橢圓曲線密碼系統於有限場 GF(p)和 GF(2
m)之硬體實現
學生： 盧冠州 指導教授： 李程輝 教授
國立交通大學電信工程學系碩士班
中文摘要
近年來廣為使用的 RSA 密碼系統，為了保持一定的安全性，其金鑰位元長 度不斷的增加，進而加重了 RSA 的運算複雜度。相對於 RSA，橢圓曲線密碼系 統 ( ECC ) 逐漸被重視。在西元 1985 年，Koblitz 與 Miller 提出橢圓曲線密碼系 統，其安全性是建立在橢圓曲線離散對數問題 ( ECDLP )。目前已經被廣泛地制 定於國際標準如 ISO 11770-3、ANSI X9.62、IEEE P1363、FIPS 186-2 等。
橢圓曲線密碼系統的優點是，在相同的安全性下，其所使用的金鑰長度比 RSA 密碼系統短 ( 1024 位元 RSA 密碼系統的安全強度等於 155 位元的 ECC )。
這個好處可以應用在智慧卡或行動電話這種記憶體跟運算能力有限的系統上面。
本論文在實作方面是利用 Verilog 硬體描述語言來撰寫橢圓曲線密碼系統。
我們採用 A.F. Tenca 和 C.K. Koc 所提出的用於蒙哥馬利乘法的可擴充性架構 [32]，並改良使之可以支援有限場 GF(p)和 GF(2m)的運算。另外我們採用 Projective 座標系統，將除法運算轉變為乘法運算，進而降低運算結果的時間。我們利用 Synopsys 的合成軟體來將 Verilog codes 合成成電路，並加以模擬驗證。
Hardware Implementation of Elliptic Curve Cryptosystem over Finite Fields GF(p) and GF(2
m)
Student: Guan-Zhou Lu Advisor: Prof. Tsern-Huei Lee
Department of Communication Engineering
National Chiao-Tung University
Abstract
The RSA cryptosystem used widely in recent years, for keeping the certain security degree, continuous to increase the length of public key, and aggravated the RSA to operate the complicacy. Opposite to RSA, the Elliptic Curve Cryptosystem (ECC) attracts more and more attention. In 1985, Koblitz and Miller proposed a higher security public key cryptosystem, based on ECDLP, called ECC. At present, there are several international standards proposed in ISO 11770-3, ANSI X9.62, IEEE P1363, FIPS 186-2.
The advantages of ECC are that its key sizes are smaller than RSA with equivalent levels of security (1024 bits RSA is equal to 155 bits ECC) so that it can be implemented in smart card or mobile phone.
In this thesis, we developed the hardware implementation of ECC by using Verilog HDL. We adopted the scalable architecture for Montgomery multiplication proposed by F.A. Tenca and C.K. Koc [32], and modified it to support the operations
over dual-field GF(p) and GF(2m). Also, the inversion is designed in the projective coordinates that will save much computation time. We synthesize our verilog codes by software of Synopsys, and confirm by simulation.
誌 謝
研究所兩年的時間，過程辛苦但也很充實。其中我最感謝的是我的指導教授 李程輝教授，在我的論文研究上不厭其煩的給予我指導。不論在研究的方向或者 是架構的設計等等，都給了我相當中肯且實用的建議；並且讓我在論文研究的過 程中瞭解到如何去發現問題、思考問題最後解決問題，著實讓我獲益良多。其次，
我要感謝網路技術實驗室的同學–程翔、思儒、克偉、柏成、柏均以及麗雲。他 們在我的研究過程中給予了我相當的幫助，在我程式寫不出來的時候為我加油打 氣，讓我得以順利的完成此篇論文。另外我也要感謝網路技術實驗室的學弟、妹 們，陪我一起度過了許多歡笑以及難過的時光。最後，我要感謝我的父母親以及 我的女朋友，不斷的給我支持與鼓勵，使得我有力量完成這篇論文。謹以此篇論 文獻給我的家人以及所有曾經關心過我、陪我一起歡笑一起難過的朋友們。
Contents
中文摘要 i
English Abstract ii
誌謝 iv
Contents v
List of Tables viii
List of Figures x
Chapter 1 Introduction 1
1.1 Introduction to Cryptography……… 1
1.2 Organization of this thesis………. 3
Chapter 2 Mathematical Background 4 2.1 Introduction to Galois Field……….. 4
2.1.1 Finite Field GF(p)... 4
2.1.2 Finite Field GF(2m)... 6
2.2 Fermat’s Theorem and Euclid’s Algorithm……….. 8
2.2.1 Fermat’s Theorem... 8
2.2.2 Euclid’s Algorithm... 9
Chapter 3 Overview of Elliptic Curves 12
3.1 History………...……… 12
3.2 Basic theorems……….. 13
3.2.1 Theorems used in Elliptic Curves……… 13
3.2.2 Group Law………... 16
3.3 Projective Space...………. 23
3.3.1 Adding two point on elliptic curve over F2m……… 23
3.3.2 Adding two point on elliptic curve over Fq……….. 25
3.3.3 Summary……….. 27
3.4 The Elliptic Curve Group Structure……….. 27
3.5 The Elliptic Curve Discrete Logarithm Problem……….. 29
3.6 The order of a point……….. 31
Chapter 4 Elliptic Curve Cryptography (ECC) 32 4.1 Analog of ElGamal Public Key Cryptography……….. 32
4.2 Elliptic curve Diffie-Hellman key exchange (ECDH)……….. 34
4.3 Elliptic Curve Digital Signature Algorithm (ECDSA)……….. 35
4.4 Standards of Elliptic Curve Cryptography……… 37
Chapter 5 Implementation of Arithmetic Processor for ECC and Simulation results 39 5.1 Architecture………... 39
5.1.1 MC, NtoM, EPM, PtoA and MtoN………..……… 40
5.1.2 EPDA, MMI and MASC………..……… 43
5.1.3 MMMC………..………..……… 44
5.2 Modified Architecture for Dual-Field………... 50
5.2.1 Modified NtoM, EPDA, PtoA and MMI…..……… 50
5.2.2 Modified MMMC……...………..……… 54
5.3 Simulation Results……….………... 57
Chapter 6 Conclusions 60
Bibliography 61
List of Tables
2.1 Modulo 7 addition………... 5
2.2 Modulo 7 multiplication………... 5
2.3 Three representations for the elements of GF(24) generated by p(x)=X4+X+1... 8
2.4 An example of Extended Euclid (550,1769)…... 11
3.1 Equivalent strength comparison……… 13
3.2 Comparison of different coordinates………... 27
3.3 The first eight multiples of generator point P………. 30
4.1 Analog of the ElGamal cryptosystem………. 33
4.2 ECDSA key generation………... 35
4.3 ECDSA signature generation……….. 36
4.4 ECDSA signature verification………. 36
4.5 Standards of ECC……… 38
5.1 GF(p) ECC hardware performance comparison………. 57
5.2 GF(2m) ECC hardware performance comparison………. 58
5.3 Circuit size comparison………..…… 58
5.4 GF(p) latency of the operations executed in ECP……….. 58
5.5 GF(2m) latency of the operations executed in ECP……… 59
List of Figures
3.1 Point addition………... 16
5.1 EC point multiplier circuit block diagram………... 40
5.2 The dependency graph for the MWR2MM Algorithm………... 47
5.3 Pipelined organization for the multiplier………. 47
5.4 PE data path (a) block diagram and (b) logic diagram for w=3 bits.... 48
5.5 Converting the result from the Carry-Save form to the nonredundant form in the last stage of the pipeline……… 49
5.6 An example of pipeline computation for 7-bit operations, where w=1………..……… 50
5.7 An example of pipeline computation for 7-bit operations, illustrating the situation of pipeline stalls, where w=1..……….. 50
5.8 Standard full adder………... 55
5.9 Dual-field adder………... 55
5.10 Modified Processing Element (PE) for w=3 bits..……….. 56
