# Elliptic-Curve Crypto Processor for RFID Applications
## 2 Preliminaries
### PM Computation over \(Gf(2^{M})\)  
One PM operation over \(GF(2^{m})\) is performed by iterating \(k\) times the sum of a point \(P\), i.e., \(Q=k\cdot P\ =\ P+P+\ldots+P\), where \(Q\) is the final point, \(k\) is a scalar multiplier, and \(P\) is the initial point. We have employed the following Lopez-Dahab PM algorithm (Algorithm 1). The coordinates (i.e., \(x_{p}\) and \(y_{p}\)) of initial point \(P\) and a scalar multiplier \(k\) are inputs to Algorithm 1. Moreover, \(k_{n-1},\ldots,k_{1},k_{0}\) determine the scalar multiplier, i.e., key values in terms of 0 s and 1 s. The coordinates (i.e., \(x_{q}\) and \(y_{q}\)) of the final point \(Q\) are the output. For PM computation, Algorithm 1 consists of three parts: (i) affine to projective conversion, (ii) PM computation in projective coordinates and (iii) projective to affine conversions. The PM in projective coordinates is operated in a loop fashion. The control variable, i.e., \(m\), in the \(for\) loop determines the key length. Figure 1: Structure of an RFID tag chip with Elliptic-curve Cryptography Processor (taken from [11]). We provided our architecture for the ECP block highlighted with red color dotted lines. ```
Input:\(k=(k_{n-1},\ldots,k_{1},k_{0})\), \(P=(x_{p},y_{p})\in GF(2^{m})\) Output:\(\mathcal{Q}=(x_{q},y_{q})=k. (P)\) // Affine to projective conversion
1. \(X_{1}=x_{p}\)
2. \(Z_{1}=1\)
3. \(Z_{2}=x_{p}^{2}\)
4. \(X_{2}=Z_{2}^{2}\)
5. \(X_{2}=X_{2}+b\) // Point Multiplication in projective coordinates for (from m-2 down to 0)do
```
1. \(V_{1}=X_{1}\times Z_{2}\)
2. \(V_{2}=X_{2}\times Z_{1}\)
3. \(V_{3}=X_{1}\times Z_{1}\)
4. \(R_{3}=Z_{1}^{2}\)
5. \(R_{3}=R_{3}^{2}\)
6. \(Z_{2}=V_{1}+V_{2}\)
7. \(Z_{2}=Z_{2}^{2}\)
8. \(Z_{1}=V_{3}^{2}\)
9. \(V_{1}=V_{1}\times V_{2}\)
10. \(V_{2}=x_{p}\times Z_{2}\)
11. \(V_{3}=b\times R_{3}\)
12. \(R_{3}=X_{1}^{2}\)
13. \(R_{3}=R_{3}^{2}\)
14. \(X_{2}=V_{1}+V_{2}\)
15. \(X_{1}=V_{3}+R_{3}\) ```
**Algorithm 1**Lopez-Dahab PM Algorithm [27]
``` Input:\(k=(k_{n-1},\ldots,k_{1},k_{0})\), \(P=(x_{p},y_{p})\in GF(2^{m})\) Output:\(\mathcal{Q}=(x_{q},y_{q})=k. (P)\) // Affine to projective conversion
1. \(X_{1}=x_{p}\)
2. \(Z_{1}=1\)
3. \(Z_{2}=x_{p}^{2

+++ ==WARNING: Truncated because of repetitions==
}\)
4. \(X_{2}=Z_{2}^{2}\)
5. \(X_{2}=X_{2}+b\)
6. // Point Multiplication in projective coordinates for (from m-2 down to 0)do



++

## 3 Proposed ECP Hardware Accelerator Architecture

The proposed architecture contains four blocks, i.e., (i) a register array, (ii) shift buffers/registers, (iii) an arithmetic unit, and (iv) a dedicated command controller, as shown in Figure 2. Furthermore, it contains \(clk\), \(rst\) and \(start\) (1-bit) signals. A 1-bit _done_ signal is generated once the crypto processor performs all the required computations. Similarly, it takes 8-bit input data. These input data are either the coordinates of an initial point \(P\) or related ECC parameters required for the computation. The \(din\) signal is used externally by the user while the result is in the form of an 8-bit output (\(dout\)). It is important to note that the size of the architecture is \(m\)-bit, where \(m\) is the key length. The architecture is modeled using Verilog HDL in Vivado IDE. ### Register Array

An array containing a register file is incorporated into the proposed accelerator architecture, as shown in Figure 2. It constitutes a total of ten registers, i.e., \(X_{1}\), \(X_{2}\), \(Z_{1}\), \(Z_{2}\), \(V_{1}\), \(V_{2}\), \(V_{3}\), \(R_{1}\), \(R_{2}\), and \(R_{3}\). These registers are required to contain intermediate and the final results when implementing Algorithm 1. Moreover, two \(10\times 1\) multiplexers (not shown in Figure 2) are used to read operands. Similarly, a \(1\times 10\) demultiplexer is incorporated (not shown in Figure 2) to update the values in a particular register. Each particular register from the employed register array is connected as an input to the multiplexers while the output is connected to \(data1\) and \(rdata2\) signals.