X2065: Lightweight Key Exchange for the Internet of Things
Georgios Fotiadis, Johann Großschädl, Peter Y. A. Ryan · 2024
The Internet is rapidly transitioning from a network of personal computers, laptops and mobile phones to a network that will soon connect 32 billion smart devices (or "things"), many of which are extremely constrained in terms of computational resources and energy supply (e.g., battery-powered wireless sensor nodes). This evolution has created a demand for lightweight implementations of cryptographic primitives to meet the specific requirements and resource-constraints of the so-called Internet of Things (IoT). In the present paper we introduce Curve2065, a new elliptic curve in Montgomery form for x-coordinate-only ECDH key exchange between devices equipped with an 8/16/32-bit microcontroller. As its name indicates, Curve2065 is based on the 206-bit prime field Fp given by p = 2206 - 5, a pseudo-Mersenne prime that enables fast modular arithmetic. Concretely, Curve2065 is defined by the equation EA: (A + 2)y2 = x3 + Ax2 + x where A = -(4/91681 + 2) and offers a security level of 102 bits. The curve parameter A was chosen so that EA is birationally-equivalent to an Edwards curve with a small parameter d to enable fast key-pair generation. Even though A is not small, the Montgomery ladder on Curve2065 is exactly as efficient as on Bernstein's Curve25519. We describe an implementation of Curve2065 for ECDH key exchange based on a "lightweight" (i.e., size-optimized) Fp -arithmetic library for the TI MSP430(X) family of 16-bit microcontrollers. Our simulation results show that a variable-base scalar multiplication using the Montgomery ladder on Curve2065 takes 7.22 · 106 clock cycles on an MSP430F1611 target, while a fixed-base scalar multiplication with eight precomputed points on an isogenous twisted Edwards curve can be executed in only 2.96 · 106 cycles.