1. 1 Analysis of Fractional Window Recoding Methods and Their Application to Elliptic Curve Cryptosystems 片斷視窗編碼法的分析及應用到 ECC IEEE Transactions on Computers, VOL. 55, NO. 1, JAN 2006 Author ： Katja Schmidt-Samoa, Olivier Semay, and Tsuyoshi Takagi Adviser ：鄭錦楸, 郭文中 教授 Reporter ：林彥宏

2. 2 Outline Introduction Elliptic curve cryptography (ECC) Nonadjacent Form (NAF) window NAF (wNAF) mutual opposite form (MOF) window MOF (wMOF) Fractional wNAF Fractional wMOF Conclusions

3. 3 Introduction(1/13) Elliptic curve cryptography (ECC) shorter key-size and faster computation suitable for small-memory device Time of crack (ns)RSA bit-lengthECC bit-lengthRSA/ECC 512 768 1024 2048 2100 106 132 160 210 600 5 ： 1 6 ： 1 7 ： 1 10 ： 1 35 ： 1

4. 4 Introduction(4/13) Elliptic curve on prime field ECADD ECDBL

5. 5 Introduction(2/13) EC Doubling (ECDBL) EC Addition (ECADD)

6. 6 Introduction(3/13) Scalar Multiplication –Binary Method 1. 2.For down to ECDBL if, ECADD 3.Return binary representation Ex. D D DADADA

7. 7 Introduction(5/13) Example: {O, (2,4), (2,7), (3,5), (3,6), (5,2), (5,9), (7,2), (7,9), (8,3), (8,8), (10,2), (10,9)}

8. 8 Introduction(6/13) Nonadjacent Form (NAF) Input: A positive integer Output: A signed digit representation

9. 9 Introduction(7/13) Example: 1. 2. 1011011001=

10. 10 Introduction(8/13) window NAF (wNAF) –The most significant non-zero bit is positive. –Among any consecutive digits, at most one is non- zero. –Each non-zero digit is odd and less than in absolute value.

11. 11 Introduction(9/13)

12. 12 Introduction(10/13) Example: w=5

13. 13 Introduction(11/13) mutual opposite form (MOF) recoding stage can be done Left-to-Right –The signs of adjacent non-zero bits (without considering 0 bits) are opposite. –The most non-zero bit and the least non-zero bit are 1 and -1, respectively.

14. 14 Introduction(12/13) Example:

15. 15 Introduction(13/13) window MOF(wMOF) - The most significant non-zero bit is positive. - Each non-zero digit is odd and less than in absolute value. EX :

16. 16 Fractional wNAF 1 1 0 1 0 1 1 0 0 1 1 0 0 1 1 1 0 1 0 0 1 1 0 1 w=2 | 0 3| 0| 1 0| 0 3| 0 0| 0 3| 0 0| 0 3| 1 0| 1 0| 0| 0 3| 0 1 w=3 | 0 3 0| 0 0 5| 1 0 0| 0 3 0| 0| 0 0 7| 0 |1 0 0| 0 3 0| 1

17. 17 Fractional wMOF First Phase: the table entries are precompute Second Phase: merges recoding and evaluation

18. 18 conclusions proved that the proposed Frac-wMOF has the same nonzero density as Frac-wNAF using identical table sizes Frac-wMOF recoding requiring less working memory than the Frac-wNAF approach