Elliptic Curve Cryptography

1. Elliptic Curve Cryptography Implementation & PKI Adoption Brian Saville Jonathan Mitchell

2. Overview • Background of ECC and PKI • ECC Weaknesses • Experimentation • Results • ECC Adoption • Conclusion • Questions

3. Elliptic Curves All Elliptic Curves come in the following form:                  y2 = x3 + ax + b

4. Mathematical Properties Can define a new algebra on Elliptic Curves with interesting mathematical properties: • first, add a point-at-infinity O • point addition: draw a line through 2 points. the sum is the opposite of where the line hits the curve a 3rd time. • adding point to itself: use tangent line (point doubling) • if vertical, sum is "O" • this can also be determined algebraically.

5. Point Addition: Rules

6. Finite Elliptic Curves • Encryption works better with integers. • Wrap elliptic curves in finite field (modulo) • Pretty curves and lines no longer applicable • Algebra still works  • Curves now look like:y2 mod p = (x3 +ax+b) mod p

7. Finite Point Addition: Rules

8. Uses in Cryptography Mathematical properties are useful for PKI • Can generate asymmetric (public/private) keys • Can encrypt/decrypt data Stronger than RSA

9. Key Generation Agree on the following (public): • Curve parameters (a, b) • The modulus p • Base point G (on the curve) Pick a random integer n as private key Calculate public key P = n*G

10. Encryption/Decryption  Alice represents her text or data to send as a point Pm  Alice sends Bob a pair of points:      SentPair = {k*G, Pm + k*P}      k = randomly chosen integer  Bob decrypts the message using his private key:     Pm + k*P - n(k*G)  =  Pm + k(n*G) - n(k*G)  =  Pm

11. Why ECC is strong The difficult mathematical problem is called the  elliptic curve discrete logarithm problem That is, given P and G, (and P= n*G), find n • Invented a whole new algebra • not susceptible to common attacks • Runs in exponential time • RSA runs in sub-exponential time • Best known attack: Pollard's rho attack (exponential) • runs in ((πn)^1/2) / 2

12. Weaknesses Unexplored since not used much in productionChoosing correct curve parameters • Modulo p - some sub-exponential algorithms exist for certain p Finding base point G • Not as easy as you'd think

13. Experiments - Goals and Outcomes • Create a visual representation of point addition • Perform timing experiments contrasting ECC and RSA • Length of time to generate keys (various key sizes) • Length of time to encrypt data (various data lengths)

14. Demo

15. Results

16. Key Generation by Key Size

17. Key Generation by Key Strength

18. Encryption by Key Size

19. Encryption by Key Strength

20. Analysis Results are about as expected, with surprises • Key generation was faster in ECC at same strength • Encryption was faster in ECC at higher bit sizes May have been due to naive implementation

21. ECC Adoption Patents • Many willing to work with community - Sun • Certicom is the problem - Sued Sony • NSA licensing from Certicom Logistics • Replace software and hardware in place for RSA, etc Estimated standard ~2020

22. Conclusion ECC is stronger than RSA for PKI Patents won't stand in the way forever Largest obstacle: replacing current PKI infrastructure

23. Review • Background of ECC and PKI • Elliptic Curves • Key Generation • Data Encryption • Weaknesses • Experimentation • Visual Point Addition • Key Generation • Data Encryption • Results • ECC Adoption - Patents, Logistics • Conclusion

24. Questions