×

Efficient hardware implementation of finite fields with applications to cryptography. (English) Zbl 1105.12003

This survey should be seen as complementary of another paper of four of the authors of this paper dedicated to the topic of Software Implementation of Finite Fields Arithmetic and published in the same issue of the same journal.
In both cases the authors follow the same scheme: they consider the three types of fields, binary fields, prime fields and extensions fields, and in each one of the cases they survey the existing algorithms for finite field Addition, Multiplication and Inversion, always thinking in architectures “specially suitable for cryptographic applications”.
The Introduction (Section 1) analyzes the influence of the development of Public Key Cryptography in the work on architectures for finite fields arithmetic and how performance gains in the computation of such arithmetic operations (in particular the modular exponentiation) “directly affect the performance of the entire cryptosystem”.
The paper is interested in the area and time complexity of the different architectures and points out that the choice of one or another of them will depend on the computational constraints of the platform to be used (specially in the case of devices with small memory and computation capability such as smart cards and RIFD tags).
Section 2 studies the case of prime fields \(\mathbb{F}_p\), describing the different Adders (ripple-carry adders, carry-lookahead adders, carry-save adders and carry-delayed adders), Multipliers (parallel and sequential algorithms, interleaved modular multiplication, Montgomery and Barret modular multiplication), etc.
Section 3 discusses the several types of basis of an extension of fields: polynomial, normal and dual basis, although in the rest of the paper the elements will be represented in a polynomial base \(\{1, \alpha,\dots, \alpha^{m-1}\}\). The hardware implementation techniques for binary field extension are reviewed in Section 4 (bit multipliers, digit multipliers and single-accumulator multipliers), while Section 5 studies the case of fields \(\mathbb{F}_{p^n}\). The case \(p=3\), due to its cryptographic applications, deserves particular attention.
Finally Section 6 summarizes the generalization (to extension fields with a polynomial basis representation) due to two of the authors of the present paper [see J. Guarjardo and C. Paar, Des. Codes Cryptogr. 25, No. 2, 207–216 (2002; Zbl 1030.11070)] of the Itoh-Tsujii algorithm [T. Itoh and S. Tsujii, Inf. Comput. 78, 171–177 (1988; Zbl 0672.68015)], for computing the inverse of a non-zero element in \(\mathbb{F}_{2^n}\) when using a normal basis representation.

MSC:

12Y05 Computational aspects of field theory and polynomials (MSC2010)
12-02 Research exposition (monographs, survey articles) pertaining to field theory
12E30 Field arithmetic
12E10 Special polynomials in general fields
11Y99 Computational number theory
94A60 Cryptography

Software:

Xilinx
Full Text: DOI

References:

[1] Actel Corporation: Actel’s ProASIC family, the only ASIC design flow FPGA. (2001)
[2] Altera Corporation: APEX 20KC programmable logic device data sheet. (2001)
[3] Amanor, D.N., Paar, C., Pelzl, J., Bunimov, V., Schimmler, M.: Efficient hardware architectures for modular multiplication on FPGAs. In: 2005 International Conference on Field Programmable Logic and Applications (FPL), Tampere, Finland, pp. 539–542. IEEE Circuits and Systems Society, Piscataway, New Jersey, August 2005
[4] Barrett, P.: Implementing the Rivest, Shamir and Adleman public-key encryption algorithm on standard digital signal processor. In: Odlyzko, A.M. (ed.) Advances in Cryptology – CRYPTO’86. LNCS, vol. 263, pp. 311–323. Springer, Berlin Heidelberg New York (1987)
[5] Boneh, D., Franklin, M.: Identity-Based Encryption from the Weil Pairing. In: Kilian, J. (ed.) Advances in Cryptology – CRYPTO 2001. LNCS, vol. 2139, pp. 213–229. Springer, Berlin Heidelberg New York (2001) · Zbl 1002.94023
[6] Bertoni, G., Guajardo, J., Kumar, S.S., Orlando, G., Paar, C., Wollinger, T.J.: Efficient GF(p m ) arithmetic architectures for cryptographic applications. In: Joye, M. (ed.) Topics in Cryptology – CT-RSA 2003. LNCS, vol. 2612, pp. 158–175. Springer, Berlin Heidelberg New York (2003) · Zbl 1039.68508
[7] Blake, I.F., Gao, S., Lambert, R.J.: Constructive problems for irreducible polynomials over finite fields. In: Gulliver, T.A., Secord, N.P. (eds.) Information Theory and Applications LNCS, vol 793, pp. 1–23. Springer, Berlin Heidelberg New York (1993) · Zbl 0894.11049
[8] Bertoni, G., Guajardo, J., Orlando, G.: Systolic and scalable architectures for digit-serial multiplication in fields GF(p m ). In: Johansson, T., Maitra, S. (eds.) Progress in Cryptology – INDOCRYPT 2003. LNCS, vol. 2904, pp. 349–362. Springer, Berlin Heidelberg New York (2003) · Zbl 1123.68300
[9] Bajard, J.-C., Imbert, L., Nègre, C., Plantard, T.: Efficient multiplication in GF(p k ) for elliptic curve cryptography. In: Bajard, J.-C., Schulte, M. (eds.) Proceedings of the 16th IEEE Symposium on Computer Arithmetic (ARITH-16), pp. 181–187. Santiago de Compostela, Spain, 15–18 June 2003
[10] Bucek, J., Lorencz, R.: Comparing subtraction-free and traditional AMI. In: Proceedings of the 9th IEEE Workshop on Design & Diagnostics of Electronic Circuits & Systems (DDECS 2006), Prague, Czech Republic, 18–21 April 2006. pp. 97–99. IEEE Computer Society, Los Alamitos, CA, USA (2006)
[11] Blakley, G.R.: A computer algorithm for calculating the product A {\(\cdot\)} B modulo M. IEEE Trans. Comput. C-32(5), 497–500 (1983) · Zbl 0522.68045 · doi:10.1109/TC.1983.1676262
[12] Batina, L., Ors, S.B., Preneel, B., Vandewalle, J.: Hardware architectures for public key cryptography. Integration, VLSI J. 34(6), 1–64 (2003) · doi:10.1016/S0167-9260(02)00053-6
[13] Bailey, D.V., Paar, C.: Optimal extension fields for fast arithmetic in public-key algorithms. In: Krawczyk, H. (ed.) Advances in Cryptology – CRYPTO ’98. LNCS, vol. 1462, pp. 472–485. Springer, Berlin Heidelberg New York (1998) · Zbl 0945.11025
[14] Bailey, D.V., Paar, C.: Efficient arithmetic in finite field extensions with application in elliptic curve cryptography. J. Cryptology 14(3), 153–176 (2001) · Zbl 1050.11100
[15] Bunimov, V., Schimmler, M.: Area and time efficient modular multiplication of large integers. In: IEEE 14th International Conference on Application-specific Systems, Architectures and Processors, The Hague, The Netherlands June 2003
[16] Bunimov, V., Schimmler, M., Tolg, B.: A complexity-effective version of montgomery’s algorithm. In: Workshop on Complexity Effective Designs, ISCA’02, Anchorage, Alaska, May 2002
[17] Di Claudio, E.D., Piazza, F., Orlandi, G.: Fast combinatorial RNS processors for DSP applications. IEEE Trans. Comput. 44(5), 624–633 (1995) · Zbl 1041.68502 · doi:10.1109/12.381948
[18] Chung, J.W., Sim, S.G., Lee, P.J.: Fast implementation of elliptic curve defined over GF(p m ) on CalmRISC with MAC2424 coprocessor. In: Koç, Ç.K., Paar, C. (eds.) Workshop on Cryptographic Hardware and Embedded Systems – CHES, 17–18 August 2000. LNCS, vol. 1965, pp. 57–70. Springer, Berlin Heidelberg New York (2000) · Zbl 0998.68654
[19] De Win, E., Bosselaers, A., Vandenberghe, S., De Gersem, P., Vandewalle, J.: A fast software implementation for arithmetic operations in GF(2 n ). In: Kim,K., Matsumoto, T. (eds.)Advances in Cryptology – ASIACRYPT ’96. Lecture Notes in Computer Science, vol. 1163, pp. 65–76. Springer, Berlin Heidelberg New York (November 1996) · Zbl 1005.94535
[20] Diffie, W., Hellman, M.E.: New directions in cryptography. IEEE Trans. Inform. Theory IT-22(6), 644–654 (1976) · Zbl 0435.94018 · doi:10.1109/TIT.1976.1055638
[21] Diffie, W.: Subject: Authenticity of non-secret encryption documents. Available at http://cryptome.org/ukpk-diffie.htm . October 6, 1999 (Email message sent to John Young)
[22] Daly, A., Marnane, L., Popovici, E.: Fast modular inversion in the montgomery domain on reconfigurable logic. Technical report, University College Cork, Ireland (2003)
[23] Ellis, J.H.: The story of non-secret encryption. Available at http://jya.com/ellisdoc.htm (December 16, 1997)
[24] Galbraith, S.D., Harrison, K., Soldera, D.: Implementing the Tate pairing. In: Fieker, C., Kohel, D. (eds.) AlgorithmicNumber Theory –ANTS-V, LNCS, vol. 2369, pp. 324–337. Springer, Berlin Heidelberg New York (2002) · Zbl 1058.11072
[25] Golomb, S.W.: Shift Register Sequences. Holden-Day, San Francisco, USA (1967) · Zbl 0267.94022
[26] Guajardo, J., Paar, C.: Efficient algorithms for elliptic curve cryptosystems. In: Kaliski Jr., B. (ed.) Advances in Cryptology – CRYPTO ’97, Lecture Notes in Computer Science, vol. 1294, pp. 342–356. Springer, Berlin Heidelberg New York (August 1997) · Zbl 0937.94009
[27] Guajardo, J., Paar, C.: Itoh–Tsujii inversion in standard basis and its application in cryptography and codes. Des. Codes Cryptogr. 25(2), 207–216 (2002) · Zbl 1030.11070 · doi:10.1023/A:1013860532636
[28] Geiselmann, W., Steinwandt, R.: A redundant representation of GF(q n ) for designing arithmetic circuits. IEEE Trans. Comput. 52(7), 848–853 (2003) · Zbl 1192.11081 · doi:10.1109/TC.2003.1214334
[29] Gutub, A.A., Tenca, A.F., Koc, C.K.: Scalable VLSI architecture for GF(p) Montgomery modular inverse computation. In: Naccache, D. (ed.) IEEE Computer Society Annual Symposium on VLSI, pp. 53–58. IEEE Computer Society Press, Los Alamitos, California (2002)
[30] Guajardo Merchan, J.: Arithmetic architectures for finite fields GF(p m ) with cryptographic applications. PhD thesis, Ruhr-Universität Bochum, Germany (Available at http://www.crypto.rub.de/theses.html ) (July 2004)
[31] Guajardo, J., Wollinger, T., Paar, C.: Area efficient GF(p) architectures for GF(p m ) multipliers. In: Proceedings of the 45th IEEE International Midwest Symposium on Circuits and Systems – MWSCAS 2002, Tulsa, Oklahoma, August 2002 · Zbl 1039.68508
[32] Itoh, T., Tsujii, S.: A fast algorithm for computing multiplicative inverses in GF(2 m ) using normal bases. Comput. Inf. 78, 171–177 (1988) · Zbl 0672.68015 · doi:10.1016/0890-5401(88)90024-7
[33] Jullien, G.A.: Residue number scaling and other operations using ROM arrays. IEEE Trans. Comput. C-27, 325–337 (1978) · Zbl 0379.68045 · doi:10.1109/TC.1978.1675105
[34] Kaliski, B.S.: The montgomery inverse and its applications. IEEE Trans. Comput. 44(8), 1064–1065 (1995) · Zbl 1031.68500 · doi:10.1109/12.403725
[35] Koç, Ç.K., Hung, C.Y.: Bit-level systolic arrays for modular multiplication. J. VLSI Signal Process. 3(3), 215–223 (1991) · doi:10.1007/BF00925832
[36] Knuth, D.E.: The Art of Computer Programming, Seminumerical Algorithms, vol. 2. Addison-Wesley, Reading, Massachusetts (November 1971)(2nd printing) · Zbl 0191.18001
[37] Knuth, D.E.: The Art of Computer Programming: Seminumerical Algorithms, vol, 2nd edn. Addison-Wesley, Massachussetts, USA (1973) · Zbl 0191.18001
[38] Karatsuba, A., Ofman, Y.: Multiplication of multidigit numbers on automata. Sov. Phys. Dokl. 7, 595–596 (1963) (English translation)
[39] Koblitz, N.: Elliptic curve cryptosystems. Math. Comput. 48(177), 203–209 (1987) · Zbl 0622.94015 · doi:10.1090/S0025-5718-1987-0866109-5
[40] Koblitz, N.: Hyperelliptic cryptosystems. J. Cryptology 1(3), 129–150 (1989) · Zbl 0674.94010 · doi:10.1007/BF02252872
[41] Koblitz, N.: An elliptic curve implementation of the finite field digital signature algorithm. In: Krawczyk, H. (ed.) Advances in Cryptology – CRYPTO 98. LNCS, vol. 1462, pp. 327–337. Springer, Berlin Heidelberg New York (1998) · Zbl 0971.94012
[42] Koren, I.: Computer Arithmetic Architectures. Prentice-Hall, New Jersey (1993)
[43] Lidl, R., Niederreiter, H.: Finite fields. In: Encyclopedia of Mathematics and its Applications, vol 20, 2nd edn. Cambridge University Press, Great Britain (1997) · Zbl 1139.11053
[44] Loidreau, P.: On the factorization of trinomials over F 3. Rapport de recherche no. 3918, INRIA (April 2000)
[45] Lenstra, A., Verheul, E.: The XTR public-key cryptosystem. In: Bellare, M. (ed.) Advances in Cryptology – CRYPTO 2000. LNCS, vol. 1423, pp. 1–19. Springer, Berlin Heidelberg New York (2000) · Zbl 0995.94538
[46] Mihăilescu, P.: Optimal Galois Field Bases which are not Normal. Recent Results Session – FSE ’97 (1997)
[47] Miller, V.S.: Use of elliptic curves in cryptography. In: Williams, H.C. (ed.) Advances in cryptology – CRYPTO ’85. Lecture Notes in Computer Science, vol. 218, pp. 417–426. Springer, Berlin Heidelberg New York (August 1986)
[48] Morii, M., Kasahara, M., Whiting, D.L.: Efficient bit-serial multiplication and discrete-time Wiener–Hoph equation over finite fields. IEEE Trans. Inform. Theory, IT-35, 1177–1184 (1989) · Zbl 0694.94024 · doi:10.1109/18.45274
[49] Montgomery, P.L.: Modular multiplication without trial division. Math. Comput. 44(170), 519–521 (1985) · Zbl 0559.10006 · doi:10.1090/S0025-5718-1985-0777282-X
[50] Montgomery, P.L.: Modular multiplication without trial division. Math. Comput. 44(170), 519–521 (1985) · Zbl 0559.10006 · doi:10.1090/S0025-5718-1985-0777282-X
[51] Menezes, A.J., van Oorschot, P.C., Vanstone, S.A.: Handbook of Applied Cryptography. The CRC Press Series on Discrete Mathematics and Its Applications. CRC, Florida, USA (1997) · Zbl 0868.94001
[52] National Institute for Standards and Technology: FIPS 186-2: Digital Signature Standard (DSS)186-2. Gaithersburg, Maryland, USA (Available for download at http://csrc.nist.gov/encryption ) ( February 2000)
[53] Norris, M.J., Simmons, G.J.: Algorithms for high-speed modular arithmetic. Congressus Numeratium 31, 153–163 (1981) · Zbl 0514.68091
[54] Oo, J.Y., Kim, Y.-G., Park, D.-Y., Kim, H.-S.: Efficient multiplier architecture using optimized irreducible polynomial over GF((3 n )3). In: Proceedings of the IEEE Region 10 Conference – TENCON 99. Multimedia Technology for Asia-Pacific Information Infrastructure, vol. 1, pp. 383–386, Cheju, Korea (1999)
[55] Parhami, B.: Computer Arithemtic – Algorithms and Hardware Designs. Oxford University Press, New York, USA (1999)
[56] Parker, M.G., Benaissa, M.: GF(p m ) multiplication using polynomial residue number systems. IEEE Trans. Circuits Syst., 2 Analog Digit. Signal Process. 42(11), 718–721 (1995) · doi:10.1109/82.475249
[57] Paliouras, V., Karagianni, K., Stouraitis, T.: A low-complexity combinatorial RNS multiplier. IEEE Trans. Circuits Systems I. Fund., 2 Analog Digit. Signal Process. 48(7), 675–683 (2001) · Zbl 1011.94031 · doi:10.1109/82.958337
[58] Smith, P., Skinner, C.: A public-key cryptosystem and a digital signature system based on the lucas function analogue to discrete logarithms. In: Pieprzyk, J., Safavi-Naini, R. (eds.) Advances in Cryptology – ASIACRYPT’94. LNCS, vol. 917, pp. 357–364. Springer, Berlin Heidelberg New York(1995) · Zbl 0872.94041
[59] Page, D., Smart, N.P.: Hardware implementation of finite fields of characteristic three. In: Kaliski Jr., B.S., Koç, Ç.K., Paar, C. (eds.) Workshop on Cryptographic Hardware and Embedded Systems – CHES 2002. LNCS, vol. 2523, pp. 529–539. Springer, Berlin Heidelberg New York (2002) · Zbl 1028.68003
[60] Rivest, R.L., Shamir, A., Adleman, L.: A method for obtaining digital signatures and public-key cryptosystems. Commun. ACM 21(2), 120–126 (1978) · Zbl 0368.94005 · doi:10.1145/359340.359342
[61] Radhakrishnan, D., Yuan, Y.: Novel approaches to the design of VLSI RNS multipliers. IEEE Trans. Circuits Syst., 2 Analog Digit. Signal Process 39(1), 52–57 (1992) · Zbl 0776.11072 · doi:10.1109/82.204109
[62] Schneier, B.: Crypto-Gram newsletter. (available at http://www.schneier.com/crypto-gram-9805.html ) May 15, 1998
[63] Sloan, K.R.: Comments on a computer algorithm for calculating the product A {\(\cdot\)} B modulo M. IEEE Trans. Comput. C-34(3), 290–292 (1985) · doi:10.1109/TC.1985.1676574
[64] Smart, N.: Elliptic curve cryptosystems over small fields of odd characteristic. J. Cryptology. 12(2), 141–151 (1999) · Zbl 0938.94008 · doi:10.1007/PL00003820
[65] Song, L., Parhi, K.K.: Low energy digit-serial/parallel finite field multipliers. J. VLSI Signal Process. 19(2), 149–166 (1998) · doi:10.1023/A:1008013818413
[66] Soudris, D.J., Paliouras, V., Stouraitis, T., Goutis, C.E.: A VLSI design methodology for RNS full adder-based inner product architectures. IEEE Trans. Circuits Syst., 2 Analog Digit. Signal Process. 44(4), 315–318 (1997) · doi:10.1109/82.566648
[67] Szabó, N., Tanaka, R.: Residue Arithmetic and its Applications to Computer Technology, McGraw-Hill, New York (1967) · Zbl 0168.15303
[68] Skavantzos, A., Taylor, F.J.: On the polynomial residue number system. IEEE Trans. Signal Process. 39, 376–382 (1991) · Zbl 0719.65012 · doi:10.1109/78.80821
[69] Takagi, N.: A VLSI algorithm for modular division based on the binary GCD algorithm. In: IEICE TRANSACTIONS on Fundamentals of Electronics, Communications and Computer Sciences, vol. E81-A, pp. 724–728 (1998)
[70] Tenca, A.F., Koç, Ç.K.: A scalable architecture for montgomery multiplication. In: Koç, Ç.K., Paar, C. (eds.) Workshop on Cryptographic Hardware and Embedded Systems – CHES’99. LNCS, vol. 1717 pp. 94–108. Springer, Berlin Heidelberg New York 12–13 August 1999 · Zbl 0955.68006
[71] Tawalbeh, L.A., Tenca, A.F., Park, S., Koc, C.K.: A dual-field modular division algorithm and architecture for application specific hardware. In: Thirty-Eighth Asilomar Conference on Signals, Systems, and Computers, vol. 1, pp. 483–487. Pacific Grove, California (2004)
[72] von zur Gathen, J.: Irreducible trinomials over finite fields. In: Mourrain, B. (ed.) Proceedings of the 2001 International Symposium on Symbolic and Algebraic Computation – ISSAC2001, pp. 332–336. ACM, New York (2001) · Zbl 1083.11078
[73] von zur Gathen, J., Nöcker, M.: Exponentiation in finite fields: theory and practice. In: Mora, T., Mattson, H. (eds.) Applied Algebra, Agebraic Algorithms and Error Correcting Codes – AAECC-12. LNCS, vol. 1255, pp. 88–113. Springer, Berlin Heidelberg New York (2000) · Zbl 1039.11515
[74] Walter, C.D.: Logarithmic speed modular multiplication. Electron. Lett. 30(17), 1397–1398 (1994) · doi:10.1049/el:19940969
[75] Wang, M., Blake, I.F.: Bit serial multiplication in finite fields. SIAM J. Discrete Math. 3(1), 140–148 (1990) · Zbl 0696.12014 · doi:10.1137/0403012
[76] Wu, H., Hasan, M.A., Blake, I.F.: Low complexity parallel multiplier in \(F_{q^n}\) over F q . IEEE Trans. Circuits Systems 1, Fund. Theory Appl. 49(7), 1009–1013 (2002) · doi:10.1109/TCSI.2002.800836
[77] Xilinx, Inc.: The Programmable Logic Data Book (2000)
[78] Zierler, N., Brillhart, J.: On primitive trinomials \((\bmod 2)\) . Inf. Control 13, 541–554 (1968) · Zbl 0165.06503 · doi:10.1016/S0019-9958(68)90973-X
[79] Zierler, N., Brillhart, J.: On primitive trinomials \((\bmod 2)\) , II. Inf. Control 14, 566–569 (1969) · Zbl 0184.07705 · doi:10.1016/S0019-9958(69)90356-8
[80] Zierler, N.: On x n + x + 1 over GF(2). Inf. Control 16, 67–69 (1970) · Zbl 0205.35503 · doi:10.1016/S0019-9958(70)90264-0
This reference list is based on information provided by the publisher or from digital mathematics libraries. Its items are heuristically matched to zbMATH identifiers and may contain data conversion errors. In some cases that data have been complemented/enhanced by data from zbMATH Open. This attempts to reflect the references listed in the original paper as accurately as possible without claiming completeness or a perfect matching.