Are standards compliant Elliptic Curve Cryptosystems feasible on RFID? Sandeep Kumar* and Christof Paar Horst Görtz Institute for IT Security, Ruhr-Universität Bochum, Germany

Outline The Past The Problem The Solution The Implementation The Future : Previous work : Design a tiny ECC processor : Algorithmic choice : CMOS ASIC design : ECC in RFID

The Past: RFID workshop 2005!

Elliptic Curve Cryptography (ECC) ECC suggested in 1985 by Miller/Koblitz Elliptic Curve Discrete Logarithm Problem (ECDLP) Define an Additive Abelian Group (E,+) over an Elliptic Curve Set E: Points on curve Operation: P+Q=(x1,y1)+(x2,y2)=R=(x3,y3) 1.00 Discribe groµP GroµP operation Field operation Point mult and ECDLP

Elliptic Curve Cryptography (ECC) ECC suggested in 1985 by Miller/Koblitz Elliptic Curve Discrete Logarithm Problem (ECDLP) Define an Additive Abelian Group (E,+) over an Elliptic Curve Set E: Points on curve Operation: P+Q=(x1,y1)+(x2,y2)=R=(x3,y3) =(y2-y1)/(x2-x1) x3=2-x2-x1 y3=(x1-x3)-y1 Discribe groµP GroµP operation Field operation Point mult and ECDLP

Elliptic Curve Cryptography (ECC) Define group over an Elliptic Curve Finite Field Types Binary Fields Prime Fields Extension Fields (OEF) Finite Fields Prime fields Extension fields GF(p) GF(pm) char = 2 char > 2 binary OEF Describe groµP GroµP operation Field operation Point mult and ECDLP GF(2n) GF((2n-c)m)

ECC System Design Protocol Group Operation Field Operations Point Mult (k.P) Group Operation Point Add/Double Field Operations Addition/Subtraction Multiplication Reduction Inverse a+b, a-b, a·b, 1/b

ECC System Design Protocol Group Operation Field Operations Point Mult (k.P) Group Operation Point Add/Double Field Operations Addition/Subtraction Multiplication Reduction Inverse x3=... y3=... a+b, a-b, a·b, 1/b

ECC System Design Protocol Group Operation Field Operations Point Mult (k.P) Group Operation Point Add/Double Field Operations Addition/Subtraction Multiplication Reduction Inverse kP x3=... y3=... a+b, a-b, a·b, 1/b

Scalar Point Multiplication Easy : Hard : k . P (Point Mult.) P + P + .. + P = T Given P, T. Find k? Elliptic Curve Discrete Logarithm Problem (ECDLP) Discribe groµP GroµP operation Field operation Point mult and ECDLP

The Problem: Tiny ECC design Reduce memory requirements Reduce arithemtic unit area Keep it simple but efficient : memory amounts to more than 50% of design : avoid units like invertor design for specific size : reduce control logic area - multiplexers

The Problem ! The Solution arithemtic unit memory Solution simple but efficient

The Solution: Tiny ECC design Reduce memory requirements Reduce arithemtic unit area Keep it simple but efficient : Affine co-ordinates, Montgomery scalar multiplication : An efficient invertor unit using an efficient squarer : Modify Montgomery scalar multiplication algo.

Tiny ECC processor Arithmetic Units Point Multiplier Memory Unit Squarer Invertor Point Multiplier Control Unit Memory Unit Most-Significant Bit Mult.

The Implementation: Multiplier Most-Significant Bit (MSB) Multiplier n-clocks for n-bit multiplier

Tiny ECC processor Arithmetic Units Point Multiplier Memory Unit Squarer Invertor Point Multiplier Control Unit Memory Unit Most-Significant Bit Mult. Fermat‘s Little Theorem

The Implementation: Invertor Fermat‘s Little Theorem A-1 = A2m-2 mod F(x) if A in GF(2m) For m=163 : 161 Mult. + 162 Sqr. Itoh-Tsuji Method: For m=163: 9 Mult. + 162 Sqr. A2m-2=A(2(m-1)-1).2 =A[111..1]2.2 Running difference: P=(x,y)=P1-P2 Derive x-coordinate of P1+P2=(x3,y3) x3=f(x,x1,x2)

Tiny ECC processor Arithmetic Units Point Multiplier Memory Unit Squarer Invertor Point Multiplier Control Unit Memory Unit Most-Significant Bit Mult. Parallel Squaring Fermat‘s Little Theorem

The Implementation: Squarer Single Cycle Squaring Low critical path

Tiny ECC processor Arithmetic Units Point Multiplier Memory Unit Squarer Invertor Point Multiplier Control Unit Memory Unit Most-Significant Bit Mult. Parallel Squaring Fermat‘s Little Theorem Modified Montgomery Algo

Modified Montgomery Algorithm Running difference: P=(x,y)=P1-P2 Derive x-coordinate of P1+P2=(x3,y3) x3=f(x,x1,x2)

The Implementation ECC processor implementation for 2113,2131,2163,2193 Running difference: P=(x,y)=P1-P2 Derive x-coordinate of P1+P2=(x3,y3) x3=f(x,x1,x2)

Tiny ECC processor: Results Performance @ 13.56 MHz Field Size Arithmetic Unit(gates) Memory (gates) Total Time (ms) 113 1,625 6,686 10,112 14 131 2,071 7,747 11,969 18 163 2,572 9,632 15,094 32 193 2,776 11,400 17,723 41 Running difference: P=(x,y)=P1-P2 Derive x-coordinate of P1+P2=(x3,y3) x3=f(x,x1,x2) 22% smaller than previous results

The Future Are standards compliant Elliptic Curve Cryptosystems feasible on RFID? Yes and No! Depends on application, RFID device, power... Future? The next 60 mins!

Thank You!