An x-Coordinate Point Compression Method for Elliptic Curves over Fp 2019/7/17 An x-Coordinate Point Compression Method for Elliptic Curves over Fp Author: Alina Dudeanu, George-Razvan Oancea, Sorin Iftene Publisher: IEEE, 12th International Symposium on Symbolic and Numeric Algorithms for Scientific Computing, 2010 Presenter: 柯懷貿 Date: 2019/04/17 Department of Computer Science and Information Engineering National Cheng Kung University, Taiwan R.O.C. 1 CSIE CIAL Lab

Background Usually, a point P on an elliptic curve over a finite field Fq, is represented by its affine coordinates (Xp , Yp ), thus requiring at most dlog2 bits for its representation. The main idea of point compression is to solve EC equation from when X or Y is known. The classical y-coordinate point compression needs , and the extra bit is used to identify correct value as have two roots. National Cheng Kung University CSIE Computer & Internet Architecture Lab

Quadratic Residue If there exists X such that , we , we call d is p’s quadratic residue. For determining if an integer is a quadratic residue, we use following formulas: 1. Fermat‘s little theorem : → 2. Euler‘s Criterion : Since a = X^2, a^((p-1)/2) ≡ X^(p-1) ≡ 1 (mod p is odd), vice versa. We can solve modular quadratic equation by finding square root of a. National Cheng Kung University CSIE Computer & Internet Architecture Lab

Tonelli–Shanks Algorithm Find s, t such that p-1 = t*(2^s), and a random number d, which is not a quadratic residue. (d^((p-1)/2) = -1) Let b = a^((t+1)/2), r = a^t, c = d^t, and we know r^(2^s) = (a^t)^(2^s) = a^((2^s)*t) = a^(p-1) = 1, c^(2^s) = (d^t)^(2^s) = d^((2^s)*t) = d^(p-1) = 1 Let b^2 = a^(t+1) = (a^t)*a = r*a, b is square root of a if r = 1. In the case r is not 1, let (b^2)*(c^(2^(s-i-1))^2) = r*a* (c^(2^(s-i-1))^2) = (b*c^(2^(s-i-1)))^2. We can get b*c^(2^(s-i-1)) is square root of a if r* (c^(2^(s-i-1))^2) is 1. National Cheng Kung University CSIE Computer & Internet Architecture Lab

y-Coordinate Compression The complexity of y-Coordinate Compression is O(1). -y -y ≡ p - y (mod p) The algorithms for computing square roots have worst-case complexity thus, the algorithm y-Coordinate Decompression has the same complexity. National Cheng Kung University CSIE Computer & Internet Architecture Lab

Cube Roots If p ≡ 2 (mod 3), because If p ≡ 1 (mod 3) and a = 1, then a (trivial) cube root of a is 1. Moreover, we can determine a non-trivial cube root of 1 as If p ≡ 1 (mod 3) and a is not 1, then a is a cubic residue if and only if We will consider three subcases: 1. If p ≡ 7 (mod 9), 2. If p ≡ 4 (mod 9), 3. If p ≡ 1 (mod 9) then use the cubic variant of Tonelli-Shanks algorithm. National Cheng Kung University CSIE Computer & Internet Architecture Lab

Cubic Tonelli-Shanks Algo.rithm The other two cube roots can be obtained as follows. Let U be a non-trivial cube root of 1. If is a cube root of a then U* and (U^2)* are also cube roots of a. using Pohlig-Hellman DLA to find k such that National Cheng Kung University CSIE Computer & Internet Architecture Lab

Modular Cubic Equation The most popular polynomial factorization algorithms are Berlekamp with and Cantor-Zassenhaus , where n is the degree of the polynomial. Let us consider the equation with discriminant D = , and when D is not 0, the number of solutions Np is : When D = 0, Np = 3 and solutions are : National Cheng Kung University CSIE Computer & Internet Architecture Lab

Modular Cubic Equation with Single Solution In this case, D is a quadratic non-residue modulo p in Assume , , if and the only solution is : There is an efficient algorithm for evaluating Lucas sequences based on the following properties which costs : National Cheng Kung University CSIE Computer & Internet Architecture Lab

Modular Cubic Equation with Three Solution In this case, D is a quadratic residue modulo p in Assume , , if and there are three solutions for p ≡ 1 (mod 3) when existing Y such that Also, we can get a cubic residue 4(b − y), with three cube roots (z0, z1, z2) indicating three solutions of a cubic equation: The part of p ≡ 2 (mod 3) is rather complicated and thus we omit it. National Cheng Kung University CSIE Computer & Internet Architecture Lab

Modular Cubic Equation Algorithm The most time-consuming part is computing square roots and cube roots. Thus, the worst-case complexity of the algorithm is National Cheng Kung University CSIE Computer & Internet Architecture Lab

x-Coordinate Point Compression The size of the compressed point is at most for The main idea is to sort the solutions of the cubic and identify the component Xp by its index. National Cheng Kung University CSIE Computer & Internet Architecture Lab

x-Coordinate Point Compression In our compression algorithm, because Xp ∈ {(00),(01),(10)}, we may use (11) to signal whether a cubic equation is a quadratic non-residue - thus, computing the discriminant is not required in the decompression phase. The worst-case complexities of x-Coordinate Compression and x-Coordinate Decompression algorithm are the same, namely We have to remark that in case of the equations with p ≡ 1 (mod 3) : The following are available: National Cheng Kung University CSIE Computer & Internet Architecture Lab

Experiments The implementation is written in Visual Studio 2008 on a Intel Core 2 Duo, running on a 2.53 GHz Dell laptop, under Windows 7 operating system. We have compared our algorithms with the algorithms implemented in NTL lib in case of solving cubic equations or finding a cube root. The average times have been measured in milliseconds. For the case of cubic equations with a single solution, we have implemented a binary algorithm for computing the Lucas number and we have compared our Cubic Equation algorithm with FindRoot from NTL lib. National Cheng Kung University CSIE Computer & Internet Architecture Lab

Experiments In case p ≡ 1 (mod 3) and the discriminant is a quadratic residue (the cubic equation has three solutions), we have compared our Cubic Equation algorithm with FindRoots from NTL. The results are presented in Table II. Finally, we have compared our Cubic Tonelli-Shanks algorithm (denoted as CTS) with FindRoot from NTL for the case of computing a cube root. The results are presented in Table III. National Cheng Kung University CSIE Computer & Internet Architecture Lab