Elliptic Curves and Cryptography 1 Elliptic Curves
Total Page:16
File Type:pdf, Size:1020Kb
Elliptic Curves and Cryptography Prof. Will Traves, USNA1 Many applications of mathematics depend on properties of smooth degree-2 curves: for example, Galileo showed that planets move in elliptical orbits and modern car headlights are more efficient because they use parabolic reflectors (see Exercise 1). In the last 30 years smooth degree-3 curves have been at the heart of significant theoretical and practical applications. Smooth degree-3 curves, known as elliptic curves, were used in Andrew Wiles’s proof of Fermat’s Last Theorem [11]. The points on elliptic curves form a group with a nice geometric description. Hendrick Lenstra [5] exploited this group structure to show that elliptic curves can be used to factor large numbers with a relatively small divisor. At one time this was thought to offer a serious challenge to RSA cryptography, which depends on the difficulty of factoring large numbers to secure communication. The Diffie-Helman protocol is another cryptographic scheme which is increasingly popular. While the Diffie-Helman protocol can be used with any group, recent implementations using elliptic curves seem to be very efficient. In this packet of course notes, we’ll explore the mathematics underlying elliptic curves and their use in cryptography. 1 Elliptic Curves The definition of an elliptic curve hides a lot of details: An elliptic curve is a smooth degree-3 plane curve. The first subtlety is that the curve lives in the projective plane rather than the usual xy-plane. In the projective plane P2 the points are tuples of ratios (X : Y : Z) 6= (0 : 0 : 0) under the equivalence relation (X : Y : Z) = (λX : λY : λZ) for λ 6= 0: A point (X : Y : Z) with Z 6= 0 can be written in the form (X=Z : Y=Z : 1) and corresponds to the point (x; y) with x = X=Z and y = Y=Z in two-space. Points (X : Y : Z) with Z = 0 are said to be points “at infinity”. Every curve defined by a polynomial equation in the usual plane can be extended to a curve in the projective plane. If f(x; y) = 0 is the equation of the curve in the xy-plane then we write x = X=Z and y = Y=Z and clear denominators by multiplying by Zdeg(f) to obtain an equation F (X; Y; Z) = 0 in the 1The development of these course notes was financially supported by the Defense Information Assurance Program funded by the National Security Agency. variables of P2. The polynomial F is said to be homogenized since all its terms have the same degree. The value of the homogenized polynomial F (X; Y; Z) at a point (X : Y : Z) in projective space is not well-defined since F (λX; λY; λZ) = λdeg(F )F (X; Y; Z) but it does make sense to talk about the collection V(F ) of points (X : Y : Z) 2 P2 where F (X; Y; Z) = 0. Note that if (X : Y : Z) = (x : y : 1) then F (X; Y; Z) = 0 if and only if f(x; y) = 0, so V(F ) contains points in P2 corresponding to the points on the original curve f(x; y) = 0 but V(F ) also contains some points at infinity. Example 1. Consider the line y − x + 1 = 0 in two-space. Its homogenization is Y − X + Z = 0. Every point (x; y) on the original line gives a point (x : y : 1) on the homogenization. The homogenization also contains a point at infinity: when Z = 0 we see that the homogenization equation reduces to Y − X = 0, which determines a single point (X : X : 0) = (1 : 1 : 0) in P2. That is, V(Y − X + Z) = f(x : y : 1) j y − x + 1 = 0g [ f(1 : 1 : 0)g: The line y − x − 2 = 0 has homogenization Y − X − 2Z = 0 and so if Z = 0 then we again get the point (1 : 1 : 0) lying on the line at infinity. In fact, all parallel lines intersect at the same point at infinity (see Exercise 2). So we think of the curve Z = 0 as defining the horizon, “at infinity”. There is one point at infinity for each possible slope. It is much easier to describe the intersections of curves in projective space: for example, every pair of distinct lines meets in exactly one point, even if the lines are parallel. Etienne´ Bezout,´ working at the French Naval Academy, dis- covered a generalization of this result. Figure 1: Parallel lines meet at infinity. Theorem 2 (Bezout’s´ Theorem). If two curves determined by homogeneous polynomials of degrees d1 and d2, respectively, do not share a common component, then they meet in precisely d1d2 points in the projective plane if we count the points appropriately. The theorem requires that the two curves not share a common component, i.e. that the two defining polynomials do not share a common polynomial divisor. As well, we are instructed to count points appropriately. To do so we must allow complex coordinates, count points at infinity, and count points with multiplicity. To describe the computation of multiplicity rigorously requires advanced algebraic concepts, but we can get an accurate idea of how to count with multiplicity by looking at Figure 2. Figure 2: P is a point of multiplicity 1 (left), 2 (middle), 3 (right). If a point P lies on two curves with distinct tangents at P then the point P counts with multiplicity one. If the tangent lines to the curves coincide at P then we move one of the curves slightly; the multiplicity at P is the number of points in the intersection that approach P as the moving curve approaches the original curve. In Figure 2 the moving curve is drawn with a dashed line and it approaches the horizontal line. Let’s return to our definition: an elliptic curve is a smooth projective plane curve of degree 3. That is, the curve is defined by an polynomial equation F (X; Y; Z) = 0 of degree 3. The curve is smooth if every point on the curve has a unique tangent line. We can find the tangent line using the gradient. If P (X0 : Y0 : Z0) is a point on the curve F (X; Y; Z) = 0 then P is a smooth point of the curve if rF (X0;Y0;Z0) = hfX (X0;Y0;Z0); fY (X0;Y0;Z0); fZ (X0;Y0;Z0)i= 6 h0; 0; 0i: If P is a point on the curve that is not smooth we say that P is a singular point of the curve. The curve itself is said to be smooth if each of its points is smooth. If P is smooth point of the curve, then the tangent line at P is given by the equation rF (X0;Y0;Z0) · hX − X0;Y − Y0;Z − Z0i = 0: Try Exercise 3 to get a feel for which cubic curves are smooth and which have singularities. It turns out that each elliptic curve C has a point of inflection (see Exercise 4), a point where the curve C meets its tangent line in multiplicity three, as in the right diagram of Figure 2. Fix one such point of inflection and call it E. If P and Q are distinct points on the elliptic curve, then the line through P and Q is a degree 1 curve and by Bezout’s´ Theorem it meets C in another point (PQ). Similarly, the line through E and (PQ) hits the curve C in another point, which we denote P +Q. If two points in this process coincide then we replace the secant line through both points with the tangent line. Theorem 3. The points on the elliptic curve C form an Abelian group under the operation + defined above. The identity element of the group is the point E. Proof. We leave it to the reader to check that the elliptic curve C is closed under the oper- ation +, that the identity element is E, that the inverse of a point on C is again a point on C, and that P + Q = Q + P (see Exercise 5). It remains to check that the group law is associative. This follows from a nice result about cubics: if two cubic (degree-3) curves meet in 9 points, then any other cubic passing through 8 of them also passes through the ninth. This theorem can be proven using Bezout’s´ Theorem; you might want to check out the proof given by Fields Medalist Terry Tao on his blog.2 To show that (P + Q) + R = P + (Q + R) it suffices to show that R(P + Q) = P (Q + R) since then the line joining this point to E meets C for a third time in both (P + Q) + R = P + (Q + R). We define three red lines and three blue lines as in Figure 3. Figure 3: Six lines to show R(P + Q) = P (Q + R). Let the line through P and Q be colored red. It hits C at (PQ). Let the line through (PQ) and E be colored blue. It hits C at P + Q. Let the line through P + Q and R be colored red. It hits C at R(P + Q). Now let the line through Q and R be colored blue. 2See Tao’s July 15, 2011 post at terrytao.wordpress.com. It hits C at (QR). Let the line through (QR) and E be colored red. It hits C at Q + R. Let the line through Q + R and P be colored blue.