Extending Scalar Multiplication Using Double Bases
It has been recently acknowledged [4,6,9] that the use of double bases representations of scalars n, that is an expression of the form n = ∑e, s, t (–1)eAsBt can speed up significantly scalar multiplication on those elliptic curves where multiplication by one base (say B) is fast. This is the case in particular of Koblitz curves and supersingular curves, where scalar multiplication can now be achieved in o(logn) curve additions.
Previous literature dealt basically with supersingular curves (in characteristic 3, although the methods can be easily extended to arbitrary characteristic), where A,B ∈ℕ. Only  attempted to provide a similar method for Koblitz curves, where at least one base must be non-real, although their method does not seem practical for cryptographic sizes (it is only asymptotic), since the constants involved are too large.
We provide here a unifying theory by proposing an alternate recoding algorithm which works in all cases with optimal constants. Furthermore, it can also solve the until now untreatable case where both A and B are non-real. The resulting scalar multiplication method is then compared to standard methods for Koblitz curves. It runs in less than logn/loglogn elliptic curve additions, and is faster than any given method with similar storage requirements already on the curve K-163, with larger improvements as the size of the curve increases, surpassing 50% with respect to the τ-NAF for the curves K-409 and K-571. With respect of windowed methods, that can approach our speed but require O(log(n)/loglog(n)) precomputations for optimal parameters, we offer the advantage of a fixed, small memory footprint, as we need storage for at most two additional points.
- 9.Dimitrov, V.S., Imbert, L., Mishra, P.K.: Fast elliptic curve point multiplication using double-base chains. Cryptology ePrint Archive, Report 2005/069 (2005), Available from: http://eprint.iacr.org/
- 12.Doche, C., Lange, T.: Arithmetic of Elliptic Curves. In: Cohen, H., Frey, G. (eds.) Handbook of Elliptic and Hyperelliptic Curve Cryptography. CRC Press, Inc., Boca Raton (2005)Google Scholar
- 13.Doche, C., Lange, T.: Arithmetic of Special Curves. In: Cohen, H., Frey, G. (eds.) Handbook of Elliptic and Hyperelliptic Curve Cryptography. CRC Press, Inc., Boca Raton (2005)Google Scholar
- 17.Koblitz, N.: CM-curves with good cryptographic properties. In: Feigenbaum, J. (ed.) CRYPTO 1991. LNCS, vol. 576, pp. 279–287. Springer, Heidelberg (1992)Google Scholar
- 22.Schroeppel, R.: Elliptic curve point ambiguity resolution apparatus and method, International Application Number PCT/US00/31014, filed (November 9, 2000)Google Scholar
- 23.Schroeppel, R.: Elliptic curves: Twice as fast!. In: Presentation at the Crypto 2000 Rump Session (2000)Google Scholar
- 24.Solinas, J.A.: An improved algorithm for arithmetic on a family of elliptic curves. In: Kaliski Jr., B.S. (ed.) CRYPTO 1997. LNCS, vol. 1294, pp. 357–371. Springer, Heidelberg (1997)Google Scholar