Efficient generation of cryptographically strong elliptic curves Shahar Papini Michael Krel Instructor : Barukh Ziv 1

 The project objective is to provide an efficient algorithm for creation of cryptographically strong elliptic curve for various cryptographical purposes. (Basically anything that uses a group structure and relies on the difficulty of discrete logarithm) 2

Public-key cryptography is based on the intractability of certain mathematical problems. Early schemes such as Diffie-Hellman rely on the difficulty of the Discrete Logarithm Problem for a finite field F[p]. Although no known polynomial time algorithms are known for this problem, a few sub- exponential algorithms exist. That’s where Elliptic curves come into the picture. 3

 Elliptic curve introduce a group structure, where no known sub-exponential algorithms are known for the Discrete Logarithm Problem. Moreover, the basic action on this group is much more complex then in the F[p] case.  For comparison between encryption using F[p] (e.g. RSA), and using EC, to achieve the same level of security we will need 256-bit key size for EC, where RSA will need 3072-bit public keys. 4

An elliptic curve is the locus of points over the field (usually F[p]) which hold the equation : These points form a group under the following group action (for distinct x values): 5

The intuition behind this definition is the following: 6

The strength of an elliptic curve is determined by its order. Elliptic curve will be called strong if its order is n∙p where p is a large prime and n is a small number (usually less than 10). Finding the order of an elliptic curve is difficult problem. The goal of our project is to be able to generate such elliptic curves in an efficient manner. 7

There are two main approaches to the problem of generating strong elliptic curves: Point counting: The idea behind this approach is to randomly generate curves of the desired field, and count its order using Point Counting algorithms(usually slow). Complex multiplication: Here, we try to anticipate from advanced the desired order of the curve, and using this, generate a curve accordingly. Unlike the former method, we will not be able to generate every possible curve, only curves from some constrained subset. 8

 We chose the Complex Multiplication approach. We had a few reasons:  Point counting algorithms are slower than the CM algorithms and since we want the fastest way to create elliptic curve we must choose the faster method.  We saw that we have more room for exploring the CM algorithm. 9

 Generation of strong elliptic curves of bit in a few seconds.  Encryption and decryption of data around 3 kilobytes in less than 5 seconds. 10

 There are three ways to represent points on the elliptic curve. 1. The standard method is to save the coordinates as they are (X,Y) that they hold the elliptic curve equation: 2. The Jacobian projective coordinates that save three numbers for each point (X,Y,Z) where the standard coordinates are (X/Z²,Y/Z³). 3. The compressed method which saves only sign and X value. From the equation we can calculate Y². There are two corresponding Y values, that differ by sign alone. So, we keep the sign as well. 11

 We used the jacobian method for all the computations for points on the curve. In this method the calculations are more efficient than in the other methods.  In the encryption the cipher text (represented by group points) we used compressed coordinates in order to reduce the file size. 12

 General idea: with a given prime P and a negative Discriminant D we seek a solution for the diophantic equation :  If a solution exists, then we can construct two elliptic curves of orders  If one of the orders is cryptographically strong we construct an elliptic curve with such order using a root modulo p of the Hilbert class polynomial corresponding to D. 13

 Calculating Hilbert class polynomials takes a great amount of time since the coefficients are very big numbers (magnitude of P).  To avoid that problem we constructed Weber class polynomials, found a root modulo P and converted it to a root modulo P of the corresponding Hilbert class polynomial.  Using the Weber polynomials we avoid the coefficients problem since the Weber coefficients are much smaller. 14

 We use the El-Gamal algorithm.  To generate a key, first find a point P on an elliptic curve. Then generate a random integer s. (P, s) is the private key. (P, sP) is the public key. To send a message M, one finds a random integer k, and transmits (M+k(sP), kP). To decrypt, we calculate (M+k(sP))–s(kP). 15

16

17

18 EC generation time

19

20

 The project is designed to work on Windows and we written in C++.  We used two external libraries for cpp:  NTL which handles big integers and integers modulo P. We used this library since we needed to handle with bit numbers.  ARPREC which handles big floats with arbitrary precision. This library handles with complex numbers which we use to construct Weber class polynomials. 21

 Guide To Elliptic Curve Cryptography – Hankerson  Prime numbers a computational perspective - Crandall  Elliptic Curves Number Theory and Cryptography - Lawrence C. Washington  On the Use of Weber Polynomials in Elliptic Curve Cryptography – Konstantinou, Stamatiou, Zaroliagis  Elliptic curves and primality proving – Atkin, Morain  A Course in Computational Algebraic Number Theory - Henri Cohen  On the Efficient Generation of Elliptic Curves over Prime Fields - Konstantinou, Stamatiou, Zaroliagis  IEEE P1363 / D13 22

23