1. Fast Multi-Scalar Multiplication Methods on Elliptic Curves with Precomputation Strategy using Montgomery Trick Hitachi Ltd. Katsuyuki Okeya Kouichi Sakurai Kyushu Univ.

2. 2/22 Abstract The use of multi-scalar multiplication in the verification of ECDSA Speeding up the multi-scalar multiplication The transformation from scalar multiplication to multi-scalar multiplication Motivation Problem Result Efficient Precomputation provides speedup for multi-scalar multiplication 3 times faster [GLV01] [ANSI]

3. 3/22 Contents Multi-Scalar Multiplication Target of Speedup Proposed Method Comparison

4. 4/22 What is Multi-Scalar Multiplication? Scalar multiplication Multi-scalar multiplication an integer an elliptic point Scalar multiplication integers elliptic points

5. 5/22 Two Computation Methods for Multi-Scalar Multiplication Compute separately two scalar multiplications Separate Method Compute simultaneously two scalar multiplications Scalar multiplication addition Multi-scalar multiplication Simultaneous Method [Aki01, Moe01] [Elg85, HHM00] Shamir’s trick Improvement Window method Comb method [Knu81, CMO98] [LL94] addition

6. 6/22 Computation Process Precomputa- tion stage Evaluation stage InputOutput Preparation of a table Actual computation Table addition Precomputation table

7. 7/22 Target of Speedup Precomputation Stage Evaluation Stage Separate Method Simultaneous Method Slow Fast Many researches exist Controversial ! Not so much studies as evaluation stage [Aki01, Moe01, Sol01] [CC87, MO90, LL94, CMO98, …][CMO98]

8. 8/22 What are Obstacles to Speed up the Precomputation Stage? Many precomputation points Inversions are required (1 per point) Some points are not used in evaluation stage Obstacles Multi-scalar multiplication only

9. 9/22 What are Obstacles to Speed up the Precomputation Stage? Points are computed in affine coordinates Reason Table should be saved points in affine coordinates for speeding up evaluation stage The operation in affine coordinates requires inversion Inversions are required (1 per point) Obstacles Many precomputation points Some points are not used in evaluation stage Multi-scalar multiplication only

10. 10/22 What are Obstacles to Speed up the Precomputation Stage? Reason 2 dimensionsInversions are required (1 per point) Obstacles Multi-scalar multiplication only Some points are not used in evaluation stage Many precomputation points

11. 11/22 What are Obstacles to Speed up the Precomputation Stage? Reason Precomputation stage Points to compute: 64 points Evaluation stage Points to use: 54 points 160 bits, window width 3 Inversions are required (1 per point) Obstacles Multi-scalar multiplication only Many precomputation points Some points are not used in evaluation stage

12. 12/22 Contents Multi-Scalar Multiplication Target of Speedup Proposed Method Comparison

13. 13/22 Simple Improvements has same x-coordinates Simultaneous inversion Negate the y-coordinate Omit computation

14. 14/22 MMMM I MM MM MM Montgomery Trick of Simultaneous Inversions Input Output Cost MM I M: multiplication I: inversion [Coh93] It speeds up the ECM of factorization [Coh93]

15. 15/22 Use of Montgomery Trick (Scalar Multiplication) Montgomery trick reduces from plural inversions to 1 inversion doubling Compute inversion using Montgomery trick addition Preparation of precomputation table addition [CMO98] doubling Use of Montgomery trick

16. 16/22 Use of Montgomery Trick (Multi-Scalar Multiplication) doubling addition Compute inversion using Montgomery trick addition Preparation of precomputation table addition Complicated because of 2 dimensions Montgomery trick reduces from plural inversions to 1 inversion

17. 17/22 Preparation of Precomputation Table Step 0 Step 1 Step 2 Step 3 Precomputation Table Each step uses Montgomery trick of simultaneous inversion

18. 18/22 They cannot be computed in Step 2 Some Points Do Not Need to be Computed Precomputation Table Consider how the points are computed! Step 0 Step 1 Step 2 Step 3

19. 19/22 Proposed Method Step 0 Step 1 Step 2 Step 3 Precomputation Table are first, the middles are last

20. 20/22 Some Points Do Not Need to be Computed Step 0 Step 1 Step 2 Step 3 Precomputation Table It does not affect the computation for the other points

21. 21/22 Comparison Precompu- tation stage Evaluation stage Separate Method Simultaneous Method 336.8 Ｍ Total 2809.8 Ｍ 3146.6 Ｍ 279.2 Ｍ 1655.5 Ｍ 1934.7 Ｍ Proposed method 160 bits [CMO98] 1011.6 Ｍ 1655.5 Ｍ 2667.1 Ｍ Conventional Method [HHM00][Moe01]

22. 22/22 Conclusion Speeding up the verification of ECDSA Speeding up the Multi-scalar multiplication Speeding up the scalar multiplication using multi-scalar multiplication Application Problem Result Points Montgomery trick of simultaneous inversions Simplification of precomputation procedures Efficient Precomputation provides speedup for multi-scalar multiplication 3 times faster