Elliptic curve arithmetic - ECC 2017Elliptic curve arithmetic Wouter Castryck ECC school, Nijmegen,...
Transcript of Elliptic curve arithmetic - ECC 2017Elliptic curve arithmetic Wouter Castryck ECC school, Nijmegen,...
Elliptic curve arithmetic
Wouter Castryck
ECC school, Nijmegen, 9-11 November 2017
π1
π2
π1 + π2
Tangent-chord arithmeticon cubic curves
IntroductionConsequence of BΓ©zoutβs theorem: on a cubic curve
πΆ βΆ π π₯, π¦ = Οπ+π=3ππππ₯ππ¦π = 0,
new points can be constructed from known points using tangents and chords.
This principle was already known to 17th century natives like Fermat and Newton.
π π₯, π¦ = 0
Pierre de Fermat
Isaac Newton
Introduction
This construction was known to respect the base field.
This means: if π π₯, π¦ β π[π₯, π¦] with π some field, and one starts from points having coordinates in π, then new points obtained through the tangent-chord method also have coordinates in π.
Informal reason:
Consider two points on the π₯-axis π1 = π, 0 and π2 = (π, 0).Then the βchordβ is π¦ = 0.
The intersection is computed by π π₯, 0 = π₯ β π β π₯ β π β linear factor
always has a root over π!
π1
π2
π π₯, π¦ = 0
IntroductionThus: tangents and chords give some sort of composition law on the set of π-rational points of a cubic curve.
Later it was realized that by adding in a second step, this gives the curve an abelian group structure! only after an incredible historical detour which took more than 200 yearsβ¦
First formalized by PoincarΓ© in 1901.
Henri PoincarΓ©
choose a base point
π
π1
π2
π1 + π2
π
2π commutativity:π1 + π2 = π2 + π1
associativity: π1 + π2 + π3 = π1 + (π2 + π3)
neutral element:π + π = π
inverse element:β βπ βΆ π + βπ = π
Introduction
Conditions for this to work:
1) One should work projectively (as opposed to affinely):
Homogenize
π π₯, π¦ = Οπ+π=3ππππ₯ππ¦π to πΉ π₯, π¦, π§ = Οπ+π=3ππππ₯
ππ¦ππ§3βπβπ
and consider points π₯: π¦: π§ β (0: 0: 0), up to scaling.
Two types of points:
affine points points at infinity
π§ = 0
π§ β 0: the point is of the form (π₯: π¦: 1)
But then π₯, π¦ is an affine point!
π§ = 0: points of the form (π₯: π¦: 0) up to scaling.
(Up to three such points.)
Introduction
Conditions for this to work:
2) The curve should be smooth, meaning that
π =ππ
ππ₯=
ππ
ππ¦=
ππ
ππ§= 0
has no solutions.
This ensures that every point π has a well-defined tangent line
π βΆππ
ππ₯π β π₯ +
ππ
ππ¦π β π¦ +
ππ
ππ§π β π§ = 0.
Introduction
Conditions for this to work:
3) π should have coordinates in π, in order for the arithmetic to work over π.
π
Definition: an elliptic curve over π is a smooth projectivecubic curve πΈ/π equipped with a π-rational base point π.
(Caution: there exist more general and less general definitions.)
Under these assumptions we have as wanted:Tangent-chord arithmetic turns πΈ into an abelian group with neutral element π.The set of π-rational points πΈ(π) form a subgroup.
Exercises
1) Describe geometrically what it means to invert a point π, i.e. to find a point βπ such that
π + βπ = π.
π
2) Why does this construction simplify considerably if π is a flex (= point at which its tangent line meets the curve triply)?
3) If π is a flex then
3π β π + π + π = π if and only if π is a flex.
Explain why.
On the terminologyβelliptic curvesβ
On the terminology
In the 18th century, unrelated to all this, Fagnano and Euler revisited the unsolvedproblem of determining the circumference of an ellipse.
Giulio Fagnano
Leonhard Euler
?
They got stuck on difficult integrals, now called elliptic integrals.
On the terminology
In the 19th century Abel and Jacobi studied the inverse functions of elliptic integrals.
π‘ = π(π ) ?
When viewed as complex functions, they observeddoubly periodic behaviour: there exist π1, π2 β π suchthat
π π§ + π1π1 + π2π2 = π π§ for all π1, π2 β π.
Niels H. Abel
Carl G. Jacobi
Compare to: sin π₯ + π β 2ππ = sin π₯ for all π β π, etc.
Such generalized trigonometric functions became known as elliptic functions.
On the terminology
In other words: elliptic functions on π are well-defined modulo ππ1 + ππ2.
π1
π2
Karl Weierstrass
Mid 19th century Weierstrass classified all elliptic functions forany given π1, π2, and used this to define a biholomorphism
π/(ππ1 + ππ2) β πΈ: π§ β¦ (β π§ ,ββ² π§ )
to a certain algebraic curve πΈβ¦
Note that π/(ππ1 + ππ2) is an abelian group, almost by definition.
The biholomorphism endows πΈ with the same group structureβ¦ β¦ where it turns out to correspond to tangent-chord arithmetic!
β¦ which he called an elliptic curve!
Weierstrass curves andtheir arithmetic
The concrete type of elliptic curves found by Weierstrassnow carry his name. They are the most famous shapes ofelliptic curves.
Assume char π β 2,3.
π¦2 = π₯3 + π΄π₯ + π΅π¦2π§ = π₯3 + π΄π₯π§2 + π΅π§3
(typical plot for π = π)
Weierstrass curvesπ§ = 0 π = (0: 1: 0)
Definition: a Weierstrass elliptic curve is defined by
where π΄, π΅ β π satisfy 4π΄3 + 27π΅2 β 0.The base point π is the unique point at infinity.
Can be shown: up to βisomorphismβ every elliptic curve is Weierstrass.
Note:
1) the lines through π = (0: 1: 0) are thevertical lines (except for the line at infinityπ§ = 0).
2) The equation π¦2 = π₯3 + π΄π₯ + π΅ is symmetric in π¦.
Weierstrass curves
(π₯, π¦)This gives a first feature: inverting a point on a Weierstrass curve is super easy!
Indeed: if π = (π₯, π¦) is an affine point then
βπ = π₯,βπ¦ .
π
π
(π₯, βπ¦)
What about point addition?
Weierstrass curves
Write π1 + π2 = π₯3, π¦3 .
Line through π1 = (π₯1, π¦1) and π2 = (π₯2, π¦2) is
π¦ β π¦1 = π π₯ β π₯1 where π =π¦2βπ¦1
π₯2βπ₯1.
π1
π2
π1 + π2
Substituting π¦ β π¦1 + π π₯ β π₯1 in the curve equation π₯3 + π΄π₯ + π΅ β π¦2 = 0:
π₯3 + π΄π₯ + π΅ β (π2π₯2 +β―) = 0.π₯3 + π΄π₯ + π΅ β π¦1 + π π₯ β π₯12= 0.π₯3 β π2π₯2 +β― = 0.
So, sum of the roots is π2. But π₯1, π₯2 are roots!
We find: απ₯3 = π2 β π₯1 β π₯2π¦3 = βπ¦1 β π(π₯3 β π₯1)
Weierstrass curves
π
2π
where π =π¦2βπ¦1
π₯2βπ₯1.
We find: απ₯3 = π2 β π₯1 β π₯2π¦3 = βπ¦1 β π(π₯3 β π₯1)
But what if π₯1 = π₯2?
Two cases:
Either π¦1 = π¦2 β 0, i.e. π1 = π2 = π.
In this case we need to replace π by
π =3π₯1
2+2π΄π₯1
2π¦1.
Or π¦1 = βπ¦2, in which case π1 + π2 = π.
π
π1
π2
Conclusion: formulas for computing on a Weierstrass curve are not too bad, but case distinctive.
More efficient elliptic curve arithmetic?
The Weierstrass addition formulas are reasonably good for several purposesβ¦β¦ but can they be boosted? Huge amount of activity starting in the 1980βs.
One reason: Koblitz and Millerβs suggestion to use elliptic curves in crypto!
Initial reason: Lenstraβs elliptic curve method (ECM) for integer factorization.
agree on πΈ/π π and π β πΈ(π π)
chooses secret π β π chooses secret π β π
computes ππ computes ππreceives receivescomputes π ππ = πππ computes π ππ = πππ
(Example: Diffie-Hellman key exchange.)
Victor Miller
Neal Koblitz
Generic methods for efficientscalar multiplication
Efficient scalar multiplication
The most important operation in both(discrete-log based) elliptic curve cryptography,the elliptic curve method for integer factorization,
is scalar multiplication: given a point π and a positive integer π, compute
ππ β π + π +β―+ π
π times.
Note: adding π consecutively to itself π β 1 times is not an option!
in practice π consists of hundreds of bits!
Efficient scalar multiplication: double-and-add
Much better idea: double-and-add, walking through the binary expansion of π.
Toy example: replace the 15 additions in
16π = π + π + π + π + π + π + π + π + π + π + π + π + π + π + π + π
by the 4 doublings in
16π = 2 2 2 2π .
General method:
π = 101100010β¦0101 π·
double
ππ·
double and add
π ππ· + π·
double and add
π π ππ· + π· + π·
double
π(π π ππ· + π· + π·)
double
π(π π π ππ· + π· + π· )
double
π π π π π ππ· + π· + π·
double and add
π π π π π π ππ· + π· + π· + π·
double
π π π π π π π ππ· + π· + π· + π·
Exercise: verify that this computes ππ using π(log π) additions or doublings, as opposed to π(π).(Hornerβs rule, basically.)
Warning: finding the most optimal chain of additions and doublings to compute ππ is a very difficult combinatorial problem.
We donβt want to spend more time on it than on computing ππ itself!
Efficient scalar multiplication: double-and-add
Asymptotically this is as good as we can expectβ¦
β¦ but in practice, considerable speed-ups over naive double-and-add are possible!
Example: double-and-add computes 15π as
π, 2π, 3π, 6π, 7π, 14π, 15π.
However it would have been more efficient to compute it as
π, 2π, 3π, 6π, 12π, 15π
ππ·
Efficient scalar multiplication: windowing
In double-and-add, processing a 0 (doubling) is less costly than processing a 1 (doubling and adding π). Is there a structural way of reducing the number of additions?
Example with π€ = 2:
π = 101100010β¦0101 π ππ· + ππ·
quadruple and add ππ·
π(π ππ· + ππ·)
quadruple
π π π ππ· + ππ· + π·
quadruple and add π·Requires precomputation of π,β¦ , 2π€β1π which grows exponentially with π€.
Method can be spiced up by allowing the window to slide to the next window starting with a 1.
One idea to achieve this: windowing, which is the same as double-and-add, but we now processblocks (= windows ) of π€ bits in one time.
Efficient scalar multiplication: signed digitsRecall that on a Weierstrass elliptic curve, inverting a point is quasi cost-free:
β π₯, π¦ = (π₯,βπ¦).
Idea: use negative digits in the expansion, at the benefit of having more 0βs.
The non-adjacent form (NAF) of an integer π is a base 2 expansion-> with digits taken from {β1,0,1}-> in which no two consecutive digits are non-zero.
Such an expansion always exists, is unique, and easy to find.
π·
double
ππ·
double
π ππ·
double and subtract
π π ππ· β π·
double
π(π π ππ· β π·)
double and subtract
π π π π ππ· β π· β π·
double
π π π π π ππ· β π· β π·
double and add
π π π π π π ππ· β π· β π· + π·
double
π π π π π π π ππ· β π· β π· + π·π = 1 0 0 -1 0 -1 0 1 0 β¦ 0 1 0 0 1
This method also comes in a windowing version (π€-NAF).
Efficient scalar multiplication
Tons of variations to the foregoing ideas have been investigated and proposed.
Some examples (far from exhaustive!):
Work with respect to base 3 and use an expansion with digits β {β1,0,1}.(Requires a tripling formula.)
If π has a known finite order π, check if π Β± ππ has better properties for some small π β π.
Multi-exponentiation: efficient methods for computing a π-linear combination Οπ ππππ.
Exercise: find a smarter way to compute ππ + ππ than first computing ππ, ππ separately.
Caution with double-and-add and its variants
When working through the digits of the scalar
π = 110100110101100010β¦1110,
an attacker might notice differences betweenprocessing a 0 and processing a 1. Parameters he can monitor are time, power consumption, noise, β¦
If one is uncareful then this will give away π for free!Huge threat, unless π is public anyway (as in signature verification).
Countermeasures:
Adding unnecessary computations, using uniform addition formulas, β¦ but the problem is somewhat inherent to double-and-add.
Use a Montgomery ladder for scalar multiplication.
Elliptic-curve-specificspeed-ups
Using projective coordinatesRemember the addition resp. doubling formula for Weierstrass curve arithmetic:
απ₯3 = π2 β π₯1 β π₯2π¦3 = βπ¦1 β π(π₯3 β π₯1)
where π =π¦2βπ¦1
π₯2βπ₯1resp. π =
3π₯12+2π΄π₯1
2π¦1.
Each step in the addition/subtraction chain requires a computation of π, which involves a costlyfield inversion.
Way around: use projective coordinates, computing
π3 = (π₯3: π¦3: π§3) from π1 = π₯1: π¦1: π§1 and π2 = π₯2: π¦2: π§2 .
Resulting formulas are inversion-free and even less case distinctive!
At the end of the double-and-add iteration, we can do a single inversion of the π§-coordinate to finda point of the form π₯, π¦ = (π₯: π¦: 1), as wanted.
Using projective coordinates
Formulas for this are easy to establish: replace π₯1 βπ₯1
π§1, π¦1 β
π¦1
π§1, π₯2 β
π₯2
π§2, π¦2 β
π¦2
π§2and put on
common denominators. For example in the case of addition this gives:
π3 = ( π₯2π§1 β π₯1π§2 π¦2π§1 β π¦1π§22π§1π§2 β π₯2π§1 + π₯1π§2 π₯2π§1 β π₯1π§2
3: β¦ : π₯2π§1 β π₯1π§23π§1π§2).
Looks ugly, but is more efficient!
Remember the addition resp. doubling formula for Weierstrass curve arithmetic:
απ₯3 = π2 β π₯1 β π₯2π¦3 = βπ¦1 β π(π₯3 β π₯1)
where π =π¦2βπ¦1
π₯2βπ₯1resp. π =
3π₯12+2π΄π₯1
2π¦1.
Each step in the addition/subtraction chain requires a computation of π, which involves a costlyfield inversion.
Literature contains various clever ways of evaluating these formulas efficiently.Useful other types of homogeneous coordinates (e.g. weighted).
Other formulasThe formulas for addition and doubling on a Weierstrass curve are not unique. Using the identities
π¦12 = π₯1
3 + π΄π₯1 + π΅ and π¦22 = π₯2
3 + π΄π₯2 + π΅,
it is possible to rewrite them.
One possibility: obtain a single formula that works for both addition and doubling! Interestingagainst side-channel attacks. Example:
π₯3 =π₯1π₯2 β 2π΄ π₯1π₯2 β 4π΅ π₯1 + π₯2 + π΄2
π₯1π₯2 + π΄ π₯1 + π₯2 + 2π¦1π¦2 + 2π΅
π¦3 =π₯1π₯2 π₯1 + π₯2 β π₯3 π₯1 + π₯2
2 β π₯1π₯2 + π΄ β π¦1π¦2 β π΅
π¦1 + π¦2
Remark: new exceptional point pairs will appear, but they are less likely to be hit by anaddition/subtraction chain.
Other curve shapes
Weierstrass curves are not the only shapes of elliptic curves that have been studied! Among themother cubics: Hessian curves, Montgomery curves, β¦
But itβs worth even leaving the realm of cubics! Annoying feature for this talk: arithmetic is no longer using tangents and chords.
Most prominent example: if char π β 2 then we can consider the (twisted) Edwards curves
ππ₯2 + π¦2 = 1 + ππ₯2π¦2
where π, π β π satisfy ππ π β π β 0 and π = (0,1). It admits the amazing addition formula
π₯1, π¦1 + π₯2, π¦2 =π₯1π¦2 + π¦1π₯2
1 + ππ₯1π₯2π¦1π¦2,π¦1π¦2 β ππ₯1π₯21 β ππ₯1π₯2π¦1π¦2
,
which are very efficient and can be used for doubling as well (uniformity).
Other curve shapes
A priori annoying aspect of Edwards curves: there are two singular points at infinity, each of whichsecretly corresponds to two points on the complete non-singular model.
But in fact this is a feature!
If π is a non-zero square and π is a non-square, then these four points are not defined over π.
Therefore they are never encountered duringarithmetic over π, or in other words we have an entirely affine group structure.
ππ₯2 + π¦2 = 1 + ππ₯2π¦2
Moreover, the addition formula is complete in this case, i.e. it has no exceptional points.
π-coordinate only arithmetic and the Montgomery ladder
As we have observed earlier:
π and π have the same π₯-coordinate β π = Β±π
Therefore the π₯-coordinate of ππ only depends on the π₯-coordinate of π, so it should be possibleto compute it without any involvement of π¦-coordinates.
Problem: every double-and-add routine involves addition steps, and there the idea breaks down: π₯(π) and π₯(π) do not suffice to find π₯(π + π).
π-coordinate only arithmetic and the Montgomery ladder
But it is true that π₯(π + π) is determined by π₯ π , π₯(π) and π₯(π β π).
Peter L. Montgomery
Montgomery found a way to exploit this: recursively compute
π₯ ππ , π₯( π + 1 π) from π₯π
2π , π₯(
π
2+ 1 π)
using one doubling and one appropriate addition. Note that π₯(π) is known.
Very fast.Very uniform: good against side-channel attacks.Possible to recover the π¦-coordinate from the end result (Lopez-Dahab).Comes in projective version: coordinates π₯: π§ β π1(π).Montgomery chose a more efficient curve form: π΅π¦2 = π₯3 + π΄π₯2 + π₯
Questions?