1 Montgomery Modular Multiplication in Hard- ware

FEI KEMT
the ECC instead of the RSA or DSA [56] lies in the fact that the length of key
can be much shorter. The best known algorithm for solving the elliptic curve dis-
crete logarithm problem (ECDLP) takes fully exponential time, while the algorithms
for the integer factorization problem and the discrete logarithm problem take sub-
exponential time. The comparison of key length for equivalent security level is
presented in Table 1 – 1 [91].
Table 1 – 1 Comparison of the key length (in bits) for equivalent security level for public-key
cryptosystems
Security (bits) DSA RSA ECC
80 1024 1024 160-223
112 2048 2048 224-255
128 3072 3072 256-383
192 7680 7680 384-511
256 15360 15360 512+
The fundamental and most expensive operation underlying ECC is a point multi-
plication, which is defined over field operations. For a point P and a positive integer
k, the point multiplication kP is defined by adding k-times the point P to itself:
kP = P + . . . + P
� �� �
k
. (1.16)
Various algorithms have been proposed for more efficient computation of the point
multiplication taking into account a fixed or unknown point P .
The EC over F denoted as E is a curve that is given by an equation of the
following form:
where E must be smooth.
E : y 2 + a1xy + a3y = x 3 + a2x 2 + a4x + a6 , (ai ∈ F) (1.17)
We let E(F) denote the set of points (x, y) ∈ F 2 that satisfy this equation, along
with a point at infinity denoted O. If the characteristic of F is neither 2 nor 3, then
the Equation 1.17 can be simplified to the usually used form (so-called Weierstraß
form):
y 2 = x 3 + ax + b . (a, b ∈ F) (1.18)
The condition for smoothness of the curve is, in this case, equals to the requirement
of no multiple roots of the cubic element in the Equation 1.18. This holds if and
only if the discriminant of x 3 + ax + b, which is −(4a 2 ) + 27b 3 , is nonzero.
16