Fast Elliptic Curve Algorithm of Embedded Mobile Equipment

Transcription

1 Send Orders for Reprints to 8 The Open Eletrial & Eletroni Engineering Journal, 0, 7, 8-4 Fast Ellipti Curve Algorithm of Embedded Mobile Equipment Open Aess Lihong Zhang *, Shuqian Chen and Yanglie Fu Shool of Computer Engineer, Huaihai Institute of Tehnology, Lianyungang, Jiangsu, China Abstrat: Seletion Algorithm and Generation Algorithm of ellipti urves have been the fous of researh and hotspot of the Ellipti Curve Cryptosystem. his paper disusses a random ellipti urve realization method of Embedded Mobile Equipment, the SEA algorithm and its improved algorithm from Ellipti Curve's seletion, Ellipti Curve's struture and Ellipti Curve's generation. Ensuring that the embedded system in the seurity situation goes through invariable situation auses the embedded system to realize a fast ellipti urve realization method, whih enhanes the effiieny of embedded system. Keywords: Ellipti urve ryptosystem, SEA, table, fast algorithm.. INTRODUCTION Embedded Mobile Equipment's proessor mostly is ARM9, Strong ARM or Xsale and so on. The proessor's proessing speed and the operational apability are limited. Most embedded mobile equipments offer many kinds of data aess methods, the use of Wi-Fi aess methods being more popular. But at present, in the Wi-Fi enryption algorithm whih is suited to the harateristis of embedded mobile equipment, omputing seure aess is less. The Ellipti Curve Cryptography publi key system is a more seure ryptosystem. However, the seletion and alulation of ellipti urves would be unbearable for embedded devies. The omplex regular operation, ombined with the harateristis of the embedded system, an use pre omputing and establish form to redue system's omputation load. At the same time, a simplified algorithm is used to improve system s operating effiieny. But the proessor speed of the textile mahine s ontroller and image reognition speed and auray determine whih of these senarios in real-world appliations are limited. In order to speed up the proessing speed, the use of high speed ARM proessor and the speialpurpose DSP hip, simultaneously makes the algorithm ahieve a better detetion. This artile disusses the weft detetion method from the perspetive of image reognition algorithms, and does not inlude the disussion on implementation in DSP proessor, ARM and DSP ontrol proess.. SELECTION OF ELLIPTIC CURVES Ellipti urve usually refers to a plane urve that satisfies the Weierstrass equation: y + a xy + a y = x + a x + a 4 x + a 6 ( *Address orrespondene to this author at the Shool of Computer Engineer, Huaihai Institute of Tehnology, Lianyungang, Jiangsu, China; Tel: ; Fax: ; zlh4@6.om In order to ensure the seleted seurity of ellipti urve, e should pay attention to the following question: ( In order to avoid the MOV [] algorithm attak, the seletion must be non-super singular ellipti urve; ( In order to avoid the SSAS [] algorithm attak, the seletion annot be the anomalous ellipti urve on the prime number field GF ( p ; ( Based on the Weil [] drop theory, the seletion of the harateristi of s Complex Domain is avoided and should be seleted p in domain GF( p of the ellipti urve as prime number. Based on the above seure request, there are two typial seurity ellipti urves. One is whose harateristi of finite field is prime, when q=p GF(q = GF(p, defined in the prime domain GF ( p, its Weierstrass equation is y = x + ax + b, a,b F ( The other is an ellipti urve whose finite field harateristi is, when q= n, and ellipti urves in the Binary finite field GF(q, its Weierstrass equation is y + xy = x + ax + a6, ( Note that here n is prime and n should be large enough to ounter the Weil desent algorithm, But these two kinds of urves have the shortoming of seletion diffiulty and running speed. At present, these problems are solved mainly through seletion of the appropriate or a prime order ellipti urve of prime order parameter in a limited parameter group of ellipti urves.. CONSTRUCTION OF LLIPTIC CURVES Constrution of an ellipti urve's method usually involves Random urve [4] and Complex Multipliation [] / 0 Bentham Open

2 Fast Ellipti Curve Algorithm of Embedded Mobile Equipment The Open Eletrial & Eletroni Engineering Journal, 0, Volume 7 9 (CM. Beause the CM method of onstruting ellipti urves has some additional harateristi, from the seurity angle, these harateristis are onsidered a potential threat, but the random urve is obtained ompletely randomly generated, that is onsidered the safer ellipti urve. To simplify the alulation of random ellipti urve, an isomorphi urve is onstruted in the same domain, and aording to the harateristis of the domain. In the prime field Fp, K is defined in the domain, harateristi p>, Eq. an be simplified as y = x + ax + b, a,b F, with = 4a + 7b mod, p 0 aquisition of the urve is mainly a finite group s Order alulation of an ellipti urve. In this aspet, there are many lassial algorithms, suh as the Shool algorithms, SEA algorithm, mold polynomial algorithm, Elkies algorithm, Atkin algorithm and so on. These algorithms in pratial appliations meeting the needs of the system bring lots of improvement. 4. ELLIPTIC CURVE GENERATING ALGORITHM On the preeding analysis, the seletion of a safe ellipti urve atually depends on how fast ellipti urve order is omputed. Among all the algorithms, SEA algorithm is the most representative, ombination of Elkies and Atkin brings improvements, and alulates the set of possible values, then the Chinese Remainder Theorem and Shank s Method(babystep giant-step,bsgs are used to alulate order. In the prime finite field Fq, the order is #E(Fq, the proess of the algorithm [6] is summarized as follows: Input :GF(q and E Output: #E (F(q ( l, E {(t mod,}, A {} ( for M = ; M < 4 p ompute f(q=gd( x p x, l (x, j(e if f(q Then Choose Elkies else Choose Atkin M M l get Prime l ( for (j=; j<=i; j++ M L j = ; y j = L j mod l j l j Compute t = t L y + tl y + L + ti Li yi (4 output #E F(q =q+l-t The main problem of the algorithm is the omplexity in the alulation of the l polynomial model and the division polynomial, at the same time seletion of the urve suess ratio is lower [7].. FAST GENERATING ALGORITHM In embedded systems, omputing speed of add and subtrat is faster than other operation. Multipliation mostly an omplete in the Single-yle, and supports 64-bit multiply. In order to adapt the harateristis of embedded systems, we need to improve the SEA algorithm. In above SEA algorithm desription, we will improve the alulation of ellipti urves in the order of finite groups, thus will enhane the effiieny of the system.. Improved Curve Seletion Algorithm After defining the finite domain GF(q, aording to the harateristis of embedded systems, it beomes appropriate to redue the safety requirements, request parameter q beomes greater than 60bit, its password strength is equivalent to 04bit RSA. Based on this, randomly generated parameter q, establishes the ellipti urve on this domain. Aording to the need of Generality of modular polynomials for solving #E(F(q in the SEA algorithm, onvert its definition [8], adopt the pretreatment method, and store the alulation results of polynomial model in the Flash or the main memory, and look-up table to obtain alulation results. Using these methods, the alulation time an be redued. If the randomly generated urve parameter does not meet the requirements, urve parameter needs to re-selet. So we need to set flag in the system, and alternately hange the parameters a and b. For example: when the flag is 0, hange the parameter a, then set flag to ; at next seletion, the flag is, hange the parameter b, then set flag to 0, and so on, avoid selet repeated parameters. Using these measures an improve the speed of the algorithm. The improved algorithm is as follows: Input: Random (a b Output: y = x + ax + b, a, b F ( Random (a b ( if E=Speial Curve Then return (step ( if Prime l then Elkies else Atkin (4 Compute t #E=q+l-t ( if non-prime #E if flag =0 hange a and flag return (step else hange b and flag 0 return (step else Output Curve Equation.. Improved Modulus Algorithm In the ellipti urve generating operation, the module omputing spends longer time than any other omputing. The module omputing speed an effetively improve the overall omputing effiieny of embedded systems, as mentioned above. The use of embedded memory look-up table method an save onsiderable omputing time. In eah enryption, deryption tasks, we establish a temporary table. Beause of memory omponent ost's redution, this plan's implementation possibly beomes gradual. Considering the Flash s reading speed, when forming initialization, we an map the form in the main memory (SDRAM or DDR to speed up the data s reading speed.

3 40 The Open Eletrial & Eletroni Engineering Journal, 0, Volume 7 Zhang et al. When finite field Fq is determined, Pre-ompute l mod p, the result stores in system's form, and then modulus gets ompleted and demands the same order-mode. Modular multipliation an be divided into two steps: quadrature and modulo. The modulus operator will be deomposed into n i i by the modulus, just for eah i whih is not equal 0, the model results an be aumulated the pre-omputed value l mod P,fill the pre-omputed values in the memory table, using for referene table. n Suppose X = x i Y i, x i #[0,Y ] n X [# x i Y i + (x n Y n mod M ] mod M (4 n M = m i Y i, m i #[0,Y ] ( Z j Z 0 j a = j Y a ( j mod M or z, j Y i (6 a = j Y a ( j mod M or z 0, j Y i (7 Where: j = (,,L,Y Z ( j is M s a + -order mode, reorded as Z, Z 0 ( j is M s a -order mode, reorded as Z 0 Aording to the above definition of X and M If x a < m a X mod M = X If x a = m a X M > X $ X mod M = # 0 M = X $ % X M M < X If x a > m a X mod M = # T M > T $ T M M < T a Where: T = x i Y i + Z 0 (x a. Fast modulus algorithm First onstrut M s a + -order and a -order mold table, in eah enryption and deryption of messages, built table should be ompleted before modulo operation, an build tables in the following order: (X n + Y mod N = [(X n mod N + Y ] mod N (8 (X n + X mod N = [(X n mod N + (X mod N] mod N (9 Then set X is N -bit Y -nary number, result of modulo is a A -bit Y - nary number, whih may be greater than M, and may also be less than M, the algorithm is as follows: Modular (X,M,Z for i=n- to a a i =x i x i =0 X = X + Y na Z x The final result is A -bit Y - nary number, and is stored in the X. Finally, take the same-modes to the results obtained in the previous step, the algorithm is as follows: Modular (X,M,T for i=n- to a- if x a < m a then X mod M = X x m if a = a then if M>X then X mod M=X if M=X then X mod M=0 if M<X then X mod M=X-M if x a > m a then if M>T then X mod M=T if M<T then X mod M=T-M. Modular inversion In the Modular inversion alulation, usually inverse operation is onverted to multipliation operation, whih redues the inverse frequeny to ahieve the purpose of improving the effiieny. In the field Fq, for the given points p (x,y and Q (x,y, the alulation of the size of P+Q omputation is partiularly important. In literature [9] pointed out: Assuming that (x, y = P, (x 4 = P + Q. Algorithm is as follows: = (x + / (y x = x x, y = (x x y (0 = ( y y /( x x x 4 = x x = (x x 4 y ( = (y 4 y / (x 4 x x, y ( = x x4 y = ( x x

4 Fast Ellipti Curve Algorithm of Embedded Mobile Equipment The Open Eletrial & Eletroni Engineering Journal, 0, Volume 7 4 Introdution of ommon fator, is the,, denominator least ommon multiple number, and is known as term simplest formula. For ease of alulation, suppose A, A, A to separately express,, denominator, B, B, B to separately express,, numerator, obviously,, A, A, B, B is known,, A, B need to alulate. Assuming that = (A B + A B + (A B A B A (A A ( A = / (A A ( = B (A A / (4 Inverse operation to onvert the multipliation, that is to strike, through-type (8 ~ (0 alulated x,, from the above steps, Inverse items are the only ( y, whih is inverse from the times ( and and is redued to ( and then transformation and substitution B whih is in type (9, are obtained: = A A ( x x ( ( ( Transform equation (6, we an obtain x. x ( x + x + x (6 = + ( By alulating,,, and ( x, y, we an obtain ( x, y = P + Q, Omit (x 4 = P + Q, alulated to further redue, improved algorithms are as follows [0]: Input : P = ( x, y o and Q = (x, y o Output: P + Q = ( x, y Setp: if (y =0 then return P+Q if (x =x then if (y =y then return 4P else return P step: ompute,,, A y, B x + a A x - x, B y - y = # ( A B + A B + ( A B A B A ( A A = (A A = A B = A B = (A B (x x ( Step: ompute (x, y x = x, y = (x x y Step4: ompute (x, y x = ( + ( x + x + x, y = (x x y Step: result (x, y Known x F p gd(x, p = satisfies the equation xa = mod p s A F p whih is known as the inverse of the finite field, an be expressed as x mod p, the algorithm is as follows: step: step: step: b:=p;u 0 =0;u = while (b<>0 s:=x div b;r:=x mod b;u: =u 0 -s*;u x:=b; u 0 = u ; u =u if u 0 0 then return u 0 else return u 0 +p The algorithm desription of the atual realized should put modulo division after eah multipliation Operation is arried out. This may save more time, otherwise, the results of eah Exponentiation will beome more and more huge. We an use the following method to speed up the omputation speed. Input: m p x Output: x m mod p ( y=x ( for I=n ; I>=0 ; I y=y x m mod p ( result y.. Algorithm Effiieny Analysis In the embedded system platform to ahieve the ellipti urve alulation, we seleted the ARM9 family of proessors in the Samsung's SC40X, Xsale PXA 70, SC640 and SPV0, in the Linux operating system, C programming and embedded assembly mix programming situation. We ompared the omputing time of Optimizing by this method and not by look-up table, the onlusion is shown in the Table. Table. Effiieny table Algorithm SC40 PXA 70 SC640 SPV0 Look-up table optimization 687ms 7ms 0ms 7 ms Not look-up table 96ms 48ms 4ms 6 ms 6. CONCLUSIONS Implementation of ellipti urve ryptosystem has great diffiulty. This paper has arried on a more thorough om-

5 4 The Open Eletrial & Eletroni Engineering Journal, 0, Volume 7 Zhang et al. parison to the ellipti urve generating algorithm, proposing the use of pre-omputation. We use established in tabular form to simplify the system operation, and to improve the Modular Exponentiation Algorithm and redue the amount of modular multipliation alulation. We have proposed for embedded systems the ellipti urve algorithm. We have arried on the movement onfirmation on many kinds of embedded proessors. When designing embedded system, if we hoose with the DSP or FPGA o-proessing system and Optimize proedure realization, the operations beome more effiient. CONFLICT OF INTEREST The authors onfirm that this artile ontent has no onflits of interest. ACKNOWLEDGMENTS Delared none. REFERENCES [] Menezes, T. Okamoto and S. Vanstone, Reduing Ellipti Curve Logarithms to Logarithms in a Finite Field, IEEE Trans. Inform Theory vol. 9, no., , 99. [] N. Smart, The Disrete Logarithm Problem on Ellipti Curves of Trae One, J. Cryptol., vol., no., 9-96, 999. [] I. Garia-Selfa, A.O. Miguel, and J. M. Tomero, Computing the rational torsion of an ellipti urve using tate normal form, J. Number Theory vol. 96, no. l, pp , 00. [4] N. Koblitz, CM-Curve with Good Cryptographi Properties, Advanes in Cryptology Crypto 9 LNCS76, 99, Springer- Verlag, pp [] G. Lay and H. Zimmer, Construting Ellipti Curves With Given Group Order Over Large Finite Field, Algorithmi Number Theory: First International Symposium Leture Notes in Computer Siene (877 Springer-Verlag, pp. 0-6, 994. [6] X. Youan and L. Layuan, A New Quik Publi Key Crypto System Based on the Diffiulty of Fatoring Very Large Numbers, International Symposium on Distributed Computing and Appliations to Business Engineering and Siene DCABES 00, pp. 0-4, 00. [7] S. A. Vanstone and R. J. Zuherato, Ellipti urve ryptosystems using urves of smooth order the ringzn, IEEE Trans. Inform Theory vol. 4, no. 7, pp. -7, 997. [8] X. Youan, Researhes Ellipti Curve Publi Key Cryptosystems in Network Information Seurity, PhD thesis, WuHan University of Tehnology, 00. [9] M. Ciet, M. Joye, K. Lauter and L. M. Peter, Trading inversions for multipliations in ellipti urve ryptography, Des, Codes Cryptography, vol. 9, no., pp , 006. [0] L. Lian-hao and S. Yong, Fast algorithm for salar multipliation in ellipti urves ryptography, Appl Res Comput, vol. 6, no., pp , 009. Reeived: July 0, 0 Revised: July 07, 0 Aepted: July, 0 Zhang et al.; Liensee Bentham Open. This is an open aess artile liensed under the terms of the Creative Commons Attribution Non-Commerial Liense ( whih permits unrestrited, non-ommerial use, distribution and reprodution in any medium, provided the work is properly ited.