$\mu$Kummer: efficient hyperelliptic signatures and key exchange on microcontrollers

Joost Renes (1) , Peter Schwabe (1) , Benjamin Smith (2, 3) , Lejla Batina (1)

1 Digital Security Group [Nijmegen]
2 LIX - Laboratoire d'informatique de l'École polytechnique [Palaiseau]
3 GRACE - Geometry, arithmetic, algorithms, codes and encryption

We describe the design and implementation of efficient signature and key-exchange schemes for the AVR ATmega and ARM Cortex M0 microcontrollers, targeting the 128-bit security level. Our algorithms are based on an efficient Montgomery ladder scalar multiplication on the Kummer surface of Gaudry and Schost's genus-2 hyperelliptic curve, combined with the Jacobian point recovery technique of Costello, Chung, and Smith. Our results are the first to show the feasibility of software-only hyperelliptic cryptography on constrained platforms, and represent a significant improvement on the elliptic-curve state-of-the-art for both key exchange and signatures on these architectures. Notably, our key-exchange scalar-multiplication software runs in under 9740k cycles on the ATmega, and under 2650k cycles on the Cortex M0.

Mots clés: Hyperelliptic curve cryptography; AVR ATmega; ARM Cortex M0; Kummer surface

Domaines: Cryptographie et sécurité [cs.CR]

Joost Renes, Peter Schwabe, Benjamin Smith, Lejla Batina. $\mu$Kummer: efficient hyperelliptic signatures and key exchange on microcontrollers. Cryptographic Hardware and Embedded Systems – CHES 2016, IACR, Aug 2016, Santa Barbara, United States. pp.20, ⟨10.1007/978-3-662-53140-2_15⟩. ⟨hal-01300727⟩