Loading in 5 sec....

Security of Using Special Integers in Elliptic Scalar MultiplicationPowerPoint Presentation

Security of Using Special Integers in Elliptic Scalar Multiplication

Download Presentation

Security of Using Special Integers in Elliptic Scalar Multiplication

Loading in 2 Seconds...

- 65 Views
- Uploaded on
- Presentation posted in: General

Security of Using Special Integers in Elliptic Scalar Multiplication

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Security of Using Special Integers in Elliptic Scalar Multiplication

Mun-Kyu Leeo Jin Wook Kim Kunsoo Park

School of CSE, Seoul National University

1. Preliminaries

- A curve of the form
y2 + xy = x3 + ax2 + b

or

y2 = x3 + ax + b

- There are many cryptosystems that use elliptic curve operations.

- Point Addition: R = P +Q
- First, draw theline through P and Q.
- Then this line intersectsthe elliptic curvein a third point.
- Define R = P +Q(the sum of P and Q)as the reflection ofthis point in the x-axis.

- Point Doubling: R = 2P
- First, draw the tangent lineto the curve at P.
- Then this line intersectsthe curve ina second point.
- Define R = 2P(the double of P)as the reflection ofthis point in the x-axis.

- Scalar Multiplication kP
- For a nonnegative integer k and a point P,scalar multiplication kP is defined as
- 0P = O,for k = 0, where O is the “point at infinity”which is the additive identity element.
- kP = (k-1)P + P for k > 0.

- For a nonnegative integer k and a point P,scalar multiplication kP is defined as

- Elliptic Curve Discrete Log Problem
- Given two points P and Q on an elliptic curve,
- ECDLP is to find k such that kP = Q

Scalar Multiplication

k, P

Q = kP

Efficient

ECDLP

P, Q

k s.t. Q = kP

- Computationally infeasible

- Hence, security of elliptic curve based cryptosystems is based on this problem.

- is to develop a technique to find harder instances of ECDLP,while keeping the efficiency of a scalar multiplication as the same level.

2. Previous Results:Efficient Scalar Mult. Algos.

- To compute Q = kP,
- represent k as a binary form.
- scan each bit of k from left to right.
- if the bit is 1, do a doubling and an addition.if the bit is 0, do a doubling only.

- Example: 61P = (1, 1, 1, 1, 0, 1)(2)P

1

1

1

1

0

1

DBL

DBL

1

10

110

1110

11110

111100

P

2P

6P

14P

30P

60P

DBL

DBL

DBL

ADD P

ADD P

ADD P

ADD P

3P

7P

15P

Q = 61P

11

111

1111

111101

- Complexity
- log k doublings and
- HW(k)-1 additions,where HW(k) is the Hamming weight of k,i.e., the number of 1’s in the binary representation of k.

- [Morain, Olivos 90]
- Use the following facts.
- For a point P on an elliptic curve, computation of an additive inverse –P is almost free.
- For example,on y2 = x3 + ax + b,–P is the reflection of Pin the x-axis.

- Hence, a subtraction P - Q has the same complexity as that of an addition P +Q.

- For a point P on an elliptic curve, computation of an additive inverse –P is almost free.

P = (x, y)

-P = (x, -y)

- To compute Q = kP,
- convert k to a signed binary representation k’ with smaller number of nonzero digits than k.
- if a digit is 1, do a doubling and an addition.if a digit is –1, do a doubling and a subtraction.if a digit is 0, do a doubling only.

- Example: 61P = (26 - 22 +1)P = (1, 0, 0, 0,-1, 0, 1)P

-1

1

0

0

0

0

1

DBL

DBL

DBL

DBL

DBL

1

10

100

1000

10000

100010

1000100

P

2P

4P

8P

16P

30P

60P

SUB

ADD

DBL

15P

Q = 61P

1000101

10001

- Complexity
- log k doublings and
- SHW(k)-1 additions/subtractions,where SHW(k) is the signed Hamming weight of k, i.e., the number of nonzeros in the signed binary representation of k.

- In many elliptic curve based systems, we compute kP for a randomly chosen k.
- [Agnew, Mullin, Vanstone 93]
- Choose special k’s that have small HW(k) to reduce the number of additions.
- Specifically, generate random k’s of length m in a binary form s.t. HW(k) = w for a fixed small w.
- One can control the Hamming weight, and thus the number of additions.

- Example: m = 8, w = 3
0. Initially, there are 8 empty bits.

1. Choose 3 random positions for ‘1’.

2. Set them as ‘1’ and others as ‘0’.

For kP, we need 7 doublings and 2 additions.

k = (1, 0, 1, 0, 0, 0, 0, 1)

3. Proposed Method

- Use special k’s
- Generate random k’s that have small SHW(k).
- Specifically, generate random k’s of length m in a signed binary form s.t. SHW(k) = w for a fixed small w.

- More secure than the AMV selection method, i.e., random selection of k’s with HW(k)=w.
- (Recall that an ECDLP is to find k such that kP = Q.)
- The number of possible k’s in our method is much larger,
- while the amount of computation is the same,i.e., m-1 doublings and w-1 additions/subtractions,in both of the methods.

- In order to generate a random k of length m s.t. SHW(k) = w,
- randomly select w locations for nonzero digits out of m possible digits of k,
- and then assign ‘1’ or ‘-1’ to each of these digits randomly.

- Problem
- k’s are not unique.
- Hence, the search space for k is much smaller than what we have intended.

- Example: m = 6, w = 3
- (1,0,0,1,0,-1) = (1,0,0,0,1,1) = 35

- k’s are not unique.

- select k’s in the nonadjacent form (NAF).
- NAF is a signed binary representation with the property that no two consecutive digits are nonzero.
- A number’s NAF is unique.

35

possible representations

in NAF

not in NAF

(1, 0, 0, 1, 0,-1)

(1, 0, 0, 0, 1, 1)

- Now, we want to generate a random k of length min NAF s.t. SHW(k) = w to guarantee the uniqueness of k.
- To satisfy the NAF property, we use ‘10’ and ‘-10’ as single nonzero units instead of ‘1’ and ‘-1’.
- The algorithm has six steps.

- Initially there is an array of m-w+1 consecutive empty slots.

Example: m = 8, w = 3

(m -w +1 = 6)

- Assign two-digit binary number 10 to the first slot to guarantee that k > 0 and that k has exactlym digits.

Example: m = 8, w = 3

10

- Choose w - 1 random slots out of the remaining m – w slots and assign10 or –10 randomly to each of them.

Example: m = 8, w = 3

(w -1 = 2, m -w = 5)

10

-10

10

- Assign 0 to each remaining slot.

Example: m = 8, w = 3

10

0

-10

0

0

10

- Concatenate all slots to get a number k with m +1 signed binary digits.
- Note that, for now, k is always even.

Example: m = 8, w = 3

10

0

-10

0

0

10

(1, 0, 0,-1, 0, 0, 0, 1, 0)

9 digits

- Set k = k / 2

Example: m = 8, w = 3

(1, 0, 0,-1, 0, 0, 0, 1, 0)

k = (1, 0, 0,-1, 0, 0, 0, 1)

8 digits

For kP, we need 7 DBLs and 2 ADD/SUBs.

- k’s generated by this algorithm are unique.
- k’s generated by this algorithm form a uniform distribution of k’s thathave m digits and satisfy SHW(k) = w.

4. Security Analysis

- With k’s of special forms, the best possible attack algorithm against the ECDLP is the baby-step giant-step algorithm, which is a time-memory trade-off version of the exhaustive search.
- Hence, k’s with larger search space is more secure against this attack.
- Now we compare the size of the search space of our method with that of the AMV method.

AMV

Our Method

# digits

m

m

# nonzeros

w

w

complexity ofa scalar mult.

m-1 DBLsw-1 ADDs

m-1 DBLsw-1 ADD/SUBs

sizes of

search spaces

- The size of the search space of our method is much larger.
- Our method is expected to be more secure.