Application of Mordell–Weil lattices with large kissing numbers to acceleration of multiscalar multiplication on elliptic curves

1 Introduction

It is not a secret that elliptic curves E over finite fields F q of huge characteristics p are actively used in discrete logarithm cryptography. Multiscalar multiplication (MSM) in the F q -point group E ( F q ) is widely recognized as a very slow operation. To be more precise, it is about computing the sum ∑ i = 1 N n i P i for given “basis” points P i ∈ E ( F q ) and integers n i ∈ Z . At the same time, MSM is actually a ubiquitous primitive in advanced protocols of elliptic curve cryptography. Therefore, there is a vital need among implementers to speed it up.

As a confirmation of these words, one can mention the relatively recent ZPRIZE 2022 competition [1] (see also ZPRIZE 2023 [2]). Among its objectives was accelerating MSM on certain elliptic F q -curves E b : y 2 = x 3 + b (of j -invariant 0). The money rewards of this competition were quite tempting (the total prize was $4,415,000), which indicates the importance of the topic. As is well known, j = 0 curves are the most attractive in pairing-based cryptography. Furthermore, they enjoy the most efficient group operation (at least among prime-order curves). That is why curves E b are a popular choice for implementation of discrete logarithm-based protocols, even if they do not deal with pairings.

There are numerous algorithms of MSM (see [3–5] and the references therein). All of them in one way or another are reduced to precomputing auxiliary points of the form P v ≔ ∑ i = 1 N v i P i with various integer vectors v = ( v i ) i = 1 N . The points P v are then utilized (depending on the concrete n i ) in the main part of an MSM algorithm, allowing to avoid a lot of repeating elliptic curve additions. By the way, P i = P e i , where e i = ( 0 , … , 0 , 1 , 0 , … , 0 ) are the standard basis vectors of the lattice Z N .

In fact, the points P v become less useful whenever the vectors v are long with respect to a certain norm on Z N . In this situation, P v seem to be too redundant points in the sense that we cannot often apply them during MSM. The author decided to work with the 1-norm ∣ v ∣ 1 = ∑ i = 1 N ∣ v i ∣ to stay with small naturals. Besides, it is the most suitable to reflect the “complexity” of the points P v . Indeed, if ∣ v i ∣ ⩽ 2 and more frequently ∣ v i ∣ ⩽ 1 (as it turns out in this paper), then the 1-norm almost coincides with the minimal number of additions on E necessary for computing P v given v i and P i . Thus, it is sufficient to focus on vectors v ∈ Z N that lie in the ball of some small radius R ∈ N , i.e., ∣ v ∣ 1 ⩽ R . In particular, they have to possess maximum R nonzero coordinates.

For elliptic curves having an F q -endomorphism τ of degree close to 1, the famous GLV (Gallant–Lambert–Vanstone) decomposition can be applied in addition to accelerate MSM even more. As a consequence, MSM algorithms exploiting GLV are based rather on the auxiliary points

with coefficients u i ∈ Z that equally constitute the short vector u ≔ ( u i ) i = 1 N . By abuse of notation, instead of P ( v , u ) , let’s write just P v with v ∈ Z 2 N such that v N + i = u i .

Of course, having a huge amount of available memory or a wide communication channel, the desired points P v can be found once and for all to regularly restore them from the given memory or channel. However, this solution is vulnerable to the constant danger that a malicious entity will perform a fault attack, somehow replacing one or several points in such a way that this breaks a cryptosystem. On the other hand, it is much easier to protect only basic information storing in a small piece of memory (or establish it over a reliable, but slow channel) from which every point P v can be safely (re)generated. It is clear that the described strategy, applied directly to the points, is too expensive in any sense of the word.

The recent works [6,7] are devoted to the problem of generating efficiently the “basis” points P i . In these works, it is suggested to express N = ( N div n ) n + ( N mod n ) for a little n ∈ N . Besides, we are given n linearly independent points P i ( t ) from the Mordell–Weil (MW) group ℰ ( F ) of a certain nontrivial twist ℰ of E over the function field F ≔ F q ( t ) . In the literature, ℰ is often called isotrivial elliptic surface. Then, n “basis” points can be obtained at once as the specialization of P i ( t ) at an element t ∈ F q . Transparently changing t ∈ F q , nothing prevents us from applying the same procedure N div n (plus one if n ∤ N ) times to obtain N points. In fact, ℰ ( F ) has the structure of a Euclidean lattice modulo the torsion subgroup ℰ ( F ) t o r . The corresponding (positive definite) quadratic form h ^ : ℰ ( F ) → Q ⩾ 0 is said to be canonical height. However, this lattice structure previously played only a minor role in the cryptographic context under consideration.

The present work extends the aforementioned generation method to a considerable proportion of the points P v , not exclusively P i . It is proposed to pick MW lattices (of rank r ) with large kissing (also known as Newton) number k . By definition, it is the number of the shortest (i.e., minimal) nonzero lattice points. The norm of the F -point P v ( t ) ≔ ∑ i = 1 r v i P i ( t ) , where v = ( v i ) i = 1 r ∈ Z r , is an indicator of how quickly P v ( t ) can be evaluated at elements of F q . Indeed, the degrees of the point coordinates are proportional to the norm. And the more minimal points we have, the greater performance gain takes place. That is why we are interested in large k with respect to r , that is, in maximizing the quantity δ ≔ log 2 ( k ) ⁄ r . It can be seen that the generation of P i from [6,7] corresponds to the case when ℰ ( F ) is realized as the trivial lattice Z r , because e i are its unique minimal vectors up to sign.

The task of constructing arbitrary lattices having large kissing numbers is one of the most classical tasks in mathematics. It has been carefully studied for several centuries. Established lower and upper bounds on k in the first dimensions can be found in any lattice database like [8,9]. In turn, asymptotic results as r → ∞ are well surveyed in [10,11]. In these articles, Vlăduţ constructs a k-asymptotically good family of lattices for which the kissing number grows exponentially, that is, lim sup r → ∞ δ > 0 . Unfortunately, this inequality probably does not hold for families of MW lattices, making them always k-asymptotically bad.

The last drawback is slightly mitigated for supersingular elliptic surfaces ℰ , because for them, δ decreases more slowly. In a series of articles [12–14], Elkies thoroughly studies MW lattices of such surfaces in characteristic 2. For moderate ranks, he (re)discovers lattices with the greatest known kissing numbers. Among the obtained lattices, there is in particular the 24-dimensional Leech lattice Λ 24 whose k = 196,560 , the optimal kissing number for r = 24 . Regarding an odd characteristic p , it is worth mentioning Shioda’s remarkable article [15] about certain supersingular surfaces ℰ p + 1 of j -invariant 0. Their MW lattices have the nonconstant parameters r = Θ ( p ) and k = Ω ( p 2 ) . Therefore, for p of a cryptographic size, k is an order of magnitude greater than r . However, we cannot employ the given results in discrete logarithm cryptography, because supersingular elliptic curves E are known to be weaker than ordinary ones, especially for little p .

Fortunately, at least for even ranks r ⩽ 8 , it is still possible to achieve the optimal kissing numbers through the MW lattices of ordinary elliptic surfaces, although we are forced to restrict ourselves to j = 0 . By the way, in the extreme case r = 8 , the largest k = 240 . It is about the classical root lattice E 8 , which is wonderful (in many senses) to the same extent as Λ 24 . For other constant ordinary j -invariants, the author does not find in the literature examples of elliptic surfaces whose MW lattices enjoy quite large kissing numbers, not to mention the optimal ones. The situation when k is not substantially greater than r does not merit separate attention. As a consequence, we do not lose much, dealing hereafter only with curves E b .

2 Preliminaries

We will freely use the basic notions and facts on MW lattices recalled in the previous studies [6,7], because it is assumed that the reader is aware of those articles, especially of the second. In turn, abstract lattices have already become paramount objects of (postquantum) cryptography, so they do not need any special introduction. Nonetheless, there may be some aspects of lattice theory that are not in widespread use by the cryptography society. If necessary, such knowledge gaps can be filled with the help of the manual book [16].

The notation k ( r ) will stand for the maximal kissing number among all (not necessarily MW) lattices of rank r . For convenience, Table 1 exhibits lower and upper bounds on k ( r ) for the first four even values r . Odd ranks are out of our interest, because MW ranks of isotrivial elliptic surfaces over finite fields are always even.

Table 1

Bounds on the optimal kissing numbers in small even dimensions

For the sake of simplicity, elliptic F q -curves y 2 = x 3 + b (of j -invariant 0) will be referred to just as E , i.e., without the index b . For the role of τ in the GLV decomposition on such curves, one usually chooses the order 3 automorphism [ ω ] ( x , y ) = ( ω x , y ) , where ω 2 + ω + 1 = 0 . Recall that ω ∈ F p whenever 0 is an ordinary j -invariant as in the article context.

As well as in [7, Sections 4, 5], we will work exclusively with the (rational) elliptic surfaces

where 2 ⩽ m ⩽ 6 and c ∈ F q * is a certain constant depending on m . We will suppose everywhere without reminders that m ∣ q − 1 . This condition guarantees that F q is the splitting field of ℰ m , i.e., ℰ m ( F ) = ℰ m ( F q ¯ ( t ) ) , where F q ¯ is the algebraic closure of F q . In principle, it is possible to consider alternative j = 0 elliptic surfaces. Attractive candidates are briefly discussed in Section 5.2. They will be perhaps considered during further research, but the surfaces ℰ m are quite enough to demonstrate the article idea.

It is convenient that ℰ m ( F ) does not contain nonzero torsion points, that is, ℰ m ( F ) ≃ Z r as a group. We will refer to ℰ m ( F ) by means of L m if it is necessary to stress the lattice structure. The fact is that L m is never the trivial lattice Z r . As is conventional in lattice theory, the minimal norm of L m is denoted by λ 1 ∈ Q > 0 . As it turns out, each minimal point P ∈ L m (i.e., such that h ^ ( P ) = λ 1 ) is integral, i.e., P = ( x ( t ) , y ( t ) ) is a pair of polynomial coordinates, not just rational ones. Some useful information on the lattices L m is collected in Table 2 (cf. [7, Table 1]). Be careful, the symbol ≃ here stands for the congruence (also known as isometry) relation rather than the equivalence one as in the study by Conway and Sloane [16].

Table 2

Some parameters of the MW lattices L m = ℰ m ( F )

Note that A 2 * ≃ L 2 and D 4 * ≃ L 3 (along with their root sublattices A 2 , D 4 ) possess the maximal kissing numbers in their dimensions. The situation is different for the case m = 4 , because the value k of the lattice E 6 * ≃ L 4 (in contrast to E 6 ) is not maximal for r = 6 . That is why the sublattice E 6 is represented in a separate row of the table. Of course, we can likewise realize A 2 , D 4 as sublattices of L 2 , L 3 , respectively. However, the minimal norm of the former is slightly greater (namely, λ 1 = 2 ), which negatively influences the coordinate degrees of minimal points. Unlike E 6 , the lattices A 2 , D 4 thus do not provide any advantage in our context. Finally, E 8 ≃ L 5 ≃ L 6 is simply a self-dual (also known as unimodular) lattice.

As is well known, the automorphism group of both E , ℰ m is generated by the order 6 automorphism [ − ω ] = − [ ω ] of the form [ − ω ] ( x , y ) = ( ω x , − y ) . Given a point P on E or ℰ m , we lack the notation P ¯ ≔ { [ − ω ] i P } i = 0 5 for the orbit of P with respect to [ − ω ] . It is straightforward that the norm of P ∈ ℰ m ( F ) is invariant under [ − ω ] . Therefore, the automorphisms also act on the set of minimal points. This action is free, since the nonzero fixed points of [ − ω ] i (for which x y = 0 ) are obviously outside ℰ m ( F ) regardless of i ∈ Z ⁄ 6 and m . Thereby, # P ¯ = 6 unless P is the infinity point (0:1:0). In particular, always 6 ∣ k .

Like in [7, Section 5], everywhere in this article, a basis of ℰ m ( F ) will be taken in the form P 1 , … , P r ⁄ 2 , [ ω ] P 1 , … , [ ω ] P r ⁄ 2 and, moreover, all its points will be minimal. After identifying ℰ m ( F ) ≃ Z r with respect to such a basis, we obtain the following action of [ − ω ] induced on Z r :

Here, the equality ω 2 = − ω − 1 is utilized. Similarly, denote by v ¯ the orbit of v ∈ Z r under the given action. Evidently, for the point

its orbit P v ¯ = { P u } u ∈ v ¯ .

The coordinates x , y of the six orbit representatives P u coincide up to multiplication by ω , − 1 , respectively. Consequently, for computing all the points P u ∈ P v ¯ , it is essentially sufficient to determine only one of them. To simplify this process as much as possible, it is necessary to define the “lightest” point P u in a sense. One of the reasonable ways (adopted in the next section) is to take a vector u ∈ v ¯ with the smallest 1-norm ∣ u ∣ 1 = ∑ i = 1 r ∣ u i ∣ . We will equally call this number the 1-norm of P u , which has nothing to do with the other norm h ^ ( P u ) . As an example, the basis points P i , [ ω ] P i are actually the “lightest”, because they (along with their inverse ones) are of 1-norm 1.

3 Minimal points of the lattices L m

This section is heavily based on [7, Section 5]. From there, we will borrow the concrete bases P i , [ ω ] P i depending on m . Be careful, the below points P r ⁄ 2 + i are different from [ ω ] P i in contrast to that article. We will tacitly resort to the computer algebra system Magma. The corresponding code is loaded on the web page [17]. We will consider step by step the remaining minimal points P i ∈ L m , where r ⁄ 2 < i ⩽ k ⁄ 6 . For compactness, their explicit formulas are omitted in the text (except for the degenerate case m = 2 ), but they are momentarily obtained by launching the Magma code.

4 Generating the minimal points

Assume that t ∈ F q is a known element such that the reduction (also known as specialization) ℰ m , t of the surface ℰ m at t is F q -isomorphic to the original curve E . As explained in [7, Section 3], we are able to obtain such an element as some m -th root t = ⋅ m when it is extracted over F q , that is, approximately with the probability 1 ⁄ m . The associated isomorphism has the following form:

where the coefficients c x , c y ∈ F q depend on t .

To this moment, we are given (formulas of) the minimal points P i ∈ L m from Section 3. All of the following is equally true in the case of the points P i ′ ∈ L 4 ′ . Therefore, this case will not be mentioned further to avoid repetitions. Throughout the section, we will assume that the “basis” points φ t ( P i ( t ) ) ∈ E ( F q ) , where i ⩽ r ⁄ 2 , have already been generated by [7, Algorithm 1] with respect to t ∈ F q . Our purpose is to generate as fast as possible the remaining “minimal” points φ t ( P i ( t ) ) , where i ⩽ k ⁄ 6 . By abuse of notation, we will refer to these points simply by P i as well as for the initial lattice points. Let’s suppose for simplicity that multiplications by ω , − 1 (apart from additions in F q ) are not taken into account in the below estimations of running time. Thereby, once a “minimal” point P i is determined, so is its full orbit P i ¯ of 6 conjugates.

A naive method of finding P i ∈ E ( F q ) consists in performing successive curve additions of the form P i = P i 1 + P i 2 (up to the automorphisms of E ) such that i 1 , i 2 , r ⁄ 2 < i . As shown in Section 3, such a minimal addition chain takes place regardless of m . Thus, the total number of additions on E is equal to A ≔ k ⁄ 6 − r ⁄ 2 . According to [20] and [21, Section 6.4.1], the general addition operation on an arbitrary curve E : y 2 = x 3 + b z 6 (in Jacobian coordinates) costs no less than 16 multiplications in F q . Sometimes, E can be transformed into other forms enjoying faster addition formulas. The most efficient among them is widely recognized to be the twisted Edwards form (in extended coordinates) on which + requires 10 multiplications. To sum up, the overall running time of the naive generation method lies between 10 A and 16 A field multiplications.

From the geometric point of view, the minimal points are no different from the basis ones. As a result, we have Algorithm 1 that generates all the “minimal” F q -points on E , supplementing [7, Algorithm 1] in a natural way. Formally speaking, the corresponding vectors v ∈ Z r (i.e., such that P i = P v ) have to be returned in the new algorithm in parallel with the points. Otherwise, the latter are useless for subsequent MSM algorithms. Note that reducing P i ( t ) amounts to two Horner’s schemes applied to the coordinate polynomials x = x ( P i ) and y = y ( P i ) . In turn, each application of φ t costs 2 multiplications in F q (by c x , c y ). As a consequence, to obtain one “minimal” point it is enough to perform M ≔ deg ( x ) + deg ( y ) + 2 field multiplications. Therefore, M A is the total number of multiplications in the new generation method.

We see that the new approach is faster than the naive one whenever the cost of one addition on E is greater than M . Interestingly, this is always the case, because M ⩽ 7 , that is, 10 − M ⩾ 3 and 16 − M ⩾ 9 . Table 3 demonstrates the exact numbers of multiplications (checked in Magma [17]) for all the cases 2 ⩽ m ⩽ 6 . As expected, the performance gain (namely, the last two columns) increases when m does. In particular, we do not obtain any benefit for m = 2 , and the best result occurs for m ∈ { 5 , 6 } . Curiously, there is one exception: the value ( 10 − M ) A is equal to 30 for the lattice L 4 , but 27 for its sublattice L 4 ′ . Nevertheless, the situation is opposite ( 66 < 81 ) if the curve E is in the short Weierstrass form.

Table 3

Comparison (in terms of the numbers of multiplications in F q ) of the naive and new methods of generating all the “minimal” F q -points on E

It is impossible not to mention that the entries of Table 3 should be slightly recalculated under a deeper complexity analysis. Indeed, there are several minor optimization possibilities not taken into account before, but explained in the next paragraphs. For simplicity, such a detailed analysis is omitted in the present paper, because it is more mathematical in nature than engineering. Undoubtedly, the table tendencies will remain after recalculation. In other words, supremacy of the new generation method over the naive one is beyond question. Ideally, the optimization tricks under consideration have to be used in the process of programming Algorithm 1 (or some of its versions) in one of low-level languages. Nonetheless, in view of Section 5.2, it is more logical at the beginning to conduct further research on the topic prior to proceeding with an optimized implementation.

First, the constant ω ∈ F p may be quite large (in absolute value) in contrast to − 1 . Hence, multiplication by ω may not be completely free. Second, formulas of the minimal points P i ∈ L m may sometimes have small or repeating coefficients, at least for different indices i . As a result, with the same input argument t ∈ F q , evaluating P i ( t ) together (i.e., for all i ⩽ k ⁄ 6 ) may cost considerably less than separately. On the contrary, repeating field multiplications are seemingly rare in the addition chains P i = P i 1 + P i 2 and the majority of these multiplications are general (i.e., not by a constant). The fact is that addition chains are inherently computed successively (not in parallel as P i ( t ) ), and hence, there is limited room for their optimization.

The operation + on E does not keep affine coordinates unless the inverse operation in F q * is used. Since the latter is recognized to be much more expensive than multiplication, + must return (weighted) projective coordinates. In particular, most instances of + in our addition chains are forced to receive such burdensome input coordinates. As an exception, the points P i of 1-norm 2 (unlike those of larger 1-norms) are the sums of two basis points, which are usually given on the affine plane. Therefore, the 1-norm 2 points require fewer multiplications than 10 and 16, respectively. However, the proportion of these points decreases with the growth of m . For the cases m ∈ { 5 , 6 } the most interesting for us, there are solely 6 such points among 36 nonbasis minimal points. By the way, all the minimal points P i ∈ L m are integral, hence reducing them always avoids inverting in F q * . This circumstance no doubt leads to a slight acceleration of MSM algorithms based on P i .

It has not yet been clearly justified for which value m the L m -based generation method (let’s denote it by M m ) is the best. So far, we have just made sure that this method is better than the naive one with the same m . Evidently, the smaller the given parameter, the more efficient Algorithm 1, but at the price of fewer returned points. It is important to remember that this algorithm is always preceded by much slower [7, Algorithm 1]. Recall that its complexity on average amounts to m ( ⋅ q ) m + ⋅ m (apart from several more multiplications), where ( ⋅ q ) m is the m -th power residue symbol and ⋅ m is the m -th root in the field F q .