Pith. sign in

REVIEW 4 major objections 7 minor 44 references

M-ary Precomputation-Based Accelerated Scalar Multiplication Algorithms for Enhanced Elliptic Curve Cryptography

T0 review · 4 major / 7 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A base-B precomputation table is claimed to reduce batch elliptic-curve scalar-multiplication time from $\Theta(Q \log p)$ to $\Theta(Q \log p / \log Q)$ while using $\Theta(Q \log p / \log^2 Q)$ memory.

desk verdict The core algorithm is the classical BGMW/Lim-Lee fixed-base precomputation method, the blinding step as printed is internally inconsistent, and the reported memory figures do not match the described table size; only the Lambert W parameter choice is new and it is minor. read the letter →

arxiv 2505.01845 v1 pith:ME33N5MJ submitted 2025-05-03 cs.CR

Tongxi Wu , Xufeng Liu , Jin Yang , Yijie Zhu , Shunyang Zeng , Mingming Zhan This is my paper · ORCID
classification cs.CR
keywords ellipticcurvecryptographyscalarmultiplicationM-aryprecomputationtime-spacetradeoffLambertWfunctionElGamalencryptionNS3simulationtable
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes a precomputation method for elliptic-curve cryptography that computes many scalar multiplications at once when the base point is fixed, claiming to reduce the time from $\Theta(Q \log p)$ to $\Theta(Q \log p / \log Q)$ while using $\Theta(Q \log p / \log^2 Q)$ memory. The trick is to write each scalar in a base $B$ and look up multiples of $B^i P$ in a table instead of scanning every bit of every scalar. The paper also presents a sparse variant that stores only powers-of-two multiples per level, cutting memory to $\Theta(\log p)$ at a small runtime cost. Experiments with ElGamal encryption and an NS3 communication simulation report up to 59% faster encryption on secp256k1 and 22–25% reductions in communication and simulation time on the larger curves.

What carries the argument

The load-bearing object is the M-ary table $M[i][j] = j\,(B^i P)$, built by the recurrence $M[i][j] = M[i][j-1] + M[i][1]$ and $M[i][1] = M[i-1][B]$, so the whole table costs $\Theta(dB)$ point additions. The second piece is the base-$B$ decomposition $k = \sum_{i=0}^{d-1} a_i B^i$, which turns one scalar multiplication into $d$ lookups and $d-1$ additions. The third piece is the parameter choice: $B = \lceil p^{1/d} \rceil$ and $d = \lceil \ln p / (W(Q/e)+1) \rceil$, where $W$ is the principal Lambert $W$ function; this minimizes $d(B+Q)$, converting the complexity into $\Theta(Q \log p / \log Q)$, and it is what makes the claimed speedup asymptotic in $Q$. The sparse variant stores only $H[i][j] = M[i][2^j]$ and reconstructs each digit by binary decomposition, which replaces $O(\log B)$ storage per row with a constant number of entries.

What would settle it

On secp256k1, set $Q=1000$, compute $d = \lceil \ln p / (W(1000/e)+1) \rceil$ and $B = \lceil p^{1/d} \rceil$, then count the points the implementation actually stores before scalar multiplication begins. If the stored count is not $d \cdot B$ (roughly 7,000 points) yet the reported peak memory is 0.1449 MB, the precomputation table is not part of the measurement and the claimed 30% memory savings and the asymptotic memory complexity are unsupported.

Watch

Extended reading notes

Core claim

The paper's central claim is that a table $M[i][j] = j\,(B^i P)$, precomputed once for a fixed curve and base point, lets any scalar $k$ be turned into $kP$ in $d$ point additions: write $k$ in base $B$ and sum the $d$ selected table entries. With $B$ chosen as the $d$-th root of the field size and $d$ chosen as the minimizer of $x(p^{1/x}+Q)$, which is $\ln p / (W(Q/e)+1)$ for the Lambert $W$ function, the total cost of $Q$ scalar multiplications becomes $\Theta(d(B+Q)) = \Theta(Q \log p / \log Q)$ and the table size becomes $\Theta(dB) = \Theta(Q \log p / \log^2 Q)$. A binary-storage variant keeps only the $2^j$ multiples in each row, bringing memory down to $\Theta(\log p)$ while restoring the time to $\Theta(Q \log p)$. The paper argues this beats the $\Theta(Q \log p)$ time of double-and-add, NAF, $2^k$-ary, and Montgomery-ladder baselines and the $\Theta(2^r)$ memory of windowed methods, and reports consistent speedups in ElGamal and NS3 evaluations.

Load-bearing premise

The experimental numbers are taken as evidence for the complexity claims, which presupposes that the implementation actually builds and retains the full $d \times B$ precomputation table with the stated parameter choices; if the reported peak memory of 0.1449 MB on secp256k1 at $Q=1000$ excludes that table (which alone would hold roughly 7,000 points, about 0.4 MB uncompressed), then the memory and complexity validation does not measure what the theory claims.

Editorial extensions

If this is right

  • For applications that repeatedly multiply by the same base point—ElGamal encryption rounds, signature verification with fixed public keys, batch payment processing—the $1/\log Q$ factor makes large batches asymptotically cheaper than any method that scans all $\log p$ bits per scalar.
  • The memory complexity $\Theta(Q \log p / \log^2 Q)$ grows sublinearly in $Q$, so the table size is manageable for $Q$ in the hundreds to thousands on the tested curves, unlike exponential-in-window precomputation schemes.
  • The binary-storage variant gives a practical memory floor of $\Theta(\log p)$ for constrained devices, converting the speed advantage into a space-time trade-off.
  • On the tested curves, the method reports up to 59% lower ElGamal encryption time on secp256k1 at $Q=1000$ and 22–25% lower communication and simulation time in the NS3 network scenario.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same Lambert-$W$ balancing—splitting the scalar into $d$ base-$B$ digits so that the table cost $dB$ and the per-scalar lookup cost $dQ$ are equalized—should transfer to multi-scalar multiplication (MSM) pipelines, where a table of powers of the generator per level could be reused across many scalars; the paper mentions MSM only as future work, but the asymptotic benefit is immediate.
  • Because the time formula $d(B+Q)$ already includes the precomputation cost, the reported encryption-time reductions depend on $Q$ being large enough that $W(Q/e)+1$ exceeds a small constant; for small $Q$ the method degenerates to a fixed table of $\Theta(\log p)$ points with no asymptotic gain, a regime the paper's $\log Q$ formulas do not make explicit.
  • If the memory measurements exclude the precomputation table, the 30% memory savings claim is not comparable to sliding-window memory, which counts table plus working state; a fair comparison would count the table bytes explicitly.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. This paper proposes a batch fixed-base scalar multiplication algorithm for elliptic curves. For Q scalars, it selects a digit count d and radix B via the Lambert W function, precomputes a table M[i][j] = j·B^i·P, and computes each scalar as a sum of d table entries. The authors claim time complexity Θ(Q log p / log Q) and memory complexity Θ(Q log p / log² Q), and they present a sparse binary variant, ElGamal encryption experiments, and NS3 communication simulations. The theoretical derivation in Sections 3.3–3.5 is internally consistent under an additions-only cost model and does not fit constants to data. However, Algorithm 3's scalar blinding step is mathematically incorrect, the reported peak-memory measurements cannot accommodate the precomputed table described in the paper, and the binary-variant parameter derivation in Section 3.6 contains an error.

Significance. If the unblinded variant were the contribution, the asymptotic speedup and the memory scaling improvement over a sliding-window method with window size log Q would be a plausible and potentially useful result for large fixed-base batches; the Lambert-W-based parameter selection is a reasonable closed-form minimizer of the paper's own cost expression, and no free parameters are fitted to the experimental data. However, as submitted, the security claim rests on an incorrect randomization step, the memory measurements contradict the algorithm's own storage requirements, and the binary variant's minimization is not derived correctly. These issues are load-bearing for the paper's central claims, so the practical and theoretical significance cannot be accepted in the current form.

major comments (4)
  1. [Algorithm 3, Step 3; §3.7.1] The scalar blinding step in Algorithm 3 does not compute kP. Since B^d·P is not the identity in general, the blinded scalar k + r·B^d is not congruent to k modulo the group order. The sum S over the lower d digits equals kP, because adding r·B^d does not change digits 0 through d−1, so the correction S ← S − r·(B^d·P) returns (k − r·B^d)·P; alternatively, including the missing position-d digit would return (k + r·B^d)·P. Neither is kP. A correct randomization must use k + r·ord(P), and the base-B digits of that value cannot be read off from the digits of k without additional work, so the per-scalar cost in Eq. (28) does not cover the blinding. Consequently, §3.7.1's DPA-resistance claim and the DPA column of Table 3 are unsupported, and Algorithm 3 as printed is incorrect for any nonzero r.
  2. [§4.2.2, Table 7] The peak-memory numbers in Table 7 cannot be produced by Algorithm 3 with the parameters of Sections 3.3–3.4. For secp256k1 at Q = 1000, d = ⌈ln p / (W(Q/e) + 1)⌉ ≈ 33 and B = ⌈p^{1/d}⌉ ≈ 217, so the table M of Eq. (20) contains roughly d·(B+1) ≈ 7,000 points; even with 33-byte compressed point storage this is about 0.23 MB, while the reported peak is 0.1449 MB. At Q = 1 the gap is even larger: d ≈ 139 and B ≈ 4 give roughly 700 points (about 0.02 MB compressed), against a reported peak of 0.000797 MB. The measurements therefore cannot include the precomputed table, or they use parameters different from those stated in the paper. The claimed 30% memory saving and the Θ(Q log p / log² Q) memory regime are not supported by the reported experiments.
  3. [§3.6.2, Eq. (38)] Equation (38) is not the minimizer of Eq. (37). The Q-dependent term in Θ(d(p^{1/d} + Q log p^{1/d})) is Θ(Q log p), which is independent of d; minimizing the remaining term d·p^{1/d} over real d gives d = ln p (natural logarithm) and B = e, not d = log₂ p. If one instead sets d = log₂ p, then B = p^{1/d} = 2, not e. As written, Eq. (38) asserts d = log₂ p and B = e simultaneously, which is impossible. The claimed Θ(log p) space and Θ(Q log p) time for the binary variant therefore do not follow from the stated minimization, and the NS3 results attributed to the binary variant in Table 6 rest on an unproven configuration.
  4. [§4.2.2–§4.3] The experimental sections do not state whether Algorithm 3's blinding step was enabled, which coordinate system and point encoding were used for the table, how peak memory was measured, or how the number Q of scalar multiplications relates to the plaintext length L in the ElGamal experiments. Combined with the blinding error in Algorithm 3, the reported encryption and simulation times cannot be attributed to the algorithm as printed, and the results are not reproducible without the source code or detailed implementation notes. These details are needed before the claimed practical gains can be evaluated.
minor comments (7)
  1. [Appendix B.3, Eq. (B.11)] Equation (B.11) defines M_{i,j} for 0 ≤ j < B, while Algorithm 3 and Eq. (20) use 0 ≤ j ≤ B; the recurrence M_{i,1} = M_{i−1,B} requires the j = B entry, so the appendix bound should be corrected to 0 ≤ j ≤ B.
  2. [Eqs. (24), (37), (38)] The notation 'd√n' and 'd√p' is ambiguous and should be typeset as a radical with index d, i.e., ⌈√[d]{n}⌉ and √[d]{p}.
  3. [Abstract; §4.2.3; Conclusion] The abstract and conclusion cite '30% memory savings' without a baseline; Table 7 shows reductions that vary by curve and Q, for example about 18% versus Double-and-Add on secp256k1 at Q = 1000 and about 71% versus Sliding Window on secp384r1 at Q = 100.
  4. [§4.3.2] The text states that M-ary (binary) ranks first in 9 of 12 test cases, but in Table 7 it has the lowest peak memory in all 12 rows; the count should be corrected.
  5. [§4.3.2, Figure 6] The bullet points describing Figure 6 conflict with the figure captions: the text assigns panel (a) to encryption time, (b) to communication time, and (c) to simulation time, while the captions assign (a) to simulation time, (b) to encryption time, and (c) to communication time.
  6. [§4.2.3, Table 5] The text should state explicitly how the number of scalar multiplications Q is derived from the plaintext length L in the ElGamal experiments; otherwise the claimed 1/log Q scaling cannot be checked.
  7. [Eq. (33)] The binary entries are written as 'Mi,20,Mi,21,...' without superscripts; this should be M_{i,2^0}, M_{i,2^1}, and so on.

Circularity Check

0 steps flagged · score 0.0 of 10

The paper's asymptotic claims follow analytically from its own cost model and parameter minimization, so I find no significant circularity.

full rationale

The derivation chain is self-contained. Algorithm 3 fixes a base B and depth d, precomputes a d-by-B table (Eq. 20), and computes each kP as d table lookups and additions, so the stated total cost Theta(d(B+Q)) (Eq. 25 and Appendix B.16) is the paper's own model rather than an external fitting target. The parameter B=ceil(p^(1/d)) follows from the requirement that d base-B digits represent all scalars, and the minimization of f(x)=x(p^(1/x)+Q) gives x0 = ln p / (W(Q/e)+1), which yields the stated Theta(Q log p / log Q) time bound (Eqs. 27-28). The same choice of d substituted into the table size gives Theta(Q log p / log^2 Q) (Eqs. 29-32). No fitted parameter is later renamed as a prediction, and no load-bearing argument depends on a self-citation; references [38,39] only motivate the time-space tradeoff framing. I therefore find no circularity. For completeness, the manuscript does contain a serious algorithmic bug in Algorithm 3's blinding step: after adding rB^d and summing only digits 0 through d-1, S equals kP, so subtracting r(B^d P) returns (k - rB^d)P rather than kP; and Table 7 reports peak memory for M-ary (ours) at Q=1000 on secp256k1 (0.1449 MB) that is smaller than the theoretical d*B table alone (~33*217 points). These are correctness and measurement-validity problems, not circular reductions, so they do not change the circularity score.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The ledger contains no invented entities. The design parameters d and B are derived from p and Q rather than fitted to data, so they are not listed as free parameters, but the optimality of the choice depends on the paper's cost model. The main load-bearing axioms are the fixed-base batch setting, the Θ(1) point addition and lookup cost model, the equality of scalar and field sizes up to constants, the recurrence-based precomputation cost, and standard Lambert W identities.

assumptions (5)
  • domain assumption The batch consists of Q scalar multiplications sharing the same fixed base point P and the same curve parameters.
    Section 3.2 states 'Given that the same scalar multiplication is repeatedly computed', and the Algorithm 3 input is scalars k1..kQ with a single base point P. This limits the applicability to fixed-base batch settings.
  • domain assumption Each elliptic curve point addition and table lookup has Θ(1) cost, and point doublings are not separately charged to the proposed method.
    Sections 3.2-3.5 compute time as Θ(d(B+Q)) counting only point additions. If doublings or memory access cost are charged, the comparison with baseline algorithms in Table 4 changes.
  • domain assumption The scalar size n is comparable to the field size p, so the base-B digit length is d = Θ(log p / log B).
    Section 3.3 imposes B^d ≥ n and subsequently substitutes p for n in the complexity expressions, assuming log n = Θ(log p).
  • domain assumption The precomputation table M can be filled using only the recurrence M[i][j] = M[i][j-1] + M[i][1] with M[i][1] = M[i-1][B], so precomputation costs Θ(dB) additions.
    Appendix B.3 and Section 3.2.2 invoke this recurrence to claim Θ(dB) precomputation cost; it assumes no extra cost for obtaining each row's base point.
  • standard math Standard Lambert W function identities, including exp(W(z)+1) = e·z/W(z) and W(z) = Θ(log z), are used to simplify the asymptotic expressions.
    Sections 3.4-3.5 rely on these identities to derive Θ(Q log p / log Q) time and Θ(Q log p / log^2 Q) space.

how reviews work

0 comments
Cite this review

Pith. "Pith review of M-ary Precomputation-Based Accelerated Scalar Multiplication Algorithms for Enhanced Elliptic Curve Cryptography." pith.science (2026). https://pith.science/paper/ME33N5MJ

@misc{pith2026250501845,
  author       = {Pith},
  title        = {Pith review of: M-ary Precomputation-Based Accelerated Scalar Multiplication Algorithms for Enhanced Elliptic Curve Cryptography},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ME33N5MJ}},
  note         = {Machine review of arXiv:2505.01845}
}
abstract

Efficient scalar multiplication is critical for enhancing the performance of elliptic curve cryptography (ECC), especially in applications requiring large-scale or real-time cryptographic operations. This paper proposes an M-ary precomputation-based scalar multiplication algorithm, aiming to optimize both computational efficiency and memory usage. The method reduces the time complexity from $\Theta(Q \log p)$ to $\Theta\left(\frac{Q \log p}{\log Q}\right)$ and achieves a memory complexity of $\Theta\left(\frac{Q \log p}{\log^2 Q}\right)$. Experiments on ElGamal encryption and NS3-based communication simulations validate its effectiveness. On secp256k1, the proposed method achieves up to a 59\% reduction in encryption time and 30\% memory savings. In network simulations, the binary-optimized variant reduces communication time by 22.1\% on secp384r1 and simulation time by 25.4\% on secp521r1. The results demonstrate the scalability, efficiency, and practical applicability of the proposed algorithm. The source code will be publicly released upon acceptance.

Figures

Figures reproduced from arXiv: 2505.01845 by the authors.

Figure 1
Figure 1. Steps for M-ary Precomputation-Based Algorithm, illustrating the process [PITH_FULL_IMAGE:figures/full_fig_p013_1.png] view at source ↗
Figure 2
Figure 2. Evaluation on the time consumed by various optimized algorithms for scalar [PITH_FULL_IMAGE:figures/full_fig_p023_2.png] view at source ↗
Figure 3
Figure 3. Evaluation on the proportion of time consumed by various optimized [PITH_FULL_IMAGE:figures/full_fig_p023_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Evaluation of the proportion of time consumed by ElGamal Encryption using [PITH_FULL_IMAGE:figures/full_fig_p024_4.png]
Figure 5
Figure 5. Figure 5: NS3 simulation communication model. Figure 5a demonstrates the overall network topology with point-to-point links and their associated communication metrics, such as transmission delays and data rates. Figure 5b illustrates the internal architecture of nodes in the NS3…
Figure 6
Figure 6. Figure 6: Performance Comparison of Scalar Multiplication Algorithms on Elliptic [PITH_FULL_IMAGE:figures/full_fig_p028_6.png]
Figure 7
Figure 7. Figure 7: Hardware Deployment Potentials of the proposed M-ary scalar multiplication [PITH_FULL_IMAGE:figures/full_fig_p031_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 43 canonical work pages

  1. [1]

    S. Das, S. Duan, S. Liu, A. Momose, L. Ren, V. Shoup, Asynchronous consensus without trusted setup or public-key cryptography, in: Pro- ceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 3242–3256

    work page 2024

  2. [2]

    Dolev, B

    S. Dolev, B. Guo, J. Niu, Z. Wang, Sodsbc: a post-quantum by design asynchronous blockchain framework, IEEE Transactions on Dependable and Secure Computing 21 (1) (2023) 47–62

    work page 2023

  3. [3]

    Bandarupalli, A

    A. Bandarupalli, A. Bhat, S. Bagchi, A. Kate, M. K. Reiter, Random beacons in monte carlo: Efficient asynchronous random beacon without threshold cryptography, in: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 2621– 2635. 41

    work page 2024

  4. [4]

    S. Duan, X. Wang, H. Zhang, Fin: Practical signature-free asynchronous common subset in constant time, in: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 815–829

    work page 2023

  5. [5]

    Z. Cao, L. Liu, The practical advantage of rsa over ecc and pairings, Cryptology ePrint Archive (2024)

    work page 2024

  6. [6]

    Dahiphale, H

    V. Dahiphale, H. Raut, G. Bansod, D. Dahiphale, Securing iot devices with fast and energy efficient implementation of pride and present ci- phers, Cyber Security and Applications 3 (2025) 100055

    work page 2025

  7. [7]

    Ullah, J

    S. Ullah, J. Zheng, N. Din, M. T. Hussain, F. Ullah, M. Yousaf, Ellip- tic curve cryptography; applications, challenges, recent advances, and future trends: A comprehensive survey, Computer Science Review 47 (2023) 100530

    work page 2023

  8. [8]

    Haddaji, L

    W. Haddaji, L. Ghammam, N. El Mrabet, L. B. Abdelghani, On com- puting the multidimensional scalar multiplication on elliptic curves, Cryptology ePrint Archive (2024)

    work page 2024

Show all 44 references
  1. [9]

    Kumar, H

    A. Kumar, H. Om, Design of a usim and ecc based handover authenti- cation scheme for 5g-wlan heterogeneous networks, Digital Communica- tions and Networks 6 (3) (2020) 341–353

    2020

  2. [10]

    S. Xie, S. Ma, M. Ding, Y. Shi, M. Tang, Y. Wu, Robust information bot- tleneck for task-oriented communication with digital modulation, IEEE Journal on Selected Areas in Communications 41 (8) (2023) 2577–2591

    2023

  3. [11]

    J. W. Bos, J. A. Halderman, N. Heninger, J. Moore, M. Naehrig, E. Wustrow, Elliptic curve cryptography in practice, in: Financial Cryp- tography and Data Security: 18th International Conference, FC 2014, Christ Church, Barbados, March 3-7, 2014, Revised Selected Papers 18, Spr...

    2014

  4. [12]

    Avanzi, C

    R. Avanzi, C. Heuberger, H. Prodinger, Redundant τ-adic expansions i: non-adjacent digit sets and their applications to scalar multiplication, Designs, Codes and Cryptography 58 (2011) 173–202

    2011

  5. [13]

    Zhang, Y

    W. Zhang, Y. Liu, M. Meng, J. Lv, J. Wang, Y. Liu, Data encryption transmission method of communication network based on rsa algorithm, 42 in: International Conference on Signal Processing and Communication Technology (SPCT 2022), Vol. 12615, SPIE, 2023, pp. 359–363

    2022

  6. [14]

    Rivain, Fast and regular algorithms for scalar multiplication over elliptic curves, Cryptology ePrint Archive (2011)

    M. Rivain, Fast and regular algorithms for scalar multiplication over elliptic curves, Cryptology ePrint Archive (2011)

    2011

  7. [15]

    W. Yang, C. Hou, Y. Wang, Z. Zhang, X. Wang, Y. Cao, Sakms: A secure authentication and key management scheme for ietf 6tisch indus- trial wireless networks based on improved elliptic-curve cryptography, IEEE Transactions on Network Science and Engineering (2024)

    2024

  8. [16]

    Ansari, M

    B. Ansari, M. A. Hasan, High-performance architecture of elliptic curve scalar multiplication, IEEE Transactions on Computers 57 (11) (2008) 1443–1453

    2008

  9. [17]

    N. A. Mohamed, M. H. Hashim, M. Hutter, Improved fixed-base comb method for fast scalar multiplication, in: International Conference on Cryptology in Africa, Springer, 2012, pp. 342–359

    2012

  10. [18]

    W. Yu, G. Xu, Pre-computation scheme of window τ naf for koblitz curves revisited, in: Annual International Conference on the Theory and Applications of Cryptographic Techniques, Springer, 2021, pp. 187–218

    2021

  11. [19]

    J. H. Cheon, W. Cho, J. Kim, D. Stehl´ e, Homomorphic multiple pre- cision multiplication for ckks and reduced modulus consumption, in: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 696–710

    2023

  12. [20]

    Narisada, H

    S. Narisada, H. Okada, K. Fukushima, S. Kiyomoto, T. Nishide, Gpu acceleration of high-precision homomorphic computation utilizing re- dundant representation, in: Proceedings of the 11th Workshop on En- crypted Computing & Applied Homomorphic Cryptography, 2023, pp. 1–9

    2023

  13. [21]

    Brier, M

    E. Brier, M. Joye, Weierstrass elliptic curves and side-channel attacks, in: International Workshop on Cryptographic Hardware and Embedded Systems, Springer, 2002, pp. 335–345

    2002

  14. [22]

    Z. Yan, D. Li, Performance analysis for resource constrained decentral- ized federated learning over wireless networks, IEEE Transactions on Communications (2024). 43

    2024

  15. [23]

    E. Illi, M. Qaraqe, S. Althunibat, A. Alhasanat, M. Alsafasfeh, M. de Ree, G. Mantas, J. Rodriguez, W. Aman, S. Al-Kuwari, Physi- cal layer security for authentication, confidentiality, and malicious node detection: a paradigm shift in securing iot networks, IEEE Communi- cati...

    2023

  16. [24]

    X. Fu, Q. Li, W. Li, Modeling and analysis of industrial iot reliability to cascade failures: An information-service coupling perspective, Relia- bility Engineering & System Safety 239 (2023) 109517

    2023

  17. [25]

    M. A. Al-Garadi, A. Mohamed, A. K. Al-Ali, X. Du, I. Ali, M. Guizani, A survey of machine and deep learning methods for internet of things (iot) security, IEEE communications surveys & tutorials 22 (3) (2020) 1646–1685

    2020

  18. [26]

    X. Fan, X. Deng, Y. Xia, L. Yi, L. T. Yang, C. Zhu, Tensor-based confident information coverage reliability of hybrid internet of things, IEEE Transactions on Mobile Computing 23 (3) (2023) 2171–2185

    2023

  19. [27]

    Patel, A

    C. Patel, A. K. Bashir, A. A. AlZubi, R. Jhaveri, Ebake-se: A novel ecc- based authenticated key exchange between industrial iot devices using secure element, Digital Communications and Networks 9 (2) (2023) 358– 366

    2023

  20. [28]

    Y. Cao, A. Chandrasekar, T. Radhika, V. Vijayakumar, Input-to-state stability of stochastic markovian jump genetic regulatory networks, Mathematics and Computers in Simulation 222 (2024) 174–187

    2024

  21. [29]

    Zeghid, H

    M. Zeghid, H. Y. Ahmed, A. Chehri, A. Sghaier, Speed/area-efficient ecc processor implementation over gf (2 m) on fpga via novel algorithm- architecture co-design, IEEE Transactions on Very Large Scale Integra- tion (VLSI) Systems 31 (8) (2023) 1192–1203

    2023

  22. [30]

    J. Ye, Z. Yang, An ecc with error detection and against side channel at- tacks for resource constrained devices, Journal of King Saud University- Computer and Information Sciences 36 (4) (2024) 102019

    2024

  23. [31]

    Sahasrabuddhe, D

    A. Sahasrabuddhe, D. S. Laiphrakpam, Multiple images encryption based on 3d scrambling and hyper-chaotic system, Information Sciences 550 (2021) 252–267. 44

    2021

  24. [32]

    J. Gao, M. Liu, P. Li, A. A. Laghari, A. R. Javed, N. Victor, T. R. Gadekallu, Deep incomplete multi-view clustering via information bot- tleneck for pattern mining of data in extreme-environment iot, IEEE Internet of Things Journal (2023)

    2023

  25. [33]

    Barbarossa, D

    S. Barbarossa, D. Comminiello, E. Grassucci, F. Pezone, S. Sardellitti, P. Di Lorenzo, Semantic communications based on adaptive generative models and information bottleneck, IEEE Communications Magazine 61 (11) (2023) 36–41

    2023

  26. [34]

    R. Huo, X. Cheng, C. Sun, T. Huang, A cluster-based data transmission strategy for blockchain network in the industrial internet of things, IEEE Transactions on Network and Service Management (2024)

    2024

  27. [35]

    Zhang, Z

    J. Zhang, Z. Chen, M. Ma, R. Jiang, H. Li, W. Wang, High-performance ecc scalar multiplication architecture based on comb method and low- latency window recoding algorithm, IEEE Transactions on Very Large Scale Integration (VLSI) Systems 32 (2) (2023) 382–395

    2023

  28. [36]

    A. M. Awaludin, H. T. Larasati, H. Kim, High-speed and unified ecc processor for generic weierstrass curves over gf (p) on fpga, Sensors 21 (4) (2021) 1451

    2021

  29. [37]

    D. F. Aranha, Y. El Housni, A. Guillevic, A survey of elliptic curves for proof systems, Designs, Codes and Cryptography 91 (11) (2023) 3333– 3378

    2023

  30. [38]

    Golovnev, S

    A. Golovnev, S. Guo, S. Peters, N. Stephens-Davidowitz, Revisiting time-space tradeoffs for function inversion, in: Annual International Cryptology Conference, Springer, 2023, pp. 453–481

    2023

  31. [39]

    Y. Sun, S. S. Chow, C. Chevalier, J. Wang, Elastic msm: A fast, elas- tic and modular preprocessing technique for multi-scalar multiplication algorithm on gpus, in: Proceedings of the 31st USENIX Security Sympo- sium (USENIX Security ’22), USENIX Association, 2022, pp. 153–170

    2022

  32. [40]

    P. C. Kocher, Timing attacks on implementations of diffie-hellman, rsa, dss, and other systems, in: Annual International Cryptology Conference, Springer, 1996, pp. 104–113. 45

    1996

  33. [41]

    Boneh, R

    D. Boneh, R. A. DeMillo, R. J. Lipton, On the importance of checking cryptographic protocols for faults, in: Annual International Conference on the Theory and Applications of Cryptographic Techniques, Springer, 1997, pp. 37–51

    1997

  34. [42]

    Xiong, W

    Q. Xiong, W. Ma, X. Shi, Y. Zhou, H. Jin, K. Huang, H. Wang, Z. Wang, gecc: A gpu-based high-throughput framework for elliptic curve cryp- tography, arXiv preprint arXiv:2501.03245 (2024)

    2024 arXiv

  35. [43]

    Marzouqi, M

    H. Marzouqi, M. Al-Qutayri, K. Salah, D. Schinianakis, T. Stouraitis, A high-speed fpga implementation of an rsd-based ecc processor, IEEE Transactions on very large scale integration (vlsi) systems 24 (1) (2015) 151–164

    2015

  36. [44]

    Jiang, J

    Y. Jiang, J. Zhang, A. Wang, Y. Hao, J. Wang, Z. Chen, L. Zhu, Low- latency and area-efficient elliptic curve point multiplication architectures over koblitz curves, IEEE Internet of Things Journal (2025). 46

    2025

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.