Elliptic Curve Computations (1) View the graph and an elliptic curve Graph the elliptic curve y 2 = x 3 x over the real number field R.

Transcription

1 Elliptic Curve Computations (1) View the graph and an elliptic curve Graph the elliptic curve y 2 = x 3 x over the real number field R. >> v = y^2 - x*(x-1)*(x+1) v = y^2 - x*(x-1)*(x+1) >> ezplot(v, [-1,3,-5,5]) (2) Determine the elements in an elliptic curve over a finite field. When F = Z p (or more generally, when F is a finite field), the elliptic curves over Z p will be a finite set. Here we take a = 1 and b = 0 with F = Z 17 and consider E = {(x, y) : y 2 = x 3 + x (mod 17)} {O}. Now we want to know what points are on E. To do that, we first compute the square table over F, which tells us what element in F can have a square root. This can be done by using powermod in matlab. >> Y=[]; for y=[0:16], z=[y; powermod(y,2,17)]; Y=[Y, z]; end, Y, Y = This generates the following square root table mod p (p = 17 here) Then, we compute x = 0, 1, 2,, 16 to solve the equation y 2 = x 3 + x in Z 17. Thus (0, 0) E. For x = 1, y 2 = and so the square root table gives y = ±6. Hence (1, ±6) E. For x = 2, we have y 2 = = 10. the square root table tell us that there is no solution, and so we move onto the case x = 3. The following matlab comment computes all the needed information. >> X=[]; for x=[0:16], z=[x; mod(x^3+x,17)]; X=[X, z]; end, X, X = In this way, we have E = {(0, 0), (1, ±6), (3, ±8), (4, 0), (6, ±1), (11, ±4), (13, 0), (14, ±2), (16, ±7), O}. (3) Addition Add points (1, 3) + (3, 5) and (1, 3) + O on the curve y 2 = x x + 13 (mod 29). (Recall that O represent the infinity). 1

2 >> addell([1,3], [3,5], 24, 13, 29) 26 1 >> addell([1,3], [inf, inf], 24, 13, 29) 1 3 >> Thus on E, (1, 3) + (3, 5) = (26, 1) and (1, 3) + O = (1, 3) (expected) (4) Scalar multiplication Computing kp. Let E be the elliptic curve y 2 = x x + 13 (mod 29). For P = (1, 3) and an integer k > 0, we are to compute kp on E. If we want to compute k P for one value of k, say k = 7, then we can do the following. >> multell([1,3], 7, 24, 13, 29) 15 6 Therefore, 7(1, 3) = (15, 6). When determining the order of an element, or use brute force to find eliptic curve discrete log, we might need to compute lp for more values of k. compute k(1, 3) for each value of k = 1, 2, 3,, 8. >> multsell([1,3], 8, 24, 13, 29) Therefore, 2P = (11, 10) 3P = (23, 28) 4P = (0, 10) 5P = (19, 7) 6P = (18, 19) 7P = (15, 6) 8P = (20, 24) This can let us to find the order of P = (1, 3) is 19. Try it. This can also solve the discrete log problem: Find n such that (0, 19) = n(1, 3). (Answer: n = 18). 2

3 (5) Example: What happens when P + P? Let us add (1, 3) and (1, 3) on y 2 x x + 13 (mod 29). >> addell([1,3], [1,-3], 24, 13, 29) 1/0 1/0 Therefore, the answer is O = (inf, inf). Note that the 0 in the denominators is a 0 mod 29. (For example, the denominator could have been 58, as an integer). (6) Computing np by the double-and-add algorithm for the elliptic curve E below over F = Z 1999 : y 2 = x x , with P = (1756, 348) and n = 11. Initialization: Q = P = (1756, 348) and R = O. Iteration: (Step 1) n = 11 is odd, R := R + Q = P + O = P = (1756, 348), Q := 2Q = (1526, 1612). >> multell([1756,348],2,1828, 1675, 1999) Update n := 11/2 = 5. (Step 2) n = 5 is odd, R := R + Q = (1756, 348) + (1526, 1612) = (1362, 998), Q := 2Q = (1675, 1579). >> addell([1756,348], [1526,1612], 1828, 1675, 1999) >> multell([1526,1612],2,1828, 1675, 1999) Update n := 5/2 = 2. (Step 3) n = 2 is even, Q := 2Q = (1849, 225). >> multell([1657,1579],2,1828, 1675, 1999) Update n := 2/2 = 1. (Step 4) n = 1 is odd, R := R + Q = (1362, 998) + (1849, 225) = (1068, 1540), Q := 2Q. 3

4 >> addell([1362,998], [1849,225], 1828, 1675, 1999) Update n := 1/2 = 0. (Since we know that n = 1 after the updating, we will stop at the next step and so there is no need to actually compute 2Q.) (Step 5) n = 0, stop, and answer that 11 P = R = (1068, 1540). (7) Elliptic curve Deffie-Hellman Key Exchange System Parameters: A prime p, and an elliptic curve E = E(Z p ), and a (based) point P E. Person/Actions Alice Bob 1 Chooses a secret integer n A Chooses a secret integer & computes Q A = n A P & computes Q B = n B P 2 Sends Q A to Bob Sends Q B to Alice 3 Computes Q AB = n A Q B Computes Q AB = n B Q A. bf Example Alice and Bob uses E: y 2 = x x + 13 (mod 29) with a based point P = (1, 3) to build their common secret. Alice choose her secret n A = 3 and Bob chooses his secret 8. What will be their common secret? >> na=3; nb=8; >> Qa=multell([1,3], na, 24, 13, 29) Qa = >> K=multell(Qa, nb, 24, 13, 29) K = 19 7 Alice sends Q A = (23, 28) to Bob. Bob computes the common key K = n B Q A = (19, 7). (8) Description of an Elliptic curve ElGamal Cryptosystem System Parameters: Let p be a prime. The alphabet will be points in E, an elliptic curve E(Z p ), and a point P E (usually called the base point of the system). Note that the public is assumed to know E. Making Keys: Bob chooses his secret number n B (which will be the secret deciphering key), and he computes and publicizes Q B = n B P (his public key). Encryption and Decryption Process: Alice wants to send Bob a plain text M (which is a point or a string of points in E). She first pick her secret integer n A, computes Q A = n A P and D = M + n A (Q B ), (where Q A is the clue and D is the cipher text). Then she sends the pair (Q A, D) to Bob. 4

5 Bob receives (Q A, D). He uses his secret key n B and computes and so he recovers M. D + ( n B ) Q A = M + n A (n B P ) n B (n A P ) = M, Example: Let p = 8831, and E be the elliptic curve with equation y 2 p x 3 +3x+45 over Z p. The base point is P = (4, 11). Bob s secret key is n B = 3. He keeps n B a secret and publishes Q B = 3 P = (413, 1808). Alice wants to send a message M = (5, 1743) to Bob. She first picks her secret number n A k = 8. Then she computes Q A = n A P = 8 (4, 11) = (5415, 6321), and D = M + n A Q B = (5, 1743) + 8 (413, 1808) = (6626, 3576). Getting (Q A, D) from Alice, Bob computes (6626, 3576) 3 (5415, 6321) = (6626, 3576) (617, 146) = (6626, 3576)+(617, 146) = (5, 1743). 5