Maire Model of an Elliptic Curve)

INVERTED BINARY EDWARDS COORDINATES (MAIRE MODEL OF AN ELLIPTIC CURVE) by STEVEN M. MAIRE Submitted in partial fulfillment of the requirements for the degree of Master of Science Dissertation Advisor: Dr. David Singer Department of Mathematics CASE WESTERN RESERVE UNIVERSITY May, 2014 CASE WESTERN RESERVE UNIVERSITY SCHOOL OF GRADUATE STUDIES We hereby approve the thesis/dissertation of STEVEN M. MAIRE candidate for the Master of Science degree*. Dr. David Singer Dr. Elisabeth Werner Dr. Johnathan Duncan (date) March 25, 2014 *We also certify that written approval has been obtained for any proprietary material contained therein. Dedication To my mother, Lynda O. Maire, whose lessons to me as a child came as encrypted signals, where the only cipher, is time. i Contents Dedication i List of Tables iv List of Figures v Acknowledgements vi Abstract vii 1 Introduction 1 1.1 Elliptic Curves in Cryptography . .1 2 Weierstrass Form: Paving the Way 3 2.1 Weierstrass Addition Law . .4 2.1.1 Geometric Interpretation . .4 2.1.2 Algebraic Interpretation . .6 3 Edwards Curves: Unifying Finite Field Operations 9 3.1 The Addition Law . 10 3.1.1 Geometric Interpretation . 11 3.1.2 Algebraic Interpretation . 12 4 Binary Edwards Curves: Doubling down on Deuces 14 4.1 Building the New Shape for the Edwards' Form . 14 4.2 The First Complete Addition Law Over a Binary Field . 16 ii CONTENTS CONTENTS 5 Maire Model 18 5.1 Inverted Binary Edwards . 19 5.2 The Addition Law . 21 5.3 Operations Unification . 23 6 Elliptic Curves in Cryptography: A Revolution 25 6.1 Advantages of the Edwards' Forms . 25 6.2 Further Research . 27 iii List of Tables iv List of Figures 2.1 A graph depicting the geometrical 'chord and tangent method' of elliptic curve addtion. The solid red line denotes the 'addition line' while the dashed line denotes reflection. (Left) distinct point addition, and (Right) point doubling. .5 3.1 A graph depicting the geometry of Edwards curve addition. The solid red line denotes the 'addition line' while the dashed line denotes reflection. (Left) distinct point addition, and (Right) point doubling. 12 v Acknowledgements I would like to thank Dr. David Singer for his knowledge and guidance througout this entire process. Without the influence and passion that he shows inside and outside the classroom, I am sure that I would never have gained the appreciation and joy that I have today for mathematics. I would also like to thank my committee for their time, and patience as well as intellectual input they have had within this process. I could not ask for a better group of mathematicians who could help guide me along my way. And last, but certainly not least, each and all of the faculty of the Department of Mathematics, Applied Mathematics, and Statistics. My career at this university has been different to say the least. I am only able to be where I am today with their continued support as an undergraduate, while oversees, and now with my pursuit as a Master's. vi INVERTED BINARY EDWARDS COORDINATES (MAIRE MODEL OF AN ELLIPTIC CURVE) Abstract by STEVEN M. MAIRE Edwards curves are a fairly new way of expressing a family of elliptic curves that contain extremely desirable cryptographic properties over other forms that have been used. The most notable is the notion of a complete and unified addition law. This property makes Edwards curves extremely strong against side-channel attacks. In the analysis and continual development of Edwards curves, it has been seen in the original Edwards form that the use of inverted coordinates creates a more efficient addition/doubling algorithm. Using inverted coordinates, the field operations drop from 10M + 1S (given correctly chosen curve parameters), to 9M + 1S. The sarcrifice is the loss of completeness, but unification remains. This paper examines the use of the inverted coordinates system over the binary Edwards form, and shows the underlying advantages of this transformation. vii Chapter 1 Introduction 1.1 Elliptic Curves in Cryptography Ten years after the beginning of the idea of asymmetric cryptosystems, elliptic curves came onto the scene of public key cryptography. In 1985, Neal Koblitz and Victor Miller independently came up with a scheme that implemented the algebra that exists over an elliptic curve. The Diffie-Hellman key exchange, which was originally published in 1976, based its security on the non-existence of sub- exponential algorithms to solve the discrete log problem. Using this as a model, Koblitz and Miller proposed the elliptic curve discrete log problem. The use of elliptic curves allowed for the same level of security as the original Diffie-Hellman algorithm, except with smaller key sizes. In utilizing the power of finite fields in computation, Koblitz and Miller were able to take advantage of the geometric, and algebraic, structure of elliptic curves in order to create a more difficult trap-door function. Although mathematically speaking, elliptic curves are a completely valid way to securing information, the implementation leaves it vulnerable to attack. In 1999, Paul Kocher along with others in [2] published one of the first type of attacks known as side-channel attacks. This class of attacks used information within the implementation to give 1 1.1. ELLIPTIC CURVES IN CRYPTOGRAPHYCHAPTER1. INTRODUCTION them clues to the solution. Differential power analysis, timing analysis, acoustic cryptanalysis, and data reminiscence are all examples of how the attacker can gain information about the solution before even beginning to compute a solution through any brute force algorithm. To side-step the side-channel attacks, Harold Edwards, published his paper in 2007 that presented a form of elliptic curves (over a large prime characteristic fields) that contained an addition law on the group that was strongly unified, successfully negating the ability to gain information about secured data from the side-channel information. In the following chapter, we first begin by defining the geometric and algebraic definition of the Weierstrass form. After establishing that understanding, in chapter 3, we move directly into the contribution of Edwards as well as Bernstein and Lange through the introduction of the binary Edwards curves. In chapter 4, we examine a different map into the homogeneous coordinate system and how it can improve upon the original binary Edwards curve. 2 Chapter 2 Weierstrass Form: Paving the Way To define most simply, an elliptic curve is \a smooth, projective algebraic curve of genus one." We begin our examination by defining this idea of an elliptic curve in the affine coordinate system (x; y) over some field K. Let us, for now, say that char(K) 6= 2; 3, then an elliptic curve is an equation of the form: E(K): y2 = x3 + Ax + B where A; B are constants in the algebraic closure the field K (although these constants are most likely within the actual field). Together with the point at infinity, denoted 1, the points on this curve form a group where the identity (or neutral) element is 1. We must ensure that the elliptic curve stated above is non − singular, i.e. contains no cusps, or self-intersections. The way that we can guarantee that is by going back to the original definition of an elliptic curve. There is an assumption that an elliptic curve has genus one, ensures that the discriminant (denoted ∆) must not be zero. If the disciminant was zero, then we have a double root. This double root causes issues topologically because is would imply that the curve is no longer genus one, and therefore not elliptic. For this form of the elliptic curve, the discriminant is defined as: ∆ = 4A3 + 27B2 3 2.1. WEIERSTRASS ADDITION WEIERSTRASS LAWCHAPTER2. FORM: PAVING THE WAY We can include characteristic 2 and 3 fields to yield more generalized form of the Weierstrass equation, which would give us an elliptic curve: 2 3 2 y + a1xy + a3y = x + a2x + a4x + a6 where a1; :::; a6 are constants within the algebraic closure of the field K. When we begin to define the properties of an elliptic curve, we will start with the Weier- strass form, and move more generally to include fields of characteristic 2, and 3 as necessary. Now that we have a more explicit definition of what an elliptic curve will be, we can construct the addition law that makes up the group operation. 2.1 Weierstrass Addition Law Now that we have the parameters that make up the Weierstrass form of what an elliptic curve is within the affine coordinate system we can define the addition law that is found over this family of curves. We will examine these, both from the geometric as well as the algebraic perspectives. Both examinations will be important later on when we begin to transform our elliptic curve. 2.1.1 Geometric Interpretation In order to understand the addition law geometrically, we start by stating a theorem from algebraic geometry. Theorem: Bézout'sTheorem. Let f; g 2 R be nonzero polynomials of degrees m; n, respectively, that share no common factors. Let C, and D be two plane curves, described by equations f(X; Y ) = 0 and g(X; Y ) = 0 Then the total number of intersection points of C and D, including multiplicities and ideal intersections, is exactly mn. The proof of Bézout'stheorem can be found in any algebraic geometry textbook, so here we omit it. When we are considering the cubic elliptic curve as defined above, we can see that a line of the form y = mx+b must intersect the curve three 4 2.1. WEIERSTRASS ADDITION WEIERSTRASS LAWCHAPTER2. FORM: PAVING THE WAY Figure 2.1: A graph depicting the geometrical 'chord and tangent method' of elliptic curve addtion.

Load more