Non-generic attacks on elliptic curve DLPs
|
|
- Prosper Ross Turner
- 5 years ago
- Views:
Transcription
1 Non-generic attacks on elliptic curve DLPs Benjamin Smith Team GRACE INRIA Saclay Île-de-France Laboratoire d Informatique de l École polytechnique (LIX) ECC Summer School Leuven, September Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
2 Motivation Motivation The cliché: Elliptic curve discrete logarithms are as hard as possible. Idealistically: elliptic curves are used as approximations of black-box cyclic abelian groups. But There s nothing black-box about a smooth plane cubic. Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
3 Motivation Parameter selection What parameters does E/F q have? Base field, q = p n. Exploit field structure? Isomorphism class, j(e)... Exploit the geometry? plus a choice of twist Attack the twist? Isogeny class, t = #E(F q ) (q + 1). Exploit order? What are the bad choices of q, t, j, N? Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
4 Equivalence classes Equivalence classes Generic DLP algorithms: looking for collisions in a search space. If we can divide points into equivalence classes with a fast comparison test: Shrink the search space = faster DLP. Equivalence classes of size c = DLP in O( N/c) For example: automorphism orbits would work... But the automorphism group is too small to gain much. Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
5 Subfield curves Equivalence classes Suppose E is a subfield curve: ie, E is defined over F p, but we use a prime-order subgroup of E(F q ) with q = p n, n > 1. Why would you do this anyway? Easier to work out the cardinality, and small coefficients (being in F p )) may speed up arithmetic... E(F p ) E(F q ) is a nontrivial subgroup, so N #E(F q )/#E(F p ). E/F p has a Frobenius endomorphism π : (x, y) (x p, y p ) So we can split #E(F q ) into equivalence classes: P Q P = π e (Q). Classes have size n = the DLP runs n times faster. Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
6 Equivalence classes So: If you re using an extension field, don t use a subfield curve. Q: Are other curves defined over extension fields ok? Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
7 Weil descent Weil descent Suppose E is defined over an extension field: E/F q n, n > 1. E is a one-dimensional object over a degree-n field. Think of the complex numbers: C is a line (one-dimensional) over a quadratic extension R( 1), but can also visualise it as R 2. In the same way: the one-dimensional vector space F q n is isomorphic to the n-dimensional vector space F n q. Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
8 Weil descent Weil descent / Restriction of scalars Weil descent is a direct tradeoff of dimension vs degree. The Weil restriction W of E is an n-dimensional algebraic group over F q (not F q n) whose F q -points correspond to F q n-points of E. The Weil restriction always exists, and doesn t weaken E in itself. But if we re lucky, we might be able to transform all (or part) of W into the Jacobian of a higher-genus curve, which we can attack using index calculus. Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
9 Weil descent Weil descent of an elliptic curve Let s try n = 3, with q = 2 e for some e and F q 3 = F q [θ]/(θ 3 + θ + 1). F q 3 = ψ 0 = 1, ψ 1 = θ 2, ψ 2 = θ 4 F q Any elliptic curve over F q 3 is = to one in the form E/F q 3 : y 2 + xy = x 3 + (b 0 ψ 0 + b 1 ψ 1 + b 2 ψ 2 ). Equations for Weil restriction W: substitute x = x 0 ψ 0 + x 1 ψ 1 + x 2 ψ 2, y = y 0 ψ 0 + y 1 ψ 1 + y 2 ψ 2, get 3 equations over F q by collecting coefficients of the ψ i. Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
10 Explicit Weil restriction Weil descent So: Weil restriction W of E : y 2 + xy = x 3 + (b 0 ψ 0 + b 1 ψ 1 + b 2 ψ 2 ) is defined in (x 0, x 1, x 2, y 0, y 1, y 2 )-space by the three equations x0 3 + x 0 2x2 + x0x x0y1 + x0y2 + x x1x x1y0 + x1y2 + x x2y0 + x2y1 x0 3 + x 0 2x1 + x0x x0y1 + x0y2 + x 1 2x2 + x1x x1y0 + x1y1 + x x2y0 + x2y2 + y y b2 + b0 x0 2x1 + x 0 2x2 + x0x x0x x0y0 + x0y2 + x x1y1 + x1y2 + x x2y0 + x2y1 + y y b2 + b1 To get a curve in W, intersect with (say) x 0 = u, x 1 = u, x 2 = u: C : ( y uy 0 = u 3 + b 0, y uy 1 = u 3 + b 1, y uy 2 = u 3 + b 2 ) Irreducible unless b 0 = b 1 = b 2 (so β F q ). Eliminate y 1, y 2, put v = y 0 : C : v 8 + u 7 v + u 12 + u 10 + u 9 + b 0 u 6 + b 2 2u 4 + b 4 1. It may not be obvious, but C is hyperelliptic of genus 3. Desingularize C C = explicit isogeny Φ : W Jac( C). Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
11 Weil descent Discrete logarithms on the Weil restriction Start with a DLP instance in E(F q 3) Q = (x Q, y Q ) = [m](x P, y P ) = [m]p Weil-restricting, we get a DLP instance in W(F q ): (x Q 0, x Q 1, x Q 2, y Q 0, y Q 1, y Q 2 ) = [m](x P 0, x P 1, x P 2, y P 0, y P 1, y P 2 ) ; map through Φ to get a DLP instance in Jac(C): [ 3 ] [ i=1 (uq i, v Q 3 ] i ) D 0 = m i=1 (up i, vi P ) D 0 Solve DLP instance using index calculus in Jac( C) in time Õ(q4/3 ) Beats Õ(q3/2 ) using generic methods in E(F q 3). Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
12 Weil descent Gaudry Hess Smart In more generality: Theorem (Gaudry Hess Smart, 2000) Let n 4 be fixed. Write q = 2 e. As e, we can solve the DLP in E(F q n) for a significant proportion of all elliptic curves E/F q n in time O(q 2+ɛ ). For comparison: generic attacks require time O(q n/2 ). Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
13 Reductions So: In practice, use F p or F p 2, or F 2 n (with n prime) Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
14 Pairings Using pairings to move DLPs Suppose E is an elliptic curve over F p such that E(F p ) contains a subgroup G of large prime order N. Let k be the embedding degree with respect to N and p so k is the smallest integer such that N divides p k 1. We have a pairing e : E[N] E[N] µ N F p k which we can use to move the DLP from G into F p k. If k is small enough, we can solve the DLP in F p k faster than we can solve it in G. Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
15 Pairings Menezes Okamoto Vanstone (MOV) Reduction Input A point P in E(F p ) of prime order N, and a point Q in P. Output An integer m such that Q = [m]p. 1 Compute the embedding degree k for N and p. 2 Compute a point S E(F p k ) such that e N (P, S) 1. Randomly chosen S succeeds with overwhelming probability. 3 Set z 1 = e N (P, S) and z 2 = e N (Q, S). 4 Compute an integer m such that z m 1 = z 2 in F p k, using index calculus (ie, solve the DLP in F p k ). 5 Return m. Index calculus in F p k is subexponential in k log p. The whole algorithm is subexponential if k is small (polynomial in log p). Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
16 Pairings Balasubramanian Koblitz Luckily, a low embedding degree basically never happens by accident. Theorem (Balasubramanian and Koblitz (1998)) Let (p, E) be a randomly chosen pair consisting of a B-bit prime p and an elliptic curve E/F p such that N = #E(F p ) is prime. The probability that N (p k 1) for some k (log p) 2 is less than c B9 log 2 B 2 B for some effectively computable constant c > 0. Noteworthy exceptions: pairing-friendly curves, including all supersingular elliptic curves. Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
17 Pairings So: Don t use pairing-friendly curves for ordinary DLP-based systems. Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
18 Mapping into the additive group Mapping into the additive group DLPs in the additive group are really fast: they re just (modular) division. When can we map an ECDLP instance into (F p, +)? If E(F p ) is cyclic of prime order N, then a homomorphism E(F p ) (F p, +) is only nontrivial if N = p. This can happen (p is certainly in the Hasse interval): we call these trace-1 curves anomalous curves. Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
19 Mapping into the additive group Homomorphisms into the additive group Suppose E is defined over F p, and that #E(F p ) = p. Several approaches to mapping E(F p ) into (F p, +) (Semaev, Smart, Araki Satoh, Rück...) We follow Semaev s approach: an additive version of the Tate pairing gives a homomorphism E(F p ) Ω 1 (E) = (F p, +). (recall that Ω 1 (E) = regular differentials on E). Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
20 Rück s approach Mapping into the additive group Suppose #E(F p ) = p. If P is in E(F p ) then [p]p = O E, so p((p) (O E )) = (f P ) for some f P in F p (E) (Miller function!) Serre: the differential df P /f P is regular at O E. Expand at O E with local parameter t = x y (t(o E) = 0 with mult. 1): df P f P = (a 0 + a 1 t + a 2 t 2 + )dt Product rule for differentials + Algebra of Miller functions = P f P a 0 is a homomorphism! Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
21 Mapping into the additive group Solving DLPs on anomalous curves To solve a DLP instance Q = [m]p on an anomalous curve E/F p : 1 Compute a 0 (P) and a 0 (Q) using Miller loops Don t compute f P, f Q : build up the a 0 values using a double-and-add loop 2 Then m a 0 (Q)/a 0 (P) (mod p). The number of E(F p )-operations is linear in log p. This reduction is easy to implement! Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
22 Mapping into the additive group So: NEVER use anomalous curves. Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
23 Attacking the twist Diffie Hellman key exchange 1 A and B public fix a group G and a generator X 0 G. 2 A and B choose secret multipliers s A, s B Z/(#G). 3 A computes X A := [s A ]X 0 and makes it public; B computes X B := [s B ]X 0 and makes it public. 4 A and B compute the shared secret [s A s B ]X 0 = [s A ]X B = [s B ]X A. G can be a set, not a group; scalars s A and s B an abelian semigroup acting on G. Need a hard DHP (given X 0, [s A ]X 0, [s B ]X 0, find [s A s B ]X 0 ) Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
24 Attacking the twist Diffie Hellman / Montgomery Consider the curve E : y 2 = x(x 2 + Ax + 1) over F p. x([ 1]P) = x(p) for all P in E(F q ) Can compute [m] x(p) = x([m]p) in terms of x(p) and A: no need for y-coordinates This is a good move for Diffie Hellman implementations save a lot of time, and a bit of space Something funny: The x-coordinate maps [m] work (and compose properly) for any input x, not just x(p) for P E(F p )! In this case: Garbage In Garbage Out... Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
25 Attacking the twist Diffie Hellman / Montgomery The curve: E : y 2 = x(x 2 + Ax + 1) over F p. Quadratic twist: E : By 2 = x(x 2 + Ax + 1), where B is a nonsquare in F p. Every α in F p satisfies one of: 1 (α, 0) E[2](F p ) and (α, 0) E [2](F p ) 2 α = x(p) for some P E(F p ) \ E[2](F p ) 3 α = x(p ) for some P E (F p ) \ E [2](F p ) = #E(F p ) + #E (F p ) = 2(p + 1). Even if E has a strong group order, E can be weak Fouque Réal Lercier Vallette attack: sneak in α = x(p ), where P is a point on the quadratic twist, then solve the DHP on the twist instead. Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
26 Attacking the twist So: Avoid curves with insecure twists. Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
27 Isogenies Extending attacks with isogenies If E/F p is weak and E E is a computable F p -isogeny, then E should be weak, too. Anomalous curves Isogeny invariant: no gain. The entire isogeny class t = 1 is already weak. Pairing-friendly curves Isogeny invariant: no gain. Pairing-friendliness is a function of the group order and the field, not curve geometry Twist security Isogeny invariant: no gain. Weil descent Amenability is not isogeny-invariant. Starting from a strong curve and exploring its isogeny graph, we may land on a weak curve. (Galbraith Hess Smart) Subfield curves Not isogeny invariant. Avoid isogeny classes corresponding to subfield-curve traces. Smith (INRIA/LIX) Non-generic ECDLP Leuven, 11/09/ / 27
Fast, twist-secure elliptic curve cryptography from Q-curves
Fast, twist-secure elliptic curve cryptography from Q-curves Benjamin Smith Team GRACE INRIA Saclay Île-de-France Laboratoire d Informatique de l École polytechnique (LIX) ECC #17, Leuven September 16,
More informationDiscrete Logarithm Computation in Hyperelliptic Function Fields
Discrete Logarithm Computation in Hyperelliptic Function Fields Michael J. Jacobson, Jr. jacobs@cpsc.ucalgary.ca UNCG Summer School in Computational Number Theory 2016: Function Fields Mike Jacobson (University
More informationMappings of elliptic curves
Mappings of elliptic curves Benjamin Smith INRIA Saclay Île-de-France & Laboratoire d Informatique de l École polytechnique (LIX) Eindhoven, September 2008 Smith (INRIA & LIX) Isogenies of Elliptic Curves
More informationExplicit Complex Multiplication
Explicit Complex Multiplication Benjamin Smith INRIA Saclay Île-de-France & Laboratoire d Informatique de l École polytechnique (LIX) Eindhoven, September 2008 Smith (INRIA & LIX) Explicit CM Eindhoven,
More informationExplicit isogenies and the Discrete Logarithm Problem in genus three
Explicit isogenies and the Discrete Logarithm Problem in genus three Benjamin Smith INRIA Saclay Île-de-France Laboratoire d informatique de l école polytechnique (LIX) EUROCRYPT 2008 : Istanbul, April
More informationConstructing Abelian Varieties for Pairing-Based Cryptography
for Pairing-Based CWI and Universiteit Leiden, Netherlands Workshop on Pairings in Arithmetic Geometry and 4 May 2009 s MNT MNT Type s What is pairing-based cryptography? Pairing-based cryptography refers
More informationHyperelliptic curves
1/40 Hyperelliptic curves Pierrick Gaudry Caramel LORIA CNRS, Université de Lorraine, Inria ECC Summer School 2013, Leuven 2/40 Plan What? Why? Group law: the Jacobian Cardinalities, torsion Hyperelliptic
More informationElliptic curves: Theory and Applications. Day 4: The discrete logarithm problem.
Elliptic curves: Theory and Applications. Day 4: The discrete logarithm problem. Elisa Lorenzo García Université de Rennes 1 14-09-2017 Elisa Lorenzo García (Rennes 1) Elliptic Curves 4 14-09-2017 1 /
More informationElliptic Curve Cryptography
The State of the Art of Elliptic Curve Cryptography Ernst Kani Department of Mathematics and Statistics Queen s University Kingston, Ontario Elliptic Curve Cryptography 1 Outline 1. ECC: Advantages and
More informationSEMINAR SECURITY - REPORT ELLIPTIC CURVE CRYPTOGRAPHY
SEMINAR SECURITY - REPORT ELLIPTIC CURVE CRYPTOGRAPHY OFER M. SHIR, THE HEBREW UNIVERSITY OF JERUSALEM, ISRAEL FLORIAN HÖNIG, JOHANNES KEPLER UNIVERSITY LINZ, AUSTRIA ABSTRACT. The area of elliptic curves
More informationSM9 identity-based cryptographic algorithms Part 1: General
SM9 identity-based cryptographic algorithms Part 1: General Contents 1 Scope... 1 2 Terms and definitions... 1 2.1 identity... 1 2.2 master key... 1 2.3 key generation center (KGC)... 1 3 Symbols and abbreviations...
More informationDefinition of a finite group
Elliptic curves Definition of a finite group (G, * ) is a finite group if: 1. G is a finite set. 2. For each a and b in G, also a * b is in G. 3. There is an e in G such that for all a in G, a * e= e *
More informationOn the complexity of computing discrete logarithms in the field F
On the complexity of computing discrete logarithms in the field F 3 6 509 Francisco Rodríguez-Henríquez CINVESTAV-IPN Joint work with: Gora Adj Alfred Menezes Thomaz Oliveira CINVESTAV-IPN University of
More informationL-Polynomials of Curves over Finite Fields
School of Mathematical Sciences University College Dublin Ireland July 2015 12th Finite Fields and their Applications Conference Introduction This talk is about when the L-polynomial of one curve divides
More informationConstructing Pairing-Friendly Elliptic Curves for Cryptography
Constructing Pairing-Friendly Elliptic Curves for Cryptography University of California, Berkeley, USA 2nd KIAS-KMS Summer Workshop on Cryptography Seoul, Korea 30 June 2007 Outline 1 Pairings in Cryptography
More informationAdvanced Constructions in Curve-based Cryptography
Advanced Constructions in Curve-based Cryptography Benjamin Smith Team GRACE INRIA and Laboratoire d Informatique de l École polytechnique (LIX) Summer school on real-world crypto and privacy Sibenik,
More informationCover and Decomposition Index Calculus on Elliptic Curves made practical
Cover and Decomposition Index Calculus on Elliptic Curves made practical Application to a previously unreachable curve over F p 6 Vanessa VITSE Antoine JOUX Université de Versailles Saint-Quentin, Laboratoire
More informationIsogenies in a quantum world
Isogenies in a quantum world David Jao University of Waterloo September 19, 2011 Summary of main results A. Childs, D. Jao, and V. Soukharev, arxiv:1012.4019 For ordinary isogenous elliptic curves of equal
More informationProblème du logarithme discret sur courbes elliptiques
Problème du logarithme discret sur courbes elliptiques Vanessa VITSE Université de Versailles Saint-Quentin, Laboratoire PRISM Groupe de travail équipe ARITH LIRMM Vanessa VITSE (UVSQ) DLP over elliptic
More informationNo.6 Selection of Secure HC of g = divisors D 1, D 2 defined on J(C; F q n) over F q n, to determine the integer m such that D 2 = md 1 (if such
Vol.17 No.6 J. Comput. Sci. & Technol. Nov. 2002 Selection of Secure Hyperelliptic Curves of g = 2 Based on a Subfield ZHANG Fangguo ( ) 1, ZHANG Futai ( Ξ) 1;2 and WANG Yumin(Π±Λ) 1 1 P.O.Box 119 Key
More informationHigh-Performance Scalar Multiplication using 8-Dimensional GLV/GLS Decomposition
High-Performance Scalar Multiplication using 8-Dimensional GLV/GLS Decomposition Joppe W. Bos, Craig Costello, Huseyin Hisil, Kristin Lauter CHES 2013 Motivation - I Group DH ECDH (F p1, ) (E F p2, +)
More informationCounting points on elliptic curves over F q
Counting points on elliptic curves over F q Christiane Peters DIAMANT-Summer School on Elliptic and Hyperelliptic Curve Cryptography September 17, 2008 p.2 Motivation Given an elliptic curve E over a finite
More informationSolving Discrete Logarithms on a 170-bit MNT Curve by Pairing Reduction
Solving Discrete Logarithms on a 170-bit MNT Curve by Pairing Reduction Aurore Guillevic and François Morain and Emmanuel Thomé University of Calgary, PIMS CNRS, LIX École Polytechnique, Inria, Loria SAC,
More informationPairings for Cryptographers
Pairings for Cryptographers Craig Costello t-craigc@microsoft.com talk based on disjoint work (not mine) by: Steven Galbraith, Kenny Paterson, Nigel Smart August 15, 2012 1 /22 Pairing groups A pairing
More informationIsogeny graphs of abelian varieties and applications to the Discrete Logarithm Problem
Isogeny graphs of abelian varieties and applications to the Discrete Logarithm Problem Chloe Martindale 26th January, 2018 These notes are from a talk given in the Séminaire Géométrie et algèbre effectives
More informationIntroduction to Elliptic Curve Cryptography. Anupam Datta
Introduction to Elliptic Curve Cryptography Anupam Datta 18-733 Elliptic Curve Cryptography Public Key Cryptosystem Duality between Elliptic Curve Cryptography and Discrete Log Based Cryptography Groups
More informationOn Partial Lifting and the Elliptic Curve Discrete Logarithm Problem
On Partial Lifting and the Elliptic Curve Discrete Logarithm Problem Qi Cheng 1 and Ming-Deh Huang 2 1 School of Computer Science The University of Oklahoma Norman, OK 73019, USA. Email: qcheng@cs.ou.edu.
More informationPairing-Friendly Elliptic Curves of Prime Order
Pairing-Friendly Elliptic Curves of Prime Order Paulo S. L. M. Barreto 1 Michael Naehrig 2 1 University of São Paulo pbarreto@larc.usp.br 2 RWTH Aachen University mnaehrig@ti.rwth-aachen.de SAC 2005 Outline
More informationElliptic Curve Discrete Logarithm Problem
Elliptic Curve Discrete Logarithm Problem Vanessa VITSE Université de Versailles Saint-Quentin, Laboratoire PRISM October 19, 2009 Vanessa VITSE (UVSQ) Elliptic Curve Discrete Logarithm Problem October
More informationAspects of Pairing Inversion
Applications of Aspects of ECC 2007 - Dublin Aspects of Applications of Applications of Aspects of Applications of Pairings Let G 1, G 2, G T be groups of prime order r. A pairing is a non-degenerate bilinear
More informationFinite Fields and Elliptic Curves in Cryptography
Finite Fields and Elliptic Curves in Cryptography Frederik Vercauteren - Katholieke Universiteit Leuven - COmputer Security and Industrial Cryptography 1 Overview Public-key vs. symmetric cryptosystem
More informationIndividual Discrete Logarithm in GF(p k ) (last step of the Number Field Sieve algorithm)
Individual Discrete Logarithm in GF(p k ) (last step of the Number Field Sieve algorithm) Aurore Guillevic INRIA Saclay / GRACE Team École Polytechnique / LIX ECC 2015, Sept. 28th Aurore Guillevic (INRIA/LIX)
More informationA gentle introduction to isogeny-based cryptography
A gentle introduction to isogeny-based cryptography Craig Costello Tutorial at SPACE 2016 December 15, 2016 CRRao AIMSCS, Hyderabad, India Part 1: Motivation Part 2: Preliminaries Part 3: Brief SIDH sketch
More informationA gentle introduction to elliptic curve cryptography
A gentle introduction to elliptic curve cryptography Craig Costello Summer School on Real-World Crypto and Privacy June 5, 2017 Šibenik, Croatia Part 1: Motivation Part 2: Elliptic Curves Part 3: Elliptic
More informationKatherine Stange. ECC 2007, Dublin, Ireland
in in Department of Brown University http://www.math.brown.edu/~stange/ in ECC Computation of ECC 2007, Dublin, Ireland Outline in in ECC Computation of in ECC Computation of in Definition A integer sequence
More informationCPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Instructor: Michael Fischer Lecture by Ewa Syta Lecture 13 March 3, 2013 CPSC 467b, Lecture 13 1/52 Elliptic Curves Basics Elliptic Curve Cryptography CPSC
More informationCPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer 1 Lecture 13 October 16, 2017 (notes revised 10/23/17) 1 Derived from lecture notes by Ewa Syta. CPSC 467, Lecture 13 1/57 Elliptic Curves
More informationElGamal type signature schemes for n-dimensional vector spaces
ElGamal type signature schemes for n-dimensional vector spaces Iwan M. Duursma and Seung Kook Park Abstract We generalize the ElGamal signature scheme for cyclic groups to a signature scheme for n-dimensional
More informationComputing the endomorphism ring of an ordinary elliptic curve
Computing the endomorphism ring of an ordinary elliptic curve Massachusetts Institute of Technology April 3, 2009 joint work with Gaetan Bisson http://arxiv.org/abs/0902.4670 Elliptic curves An elliptic
More information8 Elliptic Curve Cryptography
8 Elliptic Curve Cryptography 8.1 Elliptic Curves over a Finite Field For the purposes of cryptography, we want to consider an elliptic curve defined over a finite field F p = Z/pZ for p a prime. Given
More informationAte Pairing on Hyperelliptic Curves
Ate Pairing on Hyperelliptic Curves R. Granger, F. Hess, R. Oyono, N. Thériault F. Vercauteren EUROCRYPT 2007 - Barcelona Pairings Pairings Let G 1, G 2, G T be groups of prime order l. A pairing is a
More informationWEIL DESCENT ATTACKS
WEIL DESCENT ATTACKS F. HESS Abstract. This article is to appear as a chapter in Advances in Elliptic Curve Cryptography, edited by I. Blake, G. Seroussi and N. Smart, Cambridge University Press, 2004.
More informationA brief overwiev of pairings
Bordeaux November 22, 2016 A brief overwiev of pairings Razvan Barbulescu CNRS and IMJ-PRG R. Barbulescu Overview pairings 0 / 37 Plan of the lecture Pairings Pairing-friendly curves Progress of NFS attacks
More informationAn introduction to supersingular isogeny-based cryptography
An introduction to supersingular isogeny-based cryptography Craig Costello Summer School on Real-World Crypto and Privacy June 8, 2017 Šibenik, Croatia Towards quantum-resistant cryptosystems from supersingular
More informationSelecting Elliptic Curves for Cryptography Real World Issues
Selecting Elliptic Curves for Cryptography Real World Issues Michael Naehrig Cryptography Research Group Microsoft Research UW Number Theory Seminar Seattle, 28 April 2015 Elliptic Curve Cryptography 1985:
More information190 R. Harasawa, J. Shikata, J. Suzuki, and H. Imai generally requires an exponential time in log q to solve it (V. Miller [15], and J. Silverman and
Comparing the MOV and FR Reductions in Elliptic Curve Cryptography Ryuichi Harasawa 1, Junji Shikata 1, Joe Suzuki 1, and Hideki Imai 2 1 Department of Mathematics, Graduate School of Science, Osaka University,
More informationPublic-key Cryptography and elliptic curves
Public-key Cryptography and elliptic curves Dan Nichols University of Massachusetts Amherst nichols@math.umass.edu WINRS Research Symposium Brown University March 4, 2017 Cryptography basics Cryptography
More informationComparing the MOV and FR Reductions in Elliptic Curve Cryptography
Comparing the MOV and FR Reductions in Elliptic Curve Cryptography Ryuichi Harasawa 1, Junji Shikata 1, Joe Suzuki 1, and Hideki Imai 2 1 Department of Mathematics, Graduate School of Science, Osaka University,
More information14 Ordinary and supersingular elliptic curves
18.783 Elliptic Curves Spring 2015 Lecture #14 03/31/2015 14 Ordinary and supersingular elliptic curves Let E/k be an elliptic curve over a field of positive characteristic p. In Lecture 7 we proved that
More informationAsymmetric Pairings. Alfred Menezes (joint work with S. Chatterjee, D. Hankerson & E. Knapp)
Asymmetric Pairings Alfred Menezes (joint work with S. Chatterjee, D. Hankerson & E. Knapp) 1 Overview In their 2006 paper "Pairings for cryptographers", Galbraith, Paterson and Smart identified three
More informationComputing the image of Galois
Computing the image of Galois Andrew V. Sutherland Massachusetts Institute of Technology October 9, 2014 Andrew Sutherland (MIT) Computing the image of Galois 1 of 25 Elliptic curves Let E be an elliptic
More informationScalar multiplication in compressed coordinates in the trace-zero subgroup
Scalar multiplication in compressed coordinates in the trace-zero subgroup Giulia Bianco and Elisa Gorla Institut de Mathématiques, Université de Neuchâtel Rue Emile-Argand 11, CH-2000 Neuchâtel, Switzerland
More informationFaster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves
Faster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves Junfeng Fan, Frederik Vercauteren and Ingrid Verbauwhede Katholieke Universiteit Leuven, COSIC May 18, 2009 1 Outline What is
More informationExtending the GHS Weil Descent Attack
Extending the GHS Weil Descent Attac S. D. Galbraith 1, F. Hess 2 and N. P. Smart 2 1 Mathematics Department, Royal Holloway University of London, Egham, Surrey TW20 0EX, United Kingdom. 2 Department of
More informationA Note on Scalar Multiplication Using Division Polynomials
1 A Note on Scalar Multiplication Using Division Polynomials Binglong Chen, Chuangqiang Hu and Chang-An Zhao Abstract Scalar multiplication is the most important and expensive operation in elliptic curve
More informationIntroduction to ECC. Nigel Smart. January 17, Nigel Smart Introduction to ECC Slide 1
Introduction to ECC nigel@cs.bris.ac.uk January 17, 2013 Introduction to ECC Slide 1 Why the need for Elliptic Curves? Introduction to ECC Slide 2 Discrete logarithm problem example Let p = 10535462803950169753046165829339587319488718149259
More informationOptimal curves of genus 1, 2 and 3
Optimal curves of genus 1, 2 and 3 Christophe Ritzenthaler Institut de Mathématiques de Luminy, CNRS Leuven, 17-21 May 2010 Christophe Ritzenthaler (IML) Optimal curves of genus 1, 2 and 3 Leuven, 17-21
More informationIntroduction to Elliptic Curves
IAS/Park City Mathematics Series Volume XX, XXXX Introduction to Elliptic Curves Alice Silverberg Introduction Why study elliptic curves? Solving equations is a classical problem with a long history. Starting
More informationConstructing genus 2 curves over finite fields
Constructing genus 2 curves over finite fields Kirsten Eisenträger The Pennsylvania State University Fq12, Saratoga Springs July 15, 2015 1 / 34 Curves and cryptography RSA: most widely used public key
More informationIdentifying supersingular elliptic curves
Identifying supersingular elliptic curves Andrew V. Sutherland Massachusetts Institute of Technology January 6, 2012 http://arxiv.org/abs/1107.1140 Andrew V. Sutherland (MIT) Identifying supersingular
More informationYou could have invented Supersingular Isogeny Diffie-Hellman
You could have invented Supersingular Isogeny Diffie-Hellman Lorenz Panny Technische Universiteit Eindhoven Πλατανιάς, Κρήτη, 11 October 2017 1 / 22 Shor s algorithm 94 Shor s algorithm quantumly breaks
More informationGeneration Methods of Elliptic Curves
Generation Methods of Elliptic Curves by Harald Baier and Johannes Buchmann August 27, 2002 An evaluation report for the Information-technology Promotion Agency, Japan Contents 1 Introduction 1 1.1 Preface.......................................
More informationElliptic Curve Cryptography with Derive
Elliptic Curve Cryptography with Derive Johann Wiesenbauer Vienna University of Technology DES-TIME-2006, Dresden General remarks on Elliptic curves Elliptic curces can be described as nonsingular algebraic
More informationDiscrete Logarithm Problem
Discrete Logarithm Problem Çetin Kaya Koç koc@cs.ucsb.edu (http://cs.ucsb.edu/~koc/ecc) Elliptic Curve Cryptography lect08 discrete log 1 / 46 Exponentiation and Logarithms in a General Group In a multiplicative
More informationIntroduction to Elliptic Curve Cryptography
Indian Statistical Institute Kolkata May 19, 2017 ElGamal Public Key Cryptosystem, 1984 Key Generation: 1 Choose a suitable large prime p 2 Choose a generator g of the cyclic group IZ p 3 Choose a cyclic
More informationThe Discrete Logarithm Problem on the p-torsion Subgroup of Elliptic Curves
The Discrete Logarithm Problem on the p-torsion Subgroup of Elliptic Curves Juliana V. Belding May 4, 2007 The discrete logarithm problem on elliptic curves Consider a finite group G of prime order N.
More informationCurves, Cryptography, and Primes of the Form x 2 + y 2 D
Curves, Cryptography, and Primes of the Form x + y D Juliana V. Belding Abstract An ongoing challenge in cryptography is to find groups in which the discrete log problem hard, or computationally infeasible.
More informationHigh-Performance Scalar Multiplication using 8-Dimensional GLV/GLS Decomposition
High-Performance Scalar Multiplication using 8-Dimensional GLV/GLS Decomposition Joppe W. Bos 1, Craig Costello 1, Huseyin Hisil 2, and Kristin Lauter 1 1 Microsoft Research, Redmond, USA 2 Yasar University,
More informationHyperelliptic Curve Cryptography
Hyperelliptic Curve Cryptography A SHORT INTRODUCTION Definition (HEC over K): Curve with equation y 2 + h x y = f x with h, f K X Genus g deg h(x) g, deg f x = 2g + 1 f monic Nonsingular 2 Nonsingularity
More informationof elliptic curves dened over F 2 155, the probability of nding one where the GHS attac is applicable is negligible. In this paper we extend the GHS a
Extending the GHS Weil Descent Attac No Author Given No Institute Given Abstract. In this paper we extend the Weil descent attac due to Gaudry, Hess and Smart (GHS) to a much larger class of elliptic curves.
More informationPoint counting and real multiplication on K3 surfaces
Point counting and real multiplication on K3 surfaces Andreas-Stephan Elsenhans Universität Paderborn September 2016 Joint work with J. Jahnel. A.-S. Elsenhans (Universität Paderborn) K3 surfaces September
More informationSolving Elliptic Curve Discrete Logarithm Problems Using Weil Descent
Solving Elliptic Curve Discrete Logarithm Problems Using Weil Descent Michael Jacobson University of Manitoba jacobs@cs.umanitoba.ca Alfred Menezes Certicom Research & University of Waterloo ajmeneze@uwaterloo.ca
More informationECC mod 8^91+5. especially elliptic curve 2y^2=x^3+x for cryptography Andrew Allen and Dan Brown, BlackBerry CFRG, Prague, 2017 July 18
ECC mod 8^91+5 especially elliptic curve 2y^2=x^3+x for cryptography Andrew Allen and Dan Brown, BlackBerry CFRG, Prague, 2017 July 18 2y 2 =x 3 +x/gf(8 91 +5) Simplest secure and fast ECC? Benefits of
More informationCOMPRESSION FOR TRACE ZERO SUBGROUPS OF ELLIPTIC CURVES
COMPRESSION FOR TRACE ZERO SUBGROUPS OF ELLIPTIC CURVES A. SILVERBERG Abstract. We give details of a compression/decompression algorithm for points in trace zero subgroups of elliptic curves over F q r,
More informationElliptic Curves Spring 2013 Lecture #12 03/19/2013
18.783 Elliptic Curves Spring 2013 Lecture #12 03/19/2013 We now consider our first practical application of elliptic curves: factoring integers. Before presenting the elliptic curve method (ECM) for factoring
More informationElliptic and Hyperelliptic Curve Cryptography
Elliptic and Hyperelliptic Curve Cryptography Renate Scheidler Research supported in part by NSERC of Canada Comprehensive Source Handbook of Elliptic and Hyperelliptic Curve Cryptography Overview Motivation
More informationFaster Compact DiffieHellman: Endomorphisms on the x-line
Faster Compact DiffieHellman: Endomorphisms on the x-line Craig Costello craigco@microsoft.com Microsoft Resesarch Redmond Seattle, USA Hüseyin Hışıl huseyin.hisil@yasar.edu.tr Computer Eng. Department
More informationElliptic Curve Cryptosystems
Elliptic Curve Cryptosystems Santiago Paiva santiago.paiva@mail.mcgill.ca McGill University April 25th, 2013 Abstract The application of elliptic curves in the field of cryptography has significantly improved
More informationElliptic Curves I. The first three sections introduce and explain the properties of elliptic curves.
Elliptic Curves I 1.0 Introduction The first three sections introduce and explain the properties of elliptic curves. A background understanding of abstract algebra is required, much of which can be found
More informationOptimal TNFS-secure pairings on elliptic curves with even embedding degree
Optimal TNFS-secure pairings on elliptic curves with even embedding degree Georgios Fotiadis 1 and Chloe Martindale 2 1 University of the Aegean, Greece gfotiadis@aegean.gr 2 Technische Universiteit Eindhoven,
More informationELLIPTIC CURVES OVER FINITE FIELDS
Further ELLIPTIC CURVES OVER FINITE FIELDS FRANCESCO PAPPALARDI #4 - THE GROUP STRUCTURE SEPTEMBER 7 TH 2015 SEAMS School 2015 Number Theory and Applications in Cryptography and Coding Theory University
More informationPublic-key Cryptography: Theory and Practice
Public-key Cryptography Theory and Practice Department of Computer Science and Engineering Indian Institute of Technology Kharagpur Chapter 2: Mathematical Concepts Divisibility Congruence Quadratic Residues
More informationIgusa Class Polynomials
Genus 2 day, Intercity Number Theory Seminar Utrecht, April 18th 2008 Overview Igusa class polynomials are the genus 2 analogue of the classical Hilbert class polynomial. For each notion, I will 1. tell
More informationCyclic Groups in Cryptography
Cyclic Groups in Cryptography p. 1/6 Cyclic Groups in Cryptography Palash Sarkar Indian Statistical Institute Cyclic Groups in Cryptography p. 2/6 Structure of Presentation Exponentiation in General Cyclic
More informationFaster Point Multiplication on Elliptic Curves with Efficient Endomorphisms
Faster Point Multiplication on Elliptic Curves with Efficient Endomorphisms Robert P. Gallant 1, Robert J. Lambert 1, and Scott A. Vanstone 1,2 1 Certicom Research, Canada {rgallant,rlambert,svanstone}@certicom.com
More informationWeil pairing. Algant: Regensburg and Leiden Elliptic curves and Weil conjectures seminar, Regensburg. Wednesday 22 nd June, 2016.
Weil pairing Jana Sotáková Algant: Regensburg and Leiden Elliptic curves and Weil conjectures seminar, Regensburg Wednesday 22 nd June, 2016 Abstract In this talk we are mainly invested in constructing
More informationABHELSINKI UNIVERSITY OF TECHNOLOGY
Identity-Based Cryptography T-79.5502 Advanced Course in Cryptology Billy Brumley billy.brumley at hut.fi Helsinki University of Technology Identity-Based Cryptography 1/24 Outline Classical ID-Based Crypto;
More informationConstructing Families of Pairing-Friendly Elliptic Curves
Constructing Families of Pairing-Friendly Elliptic Curves David Freeman Information Theory Research HP Laboratories Palo Alto HPL-2005-155 August 24, 2005* cryptography, pairings, elliptic curves, embedding
More informationON THE ASYMPTOTIC EFFECTIVENESS OF WEIL DESCENT ATTACKS
ON THE ASYMPTOTIC EFFECTIVENESS OF WEIL DESCENT ATTACKS KORAY KARABINA, ALFRED MENEZES, CARL POMERANCE, AND IGOR E. SHPARLINSKI Abstract. In this paper we investigate the asymptotic effectiveness of the
More informationClass invariants by the CRT method
Class invariants by the CRT method Andreas Enge Andrew V. Sutherland INRIA Bordeaux-Sud-Ouest Massachusetts Institute of Technology ANTS IX Andreas Enge and Andrew Sutherland Class invariants by the CRT
More informationFINITE GROUPS AND EQUATIONS OVER FINITE FIELDS A PROBLEM SET FOR ARIZONA WINTER SCHOOL 2016
FINITE GROUPS AND EQUATIONS OVER FINITE FIELDS A PROBLEM SET FOR ARIZONA WINTER SCHOOL 2016 PREPARED BY SHABNAM AKHTARI Introduction and Notations The problems in Part I are related to Andrew Sutherland
More informationOptimised versions of the Ate and Twisted Ate Pairings
Optimised versions of the Ate and Twisted Ate Pairings Seiichi Matsuda 1, Naoki Kanayama 1, Florian Hess 2, and Eiji Okamoto 1 1 University of Tsukuba, Japan 2 Technische Universität Berlin, Germany Abstract.
More informationPairings for Cryptography
Pairings for Cryptography Michael Naehrig Technische Universiteit Eindhoven Ñ ÐÖÝÔØÓ ºÓÖ Nijmegen, 11 December 2009 Pairings A pairing is a bilinear, non-degenerate map e : G 1 G 2 G 3, where (G 1, +),
More informationThe Application of the Mordell-Weil Group to Cryptographic Systems
The Application of the Mordell-Weil Group to Cryptographic Systems by André Weimerskirch A Thesis Submitted to the Faculty of the WORCESTER POLYTECHNIC INSTITUTE In partial fulfillment of the requirements
More informationCounting points on elliptic curves: Hasse s theorem and recent developments
Counting points on elliptic curves: Hasse s theorem and recent developments Igor Tolkov June 3, 009 Abstract We introduce the the elliptic curve and the problem of counting the number of points on the
More informationHyperelliptic-curve cryptography. D. J. Bernstein University of Illinois at Chicago
Hyperelliptic-curve cryptography D. J. Bernstein University of Illinois at Chicago Thanks to: NSF DMS 0140542 NSF ITR 0716498 Alfred P. Sloan Foundation Two parts to this talk: 1. Elliptic curves; modern
More informationAn Introduction to Elliptic Curve Cryptography
Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term 2013 1/22 An Introduction to Elliptic Curve Cryptography Harald Baier Hochschule Darmstadt, CASED, da/sec Summer term 2013 Harald
More informationIntroduction to Arithmetic Geometry
Introduction to Arithmetic Geometry 18.782 Andrew V. Sutherland September 5, 2013 What is arithmetic geometry? Arithmetic geometry applies the techniques of algebraic geometry to problems in number theory
More informationGenus 2 Curves of p-rank 1 via CM method
School of Mathematical Sciences University College Dublin Ireland and Claude Shannon Institute April 2009, GeoCrypt Joint work with Laura Hitt, Michael Naehrig, Marco Streng Introduction This talk is about
More information