Elliptic Curves 1 - CSS Homepageshomepages.herts.ac.uk/~comqjs1/Ellipt1.pdf · Elliptic Curves 1 Joseph Spring Department of Computer Science MSc - Distributed Systems and Security

Lecture - 25th February 2002

Elliptic Curves 1

Joseph SpringDepartment of Computer Science

MSc - Distributed Systems and Security


Areas for Discussion

• Motivation

• Elliptic Curves

• Elliptic Curves over Finite Fields

• Cryptography with Elliptic Curves

• Security of ECC


Motivation

• Majority of products/standards using public keycryptography for encryption and digital signaturesuse RSA

• Bit length for secure RSA however, has increased inrecent years putting heavier processing loads onapplications that use RSA

• This has had subsequent consequences for e-commerce sites that carry out a lot of securetransactions


Motivation

• Elliptic Curve Cryptography (ECC) is a recent

development in the field of public key systems - a

new challenger to RSA

• ECC already appears in Standardisation documents

– e.g. IEEE P1363 Standard for Public Key Cryptography


Motivation

• Attraction– ECC appears to offer the same security for far smaller bit

size - thus reducing processing time

– Theory for ECC longstanding

• Concern lies in– ECC products are a recent innovation

– Sustained cryptanalytic interest looking for weaknesses inECC are recent

– Hence, confidence in ECC not yet as high as in RSA


Diophantine Equations

• Elliptic curves belong to a class of equations knownas Diophantine Equations which are polynomialequations in one or more variables for which we seekeither integer or rational solutions

• For example:2 2 2

4 4 4

2 2

Pythagorean Triples Fermats equation of degree 4

1 Pells Equation (D being a non square integer)

X Y Zx y zx Dy

+ =+ =− =


Elliptic Curves - Form of Equation• In general Elliptic Curves are of the form:

where a, b, c and d are real numbers satisfying somesimple conditions

• Included in the definition of any elliptic curve is anelement 0 referred to as the point at infinity or thezero point

• Such equations are said to be cubic or of order 3– the highest power they contain is a 3

2 3 2y axy by x cx dx e+ + = + + +


Elliptic Curves - Form of EquationExamples

(see p194 in course text for graphs of examples)

Sketch the following elliptic curves:

2 3

2 3

1 2 1

y x xy x x

= −= + +

2 3

2 3

2 3 2

1 172 3 4 16

y xy x xy x x

= += += − +


Elliptic Curves - Sketch/Graphs










Elliptic Curves - Graphs

Note

• Elliptic curves are not Ellipses– the graph of an ellipse looks like a flattened circle

– equations for an elliptic curve are similar to those used tocalculate the circumference of an ellipse


Elliptic Curves - AdditionA form of addition may be defined upon ‘the set ofpoints on an Elliptic curve E’ such that an AbelianGroup (E,+) results.

We begin with the following definition:

DefinitionIf three points lie on an elliptic curve E and at thesame time also lie on a straight line then their sum isDEFINED to be ‘0’ the point at infinity or zero point(see pp 193-195 of course text)


Elliptic Curves - Addition• 0 is referred to as the additive identity. So

• 0 = - 0 and in particular P + 0 = P

for all points P lying on the Elliptic curve E• A vertical line meets the elliptic curve E at two

points P1 = (x, y) and P2 = (x, -y) with the same x co-ordinate. It also meets the curve at the infinity point0. Hence

• P1 + P2 + 0 = 0 and P1 = - P2

So the negative of a point is a point with the same xco-ordinate but negative y co-ordinate


Elliptic Curves - Addition

• The addition of two points with different x co-ordinates may now be defined:

Case 1 Q !R straight line non-tangentialDraw a straight line between points Q and R. Thestraight line intersects the Elliptic Curve E again atthe point P1.

Case 2 Q !R straight line tangential at QIn this case we take P1 = Q

Case 3 Q !R straight line tangential at RIn this case we take P1 = R



In each of Cases 1, 2 and 3 it follows thatQ + R + P1 = 0

and hence thatQ + R = - P1

(See p 194 for the construction)

Note:To double a point Q we simply draw the tangent tothe Elliptic curve E at Q find the third point S. Then:

Q + Q = 2Q = -S



Now that we have a construction allowing us to addany two points on an Elliptic curve E we caninvestigate the– Associative and Commutative Properties of Addition

As mentioned earlier it transpires that the points onan Elliptic curve form an Abelian group - theproperties of which follow on the next slide:


Elliptic Curves - Addition Properties

Let E be an Elliptic Curve; Q, -Q, R and S be points onE; and 0 be the point at infinity / zero point1 Identity Law,

Q + 0 = 0 + Q = Q (additive identity)2 Commutative Law

Q + R = R + Q3 Associative Law

Q + (R + S) = (Q + R) + S4 Inverse Law

Q + (-Q) = (-Q) + Q = 0 (additive inverse)


Elliptic Curves - Question

For next Lecture:

1 Using the construction shown above and on pp 193 -195 of the course text book show that the points of anElliptic Curve form an Abelian Group

2 What is the significance of an Abelian Group inPublic Key Cryptography?


Summary

• Motivation

• Elliptic Curves

• Elliptic Curves over Finite Fields

• Cryptography with Elliptic Curves

• Security of ECC


References

• William Stallings: Cryptography and NetworkSecurity

• Jan C A Van Der Lubbe: Basic Methods ofCryptography

• Joseph H Silverman: A Friendly introduction toNumber Theory

• Douglas R Stinson: Cryptography - Theory andPractice

• N Koblitz: A Course in Number Theory andCryptography

Documents

Elliptic Curves 1 - CSS Homepageshomepages.herts.ac.uk/~comqjs1/Ellipt1.pdf · Elliptic Curves 1 Joseph Spring Department of Computer Science MSc - Distributed Systems and Security