Are there shortcuts for computing ECC Point multiplication?












1












$begingroup$


I'm trying to learn about elliptic curve cryptography.



Let's say you have point $P$ and 256 bit number $n$ and you want to compute $nP$. It sounds like computing additions one at a time is not computationally feasible. Is there an algorithmic "shortcut" to compute this? If so, how does it work?






elliptic-curves







share|improve this question









New contributor




Jon Aird is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.







$endgroup$








  • 1




    $begingroup$
    First google hits en.wikipedia.org/wiki/Elliptic_curve_point_multiplication and crypto.stackexchange.com/questions/3907/… .
    $endgroup$
    – dave_thompson_085
    2 days ago
















1












$begingroup$


I'm trying to learn about elliptic curve cryptography.



Let's say you have point $P$ and 256 bit number $n$ and you want to compute $nP$. It sounds like computing additions one at a time is not computationally feasible. Is there an algorithmic "shortcut" to compute this? If so, how does it work?






elliptic-curves







share|improve this question









New contributor




Jon Aird is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.







$endgroup$








  • 1




    $begingroup$
    First google hits en.wikipedia.org/wiki/Elliptic_curve_point_multiplication and crypto.stackexchange.com/questions/3907/… .
    $endgroup$
    – dave_thompson_085
    2 days ago














1












1








1





$begingroup$


I'm trying to learn about elliptic curve cryptography.



Let's say you have point $P$ and 256 bit number $n$ and you want to compute $nP$. It sounds like computing additions one at a time is not computationally feasible. Is there an algorithmic "shortcut" to compute this? If so, how does it work?






elliptic-curves







share|improve this question









New contributor




Jon Aird is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.







$endgroup$




I'm trying to learn about elliptic curve cryptography.



Let's say you have point $P$ and 256 bit number $n$ and you want to compute $nP$. It sounds like computing additions one at a time is not computationally feasible. Is there an algorithmic "shortcut" to compute this? If so, how does it work?






elliptic-curves




elliptic-curves






share|improve this question









New contributor




Jon Aird is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.











share|improve this question









New contributor




Jon Aird is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









share|improve this question




share|improve this question








edited 2 days ago









AleksanderRas

2,8901835




2,8901835






New contributor




Jon Aird is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









asked 2 days ago









Jon AirdJon Aird

61




61




New contributor




Jon Aird is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.





New contributor





Jon Aird is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.






Jon Aird is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.








  • 1




    $begingroup$
    First google hits en.wikipedia.org/wiki/Elliptic_curve_point_multiplication and crypto.stackexchange.com/questions/3907/… .
    $endgroup$
    – dave_thompson_085
    2 days ago














  • 1




    $begingroup$
    First google hits en.wikipedia.org/wiki/Elliptic_curve_point_multiplication and crypto.stackexchange.com/questions/3907/… .
    $endgroup$
    – dave_thompson_085
    2 days ago








1




1




$begingroup$
First google hits en.wikipedia.org/wiki/Elliptic_curve_point_multiplication and crypto.stackexchange.com/questions/3907/… .
$endgroup$
– dave_thompson_085
2 days ago




$begingroup$
First google hits en.wikipedia.org/wiki/Elliptic_curve_point_multiplication and crypto.stackexchange.com/questions/3907/… .
$endgroup$
– dave_thompson_085
2 days ago










1 Answer
1






active

oldest

votes


















3












$begingroup$

It is called "double-and-add". For instance, take a point, and add it to itself. Then take the result, and add it to itself. Do that again. And again. After ten additions, what you get is $2^{10} = 1024$ times the original point: in just 10 additions, not 1023. That's the "shortcut".



More generally, with $k$ successive doublings (a "doubling" is the addition of a point with itself), starting from a point $P$, you get $2^k P$. Now, all you have to do is to consider your multiplier $n$ in binary: this is about writing it as a sum of powers of two. For instance, if $n = 224965$, then, in binary, it becomes $110110111011000101$, which means that:
$$ n = 2^0 + 2^2 + 2^6 + 2^7 + 2^9 + 2^{10} + 2^{11} + 2^{13} + 2^{14} + 2^{16} + 2^{17} $$
And therefore:
$$ nP = 2^0P + 2^2P + 2^6P + 2^7P + 2^9P + 2^{10}P + 2^{11}P + 2^{13}P + 2^{14}P + 2^{16}P + 2^{17}P $$
So all you have to do to compute $nP$ is to compute these $2^kP$ (with successive doublings) and then add them together.



$2^0P$ is just $P$, so you already have it. Double it twice, and you get $2^2P$. Double that one four times, and you get $2^6P$. And so on. With $17$ doublings, you'll get all $2^kP$ for $k$ up to $17$, so in particular you'll get all the values you are interested in. As the formulas above show, ten extra additions, between the eleven $2^kP$ that are needed, will yield the result. In total, you got $224965 P$ with $17$ doublings and $10$ additions, i.e. much fewer than $224964$.



In all generality, if $n$ is a number of $t$ bits (i.e. less than $2^t$), then $t-1$ doublings and at most $t-1$ extra additions are enough.



There are many variations upon this mechanism, depending on how you interleave the doublings and the additions, and possibly reuse some addition results. You'll still need to compute the $t-1$ doublings, but you may save on some of the extra additions. How many intermediate results you need to keep in RAM is also a consideration. Moreover, if $n$ is a secret value, then you'll want to avoid side-channel attacks that may result in leaking some of the bits of $n$, and this impacts the kinds of double-and-add algorithms you can tolerate.






share|improve this answer









$endgroup$













    Your Answer





    StackExchange.ifUsing("editor", function () {
    return StackExchange.using("mathjaxEditing", function () {
    StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix) {
    StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
    });
    });
    }, "mathjax-editing");

    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "281"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: false,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: null,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    noCode: true, onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });






    Jon Aird is a new contributor. Be nice, and check out our Code of Conduct.










    draft saved

    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f68278%2fare-there-shortcuts-for-computing-ecc-point-multiplication%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    3












    $begingroup$

    It is called "double-and-add". For instance, take a point, and add it to itself. Then take the result, and add it to itself. Do that again. And again. After ten additions, what you get is $2^{10} = 1024$ times the original point: in just 10 additions, not 1023. That's the "shortcut".



    More generally, with $k$ successive doublings (a "doubling" is the addition of a point with itself), starting from a point $P$, you get $2^k P$. Now, all you have to do is to consider your multiplier $n$ in binary: this is about writing it as a sum of powers of two. For instance, if $n = 224965$, then, in binary, it becomes $110110111011000101$, which means that:
    $$ n = 2^0 + 2^2 + 2^6 + 2^7 + 2^9 + 2^{10} + 2^{11} + 2^{13} + 2^{14} + 2^{16} + 2^{17} $$
    And therefore:
    $$ nP = 2^0P + 2^2P + 2^6P + 2^7P + 2^9P + 2^{10}P + 2^{11}P + 2^{13}P + 2^{14}P + 2^{16}P + 2^{17}P $$
    So all you have to do to compute $nP$ is to compute these $2^kP$ (with successive doublings) and then add them together.



    $2^0P$ is just $P$, so you already have it. Double it twice, and you get $2^2P$. Double that one four times, and you get $2^6P$. And so on. With $17$ doublings, you'll get all $2^kP$ for $k$ up to $17$, so in particular you'll get all the values you are interested in. As the formulas above show, ten extra additions, between the eleven $2^kP$ that are needed, will yield the result. In total, you got $224965 P$ with $17$ doublings and $10$ additions, i.e. much fewer than $224964$.



    In all generality, if $n$ is a number of $t$ bits (i.e. less than $2^t$), then $t-1$ doublings and at most $t-1$ extra additions are enough.



    There are many variations upon this mechanism, depending on how you interleave the doublings and the additions, and possibly reuse some addition results. You'll still need to compute the $t-1$ doublings, but you may save on some of the extra additions. How many intermediate results you need to keep in RAM is also a consideration. Moreover, if $n$ is a secret value, then you'll want to avoid side-channel attacks that may result in leaking some of the bits of $n$, and this impacts the kinds of double-and-add algorithms you can tolerate.






    share|improve this answer









    $endgroup$


















      3












      $begingroup$

      It is called "double-and-add". For instance, take a point, and add it to itself. Then take the result, and add it to itself. Do that again. And again. After ten additions, what you get is $2^{10} = 1024$ times the original point: in just 10 additions, not 1023. That's the "shortcut".



      More generally, with $k$ successive doublings (a "doubling" is the addition of a point with itself), starting from a point $P$, you get $2^k P$. Now, all you have to do is to consider your multiplier $n$ in binary: this is about writing it as a sum of powers of two. For instance, if $n = 224965$, then, in binary, it becomes $110110111011000101$, which means that:
      $$ n = 2^0 + 2^2 + 2^6 + 2^7 + 2^9 + 2^{10} + 2^{11} + 2^{13} + 2^{14} + 2^{16} + 2^{17} $$
      And therefore:
      $$ nP = 2^0P + 2^2P + 2^6P + 2^7P + 2^9P + 2^{10}P + 2^{11}P + 2^{13}P + 2^{14}P + 2^{16}P + 2^{17}P $$
      So all you have to do to compute $nP$ is to compute these $2^kP$ (with successive doublings) and then add them together.



      $2^0P$ is just $P$, so you already have it. Double it twice, and you get $2^2P$. Double that one four times, and you get $2^6P$. And so on. With $17$ doublings, you'll get all $2^kP$ for $k$ up to $17$, so in particular you'll get all the values you are interested in. As the formulas above show, ten extra additions, between the eleven $2^kP$ that are needed, will yield the result. In total, you got $224965 P$ with $17$ doublings and $10$ additions, i.e. much fewer than $224964$.



      In all generality, if $n$ is a number of $t$ bits (i.e. less than $2^t$), then $t-1$ doublings and at most $t-1$ extra additions are enough.



      There are many variations upon this mechanism, depending on how you interleave the doublings and the additions, and possibly reuse some addition results. You'll still need to compute the $t-1$ doublings, but you may save on some of the extra additions. How many intermediate results you need to keep in RAM is also a consideration. Moreover, if $n$ is a secret value, then you'll want to avoid side-channel attacks that may result in leaking some of the bits of $n$, and this impacts the kinds of double-and-add algorithms you can tolerate.






      share|improve this answer









      $endgroup$
















        3












        3








        3





        $begingroup$

        It is called "double-and-add". For instance, take a point, and add it to itself. Then take the result, and add it to itself. Do that again. And again. After ten additions, what you get is $2^{10} = 1024$ times the original point: in just 10 additions, not 1023. That's the "shortcut".



        More generally, with $k$ successive doublings (a "doubling" is the addition of a point with itself), starting from a point $P$, you get $2^k P$. Now, all you have to do is to consider your multiplier $n$ in binary: this is about writing it as a sum of powers of two. For instance, if $n = 224965$, then, in binary, it becomes $110110111011000101$, which means that:
        $$ n = 2^0 + 2^2 + 2^6 + 2^7 + 2^9 + 2^{10} + 2^{11} + 2^{13} + 2^{14} + 2^{16} + 2^{17} $$
        And therefore:
        $$ nP = 2^0P + 2^2P + 2^6P + 2^7P + 2^9P + 2^{10}P + 2^{11}P + 2^{13}P + 2^{14}P + 2^{16}P + 2^{17}P $$
        So all you have to do to compute $nP$ is to compute these $2^kP$ (with successive doublings) and then add them together.



        $2^0P$ is just $P$, so you already have it. Double it twice, and you get $2^2P$. Double that one four times, and you get $2^6P$. And so on. With $17$ doublings, you'll get all $2^kP$ for $k$ up to $17$, so in particular you'll get all the values you are interested in. As the formulas above show, ten extra additions, between the eleven $2^kP$ that are needed, will yield the result. In total, you got $224965 P$ with $17$ doublings and $10$ additions, i.e. much fewer than $224964$.



        In all generality, if $n$ is a number of $t$ bits (i.e. less than $2^t$), then $t-1$ doublings and at most $t-1$ extra additions are enough.



        There are many variations upon this mechanism, depending on how you interleave the doublings and the additions, and possibly reuse some addition results. You'll still need to compute the $t-1$ doublings, but you may save on some of the extra additions. How many intermediate results you need to keep in RAM is also a consideration. Moreover, if $n$ is a secret value, then you'll want to avoid side-channel attacks that may result in leaking some of the bits of $n$, and this impacts the kinds of double-and-add algorithms you can tolerate.






        share|improve this answer









        $endgroup$



        It is called "double-and-add". For instance, take a point, and add it to itself. Then take the result, and add it to itself. Do that again. And again. After ten additions, what you get is $2^{10} = 1024$ times the original point: in just 10 additions, not 1023. That's the "shortcut".



        More generally, with $k$ successive doublings (a "doubling" is the addition of a point with itself), starting from a point $P$, you get $2^k P$. Now, all you have to do is to consider your multiplier $n$ in binary: this is about writing it as a sum of powers of two. For instance, if $n = 224965$, then, in binary, it becomes $110110111011000101$, which means that:
        $$ n = 2^0 + 2^2 + 2^6 + 2^7 + 2^9 + 2^{10} + 2^{11} + 2^{13} + 2^{14} + 2^{16} + 2^{17} $$
        And therefore:
        $$ nP = 2^0P + 2^2P + 2^6P + 2^7P + 2^9P + 2^{10}P + 2^{11}P + 2^{13}P + 2^{14}P + 2^{16}P + 2^{17}P $$
        So all you have to do to compute $nP$ is to compute these $2^kP$ (with successive doublings) and then add them together.



        $2^0P$ is just $P$, so you already have it. Double it twice, and you get $2^2P$. Double that one four times, and you get $2^6P$. And so on. With $17$ doublings, you'll get all $2^kP$ for $k$ up to $17$, so in particular you'll get all the values you are interested in. As the formulas above show, ten extra additions, between the eleven $2^kP$ that are needed, will yield the result. In total, you got $224965 P$ with $17$ doublings and $10$ additions, i.e. much fewer than $224964$.



        In all generality, if $n$ is a number of $t$ bits (i.e. less than $2^t$), then $t-1$ doublings and at most $t-1$ extra additions are enough.



        There are many variations upon this mechanism, depending on how you interleave the doublings and the additions, and possibly reuse some addition results. You'll still need to compute the $t-1$ doublings, but you may save on some of the extra additions. How many intermediate results you need to keep in RAM is also a consideration. Moreover, if $n$ is a secret value, then you'll want to avoid side-channel attacks that may result in leaking some of the bits of $n$, and this impacts the kinds of double-and-add algorithms you can tolerate.







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered 2 days ago









        Thomas PorninThomas Pornin

        70.4k13184267




        70.4k13184267






















            Jon Aird is a new contributor. Be nice, and check out our Code of Conduct.










            draft saved

            draft discarded


















            Jon Aird is a new contributor. Be nice, and check out our Code of Conduct.













            Jon Aird is a new contributor. Be nice, and check out our Code of Conduct.












            Jon Aird is a new contributor. Be nice, and check out our Code of Conduct.
















            Thanks for contributing an answer to Cryptography Stack Exchange!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid …



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            Use MathJax to format equations. MathJax reference.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f68278%2fare-there-shortcuts-for-computing-ecc-point-multiplication%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            -

            Popular posts from this blog

            數位音樂下載

            Image
            數位音樂下載 為非以「實體」方式來販賣音樂的相關產品，而使用數位格式如mp3、AAC等文件格式來進行銷售販賣的一种音乐产业形式。著名的數位音樂下載服務商有iTunes Store、RecoChoku、Google Play音乐和微软Zune等。数字音乐下载在二十一世纪初一度风靡全球， [1] [2] 使得传统唱片产业走向衰落，但其自身也在2010年代流媒体音乐服务如Apple Music、Spotify等的挤压下迅速失去市场份额。 [3] [4] 数字音乐下载有便于携带、传播迅速、制作简单成本低等优点，与流媒体音乐相比也能更好保障音乐人权益； [5] 但它同时很可能带来侵犯版权和滥用的情形， [6] 也给音乐产业带来了诸多不利影响。数字音乐下载为音乐人和乐迷提供了更加便捷直接的交流渠道，也一定程度上推动了网络音乐人的出现和独立音乐的迅速发展。 [7] 目录 1 历史 1.1 技术积淀（1987-2000） 1.2 出现与兴起（2000-2004） 1.3 唱片市场的颠覆者（2004-2007） 1.4 巅峰和衰落（2005-2013） 1.5 摇摇欲坠的现状与不可预知的明天（2014至今） 2 主要文件格式 2.1 PCM编码格式 2.1.1 WAV 2.1.2 APE 2.1.3 FLAC 2.2 苹果推出的无损文件格式 2.2.1 AIFF 2.2.2 ALAC 2.3 有损压缩格式 2.3.1 MP3 2.3.2 AAC 3 主要市场 3.1 iTunes Store 3.2 Google Play音乐商店 3.3 亚马逊音乐商店 3.4 部分其他音乐商店 4 影响与评价 4.1 对音乐产业的影响 4.2 对科技行业的影响 4.3 正面评价 4.4 负面评价 4.4.1 侵权问题 4.4.2 经营模式不明晰 4.4.3 不适应移动时代 4.5 文化现象 5 延伸阅读 6 参考资料 历史 苹果iTunes+iPod的软硬件搭配让数字音...
            Read more

            When can things happen in Etherscan, such as the picture below?

            Image
            2 I don't know why balance of the address is 0. when can this situation? etherscan balances share | improve this question asked yesterday Ru Hi Ru Hi 11 1 New contributor Ru Hi is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct. add a comment  |  ...
            Read more

            格利澤436b

            Image
            格利泽436b 太陽系外行星 太陽系外行星列表 艺术家笔下的格利泽436b 母恆星 母恆星 Gliese 436 星座 獅子座 赤經 ( α ) 11 h  42 m  11.0941 s [1] 赤緯 ( δ ) +26° 42′ 23.652″ [1] 距離 33.4 ly (10.2 pc) 光譜類型 M2.5 V [1] 軌道參數 半长轴 ( a ) 0.0291±0.0004 [2] AU 軌道離心率 ( e ) 0.150±0.012 [2] 公轉週期 ( P ) 2.643904±0.000005 [3] d (0.00723849 y) 軌道傾角 ( i ) 85.8 +0.21 −0.25 [3] ° 角距 ( θ ) 2.794 mas 近星點時間 ( T 0 ) 2,451,551.716 ±0.01 JD 半振幅 ( K ) 18.68±0.8 m/s 物理性质 质量 ( m ) 22.2±1.0 [2] M ⊕ 半徑 ( r ) 4.327±0.183 [2] [4] R ⊕ 密度 ( ρ ) 1.51 g cm -3 表面重力 ( g ) 1.18 g 溫度 ( T ) 712±36 [2] K 發現 發現時間 2004 發現者 巴特勒、沃格特、 馬西 et al. 發現方法 徑向速度、凌日法 發現地點 美國加利福尼亞州 發表論文 出版 其他名稱 Ross 905 b, GJ 436 b, [5] LTT 13213 b, GCTP 2704.10 b, LHS 310, AC+27:28217 b, Vyssotsky 616 b, HIP 57087 b, GEN# +9.80120068 b, LP 319-75 b, G 121-7 b, LSPM J1142+2642 b, 1RXS J114211.9+264328 b, ASCC 683818 b, G 147-68 b, UCAC2 41198281 b, BP...
            Read more