FPGA based Hardware Accleration for Elliptic Curve Cryptography ...

More documents

Recommendations

Info

Ô Ô Ô 2.3. SEQUENTIAL MULTIPLICATION SCHEMES 17 #" ¦ ) 3 in the following way: It is assumed that ( Í‰Ï4Ð 6°I ; if not, the polynomials are padded with the necessary number of zero coefficients. A polynomial v E hÁ5.Â is divided into segments (! Y ±ÈÇÉ® v ±ä`ò 5 ± , with ò 5 0ó6 5 ¦î ¦ . With Eqn. 2.13} 6 v |]6 ! #" ¦ v @ | holds for any ¦ such thatv 6¦¥ degree( polynomialsv @ |ËE -hÁ5.Â : 5 ± Yª ¦ (2.13) whereas & œ" ¦ v @ | 6¨§ ¦ 5 ± Y ¾ § ¦ Y ±ÈÇbY ±©®v @ | #ò ±ÈÇbY ¦ ±©± v @ | aò © v @ | 6 § ô Y Ô ±ÈÇbY ±© v @ | ô § ô Y Ô ±–ÇbY ±© ª ô ± v @ | ¾? ô © v @ | 9@ (2.14) ¾ | ± \ ±ÈÇ ±ÈÇ The annex of this paper presents an example application of the for& #" 8 above equations . According to Eqn. 2.13 product} 6 v | 6 ! #" ¦ v @ | the entire is composed of the partial sums v @ | . Each partial sum consists of partial products ô © v @ | according to Eqn. 2.14. The total © ,. number of (b†¦ required -bit multiplications in order to perform ( one -bit multiplication using ô #" ¦ the scheme results from ! Y© v @ | 6 Y© v @ | and ô © v @ | 6 § ª ô Y ô Y Ô ª v ± § 6 Ì ¯ ¦ 6 M)²cS#B \ (2.15)
2.3. SEQUENTIAL MULTIPLICATION SCHEMES 18 to the rectangles determine the indices of the segments, whose sums have been multiplied. E.g., the label ”123” represents termv YP¾ v 3 ¾ v 8 =A| Y4¾ | 3 ¾ | 8 the , which denoted 8 ©øYSv @ | is in Eqn. 2.14. The horizontal position of a rectangle represents exponent¯ the of the associated ò 5 ± factor . E.g., the rectangle in the lower left edge labeled ”3” together with its position denotes the v 8 ¾ | 8 Pò 5 term . The } 6 v | result is computed by summing up (XORing) all the terms according to their horizontal position. This final is product segments wide, as one would expect. The partial products can be reordered as shown in Fig. 2.4d. This order was achieved from a consideration of three optimization criteria. First, most partial products are added two times to compute the final result. They can be grouped together and placed in one of three patterns, which are indicated in Fig. 2.4d. This is true for all instances of the MSK algorithm (again this has been evaluated semi-manually by a C program for Õ c II any ). In the architecture detailed in Sec. 3, these patterns are computed by some additional combinational logic, which is connected to the output of the combinational multiplier. Second, the resulting patterns are ordered descending¯ by of their ò factor ± . In this way, the product can be accumulated easily in a shift register. 5 As the third optimization criterion the remaining degree of freedom is taken advantage of in the following way: The patterns are once more reordered, such that when iterating over them from top to bottom, one of two conditions holds: Either the current pattern is constructed from a single segment (e.g.v ®j | ® product , but v ®j¾ v YXœ| ®j¾ | Y not ) or the set of indices of the pattern segments differs only at one index from its predecessor (as in the productsv ® | ® andv ®¾ v Y[#=| ®:¾ | YX partial ). Since this criterion can not always be met for all segments some accumulation steps take one additional cycle. However it can be shown that it is always possible to reorder the segments in a way that either the sum of up to two single segments or at most two additional segments need to be accumulated. A fact that already has been proven and has been evaluated for interesting all , too. By applying the third optimization criterion to the pattern sequence, the partial product computations can be performed as follows: By + placing -bit accumulator registers at the inputs of the combinational multiplier, from which each can add up one segment to the current value or load one new segment in a single clock cycle, terms ô © v @ | the can be computed iteratively in a pipelined fashion (see Fig. 3.2). This results in a two stage pipelined design for the complete datapath and yields a total cZ of clock cycles to perform one multiplication the! #"'$ using . The MSK scheme has a slight performance disadvantage in terms of + required -bit multiplications in comparison to the classical Karatsuba algorithm (11% ! #"¨$ for and 33% ! #" for ), but there are considerable benefits: First, the number segments of that the polynomials are divided into is not limited to be a power of two, but can be any natural number when the MSK scheme is applied. With respect to a HW implementation this provides more flexibility concerning the selection of system parameters. Like stated before, segment counts in range E JBþ4@\–\–@PR the provide the best results; a fact that can be uniquely exploited by the MSK approach. Second, each time an additional level of recursion unrolling is applied to the classical Karatsuba algorithm, two new patterns occur in the multiplication scheme, whose size is growing exponentially by a factor of 2 (compare Fig. 2.5 to Fig. 2.4b.) In contrast, for any of value the number of different patterns will exceedþ never in case of the MSK scheme. This fact allows the efficient multiplication of polynomials of different degrees on the same datapath: If, e.g., the underlying supports datapath any& œ" segments, scheme x Õ for can be performed just by modification of the controller which is running the MSK algorithm.
Page 1 and 2: Fachbereich Informatik Integrierte
Page 3 and 4: Contents List of Figures iv 1 Intro
Page 5 and 6: List of Figures c)! #"%$ d)& #"'$ 2
Page 7 and 8: 1.2. PREVIOUS WORK 2 of dividing a
Page 9 and 10: Chapter 2 Mathematical Background T
Page 11 and 12: Ymonpn _ #qkr9;=stPuiY[ v l _ wr9xK
Page 13 and 14: 2.2. FINITE FIELD ARITHMETIC 8 k P
Page 15 and 16: 2.2.4 Addition in-·‰¸º¹ » 2
Page 17 and 18: Ì Ì Ì Ì Ì Ì Ì Ì Ì Ì Ì Ì
Page 19 and 20: 2.3. SEQUENTIAL MULTIPLICATION SCHE
Page 21: 6 v |!6 v 3 5 3 î 8 ¾ v Yg5 î 8
Page 25 and 26: 3.2. REGISTER FILE 20 3.2 Register
Page 27 and 28: 3.4. FINITE FIELD ARITHMETIC 22 3.4
Page 29 and 30: Ì Ì Ì Ì Ì 3.4. FINITE FIELD AR
Page 31 and 32: 3.6. EVALUATION SOFTWARE 26 used fo
Page 33 and 34: 4.2. XILINX XCV405E 28 implementati
Page 35 and 36: Chapter 5 Conclusions and Outlook 5
Page 37 and 38: Bibliography [1] National Institute
Page 39 and 40: Ô Ô bY©®v @ | ò 6 6 Y©® v
Page 41: 3 m°e'Ỹ %jijY l Y Ym°5 l l $ƒm

FPGA based Hardware Accleration for Elliptic Curve Cryptography ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?