Software Implementation of Elliptic Curve Encryption over Binary Field *

Transcription

1 Dec. 3 Journal of Electronc Scence and Technolog of Chna Vol. No. Software Ipleentaton of Ellptc Curve Encrpton over Bnar Feld * ZHANG Xanfeng QIN Zhguang ZHOU Shje LIU Jnde (School of Coputer Scence and Engneerng, UESTC Chengdu 654 Chna) Abstract The atheatcal theor for ellptc curve encrpton based on optal noral bass (ONB) over F s ntroduced. Then an ellptc curve crptograph(ecc) based encrpton schee s analzed and desgned. The echans for ke exchange based on Dffe-Hellan s descrbed n detals for further applcatons. Based on these theoretc foundatons, the software based on ECC s developed and an applcaton s provded. The software s characterzed b excellent securt as well as hgh effcenc. Ke words network securt; ellptc curve crptograph(ecc); encrpton software; bnar feld Currentl, ellptc curve crptograph (ECC) s regarded as an attractve crptograph that can provde greater strength, hgher speed and saller kes than [~6] other crptograph sstes. A vast aount of research has been done on ts secure and effcent pleentaton. ECC has receved ncreased coercal acceptance and s adopted b accredted standards organzatons such as ANSI (Aercan Natonal Standards Insttute), IEEE (Insttute of Electrcal and Electroncs Engneers), ISO (Internatonal Standards Organzaton), and NIST (Natonal Insttute of Standards and Technolog). In the practcal applcatons based on ECC, ellptc curves groups are usuall ade up of ellptc curves over underlng felds of F p or F (where p s a pre). Generall, eleents over feld F p are denoted b polnoal bass representatons, and eleents over feld F can be denoted b noral bass representatons. Although the descrpton of the feld F s coplcated, the feld F s extreel useful because ts coputatons can be done effcentl n [7] hardware. For feld F, noral bass representatons have the coputatonal advantage that squarng an eleent can be done ver effcentl. Multplng dstnct eleents, on the other hand, can be cubersoe n general. For ths reason, t s coon to specalze a class of noral bases, called Gaussan noral bases, for whch ultplcaton s both spler and ore effcent. Gaussan noral bases for F exst whenever s not dvsble b 8. The nclude the optal noral bases (ONB), whch have the ost effcent ultplcaton possble n a [8,9] noral bass. In 999, Tatsuak Okaoto, Echro Fujsak and Hkaru Mortaan descrbed a provabl ellptc curve encrpton schee usng the ellptc curve ElGaal trapdoor functon, rando functon (hash functon) and [] a setrc-ke encrpton. In, a stud of the software pleentaton on workstatons of the NIST-recoended ellptc curves over bnar felds [] was presented. In, M. Brown, D. Hankerson and J. Lopez presented an extensve studof the software pleentaton on workstatons of the NIST-recoended ellptc curves over pre [] felds. In ths paper, we desgn and pleent coplete ellptc curve encrpton software based on ONB presentaton over F and Dffe-Hellan ke agreeent schee. It s desgned to be both seantcall secure and plantext-aware, n the presence of an adversar capable of launchng chosen-plantext and chosen-cphertext attacks. The eceved 3-3- * Supported b Natonal 863 lan roject (No. AA44)

2 No. ZHANG Xanfeng et al: Software Ipleentaton of Ellptc Curve Encrpton over Bnar Feld 55 test result proves that our encrpton software can be coparable wth those schees presented n efs. [~]. ONB resentaton and Feld Matheatc ules over Feld F. ONB presentaton Ever fnte feld F has a noral bass. But not all fnte felds have an ONB. Moreover, there are onl tpes of ONB for feld F f exst. If > s not dvsble b 8,the followng algorth tests for the exstence of an ONB for feld F [8] of gven tpe. Input: an nteger > not dvsble b 8; a postve nteger T= or. Output: f a tpe T ONB for feld F exsts, the essage True, otherwse False. Set p=t+; If p s not pre then output False and stop; k Copute k that satsfes (od p); Set h=t/k; Copute d:=gcd(h,), where GCD(h,) deno-tes the greatest coon dvsor of h and ; If d = then output True ; else output False. If feld F has a tpe ONB then set the feld polnoal pt ( ) = t + t + L + t + t + ;f F has a tpe ONB then copute pt ( ) = p () t usng the followng recursve forulae p ( t) = p ( t) = t + p+ () t = tp() t + p () t, L, At each stage, the coeffcents of the polnoals p () t are reduced odulo ; hence pt ( ) s a polnoal of degree wth coeffcents n F.. Coputng ules Based ONB for Fled F ^ Let ONB for feld F be {t,t,t, L, ^( ) t }(t F ), feld eleent a=(a a L a ), b=(bb L b ), then ONB s the presentaton of a ^ ^ = at and b= bt... Addton and Subtracton The addton of eleent a and b over F defned as: a+b=(c,c,l,c ), where c = (a +b ) od. The subtracton a b can be calculated b a+( b), s where ( b) s the addton reverse of b, and b =( b, b,, b ) od... Squarng and Square oot ^ For feld eleent a = at, squarng and the calculaton of square root are lnear operatons n F as follows: ^ (a ) =( ) ^( + ) at = at = ^ a(( ) od t (a ) ^ =( at ) L =( a a a a ) ^( ) = at = ^ a(( + ) od t =( a La a ) Hence squarng or the calculaton of square root of a fnte feld eleent s a sple rotaton of the vector representaton...3 Multplcaton and Dvson When eleents over F are presented based on ONB, the ultplcaton rule for two eleents s depcted n ef.[]. The dvson s the reverse calculaton of the ultplcaton. Thus, a/b can be coputed b a b, where b s the ultplcatve reverse of b that wll be coputed next...4 Multplcatve Inverse Because the feld eleents over F can be denoted b polnoals over F, the ultplcatve nverse of eleents can be calculated va the Extended Eucldean Algorth. Meanwhle, because the bt strng presentaton of a s equal to the bt strng (a a L a ) wth tes of crcular left shft operaton, or a=a, the ultplcatve reverse of a s coputed va a = a. Addtonall, because s equal to + + +, a can be calculated b a a a. So va ( ) tes of squarng and ultplcaton operaton, a, whch equals a, can be coputed. The Ellptc Curves and ont fffff.operatons. The Ellptc Curves over Feld F Accordng to standard specfcatons for ublc Ke Crprograph, an ellptc curve can be denoted b a septuplet: T=(, f(x),a,b,g,n,h), consstng of an

3 56 Journal of Electronc Scence and Technolog of Chna Vol. nteger specfng the fnte feld F, an rreducble bnar polnoal f( x ) of degree specfng the representaton of F, two eleents a, b F specfng the ellptc curve E(F ) defned b the equaton: + x = x 3 + ax + b n F, a base pont G=(x G, G ) on E(F ), a pre n whch s the order of G, and an nteger h whch s the cofactor h =# E(F )/ n (where # E(F )s the nuber of ponts on E(F )). Ellptc curve E(F ) conssts of the set of ponts =( x, ) ( x, F ). All ponts n together wth the pont at nfnt, denoted b O, for an Abel group (ellptc curve group). All ponts on an ellptc curve can be deterned b an rreducble non-zero feld or noral polnoal of degree. The desred securt level s controlled b. In practce, requreents on securt and effcenc deterne the selecton of. Usuall s selected fro the nteger set {3, 3, 63, 93, 33, 39, 83, [8] 49, 57}.. ont Operatons n F.. ont Addton and Subtracton Set pont =( x, ) E(F ), then the pont =( x, x + ) s the reverse of. For ever pont E(F ), +( )= O, + O = O+ =. Set pont Q =( xq, Q ) E(F ), where Q, and let + Q = =( x, ), then If = Q (self-addton), then b x = x + x = x + ( x + ) x + x x If Q (addton), then + Q + Q x = ( ) + ( ) + x + xq +a x + x x + x Q + Q = ( ) x + x Q Q ( x + x ) + x + The subtracton of and coputed va Q = +( Q ). Q over F s.. Scalar Multplcaton Set a pont over E(F ) wth an order n(n =O), the scalar ultplcaton of can be denoted b Q= k, where Q E(F ), k n. B the defnton of the pont addton, k can be calculated b addng to tself k tes. Because h k F, k can be denoted b k = k,where h and are ntegers, h and k {,}. Thus h k can be coputed as k = k = ( k+ ( k+ ( +( + ) kh 3 kh kh ) + k.ths approach requres h self-addtons and (w k ) addtons, where s the nuber of ones of the bnar w k representaton of k...3 Fndng a ont on An Ellptc Curve The base pont and publc kes accordng to ECC are all ponts on E(F ). The x -coordnate and -coordnate are all eleents over fled F. To generate these ponts, a coon approach s to appont a feld eleent ( x -coordnate) frst, then the correspondng -coordnate can be calculated b the equaton of E(F ). Set E(F ): +x = x 3 + ax + a6, the correspondng -coordnate can be coputed [5] b the followng steps. ) Appont x ( F ), copute the value of 3 3 polnoal x + ax + a6, set b = x + ax + a6. ) Copute the equaton + x = b, ths s equvalent to copute the equaton + x +b =. 3) Set = x z, then + x + b = s transfored to z +z + b / x =. In F, z + z + b / x = s equvalent to z = z +b / x, that s z = / / ( z ) +(( b / x )) ).For two eleents u and v over F, equaton (u + v ) = u + v holds. / / So the equaton z =( z ) +(( b / x ) ) s / / / equvalent to z = z +( b / x ). Hence z = / z +( b / x ). 4) Assue z =( z z z ) and k =( b / / / x ) =( k k k ), equaton z = z +( b / / x ) s equvalent to ( z z z z )=( z z z )+( k k k k ). Therefore, when one bt of z s deterned, the other bts can be deterned b the equaton ( z z z L z )=( z z L z )+( k k k L k ). Furtherore, s coputed. Of course, a rando feld eleent over F a not be the x -coordnate of a pont on E(F ). In that

4 No. ZHANG Xanfeng et al: Software Ipleentaton of Ellptc Curve Encrpton over Bnar Feld 57 case, we can ncrease the rando feld eleent b pre). We also assue that the councatng and check whether the new eleent s the partes are C and S. C s publc-prvate ke par s x -coordnate of a pont on E(F ). The procedure s repeated untl the desred eleent s found. (Q C,d C ) and S s ke par s (Q S,d S ). At the end of the protocol, the councatng partes end up wth the sae value K whch s a pont on the curve. A 3 Analss and Desgn part of K (such as x -coordnate of K ) can be used as a secret ke to a setrc ke encrpton 3. Choosng the Ellptc Curve algorth. The Dffe-Hellan protocol based on ECC To obtan a desred securt level, the paraeter s llustrated n Tab. should be about 6. All bnar felds F have the Tab. The dffe-hellan protocol based on ECC propert that s pre, whch can resst recent attacks on ellptc curves defned over where s User C User S coposte. Accordng to Standard specfcatons for Choose d C [, n -] Choose d S [, n -] ublc Ke Crptograph, we appont =63 for F. Q C = d C G Q S = d S G 63 can provde excellent securt and hgh effcenc Send Q C eceve as well. And we select ellptc curve equaton: eceve Q S Send +x=x 3 +ax +b n F b generatng the coeffcent K =d C Q S K =d S Q C a and b randol. However, to avod supersngular ellptc curves and anoalous ellptc curves whch have securt vulnerablt, we ust also check the ellptc curve we generate. A ethod to check generated ellptc curve can be referred to ef. [8]. If an attacker can onl get publc ke Q C, Q S and the base pont G, he can not coprose the pont K. Ths s equvalent to get prvate ke d C or d S fro Q C, Q S and G, whch s an ellptc curve dscrete logarth proble (ECDL). 3. Ke Exchange rotocol Based on ECC 3.3 The Encrpton Schee To establsh a shared ke between two partes Based on the descrpton and analss above, an effcentl, the Dffe-Hellan ke exchange protocol [3] based on ECC s selected. We assue that the underlng feld F and the ellptc curve equaton E (F ): + x = x 3 + ax + b s selected. And the encrpton schee s presented n the followng. To elaborate our schee explctl, we assue the councatng partes are a clent and a server. The encrpton schee can be llustrated n Fg.. base pont G s set up, whose order s n (n s a Server Clent Choose feld F Generate the ellptc curve and the base pont, choose a setrc encrpton schee Send the choces eceve the paraeters Generate the publc and prvate ke par of server Exchange the publc Generate the publc and prvate ke par of clent Generate the shared ke b the Dffe-Hellan protocol based on ECC Generate the shared ke b the Dffe-Hellan protocol based on ECC Decrpt the cpher text b the setrc encrpton schee, and check the MAC to recover the plan text. Send the cpher text Encrpt the plan text b the setrc encrpton schee, and generate MAC. Fg. The flow chart of the encrpton schee

5 58 Journal of Electronc Scence and Technolog of Chna Vol. Frstl, the server should deterne the underlng fled F, the ellptc curve, a base pont and the setrc encrpton schee to be used, then send these choces to the clent. After the two councatng partes generate ther own ke par, the send ther respectve publc kes to each other and negotate the shared ke b the Dffe-Hellan rotocol based on ECC. Now two partes can conduct encrpton and decrpton va the setrc ke schees (such as btwse exclusve-or encrpton algorth, IDEA, 3DES, AES, etc.). To ensure the ntegrt of the cpher-text, soe essage authentcaton code (MAC) schee s taken. 4 Ipleentaton and Applcaton In the pleentaton of the encrpton software, we choose the exclusve-or encrpton algorth as the setrc encrpton algorth. The bte length of encrpted data packet s set to be 4. [4,5] HMAC_SHA-_6 s selected as the s selected as the MAC schee. These choces can ensure desrable securt. The effcenc of the encrpton software s deterned b the calculaton operatons of feld eleents and ellptc curve ponts based on ONB for fled F and the conversons between the ellptc curve ponts and the feld eleents. To ake our code ore concse, effcent and reusable, we choose Turbo C. as the developent tool, and encapsulate all the underlng functons n a dnac lnk lbrar (DLL) fle. The perforance results of the encrpton software are tested on a platfor entu Ⅲ 733. Tab. shows the te for encrpton and decrpton operatons. 63 Tab. Te for ECC operatons over F Operaton ando curve over F 63 Encrpton Decrpton 3.96 llseconds.58 llseconds We have appled the toolkt (DLL fle) to a project (naed User Identt Identfcaton) of Cheng Dan Unead software Lt Corporaton. The an technologes nclude: at clent, a thero-senstve sensor obtans the user s lve fngerprnt; The data of lve fngerprnt are processed, then encrpted b the encrpton toolkt and transtted to the server; At server, Encrpted data are decrpted and the pattern recognton operaton s conducted. Fnall the purpose of dentfng the user s dentt s acheved. The practcal functon and perforance test of the sste shows that the toolkt s characterzed b effcent [6] securt and hgh effcenc. 5 Conclusons SA has been n publc ke sstes for over two decades, but ECC offers an alternatve. ECC s exctng because of the potental to provde slar levels of securt copared to SA but wth sgnfcantl reduced ke szes. ECC presuabl offers faster processng, and lower deands on eor and bandwdth, whch are crtcal n the space of oble solutons [3,7] the threshold crptograph develops fast. Currentl, the research on [8]. However, the threshold crptograph technologes based on ECC deserve great attenton. eferences [] Xu Qulang, L Daxng. Ellptc curve crptosstes[j]. Journal of Coputer esearch and Developent, 999, 36(): 8 (n chnese) [] Wang Hanqang, We Qngfu. A publc ke crptosste based on ellptc curves over Z/nZ[J]. Journal of Chna Insttute of Councatons, 999, (7):6 (n chnese) [3] Zhang Xanfeng, Qn Zhguang, Lu Jnde. An analss of the securt and effcenc on ellptc curve crptosstes[j]. Journal of Unverst of Electronc Scence and Technolog of Chna,, 3():44 (n Chnese) [4] Certco Corp. Current ublc-ke Crptographc Sste[DB/OL]. A Cetco Whtepaper, Canada,. pdf [5] Certco Corp. earks on the securt of the ellptc curve crptosste[db/ol]. A Cetco Whtepaper, Canada,. Ecc Whte3.pdf [6] Lopez J, Dahab. An Overvew of Ellptc Curve Crptograph[DB/OL]. htl. [7] Certco Corp. Math. Canada[DB/OL]. certco.co/resources/ecc/ath7.htl 3

6 No. ZHANG Xanfeng et al: Software Ipleentaton of Ellptc Curve Encrpton over Bnar Feld 59 [8] IEEE Standards Departent[S]. IEEE 363/D3 (Draft Verson 3), Standard Specfcatons for ublc Ke Crptograph, , [9] Agnew G B, Mulln C, Vanstone S A.An pleentaton of ellptc curve crptosstes over F 55 [J]. IEEE journal FC 4, [6] Chengdan Unead software lt corp[]. The test report of UID,. 5 [7] Chrstopher M K, Curts E D, Osanoglu T. Securt Archtecture: Desgn, Deploent and Operatons[M]. on selecte.d areas n coun- catons, 993, (5):84 ~ 83 [] Tatsuak Okaoto, Echro Fujsak, Hkaru Morta. SEC: rovabl Secure Ellptc Curve Encrpton Schee Sdne: Osborne/McGraw-Hll,, 9 [8] Desedt Y. Soe ecent esearch Aspects of Threshold Crptograph[DB/OL]. co/dese dt97soe htl, 997 [DB/OL] / 363a/co-ntrbutons/psec.pdf [] Hankerson D, Julo Lopez, Menezes A. Software pleentaton of Ellptc Curve Crptograph Over Bref Introducton to Author(s) ZHANG Xanfeng( 张 险 峰 )was born n 973. He s now pursung h.d. degree n UESTC. Hs research nterests nclude: Bnar Felds[DB/OL].. prnceton. nforaton securt, crptograph technolog. E-al: edu/ fskran/ reposto-r/ CHES/ hankerson software. pdf zhangxf@uestc.edu.cn QIN Zhguang( 秦 志 光 )was born n 957. He s now a [] Brown M, Hankerson D, Lopez J. Software rofessor, and Doctoral Advsor n UESTC. Hs research pleentaton of the NIST Ellptc Curve Over re Felds[DB/OL].. edu/users/ halton/secu-rt/pubs/software_ipleentaton_of_ nterests nclude: nforaton securt, ITS and ddleware E-al: qnzg@uestc.edu.cn ZHOU Shje( 周 世 杰 )was born n 97. He s now the_nist_ Ellptc. pdf pursung h.d. degree n UESTC. Hs research nterests [3] Ados M, Sava E C. Ipleentng Network Securt nclude: coputng, nforaton securt, and dstrbuted rotocols based on Ellptc Curve Crptograph[DB/OL]. coputng. E-al: sjzhou@uestc.edu.cn c6nsecc.pdf, LIU Jnde( 刘 锦 德 )was born n 93. He s now a -7-5 rofessor and Doctoral Advsor n UESTC. Hs research [4] ANSI X9.7-99x. Keed Hash Message Authentcaton nterests nclude: openng dstrbuted coputng and code[a]. Workng Draft. 998 [5] Krawczk H, Bellare M, Canett. HMAC: Keed Hashng for Message Authentcaton[DB/OL]. Internet ddleware technolog, oble agent technolog. E-al: jdlu@uestc.edu.cn (Contnued fro page 4) Theor[M]. Chengdu: ublshng House of UESTC, 996. (n Chnese) 4 Conclusons Fro the analss above, the expresson of couplng rato k s obtaned. The equvalent crcut of the couplng between the crostrp and D s analzed and the coponents expresson s obtaned. eferences [] L Yng. Theor and Applcaton of Electroagnetc D[M]. Bejng: ublshng House of Electroncs Industr, 988. (n Chnese) [] Vrdee B S, arsons A J, Meadows G. Coercal coputer-aded desgn software optses DO Crcut Desgn[J]. Mcrowave Conference/Brazl, 993, SBMO Internatonal, 993, (5): [3] Lou enha, Fu Guoxng, Yuan Jnghong. Electroagnetc Bref Introducton to Author(s) LIAO Juan( 廖 娟 )was born n Schuan, Chna, n 977. She receved B.S degree n E.E. n and M.S degree n Crcuts an Sstes n fro UESTC. After graduaton fro UESTC, She s now engaged as an engneer of oble councaton b the Councaton Copan of Chna. LIU Guanghu( 刘 光 祜 )was born n Schuan, Chna, n 946. He graduated fro E.E. Dept. of Harbn Engneerng Unverst n 968. As a senor vstng scholar, He used to be nvted to Unverst of Nevada-eno n USA to do research fro 989 to 99. He s now a rofessor and the Chef Lecturer of UESTC and Head Engneer of Chengdu Sne Scence and Technolog CO. Ltd. of UESTC. Hs research nterests nclude: F and crowave crcuts and sstes.