1. Elliptic Curve Weak Class Identification for the Security of Cryptosystem Intan Muchtadi, Ahmad Muchlis and Fajar Yuliawan Algebra Research Group, Institut Teknologi Bandung (ITB), Indonesia

2. Elliptic Curve  In 1985 both Koblitz and Miller independently suggested the use of Elliptic Curves in the development of a new type of public key cipher.  An Elliptic Curve is a simple equation of the form: y 2 = x 3 +ax+b a,b in F of characteristic p  2,3 and 4a 3 + 27b 2  0

3. Elliptic curve y 2 = x 3 − x

4. y 2 = x 3 − ½x + ½

5. y 2 = x 3 − 4/3x + 16/27

6. Elliptic curve over F 23 y 2 = x 3 + x + 1

7. Elliptic Curve Addition P+Q P Q

8. Multiples in Elliptic Curves 1  The interest in Elliptic Curve Addition is the process of adding a point to itself. That is given a point P find the point P+P or 2P. This is done by drawing a line tangent to P and reflecting the point at which it intercepts the curve P can be added to itself k times resulting in a point W = kP.

9. Multiples in Elliptic Curves 1 P+P = 2P P

10. Multiples in Elliptic Curves 2  Finding the value of 3P: 3P P P+P = 2P

11. Discrete Logarithm Problem 1.A and B agree on a finite group G and some fixed element g. 2. A selects an integer x at random and transmits b = g x to B. 3. B selects an integer y at random and transmits c = g y to A. 4. A determines k = c x, B determines k = b y, k is then used as the secret key.

12. Elliptic Curve Cryptography Based on the discrete logarithm problem applied to Abelian group E(Fp) formed by the points of an elliptic curve over a finite field E(Fp)={(x,y)  (Fp)²:y²=x³+ax+b}  {O}

13. Elliptic Curve Discrete Logarithm Problem 1.A and B agree on some fixed point P 2. A selects an integer x at random and transmits S = xP to B. 3. B selects an integer y at random and transmits R = yP to A. 4. A determines Q = Rx, B determines Q= yS, Q=yxP = xyP is then used as the secret key.

14. Elliptic Curve Cryptosystem  There are several ways in which the ECDLP can be imbedded in a cipher system. One method begins by selecting an Elliptic Curve and a point P on the curve and a secret number d which will be the private key. The public key is P and Q where Q = dP A message is encrypted by converting the plaintext into a number m, selecting a random number k, and finding a point M on the curve where the difference of the x and the y co- ordinates equals m. the ciphertext consists of two points on the curve: (C1,C2) = (kP, M + kQ)

15. Decipher  The secret key, d is used to decipher the ciphertext Multiply the first point by d and subtract the result from the second point: M = C2-dC1= M+kQ –dkP= M + kdP - dkP

16. Elliptic Curve Encryption  INPUT: Prime p, elliptic curve E, point P of order n, private key d  [1,n-1], plaintext m  OUTPUT: Ciphertext (C1,C2)

17. EC Encryption 1.Compute Q=dP 2.Represent the message m as the point M in E(Fp) 3.Select k  [1,n-1] 4.Compute C1=kP 5.Compute C2 = M + kQ 6.Return (C1,C2)

18. Elliptic Curve Decryption  INPUT : prime p, elliptic curve E, point P of order n, private key d, ciphertext (C1,C2)  OUTPUT: Plaintext m 1.Compute M = C2-dC1 and extract m from M 2.Return (m).

19. Elliptic Curve Security  The security of the Elliptic Curve algorithm is based on the fact that it is very difficult (as difficult as factoring) to solve the Elliptic Curve Discrete Logarithm Problem: Given two points P and Q where Q = kP, find the value of k

20. Imaginary Quadratic Orders

21. Maximal Orders and Non-maximal Orders  If Δ is squarefree, then O Δ is the maximal order of the quadratic number field Q(√Δ) and Δ is called a fundamental discriminant.  The non-maximal order of conductor p>1 with ( non- fundamental ) discriminant Δ p =Δp² is denoted by O Δ p. Assume that the conductor p is prime.  Let I Δ = The group of invertible O Δ -ideals and  P Δ = The set of principal O Δ -ideals.  The class group of O Δ = Cl(Δ) = I Δ /P Δ is a finite abelian group with neutral element O Δ  The class number of O Δ = h(Δ) = | Cl(Δ)|.

22. Imaginary Quadratic Orders  In 1988 Buchmann and William use the class groups of imaginary quadratic orders Cl  for the construction of cryptosystem.

23. Reducing the DLP  Huhnlein et al showed that for totally non-maximal imaginary quadratic orders (i.e., h  =1), the DLP can be reduced to the DLP in some finite field.

24. Problem  Can we find a condition for elliptic curves such that the DLP for those curves can be reduced to the DLP of some finite fields?

25. The 1 st Relation  If E is an elliptic curve over Fq, then endomorphism ring of E is an imaginary quadratic order O  if and only if |E(Fq)| ≠ q+1.  Moreover, there exists a   O  such that |E(Fq)| = q + 1 – (  +  ), where  is the conjugate of , and  is the Frobenius endomorphism   (x,y) = (x q,y q ) for all (x,y)  E(Fq).

26. Consequence  If q satisfies 4q=m²-Δn², for some m,n  Z, then  =±(m+n√Δ)/2,  As  ²-t  +q=0, we get t =  +  =±m.  Therefore |E(Fq)| = q +1 ± m  If m=1, then |E(Fq)| = q or q+2.  The case |E(Fq)|=q is cryptographycally weak  We consider the case where |E(Fq)|=q+2.

27. The Result: Reducing the ECDLP Main Theorem Let q be a prime satisfies 4q=1-Δn², for some n  Z, such that p=q+2 is also a prime, and let E be an elliptic curve over Fq with |E(Fq)|=p. Then the DLP in E(Fq) can be reduced to the DLP in Fp² as additive group.

28. The method in [Huhnlein et al]

29. The 2 nd Relation

30. Auxiliary Result

31. The proof E(Fq)  O  /(  -1) O   O  /pO   Fp 2  given G and P  E(Fq) with P=[m]G,  compute the corresponding elements  +(π-1) O  and  +(π-1) O   O  /(  -1) O   compute the corresponding  +pO  and  +pO   O  /pO   compute the corresponding elements in Fp²  Then compute the discrete logarithm there or determine that it does not exist.

32. Conclusion  For q a prime satisfies 4q=1-Δn², for some n  Z, such that p=q+2 is also a prime, the ECDLP in E(Fq) whose order is p can be reduced to the DLP in finite field of order p² as additive group.

33. Question of Existence  How to construct such cryptographically weak curves. Answer  By using the construction of anomalous elliptic curves (i.e. where |E(Fq)|=q).

34. Recall  If q satisfies 4q=m²-Δn², for some m,n  Z, then  =±(m+n√Δ)/2,  As  ²-t  +q=0, we get t =  +  =±m.  Therefore |E(Fq)| = q +1 ± m  If m=1, then |E(Fq)| = q or q+2.

35. Construction of Anomalous Curves (based on [Leprevost et al])  Step 1 :  Choose  < 0 a fundamental discriminant of an imaginary quadratic field K = Q(  ) such that order of K has class number 1.   {-3, -4, -7, -8, -11, -19, -43, -67, -163} [Cox, Theorem 7.30]

36. Step 1(contd)  Choose an odd prime q such that 4q = 1-  n 2 for an integer n.  We can show that 1. -   3 mod 8 (   {-3, -11, -19, -43, -67, - 163} ) 2. q = -  u(u+1)+ (-  +1)/4 for some integer u

37. Step 2  O K = O  =Z[(  +  )/2  Let j(O K ) be the j-invariant of O K. For class number = 1 the j-invariant is given as following [Cox, p.261]  j(O k ) -30 -11-32 3 -19-96 3 -43-960 3 -67-5280 3 -163-640320 3

38. Step 3  Choose an elliptic curve over L=K(j(O K )) with j-invariant j 0 = j(O K ) :  Since j(E) = 1728(4a 3 /(4a 3 +27b 2 )), then we can choose E: y 2 = x 3 + ax + b where a=3j 0 /(1728-j 0 ) and b=2j 0 /(1728-j 0 )

39. Step 4  Reduce E to E : y 2 = x 3 + [a]x + [b] over Fq  We can show that |E(Fq)|  {q,q+2}  If |E(Fq)|=q+2, a prime, then we’re done.

40. Step 5  If |E(Fq)|=q, define E’:y 2 =x 3 +d 2 [a]x+d 3 [b], where d  Fq a non-quadratic element.  |E’(Fq)| = q+2  If q+2 is prime, then we’re done.

41. Problem  It’s not easy to find a prime q such that  4q = 1-  n 2 for an integer n  q+2 is also a prime

42. Example  For  = -11 dan u = 257 743 850 762 632 419 871 495,  q = 11u(u + 1) +(11+1)/4 = 730 750 818 665 451 459 112 596 905 638 433 048 232 067 471 723  j(O K )=-32 3

43. Example (contd)  E: y 2 = x 3 + ax + b  a= 3(-32 3 )/(1728-(-32 3 )) =425 706 413 842 211 054 102 700 238 164 133 538 302 169 176 474  b= 2(-32 3 )/(1728-(-32 3 )) = 527 387 882 116 624 522 439 332 460 655 566 708 278 801 941 557

44. Example(contd)  #E(Fq) = q+2 BUT  q + 2 = 730 750 818 665 451 459 112 596 905 638 433 048 232 067 471 725 = 3 3 x 5 2 x 4217 x 20 016 645 573 637 x 2413 234 030 223 5314 x607 504 832 341 is not a prime

45. Twin Prime Conjecture  There are infinitely many primes q such that q + 2 is also prime.

46. Next?  Find examples of “weak curves”, i.e twin primes that satisfy the condition in the Main Theorem.  Does the result in this work have any relevance to the ECDLP for elliptic curves whose endomorphism ring is a totally non-maximal order?

47. References [1] H.Baier (2002), Efficient algorithms for generating elliptic curves over finite fields suitable for use in cryptography, PhD Dissertation. [2] I. F. Blake, G. Seroussi, and N. P. Smart (2000), Elliptic curves in cryptography, volume 265 of London Mathematical Society Lecture Note Series,Cambridge University Press, Cambridge. [3] I. F. Blake, G. Seroussi, and N. P. Smart (2005), Advances in elliptic curve cryptography, volume 317 of London Mathematical Society Lecture Note Series, Cambridge University Press, Cambridge. [4]J.Buchmann dan H.C.Williams (1988), A key exchange system based on imaginary quadratic field, Journal of Cryptology, 1, 107-118.

48. References (contd) [5] J. Buchmann (2004), Introduction to cryptography, Springer. [6] H. Cohen and G. Frey (2006), Handbook of elliptic and hyper elliptic curve cryptography, Hall and Chapman, Taylor and Francis Group. [7] D. A. Cox (1989), Primes of the forms x2 + ny2, John Wiley and Sons, New York. [8] W. Diffie and M. Hellman (1976), New directions in cryptography, IEEE Transactions on Information Theory, 22, 472-492. [9] A. Enge (2001), Elliptic curves and their applications to cryptography : an introduction, Kluwer Academic Publishers. [10] D.Hankerson, A.J. Menezes, S. Vanstone (2004), Guide to elliptic curve cryptography, Springer-Verlag, New York.

49. References (contd) [11] D.Huhnlein, M.J. Jacobson, S. Paulus and T.Takagi (1998), A cryptosystem based on non-maximal imaginary quadratic order with fast decryption, in Advances in Cryptology, LNCS 1403, Springer, 294-307. [12] D.Huhnlein, M.J. Jacobson, D. Weber (2003), Towards Practical Non-Interactive Public-Key Cryptosystems Using Non- Maximal Imaginary Quadratics Orders, Designs, Codes and Cryptography, 30, Issue 3, 281-299. [13] D.Huhnlein, T.Takagi (1999), Reducing logarithms in totally non-maximal imaginary quadratic orders to logarithms in nite elds, ASIACRYPT, 219-231. [14] N.Koblitz (1987), Elliptic curve cryptosystem, Mathematics of Computation 48, 203-209.

50. References (contd) [15] H.W.Lenstra (1996), Complex multiplication structure of elliptic curves, Journal of Number Theory, 56, No. 2, 227-241. [16] F. Leprevost, J.Monnerat, S. Varrette, S.Vaudenay (2005), Generating anomalous elliptic curves, Information Processing Letters, 93, 225-230. [17] K. S. McCurley (1988), A Key Distribution System Equivalent to Factoring, Journal of Cryptology 1, 95-105. [18] V.S. Miller (1986), Use of elliptic curve in cryptography, in Advances in Cryptology - CRYPTO '85, Springer-Verlag, LNCS 218, 417-426. [19] J.H. Silverman (1986), The arithmetic of elliptic curves, Springer-Verlag, NewYork. [20] L.C. Washington (2008) Elliptic curves, number theory and cryptography,Chapman and Hall/CRC, Taylor and Francis Group.

51. Thank you