%0 Conference Proceedings
%T A Family of Lightweight Twisted Edwards Curves for the Internet of Things
%+ Interdisciplinary Centre for Security, Reliability and Trust [Luxembourg] (SnT)
%+ Nanjing University of Aeronautics and Astronautics [Nanjing] (NUAA)
%A Ghatpande, Sankalp
%A Grossschädl, Johann
%A Liu, Zhe
%Z Part 6: Internet of Things
%< avec comité de lecture
%( Lecture Notes in Computer Science
%B 12th IFIP International Conference on Information Security Theory and Practice (WISTP)
%C Brussels, Belgium
%Y Olivier Blazy
%Y Chan Yeob Yeun
%I Springer International Publishing
%3 Information Security Theory and Practice
%V LNCS-11469
%P 193-206
%8 2018-12-10
%D 2018
%R 10.1007/978-3-030-20074-9_14
%Z Computer Science [cs]Conference papers
%X We introduce a set of four twisted Edwards curves that satisfy common security requirements and allow for fast implementations of scalar multiplication on 8, 16, and 32-bit processors. Our curves are defined by an equation of the form $$-x^2 + y^2 = 1 + dx^2y^2$$ over a prime field $$\mathbb {F}_p$$, where d is a small non-square modulo p. The underlying prime fields are based on “pseudo-Mersenne” primes given by $$p = 2^k - c$$ and have in common that $$p \equiv 5 \bmod {8}$$, k is a multiple of 32 minus 1, and c is at most eight bits long. Due to these common features, our primes facilitate a parameterized implementation of the low-level arithmetic so that one and the same arithmetic function is able to process operands of different length. Each of the twisted Edwards curves we introduce in this paper is birationally equivalent to a Montgomery curve of the form $$-(A+2)y^2 = x^3 + Ax^2 + x$$ where $$4/(A+2)$$ is small. Even though this contrasts with the usual practice of choosing A such that $$(A + 2)/4$$ is small, we show that the Montgomery form of our curves allows for an equally efficient implementation of point doubling as Curve25519. The four curves we put forward roughly match the common security levels of 80, 96, 112 and 128 bits. In addition, their Weierstraß representations are isomorphic to curves of the form $$y^2 = x^3 - 3x + b$$ so as to facilitate inter-operability with TinyECC and other legacy software.
%G English
%Z TC 11
%Z WG 11.2
%2 https://hal.science/hal-02294608/document
%2 https://hal.science/hal-02294608/file/484602_1_En_14_Chapter.pdf
%L hal-02294608
%U https://hal.science/hal-02294608
%~ IFIP-LNCS
%~ IFIP
%~ IFIP-TC
%~ IFIP-TC11
%~ IFIP-WISTP
%~ IFIP-WG11-2
%~ IFIP-LNCS-11469