Paper 2022/748

2DT-GLS: Faster and exception-free scalar multiplication in the GLS254 binary curve

Marius A. Aardal, Aarhus University
Diego F. Aranha, Aarhus University

We revisit and improve performance of arithmetic in the binary GLS254 curve by introducing the 2DT-GLS scalar multiplication algorithm. The algorithm includes theoretical and practice-oriented contributions of potential independent interest: (i) for the first time, a proof that the GLS scalar multiplication algorithm does not incur exceptions, such that faster incomplete formulas can be used; (ii) faster dedicated atomic formulas that alleviate the cost of precomputation; (iii) a table compression technique that reduces the storage needed for precomputed points; (iv) a refined constant-time scalar decomposition algorithm that is more robust to rounding. We also present the first GLS254 implementation for Armv8. With our contributions, we set new speed records for constant-time scalar multiplication by $34.5\%$ and $6\%$ on 64-bit Arm and Intel platforms, respectively.

Available format(s)
Publication info
Published elsewhere. SAC 2022
ECC binary elliptic curves software implementation GLS254
Contact author(s)
maardal @ cs au dk
dfaranha @ cs au dk
2022-10-01: last of 4 revisions
2022-06-13: received
See all versions
Short URL
Creative Commons Attribution


      author = {Marius A. Aardal and Diego F. Aranha},
      title = {2DT-GLS: Faster and exception-free scalar multiplication in the GLS254 binary curve},
      howpublished = {Cryptology ePrint Archive, Paper 2022/748},
      year = {2022},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.