Introduction to Modern Cryptography Sharif University Spring 2015 Data and Network Security Lab Sharif University of Technology Department of Computer Engineering Elliptic Curve Cryptography Author & Instructor: Hamed Dashti 1 / 50

Introduction to Modern Cryptography Sharif University Spring 2015  What Is An Elliptic Curve?  Elliptic Curve Structures o ECDLP  Elliptic Curve Cryptography o ECC Diffie-Hellman Key Exchange o ECC ElGamal Public key Cryptosystem o ECC Signature  Lenstra’s Elliptic Curve Factorization Algorithm  Bilinear Pairing o Weil Pairing Outline 2 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 What Is An Elliptic Curve? 3 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 What is an Elliptic Curve? 4 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Defining a group over EC 5 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Addition over EC: A visual example 6 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Addition over EC: An algebraic example 7 / 50

Introduction to Modern Cryptography Sharif University Spring 2015  What happens if we want to add a point P itself? Doubling a point 8 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Example 9 / 50

Introduction to Modern Cryptography Sharif University Spring 2015  Define the inverse of P = (a, b) to be  P = (a,  b).  We want to add P and  P o The line L is a vertical lines!  Define an extra point that lives at infinity! Defining the inverse of a point 10 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 What is an elliptic curve: Recap 11 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Singular points 12 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Theorems about EC 13 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Theorems about EC 14 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 خم‌های بیضوی روی میدان‌های متناهی 15 / 50

Introduction to Modern Cryptography Sharif University Spring 2015  مثال : می خواهیم دو نقطه ( 9 ، 7 ) و ( 1 ، 8 ) را با یکدیگر جمع کنیم. o ابتدا λ را محاسبه می کنیم : 8 o سپس با توجه به قضیه 2 داریم : ( 2 ، 10) خم ‌ های بیضوی روی میدان ‌ های متناهی 16 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 خم ‌ های بیضوی روی میدان ‌ های متناهی 17 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic Curves over Finite Fields 18 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 The Elliptic Curve Discrete Logarithm Problem (ECDLP) 19 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 ECDLP 20 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 ECDLP 21 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 ECDLP 22 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 ECDLP 23 / 50 The proof is very simple

Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic Curve Cryptography 24 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic Diffie–Hellman Key Exchange 25 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic Diffie–Hellman Key Exchange 26 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic Curve Diffie–Hellman Problem 27 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic ElGamal Public Key Cryptosystem 28 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic ElGamal Public Key Cryptosystem 29 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic ElGamal Public Key Cryptosystem 30 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic Curve Signatures 31 / 50  We don’t say anything about this, now!

Introduction to Modern Cryptography Sharif University Spring 2015 The Evolution of Public Key Cryptography 32 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 The Evolution of Public Key Cryptography 33 / 50  What happens for RSA and ElGamal?  What about ECC? Quantum Computers will destroy everything!  Lattice-based Cryptography o NTRU o GGH

Introduction to Modern Cryptography Sharif University Spring 2015 The Evolution of Public Key Cryptography 34 / 50  Why use elliptic curves? o reduced key size o hence speed

Introduction to Modern Cryptography Sharif University Spring 2015 Lenstra’s Elliptic Curve Factorization Algorithm 35 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Lenstra’s Elliptic Curve Factorization Algorithm 36 / 50  Pollard’s p  1 Algorithm  It is similar to Pollard Algorithm.  We’ll see an example

Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 37 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 38 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 39 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 40 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 برای مطالعه بیشتر ( خارج از درس ) 41 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 42 / 50  The bilinear pairings that we discuss in this section are similar in that they take as input two points on an elliptic curve and give as output a number.

Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 43 / 50 These fields are also sometimes called Galois fields

Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 44 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 Rational Functions and Divisors on Elliptic Curves 45 / 50  In order to define the Weil and Tate pairings, we need to explain how a rational function on an elliptic curve is related to its zeros and poles.  A rational function is a ratio of polynomials  Definition: Divisor of f(X)

Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 46 / 50  Similar to one variable function, we have an associated divisor for two variable function(an elliptic curve).

Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 47 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 The Weil Pairing 48 / 50 Definition: The Weil pairing is expressed by the equations: The Weil pairing of P and Q is the quantity

Introduction to Modern Cryptography Sharif University Spring 2015 The Weil Pairing 49 / 50

Introduction to Modern Cryptography Sharif University Spring 2015 The Tate Pairing 50 / 50