Cryptology ePrint Archive: Report 2017/350

The Montgomery ladder on binary elliptic curves

Thomaz Oliveira and Julio López and Francisco Rodríguez-Henríquez

Abstract: In this survey paper we present a careful analysis of the Montgomery ladder procedure applied to the computation of the constant-time point multiplication operation on elliptic curves defined over binary extension fields. We give a general view of the main improvements and formula derivations that several researchers have contributed across the years, since the publication of Peter Lawrence Montgomery seminal work in 1987. We also report a fast software implementation of the Montgomery ladder applied on a Galbraith-Lin-Scott (GLS) binary elliptic curve that offers a security level close to 128 bits. Using our software we can execute the ephemeral Diffie-Hellman protocol in just 95,702 clock cycles when implemented on an Intel Skylake machine running at 4 GHz.

Category / Keywords: Montgomery ladder, Scalar multiplication, binary elliptic curves

Original Publication (with minor differences): To appear in Journal of Cryptographic Engineering

Date: received 19 Apr 2017, last revised 17 May 2017

Contact author: francisco at cs cinvestav mx

Available format(s): PDF | BibTeX Citation

Version: 20170517:183703 (All versions of this report)

Short URL:

Discussion forum: Show discussion | Start new discussion

[ Cryptology ePrint archive ]