Chapter

Cryptographic Hardware and Embedded Systems - CHES 2009

Volume 5747 of the series Lecture Notes in Computer Science pp 254-271

Designing an ASIP for Cryptographic Pairings over Barreto-Naehrig Curves

  • David KammlerAffiliated withInstitute for Integrated Signal Processing Systems (ISS), RWTH Aachen University
  • , Diandian ZhangAffiliated withInstitute for Integrated Signal Processing Systems (ISS), RWTH Aachen University
  • , Peter SchwabeAffiliated withDepartment of Mathematics and Computer Science, Eindhoven University of Technology
  • , Hanno ScharwaechterAffiliated withInstitute for Integrated Signal Processing Systems (ISS), RWTH Aachen University
  • , Markus LangenbergAffiliated withInstitute for Theoretical Information Technology (TI), RWTH Aachen University
  • , Dominik AurasAffiliated withInstitute for Integrated Signal Processing Systems (ISS), RWTH Aachen University
  • , Gerd AscheidAffiliated withInstitute for Integrated Signal Processing Systems (ISS), RWTH Aachen University
  • , Rudolf MatharAffiliated withInstitute for Theoretical Information Technology (TI), RWTH Aachen University

Abstract

This paper presents a design-space exploration of an application-specific instruction-set processor (ASIP) for the computation of various cryptographic pairings over Barreto-Naehrig curves (BN curves). Cryptographic pairings are based on elliptic curves over finite fields—in the case of BN curves a field \(\mathbb{F}_p\) of large prime order p. Efficient arithmetic in these fields is crucial for fast computation of pairings. Moreover, computation of cryptographic pairings is much more complex than elliptic-curve cryptography (ECC) in general. Therefore, we facilitate programming of the proposed ASIP by providing a C compiler.

In order to speed up \(\mathbb{F}_p\) arithmetic, a RISC core is extended with additional scalable functional units. Because the resulting speedup can be limited by the memory throughput, utilization of multiple data-memory banks is proposed.

The presented design needs 15.8 ms for the computation of the Optimal-Ate pairing over a 256-bit BN curve at 338 MHz implemented with a 130 nm standard cell library. The processor core consumes 97 kGates making it suitable for the use in embedded systems.

Keywords

Application-specific instruction-set processor (ASIP) design-space exploration pairing-based cryptography Barreto-Naehrig curves elliptic-curve cryptography (ECC) \(\mathbb{F}_p\) arithmetic