Algebraic approaches for the Elliptic Curve Discrete Logarithm - - PowerPoint PPT Presentation

▶
algebraic approaches for the elliptic curve discrete
SMART_READER_LITE
LIVE PREVIEW

Algebraic approaches for the Elliptic Curve Discrete Logarithm - - PowerPoint PPT Presentation

Apr 20, 2023 148 likes •563 views

Algebraic approaches for the Elliptic Curve Discrete Logarithm Problem over Prime Fields Christophe Petit, Michiel Kosters, Ange Messeng University of Oxford, University of California Irvine, University of Passau Christophe Petit - PKC2016 -

slide-1
SLIDE 1

Christophe Petit - PKC2016 - Prime ECDLP 1

Algebraic approaches for the Elliptic Curve Discrete Logarithm Problem

  • ver Prime Fields

Christophe Petit, Michiel Kosters, Ange Messeng University of Oxford, University of California Irvine, University of Passau

slide-2
SLIDE 2

Christophe Petit - PKC2016 - Prime ECDLP 2

Elliptic Curve Discrete Logarithm Problem

◮ Elliptic Curve Discrete Logarithm Problem (ECDLP)

Let K a finite field and let E be an elliptic curve over K. Let P ∈ E(K) and let Q ∈ G :=< P >. Find k ∈ Z such that Q = kP.

◮ In practice K is a prime field, a binary field with prime

degree extension, or Fpn with n relatively small

slide-3
SLIDE 3

Christophe Petit - PKC2016 - Prime ECDLP 2

Elliptic Curve Discrete Logarithm Problem

◮ Elliptic Curve Discrete Logarithm Problem (ECDLP)

Let K a finite field and let E be an elliptic curve over K. Let P ∈ E(K) and let Q ∈ G :=< P >. Find k ∈ Z such that Q = kP.

◮ In practice K is a prime field, a binary field with prime

degree extension, or Fpn with n relatively small

◮ Elliptic Curve Cryptography secure ⇒ ECDLP hard

slide-4
SLIDE 4

Christophe Petit - PKC2016 - Prime ECDLP 3

Is ECDLP hard ?

◮ Can apply generic attacks

slide-5
SLIDE 5

Christophe Petit - PKC2016 - Prime ECDLP 3

Is ECDLP hard ?

◮ Can apply generic attacks ◮ For exceptional parameters, can reduce it to another

discrete logarithm problem

◮ Anomalous attack ◮ Reduction to finite field DLP using pairings ◮ Reduction to a hyperelliptic curve DLP

slide-6
SLIDE 6

Christophe Petit - PKC2016 - Prime ECDLP 3

Is ECDLP hard ?

◮ Can apply generic attacks ◮ For exceptional parameters, can reduce it to another

discrete logarithm problem

◮ Anomalous attack ◮ Reduction to finite field DLP using pairings ◮ Reduction to a hyperelliptic curve DLP ◮ Index calculus approaches being developed since 2004,

but mostly focused on extension fields

slide-7
SLIDE 7

Christophe Petit - PKC2016 - Prime ECDLP 3

Is ECDLP hard ?

◮ Can apply generic attacks ◮ For exceptional parameters, can reduce it to another

discrete logarithm problem

◮ Anomalous attack ◮ Reduction to finite field DLP using pairings ◮ Reduction to a hyperelliptic curve DLP ◮ Index calculus approaches being developed since 2004,

but mostly focused on extension fields

◮ Our goal : extend previous index calculus algorithms

to ECDLP over prime fields

slide-8
SLIDE 8

Christophe Petit - PKC2016 - Prime ECDLP 4

Outline

Previous index calculus algorithms for ECDLP New variants for curves over prime fields

slide-9
SLIDE 9

Christophe Petit - PKC2016 - Prime ECDLP 5

Outline

Previous index calculus algorithms for ECDLP New variants for curves over prime fields

slide-10
SLIDE 10

Christophe Petit - PKC2016 - Prime ECDLP 6

Index Calculus for Elliptic Curves

  • 1. Fix m ∈ Z, and fix V ⊂ K with |V |m ≈ K

Define a factor basis F = {(x, y) ∈ E(K) | x ∈ V }

slide-11
SLIDE 11

Christophe Petit - PKC2016 - Prime ECDLP 6

Index Calculus for Elliptic Curves

  • 1. Fix m ∈ Z, and fix V ⊂ K with |V |m ≈ K

Define a factor basis F = {(x, y) ∈ E(K) | x ∈ V }

  • 2. Compute about |F| relations

aiP + biQ = Pi,1 + Pi,2 + . . . + Pi,m with Pi,j ∈ F

slide-12
SLIDE 12

Christophe Petit - PKC2016 - Prime ECDLP 6

Index Calculus for Elliptic Curves

  • 1. Fix m ∈ Z, and fix V ⊂ K with |V |m ≈ K

Define a factor basis F = {(x, y) ∈ E(K) | x ∈ V }

  • 2. Compute about |F| relations

aiP + biQ = Pi,1 + Pi,2 + . . . + Pi,m with Pi,j ∈ F

  • 3. Linear algebra on relations gives aP + bQ = 0
slide-13
SLIDE 13

Christophe Petit - PKC2016 - Prime ECDLP 7

Relation search : Semaev polynomials

◮ Semaev polynomials relate the x-coordinates of points

that sum up to 0 : Sr(x1, . . . , xr) = 0 ⇔ ∃(xi, yi) ∈ E( ¯ K) s.t. (x1, y1) + · · · + (xr, yr) = 0

◮ Relation search ◮ Compute (X, Y ) := aP + bQ for random a, b ◮ Search for xi ∈ V with Sm+1(x1, . . . , xm, X) = 0 ◮ For any such solution, find corresponding yi values

slide-14
SLIDE 14

Christophe Petit - PKC2016 - Prime ECDLP 8

Existing Variants

◮ Semaev ◮ K = Fp and V contains all “small” elements ◮ No algorithm to solve Sm+1

slide-15
SLIDE 15

Christophe Petit - PKC2016 - Prime ECDLP 8

Existing Variants

◮ Semaev ◮ K = Fp and V contains all “small” elements ◮ No algorithm to solve Sm+1 ◮ Gaudry-Diem ◮ K = Fqn and V = Fq ◮ Reduction to polynomial system over Fq ◮ Generic bounds give Lqn(2/3) complexity if q = Lqn(2/3)

slide-16
SLIDE 16

Christophe Petit - PKC2016 - Prime ECDLP 8

Existing Variants

◮ Semaev ◮ K = Fp and V contains all “small” elements ◮ No algorithm to solve Sm+1 ◮ Gaudry-Diem ◮ K = Fqn and V = Fq ◮ Reduction to polynomial system over Fq ◮ Generic bounds give Lqn(2/3) complexity if q = Lqn(2/3) ◮ Diem, FPPR, P-Quisquater ◮ K = F2n and V a vector space of K over F2 ◮ Reduction to polynomial system over F2 ◮ Experiments suggest system “somewhat easy”

slide-17
SLIDE 17

Christophe Petit - PKC2016 - Prime ECDLP 9

Relation search : Weil Descent

◮ For each relation solve a generalized root-finding problem

Given f ∈ Fqn[x1, . . . , xm] and vector space V ⊂ Fqn, find xi ∈ V such that f (x1, . . . , xm) = 0

slide-18
SLIDE 18

Christophe Petit - PKC2016 - Prime ECDLP 9

Relation search : Weil Descent

◮ For each relation solve a generalized root-finding problem

Given f ∈ Fqn[x1, . . . , xm] and vector space V ⊂ Fqn, find xi ∈ V such that f (x1, . . . , xm) = 0

◮ Solved by Weil Descent : reduction to polynomial system ◮ Fix a basis for V over Fq ◮ Introduce variables xij ∈ Fq with xi =

j xijvj

◮ See single equation f

  • j x1jvj, . . . ,

j xmjvj

  • = 0
  • ver Fqn as a system of n equations over Fq
slide-19
SLIDE 19

Christophe Petit - PKC2016 - Prime ECDLP 10

Limits of previous works

◮ Fields with q = Lqn(2/3) are not used in practice

slide-20
SLIDE 20

Christophe Petit - PKC2016 - Prime ECDLP 10

Limits of previous works

◮ Fields with q = Lqn(2/3) are not used in practice ◮ In binary case asymptotic complexity is not clear,

and practical complexity is poor

slide-21
SLIDE 21

Christophe Petit - PKC2016 - Prime ECDLP 10

Limits of previous works

◮ Fields with q = Lqn(2/3) are not used in practice ◮ In binary case asymptotic complexity is not clear,

and practical complexity is poor

◮ Not clear how to extend to prime fields : no subspace

available and we a priori want small degree equations

slide-22
SLIDE 22

Christophe Petit - PKC2016 - Prime ECDLP 11

Outline

Previous index calculus algorithms for ECDLP New variants for curves over prime fields

slide-23
SLIDE 23

Christophe Petit - PKC2016 - Prime ECDLP 12

Main idea

◮ Find low degree rational maps Lj such that

#{x ∈ Fp | L(x) = Ln′◦. . .◦L1(x) = 0} ≈

  • deg Lj ≈ p1/m

◮ Define V = {x ∈ Fp | L(x) = 0} ◮ Define F = {(x, y) ∈ E(K) | x ∈ V }

slide-24
SLIDE 24

Christophe Petit - PKC2016 - Prime ECDLP 12

Main idea

◮ Find low degree rational maps Lj such that

#{x ∈ Fp | L(x) = Ln′◦. . .◦L1(x) = 0} ≈

  • deg Lj ≈ p1/m

◮ Define V = {x ∈ Fp | L(x) = 0} ◮ Define F = {(x, y) ∈ E(K) | x ∈ V } ◮ Relation search : solve the polynomial system

     Sm+1(x11, . . . , xm1, X) = 0 xi,j+1 = Lj(xi,j) i = 1, . . . , m; j = 1, . . . , n′ − 1 0 = Ln′(xi,n′) i = 1, . . . , m.

slide-25
SLIDE 25

Christophe Petit - PKC2016 - Prime ECDLP 13

Remarks

◮ One can write similar systems in binary cases, and

show they are equivalent to Weil descent systems

◮ Precomputation of the maps Lj can a priori be used for

any DLP defined over any curve over the same field

slide-26
SLIDE 26

Christophe Petit - PKC2016 - Prime ECDLP 13

Remarks

◮ One can write similar systems in binary cases, and

show they are equivalent to Weil descent systems

◮ Precomputation of the maps Lj can a priori be used for

any DLP defined over any curve over the same field

◮ Remaining of the talk : ◮ How to compute the maps Lj ? ◮ How to solve the system ?

slide-27
SLIDE 27

Christophe Petit - PKC2016 - Prime ECDLP 14

Finding good maps : p − 1 “smooth”

◮ Suppose p − 1 = S · N′ with S ≈ p1/m smooth ◮ We want low degree rational maps Lj such that

#{x ∈ Fp | L(x) = Ln′◦. . .◦L1(x) = 0} ≈

  • deg Lj ≈ p1/m
slide-28
SLIDE 28

Christophe Petit - PKC2016 - Prime ECDLP 14

Finding good maps : p − 1 “smooth”

◮ Suppose p − 1 = S · N′ with S ≈ p1/m smooth ◮ We want low degree rational maps Lj such that

#{x ∈ Fp | L(x) = Ln′◦. . .◦L1(x) = 0} ≈

  • deg Lj ≈ p1/m

◮ Take L(X) = X S − 1 and V subgroup of order S in F∗

p

◮ If S = n′

j=1 qj take Lj(X) = X qj and Ln′(X) = X qn′ − 1

slide-29
SLIDE 29

Christophe Petit - PKC2016 - Prime ECDLP 14

Finding good maps : p − 1 “smooth”

◮ Suppose p − 1 = S · N′ with S ≈ p1/m smooth ◮ We want low degree rational maps Lj such that

#{x ∈ Fp | L(x) = Ln′◦. . .◦L1(x) = 0} ≈

  • deg Lj ≈ p1/m

◮ Take L(X) = X S − 1 and V subgroup of order S in F∗

p

◮ If S = n′

j=1 qj take Lj(X) = X qj and Ln′(X) = X qn′ − 1

◮ Remark : NIST P-224 curve satisfies

p − 1 = 296 · N′

slide-30
SLIDE 30

Christophe Petit - PKC2016 - Prime ECDLP 15

Finding good maps : isogeny Kernels

◮ Find an auxiliary curve E ′ with #E ′(Fp) = S · N′

and S = n′

j=1 qj ≈ p1/m smooth

◮ Let G be a subgroup of E ′(Fp) with order S

slide-31
SLIDE 31

Christophe Petit - PKC2016 - Prime ECDLP 15

Finding good maps : isogeny Kernels

◮ Find an auxiliary curve E ′ with #E ′(Fp) = S · N′

and S = n′

j=1 qj ≈ p1/m smooth

◮ Let G be a subgroup of E ′(Fp) with order S ◮ Compute isogenies ϕj such that ϕ = ϕn′ ◦ . . . ◦ ϕ1

has kernel G

slide-32
SLIDE 32

Christophe Petit - PKC2016 - Prime ECDLP 15

Finding good maps : isogeny Kernels

◮ Find an auxiliary curve E ′ with #E ′(Fp) = S · N′

and S = n′

j=1 qj ≈ p1/m smooth

◮ Let G be a subgroup of E ′(Fp) with order S ◮ Compute isogenies ϕj such that ϕ = ϕn′ ◦ . . . ◦ ϕ1

has kernel G

◮ Take Lj the x-coordinate part of ϕj, except for Ln′ taken

in a slightly different way

slide-33
SLIDE 33

Christophe Petit - PKC2016 - Prime ECDLP 16

Finding a smooth order curve

◮ Method 1 : pick random curves ◮ Method 2 : use complex multiplication

slide-34
SLIDE 34

Christophe Petit - PKC2016 - Prime ECDLP 16

Finding a smooth order curve

◮ Method 1 : pick random curves ◮ Method 2 : use complex multiplication ◮ Method 1 needs at most ≈ |F| trials on average ◮ Method 2 more efficient when you can chose p yourself

(kind of trapdoor)

slide-35
SLIDE 35

Christophe Petit - PKC2016 - Prime ECDLP 17

Solving the system

◮ Relation search : solve the polynomial system

     Sm+1(x11, . . . , xm1, X) = 0 xi,j+1 = Lj(xi,j) i = 1, . . . , m; j = 1, . . . , n′ − 1 0 = Ln′(xi,n′) i = 1, . . . , m.

slide-36
SLIDE 36

Christophe Petit - PKC2016 - Prime ECDLP 17

Solving the system

◮ Relation search : solve the polynomial system

     Sm+1(x11, . . . , xm1, X) = 0 xi,j+1 = Lj(xi,j) i = 1, . . . , m; j = 1, . . . , n′ − 1 0 = Ln′(xi,n′) i = 1, . . . , m.

◮ Low degree equations, block triangular structure ◮ mn′ variables and mn′ + 1 equations ◮ Seems reasonable to expect dedicated algorithms, but

here we start with Groebner basis algorithms

slide-37
SLIDE 37

Christophe Petit - PKC2016 - Prime ECDLP 18

Groebner Basis Experiments

◮ Studied comparable size systems in binary and prime cases ◮ Measured average values of degree of regularity ◮ Compared with semi-generic systems

log p

5 10 15 20

degree of regularity

2 4 6 8 10 12 14

binary system binary system p-1 case isogeny kernels semi-generic systems

slide-38
SLIDE 38

Christophe Petit - PKC2016 - Prime ECDLP 19

Solving the system : complexity ?

◮ Algorithm only practical for small parameters ◮ Generic bounds for solving polynomial systems suggest

exponential-time ECDLP algorithm

slide-39
SLIDE 39

Christophe Petit - PKC2016 - Prime ECDLP 19

Solving the system : complexity ?

◮ Algorithm only practical for small parameters ◮ Generic bounds for solving polynomial systems suggest

exponential-time ECDLP algorithm

◮ Experiments using Groebner basis suggest systems easier

than random systems of same size

◮ Sparse, block-triangular structure, and resemblance to the

(polynomial time solvable) root-finding problem suggest to build dedicated algorithms to solve the systems

slide-40
SLIDE 40

Christophe Petit - PKC2016 - Prime ECDLP 19

Solving the system : complexity ?

◮ Algorithm only practical for small parameters ◮ Generic bounds for solving polynomial systems suggest

exponential-time ECDLP algorithm

◮ Experiments using Groebner basis suggest systems easier

than random systems of same size

◮ Sparse, block-triangular structure, and resemblance to the

(polynomial time solvable) root-finding problem suggest to build dedicated algorithms to solve the systems

◮ Open problem !

slide-41
SLIDE 41

Christophe Petit - PKC2016 - Prime ECDLP 20

Conclusion

◮ Suggested an approach to generalize previous ECDLP

algorithms to elliptic curves over prime fields

◮ Like previous ones, algorithm only practical for very small

parameters (Pollard’s rho definitely better for crypto sizes)

◮ Open problems : asymptotic complexity, dedicated

polynomial system solving methods