# A Unified Point Multiplication Architecture of Weierstrass, Edward and Huff Elliptic Curves on FPGA
## 2 Mathematical Background over \(GF(2^{m})\)
Similarly, the alpha and beta buffers are needed for the Huff curve to load the pre-computed values of \(\alpha\) and \(\beta\), while we use the gamma buffer to load the \(y\) coordinate of the initial point. In the case of the Weierstrass curve, we need only to load parameter \(b\). Hence, we utilized only the alpha buffer to load the curve constant \(b\) for the PM computation on the Weierstrass curve. A _KeyReg_ buffer holds an \(m\)-bit scalar multiplier value to execute the \(if\) and _else_ pieces of Algorithms 1-3. In short, xp, yp, alpha, beta, gamma, and KeyReg contain the input parameters that need to load from outside to our unified architecture. These buffers are preserved during the entire PM computation. We select the initial values as input for our processor for computation from the standardized document by NIST [7]. \[E:Y^{2}+XYZ=X^{3}Z+aX^{2}Z^{2}+bZ^{4} \tag{2}\]1 FPGA comparison with most recent PM architectures of the Weierstrass, Edward, and Huff curves. ### Memory Block

Section 3 describes the memory optimizations to implement the Weierstrass, Edward, and Huff curves at the same time. Consequently, we use a \(16\times m\) array size for a register file (marked with MemBlock in Figure 1). It takes an \(m\)-bit vector as input (din) and results in two \(m\)-bit vectors as output (douta and doutb). The objective of MemBlock is to keep initial, intermediate, and final results. For read/write operations, it contains two \(16\times 1\) multiplexers and one \(1\times 16\) demultiplexer (not shown in Figure 1). The multiplexers and demultiplexers provide a mechanism to read two \(m\)-bit vectors. The control unit provides the corresponding control signals for two multiplexers and a demultiplexer. ### Arithmetic Unit

_Adder and square units._ The arithmetic and logic unit of our architecture, shown in Figure 1, contains an adder, a square, and a multiplier. We implemented the adder circuit by executing a bitwise exclusive (OR) operation. It is essential to emphasize that adding two polynomials in the binary field is carry-free. Therefore, for two \(m\)-bit polynomials, only the \(m\)-exclusive (OR) gates are needed to add polynomials. We have implemented the square circuit by inserting a '0' bit after each successive data bit, as implemented in [10; 11; 13]. _Karatsuba multiplier and polynomial reduction._ As shown in Figure 1, we have employed a Karatsuba modular multiplier to perform polynomial multiplication over \(GF(2^{233})\). The Karatsuba multiplier bears two \(m\)-bit polynomials \(a\) and \(b\) as input and splits them into two \(\frac{m}{2}\) parts. The divided portions of polynomial \(a\) are \(ah\) and \(al\). Likewise, \(bh\) and \(bl\) are the pieces of polynomial \(b\). According to [26], we need three multipliers to perform the internal polynomial multiplications. Therefore, in our Karatsuba design of Figure 1, the used multipliers are M1, M2, and M3. The purpose of multiplier M1 is to perform multiplication of \(ah\) with \(bh\), whereas M2 multiplies \(al\) with \(bl\). The M3 multiplier is liable to perform multiplication over the outputs generated after adders, i.e., A1 and A2. Instead of the multipliers, M1, M2, and M3, four adders (A1, A2, A3, and A4) are also required. Adder A1 adds \(ah\) with \(al\). Adder A2 adds \(bh\) with \(bl\). Adder A3 accumulates the multiplication results produced by multipliers M1, M2, and M3. Adder A4 yields the final polynomial with \(2\times m\) bit size and drives the output to the reduction block as input to produce an \(m\)-bit final output. Despite the multipliers and adders, we also need two shifters (S1 and S2) to shift polynomials by \(\frac{m}{2}\) and \(m\) bit towards the right. As shown in Figure 1, the multiplier circuit results in a \(2m\) bit. Therefore, an essential inversion operation is necessary to implement after the modular square and multiplier circuits. To operate polynomial reduction over \(GF(2^{233})\), we implemented the NIST-recommended algorithm, as described in Algorithm 4.