A Dual Field Elliptic Curve Cryptographic Processor Laboratory for Reliable Computing (LaRC) Electrical Engineering Department National Tsing Hua University Advisor : Prof. Cheng-Wen Wu Student : San-Yang Lin Advisor : Prof. Cheng-Wen Wu Student : San-Yang Lin

Laboratory for Reliable Computing (LaRC), OutlineOutline  Introduction  Cryptosystem  Mathematical Background  Introduction to Elliptic Curves  The Elliptic Scalar Multiplication  Elliptic Curve Crypto-Processor Design  Experimental Results  Conclusions

Laboratory for Reliable Computing (LaRC), IntroductionIntroduction  Demand of Security - E-commerce - Electronic Banking  Software vs. Hardware Implementation - The Energy/computation Inefficiencies of Software - An Open Untrustworthy environment at Software  Public Key Cryptosystem - ECC vs. RSA

Laboratory for Reliable Computing (LaRC), Cryptosystem (1/2)  Symmetric Key Cryptosystem

Laboratory for Reliable Computing (LaRC), Cryptosystem (2/2)  Asymmetric Key Cryptosystem

Laboratory for Reliable Computing (LaRC), Mathematical Background (1/2)  Galois Fields - Contain a Finite Number of Element - GF(p) Prime Field - GF(2 m ) Binary Field  Modular Arithmetic - a = b (mod) m - c = a ± b (mod) m - c = a × b (mod) m - 1 = a × a -1 (mod) m

Laboratory for Reliable Computing (LaRC), Mathematical Background (2/2)  Polynomial Basic Polynomial Addition and Substraction -(0110) + (0101) = (0011) -(0110) – (0101) = (0011) Polynomial Multiplication Irreducible Polynomial : f(x) = x 4 + x + 1 (1101)(1001) = (x 3 + x 2 + 1)(x 3 + 1) (mod f(x)) = x 6 + x 5 + 2x 3 + x (mod f(x)) = x 6 + x 5 + x (mod f(x)) = (x 4 + x + 1)(x 2 + x) + (x 3 + x 2 + x + 1)(mod f(x)) = x 3 + x 2 + x + 1 = (1111)

Laboratory for Reliable Computing (LaRC), Introduction to Elliptic Curves  Elliptic Curve Equation: y 2 = x 3 + ax + b in prime field y 2 + xy = x 3 + ax 2 + b in binary field

Laboratory for Reliable Computing (LaRC), Elliptic Curve Addition (1/2)  P + Q = R P + -P = 0

Laboratory for Reliable Computing (LaRC), Elliptic Curve Addition (1/2)  P + P = 2P = R

Laboratory for Reliable Computing (LaRC), Example of an Elliptic Curve Group over F p  Elliptic Curve Equation: y 2 = x 3 + x at F 23 The point (9,5) satisfies this equation: y 2 (mod p) = x 3 + x (mod p) 25 (mod 23) = (mod 23) 25 (mod 23) = 738 (mod 23) 2 = 2

Laboratory for Reliable Computing (LaRC), A Crypto Example for Elliptic Curve (1/2)

Laboratory for Reliable Computing (LaRC), A Crypto Example for Elliptic Curve (2/2)  Suppose B = (2,7) and Bob chooses a=7  Bob ’ s public key = 7B = (7,2)  Alice wishes to send M=(10,9) to Bob. Randomly select k = 3 then, [ kB, M + k(aB) ] = [ (8,3), (10,9) + 3(7,2) ] = [ (8,3), (10,9) + (3,5) ] = [ (8,3), (10,2) ]  Bob receives pair and multiplies a by kB  7(8,3) and subtracts from M + k(aB) to obtain: M + k(aB) – a(kB) = (10,2) – 7(8,3) = (10,2) – (3,5) = (10,2) + (3,6) = (10,9)

Laboratory for Reliable Computing (LaRC), The Elliptic Scalar Multiplication  The Scalar Multiplication Algorithm ComplexityMontgomery Form Double and Add (projective) Double and Add (affine) Add and Subtract (projective) Add and Subtract (affine) #Square5log 2 k (log 2 k – 1)1.5(log 2 k - 1)5.33(log 2 k –1)1.33(log 2 k-1) #Mult6log 2 k (log 2 k –1)3(log 2 k – 1)10(log 2 k – 1)2.33(log 2 k–1) #Inverse121.5(log 2 k – 1)21.33(log 2 k-1)

Laboratory for Reliable Computing (LaRC), Multiplication in GF(p)  Multiply-then Divide vs. Montgomery multiplier  Montgomery multiplier: MM(A,B,M) = AB2 -n mod M AB mod M = MM(AB2 -n modM,2 2n modM,M)

Laboratory for Reliable Computing (LaRC), Multiplication in GF(2 n )  Parallel vs. Serial algorithm  Serial Algorithm:

Laboratory for Reliable Computing (LaRC), Inversion in GF(2 n )  Extended Euclidean Algorithm :

Laboratory for Reliable Computing (LaRC), Elliptic Curve Crypto-Processor Design

Laboratory for Reliable Computing (LaRC), The Instruction Set of the ECC processor

Laboratory for Reliable Computing (LaRC), IO Interface

Laboratory for Reliable Computing (LaRC), ControllerController

Laboratory for Reliable Computing (LaRC), D Gated Clock Design clk_r0clk_r0 clk_r1clk_r1 clk_r2clk_r2 clk_r3clk_r3 clk_r4clk_r4 enableenable

Laboratory for Reliable Computing (LaRC), Arithmetic Unit

Laboratory for Reliable Computing (LaRC), Register File

Laboratory for Reliable Computing (LaRC), Comparator Unit

Laboratory for Reliable Computing (LaRC), Adder Unit

Laboratory for Reliable Computing (LaRC), Multi-Arithmetic Unit

Laboratory for Reliable Computing (LaRC), Simulation Flow DefineSpecificationDefineSpecification Behavior Model Establishment HDL Design FunctionSimulationFunctionSimulation SynthesisSynthesis Pre-layoutSimulationPre-layoutSimulation MatchMatch MatchMatch MismatchMismatch MismatchMismatch

Laboratory for Reliable Computing (LaRC), Experimental Results  Maximum Frequency : 384 MHz using UMC 0.18 CMOS Process Binary FieldPrime Field EC Scalar Multiplication (cycles) (m – 1 )(6m + 94) +16m (m – 1)(32m + 196) + 964

Laboratory for Reliable Computing (LaRC), Circuit Size Functional blockCircuit size (gated)Circuit size (normal) MAU core (logic) MAU core (local registers) Register File Adder Compare IO interface Controller Total

Laboratory for Reliable Computing (LaRC), Power Results  Gated Clock Design: 128bit160bit192bit224bit256bit Power143mW151mW163mW183mW205mW

Laboratory for Reliable Computing (LaRC), Compare (1/2) ReferenceFieldPlatform Maximum Frequency EC mult time Notes This workGF(2 163 )0.18um CMOS ASIC 384MHz0.46msdual field multiplier and inversion: logic size: gates Eberle(03) GF(2 163 ) Xilinx xcv2000E-7 66MHz0.30ms256*64bit Binary multiplier (estimated:460k gates) Eberle(03) GF(2 163 ) Xilinx xcv2000E-7 66MHz0.14msOptimal for named curve Satoh(03)GF(2 163 )0.13um CMOS ASIC 510.2MHz0.36ms64*64bit dual field multiplier logic size: gates Orlando (00) GF(2 167 )Xilinx xcv400E 76.7MHz0.21ms167*16bit binary multiplier and 167*167bit squarer for P(x) = x 167 +x 6 +1 (estimated:140k gates)

Laboratory for Reliable Computing (LaRC), Compare (2/2) ReferenceFieldPlatform Maximum Frequency EC mult time Notes This work GF(p) 192bit 0.18um CMOS ASIC 384MHz3.1 ms dual field multiplier and inversion: logic size: gates Satoh(03)GF(p) 192bit 0.13um CMOS ASIC 137.7MHz2.66 ms 64*64bit dual field multiplier logic size: gates Orlando (00) GF( ) Xilinx xcv1000E-8 40MHz3ms192 * 8 bit multiplier

Laboratory for Reliable Computing (LaRC), ConclusionConclusion  Support Dual Field Arithmetic  Merge Different Arithmetic Operation to One Unit  Smallest Product of Area × EC Mult. Time  Power Efficiency Design