elliptic curve cryptographycse.iitkgp.ac.in/~debdeep/pres/ti/ecc.pdf · • elliptic curve...
TRANSCRIPT
![Page 1: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/1.jpg)
Elliptic Curve Cryptography
Speaker : Debdeep MukhopadhyayDept of Computer Sc and EnggIIT Madras
![Page 2: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/2.jpg)
Outline of the Talk…• Introduction to Elliptic Curves
• Elliptic Curve Cryptosystems (ECC)
• Implementation of ECC in Binary Fields
![Page 3: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/3.jpg)
Introduction to Elliptic Curves
![Page 4: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/4.jpg)
Lets start with a puzzle…• What is the number of balls that may be
piled as a square pyramid and also rearranged into a square array?
• Soln: Let x be the height of the pyramid…Thus,
We also want this to be a square:Hence,
2 2 2 2 ( 1)(2 1)1 2 3 ...6
x x xx + ++ + + + =
2 ( 1)(2 1)6
x x xy + +=
![Page 5: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/5.jpg)
Graphical Representation
X axis
Y axis
Curves of this nature are called ELLIPTIC
CURVES
![Page 6: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/6.jpg)
Method of Diophantus• Uses a set of known points to produce new points• (0,0) and (1,1) are two trivial solutions• Equation of line through these points is y=x.• Intersecting with the curve and rearranging terms:
• We know that 1 + 0 + x = 3/2 => x = ½ and y = ½
• Using symmetry of the curve we also have (1/2,-1/2) as another solution
3 23 1 02 2
x x x− + =
![Page 7: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/7.jpg)
Diophantus’ Method• Consider the line through (1/2,-1/2) and (1,1) =>
y=3x-2• Intersecting with the curve we have:
• Thus ½ + 1 + x = 51/2 or x = 24 and y=70
• Thus if we have 4900 balls we may arrange them in either way
3 251 ... 02
x x− + =
![Page 8: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/8.jpg)
Elliptic curves in Cryptography
• Elliptic Curve (EC) systems as applied to cryptography were first proposed in 1985 independently by Neal Koblitz and Victor Miller.
• The discrete logarithm problem on elliptic curve groups is believed to be more difficult than the corresponding problem in (the multiplicative group of nonzero elements of) the underlying finite field.
![Page 9: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/9.jpg)
Discrete Logarithms in Finite Fields
Alice Bob
Pick secret, random X from F
Pick secret, random Y from F
gy mod p
gx mod p
Compute k=(gy)x=gxy mod p
Compute k=(gx)y=gxy mod p
Eve has to compute gxy from gx and gy without knowing x and y…She faces the Discrete Logarithm Problem in finite fields
F={1,2,3,…,p-1}
![Page 10: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/10.jpg)
Elliptic Curve on a finite set of Integers
• Consider y2 = x3 + 2x + 3 (mod 5)
x = 0 ⇒ y2 = 3 ⇒ no solution (mod 5)
x = 1 ⇒ y2 = 6 = 1 ⇒ y = 1,4 (mod 5)x = 2 ⇒ y2 = 15 = 0 ⇒ y = 0 (mod 5)
x = 3 ⇒ y2 = 36 = 1 ⇒ y = 1,4 (mod 5)x = 4 ⇒ y2 = 75 = 0 ⇒ y = 0 (mod 5)
• Then points on the elliptic curve are(1,1) (1,4) (2,0) (3,1) (3,4) (4,0) and the point at infinity: ∞Using the finite fields we can form an Elliptic Curve Group
where we also have a DLP problem which is harder to solve…
![Page 11: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/11.jpg)
Definition of Elliptic curves• An elliptic curve over a field K is a nonsingular
cubic curve in two variables, f(x,y) =0 with a rational point (which may be a point at infinity).
• The field K is usually taken to be the complex numbers, reals, rationals, algebraic extensions of rationals, p-adic numbers, or a finite field.
• Elliptic curves groups for cryptography are examined with the underlying fields of Fp (where p>3 is a prime) and F2
m (a binary representation with 2m elements).
![Page 12: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/12.jpg)
General form of a EC• An elliptic curve is a plane curve defined by an
equation of the form
baxxy ++= 32
Examples
![Page 13: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/13.jpg)
Weierstrass Equation• A two variable equation F(x,y)=0, forms a curve
in the plane. We are seeking geometric arithmetic methods to find solutions
• Generalized Weierstrass Equation of elliptic curves:
2 2 21 3 2 4 6y a xy a y x a x a x a+ + = + + +
Here, A, B, x and y all belong to a field of say rationalnumbers, complex numbers, finite fields (Fp) or
Galois Fields (GF(2n)).
![Page 14: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/14.jpg)
• If Characteristic field is not 2:
• If Characteristics of field is neither 2 nor 3:
222 3 23 31 1
2 4 6
2 3 ' 2 ' '1 2 4 6
( ) ( ) ( )2 2 4 4
a aa x ay x a x a x a
y x a x a x a
+ + = + + + + +
⇒ = + + +
'1 2
2 31 1 1
/ 3x x a
y x Ax B
= +
⇒ = + +
![Page 15: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/15.jpg)
Points on the Elliptic Curve (EC)• Elliptic Curve over field L
• It is useful to add the point at infinity• The point is sitting at the top of the y-axis
and any line is said to pass through the point when it is vertical
• It is both the top and at the bottom of the y-axis
2 3( ) { } {( , ) | ... ...}E L x y L L y x= ∞ ∪ ∈ × + = +
![Page 16: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/16.jpg)
The Abelian Group
• P + Q = Q + P (commutativity)
• (P + Q) + R = P + (Q + R) (associativity)
• P + O = O + P = P (existence of an identity element)
• there exists ( − P) such that − P + P = P + ( − P) = O (existence of inverses)
Given two points P,Q in E(Fp), there is a third point, denoted by P+Q on E(Fp), and the following relations hold for all P,Q,R in E(Fp)
![Page 17: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/17.jpg)
Elliptic Curve Picture
• Consider elliptic curveE: y2 = x3 - x + 1
• If P1 and P2 are on E, we can define
P3 = P1 + P2as shown in picture
• Addition is all we need
P1P2
P3
x
y
![Page 18: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/18.jpg)
Addition in Affine Co-ordinates
x
y
1 1 2 2
3 3
( , ), ( , )( ) ( , )
P x y Q x yR P Q x y= == + =
y=m(x-x1)+y1
2 1
2 1
2 31 13 2 2
23 1 2
3 1 2 1
;
To find the intersection with E. we get( ( ) )
,0 ...,
( )
y ymx x
m x x y x Ax Bor x m xSo x m x x
y m x x y
−=
−
− + = + +
= − +
= − −⇒ = − −
Let, P≠Q,
y2=x3+Ax+B
![Page 19: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/19.jpg)
Doubling of a point• Let, P=Q
• What happens when P2=∞?
2
21
1
1 1 23 2 2
23 1 3 1 3 1
2 3
32
, 0 (since then P +P = ):0 ...
2 , ( )
dyy x Adx
dy x Amdx y
If yx m x
x m x y m x x y
= +
+⇒ = =
≠ ∞
∴ = − +
⇒ = − = − −
![Page 20: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/20.jpg)
Why do we need the reflection?
P2=O=∞
P1
y
P1=P1+ O=P1
![Page 21: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/21.jpg)
Sum of two points
⎪⎪⎩
⎪⎪⎨
⎧
=+
≠−−
=
211
21
2112
12
_2
3
_
xxfory
ax
xxforxxyy
λ
Define for two points P (x1,y1) and Q (x2,y2) in the Elliptic curve
Then P+Q is given by R(x3,y3) :
1133
213
)( yxxyxxx+−=
−−=λλ
![Page 22: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/22.jpg)
P+P = 2P
Point at infinity O
As a result of the above case P=O+P
O is called the additive identity of the elliptic curve group.
Hence all elliptic curves have an additive identity O.
![Page 23: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/23.jpg)
Projective Co-ordinates• Two-dimensional projective space over K
is given by the equivalence classes of triples (x,y,z) with x,y z in K and at least one of x, y, z nonzero.
• Two triples (x1,y1,z1) and (x2,y2,z2) are said to be equivalent if there exists a non-zero element λ in K, st:– (x1,y1,z1) = (λx2, λy2, λz2)– The equivalence class depends only the ratios
and hence is denoted by (x:y:z)
2KP
![Page 24: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/24.jpg)
Projective Co-ordinates• If z≠0, (x:y:z)=(x/z:y/z:1)• What is z=0? We obtain the point at infinity.• The two dimensional affine plane over K:
2
2 2
{( , ) }Hence using,( , ) ( : :1)
K
K K
A x y K K
x y X YA P
= ∈ ×
→
⇒ =
There are advantages with projective co-ordinates from the implementation point of view
![Page 25: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/25.jpg)
Singularity• For an elliptic curve y2=f(x), define
F(x,y)=y2-F(x). A singularity of the EC is a pt (x0,y0) such that:
0 0 0 0
0 0
0 0
( , ) ( , ) 0
, 2 '( ) 0, ( ) '( ) f has a double root
F Fx y x yx y
or y f xor f x f x
∂ ∂= =
∂ ∂= − ==
∴
It is usual to assume the EC has no singular points
![Page 26: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/26.jpg)
If Characteristics of field is not 3:
1. Hence condition for no singularity is 4A3+27B2≠0
2. Generally, EC curves have no singularity
0 0 0 0
0 0
0 0
2 3
3 2
2
4 2
2 2
2
22
3 2
( , ) ( , ) 0
,2 '( ) 0, ( ) '( ) f has a double root
For double roots,3 0
/ 3.Also, +Bx=0,
09 3
29
23( ) 09
4 27 0
F Fx y x yx y
or y f xor f x f x
y x Ax B
x Ax B x Ax A
x AxA A Bx
AxB
A AB
A B
∂ ∂= =
∂ ∂= − ==
∴
= + +
+ + = + =
⇒ = −
+
⇒ − + =
⇒ =
⇒ + =
⇒ + =
2 3( )y f x x Ax B= = + +
![Page 27: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/27.jpg)
Elliptic Curves in Characteristic 2
• Generalized Equation:
• If a1 is not 0, this reduces to the form:
• If a1 is 0, the reduced form is:
• Note that the form cannot be:
2 3 2y xy x Ax B+ = + +
2 3 21 3 2 4 6y a xy a y x a x a x a+ + = + + +
2 3y Ay x Bx C+ = + +
2 3y x Ax B= + +
![Page 28: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/28.jpg)
Outline of the Talk…• Introduction to Elliptic Curves
• Elliptic Curve Cryptosystems
• Implementation of ECC in Binary Fields
![Page 29: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/29.jpg)
Elliptic Curve Cryptosystems(ECC)
![Page 30: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/30.jpg)
Public-Key Cryptosystems
Secrecy: Only B can Decrypt the message
Authentication: Only A can generate the encrypted message
![Page 31: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/31.jpg)
Public-Key Cryptography
![Page 32: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/32.jpg)
Public-Key Cryptography
![Page 33: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/33.jpg)
What Is Elliptic Curve Cryptography (ECC)?
• Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal.
• Every user has a public and a private key.– Public key is used for encryption/signature
verification.– Private key is used for decryption/signature
generation.• Elliptic curves are used as an extension to other
current cryptosystems.– Elliptic Curve Diffie-Hellman Key Exchange– Elliptic Curve Digital Signature Algorithm
![Page 34: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/34.jpg)
Using Elliptic Curves In Cryptography
• The central part of any cryptosystem involving elliptic curves is the elliptic group.
• All public-key cryptosystems have some underlying mathematical operation.– RSA has exponentiation (raising the message or
ciphertext to the public or private values)– ECC has point multiplication (repeated addition of two
points).
![Page 35: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/35.jpg)
Generic Procedures of ECC• Both parties agree to some publicly-known data items
– The elliptic curve equation• values of a and b• prime, p
– The elliptic group computed from the elliptic curve equation– A base point, B, taken from the elliptic group
• Similar to the generator used in current cryptosystems• Each user generates their public/private key pair
– Private Key = an integer, x, selected from the interval [1, p-1]– Public Key = product, Q, of private key and base point
• (Q = x*B)
![Page 36: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/36.jpg)
Example – Elliptic Curve Cryptosystem Analog to El Gamal
• Suppose Alice wants to send to Bob an encrypted message.– Both agree on a base point, B.– Alice and Bob create public/private keys.
• Alice– Private Key = a– Public Key = PA = a * B
• Bob– Private Key = b– Public Key = PB = b * B
– Alice takes plaintext message, M, and encodes it onto a point, PM, from the elliptic group
![Page 37: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/37.jpg)
Example – Elliptic Curve Cryptosystem Analog to El Gamal– Alice chooses another random integer, k from the
interval [1, p-1]– The ciphertext is a pair of points
• PC = [ (kB), (PM + kPB) ]
– To decrypt, Bob computes the product of the first point from PC and his private key, b
• b * (kB)– Bob then takes this product and subtracts it from the
second point from PC• (PM + kPB) – [b(kB)] = PM + k(bB) – b(kB) = PM
– Bob then decodes PM to get the message, M.
![Page 38: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/38.jpg)
Example – Compare to El Gamal
– The ciphertext is a pair of points • PC = [ (kB), (PM + kPB) ]
– The ciphertext in El Gamal is also a pair.• C = (gk mod p, mPB
k mod p)
--------------------------------------------------------------------------– Bob then takes this product and subtracts it from the
second point from PC• (PM + kPB) – [b(kB)] = PM + k(bB) – b(kB) = PM
– In El Gamal, Bob takes the quotient of the second value and the first value raised to Bob’s private value
• m = mPBk / (gk)b = mgk*b / gk*b = m
![Page 39: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/39.jpg)
Diffie-Hellman (DH) Key Exchange
![Page 40: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/40.jpg)
ECC Diffie-Hellman• Public: Elliptic curve and point B=(x,y) on curve• Secret: Alice’s a and Bob’s b
Alice, A Bob, B
a(x,y)
b(x,y)
• Alice computes a(b(x,y))• Bob computes b(a(x,y))• These are the same since ab = ba
![Page 41: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/41.jpg)
Example – Elliptic Curve Diffie-Hellman Exchange
• Alice and Bob want to agree on a shared key.– Alice and Bob compute their public and private keys.
• Alice» Private Key = a» Public Key = PA = a * B
• Bob» Private Key = b» Public Key = PB = b * B
– Alice and Bob send each other their public keys.– Both take the product of their private key and the other user’s
public key.• Alice KAB = a(bB)• Bob KAB = b(aB)• Shared Secret Key = KAB = abB
![Page 42: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/42.jpg)
Why use ECC?
• How do we analyze Cryptosystems?– How difficult is the underlying problem that it
is based upon• RSA – Integer Factorization• DH – Discrete Logarithms• ECC - Elliptic Curve Discrete Logarithm problem
– How do we measure difficulty?• We examine the algorithms used to solve these
problems
![Page 43: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/43.jpg)
Security of ECC• To protect a 128 bit
AES key it would take a:– RSA Key Size: 3072
bits– ECC Key Size: 256
bits• How do we
strengthen RSA?– Increase the key
length• Impractical?
![Page 44: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/44.jpg)
Applications of ECC• Many devices are small and have limited
storage and computational power• Where can we apply ECC?
– Wireless communication devices– Smart cards– Web servers that need to handle many encryption
sessions– Any application where security is needed but
lacks the power, storage and computational power that is necessary for our current cryptosystems
![Page 45: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/45.jpg)
Benefits of ECC
• Same benefits of the other cryptosystems: confidentiality, integrity, authentication and non-repudiation but…
• Shorter key lengths– Encryption, Decryption and Signature
Verification speed up– Storage and bandwidth savings
![Page 46: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/46.jpg)
Summary of ECC• “Hard problem” analogous to discrete log
– Q=kP, where Q,P belong to a prime curvegiven k,P “easy” to compute Qgiven Q,P “hard” to find k
– known as the elliptic curve logarithm problem• k must be large enough
• ECC security relies on elliptic curve logarithm problem– compared to factoring, can use much smaller key sizes than with RSA
etcfor similar security ECC offers significant
computational advantages
![Page 47: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/47.jpg)
Outline of the Talk…• Introduction to Elliptic Curves
• Elliptic Curve Cryptosystems
• Implementation of ECC in Binary Fields
![Page 48: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/48.jpg)
Implementation of ECC in Binary Fields
![Page 49: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/49.jpg)
Sub-Topics1. Scalar Multiplication: LSB first vs MSB first2. Montgomery Technique of Scalar Multiplication3. Fast Scalar Multiplication without pre-
computation.4. Lopez and Dahab Projective Transformation to
Reduce Inverters5. Mixed Coordinates6. Parallelization Techniques7. Half and Add Technique for Scalar
Multiplication
![Page 50: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/50.jpg)
ECC operations: Hierarchy
ECC
Pointmultiplication:
kP
Group operation: point add/double
Finite field arithmetic: multiplication,addition, subtraction, inversion, …
Parallelize the architectures
Level 0
Level 1
Level 2
Level 3
![Page 51: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/51.jpg)
Scalar Multiplication: MSB first
• Require k=(km-1,km-2,…,k0)2, km=1• Compute Q=kP
– Q=P– For i=m-2 to 0
• Q=2Q• If ki=1 then
– Q=Q+P• End if
– End for– Return Q
Sequential Algorithm
Requires m point doublings and (m-1)/2 point additions on the average
![Page 52: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/52.jpg)
Example
• Compute 7P:– 7=(111)2
– 7P=2(2(P)+P)+P=> 2 iterations are required– Principle: First double and then add
(accumulate)• Compute 6P:
– 6=(110)2
– 6P=2(2(P)+P)
![Page 53: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/53.jpg)
Scalar Multiplication: LSB first
• Require k=(km-1,km-2,…,k0)2, km=1• Compute Q=kP
– Q=0, R=P– For i=0 to m-1
• If ki=1 then– Q=Q+R
• End if• R=2R
– End for– Return Q
Can Parallelize…
What you are doubling and what you are accumulating are different…
On the average m/2 point Additions and m/2 point doublings
![Page 54: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/54.jpg)
Example
• Compute 7P, 7=(111)2, Q=0, R=P– Q=Q+R=0+P=P, R=2R=2P– Q=P+2P=3P, R=4P– Q=7P, R=8P
• Compute 6P, 6=(110)2, Q=0, R=P– Q=0, R=2R=2P– Q=0+2P=2P, R=4P– Q=2P+4P=6P, R=8P
![Page 55: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/55.jpg)
Compute 31P…
1. Q=2P2. Q=3P3. Q=6P4. Q=7P5. Q=14P6. Q=15P7. Q=30P8. Q=31P
1. Q=P, R=2P2. Q=3P, R=4P3. Q=7P, R=8P4. Q=15P, R=16P5. Q=31P, R=32P
31=(11111)2MSB First LSB First
![Page 56: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/56.jpg)
Weierstrass Point Addition
• Let, P=(x1,y1) be a point on the curve. • -P=(x1,x1+y1)• Let, R=P+Q=(x3,y3)
2 3 2 , ( , ) (2 ) (2 )m my xy x ax b x y GF GF+ = + + ∈ ×
2
1 2 1 21 2
1 2 1 2
3 21 2
1
1 21 3 3 1
1 2
3 2 11 1 3 3
1
;
;
( ) ;
( ) ;
y y y y x x a P Qx x x x
x bx P Qx
y y x x x y P Qx x
y yx x x x P Qx
⎧⎛ ⎞+ +⎪ + + + + ≠⎜ ⎟+ +⎪⎝ ⎠⎪= ⎨
+ =⎪⎪⎪⎩⎧⎛ ⎞+
+ + + ≠⎪⎜ ⎟+⎝ ⎠⎪⎪= ⎨+ + + =⎪
⎪⎪⎩
1. Point addition and doubling each require 1 inversion & 2 multiplications
2. We neglect the costs of squaring and addition
3. Montgomery noticed that the x-coordinate of 2P does not depend on the y-coordinate of P
![Page 57: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/57.jpg)
Montgomery’s method to perform scalar multiplication
• Input: k>0, P• Output: Q=kP1. Set k<-(kl-1,…,k1,k0)2
2. Set P1=P, P2=2P3. For i from l-2 to 0
If ki=1, Set P1=P1+P2, P2=2P2
else Set P2=P2+P1, P1=2P1
4. Return Q=P1
Invariant Property:P=P2-P1
Question: How to implement the Operation efficiently?
![Page 58: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/58.jpg)
ExampleCompute 7P• 7=(111)2
• Initialization: P1=P; P2=2P
• Steps:– P1=3P, P2=4P– P1=7P, P2=8P
Compute 6P• 7=(110)2
• Initialization: P1=P; P2=2P
• Steps:– P1=3P, P2=4P– P2=7P, P1=6P
![Page 59: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/59.jpg)
Fast Multiplication on EC without pre-computation
![Page 60: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/60.jpg)
Result-1• Let P1 = (x1,y1) and P2=(x2,y2) be elliptic points.
Then the x-coordinate of P1+P2, x3 can be computed as:
2 21 2 2 1 1 2 2 1
3 21 2( )
x y x y x x x xxx x
+ + +=
+
Hint: Remember that the field has a characteristic 2 and that P1 and P2 are points on the curve
![Page 61: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/61.jpg)
Result-2• Let P=(x,y), P1 = (x1,y1) and P2=(x2,y2) be
elliptic points. Let P=P2-P1 be an invariant.Then the x-coordinate of P1+P2, x3 can be computed in terms of the x-coordinatesas:
2
1 11 2
1 2 1 2
3 21 1 22
1
;
;
x xx P Px x x x
x bx P Px
⎧ ⎛ ⎞⎪ + + ≠⎜ ⎟+ +⎪ ⎝ ⎠⎪= ⎨
+ =⎪⎪⎪⎩
![Page 62: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/62.jpg)
Result-3Let P=(x,y), P1=(x1,y1) and P2=(x2,y2) be
elliptic points. Assume that P2-P1=P and x is not 0. Then the y-coordinates of P1 can be expressed in terms of P, and the x-coordinates of P1 and P2 as follows:
21 1 1 2( ){( )( ) }/y x x x x x x x y x y= + + + + + +
![Page 63: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/63.jpg)
Final AlgorithmInput: k>0, P=(x,y)Output: Q=kP1. If k=0 or x=0 then output(0,0)2. Set k = (kl-1,kl-2,…,k0)23. Set x1=x, x2=x2+b/x2
4. For i from l-2 to 01. Set t=x1/(x1+x2)2. If ki=1,
x1=x+t2+t, x2=x22+b/x2
2
else x1=x1
2+b/x12, x2=x+t2+t
5. r1=x1+x, r2=x2+x6. y1=r1(r1r2+x2+y)/x+y7. Return Q=(x1,y1)
• #INV:2(l-2)+1;• #MULT: 2(l-2)+4• #ADD: 4(l-2)+6• #SQR: 2(l-2)+2
![Page 64: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/64.jpg)
How to reduce inversions?1. In affine coordinates Inverses are very
expensive2. For each inversion requires around 7
multipliers (in hardware designs)3. Lopez Dahab Projective coordinates:
• (X,Y,Z), Z≠0, maps to (X/Z,Y/Z2)• Motivation is to replace inversions by the
multiplication operations and then perform one inversion at the end (to obtain back the affine coordinates)
128n≥
![Page 65: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/65.jpg)
Doubling• Remember:
• In Projective Coordinates:
2
1 11 2
1 2 1 2
3 21 1 22
1
;
;
x xx P Px x x x
x bx P Px
⎧ ⎛ ⎞⎪ + + ≠⎜ ⎟+ +⎪ ⎝ ⎠⎪= ⎨
+ =⎪⎪⎪⎩
4 41 2 3 1 1
2 23 1 1
21 2 3 1 2 2 1
3 3 1 2 2 1
, .
.
, ( . . ) . ( . ).( . )
P P X X b Z
Z Z X
P P Z X Z X ZX x Z X Z X Z
= = +
=
≠ = += +
• 2 inverses• 1 general field
multiplication• 4 additions• 2 squarings
• 0 inverses• 4 general field
multiplications• 3 additions• 5 squarings
![Page 66: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/66.jpg)
Montgomery Algorithm• Input: k>0, P=(x,y)• Output: Q=kP• Set k<-(kl-1,…,k1,k0)2
• Set X1=x, Z1=1; X2=x4+b, Z2=x2
• For i from l-2 to 0 – If ki =1,
Madd(X1,Z1,X2,Z2), Mdouble(X2,Z2)else
Madd(X2,Z2,X1,Z1), Mdouble(X1,Z1)• Return Q=(Mxy(X1,Y1,X2,Y2))
![Page 67: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/67.jpg)
Mxy: Projective to Affine3 1 1
2 13 1 1 1 1 2 2 1 2 1 2
/
( / )[( )( ) ( )( )]( )
x X Z
y x X Z X xZ X xZ x y Z Z xZ Z y−
=
= + + + + + +
Requires 10 multiplications and one inverse operation
![Page 68: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/68.jpg)
Final ComparisonAffine Coordinates
Inv: 2logk + 1Mult: 2logk + 4Add: 4logk + 6Sqr: 2logk + 2
Projective Coordinates
Inv: 1Mult: 6logk + 10Add: 3logk + 7Sqr: 5logk + 3
Hence, final decision depends upon the I:M ratio of the finite field operators
![Page 69: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/69.jpg)
Addition in Mixed Coordinates
• Theorem: Let P1=(X1/Z1,Y1/Z12) and
P2=(X2/Z2,Y2/Z22) be two points on the curve.
If Z1=1, then P1+P2=(X3/Z3,Y3/Z32) st.
Number of multiplications are further reduced.Squaring is increased a bit, but they are cheap in GF(2n)
Improvement by 10 % if a≠0, otherwise 12 %...
2 22 1 2 2 1 2 2 3
2 23 1 3
23 3 3 3
, , , ,
, ( ),
( )( )
U Z Y Y S Z X X T Z S Z T
V Z X X U T U S Ta
Y V X TU Z Z C
= + = + = =
= = + + +
= + + +
![Page 70: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/70.jpg)
Parallel Strategies for Scalar Point Multiplication
• Point Doubling– Cycle 1: T=X1
2, M=cZ12, Z2=T.Z1
2
– Cycle 1a: X2=T2+M2
• Point Addition– Cycle 1: t1=(X1.Z2); t2=(Z1.X2)– Cycle 1a: M=(t1+t2), Z1=M2
– Cycle 2: N=t1.t2, M=xZ1
– Cycle 2a: X1=M+N
1 multiplier
2 multipliers
We assume that squarings and multiplications with constants can be performed without multipliers…
![Page 71: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/71.jpg)
Parallelizing Montgomery Algorithm
1. Input: k>0, P=(x,y)2. Output: Q=kP3. Set k<-(kl-1,…,k1,k0)2
4. Set X1=x, Z1=1; X2=x4+b, Z2=x2
5. For i from l-2 to 0 If ki =1, 5a) Madd(X1,Z1,X2,Z2), Mdouble(X2,Z2)else
5b) Madd(X2,Z2,X1,Z1), Mdouble(X1,Z1)6. Return Q=(Mxy(X1,Y1,X2,Y2))
![Page 72: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/72.jpg)
Looking back at our Design Hierarchy
ECC
Pointmultiplication:
kP
Group operation: point add/double
Finite field arithmetic: multiplication,addition, subtraction, inversion, …
Parallelize the architectures
Level 0
Level 1
Level 2
Level 3
![Page 73: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/73.jpg)
Parallelizing Strategies• Parallelize level 1: If we allocate one multiplier
to each of Madd and Mdouble, then we can parallelize steps 5a and 5b. Thus 4 clock cycles are required for each iteration. Total time is nearly 4l.
• Parallelize level 2: If we can parallelize the underlying Madd and Mdouble, then we cannot parallelize level 1, if we have constraint of 2 multipliers. So, we have a sequential step 5a and 5b. Total time is 3l.
![Page 74: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/74.jpg)
Parallelizing Strategies
• Parallelize both the levels: Total time is 2l clock cycles. Require 3 multipliers.
• Thus Montgomery algorithm is highly parallelizable
• Helpful in high performance designs (low power, high thoughput etc)
![Page 75: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/75.jpg)
Point Halving
• In 1999 Scroeppel and Knudsen proposed further speed up
• Idea is to replace point doubling by halving• Point Halving is three times as fast than
doubling• The scalar k, has to be expressed in the
negative powers of 2
![Page 76: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/76.jpg)
Computing the Half• Problem: Let E be the Elliptic Curve, defined
by the equation: • Let Q=(u,v)=2P• Compute P=(x,y)• Remember :
2 3 2 , 0y xy x ax b b+ = + + ≠
22
2 ( )
bu xx
yv x x u ux
= +
= + + +
![Page 77: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/77.jpg)
Halving (contd.)
• Thus, we have to solve the above equations
• λ-representation: (x, λx)
2
2
,
( 1) ( 1)
:
yLet xx
v x u x v u
Note u a
λ
λ λ
λ λ
= +
∴ = + + ⇒ = + +
+ = +
Square Root
Solving Quadratics
![Page 78: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/78.jpg)
Trace of a point
• Define:• Properties of Trace:
– Tr(c)=Tr(c2)=Tr(c)2, Tr(c) can be 0 or 1– Tr(c+d)=Tr(c)+Tr(d)– NIST Curves : Tr(a)=1– If x,y belongs to the Elliptic Curve, Tr(x)=Tr(a)
12 2( ) ...m
Tr C C C C−
= + + +
![Page 79: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/79.jpg)
Computing λ• The roots of are λ1= λ or λ+1• Theorem:
2 u aλ λ+ = +
2
Let, ( , ), ( , ) , . 2 ˆand denote / . Let be a solution ˆto and . Suppose that
ˆ( ) 1. Then if and only if ( ) 0.
P x y Q u v G st Q P
x y x
u a t v u
Tr a Tr t
λ λ
λ λ λ
λ λ
= = ∈ =
= +
+ = + = +
= = =
![Page 80: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/80.jpg)
Halving Algorithm• Input: (u,v) , Output: (x,y)1. Solve for λ. Let the root be 2. Compute 3. If Tr(t)=0, then λP= , x=(t+u)1/2
else λP= +1,x=(t)1/2
4. Return (x,λP)
2 u aλ λ+ = + λ̂
ˆt v uλ= +
λ̂
λ̂
![Page 81: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/81.jpg)
Implementation of Trace• Trace :
• Can be evaluated in O(1) time• Example: GF(2163), with reduction polynomial
p(x)=x163+x7+x6+x3+1, Tr(xi)=1, iff i=0 or 159.• Thus, the implementation is only one xor gate
to add the 0th and the 159th bits of the register storing C.
1 1
0 0( ) ( ) ( )
m mi i
i ii i
Tr C Tr c x c Tr x− −
= =
= =∑ ∑
![Page 82: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/82.jpg)
Solving a Quadratic over GF(2m)
• Solve x2+x=c+Tr(c), c is an element of GF(2m)• Define Half Trace:
2( 1) / 2
2
0
2
2
( )
1. ( ) ( ) ( )2. ( ) is a root for ( ), as ( ) ( ) ( )
im
iH C C
H C D H C H DH C x x C Tr CH C H C C Tr C
−
=
=
+ = +
+ = +
= + +
∑
H(C) gives a root for the quadratic equation. A simple method to find H(C) requires storage for m elements and m/2 field additions on an average
![Page 83: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/83.jpg)
Obtaining Square Root• Field squaring in binary field is linear• Hence squaring can be rephrased as:
– C=MA=A2
• We require to compute D st. D2=A• Let, D=M-1A=> A=MD• D2=MD (as M is the squaring matrix)
=M(M-1A)=A• Hence, D=(A)1/2
![Page 84: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/84.jpg)
An Example7 7
10 12
9 8 6 2
7
7 7
7 7 7
Compute: 763R , where order of R 101310
2 (763) 651(mod 1013) (1010001011)1 1 1 1763 ( 1) mod(1013)2 2 2 2
763 may be computed using the following steps:1Step 1: 21 1Step 2: ( )2 2
m
R
R R
R R R
−
=⇒ =
= =
∴ = + + + +
∴
+
+ +
Step 3: Similarly continue...
![Page 85: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/85.jpg)
Half and Add Algorithm1. Input: 0<k<n, P=(x,y)2. Output: Q=kP3. Compute: , k1=(2t-1k)mod n4. Q=O5. for i=0 to m-1 do
1. Q=[1/2]Q2. If, k1
i=1, then Q=Q+P
6. return Q
2t= log 1n +⎢ ⎥⎣ ⎦
No method is currently known to perform point halving in projective Coordinates. Keep Q in affine coordinates and P in Projective Coordinates. Then step 5.2 is a mixed operation, giving further efficiency.
![Page 86: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/86.jpg)
Key References• Papers:
– J. Lopez and R. Dahab, “Fast Multiplication on Elliptic Curves over GF(2m) without pre-computation”, CHES 1999
– K. Fong etal, “Field Inversion and Point Halving Revisited”, IEEE Trans on Comp, 2004
– G. Orlando and C. Paar, “A High Performance Reconfigurable Elliptic Curve Processor for GF(2m)”, CHES 2000
– N. A. Saqib etal, “A Parallel Architecture for Fast Computation of Elliptic Curve Scalar Multiplication over GF(2m)”, Elsevier Journal of Microprocessors and Microsystems, 2004
– Sabiel Mercurio etal, “ An FPGA Arithmetic Logic Unit for Computing Scalar Multiplication using the Half-and-Add Method”, IEEE ReConfig 2005
![Page 87: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/87.jpg)
Key References
• Books:– Elliptic Curves: Number Theory and
Cryptography, by Lawrence C. Washington – Guide to Elliptic Curve Cryptography, Alfred J.
Menezes– Guide to Elliptic Curve Cryptography, Darrel
R. Hankerson, A. Menezes and A. Vanstone– http://cr.yp.to/ecdh.html ( Daniel Bernstein)
![Page 88: Elliptic Curve Cryptographycse.iitkgp.ac.in/~debdeep/pres/TI/ecc.pdf · • Elliptic curve cryptography [ECC] is a public-key cryptosystem just like RSA, Rabin, and El Gamal. •](https://reader030.vdocument.in/reader030/viewer/2022040215/5ed927116714ca7f47693e82/html5/thumbnails/88.jpg)
Thank You