1. PSEC-KEM NTT Tetsutaro Kobayashi

2. 2001/10/10CRYPTREC 2001 2 Policy Elliptic curve cryptsystem IND-CCA2

3. 2001/10/10CRYPTREC 2001 3 Key Types Secret key SK = ( s ) Public key PK = ( E, W, MGF, hLen ) E:Elliptic curve parameter W:Base point of E, W = sP MGF:Choice of MGF hLen:Bit length of MGF output

4. 2001/10/10CRYPTREC 2001 4 Specification KGP-PSEC EP-PSEC DP-PSEC ES-PSEC-KEM EME-PSEC-KEM-A EME-PSEC-KEM-B EME-PSEC-KEM-C EME-PSEC-KEM-D Cryptograhic primitives Key encapsulation mechanisms Encoding methods

5. 2001/10/10CRYPTREC 2001 5 Cryptographic Primitives EP-PSEC [Encryption] Q =  W C 1 =  P DP-PSEC [Decryption] Q = sC 1

6. 2001/10/10CRYPTREC 2001 6 Encoding Methods EME-PSEC-B EME-PSEC-A 0000…0000Random r 32 bit pLen + 128 bit keyLen bit (  = t mod p ) 0000…0001C1C1 32 bit Q qmLen bit hLen bit rc2c2 C 0 = C 1 || c 2 tk MGF hLen bit P P W W

7. 2001/10/10CRYPTREC 2001 7 Elliptic Curve DH Problem Solve abP form given P, aP, bP on elliptic curve  ECDHP is difficult

8. 2001/10/10CRYPTREC 2001 8 Comparison of Security 

9. 2001/10/10CRYPTREC 2001 9 Advantage of Ellptic curve 160 bit EC Diffie-Hellman 1024 bit Diffie-Hellman Key length ( | p | )

10. 2001/10/10CRYPTREC 2001 10 Comparison of Efficiency * Group checking operation

11. 2001/10/10CRYPTREC 2001 11 Parameters Necessary conditions –Parameters pLen  160 hLen  128 –Hash function Any Recommended conditions –Parameters pLen = 160 hLen = 160 keyLen = 256 –Hash function MGF: MGF1-SHA1 R: Compressed

12. 2001/10/10CRYPTREC 2001 12 Evaluation by Implement Environment –CPU:Pentium ‐ III 600MHz (FSB 100MHz) –RAM:128MB –OS:Windows2000 5.0 (Build 2195) SP2 –Compiler:Visual Studio 6 Enterprise SP5 –Language:C Parameters –Same as recommended conditions –Prime field

13. 2001/10/10CRYPTREC 2001 13 Result

14. 2001/10/10CRYPTREC 2001 14 Status of Publicity Essential patent of PSEC –Announcement of royalty-free licenses [Apr 17, 2001] ISO JTC1 SC27 WG2 draft