## 3 Proposed Crypto Processor Design
### Control Unit and Clock Cycles Calculation  
An FSM-based dedicated controller is implemented in this work to execute Algorithm 1 for PM computation. Before implementing it, we need to load the initial point \(P\) coordinates (i.e., \(x_{p}\), \(y_{p}\)), a curve constant \(b\), and a value of the scalar multiplier (\(k\)) as input, as shown in Algorithm 1. Based on a one bit signal \(LD\), the corresponding data values will be loaded into the related data memory addresses; in other words, the \(LD\) signal triggers the proposed crypto processor to load curve input parameters (\(x_{p}\), \(y_{p}\), and \(b\)). Similarly, when a one bit signal, \(LK\), becomes 1, a secret key or scalar multiplier \(k\) must be loaded into a KeyReg, as shown in Figure 1. The interface of the proposed crypto processor architecture only supports 8 bit data loading using an 8 bit \(din\); therefore, the 233 bit ECC parameters, including \(xp\), \(yp\), \(b\), and a secret key \(k\), must be loaded in 8 bit form. Hence, loading a 233 bit secret key into the corresponding KeyReg buffer needs 32 clock cycles, and loading \(xp\), \(yp\), and \(b\) into the data memory addresses requires 3 \(\times\) 32 clock cycles. Next, after loading the input parameters, the PM computation is essential to execute; hence, to do so, FSM goes through multiple states for affine to projective conversions, PM computation in projective coordinates, and re-conversion back from projective to affine coordinates; details about these states are as follows. The first line in Algorithm 1 applies initializing or converting coordinates from affine to projective form. Due to our implementation of modular operators, an adder unit takes one clock cycle for computation, and a multiplier unit needs 233 clock cycles for a 233 bit key length. As can be observed from the first line of Algorithm 1, there are four instructions to execute: (i) \(X_{1}=x_{p}\), (ii) \(Z_{1}=1\), (iii) \(Z_{2}=x_{p}^{2}\), and (iv) \(X_{2}=x_{p}^{4}+b\). Using our architecture, \(X_{1}=x_{p}\) and \(Z_{1}=1\) take two clock cycles to execute. Recalling again that we executed square instructions by providing identical inputs to the multiplier unit, \(Z_{2}=x_{p}^{2}\) takes 233 clock cycles, as the supported key length is 233 bits. Similarly, to compute \(x_{p}^{4}+b\), 234 clock cycles are needed; there are 233 cycles for computation of \(x_{p}^{4}\) and one clock cycle for adding curve constant \(b\). Overall, the affine to projective coordinate takes 469 clock cycles to implement. Figure 3: Bit-serial polynomial multiplier over \(GF(2^{233})\). A \(for\) loop in Algorithm 1 determines the PM computation in Lopez Dahab projective form. The \(if\) and \(else\) statements (within the \(for\) loop) incorporate instructions for executing PA and PD operations, respectively. The \(Inst_{1}\)-\(Inst_{7}\) are for PA, whereas \(Inst_{8}\)-\(Inst_{14}\) are for PD. Implementing the \(if\) or \(else\) portions of Algorithm 1 relies on the value of the one bit scalar multiplier \(k_{i}\); when \(k_{i}=1\), the \(if\) statements will be implemented; otherwise, the \(else\) portion will be implemented. Note that the \(if\) and \(else\) parts comprise fourteen instructions; eleven are for square and multiplier computations, and three are for modular addition. Hence, \(if\) and \(else\) statements require 2563 clock cycles for square and multiplier units and three clock cycles for addition computations. This is the cost for one PA and PD computation; the total clock cycle cost to process 233 bit key length is 233 \(\times\) 2566, equivalent to 597,878. The final two lines of Algorithm 1 generate the \(x\) and \(y\) coordinates of the resultant point \(Q\) on the curve. These two lines determine re-conversion from Lopez Dahab projective to affine coordinates; as noted, these lines need two modular inverse operations and some addition and multiplication operations, as shown in Algorithm 1.