1. Introduction to Modern Cryptography Sharif University Spring 2015 Data and Network Security Lab Sharif University of Technology Department of Computer Engineering Elliptic Curve Cryptography Author & Instructor: Hamed Dashti 1 / 50

2. Introduction to Modern Cryptography Sharif University Spring 2015  What Is An Elliptic Curve?  Elliptic Curve Structures o ECDLP  Elliptic Curve Cryptography o ECC Diffie-Hellman Key Exchange o ECC ElGamal Public key Cryptosystem o ECC Signature  Lenstra’s Elliptic Curve Factorization Algorithm  Bilinear Pairing o Weil Pairing Outline 2 / 50

3. Introduction to Modern Cryptography Sharif University Spring 2015 What Is An Elliptic Curve? 3 / 50

4. Introduction to Modern Cryptography Sharif University Spring 2015 What is an Elliptic Curve? 4 / 50

5. Introduction to Modern Cryptography Sharif University Spring 2015 Defining a group over EC 5 / 50

6. Introduction to Modern Cryptography Sharif University Spring 2015 Addition over EC: A visual example 6 / 50

7. Introduction to Modern Cryptography Sharif University Spring 2015 Addition over EC: An algebraic example 7 / 50

8. Introduction to Modern Cryptography Sharif University Spring 2015  What happens if we want to add a point P itself? Doubling a point 8 / 50

9. Introduction to Modern Cryptography Sharif University Spring 2015 Example 9 / 50

10. Introduction to Modern Cryptography Sharif University Spring 2015  Define the inverse of P = (a, b) to be  P = (a,  b).  We want to add P and  P o The line L is a vertical lines!  Define an extra point that lives at infinity! Defining the inverse of a point 10 / 50

11. Introduction to Modern Cryptography Sharif University Spring 2015 What is an elliptic curve: Recap 11 / 50

12. Introduction to Modern Cryptography Sharif University Spring 2015 Singular points 12 / 50

13. Introduction to Modern Cryptography Sharif University Spring 2015 Theorems about EC 13 / 50

14. Introduction to Modern Cryptography Sharif University Spring 2015 Theorems about EC 14 / 50

15. Introduction to Modern Cryptography Sharif University Spring 2015 خم‌های بیضوی روی میدان‌های متناهی 15 / 50

16. Introduction to Modern Cryptography Sharif University Spring 2015  مثال : می خواهیم دو نقطه ( 9 ، 7 ) و ( 1 ، 8 ) را با یکدیگر جمع کنیم. o ابتدا λ را محاسبه می کنیم : 8 o سپس با توجه به قضیه 2 داریم : ( 2 ، 10) خم ‌ های بیضوی روی میدان ‌ های متناهی 16 / 50

17. Introduction to Modern Cryptography Sharif University Spring 2015 خم ‌ های بیضوی روی میدان ‌ های متناهی 17 / 50

18. Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic Curves over Finite Fields 18 / 50

19. Introduction to Modern Cryptography Sharif University Spring 2015 The Elliptic Curve Discrete Logarithm Problem (ECDLP) 19 / 50

20. Introduction to Modern Cryptography Sharif University Spring 2015 ECDLP 20 / 50

21. Introduction to Modern Cryptography Sharif University Spring 2015 ECDLP 21 / 50

22. Introduction to Modern Cryptography Sharif University Spring 2015 ECDLP 22 / 50

23. Introduction to Modern Cryptography Sharif University Spring 2015 ECDLP 23 / 50 The proof is very simple

24. Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic Curve Cryptography 24 / 50

25. Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic Diffie–Hellman Key Exchange 25 / 50

26. Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic Diffie–Hellman Key Exchange 26 / 50

27. Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic Curve Diffie–Hellman Problem 27 / 50

28. Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic ElGamal Public Key Cryptosystem 28 / 50

29. Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic ElGamal Public Key Cryptosystem 29 / 50

30. Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic ElGamal Public Key Cryptosystem 30 / 50

31. Introduction to Modern Cryptography Sharif University Spring 2015 Elliptic Curve Signatures 31 / 50  We don’t say anything about this, now!

32. Introduction to Modern Cryptography Sharif University Spring 2015 The Evolution of Public Key Cryptography 32 / 50

33. Introduction to Modern Cryptography Sharif University Spring 2015 The Evolution of Public Key Cryptography 33 / 50  What happens for RSA and ElGamal?  What about ECC? Quantum Computers will destroy everything!  Lattice-based Cryptography o NTRU o GGH

34. Introduction to Modern Cryptography Sharif University Spring 2015 The Evolution of Public Key Cryptography 34 / 50  Why use elliptic curves? o reduced key size o hence speed

35. Introduction to Modern Cryptography Sharif University Spring 2015 Lenstra’s Elliptic Curve Factorization Algorithm 35 / 50

36. Introduction to Modern Cryptography Sharif University Spring 2015 Lenstra’s Elliptic Curve Factorization Algorithm 36 / 50  Pollard’s p  1 Algorithm  It is similar to Pollard Algorithm.  We’ll see an example

37. Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 37 / 50

38. Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 38 / 50

39. Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 39 / 50

40. Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 40 / 50

41. Introduction to Modern Cryptography Sharif University Spring 2015 برای مطالعه بیشتر ( خارج از درس ) 41 / 50

42. Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 42 / 50  The bilinear pairings that we discuss in this section are similar in that they take as input two points on an elliptic curve and give as output a number.

43. Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 43 / 50 These fields are also sometimes called Galois fields

44. Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 44 / 50

45. Introduction to Modern Cryptography Sharif University Spring 2015 Rational Functions and Divisors on Elliptic Curves 45 / 50  In order to define the Weil and Tate pairings, we need to explain how a rational function on an elliptic curve is related to its zeros and poles.  A rational function is a ratio of polynomials  Definition: Divisor of f(X)

46. Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 46 / 50  Similar to one variable function, we have an associated divisor for two variable function(an elliptic curve).

47. Introduction to Modern Cryptography Sharif University Spring 2015 Bilinear Pairings on Elliptic Curves 47 / 50

48. Introduction to Modern Cryptography Sharif University Spring 2015 The Weil Pairing 48 / 50 Definition: The Weil pairing is expressed by the equations: The Weil pairing of P and Q is the quantity

49. Introduction to Modern Cryptography Sharif University Spring 2015 The Weil Pairing 49 / 50

50. Introduction to Modern Cryptography Sharif University Spring 2015 The Tate Pairing 50 / 50