Elliptic 6.4 Curve Cryptography
113
6.4 Elliptic Curve Cryptography
In this section we discuss an analogue of Die-Hellman that uses an elliptic curve instead of (Z/pZ) . The idea to use elliptic curves in cryptography was independently proposed by Neil Koblitz and Victor Miller in the mid 1980s. We then discuss the ElGamal elliptic curve cryptosystem.
6.4.1 Elliptic Curve Analogues of Die-Hellman
The Die-Hellman key exchange from Section 3.1 works well on an elliptic curve with no serious modication. Michael and Nikita agree on a secret key as follows: 1. Michael and Nikita agree on a prime p, an elliptic curve E over Z/pZ, and a point P E(Z/pZ). 2. Michael secretly chooses a random m and sends mP . 3. Nikita secretly chooses a random n and sends nP . 4. The secret key is nmP , which both Michael and Nikita can compute. Presumably, an adversary can not compute nmP without solving the discrete logarithm problem (see Problem 3.1.2 and Section 6.4.3 below) in E(Z/pZ). For well-chosen E, P , and p experience suggests that the discrete logarithm problem in E(Z/pZ) is much more dicult than the discrete logarithm problem in (Z/pZ) (see Section 6.4.3 for more on the elliptic curve discrete log problem).
6.4.2 The ElGamal Cryptosystem and Digital Rights Management
This section is about the ElGamal cryptosystem, which works well on an elliptic curves. This section draws on a paper by a computer hacker named Beale Screamer who cracked a Digital Rights Management (DRM) system. The elliptic curve used in the DRM is an elliptic curve over the nite eld k = Z/pZ, where p = 785963102379428822376694789446897396207498568951. In base 16 the number p is 89ABCDEF012345672718281831415926141424F7, which includes counting in hexadecimal, and digits of e, , and elliptic curve E is 2. The
y 2 = x3 + 317689081251325503476317476413827693272746955927x + 79052896607878758718120572025718535432100651934.
114
6. Elliptic Curves
We have #E(k) = 785963102379428822376693024881714957612686157429, and the group E(k) is cyclic with generator B = (771507216262649826170648268565579889907769254176, 390157510246556628525279459266514995562533196655). Our heroes Nikita and Michael share digital music when they are not out ghting terrorists. When Nikita installed the DRM software on her computer, it generated a private key n = 670805031139910513517527207693060456300217054473, which it hides in bits and pieces of les. In order for Nikita to play Juno Reactors latest hit juno.wma, her web browser contacts a web site that sells music. After Nikita sends her credit card number, that web site allows Nikita to download a license le that allows her audio player to unlock and play juno.wma. As we will see below, the license le was created using the ElGamal public-key cryptosystem in the group E(k). Nikita can now use her license le to unlock juno.wma. However, when she shares both juno.wma and the license le with Michael, he is frustrated because even with the license his computer still does not play juno.wma. This is because Michaels computer does not know Nikitas computers private key (the integer n above), so Michaels computer can not decrypt the license le.
We now describe the ElGamal cryptosystem, which lends itself well to implementation in the group E(Z/pZ). To illustrate ElGamal, we describe how Nikita would set up an ElGamal cryptosystem that anyone could use to encrypt messages for her. Nikita chooses a prime p, an elliptic curve E over Z/pZ, and a point B E(Z/pZ), and publishes p, E, and B. She also chooses a random integer n, which she keeps secret, and publishes nB. Her public key is the four-tuple (p, E, B, nB). Suppose Michael wishes to encrypt a message for Nikita. If the message is encoded as an element P E(Z/pZ), Michael computes a random integer r
6.4 Elliptic Curve Cryptography
115
and the points rB and P + r(nB) on E(Z/pZ). Then P is encrypted as the pair (rB, P + r(nB)). To decrypt the encrypted message, Nikita multiplies rB by her secret key n to nd n(rB) = r(nB), then subtracts this from P + r(nB) to obtain P = P + r(nB) r(nB). We implement this cryptosystem in Section 7.6.3. Remark 6.4.1. It also make sense to construct an ElGamal cryptosystem the in group (Z/pZ) . Returning out our story, Nikitas license le is an encrypted message to her. It contains the pair of points (rB, P + r(nB)), where rB = (179671003218315746385026655733086044982194424660, 697834385359686368249301282675141830935176314718) and P + r(nB) = (137851038548264467372645158093004000343639118915, 110848589228676224057229230223580815024224875699). When Nikitas computer plays juno.wma, it loads the secret key n = 670805031139910513517527207693060456300217054473 into memory and computes n(rB) = (328901393518732637577115650601768681044040715701, 586947838087815993601350565488788846203887988162). It then subtracts this from P + r(nB) to obtain P = (14489646124220757767, 669337780373284096274895136618194604469696830074). The x-coordinate 14489646124220757767 is the key that unlocks juno.wma. If Nikita knew the private key n that her computer generated, she could compute P herself and unlock juno.wma and share her music with Michael. Beale Screamer found a weakness in the implementation of this system that allows Nikita to detetermine n, which is not a huge surprise since n is stored on her computer after all.
6.4.3 The Elliptic Curve Discrete Logarithm Problem
Problem 6.4.2 (Elliptic Curve Discrete Log Problem). Suppose E is an elliptic curve over Z/pZ and P E(Z/pZ). Given a multiple Q of P , the elliptic curve discrete log problem is to nd n Z such that nP = Q.
116
6. Elliptic Curves
For example, let E be the elliptic curve given by y 2 = x3 + x + 1 over the eld Z/7Z. We have E(Z/7Z) = {O, (2, 2), (0, 1), (0, 6), (2, 5)}. If P = (2, 2) and Q = (0, 6), then 3P = Q, so n = 3 is a solution to the discrete logarithm problem. If E(Z/pZ) has order p or p1 or is a product of reasonably small primes, then there are some methods for attacking the discrete log problem on E, which are beyond the scope of this book. It is thus important to be able to compute #E(Z/pZ) eciently, in order to verify that the elliptic curve one wishes to use for a cryptosystem doesnt have any obvious vulnerabilities. The naive algorithm to compute #E(Z/pZ) is to try each value of x Z/pZ and count how often x3 + ax + b is a perfect square mod p, but this is of no use when p is large enough to be useful for cryptography. Fortunately, there is an algorithm due to Schoof, Elkies, and Atkin for computing #E(Z/pZ) eciently (polynomial time in the number of digits of p), but this algorithm is beyond the scope of this book. In Section 3.1.1 we discussed the discrete log problem in (Z/...