1 / 30

Selecting Class Polynomials for the Generation of Elliptic Curves

Selecting Class Polynomials for the Generation of Elliptic Curves . Elisavet Konstantinou joint work with Aristides Kontogeorgis. Department of Information and Communication Systems Engineering University of the Aegean. Why Elliptic Curves?. More Efficient (smaller parameters) Faster

eitan
Download Presentation

Selecting Class Polynomials for the Generation of Elliptic Curves

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Selecting Class Polynomials for the Generation of Elliptic Curves Elisavet Konstantinou joint work with Aristides Kontogeorgis Department of Information and Communication Systems Engineering University of the Aegean

  2. Why Elliptic Curves? More Efficient (smaller parameters) Faster Less Power and Computational Consumption Cheaper Hardware (Less Silicon Area, Less Storage Memory)

  3. Frequent Generation of ECs Requests different EC parameters Frequent change of parameters calls for strict timing response constraints (due to security requirements, vendor preferences/policy etc.)

  4. Generation of ECs The goal is to determine the following parameters of an EC y2 = x3 + ax + b • The order p of the finite field Fp. • The order m of the elliptic curve. • The coefficients a and b.

  5. Generation of secure ECs • Cryptographic Strengthsuitable order m • Suitable order • m = nq where q a prime > 2160 • m  p • pk ≢ 1 (mod m) for all 1 k 20 • The above conditions guarantee resistance to all known attacks • Sometimes, a prime m may be additionally required

  6. Generation of ECs • Point Counting methods: Rather slow (with ) ECs have to be tried before a prime order EC is found in Fp • Complex Multiplication (CM) method: Rather involved implementation, but more efficient first the order is selected and then the EC is constructed

  7. Determine D s.t. 4p=x2+Dy2 for x,y integers EC order m=p+1  x Is the order m suitable? NO YES Hilbert polynomial Class polynomial Transform the roots Construct the EC Complex Multiplication method Input:a prime p

  8. Class field polynomials • Class field polynomials: polynomials with integer coefficients whose roots (class invariants) generate the Hilbert class field of the imaginary quadratic field K = Q( ). • Drawback of Hilbert polynomials: large coefficients; time consuming construction; difficult to implement in devices of limited resources. • other class field polynomials: much smaller coefficients.

  9. Class field polynomials Alternative class field polynomials: • Weber polynomials • MD,l(x) polynomials • MD,p1,p2(x) polynomials or Double eta polynomials • Ramanujan polynomials TD(x) All are associated with a modular polynomial Φ(x, j) that transforms a root x of these polynomials to a root j of the Hilbert polynomial.

  10. An example (D = 292) W292(x) = x4 - 5x3 - 10x2 - 5x + 1 H292(x) = x4 - 2062877098042830460800x3 - 93693622511929038759497066112000000x2 + 45521551386379385369629968384000000000x 380259461042512404779990642688000000000000

  11. Congruences for D Weber polynomials D0 mod 3 D≢ 0 mod 3 d = D/4 if D 0 mod 4 d = D if D 3 mod 4 d mod 8 d mod 8 1 1 2 or 6 2 or 6 3 3 5 5 7 7 MD,l polynomialsRamanujan polynomials Double eta polynomials D11 mod 24 D0 mod l

  12. Hilbert polynomials satisfies the equation D h [a, b, c] (primitive, reduced quadratic forms) THEOREM: A Hilbert polynomial with degree h, has exactly h roots modulo p if and only if the equation 4p=x2+Dy2 has integer solutions.

  13. [a, b, c] D h or 3h (quadratic forms) Weber polynomials satisfies the equation g is defined by the Weber functions f, f1 and f2 The degree of Weber polynomials is 3 times larger than the degree of the corresponding Hilbert polynomials when D ≡ 3 mod 8.

  14. MD,l(x) polynomials where and e depends on l satisfies the equation 2 transf. [A, B, C] D h [a, b, c] (primitive, reduced quadratic forms) divisible by l each root RM is transformed to a Hilbert root RH with a modular equation:

  15. MD,p1,p2(x) polynomials primes and where satisfies the equation 2 transf. [A, B, C] D h [a, b, c] (primitive, reduced quadratic forms) each root RMd is transformed to a Hilbert root RH with a modular equation (which has large coefficients and degree at least 2 in RH ):

  16. Ramanujan polynomials TD(x) THEOREM: The Ramanujan value tn is a class invariant for n 11 mod 24. Its minimal polynomial is equal to: and the construction satisfies the equation of the function t() is based on modular functions of level 72.

  17. Precision Requirements Bit precision for the construction of polynomials EQUAL to logarithmic height of the polynomials Bit precision for the Hilbert polynomials:

  18. Precision Requirements “Efficiency” of a class invariant is measured by the asymptotic ratio of the logarithmic height of a root of the Hilbert polynomial to a root of the class invariant. Asymptotically, one can estimate the ratio of the logarithmic height h(j(τ)) of the algebraic integer j(τ) to the logarithmic height h(f(τ)) of the algebraic integer f(τ). Namely,

  19. Precision Requirements Let H(Pf) be the logarithmic height of the minimal polynomial of the algebraic integer f(τ) and H(Pj) the logarithmic height of the corresponding Hilbert polynomial. Then, where m = 1 if f(τ)generates the Hilbert class field and m = extension degree when f(τ)generates an algebraic extension of the Hilbert class field.

  20. Precision Requirements We can derive the precision requirements for the construction of every class polynomial by the equation In all cases m = 1, except when D≡ 3 mod 8 for Weber polynomials.

  21. Ramanujan polynomials The modular equation for Ramanujan polynomials is: Therefore, the value r(f) = 36. Also, since the degree of Ramanujan polynomials is equal to the degree of Hilbert polynomials, the value m = 1. Theoretically, there is a limit for r(f) ≤ 96. The best known value is r(f) = 72 for Weber polynomials with D≡ 7 mod 8.

  22. Precision Estimates

  23. Precision Estimates

  24. Precision Estimates

  25. Experiments

  26. Construction of polynomials (bit prec.)

  27. Construction of polynomials (bit prec.)

  28. Experimental observations The precision requirements for the construction of Ramanujan polynomials are on average 66%, 42%, 32% and 22% less than the precision requirements of MD,13(x), Weber, MD,5,7(x) and MD,3,13(x) respectively. The percentages are much larger when other MD,l(x) and MD,p1,p2(x) polynomials are used. The same ordering is true for the storage requirements of the polynomials with one exception: Weber polynomials.

  29. Conclusions • Ramanujan polynomials clearly outweigh all previously used polynomials when D≡ 3 mod 8 and they are by far the best choice in the generation of prime order ECs. • The congruence modulo 8 of the discriminant is crucial for the size of polynomials and this affects the efficiency of their construction.

  30. Thank you for your attention!

More Related