Elliptic Curves, Cryptography and Computation Victor S. Miller IDA - - PowerPoint PPT Presentation

▶

Feb 14, 2024 515 likes •1.26k views

Elliptic Curves, Cryptography and Computation Victor S. Miller IDA Center for Communications Research Princeton, NJ 08540 USA 18 Oct, 2010 Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 1 / 73 Victor S. Miller (CCR)

SLIDE 1

Elliptic Curves, Cryptography and Computation

Victor S. Miller

IDA Center for Communications Research Princeton, NJ 08540 USA

18 Oct, 2010

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 1 / 73

SLIDE 2

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 2 / 73

SLIDE 3

Number Theory and Computation

Serge Lang

It is possible to write endlessly about Elliptic Curves – this is not a threat!

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 3 / 73

SLIDE 4

Number Theory and Computation

Solutions to Diophantine Equations

A lot of research in Mathematics has been motivated by hard, but easy to state problems. Famous example: Fermat’s Last Theorem xn + yn = zn.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 4 / 73

SLIDE 5

Number Theory and Computation

Computation versus Existence

Proving that something exists versus computing it efficiently. With the availability of great computing resources, the quest for computing mathematical objects, so prominent in the 19th century, has been revived.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 5 / 73

SLIDE 6

Elliptic Curves

A field that’s becoming more known

Studied intensively by number theorists for past 100 years. Until recently fairly arcane. Before 1985 – virtually unheard of in crypto and theoretical computer science community. In mathematical community: Mathematical Reviews has about 200 papers with “elliptic curve” in the title before 1984, but in all now has about 2000. A google search yield 83 pages of hits for the phrase “elliptic curve cryptography”.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 6 / 73

SLIDE 7

Elliptic Curves

Set of solutions (points) to an equation E : y2 = x3 + ax + b. More generally any cubic curve – above is “Weierstrass Form”. The set has a natural geometric group law, which also respects field

f definition – works over finite fields.

Weierstrass p function: p′2 = 4p3 − g2p − g3. Only doubly-periodic complex function.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 7 / 73

SLIDE 8

Elliptic Curves

Chord and Tangent Process

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 8 / 73

SLIDE 9

Elliptic Curves

Abelian Varieties

Multi-dimensional generalization of elliptic curves. Dimension g has 2g periods. Also has group law, which respects field of definition. First studied by Abel (group is also abelian – a happy conincidence!).

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 9 / 73

SLIDE 10

Elliptic Curves

Elliptic Curves over Rational Numbers

Set of solutions always forms a finitely generated group – Mordell-Weil Theorem. There is a procedure to find generators – very often quite efficient (but not even known to terminate in many cases!). Size function – “Weil height” – roughly measures number of bits in a point. Tate height – smoothing of height. Points form a lattice.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 10 / 73

SLIDE 11

Elliptic Curves

Louis Mordell, Andr´ e Weil

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 11 / 73

SLIDE 12

Elliptic Curves

Barry Mazur

No point on an elliptic curve over Q has order more than 12.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 12 / 73

SLIDE 13

Elliptic Curves

John Tate

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 13 / 73

SLIDE 14

Elliptic Curves

Emil Artin and John von Neumann

In 1952 Emil Artin asked John von Neumann to do a calculation on the ENIAC computer about cubic Gauss sums related to the distribution of the number of points on y2 = x3 + 1 mod p.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 14 / 73

SLIDE 15

Elliptic Curves

Bryan Birch and Peter Swinnerton-Dyer

Birch and Swinnerton-Dyer formulated their important conjecture only after extensive computer calculations.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 15 / 73

SLIDE 16

Elliptic Curves

Bryan Birch and Peter Swinnerton-Dyer

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 16 / 73

SLIDE 17

Discrete Logarithms

The state of Number Theory

Number Theory is a beautiful garden – Carl Ludwig Siegel Oil was discovered in the garden. – Hendrik W. Lenstra, Jr.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 17 / 73

SLIDE 18

Discrete Logarithms

Public Key

In 1976 Diffie and Hellman proposed the first public key protocol. Let p be a large prime. Non zero elements of Fp form cyclic group, g ∈ Fp a “primitive root” – a generator. Security dependent upon difficulty of solving: DHP: Given p, g, ga and gb, find gab (note a and b are not known. Speculated: only good way to solve DHP is to solve: DLP: Given p, g, ga, find a. Soon generalized to work over any finite field – especially F2n.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 18 / 73

SLIDE 19

Discrete Logarithms

Marty Hellman and Whit Diffie

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 19 / 73

SLIDE 20

Discrete Logarithms

Whit Diffie and Marty Hellman

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 20 / 73

SLIDE 21

Discrete Logarithms

Attacks on DLP

Pohlig-Hellman – only need to solve problem in a cyclic group of prime order – security depends on largest prime divisor q of p − 1 (or

f 2n − 1 for F2n).

Shanks “baby step giant step” in time O(√q). They speculated that this was the best one could do.

A. E. Western, J. C. P. Miller in 1965, Len Adleman in 1978 –

heuristic algorithm in time O(exp(

2 log p log log p)).

Hellman and Reynieri – similar for F2n with 2n replacing p in above. Fuji-Hara, Blake, Mullin, Vanstone – a significant speed up of Hellman and Reynieri.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 21 / 73

SLIDE 22

Discrete Logarithms

Dan Shanks

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 22 / 73

SLIDE 23

Discrete Logarithms

Len Adleman

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 23 / 73

SLIDE 24

Discrete Logarithms

My initiation into serious cryptography

Friend and colleague of Don Coppersmith since graduate school. In 1983 Fuji-Hara gave talk at IBM, T. J. Watson Research Center “How to rob a bank”, on work with Blake, Mullin and Vanstone. The Federal Reserve Bank of California wanted to use DL over F2127 to secure sensitive transactions. Hewlett-Packard starting manufacturing chips to do the protocol. Fuji-Hara’s talk piqued Don’s interest.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 24 / 73

SLIDE 25

Discrete Logarithms

Don Coppersmith

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 25 / 73

SLIDE 26

Discrete Logarithms

Ryoh Fuji-Hari, Ian Blake, Ron Mullin, Scott Vanstone

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 26 / 73

SLIDE 27

Discrete Logarithms

Factoring, Factor Bases and Discrete Logarithms

Subexponential time factoring of integers. CFRAC: Morrison and Brillhart. Brillhart coined the term “Factor Base” Rich Schroeppel – Linear Sieve Carl Pomerance: coined the term “smooth”, the “quadratic sieve” and the notation Lx[a; b] := exp(b(log x)a(log log x)1−a). From analyzing probability that a random integer factors into small primes (“smooth”).

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 27 / 73

SLIDE 28

Discrete Logarithms

John Brillhart

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 28 / 73

SLIDE 29

Discrete Logarithms

Rich Schroeppel

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 29 / 73

SLIDE 30

Discrete Logarithms

Carl Pomerance

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 30 / 73

SLIDE 31

Discrete Logarithms

Coppersmith’s attack on DL over F2127

After Fuji-Hara’s talk, Don started thinking seriously about the DL problem. We would talk a few times a week about it – this taught me a lot about the intricacies of the “index calculus” (coined by Odlyzko to describe the family of algorithms). The BFMV algorithm was still L[1/2] (with a better constant in the exponential). Don devised an L[1/3] algorithm for F2n. Successfully attacked F2127 in seconds. Ten years later Dan Gordon devised an L[1/3] algorithm for Fp.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 31 / 73

SLIDE 32

Discrete Logarithms

Dan Gordon

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 32 / 73

SLIDE 33

Discrete Logarithms

Were Hellman and Pohlig right about discrete logarithms?

Yes, and no. For original problem – no. Needed to use specific property (“smoothness”) to make good attacks work. Nechaev (generalized by Shoup) showed that O(√q) was the best that you could do for “black box groups”. What about DHP? Maurer, and later Boneh and Lipton gave strong evidence that it was no harder than DL (used elliptic curves!).

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 33 / 73

SLIDE 34

Discrete Logarithms

Victor Shoup

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 34 / 73

SLIDE 35

Discrete Logarithms

Ueli Maurer, Dan Boneh, Dick Lipton

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 35 / 73

SLIDE 36

Enter Elliptic Curves

A New Idea

While I visted Andrew Odlyzko and Jeff Lagarias at Bell Labs in August 1983, they showed me a preprint of a paper by Ren´ e Schoof giving a polynomial time algorithm for counting points on an elliptic curve over Fp. Shortly thereafter I saw a paper by Hendrik Lenstra (Schoof’s advisor) which used elliptic curves to factor integers in time L[1/2]. This, combined with Don’s attack on DL over F2n got me to thinking

f using elliptic curves for DL.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 36 / 73

SLIDE 37

Enter Elliptic Curves

Andrew Odlyzko, Jeff Lagarias

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 37 / 73

SLIDE 38

Enter Elliptic Curves

Rene Schoof

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 38 / 73

SLIDE 39

Enter Elliptic Curves

Hendrik W. Lenstra, Jr.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 39 / 73

SLIDE 40

Enter Elliptic Curves

Diffie-Hellman in General Groups

Many people realized that DH protocol only needed associative multiplication. Some other protocols needed inverse. So one can do it in a group. Why use another group? Finite fields (mostly) have index calculus attacks. Good candidate: algebraic groups – group law and membership given by polynomial or rational functions. Chevalley’s Theorem: algebraic groups are extensions of matrix groups by abelian varieties (over finite fields). Pohlig and Hellman: DL “lives” in either matrix group or abelian variety. Using eigenvalues – matrix group DL reduces to multiplicative group DL in a small extension.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 40 / 73

SLIDE 41

Enter Elliptic Curves

Claude Chevalley

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 41 / 73

SLIDE 42

Enter Elliptic Curves

Index Calculus

Given primitive root g of a prime p. Denote by x = logg(a), an integer in [0, p − 1] satisfying gx = a. Choose a factor base F = {p1, . . . , pk} first k primes. Preprocess: find logg(pi) for all pi ∈ F. Individual log: use the table logg(pi) to find logg(a).

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 42 / 73

SLIDE 43

Enter Elliptic Curves

Some details: Preprocess

Preprocess: Choose random y ∈ Fp calculate z = gy (mod p), and treat z as an integer. See if z factors into the prime in F only. If it does we have z = pe1

1 . . . pek k .

Reduce mod p and take logs: y = e1 logg(p1) + · · · + ek logg(pk). y and ei are known: get linear equation in unknowns logg(pi). When we have enough equations, solve for unknowns.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 43 / 73

SLIDE 44

Enter Elliptic Curves

Some details: Individual Logs

Individual Logs: Choose random y ∈ Fp calculate z = agy (mod p), and treat z as an integer. See if z factors into the prime in F only. If it does we have z = pe1

1 . . . pek k .

Reduce mod p and take logs: logg(a) + y = e1 logg(p1) + · · · + ek logg(pk). Using the values of logg(pi) computed previously this gives answer. Increasing k increases probability of success, but also increases size of linear algebra problem. Optimal value yields time O(Lp[1/2; c]) for some constant c. Coppersmith and Gordon (NFS) use clever choice to get probability of success up (plus a lot of difficult details).

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 44 / 73

SLIDE 45

Enter Elliptic Curves

Factor Base for Elliptic Curves?

Given elliptic curve E over Fp, find E over Q which reduces mod p to E. Question: if P ∈ E(Fp) is random, how to find P ∈ E(Q) which reduces to P mod p? Big qualitative difference – assuming various standard conjectures (especially one by Serge Lang), one can show that the fraction of points in E(Q) whose number of bits are polynomial in log p are O((log log p)c) for some c. Probability of succeeding in random guess is far too small. Other advantage of Elliptic Curves: there are lots of them over Fp of all different sizes ≈ p (also used by Lenstra in his factoring algorithm).

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 45 / 73

SLIDE 46

Enter Elliptic Curves

Crypto ’85 and after

I corresponded with Odlyzko while forming my ideas. The day that I finally convinced him, he reported receving a letter from Neal Koblitz (who was in Moscow) also proposing using Elliptic Curves for a Diffie-Hellman protocol. At Crypto: the talk immediately preceding mine was given by Nelson Stephens – an exposition of Lenstra’s factoring method. The audience got a double dose of Elliptic Curves. After my talk, Len Adleman and Kevin McCurley asked that I give them an impromptu exposition about the theory of elliptic curves. The next year Len, and Ming-Deh Huang asked that I give them a similar talk about abelian varieties – lead to their random polynomial time algorithm for primality proving. Corresponded extensively with Burt Kaliski while he was working on his thesis about elliptic curves. He was first to implement my algorithm for the Weil pairing.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 46 / 73

SLIDE 47

Enter Elliptic Curves

Neal Koblitz

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 47 / 73

SLIDE 48

Enter Elliptic Curves

Nelson Stephens

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 48 / 73

SLIDE 49

Enter Elliptic Curves

Kevin McCurley

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 49 / 73

SLIDE 50

Enter Elliptic Curves

Ming-Deh Huang

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 50 / 73

SLIDE 51

Enter Elliptic Curves

Burt Kaliski

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 51 / 73

SLIDE 52

Enter Elliptic Curves

A few weak cases

Menezes, Okamoto and Vanstone, using Weil pairing (see below) in a case I missed – supersingular curves (more generally “low embedding degree”). Later by Frey and R¨ uck using the Tate Pairing for curves with p − 1 points. Nigel Smart, Igor Semaev, Takakazu Satoh and Kiyomichi Araki for curves with p points.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 52 / 73

SLIDE 53

Enter Elliptic Curves

Alfred Menezes, Tatsuaki Okamoto, Scott Vanstone

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 53 / 73

SLIDE 54

Enter Elliptic Curves

Gerhard Frey, Hans-Georg R¨ uck

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 54 / 73

SLIDE 55

Enter Elliptic Curves

Nigel Smart

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 55 / 73

SLIDE 56

Enter Elliptic Curves

Primality proving

Goldwasser and Kilian – gave polynomial size certificate for primality form almost all primes using elliptic curves. Atkin and Morain – generalized this to all curves (fastest known program for “titanic” primes) In 2002 Agrawal, Kayal and Saxena gave a deterministic polynomial time algorithm (not using elliptic curves).

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 56 / 73

SLIDE 57

Enter Elliptic Curves

Shafi Goldwasser, Joe Kilian

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 57 / 73

SLIDE 58

Enter Elliptic Curves

Oliver Atkin

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 58 / 73

SLIDE 59

Enter Elliptic Curves

Fran¸ cois Morain

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 59 / 73

SLIDE 60

Enter Elliptic Curves

Manindra Agrawal, Neeraj Kayal, Nitin Saxena

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 60 / 73

SLIDE 61

The Weil Pairing

Why compute the Weil Pairing?

Elliptic curve E/K, positive integer n, prime to char(K). A bilinear, alternating, galois equivariant, non-degenerate pairing en : E[n] × E[n] → µn. It’s used in descent calculations (a procedure to find a basis of the Mordell-Weil group). In that case n is usually quite small. What about when n is big? Schoof: can calculate #E(Fp) quickly, what about the group structure?

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 61 / 73

SLIDE 62

The Weil Pairing

Elliptic Curves and the Multiplicative Group

In December 1984 I gave a talk at IBM about elliptic curve cryptography. Manuel Blum was in the audience, and challenged me to reduce

rdinary discrete logs to elliptic curve discrete logs.

Needed: an easily computable homomorphism from the multiplicative group to the elliptic curve group. The Weil pairing does relate them, if it could be computed quickly. But it went the wrong way! But – the degree of the extension field involved would almost always be as big as p (thus completely infeasible).

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 62 / 73

SLIDE 63

The Weil Pairing

The Algorithm for the Weil Pairing

Need to evaluate a function of very high degree at a selected point. In theory could use linear algebra – but dimension would be far too big – on the order of p. Used the process of quickly computing a multiple of a point to give an algorithm O(log p) operations in the field. Wrote up paper in late 1985. Widely circulated (and cited) as an unpublished manuscript. Expanded verison published in 2004 in J. Cryptology.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 63 / 73

SLIDE 64

The Weil Pairing

Manuel Blum

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 64 / 73

SLIDE 65

The Weil Pairing

Group Structure

As an abstract group E(Fp) ∼ = Z/dZ × Z/deZ for some positive integer d, e. Given E/Fp find d and e. By Schoof we can find d2e = #E(Fp) quickly. Weil pairing lets us find d and e. Above paper outlines how to do this. Needs to factor gcd(p − 1, #E(Fp)). Friedlander, Pomerance and Shparlinski analyze this latter problem.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 65 / 73

SLIDE 66

The Weil Pairing

Friedlander, Pomerance and Shparlinski

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 66 / 73

SLIDE 67

Identity Based Encryption

The “Killer Application”?

In 1984 Adi Shamir proposed Identity Based Encryption – in which a public identity (such as an email address) could be used as a public key. In 2000, Antoine Joux gave the first steps toward realizing this as an efficient protocol using my Weil Pairing algorithm In 2001, Boneh and Franklin, gave the first fully functional version – also using the Weil pairing algorithm. It is now a burgeoning subfield – with thousands of papers.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 67 / 73

SLIDE 68

Identity Based Encryption

Adi Shamir

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 68 / 73

SLIDE 69

Identity Based Encryption

Antoine Joux

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 69 / 73

SLIDE 70

Identity Based Encryption

Dan Boneh and Matt Franklin

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 70 / 73

SLIDE 71

Uses in the “real world”

Applications

Elliptic Curve Cryptography is now used in many standards (IEEE, NIST, etc.). The NSA Information Assurance public web page has “The Case for Elliptic Curve Cryptography” Used in the Blackberry, Windows Media Player, standards for biometric data on passports, U. S. Federal Aviation Administration collision avoidance systems, and myriad others.

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 71 / 73

SLIDE 72

Uses in the “real world” Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 72 / 73

SLIDE 73

Uses in the “real world”

Alice and Bob

Victor S. Miller (CCR) Elliptic Curve Cryptography 18 Oct, 2010 73 / 73