FPGA based Hardware Accleration for Elliptic Curve Cryptography ...

2.2. FINITE FIELD ARITHMETIC 8
k P
EC-Double
EC-Add
FF-Mult
FF-Add
FF-Square
Figure 2.2: EC arithmetic hierarchy
By exploiting the previously detailed projective coordinates during the computation of a operation all
but one field inversion can be circumvented. This inversion, that takes place at the end of a operation,
converts the result that is given in projective coordinates back to the affine representation. Compared to the
number of cycles a complete operation takes, the time for this single inversion is negligible. Therefore
it can be computed using a simple algorithm based on the existing field operations FF-Square, FF-Mult and
FF-Add (see Sec. 2.2.6).
Depending on different constraints one can chose from a lot of different algorithms on all level of arithmetic.
For the operations, this work applies the Double-And-Add algorithm given in Alg. 3. The algorithm
simply scans bit-by-bit. If the current bit is set ( 6 c ), the intermediate result is doubled and the base
point is added one time. If the bit is not set ( 6«I
), only the EC-Double operation is performed.
Using precomputated values would allow to scan multiple bits at one time and by that would lead to an
improved performance. Due to space limitations the additional registers that would be needed to store these
precomputated values were the main reason not to implement such an algorithm.
Using Alg. 3 each multiplication requires( EC-Double and¬ EC-Add operations. As EC-Double is
cheaper in terms of FF multiplication as EC-Add, the performance of the algorithm benefits from a key
with low Hamming weight¬ .
2.2 Finite Field Arithmetic
The finite field- is the underlying field on which elliptic curves are based throughout this work. It
can be viewed as a vector space of dimension( over the field . In hardware field elements can be
easily implemented as a bit vector, which makes this kind of finite fields especially interesting for hardware
implementations. As already mentioned, the representation treated in this paper is a polynomial basis only.