# Large Field-Size Throughput/Area Accelerator for Elliptic-Curve Point Multiplication on FPGA
## 2 ECC Background over \(GF(2^{m})\)  
For \(GF(2^{m})\) field, an affine form of ECC is defined as a set of points, i.e., \(x\), and \(y\), by satisfying Equation (1), where \(x\) and \(y\) present the coordinates of the \(GF(2^{m})\) field. The curve constants are \(a\) and \(b\) with \(b\
eq 0\). An irreducible polynomial is the \(F(x)\). The representation of \(x\) and \(y\) coordinates of the \(GF(2^{m})\) field in a triplet, i.e., \(X\), \(Y\), and \(Z\), are projective coordinates. Therefore, for the \(GF(2^{m})\) field, a Lopez Dahab projective form of Equation (1) is defined as set of points \(P(X:Y:Z)\), presented in Equation (2). In Equation (2), the variables \(X\), \(Y\) and \(Z\) are the Lopez Dahab projective elements of point \(P(X:Y:Z)\), where \(Z\
eq 0\), \(a\) and \(b\) are the curve constants with the \(b\
eq 0\). \[E:y^{2}+xy=x^{3}+ax^{2}+b\ mod\ f(x) \tag{1}\]  
\[E:Y^{2}+XYZ=X^{3}Z+aX^{2}Z^{2}+bZ^{4} \tag{2}\]  
The points on the elliptic curve define a group--called an additive group. It means that the ECC points are combined with the point at infinity. Following the additive group definition, adding two elements in a group defines another element in the same group. For example, we have a point \(P\) and \(Q\) on an elliptic curve. Then, a point addition will be \(R=P+Q\), where \(R\) determines the resultant point. Moreover, the addition of two identical points on the ECC curve, i.e., \(P+P=2P\), denotes the point double. Point addition and double operations are mandated to operate a point multiplication in ECC. Hence, point multiplication is the addition of \(k\) copies of point addition and double on the defined ECC curve and can be calculated using Equation (3). \[Q=k.P=k.(P+P\cdots+P) \tag{3}\]  
In Equation (3), \(Q\), \(k\) and \(P\) specify the resultant point on the curve, a scalar multiplier and an initial point on the defined ECC curve. We have several algorithms in the literature to implement Equation (3) for point multiplication computation. The most frequently utilized PM algorithms are Double and Add, Lopez Dahab, Montgomery and many more. If we compare these algorithms, a Double and Add algorithm is an appropriate choice for other models of ECC curves such as Edwards, Huff, Hessian, Twisted Edwards, etc. [23; 24; 25; 26]. A Lopez Dahab algorithm is beneficial to gain instruction-level parallelism for higher performance improvements. The Montgomery PM algorithm is more practical for side-channel resistant implementation of ECC, as it involves similar instructions for point addition and double computations. We refer to [11] for a thorough comparison of several PM algorithms. Therefore, we have used the Montgomery point multiplication algorithm, Algorithm 1 (in this article) to provide a side-channel-protected hardware implementation of ECC. ```
Input:\(k=(k_{n-1},\ldots,k_{1},k_{0})\) with \(k_{n-1}=1\), \(P=(x_{p},y_{p})\in GF(2^{m})\) Output:\(Q=(x_{q},y_{q})=k\cdot P\)
1 Set\(X_{1}=x_



The Algorithm 1 takes an initial point \(P\) and a bit stream of a scalar multiplier \(k\) as an input. The \(x\) and \(y\) coordinates of a final point \(Q\) are the output of Algorithm 1. The statements provided in line one of Algorithm 1 are for the affine to Lopez Dahab projective conversions. Similarly, a for loop determines the PM computation in the Lopez Dahab projective coordinate system. The instructions inside the if and else statements are for point addition and double operations. In particular, from \(Inst_{1}\) to \(Inst_{7}\) are for the point addition and \(Inst_{8}\) to \(Inst_{14}\) are for point double. The switching between if and else statements depends on the inspected one-bit scalar multiplier. A total of fourteen instructions are concerned with point addition and double computations. More precisely, six instructions are for the modular multiplications, three are for modular additions and five are for modular squaring. Finally, the last two lines in Algorithm 1 are for reconversions from the Lopez Dahab projective to affine conversions.