Batch binary Edwards. D. J. Bernstein University of Illinois at Chicago NSF ITR

Size: px

Start display at page:

Download "Batch binary Edwards. D. J. Bernstein University of Illinois at Chicago NSF ITR"

Brianna Smith
5 years ago
Views:

1 Batch binary Edwards D. J. Bernstein University of Illinois at Chicago NSF ITR

2 Nonnegative elements of Z: etc. 0 meaning 0 1 meaning meaning meaning meaning meaning meaning meaning meaning meaning meaning Addition: = Multiplication: 2 2 = 2 +.

3 Elements of F 2 [Ø]: etc. 0 meaning 0 1 meaning Ø 0 10 meaning Ø 1 11 meaning Ø 0 + Ø meaning Ø meaning Ø 0 + Ø meaning Ø 1 + Ø meaning Ø 0 + Ø 1 + Ø meaning Ø meaning Ø 0 + Ø meaning Ø 1 + Ø 3 Addition: Ø + Ø = 0. Multiplication: Ø Ø = Ø +.

4 Modular arithmetic in Z: e.g., Z 12 = with +, reduced mod 12. Modular arithmetic in F 2 [Ø]: e.g., F 2 [Ø] (Ø 4 + Ø) = 0 1 Ø 3 + Ø 2 + Ø + 1 with +, reduced mod Ø 4 + Ø. Primes of Z: Primes of F 2 [Ø]: Ø Ø + 1 Ø 2 + Ø + 1 Ø 3 + Ø + 1. Can build finite fields from arithmetic modulo primes. e.g. Z ( ). e.g. F 2 [Ø] (Ø Ø + 1).

5 Many decades of literature have explored number-theoretic analogies between Z and F 2 [Ø]. Often F 2 [Ø] is simpler than Z. e.g. Breaking F 2 [Ø] RSA is much faster than breaking Z RSA. Fastest known algorithm to compute prime factors of a -bit element of Z: worst-case time Ó(1). Fastest known algorithm to compute prime factors of a -bit element of F 2 [Ø]: time 2 (+Ó(1))lg with 2.

6 In some cryptographic contexts, F 2 [Ø] and Z have same security. e.g. Message authentication using shared secret key. Take = Z ( ) or = F 2 [Ø] (Ø Ø + 1). Message Ñ ¾ [Ü]. One-time key (Ö ) ¾ 2 : use for only one message! Authenticator + ÖÑ(Ö) ¾. Standard security proof µ chance of successful forgery # attack bits.

7 Hardware designers prefer F 2 [Ø] because its costs are lower for the same security level. Example: GMAC, inside GCM. Lack of carries (Ø + Ø = 0) makes addition and multiplication smaller and faster; also makes squaring much smaller and faster.

8 Hardware designers prefer F 2 [Ø] because its costs are lower for the same security level. Example: GMAC, inside GCM. Lack of carries (Ø + Ø = 0) makes addition and multiplication smaller and faster; also makes squaring much smaller and faster. But software is different! For many years, Z has held crypto software speed records. Examples: Poly1305, UMAC.

9 Why is Z faster than F 2 [Ø]? Standard answer: CPUs are designed for video games, movie decompression, etc. These applications rely heavily on multiplication in Z. CPUs devote large area to Z multiplication circuits, speeding up these applications. Conventional wisdom: Advantages of F 2 [Ø] are outweighed by speed of CPU s built-in Z multipliers, especially big 64-bit multipliers.

10 Next generation of Intel CPUs devote some circuit area to F 2 [Ø] multiplier PCLMULQDQ. Maybe still slower than Z, but maybe fast enough to make F 2 [Ø] set new speed records for some crypto applications.

11 Next generation of Intel CPUs devote some circuit area to F 2 [Ø] multiplier PCLMULQDQ. Maybe still slower than Z, but maybe fast enough to make F 2 [Ø] set new speed records for some crypto applications. This talk: New speed records for elliptic-curve cryptography on current Intel CPUs. These records use F 2 [Ø].

12 User: busy server bottlenecked by public-key cryptography. Throughput: tens of thousands of Ò È ÒÈ per second. Latency: a few milliseconds. Software handles input batch (Ò 1 È 1 ) (Ò 2 È 2 ) (Ò 128 È 128 ). No need for related inputs. Security level: 2 128, assuming standard conjectures; twist-secure; constant-time. Free software: binary.cr.yp.to

13 New software is bitsliced. Advantage: low-cost shifts. Disadvantage: high-cost branches. Low-cost shifts allow very fast squarings, reductions. Low-cost shifts minimize overhead for Karatsuba etc. See paper for details of improved Karatsuba, Toom; often 20% fewer operations than previous literature.

14 What about branches? 2007 Bernstein Lange: The Edwards addition law Ü 3 = Ü 1Ý 2 + Ý 1 Ü Ü 1 Ü 2 Ý 1 Ý 2, Ý 3 = Ý 1Ý 2 Ü 1 Ü 2 1 Ü 1 Ü 2 Ý 1 Ý 2. works for all inputs on the Edwards curve Ü 2 + Ý 2 = 1 + Ü 2 Ý 2 over Z Ô if is non-square in Z Ô. Also extremely fast.

15 Completeness helps against various side-channel attacks; simplifies implementations; and helps bitslicing. Same for binary curves?

16 Completeness helps against various side-channel attacks; simplifies implementations; and helps bitslicing. Same for binary curves? 2008 B. L. Rezaeian Farashahi: Fast complete addition on binary Edwards curve (Ü+Ü 2 +Ý+Ý 2 ) = (Ü+Ü 2 )(Ý+Ý 2 ) over field F 2 [Ø] ( ) if Ü 2 + Ü + has no roots.

17 Continuing work on fast F 2 [Ø]: 1. Subfield applications. Maybe 1 5 faster ECC? 2. Genus-2 applications. Maybe 1 5 faster than ECC? 3. Better code scheduling. Maybe 2 faster? 4. Other curve applications; e.g., faster ECC2K Other crypto applications; e.g., faster McEliece.

We should share our secrets

We should share our secrets Shamir secret sharing: how it works and how to implement it Daan Sprenkels hello@dsprenkels.com Radboud University Nijmegen 28 December 2017 Daan Sprenkels We should share our