Elliptic Curve Cryptography

➢ majority of public-key crypto (RSA, D-H)

use either integer or polynomial arithmetic
with very large numbers/polynomials
➢ imposes a significant load in storing and
processing keys and messages
➢ an alternative is to use elliptic curves
➢ offers same security with smaller bit sizes
➢ newer, but not as well analysed
 Introduction
 What are Elliptic Curves?
 An elliptic curve is defined by an equation in two variables
x & y, with coefficients
 Curve with standard form over real numbers includes all
points that satisfy y2 = x3 + ax + b a, b ϵ ℝ
where 4a3 + 27b2 ≠ 0
 This EC also includes the “point at infinity” denoted O

 Characteristics of Elliptic Curve

 Forms an abelian group
 Symmetric about the x-axis
 Point at Infinity acting as the identity element
Examples of Elliptic Curves
 Finite Fields

 aka Galois Field

 GF(pn) = a set of integers {0, 1, 2, …, pn -1)

where p is a prime, n is a positive integer

 It is denoted by {F, +, x}
where + and x are the group operators
Group, Ring, Field
Why Elliptic Curve Cryptography?

 Shorter Key Length

 Lesser Computational Complexity

 Low Power Requirement

 More Secure
 Comparable Key Sizes for
Equivalent Security
Symmetric Encryption RSA and Diffie-Hellman ECC Key Size
(Key Size in bits) (modulus size in bits) in bits

56 512 112

80 1024 160

112 2048 224

128 3072 256

192 7680 384

256 15360 512

Implementing Group Operations
 Main operations
- point addition and
- point multiplication
 Adding two points that lie on an Elliptic Curve – results in a
third point on the curve, geometrically sum of P+Q is reflection
of the intersection R

 Point multiplication is repeated addition

 If P is a known point on the curve (aka Base point; part of
domain parameters) and it is multiplied by a scalar k, Q=kP
is the operation of adding P + P + P + P… +P (k times)
 Q is the resulting public key and k is the private key in the
public-private key pair
Unary Negation and Point Addition

 If P = (x, y), then –P = (x, -y)

 To add points P = (x1, y1) and Q = (x2, y2),
draw a straight line connecting them. Let
the (third) point of intersection between
this line and the EC be (x3, -y3) . Then (x3,
y3) is the sum of P and Q
Co-ordinates of P + Q
 Let P = (x1, y1) and Q = (x2, y2)
 Let R ≡ (x3, y3) = P + Q. It can be
shown that
x3 = s2 - x1 - x2
y3 = -y1 + s(x1 - x3)
where s = (y2 - y1 ) / (x2 - x1 )
Real Elliptic Curve Example
 What is Elliptic Curve Cryptography?

 Adding two points on the curve

 P and Q are added to obtain P+Q which
is a reflection of R along the X axis
Doubling a point
 To double a point, P, draw a tangent at
P. Let the co-ordinates of the point of
intersection between the tangent and
the EC be (x2, -y2)
Then 2*P = (x2, y2)
Co-ordinates of 2*P
 x2 = ((3x12 + a) / 2y1)2 – 2x1
 y2 = ((3x12 + a) / 2y1)(x1 – x2) – y1

 Check that the points on the EC form a

group
 What is Elliptic Curve Cryptography?

 A tangent at P is extended to cut the curve at a point;

its reflection is 2P
 Adding P and 2P gives 3P
 Similarly, such operations can be performed as many
times as desired to obtain Q = kP
 Finite Elliptic Curves
➢ Elliptic curve cryptography usescurves
whose variables & coefficients are finite
➢ have two families commonly used:
⚫ prime curves Ep(a,b) defined over Zp
•use integers modulo a prime
•best in software
⚫ binary curves E2m(a,b) defined over GF(2n)
•use polynomials with binary coefficients
•best in hardware
EC over Zp
 Formulas for addition are similar to those for
ECs over reals but all the operations
including inverses are modulo p
 Equation of the EC is
y2 = x3 + ax + b mod p
where 4a3 + 27b2 = 0 mod p
 # of points on the EC is O(p)
EC over GF(2m)
 Equation of the EC is
y2 + xy = x3 + ax2 + b
 All variables and coefficients in above
equation are elements of GF(2m) and
calculations are performed in GF(2m)
What is Elliptic Curve Cryptography?
 Discrete Log Problem
 The security of ECC is due the intractability or difficulty of
solving the inverse operation of finding k given Q and P
 This is termed as the discrete log problem
 Methods to solve include brute force and Pollard’s Rho
attack both of which are computationally expensive or
unfeasible
 The version applicable in ECC is called the Elliptic Curve
Discrete Log Problem
 Exponential running time
 ECC Encryption/Decryption
➢ several alternatives, will consider simplest
➢ must first encode any message M as a point on
the elliptic curve Pm
➢ select suitable curve & point G as in D-H
➢ each user chooses private key nA<n
➢ and computes public key PA=nAG
➢ to encrypt Pm : Cm={kG, Pm+kPb}, k random
➢ decrypt Cm compute:
Pm+kPb–nB(kG) = Pm+k(nBG)–nB(kG) = Pm
 ECC in Windows DRM v2.0
A Practical Example :

Finite field chosen

p = 785963102379428822376694789446897396207498568951

Gx = 771507216262649826170648268565579889907769254176
Gy = 390157510246556628525279459266514995562533196655

y2 = x3 + 317689081251325503476317476413827693272746955927x +
790528966078787587181205720257185354321100651934

Gx and Gy constitute the agreed upon base point (P) and the numbers in
the above equation are values for the parameters a and b
 ECC Security
➢ relies on elliptic curve logarithm problem
➢ fastest method is “Pollard rho method”
➢ compared to factoring, can use much
smaller key sizes than with RSA etc
➢ for equivalent key lengths computations
are roughly equivalent
➢ hence for similar security ECC offers
significant computational advantages
 Elliptic Curve Schemes

 Elliptic Curve Digital Signature Algorithm

(ECDSA)

 Elliptic Curve Pintsov Vanstone

Signature(ECPVS)

 Elliptic Curve Diffie-Hellman (ECDH)

 Elliptic Curve Digital Signature
Algorithm (ECDSA)
 Elliptic curve variant of Digital Signature
Algorithm

Canadian postage stamp that uses ECDSA

 ECDSA
 Signature Generation

Once we have the domain parameters and have decided on

the keys to be used, the signature is generated by the
following steps.

1. A random number k, 1 ≤ k ≤ n-1 is chosen

2. kG = (x1,y1) is computed. x1 is converted to its
corresponding integer x1’
3. Next, r = x1 mod n is computed
4. We then compute k-1 mod q
5. e = HASH(m) where m is the message to be signed
6. s = k-1(e + dr) mod n
where d is the private key of the sender.

We have the signature as (r,s)

 ECDSA
 Signature Verification

At the receiver’s end the signature is verified as follows:

1. Verify whether r and s belong to the interval [1, n-1] for the signature to be valid.
2. Compute e = HASH(m). The hash function should be the same as the one used for
signature generation.
3. Compute w = s -1 mod n.
4. Compute u1 = ew mod n and u2 = rw mod n.
5. Compute (x1,y1) = u1G + u2Q.
6. The signature is valid if r = x1 mod n, invalid otherwise.

This is how we know that the verification works the way we want it to:

We have, s = k-1(e + dr) mod n which we can rearrange to obtain, k = s -1(e + dr) which is
s-1e + s-1rd

This is nothing but we + wrd = (u1 + u2d) (mod n)

We have u1G + u2Q = (u1 + u2d)G = kG which translates to v = r.

Elliptic Curve Pintsov Vanstone
Signature (ECPVS)

 Signature scheme using Elliptic Curves

 More efficient than RSA as overhead is

extremely low
 ECPVS
 Signature Generation

The plaintext message is split into two parts: part C representing the data
elements requiring confidentiality and part V representing the data elements
presented in plaintext. Both the parts are signed. The signature is generated
as follows:

1. A random number k, 1 ≤ k ≤ n-1 is chosen.

2. Calculate the point R on the curve (R = kG).
3. Use point R and a symmetric encryption algorithm to get e = TR(C).
4. Calculate a variable d such that d = HASH(e || IA || V)
where IA is the identity of the mailer terminal.
5. Now calculate the other part of the signature s as follows: s= ad + k(mod
n); where a is the private key of the sender.

The signature pair (s,e) is transmitted together with the portion V of the
plaintext.
 ECPVS
 Signature Verification

1. Retrieve QA (QA is mailer A’s public key)

2. Calculate the variable d = HASH(e || IA || V) using the
same HASH algorithm as the one used for generating
the signature.
3. Compute U = sG – dQA.
4. Recover C = Tu-1(e).
5. Run a redundancy test on C. If the test fails, discard the
message. Else, the plaintext is recovered.
We have, s = ad + k. Multiply by base point G to obtain sG =
adG + kG which is dQA + R
Therefore, R = sG – dQA which is U. Comparing the
decrypted versions, m and m’ obtained using U and R,
we ascertain the validity of the signature
 Elliptic Curve Diffie-Hellman
(ECDH)

 Elliptic curve variant of the key exchange

Diffie-Hellman protocol.

 Decide on domain parameters and come

up with a Public/Private key pair

 To obtain the private key, the attacker

needs to solve the discrete log problem
 ECDH
 How the key exchange takes place:

1. Alice and Bob publicly agree on an elliptic curve E

over a large finite field F and a point P on that curve.
2. Alice and Bob each privately choose large random
integers, denoted a and b
3. Using elliptic curve point-addition, Alice computes
aP on E and sends it to Bob. Bob computes bP on E
and sends it to Alice.
4. Both Alice and Bob can now compute the point
abP Alice by multiplying the received value of bP by
her secret number a and Bob vice-versa.
5. Alice and Bob agree that the x coordinate of this
point will be their shared secret value.
 ECC Diffie-Hellman
➢ can do key exchange analogous to D-H
➢ users select a suitable curve Eq(a,b)
➢ select base point G=(x1,y1)
⚫ with large order n s.t. nG=O
➢A& B select private keys nA<n, nB<n
➢ compute public keys: PA=nAG, PB=nBG
➢ compute shared key: K=nAPB, K=nBPA
⚫ same since K=nAnBG
➢ attacker would need to find k, hard
 Pros and Cons
 Pros
 Shorter Key Length
○ Same level of security as RSA achieved at a much shorter
key length
 Better Security
○ Secure because of the ECDLP
○ Higher security per key-bit than RSA
 Higher Performance
○ Shorter key-length ensures lesser power requirement –
suitable in wireless sensor applications and low power
devices
○ More computation per bit but overall lesser computational
expense or complexity due to lesser number of key bits
 Pros and Cons
 Cons
 Relatively newer field
○ Idea prevails that all the aspects of the topic may not
have been explored yet – possibly unknown
vulnerabilities
○ Doesn’t have widespread usage
 Not perfect
○ Attacks still exist that can solve ECC (112 bit key length
has been publicly broken)
○ Well known attacks are the Pollard’s Rho attack
(complexity O(√n) ), Pohlig’s attack, Baby Step,Giant
Step etc