Cryptograpic Protocols Based on Elliptic Curves
Rana Barua
Indian Statistical Institute Kolkata
July 15, 2011
ElGamal Public Key Cryptosystem, 1984
• Key Generation:
1 Choose a cyclicG =<g >of prime orderp
2 choosexA∈R Zp and computeyA=gxA
3 Public key is (g,yA) and secret key isxA.
• Encryption: Given messagem∈G,
1 chooser ∈R Zp and computeh=gr
2 send ciphertext (h,yAr.m)
• Decryption: On receiving ciphertext (h,z), compute m= (hxA)−1.z
Motivation for ECC
• Note that the security of ElGamal depends on the Discrete Log Problem in G. So, in general,p should be ”large”. e.g. if G is (a subgroup of) Zq∗, then one takes p is 512 0r 1024 bits.
• Question: Can one take a relatively smaller group, and yet the discrete log problem is equally hard.
• In 1985, Koblitz (and independently, Miller) proposed the use of elliptic curve groups over a field of much smaller size.
• In fact, one can show that for 128-bit security one needs an elliptic curve over a field of order 2256, whereas RSA would need about 3072-bit keys.(Similarly for DSA basded on ElGamal)
Elliptic Curve over a Finite Field
• An elliptic curve E over a finite fieldK =Fq (Zp,p>3) is given by an equation
y2 =x3+ax +b, a,b ∈K, where 4a3+ 27b2 6= 0
• The set of K-rational points on E is
E(K) ={(x,y)∈K×K :y2 = x3+ax +b} ∪ {O}.
Elliptic Curve over a Finite Field
The setE(L) is an abelian group under the “chord-and-tangent law”. ConsiderE/K :y2 =x3+ax +b. Addition formulae are as follows:
1 P +∞=∞+P =P, for all P ∈E(L).
2 −∞=∞.
3 IfP = (x,y)∈E(L), then −P = (x,−y).
4 IfQ =−P, thenP +Q =∞.
5 IfP = (x1,y1)∈E(L),Q = (x2,y2)∈E(L),P 6=−Q, then P +Q = (x3,y3), where x3 =λ2−x1−x2,
y3=λ(x1−x3)−y1, and λ = yx2−y1
2−x1 if P 6=Q; λ = 3x2y12+a
1 if P =Q.
Elliptic Curve over a Finite Field
SupposePandQare both points on the elliptic curve thenP + Qis always another point on the elliptic curve which is defined as follows. Draw a line throughPandQ(if P = Q take the Tangent line). The line intersects the curve in a third Point. Reflect that point through the x-axis to findR = P + Q
Elliptic Curve over a Finite Field
• (Hasse’s Theorem) #E(Fq) =q+ 1−t,|t| ≤2√ q. Consequently, #E(Fq)≈q.
• (Schoof’s Algorithm) #E(Fq) can be computed in polynomial time.
• – LetE be an elliptic curve defined overFq. Then E(Fq)∼=Zn1⊕Zn2, wheren2|n1 and n2|(q−1).
• – E(Fq) is cyclic if and only ifn2= 1.
• – P ∈E is ann-torsion point ifnP =∞ andE[n] is the set of all n-torsion points.
• – If gcd(n,q) = 1, then E[n]∼=Zn⊕Zn
Some Hardness Assumptions
LetG =<P >be a group of prime orderq (e.g. a subgroup of a suitable elliptic curve)
• Discrete Log Problem (DLP) in G : Instance : (P,aP) for somea∈Zq∗. Output : a.
• Computational Diffie-Hellman (CDH) problem inG : Instance : (P,aP,bP) for some a,b ∈Zq∗.
Output : abP.
The success probability of any probabilistic, polynomial-time algorithmmathcalAin solving CDH problem inG is defined to be :
SuccCDHA,G = Prob[A(P,aP,bP) =abP :a,b∈RZq∗].
CDH assumption : For every probabilistic, polynomial-time algorithmA, SuccCDHA,G is negligible.
Some Hardness Assumptions
Decisional Diffie-Hellman (DDH) problem inG : Instance: (P,aP,bP,cP) for some a,b,c ∈Zq∗. Output: yes ifc =abmodq and output no otherwise.
The advantage of any probabilistic, polynomial-time, 0/1-valued algorithmAin solving DDH problem inG1 is defined to be :
AdvDDHA,G =|Prob[A(P,aP,bP,cP) = 1]−Prob[A(P,aP,bP,abP) = 1] :a,b,c∈RZq∗|.
DDH assumption : For every probabilistic, polynomial-time, 0/1-valued algorithmA, AdvDDHA,G is negligible.
ECDSA
Setup
• Select an elliptic curve E defined overZp. The number of points in E(Zp) should be divisible by a large primen.
• Select a point P ∈E(Zp) of order n.
• Select an integerd in the interval [1,n−1].
• ComputeQ =dP .
• A’s public key is (E;P;n;Q); A’s private key isd.
ECDSA(cont)
ECDSA signature generation. To sign a message m, A does the following:
• Select a random integer k in the interval [1,n−1].
• ComputekP = (x1;y1) andr =x1modn.
• Computek−1modn.
Computes =k−1[h(m) +dr] modn, whereh is the Secure Hash Algorithm (SHA-1).
• The signature for the message m is the pair of integers (r;s).
ECDSA(cont)
ECDSA signature verification. To verify A’s signature (r;s) on m, B should:
• Computew =s−1modn andh(m).
• Computeu1 =h(m)w modn andu2=rw modn.
• Computeu1P+u2Q = (x0;y0) andv =x0 modn.
• Accept the signature if and only if v =r.
the parametern should have about 160 bits. If this is the case, then ECDSA signatures have size 320 bits (same as DSA).
Another Motivation for ECC
The concept of identity-based cryptosystem is due to Shamir (Crypto 84). Such a scheme has the property that a user’s public key is an easily calculated function of his identity, while a user’s private key can be calculated for him by a trusted authority, called private key generator (PKG).
Earlier, Weil pairing and Tate pairing of algebraic curves were used in cryptography for attacks on ECDLP by reducing the discrete logarithm problem on some elliptic curves to the discrete logarithm problem in a finite field. In recent years, bilinear pairings have found positive application in cryptography to construct new ID-based cryptographic primitives.
Joux [?], in 2000, showed that the Weil pairing can be used in a protocol to construct a three-party one-round Diffie-Hellman key agreement. This was one of the breakthroughs in key agreement protocols.
Bilinear Map
LetG1,G2 be two groups of the some large prime orderq.
LetG1 =<P >. (aP denotes P added to itself a times).
Assume that discrete logarithm problem (DLP) is hard in bothG1 andG2.
A mappinge :G12−→G2 satisfying the following properties is called a cryptographic bilinear map.
(Bilinearity) : e(aP,bQ) =e(P,Q)ab for all P,Q ∈G1 anda,b∈Zq∗.
(Non-degeneracy): e(P,P)6= 1. i.e. if P is a generator of G1, then e(P,P) is a generator of G2. (Computability) : There exists an efficient algorithm to computee(P,Q) for all P,Q ∈G1. Modified Weil Pairing [?] and Tate Pairing are examples of
cryptographic bilinear maps.
Identity Based Encryption (IBE)
• Setup : Choose s∈RZq∗ and setPpub =sP. Choose cryptographic hash functionsH1:{0,1}∗−→G1∗ and H2:G2 −→ {0,1}n,n is the bit length of messages. The master key is s and the global public key is Ppub.
• Extract : Given a public identity ID∈ {0,1}∗, compute the public keyQID=H1(ID)∈G1 and the private keySID=sQID.
Identity Based Encryption (IBE)(cont.)
• Encrypt : Choose a randomr ∈Zq∗, set the ciphertext for the message M to beC =hrP,M ⊕H2(gIDr )i where
gID=e(QID,Ppub).
• Decrypt : GivenC =hU,Vi, computeV ⊕H2(e(SID,U)).
• Assumption :
BDH problem is hard.
Identity Based Encryption (IBE)(cont.)
Security :
This is the basic scheme. Security against adaptive chosen cipher text attack in the random oracle model under the BDH assumption is obtained after the Fujisaki-Okamoto [?] transformation.
