An Introduction to Elliptic Curve Cryptography

Transcription

1 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 An Introduction to Elliptic Curve Cryptography Harald Baier Hochschule Darmstadt, CASED, da/sec Summer term 2013

2 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Central Questions In this lecture we will answer the following questions: 1. Why is elliptic curve mathematics (especially elliptic curve cryptography (ECC)) relevant? 1.1 In practice: Practical applications? 1.2 In theory: e.g. to solve number theoretic problems. 2. What is an elliptic curve? 3. On which hard problem does the security of ECC rely?

3 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Foundations Foundations Elliptic Curves Security of ECC Applications

4 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Modulo computation Foundations Motivation You go out at 10 p.m. and return back after 4 hours. At what time do you return? Formally: 1. N = {1, 2, 3, 4, }: Set of natural numbers. 2. Z = {, 2, 1, 0, 1, 2, }: Set of integers. 3. Let n N: n is called a modulus. 4. For a, b Z we have: a b mod n n (b a). 5. Examples: 3 18 mod 5? 3 3 mod 7?

5 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Foundations Calculation rule Key property If n is a modulus and if we have a 1 a 2 mod n and b 1 b 2 mod n, then as well as a 1 + b 1 a 2 + b 2 mod n and a 1 + b 2 a 2 + b 1 mod n a 1 b 1 a 2 b 2 mod n and a 1 b 2 a 2 b 1 mod n. Example: 1. Compute mod 10.

6 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Foundations Canonical representative Canonical representative Let n be a modulus. If a Z is given, then there is an a c Z with a c a mod n and 0 a c n 1. a c is called the canonical representative of a. Examples: 1. n = 3, a = 12: a c =? 2. n = 4, a = 15: a c =? 3. n = 11, a = 6: a c =?

7 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Foundations Residue class Residue class (or congruence class) Let n be a modulus and a Z a canonical representative. The set of all integers, which are congruent to a modulo n, is called the residue class of a. This set is denoted as a: a = {b Z : b a mod n}. Examples: 1. n = 4, a = 2: a =? 2. n = 7, a = 0: a =?

8 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Sets of residue classes Foundations The set Z p Let p be a (positive) integer prime. The set Z p = {0, 1, 2,, p 1} is called the set of integers modulo p. The set Z p Let p be a (positive) integer prime. The set Z p = {1, 2,, p 1} is called the reduced residue system modulo p. Examples: Z 1 =? Z 5 =? Z 2 =? Z 11 =?

9 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Definition of a Group General definition Abelian group Cyclic group Generator Order Foundations

10 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Elliptic Curves Foundations Elliptic Curves Security of ECC Applications

11 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Elliptic Curves Elliptic Curves We only consider elliptic curves over Z p or R. You may also consider ECC over any finite field for cryptography. For illustration we make use of R.

12 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Elliptic Curves over R Elliptic Curves 1. Defining equation: y 2 = x 3 + ax + b. 2. We have to assume 4a b The solutions of this equation over R together with the point at infinity O is referred to as E(R). Example: 1. y 2 = x 3 7x = x (x 7) (x + 7). 2. Visualisation as graph. 3. Adding of points, doubling, group law.

13 Elliptic Curves Sample addition over the reals Source: Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22

14 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Elliptic Curves Elliptic Curves over Z p We assume p Elliptic curve: y 2 x 3 + ax + b mod p. 2. We have to assume 4a b 2 0 mod p. 3. The solutions of this congruence over Z p together with the point at infinity O is referred to as E(Z p ). Example: y 2 x 3 + x mod 23. E(Z 23 ) = {O, (0, 0), (1, 5), (1, 18), (9, 5), (9, 18), (11, 10), 11, 13), (13, 5), (13, 18), (15, 3), (15, 20), (16, 8), (16, 15), (17, 10), (17, 13), (18, 10), (18, 13), (19, 1), (19, 22), (20, 4), (20, 19), (21, 6), (21, 17)}

15 Elliptic Curves A sample elliptic curve over Z 23 Source: Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22

16 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Elliptic Curves Order of Elliptic Curves over Z p 1. Upper bound: E(Z p ) 2p However: Theorem of Hasse: E(Z p ) p More precisely: E(Z p ) = p + 1 t with t 2 p

17 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Security of ECC Foundations Elliptic Curves Security of ECC Applications

18 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Security of ECC Security Considerations Discrete-Logarithm-Problem (DLP) in G 1. Given: A cyclic group G. A generator g G, i.e., G = g = {g 0, g 1, g 2,...}. Some element h G. 2. Then we have h = g x. 3. We have to find the exponent x.

19 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 ECC Security of ECC 1. Elements in the group E(Z p ) may be added. 2. Definition of ECDLP; we assume that E(Z p ) is cyclic: E(Z p ) = g = {0 g, 1 g, 2 g,...} 3. The DLP in E(Z p ) is assumed to be hard (i.e., exponential complexity with respect to the input size). 4. Definition of public and private key: Public: p, a, b, g, h = l g. Private Key: l.

20 Security Considerations Security of ECC Source: (Draft from October 12th 2012) Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22

21 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Applications Foundations Elliptic Curves Security of ECC Applications

22 Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term /22 Applications Elliptic Curve Applications 1. Practical Applications? TLS: ECDH für Elliptic Curve based Diffie-Hellman. ECDHE für Elliptic Curve based ephemeral Diffie-Hellman. epass: ECDSA für Elliptic Curve Digital Signature Algorithm. epass PKI: Example from epass: CSCA. npa: ECDHE for PACE. 2. Theory: Factoring: Elliptic Curve Method (ECM) Primality Proving: ECPP