引用本文： 陶铮,胡志.同源密码中Montgomery模型的w-坐标研究[J].信息安全学报,2021,6(6):92-101    [点击复制] TAO Zheng,HU Zhi.On the w-coordinates of Montgomery Model in Isogeny-based Cryptography[J].Journal of Cyber Security,2021,6(6):92-101   [点击复制]
 【打印本页】 【下载PDF全文】 【查看/发表评论】【下载PDF阅读器】【关闭】
 本文已被：浏览 2919次   下载 2297次 码上扫一扫！ 同源密码中Montgomery模型的w-坐标研究 陶铮, 胡志 0 字体:加大+|默认|缩小- (中南大学数学与统计学院 长沙 中国 410083)

DOI：10.19363/J.cnki.cn10-1380/tn.2021.11.08

On the w-coordinates of Montgomery Model in Isogeny-based Cryptography
TAO Zheng, HU Zhi
(School of Mathematics and Statistics, Central South University, Changsha 410083, China)
Abstract:
Elliptic curve group law calculation is the core operation of traditional Elliptic Curve Cryptography (ECC), which is also an important part of isogeny-based post quantum cryptography. The Montgomery ladder algorithm on Montgomery curve is an efficient (pseudo) group law calculation method, which is commonly used to resist side channel attacks. Farashahi and Hosseini in ACISP 2017 proposed the w-coordinates on Edwards curve model which could induce Montgomery-like ladder algorithm for group law calculation. By adopting such w-coordinates, Kim et al. in Asiacrypt 2019 optimized odd order isogeny computation. After that, several works have been devoted to extensively exploiting w-coordinates on different elliptic curve models. Essentially, the w-coordinates are rational functions of the traditional (x, y)-coordinates for rational points. Compared with the standard elliptic curve rational point (x, y)-coordinate, the w-coordinate not only reduces the amount of intermediate calculation in group law calculation and isogeny calculation, but also saves half of the bandwidth. Hisil and Renes in ACM TOMS 2019 considered how to obtain more w-coordinates by adding some 2-torsion point. Inspired by their work, this paper proposes three new w-coordinates by using a 2-isogeny on Montgomery curve, which are similar to the x-coordinate. These w-coordinates can be applied to Montgomery ladder algorithm, as well as to the optimization of odd degree isogeny computation. Simultaneously, in the calculation of the odd-numbered homology of the w-coordinate, the calculation formula of the Montgomery curve coefficient is similar to the isogeny formula, so the SIMD instruction set can be used to parallelize the coordinate calculation and the coefficient calculation, so as to obtain the further acceleration of the isogeny calculation. Moreover, since curve models such as Edwards, Huff, and Jacobi can establish a rational equivalent mapping with the Montgomery curve model under certain conditions, more w-coordinates can be developed from the three new types of w-coordinates, which implies such curve models can possess more w-coordinates to design better algorithms for isogeny based cryptography.
Key words: