APPLICATION OF ELLIPTIC CURVES TO CRYPTOGRAPHY Debdeep Mukhopadhyay
APPLICATION OF ELLIPTIC CURVES TO CRYPTOGRAPHY Debdeep Mukhopadhyay Chester Rebeiro Department of Computer Science and Engineering Indian Institute of Technology Kharagpur INDIA -721302 23 -27 May 2011 Anurag Labs, DRDO 1
Objectives Elliptic ECC Curves and Cryptography Procedures – El. Gamal type Encoding of a message onto the EC ECC D-H key exchange Why use ECC? Hard Problem underlying ECC. 23 -27 May 2011 Anurag Labs, DRDO 2
Public-Key Cryptosystems Authentication: Only A can generate the encrypted message Secrecy: Only B can Decrypt message 23 -27 May 2011 the Anurag Labs, DRDO 3
Public-Key Cryptography Ring 23 -27 May 2011 Anurag Labs, DRDO 4
Public-Key Cryptography Ring 23 -27 May 2011 Anurag Labs, DRDO 5
What Is Elliptic Curve Cryptography (ECC)? Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA and El Gamal. Every user has a public and a private key. ◦ Public key is used for encryption/signature verification. ◦ Private key is used for decryption/signature generation. Elliptic curves are used as an extension to other current cryptosystems. ◦ Elliptic Curve Diffie-Hellman Key Exchange ◦ Elliptic Curve Digital Signature Algorithm 23 -27 May 2011 Anurag Labs, DRDO 6
Using Elliptic Curves In Cryptography The central part of any cryptosystem involving elliptic curves is the elliptic group. All public-key cryptosystems have some underlying mathematical operation. ◦ RSA has exponentiation (raising the message or ciphertext to the public or private values) ◦ ECC has point multiplication (repeated addition of two points). 23 -27 May 2011 Anurag Labs, DRDO 7
Generic Procedures of ECC Both parties agree to some publicly-known data items ◦ The elliptic curve equation values of a and b prime, p ◦ The elliptic group computed from the elliptic curve equation ◦ A base point, B, taken from the elliptic group Similar to the generator used in current cryptosystems Each user generates their public/private key pair ◦ Private Key = an integer, x, selected from the interval [1, p-1] ◦ Public Key = product, Q, of private key and base point (Q = x*B) 23 -27 May 2011 Anurag Labs, DRDO 8
Example – Elliptic Curve Cryptosystem Analog to El Gamal Suppose Alice wants to send to Bob an encrypted message. ◦ Both agree on a base point, B. ◦ Alice and Bob create public/private keys. Alice Private Key = a Public Key = PA = a * B Bob Private Key = b Public Key = PB = b * B ◦ Alice takes plaintext message, M, and encodes it onto a point, PM, from the elliptic group 23 -27 May 2011 Anurag Labs, DRDO 9
Encoding of a message onto the Elliptic Curve Consider a curve: y 2=x 3+ax+b The plaintexts are say numbers and English Characters (0 -9 and 10 -35). ◦ ‘B’ is encoded as m=11. Choose a public variable, k=20. ◦ compute, x=mk+i. Vary i from 1 to k-1 and try to get an integral value of y. Thus, m is encoded as (x, y). The decoding is simple: m=floor((x-1)/k). 23 -27 May 2011 Anurag Labs, DRDO 10
Example p=751, a=-1, b=188 and k=20. Let m=11 Choose, x=mk+1. Thus, x=222. But correspondingly, there is no solution for y. So, we continue until x=mk+4. x=224. Thus, y=248 and hence m=11 is encoded as (224, 248). Decoding: m=floor((224 -1)/20)=11 23 -27 May 2011 Anurag Labs, DRDO 11
Example – Elliptic Curve Cryptosystem Analog to El Gamal ◦ Alice chooses another random integer, k from the interval [1, p-1] ◦ The ciphertext is a pair of points PC = [ (k. B), (PM + k. PB) ] ◦ To decrypt, Bob computes the product of the first point from PC and his private key, b b * (k. B) ◦ Bob then takes this product and subtracts it from the second point from PC (PM + k. PB) – [b(k. B)] = PM + k(b. B) – b(k. B) = PM ◦ Bob then decodes PM to get the message, M. 23 -27 May 2011 Anurag Labs, DRDO 12
Diffie-Hellman (DH) Key Exchange 23 -27 May 2011 Anurag Labs, DRDO 13
ECC Diffie-Hellman Public: Elliptic curve and point B=(x, y) on curve Secret: Alice’s a and Bob’s b a(x, y) b(x, y) Alice, A Bob, B • Alice computes a(b(x, y)) • Bob computes b(a(x, y)) • These are the same since ab = ba 23 -27 May 2011 Anurag Labs, DRDO 14
Example – Elliptic Curve Diffie-Hellman Exchange Alice and Bob want to agree on a shared key. ◦ Alice and Bob compute their public and private keys. Alice Private Key = a Public Key = PA = a * B Bob Private Key = b Public Key = PB = b * B ◦ Alice and Bob send each other their public keys. ◦ Both take the product of their private key and the other user’s public key. Alice KAB = a(b. B) Bob KAB = b(a. B) Shared Secret Key = KAB = ab. B 23 -27 May 2011 Anurag Labs, DRDO 15
Why use ECC? How do we analyze Cryptosystems? ◦ How difficult is the underlying problem that it is based upon RSA – Integer Factorization DH – Discrete Logarithms ECC - Elliptic Curve Discrete Logarithm problem ◦ How do we measure difficulty? We examine the algorithms used to solve these problems 23 -27 May 2011 Anurag Labs, DRDO 16
Security of ECC results in shorter key sizes. ◦ this leads to efficient applications, at the same level of security. ◦ e. g 163 bits of ECC key is equivalent to 1024 bits of a RSA key. 23 -27 May 2011 Anurag Labs, DRDO 17
Applications of ECC Many devices are small and have limited storage and computational power. Where can we apply ECC? ◦ ◦ ◦ Wireless communication devices Smart cards Online Transactions Web servers Any application where security is needed but lacks the power, storage and computational power that is necessary for our present day applications. 23 -27 May 2011 Anurag Labs, DRDO 18
Hard Problem of ECC “Hard log problem” analogous to discrete ◦ Q=k. P, where Q, P belong to a prime curve given k, P “easy” to compute Q given Q, P “hard” to find k ◦ known as the elliptic curve logarithm problem k must be large enough ECC security relies on elliptic curve logarithm problem ◦ compared to factoring, can use much smaller key sizes than with RSA etc 23 -27 May 2011 Anurag Labs, DRDO 19
Elliptic Curve Discrete Log Problem (ECDLP) 23 -27 May 2011 Anurag Labs, DRDO 20
Points about ECDLP log. P(Q) may not be defined: there may be points P and Q, such that Q is not a scalar multiple of P. There is not one value, n st. Q=n. P. ◦ there exists s such that s. P=O. ◦ Since there are finite points on the EC, from the points in list P, 2 P, 3 P, 4 P, … there must be i and j st. i. P=j. P, i>j. Let s=(i-j) and the smallest such s is called order of P. ◦ Thus, if n 0 is an integer such that Q=n 0 P, then for any integer i, n=n 0+is, satisfies the equation Q=n. P. ◦ We choose, the value of log. P(Q) to be in Z/s. Z. 23 -27 May 2011 Anurag Labs, DRDO 21
How hard is ECDLP? Consider 2 lists, generated by choosing random integers j 1, …, jr and k 1, …, kr between 1 and p. ◦ List L 1: j 1 P, j 2 P, …, jr. P ◦ List L 2: k 1 P+Q, k 2 P+Q, …, kr. P+Q ◦ Any collision between the 2 lists imply, ju. P=kv. P+Q, thus Q=(ju-kv)P. ◦ From B. Paradox, with r=O(p 1/2) there is a good chance of a collision. ◦ The fastest algorithm to solve ECDLP is O(p 1/2). ◦ The ECDLP is harder than the DLP in Fp* The DLP problem has faster algorithms. 23 -27 May 2011 Anurag Labs, DRDO 22
References Books: ◦ Elliptic Curves: Number Theory and Cryptography, by Lawrence C. Washington ◦ Guide to Elliptic Curve Cryptography, Alfred J. Menezes ◦ Guide to Elliptic Curve Cryptography, Darrel R. Hankerson, A. Menezes and A. Vanstone ◦ http: //cr. yp. to/ecdh. html ( Daniel Bernstein) 23 -27 May 2011 Anurag Labs, DRDO 23
- Slides: 23