Fast, twist-secure elliptic curve cryptography from Q-curves
|
|
- Noreen Griffith
- 5 years ago
- Views:
Transcription
1 Fast, twist-secure elliptic curve cryptography from Q-curves Benjamin Smith Team GRACE INRIA Saclay Île-de-France Laboratoire d Informatique de l École polytechnique (LIX) ECC #17, Leuven September 16, 2013 Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
2 Scalar multiplication General ECC situation: We have a cryptosystem based on a cyclic subgroup G E(F q ), #G = N prime #E(F q ) q. To implement the system: want to construct a curve E/F q with 1 a very strong group structure: prime/almost-prime order, 2 fast cryptographic operations:, [2], and [m], 3 fast finite field arithmetic: eg. q = 2 n e with tiny e We want all three of these improvements simultaneously......but in practice, the three properties are not orthogonal. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
3 Schnorr signatures: Key Generation algorithm System parameters G = P of prime order N, cryptographic hash function H : {0, 1} Z/NZ Output A public/private-key pair (Q, x) G Z/NZ 1 Set x := random(z/nz); // x is the private key 2 Set Q := [x]p; // Q is the public key 3 Return (Q, x). All of the hard work is in computing Q = [x]p. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
4 Schnorr signatures: Sign algorithm System parameters G = P of prime order N, cryptographic hash function H : {0, 1} Z/NZ Input A message m {0, 1} and a private key x Z/NZ. Output A Schnorr signature (s, e) (Z/NZ) 2. 1 Set k := random(z/nz); 2 Set R := [k]p; 3 Set e := H(m R); // is bitstring concatenation 4 Let s := k xe (mod N); 5 Return (s, e). All of the hard work is in computing R = [k]p. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
5 Generic binary exponentiation Input m [0..2 β ) and P G Output [m]p // β-bit m, gen. β = log 2 N 1 Compute binary representation m = β 1 i=0 m i2 i (with m i {0, 1}); // normally this is for free 2 Set R := 0 G ; 3 For i in β 1 down to 0, // β iterations 3a Set R := [2]R; 3b Set R := R [m i ]P; // [m i ]P = 0 or P 4 Return R. Optimizations/variations: windows, combs, NAF,... But the bigger the β, the longer it takes. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
6 Schnorr signatures: Verify algorithm System parameters G = P of prime order N, cryptographic hash function H : {0, 1} Z/NZ Input A signature (s, e) (Z/NZ) 2, a message m {0, 1}, and a public key Q G. Output True if (s, e) is a valid signature on the message m for the user with public key Q, otherwise False. 1 Let R := [s]p [e]q; //= R if s k xe (mod N) 2 Let e := H(m R ); 3 If e = e, then Return True; else Return False. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
7 Generic binary multiexponentiation Input (a, b) in [0..2 β ) 2, P, Q in G Output [a]p [b]q // eg. β = log 2 N 1 Compute binary reps a = β 1 i=0 a i2 i and b = β 1 i=0 b i2 i 2 Set T 0,0 := 0 G, T 1,0 := P, T 0,1 := Q, T 1,1 := P Q; 3 Set R := 0 G ; 4 For i = β 1 down to 0, // β iterations 4a Set R := [2]R; 4b Set R := R T ai,b i ; 5 Return R. #group ops same as plain exponentiation by max( a, b ). Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
8 Eigenvalues of endomorphisms In practice: G = Z/NZ is embedded in an ordinary elliptic curve E, which has a much richer structure than Z/NZ : End(G) = Z/NZ but End(E) Z[π], where π : (x, y) (x q, y q ) is Frobenius. If ψ End(E) restricts to an endomorphism of G (that is, ψ(g) G; this happens pretty much all the time): ψ(p) = [λ ψ ]P for all P G We call λ ψ the eigenvalue of ψ on G. Convention: N/2 < λ ψ < N/2. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
9 Scalar multiplication with an endomorphism Binary exponentiation: can compute [m]p with log 2 m doubles. If ψ has eigenvalue λ ψ on G and (a, b) satisfies m a + bλ ψ (mod N), then for any P in G we have [m]p = [a]p [b]ψ(p) and we can compute the RHS using multiexponentation. Multiexponentiation by (a, b) will beat exponentiation by m if ψ can be evaluated fast (time/space < a few doubles), and we can find a and b significantly shorter than m. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
10 Scalar multiplication with an endomorphism Lemma: If λ ψ > N 1/2, then we can quickly find a and b such that a + bλ ψ m (mod N) with log 2 max ( a, b ) 1 2 log 2 N + ɛ. (The constant ɛ is easily bounded; constant-length (a, b) are possible.) Great! Now all we need is a source of good E equipped with fast ψ but this turns out to be highly nontrivial. Note: integer multiplications and Frobenius do not make good ψ. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
11 GLV Curves (Gallant Lambert Vanstone, CRYPTO 2001) Start with an explicit CM curve over Q and reduce mod p. Example (CM by 1) Let p 1 (mod 4); let i be a square root of 1 in F p. Then the curves E a : y 2 = x 3 + ax have an explicit (and extremely efficient) endomorphism ψ : (x, y) ( x, iy). Short scalar decompositions: large eigenvalue λ ψ 1 (mod N). Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
12 Limitations of GLV The curves E a /F p : y 2 = x 3 + ax look perfect......but we are not always free to choose our own (fast) prime p! Example The 256-bit prime p = offers very fast field arithmetic. The F p -isomorphism classes of E a /F p are represented by a = 1, 2, 4, bits if a = bits if a = 2 Largest prime factor of #E a (F p ) = 175 bits if a = bits if a = 8 So we pay for fast arithmetic with at least 17 (/256) bits of group order, which is about 9 (/128) bits of security. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
13 Other GLV curves We can try other explicit CM curves... But there are hardly any of them! ψ fast generally implies deg ψ very small deg ψ small, ψ / Z = Z[ψ] has small discriminant curves with CM by discriminant have j-invariant classified by Hilbert polynomials H H has very small degree, typically 1 for tiny = only one j-invariant per Only 2, 4, or 6 twists (curves) per j-invariant = a handful of suitable curves, none of which might have (almost)-prime reduction mod p Only 18 GLV curves with endomorphisms faster than doubling. No guarantee any of them have good cryptographic group orders mod p. Curve rarity is a critical weakness of the GLV technique. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
14 GLS Curves (Galbraith Lin Scott, EUROCRYPT 2009) Start with any curve over F p, extend to F p 2, and use p-th powering on the quadratic twist. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
15 GLS Curves (Galbraith Lin Scott, EUROCRYPT 2009) Start with any curve over F p, extend to F p 2, and use p-th powering on the quadratic twist. Example Let p 5 (mod 8), take A, B, in F p, take µ in F p 2 with µ nonsquare: E/F p 2 : y 2 = x 3 + µ 2 Ax + µ 3 B has an efficient endomorphism ψ : (x, y) ( x p, iy p ) where i 2 = 1. p-th powering in F p 2 = F p ( D) almost free: (a 0 + a 1 D) p = a 0 a 1 D Good scalar decompositions: λ ψ 1 (mod N). Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
16 Twist security: the problem with GLS GLS offers p different j-invariants with an extremely fast endomorphism. Some of these j-invariants should give prime/secure order curves. Solves the secure curve choice problem for fixed p! Weak point: built-in twist-insecurity. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
17 Diffie Hellman key exchange An overly abstract point of view of Diffie Hellman: 1 A and B public fix a group G and a generator X 0 G. G can be a set, not a group 2 A and B choose secret multipliers s A, s B Z/(#G). scalars s A and s B an abelian semigroup acting on G. 3 A computes X A := [s A ]X 0 and makes it public; B computes X B := [s B ]X 0 and makes it public. 4 A and B compute the shared secret [s A s B ]X 0 = [s A ]X B = [s B ]X A. DHP in G (given X 0, [s A ]X 0, [s B ]X 0, find [s A s B ]X 0 ) should be hard. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
18 Dropping y-coordinates Implementing Diffie Hellman on E : y 2 = x 3 + Ax + B over F q : Working without y-coordinates saves time and a bit of space. We can compute [m] x(p) := x([m]p) in terms of x(p) (and A, B). Similarly, with an endomorphism ψ: Can compute (a + bψ) (x(p)) := x([a]p [b]ψ(p)) in terms of x(p). Algorithmically, no need for y-coordinates Solve x(q) = [s] x(p) = solve Q = [s]p on E Cryptographically, no need for y-coordinates The x-coordinate maps [m] and (a + bψ) work, compose, and commute for any input x, not just x(p) for P E(F q )! Garbage In = Garbage Out. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
19 Diffie Hellman / Montgomery Curve over F q : E : y 2 = x(x 2 + Ax + 1) Quadratic twist: E : By 2 = x(x 2 + Ax + B), where B is a nonsquare Every α in F q satisfies one of: (α, 0) E[2](F q ) and (α, 0) E [2](F q ) α = x(p) for some P E(F q ) \ E[2](F q ) α = x(p ) for some P E (F q ) \ E [2](F q ) Fault attack (Bernstein, Fouque Réal Lercier Vallette): Sneak in α = x(p E (F q )), then solve the DHP on the twist. = We need almost-prime order for both E and E. GLS curves: twists are (by construction) subfield curves. Largest prime factor in O(p), not O(p 2 ) = built-in weakness. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
20 Another look at GLS Consider a pair of Galois-conjugate curves over F p 2: E : y 2 = x 3 + Ax + B and (p) E : y 2 = x 3 + A p x + B p. We always have a p-th power Frobenius isogeny π 0 : (p) E E. If E is a GLS curve, then an isomorphism φ : E (p) E, and the GLS endomorphism is ψ := π 0 φ. But existence of an isomorphism = j(e) F p = twist-insecurity! Idea: Let s replace φ with a low degree separable isogeny. Easy source of pairs of separably isogenous Galois-conjugate curves: (mod p reductions of) quadratic Q-curves. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
21 Q-curves Definition: A quadratic Q-curve of degree d is an elliptic curve Ẽ : y 2 = x 3 + Ax + B over a quadratic field Q( ), without complex multiplication, with a d-isogeny φ : Ẽ σ Ẽ : y 2 = x 3 + σ(a)x + σ(b), where σ is conjugation on Q( ). Where do we find quadratic Q-curves of degree d? Look at the map X 0 (d) X (d) := X 0 (d)/ Atkin Lehners. Q-curves irrational preimages of points in X (d)(q). We want small d for efficiency, and X 0 (d) = P 1 for small d; = one-parameter families of Q-curves Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
22 Endomorphism recipe Preheat a fast prime p and a nice with ( /p) = 1. Choose a degree-d Q-curve /Q( ) with good reduction at p. = d-isogeny φ : Ẽ σ Ẽ over Q(, d). Reduce φ modulo p (which is inert in Q( ), since ( /p) = 1) = d-isogeny φ : E (p) E over F p ( ). Compose φ with p-powering isogeny π 0 : (p) E E = dp-endomorphism ψ := π 0 φ in End(E), and σ φ φ = [±d] (since Ẽ has no CM), so ψ 2 = [±d]π. Serve hot d small = ψ fast, with big eigenvalue ± ±d (mod N). Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
23 Hasegawa s universal quadratic Q-curve of degree 2 For any squarefree discriminant and any t in Q, define conjugate curves Ẽ t /Q( ) : y 2 = (x 4)(x 2 + 4x t ), σ Ẽ t /Q( ) : y 2 = (x 4)(x 2 + 4x 14 18t ). Good reduction at every prime p > 3 inert in Q( )! φ : (x, y) There exists a 2-isogeny φ : Ẽt σ Ẽ t, defined by ( ) y f (x), f (x) 2 where f (x) = x 2 9(1 + t ) x 4. Hasegawa: Every degree-2 Q-curve over Q( ) is = Ẽt for some t Q. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
24 A family of degree-2p endomorphisms Applying the recipe to the whole Hasegawa degree-2 family at once: Take any F p 2 = F p ( ). For every t F p, the curve E t /F p 2 : y 2 = x 3 6(5 3t )x + 8(7 9t ) has an efficient (faster than doubling) endomorphism ( ψ : (x, y) f (x p y p ) ), f (x p ) where f (x p ) = x p 2 2 9(1 t ) (x p 4). We have ψ 2 = [±2]π, so λ ψ = ± ±2 on cryptographic subgroups. Lots of choice: p ɛ different j-invariants in F p 2 (+ codomains) Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
25 Example Take F p 2 = F p (i) where p = (Mersenne prime) and i 2 = 1. After a quick search, we find the 254-bit curve E 9245 /F p 2 : y 2 = x 3 30(5 5547i)x + 8( i) Looking at the curve and its twist, we find E 9245 (F p 2) = Z/2Z Z/NZ and E 9245(F p 2) = Z/2Z Z/N Z, where N and N are 253-bit primes. On either curve, 253-bit scalar multiplications 127-bit multiexponentiations. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
26 Producing more curves and endomorphisms g(x 0 (d)) = 0 = family of degree-dp endomorphisms Applying the recipe: d = 1: degenerate case, recover twist-insecure GLS curves d = 3: construct prime-order twist-secure curves Hasegawa: one-parameter universal curve family d = 5: construct prime-order twist-prime-order curves Hasegawa = one-parameter family for fixed d = 7: More prime-order twist-prime-order curves Hasegawa: one-parameter universal curve family d 7: Even more curves... But slower and less interesting. Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
27 Go forth and scalar multiply 1-parameter families of elliptic curves over any F p 2 with efficient endomorphisms of degree 2p, 3p, 5p, 7p yielding half-length scalar decompositions. Ready to use: plenty of secure parameters. Details: ASIACRYPT 2013, Full version with d = 5 curves coming soon Work in progress (with Costello & Hisil): A fast, open, constant-time implementation Smith (INRIA/LIX) Fast, twist-secure ECC from Q-curves ECC Leuven, 16/09/ / 27
Non-generic attacks on elliptic curve DLPs
Non-generic attacks on elliptic curve DLPs Benjamin Smith Team GRACE INRIA Saclay Île-de-France Laboratoire d Informatique de l École polytechnique (LIX) ECC Summer School Leuven, September 13 2013 Smith
More informationExplicit Complex Multiplication
Explicit Complex Multiplication Benjamin Smith INRIA Saclay Île-de-France & Laboratoire d Informatique de l École polytechnique (LIX) Eindhoven, September 2008 Smith (INRIA & LIX) Explicit CM Eindhoven,
More informationFamilies of fast elliptic curves from Q-curves
Families of fast elliptic curves from Q-curves Benjamin Smith Team GRACE, INRIA Saclay Île-de-France and Laboratoire d Informatique de l École polytechnique (LIX) Bâtiment Alan Turing, 1 rue Honoré d Estienne
More informationAdvanced Constructions in Curve-based Cryptography
Advanced Constructions in Curve-based Cryptography Benjamin Smith Team GRACE INRIA and Laboratoire d Informatique de l École polytechnique (LIX) Summer school on real-world crypto and privacy Sibenik,
More informationFaster Compact DiffieHellman: Endomorphisms on the x-line
Faster Compact DiffieHellman: Endomorphisms on the x-line Craig Costello craigco@microsoft.com Microsoft Resesarch Redmond Seattle, USA Hüseyin Hışıl huseyin.hisil@yasar.edu.tr Computer Eng. Department
More informationMappings of elliptic curves
Mappings of elliptic curves Benjamin Smith INRIA Saclay Île-de-France & Laboratoire d Informatique de l École polytechnique (LIX) Eindhoven, September 2008 Smith (INRIA & LIX) Isogenies of Elliptic Curves
More informationFour-Dimensional GLV Scalar Multiplication
Four-Dimensional GLV Scalar Multiplication ASIACRYPT 2012 Beijing, China Patrick Longa Microsoft Research Francesco Sica Nazarbayev University Elliptic Curve Scalar Multiplication A (Weierstrass) elliptic
More informationYou could have invented Supersingular Isogeny Diffie-Hellman
You could have invented Supersingular Isogeny Diffie-Hellman Lorenz Panny Technische Universiteit Eindhoven Πλατανιάς, Κρήτη, 11 October 2017 1 / 22 Shor s algorithm 94 Shor s algorithm quantumly breaks
More informationElliptic curves: Theory and Applications. Day 4: The discrete logarithm problem.
Elliptic curves: Theory and Applications. Day 4: The discrete logarithm problem. Elisa Lorenzo García Université de Rennes 1 14-09-2017 Elisa Lorenzo García (Rennes 1) Elliptic Curves 4 14-09-2017 1 /
More informationCurves, Cryptography, and Primes of the Form x 2 + y 2 D
Curves, Cryptography, and Primes of the Form x + y D Juliana V. Belding Abstract An ongoing challenge in cryptography is to find groups in which the discrete log problem hard, or computationally infeasible.
More informationConstructing Abelian Varieties for Pairing-Based Cryptography
for Pairing-Based CWI and Universiteit Leiden, Netherlands Workshop on Pairings in Arithmetic Geometry and 4 May 2009 s MNT MNT Type s What is pairing-based cryptography? Pairing-based cryptography refers
More informationHigh-Performance Scalar Multiplication using 8-Dimensional GLV/GLS Decomposition
High-Performance Scalar Multiplication using 8-Dimensional GLV/GLS Decomposition Joppe W. Bos, Craig Costello, Huseyin Hisil, Kristin Lauter CHES 2013 Motivation - I Group DH ECDH (F p1, ) (E F p2, +)
More informationEfficient and Secure Algorithms for GLV-Based Scalar Multiplication and Their Implementation on GLV-GLS Curves
Efficient and Secure Algorithms for GLV-Based Scalar Multiplication and Their Implementation on GLV-GLS Curves SESSION ID: CRYP-T07 Patrick Longa Microsoft Research http://research.microsoft.com/en-us/people/plonga/
More informationMontgomery curves and their arithmetic
Montgomery curves and their arithmetic The case of large characteristic fields Craig Costello Benjamin Smith A survey in tribute to Peter L. Montgomery Abstract Three decades ago, Montgomery introduced
More informationOther Public-Key Cryptosystems
Other Public-Key Cryptosystems Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-11/
More informationClass invariants by the CRT method
Class invariants by the CRT method Andreas Enge Andrew V. Sutherland INRIA Bordeaux-Sud-Ouest Massachusetts Institute of Technology ANTS IX Andreas Enge and Andrew Sutherland Class invariants by the CRT
More informationGLV/GLS Decomposition, Power Analysis, and Attacks on ECDSA Signatures With Single-Bit Nonce Bias
GLV/GLS Decomposition, Power Analysis, and Attacks on ECDSA Signatures With Single-Bit Nonce Bias Diego F. Aranha Pierre-Alain Fouque Benoît Gerard Jean-Gabriel Kammerer Mehdi Tibouchi Jean-Christophe
More informationOne can use elliptic curves to factor integers, although probably not RSA moduli.
Elliptic Curves Elliptic curves are groups created by defining a binary operation (addition) on the points of the graph of certain polynomial equations in two variables. These groups have several properties
More informationIsogenies in a quantum world
Isogenies in a quantum world David Jao University of Waterloo September 19, 2011 Summary of main results A. Childs, D. Jao, and V. Soukharev, arxiv:1012.4019 For ordinary isogenous elliptic curves of equal
More informationAn introduction to supersingular isogeny-based cryptography
An introduction to supersingular isogeny-based cryptography Craig Costello Summer School on Real-World Crypto and Privacy June 8, 2017 Šibenik, Croatia Towards quantum-resistant cryptosystems from supersingular
More informationFast Cryptography in Genus 2
Fast Cryptography in Genus 2 Joppe W. Bos, Craig Costello, Huseyin Hisil and Kristin Lauter EUROCRYPT 2013 Athens, Greece May 27, 2013 Fast Cryptography in Genus 2 Recall that curves are much better than
More informationIntroduction to Elliptic Curve Cryptography. Anupam Datta
Introduction to Elliptic Curve Cryptography Anupam Datta 18-733 Elliptic Curve Cryptography Public Key Cryptosystem Duality between Elliptic Curve Cryptography and Discrete Log Based Cryptography Groups
More informationElGamal type signature schemes for n-dimensional vector spaces
ElGamal type signature schemes for n-dimensional vector spaces Iwan M. Duursma and Seung Kook Park Abstract We generalize the ElGamal signature scheme for cyclic groups to a signature scheme for n-dimensional
More informationAspects of Pairing Inversion
Applications of Aspects of ECC 2007 - Dublin Aspects of Applications of Applications of Aspects of Applications of Pairings Let G 1, G 2, G T be groups of prime order r. A pairing is a non-degenerate bilinear
More informationSM9 identity-based cryptographic algorithms Part 1: General
SM9 identity-based cryptographic algorithms Part 1: General Contents 1 Scope... 1 2 Terms and definitions... 1 2.1 identity... 1 2.2 master key... 1 2.3 key generation center (KGC)... 1 3 Symbols and abbreviations...
More informationPolynomial Interpolation in the Elliptic Curve Cryptosystem
Journal of Mathematics and Statistics 7 (4): 326-331, 2011 ISSN 1549-3644 2011 Science Publications Polynomial Interpolation in the Elliptic Curve Cryptosystem Liew Khang Jie and Hailiza Kamarulhaili School
More informationIntroduction to Elliptic Curve Cryptography
Indian Statistical Institute Kolkata May 19, 2017 ElGamal Public Key Cryptosystem, 1984 Key Generation: 1 Choose a suitable large prime p 2 Choose a generator g of the cyclic group IZ p 3 Choose a cyclic
More informationOn the complexity of computing discrete logarithms in the field F
On the complexity of computing discrete logarithms in the field F 3 6 509 Francisco Rodríguez-Henríquez CINVESTAV-IPN Joint work with: Gora Adj Alfred Menezes Thomaz Oliveira CINVESTAV-IPN University of
More informationExplicit isogenies and the Discrete Logarithm Problem in genus three
Explicit isogenies and the Discrete Logarithm Problem in genus three Benjamin Smith INRIA Saclay Île-de-France Laboratoire d informatique de l école polytechnique (LIX) EUROCRYPT 2008 : Istanbul, April
More informationSide-Channel Attacks on Quantum-Resistant Supersingular Isogeny Diffie-Hellman
Side-Channel Attacks on Quantum-Resistant Supersingular Isogeny Diffie-Hellman Presenter: Reza Azarderakhsh CEECS Department and I-Sense, Florida Atlantic University razarderakhsh@fau.edu Paper by: Brian
More informationElliptic curve cryptography in a post-quantum world: the mathematics of isogeny-based cryptography
Elliptic curve cryptography in a post-quantum world: the mathematics of isogeny-based cryptography Andrew Sutherland MIT Undergraduate Mathematics Association November 29, 2018 Creating a shared secret
More informationSelecting Elliptic Curves for Cryptography Real World Issues
Selecting Elliptic Curves for Cryptography Real World Issues Michael Naehrig Cryptography Research Group Microsoft Research UW Number Theory Seminar Seattle, 28 April 2015 Elliptic Curve Cryptography 1985:
More informationCounting points on elliptic curves over F q
Counting points on elliptic curves over F q Christiane Peters DIAMANT-Summer School on Elliptic and Hyperelliptic Curve Cryptography September 17, 2008 p.2 Motivation Given an elliptic curve E over a finite
More informationAsymmetric Pairings. Alfred Menezes (joint work with S. Chatterjee, D. Hankerson & E. Knapp)
Asymmetric Pairings Alfred Menezes (joint work with S. Chatterjee, D. Hankerson & E. Knapp) 1 Overview In their 2006 paper "Pairings for cryptographers", Galbraith, Paterson and Smart identified three
More informationHigh-Performance Scalar Multiplication using 8-Dimensional GLV/GLS Decomposition
High-Performance Scalar Multiplication using 8-Dimensional GLV/GLS Decomposition Joppe W. Bos 1, Craig Costello 1, Huseyin Hisil 2, and Kristin Lauter 1 1 Microsoft Research, Redmond, USA 2 Yasar University,
More informationDiscrete logarithm and related schemes
Discrete logarithm and related schemes Martin Stanek Department of Computer Science Comenius University stanek@dcs.fmph.uniba.sk Cryptology 1 (2017/18) Content Discrete logarithm problem examples, equivalent
More informationLoop-abort faults on supersingular isogeny cryptosystems
Loop-abort faults on supersingular isogeny cryptosystems Alexandre Gélin Benjamin Wesolowski Laboratoire d Informatique de Paris 6 Sorbonne Universités UPMC, France École Polytechnique Fédérale de Lausanne,
More informationPairings for Cryptography
Pairings for Cryptography Michael Naehrig Technische Universiteit Eindhoven Ñ ÐÖÝÔØÓ ºÓÖ Nijmegen, 11 December 2009 Pairings A pairing is a bilinear, non-degenerate map e : G 1 G 2 G 3, where (G 1, +),
More informationMathematical analysis of the computational complexity of integer sub-decomposition algorithm
Journal of Physics: Conference Series PAPER OPEN ACCESS Mathematical analysis of the computational complexity of integer sub-decomposition algorithm To cite this article: Ruma Kareem K Ajeena and Hailiza
More informationGenus 2 Curves of p-rank 1 via CM method
School of Mathematical Sciences University College Dublin Ireland and Claude Shannon Institute April 2009, GeoCrypt Joint work with Laura Hitt, Michael Naehrig, Marco Streng Introduction This talk is about
More informationScalar multiplication in compressed coordinates in the trace-zero subgroup
Scalar multiplication in compressed coordinates in the trace-zero subgroup Giulia Bianco and Elisa Gorla Institut de Mathématiques, Université de Neuchâtel Rue Emile-Argand 11, CH-2000 Neuchâtel, Switzerland
More informationEfficient Key Agreement and Signature Schemes Using Compact Representations in GF (p 10 )
Efficient Key Agreement and Signature Schemes Using Compact Representations in GF (p 10 ) Kenneth J. Giuliani 1 and Guang Gong 2 1 Dept. of Combinatorics and Optimization University of Waterloo Waterloo,
More informationFast point multiplication algorithms for binary elliptic curves with and without precomputation
Fast point multiplication algorithms for binary elliptic curves with and without precomputation Thomaz Oliveira 1 Diego F. Aranha 2 Julio López 2 Francisco Rodríguez-Henríquez 1 1 CINVESTAV-IPN, Mexico
More informationPublic-key Cryptography and elliptic curves
Public-key Cryptography and elliptic curves Dan Nichols University of Massachusetts Amherst nichols@math.umass.edu WINRS Research Symposium Brown University March 4, 2017 Cryptography basics Cryptography
More informationComputing the image of Galois
Computing the image of Galois Andrew V. Sutherland Massachusetts Institute of Technology October 9, 2014 Andrew Sutherland (MIT) Computing the image of Galois 1 of 25 Elliptic curves Let E be an elliptic
More informationConstructing Pairing-Friendly Elliptic Curves for Cryptography
Constructing Pairing-Friendly Elliptic Curves for Cryptography University of California, Berkeley, USA 2nd KIAS-KMS Summer Workshop on Cryptography Seoul, Korea 30 June 2007 Outline 1 Pairings in Cryptography
More informationLecture 1: Introduction to Public key cryptography
Lecture 1: Introduction to Public key cryptography Thomas Johansson T. Johansson (Lund University) 1 / 44 Key distribution Symmetric key cryptography: Alice and Bob share a common secret key. Some means
More informationCSC 774 Advanced Network Security
CSC 774 Advanced Network Security Topic 2.6 ID Based Cryptography #2 Slides by An Liu Outline Applications Elliptic Curve Group over real number and F p Weil Pairing BasicIdent FullIdent Extensions Escrow
More informationOther Public-Key Cryptosystems
Other Public-Key Cryptosystems Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: 10-1 Overview 1. How to exchange
More informationCSC 774 Advanced Network Security
CSC 774 Advanced Network Security Topic 2.6 ID Based Cryptography #2 Slides by An Liu Outline Applications Elliptic Curve Group over real number and F p Weil Pairing BasicIdent FullIdent Extensions Escrow
More informationCPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Instructor: Michael Fischer Lecture by Ewa Syta Lecture 13 March 3, 2013 CPSC 467b, Lecture 13 1/52 Elliptic Curves Basics Elliptic Curve Cryptography CPSC
More informationON ISOGENY GRAPHS OF SUPERSINGULAR ELLIPTIC CURVES OVER FINITE FIELDS
ON ISOGENY GRAPHS OF SUPERSINGULAR ELLIPTIC CURVES OVER FINITE FIELDS GORA ADJ, OMRAN AHMADI, AND ALFRED MENEZES Abstract. We study the isogeny graphs of supersingular elliptic curves over finite fields,
More informationElliptic Curve Cryptography
The State of the Art of Elliptic Curve Cryptography Ernst Kani Department of Mathematics and Statistics Queen s University Kingston, Ontario Elliptic Curve Cryptography 1 Outline 1. ECC: Advantages and
More informationMath/Mthe 418/818. Review Questions
Math/Mthe 418/818 Review Questions 1. Show that the number N of bit operations required to compute the product mn of two integers m, n > 1 satisfies N = O(log(m) log(n)). 2. Can φ(n) be computed in polynomial
More informationduring transmission safeguard information Cryptography: used to CRYPTOGRAPHY BACKGROUND OF THE MATHEMATICAL
THE MATHEMATICAL BACKGROUND OF CRYPTOGRAPHY Cryptography: used to safeguard information during transmission (e.g., credit card number for internet shopping) as opposed to Coding Theory: used to transmit
More informationPoints of High Order on Elliptic Curves ECDSA
! Independent thesis advanced level (degree of master (two years)) Points of High Order on Elliptic Curves ECDSA Author: Behnaz Kouchaki Barzi Supervisor: Per-Anders Svensson Examiner: Andrei Khrennikov
More informationA gentle introduction to isogeny-based cryptography
A gentle introduction to isogeny-based cryptography Craig Costello Tutorial at SPACE 2016 December 15, 2016 CRRao AIMSCS, Hyderabad, India Part 1: Motivation Part 2: Preliminaries Part 3: Brief SIDH sketch
More informationIsogeny graphs of abelian varieties and applications to the Discrete Logarithm Problem
Isogeny graphs of abelian varieties and applications to the Discrete Logarithm Problem Chloe Martindale 26th January, 2018 These notes are from a talk given in the Séminaire Géométrie et algèbre effectives
More informationFaster Point Multiplication on Elliptic Curves with Efficient Endomorphisms
Faster Point Multiplication on Elliptic Curves with Efficient Endomorphisms Robert P. Gallant 1, Robert J. Lambert 1, and Scott A. Vanstone 1,2 1 Certicom Research, Canada {rgallant,rlambert,svanstone}@certicom.com
More information8 Elliptic Curve Cryptography
8 Elliptic Curve Cryptography 8.1 Elliptic Curves over a Finite Field For the purposes of cryptography, we want to consider an elliptic curve defined over a finite field F p = Z/pZ for p a prime. Given
More informationModular Multiplication in GF (p k ) using Lagrange Representation
Modular Multiplication in GF (p k ) using Lagrange Representation Jean-Claude Bajard, Laurent Imbert, and Christophe Nègre Laboratoire d Informatique, de Robotique et de Microélectronique de Montpellier
More informationHONDA-TATE THEOREM FOR ELLIPTIC CURVES
HONDA-TATE THEOREM FOR ELLIPTIC CURVES MIHRAN PAPIKIAN 1. Introduction These are the notes from a reading seminar for graduate students that I organised at Penn State during the 2011-12 academic year.
More informationConstructing genus 2 curves over finite fields
Constructing genus 2 curves over finite fields Kirsten Eisenträger The Pennsylvania State University Fq12, Saratoga Springs July 15, 2015 1 / 34 Curves and cryptography RSA: most widely used public key
More informationAn improved compression technique for signatures based on learning with errors
An improved compression technique for signatures based on learning with errors Shi Bai and Steven D. Galbraith Department of Mathematics, University of Auckland. CT-RSA 2014 1 / 22 Outline Introduction
More informationSome Efficient Algorithms for the Final Exponentiation of η T Pairing
Some Efficient Algorithms for the Final Exponentiation of η T Pairing Masaaki Shirase 1, Tsuyoshi Takagi 1, and Eiji Okamoto 2 1 Future University-Hakodate, Japan 2 University of Tsukuba, Japan Abstract.
More informationNumber Theory: Applications. Number Theory Applications. Hash Functions II. Hash Functions III. Pseudorandom Numbers
Number Theory: Applications Number Theory Applications Computer Science & Engineering 235: Discrete Mathematics Christopher M. Bourke cbourke@cse.unl.edu Results from Number Theory have many applications
More informationArithmetic of split Kummer surfaces: Montgomery endomorphism of Edwards products
1 Arithmetic of split Kummer surfaces: Montgomery endomorphism of Edwards products David Kohel Institut de Mathématiques de Luminy International Workshop on Codes and Cryptography 2011 Qingdao, 2 June
More informationEdwards Curves and the ECM Factorisation Method
Edwards Curves and the ECM Factorisation Method Peter Birkner Eindhoven University of Technology CADO Workshop on Integer Factorization 7 October 2008 Joint work with Daniel J. Bernstein, Tanja Lange and
More informationFaster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves
Faster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves Junfeng Fan, Frederik Vercauteren and Ingrid Verbauwhede Katholieke Universiteit Leuven, COSIC May 18, 2009 1 Outline What is
More informationLecture 4 Chiu Yuen Koo Nikolai Yakovenko. 1 Summary. 2 Hybrid Encryption. CMSC 858K Advanced Topics in Cryptography February 5, 2004
CMSC 858K Advanced Topics in Cryptography February 5, 2004 Lecturer: Jonathan Katz Lecture 4 Scribe(s): Chiu Yuen Koo Nikolai Yakovenko Jeffrey Blank 1 Summary The focus of this lecture is efficient public-key
More informationFour-Dimensional Gallant-Lambert-Vanstone Scalar Multiplication
Four-Dimensional Gallant-Lambert-Vanstone Scalar Multiplication Patrick Longa and Francesco Sica 2 Microsoft Research, USA plonga@microsoft.com 2 Nazarbayev University, Kazakhstan francesco.sica@nu.edu.kz
More informationElliptic Curves Spring 2013 Lecture #12 03/19/2013
18.783 Elliptic Curves Spring 2013 Lecture #12 03/19/2013 We now consider our first practical application of elliptic curves: factoring integers. Before presenting the elliptic curve method (ECM) for factoring
More informationAn Introduction to Pairings in Cryptography
An Introduction to Pairings in Cryptography Craig Costello Information Security Institute Queensland University of Technology INN652 - Advanced Cryptology, October 2009 Outline 1 Introduction to Pairings
More informationSignatures and DLP-I. Tanja Lange Technische Universiteit Eindhoven
Signatures and DLP-I Tanja Lange Technische Universiteit Eindhoven How to compute ap Use binary representation of a to compute a(x; Y ) in blog 2 ac doublings and at most that many additions. E.g. a =
More informationCPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer 1 Lecture 13 October 16, 2017 (notes revised 10/23/17) 1 Derived from lecture notes by Ewa Syta. CPSC 467, Lecture 13 1/57 Elliptic Curves
More informationIntroduction to Elliptic Curves
IAS/Park City Mathematics Series Volume XX, XXXX Introduction to Elliptic Curves Alice Silverberg Introduction Why study elliptic curves? Solving equations is a classical problem with a long history. Starting
More informationUsing semidirect product of (semi)groups in public key cryptography
Using semidirect product of (semi)groups in public key cryptography Delaram Kahrobaei 1 and Vladimir Shpilrain 2 1 CUNY Graduate Center and City Tech, City University of New York dkahrobaei@gc.cuny.edu
More informationUsing semidirect product of (semi)groups in public key cryptography
Using semidirect product of (semi)groups in public key cryptography Delaram Kahrobaei City University of New York Graduate Center: PhD Program in Computer Science NYCCT: Mathematics Department University
More informationConnecting Legendre with Kummer and Edwards
Connecting Legendre with Kummer and Edwards Sabyasachi Karati icis Lab Department of Computer Science University of Calgary Canada e-mail: sabyasachi.karati@ucalgary.ca Palash Sarkar Applied Statistics
More informationIndividual Discrete Logarithm in GF(p k ) (last step of the Number Field Sieve algorithm)
Individual Discrete Logarithm in GF(p k ) (last step of the Number Field Sieve algorithm) Aurore Guillevic INRIA Saclay / GRACE Team École Polytechnique / LIX ECC 2015, Sept. 28th Aurore Guillevic (INRIA/LIX)
More informationKatherine Stange. ECC 2007, Dublin, Ireland
in in Department of Brown University http://www.math.brown.edu/~stange/ in ECC Computation of ECC 2007, Dublin, Ireland Outline in in ECC Computation of in ECC Computation of in Definition A integer sequence
More informationElliptic Curve Cryptography
Elliptic Curve Cryptography Elliptic Curves An elliptic curve is a cubic equation of the form: y + axy + by = x 3 + cx + dx + e where a, b, c, d and e are real numbers. A special addition operation is
More informationGeneration Methods of Elliptic Curves
Generation Methods of Elliptic Curves by Harald Baier and Johannes Buchmann August 27, 2002 An evaluation report for the Information-technology Promotion Agency, Japan Contents 1 Introduction 1 1.1 Preface.......................................
More informationBatch Verification of ECDSA Signatures AfricaCrypt 2012 Ifrane, Morocco
Batch Verification of ECDSA Signatures AfricaCrypt 2012 Ifrane, Morocco Department of Computer Science and Engineering Indian Institute of Technology Kharagpur, West Bengal, India. Outline Introduction
More informationPublic Key Algorithms
Public Key Algorithms Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-09/
More informationDigital Signatures. Saravanan Vijayakumaran Department of Electrical Engineering Indian Institute of Technology Bombay
Digital Signatures Saravanan Vijayakumaran sarva@ee.iitb.ac.in Department of Electrical Engineering Indian Institute of Technology Bombay July 24, 2018 1 / 29 Group Theory Recap Groups Definition A set
More informationAn introduction to the algorithmic of p-adic numbers
An introduction to the algorithmic of p-adic numbers David Lubicz 1 1 Universté de Rennes 1, Campus de Beaulieu, 35042 Rennes Cedex, France Outline Introduction 1 Introduction 2 3 4 5 6 7 8 When do we
More informationAte Pairing on Hyperelliptic Curves
Ate Pairing on Hyperelliptic Curves R. Granger, F. Hess, R. Oyono, N. Thériault F. Vercauteren EUROCRYPT 2007 - Barcelona Pairings Pairings Let G 1, G 2, G T be groups of prime order l. A pairing is a
More informationµkummer: efficient hyperelliptic signatures and key exchange on microcontrollers
µkummer: efficient hyperelliptic signatures and key exchange on microcontrollers Joost Renes 1 Peter Schwabe 1 Benjamin Smith 2 Lejla Batina 1 1 Digital Security Group, Radboud University, The Netherlands
More informationElliptic Curves Spring 2015 Lecture #23 05/05/2015
18.783 Elliptic Curves Spring 2015 Lecture #23 05/05/2015 23 Isogeny volcanoes We now want to shift our focus away from elliptic curves over C and consider elliptic curves E/k defined over any field k;
More informationParameterization of Edwards curves on the rational field Q with given torsion subgroups. Linh Tung Vo
Parameterization of Edwards curves on the rational field Q with given torsion subgroups Linh Tung Vo Email: vtlinh@bcy.gov.vn Abstract. This paper presents the basic concepts of the Edwards curves, twisted
More informationCRYPTANALYSIS OF ELGAMAL TYPE DIGITAL SIGNATURE SCHEMES USING INTEGER DECOMPOSITION
Trends in Mathematics Information Center for Mathematical Sciences Volume 8, Number 1, June, 2005, Pages 167 175 CRYPTANALYSIS OF ELGAMAL TYPE DIGITAL SIGNATURE SCHEMES USING INTEGER DECOMPOSITION IKKWON
More informationAn overview of the XTR public key system
An overview of the XTR public key system Arjen K. Lenstra 1, Eric R. Verheul 2 1 Citibank, N.A., and Technische Universiteit Eindhoven, 1 North Gate Road, Mendham, NJ 07945-3104, U.S.A., arjen.lenstra@citicorp.com
More informationPseudo-random Number Generation. Qiuliang Tang
Pseudo-random Number Generation Qiuliang Tang Random Numbers in Cryptography The keystream in the one-time pad The secret key in the DES encryption The prime numbers p, q in the RSA encryption The private
More informationPublic-key Cryptography and elliptic curves
Public-key Cryptography and elliptic curves Dan Nichols nichols@math.umass.edu University of Massachusetts Oct. 14, 2015 Cryptography basics Cryptography is the study of secure communications. Here are
More informationEfficient Implementation of Cryptographic pairings. Mike Scott Dublin City University
Efficient Implementation of Cryptographic pairings Mike Scott Dublin City University First Steps To do Pairing based Crypto we need two things Efficient algorithms Suitable elliptic curves We have got
More informationSecure Bilinear Diffie-Hellman Bits
Secure Bilinear Diffie-Hellman Bits Steven D. Galbraith 1, Herbie J. Hopkins 1, and Igor E. Shparlinski 2 1 Mathematics Department, Royal Holloway University of London Egham, Surrey, TW20 0EX, UK Steven.Galbraith@rhul.ac.uk,
More informationA quasi polynomial algorithm for discrete logarithm in small characteristic
CCA seminary January 10, 2014 A quasi polynomial algorithm for discrete logarithm in small characteristic Razvan Barbulescu 1 Pierrick Gaudry 2 Antoine Joux 3 Emmanuel Thomé 2 LIX, École Polytechnique
More informationCongruent number elliptic curves of high rank
Michaela Klopf, BSc Congruent number elliptic curves of high rank MASTER S THESIS to achieve the university degree of Diplom-Ingenieurin Master s degree programme: Mathematical Computer Science submitted
More information