A Family of Lightweight Twisted Edwards Curves for the Internet of Things
English
Ghatpande, Sankalp[University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
Groszschädl, Johann[University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC) >]
Liu, Zhe[University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > Computer Science and Communications Research Unit (CSC) >]
Dec-2018
Information Security Theory and Practice, 12th IFIP WG 11.2 International Conference, WISTP 2018, Brussels, Belgium, December 10-11, 2018, Proceedings
Blazy, Olivier
Yeun, Chan Y.
Springer Verlag
Lecture Notes in Computer Science, volume 11469
193-206
Yes
International
12th International Conference on Information Security Theory and Practice (WISTP 2018)
from 10-12-2018 to 11-12-2018
Brussels
Belgium
[en] Internet of Things (IoT) ; Lightweight Cryptography ; Elliptic Curve Cryptography ; Twisted Edwards Curve ; Montgomery Curve ; Pseudo-Mersenne Prime Field
[en] We introduce a set of four twisted Edwards curves that satisfy common security requirements and allow for fast implementations of scalar multiplication on 8, 16, and 32-bit processors. Our curves are defined by an equation of the form -x^2 + y^2 = 1 + dx^2y^2 over a prime field Fp, where d is a small non-square modulo p. The underlying prime fields are based on "pseudo-Mersenne" primes given by p = 2^k - c and have in common that p is congruent to 5 modulo 8, k is a multiple of 32 minus 1, and c is at most eight bits long. Due to these common features, our primes facilitate a parameterized implementation of the low-level arithmetic so that one and the same arithmetic function is able to process operands of different length. Each of the twisted Edwards curves we introduce in this paper is birationally equivalent to a Montgomery curve of the form -(A+2)y^2 = x^3 + Ax^2 + x where 4/(A+2) is small. Even though this contrasts with the usual practice of choosing A such that (A+2)/4 is small, we show that the Montgomery form of our curves allows for an equally efficient implementation of point doubling as Curve25519. The four curves we put forward roughly match the common security levels of 80, 96, 112 and 128 bits. In addition, their Weierstraß representations are isomorphic to curves of the form y^2 = x^3 - 3x + b so as to facilitate inter-operability with TinyECC and other legacy software.
[University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
