Proposed Radix-8 Algorithm for Scalar Multiplication

We perform the scalar multiplication with a new right-to-left radix-8 algorithm using the non- seven representation of kthat is discussed in Subsection 5.3.2 and obtained in Algorithm 12. We notice that the evaluation of the scalar multiplication in the proposed radix-8 algorithm, is performed utilizing three EC-points, i.e.,PkP,P1, andPAccwithout pre-computation.

5.3. ProposedRadix-8 ScalarMultiplicationAlgorithm 97

Algorithm 13 Proposed Signed Radix-8 Scalar Multiplication Input: PointP∈E(Fq), Atdigit of integerk, i.e.,

k =(kt−1, kt−2, · · ·, k0)8,kj∈ { −1, 0, 1, · · ·, 6}. Output: PointQ=kP. Initialize:PkP← O,P1←P,PAcc←P; Step 1:For j=0 tot−1do Step 1.1:Ifkj ∈ { −1, 0, 1, 2, 4}Then Step 1.1.1:PkP ←PkP+kjPAcc;

Step 1.1.2:PAcc ←8PAcc; /* Prepare P(

j+1)

Acc */

Step 1.1.3:P1←PAcc−PkP; Step 1.2:Else If kj ∈ {3, 5, 6}Then

Step 1.2.1:P1←P1+(7−kj)PAcc;

Step 1.2.2:PAcc ←8PAcc; /* Prepare P(_Accj+1) */ Step 1.2.3:PkP ←PAcc−P1;

Step 2:End For Step 3:Return(PkP) ; as follows P_kP(j) =            P_kP(j−1)+kjP (j) Acc, if kj ∈ { −1, 0, 1, 2, 4}, 8P_Acc(j) −P₁(j), if kj ∈ {3, 5, 6}. (5.13)

Similarly, from the extension of Lemma 5.3.1, one can compute P₁(j)for any j> 0, and−1 ≤

kj ≤6, as follows P₁(j) =            8P_Acc(j) −P_kP(j), if kj ∈ { −1, 0, 1, 2, 4}, (7−kj)P (j) Acc+P (j−1) 1 , ifkj ∈ {3, 5, 6}. (5.14)

Note that the reason we have split the eight possible combinations ofkj in (5.13) into two cases is to have thekj with a maximum of one Hamming-weight in one group list. Similarly, the reason we have split the eight possible combinations of of kj in (5.14) into two cases is to have the 7− kj with a a maximum of one Hamming-weight in one group list. Based on (5.13) and (5.14), we propose Algorithm 13 in which the scalarkis obtained from the output of Algorithm 12. In Algorithm 13, it is shown that 8PAcc is computed in each iteration, and the result of its computation is stored in a register known asPAcc (see Steps 1.1.2, and 1.2.2). Hence, the value of pointP(_Accj+1) = 8P(_Accj) is evaluated in advance at the end of iteration j. The evaluation ofkPinvolves a total oftcomputational iterations. At each iteration, the sum of the

Table 5.1: An Example That Shows The Computation for kP = 6644PUsing The Proposed Signed Radix-8 Scalar Multiplication.

kjGroups Initialization (Iteration No.) ,kj=kjvalue

(0) ,k0= 4 (1) ,k1= 6 (2) ,k2=−1 (3) ,k3= 5 (4) ,k4= 1 (5) ,k4= 0 PkP ← O kj∈ {−1,0,1, PAcc←P PkP←4P PkP← −12P PkP←6644P PkP←6644P 2,4}. P1←P

PAcc←8P PAcc←512P PAcc←32768P PAcc←262144P P1←4P P1←524P P1←26124P P1←255500P

kj∈ {3,5,6}.

PkP←52P PkP←2548P PAcc←64P PAcc←4096P P1←12P P1←1548P

two pointsPkP andP1are always equal to the value of point PAcc. The final result of thekPis obtained at the last iteration, which is the content values of the registerPkPat the iterationt−1. It is noteworthy that both Algorithms 12, and 13 are evaluated from right to left; hence, they can be interleaved resulting in a significant memory register reduction, because it eliminates the need to store both the scalar and its recoding.

We illustrate Algorithm 13 by showing an example of computing kP. Suppose thatk =

6644 and has an octal representation of (14764)8, which can be further represented as (015¯164)8,

where ¯1= −1, using the non-seven recoding method that is shown in Algorithm 12. Table 5.1, illustrates the process of computingkPby exploiting the proposed signed radix-8 scalar multi- plication that is shown in Algorithm 13.

As shown in Table 5.1, the three registers PkP, P1, and PAcc are initialized toO, P, and P, respectively (see the Initialize step in Algorithm 13). The loop started in Step 1, is executed

t times, that is t =

log₈6644+

1 = 6 in this example. As shown in Step 1 in Algorithm 13, theforloop iteration starts from the least significant octal value ofk. This is shown in the third column of Table 5.1. If the octal digit, i.e.,kj in a column iskj ∈ { −1, 0, 1, 2, 4}, then the operations in Steps from 1.1.1 to 1.1.3 are sequentially computed. On the other hand, if

kj ∈ {3, 5, 6}, then the operations in Steps from 1.2.1 to 1.2.3 in Algorithm 13 are sequentially computed. Eventually, the content of the PkP register, at iterationt−1 = 5 (initial iteration = 0), contains the desired computation ofkP, i.e., in the rightmost column in Table 5.1. It is clear from the presented example that the total number of computational cycles required is 6.

5.4. ProposedRegularECSM Scheme 99

Table 5.2: The 4 Stages That The Proposed Algorithm 13 Evaluates for Each Value ofkj.

kj Processing Stages kj Processing Stages

-1

PT emp←2PAcc.

3

PAcc←2PAcc.

PT emp←2PT emp. PAcc←2PAcc.

PkP ←PkP −PAcc,† PAcc←2PT emp. P1←PAcc+P1, PAcc←2PAcc.

P1←PAcc−PkP. PkP ←PAcc−P1.

0

PT emp←2PAcc.

4

PAcc←2PAcc.

PT emp←2PT emp. PAcc←2PAcc.

PkP ←PAcc−P1,† PAcc←2PT emp. PkP ←PAcc+PkP, PAcc←2PAcc.

P1←PAcc−PkP. P1←PAcc−PkP.

1

PT emp←2PAcc.

5

PAcc←2PAcc.

PT emp←2PT emp. PT emp←2PAcc.

PkP ←PAcc+PkP, PAcc←2PT emp. P1←PAcc+P1, PAcc←2PT emp.

P1←PAcc−PkP. PkP ←PAcc−P1.

2

PAcc←2PAcc.

6

PT emp←2PAcc.

PT emp←2PAcc. PT emp←2PT emp.

PkP ←PAcc+PkP, PAcc←2PT emp. P1←PAcc+P1, PAcc←2PT emp.

P1←PAcc−PkP. PkP ←PAcc−P1.

†_{The SUB operation can be easily obtained using the ADD operation.}