# Large Field-Size Throughput/Area Accelerator for Elliptic-Curve Point Multiplication on FPGA
## 1 Introduction  
Elliptic curve cryptography (ECC) [1] and Rivest-Shamir-Adleman (RSA) [2] are well-known public-key cryptographic schemes. ECC guarantees comparable security with shorter key lengths compared to RSA. For example, 233 bits of ECC are sufficient to achieve identical security to a 2048-bit RSA [2]. The low area, low power consumption, and lower channel bandwidth are some benefits of the shorter key lengths when transmitting sensitive information over the unsecured channel. These advantages enable ECC for area-constrained applications such as wireless sensor nodes (WSNs) [3; 4], radio-frequency-identification-networks (RFID) [5; 6], automotive vehicles [7], and secure robotics communication [8]. The National Institute of Standards and Technology (NIST) (NIST) is an American organization that maintains security standards for efficient communications) has standardized ECC for prime and binary fields, i.e., \(GF(P)\), and \(GF(2^{m})\)[9]. To implement NIST-recommended prime and binary field lengths, ECC includes four layers of a model [10]. The topmost layer is the protocol which ensures encryption/decryption, signature generation/verification, key authentication between two devices, etc. The critical operation in ECC is point multiplication (PM). It includes point addition (PA) and double (PD) operations for computations. The PAand PD operations are the layer two operations in ECC. The building blocks of layer one are modular arithmetic operators (adder, square, multiplier, and inversion). The efficiency of the PM operation of ECC relies on the efficient implementations of these modular arithmetic operators. There are two possible choices to implement ECC either on software platforms (such as microcontrollers) or as hardware accelerators on field-programmable gate arrays (FPGA) and application-specific integrated circuits (ASIC) platforms. The software-ported implementations provide higher flexibility with limited throughput. Hardware accelerators provide higher throughput with limited flexibility features [11]. Therefore, there is always a tradeoff. ECC suggests prime and binary fields for different implementation platforms (software or hardware). The prior is more advantageous on software platforms, while due to carry-free additions, the binary fields are more appealing for hardware accelerations of building blocks of ECC. To implement prime and binary fields, ECC provides two basis for point representation [10]: (i) polynomial and (ii) normal. For efficient modular multiplications, polynomial basis representation is more practical. A normal basis is appropriate for frequent modular square implementations [10; 12]. The general affine and projective coordinates influence the performance of the ECC implementations. The affine coordinate is more expensive in computational time as it needs an inversion operation during the execution of each PA and PD operation [10; 13; 14]. In addition, the affine coordinates are reasonable for software implementations. On the other hand, the projective coordinates are suitable for achieving throughput/area ECC accelerators. Based on the discussions presented above, we have selected: (i) binary fields, (ii) projective coordinates, and (iii) polynomial basis representations because our focus is to accelerate ECC on a hardware platform. Some recent FPGA and ASIC accelerators of PM computation of ECC over \(GF(2^{571})\) are described in [15; 16; 17; 18; 19; 20; 21]. An efficient throughput/area ECC processor over \(GF(2^{163})\) to \(GF(2^{571})\) is presented in [15]. The authors presented the rescheduling of PA and PD operations to reduce the clock cycles. The decrease in clock cycles eventually reduces the latency (i.e., the computation time). A segmented digit-serial modular multiplier is employed to reduce hardware resources. The implementation results are reported on the Xilinx Virtex-7 FPGA device. Another throughput/area ECC processor is implemented in [16].