Elliptic Curve Cryptography

1
Elliptic Curve Cryptography

• Elliptic Curve over K is the set of points (x,y),
  with x, y ? K, which satisfy
• y2 x3 ax b, together with the point at
  infinity O, if characteristic of K gt 3 and x3
  ax b has no multiple roots
• If the characteristic of K is 2, than the
  elliptic curve is
• y2 cy x3 ax b (1)
• y2 xy x3 ax2 b (2), where we dont care
  about multiple roots

2
Elliptic Curve Cryptography

• A nonsingular point in F(x,y) 0 is a point in
  which one of the partial derivatives (over x or
  y) is non-zero
• The equation on the elliptic curve x3 ax b
  will not have multiple root if F(x,y) has only
  nonsingular points.
• Using ? -16(4a3 27b2), F(x,y) will have only
  nonsingular points if ? ? 0

3
Elliptic Curve Cryptography

• In fact the elliptic curve is given by the
  Weierstrass equation
• y2 a1xy a3y x3 a2x2 a4x a6
• This is specialized with variable changes to the
  equations initially shown
• The equations for K of characteristic 2 come
  from
• Define j(E) (a1)12/? (already specialized)
• Than if j(E) ? 0 we get (2)
• If j(E) 0 we get 1

4
Elliptic Curve Cryptography

• Now we can show the formulas for adding points.
• Assume P (x1, y1) and Q (x2, y2)
• If the characteristic of K is gt 3 than
• -P (x1, -y1)
• P Q (?2 - x1- x2, ?(x1- x3) - y1)
• ? (y2- y1)/(x2- x1), if P ? Q
• (3 x12 a)/2y1, if P Q

5
Elliptic Curve Cryptography

• If the characteristic of K is 2, than
• If j(E) ? 0
• -P (x1, y1 x1)
• PQ (x3, y3)
• x3 ((y1y2)/(x1x2))2 (y1y2)/(x1x2) x1x2
  a, P ? Q
• x12 b/ x12, P Q
• y3 ((y1y2)/(x1x2))(x1x3) x3 y1, P ? Q
• x12 (x1 y1/x1)x3 x3, P Q

6
Elliptic Curve Cryptography

• If the characteristic of K is 2, than
• If j(E) 0
• -P (x1, y1 c)
• PQ (x3, y3)
• x3 ((y1y2)/(x1x2))2 x1x2, P ? Q
• (x14 a2)/ c2, P Q
• y3 ((y1y2)/(x1x2))(x1x3) c y1, P ? Q
• ((x12 a)/c)(x1x3) c y1, P Q

7
Elliptic Curve Cryptography

• Elliptic curve of finite field Fq
• The number of points is given by
• q 1 ??(x3 ax b), ? is the quadratic
  character of Fq
• Hassess Theorem
• N (q1)? 2?q
• The abelian group over Fq does not need to be
  cyclic, but it can be decomposed on cyclic groups

8
Elliptic Curve Cryptography

• Extension fields
• If E is defined over Fq, it is also defined over
  Fqr, for r 1, 2, .
• Assume that Nr is the number of points on E
  defined over Fqr
• The generating series Z( T E/ Fq) is defined as

9
Elliptic Curve Cryptography

• Weil conjecture
• Z(T E/ Fq) (1- aT qT2)/((1-T)(1-qT))
• N N1 q 1 a
• The inverse roots of the numerator are ? and ?,
  complex of absolute value ?q
• Nr qr 1 ?r ?r, r 1, 2, .
• Example
• Find Nr for the curve y2 y x3 over F2r

10
Elliptic Curve Cryptography

• The analogy of multiplying two elements in Fq is
  adding two points in E
• So the analogy of raising an element to power k
  is multiplying a point by k
• Raising to power k can be accomplished in O(log k
  log3q) bit operations
• Multiplying a point by k can be accomplished in
  O(log k log3q)

11
Elliptic Curve Cryptography

• The discrete log problem in elliptic curve is the
  problem of given P and B find an x such as P
  xB
• There is a way to reduce the log problem over
  elliptic curve to the log problem over Fqk
• The reduction only works for some special curves
  that are called supersingular
• Why do you care about this?

12
Diffie Hellman over ECC

• Alice and Bob chose a finite field Fq and an
  elliptic curve E
• The key will be taken from a random point P over
  the elliptic curve (e.g. the x coordinate)
• Alice and Bob choose a point B that does not need
  to be secret
• B must have a very large order!

13
Diffie Hellman over ECC

• Alice chooses a random a and compute aB ? E
• Bob chooses a random b and compute bB ? E
• Alice and Bob exchange the computed values
• Alice, from bB and a can compute P abB
• Bob, from aB and b can compute P abB