Skip to main content
SpringerLink
Log in

Faster Scalar Multiplication on the x-Line: Three-Dimensional GLV Method with Three-Dimensional Differential Addition Chains

  • Conference paper
  • First Online:
Codes, Cryptology and Information Security (C2SI 2019)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 11445))

  • 689 Accesses

Abstract

On the quadratic twist of a GLV curve, we explore faster scalar multiplication on its x-coordinate system utilizing three-dimensional GLV method. We construct and implement two kinds of three-dimensional differential addition chains, one of which is uniform and the other is non-uniform but runs faster. Implementations show that at about 254-bit security level, the triple scalar multiplication using our second differential addition chains runs about \(26\%\) faster than the straightforward computing using Montgomery ladder, and about \(6\%\) faster that the double scalar multiplication using DJB chains.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    In the two-dimensional GLV, we always utilize the endomorphism \(\varPsi \) in the testing.

  2. 2.

    As the analogous symbol used in Sect. 4.1, S(a, b, c, d) is the set \((a,b,c,d)+\{0,1\}^4\).

References

  1. Akishita, T.: Fast simultaneous scalar multiplication on elliptic curve with montgomery form. In: Vaudenay, S., Youssef, A.M. (eds.) SAC 2001. LNCS, vol. 2259, pp. 255–267. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-45537-X_20

    Chapter  Google Scholar 

  2. Azarderakhsh, R., Karabina, K.: A new double point multiplication algorithm and its application to binary elliptic curves with endomorphisms. IEEE Trans. Comput. 63(10), 2614–2619 (2014)

    Article  MathSciNet  Google Scholar 

  3. Bernstein, D.J.: Differential addition chains. Technical Report (2006). http://cr.yp.to/ecdh/diffchain-20060219.pdf

  4. Brown, D.R.: Multi-dimensional montgomery ladders for elliptic curves. Cryptology ePrint Archive, Report 2006/220 (2006). https://eprint.iacr.org/2006/220

  5. Cohen, H., et al.: Handbook of Elliptic and Hyperelliptic Curve Cryptography. CRC Press (2005)

    Google Scholar 

  6. Costello, C., Hisil, H., Smith, B.: Faster compact diffie–hellman: endomorphisms on the x-line. In: Nguyen, P.Q., Oswald, E. (eds.) EUROCRYPT 2014. LNCS, vol. 8441, pp. 183–200. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-642-55220-5_11

    Chapter  Google Scholar 

  7. Costello, C., Longa, P.: Four\(\mathbb{Q}\): four-dimensional decompositions on a \(\mathbb{Q}\)-curve over the mersenne prime. In: Iwata, T., Cheon, J.H. (eds.) ASIACRYPT 2015. LNCS, vol. 9452, pp. 214–235. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-48797-6_10

    Chapter  Google Scholar 

  8. Galbraith, S.D., Lin, X., Scott, M.: Endomorphisms for faster elliptic curve cryptography on a large class of curves. In: Joux, A. (ed.) EUROCRYPT 2009. LNCS, vol. 5479, pp. 518–535. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-01001-9_30

    Chapter  Google Scholar 

  9. Gallant, R.P., Lambert, R.J., Vanstone, S.A.: Faster point multiplication on elliptic curves with efficient endomorphisms. In: Kilian, J. (ed.) CRYPTO 2001. LNCS, vol. 2139, pp. 190–200. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-44647-8_11

    Chapter  Google Scholar 

  10. Zhi, H., Longa, P., Maozhi, X.: Implementing the 4-dimensional GLV method on GLS elliptic curves with \(j\)-invariant 0. Des. Codes Crypt. 63(3), 331–343 (2012)

    Article  MathSciNet  Google Scholar 

  11. Hutchinson, A., Karabina, K.: Constructing multidimensional differential addition chains and their applications. J. Cryptographic Eng. 1–19 (2017)

    Google Scholar 

  12. Longa, P., Sica, F.: Four-dimensional gallant-lambert-vanstone scalar multiplication. In: Wang, X., Sako, K. (eds.) ASIACRYPT 2012. LNCS, vol. 7658, pp. 718–739. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-34961-4_43

    Chapter  Google Scholar 

  13. Montgomery, P.L.: Evaluating recurrences of form \({X}_{m+n} = f({X}_m, {X}_n, {X}_{m-n})\) via lucas chains (1983). ftp.cwi.nl:/pub/pmontgom/lucas.ps.gz

    Google Scholar 

  14. Montgomery, P.L.: Speeding the pollard and elliptic curve methods of factorization. Math. Comput. 48(177), 243–264 (1987)

    Article  MathSciNet  Google Scholar 

  15. Rao, S.R.S.: A note on Schoenmakers algorithm for multi exponentiation. In: 2015 12th International Joint Conference on e-Business and Telecommunications (ICETE), vol. 4, pp. 384–391 (2015)

    Google Scholar 

  16. Subramanya Rao, S.R.: Three dimensional montgomery ladder, differential point tripling on montgomery curves and point quintupling on weierstrass’ and edwards curves. In: Pointcheval, D., Nitaj, A., Rachidi, T. (eds.) AFRICACRYPT 2016. LNCS, vol. 9646, pp. 84–106. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-31517-1_5

    Chapter  Google Scholar 

  17. Stam, M.: Speeding up subgroup cryptosystems. Technische Universiteit Eindhoven (2003)

    Google Scholar 

  18. Yi, H., Zhu, Y., Lin, D.: Refinement of the four-dimensional GLV method on elliptic curves. In: Adams, C., Camenisch, J. (eds.) SAC 2017. LNCS, vol. 10719, pp. 23–42. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-72565-9_2

    Chapter  Google Scholar 

Download references

Acknowledgement

We would like to thank Yuqing Zhu for his kind advice and selfless help on the first version of this work. And we would like to thank the anonymous reviewers for their detailed comments and suggestions. This work is supported by National Natural Science Foundation of China (Grant No. 61872359).

Author information

Authors and Affiliations

  1. State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100093, China

    Hairong Yi, Guiwen Luo & Dongdai Lin

  2. School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China

    Hairong Yi & Guiwen Luo

Authors
  1. Hairong Yi
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Guiwen Luo
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Dongdai Lin
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Hairong Yi .

Editor information

Editors and Affiliations

  1. Université Paris 8, Saint-Denis, France

    Claude Carlet

  2. Institut MINES-TELECOM, Paris, France

    Sylvain Guilley

  3. Université de Caen, Caen, France

    Abderrahmane Nitaj

  4. Mohammed V University, Rabat, Morocco

    El Mamoun Souidi

A Four-dimensional Case

A Four-dimensional Case

If we consider further the straightforward 4-dimensional extension of DJB chains, we found that in each iteration we should compute \(2+(2^4-2)/2=9\) elements, containing 1 double and 8 additions, which is rather expensive and hence has no practical usage. For completeness, in this part we give its definition and a simple example. Its complex proof of correctness has been done by authors and one can also check it by computers.

For brief of notation we let \(e_1=(1,0,0,0),e_2=(0,1,0,0),e_3=(0,0,1,0),e_4=(0,0,0,1),e_5=(1,1,0,0),e_6=(1,0,1,0),e_7=(1,0,0,1)\). Denote by \(n^4\) the 4-tuple (n, n, n, n). Then the 7 elements omitted from S(a, b, c, d)Footnote 2 can be described as \(T_i=(a,b,c,d)+(U_i\mathrm {~mod~}2)\) where \(U_i=(a,b,c,d)+f_i^4+e_i\) and \(f_i\in \{0,1\}\) for \(i=1,\cdots ,7\).

Definition 2

For a given 4-tuple of nonnegative integers (A, B, C, D) and the set \(\{F_1,\cdots ,F_7\}\) where \(F_i\in \{0,1\},i=1,\cdots ,7\), the chain \(C(\{F_i\}_{i=1}^7;A,B,\) C, D) is defined recursively, as the set \(C(\{f_i\}_{i=1}^7;a,b,c,d)\) added with the following nine elements:

$$\begin{array}{llllll} M_{-1}&{}=(A,B,C,D)+((A+1,&{}B+1,&{}C+1,&{}D+1)\mathrm {~mod~}2),\\ M_0&{}=(A,B,C,D)+((A,&{}B,&{}C,&{}D)\mathrm {~mod~}2), \end{array}$$

and for \(i=1,\cdots ,7\),

$$M_i=(A,B,C,D)+ (N_i \mathrm {~mod~}2)\quad \text { where } N_i=(A,B,C,D)+(F_i+1)^4+e_i.$$

Here \((a,b,c,d)=(\lfloor A/2\rfloor ,\lfloor B/2\rfloor ,\lfloor C/2\rfloor ,\lfloor D/2\rfloor )\) and \((f_1,\cdots ,f_7)\) is taken as

$$\begin{array}{cccc} (f_1,\cdots ,f_7) &{} \begin{array}{cc} &{}if (a+A,b+B,\\ {} &{}c+C,d+D)\mathrm {~mod~}2\end{array} &{} (f_1,\cdots ,f_7) &{} \begin{array}{cc} &{}if (a+A,b+B,\\ {} &{}c+C,d+D)\mathrm {~mod~}2\end{array} \\ (1,0,0,0,1,1,1) &{} (1,0,0,0) &{} (0,1,1,1,0,0,0) &{} (0,1,1,1)\\ (0,1,0,0,1,0,0) &{} (0,1,0,0) &{} (1,0,1,1,0,1,1) &{} (1,0,1,1)\\ (0,0,1,0,0,1,0) &{} (0,0,1,0) &{} (1,1,0,1,1,0,1) &{} (1,1,0,1)\\ (0,0,0,1,0,0,1) &{} (0,0,0,1) &{} (1,1,1,0,1,1,0) &{} (1,1,1,0)\\ (1,1,0,0,1,0,0) &{} (1,1,0,0) &{} (0,0,1,1,0,0,0) &{} (0,0,1,1)\\ (1,0,1,0,0,1,0) &{} (1,0,1,0) &{} (0,1,0,1,0,0,0) &{} (0,1,0,1)\\ (1,0,0,1,0,0,1) &{} (1,0,0,1) &{} (0,1,1,0,0,0,0) &{} (0,1,1,0)\\ \begin{array}{cc}&{}(F_1,F_2,F_3,F_4,\\ {} &{}F_5,F_6,F_7)\end{array} &{} (0,0,0,0) &{} \begin{array}{cc}&{}(1-F_1,1-F_2,1-F_3,\\ {} &{}1-F_4,1-F_5,1-F_6,\\ {} &{}1-F_7)\end{array}&(1,1,1,1). \end{array}$$

Specially, for arbitrary \(F_1,\cdots ,F_7\), let \(C(\{F_i\};0,0,0,0)\) be the union of the sets

$$\begin{array}{ll} S_1=&{}\{(0,0,0,0), (1,0,0,0), (0,1,0,0), (0,0,1,0),(0,0,0,1),\\ &{}(1,-1,0,0),(1,0,-1,0),(1,0,0,-1),(0,1,-1,0),(0,1,0,-1),(0,0,1,-1), \\ &{}(1,1,-1,0),(1,1,0,-1),(1,0,1,-1),(0,1,1,-1),\\ &{}(1,1,1,-1)\} \\ S_2=&{}\{(1,1,0,0),(1,0,1,0),(1,0,0,1),(0,1,1,0),(0,1,0,1),(0,0,1,1),\\ &{}(1,1,1,0),(1,1,0,1),(1,0,1,1),(0,1,1,1),\\ &{}(1,-1,1,0),(1,-1,0,1),(1,0,-1,1),(0,1,-1,1),\\ &{}(-1,1,1,0),(-1,1,0,1),(-1,0,1,1),(0,-1,1,1),\\ &{}(1,1,-1,1),(1,-1,1,1),(-1,1,1,1),\\ &{}(1,1,-1,-1),(1,-1,1,-1),(1,-1,-1,1) \}\\ \end{array}$$

where \(S_2\) can be computed from \(S_1\).

We find that as the dimension of the chain increases, the pre-computation part becomes a heavy burden, and it grows exponentially w.r.t. the dimension. In some situation, this maybe a main disadvantage of computing scalar multiplication using higher dimensional DACs.

Example 3

Given a simple 4-tuple (10, 9, 8, 7). The uniform 4-dimensional DAC of (10, 9, 8, 7) is: \(S_1\cup S_2 \cup S_3\) where \(S_3=\)

$$\begin{aligned} \begin{aligned}&\{(1,1,1,1),(2,2,2,0),(2,1,1,1),(2,1,2,0),(2,2,1,0),(2,2,2,1),(2,2,1,1),(2,1,2,1),(2,1,1,0),\\&(3,3,3,1),(2,2,2,2),(3,2,2,2),(3,2,3,1),(3,3,2,1),(3,3,3,2),(3,3,2,2),(3,2,3,2),(3,2,2,1),\\&(5,5,5,3),(6,4,4,4),(5,4,4,4),(6,5,4,4),(5,5,4,3),(5,5,5,4),(5,5,4,4),(5,4,5,4),(5,4,4,3),\\&(11,9,9,7),(10,10,8,8),(10,9,9,7),(11,10,9,7),(11,9,8,7),(11,9,9,8),(10,10,9,7),(10,9,8,7),\\&(10.9.9.8)\} \end{aligned} \end{aligned}$$

Rights and permissions

Reprints and permissions

Copyright information

© 2019 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Yi, H., Luo, G., Lin, D. (2019). Faster Scalar Multiplication on the x-Line: Three-Dimensional GLV Method with Three-Dimensional Differential Addition Chains. In: Carlet, C., Guilley, S., Nitaj, A., Souidi, E. (eds) Codes, Cryptology and Information Security. C2SI 2019. Lecture Notes in Computer Science(), vol 11445. Springer, Cham. https://doi.org/10.1007/978-3-030-16458-4_14

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-16458-4_14

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-16457-7

  • Online ISBN: 978-3-030-16458-4

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation