Abstract. We describe an implementation of fast elliptic curve scalar multiplication, optimized for Diffie-Hellman Key Exchange at the 128-bit security level. The algorithms are compact (using only x-coordinates), run in constant time with uniform execution patterns, and do not distinguish between the curve and its quadratic twist; they thus have a built-in measure of sidechannel resistance. The core of our construction is a suite of two-dimensional differential addition chains driven by efficient endomorphism decompositions, built on curves selected from a family of Q-curve reductions over F p 2 with p = 2 127 −1. We include state-of-the-art experimental results for twist-secure, constant-time, x-coordinate-only scalar multiplication.
In REF the authors use a curve and its quadratic twist (over F p 2 ) to obtain a fast x-coordinate-only scalar multiplication algorithm using 256 bytes of memory for precomputations.
Faster Compact Diffie-Hellman: Endomorphisms on the x-line
EUROCRYPT
Computer Science Mathematics