A Comparison on FPGA of Modular Multipliers Suitable for Elliptic Curve Cryptography over GF(p) for Specific p Values

Transcription

1 A Compariso o FPGA of Modular Multipliers Suitable for Elliptic Curve Cryptography over GF(p) for Specific p Values Mark Hamilto, William Marae, Araud Tisserad To cite this versio: Mark Hamilto, William Marae, Araud Tisserad. A Compariso o FPGA of Modular Multipliers Suitable for Elliptic Curve Cryptography over GF(p) for Specific p Values. 21st Iteratioal Coferece o Field Programmable Logic ad Applicatios (FPL), Sep 2011, Chaia, Greece. IEEE, pp , 2011, < /FPL >. <iria > HAL Id: iria Submitted o 17 Oct 2011 HAL is a multi-discipliary ope access archive for the deposit ad dissemiatio of scietific research documets, whether they are published or ot. The documets may come from teachig ad research istitutios i Frace or abroad, or from public or private research ceters. L archive ouverte pluridiscipliaire HAL, est destiée au dépôt et à la diffusio de documets scietifiques de iveau recherche, publiés ou o, émaat des établissemets d eseigemet et de recherche fraçais ou étragers, des laboratoires publics ou privés.

2 st Iteratioal Coferece o Field Programmable Logic ad Applicatios A Compariso o FPGA of Modular Multipliers Suitable for Elliptic Curve Cryptography over GF(p) for Specific p Values Mark Hamilto, William P. Marae Claude Shao Istitute for Discrete Mathematics, Codig ad Cryptography Departmet of Electrical & Electroic Egieerig Uiversity College Cork, Irelad {markh,liam}@eleceg.ucc.ie Araud Tisserad IRISA, CNRS, INRIA, Cetre Rees - Bretage Atlatique, Uiversité Rees 1, 6 rue Kérampot, Laio, FRANCE araud.tisserad@irisa.fr Abstract I this paper we provide a compariso of differet modular multipliers suitable for use i a elliptic curve processor, whe workig with a Mersee prime modulus. Mersee primes allow for the use of fast modular reductio techiques. Several multipliers are preseted that ca be implemeted solely i slice logic. A desig that makes use of the DSP48E blocks o Virtex 5 FPGAs is also described. The differet multipliers are compared for speed, area ad power cosumptio whe implemeted o a Virtex 5 FPGA. Keywords: FPGA, Hiasat Multiplier, Elliptic Curve Processor, Mersee prime, Modular Multiplicatio. I. INTRODUCTION The modular multiplier i a elliptic curve processor is geerally the compoet that determies the critical path of the desig. A very basic method for computig a sigle modular multiplicatio is to perform a full width multiplicatio ad the reduce the result mod p. The reductio step is computatioally itesive as it requires more or less the divisio of two umbers. Durig a modular expoetiatio the reductio would have to be performed after each multiplicatio, this method would be too slow to be used for Elliptic Curve Cryptography (ECC) where the modulus ca be several hudred bits i legth. The Motgomery algorithm [1] is a much more efficiet method as it does ot require the computatioally itesive trial divisio operatios. A alterative to the Motgomery method is to choose a modulus of a special form that support fast modular reductio, such as 2 1, 2 or For ECC the most iterestig form is 2 1 where is a prime umber. This form of umber is kow as a Mersee prime ad there are two such primes that are curretly useful for ECC. I [2], NIST specify a curve over GF(p) with p = as oe of the stadard curves to be used for ECC. I [3], the authors itroduce a method for performig ECC usig a curve defied over the extesio field GF(p 2 ) with p = There are may ways of implemetig a multiplier modulo a Mersee prime. Several desigs were implemeted o a Virtex xc5vlx50 ad a xc5lx220 FPGA ad compared. The xc5vlx50 is the smallest Virtex 5 FPGA that ilix produces. II. MULTIPLIERS FOR MODULO 2 1 MULTIPLICATION I 1992, Hiasat [4] proposed a desig that takes advatage of the fast modular reductio that ca be performed whe workig with moduli of the form 2 ± 1. I the case of 2 1 the multiplicatio ca be performed as follows. If, = = 2 1 i=0 z i 2 i (1) the modular reductio of ca be described as, = z i 2 i + 2 z i 2 i i=0 i= 2 1 where, (2) = (3) This type of multiplier ca be implemeted through the use of a full width multiplier followed by correctio circuitry that performs the modular reductio step. Methods for performig the bit multiplicatio are discussed later i the sectio. The correctio circuitry cosists of simple combiatioal logic. The setup is show i Fig. 1. x bits Figure 1. 2 Correctio Circuitry Hiasat Multiplier 2 1 We have see that the modular reductio step above ca be performed efficietly i hardware. Next we discuss methods for efficietly implemetig the bit multiplicatio show i Fig /11 $ IEEE DOI /FPL

3 A. Serial Multiplier The simplest form of multiplier is oe which implemets a -bit multiplicatio as the sum of partial products, Fig. 2. The multiplier,, is fed ito a shift register ad the least sigificat bit (LSB) is scaed. If the curret bit is a 1, the multiplicad,, is added to a accumulator ad the multiplier is shifted to the right by oe bit positio. If a 0 bit is detected, othig is added to the accumulator ad the multiplier is shifted to the right by oe bit positio, this is represeted by the multiplexer i Fig. 2. This process cotiues util every bit of the multiplier has bee scaed. This method is kow as the schoolbook method for multiplicatio. This form of multiplier requires a sigle -bit adder ad performs the multiplicatio i clock cycles. Fig. 2 shows how the output of the adder feeds ito a shift register that holds the accumulator value. is stored i the LSBs of the accumulator ad shifted right. After clock cycles is completely shifted out of the accumulator ad oly the result of the multiplicatio,, will remai. ca the be fed ito some correctio circuitry to obtai the mod 2 1 result, as show i Fig. 1. The critical path of the desig is the -bit adder. B. Booth Multiplier Figure shift shift Serial Multiplier I 1951 Booth [5] itroduced a multiplicatio algorithm which reduced the umber of additios of partial products to /2, at the cost of some extra hardware. A modified versio of Booth s algorithm was itroduced i [6]. Both algorithms work by precomputig partial products multiples from a certai set. I the case of the modified Booth algorithm the multiples { 2,, 0,, +2} are precomputed. Every multiple i this set ca be calculated by a bitwise shift, a iversio i 2 s complemet or both. For the modified Booth algorithm overlappig groups of 3 bits of the multiplicad must be scaed at a time. For a detailed descriptio of Booth recodig schemes see [7]. The circuit is show i Fig. 3. The critical path of this desig is through the adder ad the circuitry used for the precomputatios. 2 precompute multiples Figure 3. shift shift 2+3 Booth2 Multiplier III. MONTGOMER MULTIPLIER I 1985 Motgomery [1] itroduced a algorithm to efficietly compute the modular product of two umbers. The algorithm is very efficiet whe used for modular expoetiatio as it does ot require computatioally itesive trial divisio operatios. The Motgomery multiplier is oe of the most widely used types of multipliers i elliptic curve processors. This is due to its relatively short critical path ad its ability to be used with a wide rage of differet moduli. Motgomery s method first requires the umbers to be coverted to a N-residue form mod p. The result of a Motgomery multiplicatio will also be i N-residue form. To obtai the correct result the aswer must be coverted back to stadard form. The mai operatio performed i ECC is scalar multiplicatio. From [8] we kow that for this case, the coditioal subtractio at the ed of the Motgomery Multiplicatio algorithm is ot required. Algorithm 1 shows how the Motgomery Multiplicatio is performed without a coditioal subtractio. Algorithm 1: Motgomery Multiplicatio Iput: = k i=0 i 2i, = k i=0 i 2i, p Output: = 2 k+2 (mod p) = 0, y k+1 = 0; for i=1 to k + 2 do q i = i 1 + y i (mod 2) z i = ( i 1 + q i + y i )/2 ed A circuit for performig a Motgomery multiplicatio is show i Fig. 4. The critical path of this desig is through the two adders. shift Figure 4. i 1 Motgomery Multiplier 2 i 274

4 IV. MULTIPLIER WITH AND DSP48ES All of the previous multipliers that have bee discussed ca be implemeted etirely i slice logic o a FPGA. However, FPGAs also cotai large amouts of block RAM ad DSP blocks. Icorporatig these elemets ito the desig of the multiplier ca give a alterative for performig large multiplicatios. I a ilix FPGA, the DSP48E ad based desig uses a umber of DSP48E blocks to calculate the partial products. The partial products are the stored i. A adder ca read from the ad add the partial products. To decrease the umber of clock cycles required to perform a multiplicatio, the umber of DSP48E blocks used ca be icreased. A example of the desig of the multiplier usig four DSP48E blocks is show i Fig. 5. The desig show cosists of four DSP48E blocks, four blocks of ad oe adder. If the umber of DSP48E blocks ad is icreased, the geeral setup of the desig remais the same. decompose & eable partial product select d_ia d_ib d_ia d_ib d_ia d_ib d_ia d_ib cotroller RAM_select recursive_level Figure 5. DSP48E ad based Multiplier Each DSP48E block o a ilix Virtex 5 FPGA is capable of performig a full bit multiplicatio, givig a 48 bit result. However i this desig we oly require the DSP48E blocks to perform bit multiplicatios. To take advatage of the high clock frequecy of these DSP48E blocks, a large multiplicatio must be decomposed recursively util the size of the partial product multiplicatios is bits or less. The maximum frequecy of the desig will ot be limited by the DSP48E blocks but by the critical path of the adder used to sum the partial products. It is possible to pipelie the adder but for large bit legths, achievig a clock frequecy close to that of the DSP blocks is ot possible. The simplest way to decompose the multiplicatio x y, is as follows. Let x ad y be represeted as a biary strig of legth t. To split x ad y ito two equal parts let = t/2, the, x = x H 2 + x L doe y = y H 2 + y L x y = (x H 2 + x L )(y H 2 + y L ) = z a z b 2 + z c (4) where, z a = x H y H, z b = x H y L + x L y H ad z c = x L y L. This method ca be applied recursively to the partial products util the calculatio of z a, z b ad z c cosist of bit, or less, multiplicatios. For each decompositio there are the four partial products that have to be calculated usig the DSP48E blocks, x L y L, x L y H, x H y L ad x H y H. These four partial products must the be summed accordig to Eq. (4). By usig the Karatsuba method for decompositio [9], the umber of multiplicatios required to calculate the partial products ca be reduced from four to three. However this icreases the umber of additios that eed to be performed. Sice the critical path i the desig is through the adder, the previous method for decompositio, Eq. (4), is used. A. Multiplier Operatio The multiplier desig based o DSPE blocks ad is show i Fig. 5. The iputs ad are decomposed by simply routig the correct portios of the array of bits to the multipliers. A multiplexer routes the decomposed ad sigals ito the DSP blocks, to be multiplied. The cotroller determies which partial products are routed to the multipliers at each clock cycle through the use of the partial product select lie. For every DSP48 block i the desig, there is a dual port block RAM ad for every four DSP48E blocks there is a sigle adder. A geerator was writte i C++ to geerate the VHDL code for the multiplier. This was ecessary due to the complexity of decomposig the multiplicads ad also the multiplexer that routes iputs to the DSP48E blocks. The geerator is desiged to take as iputs the bit legth of the multiplicatio ad umber of DSP48E blocks to be used. From these values the geerator produces all the VHDL files ecessary to implemet the multiplier. V. IMPLEMENTATION I order to thoroughly compare the differet multiplier desigs, the circuits were implemeted o a Virtex 5 FPGA ad the power cosumptio measured. The SASEBO- GII evaluatio board [10] is specifically desiged for side chael aalysis experimets o FPGAs, cosequetly the board is also suitable for accurately measurig the power cosumptio of circuits o a FPGA. The board allows for access to the V cc it pi of the FPGA. The V cc it pi of the FPGA is a 1V power lie used oly to power the core of the chip. This is useful for measurig the power cosumptio of a circuit o a FPGA as power to the IO blocks are supplied separately. The resultig value for power cosumptio is that oly of the circuit implemeted o the FPGA. The V cc it pi of the FPGA was coected to a very accurate DC power aalyser. The dyamic power cosumptio of each circuit was measured ad averaged over the period of 30 miutes. Each circuit processed radom data set from the cotrol 275

5 Multiplier Bit Legth Area(slices) Max Freq(MHz) Clk Cycles Throughput Power Cosumptio (Mbits/S) dyamic static (mw) Motgomery Serial Booth DSP (4DSPs) Motgomery Serial Booth *DSP (4DSPs) Table I POWER CONSUMPTION RESULTS FPGA durig this time. The static power cosumptio was also measured while the circuit was ot processig ay data. VI. RESULTS Show i Table IV-A are post place ad route ad power cosumptio measurmet results for a Virtex xc5vlx50-1ff324. The clock speed for all power measuremets is 24MHz. The results for 521-bit DSP circuit, deoted by *, are take from a xc5vlx220 as this circuit cotais too much block RAM to fit o the smaller Virtex xc5vlx50. The area results for the DSP circuits do ot take ito accout the or the DSP48E blocks that are also preset i the circuit. The best results i each category are highlighted i bold. I order to properly route the 521 bit Booth2 circuit, a pipelied desig was used. This allowed the desig to be routed oto the chip without exceedig the legth of the carry chai o the FPGA. The results show that the Motgomery, Booth2 ad Serial multipliers are all closely matched i the power they cosume. The circuits that make use of block RAM ad DSP blocks are capable of performig the multiplicatio much faster tha the other circuits. However the area used by these multipliers is much higher tha the circuits that implemet the multiplicatio i a serial way. The stadard deviatio of the power cosumptio of the Booth2 multiplier was lowest for a bit legth of 127 bits. This low stadard deviatio i power cosumptio would be a desirable property for high security applicatios as it should reduce the risk of the circuit beig susceptible to power aalysis attacks such as those described i [11] ad [12]. For a compariso of ECC algorithms resistat to Simple Power Aalysis attacks see [13]. VII. CONCLUSION We have show a compariso of the performace of various differet multipliers o a Virtex 5 FPGA. The multipliers were compared for area, throughput ad power cosumptio. The results have show that there are may ways of implemetig a modular multiplier o a FPGA, each of which has their ow advatages. The Motgomery multiplier desig has the advatage of beig able to perform modular multiplicatios where the modulus is of a geeral form ad also at very low area. Whe workig with a modulus of special form such as 2 1, the most efficiet desig is a Booth2 multiplier. The Booth2 desig has a low area similar to a serial multiplier but a much higher throughput due to the recodig used. I certai applicatios such as hadlig large amouts of traffic o a etwork, high speed ecryptio is more desirable tha low area or low power desig. I this situatio makig use of the ad DSP48E resources o the FPGA may be a desirable way of implemetig the multiplier i a ECC uit. Implemetig the multiplier i this way also keeps the critical path of the desig relatively short. Performig the full -bit multiplicatio ad reductio i a sigle clock cycle with a fully parallel multiplier would give a very high throughput but also a log critical path. Such a desig might hider operatios elsewhere o the chip if oly oe clock is preset. ACKNOWLEDGMENT This material is based upo works supported by the Sciece Foudatio Irelad uder Grat No. 06/MI/006 ad the Mobility Grat 2010 from the Collège Doctoral Iteratioal of the Uiversité Européee de Bretage. REFERENCES [1] P. Motgomery, Modular multiplicatio without trial divisio, i Mathematics of Computatio, vol. 44, 1985, pp [2] Digital Sigature Stadard (FIPS 186-3), NIST, Jue [3] S. D. Galbraith,. Li, ad M. Scott, Edomorphisms for faster elliptic curve cryptography o a large class of curves, i EUROCRPT 2009, LNCS 5479, 2009, pp [4] A. Hiasat, New Memoryless, mod(2 ± 1) Residue Multiplier, i Electroics Letters, vol. 28, [5] A. D. Booth, A Siged Biary Multiplicatio Techique. Quarterly Joural of Mechaics ad Applied Mathematics,, vol. 4, o. 2, pp , [6] O. MacSorley, High-speed arithmetic i biary computers, Proceedigs of the IRE, vol. 49, o. 1, pp , ja [7] G. W. Bewick, Fast multiplicatio: Algorithms ad implemetatio, Ph.D. dissertatio, Electrical Egieerig, Staford Uiversity, [8] C. D. Walter, Motgomery expoetiatio eeds o fial subtractios, Electroic Letters, vol. 35, o. 21, pp , October [9] A. Karatsuba ad. Ofma, Multiplicatio of may-digital umbers by automatic computers, Proceedigs of the USSR Academy of Scieces, vol. 145, pp , [10] Side-chael attack stadard evaluatio board, SASEBO-GII, http: // [11] E. Brier, C. Clavier, ad F. Olivier, Correlatio power aalysis with a leakage model, i CHES 2004, ser. LNCS, vol. 3156, 2004, pp [12] P. Kocher, J. Jaffe, ad B. Ju, Differetial power aalysis, i Advaces i Cryptology CRPTO 99, ser. LNCS, vol. 1666, 1999, pp [13] A. Byre, N. Meloi, A. Tisserad, E. M. Popovici, ad W. P. Marae, Compariso of simple power aalysis attack resistat algorithms for a elliptic curve cryptosystem, i Joural of Computers, vol. 2, 2007, pp