# An Optimized Flexible Accelerator for Elliptic Curve Point Multiplication over NIST Binary Fields
## 2 Lopez-Dahab Projective Form of ECC over \(GF(2^{m})\)
Similarly, the total cycles required for one modular inversion computation over \(GF(2^{233})\), \(GF(2^{283})\), \(GF(2^{409})\), and \(GF(2^{571})\) fields is 242, 292, 509, and 582. #### 3.2.3 Controller Circuit and Formulation for Clock Cycles

Our accelerator incorporates a controller circuit to execute Algorithm 1 for PM computation. Before initiating the PM computation, it is necessary to load the input parameters into the data memory. Using the 571-bit buffer of Figure 1, it loads four \(m-1\) bits inputs. This initial loading into the data memory requires \((4\times m)+4\) clock cycles. Once the input parameters are loaded, the controller generates the _start_ signal. It allows the proposed accelerator to proceed with the PM computation. It involves various states. These states are responsible for various operations, e.g., the conversion from affine coordinate system to projective coordinate system, execution of PM operation, and reconversion from projective coordinate system to affine coordinate system. The algorithm starts with the initialization step. Here, it converts affine coordinates to projective coordinates. The operators, including the adder, square, and multiplier, efficiently compute results in just one clock cycle. Consequently, for the statements in the first line of Algorithm 1, which involve addition and square operations, we can complete the computations in an efficient way. Specifically, for the computation of affine to projective coordinates, the statements \(X_{1}=x_{p}\), \(Z_{1}=1\), \(Z_{2}=x_{p}^{2}\), and \(X_{2}=x_{p}^{4}+b\) can be efficiently processed in our accelerator, requiring only five clock cycles for all field lengths ranging from \(GF(2^{163})\) to \(GF(2^{571})\). Algorithm 1 utilizes a _for_ loop to perform PM operation in Lopez-Dahab projective form. Within the _for_ loop, the \(if\) and \(else\) portions contain statements for point addition and point doubling steps, respectively. The instructions \(Inst_{1}\) to \(Inst_{7}\) correspond to point addition, while \(Inst_{8}\) to \(Inst_{14}\) relate to point doubling. The \(if\) or \(else\) parts of the algorithm depends on the value of \(k_{i}\). When the value is equal to one, the \(if\) part is executed. When the value is not equal to one, the \(else\) part is executed. It is important to note that the \(if\) and \(else\) sections consist of 14 instructions. Out of these 14 instructions, 11 instructions are reserved for squaring and multiplication. Similarly, three out of these 14 instructions are dedicated to modular addition. As a result, the \(if\) and \(else\) portions together need \(14\times m\) cycles for PM computation in projective coordinates, where the value of \(m\) corresponds to the key length (e.g., 163, 233, 283, 409, or 571). For the proposed accelerator, the number of clock cycles utilized is as follows: 2282 cycles for \(GF(2^{163})\), 3262 cycles for \(GF(2^{233})\), 3962 cycles for \(GF(2^{283})\), 5726 cycles for \(GF(2^{409})\), and 7994 cycles for \(GF(2^{571})\). The last part of the algorithm generates the \(x\) and \(y\) components of the final point \(Q\). Moreover, a reconversion is made from the Lopez-Dahab coordinate system to the affine coordinate system. We have previously described the computational cost of one modular addition, square, multiplication, and inversion operations for the NIST-recommended field lengths. Therefore, our proposed accelerator requires 2\(\times\) inversion + 24 clock cycles to perform the Lopez-Dahab projective to affine conversion. Here, 2\(\times\) inversion indicates the clock cycles needed for executing two modular inversions. An additional 24 cycles are necessary to implement the other modular operations in the last two lines of Algorithm 1. As a result, our accelerator performs the Lopez-Dahab to affine conversion in 366 cycles for \(GF(2^{163})\), 508 cycles for \(GF(2^{233})\), 608 cycles for \(GF(2^{283})\), 1042 cycles for \(GF(2^{409})\), and 1188 cycles for \(GF(2^{571})\) fields.