# Elliptic-Curve Crypto Processor for RFID Applications
## 2 Preliminaries
### PM Computation over \(Gf(2^{M})\)
On the other hand, one clock cycle is required for bit-parallel and digit-parallel multiplier approaches with an overhead over area and power parameters. There is always a design space between, area, power and speed/performance. The digit-serial multipliers take \(\frac{m}{n}\) clock cycles, where \(m\) is the operand length and \(n\) determines the size of the digit. That is why the goal of this work is to provide a low-area and low-power architecture for extremely constrained RFID applications. Subsequently, a traditional schoolbook multiplication method (a type of bit-serial multipliers) is incorporated in this work to achieve low-area and low-power values. A schoolbook multiplication method with shift and add operations take two \(m\)-bit polynomials as input and results in \(2\times m-1\)-bit polynomial as an output. It takes \(m\) clock cycles to perform one polynomial multiplication. * **Polynomial reduction:** After each polynomial squaring and multiplication, a reduction is essential to transform \(2\times m-1\)-bit polynomials into an \(m\)-bit. Therefore, we have performed a reduction using a sequence of routines given in Algorithm 2. For more description on these reduction routines, we refer the reader to [27]. In our proposed ECP architecture, the RTL (Register Transfer Level) development of Algorithm 2 in Verilog (HDL) is implemented using a combinational logic. Therefore, it takes one clock cycle for the polynomial reduction after multiplication. Similarly, a combinational logic is inferred for squarer block. However, squaring including reduction operation takes one clock cycle for the computation. * **Polynomial inversion:** For polynomial inversion computation, we have employed the Dimitrov-jarvinen (DJ) algorithm [29]. It is formulated with an improvement to the most frequently utilized Itoh-Tsujii algorithm. The computational complexity of both IT and DJ inversion algorithms is the same. For example, these inversion algorithms require 9 multiplications and 162 squarings over \(GF(2^{163})\). The key difference is the use of different register variables for the execution of the routines involved in these inversion algorithms (IT and DJ). Therefore, the IT inversion algorithm takes three 163-bit registers while the DJ algorithm needs only two. Based on this observation, our ECP architecture has implemented a DJ inversion algorithm. The sequence of routines in our work over \(GF(2^{163})\) is given in Algorithm 5 of [11]. Moreover, we have used the same hardware resources of the squarer and multiplier blocks to implement the DJ inversion algorithm. * **AU-controller and routing multiplexer:** As described earlier, the adder, squarer and reduction take one clock cycle for the implementation while the multiplier needs \(m\) clock cycles for two \(m\)-bit operands. Therefore, an AU-controller is required to make a SYNC of combinational (adder, squarer, reduction) and sequential (multiplier) logic inferred in the RTL development of our ECP architecture. It takes three operands (i.e., \(rdata\), \(rdata1\), and \(rdata2\)) as an input and results in one operand as an output (\(wdata\)). The \(rdata\) is an output from shift buffers block and it contains a 163-bit value. This value is selected with a routing multiplexer (not shown in Figure 2) either from the ECC parameters (\(x_{p}\), \(y_{p}\)) or a curve constant (\(b\)). The \(rdata1\) and \(rdata2\) are read operands to the arithmetic unit from the register array. Therefore, based on the control signals from command controller, the AU-controller is responsible to select the appropriate operands for the execution of adder, squarer and multiplier blocks. The output of each arithmetic operator is connected to a routing multiplexer for the written-back data (\(wdata\)) on the register array.