Low-Power Flexible GF(p) Elliptic-Curve Cryptography Processor

Hamid Reza Ahmadi and Ali Afzali-Kusha School of Electrical and Computer Engineering

University of Tehran Tehran, Iran

E-mail: hrahmadi@ut.ac.ir and afzali@ut.ac.ir

Abstract—In this paper, we present a very low power standard public-key cryptography processor for use in power-limited applications. The proposed prime-field elliptic-curve cryptography processor is flexible in terms of field and curve parameters. The power consumption of the structure is minimized by simplifying the architecture and circuit implementation. To assess the power efficiency of the design, we have implemented the processor for 192-bit fields using a standard 0.13μm CMOS technology. The simulation results show that the processor consumes only 26.3 μW/MHz which is considerably lower than the power consumptions reported for similar designs. The hardware completes a 192-bit scalar multiplication in 1.15 s at a frequency of 13.56 MHz. With these specifications, the proposed processor may be used in many applications of RFID tags and wireless sensors.

I. INTRODUCTION Public-key cryptography (PKC) algorithms and protocols

based on elliptic curves (EC) have attracted considerable attention in recent years [1]. Many of the research activities in this area have been focused on the applications which have limited resources available such as RFID tags, wireless sensors and contactless smart cards [2]. For these applications, there was a common belief that the use of the standard PKC algorithms such as ECC is not feasible, mainly due to the complex and calculation-intensive nature of these algorithms [2]. Therefore, much of the efforts have been confined to using the much smaller symmetric cryptography algorithms (e.g., [3]) or designing the so-called light-weight PKC algorithms (e.g., [4]). On the other hand, using the standard PKC algorithms is generally recommended because of their efficiency in implementing different security services [5][6]. In addition, the standard PKC algorithms are necessary for providing services like the broadcast authentication in sensor networks [2]. These reasons have been the driving force for examining the possibility of implementing standard PKC algorithms on resource-limited devices like wireless sensors and the RFID tags. Among well-known PKC algorithms, EC-based cryptography has the advantage of providing the necessary level of security with a smaller size of the underlying number field [7]. This feature makes these algorithms more suitable for use in applications with power and/or area limitations. Recently, EC-based cryptography hardware designs have been shown to be able to meet area and power limitations of such devices and/or applications [2].

In this paper, we present a very low-power implementation of elliptic-curve cryptography for devices such as wireless sensors and RFID tags. The rest of the paper is organized as follows. Section II provides a brief mathematical background of the EC-based cryptography while a brief review of previous works is given in Section III. We present the proposed ECC processor design in Section IV and compare it with previously reported ECC processors in Section V. Finally, the conclusion of the paper is given in Section VI.

II. MATHEMATICAL BACKGROUND A prime field denoted by GF(p), is the set of all integers

modulo a prime ‘p’ (i.e. {0, 1, 2, ..., p-1}) together with addition and multiplication of integers modulo ‘p’ [7]. For use in elliptic-curve cryptography, an elliptic curve E over GF(p) is defined as a set of points P = (x , y) with x and y ∈ GF(p), which satisfy the simplified Weierstrass equation as

).mod(32 pbxaxy ++≡ (1)

Here, a and b ∈ GF(p) and 4a3 + 27b2 ≠ 0. Another point ‘O’ at infinity is also included in the curve. The field parameter is ‘p’ and its length in bits is the field size, while ‘a’ and ‘b’ are the curve parameters. Note that in the hardware implementation, the field size is the bit-length of the numbers corresponding to the size of the registers and therefore is a constant in any specific implementation (e.g., 192 bits in this design).

Over the curve E, a ‘Point Addition’ operation is defined where for every two points P1 and P2 ∈ E, there exists a point P3 ∈ E obtained from P3 = P1 + P2. Based on the geometric properties of elliptic curves, this operation is defined as

EyxPyxP ∈==∀ ),(2,),(1 2211 (2)

213,),(3 33 PPPEyxP +=∋∈=∃ (3)

1313212

3 )(, yxxyxxx −−Δ=−−Δ= (4)

⎪⎪⎩

⎪⎪⎨

⎧

=+

≠−−

=Δ21

23

21

1

21

12

12

PPy

ax

PPxxyy

(5)

As deduced from (4) and (5), to perform a point addition, one needs to do addition (and subtraction), multiplication and division (i.e., inversion) operations on integer numbers. All of these operations must be performed modulo a prime ‘p’.

Using repeated point additions, another operation called ‘Scalar Point Multiplication’ is defined where for every point P ∈ E and every integer k ∈ GF(p), there exists a point Q ∈ E, equal to Q = k P.

…timeskadd

PPPPPkQ1−

++++== (6)

Elliptic curves defined over binary extension fields GF(2m), follow the same definitions but have slightly different equations. More details on the mathematics of elliptic curve cryptography can be found in [7].

EC cryptography is based on the hardness of finding the value ‘k’ from known points P and Q when Q = k P. This is called the ‘elliptic-curve discrete logarithm problem’ (ECDLP). Cryptographic protocols based on elliptic curves are mathematical procedures that manipulate and hide the information (i.e. numbers or messages) using the hardness of ECDLP. The point addition and point multiplication operations are performed by ECC processors which are the building blocks of the systems using EC-based cryptography.

III. RELATED WORKS One obvious design method to obtain a low-area (and hence

low-power) hardware for calculation-intensive mathematics applications such as EC cryptography, is simplifying the underlying equations. Different research groups have taken several approaches for this simplification. Most of the efforts have confined their designs to the elliptic curves over the binary extension fields (see, e.g., [8]-[11]). Working on these fields, one may take advantage of more simple carry-free binary field operations. Generally, these designs do not support prime field operations assuming another processor (or other computing resource) can perform those operations when necessary. In addition to using binary extension fields, the flexibility of the design parameters has been further reduced in order to meet the power limitations. For example, in [8], this has been performed by limiting the parameters to only one special elliptic curve (usually the ones recommended by a standard). As another example, by selecting special field sizes, very low power levels for the GF(2m) ECC hardware have been achieved in [11]. In such cases, the pre-selected parameters either hardwired in the RT-level design or imprinted in ROM blocks, and hence, may not be changed while in use.

Confining the design to binary fields and limiting the flexibility of the design parameters restricts the number of applications which can use the final device. Using these designs, any change in the security parameters will require that all of the devices (tags/sensors) be replaced. A more important drawback of these approaches is that they may not be used for higher level standard EC-based protocols like ECDSA (Elliptic Curve Digital Signature Algorithm). These protocols, in addition to EC point operations, are based on normal integer modulo operations. For the binary field designs, as stated in [12], these modulo operations must be done either in a separate

processor (which is not present in many of the RFID tags) or in a separate hardware (which will consume additional power).

The same approach of limiting the flexibility of design parameters for reducing the power consumption has also been used in designs based on elliptic curves over the prime fields. In [2], [6], and [13], special prime numbers were chosen to simplify the arithmetic implementations. Even these GF(p) designs will need a separate hardware for normal-integer operations [14].

Therefore, generic prime-field ECC designs which are able to perform both the EC point operations and integer modulo operations and consume low power are more desired.

Next, we review low-power ECC designs over prime fields. Many papers exist in the literature, that consider the case of the ECC over prime fields (e.g., [15]). Here, we only focus on those which have power levels suitable for RFID tags (and/or wireless sensors) ([12], [14], [16], and [17]). These designs have minimized the power consumption using, e.g., an optimum choice of the curve point coordinates, different mathematical methods, and special design techniques such as bit-serialization.

Generic GF(p) ECC processors for use in ECDSA calculations on RFID tags are presented in [14] and [16]. For the field multiplication, a radix-4 Montgomery multiplier with Booth recoding is used. The radix-4 is used to reduce area-cycles product of the processor. To perform the field inversion, they used the Extended Euclidean Algorithm (EEA) [7]. Finally, to minimize the critical paths, carry-save adders (CSA’s) have been employed. However, some of these design decisions may not be the best choice when the power consumption should be minimized.

A more favorable design has been presented in [12] which is a dual-field ECC processor performing both prime and binary field operations. To reduce the power consumption, they made use of techniques such as clock-gating and glitch-elimination and used a bit-serial implementation of the Montgomery multiplier. Since the RFID tag application is not time-critical, their design operated at a frequency of 100 KHz. Another dual-field ECC processor for use in RFID tags has been presented in [17]. Although the main goal was to reach RFID-level power consumption, carry-save adders and redundant number representation were used to minimize the critical path delay for obtaining a higher maximum clock frequency. This design also uses the EEA for the inversion and the Montgomery method for the field multiplication.

Finally, note that resource-limited devices such as PDAs, wireless sensors, and RFID tags cover a wide range of applications which many of them do not impose severe limitations on the calculation time (for the cryptography part). This allows the designers to use lower clock frequencies and trade-off calculation time with the power consumption. Many of the works discussed in this section, reported frequencies in the range of 100-500 KHz for their EC-based hardware designs.

IV. DESIGN OF OUR ECC PROCESSOR In this section, we present our design of a low-power

prime-field elliptic-curve crypto-processor suitable for use in

power-constrained devices like RFID tags, wireless sensors, and contactless smart cards.

A. Features of the selected design method In this section, we explain the low-power flexible ECC

processor presented in this work. The implementation has the features explained next. The design is a prime field processor which can perform all of the necessary cryptography operations by itself without requiring any additional processors. Also, the support for the binary field operations may later be added to the design with a minimal overhead (similar to [17]). The design is completely flexible in terms of the field size and field and curve parameters. The design does not use any special hardware optimization for a specific field size (i.e., the bit-width of the prime number ‘p’), and hence, can be synthesized for any desirable number length. Also, when synthesized for a specific field size, the processor can perform calculations for any chosen prime number ‘p’ with a length smaller than the designed field size. All of the field and elliptic curve parameters are given as inputs to this ECC processor. This guarantees the reusability of the hardware when a change in the security parameters is needed.

The design is based on the affine representation of the curve points. This reduces the necessary storage elements to the minimum of two registers for a curve point and leads to lower power consumption [14]. The calculation time, however, will be longer due to the necessary inversion operations [8]. Also, to further minimize the power consumption, we avoided introducing complexity throughout the design as much as possible. This allowed the synthesis tool to do more efficient optimizations. For example, instead of using RAM to store intermediate variables (like [11] and [17]), we have used normal flip-flops. This simplified the controllers and also provided us with good power-saving options like using the clock-gating technique.

B. Architecture of the ECC processor The overall architecture of our design is shown in Fig. 1.

The architecture which is simple, consists of only two calculation units as the central part of the design. The two units which are an adder/subtractor with modulo reduction (see Fig. 2(a)) and a Montgomery-domain multiplier (see Fig. 2(b)) are very similar to what have been used in [15] with the difference that we have not merged them into one larger ALU. Our study shows that merging the two units increases the number of multiplexers, giving rise to an increase in the power consumption. The adder/subtractor unit can output a new result in each clock cycle and the multiplier performs a Montgomery multiplication in ‘n’ clock cycles, where ‘n’ is the field size. More details of the units can be found in [15]. In addition to these calculation units, a dedicated controller consisting of three inter-related FSMs controls the adder/subtractor and multiplier units to perform the EC point addition and point doubling operations. In addition to the two dedicated registers (B and R in Fig. 2(b)) of the Montgomery multiplier, this controller uses three registers to store the temporary values. These temporary registers have the same width as the field size.

The controller (FSMs) along with the three registers, the necessary multiplexers, and the two calculation units, are called the ‘Point-Adder’. At the top level (shown in Fig. 1), another

controller uses the ‘Point-Adder’ to perform the scalar point multiplication. At this level, only two more registers are needed which will finally contain the coordinates of the resulting curve point. The value of the ‘scalar’ is shifted in bit-by-bit by the controller which best suits the RFID tag and wireless sensor systems [16].

To achieve a minimum hardware size, this design uses the same adder/subtractor and multiplier units to perform all of the operations including the field inversion. To do this, the Fermat’s Little Theorem [7] is used. Using this theorem, a prime field inversion is transformed into a modular exponentiation using

).(mod21 pp −− Χ≡Χ (7)

The exponentiation is done using multiple modular multiplications which can be performed using the same Montgomery multiplier. Although the decision to use (7) for the inversion operation reduces the hardware cost to only four additional states in the controller FSM, at the same time it causes the calculation time to become large which is considered a design trade-off.

Figure 1. Architecture of the ECC processor.

Figure 2. (a) Adder/subtractor with modulo reduction. (b) Montgomery Multiplier. Redrawn from [15].

C. Low Power Design of the ECC processor The application of this ECC processor in RFID tags and

wireless sensors allows the use of very low clock frequencies. We have used this property throughout the design process. This has allowed us to use smaller adder blocks with longer critical paths inside the two calculation units while in other works (e.g., [14], [16], and [17]) larger adder blocks which are faster have been used. In addition, special care was given during the synthesis of the design to use only the smallest version of each technology standard cell. This led to some extra power savings.

As a more effective technique to reduce the power consumption, we have also used the clock-gating technique which is explained here. The design makes use of totally seven registers each with the same width as the field size. The typical field sizes used for the ECC are in the range of 160 up to 500 bits (192 bits in our design). With more than 1000 flip-flops, an efficient application of the clock-gating technique may significantly reduce the power consumption. The performance of the clock-gating in reducing the power consumption of a register becomes smaller when its value changes more frequently, and even may be negative when the rate of the changes becomes very high. Our tests show that the threshold rate for the usefulness of the clock gating is dependent on the design, synthesis parameters, and the CMOS technology characteristics. Therefore, the exact effect of the clock-gating on each of the registers should be checked by simulation.

The simulations show that in our design the two registers of the Montgomery multiplier have high enough usage that the clock-gating does not reduce their power consumption. The other five registers benefit from the clock-gating, especially the two registers at the top level which have relatively lower value changes. Our results showed that the application of this technique to our 192-bit ECC processor led to a 39.4 percent reduction in the total power consumption.

V. RESULTS AND DISCUSSION The proposed 192-bit prime filed ECC processor design

was synthesized in a standard 0.13 μm CMOS technology. The hardware specifications and the results of the hardware synthesis are shown in TABLE I. The area of the processor is small enough to be embedded in RFID and wireless sensor applications as well as contactless smart cards. The design’s maximum frequency enables the ECC processor to be used in many standard applications such as proximity and vicinity contactless cards, RFID item management and EPC (Electronic Product Code) which are based on the 13.56 Megahertz radio signals.

TABLE I. RESULTS OF ECC PROCESSOR SYNTHESIS

Field Type Prime

Field Size 192 bits

ECC Parameters Flexible

CMOS Technology 0.13 μm

Number of cells 2808 cells

Total Area < 0.15 mm2

Maximum Frequency > 18 MHz

TABLE II. POWER/ENERGY AND TIMING OF THE ECC PROCESSOR

CMOS Technology 0.13 μm 0.18 μm Average Power

Consumption (μW/MHz) 26.3 129

Total energy (for 1 scalar multiplication) 410.1 μWs 2.01 mWs

Total time (for 1 scalar multiplication)

@ f = 13.56 MHz ∼ 1.15 s

TABLE III. COMPARISON OF ECC PROCESSOR DESIGNS

Design CMOS Technology

Avg. Power ( μW/MHz ) Field

[6] 0.13 μm 49.5 168 bit special prime

[13] 0.13 μm 788.8 102 bit special prime

[10] 0.13 μm 42.8 193 bit binary

[11] 0.13 μm < 65 134 bit binary

This work 0.13 μm 26.3 192 bit

flexible prime

[17] 0.18 μm 170 192 bit flexible prime

This work 0.18 μm 129 192 bit

flexible prime

TABLE II shows the power/energy consumption and timing characteristics of the ECC processor. The average power consumption is derived from simulations with many different random field parameters, curve points, and scalar numbers. To be able to compare our design to previously reported designs, we also used a standard 0.18 μm CMOS technology and measured the corresponding power consumption. To compare the design in this work with the designs reported in the literature, we have used a metric of the average power per Megahertz of the clock frequency. Since for a given application, the required frequency is fixed, a lower value for the power per Megahertz of the clock frequency is desired. This metric for different designs are presented in TABLE III. These references have used the same technologies as used in this work. The results reveal that, for a given technology, the proposed design leads to a considerably lower power consumption.

The lower power consumption obtained in our design has been obtained at the cost of a longer calculation time compared to the other designs considered in this work. Therefore, the design may not be suitable for RFID tag applications which require shorter calculation times. This is a direct result of using the Fermat’s Little Theorem for the calculation of the field inversion operation combined with the serial one-bit-per-clock-cycle design of the Montgomery multiplier.

VI. CONCLUSION In this work, we presented a very low power flexible design

of an elliptic-curve cryptography processor. It is suitable for use in many applications of RFID tags and wireless sensors as well as contactless smart cards. Minimizing the power

consumption was achieved by using different low-power techniques. Using these techniques, a generic flexible hardware for ECC on prime fields was obtained with the same level of power consumption as specific-parameter binary-field ECC designs. To compare the power efficiency of this design, we designed and simulated the processor in 0.13 μm and 0.18 μm CMOS technologies and compared it with the previously reported processors. The results showed a considerably lower power consumption for this ECC processor compared to those of similar processors. As a result this processor may be used for very low power applications where the calculation time is not of a prime concern.

REFERENCES

[1] C. J. McIvor, M. McLoone, and J. V. McCanny, “Hardware Elliptic Curve Cryptographic Processor Over GF(p),” IEEE Transactions on Circuits and Systems, vol. 53, no. 9, pp. 1946-1956, Sep 2006.

[2] J. P. Kaps, “Cryptography for Ultra-Low Power Devices,” Ph.D. dissertation, ECE Department, Worcester Polytechnic Institute, Worcester, Massachusetts, USA, May 2006.

[3] M. Feldhofer, J. Wolkerstorfer, and V. Rijmen, “AES implementation on a grain of sand,” Information Security, IEE Proceedings, vol. 152, no. 1, pp. 13–20, Oct 2005.

[4] J. P. Kaps, G. Gaubatz, and B. Sunar, “Cryptography on a Speck of Dust,” IEEE Computer, vol. 40, no. 2, pp. 38-44, Feb 2007.

[5] M. Aigner, “Seven reasons for application of standardized crypto functionality on low cost tags,” In Proceedings of the EU RFID Forum (RFID Convocation), Brussels, Belgium, Mar 2007.

[6] E. Öztürk, B. Sunar, and E. Savaş, “Low-Power Elliptic Curve Cryptography Using Scaled Modular Arithmetic,” In Proceedings of the sixth International Workshop on Cryptographic Hardware in Embedded Systems (CHES), volume 3156 of Lecture Notes in Computer Science, pp. 92-106. Springer-Verlag, Aug 2004.

[7] D. Hankerson, A. J. Menezes, and S. Vanstone, Guide to Elliptic Curve Cryptography. Springer-Verlag Inc., Berlin, Germany, 2004.

[8] S. S. Kumar and C. Paar, “Are standards compliant Elliptic Curve Cryptosystems feasible on RFID?,” In Proceedings of Workshop on RFID Security, page 19, Graz, Austria, July 2006.

[9] G. Bertoni, L. Breveglieri, and M. Venturi, “ECC Hardware Coprocessors for 8-bit Systems and Power Consumption Considerations,” In Proceedings of the Third IEEE International Conference on Information Technology: New Generations, ITNG’06, pp. 573-574, 2006.

[10] G. M. de Dormale, R. Ambroise, D. Bol, J. J. Quisquater, and J. D. Legat, “Low-Cost Elliptic Curve Digital Signature Coprocessor for Smart Cards,” In Proceedings of the IEEE 17th International Conference on Application-specific Systems, Architectures and Processors, ASAP’06, pp. 347-353, 2006.

[11] L. Batina, N. Mentens, K. Sakiyama, B. Preneel, and I. Verbauwhede, “Public-Key Cryptography on the Top of a Needle,” In Proceedings of the IEEE International Symposium on Circuits and Systems, ISCAS’07, pp. 1831-1834, May 2007.

[12] M. Feldhofer and J. Wolkerstorfer, “Strong Crypto for RFID Tags – A Comparison of Low-Power Hardware Implementations,” In Proceedings of the IEEE International Symposium on Circuits and Systems, ISCAS’07, pp. 1839-1842, May 2007.

[13] G. Gaubatz, J. P. Kaps, E. Öztürk, and B. Sunar, “State of the Art in Ultra-Low Power Public Key Cryptography for Wireless Sensor Networks,” In Proceedings of the Third IEEE international Conference on Pervasive Computing and Communications Workshops, pp. 146–150, March 2005.

[14] F. Fürbass and J. Wolkerstorfer, “ECC Processor with Low Die Size for RFID Applications,” In Proceedings of the IEEE International Symposium on Circuits and Systems, ISCAS’07, pp. 1835-1838, May 2007.

[15] A. Byrne, N. Meloni, F. Crowe, W. P. Marnane, A. Tisserand, and E. M. Popovici, “SPA resistant Elliptic Curve Cryptosystem using Addition Chains,” In Proceedings of the Fourth IEEE International Conference on Information Technology: New Generations, ITNG’07, pp. 995-1000, Apr 2007.

[16] F. Fürbass, “ECC Signature Generation Device for RFID Tags,” Programme for Advanced Contactless Technologies - Best Paper Award, Graz University of Technology, Austria, Sep 2006.

[17] J. Wolkerstorfer, “Scaling ECC Hardware to a Minimum,” ECRYPT workshop - Cryptographic Advances in Secure Hardware (CRASH 2005), Invited talk, Sep 2005.