Cyber Defense Laboratory

TinyECC: Elliptic Curve Cryptography for Sensor Networks
(Version 0.1)

Released on 09/15/05.

TinyECC is a software package providing Elliptic Curve Cryptography (ECC) operations on TinyOS. It supports all elliptic curve operations over F_p, including point addition, point doubling and scalar point multiplication, as well as ECDSA operations over F_p (signature generation and verification). We plan to include other ECC schemes (e.g. ECDH) in this package in the future.

TinyECC implements several known optimizations for speeding up ECC operations. (However, it does not include all the known optimization techniques, such as Non-Adjacent Forms, Optimizing Multiplication for Memory Operations proposed in [2].)

For questions about this implementation, please contact An Liu at aliu3 (at) ncsu.edu.

People

• Dr. Peng Ning
• An Liu

Platform

• TinyOS

Related Software

• TinyKeyMan

Related Document

• TinyECC is a byproduct of our research on how to use public key cryptograpy in sensor networks safely. One result can be found in the following paper:
  • Peng Ning, An Liu, Wenliang Du, "Mitigating DoS Attacks against Broadcast Authentication in Wireless Sensor Networks," Technical Report, North Carolina State University, Department of Computer Science, Revised September 2006.

Download

• Click here to download.

How to Use

• Please check README for details.
• If you need to cite TinyECC, please use the following:

  An Liu, Peng Ning, "TinyECC: Elliptic Curve Cryptography for Sensor Networks (Version 0.1)", http://discovery.csc.ncsu.edu/software/TinyECC/, September 2005.

Performance Results

The following performance results were measured on MICAz running TinyOS. Secp128r1, secp128r2, secp160k1, secp160r1, secp160r2 are elliptic curve domain parameters over F_p[7] recommended by Standards for Efficient Cryptography Group (SECG).

• Code size (on MICAz)

We used the sliding window method to speed up scalar point multiplication operation. Table 1 and Table 2 show the code size for different curves and window sizes. Note that the code size changes with different parameters due to the changes in the ECC parameters and some internal state. Moreover, the code for SHA-1, which is 31,866 bytes, is the dominant part of TinyECC.

• Computational cost (on MICAz)

Though the word size on MICAz (ATmega128) is 8 bits, the compiler can provide 16-bit operations and can usually speed up the computation in pure nesC implementation. We measured the time for signature generation and verification for both 8-bit and 16-bit word sizes and different window sizes on MICAz, where the 8-bit versions used inline assembly for some critical functions. Table 3 shows the timing results.

Techniques Adopted in TinyECC

We implemented several well known optimizations for TinyECC, which are listed below. However, this implementation does not include all known optimizations, such as Non-Adjacent Forms, Optimizing Multiplication for Memory Operations proposed in [2].

• Projective Coordinate Systems

There is no division instruction for ATmega128, so the inverse operation is significantly more expensive than multiplication. It is efficient to implement elliptic curve operations in projective coordinates instead of affine coordinates. We used weighted projective representation (Jacobian representation) [1] in TinyECC to speed up point addition, point doubling and scalar point multiplication.

• Curve-Specific Optimizations

For all NIST and most SECG curves, the underlying field primes p were chosen as pseudo-Mersenne primes to allow for optimized modular reduction [2]. We implemented this optimized modular reduction algorithm to speed up modular multiplication and modular square.

• Sliding Window Method (The m-ary Method)

We implemented the sliding window method to speed up scalar point multiplication. The traditional method to do scalar point multiplication is binary method. Binary method scans bits of scalar n from left to right. It scans 1 bit at a time. A point doubling is performed at each step, depending on the scanned bit value a subsequent point addition is performed. Sliding window method [3] scans k bits at a time. Point doubling is performed k times at each step, depending on the scanned k bits value a subsequent point addition is performed. We have to pre-compute all the added points, which is the result of possible k bits value multiply the base point. The sliding window method can speed up scalar point multiplication by reducing the total number of point additions, but extra memory is required.

• Inline Assembly

The natural number operations in TinyECC are based on the implementation in RSAREF2.0 [6]. The natural number operations in RSAREF2.0 are platform independent, but they are not efficient. We used inline assembly code [4] in functions NN_Add, NN_Sub, NN_AddDigitMult and NN_SubDigitMult to eliminate unnecessary shift operations and conditional sentences. Note that this can not be used with sensor nodes that do not use ATmega128 (e.g. TelosB).

• Optimization for Modular Addition and Modular Subtraction

We implemented algorithms 2.7 & 2.8 in [5] to speed up modular addition and modular subtraction.

Copyright and Disclaimer

All new code in this distribution is Copyright 2005 by North Carolina State University. All rights reserved. Redistribution and use in source and binary forms are permitted provided that this entire copyright notice is duplicated in all such copies, and that any documentation, announcements, and other materials related to such distribution and use acknowledge that the software was developed at North Carolina State University, Raleigh, NC. No charge may be made for copies, derivations, or distributions of this material without the express written consent of the copyright holder. Neither the name of the University nor the name of the author may be used to endorse or promote products derived from this material without specific prior written permission.

IN NO EVENT SHALL THE NORTH CAROLINA STATE UNIVERSITY BE LIABLE TO ANY PARTY FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN IF THE NORTH CAROLINA STATE UNIVERSITY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. THE SOFTWARE PROVIDED HEREUNDER IS ON AN "AS IS" BASIS, AND THE NORTH CAROLINA STATE UNIVERSITY HAS NO OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS."

Acknowledgment

The natural number operations in TinyECC are based on the implementation in RSAREF 2.0 [6].

References

[1] I. Blake, G. Seroussi, and N. Smart. Elliptic Curves in Cryptography. Cambridge University Press, 1999. London Mathematical Society Lecture Note Series 265.

[2] N. Gura, A. Patel, and A. Wander. Comparing elliptic curve cryptography and RSA on 8-bit CPUs. In Proceedings of the 2004 Workshop on Cryptographic Hardware and Embedded Systems (CHES 2004), August 2004.

[3] Çetin Kaya Kac. High-Speed RSA Implementation, RSA Laboratories Technical Report TR-201, Version 2.0, November 22, 1994.

[4] 8-bit AVR Instruction Set. http://www.atmel.com/dyn/resources/prod_documents/DOC0856.PDF

[5] D. Hankerson, A. Menezens, and S. Vanstone. Guide to Elliptic Curve Cryptography. Springer, 2004.

[6] RSA Laboratories. RSAREF: A cryptographic toolkit (version 2.0), March 1994.

[7] Certicom Research. Standards for efficient cryptography - SEC2: Recommended elliptic curve domain parameters. http://www.secg.org/download/aid-386/sec2_final.pdf, September 2000.

Sponsors

This project has been generously supported by

This material is based upon work supported by the National Science Foundation (NSF) under grant CAREER-0447761 and US Army Research Office (ARO) under grant W911NF-05-1-0247. Any opinions, findings and conclusions or recomendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the NSF or the ARO.