Designing an ASIP for Cryptographic Pairings over Barreto-Naehrig Curves

  • Authors:

  • David Kammler;Diandian Zhang;Peter Schwabe;Hanno Scharwaechter;Markus Langenberg;Dominik Auras;Gerd Ascheid;Rudolf Mathar

  • Affiliations:

  • Institute for Integrated Signal Processing Systems (ISS), RWTH Aachen University, Aachen, Germany;Institute for Integrated Signal Processing Systems (ISS), RWTH Aachen University, Aachen, Germany;Department of Mathematics and Computer Science, Eindhoven University of Technology, Eindhoven, Netherlands;Institute for Integrated Signal Processing Systems (ISS), RWTH Aachen University, Aachen, Germany;Institute for Theoretical Information Technology (TI), RWTH Aachen University, Aachen, Germany;Institute for Integrated Signal Processing Systems (ISS), RWTH Aachen University, Aachen, Germany;Institute for Integrated Signal Processing Systems (ISS), RWTH Aachen University, Aachen, Germany;Institute for Theoretical Information Technology (TI), RWTH Aachen University, Aachen, Germany

  • Venue:
  • CHES '09 Proceedings of the 11th International Workshop on Cryptographic Hardware and Embedded Systems
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

This paper presents a design-space exploration of an application-specific instruction-set processor (ASIP) for the computation of various cryptographic pairings over Barreto-Naehrig curves (BN curves). Cryptographic pairings are based on elliptic curves over finite fields--in the case of BN curves a field $\mathbb{F}_p$ of large prime order p . Efficient arithmetic in these fields is crucial for fast computation of pairings. Moreover, computation of cryptographic pairings is much more complex than elliptic-curve cryptography (ECC) in general. Therefore, we facilitate programming of the proposed ASIP by providing a C compiler. In order to speed up $\mathbb{F}_p$ arithmetic, a RISC core is extended with additional scalable functional units. Because the resulting speedup can be limited by the memory throughput, utilization of multiple data-memory banks is proposed. The presented design needs 15.8 ms for the computation of the Optimal-Ate pairing over a 256-bit BN curve at 338 MHz implemented with a 130 nm standard cell library. The processor core consumes 97 kGates making it suitable for the use in embedded systems.