Cryptology ePrint Archive: Report 2019/1304

Reduction Modulo $2^{448}-2^{224}-1$

Kaushik Nath and Palash Sarkar

Abstract: An elliptic curve known as Curve448 over the finite field $\mathbb{F}_p$, where $p=2^{448}-2^{224}-1$ has been proposed as part of the Transport Layer Security (TLS) protocol, version 1.3. Elements of $\mathbb{F}_p$ can be represented using 7 limbs where each limb is a 64-bit quantity. In this paper, we describe efficient algorithms for reduction modulo $p$ that are required for performing field arithmetic in $\mathbb{F}_p$. A key feature of our algorithms is that we provide the relevant proofs of correctness. Based on the proofs of correctness we point out the incompleteness of the reduction methods in the previously known fastest code for implementing arithmetic in $\mathbb{F}_p$.

Category / Keywords: public-key cryptography / Curve448, Goldilocks prime, modulo reduction, elliptic curve cryptography.

Date: received 10 Nov 2019, last revised 11 Nov 2019

Contact author: kaushikn_r at isical ac in,palash@isical ac in

Available format(s): PDF | BibTeX Citation

Version: 20191112:061154 (All versions of this report)

Short URL: ia.cr/2019/1304


[ Cryptology ePrint archive ]