Abstract
The GLV/GLS technique speeds up scalar multiplications on elliptic curves endowed with an efficiently computable endomorphism: a scalar multiplication by a full-size scalar becomes a double scalar multiplication by half-size scalars, which is significantly faster. However, this requires to first decompose the original scalar into an appropriate linear combination of half-size scalars using reduction in a low-dimensional lattice. Since a reduced basis of the lattice can be precomputed, this is typically fast, but it tends to leak a lot of side-channel information about the scalar.
To avoid this issue, Aranha et al. (ASIACRYPT 2014) proposed to use “recomposition” instead, i.e. choose the two half-sized scalars at random in a suitable interval, defining a corresponding full-size scalar implicitly. If the statistical distance to uniform of the distribution of that scalar is negligible, the recomposition method is secure and avoids any of the leakage of GLV/GLS decomposition. The original paper obtained the statistical distance result for GLS curves of prime order. In this work, we extend their proof to GLS curves having a cofactor which can be written as a sum of two squares. This shows in particular how to obtain secure recomposition for (twisted) Edwards GLS curves and the fast binary curve GLS254 of Oliveira et al. (CHES 2013), as these curves have cofactor 4 and 2 respectively.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
For this to be well-defined, we of course need a family of random variables on increasingly large sets S. Usual abuses of language apply.
References
Aranha, D.F., Fouque, P.-A., Gérard, B., Kammerer, J.-G., Tibouchi, M., Zapalowicz, J.-C.: GLV/GLS decomposition, power analysis, and attacks on ECDSA signatures with single-bit nonce bias. In: Sarkar, P., Iwata, T. (eds.) ASIACRYPT 2014. LNCS, vol. 8873, pp. 262–281. Springer, Heidelberg (2014). doi:10.1007/978-3-662-45611-8_14
Berndt, B.C.: Number Theory in the Sprit of Ramanujan. American Mathematical Society (2006)
Bernstein, D.J., Birkner, P., Joye, M., Lange, T., Peters, C.: Twisted Edwards curves. In: Vaudenay, S. (ed.) AFRICACRYPT 2008. LNCS, vol. 5023, pp. 389–405. Springer, Heidelberg (2008). doi:10.1007/978-3-540-68164-9_26
Bernstein, D.J., Lange, T.: eBACS: ECRYPT benchmarking of cryptographic systems. https://bench.cr.yp.to. Accessed 24 Mar 2017
Bos, J.W., Costello, C., Hisil, H., Lauter, K.: High-performance scalar multiplication using 8-dimensional GLV/GLS decomposition. In: Bertoni, G., Coron, J.-S. (eds.) CHES 2013. LNCS, vol. 8086, pp. 331–348. Springer, Heidelberg (2013). doi:10.1007/978-3-642-40349-1_19
Brumley, B.B., Nyberg, K.: On modular decomposition of integers. In: Preneel, B. (ed.) AFRICACRYPT 2009. LNCS, vol. 5580, pp. 386–402. Springer, Heidelberg (2009). doi:10.1007/978-3-642-02384-2_24
Costello, C., Hisil, H., Smith, B.: Faster compact Diffie–Hellman: endomorphisms on the x-line. In: Nguyen, P.Q., Oswald, E. (eds.) EUROCRYPT 2014. LNCS, vol. 8441, pp. 183–200. Springer, Heidelberg (2014). doi:10.1007/978-3-642-55220-5_11
Costello, C., Longa, P.: Four\(\mathbb{Q}\): four-dimensional decompositions on a \(\mathbb{Q}\)-curve over the Mersenne prime. In: Iwata, T., Cheon, J.H. (eds.) ASIACRYPT 2015. LNCS, vol. 9452, pp. 214–235. Springer, Heidelberg (2015). doi:10.1007/978-3-662-48797-6_10
Galbraith, S.D., Lin, X., Scott, M.: Endomorphisms for faster elliptic curve cryptography on a large class of curves. J. Cryptol. 24(3), 446–469 (2011)
Gallant, R.: Efficient multiplication on curves having an endomorphism of norm 1. Workshop on Elliptic Curve Cryptography (1999)
Gallant, R.P., Lambert, R.J., Vanstone, S.A.: Faster point multiplication on elliptic curves with efficient endomorphisms. In: Kilian, J. (ed.) CRYPTO 2001. LNCS, vol. 2139, pp. 190–200. Springer, Heidelberg (2001). doi:10.1007/3-540-44647-8_11
Hankerson, D., Karabina, K., Menezes, A.: Analyzing the Galbraith-Lin-Scott point multiplication method for elliptic curves over binary fields. Cryptology ePrint Archive, Report 2008/334 (2008). http://eprint.iacr.org/2008/334
Oliveira, T., López, J., Aranha, D.F., Rodríguez-Henríquez, F.: Two is the fastest prime: lambda coordinates for binary elliptic curves. J. Cryptogr. Eng. 4(1), 3–17 (2014)
Park, Y.-H., Jeong, S., Kim, C.H., Lim, J.: An alternate decomposition of an integer for faster point multiplication on certain elliptic curves. In: Naccache, D., Paillier, P. (eds.) PKC 2002. LNCS, vol. 2274, pp. 323–334. Springer, Heidelberg (2002). doi:10.1007/3-540-45664-3_23
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2017 Springer International Publishing AG
About this paper
Cite this paper
Kim, E., Tibouchi, M. (2017). Secure GLS Recomposition for Sum-of-Square Cofactors. In: Pieprzyk, J., Suriadi, S. (eds) Information Security and Privacy. ACISP 2017. Lecture Notes in Computer Science(), vol 10343. Springer, Cham. https://doi.org/10.1007/978-3-319-59870-3_20
Download citation
DOI: https://doi.org/10.1007/978-3-319-59870-3_20
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-59869-7
Online ISBN: 978-3-319-59870-3
eBook Packages: Computer ScienceComputer Science (R0)