Suppose F is a field and a1,..., a6 F. Definition 1. An elliptic curve E over a field F is a curve given by an equation:

Transcription

1 Elliptic Curve Cryptography Jim Royer CIS 428/628: Introduction to Cryptography November 6, 2018 Suppose F is a field and a 1,..., a 6 F. Definition 1. An elliptic curve E over a field F is a curve given by an equation: Y 2 + a 1 XY + a 3 Y = X 3 + a 2 X 2 + a 4 X + a 6 (1) If char(f) = 2, 3, then a change of variables can simplify (1) to: Y 2 = X 3 + a 1 X + a 2 (2) Elliptic Curve Cryptography char(f) = 2, 3 means = 0 and = 0. We also require that 4a a2 2 = 0, or equivalently, x 3 + a 1 x + a 2 has distinct roots. Double roots will break the algebra below. Suppose F is a field and a1,..., a6 F. Definition 1. An elliptic curve E over a field F is a curve given by an equation: Y 2 + a1xy + a3y = X 3 + a2x 2 + a4x + a6 (1) If char(f) = 2, 3, then a change of variables can simplify (1) to: Y 2 = X3 + a1x + a2 (2) Why Are Nifty? They played a key role in Wiles solution to the Fermat s Last Theorem problem and the solution of the Taniyama-Shimura conjecture. There are abelian groups hiding in these curves that are very similar to the Z p k s. There are a lot more elliptic curves that Z p k s. You can build cryptosystems based on elliptic curves that require much smaller key length (e.g., 4096 bits vs. 313 bits) for similar security.!!! However...

2 Why Are Nifty? They played a key role in Wiles solution to the Fermat s Last Theorem problem and the solution of the Taniyama-Shimura conjecture. There are abelian groups hiding in these curves that are very similar to the Z p k s. There are a lot more elliptic curves that Z p k s. You can build cryptosystems based on elliptic curves that require much smaller key length (e.g., 4096 bits vs. 313 bits) for similar security.!!! However... because of the small key size, and they turn out to be more vulnerable to quantum attacks! Elliptic Curve Addition Rules: Geometric, I Addition Rules (Geometric) The curves always include a point at, where =. The curves are really on a torus/doughnut. The curves are symmetric around the x-axis. P 1 + P 2 = P Draw a line through P 1 and P 2. (If P 1 = P 2, use the tangent line.) 2. The line hits the curve at a unique third point Q. 3. Let P 3 be the point symmetric to Q on the other side of the x-axis. Note: P 1 + = P 1. ( acts like 0.) Fact: P + Q + R = iff P, Q, and R are co-linear. The addition rules don t work for ECs with double roots. Elliptic Curve Addition Rules: Geometric, II Addition Rules (Algebraic) Suppose Elliptic Curve Addition Rules: Algebraic Then P 1 + P 2 = P 3 = (x 3, y 3 ) where E : Y 2 = X 3 + ax + b P 1 = (x 1, y 1 ) P 2 = (x 2, y 2 ) x 3 = m 2 x 1 x 2 y 3 = m (x 1 x 2 ) y 1 m = { (y2 y 1 )/(x 1 x 2 ), if P 1 = P 2 (3x a)/(2y 1) if P 1 = P 2 Picture from: 21-elliptic-curve-addition-a-geometric-approach.html (If m =, then P 3 =.) Facts: (P + Q) + R = P + (Q + R) and P + Q = Q + P.

3 Example Consider: E : y 2 = x 3 + 2x + 3 (mod 5) mod n, I E = { (x, y) (Z 5 Z 5 ) { (, ) } y 2 x 3 + 2x + 3 (mod 5) } = { (1, 0), (2, 2), (2, 3), (3, 0), (4, 2), (4, 3), (, ) } Point Arithmetic: (1, 4) + (3, 1) =? Since (1, 4) = (3, 1): (1, 4) + (3, 1) = (2, 0). m = y 2 y 1 x 2 x (mod 5) x 3 m 2 x 1 x (mod 5) y 3 m (x 1 x 3 ) y 1 1 (1 2) 4 0 (mod 5) mod n, II How many points are there on an elliptic curve mod m? Theorem 2 (Hasse s Theorem). Suppose F q be a finite field with q elements. E is an elliptic curve over F q with N points. Then N q 1 < 2 q, that is: i.e,, there are enough points to make trouble. Schoof s Algorithm (q 1) 2 q < N < (q 1) + 2 q Given E over F q, one can find E in O((log 2 q) 8 ) time. (There are faster algorithms for special cases.) mod N, III Representing Plaintext on The Classical Discrete Log Problem Given: β, α, p β α k (mod p). Find: k. k A = def A + + A }{{} k many in F q. The Discrete Log Problem for Elliptic Curves mod m Given: A & B points on E B = k A. Find: k. : Z p :: + :ECs (mod p). Finding Points on a Given There is no known deterministic poly-time algorithm for this. However, there are reasonably fast probabilistic methods (that have a certain probability of failure). State of Play: The known algorithms for solving the EC-discrete log problem are even worse that the ones for the classical problem. (Good news for Cryptography) Factoring and Primality Testing with E.C.s See text.

4 Quick Review: Quadratic Residues We want to solve equations like: x 2 b (mod n) There may not be a solution. E.g., Definition 3. x 2 3 (mod 5). Suppose a Z p, where p is a prime. a is a quadratic residue mod p iff for some x: x 2 a (mod p). QR(p) = the quadratic residues mod p a (Z p QR(p)) is a nonresidue. Fact: QR(p) = p 1 2. Theorem 4. Suppose a Z p where p is prime. a is a quadratric residue mod p iff a (p 1)/2 1 (mod p). Proposition 5. Suppose p is a prime with p 3 (mod 4). Let y Z p and x = y (p+1)/4 (mod p). Then either: y QR(p) with roots ±x or: y QR(p) with roots ±x. Koblitz s Method All of the following will be Suppose p is a prime with p 3 (mod 4) and that E : y 2 = x 3 + ax + b is the elliptic curve in question. Pick K so that 1/2 K (the failure bound) is tolerably small. Messages will be from { m Z p For j = 0,..., K 1: m < p K K Set x j = m K + j & w j = x 3 j + ax j + b & z j = w p+1 4 j (Note: Either z 2 j = w j or z 2 j = w j.) (Why?) }. Let m be a message. (mod p). If z 2 j = w j, then return (x j, z j ) as the point on E encoding m. If z 2 j = w j, we continue a for-loop. (Why?) If no j works, report failure. Probability of failure 1 2 K. (Why?) If (x, y) on E encodes a message m, then m = x/k. The ElGamal Cryptosystem for ECs Classical Elliptic Curve Bob Chooses Bob Chooses p, prime E (mod p), p prime α Zp α E a Z a Z β = α a (mod p) β = a α Public: p, α, β Private: a Public: E, E, α, β Private: a Alice with message x Alice with message m P E Z p 1 Z E 1 Computes: Computes: y 1 α k (mod p) y 1 = k α y 2 x β k (mod p) y 2 = P + k β Diffie-Hellman on Setup E : y 2 x 3 + ax + b (mod p) with e points. Public G, a point on E. Public Alice Bob ran Chooses n a Ze 1. Sends n a G to Bob. ran Chooses n b Ze 1. Sends n b G to Alice. Alice Computes K ab = n a (n b G) = n a n b G. Bob Computes K ab = n b (n a G) = n a n b G. Private Private Bob Computes: Bob Computes: P = y 2 a y 1 x y 2 y1 a (mod p) Extracts m from P

5 Alice s Setup ElGamal Signatures on ECs, I Chooses an EC E (mod p), where p is a prime. Chooses A, a point on E. Computes n, the number of points on E. Assume n > any message. Chooses a N. Computes B = a A. Alice: signs m Z n. Computes R = k A = (x, y). Computes s k 1 (m ax) (mod n). Sends (m, R, s). private more... Bob: Wants to verify (m, R, s) ElGamal Signatures on ECs, II Obtains p, E, n, A, and B B = a A Computes V 1 = x B + s R R = k A = (x, y) Computes V 2 = m A s = k 1 (m ax) (mod n) Checks if V 1 = V 2 Why does this work? V 1 = x B + s R = x a A + k 1 (m a x) (k A) = x a A + (m a x) A = x a A + m A a x A = m A = V 2