A Novel Elliptic Curve Scalar Multiplication Algorithm against Power Analysis

Abstract

Nowadays, power analysis attacks are becoming more and more sophisticated. Through power analysis attacks, an attacker can obtain sensitive data stored in smart cards or other embedded devices more efficiently than with any other kind of physical attacks. Among power analysis, simple power analysis (SPA) is probably the most effective against elliptic curve cryptosystem, because an attacker can easily distinguish between point addition and point doubling in a single execution of scalar multiplication. To make elliptic curve scalar multiplication secure against SPA attacks, many methods have been proposed using special point representations. In this paper, a simple but efficient SPA-resistant multiscalar multiplication is proposed. The method is to convert the scalar into a nonadjacent form (NAF) representation at first and then constitute it in a new signed digit representation. This new representation is undertaken at a small precomputation cost, as each representation needs just one doubling and 1/2 additions for each bit. In addition, when combined with randomization techniques, the proposed method can also guard against differential power analysis (DPA) attack.

1. Introduction

Since being proposed independently by Koblitz [1] and Miller [2] in the mid 1980s, elliptic curve cryptosystem (ECC) has been widely applied in public key cryptography, especially in pairing cryptosystems [3, 4]. This is due to ECC using a much shorter key size than other traditional public key cryptosystems such as RSA to provide a corresponding level of security. For instance, 160 bit ECC provides about the equivalent level of security as 1024 bit RSA [5]. Due to the shorter key length, higher speed, and lower power consumption, ECC has been attractive for wireless and smart card applications which have limited bandwidth and storage resources. The security of ECC is based on the hardness of the discrete logarithm problem (DLP) on an elliptic curve called elliptic curve discrete logarithm problem (ECDLP) [6]. Given a scalar multiplication 𝑘𝑃=𝑄, where 𝑘 is an integer, and 𝑃,  𝑄 are the points on an elliptic curve, according to ECDLP, if 𝑘 is large enough, then it is unable to calculate 𝑘 when the values of 𝑃 and 𝑄 are given. When ECC is implemented in the wireless or smart card devices, they are very vulnerable to power analysis attacks [7, 8].

In power analysis attacks, which were proposed by Kocher et al. [8], an attacker can obtain the secret key stored inside a device by monitoring the cryptographic device’s power consumption. Generally speaking, simple power analysis (SPA) [7] and differential power analysis (DPA) [8] are the two main types of power analysis attacks. SPA can observe secret information through analysis on a single execution of a cryptographic operation, while DPA may need many executions and to analyze them using a statistical process. As different operations executed by the device consume different amounts of time and power, the different time and power consumptions can be used to determine which operations were performed in what order. In the case of scalar multiplication, it may be possible for an attacker to distinguish which parts of the operation were performed by a point doubling, and which parts were performed by a point addition, although he has no knowledge about the private keys. With this the attacker can obtain the secret key, from the acquired information, for using as the scalar in the elliptic curve scalar multiplication.

In the past decade, various scalar multiplication algorithms that resist SPA or DPA have been proposed, for example, [9–17]. In [10], Coron first generalized a DPA attack to the elliptic curve cryptosystem and introduced double-and-add always algorithm to resist SPA and randomization method to resist DPA. Since then, many countermeasures, which are based on randomization and scalar recoding, have been proposed. Reference [11] proposed the randomized addition-subtraction chains method, and [17] introduced the randomized window method. Lee first proposed a SPA-resistant countermeasure based on multiscalar multiplication [13]. Then, [14–16] not only introduced multi-scalar multiplication to resist SPA, but also used randomization method to resist DPA. However, those methods provide security at the cost of efficiency. In this paper, we propose a novel efficient SPA-resistant multi-scalar multiplication method and combine it with a randomization method to resist DPA.

The rest of the paper is organized as follows. Section 2 gives a brief introduction to ECC, scalar multiplication, and previous SPA-resistant algorithms. Section 3 describes the proposed scalar multiplication algorithm. Section 4 compares the performance of our strategies with the previous countermeasures. Finally, Section 5 concludes this paper.

2. Preliminaries

2.1. Elliptic Curve Arithmetic

This subsection presents a brief introduction to ECC. For extended details, the reader can refer to [6, 18]. Let 𝐺𝐹(𝑝) be a finite prime field. An elliptic curve 𝐸 over 𝐺𝐹(𝑝) can be defined by the Weierstrass equation: 𝑦²+𝑎₁𝑥𝑦+𝑎₃𝑦=𝑥³+𝑎₂𝑥²+𝑎₄𝑥+𝑎₆, (1) where 𝑎₁,𝑎₂,𝑎₃,𝑎₄,𝑎₆∈𝐺𝐹(𝑝). The set of points on an elliptic curve 𝐸 and the point at infinity (denoted by 𝑂) form an Abelian group under a point addition operation. The formula for computing point operation consists of two basic operations: the elliptic curve addition (ECADD) when computing 𝑃+𝑄 according to a group addition rule when two points 𝑃 and 𝑄 on the curve are given and 𝑃 is not equal to 𝑄, and the elliptic doubling (ECDBL) when computing 2𝑃 when a point 𝑃 is given. This needs expensive filed inversions in the computation of point operations when using (𝑥,𝑦) known as affine coordinates to represent the points on the curve 𝐸. So, the most efficient implementations adopt representations of the form (𝑋∶𝑌∶𝑍), known as projective coordinates, including standard projective coordinates, Jacobian projective coordinates, Chudnovsky Jacobian coordinates, and Lopez-Dahab projective coordinates [6].

2.2. Scalar Multiplication

Scalar multiplication is the basic operation in ECDSA signature [19] and ECDH key agreement [20] protocols. The operation calculates the multiples of a point 𝑘𝑃=𝑃+𝑃+⋯+𝑃 (𝑘 times), where 𝑃 is a point on curve 𝐸 and 𝑘 is an integer scalar. As the most time consuming operation in the previously mentioned protocols, many algorithms have been proposed to improve the efficiency of scalar multiplication during the past decade. Among them, the nonadjacent form (NAF) [21] is the standard one. An NAF of a positive integer 𝑘 is an expression 𝑘_NAF=^𝑙−1_𝑖=0𝑘_𝑖2^𝑖, (2) where 𝑘_𝑖∈{0,±1}, 𝑘_𝑙−1≠0, and no two consecutive digits of  𝑘_𝑖 are nonzero. The computation of NAF of a positive integer 𝑘 is described as in Algorithm 1. Then, it is possible to compute the scalar multiplication using NAF method following Algorithm 2.

Input: Positive integer 𝑘,𝑘 = (𝑘𝑙−1,𝑘𝑙−2,…,𝑘0)2 Output: 𝑘NAF, 𝑘NAF = (𝑘𝑙,𝑘𝑙−1,𝑘𝑙−2,…,𝑘0)NAF (1) i = 0. (2) While (k > 0) do     (2.1) if (k is odd) then      (2.2) 𝑘𝑖= 2 − (k mod 4);      (2.3) else      (2.4) 𝑘𝑖= 0;      (2.5) k = (𝑘−𝑘𝑖)/2;      (2.6) 𝑖=𝑖+1; (3)Return (k).

Algorithm 1 

NAF of a positive integer 𝑘.

Input: Positive integer 𝑘, 𝑃∈𝐸 Output: 𝑄=𝑘𝑃 (1) Use Algorithm 1 to compute 𝑘NAF. (2) 𝑄=𝑂. (3) For 𝑖 from 𝑙−1 downto 0 do    (3.1) Q = 2Q.     (3.2) If 𝑘𝑖 = 1 then 𝑄=𝑄+𝑃;     (3.3) If 𝑘𝑖= −1 then 𝑄=𝑄−𝑃; (4) Return (Q).

Algorithm 2 

Binary NAF method for scalar multiplication.

Each positive 𝑘 has a unique NAF. Among all signed binary representations, NAF(𝑘) has the fewest nonzero digits. It is known that the average density of nonzero bits of  NAF is approximately 1/3. This means that scalar multiplication using NAF needs 𝑛 ECDBL + (𝑛/3) ECADD.

2.3. Previous Algorithms

2.3.1. Ciet and Joye’s Algorithm

This algorithm [14] uses the variant of Shamir’s double ladder to compute the multi-scalar multiplication 𝑘1𝑃+𝑘2𝑄. The main difference is to insert a dummy operation in the computation. So, each loop includes one doubling and one addition, and the operation order is DADADADADA in Algorithm 3. Hence, one point doubling and one point addition per bit is needed.

Input: 𝑃,𝑘 = 𝑘𝑙−1,𝑘𝑙−2,…,𝑘02, 𝑆,   𝑑 = (𝑑𝑙−1,𝑑𝑙−2,…,𝑑0)2 Output: 𝑄=[𝑘]𝑃+[𝑑]𝑆 (1) 𝑅1 =𝑃;𝑅2=𝑆;𝑅3=𝑃+𝑆; (2) 𝑗=2𝑑𝑙−1+𝑘𝑙−1;𝑅0=𝑅𝑗 (3) For 𝑖 from 𝑙−2 downto 0 do    (3.1) 𝑅0=2𝑅0,𝑅1=𝑃;    (3.2) c = !(𝑘𝑖||𝑑𝑖), 𝑗=2𝑑𝑖+𝑘𝑖;    (3.3) 𝑅𝑐=𝑅𝑐+𝑅𝑗; (4) Return (𝑅0).

Algorithm 3 

Ciet and Joye's algorithm.

2.3.2. Lee’s Algorithm

To resist SPA, Lee improved the simultaneous scalar multiplication [21] in [13]. He changed the values of (𝑘_𝑖, 𝑚_𝑖) when (𝑘_𝑖, 𝑚_𝑖) = (0, 0) to construct another adequate digit pair with at least one non-zero digit. Of course, the adjacent pair (𝑘_𝑖+1, 𝑚_𝑖+1) should be modified as well. The transformation rules can be described as in Table 1.

Table 1 

Transformation rules of Lee's algorithm.

After the transformation, the digit pair (𝑘_𝑖,𝑚_𝑖) cannot be all zero. Therefore, the modified simultaneous scalar multiplication was proposed by Lee to resist SPA; see Algorithm 4. Obviously, the cost of Lee's algorithm is also one point doubling and one point addition per bit.

Input: 𝑃,𝑘 =(𝑘𝑙−1,𝑘𝑙−2,…,𝑘0)2 ,𝑆,𝑚=(𝑚𝑙−1,𝑚𝑙−2,…,𝑚0)2 Output: 𝑄=[𝑘]𝑃+[𝑚]𝑆 (1) (𝑘,𝑚) is transformed to (𝑘′,𝑚′) as Table 1 rule; (2) Pre-computation     𝑇[0,1]=𝑆;𝑇[1,0]=𝑃;𝑇[1,1]=𝑃+𝑆;     𝑇[0,2]=2𝑆;𝑇[0,−2]=−2𝑆; (3) 𝑅=𝑇[𝑘′𝑙−1,𝑚′𝑙−1]; (4) For 𝑖 from 𝑙−2 downto 0 do    (4.1) 𝑅=2𝑅;     (4.2) 𝑅=𝑅+𝑇[𝑘′𝑖,𝑚′𝑖]; (5 ) Return (𝑅).

Algorithm 4 

Lee's algorithm.

2.3.3. Zhang, Chen, Xiao’s Algorithm

This algorithm [16] proposes four scalar multiplication algorithms against power analysis. Those algorithms are all based on the highest-weight binary form (HBF) of the scalars and randomization to resist power analysis. Although those four countermeasures have no dummy operations, the efficiency of them is similar to Ciet and Joye’s algorithm. They also almost need one point doubling and one point addition per bit. One of these algorithms can be seen as follows in Algorithm 5.

Input: 𝑃,𝑘 = (𝑘𝑙−1,𝑘𝑙−2,…,𝑘0)2 Output: 𝑄=[𝑘]𝑃 (1) Select a random 𝑟;     𝑟=(𝑟𝑙−1,𝑟𝑙−2,…,𝑟0)2;     𝑘′=𝑘−𝑟; (2) HBF(𝑟,𝑙); (3) For 𝑖 from 0 downto 𝑙−1     If 𝑟+𝑘′𝑖=0     (𝑘′𝑙−1,…,𝑘′𝑖+1) +𝑘′𝑖,𝑘′𝑖 = −𝑘′𝑖 (4) Construct a pre-computation table 𝑇     𝑇=𝑂;𝑇[1]=𝑃;𝑇[−1]=−𝑃;     𝑇[2] = 2𝑃; 𝑇[−2] = −2𝑃; (5) For 𝑖 from 𝑙−1 downto 0 do      (5.1) 𝑇=2𝑇;      (5.2) 𝑇=𝑇+𝑇[𝑟+𝑘′𝑖]; (6) Return (𝑇).

Algorithm 5 

Zhang, Chen, Xiao's algorithm.

2.3.4. Liu, Tan, and Dai’s Algorithm

Liu et al. also propose a multi-scalar multiplication to resist SPA in [15]. The difference is that they use a joint sparse form (JSF) to represent a pair of integers and process two or three JSF columns each time. Although the processed column number may be different, the algorithm always performs four point doublings and two point additions in each loop. This means that it is not possible for useful information related to the private key to be obtained by the attacker through SPA.

Next, 𝑘=213, 𝑚=408 are selected as a simple example. The JSF of (213, 408) is .213=0100−10−1−101408=100−1−10−1000 (3) Then, this algorithm processes the JSF columns as follows: .0100−10−1−101100−1−10−1000 (4) That is to say, it needs four iterations to complete the whole operation; so, sixteen point doubling and eight point addition operations are required. The theoretical analysis and simulation results show that this algorithm needs 1.384 point doublings and 0.692 point additions per bit.

3. The New Algorithm

Based on the algorithms mentioned earlier, a simple but efficient scalar multiplication algorithm is proposed to resist known power analysis attacks in this section. The method first transforms the NAF of the multi-scalar (𝑘,𝑚) then combines it with the window method and modifies the value of the digit pair with all zero digits; so, the new algorithm can be obtained.

3.1. Scalar Representation

In a scalar multiplication, it can be seen that each bit requires at least a point doubling, while the number of point addition varies in different algorithms. Therefore, the best way to improve the efficiency of the scalar multiplication is to reduce the number of point addition. In this approach, a window method with the NAF form is used to reduce the number of point addition.

First, the window method with the NAF form for a single scalar 𝑘 is described. Let 𝑤 be the window size, SHW(𝑤) the maximum Hamming weight, and SPN(𝑤) the point number of the precomputation table in each window. The NAF of a scalar 𝑘 is denoted by 𝑘_NAF, and generally it can be represented as (2), where 𝑙 is the bit length of the NAF of 𝑘. When using the window method, it can be represented as ∑^𝑚−1_𝑖=0𝑘^′_𝑖2^𝑖, where 𝑚=𝑙/𝑤 and 𝑤 bit 𝑘^′∈𝑆_𝑤, in which 𝑆_𝑤 is the set of all possible 𝑤-bit parts of the NAF integers. Consider (𝑤)=𝑤SHW2(),𝑤𝑤iseven2(),(𝑤)=2+1𝑤isoddSPN^(𝑤−1)+2^(𝑤−3)+⋯+2¹(),2𝑤iseven_(𝑤−1)+2^(𝑤−3)+⋯+2⁰(𝑤isodd). (5)(6) In Table 2, we only list the values of SHW(𝑤) and SPN(𝑤) for 𝑤 from 2 to 6, but from (6), it can be seen that SPN(𝑤) rises by times with the increase of 𝑤.

Table 2 

Values of SHW(𝑤) and SPN(𝑤) for different window sizes.

Next, the window method with the NAF form for multi-scalar (𝑘,𝑚) is introduced, where 𝑤 is the window size, MHW(𝑤) is the maximum Hamming weight, and MPN(𝑤) is the point number of pre-computation table in each window (Table 3). Now, in each window, there are two scalars; so, MHW(𝑤) is double SHW(𝑤), but MPN(𝑤) is much larger than SPN(𝑤). MPN(𝑤) is the combination of two numbers (SPN_𝑘(𝑤), SPN_𝑚(𝑤)). Consider (𝑤)=𝑤MHW2(),𝑤𝑤iseven2(),(𝑤)+1𝑤isoddMPN=SPN_𝑘(𝑤)+SPN_𝑚(𝑤)+SPN_𝑘(𝑤)∗SPN_𝑚(𝑤)∗2. (7)(8) From (8), it can be seen that MPN(𝑤) rises exponentially with an increase of 𝑤. So, in this paper, 𝑤=2 was selected as the window size.

Table 3 

Values of MHW(𝑤) and MPN(𝑤) for different window sizes.

When (𝑘_𝑖+1,𝑘_𝑖)=(0,0) and (𝑚_𝑖+1,𝑚_𝑖)=(0,0), no point addition is performed. Hence, an attacker can determine this case through SPA. To assist SPA, (𝑘_𝑖+1,𝑘_𝑖)=(0,0) and (𝑚_𝑖+1,𝑚_𝑖)=(0,0) should be converted, so that a real point addition happens. This is to say that (𝑘_𝑖+1,𝑘_𝑖)=(0,0) and (𝑚_𝑖+1,𝑚_𝑖)=(0,0) are converted to another digit pair with at least one non-zero digit. In this paper, we select to transform (𝑚_𝑖+1,𝑚_𝑖)=(0,0). Of course, the adjacent pair (𝑚_𝑖+3,𝑚_𝑖+2) should be considered as well. According to the NAF coding rule, there are five possible cases related to the digit pair (𝑚_𝑖+3,𝑚_𝑖+2). The transformation rules can be described as in Table 4.

Table 4 

Transformation rules of new algorithm.

After the transformation, the digit pair (𝑚^′_𝑖+1,𝑚^′_𝑖) adds two more cases, but the pre-computation table only adds one more point due to the different symbol between the two cases.

3.2. Proposed New Multiscalar Multiplication Algorithm

Now, the new algorithm to calculate [𝑘]𝑃+[𝑚]𝑆 based on the new representation mentioned earlier can be described. The algorithm has a uniform doubling and adding operation, but no dummy operation.

From Algorithm 6, it can be found that two doublings and one addition are performed in each window. It is assumed that the power consumption of subtraction is the same as the addition. There are fifteen points in the pre-computation table.

Input: 𝑃,𝑘,𝑆,𝑚 Output: 𝑄=[𝑘]𝑃+[𝑚]𝑆   (1) Compute the NAF form of (𝑘,𝑚);   (2) Add leading 0's in (𝑘,𝑚) so that the number of bits in      (𝑘,𝑚) is multiple of 2, 𝑘=(𝑘𝑙−1,𝑘𝑙−2,…,𝑘0)NAF,     𝑚=(𝑚𝑙−1,𝑚𝑙−2,…,𝑚0)NAF;   (3) 𝑖=0;   (4) While (𝑖<(𝑙−2)) do     (4.1) if ((𝑘𝑖+1,𝑘𝑖)=(0,0) and (𝑚𝑖+1,𝑚𝑖) = (0, 0)) then     (4.2) if ((𝑚𝑖+3,𝑚𝑖+2)=(0,0)) then     (4.3)  set (𝑚𝑖+3,𝑚𝑖+2)=(0,1) and (𝑚𝑖+1,𝑚𝑖) =(−2,0);     (4.4) else if((𝑚𝑖+3,𝑚𝑖+2)=(0,−1)) then     (4.5)  set (𝑚𝑖+3,𝑚𝑖+2)=(−1,0)and(𝑚𝑖+1,𝑚𝑖) =(2,0);     (4.6) else if ((𝑚𝑖+3,𝑚𝑖+2)=(0,1)) then     (4.7)  set (𝑚𝑖+3,𝑚𝑖+2)=(1,0) and (𝑚𝑖+1,𝑚𝑖) =(−2,0);     (4.8) else if ((𝑚𝑖+3,𝑚𝑖+2)=(−1,0) then     (4.9)  set (𝑚𝑖+3,𝑚𝑖+2)=(0,−1) and (𝑚𝑖+1,𝑚𝑖) =(−2,0);     (4.10) else     (4.11)  set (𝑚𝑖+3,𝑚𝑖+2)=(0,1) and (𝑚𝑖+1,𝑚𝑖) =(2,0);     (4.12) else     (4.13) 𝑖=𝑖+2;   (5) Pre-computation  𝑇[0,1]=𝑆;𝑇[0,2]=2𝑆;𝑇[0,4]=4𝑆;𝑇[1,0]=𝑃  ;𝑇[2,0]=2𝑃;𝑇[1,1]=𝑃+𝑆;𝑇[1,2]=𝑃+2𝑆;  𝑇[1,−1]=𝑃−𝑆;𝑇[1,−2]=𝑃−2𝑆;𝑇[2,1]=2𝑃+𝑆; 𝑇[2,2]=2𝑃+2𝑆;𝑇[2,−1]=2𝑃−𝑆;   𝑇[2,−2]=2𝑃−2𝑆;   (6) 𝑅=𝑇[(𝑘𝑙−1,𝑘𝑙−2),(𝑚𝑙−1,𝑚𝑙−2)];   (7) For 𝑖 from 𝑙−2 downto 0 𝑖=𝑖−2 do    (7.1) 𝑅=2𝑅;     (7.2) 𝑅=2𝑅;     (7.3) if ((𝑘𝑖−1,𝑘𝑖−2)<0) then     (7.4) 𝑅=𝑅−𝑇[−(𝑘𝑖−1,𝑘𝑖−2),−(𝑚𝑖−1,𝑚𝑖−2)];     (7.5) else if ((𝑘𝑖−1,𝑘𝑖−2)==0) then     (7.6)  if ((𝑚𝑖−1,𝑚𝑖−2)<0) then     (7.7 )  𝑅=𝑅−𝑇[(𝑘𝑖−1,𝑘𝑖−2),−(𝑚𝑖−1,𝑚𝑖−2)];     (7.8) else     (7.9)  𝑅=𝑅+𝑇[(𝑘𝑖−1,𝑘𝑖−2),(𝑚𝑖−1,𝑚𝑖−2)];     (7.10) else     (7.11) 𝑅=𝑅+𝑇[(𝑘𝑖−1,𝑘𝑖−2),(𝑚𝑖−1,𝑚𝑖−2)];   (8) Return (𝑅).

Algorithm 6 

New multi-scalar multiplication algorithm.

Next, a simple example that shows how Algorithm 6 works is described, and the NAF of (209, 416) is .209=010−1010001416=10−10100000 (9)

After transformation according to Table 4, the new representation of (209, 416) is .209=010−1010001416=10−10012000 (10) Then, the process of Algorithm 6 computing 209𝑃+416𝑆 is illustrated in Table 5.

Table 5 

Example of Algorithm 6.

3.3. Proposed DPA-Resistant Scalar Multiplication Algorithm

Among the various DPA countermeasures [22], random key splitting is the most common method to resist DPA. The scalar 𝑘 can be split in at least two different ways; one is 𝑘=(𝑘−𝑟)+𝑟, and the other is 𝑘=⌊𝑘/𝑟⌋𝑟+(𝑘mod𝑟), where 𝑟 is random and the length of 𝑟 is the same of 𝑘. In this paper, the first way 𝑘=𝑘1+𝑘2 was chosen, where 𝑘1=𝑘−𝑟,  𝑘2=𝑟. It can be observed that this method is the same as multi-scalar approach. Then, a similar method as in Algorithm 6 can be used to compute the scalar multiplication. The difference is that the point 𝑆 is equal to 𝑃. Of course, the transformation rule and pre-computation table are also different. To assist an SPA, 𝑘1 and 𝑘2 when (𝑘1_𝑖+1,𝑘1_𝑖)+(𝑘2_𝑖+1,𝑘2_𝑖)=(0,0) should be converted, so that a real point addition happens. Algorithm 7 describes this in detail.

Input: P, k Output: Q = [k]P  (1) Select a random r, 𝑘1=𝑘−𝑟,𝑘2=𝑟;  (2) Compute the NAF form of (𝑘1,𝑘2);  (3) Add leading 0's in (𝑘1,𝑘2) so that the number of bits in      (𝑘1,𝑘2) is multiple of 2, 𝑘1=(𝑘1𝑙−1,𝑘1𝑙−2,…,𝑘10)NAF,      𝑘2=(𝑘2𝑙−1,𝑘2𝑙−2,…,𝑘20)NAF;  (4) 𝑖=0;  (5) While (𝑖<(𝑙−2)) do    (5.1) set 𝑐=(𝑘1𝑖+1,𝑘1𝑖)+(𝑘2𝑖+1,𝑘2𝑖);     (5.2) if (𝑐=0) then     (5.3) if ((𝑘2𝑖+3,𝑘2𝑖+2)>0) then     (5.4)  set 𝑘2𝑖+3,𝑘2𝑖+2−=(0,1) and (𝑘2𝑖+1,𝑘2𝑖) =(−2,0);     (5.5)  else     (5.6)  set 𝑘2𝑖+3,𝑘2𝑖+2+=(0,1) and (𝑘2𝑖+1,𝑘2𝑖) =(2,0);     (5.7) else     (5.8) 𝑖=𝑖+2;   (6) Pre-computation      𝑇[1]=𝑃;𝑇[2]=2𝑃;𝑇[3]=3𝑃;𝑇[4]=4𝑃;   (7) if ((𝑘1𝑙−1,𝑘1𝑙−2)+(𝑘2𝑙−1,𝑘2𝑙−2)=0) then      𝑅=𝑂;     else 𝑅=𝑇[(𝑘1𝑙−1,𝑘1𝑙−2)+(𝑘2𝑙−1,𝑘2𝑙−2)];   (8) For 𝑖 from 𝑙−2 downto 0 𝑖=𝑖−2 do     (8.1) 𝑐=(𝑘1𝑖−1,𝑘1𝑖−2)+(𝑘2𝑖−1,𝑘2𝑖−2);     (8.2) 𝑅=2𝑅;     (8.3) 𝑅=2𝑅;     (8.4) if (𝑐<0) then     (8.5) 𝑅=𝑅−𝑇[−𝑐];     (8.6) else     (8.7) 𝑅=𝑅+𝑇[𝑐];   (9) Return (𝑅).

Algorithm 7 

DPA-resistant scalar multiplication algorithm.

It can be seen that there are only four points in the pre-computation table for Algorithm 7, but the program sequence is also DDA. Therefore, due to the uniform operation sequence, it can resist SPA, and to ensure that there is no correlation between two times, a random 𝑟 was inserted. Of course, the attacker cannot obtain any information through DPA.

4. Performance Comparison

In this section, the performance of Algorithm 7 is analyzed and compared with previous algorithms. In Algorithm 7, each loop processes two bits and has two point doubling and one point addition. Each bit needs one point doubling and 1/2 point addition. In order to show the performance of Algorithm 7, a comparison with previous methods is listed in Table 6.

Table 6 

Performance comparison of algorithms.

According to [23], one projective elliptic doubling in prime case needs 4S (S denotes module square) and 4M (M denotes module multiplication), and one projective elliptic addition on prime case needs 4S and 12M. We resume S≈0.8M [24]. Then, algorithm in [13, 14, 16] needs 8S+16M≈22.4M per bit, and algorithm in [15] needs about 20.4M, while Algorithm 7 only needs 6S+10M≈14.8M per bit. Hence, it Algorithm 7 can improve performance by at least 25% compared with previous algorithms, and, sacrifices a small amount of memory to store pre-computation points.

5. Conclusion

In this paper, a simple but efficient elliptic scalar multiplication against power analysis attacks has been presented. First, we analyze previous algorithms which can resist SPA or DPA. Then, we present the new multi-scalar multiplication to endure SPA. This algorithm is based on NAF and processes two columns each loop. When computing scalar multiplication 𝑘𝑃, we adopt a random number 𝑟 to split scalar 𝑘 and combine it with the multi-scalar multiplication. So, the new DPA-resistant scalar multiplication algorithm is proposed in this work. The proposed DPA-resistant scalar multiplication algorithm not only can resist SPA and DPA, but also provides good performance at a cost of only a few storage spaces.