## Efficient arithmetic on Koblitz curves (2000)

### Cached

### Download Links

- [islab.postech.ac.kr]
- [computacion.cs.cinvestav.mx]
- DBLP

### Other Repositories/Bibliography

Venue: | Designs, Codes, and Cryptography |

Citations: | 85 - 0 self |

### BibTeX

@ARTICLE{Solinas00efficientarithmetic,

author = {Jerome A. Solinas},

title = {Efficient arithmetic on Koblitz curves},

journal = {Designs, Codes, and Cryptography},

year = {2000},

pages = {195--249}

}

### Years of Citing Articles

### OpenURL

### Abstract

Abstract. It has become increasingly common to implement discrete-logarithm based public-key protocols on elliptic curves over finite fields. The basic operation is scalar multiplication: taking a given integer multiple of a given point on the curve. The cost of the protocols depends on that of the elliptic scalar multiplication operation. Koblitz introduced a family of curves which admit especially fast elliptic scalar multiplication. His algorithm was later modified by Meier and Staffelbach. We give an improved version of the algorithm which runs 50 % faster than any previous version. It is based on a new kind of representation of an integer, analogous to certain kinds of binary expansions. We also outline further speedups using precomputation and storage.

### Citations

2717 | Handbook of Applied Cryptography
- Menezes, Oorschot, et al.
- 1997
(Show Context)
Citation Context ...rformed. The group should be chosen so that it is computationally difficult to compute discrete logarithms of its elements. Thus, for example, the order #Ea(F2m ) should be divisible by a large prime =-=[17]-=-. Ideally, #Ea(F2m ) should be a prime or the product of a prime and small integer. This can only happen when m is itself prime, for otherwise there are large divisors arising from subgroups Ea(F2d ) ... |

898 |
The Arithmetic of Elliptic Curves
- Silverman
- 1982
(Show Context)
Citation Context ... first, thus requiring more storage space and memory calls. The cost of the addition-subtraction method depends on the bit length ℓ of NAF(n), which we now estimate. It follows from the Hasse theorem =-=[22]-=- that the order of an elliptic curve over F2m is #E(F2 m ) = 2m + O(2 m/2 ). Most public-key protocols on elliptic curves use a base point of prime order r. Since all of the curves (1) have even order... |

317 |
Reducing elliptic curves logarithms to logarithms in a finite field
- Menezes, Okamoto, et al.
- 1993
(Show Context)
Citation Context ...Reiter for many helpful comments and suggestions. Notes 1. We restrict our attention to elliptic curves that are not supersingular, since such curves are cryptographically weaker than ordinary curves =-=[16]-=-. But see [12] for cryptographic applications of supersingular curves. 2. This does not cause confusion, because the origin is never on E. 3. There do exist special-purpose improvements to the basic e... |

262 |
Fundamental Algorithms
- Knuth
- 1975
(Show Context)
Citation Context ...o as to optimize the efficiency of elliptic scalar multiplication. Thus, for example, one might choose the field of integers modulo a Mersenne prime, since modular reduction is particularly efficient =-=[9]-=- in that case. This option is not available for, say, RSA systems, since the secret primes are chosen randomly in order to maintain the security of the system. 2. One can use the fact that subtraction... |

214 |
A Course in Number Theory and Cryptography
- Koblitz
- 1988
(Show Context)
Citation Context ...= 2k−1 for k ≥ 1. (20) 135206 SOLINAS • The group orders #Ea(F2m ) are easily computed via #Ea(F2 m ) = 2m + 1 − Vm. (21) This identity follows from the basic properties of zeta functions of curves; =-=[11]-=-. The Norm. The norm of an element α ∈ Z[τ] is the product of α and its complex conjugate α. Explicitly, the norm of δ := d0 + d1 τ is N(δ) = d 2 0 + µ d0 d1 + 2 d 2 1 . We will require the following ... |

170 | A Survey of Fast Exponentiation Methods
- Gordon
- 1988
(Show Context)
Citation Context ...plication operation. Scalar multiplication on an elliptic curve is analogous to exponentiation in the multiplicative group of integers modulo a fixed integer m. Various techniques have been developed =-=[4]-=- to speed modular exponentiation using memory and precomputations. Such methods, for the most part, carry over to elliptic scalar multiplication. There are also efficiency improvements available in th... |

157 | Parallel collision search with cryptanalytic applications
- Oorschot, Wiener
- 1999
(Show Context)
Citation Context ...tudied [12], and representations analogous to the τ-adic NAF (but with even fewer nonzero terms) have been obtained. It has been observed [3], [24] that the best square-root attack on elliptic curves =-=[20]-=- can be modified in the case of Koblitz curves. Rather than working with the points on the curve, one instead works with the cycles under the Frobenius operation. The resulting algorithm requires fewe... |

133 |
CM-curves with good cryptographic properties
- Koblitz
- 1992
(Show Context)
Citation Context ...lex algebraic integers (as opposed to ordinary integers). These operations can be carried out efficiently for certain families of elliptic curves. In these cases, they can be utilized in various ways =-=[10]-=- to increase the efficiency of elliptic scalar multiplication. It is the purpose of this paper to present a new technique for elliptic scalar multiplication. This new algorithm incorporates elements f... |

119 | The elliptic curve digital signature algorithm (ECDSA
- Johnson, Menezes
- 1999
(Show Context)
Citation Context ...the end of §4.3 prove that there is no asymptotic value for F(α) as N(α) gets large.) 171242 SOLINAS • It is often required (e.g. in many cryptographic algorithms such as the ECDSA digital signature =-=[8]-=-) to take a random multiple of a point on an elliptic curve. More precisely, let P be in the main subgroup of a Koblitz curve of very nearly prime order. To take a random multiple of P, one generates ... |

103 | Speeding up the computations on an elliptic curve using addition-subtraction chains. Informatique théorique et
- Morain, Olivos
- 1990
(Show Context)
Citation Context ... expansion of the exponent. The analogous procedure for elliptic scalar multiplication uses a sequence of doublings and additions of points. If we allow subtractions of points as well, we can replace =-=[15]-=- the binary expansion of the coefficient n by a more efficient signed binary expansion (i.e. an expansion in powers of two with coefficients 0 and ±1). 3. One can use complex multiplication. Every ell... |

101 |
A fast algorithm for computing multiplicative inverses
- Itoh, Tsujii
- 1988
(Show Context)
Citation Context ...tiplications it uses. Inversion. Multiplicative inversion in F2 m 126 L(m − 1) + W (m − 1) − 2 can be performed inEFFICIENT ARITHMETIC ON KOBLITZ CURVES 197 field multiplications using the method of =-=[7]-=-. Here L(k) represents the length of the binary expansion of k, and W (k) the number of ones in the expansion. This fact may be a consideration when choosing the degree m. (Alternatively, one can use ... |

69 | Improving the parallelized pollard lambda search on anomalous binary curves
- Gallant, Lambert, et al.
- 2000
(Show Context)
Citation Context ...itz curves over fields of small odd characteristic have been studied [12], and representations analogous to the τ-adic NAF (but with even fewer nonzero terms) have been obtained. It has been observed =-=[3]-=-, [24] that the best square-root attack on elliptic curves [20] can be modified in the case of Koblitz curves. Rather than working with the points on the curve, one instead works with the cycles under... |

63 | Faster attacks on elliptic curve cryptosystems
- Wiener, Zuccherato
- 1998
(Show Context)
Citation Context ...urves over fields of small odd characteristic have been studied [12], and representations analogous to the τ-adic NAF (but with even fewer nonzero terms) have been obtained. It has been observed [3], =-=[24]-=- that the best square-root attack on elliptic curves [20] can be modified in the case of Koblitz curves. Rather than working with the points on the curve, one instead works with the cycles under the F... |

48 |
Fast multiplication on elliptic curves over GF (2 ) without precomputation
- López, Dahab
- 1999
(Show Context)
Citation Context ...graphic applications of supersingular curves. 2. This does not cause confusion, because the origin is never on E. 3. There do exist special-purpose improvements to the basic elliptic operations, e.g. =-=[14]-=-, but they are not relevant to this paper. 4. It is easy to prove there is no left-to-right method for computing the NAF. On the other hand, there exist signed binary expansions that are as good as th... |

39 |
An elliptic curve implementation of the finite field digital signature algorithm
- Koblitz
- 1998
(Show Context)
Citation Context ...√ −15)/2 are defined over F22. (The results of this paper should also carry over to this more general situation.) Analogues of Koblitz curves over fields of small odd characteristic have been studied =-=[12]-=-, and representations analogous to the τ-adic NAF (but with even fewer nonzero terms) have been obtained. It has been observed [3], [24] that the best square-root attack on elliptic curves [20] can be... |

35 | Fast Multiplication on Elliptic Curves over Small Fields of Characteristic Two
- Müller
- 1998
(Show Context)
Citation Context ...put Q The routine (10) is a left-to-right algorithm. The right-to-left algorithm (6) does not generalize well to the width-w case, since each point Pi would have to be doubled ℓ times. As remarked in =-=[19]-=-, this is a general difficulty with window methods: the binary expansions must be computed right to left in general, but the elliptic scalar multiplication is best done 132EFFICIENT ARITHMETIC ON KOB... |

33 |
Speeding up elliptic cryptosystems by using a signed binary window method
- Koyama, Tsuruoka
- 1993
(Show Context)
Citation Context ...sions and 68 field multiplications. One could obtain still further speedups by using more general window methods. These would be straightforward adaptations of existing methods such as those found in =-=[13]-=-. On the other hand, such methods are less automatic than the above fixed-width-window technique, so that more complicated up-front calculations are needed. (78) 8. Efficient Modular Reduction The mod... |

25 |
Low complexity normal bases
- Ash, Blake, et al.
- 1989
(Show Context)
Citation Context ...it cyclic shift of the bit string representing the element. This property will be crucial in what follows. If m is not divisible by 8, then one can use Gaussian cyclotomic periods to construct easily =-=[1]-=- an efficient normal basis for F2m . (Since our application will require m to be prime, we can always use the Gaussian method.) Our emphasis in this paper will be the case in which the field arithmeti... |

20 |
Efficient multiplication on certain non-supersingular elliptic curves
- Meier, Staffelbach
- 1993
(Show Context)
Citation Context ...s, if P = (x, y) is a point on E1, then 9P = (x 32 , y 32 ) − (x 8 , y 8 ) + (x, y). The above example gives 9 as what we call a τ-adic NAF, since no two consecutive terms are nonzero. (Both [10] and =-=[18]-=- use signed τ-adic expansions, but neither kind has the nonadjacency property.) As we shall see, the use of τ-adic NAF’s gives a significant reduction in the number of terms, just as NAF’s give a sign... |

13 |
Algebraic Coding Theory,” Aegean
- Berlekamp
- 1984
(Show Context)
Citation Context ...he length of the binary expansion of k, and W (k) the number of ones in the expansion. This fact may be a consideration when choosing the degree m. (Alternatively, one can use the Euclidean algorithm =-=[2]-=-, but one must first convert from the normal basis representation to the more familiar polynomial basis form, and then back again after the inversion.) Elliptic Addition. The standard equation for an ... |

11 | Compact representations of elliptic curve points over GF(2n). Research Contribution to
- SEROUSSI
- 1998
(Show Context)
Citation Context ... result of (12), we have the following simple conditions to determine whether a given point is in the main subgroup. If a = 1, then a point P = (x, y) is in the main subgroup if and only if Tr(x) = 1 =-=[21]-=-. If a = 0, then (x, y) is in the main subgroup if and only if Tr(x) = 0 and Tr(y) = Tr(λ x), where λ is an element with λ 2 + λ = x. (See Appendix A for proofs.) With a normal basis representation of... |