# An Optimized Flexible Accelerator for Elliptic Curve Point Multiplication over NIST Binary Fields
## 2 Lopez-Dahab Projective Form of ECC over \(GF(2^{m})\)
``` Input:\(k=(k_{n-1},\ldots,k_{1},k_{0})\) with \(k_{n-1}=1\), \(P=(x_{p},y_{p})\in GF(2^{m})\) Output:\(Q=(x_{q},y_{q})=k\cdot P\)
1 Set \(X_{1}=x_{p}\), \(Z_{1}=1\), \(Z_{2}=x_{p}^{2}\) and \(X_{2}=x_{p}^{4}+b\)
2 for(i from m-2 down to 0)do
3 if(\(k_{i}=1\))then
4\(Inst_{1}\gets Z_{1}=X_{2}\times Z_{1}\)
5\(Inst_{2}\gets X_{1}=X_{1}\times Z_{2}\)
6\(Inst_{3}\gets T_{1}=X_{1}+Z_{1}\)
7\(Inst_{4}\gets X_{1}=X_{1}\times Z_{1}\)
8\(Inst_{5}\gets Z_{1}=T_{1}^{2}\)
9\(Inst_{6}\gets T_{1}=x_{p}\times Z_{1}\)
10\(Inst_{7}\gets X_{1}=X_{1}+T_{1}\)
11\(Inst_{8}\gets Z_{2}=Z_{2}^{2}\)
12\(Inst_{9}\gets T_{1}=Z_{2}^{2}\)
13\(Inst_{10}\gets T_{1}=b\times T_{1}\)
14\(Inst_{11}\gets X_{2}=X_{2}^{2}\)
15\(Inst_{12}\gets Z_{2}=X_{2}\times Z_{2}\)
16\(Inst_{13}\gets X_{2}=X_{2}^{2}\)
17\(Inst_{14}\gets X_{2}=X_{2}+T_{1}\)
18 else
19\(Inst_{1}\gets Z_{2}=X_{1}\times Z_{2}\)
20\(Inst_{2}\gets X_{2}=X_{2}\times Z_{1}\)
21\(Inst_{3}\gets T_{1}=X_{2}+Z_{2}\)
22\(Inst_{4}\gets X_{2}=X_{2}\times Z_{2}\)
23\(Inst_{5}\gets Z_{2}=T_{1}^{1}\)
24\(Inst_{6}\gets T_{1}=x_{p}\times Z_{2}\)
25\(Inst_{7}\gets X_{2}=X_{2}+T_{1}\)
26\(Inst_{8}\gets Z_{1}=Z_{1}^{2}\)
27\(Inst_{9}\gets T_{1}=Z_{1}^{2}\)
28\(Inst_{10}\gets T_{1}=b\times T_{1}\)
29\(Inst_{11}\gets X_{1}=X_{1}^{2}\)
30\(Inst_{12}\gets Z_{1}=X_{1}\times Z_{1}\)
31\(Inst_{13}\gets X_{1}=X_{1}^{2}\)
32\(Inst_{14}\gets X_{1}=X_{1}+T_{1}\)
33 endfor
34
35\(x_{q}=\frac{X_{1}}{Z_{1}}\), \(y_{q}=x_{p}+(\frac{X_{1}}{Z_{1}})[(X_{1}+x_{p}\times Z_{1})(X_{2}+x_{p}\times Z _{2})+(x_{p}^{2}+y_{p})(Z_{1}\times Z_{2})](x_{p}\times Z_{1}\times Z_{2})^{ -1}+y_{p}\)

## 3 Proposed Hardware Accelerator Architecture

Figure 1 illustrates our proposed architecture for a PM accelerator over \(GF(2^{m})\), where \(m\) is set to 571. The architecture has two components: (i) load I/O parameters and (ii) elliptic curve point multiplication core (PM-core). The following subsections elaborate on various components of the proposed architecture. ### Loading I/O Parameters to Our Accelerator

As mentioned before, our accelerator is flexible, which means different input parameters can be provided from outside to perform the PM operation of ECC. In other words, the proposed accelerator is not dedicated to specific input parameters. We have employed two 571-bit data buffers (denoted with 571-_bit dbuff_) and one 4-bit address buffer (represented with 4-_bit abuff_) to achieve this flexibility. Amongst the NIST-recommended binary field lengths, the longer key length is 571. Therefore, we prefer to choose a buffer length of 571 bits for a constant-time implementation. These three buffers operate serially. It implies that the corresponding 571-bit input buffer serially loads the input parameters bit-by-bit. After loading the one input parameter, the corresponding read/write address is loaded into 4-_bit abuff_. This process repeats until all the input parameters are provided to the PM-core for computations. Similarly, the corresponding 571-bit output buffer serially shifts the bits of the output. As seen in the block diagram of the proposed architecture, the data and address buffers correspond to the input-output load control (IOLC) block. This acts similarly to a controller between the buffers and the control unit of the PM-core to pass/collect data, read/write addresses, and other related control signals. We employ a 3-bit \(ctrl_{ext}\) signal for efficient control functionalities. The encoding of IOLC block using \(ctrl_{ext}\) signal is given below:

* Data read and write: we use \(ctrl_{ext}\) = 000, which specify the bit-by-bit output data read from 571-_bit dbuff_ using one-bit \(dout\)-\(ext\) signal. Similarly, we have encoded \(ctrl_{ext}\) = 001 for input data write on a 571-_bit dbuff_ using one-bit \(din\)-\(ext\) signal. * Loading the coordinates of starting point: we set \(ctrl_{ext}\) = 010 and \(ctrl_{ext}\) = 011 to input the \(x\) and \(y\) components of the starting point \(P\) on a 571-_bit dbuff_ using one-bit \(din\)-\(ext\) signal.