Optimal software-implemented Itoh–Tsujii inversion for \(\mathbb {F}_{2^{m}}\)

Field inversion in \(\mathbb {F}_{2^{m}}\) dominates the cost of modern software implementations of certain elliptic curve cryptographic operations, such as point encoding/hashing into elliptic curves (Brown et al. in: Submission to NIST, 2008; Brown in: IACR Cryptology ePrint Archive 2008:12, 2008; Aranha et al. in: Cryptology ePrint Archive, Report 2014/486, 2014) Itoh–Tsujii inversion using a polynomial basis and precomputed table-based multi-squaring has been demonstrated to be highly effective for software implementations (Taverne et al. in: CHES 2011, 2011; Oliveira et al. in: J Cryptogr Eng 4(1):3–17, 2014; Aranha et al. in: Cryptology ePrint Archive, Report 2014/486, 2014), but the performance and memory use depend critically on the choice of addition chain and multi-squaring tables, which in prior work have been determined only by suboptimal ad-hoc methods and manual selection. We thoroughly investigated the performance/memory tradeoff for table-based linear transforms used for efficient multi-squaring. Based upon the results of that investigation, we devised a comprehensive cost model for Itoh–Tsujii inversion and a corresponding optimization procedure that is empirically fast and provably finds globally-optimal solutions. We tested this method on eight binary fields commonly used for elliptic curve cryptography; our method found lower-cost solutions than the ad-hoc methods used previously, and for the first time enables a principled exploration of the time/memory tradeoff of inversion implementations.