1 Analysis of Fractional Window Recoding Methods and Their Application to Elliptic Curve Cryptosystems 片斷視窗編碼法的分析及應用到 ECC IEEE Transactions on Computers, VOL. 55, NO. 1, JAN 2006 Author ： Katja Schmidt-Samoa, Olivier Semay, and Tsuyoshi Takagi Adviser ：鄭錦楸, 郭文中 教授 Reporter ：林彥宏

2 Outline Introduction Elliptic curve cryptography (ECC) Nonadjacent Form (NAF) window NAF (wNAF) mutual opposite form (MOF) window MOF (wMOF) Fractional wNAF Fractional wMOF Conclusions

3 Introduction(1/13) Elliptic curve cryptography (ECC) shorter key-size and faster computation suitable for small-memory device Time of crack (ns)RSA bit-lengthECC bit-lengthRSA/ECC ： 1 6 ： 1 7 ： 1 10 ： 1 35 ： 1

4 Introduction(4/13) Elliptic curve on prime field ECADD ECDBL

5 Introduction(2/13) EC Doubling (ECDBL) EC Addition (ECADD)

6 Introduction(3/13) Scalar Multiplication –Binary Method 1. 2.For down to ECDBL if, ECADD 3.Return binary representation Ex. D D DADADA

7 Introduction(5/13) Example: {O, (2,4), (2,7), (3,5), (3,6), (5,2), (5,9), (7,2), (7,9), (8,3), (8,8), (10,2), (10,9)}

8 Introduction(6/13) Nonadjacent Form (NAF) Input: A positive integer Output: A signed digit representation

9 Introduction(7/13) Example: =

10 Introduction(8/13) window NAF (wNAF) –The most significant non-zero bit is positive. –Among any consecutive digits, at most one is non- zero. –Each non-zero digit is odd and less than in absolute value.

11 Introduction(9/13)

12 Introduction(10/13) Example: w=5

13 Introduction(11/13) mutual opposite form (MOF) recoding stage can be done Left-to-Right –The signs of adjacent non-zero bits (without considering 0 bits) are opposite. –The most non-zero bit and the least non-zero bit are 1 and -1, respectively.

14 Introduction(12/13) Example:

15 Introduction(13/13) window MOF(wMOF) - The most significant non-zero bit is positive. - Each non-zero digit is odd and less than in absolute value. EX :

16 Fractional wNAF w=2 | 0 3| 0| 1 0| 0 3| 0 0| 0 3| 0 0| 0 3| 1 0| 1 0| 0| 0 3| 0 1 w=3 | 0 3 0| 0 0 5| 1 0 0| 0 3 0| 0| 0 0 7| 0 |1 0 0| 0 3 0| 1

17 Fractional wMOF First Phase: the table entries are precompute Second Phase: merges recoding and evaluation

18 conclusions proved that the proposed Frac-wMOF has the same nonzero density as Frac-wNAF using identical table sizes Frac-wMOF recoding requiring less working memory than the Frac-wNAF approach