TY - GEN

T1 - Binary edwards curves

AU - Bernstein, Daniel J.

AU - Lange, Tanja

AU - Rezaeian Farashahi, Reza

PY - 2008

Y1 - 2008

N2 - This paper presents a new shape for ordinary elliptic curves over fields of characteristic 2. Using the new shape, this paper presents the first complete addition formulas for binary elliptic curves, i.e., addition formulas that work for all pairs of input points, with no exceptional cases. If n ≥ 3 then the complete curves cover all isomorphism classes of ordinary elliptic curves over . This paper also presents dedicated doubling formulas for these curves using 2M∈+∈6S∈+∈3D, where M is the cost of a field multiplication, S is the cost of a field squaring, and D is the cost of multiplying by a curve parameter. These doubling formulas are also the first complete doubling formulas in the literature, with no exceptions for the neutral element, points of order 2, etc. Finally, this paper presents complete formulas for differential addition, i.e., addition of points with known difference. A differential addition and doubling, the basic step in a Montgomery ladder, uses 5M∈+∈4S∈+∈2D when the known difference is given in affine form.

AB - This paper presents a new shape for ordinary elliptic curves over fields of characteristic 2. Using the new shape, this paper presents the first complete addition formulas for binary elliptic curves, i.e., addition formulas that work for all pairs of input points, with no exceptional cases. If n ≥ 3 then the complete curves cover all isomorphism classes of ordinary elliptic curves over . This paper also presents dedicated doubling formulas for these curves using 2M∈+∈6S∈+∈3D, where M is the cost of a field multiplication, S is the cost of a field squaring, and D is the cost of multiplying by a curve parameter. These doubling formulas are also the first complete doubling formulas in the literature, with no exceptions for the neutral element, points of order 2, etc. Finally, this paper presents complete formulas for differential addition, i.e., addition of points with known difference. A differential addition and doubling, the basic step in a Montgomery ladder, uses 5M∈+∈4S∈+∈2D when the known difference is given in affine form.

KW - Binary fields

KW - Complete addition law

KW - Countermeasures against side-channel attacks

KW - Edwards curves

KW - Elliptic curves

KW - Montgomery ladder

UR - http://www.scopus.com/inward/record.url?scp=51049085112&partnerID=8YFLogxK

U2 - 10.1007/978-3-540-85053-3_16

DO - 10.1007/978-3-540-85053-3_16

M3 - Conference proceeding contribution

AN - SCOPUS:51049085112

SN - 354085052X

SN - 9783540850526

VL - 5154 LNCS

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 244

EP - 265

BT - Cryptographic Hardware and Embedded Systems - CHES 2008 - 10th International Workshop, Proceedings

A2 - Oswald, Elisabeth

A2 - Rohatgi, Pankaj

T2 - 10th International Workshop on Cryptographic Hardware and Embedded Systems, CHES 2008

Y2 - 10 August 2008 through 13 August 2008

ER -