Citation Context

...meet the new security condition. Half of these curves are within the streamlined case expressed by Theorem 1. Given the amount of performance optimization of Curve25519 (see [4], [26], [14], [6], and =-=[8]-=-) and the wide deployment of Curve25519 in several applications (see, e.g., [2]) we were hoping that this condition would be met by Curve25519. However, our approach to encoding is clearly limited to ...

Citation Context

...27: else if s1 = s3 then 28: T1[12] ← ψ 1 (T1[6]) 29: if s1 = s2 then 30: T1[12] ← −T1[12] 31: else 32: T1[12] ← D2 + D3 33: T1[13] ← T1[12] + T1[1] 34: if s0 = s1 = s2 = s3 then 35: T1[14] ← ψ 1 (T1=-=[7]-=-) 36: else 37: T1[14] ← T1[12] + T1[2] 38: T1[15] ← T1[14] + T1[1] 39: T2[0] ← O 40: T2[1] ← D4 41: T2[2] ← D5 42: if s0 · s1 = s4 · s5 then 43: T2[3] ← ψ 4 (T1[3]) 44: if s0 = s4 then 45: T2[3] ← −T...

Citation Context

...vious NaCl optimization focused on large general-purpose server and desktop CPUs; the “smallest” architecture targeted by previous NaCl optimization is ARMv7 CPUs with the NEON vector-instruction set =-=[10]-=-. Despite this focus on large processors, the NaCl designers claim in [4, Section 4] that “allofthe cryptographicprimitives in NaCl canfit ontomuch smaller CPUs: there are no requirements for large ta...

Citation Context

... just a few, have adopted the ARM Cortex family of processors for powering their tablets, smartphones and other mobile devices. A majority of those devices support the vector set of instructions NEON =-=[6]-=-. In spite of their ever increasing popularity, it is only until recently that some research works have studied the implementation of cryptographic primitives over ARM processor platforms. Among the r...

Citation Context

... algorithms since à ± ˜ B ≡ (A · rn ) ± (B · rn ) ≡ (A ± B) · rn (mod M). 2.3 Related Work There has been a considerable amount of work related to SIMD implementations of cryptography. The authors of =-=[6, 12, 35]-=- propose ways to speed up cryptography using the NEONvector instructions. Intel’s SSE2 vector instruction set extension is used to compute pairings in [15] and multiply big numbers in [21]. Simultane...

Citation Context

...ave eliminated historical cryptographic performance bottlenecks. Now, strong symmetric encryption can be performed on a single CPU core at Gb/s rates [40], even on resource-constrained mobile devices =-=[8]-=-. Public-key cryptography, once so agonizingly slow that systems would try to simulate it with symmetric key cryptography [36], is now performed at tens of thousands of operations per second on commod...

Citation Context

...ms effective in increasing attack cost rather than preventing an attack. 5 NEON NEON is a general-purpose SIMD extension to Cortex A-series ARM cores, harnessed, for example, by Bernstein and Schwabe =-=[8]-=- to both accelerate cryptographic workloads and deliver constant execution time. In terms of the ISA, each vector instructionsw processes vector operands with l = nw elements (or sub-words), each w-bi...

Citation Context

...meet the new security condition. Half of these curves are within the streamlined case expressed by Theorem 1. Given the amount of performance optimization of Curve25519 (see [4], [26], [14], [6], and =-=[8]-=-) and the wide deployment of Curve25519 in several applications (see, e.g., [2]) we were hoping that this condition would be met by Curve25519. However, our approach to encoding is clearly limited to ...

Citation Context

....0 of FourQlib [13]. Our benchmark results extend FourQ’s top performance to 32-bit ARM processors with NEON, and demonstrate for the first time FourQ’s vectorization potential. For example, on a 2.0GHz Odroid XU3 board powered by a Cortex-A15 CPU, our software computes a variablebase scalar multiplication in only 132,000 cycles (or 66 microseconds for a throughput above 15,150 operations/second). This result is about 1.7x faster than the Kummer implementation from [7], about 1.8x faster than the GLV+GLS based implementation from [15], about 2.4x faster than the Curve25519 implementation from [9], and about 5.6x faster than the implementation of the standardized NIST curve K-283 from [10]. As in our case, all of these implementations are state-of-the-art, exploit NEON instructions and are protected against timing and cache attacks. See Section 5 for complete benchmark results. The paper is organized as follows. In Section 2, we provide relevant details about FourQ. In Section 3, we describe the 32-bit ARM architecture using NEON with focus on the targeted Cortex-A processors. We describe our vectorized NEON design and optimizations in Section 4 and, finally, Section 5 concludes the pa...