Speeding scalar multiplication over binary elliptic curves using the new carry-less multiplication instruction

Abstract

The availability of a new carry-less multiplication instruction in the latest Intel desktop processors significantly accelerates multiplication in binary fields and hence presents the opportunity for reevaluating algorithms for binary field arithmetic and scalar multiplication over elliptic curves. We describe how to best employ this instruction in field multiplication and the effect on performance of doubling and halving operations. Alternate strategies for implementing inversion and half-trace are examined to restore most of their competitiveness relative to the new multiplier. These improvements in field arithmetic are complemented by a study on serial and parallel approaches for Koblitz and random curves, where parallelization strategies are implemented and compared. The contributions are illustrated with experimental results improving the state-of-the-art performance of halving and doubling-based scalar multiplication on NIST curves at the 112- and 192-bit security levels and a new speed record for side-channel-resistant scalar multiplication in a random curve at the 128-bit security level. The algorithms presented in this work were implemented on Westmere and Sandy Bridge processors, the latest generation Intel microarchitectures.

Citation

@article{taverne_jcen2011,
  author = {Jonathan Taverne and
            Armando Faz-Hernández and
            Diego F. Aranha and
            Francisco Rodríguez-Henríquez and
            Darrel Hankerson and
            Julio López},
  title = {Speeding scalar multiplication over binary elliptic curves using the new carry-less multiplication instruction},
  journal = {Journal of Cryptographic Engineering},
  volume = {1},
  number = {3},
  pages = {187--199},
  year = {2011},
  month = {sep},
  doi = {10.1007/S13389-011-0017-8}
}