Fast MultiScalar Multiplication Methods on Elliptic Curves with Precomputation Strategy using Montgo

1
Fast Multi-Scalar Multiplication Methods on
Elliptic Curves with Precomputation Strategy
using Montgomery Trick
Katsuyuki Okeya

• Hitachi Ltd.

Kouichi Sakurai
Kyushu Univ.
2
Abstract
The use of multi-scalar multiplication in the
verification of ECDSA
Motivation
ANSI
The transformation from scalar multiplication to
multi-scalar multiplication
GLV01
Speeding up the multi-scalar multiplication
Problem
Result
Efficient Precomputation provides speedup for
multi-scalar multiplication
3 times faster
3
Contents
Multi-Scalar Multiplication
Target of Speedup
Proposed Method
Comparison
4
What isMulti-Scalar Multiplication?
Scalar multiplication
Scalar multiplication
an integer
an elliptic point
Multi-scalar multiplication
Multi-scalar multiplication
integers
elliptic points
5
Two Computation Methodsfor Multi-Scalar
Multiplication
Compute separately two scalar multiplications
Separate Method
Comb method
Scalar multiplication
LL94
addition
Window method
Scalar multiplication
Knu81, CMO98
Compute simultaneously two scalar
multiplications
Simultaneous Method
Shamirs trick
Multi-scalar multiplication
Elg85, HHM00
Improvement
addition
Aki01, Moe01
6
Computation Process
Precomputa-tion stage
Evaluation stage
Input
Output
Preparation of a table
Actual computation
addition
Precomputation table
Table
7
Target of Speedup
Precomputation Stage
Evaluation Stage
Separate Method
Slow
Fast
CC87, MO90, LL94, CMO98,
CMO98
Simultaneous Method
Fast
Slow
Aki01, Moe01, Sol01
8
What are Obstacles to Speed upthe Precomputation
Stage?
Obstacles
Inversions are required (1 per point)
Many precomputation points
Some points are not used in evaluation stage
9
What are Obstacles to Speed upthe Precomputation
Stage?
Reason
Obstacles
Inversions are required (1 per point)
Points are computed in affine coordinates
Table should be saved points in affine
coordinates for speeding up evaluation stage
Many precomputation points
Some points are not used in evaluation stage
The operation in affine coordinates requires
inversion
10
What are Obstacles to Speed upthe Precomputation
Stage?
Reason
Obstacles
2 dimensions
Inversions are required (1 per point)
Many precomputation points
Some points are not used in evaluation stage
11
What are Obstacles to Speed upthe Precomputation
Stage?
Reason
Obstacles
Precomputation stage Points to compute 64 points
Inversions are required (1 per point)
Evaluation stage Points to use 54 points
Many precomputation points
160 bits, window width 3
Some points are not used in evaluation stage
12
Contents
Multi-Scalar Multiplication
Target of Speedup
Proposed Method
Comparison
13
Simple Improvements
has same x-coordinates
Simultaneous inversion
Negate the y-coordinate
Omit computation
14
Montgomery Trickof Simultaneous Inversions
Coh93
Cost
Input
Output
I
M multiplication
Coh93
I inversion
It speeds up the ECM of factorization
15
Use of Montgomery Trick(Scalar Multiplication)
CMO98
Montgomery trick reduces from plural inversions
to 1 inversion
Preparation of precomputation table
doubling
addition
addition
doubling
addition
addition
doubling
Use of Montgomery trick
Compute inversion using Montgomery trick
16
Use of Montgomery Trick(Multi-Scalar
Multiplication)
Montgomery trick reduces from plural inversions
to 1 inversion
Preparation of precomputation table
doubling
addition
addition
addition
addition
addition
doubling
Compute inversion using Montgomery trick
Complicated because of 2 dimensions
17
Preparation of Precomputation Table
Precomputation Table
Step 0
Step 1
Step 2
Step 3
Each step uses Montgomery trick of simultaneous
inversion
18
Some Points Do Not Needto be Computed
Precomputation Table
Step 0
Step 1
Step 2
Step 3
Consider how the points are computed!
19
Proposed Method
Precomputation Table
Step 0
Step 1
Step 2
Step 3
are first, the middles are last
20
Some Points Do Not Needto be Computed
Precomputation Table
Step 0
Step 1
Step 2
Step 3
It does not affect the computation for the other
points
21
Comparison
Precompu-tation stage
Evaluation stage
Total
160 bits
336.8M
2809.8M
3146.6M
Separate Method
CMO98
Simultaneous Method
Conventional Method
HHM00
Moe01
Proposed method
22
Conclusion
Speeding up the Multi-scalar multiplication
Problem
Points
Montgomery trick of simultaneous inversions
Simplification of precomputation procedures
Result
Efficient Precomputation provides speedup for
multi-scalar multiplication
3 times faster
Speeding up the verification of ECDSA
Application
Speeding up the scalar multiplication using
multi-scalar multiplication