# Large Field-Size Elliptic Curve Processor for Area-Constrained Applications
## 3 Proposed Crypto Processor Architecture
### Arithmetic Unit  
The gray highlighted portion in Figure 1 shows the arithmetic unit. It contains an \(m\)-bit adder and an \(m\)-bit multiplier. The adder unit is simply implemented by the bitwise exclusive (OR) operation. For two \(m\)-bit operands, \(m\) exclusive (OR) gates are needed. We have performed modular multiplication using a hybrid Karatsuba multiplier. A hybrid approach is achieved by combining Karatsuba and traditional school book multipliers. In order to completely describe our proposed multiplier architecture, we first present the polynomial splits over \(GF(2^{571})\) for the Karatsuba multiplier in Figure 2. It can be observed from Figure 2, the input polynomials of length 571-bits are partitioned into two pieces, i.e., 285 and 286. Then, in level two, the split 285-bit polynomial is further divided into two more parts of lengths 142 and 143. We repeat the splitting process until to reach the 35-bit and 36-bit polynomials. Afterward, the multiplication over polynomial lengths of 35-bit and 36-bit is acquired using a traditional schoolbook multiplier. The proposed hybrid modular multiplier architecture is shown in Figure 3.  
Figure 1: Block diagram of our large field-size elliptic curve cryptographic processor in \(GF(2^{m})\). Figure 2: Polynomial splits of a Karatsuba modular multiplier over \(GF(2^{571})\). The orange color portion in Figure 3 determines the Karatsuba multiplication while the gray highlighted regions are for traditional schoolbook multiplication. The proposed hybrid Karatsuba multiplier operates in a way that the schoolbook multiplier performs first to generate the polynomial multiplication result over smaller polynomial lengths. Then, the outputs of the schoolbook multiplier will be transferred to the Karatsuba multiplier to accomplish the required polynomial multiplications over 409 and 571 bits. The area cost of the schoolbook multiplier is 35 AND gates to generate a partial product over 35-bit polynomials. The overall cost includes \(35\times 35\) (meaning that 35 partial products are needed and the length of each partial product is 35-bits). Some OR gates are needed to generate the resultant product of 71-bits length. Similarly, the area cost of the schoolbook multiplier is 36 AND gates to generate a partial product over 36-bit polynomials. The overall cost will be \(36\times 36\). It implies that a total of 36 partial products are needed and each partial product contains a 36-bits length. The final product of 72-bit length is generated using some OR gates. The outputs of schoolbook multipliers is 71 (for \(35\times 35\)) and 72 (for \(36\times 36\)) bits. These 71 and 72-bit outputs are input to the Karatsuba multiplier for generating multiplications over longer polynomials than 35 and 36 bits. The Karatsuba multiplier takes two \(m\)-bit operands \(a\) and \(b\) as input and divides them into two \(\frac{m}{2}\) parts. The split parts of polynomial \(a\) are \(ah\) and \(al\). Similarly, the split parts of polynomial \(b\) are \(bh\) and \(bl\). Three multipliers are needed to execute the inner multiplications [29]. The M1 multiplies \(ah\) and \(bh\) whereas M2 multiplies \(al\) and \(bl\). The multiplier M3 is responsible to multiply the outputs generated after adders, i.e., A1, and A2. Apart from the inner multiplications, the addition of split polynomials is performed. The first adder (i.e., A1) is used to add \(ah\) and \(al\). Similarly, the second adder (i.e., A2) adds the  
Figure 3: Proposed Karatsuba modular multiplier. \(bh\) and \(bl\) polynomials. As seen in Figure 3, the adder A3 adds the multiplication results produced by multipliers M1, M2 and M3. Two shifters, i.e., S1, and S2, are needed to shift polynomials by \(\frac{m}{2}\) and \(m\) bit towards the right. Finally, an adder A4 generates the resultant polynomial of length \(2\times m\) and it goes to the reduction block as input to generate an \(m\)-bit output.