 POINT MULTIPLICATION ON SUPERSINGULAR ELLIPTIC
CURVES DEFINED OVER FIELDS OF CHARACTERISTIC 2 AND 3
Kwang Ho Kim
Department of Algebra, Institute of Mathematics, The State Academy of Sciences
Pyongyang city, Democratic People’s Republic of Korea
Christophe Negre
Team DALI/ELIAUS, University of Perpignan, Perpignan, France
Keywords:
Supersingular, Eliptic Curve, Coordinate Systems, Mixed Addition, Doubling, Tripling.
Abstract:
Elliptic curve cryptosystem protocols use two main operations, the scalar multiplication and the pairing com-
putation. Both of them are done through a chain of basic operation on the curve. In this paper we present new
formulas for supersingular elliptic curve in characteristic 2 and 3. We improve best known formulas by at least
one multiplication in the ﬁeld.
1 INTRODUCTION
For elliptic curve cryptosystems, scalar multiplica-
tion on the curve is the most important but time-
consuming operation. So the research on speeding up
this operation continues to get increasing attraction
since the elliptic curve cryptography has been pro-
posed (Koblitz 1987, Miller 1986).
The scalar multiplication is generally performed
by a chain of elementary curve operations like point
addition, point doubling and point tripling. This is
the case for example in double and add method (Han-
kerson et al., 2004) or triple and add method (Page
and Smart, 2002). Each curve operation requires sev-
eral ﬁeld operations on the point coordinates (addi-
tion/subtraction, multiplication and eventually inver-
sion or powering).
Consequently to get an efﬁcient scalar multiplica-
tion and an efﬁcient pairing it is important to decrease
the number of ﬁeld operations involved in basic curve
operations.
Here we focus on supersingular elliptic curve in
characteristic two and three. Projective versions of
arithmetic on supersingular elliptic curves have been
proposed in characteristic 3 by N. Koblitz (Koblitz,
1998), P. Baretto et al. (Baretto et al., 2002) and K.
Harrison et al. (Harrison et al., 2002). For character-
istic two the main result is the work et al.(Scott et al.,
2006). The cost of their respective formulas are given
in Table 1.
Table 1: Complexity comparison.
(Scott et al., 2006) 9M + 3S 1M + 7S
Proposed 9M + 5S 8S
(Koblitz, 1998) 6C 10M + 1C
(Baretto et al., 2002) 6C 9M + 1C
(Harrison et al., 2002) M + 6C 8M + 3C 7M + 2C
Proposed 8C 7M + 3C 6M + 4C
In this paper we ﬁrst propose a new coordinate
system in characteristic 2 called the XZ-projectiveco-
ordinate system. We provide in this system formulas
for doubling and mixed addition. We propose also a
new coordinate system for characteristic 3 called ML-
projectivecoordinate system. Again we give formulas
for adding, doubling and tripling. The cost of these
formulas are given in Table 1
Table 1 shows that our formulas provide some im-
provement in the efﬁciency of curve operations.
This paper is organizedas follows. Basic concepts
and previous work on arithmetic on supersingular el-
liptic curves are summarized in Section 2. We present
our contribution for supersingular curve in character-
istic 2 (resp. 3) in Section 3 (resp. Section 4). Finally
we brieﬂy conclude in Section 5.
373
Ho Kim K. and Negre C. (2008).
POINT MULTIPLICATION ON SUPERSINGULAR ELLIPTIC CURVES DEFINED OVER FIELDS OF CHARACTERISTIC 2 AND 3.
In Proceedings of the International Conference on Security and Cr yptography, pages 373-376
DOI: 10.5220/0001926103730376
c
SciTePress Table 2: Curve operations Afﬁne coordinates.
Characteric2 Characteric3
λ =
y
1
+y
2
x
1
+x
2
,
x
3
= λ
2
+ (x
1
+ x
2
),
y
3
= y
1
+ 1
+λ(x
1
+ x
3
),
λ =
y
1
y
2
x
1
x
2
,
x
3
= λ
2
(x
1
+ x
2
),
y
3
= (y
1
+ y
2
) λ
3
,
Doub.
x
3
= x
4
1
+ 1,
y
3
= y
4
1
+ x
4
1
λ =
1
y
1
x
3
= x
1
+ λ,
y
3
= (y
1
+ λ
3
),
Trip.
x
3
= x
9
1
b,
y
3
= y
9
1
.
2 ARITHMETIC ON
SUPERSINGULAR ELLIPTIC
CURVES
Given a ﬁnite group with underlying difﬁcult discrete
logarithm problem (DLP) and efﬁcient group law, one
could use this group to implement cryptographic pro-
tocols such as ElGamal encryption or Difﬁe-Hellman
key exchange.
Recall that given a ﬁnite ﬁeld F
p
n
with p prime an
elliptic curve E over F
p
n
is the set of pairs (x,y)
F
p
n
× F
p
n
satisfying a Weierstrass equation of the
form y
2
+ a
1
xy + a
3
y = x
3
+ a
2
x
2
+ a
4
x + a
6
where
a
i
for i = 1,...,6 are constants in F
p
n
. Elliptic curves
have a natural group structure given by chord and tan-
gent method. This provides efﬁcient group arithmetic
and difﬁcult DLP suitable for cryptographic applica-
tions.
In this paper we consider special elliptic curves,
the supersingular elliptic curves deﬁned over ﬁeld of
characteristic 2 and 3. Their equation are the follow-
ing
E(F
2
n
) Y
2
+Y = X
3
+ X + b where b {0, 1} (1)
E(F
3
n
) Y
2
= X
3
X + b where b {−1,1} (2)
These curves are really interesting for efﬁcient im-
plementation of pairing-based cryptosystems. Indeed,
to implement protocol based on pairing on an elliptic
curve E(F
q
), the curve must have an embedded de-
gree k not too big. The embedded degree is the small-
est integer k such that the Tate pairing, for instance,
can be computed. It has been shown that supersin-
gular elliptic curves satisfy this condition (Galbraith,
2001).
In afﬁne coordinates, operations on the curve can
be computed using the following formulas give in Ta-
ble 2
Since the proposition of ECC by Koblitz and
Miller, research have been done to improvethe cost of
operations on the curve. We see in Table 2 that dou-
bling and tripling is free of ﬁeld inversion and ﬁeld
multiplication. But the other operations require inver-
sion in afﬁne coordinate.
A popular idea to avoid inversion in curve opera-
tions consists to use projective coordinates. The most
interesting projective systems are the following
1. Ordinary projective (X,Y, Z) (x,y) =
(X/Z,Y/Z) in afﬁne.
2. Lopez-Dahab projective (X,Y, Z) (x,y) =
(X/Z,Y/Z
2
) in afﬁne.
3. Jacobian projective (X,Y,Z) (X/Z
2
,Y/Z
3
)
Each system provides different operation cost for
addition, doubling and tripling, but all of them avoid
with a point in the current projective system say P
1
and a second point P
2
in afﬁne coordinate. It is gener-
ally cheaper than a general addition.
Field operations. Let us denote I a ﬁeld inversion,
M a multiplication, S a squaring and C a cubing in
the ground ﬁeld. These operations have different
time consuming depending on the characteristic of the
ﬁeld. Speciﬁcally
In characteristic two we have I M S and C =
M + S.
In the case of characteristic three we have I
M
=
S C (see (Ahmadi et al., 2007)).
The curve operations are optimized regarding these
relative costs of ﬁeld operations.
3 OPERATIONS IN
CHARACTERISTIC 2
In this section we present our work concerning arith-
metic on an supersingular elliptic curve in characteris-
tic 2. Speciﬁcally we would like to improve the arith-
metic on the curve
E(F
2
n
) Y
2
+Y = X
3
+ X + b where b {0,1}.
To reach this goal we use a new system of repre-
sentation called XZ-projective coordinates. This sys-
tem can be seen as an improvement of the Lopez-
Dahab (Lopez and Dahab, 1998) projective coordi-
nates.
Deﬁnition 1 (XZ-projective coordinates). The XZ-
projective coordinates of a point P on an elliptic curve
E is a quadruple (X,Y,Z,T) such that T = XZ and
the afﬁne coordinate (x,y) of P are given by
x = X/Z, y = Y/Z
2
.
SECRYPT 2008 - International Conference on Security and Cryptography
374 In this system we obtain the formulas given in the
following proposition for addition and doubling on
the curve deﬁned by (1).
Proposition 1 (Curve operation in XZ-projective co-
ordinate). Let E(F
2
n
) a supersingular curve deﬁned
by the following equation
Y
2
+Y = X
3
+ X + b where b {0,1}.
Let P
1
= (X
1
,Y
1
,Z
1
,T
1
) and P
2
= (X
2
,Y
2
,1,T
2
=
X
2
) be two points on E(F
2
n
) expressed in XZ-
projective coordinates. Then
3
= P
1
+ P
2
, the XZ-
coordinates (X
3
,Y
3
,Z
3
,T
3
) of P
3
can be computed
as
Z
3
= (X
2
Z
2
1
+ T
1
)
2
, T
3
= X
3
Z
3
,
X
3
= (X
2
Z
2
1
+ T
1
)(X
2
Z
1
+ X
1
)
2
+(Y
2
Z
2
1
+Y
1
)
2
,
Y
3
= Z
2
3
(Y
2
+ 1)
+(X
2
Z
3
+ X
3
)(X
2
Z
2
1
+ T
1
)(Y
2
Z
2
1
+Y
1
).
(3)
And the cost of these formulas is 9M + 3S
Doubling. Let P
3
= 2P
1
, the XZ-coordinates
(X
3
,Y
3
,Z
3
,T
3
) of P
3
can be computed as
X
3
= (X
1
+ Z
1
)
4
, Y
3
= (Y
1
+ T
1
)
4
,
Z
3
= (Z
2
1
)
2
, T
3
= (T
1
+ Z
2
1
)
4
.
(4)
The cost of these formulas is equal to 8S.
Proof. Mixed Addition. To provethat the formulas(3)
are correct, we have to provethat X
3
/Z
3
andY
3
/Z
2
3
are
equal to the expression of x
3
and y
3
in Table 2. Using
(3) we have
X
3
/Z
3
=
(X
2
Z
2
1
+ T
1
)(X
2
Z
1
+ X
1
)
2
+ (Y
2
Z
2
1
+Y
1
)
2
(X
2
Z
2
1
+ T
1
)
2
.
If we factorize Z
4
1
in the numerator and the denomi-
nator we get
X
3
/Z
3
=
(X
2
+X
1
/Z
1
)(X
2
+X
1
/Z
1
)
2
+(Y
2
+Y
1
/Z
2
1
)
2
(X
2
+X
1
/Z
1
)
2
= (x
2
+ x
1
) +
y
2
+y
1
x
2
+x
1
2
.
This means that X
3
/Z
3
satisﬁes equation of Table 2.
Now let do the same thing in the expression of Y
3
/Z
2
3
Y
3
/Z
2
3
= (Y
2
+ 1) +
(X
2
+X
3
/Z
3
)(X
2
Z
2
1
+T
1
)(Y
2
Z
2
1
+Y
1
)
Z
3
= (Y
2
+ 1) +
(X
2
+X
3
/Z
3
)(X
2
+X
1
/Z
1
)(Y
2
+Y
1
/Z
2
1
)
(X
2
+X
1
/Z
1
)
2
but this last expression is equal the expression of Ta-
ble 2.
Doubling. This case is simpler, and the proof is sim-
ilar to the proof of addition formulas. For the sake of
simplicity we leave this part to the reader.
Now let us compare our formulas with best known
formulas for curve E(F
2
n
deﬁned by
Y
2
+Y = X
3
+ X + b where b {0, 1}.
We reported the cost of these formulas (Scott et al.,
2006) reported in Table 3.
Table 3: Complexity comparison.
Classic Aff. 4S I + 2M + S
(Scott et al., 2006) Jac. M + 7S 9M + 3S
Proposed XZ-proj. 8S 9M + 5S
We can see that the doubling is cheaper by 1M
compared to Scott. In counter part,we have one more
squaring int the doubling, and two more squaring in
4 OPERATIONS IN
CHARACTERISTIC 3
We propose a novel system of representation called
ML-projective coordinates. This system can be seen
as an improvement of the original Jacobian coordi-
nate.
Deﬁnition 2. The ML-projective coordinate of a point
P on an elliptic curve E is quadruplet (X,Y,Z,T)
such that T = Z
2
and the afﬁne coordinate (x,y) of
P are given by
x = X/T,y = Y/Z
3
.
In this system we found different formulas for
point addition, point doubling and point tripling on
an elliptic curve deﬁned by (2).
Proposition 2 (Curve operation in ML-projective co-
ordinate). Let E(F
3
n
) a supersingular curve deﬁned
by the following equation
E(F
3
n
) Y
2
= X
3
X + b where b = ±1
Let P
1
= (X
1
,Y
1
,Z
1
,T
1
) and P
2
= (X
2
,Y
2
,1,1) be
two points on E(F
3
n
) expressed in ML-projective co-
ordinates. Then
3
= P
1
+ P
2
, the ML-coordinates
(X
3
,Y
3
,Z
3
,T
3
) of P
3
can be computed as
Z
3
= Z
1
(X
2
T
1
X
1
), T
3
= Z
2
3
,
X
3
= (Y
2
Z
3
1
Y
1
)
2
+ (X
2
T
1
X
1
)
3
+X
2
T
3
,
Y
3
= (Y
2
Z
3
1
+Y
1
)(X
2
T
1
X
1
)
3
(Y
2
Z
3
1
Y
1
)
3
.
(5)
These formulas require 7M + 3C.
POINT MULTIPLICATION ON SUPERSINGULAR ELLIPTIC CURVES DEFINED OVER FIELDS OF
CHARACTERISTIC 2 AND 3
375 Table 4: Complexity comparison.
Algorithm Coordinates Tripling Mixed addition Doubling
Classic Afﬁne 4C 1I + 2M + 1C 1I + 1M + 1C
(Koblitz, 1998) Ordinary projective 6C 10M + 1C -
(Baretto et al., 2002) Ordinary projective 6C 9M + 1C -
(Harrison et al., 2002) Jacobian 1M + 6C 8M + 3C 7M + 2C
Proposed ML-Projective 8C 7M+ 3C 6M + 4C
Doubling. Let P
3
= 2P
1
the ML-coordinates
(X
3
,Y
3
,Z
3
,T
3
) of P
3
can be computed as
Z
3
= Y
1
Z
3
1
, T
3
= Z
2
3
,
X
3
= (T
3
1
)
2
+ (X
3
1
Y
2
1
)Y
2
1
+ bT
3
,
Y
3
= T
9
1
+Y
2
1
T
3
.
(6)
These formulas require 6M + 4C.
Tripling. Let P
3
= 3P
1
the ML-coordinates
(X
3
,Y
3
,Z
3
,T
3
) of P
3
can be computed as
X
3
= (X
1
bT
1
)
9
, Y
3
= Y
9
1
,
Z
3
= Z
9
1
, T
3
= T
9
1
.
(7)
These formulas require 8C.
Proof. Mixed Addition. Let us check that X
3
/T
3
and
Y
3
/Z
3
3
are equal respectively to x
3
and y
3
of Table 2.
For X
3
/T
3
we have
X
3
/T
3
=
(Y
2
Z
3
1
Y
1
)
2
+(X
2
T
1
X
1
)
3
+X
2
T
3
T
3
=
(Y
2
Z
3
1
Y
1
)
2
+(X
2
Z
2
1
X
1
)
3
(
Z
1
(X
2
Z
2
1
X
1
)
)
2
+ X
2
since T
1
= Z
2
1
. We proceed the simpliﬁcations
X
3
/T
3
=
(Y
2
Z
3
1
Y
1
)
2
Z
2
1
(X
2
Z
2
1
X
1
)
2
+
X
2
Z
2
1
X
1
Z
2
1
+ X
2
=
y
2
y
1
x
2
x
1
2
(x
2
+ x
1
).
After the cancellation of the power of Z
1
in the
numerators and denominators we get the required ex-
pression (Table 2).
ForY
3
/Z
3
3
and for Doubling and Tripling formulas
we can prove it in the same way.
In Table 4 we give the cost of the operation in ML-
coordinate and also the cost of the best known for-
mulas ((Koblitz, 1998; Baretto et al., 2002; Harrison
et al., 2002)). We remark that our formulas improve
previous mixed addition formulas by 1M or 2M. In
on other hand, the tripling require 2 more cubing.
5 CONCLUSIONS
In this paper we have studied the arithmetic on super-
singular elliptic curve deﬁned over ﬁeld of character-
istic 2 and 3. We have introduced two new coordinate
systems , the XZ-projective coordinates and the ML-
projective coordinates. We obtain new formulas for
point addition, point doubling and point tripling on
the curve. The formulas are cheaper and provide a
more efﬁcient scalar multiplication on the curve.
REFERENCES
Ahmadi, O., Hankerson, D., , and Menezes, A. (2007).
Software implementation of arithmetic in GF(3
n
). In
WAIFI 2007.
Baretto, P. S. L. M., Kim, H. Y., Lynn, B., and Scott, M.
(2002). Efﬁcient algorithms for pairing based cryp-
tosystems. In CRYPTO’2002, volume 2442, pages
354–368.
Galbraith, S. D. (2001). Supersingular curves in cryptogra-
phy. Lecture Notes in Computer Science, 2248.
Hankerson, D., Menezes, A., and Vanstone, S. (2004).
Guide to Elliptic Curve Cryptography. Springer-
Verlag.
Harrison, K., Page, D., and Smart, N. P. (2002). Software
implementation of nite ﬁelds of characteristic three,
for use in pairing-based cryptosystems. LMS J. Com-
put. Math., 5:181–193.
Koblitz, N. (1998). An elliptic curve implementation of the
ﬁnite ﬁeld digital signature algorithm. In CRYPTO’98,
volume 1462, pages 327–337.
Lopez, J. and Dahab, R. (1998). Improved algorithms for
elliptic curve arithmetic in GF(2
n
). In SAC’98, pages
201–212.
Page, D. and Smart, N. P. (2002). Hardware implemen-
tation of ﬁnite elds of characteristic three. In 4th
CHES’2002, volume 2523 of LNCS, pages 529–539.
Springer.
Scott, M., Costigan, N., and Abdulwahab, W. (2006). Im-
plementing cryptographic pairings on smartcards. In
CHES 2006, volume 4249, pages 134–147.
SECRYPT 2008 - International Conference on Security and Cryptography
376 