ECC Key Material Generation with CryptoCore on DE1 SoC

This project explores ECC key material generation over a prime field GF(p) using the CryptoCore hardware accelerator on the DE1 SoC platform. The implementation focuses on the driver level integration of ECC related arithmetic operations and verifies the reported device results against SageMath reference calculations.

Goal pipeline:
  private scalar k from TRNG
    → Montgomery transformation
    → affine to Jacobian conversion
    → Point Doubling and Point Addition
    → Point Multiplication Q = kG
    → Jacobian to affine conversion
    → SageMath verification

A private key is a randomly generated scalar k. The public key is derived by multiplying a fixed generator point G by this scalar. The central operation is therefore scalar multiplication on an elliptic curve. For the selected curve family, this operation is built from repeated Point Doubling and conditional Point Addition.

Private key:
  k ∈ [1, n − 1]

Public key:
  Q = k · G

Double and Add idea:
  scan scalar bits
  double current point each step
  add G when the processed bit is 1

The project works with elliptic curves in short Weierstrass form and uses brainpoolP512r1 as the main 512 bit prime field curve. This makes the implementation relevant to standardized prime field ECC parameters while keeping the arithmetic structure compatible with the formulas used in the Explicit Formulas Database.

Short Weierstrass form:
  y² = x³ + ax + b

Selected curve family:
  brainpoolP512r1

Field:
  GF(p), where p is a large prime

Affine point operations require modular inversion, which is expensive in prime field arithmetic. Jacobian projective coordinates reduce the number of inversions by introducing a third coordinate Z. Most intermediate ECC arithmetic in the project is therefore represented in Jacobian coordinates before converting the final result back to affine form.

Affine point:
  (x, y)

Jacobian representation:
  x = X / Z²
  y = Y / Z³

Point in Jacobian form:
  (X : Y : Z)

The implementation is based on explicit Jacobian formulas for short Weierstrass curves. Point Addition combines two distinct points. Point Doubling computes 2P from a single point. These operations form the lower level building blocks for scalar multiplication and public key derivation.

Formula cost used in the report:
  Point Addition:  16M
  Point Doubling:   9M

M = field multiplication
S = field squaring

Montgomery domain arithmetic is used to reduce the cost of modular arithmetic. Instead of performing expensive division based modular reductions directly, values are transformed into a Montgomery representation, processed there, and transformed back at the end of the calculation.

Montgomery multiplication idea:
  MontMult(A, B, P) = A · B · R⁻¹ mod P

Typical flow:
  normal domain
    → Montgomery domain
    → arithmetic operations
    → back transformation

The implementation extends the Linux side access to the CryptoCore accelerator. The user space application communicates with the kernel driver, while the driver controls CryptoCore operations and maps intermediate values into the MWMAC RAM register structure. This is the embedded software core of the project.

Software and hardware path:
  user space application
    → header interface
    → kernel driver
    → CryptoCore command
    → MWMAC RAM registers
    → result read back to user space

The reported Point Addition, Point Doubling, and Point Multiplication outputs were compared against SageMath calculations. SageMath was used as a mathematical reference because it can model finite field elliptic curve operations directly and allows fast checking of expected values.

Verification loop:
  choose curve parameters
  run operation on CryptoCore driver
  run same operation in SageMath
  compare x and y coordinates
  report whether the device result matches

The report documents limitations that should stay visible on the project page. The code does not fully check point at infinity cases. The driver code also contains optimization issues due to the project deadline. Copy heavy helper paths can be cleaned up. Standalone Point Addition needs a revised register allocation if it should safely handle two independent input points in the final branch.

Remaining work:
  add point at infinity handling
  add point validation
  redesign standalone Point Addition register allocation
  reduce copy heavy driver code
  add side channel hardening
  extend automated test vectors