# Throughput/Area Optimized Architecture for Elliptic-Curve Diffie-Hellman Protocol
## 1 Introduction  
Nowadays, security is becoming a critical threat in various modern applications such as healthcare [1], automotive [2, 3, 4], smart cards [5, 6] and the Internet of Things (IoT) [7, 8, 9, 10]. These applications demand the exchange of sensitive data on a vulnerable public channel. Consequently, different symmetric and asymmetric cryptographic algorithms are utilized to achieve various security services. Examples of these security services are public key exchange, signature generation/verification, authentication and encryption/decryption. It has been observed that a higher security level can be achieved with the employment of asymmetric protocols as compared to symmetric algorithms [11]. The most frequently usedasymmetric algorithms are RSA (Rivest-Shamir-Adleman) and elliptic-curve cryptography (ECC). However, the ECC provides similar data protection with a relatively shorter key length as compared to RSA [12; 13]. The security hardness of ECC depends on solving the discrete logarithms problem [14]. Typically, the layout of ECC incorporates a four-layer design [12; 14], as presented in Figure 1a. Each design layer in Figure 1a can be implemented using various alternatives. For example, the topmost layer (layer 4) specifies the number of rules to produce encryption (or) decryption, signature generation (or) verification and public key exchange (depending on the used protocol). Here, we have selected elliptic-curve Diffie-Hellman (ECDH) [15] protocol for key agreement, as shown in Figure 1b. Inherently, the ECDH protocol is responsible for generating the shared secret values based on certain input parameters. Therefore, the adopted ECC hierarchical model in this article is illustrated in Figure 1b. Similarly, the critical operation in ECC is elliptic-curve point multiplication (ECPM) which is the third layer operation in a typical ECC hierarchy [12; 16; 17; 18; 19]. As given in Figure 1b, the execution of ECPM is achieved with the use of a Montgomery algorithm because it (by default) provides resistance against SPA (simple power analysis) and timing attacks. The computation of ECPM relies on the execution of point addition (PAdd) and double (PDbl) operations. The building blocks (layer one operations), to serve PAdd and PDbl, are addition, multiplication, square and inversion. Among these, multiplication is the most computationally intensive operation. A variety of multiplication approaches are available [20; 21; 22; 23]. However, we have targeted the Karatsuba multiplier as it consumes one clock cycle for a singular multiplication [25]. The employed Karatsuba multiplier is also used for squaring and inversion computations, as shown in Figure 1b. More insight particulars are described in Section 3.3. In addition to various choices in Figure 1b, the ECC designers may select the prime \((GF(P))\) or binary \((GF(2^{m}))\) fields. Similarly, the polynomial or Gaussian normal basis can be used to represent the initial and final points on the respective elliptic curve. Moreover, different coordinate systems (i.e., affine, and projective) are available. This article employs \(GF(2^{m})\) field due to its carry-free additions and suitability for hardware deployments [12; 14; 24]. In addition, the binary fields are faster as compared to prime fields. On the other hand, the \(GF(P)\) field is useful for software implementations and is more convenient for long-term security as compared to binary elliptic curves [26; 27]. According to [28], a \(GF(P)\) field contains a prime number \(p\) of elements. The elements of this field are the integers modulo \(p\), and the field arithmetic is implemented in terms of the arithmetic of integers modulo \(p\). Similarly, a \(GF(2^{m})\) field contains \(2m\) elements for some \(m\) (determines the degree of the field). The elements of this field are the bit strings of length \(m\), and the field arithmetic is implemented in terms of operations on the bits. This motivate us to use binary fields as the main interest of this work was to deal with hardware implementations.