1. A Reconfigurable System on Chip Implementation for Elliptic Curve Cryptography over GF(2 n ) Michael Jung 1, M. Ernst 1, F. Madlener 1, S. Huss 1, R. Blümel 2 1 Integrated Circuits and Systems Lab Computer Science Department Darmstadt University of Technology Germany 2 cv cryptovision GmbH Gelsenkirchen Germany

2. ECC over GF(2 n ) GF(2 n ) operations implemented in HWGF(2 n ) operations implemented in HW –Square, Multiply, Add –Inversion with Fermat‘s little Theorem –Polynomial Base –Multiplier based on a novel, generalized version of the Karatsuba Ofman Algorithm 1 EC level algorithms implemented in SWEC level algorithms implemented in SW –2P Algorithm 2 for EC point multiplication –Projective Point Coordinates Algorithmic flexibility combined with performanceAlgorithmic flexibility combined with performance [1] Karatsuba and Ofman, Multiplication of multidigit numbers on automata, 1963 [2] Lopez/Dahab, Fast multiplication on elliptic curves over GF(2m) without precomputations, 1999

3. Atmel FPSLIC 8-Bit RISC Microcontroller 20+ MIPS @ 25 MHz Reconfigurable System on Chip

4. Atmel FPSLIC 8-Bit RISC Microcontroller FPGA 40k Gate Equivalents Distributed FreeRAM TM Cells Reconfigurable System on Chip

5. Atmel FPSLIC 8-Bit RISC Microcontroller 36 kByte RAM FPGA Dual Ported Simultaneously accessible by MCU and FPGA Reconfigurable System on Chip

6. Atmel FPSLIC 8-Bit RISC Microcontroller 36 kByte RAM FPGA Peripherals UARTs Timers etc. Reconfigurable System on Chip

7. Atmel FPSLIC 8-Bit RISC Microcontroller 36 kByte RAM FPGA Peripherals Reconfigurable System on Chip Low cost, low complexity device

8. Polynomial Karatsuba Multiplication A*B 0 0 01 1 1 with

9. Multi-Segment Karatsuba (MSK) with, and Generalization of the Karatsuba Multiplication Algorithm Polynomials are split into an arbitrary number of segments

10. A*B 0 0 1 01 12 012 1 2 12 2 MSK k for k=3 with

11. Reordering of Partial Products A*B 0 0 1 01 12 012 1 2 12 2 1)Pattern Grouping 2)Reorder pattern by decreasing x n 3)Minimize differences in the set of indices of adjacent pattern

12. A*B 0 0 1 01 12 012 1 2 12 2 2 2 2 Pattern Grouping 1.) Grouping the partial products to one of three possible pattern

13. A*B 0 0 1 01 12 012 1 12 2 Pattern Grouping 1.) Grouping the partial products to one of three possible pattern

14. A*B 0 0 1 01 012 1 1 1 1 122 Pattern Grouping 1.) Grouping the partial products to one of three possible pattern

15. A*B 0 0 01 012 1 122 Pattern Grouping 1.) Grouping the partial products to one of three possible pattern

16. A*B 0 0 01 012 1 122 Pattern Grouping 1.) Grouping the partial products to one of three possible pattern

17. A*B 0 0 0 0 0 01 012 1 122 Pattern Grouping 1.) Grouping the partial products to one of three possible pattern

18. Reordering of Partial Products 1)Pattern Grouping 2)Reorder pattern by decreasing x n 3)Minimize differences in the set of indices of adjacent pattern A*B 001 012 1 122

19. A*B 001 012 1 122 012 Reordering of Partial Products 2.) Ordering of the pattern in a top-left to bottom-right fashion

20. A*B 001 1 012 122 Reordering of Partial Products 2.) Ordering of the pattern in a top-left to bottom-right fashion

21. Reordering of Partial Products 1)Pattern Grouping 2)Reorder pattern by decreasing x n 3)Minimize differences in the set of indices of adjacent pattern A*B 001 1 012 122

22. A*B 001 1 012 122 01 Reordering of Partial Products 3.) Ensuring that the set of added up segments in the partial products differs only by one element between two adjacent patterns

23. A*B 0 1 01 012 122 Reordering of Partial Products 3.) Ensuring that the set of added up segments in the partial products differs only by one element between two adjacent patterns

24. Multiplication Sequence A 2 A 1 A 0 B 2 B 1 B 0 Mult

25. Multiplication Sequence A 2 A 1 A 0 B 2 B 1 B 0 Clock Cycle: 1 Mult

26. Multiplication Sequence A 2 A 1 A 0 B 2 B 1 B 0 22 Clock Cycle: 2 Mult

27. Multiplication Sequence A 2 A 1 A 0 B 2 B 1 B 0 2 12 Clock Cycle: 3 Mult

28. Multiplication Sequence A 2 A 1 A 0 B 2 B 1 B 0 012 122 Clock Cycle: 4 Mult

29. Multiplication Sequence A 2 A 1 A 0 B 2 B 1 B 0 01 012 122 Clock Cycle: 5 Mult

30. Multiplication Sequence A 2 A 1 A 0 B 2 B 1 B 0 11 01 012 122 Clock Cycle: 6 Mult

31. Multiplication Sequence A 2 A 1 A 0 B 2 B 1 B 0 00 1 01 012 122 Clock Cycle: 7 Mult

32. Multiplication Sequence A 2 A 1 A 0 B 2 B 1 B 0 0 1 01 012 122 Clock Cycle: 8 Mult

33. Coprocessor Interface FF-ALU Op. AOp. B Controller FPGA Finite Field Arithmetic AVR EC level Algorithms RAM... MULT ADD SQUARE

34. Results FF-LevelClock Cycles Operationbest caseworst case FF-Mult32152 FF-Add16136 FF-Square191 One EC point multiplication takes 10.9 ms @ 12 MHz Speed-up factor of about 40 compared to an assembler optimized software implementation Prototype Implementation: 5-Segment Karatsuba (MSK 5 ) 23-Bit combinational Multiplier GF(2 113 ) OperationClock Cycles EC-Double493 EC-Add615 k·Pk·P130,200