EP1997000A1

EP1997000A1 - Cryptographic method with elliptical curves

Info

Publication number: EP1997000A1
Application number: EP07726643A
Authority: EP
Inventors: Jean Georgiades; Anton Kargl; Bernd Meyer
Original assignee: Siemens AG
Current assignee: Siemens AG
Priority date: 2006-03-23
Filing date: 2007-03-06
Publication date: 2008-12-03
Also published as: DE102006013515A1; WO2007107450A1; KR101391216B1; CN101410792B; JP2009531726A; US20090285388A1; KR20080111089A; US8582761B2; JP2012123426A; CN101410792A

Abstract

The invention relates to a method for determining an elliptical curve, suitable for a cryptographic method, comprising the following steps: (a) an elliptical curve to be tested is prepared; (b) the order of a twisted elliptical curve associated with the elliptical curve to be tested is determined; (c) it is automatically checked whether the order of the twisted elliptical curve is a strong prime number; and (d) if the order of the twisted elliptical curve is a strong prime number, the elliptical curve to be tested is selected as an elliptical curve suitable for cryptographical methods.

Description

description

Cryptographic method with elliptic curves

The present invention relates to a method for Ermit ^¬ stuffs of elliptic curves, which, in particular of elliptic curves are suitable for cryptographic data processing. Further, the present invention relates to a kryp ^¬ tographisches method and apparatus based on the to-elliptical front selected curves.

Cryptographic techniques are used to encrypt messages, sign documents, and authenticate people or objects, among other things. For this purpose, called asymmetric Locks ^¬ are particularly so selungsverfahren, as well as provide a public key for a user in both a private and secret keys.

When encrypting a message, the sender obtains the public key of the desired addressee and thus encrypts the message. Only the addressee is there ^¬ able to decrypt the message again with the private key known only to him.

When signing a document a Signing a document calculates a elekt ^¬ tronic signature with his private key. Other people can easily verify the signature using the undersigned's public key. However, only signatures can be verified with the public key, which are signed with the associated private key. This unambiguous assignment and the assumption that the private key is kept secret by the signer result in a clear assignment of the signature to the signer and the document. When authenticating using a challenge-response (request-response) protocol transmits a testing a request to a person and ask it to this on ^¬ ask with the private key of the person to calculate an answer and be returned. A positive authentication occurs in the event that the verifier can verify the returned response with the public key of the person under review.

The asymmetric cryptography methods are based on a private and a public key, as stated above. In this case, the public key is generated from the private key by means of a predetermined algorithm. Essential for the cryptographic methods is that a reversal, i. H. a determination of the private key from the public key in finite time with the available computing capacity is not manageable. The latter is granted if the key length of the private key reaches a minimum length. The minimum length of the key depends on the algorithms used for encryption and the determination of the public key.

Operations with public or private keys require a certain amount of computation. This depends on the algorithms used and also on the length of the keys used. It proves to be advantageous to use encryption algorithms based on ellip ^¬ tables curves, since they provide a high level of security with short key lengths. So far, unlike other methods, no determination of the private key from the public key is known for cryptographic methods based on elliptic curves, the Re ^¬ chenaufwand increases slower than exponential increase with increasing key length. In other words, the Si ^¬ cherheitsgewinn per additional bit length of the key used is higher than in other processes. For practical therefore, shorter key lengths can be used.

An elliptic curve E is generally defined by a Weierstrass equation which written as following cubic sliding ^¬ chung:

The ai are aΣ a3 a selected elements of a

Body K and the pairs (x, y) are hot points of the elliptic curve E and satisfy the Weierstrass equation. For the cryptographic methods, a finite field K is selected. Correspondingly, the number of points of the elliptic curve E is finite and is hereinafter referred to as the order ord (E) of the curve E. In addition, a formal point is introduced at infinity.

An abelian group structure G can be defined on the set of points of the elliptic curve. The operation of the abelian group structure is hereinafter referred to as addition and written additively. The addition of two arbitrary points of the elliptic curve clearly gives a third point of this elliptic curve. Further, a scalar multiplication can be defined in DIE se, which is defined as multiple addition of a point to itself defi ^¬. P is a point on the elliptic curve E, s is an integer and Q = sP the s-fold of the point P. Q is flat ^¬ if a point of the elliptic curve. The determination of the scalar s at given points P and Q is called a discrete logarithm problem for elliptic curves. With a suitable choice of the body K and the parameters of the elliptic curve E, it is impossible with the computer equipment available today to solve the discrete logarithm problem within a reasonable time. The security of cryptographic methods using elliptic curves is based on this difficulty. A communication user selects a scalar s as his private key and keeps it secret. Furthermore, it generates the public key Q from a starting point P as the scalar multiple of the starting point. With respect to the start point P is agreement between the communication ^¬ participants. S is a determination of the private key from the public key Q due to the high computational effort of the discrete logarithm problem does not mög ^¬ Lich and thus granted the security of cryptographic methods with elliptic curves. Another requirement of the elliptic curves is that their order is a large prime or the product of a large prime with a small number.

The cryptographic techniques provide a compromise between security to be expected and the computational effort during the encryption of data. In DE 101 61 138 Al it is shown that to determine the scalar Vielfa ^¬ surfaces of a point using only the x-coordinate without reciprocating drawing the y-coordinates is possible. Corresponding calculation instructions are described for arbitrary bodies in DE 101 61 138 A1. This can be much more efficient implementations of the point arithmetic, z. As a Montgomery ladder for scalar multiplication, a lower number of body multiplies per point addition and a smaller number of registers for the point representation and achieve the intermediate results. However reindeer in this procedural ^¬, is not checked whether a point element is really the elliptic curve ^¬ rule.

This results in the possibility to perform a side channel attack. An x-coordinate of a point can be transmitted to an encryption device, the point not lying on the elliptic curve. For this purpose, it is described in DE 10161138 A1 that in this way a partial reconstruction of the private key of the encryption ^{device is} possible. DE 10161138 A1 specifically uses to prevent such side channel attack. chose elliptic curves. The criterion used here are the twisted elliptic curves associated with the elliptic curves. The associated twisted elliptic curve is defined as follows:

y ² + vaixy + a3y = x ³ + va2X ² + v ² a4xv ³ aε,

wherein the parameters ai, a _2, a _3, a _4, a _6, the parameters of the el ^¬ liptischen curves. The parameters v are all non-squares of the body K if the characteristic of the body K is odd or an element of the body K with trace 1. Al ^¬ le these twisted elliptic curves should also have an order according to DE 10161138 Al, the one large prime or the product of a large prime number with a small number.

The authors write Daniel RL Brown and Robert P. Gallant be ^¬ in their article "The Static Diffie-Hellman problem" another opportunity for a side-channel attack, completely to a private key or in part for For ^¬ peek.

Against this background, the object of the invention is to provide a method which selects elliptic curves which do not permit any conclusion on the private key in side channel attacks.

According to the invention, this object is achieved by the method having the features of patent claim 1. A method for the cryptographic processing of data with the features of claim 4 and a device for Identitätsbes ^¬ actuation of a person or an object with the features of claim 6 also prevent a determination of the private key or a partial determination of the private key by side channel attacks.

Accordingly, it is provided: Method for determining an elliptic curve suitable for cryptographic methods, comprising the following steps:

(a) providing an elliptic curve to be tested;

(b) determining the order of a twisted elliptic curve associated with the elliptic curve to be tested;

(c) automatically checking if the order of the twisted elliptic curve is a strong prime; and

(d) selecting the test elliptic curve as the elliptic curve net cryptographic procedures geeig ^¬ when the order of the twisted elliptic curve is a strong prime number.

Method for cryptographically processing data with the following steps:

Providing an elliptic curve determined by one of the methods of claims 1 to 3; Providing only one x-coordinate of a point; Providing a private key; automatically applying a cryptographic Locks ^¬ selungsverfahrens on the x coordinate using the provided elliptic curve and the private key for determining an encrypted x-coordinate; and outputting a value based on the encrypted x-coordinate.

A device for confirming the identity of a person or an object with a receiving device that serves to receive a coordinate, a storage device that holds a private key of the person or the object, processing means for processing the received coordinate with the private key, wherein the processing is based on an elliptic curve selected according to any of the methods 1 to 3 and an output means arranged to output the processed coordinate.

The idea underlying the present invention is to provide an elliptic curve only for cryptographic

Method to use when the elliptic curves twisted to this elliptic curve have an order that is a strong prime. A strong prime P is described by the following equation:

P = I + r-q,

where r is a small number, typically in the range up to 255, and q is a large prime. Ideally, the strong prime is a so-called Sophie Germain prime, i. r is 2. The elliptic curves and the associated twisted elliptic curves correspond to the definitions given above. The present invention prevents page channel attacks based on improperly transmitted x coordinates or malformed incorrectly transmitted x coordinates, these x coordinates not corresponding to any point on the selected elliptic curve. The method according to the invention is robust to the extent that even with such x-coordinates no spying or partial determination of the private key by an external device is possible.

Advantageous developments and refinements are the subject of the other dependent claims or will become apparent from the description in conjunction with the drawings.

According to one embodiment, the order of the twisted elliptic curve is calculated by counting a number of points. true, which lie on the twisted elliptic curve. Alternatively, the order of the twisted elliptic curve may also be made based on a determination of the order of the elliptic curve and the characteristic of the body. For this purpose, clear mathematical relations between the different orders can be used. The counting of the dots is done by methods well known to those skilled in the art.

In one embodiment, it is automatically checked whether the order of the elliptic curve to be tested is a strong prime, and the elliptic curve to be tested is selected for cryptographic methods only if the order of the elliptic curve to be tested is a strong prime.

The present invention is explained below with reference to the exemplary embodiments indicated in the schematic figures of the drawing. Show

1 shows a flow chart of an embodiment of the method according to the invention;

Fig. 2 is a block diagram of an embodiment of the device according to the invention; and

3 is a flowchart of an embodiment of the method according to the invention, which is carried out by the devices of FIG. 2.

FIG. 1 shows a flow chart for illustrating an embodiment of the method according to the invention. In a first step, a pool with elliptic curves E is provided (S1). The elliptic curves E are defined over a finite field K. Thus, the curve E contains a finite number of points P. As already described, the elliptic curve is defined by the Weierstrass equation and the parameters ai, a ₂ , a ₃ , a ₄ , a ₆ . By corre ^¬ sponding restrictions or changes in the parameterization individual parameters can be zero. The parameters are selected so that the elliptic curves are not singular.

Subsequently, the order of the elliptic curve is determined (S2). The order of the elliptic curve is understood to mean the number of points over a body K that satisfy the Weerrstraß equation. In a geometric interpretation, these are all points P lying on the elliptic curve E.

The order of the elliptic curve, abbreviated ord (E), should be a prime number. If a review that this is not a prime number, a different curve E is out of the pool on the ^¬ selected (S8). If the order of the elliptic curve E is confirmed to be prime, a check is made as to whether the order of the elliptic curve is a strong prime (S3). The definition of a strong prime is given above.

In a next step, the elliptical curves E that are twisted into the elliptic curve E are checked (S4). The definition for the twisted curves E 'is already given above. The check is made for all twisted curves E ', i. for all possible parameters v, which are correspondingly not a square or an element with track 1. In detail, the order of the twisted curve E 'is determined

(S5). The order of the twisted curve E 'should also be a prime number like the elliptic curve. If this is not satisfied, another elliptic curve E is selected.

In addition, it is checked whether the order of the elliptic curve E 'is a strong prime number (E6).

If all four conditions of steps S2, S3, S5 and S6 it fills ^¬, the elliptic curve E is selected for a cryptographic method. The order of an elliptic curve can be determined by a known counting method. Alternatively it is possible the order about the relationship

ord (E) + ord (E ') = 2- | κ | + 2

to determine, where κ | the characteristic of the body K is.

FIG. 2 shows a block diagram of a test object A and a test device B. The test object may be, for example, a smart card or an RFID chip. The testing device B is the corresponding reading device. The test object A has ei ^¬ ne memory device 1, in which a private key KP is held. This private key KP is kept secret and is in no way readable by an external device. In a further memory device 2, the parameters required for the parameterization of an elliptic curve E are stored. A data processing device 3 performs an encryption algorithm based on the private key and an elliptic curve, which is determined by the parameters which chereinrichtung in the SpeI ^¬ stored second The parameters or the elliptic curve are determined by means of the method according to the invention, for example by the exemplary embodiment shown in FIG. Furthermore, the test object has a receiving device 4, which can receive an x-coordinate of a point. This x coordinate is supplied to the data processing means 3 which carries out the predetermined process from ^¬. What is special about this method is that it is only applied to the x-coordinate and only requires the x-coordinate of a point. The processed or encrypted x-coordinate is output by a transmitting device 5. The test object A does not check whether the transmitted x-coordinate can be a valid x-coordinate. The test object A does not check whether this x-coordinate is assigned to a point P of the elliptic curve. However, the selected rule ^¬ elliptic curves that are stored in the memory means 2 shall make sure that such an x- Coordinate no spying or partial spying of the private key is possible.

The tester B has a random number generator 10 which selects an arbitrary point PO from the elliptic curve. This is transmitted by means of a transmitting device 11 to the test object A. Furthermore, the checking device B has a receiving device for receiving the processed x-coordinate Q (x). A data processing device 13 checks the processed x-coordinate on the basis of a public key of the test object A. The public key can either be stored in the test device B or obtained from an external source. If the decrypted value corresponds to the previously randomly generated x-coordinate, it is output at an interface 14 that the identity of the test object A is confirmed.

In FIG. 3, the flow of an identification of a test object A is again shown schematically in a flow chart. In a first step S generates a to ^¬ event generator a point PO on the elliptic curve E and transmits the x-coordinate as a request to the test ^¬ object A. This is calculated from the x-coordinate with its private key KP a response (Sil) , Subsequently, the test object transmits the answer Q (x) and possibly also its public key KO. The response is ge by the verifier B using the public key KO ^¬ checked (S12). Upon confirmation of the response, a signal is output that person A is authenticated or identified (S13, S14).

In the following, a suitable elliptic curve is given by way of example. The finite field K has the form Z / pZ, and the equation of the elliptic curve E is given by y ² = x ³ + ax + b. The corresponding parameters of the elliptic curve E are:

p = 517847993827160675843549642866661055787617496734405781471 b = 395393382584534989047698356330422317897630021672687214876

The order of the elliptic curve ord (E) = 517847993827160675843549642866661055787617496734522943517 and the elliptic curve E 'twisted to the elliptic curve E also has a prime order ord (E') =

517847993827160675843549642866661055787617496734288619427. The base point P = (x, y) is defined by the coordinates

y = 482060190644397986573077501327725919378173632606557848976

given lies on the elliptic curve E and in this case even generates a complete point group. That is, each point of the elliptic curve E can be represented as a scalar multiple of the base point P. Further, the orders of the curves E and the twisted curves E 'have the following value:

Ord (E) = 1 + 4 • 129461998456790168960887410716665263946904

374183630735879 Ord (E ') = 1 + 2 • 258923996913580337921774821433330527893808

748367144309713

This fulfills all required properties for the elliptic curve for a cryptographic method.

Claims

claims

A method of determining an elliptic curve for cryptographic methods comprising the steps of:

(a) providing an elliptic curve to be tested;

(b) determining the order of a twisted elliptical curve associated with the elliptic curve to be tested;

(d) selecting the test is suitable elliptic curve as the elliptic curve, the cryptographic procedures ge ^¬ when the order of the twisted elliptic curve is a strong prime number.

2. Method according to claim 1, characterized in that the order of the twisted elliptic curve is determined by counting a number of points lying on the twisted elliptic curve.

A method according to claim 1, characterized in that the elliptic curve to be tested is defined over a body having a known characteristic and the order of the twisted elliptic curve is determined based on a determination of the order of the elliptic curve and the characteristic of the body.

4. The method according to any one of the preceding claims, characterized in that it is automatically checked whether the order of the elliptic curve to be tested is a strong prime and that the elliptic curve to be tested is selected for the cryptographic ^method when the order of the elliptic curve to be tested is a strong prime.

5. Method for cryptographically processing data with the steps:

(A) determining and providing an elliptic curve by means of a method according to one of the preceding Ansprü ^¬ surface; (b) providing only one x-coordinate of a point;

(c) providing a private key;

(d) automatically applying a cryptographic method to the x-coordinate by using the ready rack ^¬ th elliptic curve and the private key for determining a processed x-coordinate;

(e) output a value based on the processed x-coordinate.

6. The method according to claim 5, characterized in that the x-coordinate is sent from a test site to a test object; the test object provides the private key; the test object determines the processed x-coordinate; the test object transmits the processed x-coordinate to the test site; the verifier provides a public key of the test object; the verifier checks the processed x-coordinate with the public key; and the test center issues a confirmation of identity of Testob ^¬ jekts when examining the validity of the proces ^¬ ended resulting x coordinate.

7. A device for confirming the identity of a person or an object, having a receiving device which is provided for receiving a coordinate, with a storage device holding a private key of the person or object, with a processing device that processes the received coordinates using a method according to one of claims 1 to 4 with the private key based on the elliptic curve, and with an output device which is set up to output the processed coordinate.