1 / 55

橢圓曲線密碼技術

橢圓曲線密碼技術. 交通大學 資訊工程系 陳榮傑 http://www.cs.nctu.edu.tw/~rjchen/ECC2012S/. Outline. [1] Discrete Logarithm Problem [2] Algorithms for Discrete Logarithm [3] Cryptosystems Based on DLP [4] Elliptic Curves [5] Elliptic Curve DLP [6] Signature Scheme: ECDSA [7] How to find secure ECs?

wesley-doyle
Download Presentation

橢圓曲線密碼技術

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. 橢圓曲線密碼技術 交通大學 資訊工程系 陳榮傑 http://www.cs.nctu.edu.tw/~rjchen/ECC2012S/

  2. Outline • [1] Discrete Logarithm Problem • [2] Algorithms for Discrete Logarithm • [3] Cryptosystems Based on DLP • [4] Elliptic Curves • [5] Elliptic Curve DLP • [6] Signature Scheme: ECDSA • [7] How to find secure ECs? • [8] Hyperelliptic Curves • [9] ID-based Cryptosystems • [10] Pairing-based Cryptography

  3. [1] Discrete Logarithm Problem • Let G is a finite cyclic group of size n generated by generator g, i.e. G = <g> = {g i | i = 1, 2, …, n} or {g i | i = 0, 1, …, n-1} • Given g and i, it is easy to compute gi by repeated squaring • Discrete logarithm problem Given , find x such that We denote

  4. Example 1G = Z19*= { 1, 2, …, 18}n=18, generator g = 2 then log214 = 7 log26 = 14

  5. Example 2G=GF*(23) with irreducible poly. p(x)=x3+x+1G=Zn*/p(x)={ 1, x, x2, 1+x, 1+x2, x+x2, 1+x+x2 }n=7, generator g = x then logx(x+1) = 3 logx(x2+x+1) = 5 logx(x2+1) = 6

  6. Example 3Let p=1053546280395016975304616582933958731948871814925913489342608734258717883575185867300386287737705577937382925873762451990450430661350859682697410256268271147283034897563214300237166369174066615907176472549470083113107138189921280884003892629359 NB: p= 158(2800 + 25) + 1 and has 807 bits. • Find x in Z, such that 2x = 3 mod p

  7. [2] Algorithms for Discrete Logarithm • trivial algorithm • Shanks’ algorithm (Baby-step giant-step) • Pollard rho discrete log algorithm • Pohlig-Hellman algorithm • The index calculus method*

  8. The index calculus method • The index calculus method (Suitable only for G=Zp*)

  9. Example log59451 mod 10007=? Choose B={2, 3, 5, 7}. Of course log55=1. Use lucky exponents 4063, 5136, and 9865 54063 mod 10007 = 42 = 2 * 3 * 7 55136 mod 10007 = 54 = 2 * 33 59865 mod 10007 = 189 = 33 * 7 And we have three congruences: log52 + log53 + log57 = 4063 mod 10006 log52 + 3 log53 = 5136 mod 10006 3 log53 + log57 = 9865 mod 10006

  10. There happens to be a unique solution modulo 10006 • log52=6578, log53=6190, and log57=1301 • Choose random exponent s = 7736 and try to calculate • ags = 9451*57736 mod 10007 = 8400 • Since 8400 = 24*3*52*7 factors over B, we obtain • log59451 = (4 log52 + log53 + 2 log55 + log57 – s) mod 10006 • = (4*6578 + 6190 + 2*1 +1301 – 7736) mod 10006 • = 6057 mod 10006

  11. Complexity of Index Calculus • For factoring and the discrete logarithm problem in finite fields Fq* there are index calculus algorithm (implemented with Number Field Sieve technique) • These have subexponential complexity O(exp(c(lnN)1/3(lnlnN)2/3))

  12. [3] Cryptosystems based on DL • Key Distribution • Diffie-Hellman, 1976 • Encryption • Massey-Omura cryptosystem, 1983 • Digital Signature • ElGamal, 1985

  13. Diffie-Hellman Key Exchange Algo • Global Public Elements • q : prime number • α: α< q and α is a primitive root of q • User A Key Generation • Select private XA : XA< q • Calculate public YA : YA= αXA mod q • User B Key Generation • Select private XB : XB< q • Calculate public YB : YB= αXB mod q • Generation of Secret Key by User A • K = (YB)XA mod q • Generation of Secret Key by User B • K = (YA)XB mod q

  14. User A User B Generate random XA < q ; Calculate YA = αXA mod q Calculate K = (YB)XA mod q Generate random XB < q ; Calculate YB = αXB mod q Calculate K = (YA)XB mod q YA YB Diffie-Hellman Key Exchange

  15. Massey-Omura for message transmission • Parameters • q : prime number • e : a random private integer • 0 < e< q and gcd ( e, q-1) = 1 • d : an inverse of e • d = e-1 mod q-1 , i.e., de≡1 mod q-1 • M : a message to be encrypted and decrypted • User A wants to send a message M to User B • User A : eA and dA are both private • User B : eB and dBare both private

  16. User A User B 1.Encryption(1) C1 = M eA mod q 3.Encryption(3) C3 = C2dA = (M eAeB)dA = M eB mod q 2.Encryption(2) C2 = C1eB = M eAeB mod q 4. Decryption M = C3dB = M eBdBmod q C1 C2 C3 Massey-Omura for message transmission

  17. ElGamal signature scheme • 1985 ElGamal • Parameters • p : a large prime • α: a primitive number in GF(p) • x : a private key, x [1, p-1] • y : a public key , y = αx(mod p) • m : a message to be signed , m [1, p-1] • k : a random integer that is privately selected, k [0, p-2] • Signature • r = αkmod p • m = ks + rxmod φ(p) ,where GCD( k, φ(p) ) = 1 • ( m , (r,s) ) is sent to the verifier • Verification • αm = rs yr mod p • The signature (r,s) is accepted when the equality holds true.

  18. ElGamal encryption scheme • Parameters • p : a large prime • α: a primitive number in GF(p) • a : a private key, a [1, p-1] • β : a public key , β = αa(mod p) • m : a message to be signed , m [1, p-1] • k : a random integer that is privately selected, k [0, p-2] • K = (p, α, a, β) : public key + private key • Encryption eK(m, k)=(y1, y2) where y1= αkmodpand y2=mβkmod p • Decryption m = dK(y1, y2) = y2(y1a)-1 mod p

  19. Q P P+Q [4] Elliptic Curves • Over Fields of Characteristic p>3 • Curve form E: Y2 = X3 + aX + b where a, b  Fq, q = pn 4a3+27b2≠0 • Group operation given P1(x1,y1) and P2(x2,y2) compute P3(x3,y3) = P1+P2 (xP+Q, yP+Q) (xP+Q, yP+Q)

  20. Example of EC over GF(p) • Example: -P P+Q P Q

  21. Addition (P1P2) • Doubling (P1=P2) Computational Cost I + 3 M Computational Cost I + 4 M

  22. Over Fields of Characteristic 2 • Curve form E: Y2 + XY = X3 + aX2 + b where a, b  Fq, b≠0, q = 2n • Group operation given P1(x1,y1) and P2(x2,y2) compute P3(x3,y3) = P1+P2

  23. Example of EC over GF(2m)

  24. Addition (P1P2) • Doubling (P1=P2) Computational Cost I + 2 M + S Computational Cost I + 2 M + S

  25. [5] Elliptic Curve DLP • Basic computation of ECC • Q = kP = where P is a curve point, k is an integer • Strength of ECC • Given curve, the point P, and kP It is hard to recover k - Elliptic Curve Discrete Logarithm Problem (ECDLP)

  26. Security of ECC versus RSA/ElGamal • Elliptic curve cryptosystems give the most security per bit of any known public-key scheme. • The ECDLP problem appears to be much more difficult than the integer factorisation problem and the discrete logarithm problem of Zp. (no index calculus algo!) • The strength of elliptic curve cryptosystems grows much faster with the key size increases than does the strength of RSA.

  27. Elliptic Curve Security NIST Recommended Key Sizes

  28. ECC Benefits ECC is particularly beneficial for application where: • computational power is limited (wireless devices, PC cards) • integrated circuit space is limited (wireless devices, PC cards) • high speed is required. • intensive use of signing, verifying or authenticating is required. • signed messages are required to be stored or transmitted (especially for short messages). • bandwidth is limited (wireless communications and some computer networks).

  29. [6] Signature Scheme: ECDSA • Digital Signature Algorithm (DSA) • Proposed in 1991 • Was adopted as a standard on December 1, 1994 • Elliptic Curve DSA (ECDSA) • FIPS 186-2 in 2000

  30. Digital Signature Algorithm (DSA) L=0 mod 64, 512≤L≤1024 • Let p be a L-bit prime such that the DL problem in Zp* is intractable, and let q be a 160-bit prime that divides p-1. Let α be a qth root of 1 modulo p. Define K={ (p,q,α,a,β): β=αa mod p } p,q,α,β are the public key, a is private

  31. For a (secret) random number k, define sig(x,k)=(γ,δ), where γ=(αk mod p) mod q and δ=(SHA-1(x)+aγ)k-1 mod q • For amessage (x,(γ,δ)), verification is done by performing the following computations: e1=SHA-1(x)*δ-1 mod q e2=γ*δ-1 mod q ver(x,(γ,δ))=true iff. (αe1βe2 mod p) mod q=γ

  32. Elliptic Curve DSA • Let p be a prime, and let E be an elliptic curve defined over Fp. Let A be a point on E having prime order q, such that DL problem in <A> is infeasible. Define K={ (p,q,E,A,m,B): B=mA } p,q,E,A,B are the public key, m is private

  33. For a (secret) random number k, define sigk(x,k)=(r,s), where kA=(u,v), r=u mod q and s=k-1(SHA-1(x)+mr) mod q • For amessage (x,(r,s)), verification is done by performing the following computations: i=SHA-1(x)*s-1 mod q j=r*s-1 mod q (u,v)=iA+jB ver(x,(r,s))=true if and only if u mod q=r

  34. [7] How to find secure elliptic curves ? (1)Randomly choose a, b, p and calculate #Elliptic curve (y2=x3+ax+b) until #E = a prime q, where #E is calculate by using Schoof-Elkies-Atkin algorithm (2)(Complex multiplication method) Given a big prime q, find p, a, b such that #Elliptic curve (y2=x3+ax+b) = q

  35. [8] Hyperelliptic Curves 1. Definition of HC 2. Example of HC (rational points of HC do not form a group) 3. Divisor 4. Jacobian (Jacobian is a group) 5. HCDLP

  36. Definitions of hyperelliptic curves • A hyperelliptic curve C of genus g over a finite field K (g≧1) C : y2 + h(x)y = f(x) where • h(x) ∈ K[x] is a polynomial of degree at most g, • f(x) ∈ K[x] is a monic polynomial of degree 2g+1. • Elliptic curves are hyperelliptic curves of genus 1.

  37. R R Q Q P P -R Group law in an elliptic curve • y2=x3-x over R -R ？ P+Q=

  38. Example: Hyperelliptic curve • A genus 2 hyperelliptic curve over R:C:y2 = x5 -5x3+ 4x= x(x+1)(x-1)(x+2)(x-2) • The rational points on C do not form a group.

  39. Divisors • Definition : (divisor, degree) • A divisor D is a formal sum of points in C: • The degree of D, • The set of all divisors, denoted D, forms an additive group under the addition rule: • D0(K) is the subgroup of all divisors defined over K and of degree 0. D1=2P1+P2-3∞ D2= P1+P3 deg(D1) =2+1-3=0 deg(D2) =1+1=2 D1+D2 =3P1+P2+P3-3∞

  40. C: y2 = x5 -5x3+ 4x • x-1 Principal divisor • Definition : (principal divisors) • Let R ∈K(C) be a rational function. The divisor of R is called a principal divisor : • In fact, degree of a principal divisor is 0. • The set of all principal divisors, denoted P(K), is a subgroup of D0(K). Q1=(1, 0) on C div(x-1) = 2Q1-2∞

  41. Jacobian • Definition: (Jacobian) • The quotient group JC(K) = D0/P is called the Jacobian of the curve C. • If D1, D2 ∈ D0 and D1-D2 ∈ P, then D1 and D2 are said to be equivalent divisors; we write D1~D2.

  42. x-x6=0 P5’ P6 P6’ P5 x-x5=0 Group law in HC • A genus 2 hyperelliptic curve over R:C:y2 = x5 -5x3+ 4x • y=a3x3+a2x2+a1x+a0 P4 P2 P1 P3 ？

  43. HCDLP • HCDLP: (hyperelliptic curve discrete logarithm problem) • Let a divisor D1 in JC(Fq) with known order N, and D2 in <D1> • To find an integer λ s.t. D2 = λD1 is hard.

  44. [9] ID-based Cryptosystem Setup generate params and master key IDBob is arbitrary and meaningful ex: Bob@hotmail.com or 0912345678 Private Key Generator (PKG) Extract generate KRIDBob by IDBob and master key Authentication (IDBob) KRIDBob Alice Bob (params, IDBob) KRIDBob Encrypt Decrypt or or Verify Sign

  45. Certificate-based Cryptosystem Certificate Authority (CA) KUBob is random Authentication (KUBob) Certificate(Bob, KUBob) Certificate(Bob, KUBob) Alice Bob KUBob KRBob Encrypt Decrypt or or Verify Sign

  46. ID-based Encryption Scheme • Proposed by Boneh and Franklin (Crypto 2001) • First complete and efficient scheme • Bilinear Pairing G1: additive group generated by P, ord(P)=q G2: multiplicative group with same order q Assume that DLP in G1 and G2 are hard Let e: G1xG1  G2 satisfies: 1. Bilinear: e(P1+P2,Q)=e(P1,Q)e(P2,Q) e(P,Q1+Q2)=e(P,Q1)e(P,Q2) 2. Non-degenerate:  P,Q G1, s.t e(P,Q)1 3. Computability • Bilinear Diffie-Hellman (BDH) Assumption Given P, aP, bP, cP G1 , compute e(P, P)abc is HARD!

  47. ID-based Encryption Scheme System: k-bit prime p p=2 mod 3, p=6q-1 E: y2=x3+1 over Fp • ID-based Encryption • Setup: (1) Choose P  E/Fp of order q (2) Pick a random s Zq* and set Ppub= sP (3) Two hash functions: H1: {0,1}*  G*1(MapToPoint) H2: G2  {0,1}n for some n • Extract: Given a ID {0,1}*, build private key SID as follows: QID= H1(ID) Set dID=sQID , where s is the master key Params: <p, q, P, Ppub, H1, H2> Master-key: s

  48. ID-based Encryption Scheme • Encrypt: Use MapToPoint to map ID to QID choose a random r Zq* C = < rP, M  H2(e(QID, Ppub)r) > • Decrypt: Let C=< U, V > , if U is not a point of order q then reject M = V  H2(e(dID, U)) dID=sQID Ppub=sP e(dID, U)= e(sQID, rP)= e(QID, P)sr= e(QID, sP)r= e(QID, Ppub)r

  49. Weil Pairing • (Def)Weil pairing where is called the m-torsion group, Um is the group of the mth roots of unity • Given P, QE [m],  DP, DQDiv 0 such that DP ~ (P) – (O) and DQ ~ (Q) – (O). Also, fP , fQ such that div (fP) = m DP and div (fQ) = m DQ. Suppose supp (DP)  supp (DQ) =  Then

  50. End-to-end security for SMS(short message service) • RSA Mechanism

More Related