Parallel Implementation of SM2 Elliptic Curve Cryptography on Intel Processors with AVX2

Abstract

This paper presents an efficient and secure implementation of SM2, the Chinese elliptic curve cryptography standard that has been adopted by the International Organization of Standardization (ISO) as ISO/IEC 14888-3:2018. Our SM2 implementation uses Intel’s Advanced Vector Extensions version 2.0 (AVX2), a family of three-operand SIMD instructions operating on vectors of 8, 16, 32, or 64-bit data elements in 256-bit registers, and is resistant against timing attacks. To exploit the parallel processing capabilities of AVX2, we studied the execution flows of Co-Z Jacobian point arithmetic operations and introduce a parallel 2-way Co-Z addition, Co-Z conjugate addition, and Co-Z ladder algorithm, which allow for fast Co-Z scalar multiplication. Furthermore, we developed an efficient 2-way prime-field arithmetic library using AVX2 to support our Co-Z Jacobian point operations. Both the field and the point operations utilize branch-free (i.e. constant-time) implementation techniques, which increase their ability to resist Simple Power Analysis (SPA) and timing attacks. Our software for scalar multiplication on the SM2 curve is, to our knowledge, the first constant-time implementation of the Co-Z based ladder that leverages the parallelism of AVX2.

A SimpleRed Operation

Based on the congruence relations in Eq. (5), we add or subtract each of the upper limbs $z_i$ with $i \in [10, 20)$ to the corresponding lower limbs in Z to obtain the residue $\langle E, F \rangle _i$ from the intermediate result Z. For example, all the terms with weight $2^0 \sim 2^{26}$ and $2^{26} \sim 2^{52}$ will be added to or subtracted from $Z_0$ to obtain $\langle E, F \rangle _0$. Similarly to $Z_0$, the terms with other weights will be added to or subtracted from the corresponding terms of the intermediate result Z. The details are fully specified in Algorithm 8, which executes only simple additions (resp. subtractions), shifts, and permutation instructions.