*OUSPEVDUJPO
w 1VCMJDLFZ$SZQUPHSBQIZ 1,$

r 5IFNPTUGBNPVT1,$JT34"BOE&$$r 6TFEGPSLFZBHSFFNFOU %JGGJF)FMMNBO EJHJUBMTJHOBUVSFT QVCMJDLFZFODSZQUJPO)BSEXBSFJNQMFNFOUBUJPOPG&$$w
5IF6OJWFSTJUZPG&MFDUSP$PNNVOJDBUJPOT,B[VP4",*:"."*NQMFNFOUBUJPOPGQVCMJDLFZDSZQUPTZTUFN

r 4MPXFSFODSZQUJPOEFDSZQUJPO d.CQT UIBOTZNNFUSJDLFZDSZQUPHSBQIZ "&4d(CQT
r 34"NPEVMBSFYQPOFOUJBUJPO DE NPEO
r &$$QPJOUNVMUJQMJDBUJPO L1 POFMMJQUJDDVSWF
r &YQFOTJWF,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

1PJOUPQFSBUJPOTPOFMMJQUJDDVSWF#BTJDIJFSBSDIZGPS&$$yw 1PJOU"EEJUJPO

w 0QUJNJ[BUJPOJTQPTTJCMFJONVMUJMBZFSP

31 2

Q

4DBMBS.VMUJQMJDBUJPOP

w 1PJOU%PVCMJOH

x

3`1`
5BOHFOUMJOF

2/50

R

y2 = x3 – x + 1

w 4DBMBS.VMUJQMJDBUJPOR'JOJUF'JFME"EEJUJPO

L1#JOBSZBMHPSJUIN,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ1PJOU"EEJUJPO

3/50

1PJOU
%PVCMJOH'JOJUF'JFME.VMUJQMJDBUJPO'JOJUF'JFME*OWFSTJPO,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

4/50

4FSJFT PG NPEVMBS PQFSBUJPOT
5ZQFPG$VSWF(' Q (' N
4FDVSJUZ-FWFM$PPSEJOBUF
48)8'1(""4*$5FDIOPMPHZ 
4J[F -BUFODZ 1PXFS%BUB4J[FJO.PEVMBS0QFSBUJPOT
w .PEVMBSNVMUJQMJDBUJPO"# $ NPEQ,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

34"CJUT

34"X$35CJUT&$$CJUT

5/50

PG.PEVMBS.VMUJQMJDBUJPOT,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

6/50

5PUBMDPNQVUBUJPOBMDPNQMFYJUZ

w 34"DE &$$L1&$$CJUT

34"CJUT
YL34"CJUT

34"X$35CJUT
YYL&$$CJUT

34"X$35CJUT

Y Y L,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

7/50,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

8/50

3JHIUUPMFGU-FGUUPSJHIU

34"QBSBMMFMJTN GPSIJHITQFFE-FGUUPSJHIU#JOBSZ"MHPSJUIN

w $35
w #JOBSZBMHPSJUIN%FQFOEFODZ

C34"

1BSBMMFMJTNJO4RVBSF
BOE.VMUJQMZ.. Y

3JHIUUPMFGU#JOBSZ"MHPSJUIN

1BSBMMFMJTNJO$35
4RVBSFBOE.VMUJQMZ.. Y/P%FQFOEFODZ,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

9/50&$$QBSBMMFMJTN GPSIJHITQFFE

1PJOU"EEJUJPO'JOJUF'JFME"EEJUJPO

C34"

1PJOU%PVCMJOH'JOJUF'JFME.VMUJQMJDBUJPO

10/50&YFSDJTF

w 1PJOUPQFSBUJPOT4DBMBS.VMUJQMJDBUJPO,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

w 2-BUFODZPGC$3534"
r -BUFODZPGC..OTw "OTYYYVTr XIFOVTJOHPOF..

'JOJUF'JFME*OWFSTJPO

w "OTYYVT

C&$$ 

r XIFOVTJOHUXP..T&$$4DBMBS.VMUJQMJDBUJPO

w 4RVBSJOH..

.. Y,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

11/50,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

12/50

&YFSDJTF

'BTUFSJNQMFNFOUBUJPO

w 2-BUFODZPGC&$$w -BUFODZPG&$$DBOCFMFTTUIBOVTw "OTYYVT

w -JNJUBUJPOPG

r -BUFODZPGC..OT
r 1PJOUBEEJUJPOOFFET..
r 1PJOUEPVCMJOHOFFET..

r 4IPSUMBUFODZPGC..FHY
r .PSFQBSBMMFMJTNFHY
r &GGJDJFOUQPJOUPQFSBUJPOTFRVFODFFHY

r XIFOVTJOHPOF..

r DVSSFOU$.04UFDIOPMPHZr DVSSFOU1,$w "VT

r XIFOVTJOHUXP..TEFHQBSBMMFMJTN,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

13/50

r .FNPSZ SFHJTUFS BDDFTT
w 43".
w 83SFHJTUFS

r %ZOBNJD4UBUJD

w .VMUJQMJDBUJPO 3FEVDUJPOC&$$

r #BSSFUU3FEVDUJPO  'PDVTPO.4#T
r .POUHPNFSZ3FEVDUJPO  'PDVTPO-4#T

43".

w 4DIFEVMJOH

8

14/50

.PEVMBS.VMUJQMJDBUJPO:FU"OPUIFS#PUUMFOFDL
w %BUBDPIFSFODF,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

w #BTFEPOOCJUNVMUJQMJFS O   r &H $*04<,PÇ "DBS ,BMJTLJ+S>3FHJTUFS'JMFT

w #BTFEPOCJUTFSJBMNVMUJQMJFS

r .VMUJQMJDBOEYOCJU<(SPTDIÅEM>3,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

15/50,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

16/50

'JOBMSFEVDUJPOGPSQSJNFGJFMEQ

3JQQMF$BSSZ"EEFS 3$"

w 9:3 NPEQ
w 5 5 YJ: NQ Q

w -POHDBSSZDIBJO

r TJ YJ  ZJ  [Jr DJ  ."+ YJ ZJ [J YJ ˭ZJ ˮ ZJ ˭[J ˮ [J ˭YJ'JOBM3FEVDUJPO
6OOFDFTTBSZGP#JOBSZGJFMET'JOBMSFEVDUJPO55r QQ,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

17/50$BSSZ4BWF"EEFS $4",B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

18/50

$4"w UPDPNQSFTTJPO

w 5XP'"TXPDBSSZDIBJO

r 9 : ;7$ 74

r 9 : ; 87$ 74
LCJUTLCJUT

L CJUT,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

19/50,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

20/50

"EEFS5SFF$BSSZ-PPLBIFBE"EEFS $-"w (FOFSBUFBOE1SPQBHBUF

w PQFSBOETr HJ YJ ˭ZJ QJ  YJ  ZJ
r -BUFODZdPS'"T 3$"'"T,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

21/50#JUTFSJBM.POUHPNFSZ..

22/50.PEVMBS3FEVDUJPOGSPN-4#
w -4#GJSTUCJUTFSJBMNVMUJQMJFS CJOBSZGJFMET#JUTFSJBM.POUHPNFSZ.PEVMBS.VMUJQMJDBUJPO

X

xk-1 …

x3 x2 x1 x0 =X

yk-1 …

y3 y2 y1 y0X=Y$4"

=x1Y+=n or 0=P(x) or 0d+=a1B(x)+=P(x) or 0+…
15/11/2007

XYR-1 mod n

k

...

...

+

=A(x)
=B(x)

+

=n or 0+a3 a2 a1 a0
b3 b2 b1 b0=a0B(x)=x0Y+

ak-1 …
bk-1 …

=xk-1Y=n or 00 0 …

0 0 0 0 0 0

k bits,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

23/38
23/50

+

=ak-1B(x)+=P(x) or 0…
15/11/2007

0

0 …

0

0

A(x)

B(x)

P(x)

XOR-based k
DatapathdT(x)Montgomery Multiplier:
A(x)B(x)R-1 mod P(x) (R = xk)

0

0

0

0

- Delay is determined by d
- Loop : k/dA(x)B(x)R-k mod P(x),B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

24/50

.PEVMBS3FEVDUJPOGSPN.4#'JOBMSFEVDUJPOGPSQSJNFGJFMEQ

w .4#GJSTUCJUTFSJBMNVMUJQMJFS CJOBSZGJFME
X

ak-1 …

a3 a2 a1 a0=A(x)bk-1 …

b3 b2 b1 b0

=B(x)

A(x)

=ak-1B(x)+=P(x) or 0+

=ak-2B(x)+=P(x) or 0

0 0 …

+

=a0B(x)+=P(x) or 0

0 0 0 0 0 0

15/11/2007

P(x)XOR-based k
Datapath

d

T(x)

…..

k

d

B(x)

w 9:3 NPEQ
w 5 5 YJ: NQ Q

A(x)B(x) mod P(x)- Delay is determined by d
- Loop : k/d…

A(x)B(x) mod P(x),B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

25/50

5PXBSETOPGJOBM SFEVDUJPO'JOBM3FEVDUJPO'JOBMSFEVDUJPO55r QQ,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

.PEVMBS3FEVDUJPOGSPN-4#
w -4#GJSTUCJUTFSJBMNVMUJQMJFS QSJNFGJFME

w 9:3 NPEQ
w 5 5 YJ: NQ QX

xk xk-1 …

x3 x2 x1 x0

yk yk-1 …

y3 y2 y1 y0 =Y

=X

=x0Y

+

d

-PPQ =p or 0

+

=x1Y

+

=p or 0

...

k

+

=xkY

+

=p or 0+5 5 NQ Q,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

26/50

15/11/2007

0

0 …

0

0

B

p

CSA-based k
DatapathdTMontgomery Multiplier:
XYR-1 mod p (R = 2k+2)=p or 0
…

A

0

0

0

0

- Delay is determined by d
- Loop : (k+2)/d

XYR-1 mod n

27/50,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

28/50

.PEVMBS3FEVDUJPOGSPN.4#%JWJTJPO JO .4#GJSTU

w .4#GJSTUCJUTFSJBMNVMUJQMJFS QSJNFGJFME
X

xk-1 …

x3 x2 x1 x0=X

yk-1 …

y3 y2 y1 y0=YX=xk-1y-= 2p, p, or 0+

=xk-2y-= 2p, p, or 0

+

=x0y

-

0 0 …

= 2p, p, or 0

0 0 0 0 0 0

15/11/2007

p

CSA-based k
Datapath

d

T

…..

k

d

Y

w 9:NPEQ
w *OUFSNFEJBUFWBMVF 5  5 YJ: Q

X·Y mod p-Delay is determined by d-Loop : (k+2)/d…

w %JWJTJPOJTFTDBQFEXJUIQSFDPNQVUBUJPO<,OF[FWJD 7FSDBVUFSFO 7FSCBVXIFEF ]A(x)B(x) mod P(x),B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

29/50#BSSFUU 3FEVDUJPO

1BSBMMFMJTNJO.PEVMBS.VMUJQMJDBUJPO

w 5Q5L LQ
w 4R5LTIJGUPQFSBUJPO XJSJOH
w 45 5 R LQ QSFDPNQVUBUJPO

w #PUI.4#-4#.PEVMBS.VMUJQMJDBUJPO<#BUJOB FUBM ,BJIBSB BOE5BLBHJ >w $PNCJOF.4#GJSTUBOE-4#GJSTU..
w" Y # Y 3 NPE1 Y " Y 3 " # Y 3 NPE1 Y" Y # Y NPE1 Y .4#GJSTU
" Y # Y 3 NPE1 Y -4#GJSTU

w 3YL

w #VUR   ʜ
,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

30/50

31/50

,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

32/50

#JQBSUJUF.PEVMBS.VMUJQMJDBUJPO.FSJUT JO #JQBSUJUF .PEVMBS .VMUJQMJDBUJPO

w #JQBSUJUFCJUTFSJBMNVMUJQMJFS CJOBSZGJFME
X

ak-1 …

a3 a2 a1 a0=A(x)bk-1 …

b3 b2 b1 b0=B(x)LSB-first

MSB-first

X

ak-1 …

a3 a2 a1 a0=A(x)bk-1 …

b3 b2 b1 b0=B(x)=a0B(x)=ak-1B(x)++=P(x) or 0+

=ak-2B(x)+=P(x) or 0ddStop in the middle++=a0B(x)+=P(x) or 0+

0 0 0 0 0 0=a1B(x)+=P(x) or 0

XOR-based k
Datapathdw "QQMJDBCMFUPQSJNFGJFME PSJHJOBMQSPQPTBM
r /FFEUPUBLFDBSF GJOBM SFEVDUJPOT

T(x)

k

=P(x) or 0

0 0 …

0 0 0 0 0 0

A(x)·B(x) ·2-k mod P(x)A(x)·B(x) mod P(x)P(x)=ak-1B(x)

…

…

B(x)

Stop in the middle

A0(x)B(x)R-1 mod P(x)A1(x)B(x) mod P(x)0 0 …

=P(x) or 0

+

…..

…..

k

A(x)

w 1BSBMMFMJTNJO.PEVMBS.VMUJQMJDBUJPO

A(x)B(x)R-1 mod P(x)- Parallelized (2 times)- Loop: k/2d+

w "MNPTUEPVCMFQFSGPSNBODF MFTTUIBOEPVCMFBSFB ''TBSFTIBSFE

A(x)B(x)R-1 mod P(x),B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

33/50'BTU.VMUJQMJFS
w #PPUISFDPEJOH SBEJY,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

34/50.VMUJQMJFS#BTFE...
YJ 

YJ

YJ

[J

r 1BSUJBMQSPEVDUTYJ:
r &TDBQF:OPS:r )BMGPGPQFSBOET BUXPSTU
r $4" $-".VMUJQMJFS#BTFE.POUHPNFSZ.PEVMBS.VMUJQMJDBUJPO.VMUJQMJDBUJPOTw "MTPEFSJWFECZ9r 9 9w &Y 9    
9
9



;
,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

35/50,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

36/50

&$$ DPQSPDFTTPS *"SDIJUFDUVSF GPS &$$ DPQSPDFTTPS
w )848DPEFTJHO

5:1&*4NBMMFTUJNQMFNFOUBUJPO CBTFMJOF

r $16 DPQSPDFTTPSGPS&$$

Main CPUw 4QFFE QFSGPSNBODFEFQFOETPOBSDIJUFDUVSF
r 5SBEFPGGCFUXFFODPTUBOEQFSGPSNBODF
r -PDBMEFEJDBUFENFNPSZGPSIJHIQFSGPSNBODF

Program
ROM
Memory Mapped I/O
Buffer32-bit32-bit data instruction
Full

Coprocessor

FSM IBC
IQB

DBC
Data Bus

Instruction Bus

MALU

w *OTUSVDUJPOTFU FYUFOTJPO "4*$ FUD
,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

37/50&$$ DPQSPDFTTPS **

SRAM

DBC

µ-codedRAM

38/50

5:1&***5:1&* $13".
Main CPU

Program
ROM
Memory Mapped I/O
Buffer32-bit32-bit data instruction
Full

Coprocessor,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

&$$ DPQSPDFTTPS ***5:1&**5:1&* NDPEFE3".
Main CPU

SRAM

SRAM

Program
ROM
Memory Mapped I/O
Buffer32-bit32-bit data instruction
Full

Coprocessor

FSM IBCIQB

FSM IBC
IQB

DBC

ProgramData Bus

Instruction Bus

Data Bus

MALU

Instruction Bus

MALU
Coprocessor RAM (CPRAM),B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

39/50,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

40/50

1SPGJMJOH&$$DPQSPDFTTPS&$$ DPQSPDFTTPS *7
5:1&*75:1&* $13".NDPEF3".
SRAM

Coprocessor
DBCµ-codedRAM

2 859

Type I

IQB

Type II
SW

SW

Instruction Bus

I/O Overhead

MALU

Datapath

Datapath +µ-coded RAM

Type III

Type IV

SW

SW

Datapath

Datapath +µ-coded RAM

CPRAM

CPRAM

I/O Transfer
CPRAM Access
Datapath

400
300
200

187

100

38
0

0
TYPE I

41/50

0
TYPE II

38
67

67
TYPE III$PTU 1FSGPSNBODFBOE4FDVSJUZ5SBEFPGGT
p 1SPHSBNNBCMF74IBSEXJSFEQBSBNFUFST

p $VSWFQBSBNFUFST
p $PNQVUBUJPOBMTFRVFODF$PPSEJOBUFT PQFSBUJPOGPSNp 1SJNFQ JSSFEVDJCMFQPMZOPNJBM1 Y
p 'JFMETJ[FTProgrammable:- wider-range of applications- higher-security algorithms

Cost (gate area)
43/50,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

0

67

TYPE IV

42/50$PTU 1FSGPSNBODFBOE4FDVSJUZ5SBEFPGGT
p 1SPHSBNNBCMF74IBSEXJSFEQBSBNFUFST

p $VSWFQBSBNFUFST
p $PNQVUBUJPOBMTFRVFODF$PPSEJOBUFT PQFSBUJPOGPSNp 1SJNFQ JSSFEVDJCMFQPMZOPNJBM1 Y
p 'JFMETJ[FTPerformance (latency),B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

Performance (latency)

67

System Configuration

Coprocessor RAM (CPRAM)

Hardwired- compact & fast

2 672

500

FSM IBC

ProgramData Bus

r 5IFOVNCFSPGDZDMFTJTSFEVDFECZ$13".
r .JDSPDPEFE3".DBOBWPJEJOTUSVDUJPOTUBMMTRequired Clock Cycles [K]Main CPU

Program
ROM
Memory Mapped I/O
Buffer32-bit32-bit data instruction
Full

w 1FSGPSNBODFGPS)&$$PWFS(' 

Hardwired- compact & fast

Programmable:- wider-range of applications- higher-security algorithms

Fixingparameters
For high-speed applications
Cost (gate area)
44/50,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ)JHITQFFE&$$)&$$$PTU 1FSGPSNBODFBOE4FDVSJUZ5SBEFPGGT
p 1SPHSBNNBCMF74IBSEXJSFEQBSBNFUFST

p 1SPHSBNNBCMFIJHITQFFEDPQSPDFTTPS
p &$$)&$$PWFS(' N
p 4JY ."-6DPSFT ."-6

Hardwired- compact & fast

Data 32

Fixingparameters

FSM IBCµ-codedRAM

Program
Instruction

IQB
Instruction

Instruction Bus

For RFID tags

Data Bus

Cost (gate area),B[VP4",*:"."
45/50"VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

1BSBMMFMJTNJOTDBMBSNVMUJQMJDBUJPOHECC over GF(283)
ECC over GF(2163 )ECC_M over GF(2163 )Number of Clock Cycles

70,000(b) A(B+D) + C

p 0QFSBUJPOGPSN"# $BOE" # $  %

p $IFDLUIFEBUBEFQFOEFODJFTGPS
&$$ BOE)&$$1xMALU

2xMALU

30,0002xMALUHECC over GF(283)
ECC over GF(2163 )ECC_M over GF(2163 )

70,00050,0001xMALUb

1xMALUb

30,0002xMALUb

4xMALU
1

2

3

4

5

6

7

8

1

2

3

4

5

6

7

8

,B[VP4",*:"."
Number of Instructions to search ILP (ILPD)"VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ(b) A(B+D) + C(a) AB + C

4xMALU

10,00046/50p )PXNBOZJOTUSVDUJPOTFYFDVUFEJOQBSBMMFM 

50,0001xMALU…

90,00090,000(a) AB + C

…

MALU
MALU
MALU
MALU
RF1 RF2 RF3 ,B[VP4",*:"."
RF6 -1 core -2 core -3 core -6 core
"VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

1BSBMMFMJTNJOTDBMBSNVMUJQMJDBUJPOp )PXNBOZJOTUSVDUJPOTFYFDVUFEJOQBSBMMFM 

p $IFDLUIFEBUBEFQFOEFODJFTGPS
&$$ BOE)&$$Control32

Cryptoprocessor

DBC

p 0QFSBUJPOGPSN"# $BOE" # $  %

RAM

Memory Mapped I/O

Instruction

Programmable:- wider-range of applications- higher-security algorithms

ROM

Main CPU

Number of Clock Cycles

Performance (latency)

p $VSWFQBSBNFUFST
p $PNQVUBUJPOBMTFRVFODF$PPSEJOBUFT PQFSBUJPOGPSNp 1SJNFQ JSSFEVDJCMFQPMZOPNJBM1 Y
p 'JFMETJ[FT

10,000

1

2

3

4

5

6

4xMALUb
7 8

2xMALUb

1

2

3

4

4xMALUb
5 6 7 8,B[VP4",*:"."
Number of Instructions to search ILP (ILPD)"VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

$PODMVTJPOT-JHIUXFJHIU&$$'PS3'*%
p -PXQPXFS."-6GPS3'*%UBHT

p 5SBEFPGGT JO &$$ IBSEXBSF

p 1BSBMMFMQSPDFTTJOH
p 0QFSBUJPOGPSNT"# $PS" # %  $
p $PTU QFSGPSNBODF TFDVSJUZ

p #BTFEPO."-6
p $PTUBOEQFSGPSNBODFGPS&$$BOE)&$$p 1PXFSFTUJNBUJPOXJUIVN$.04MJCSBSZ

ScalarMultiplication

p 3FTPVSDFTIBSJOH

Costp .PEVMBSBEEJUJPOBOE
NVMUJQMJDBUJPOVTFUIFTBNFIBSEXBSF DFMM

,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

Point
Addition

Performance

49/50

Security

Finite Field
Addition

Point
Doubling

Finite Field
Multiplication

Finite Field
Inversion,B[VP4",*:".""VUVNO4DIPPM OE 8PSLTIPQPO&MMJQUJD$VSWF$SZQUPHSBQIZ

50/50