Are standards compliant Elliptic Curve Cryptosystems feasible on RFID?

1
Are standards compliant Elliptic Curve
Cryptosystems feasible on RFID?

• Sandeep Kumar and Christof Paar
• Horst Görtz Institute for IT Security,
• Ruhr-Universität Bochum, Germany

2
Outline

• The Past
• The Problem
• The Solution
• The Implementation
• The Future

Previous work Design a tiny ECC
processor Algorithmic choice
CMOS ASIC design ECC in RFID
3
The Past RFID workshop 2005!
4
Elliptic Curve Cryptography (ECC)
ECC suggested in 1985 by Miller/Koblitz Elliptic
Curve Discrete Logarithm Problem (ECDLP) Define
an Additive Abelian Group (E,) over an Elliptic
Curve Set E Points on curve Operation
PQ(x1,y1)(x2,y2)R(x3,y3)
5
Elliptic Curve Cryptography (ECC)
ECC suggested in 1985 by Miller/Koblitz Elliptic
Curve Discrete Logarithm Problem (ECDLP) Define
an Additive Abelian Group (E,) over an Elliptic
Curve Set E Points on curve Operation
PQ(x1,y1)(x2,y2)R(x3,y3) ?(y2-y1)/(x2-x1) x3
?2-x2-x1 y3?(x1-x3)-y1
6
Elliptic Curve Cryptography (ECC)

• Define group over an Elliptic Curve
• Finite Field Types
• Binary Fields
• Prime Fields
• Extension Fields (OEF)

Finite Fields
Prime fields
Extension fields
GF(pm)
GF(p)
char gt 2
char 2
OEF
binary
GF(2n)
GF((2n-c)m)
7
ECC System Design

• Protocol
• Point Mult (k.P)
• Group Operation
• Point Add/Double
• Field Operations
• Addition/Subtraction
• Multiplication
• Reduction
• Inverse

ab, a-b, ab, 1/b
8
ECC System Design

• Protocol
• Point Mult (k.P)
• Group Operation
• Point Add/Double
• Field Operations
• Addition/Subtraction
• Multiplication
• Reduction
• Inverse

x3... y3...
ab, a-b, ab, 1/b
9
ECC System Design

• Protocol
• Point Mult (k.P)
• Group Operation
• Point Add/Double
• Field Operations
• Addition/Subtraction
• Multiplication
• Reduction
• Inverse

kP
x3... y3...
ab, a-b, ab, 1/b
10
Scalar Point Multiplication
k . P (Point Mult.) P P .. P T Given P,
T. Find k? Elliptic Curve Discrete Logarithm
Problem (ECDLP)
Easy Hard
11
The Problem Tiny ECC design

• Reduce memory requirements
• Reduce arithemtic unit area
• Keep it simple but efficient

• memory amounts to more than 50 of design
• avoid units like invertor
• design for specific size
• reduce control logic area - multiplexers

12
The Problem ! The Solution
arithemtic unit
memory
simple but efficient
13
The Solution Tiny ECC design

• Reduce memory requirements
• Reduce arithemtic unit area
• Keep it simple but efficient

• Affine co-ordinates, Montgomery scalar
  multiplication
• An efficient invertor unit using an efficient
  squarer
• Modify Montgomery scalar multiplication algo.

14
Tiny ECC processor

• Arithmetic Units
• Multiplier
• Squarer
• Invertor
• Point Multiplier
• Control Unit
• Memory Unit

• Most-Significant Bit Mult.

15
The Implementation Multiplier
Most-Significant Bit (MSB) Multiplier n-clocks
for n-bit multiplier
16
Tiny ECC processor

• Arithmetic Units
• Multiplier
• Squarer
• Invertor
• Point Multiplier
• Control Unit
• Memory Unit

• Most-Significant Bit Mult.
• Fermats Little Theorem

17
The Implementation Invertor
Fermats Little Theorem A-1 A2m-2 mod F(x) if
A in GF(2m) For m163 161 Mult. 162
Sqr. Itoh-Tsuji Method For m163 9 Mult.
162 Sqr.
A2m-2A(2(m-1)-1).2 A111..12.2
18
Tiny ECC processor

• Arithmetic Units
• Multiplier
• Squarer
• Invertor
• Point Multiplier
• Control Unit
• Memory Unit

• Most-Significant Bit Mult.
• Parallel Squaring
• Fermats Little Theorem

19
The Implementation Squarer
Single Cycle Squaring Low critical path
20
Tiny ECC processor

• Arithmetic Units
• Multiplier
• Squarer
• Invertor
• Point Multiplier
• Control Unit
• Memory Unit

• Most-Significant Bit Mult.
• Parallel Squaring
• Fermats Little Theorem
• Modified Montgomery Algo

21
Modified Montgomery Algorithm
22
The Implementation

• ECC processor implementation for
  2113,2131,2163,2193

23
Tiny ECC processor Results
Performance _at_ 13.56 MHz
Field Size Arithmetic Unit(gates) Memory (gates) Total (gates) Time (ms)
113 1,625 6,686 10,112 14
131 2,071 7,747 11,969 18
163 2,572 9,632 15,094 32
193 2,776 11,400 17,723 41
22 smaller than previous results
24
The Future

• Are standards compliant Elliptic Curve
  Cryptosystems feasible on RFID?
• Yes and No!
• Depends on application, RFID device, power...
• Future?
• The next 60 mins!

25
Thank You!