![](bg6.png)
Fouque, P.-A., Lercier, R., Ral, D., and Valette, F. (2008a).
Fault attack on elliptic curve Montgomery ladder im-
plementation. In FDTC’08, pages 92–98. IEEE.
Fouque, P.-A., R
´
eal, D., Valette, F., and Drissi, M. (2008b).
The Carry Leakage on the Randomized Exponent
Countermeasure, pages 198–213. Springer Berlin
Heidelberg, Berlin, Heidelberg.
Galbraith, S. and Gaudry, P. (2016). Recent progress on
the elliptic curve discrete logarithm problem. Designs,
Codes, and Cryptography, 78(1):51–72.
Gaudry, P., Hess, F., and Smart, N. (2002). Constructive and
destructive facets of weil descent on elliptic curves.
Journal of Cryptology, 15(1):19–46.
Herbst, C. and Medwed, M. (2008). Using templates to
attack masked montgomery ladder implementations
of modular exponentiation. In International Work-
shop on Information Security Applications, pages 1–
13. Springer.
Information Technology Laboratory (2013). Digital Signa-
ture Standard (DSS). Technical Report NIST FIPS
186-4, NIST.
Joye, M. and Yen, S.-M. (2002). The Montgomery power-
ing ladder. In CHES, pages 291–302.
Kim, K., Lee, C., Negre, C., and Negre, C. (2014). Binary
edwards curves revisited. Lecture Notes in Computer
Science, 8885:393–408.
Koblitz, N. (1987). Elliptic curve cryptosystems. Mathe-
matics of Computation, 48(177):243–264.
Kocher, P. C. (1996). Timing Attacks on Implementations
of Diffie-Hellman, RSA, DSS, and Other Systems. In
CRYPTO’96, LNCS, pages 104–113.
Kocher, P. C., Jaffe, J., and Jun, B. (1999). Differential
Power Analysis. In CRYPTO’99, number 1666 in
LNCS, pages 388–397.
Koziel, B., Azarderakhsh, R., and Mozaffari-Kermani, M.
(2015). Low-resource and fast binary edwards curves
cryptography. LNCS, 9462:347–369.
Miller, V. (1986). Use of Elliptic-Curves in Cryptography.
Lecture Notes in Computer Science, 218:417–426.
Rubens, P. (2014). Internet of Things a Potential Security
Disaster.
Scott, M. (2007). Optimal Irreducible Polynomials for
GF(2
m
) Arithmetic. In IACR Cryptology ePrint
Archive, volume 2007, page 192.
Skarmeta, A. and Moreno, M. (2014). Internet of Things.
In Jonker, W. and Petkovic, M., editors, Secure Data
Management, LNCS, pages 48–53.
The Sage Developers (2017). SageMath, the Sage
Mathematics Software System (Version x.y.z).
http://www.sagemath.org.
Tschofenig, H., Pegourie-Gonnard, M., and Vincent, H.
(2015). Performance of State-of-the-Art Cryptog-
raphy on ARM-based Microprocessors. In NIST
Lightweight Cryptography Workshop 2015 Session
VII: Implementations & Performane.
Yen, S.-M., Ko, L.-C., Moon, S., and Ha, J. (2005). Rel-
ative doubling attack against montgomery ladder. In
International Conference on Information Security and
Cryptology, pages 117–128. Springer.
APPENDIX
m is the size of the extension of F
2
f is the modulus defining the representation of the
finite field
d is the parameter of the curve in BEC form,
equation 1
G
x
, G
y
and G
1/w
are the coordinates of a friendly (32-bit) generator
with G
1/w
=
1
w
where w = G
x
+ G
y
n is the number of points of the curve
p is the prime order of the sub-group generated by G
h is the cofactor = 4
m = 257; f = x
257
+ x
65
+ 1; d = t
65
+t
31
+t
14
+ 1
G
x
= 16b46e24aa4b12ab2289fcd3417615387810f083f43419d8c
ae38ad9ac640d960
G
y
= 16b46e24aa4b12aba289fcd3417615383810f083f43419d8e
ae38ad9ac640d968
G
1/w
= 1000000000000000000000000000000000000
000000000000
n = 231584178474632390847141970017375815706332616967
362709021140632923291797618908
p = 578960446186580977117854925043439539265831542418
40677255285158230822949404727
m = 313; f = x
313
+ x
121
+ 1; d = t
38
+t
33
+t
28
+ 1
G
x
= 15c67e3024c7c27466e72a3391256e9a729fc158092053d89
087c0f38408b214b0ade57363ea938
G
y
= 15c67e3024c7c27446e72a3391256e9a529fc158092053d8b
087c0f38408b214b0ade57363ea938
G
1/w
= 10000000000000001
n = 166873987181321100187111070794496258953336290808
16145622654549217988600018895406224309766337212
p = 417184967953302750467777676986240647383340727020
4036405663637304497150004723851556077441584303
m = 431; f = x
431
+ x
303
+ x
239
+ x
111
+ 1; d = t
83
+t
66
+t
17
+ 1
G
x
= 4e1765c1f2f6140db17d5ef2f14c59a38a93e5b65ba9acca54
7bf2cc34f3d55bd85ccf4daeaf7ca1becaa8ee877b01f8d8ac
ae12b210
G
y
= 4e1765c1f2f6140d317d5ef2f14c59a30a93e5b65ba9acca54
7bf2cc34f3d55b585ccf4daeaf7ca13ecaa8ee877b01f8d8ac
ae12b210
G
1/w
= 10000000000000001
n = 554533938824162971915682836828616740687287415075
163315034095916131188222853620417205051641025857
5498003250039698819164222488620692
p = 138633484706040742978920709207154185171821853768
790828758523979032797055713405104301262910256464
3874500812509924704791055622155173
m = 479; f = x
479
+ x
255
+ 1; d = t
73
+t
29
+t
3
+ 1
G
x
= 7bdd9f19e11e888e80d7c093092d208b4fe996e8fcbdffa28c
c90173ece2c43673f1372e975ba9dcd3a06332abf15dbe9b67
9f6c63e30b884ab93272
G
y
= 3bdd9f19a11e888e40d7c093492d208b8fe996e8bcbdffa24c
c90173ece2c436f3f1372e175ba9dc53a063322bf15dbe1b67
9f6ce3e30b88cab93272
G
1/w
= 10000000000000001
n = 1560874275157996115690798614896583152874299071332
4855754295784798126858694154480197179544588188676
30469346980324113959778896164309795945994558356
p = 3902185687894990289226996537241457882185747678331
2139385739461995317146735386200492948861470471690
7617336745081028489944724041077448986498639589
m = 487; f = x
487
+ x
295
+ x
167
+ x
39
+ 1; d = t
69
+t
33
+t
15
+ 1
G
x
= 339b843c53c409543f396d39e57efde813f06e3099735004b
999b15776a75a4c3a22dcaf1e91e261fe479b89a64d651039
28195d727bd3d157735b2071
G
y
= 339b843c53c40954bf396d39e57efde893f06e30997350043
999b15776a75a4c3a22dcaf1e91e261fe479b89a64d6510b9
28195d727bd3d1d7735b2071
G
1/w
= 10000000000000001
n = 3995838144404470056168444454135252871358205622611
1630730997209083204758260181862138226693854521544
4668253454986755337077661569719769645413325977844
p = 9989595361011175140421111135338132178395514056527
9076827493022708011895650454655345566734636303861
167063363746688834269415392429942411353331494461
SECRYPT 2018 - International Conference on Security and Cryptography
464