Can we Beat the Square Root Bound for ECDLP over F p 2 via - PowerPoint PPT Presentation

Can we Beat the Square Root Bound for ECDLP over F p 2 via Representation? JNCF 2020 , Luminy Claire Delaplace Alexander May

Elliptic Curve O y 4 K : Field of characteristic � = 2 , 3 E : y 2 = f ( x ) = x 3 + ax + b 2 x − 2 2 4 − 2 − 4 2

Elliptic Curve O y 4 K : Field of characteristic � = 2 , 3 E : y 2 = f ( x ) = x 3 + ax + b 2 x − 2 2 4 ( E ( K ) , +) : Abelian group − 2 − 4 2

Elliptic Curve Discrete Logarithm Problem F q : Finite field with q elements Order of a point The order r of a point P ∈ E ( F q ) is the smallest integer > 0 s.t. rP = O ECDLP Given P, Q ∈ E ( F q ) s.t. P of order r = O ( q ) , Q ∈ � P � Find k ∈ Z /r such that kP = Q . 3

Elliptic Curve Discrete Logarithm Problem F p 2 : Finite field with p 2 elements Order of a point The order r of a point P ∈ E ( F p 2 ) is the smallest integer > 0 s.t. rP = O p 2 -ECDLP � p 2 � Given P, Q ∈ E ( F p 2 ) s.t. P of order r = O , Q ∈ � P � Find k ∈ Z /r such that kP = Q . This work : F p 2 , p prime. 3

Overview Previous algorithms �� � • Pollard Rho: T = ˜ = ˜ O p 2 O ( p ) � � • [Gaudry09]: T = ˜ p 2 − 2 = ˜ O O ( p ) 2 4

Overview Previous algorithms �� � • Pollard Rho: T = ˜ = ˜ O p 2 O ( p ) � � • [Gaudry09]: T = ˜ p 2 − 2 = ˜ O O ( p ) 2 Question Is there an algorithm for p 2 -ECDLP with runtime o ( p ) ? 4

Overview Previous algorithms �� � • Pollard Rho: T = ˜ = ˜ O p 2 O ( p ) � � • [Gaudry09]: T = ˜ p 2 − 2 = ˜ O O ( p ) 2 Question Is there an algorithm for p 2 -ECDLP with runtime o ( p ) ? Our work [DM19]... � p 1+ ǫ � • gives a new algorithm with runtime T = ˜ O , ∀ ǫ > 0 • may lead to a o ( p ) algorithm if improved 4

Core Idea: Representation Technique • Introduced by [H-GJ10] for the subset-sum problem • In our case : k can be decomposed as k = k 1 + k 2 log( p ) log( p ) log( p ) 2 2 k 1 = In base 2 k 2 = in ≈ p different ways 5

Core Idea: Representation Technique • Introduced by [H-GJ10] for the subset-sum problem • In our case : k can be decomposed as k = k 1 + k 2 log( p ) log( p ) log( p ) 2 2 k 1 = In base 2 k 2 = in ≈ p different ways Find a needle in a haystack 5

Core Idea: Representation Technique • Introduced by [H-GJ10] for the subset-sum problem • In our case : k can be decomposed as k = k 1 + k 2 log( p ) log( p ) log( p ) 2 2 k 1 = In base 2 k 2 = in ≈ p different ways Find a needle in a haystack ֒ → Find any needle among p 5

General Idea k 1 = k 2 = 3 3 k 1 P Q − k 2 P ≈ p ≈ p 2 2 L L ′ p representations k 1 P = Q − k 2 P = ⇒ k = k 1 + k 2 6

General Idea k 1 = k 2 = 1 1 Q − k 2 P k 1 P ≈ p ≈ p 2 2 L L ′ 1 representation k 1 P = Q − k 2 P = ⇒ k = k 1 + k 2 6

General Idea k 1 = k 2 = 1 1 Q − k 2 P k 1 P ≈ p ≈ p 2 2 L L ′ 1 representation k 1 P = Q − k 2 P = ⇒ k = k 1 + k 2 ∀ ( x, y ) ∈ L (resp. L ′ ) x ∈ F p 6

How to Proceed Splitting k 1 and k 2 k 1 = k 11 + k 12 k 2 = k 21 + k 22 log( p ) log( p ) k 11 = k 21 = k 12 = k 22 = 1 1 4 log p 4 log p 7

How to Proceed Splitting k 1 and k 2 k 1 = k 11 + k 12 k 2 = k 21 + k 22 log( p ) log( p ) k 11 = k 21 = k 12 = k 22 = 1 1 4 log p 4 log p • L : list of all P 1 = ( k 11 + k 12 ) P = ( x, y ) , x ∈ F p • L ′ : list of all P 2 = Q − ( k 21 + k 22 ) P = ( x ′ , y ′ ) , x ′ ∈ F p 7

A 4 -List Algorithm k 11 = k 12 = k 21 = k 22 = k 11 P k 12 P Q − k 21 P − k 22 P 8

A 4 -List Algorithm k 11 = k 12 = k 21 = k 22 = 3 3 3 3 k 11 P k 12 P Q − k 21 P − k 22 P p p p p 4 4 4 4 3 T ≈ p 4 8

A 4 -List Algorithm k 11 = k 12 = k 21 = k 22 = k 11 P k 12 P Q − k 21 P − k 22 P Join Join ( x, y ) ( x ′ , y ′ ) x ′ ∈ F p x ∈ F p 3 4 + T Join T ≈ p 8

A 4 -List Algorithm k 11 = k 12 = k 21 = k 22 = k 11 P k 12 P Q − k 21 P − k 22 P Join Join ( x, y ) ( x ′ , y ′ ) x ′ ∈ F p x ∈ F p T ≈ T Join 8

A 4 -List Algorithm k 11 = k 12 = k 21 = k 22 = k 11 P k 12 P Q − k 21 P − k 22 P Join Join ( x, y ) ( x ′ , y ′ ) 1 1 p x ′ ∈ F p p 2 2 x ∈ F p ( k 11 + k 12 ) P = Q − ( k 21 + k 22 ) P 1 T ≈ T Join + p 2 8

A 4 -List Algorithm k 11 = k 12 = k 21 = k 22 = k 11 P k 12 P Q − k 21 P − k 22 P Join Join ( x, y ) ( x ′ , y ′ ) x ′ ∈ F p x ∈ F p ( k 11 + k 12 ) P = Q − ( k 21 + k 22 ) P T ≈ T Join 8

The Join Problem Sur ( Z , +) y p 3 / 4 x T = p 3 / 4 Join x + y = z z = 0 [ p ] 9

The Join Problem Sur ( E ( F p 2 ) , +) p 3 / 4 P 1 P 2 T =? Join ( x, y ) x ∈ F p 9

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p 10

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p Group law : ( x 1 − x 2 ) 2 ( x 1 + x 2 + x ) − y 2 1 − y 2 2 = − 2 y 1 y 2 10

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p Group law : ( x 1 − x 2 ) 2 ( x 1 + x 2 + x ) − y 2 1 − y 2 2 = − 2 y 1 y 2 10

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p Weierstraß : (( x 1 − x 2 ) 2 ( x 1 + x 2 + x ) − f ( x 1 ) − f ( x 2 )) 2 − 4 f ( x 1 ) f ( x 2 ) = 0 10

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p x 1 = u 1 + αv 1 , x 2 = u 2 + αv 2 x = u + αv Weierstraß : (( x 1 − x 2 ) 2 ( x 1 + x 2 + x ) − f ( x 1 ) − f ( x 2 )) 2 + 4 f ( x 1 ) f ( x 2 ) = 0 10

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p x 1 = u 1 + αv 1 , x 2 = u 2 + αv 2 x = u + αv g 0 ( u 1 , v 1 , u 2 , v 2 , u, v ) + α g 1 ( u 1 , v 1 , u 2 , v 2 , u, v ) = 0 10

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p x 1 = u 1 + αv 1 , x 2 = u 2 + αv 2 x = u + αv g 0 ( u 1 , v 1 , u 2 , v 2 , u, 0) + α g 1 ( u 1 , v 1 , u 2 , v 2 , u, 0) = 0 10

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p x 1 = u 1 + αv 1 , x 2 = u 2 + αv 2 x = u + αv g ′ 0 ( u 1 , v 1 , u 2 , v 2 , u ) + α g ′ 1 ( u 1 , v 1 , u 2 , v 2 , u ) = 0 10

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p x 1 = u 1 + αv 1 , x 2 = u 2 + αv 2 x = u + αv g ′ 0 ( u 1 , v 1 , u 2 , v 2 , u ) + α g ′ 1 ( u 1 , v 1 , u 1 , v 2 , u ) = 0 � �� � � �� � =0 =0 = ⇒ We can eliminate u 10

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p x 1 = u 1 + αv 1 , x 2 = u 2 + αv 2 x = u + αv f ( u 1 , v 1 , u 2 , v 2 ) = 0 10

The Zero-Join Problem ZJ-Problem Given • A polynomial f ∈ F p [ X 1 , . . . X 4 ] , deg( f ) constant p s.t. | A || B | = p 3 / 2 • Two lists A , B of points ( u i , v i ) (resp. ( u j , v j ) ) in F 2 Compute the list C of all points ( u i , v i , u j , v j ) s.t. f ( u i , v i , u j , v j ) = 0 11

The Zero-Join Problem ZJ-Problem Given • A polynomial f ∈ F p [ X 1 , . . . X 4 ] , deg( f ) constant p s.t. | A || B | = p 3 / 2 • Two lists A , B of points ( u i , v i ) (resp. ( u j , v j ) ) in F 2 Compute the list C of all points ( u i , v i , u j , v j ) s.t. f ( u i , v i , u j , v j ) = 0 How to solve this? � p 3 / 2 � • Naive algorithm O ( | A || B | ) = O • Can we do better? • Can we solve this in o ( p ) ? 11

The Zero-Join Problem ZJ-Problem Given • A polynomial f ∈ F p [ X 1 , . . . X 4 ] , deg( f ) constant p s.t. | A || B | = p 3 / 2 • Two lists A , B of points ( u i , v i ) (resp. ( u j , v j ) ) in F 2 Compute the list C of all points ( u i , v i , u j , v j ) s.t. f ( u i , v i , u j , v j ) = 0 How to solve this? � p 3 / 2 � • Naive algorithm O ( | A || B | ) = O • Can we do better? Yes! • Can we solve this in o ( p ) ? We don’t know yet... 11

Sub-quadratic algorithm for the ZJ-problem ( u i , v i ) ( u j , v j ) All ( u i , v i , u j , v j ) s.t. f ( u i , v i , u j , v j ) = 0 12

Sub-quadratic algorithm for the ZJ-problem f i = f ( u i , v i , X, Y ) ( u j , v j ) All ( f i , ( u j , v j )) s.t. f i ( u j , v j ) = 0 12

Sub-quadratic algorithm for the ZJ-problem × f i = f ( u i , v i , X, Y ) ( u j , v j ) × All ( f i , ( u j , v j )) s.t. f i ( u j , v j ) = 0 12

Sub-quadratic algorithm for the ZJ-problem × f i = f ( u i , v i , X, Y ) ( u j , v j ) All ( f i , ( u j , v j )) s.t. f i ( u j , v j ) = 0 12

Sub-quadratic algorithm for the ZJ-problem F = � i f i ∀ ( u j , v j ) s.t. F ( u j , v j ) = 0 , find f i s.t f i ( u j , v j ) = 0 12

Sub-quadratic algorithm for the ZJ-problem f i ∀ ( u j , v j ) s.t. F ( u j , v j ) = 0 , find f i s.t f i ( u j , v j ) = 0 12

Complexity analysis • Start with √ p polynomials f i ( X, Y ) and p points ( u j , v j ) 13

Complexity analysis • Start with √ p polynomials f i ( X, Y ) and p points ( u j , v j ) deg( F ) = d ≈ √ p • Compute F = � T = ˜ i f i O ( p ) 13