elliptic curve hash and sign
play

Elliptic Curve Hash (and Sign) ECOH (and the 1-up problem for ECDSA) - PowerPoint PPT Presentation

Apr 01, 2023 •620 likes •1.37k views

Elliptic Curve Hash (and Sign) ECOH (and the 1-up problem for ECDSA) Daniel R. L. Brown Certicom Research ECC 2008, Utrecht, Sep 22-24 2008 Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 1 / 43 Outline ECOH 1 Background

  1. Elliptic Curve Hash (and Sign) ECOH (and the 1-up problem for ECDSA) Daniel R. L. Brown Certicom Research ECC 2008, Utrecht, Sep 22-24 2008 Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 1 / 43

  2. Outline ECOH 1 Background Evolution Implementation CFV One-Up Problem for ECDSA 2 Conclusion 3 Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 2 / 43

  3. ECOH Elliptic Curve Only Hash Definition (High level) Pad message block M i into a point P i . � T = P i (1) i Do the same for T . Truncate to get hash H . Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 3 / 43

  4. ECOH Background Motivation: SHA-3 Wang, Feng, Lai, Yu: collision FOUND in MD5. Wang, Yin, Yu: 2 69 collision algorithm for SHA-1 Wang, Yao, Yao: 2 63 collision algorithm for SHA-1 NIST: please use SHA-2 NIST: is SHA-2 ok? NIST: SHA-3 competition, AES-style Some like to call “AHS” Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 4 / 43

  5. ECOH Background Motivation: SHA-3 Wang, Feng, Lai, Yu: collision FOUND in MD5. Wang, Yin, Yu: 2 69 collision algorithm for SHA-1 Wang, Yao, Yao: 2 63 collision algorithm for SHA-1 NIST: please use SHA-2 NIST: is SHA-2 ok? NIST: SHA-3 competition, AES-style Some like to call “AHS” Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 4 / 43

  6. ECOH Background Motivation: SHA-3 Wang, Feng, Lai, Yu: collision FOUND in MD5. Wang, Yin, Yu: 2 69 collision algorithm for SHA-1 Wang, Yao, Yao: 2 63 collision algorithm for SHA-1 NIST: please use SHA-2 NIST: is SHA-2 ok? NIST: SHA-3 competition, AES-style Some like to call “AHS” Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 4 / 43

  7. ECOH Background Motivation: SHA-3 Wang, Feng, Lai, Yu: collision FOUND in MD5. Wang, Yin, Yu: 2 69 collision algorithm for SHA-1 Wang, Yao, Yao: 2 63 collision algorithm for SHA-1 NIST: please use SHA-2 NIST: is SHA-2 ok? NIST: SHA-3 competition, AES-style Some like to call “AHS” Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 4 / 43

  8. ECOH Background Motivation: SHA-3 Wang, Feng, Lai, Yu: collision FOUND in MD5. Wang, Yin, Yu: 2 69 collision algorithm for SHA-1 Wang, Yao, Yao: 2 63 collision algorithm for SHA-1 NIST: please use SHA-2 NIST: is SHA-2 ok? NIST: SHA-3 competition, AES-style Some like to call “AHS” Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 4 / 43

  9. ECOH Background Motivation: SHA-3 Wang, Feng, Lai, Yu: collision FOUND in MD5. Wang, Yin, Yu: 2 69 collision algorithm for SHA-1 Wang, Yao, Yao: 2 63 collision algorithm for SHA-1 NIST: please use SHA-2 NIST: is SHA-2 ok? NIST: SHA-3 competition, AES-style Some like to call “AHS” Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 4 / 43

  10. ECOH Background Motivation: SHA-3 Wang, Feng, Lai, Yu: collision FOUND in MD5. Wang, Yin, Yu: 2 69 collision algorithm for SHA-1 Wang, Yao, Yao: 2 63 collision algorithm for SHA-1 NIST: please use SHA-2 NIST: is SHA-2 ok? NIST: SHA-3 competition, AES-style Some like to call “AHS” Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 4 / 43

  11. ECOH Background Discrete Log Hash: CHP Definition (Chaum, van Heijst, Pfitzmann (1991)) H ( m , n ) = mP + nQ Theorem A collision in H gives log P ( Q ) . Proof. If H ( a , b ) = H ( c , d ), then aP + bQ = cP + dQ (2) and solving log P ( Q ) = a − c d − b mod n . Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 5 / 43

  12. ECOH Background Discrete Log Hash: CHP Definition (Chaum, van Heijst, Pfitzmann (1991)) H ( m , n ) = mP + nQ Theorem A collision in H gives log P ( Q ) . Proof. If H ( a , b ) = H ( c , d ), then aP + bQ = cP + dQ (2) and solving log P ( Q ) = a − c d − b mod n . Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 5 / 43

  13. ECOH Background Discrete Log Hash: CHP Definition (Chaum, van Heijst, Pfitzmann (1991)) H ( m , n ) = mP + nQ Theorem A collision in H gives log P ( Q ) . Proof. If H ( a , b ) = H ( c , d ), then aP + bQ = cP + dQ (2) and solving log P ( Q ) = a − c d − b mod n . Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 5 / 43

  14. ECOH Background CHP Pros and Cons Provably secure assuming ECDLP hard. 3 m / 2 EC adds per 2 m bits. Compression factor 2, must be iterated. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 6 / 43

  15. ECOH Background Discrete Log Hash 2: MuHASH Definition (Bellare and Micciancio (1997)) Let P i = F ( i � M i ), where F is a “random oracle”. Let � H = P i (3) i Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 7 / 43

  16. ECOH Background MuHASH Advantages One EC add per m bits. ◮ E.g. 384 times faster than CHP. Parallelizable. Incremental: ◮ H ′ = H − P i + P ′ i Provably secure, assuming ECDLP hard and F random oracle. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 8 / 43

  17. ECOH Background MuHASH Disadvantages Assumes F is a random oracle. Insecure if F insecure. ◮ Must already have a collision-resistant F . ◮ SHA-1? SHA-2? SHA-3? Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 9 / 43

  18. ECOH Evolution ECOH’s Design Rationale Leverage from MuHASH: ◮ Speed. ◮ Parallelizability. ◮ Incrementality. Avoid reliance on pre-existing F . Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 10 / 43

  19. ECOH Evolution EECH Replace F by fixed key block cipher: � H = F ( i � M i ) (4) i Encrypted Elliptic Curve Hash (EECH) born. No collisions in F , guaranteed. Model F by ideal cipher. Rehash Bellare and Micciancio’s security proof. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 11 / 43

  20. ECOH Evolution EECH Replace F by fixed key block cipher: � H = F ( i � M i ) (4) i Encrypted Elliptic Curve Hash (EECH) born. No collisions in F , guaranteed. Model F by ideal cipher. Rehash Bellare and Micciancio’s security proof. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 11 / 43

  21. ECOH Evolution EECH Replace F by fixed key block cipher: � H = F ( i � M i ) (4) i Encrypted Elliptic Curve Hash (EECH) born. No collisions in F , guaranteed. Model F by ideal cipher. Rehash Bellare and Micciancio’s security proof. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 11 / 43

  22. ECOH Evolution EECH Replace F by fixed key block cipher: � H = F ( i � M i ) (4) i Encrypted Elliptic Curve Hash (EECH) born. No collisions in F , guaranteed. Model F by ideal cipher. Rehash Bellare and Micciancio’s security proof. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 11 / 43

  23. ECOH Evolution EECH Replace F by fixed key block cipher: � H = F ( i � M i ) (4) i Encrypted Elliptic Curve Hash (EECH) born. No collisions in F , guaranteed. Model F by ideal cipher. Rehash Bellare and Micciancio’s security proof. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 11 / 43

  24. ECOH Evolution Oops: Not 1-way Unlike MuHASH, F now invertible. If adversary knows M 1 and M 3 but not M 2 , then 2 � M 2 = F − 1 ( H ( M 1 , M 2 , M 3 ) − F (1 � M 1 ) − F (3 � M 3 )) (5) Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 12 / 43

  25. ECOH Evolution Oops: Not 1-way Unlike MuHASH, F now invertible. If adversary knows M 1 and M 3 but not M 2 , then 2 � M 2 = F − 1 ( H ( M 1 , M 2 , M 3 ) − F (1 � M 1 ) − F (3 � M 3 )) (5) Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 12 / 43

  26. ECOH Evolution Fix it up. Post-process with one-way function? ◮ Scalar multiply? ◮ EECH again? ◮ Pairing? ◮ Checksum in extra block? Seems to thwart block inversion attack. Interferes with incrementality. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 13 / 43

  27. ECOH Evolution Ouch: Not collision resistant! Let 2 � D = F − 1 ( F (1 � A ) + F (2 � B ) − F (1 � C )) (6) Probability of index 2 appearing depends its bit length. Try that many C values, until it works. Then F (1 � A ) + F (2 � B ) = F (1 � C ) + F (2 � D ) , (7) i.e. a collision H ( A , B ) = H ( C , D ). Second preimage attack! Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 14 / 43

  28. ECOH Evolution Fix it again. Pad M i , before applying F . If F random enough, inverting will not give requisite padding. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 15 / 43

  29. ECOH Evolution ECOH Now that EECH is all fixed ... just set F to the identity function. Elliptic Curve Only Hash. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 16 / 43

  30. ECOH Evolution ECOH Now that EECH is all fixed ... just set F to the identity function. Elliptic Curve Only Hash. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 16 / 43

  31. ECOH Evolution ECOH Now that EECH is all fixed ... just set F to the identity function. Elliptic Curve Only Hash. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 16 / 43

  32. ECOH Evolution ECOH vs. EECH Purity of ECOH. No dependence on ideal cipher model. No performance cost of enciphering. ◮ ECOH is already slow enough. Is it more crazy to: ◮ encrypt with a fixed key, ◮ do nothing? Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 17 / 43

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Quick Review: Quadratic Residues Koblitzs Method We want to solve equations like: All of the

Quick Review: Quadratic Residues Koblitzs Method We want to solve equations like: All of the

Elliptic Curves Suppose F is a field and a 1 , . . . , a 6 F . Elliptic Curve Cryptography Definition 1. An elliptic curve E over a field F is a curve given by an equation: Jim Royer Y 2 + a 1 XY + a 3 Y X 3 + a 2 X 2 + a 4 X + a 6 = (1)

337 views • 5 slides
Elliptic Curve Cryptography Applications of Elliptic Curve Cryptography Elliptic Curve

Elliptic Curve Cryptography Applications of Elliptic Curve Cryptography Elliptic Curve

Cryptography Elliptic Curve Cryptography Overview of Elliptic Curve Cryptography Elliptic Curve Cryptography Applications of Elliptic Curve Cryptography Elliptic Curve Cryptography Cryptography in OpenSSL School of Engineering and

857 views • 17 slides
Hyper-and-elliptic-curve cryptography (which is not the same as: hyperelliptic-curve

Hyper-and-elliptic-curve cryptography (which is not the same as: hyperelliptic-curve

Hyper-and-elliptic-curve cryptography (which is not the same as: hyperelliptic-curve cryptography and elliptic-curve cryptography) Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Tanja Lange

318 views • 29 slides
Hyper-and-elliptic-curve cryptography (which is not the same as: hyperelliptic-curve

Hyper-and-elliptic-curve cryptography (which is not the same as: hyperelliptic-curve

Hyper-and-elliptic-curve cryptography (which is not the same as: hyperelliptic-curve cryptography and elliptic-curve cryptography) Daniel J. Bernstein Through our inefficient use of University of Illinois at Chicago & energy (gas

1.07k views • 76 slides
Motivation Given an elliptic curve E over a finite field F q . Is the Discrete Logarithm Problem

Motivation Given an elliptic curve E over a finite field F q . Is the Discrete Logarithm Problem

Counting points on elliptic curves over F q Christiane Peters DIAMANT-Summer School on Elliptic and Hyperelliptic Curve Cryptography September 17, 2008 Motivation Given an elliptic curve E over a finite field F q . Is the Discrete Logarithm

587 views • 30 slides
Elliptic Curves over the Rational Mordells Theorem Numbers Q An elliptic curve is a

Elliptic Curves over the Rational Mordells Theorem Numbers Q An elliptic curve is a

Elliptic Curves over the Rational Mordells Theorem Numbers Q An elliptic curve is a nonsingular plane cu- Theorem (Mordell). The group E ( Q ) of rational points on an bic curve with a rational point (possibly at elliptic curve is a

402 views • 7 slides
The AGM- X 0 ( N ) Algorithm Heegner point lifting with application to elliptic curve point

The AGM- X 0 ( N ) Algorithm Heegner point lifting with application to elliptic curve point

The AGM- X 0 ( N ) Algorithm Heegner point lifting with application to elliptic curve point counting David R. Kohel School of Mathematics and Statistics University of Sydney I Elliptic Curves in Cryptography An elliptic curve E/ F p r for

415 views • 18 slides
Elliptic Curve Cryptography Meghana Doddapaneni University of Maryland 5 December 2018

Elliptic Curve Cryptography Meghana Doddapaneni University of Maryland 5 December 2018

Elliptic Curve Cryptography Meghana Doddapaneni University of Maryland 5 December 2018 Introduction y 2 = x 3 + ax + b en.wikipedia.org/wiki/Elliptic curve Elliptic Curve Addition P = ( x p .y p ), Q = ( x q , y q ), R = ( x r .y r ) =

187 views • 16 slides
Elliptic Curves over Q Peter Birkner Technische Universiteit Eindhoven DIAMANT Summer School on

Elliptic Curves over Q Peter Birkner Technische Universiteit Eindhoven DIAMANT Summer School on

Elliptic Curves over Q Peter Birkner Technische Universiteit Eindhoven DIAMANT Summer School on Elliptic and Hyperelliptic Curve Cryptography 16 September 2008 What is an elliptic curve? (1) An elliptic curve E over a field k in Weierstra

298 views • 25 slides
Elliptic-curve cryptography Tanja Lange Technische Univesiteit Eindhoven The Netherlands July

Elliptic-curve cryptography Tanja Lange Technische Univesiteit Eindhoven The Netherlands July

Elliptic-curve cryptography Tanja Lange Technische Univesiteit Eindhoven The Netherlands July 23, 2014 1 / 12 Elliptic-curve cryptography: signatures and key exchange Given: some elliptic curve E , point P on E of known order . Key

885 views • 16 slides
Efficient Finite Field and Elliptic Curve Arithmetic Laurent Imbert CNRS, LIRMM, Universit e

Efficient Finite Field and Elliptic Curve Arithmetic Laurent Imbert CNRS, LIRMM, Universit e

Efficient Finite Field and Elliptic Curve Arithmetic Laurent Imbert CNRS, LIRMM, Universit e Montpellier 2 Summer School ECC 2011 Nancy, September 12-16, 2011 Part 2 Elliptic curve arithmetic 1/41 The two facets of an elliptic curve

606 views • 42 slides
Further Reading A. H. Koblitz, N. Koblitz, A. Menezes, Elliptic curve cryptography: The

Further Reading A. H. Koblitz, N. Koblitz, A. Menezes, Elliptic curve cryptography: The

Twenty-Three Years of Elliptic Curve Cryptography Alfred Menezes University of Waterloo September 3 2008 1 Further Reading A. H. Koblitz, N. Koblitz, A. Menezes, Elliptic curve cryptography: The serpentine course of a paradigm

300 views • 18 slides
Next-generation elliptic-curve cryptography (ECC) Daniel J. Bernstein Cryptographic

Next-generation elliptic-curve cryptography (ECC) Daniel J. Bernstein Cryptographic

Next-generation elliptic-curve cryptography (ECC) Daniel J. Bernstein Cryptographic Implementations group: eindhoven.cr.yp.to working closely with the Coding Theory and Cryptology group: www.win.tue.nl/cc/ Next-generation elliptic-curve

456 views • 18 slides
Elliptic Curve Cryptography An Introduction Dr. F . Vercauteren Katholieke Universiteit Leuven

Elliptic Curve Cryptography An Introduction Dr. F . Vercauteren Katholieke Universiteit Leuven

Cryptography Elliptic Curves EC Cryptographic Primitives Pairings Elliptic Curve Cryptography An Introduction Dr. F . Vercauteren Katholieke Universiteit Leuven 22 April 2008 Dr. F. Vercauteren Elliptic Curve Cryptography An Introduction

491 views • 32 slides
A Brief Introduction to Elliptic Curve Cryptography Or: A headache in 15 minutes Don Owen March

A Brief Introduction to Elliptic Curve Cryptography Or: A headache in 15 minutes Don Owen March

A Brief Introduction to Elliptic Curve Cryptography A Brief Introduction to Elliptic Curve Cryptography Or: A headache in 15 minutes Don Owen March 21 st , 2016 1/13 A Brief Introduction to Elliptic Curve Cryptography Elliptic Curve 2/13 A

385 views • 13 slides
elliptic curve cryptography Craig Costello Summer School on Real-World Crypto and Privacy June

elliptic curve cryptography Craig Costello Summer School on Real-World Crypto and Privacy June

A gentle introduction to elliptic curve cryptography Craig Costello Summer School on Real-World Crypto and Privacy June 11, 2018 ibenik , Croatia Part 1: Motivation Part 2: Elliptic Curves Part 3: Elliptic Curve Cryptography Part 4:

1.38k views • 48 slides
Baker-Akhiezer functions and configurations of hyperplanes Alexander Veselov, Loughborough

Baker-Akhiezer functions and configurations of hyperplanes Alexander Veselov, Loughborough

Baker-Akhiezer functions and configurations of hyperplanes Alexander Veselov, Loughborough University ENIGMA conference on Geometry and Integrability, Obergurgl, December 2008 Plan BA function related to configuration of hyperplanes

938 views • 49 slides
Inner models from extended logics Joint work with Juliette Kennedy and Menachem Magidor

Inner models from extended logics Joint work with Juliette Kennedy and Menachem Magidor

Introduction The cof-model The aa-model HOD 1 Inner models from extended logics Joint work with Juliette Kennedy and Menachem Magidor Department of Mathematics and Statistics, University of Helsinki ILLC, University of Amsterdam January 2017

717 views • 42 slides
Webinar The economics of Electric Freight in urban areas Tuesday 5 th September 2017 Programme

Webinar The economics of Electric Freight in urban areas Tuesday 5 th September 2017 Programme

Webinar The economics of Electric Freight in urban areas Tuesday 5 th September 2017 Programme 15.00-15.05: Welcome 15.05-15.15: Presentation of the FREVUE project 15.15-15.45: Presentation on the economice of electric freight in

961 views • 58 slides
Packet Radio Networks Packet Radio Networks are multiaccess networks in which not all nodes can

Packet Radio Networks Packet Radio Networks are multiaccess networks in which not all nodes can

Packet Radio Networks Packet Radio Networks are multiaccess networks in which not all nodes can hear the transmission of all other nodes, this feature is characteristic for radio communication We will focus on the effect of partial connectivity

882 views • 28 slides
Enhancing Symbolic Execution for Coverage-Oriented Testing S ebastien Bardin, Nikolai

Enhancing Symbolic Execution for Coverage-Oriented Testing S ebastien Bardin, Nikolai

Enhancing Symbolic Execution for Coverage-Oriented Testing S ebastien Bardin, Nikolai Kosmatov, Micka el Delahaye CEA LIST, Software Safety Lab (Paris-Saclay, France) Bardin et al. CFV 2015 1/ 40 Context : white-box software testing

1.43k views • 74 slides
Modern Electronic Structure: Modern Electronic Structure: many- -body physics body physics

Modern Electronic Structure: Modern Electronic Structure: many- -body physics body physics

Modern Electronic Structure: Modern Electronic Structure: many- -body physics body physics many in nano nano- -world world in Liviu Chioncel Chioncel Liviu Graz University of Technology Graz University of Technology Austria Austria

685 views • 44 slides
Tracing the innards of YOUR application Alexandre Montplaisir, Ericsson Florian Wininger,

Tracing the innards of YOUR application Alexandre Montplaisir, Ericsson Florian Wininger,

Tracing the innards of YOUR application Alexandre Montplaisir, Ericsson Florian Wininger, Polytechnique EclipseCon 2014, PolarSys Day pRESENTERS Alexandre Montplaisir Software Developer, Ericsson Committer on the Eclipse Linux

675 views • 31 slides
Multivariate Polynomial maps Noncommutative and non-associative structures, braces and

Multivariate Polynomial maps Noncommutative and non-associative structures, braces and

1 Multivariate Polynomial maps Noncommutative and non-associative structures, braces and applications. Malte, March 2018 Part of this talk is extracted from a few joint works with T.Y. Lam, A. Ozturk, J. Delenclos. . 2 I) Noncommutative

523 views • 14 slides

More recommend