DOCSLIB.ORG

A Verified Extensible Library of Elliptic Curves Jean Karim Zinzindohoue, Evmorfia-Iro Bartzia, Karthikeyan Bhargavan

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
A Verified Extensible Library of Elliptic Curves Jean Karim Zinzindohoue, Evmorfia-Iro Bartzia, Karthikeyan Bhargavan A Verified Extensible Library of Elliptic Curves Jean Karim Zinzindohoue, Evmorfia-Iro Bartzia, Karthikeyan Bhargavan To cite this version: Jean Karim Zinzindohoue, Evmorfia-Iro Bartzia, Karthikeyan Bhargavan. A Verified Extensible Li- brary of Elliptic Curves. 29th IEEE Computer Security Foundations Symposium (CSF), Jun 2016, Lisboa, Portugal. 10.1109/CSF.2016.28. hal-01425957 HAL Id: hal-01425957 https://hal.inria.fr/hal-01425957 Submitted on 8 Dec 2018 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. A Verified Extensible Library of Elliptic Curves Jean Karim Zinzindohoue´ Evmorfia-Iro Bartzia Karthikeyan Bhargavan ENPC/INRIA INRIA INRIA [email protected] [email protected] [email protected] Abstract—In response to increasing demand for elliptic curve ification and code can be significantly large. Abstractly, such cryptography, and specifically for curves that are free from the primitives compute well-defined mathematical functions in suspicion of influence by the NSA, new elliptic curves such as some finite field, whereas concretely, their implementations Curve25519 and Curve448 are currently being standardized, manipulate arrays of bytes that represent arbitrary precision in- implemented, and deployed in major protocols such as Transport tegers (called bignums). Furthermore, since asymmetric primi- Layer Security. As with all new cryptographic code, the correct- tives are typically much slower and can form the bottleneck in ness of these curve implementations is of concern, because any bug or backdoor in this code can potentially compromise the a cryptographic protocol, most implementations incorporate a security of important Internet protocols. We present a principled range of subtle performance optimizations that further distance approach towards the verification of elliptic curve implementa- the code from the mathematical specification. Consequently, tions by writing them in the dependently-typed programming even for small prime fields, comprehensive testing is ineffec- language F* and proving them functionally correct against a tive for guaranteeing the correctness of asymmetric primitive readable mathematical specification derived from a previous Coq implementations, leading to bugs in even well-vetted crypto- development. A key technical innovation in our work is the use graphic libraries [8], [9]. Even worse, asymmetric primitives of templates to write and verify arbitrary precision arithmetic are often used with long-term keys, hence any bug that leaks once and for all for a variety of Bignum representations used the underlying key material can be disastrous. in different curves. We also show how to use abstract types to enforce a coding discipline that mitigates side-channels at the Recent trends in protocol design indicate a shift towards source level. We present a verified F* library that implements the use of elliptic curves in preference to older asymmetric the popular curves Curve25519, Curve448, and NIST-P256, and primitives. This is partly due to concerns about mass surveil- we show how developers can add new curves to this library with lance, which means that non-forward-secret primitives such as minimal programming and verification effort. RSA encryption are no longer considered sufficient. Moreover, finite-field Diffie-Hellman computations are both slow and I. VERIFYING CRYPTOGRAPHIC LIBRARIES vulnerable to precomputation [10], two limitations that do not apply to elliptic curves, as far as currently known. The security of important Internet protocols, such as Trans- port Layer Security (TLS), crucially relies on cryptographic Cryptographic libraries such as OpenSSL already imple- constructions implemented in software and hardware. Any bug ment dozens of standardized elliptic curves. However, concerns or backdoor in these implementations can be catastrophic for about backdoors in NIST standards [11] have led to the security. Yet, although the precise computational security of standardization of new elliptic curves such as Curve25519 composite constructions and protocols has been widely studied and Curve448 [12], and implementations of these relatively using formal tools [1]–[3], the correctness of implementations new curves are currently being developed and widely de- of the underlying cryptographic primitives have received far ployed. The verification of these fresh implementations of less attention from the formal verification community. new elliptic curves was presented as an open challenge from practitioners to academics at the Real World Cryptography For symmetric primitives, such as block ciphers and hash workshop in 2015 [13]. Verifying libraries with multiple curves functions, the algorithm is the specification. Hence, verifying is particularly difficult because each curve implements its own a block cipher implementation amounts to proving the equiv- optimized field arithmetic code, and so two elliptic curves do alence between a concrete program written for some platform not share much code between them. This is in direct contrast and an abstract program given in the standard specification. to RSA and finite-field Diffie-Hellman libraries that are written Practitioners commonly believe that a combination of careful once and for all and remain stable thereafter. code inspection and comprehensive testing is enough to ensure functional correctness for such primitives, but that the greater In this paper, we take up this challenge and show how challenge is preventing side-channels such as timing leaks to write a library of elliptic curves that can be mechanically that have led to many recent attacks (e.g. see [4]). However, verified using a dependent type system. To better explain separating these concerns is not always possible or desirable, our approach and the design of our verified library, we first and researchers have shown that formal approaches can be consider a motivating example. effective both for verifying subtle performance optimizations in source programs [5], and for detecting side-channels in as- A. Example: Elliptic Curve Diffie-Hellman Key Exchange sembly code [6]. Furthermore, such code-based guarantees can also be formally linked to high-level cryptographic proofs [7]. One of the main applications of elliptic curves in cryp- tographic protocols is to implement a Diffie-Hellman key- For asymmetric primitives, such as RSA encryption, finite- exchange. Figure 1 illustrates a simple elliptic curve Diffie- field Diffie-Hellman, or elliptic curves, the gap between spec- Hellman protocol inspired by the QUIC transport protocol [14] Client Server let send sPub msg = let cPriv,cPubBytes = ECDH.keygen () in Knows S = sG Knows s let k = ECDH.shared secret cPriv sPub in (cPub, AEAD.encrypt k msg) Generates key-pair (c; C = cG) let receive sPriv (cPubBytes,encmsg) = Computes shared key k = cS if ECDH.is on curve cPubBytes then let cPub = ECDH.to spoint cPubBytes in C; enc(k; msg) let k = ECDH.shared secret sPriv cPub in AEAD.decrypt k msg else failwith "error" Computes shared key k = sC Fig. 1. An ephemeral-static elliptic curve Diffie-Hellman (ECDH) key exchange sending a single encrypted message (msg). The client and server are assumed to have agreed upon a curve with generator G. The server’s static public key S is known to everyone. The client is anonymous. Scalar multiplication (e.g. sG) can be read as a classic Diffie-Hellman modular exponentiation (Gx). Sample F* code for the client and server is shown on the right. and the 0-RTT mode of TLS 1.3 [15]. The right side of the leak its secret inputs via side-channels, and that its security figure displays example client-server code for this protocol in guarantees are preserved by the application code. an ML-like language called F* (e.g. the miTLS library [16] implements all of the TLS protocol in this style.) B. Towards a Verified Elliptic Curve Library An anonymous client wishes to send a secret message msg The most relevant prior work on verifying an elliptic curve to a public server. We assume that both have agreed upon implementation appears in [18], which shows how an imple- a curve (e.g. Curve25519) with public generator G, and we mentation of Curve25519 in the qhasm language [19] can be assume that the client has previously retrieved the server’s formally verified to be functionally correct using a combination static public key S from some trusted source. In the elliptic- of an SMT solver and the Coq theorem prover. This result is curve setting S is computed as the scalar multiplication sG, particularly impressive because it applies to highly optimized where s is the server’s private key. code written in a low-level assembly language. To send the message, the client generates an ephemeral Inspired by [18], we propose to build a verified library private-public key-pair (c; C), where C = cG, computes a that consists of multiple elliptic curves that maximally share Diffie-Hellman shared secret k = cS, uses it to encrypt the code, so that the verification effort of adding a new curve message, and sends the encrypted message along with its can be minimized. However, the approach used in [18] is public key C. The server first verifies that C is a valid point not particularly well-suited for this purpose. As a low-level on the curve, then computes k = sC, decrypts the message, programming language, qhasm does not lend itself to modular, and returns an (unencrypted) error message if it fails. incremental, proof-friendly development. The qhasm code for The main goal of the protocol is that the message msg must each curve is completely different, so the proof effort would remain a secret between the client and the server. This property have to be repeated from scratch for a new curve.
Load more

Recommended publications
  • How to (Pre-)Compute a Ladder
    How to (pre-)compute a ladder Improving the performance of X25519 and X448 Thomaz Oliveira1, Julio L´opez2, H¨useyinHı¸sıl3, Armando Faz-Hern´andez2, and Francisco Rodr´ıguez-Henr´ıquez1 1 Computer Science Department, Cinvestav-IPN [email protected], [email protected] 2 Institute of Computing, University of Campinas [email protected], [email protected] 3 Yasar University [email protected] Abstract. In the RFC 7748 memorandum, the Internet Research Task Force specified a Montgomery-ladder scalar multiplication function based on two recently adopted elliptic curves, \curve25519" and \curve448". The purpose of this function is to support the Diffie-Hellman key ex- change algorithm that will be included in the forthcoming version of the Transport Layer Security cryptographic protocol. In this paper, we describe a ladder variant that permits to accelerate the fixed-point mul- tiplication function inherent to the Diffie-Hellman key pair generation phase. Our proposal combines a right-to-left version of the Montgomery ladder along with the pre-computation of constant values directly de- rived from the base-point and its multiples. To our knowledge, this is the first proposal of a Montgomery ladder procedure for prime elliptic curves that admits the extensive use of pre-computation. In exchange of very modest memory resources and a small extra programming effort, the proposed ladder obtains significant speedups for software implemen- tations. Moreover, our proposal fully complies with the RFC 7748 spec- ification. A software implementation of the X25519 and X448 functions using our pre-computable ladder yields an acceleration factor of roughly 1.20, and 1.25 when implemented on the Haswell and the Skylake micro- architectures, respectively.
    [Show full text]
  • The Complete Cost of Cofactor H = 1
    The complete cost of cofactor h = 1 Peter Schwabe and Daan Sprenkels Radboud University, Digital Security Group, P.O. Box 9010, 6500 GL Nijmegen, The Netherlands [email protected], [email protected] Abstract. This paper presents optimized software for constant-time variable-base scalar multiplication on prime-order Weierstraß curves us- ing the complete addition and doubling formulas presented by Renes, Costello, and Batina in 2016. Our software targets three different mi- croarchitectures: Intel Sandy Bridge, Intel Haswell, and ARM Cortex- M4. We use a 255-bit elliptic curve over F2255−19 that was proposed by Barreto in 2017. The reason for choosing this curve in our software is that it allows most meaningful comparison of our results with optimized software for Curve25519. The goal of this comparison is to get an under- standing of the cost of using cofactor-one curves with complete formulas when compared to widely used Montgomery (or twisted Edwards) curves that inherently have a non-trivial cofactor. Keywords: Elliptic Curve Cryptography · SIMD · Curve25519 · scalar multiplication · prime-field arithmetic · cofactor security 1 Introduction Since its invention in 1985, independently by Koblitz [34] and Miller [38], elliptic- curve cryptography (ECC) has widely been accepted as the state of the art in asymmetric cryptography. This success story is mainly due to the fact that attacks have not substantially improved: with a choice of elliptic curve that was in the 80s already considered conservative, the best attack for solving the elliptic- curve discrete-logarithm problem is still the generic Pollard-rho algorithm (with minor speedups, for example by exploiting the efficiently computable negation map in elliptic-curve groups [14]).
    [Show full text]
  • Efficient Elliptic Curve Diffie-Hellman Computation at the 256-Bit Security
    Efficient Elliptic Curve Diffie-Hellman Computation at the 256-bit Security Level Kaushik Nath and Palash Sarkar Applied Statistics Unit Indian Statistical Institute 203, B. T. Road Kolkata - 700108 India fkaushikn r,[email protected] Abstract In this paper we introduce new Montgomery and Edwards form elliptic curve targeted at the 506 510 256-bit security level. To this end, we work with three primes, namely p1 := 2 − 45, p2 = 2 − 75 521 and p3 := 2 − 1. While p3 has been considered earlier in the literature, p1 and p2 are new. We define a pair of birationally equivalent Montgomery and Edwards form curves over all the three primes. Efficient 64-bit assembly implementations targeted at Skylake and later generation Intel processors have been made for the shared secret computation phase of the Diffie-Hellman key agree- ment protocol for the new Montgomery curves. Curve448 of the Transport Layer Security, Version 1.3 is a Montgomery curve which provides security at the 224-bit security level. Compared to the best publicly available 64-bit implementation of Curve448, the new Montgomery curve over p1 leads to a 3%-4% slowdown and the new Montgomery curve over p2 leads to a 4:5%-5% slowdown; on the other hand, 29 and 30.5 extra bits of security respectively are gained. For designers aiming for the 256-bit security level, the new curves over p1 and p2 provide an acceptable trade-off between security and efficiency. Keywords: Elliptic curve cryptography, Elliptic curve Diffie-Hellman key agreement, Montgomery form, Edwards form, 256-bit security.
    [Show full text]
  • Measuring and Securing Cryptographic Deployments
    University of Pennsylvania ScholarlyCommons Publicly Accessible Penn Dissertations 2019 Measuring And Securing Cryptographic Deployments Luke Taylor Valenta University of Pennsylvania, [email protected] Follow this and additional works at: https://repository.upenn.edu/edissertations Part of the Computer Sciences Commons Recommended Citation Valenta, Luke Taylor, "Measuring And Securing Cryptographic Deployments" (2019). Publicly Accessible Penn Dissertations. 3507. https://repository.upenn.edu/edissertations/3507 This paper is posted at ScholarlyCommons. https://repository.upenn.edu/edissertations/3507 For more information, please contact [email protected]. Measuring And Securing Cryptographic Deployments Abstract This dissertation examines security vulnerabilities that arise due to communication failures and incentive mismatches along the path from cryptographic algorithm design to eventual deployment. I present six case studies demonstrating vulnerabilities in real-world cryptographic deployments. I also provide a framework with which to analyze the root cause of cryptographic vulnerabilities by characterizing them as failures in four key stages of the deployment process: algorithm design and cryptanalysis, standardization, implementation, and endpoint deployment. Each stage of this process is error-prone and influenced by various external factors, the incentives of which are not always aligned with security. I validate the framework by applying it to the six presented case studies, tracing each vulnerability back to communication
    [Show full text]
  • Optimized Architectures for Elliptic Curve Cryptography Over Curve448
    Optimized Architectures for Elliptic Curve Cryptography over Curve448 Mojtaba Bisheh Niasar1, Reza Azarderakhsh1,2, and Mehran Mozaffari Kermani3 1 Department of Computer and Electrical Engineering and Computer Science, Florida Atlantic University, FL, USA {mbishehniasa2019,razarderakhsh}@fau.edu 2 PQSecure Technologies, LLC, Boca Raton, FL , USA 3 Department of Computer Science and Engineering, University of South Florida, FL, USA [email protected] Abstract. In this paper, we present different implementations of point multiplication over Curve448. Curve448 has recently been recommended by NIST to provide 224-bit security over elliptic curve cryptography. Although implementing high-security cryptosystems should be consid- ered due to recent improvements in cryptanalysis, hardware implemen- tation of Curve488 has been investigated in a few studies. Hence, in this study, we propose three variable-base-point FPGA-based Curve448 im- plementations, i.e., lightweight, area-time efficient, and high-performance architectures, which aim to be used for different applications. Synthe- sized on a Xilinx Zynq 7020 FPGA, our proposed high-performance design increases 12% throughput with executing 1,219 point multipli- cation per second and increases 40% efficiency in terms of required clock cycles×utilized area compared to the best previous work. Furthermore, the proposed lightweight architecture works in 250 MHz and saves 96% of resources with the same performance. Additionally, our area-time ef- ficient design considers a trade-off between time and required resources, which shows a 48% efficiency improvement with 52% fewer resources. Fi- nally, effective side-channel countermeasures are added to our proposed designs, which also outperform previous works. Keywords: Curve448, elliptic curve cryptography, FPGA, hardware se- curity, implementation, point multiplication, side-channel 1 Introduction Elliptic curve cryptography (ECC) has gained prominent attention among asym- metric cryptographic algorithms due to its short key size.
    [Show full text]
  • Comments Received on FIPS 186-4: Digital Signature Standard (DSS) (December 4, 2015 Deadline)
    Public Comments Received on FIPS 186-4: Digital Signature Standard (DSS) (December 4, 2015 deadline) Mehmet Adalier, Antara Teknik LLC ............................................................. 1 Agence Nationale de la Sécurité des Systèmes d’Information (ANSSI) ........ 3 Reza Azarderakhsh, Rochester Institute of Technology ............................... 4 Daniel Bernstein and Tanja Lange................................................................. 5 Bundesamt für Sicherheit in der Informationstechnik (BSI) ......................... 30 Robert Burns, Thales e-Security World Wide ............................................... 34 Mike Hamburg .............................................................................................. 37 Michael Harris, Centers for Disease Control and Prevention ....................... 39 Brian Haslett ................................................................................................. 40 Intel ............................................................................................................... 41 Simon Josefsson ............................................................................................ 48 The Keccak and Keyak Team ......................................................................... 49 Andrea A. Kunz, MITRE ................................................................................. 51 Watson Ladd ................................................................................................. 52 Dr. Zhe Liu, University of Waterloo .............................................................
    [Show full text]
  • Cryptography for Next Generation TLS
    Cryptography for Next Generation TLS: Implementing the RFC 7748 Elliptic Curve448 Cryptosystem in Hardware Pascal Sasdrich Tim Güneysu Horst Görtz Institute for IT Security, University of Bremen & DFKI Ruhr-Universität Bochum [email protected] [email protected] ABSTRACT has to be implemented on various physical and embedded With RFC 7748 the two elliptic curves Curve25519 and devices. But since both curves were primarily designed for Curve448 were proposed for the next generation of TLS. software platforms (x86/x64) and without explicit evalua- Both curves were designed and optimized purely for software tion of their resistance against low-level physical such as implementation; their implementation in hardware or phys- side-channel attacks, we still need to investigate the hard- ical protection against side-channel attacks were not con- ware implementation of both curves in combination with sidered in the design phase. Recently, it has been shown suitable countermeasures. that for Curve25519 an efficient implementations in hard- ware along with side-channel protection is feasible { yet re- Contribution. In this work, we present an efficient hard- sults for the high-security Curve448 are missing. In this ware implementation of Curve448 for modern Xilinx Field- work we demonstrate that Curve448 can indeed be efficiently Programmable Gate Array (FPGA) devices. Our work fills and securely implemented in hardware. We present a novel the gap left from the previous work on Curve25519 [14, 15]. architecture for Curve448 that can compute more than 1000 Despite of the similarity of Curve448 and Curve25519, we point multiplications per second with 1580 logic slices and were faced with completely revising the design rationales 33 DSP units of a Xilinx XC7Z020 FPGA.
    [Show full text]
  • In Search of Curveswap: Measuring Elliptic Curve Implementations in the Wild
    In search of CurveSwap: Measuring elliptic curve implementations in the wild Luke Valenta∗, Nick Sullivany, Antonio Sansoz, Nadia Heninger∗ ∗University of Pennsylvania, yCloudflare, Inc., zAdobe Systems Abstract—We survey elliptic curve implementations from sev- are a number of potential vulnerabilities in elliptic curve eral vantage points. We perform internet-wide scans for TLS implementations that taken in combination could enable a on a large number of ports, as well as SSH and IPsec to CurveSwap attack, including support for curves of small measure elliptic curve support and implementation behaviors, order, point validation failures, and twist insecurity. We per- and collect passive measurements of client curve support formed extensive passive and active measurements of these for TLS. We also perform active measurements to estimate behaviors and implementation choices among clients and server vulnerability to known attacks against elliptic curve servers. Among our scans, we found populations of servers implementations, including support for weak curves, invalid that accept invalid curve points years after flaws have been curve attacks, and curve twist attacks. We estimate that 0.77% publicly disclosed and patched in common libraries, little of HTTPS hosts, 0.04% of SSH hosts, and 4.04% of IKEv2 vulnerability to twist attacks, and significant populations of hosts that support elliptic curves do not perform curve validity hosts that repeat public key exchange values both across checks as specified in elliptic curve standards. We describe how IP addresses and across multiple scans. However, these such vulnerabilities could be used to construct an elliptic curve behaviors were not present in combinations that would lead parameter downgrade attack called CurveSwap for TLS, and to an effective attack for vulnerable curves.
    [Show full text]
  • Cryptography in Python Hashes, ECC and ECDSA, Eth Keys Library ECDSA in Python: Generate / Load Keys
    Table of Contents Welcome 1.1 Preface 1.2 Cryptography - Overview 1.3 Hash Functions 1.4 Crypto Hashes and Collisions 1.4.1 Hash Functions: Applications 1.4.2 Secure Hash Algorithms 1.4.3 Hash Functions - Examples 1.4.4 Exercises: Calculate Hashes 1.4.5 Proof-of-Work Hash Functions 1.4.6 MAC and Key Derivation 1.5 HMAC and Key Derivation 1.5.1 HMAC Calculation - Examples 1.5.2 Exercises: Calculate HMAC 1.5.3 KDF: Deriving Key from Password 1.5.4 PBKDF2 1.5.5 Modern Key Derivation Functions 1.5.6 Scrypt 1.5.7 Bcrypt 1.5.8 Linux crypt() 1.5.9 Argon2 1.5.10 Password Encryption 1.5.11 Exercises: Password Encryption 1.5.12 Secure Random Generators 1.6 Pseudo-Random Numbers - Examples 1.6.1 Secure Random Generators (CSPRNG) 1.6.2 Exercises: Pseudo-Random Generator 1.6.3 Key Exchange and DHKE 1.7 Diffie–Hellman Key Exchange 1.7.1 DHKE - Examples 1.7.2 Exercises: DHKE Key Exchange 1.7.3 Encryption: Symmetric and Asymmetric 1.8 Symmetric Key Ciphers 1.9 Cipher Block Modes 1.9.1 Popular Symmetric Algorithms 1.9.2 The AES Cipher - Concepts 1.9.3 AES Encrypt / Decrypt - Examples 1.9.4 Ethereum Wallet Encryption 1.9.5 2 Exercises: AES Encrypt / Decrypt 1.9.6 ChaCha20-Poly1305 1.9.7 Exercises: ChaCha20-Poly1305 1.9.8 Asymmetric Key Ciphers 1.10 The RSA Cryptosystem - Concepts 1.10.1 RSA Encrypt / Decrypt - Examples 1.10.2 Exercises: RSA Encrypt / Decrypt 1.10.3 Elliptic Curve Cryptography (ECC) 1.10.4 ECDH Key Exchange 1.10.5 ECDH Key Exchange - Examples 1.10.6 Exercises: ECDH Key Exchange 1.10.7 ECC Encryption / Decryption 1.10.8 ECIES Hybrid Encryption
    [Show full text]
  • Reduction Modulo 2 448 − 2224
    Mathematical Cryptology, 0(1): 8–21 Reduction Modulo 2448 − 2224 − 1 Kaushik Nath1,*, Palash Sarkar1 1Indian Statistical Institute, Kolkata, India Received: 15th July 2020 | Revised: 4th September 2020 | Accepted: 23rd December 2020 448 224 Abstract An elliptic curve known as Curve448 defined over the finite field F?, where ? = 2 − 2 − 1, has been proposed as part of the Transport Layer Security (TLS) protocol, version 1.3. Elements of F? can be represented using 7 limbs where each limb is a 64-bit quantity. This paper describes efficient algorithms for reduction modulo ? that are required for performing field arithmetic in F? using 7-limb representation. A key feature of our work is that we provide the relevant proofs of correctness of the algorithms. We also report efficient constant-time 64-bit assembly implementations for key generation and shared secret computation phases of the Diffie-Hellman key agreement protocol on Curve448. Timings results on the Haswell and Skylake processors demonstrate that the new 64-bit implementations for computing the shared secret and key generation are significantly faster than the previously best known 64-bit implementations. Keywords: Curve448, Goldilocks prime, modulo reduction, elliptic curve cryptography, Diffie-Hellman key agreement. 2010 Mathematics Subject Classification: 94A60 1 INTRODUCTION As part of the Transport Layer Security (TLS) protocol, version 1.3 [21], RFC 7748 [11] specifies the Mont- gomery form elliptic curve Curve448 and its birationally equivalent Edwards form elliptic curve Edwards448. The curve Edwards448 was originally proposed in [9] where it was named Ed448-Goldilocks. The underlying field for 448 224 Curve448 and Edwards448 is F? where ? is the prime 2 − 2 − 1.
    [Show full text]
  • On TLS 1.3 Early Performance Analysis in the Iot Field
    On TLS 1.3 Early Performance Analysis in the IoT Field Simone Bossi1, Tea Anselmo2 and Guido Bertoni2 1Department of Computer Science, Universita` degli studi di Milano, Milan, Italy 2STMicroelectronics, Via Olivetti 2, Agrate B.za, Italy Keywords: TLS 1.3, Authenticated Encryption, IoT, Performance Analysis, Data Security. Abstract: The TLS 1.3 specifications are subject to change before the final release, and there are still details to be clarified, but yet some directions have been stated. In the IoT scenario, where devices are constrained, it is important and critical that the added security benefits of the new TLS 1.3 does not increase complexity and power consumption significantly compared to TLS 1.2. This paper provides an overview of the novelties intro- duced in TLS 1.3 draft finalized to improve security and latency of the protocol: the reworked handshake flows and the newly adopted cryptographic algorithms are analyzed and compared in terms of security and latency to the current TLS in use. In particular, the analysis is focused on performance and memory requirements overhead introduced by the TLS 1.3 current specifications, and the final section reports simulation results of a commercial cryptographic library running on a low end device with an STM32 microcontroller. 1 INTRODUCTION ple HTTP (Rescorla, 2000), FTP (Ford-Hutchinson, 2005), SMTP (Hoffman, 2002), and XMPP (Saint- The emerging technology of the Internet of Things Andre, 2011). (IoT) is having a huge impact on the generated data The main purpose of the TLS protocol is to pro- volume, on network traffic and the way of handling vide communication security in terms of privacy and them.
    [Show full text]
  • Generation, Verification, and Attacks on Elliptic Curves and Their
    Rochester Institute of Technology RIT Scholar Works Theses 2-2021 Generation, Verification, and ttacksA on Elliptic Curves and their Applications in Signal Protocol Tanay Pramod Dusane [email protected] Follow this and additional works at: https://scholarworks.rit.edu/theses Recommended Citation Dusane, Tanay Pramod, "Generation, Verification, and ttacksA on Elliptic Curves and their Applications in Signal Protocol" (2021). Thesis. Rochester Institute of Technology. Accessed from This Thesis is brought to you for free and open access by RIT Scholar Works. It has been accepted for inclusion in Theses by an authorized administrator of RIT Scholar Works. For more information, please contact [email protected]. Generation, Verification, and Attacks on Elliptic Curves and their Applications in Signal Protocol by Tanay Pramod Dusane THESIS Presented to the Faculty of the Department of Computer Science B. Thomas Golisano College of Computing and Information Sciences Rochester Institute of Technology in Partial Fulfillment of the Requirements for the Degree of Master of Science in Computer Science Rochester Institute of Technology February 2021 Generation, Verification, and Attacks on Elliptic Curves and their Applications in Signal Protocol Approved by Supervising committee: Stanis law Radziszowski, Chair Monika Polak, Reader Anurag Agarwal, Observer Abstract Elliptic curves (EC) are widely studied due to their mathematical and cryptographic properties. Cryptographers have used the proper- ties of EC to construct elliptic curve cryptosystems (ECC). ECC are based on the assumption of hardness of special instances of the discrete logarithm problem in EC. One of the strong merits of ECC is providing the same cryptographic strength with smaller key size compared to other public key cryptosystems.
    [Show full text]