1. Elliptic Curve Cryptography over GF(2m) on a Reconfigurable Computer:
Polynomial Basis vs. Optimal Normal Basis Representation
Comparative Study
Kris Gaj, Sashisu Bajracharya, Nghi Nguyen, Deapesh Misra
Tarek El-Ghazawi
George Mason University
The George Washington University
Gaj 1

2. What is a reconfigurable computer? Reconfigurable processor
system
Microprocessor system P
. . . P
. . .
FPGA
FPGA P
memory P
memory
FPGA
memory
FPGA
memory
. . .
. . .
Interface
Interface
I/O
I/O
Gaj 2

3. Why cryptography is a good application for reconfigurable computers?
computationally intensive
arithmetic operations
unconventionally long operand sizes
( bits)
multiple algorithms, parameters,
key sizes, and architectures
= need for reconfiguration

4. SRC Hardware & Software
Gaj 4

5. SRC-6E from SRC Computers, Inc.
Gaj 5

6. SRC Hardware Architecture
Gaj 6

7. SRC Programming SRC HDL (VHDL) HLL (C) P system FPGA system Library
Developer
Application
Programmer
Gaj 7

8. SRC Compilation Process
Gaj 8

9. Elliptic Curve Cryptosystems
Gaj 9

10. Elliptic Curve Cryptosystems
public key (asymmetric) cryptosystems
first true alternative for RSA
several times shorter keys
fast and compact implementations,
in particular in hardware
a family of cryptosystems, instead of a single
cryptosystem
Gaj 10

11. Three Classes of Elliptic Curves
Elliptic curves built over
Secure m m=
K = GF(p)
K = GF(2m)
Our m
m=233
Arithmetic
operations
present
in many libraries
Polynomial basis
representation
Normal basis
representation
Fast in hardware
Compact in hardware
Gaj 11

12. Basic operations of ECC
Basic operations in Galois Field GF(2m)
addition and subtraction (xor): x+y, x-y (XOR)
multiplication, squaring: x  y, x2
inversion: x-1
Basic operations on points of an Elliptic Curve
addition of points: P + Q
doubling a point: P
projective to affine coordinate: P2A
Complex operations on points of an Elliptic Curve
scalar multiplication: k  P = P + P + …+P
Gaj 12
k times

13. ECC hierarchy of functions
High
level kP
projective_to_affine (P2A)
Medium
level
P+Q 2P
Low
level 2
INV
Low
level 1
XOR
MUL
SQR
independent of the
GF representation
specific to the given
GF representation
Gaj 13

14. Investigated Partitioning
Schemes
Gaj 14

15. SRC Program Partitioning
C function
for P
P system
HLL
C function
for MAP
FPGA system
VHDL
macro
HDL
Gaj 15

16. H00 Partitioning (μP Software Only)
C function
for P kP H
C function
for MAP
VHDL
macro
specific to the given
GF representation
Gaj 16

17. 00H Partitioning (VHDL only)
C function
for P
C function
for MAP
VHDL
macro H kP
specific to the given
GF representation
Gaj 17

18. 0HL1 Partitioning C function for MAP VHDL macros for µ P H L1 kP
MUL4
C function
for MAP
VHDL
macros
ROT
SQR
XOR
for P H L1 V_
POW kP
INV
P2A
P+Q 2P
MUL2
MUL
independent of the
GF representation
specific to the given
GF representation
Gaj 18

19. FPGA Contents (0HL1) kP MUL4 P+Q 2P P2A MUL2 INV MUL MUL MUL MUL MUL
POW
INV
P2A
Gaj 19

20. 0HL2 Partitioning C function for µ P kP kP C function H for MAP VHDL
for P kP kP
C function H
P+Q 2P
for MAP
P+Q
P+Q 2P 2P
P2A
P2A
VHDL
MUL2 L2
MUL4
SQR
ROT
XOR
INV
INV
macros
independent of the
GF representation
specific to the given
GF representation
Gaj 20

21. 0HM Partitioning C function for µ P C function kP H for MAP VHDL P+Q
C function
for P
C function kP H
for MAP
VHDL
P+Q
P+Q 2P 2P
P2A
P2A M
macros
independent of the
GF representation
specific to the given
GF representation
Gaj 21

22. Results
Gaj 22

23. Timing Measurements End-to-End time (SW) MAP function MAP function MAP
.c file
.mc file
MAP
function
MAP function
MAP
Alloc.
FPGA
Configure
DMA
Data In
FPGA
Computation
DMA
DataOut
MAP
Free
End-to-End time (HW)
End-to-End time (SW)
MAP
Allocation
time
Configuration
time
MAP
Release
Time
Gaj 23

24. Results for Optimal Normal Basis (Latency)
Gaj 24

25. Results for Polynomial Basis (Latency)
Gaj 25

26. Results for Optimal Normal Basis (Area)
Gaj 26

27. Results for the Polynomial Basis (Area)
Gaj 27

28. Algorithm Partitioning Scheme
Number of lines of code
Algorithm Partitioning Scheme
VHDL PB
ONB
Macro Wrapper
MAP C
Main C
0HL1
N/A
1007
260
371
153
0HL2
714
1291
230
349
0HM
1744
160
185
00H
1960 36 78
Gaj 28

29. Conclusions Assuming focus on: Timing Resources Ease of programming
Gaj 29

30. Large speedup vs. software Ease of implementation
Best implementation approaches
Optimal Normal Basis
OHL1 scheme
Polynomial Basis
OHL2 scheme
Large speedup vs. software
Ease of implementation
Flexibility
Gaj 30

31. Conclusions Elliptic Curve Cryptosystem implementation
challenging for reconfigurable computers because of
optimization for latency rather than throughput
limited amount of parallelism
Absolute latency and resource utilization similar for
Optimal Normal Basis
and
Polynomial Basis
Number of lines of VHDL code smaller
for the polynomial basis representation
Gaj 31

32. Conclusions – cont.
Speed-up over Intel P3 microprocessor implementation
From 893 to 1305 times for Optimal Normal Basis
From times for Polynomial Basis
27 x greater for
Optimal Normal Basis
compared to
Polynomial Basis Representation
because of polynomial basis operations more
efficient in software
Gaj 32