Microsoft throws crypto foes an untouchable elliptic curveball

While Washington mulls ways to make crypto less effective, the industry, thank heavens, continues to push in the other direction. Microsoft Research has just published an elliptic curve library it reckons is considerably faster than what's currently available.

Outlined in this International Association for Cryptologic Research (IACR) paper, the implementation, the FourQLib, comes from noted Redmondian researchers Craig Costello and Patrick Longa.

The aim with FourQ is to update today's elliptic curve cryptography (ECC) – implementations like the National Institute of Science and Technology's (NIST's) P-256 and the non-NIST-influenced Curve25519 – since one inevitability of crypto tech is that it will become obsolete.

That be-prepared approach also means a new ECC library needs to be fast, so that crypto doesn't become too great a burden on the processors handling it. Here's what the authors say about FourQ's performance:

“On Intel’s Haswell, Ivy Bridge and Sandy Bridge architectures, our software computes a variable-base scalar multiplication in 59,000, 71,000 cycles and 74,000 cycles, respectively; and, on the same platforms, our software computes a Diffie-Hellman shared secret in 92,000, 110,000 cycles and 116,000 cycles, respectively.

"These results show that, in practice, FourQ is around four to five times faster than the original NIST P-256 curve and between two and three times faster than curves that are currently under consideration as NIST alternatives, such as Curve25519.”

In addition, FourQ is designed to be simpler, which also makes it easier to demonstrate “concrete correctness” for a four-dimensional decomposition.

It's also simple for developers, they write: “FourQ is intended to be used in the same way, i.e., using the same model, same coordinates and same explicit formulas, irrespective of the cryptographic protocol or nature of the intended scalar multiplication.

“The presence of a single, complete addition law gives implementers the ability to easily wrap higher-level software and protocols around the FourQ’s library exactly as is,” they continue.

And importantly, the code has been made public – it's available for download here – for others to audit. ®