6. ELLIPTIC CURVE CRYPTOGRAPHY (ECC)

Transcription

1 6. ELLIPTIC CURVE CRYPTOGRAPHY (ECC) 6.0 Introduction Elliptic curve cryptography (ECC) is the application of elliptic curve in the field of cryptography.basically a form of PKC which applies over the finite fields and the algebraic structure which first introduced by neal koblitx and Miller in the mid 80s over the elliptic curve. A very large number of integer factorisation algorithms make use of the elliptic curves and are being used in a number of cryptography related applications. Usually there will be basically two keys in the case of public key cryptography one used as the public key and another as private key which will be operated upon so many cryptographic manipulations. [32] Out of the two keys available the people who are authorised and who are really intended to get the private keys will be given in secret whereas the public key will be available with all who take part in the communication. All the systems that are part of the communications will be given certain predefined constants as they need it to do the processing in certain public key algorithms. Even thought the public key never demands that it need the secret keys to be transmitted to the parties involved in the communications its performance is not upto the one we get from private key one. To define and apply the elliptic curve in the cryptography field one need to take the mathematical operations to prove the algorithm scientifically. The equation that depicts the EC is y square is equal to x3 + ax + b, in which 4a3 + 27b2 is not equal to zero..here we can see that as the value of a and b changed the various forms of elliptic curves will come out. Every The coordinates x and y which all agree the above is taken along with a point which lies in the infinity also taken. The reason for taking the coordinates and the point at infinity is that one that lies in the curve is taken as the public key and the one that is in the infinity and taken randomly

2 is the private key. Here too the public key is being protected by multiplying the random point G from the curve and the secret key.the domain parameters that are concerned here are the values of random point, the values of the variables in the equation and some other constants that come in the equation. The minimum size of the key and high level of security is the main plus point in the case of ECC, that is one can get achieve the security that a key size 10 time bigger in the case of RSA can be achieved in the case of elliptic curve cryptography at the ease. Point multiplication is the vital function that is happening in the case of the ECC algorithm is concerned. That is a constant value which is of scalar nature is taken and multiplied with a known point on the curve to retrieve another point that is taken as the key. [8] 6.1 Point multiplication Here in this function a point is selected and fixed as R on the elliptic curve and one constant value c which is of scalar nature is taken and multiplied with the aid of elliptic curve equation and another point S is calculated out of this function. That is cr=s. Second function involved in Elliptic curve cryptography is Point addition where two points U and V are taken and W that is another point over the elliptic curve is calculated. i.e., W = U + V. The final function that is done in elliptic curve cryptography algorithm is Point doubling where a particular point D is taken and is added to the same point to retrieve another point E. i.e. E = 2D.

3 So in the elliptic curve all the above three comes in making the algorithm functional. So even while doing th e multiplication the addition and double comes in it so its also called as for multiplication its double and add method. Some other methods like Npon adjacent form and windowed Non adjacent form also taken in point multiplication function[15] 6.2 Point addition When two points J and K are taken in the elliptic curve and then added up to retrieve new point l over the same curve. 6.3 Geometry based explanation: Let us take L1 = L, J1 = J an d K1 = K Fig 6.3(a)

4 Now to analyse the figure let us take J and k two points over the elliptic curve figure (a). If K - J then we can see the elliptic curve is being interceted by a point at one more point called L when we draw a line through j and k.the point of addition L is found out in such a way that while intersecting the points j and k over the curve the point L is obtained and its reflection is L.Thus we can prove in the figure that j and k added will give L. Now if the value of K is equal to negative J so we can see that the line that are drawn along these points will pass through the curve at a point that will be at infinity and is taken as O which is depicted in the curve and thus the identity of addition is obtained over the curve as point O. The x axis acts as a base where the reflection of the point will be of ve. Analytical explanation Let J1 and K1 be two points considered so that J1 = (X J1, Y J1 ) and K1 = (X K1, Y K1 ) Consider L1 = J1 + K1 so that L1 = (X L1, Y L1 ), Then we can see X L1 = S 2 - X J1 X K1 and Y L1 = -Y J1 + S (X J1 X L1 ) S = (Y J1 Y K1 ) / (X J1 X K1 ), The line through J1 and K1 is taken as s. Now K1 = -J1 i.e. K1 = (X J1, -Y J1 ) so J1 + K1 = O. O represents point at infinity. Again if K1 = J1 therefore J1 + K1 = 2J1 here the equations that are of point doubling type are used. Again we can see that J1 + K1 = K1 + J1 6.4 Point doubling Point doubling refers to adding a point to itself like adding a point J1 to itself on the which yields another point L that lies on the same curve.[97]

5 6.5 Geometrical explanation: Let us take L1 = L and J1 = J

6 Fig 6.5(a) To find the value of L1 double the point J1, that is to calculate the value of L1 which is equal to 2J1, take a point J1 on an elliptic curve as depicted in figure(a). in case the point J1 s y coordinate is not zero then the line that is tangent at J1 will be passing through the elliptic curve at one more point L1. In reference to x-axis the reflection of the point L1 gives the point L1, which is obtained by doubling the point J1. Then we get L1 = 2J1. In the point J1 s y coordinate is zero then the tangent through the point touches the line at O which is in infinity. Hence 2J1 = O if Y J1 = 0. This is depicted through figure (b). Analytical explanation Now let us take a point J1 so that J1 = (X J1, Y J1 ), and Y J1 not equal to zero Suppose L1 = 2J1 so that L1 = (X L1, Y L1 ), Then

7 X L1 is equal to S 2 2X J1 Y L1 is equal to -Y J1 + S(X J1 - X L1 ) S = (3X J1 2 + a) / (2Y J1 ) where we can see that S is the tangent at point J1 and a represents a factors taken with the elliptic curve If the value of Y J1 is equal to 0 then 2J1 will be equal to O, so that O represents point at infinity. 6.6 Finite Fields The elliptic curve functions explained above are numbers that are real in nature. Calculations that involve the numbers that are real in nature are relatively slow and they will be inaccurate also since there are rounded errors. But functions in cryptography need to be much faster, accurate and error free. To achieve this that is to increase the speed, to achieve accuracy and efficiency in elliptic curve they are explained with the help of 2 finite fields F p, Prime field and F 2 m, Binary field The selection of the field with huge number of finite points that is apt for functions and calculations in cryptography. Here also the coordinate system is the general one that is commonly used in which vector(x, y) is used to represent all the points in the coordinate system.[64] 6.7 Elliptic Curve on Prime field (Fp)

8 The equation of the EC over a field that is prime in nature Fp is represented by y square mod p is equal to x 3 + a1x + b1 mod p in which 4a b1 2 mod p is not equal to zero. Here the elements of the finite field are integers between 0 and p 1. The operations such as addition, subtraction, division, multiplication involves integers between 0 and p 1.The prime number p is chosen in such a way that there is finitely large number of points on the elliptic curve in order to make the cryptosystem secure. SEC mentions curves with p ranging between bits. The graph is not a smooth curve one for the above elliptic curve equation. So the geometrical aspects of point addition and doubling related to numbers that are real in nature cannot work here. The rules related to algebra mainly over the point manipulations can be taken for EC over F p. Point Addition Let us take two distinct points J1 and K1 so that J1 = (X J1, Y J1 ) and K1 = (X K1, Y K1 ) Now let L1 = J1 + K1 so that L1 = (X L1, Y L1 ), then X L1 = L1 2 - X J1 X K1 mod P Y L1 = -Y J1 + S (X J1 X L1 ) mod P S = (Y J1 Y K1 )/(X J1 X K1 ) mod P, S represents the slope and passes through J1 and K1. If K1 = -J1 i.e. K1 = (X J1, -Y J1 mod p) then J1 + K1 = O. O lies at infinity. If K1 = J1 then J1 + K1 = 2J1 in that case we use point doubling equations. Also J1 + K1 = K1 + J1

9 Point Subtraction Now let us take two distinct points J1 and K1 such that J1 = (X J1, Y J1 ) and K1 = (X K1, Y K1 ) Then J1 K1 = J1 + (-K1) where K1 = (X k1, -Y k1 mod p) Point subtraction is applied in some implementation of point multiplication as in NAF. Point Doubling Now let us take a point J1 such that J1 = (X J1, Y J1 ), where Y J1 not equal to 0 Let L1 = 2J1 where L1 = (X L1, Y L1 ), Then X L1 is equal to S 2 2X J1 mod P Y L1 is equal to -Y J1 + S(X J1 -X L1 ) mod P S = (3X J1 2 + a) / (2Y J1 ) mod P, S is the tangent at point J1 and a is one of the parameters Suppose Y J1 is equal to 0 then 2J1 is equal to O, so that O is the point at infinity.[104] 6.8 Elliptic Curves on Binary field F2m The equation of the EC over a field which is binary in nature F2m is Y1 2 + X1Y1 is equal to X1 3 + ax1 2 + b in which the value of b is not equal to zero. The elements are integer in nature of the finite field and of maximum m bits long. Here the numbers are generally taken as a polynomial of (m 1) degree and should be a binary one. In polynomial only 0 or 1 can be the coefficients as it is a binary one. Polynomials of degree m 1 or lesser are being involved in all the basic arithmetic.. The value of m is selected so that many points of finite nature do exits on

10 the EC and the main idea of doing is to secure the system. Secure EC defines graphs having m that ranges from one thirteen to five seventy one bits. The graph so obtained will be a rough one when this equation is followed. So as in real numbers the geometrical explanation of point addition and doubling won t be effective here. But rules related to the algebra for point addition and doubling has to be applied for EC with F2m Point Addition Now let us take two separate clear points J1 and K1 such that J1 = (X J1, Y J1 ) and K1 = (X K1, Y K1 ) Let L1 be equal to J1 + K1 in which L1 = (X L1, Y L1 ), then X L1 is equal to S2 + S + X J1 + X K1 + a Y L1 is equal to S (X J1 + X L1 ) + X L1 + Y J1 S is equal to (Y J1 + Y K1 )/(X J1 + X K1 where s represents the slope of the line joining J1 and K1. If K1 is equal to -J1 that is the value of K1 = (X J1, X J1 + Y J1 ) then J1 + K1 is equal to O. where O is the point somewhere at infinity. [15] If K1 = J1 then J1 + K1 = 2J1 then point doubling equations are used. Therefore J1 + K1 = K1 + J1 Point Subtraction Now Let us consider two distinct points J1 and K1 such that J1 = (X J1, Y J1 ) and K1 = (X K1, Y K1 )

11 Then J1 K1 = J1 + (-K1) where K1 = (X k1, X k1 + Y k1 ) In Point multiplication too we will have to apply subtraction. Point Doubling Let us take a point J1 so that J1 = (X J1, Y J1 ), where X J1 is not equal to 0 Let L1 be equal to 2J1 so that L1 = (X L1, X L1 ), Then X L1 is equal to S 2 + S + a and Y L1 is equal to X J1 2 + (s + 1) * X L1 S = X J1 + Y J1 / X J1, S is the tangent at point J1 and a be single element selected from elliptic curve If X j1 = 0 then 2J1 is equal to O in such a way that it lies at infinity. 6.9 Domain parameters in Elliptic Curve For a secured and safe communication to get realised in the case of a elliptic curve cryptography there will be need of a n number of parameters besides the usual one a and b, other parameters are also being employed. Domain elements in the case of a Elliptic curve over field F p

12 Over a finite field Fp we have so many parameters defined for elliptic curve of the form y square mod p be equal to x cube + ax + b mod p of the form y as with all these as elements and having a prime number p. G represents the a reference point taken to do all the operations in cryptography represented by the coordinates X and Y at G also called as generator points. n denotes the elliptic curve s order. For point multiplication any number is taken from between zero and n-1.the cofactor is taken as h. h = E(F p )/n. Domain parameters for Elliptic Curve over field F2m Over the finite field F2m where m is an integer the different domain parameters are m, a, b, n, f(x) and h The maximum length of the members in terms of bits is m. F(x) denoteds the polynomial with degree m and a and b comes in the curve as constants. The equation that represents the elliptic curve is y 2 + xy is equal to x 3 + ax 2 + b. where G represents the a reference element taken to do all the operations in cryptography represented by the coordinates X and Y at G also called as generator points. n denotes the elliptic curve s order. The choice is free to select any number from between o and n-1 for scalar point multiplication. h is equal to E(F2 m)/n where h is the cofactor.21] 6.10 Field Arithmetic Based on the field that is taken the cryptosystem either uses the modular or the polynomial arithmetic in the Elliptic curve. A very big range of numbers that run hundreds of bits are involved in the mathematical calculations. Modular Arithmetic

13 Arithmetic operations involving numbers between zero and p-1 comes under Modular arithmetic. Whenever in any function if it goes outside the above mentioned upper limit then the final answer will be rounded inside the range of zero and p-1. Addition Let us take an example to demonstrate this let us take the values of p, a and b p = 22, a = 14, b = 90 now we will find out a + b (mod p) = (mod 22) = 33 mod 22 = 11 Here we have found out that the value of a+b which is 33 and is comes outside the range considered [0,21] the result is rounded to the range and is brought within the boundary. The remainder of a/b division process is thus got from a mod b. Subtraction Now we will do a problem related to subtraction and for this let us take the values of p, a and b as P = 22, a = 14, b = 19 The applying the value in this equation a - b (mod p) = (mod 22) = -5 mod 22 = 17 Here we can notice that as the result yielded is a negative one and is out of the range [0,21] the result is rounded and brought within the range by adding -5 with 22 until the result arrives within the specified group. Multiplication Let us take the values of p, a and b as follows

14 p = 22, a = 14, b = 19 Now we will apply the values in the formula (a * b) mod p = 14 * 19 (mod 22) = 266 mod 23 = 1 Now as in the previous two cases here also we can see that the arrived result is out of our specified range [0 22] an in order to bring the result within the range we will subtract 266 with 22 till the result comes within the specified range. Multiplicative Inverse(MI) With regards to mod q the multiplicative inverse of a number c can be explained as c-1 then it becomes c * c-1 (mod q) which is equal to one. The MI of an integer b with regards to mod p can be given as a number one subtracted form that number so that (b * b-1) (mod p) will be equal to one. The condition for multiplicative inverse is that the existence of relative prime between c and n. there are many algorithm which aid the calculation of multiplicative inverse such as Euclidean one which is recommended as the best approach, but the cost is estimated to be very heavy to find it out. To Find x1 mod y1 With any two numbers be represented by the variables x1 and y1 respectively. Now to find the value of x1 mod y1 is by dividing the variable x1 with y1. This process of dividing is continued

15 until the answer comes inside the pre specified range of [0, y1-1]. There are a large number of reduction methods that can be applied and the result can be arrived at easy and more appropriately Polynomial Arithmetic The infinite field F2m in an elliptic curve considers usually a very large integers of length m bits in the arithmetic process. The binary polynomials with degree m-1 is the usual form of these numbers. The polynomial a m-1 x m-1 + a 1 x + a 0 is the one which is represented in terms of the binary string (a m-1... a 1 a 0 ). Where the value of ai will be either zero or one. The modulus p in the arithmetic of modular type closely identifies with the one which irreducible polynomial arithmetic of degree m. So with the reduction polynomial method the degree is brought down by one if it is greater than or equal to any of the available functions.. Multiplicative Inverse A polynomial which cannot be reduced of the form f(x) a number whose multiplicative inverse can be written as one subtracted from that number then by applying in the formula we will get b * (b-1 )mod f(x) that is equal to one. To calculate the inverse more efficiently the polynomial is taken through the algorithms like the Euclidean one, but the cost of the estimation will be very heavy Irreducible polynomial

16 Like the one that exists in modular arithmetic that is p in the polynomial arithmetic is called as the Irreducible polynomial. Or it can also be stated as a polynomial which cannot be expressed in terms of any two lesser degree polynomials product. IF the irreducible polynomial is of degree m and by applying the operations to find the solution and if the polynomial that is arrived as a result is also has equal or more degree than m then the degree need to be reduced and brought within m.