SPRUJ17H March 2022 – October 2024 AM2631 , AM2631-Q1 , AM2632 , AM2632-Q1 , AM2634 , AM2634-Q1
The EC2m operations shown in Table 7-113, Point Add & Multiply on a Binary Field Curve, are used in the ECDSA and ECDH public key algorithms when the underlying elliptic curve is defined over a binary field. See Appendix D.1.3 of [FIPS 186-3] for binary field curves recommended by NIST.
The same rationale as given in Section 7.3.4.4.1.7.3.3, Operations for ECC on Curves over Prime Fields, holds for the use of projective input and output instead of the affine format.
Although the EC2m operations look very similar to the ECp operations at the interface level, their implementation is quite different due to the fact that arithmetic in the binary field GF(2m) is very different from that in GF(p). Note that the PKA module expects binary field values to be bit strings that represent a polynomial over GF(2). All arithmetic is implemented as polynomial arithmetic modulo p, where p is the field's prime (or irreducible) polynomial. All that arithmetic is done using the GF2M engine.
The EC2mMULxyz operation expects that curve parameter b is replaced by its square root c, that is: c2 = b (mod p). This allows a common optimization of the point double formulas, see for example the Appendix of "Fast multiplication on elliptic curves over GF(2m) without precomputation" by Lopez & Dahab (1999). One way to compute value c is: c = b^(2m-1).
The PKA module supports GF(2m) values up to 571-bit.
Function | Requirements |
---|---|
EC2mADDxyz | 1 < BLen <= 18 (maximum vector length is 571 bits) p must be a prime polynomial. a < p and b < p P1_xyz and P2_xyz must be on the curve (this is not checked). |
EC2mMULxyz | 0 < ALen <= 18 (maximum vector length is 571 bits) 1 < BLen <= 18 (maximum vector length is 571 bits) p must be a prime polynomial. The highest word of the modulus vector, as indicated by BLen, may not be zero. a < p and b < p P1_xyz must be on the curve (this is not checked). P1_z must equal one. 1 < k <= n, where n is the curve's order. |
EC2mSCALExyz | 1 < BLen <= 18 p must be a prime polynomial of upto 572 bits (that is, maximum degree is 571 bits). |
Function | WorkSpace Size (in 32-bit Words), |
---|---|
EC2mADDxyz | 6 * (BLen + 2 + BLen MOD 2) |
EC2mMULxyz | 6 * (BLen + 2 + BLen MOD 2) |
EC2mSCALExyz | BLen |
Status Code | Description |
---|---|
0x01 | Command executed successfully. |
0x03 | Prime polynomial is even. |
0x05 | Scalar 'k' is zero. This value should never occur in practice and is treated as an error. The result isundefined. |
0x09 | Scalar 'k' is one. This value should never occur in practice and is treated as an error. The result is undefined. |
0x0D | Result is "at-infinity" (Z = 0, not an error if the scalar 'k' was the curve's order). |