Security of Using Special Integers in Elliptic Scalar Multiplication Mun-Kyu Lee o Jin Wook Kim Kunsoo Park School of CSE, Seoul National University

1. Preliminaries

3/33 Elliptic Curve n A curve of the form y 2 + xy = x 3 + ax 2 + b or y 2 = x 3 + ax + b n There are many cryptosystems that use elliptic curve operations.

4/33 Elliptic Curve Operations [1] n Point Addition: R = P + Q –First, draw the line through P and Q. –Then this line intersects the elliptic curve in a third point. –Define R = P + Q (the sum of P and Q ) as the reflection of this point in the x -axis.

5/33 Elliptic Curve Operations [2] n Point Doubling: R = 2 P –First, draw the tangent line to the curve at P. –Then this line intersects the curve in a second point. –Define R = 2 P (the double of P ) as the reflection of this point in the x -axis.

6/33 Elliptic Curve Operations [3] n Scalar Multiplication kP –For a nonnegative integer k and a point P, scalar multiplication kP is defined as 0 P = O,for k = 0, where O is the “point at infinity” which is the additive identity element. kP = ( k -1) P + P for k > 0.

7/33 ECDLP n Elliptic Curve Discrete Log Problem –Given two points P and Q on an elliptic curve, –ECDLP is to find k such that kP = Q

8/33 Scalar Mult. vs. ECDLP Scalar Multiplication k, PQ = kP Efficient ECDLP P, Qk s.t. Q = kP - Computationally infeasible - Hence, security of elliptic curve based cryptosystems is based on this problem.

9/33 The purpose of this paper n is to develop a technique to find harder instances of ECDLP, while keeping the efficiency of a scalar multiplication as the same level.

2. Previous Results: Efficient Scalar Mult. Algos.

11/33 [1] Binary Method n To compute Q = kP, –represent k as a binary form. –scan each bit of k from left to right. –if the bit is 1, do a doubling and an addition. if the bit is 0, do a doubling only. n Example: 61 P = (1, 1, 1, 1, 0, 1) (2) P P DBL 2P 1 ADD P 3P 1 6P 1 DBL ADD P 7P 14P DBL ADD P 15P P DBL 60P ADD P Q = 61 P

12/33 [1] Binary Method n Complexity –log k doublings and – HW ( k )-1 additions, where HW ( k ) is the Hamming weight of k, i.e., the number of 1’s in the binary representation of k.

13/33 [2] Signed Binary Method n [Morain, Olivos 90] n Use the following facts. –For a point P on an elliptic curve, computation of an additive inverse – P is almost free. For example, on y 2 = x 3 + ax + b, – P is the reflection of P in the x -axis. –Hence, a subtraction P - Q has the same complexity as that of an addition P + Q. P = ( x, y ) -P = ( x, - y )

14/33 [2] Signed Binary Method n To compute Q = kP, –convert k to a signed binary representation k’ with smaller number of nonzero digits than k. –if a digit is 1, do a doubling and an addition. if a digit is –1, do a doubling and a subtraction. if a digit is 0, do a doubling only. n Example: 61 P = ( ) P = (1, 0, 0, 0,-1, 0, 1) P P DBL 2P 01 4P 0 8P DBL 16P SUB 15P DBL 30P P DBL ADD Q = 61 P

15/33 [2] Signed Binary Method n Complexity –log k doublings and – SHW ( k )-1 additions/subtractions, where SHW ( k ) is the signed Hamming weight of k, i.e., the number of nonzeros in the signed binary representation of k.

16/33 [3] AMV method n In many elliptic curve based systems, we compute kP for a randomly chosen k. n [Agnew, Mullin, Vanstone 93] –Choose special k ’s that have small HW ( k ) to reduce the number of additions. –Specifically, generate random k ’s of length m in a binary form s.t. HW ( k ) = w for a fixed small w. –One can control the Hamming weight, and thus the number of additions.

17/33 [3] AMV method n Example: m = 8, w = 3 0. Initially, there are 8 empty bits. 1. Choose 3 random positions for ‘1’. 2. Set them as ‘1’ and others as ‘0’. For kP, we need 7 doublings and 2 additions. k = (1, 0, 1, 0, 0, 0, 0, 1)

3. Proposed Method

19/33 Our Method n Use special k ’s –Generate random k ’s that have small SHW ( k ). –Specifically, generate random k ’s of length m in a signed binary form s.t. SHW ( k ) = w for a fixed small w. n More secure than the AMV selection method, i.e., random selection of k ’s with HW ( k )= w. –(Recall that an ECDLP is to find k such that kP = Q.) –The number of possible k ’s in our method is much larger, –while the amount of computation is the same, i.e., m -1 doublings and w -1 additions/subtractions, in both of the methods.

20/33 Naïve Approach n In order to generate a random k of length m s.t. SHW ( k ) = w, –randomly select w locations for nonzero digits out of m possible digits of k, –and then assign ‘1’ or ‘-1’ to each of these digits randomly. n Problem – k ’s are not unique. Hence, the search space for k is much smaller than what we have intended. –Example: m = 6, w = 3 (1,0,0,1,0,-1) = (1,0,0,0,1,1) = 35

21/33 Solution n select k ’s in the nonadjacent form (NAF). –NAF is a signed binary representation with the property that no two consecutive digits are nonzero. –A number’s NAF is unique. 35 (1, 0, 0, 1, 0,-1) (1, 0, 0, 0, 1, 1) possible representations in NAFnot in NAF

22/33 Selection Algorithm n Now, we want to generate a random k of length m in NAF s.t. SHW ( k ) = w to guarantee the uniqueness of k. n To satisfy the NAF property, we use ‘10’ and ‘-10’ as single nonzero units instead of ‘1’ and ‘-1’. n The algorithm has six steps.

23/33 Step 1 n Initially there is an array of m - w +1 consecutive empty slots. Example: m = 8, w = 3 ( m - w +1 = 6)

24/33 Step 2 n Assign two-digit binary number 10 to the first slot to guarantee that k > 0 and that k has exactly m digits. Example: m = 8, w = 3 10

25/33 Step 3 n Choose w - 1 random slots out of the remaining m – w slots and assign 10 or –10 randomly to each of them. Example: m = 8, w = 3 ( w -1 = 2, m - w = 5)

26/33 Step 4 n Assign 0 to each remaining slot. Example: m = 8, w =

27/33 Step 5 n Concatenate all slots to get a number k with m +1 signed binary digits. n Note that, for now, k is always even. Example: m = 8, w = (1, 0, 0,-1, 0, 0, 0, 1, 0) 9 digits

28/33 Step 6 n Set k = k / 2 Example: m = 8, w = 3 k = (1, 0, 0,-1, 0, 0, 0, 1) 8 digits (1, 0, 0,-1, 0, 0, 0, 1, 0) For kP, we need 7 DBLs and 2 ADD/SUBs.

29/33 Distribution of k ’s n k ’s generated by this algorithm are unique. n k ’s generated by this algorithm form a uniform distribution of k ’s that have m digits and satisfy SHW ( k ) = w.

4. Security Analysis

31/33 Security Against BSGS n With k ’s of special forms, the best possible attack algorithm against the ECDLP is the baby-step giant-step algorithm, which is a time-memory trade-off version of the exhaustive search. n Hence, k ’s with larger search space is more secure against this attack. n Now we compare the size of the search space of our method with that of the AMV method.

32/33 Comparison of the Sizes of Search Spaces for k AMVOur Method # digits # nonzeros m w m w sizes of search spaces complexity of a scalar mult. m -1 DBLs w -1 ADDs m -1 DBLs w -1 ADD/SUBs

33/33 Comparison in Typical Settings n The size of the search space of our method is much larger. n Our method is expected to be more secure.