Can we Beat the Square Root Bound for ECDLP over F p 2 via - PowerPoint PPT Presentation

Can we Beat the Square Root Bound for ECDLP over F p 2 via Representation? NutMiC 2019 , Paris Claire Delaplace Alexander May

Elliptic Curve O y 4 K : Field of characteristic � = 2 , 3 E : y 2 = f ( x ) = x 3 + ax + b 2 x − 2 2 4 − 2 − 4 2

Elliptic Curve O y 4 K : Field of characteristic � = 2 , 3 E : y 2 = f ( x ) = x 3 + ax + b 2 x − 2 2 4 ( E ( K ) , +) : Abelian group − 2 P = ( x, y ) Q = ( x ′ , y ′ ) − 4 Group Law • 2 P = ( x d , y d ) • P + Q = ( x s , y s ) � y − y ′ � 3 x 2 + a � 2 � 2 x d = − 2 x x s = − x − x ′ 2 y x − x ′ y d = y + 3 x 2 + a y s = y + y − y ′ x − x ′ ( x s − x ) ( x d − x ) 2 y 2

Elliptic Curve Discrete Logarithm Problem F q : Finite field with q elements Order of a point The order r of a point P ∈ E ( F q ) is the smallest integer > 0 s.t. rP = O ECDLP Given P, Q ∈ E ( F q ) s.t. P of order r = O ( q ) , Q ∈ � P � Find k ∈ N such that kP = Q . 3

Elliptic Curve Discrete Logarithm Problem F p 2 : Finite field with p 2 elements Order of a point The order r of a point P ∈ E ( F p 2 ) is the smallest integer > 0 s.t. rP = O p 2 -ECDLP � p 2 � Given P, Q ∈ E ( F p 2 ) s.t. P of order r = O , Q ∈ � P � Find k ∈ N such that kP = Q . This paper : F p 2 , p prime. 3

Overview Previous algorithms �� � • Pollard Rho: T = ˜ = ˜ O p 2 O ( p ) � � • [Gaudry09]: T = ˜ p 2 − 2 = ˜ O O ( p ) 2 4

Overview Previous algorithms �� � • Pollard Rho: T = ˜ = ˜ O p 2 O ( p ) � � • [Gaudry09]: T = ˜ p 2 − 2 = ˜ O O ( p ) 2 Question Is there an algorithm for p 2 -ECDLP with runtime o ( p ) ? 4

Overview Previous algorithms �� � • Pollard Rho: T = ˜ = ˜ O p 2 O ( p ) � � • [Gaudry09]: T = ˜ p 2 − 2 = ˜ O O ( p ) 2 Question Is there an algorithm for p 2 -ECDLP with runtime o ( p ) ? Our work... � p 1 . 314 � • gives a new algorithm with runtime T = O • may lead to a o ( p ) algorithm if improved 4

Core Idea: Representation Technique • Introduced by [H-GJ10] for the subset-sum problem • In our case : k can be decomposed as k = k 1 + k 2 log( p ) log( p ) log( p ) 2 2 k 1 = In base 2 k 2 = in ≈ p different ways 5

Core Idea: Representation Technique • Introduced by [H-GJ10] for the subset-sum problem • In our case : k can be decomposed as k = k 1 + k 2 log( p ) log( p ) log( p ) 2 2 k 1 = In base 2 k 2 = in ≈ p different ways Find a needle in a haystack ֒ → Find any needle among p 5

Core Idea: Representation Technique • Introduced by [H-GJ10] for the subset-sum problem • In our case : k can be decomposed as k = k 1 + k 2 log( p ) log( p ) log( p ) 2 2 k 1 = In base 2 k 2 = in ≈ p different ways Find a needle in a haystack ֒ → Find any needle among p 5

General Idea k 1 = k 2 = 3 3 k 1 P Q − k 2 P ≈ p ≈ p 2 2 L L ′ p representations k 1 P = Q − k 2 P = ⇒ k = k 1 + k 2 6

General Idea k 1 = k 2 = 1 1 Q − k 2 P k 1 P ≈ p ≈ p 2 2 L L ′ 1 representation k 1 P = Q − k 2 P = ⇒ k = k 1 + k 2 6

General Idea k 1 = k 2 = 1 1 Q − k 2 P k 1 P ≈ p ≈ p 2 2 L L ′ 1 representation k 1 P = Q − k 2 P = ⇒ k = k 1 + k 2 ∀ ( x, y ) ∈ L (resp. L ′ ) x ∈ F p 6

How to Proceed Splitting k 1 and k 2 k 1 = k 11 + k 12 k 2 = k 21 + k 22 log( p ) log( p ) k 11 = k 21 = k 12 = k 22 = 1 1 4 log p 4 log p 7

How to Proceed Splitting k 1 and k 2 k 1 = k 11 + k 12 k 2 = k 21 + k 22 log( p ) log( p ) k 11 = k 21 = k 12 = k 22 = 1 1 4 log p 4 log p • L : list of all P 1 = ( k 11 + k 12 ) P = ( x, y ) , x ∈ F p • L ′ : list of all P 2 = Q − ( k 21 + k 22 ) P = ( x ′ , y ′ ) , x ′ ∈ F p 7

A 4 -List Algorithm k 11 = k 12 = k 21 = k 22 = k 11 P k 12 P Q − k 21 P − k 22 P 8

A 4 -List Algorithm k 11 = k 12 = k 21 = k 22 = 3 3 3 3 k 11 P k 12 P Q − k 21 P − k 22 P p p p p 4 4 4 4 3 T ≈ p 4 8

A 4 -List Algorithm k 11 = k 12 = k 21 = k 22 = k 11 P k 12 P Q − k 21 P − k 22 P Join Join ( x, y ) ( x ′ , y ′ ) x ′ ∈ F p x ∈ F p 3 4 + T Join T ≈ p 8

A 4 -List Algorithm k 11 = k 12 = k 21 = k 22 = k 11 P k 12 P Q − k 21 P − k 22 P Join Join ( x, y ) ( x ′ , y ′ ) x ′ ∈ F p x ∈ F p T ≈ T Join 8

A 4 -List Algorithm k 11 = k 12 = k 21 = k 22 = k 11 P k 12 P Q − k 21 P − k 22 P Join Join ( x, y ) ( x ′ , y ′ ) 1 1 p x ′ ∈ F p p 2 2 x ∈ F p ( k 11 + k 12 ) P = Q − ( k 21 + k 22 ) P 1 T ≈ T Join + p 2 8

A 4 -List Algorithm k 11 = k 12 = k 21 = k 22 = k 11 P k 12 P Q − k 21 P − k 22 P Join Join ( x, y ) ( x ′ , y ′ ) x ′ ∈ F p x ∈ F p ( k 11 + k 12 ) P = Q − ( k 21 + k 22 ) P T ≈ T Join 8

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p 9

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p Group law : ( x 1 − x 2 ) 2 ( x 1 + x 2 + x ) − y 2 1 − y 2 2 = − 2 y 1 y 2 9

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p Group law : ( x 1 − x 2 ) 2 ( x 1 + x 2 + x ) − y 2 1 − y 2 2 = − 2 y 1 y 2 9

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p Weierstraß : (( x 1 − x 2 ) 2 ( x 1 + x 2 + x ) − f ( x 1 ) 2 − f ( x 2 ) 2 ) 2 − 4 f ( x 1 ) f ( x 2 ) = 0 9

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p x 1 = u 1 + αv 1 , x 2 = u 2 + αv 2 x = u + αv Weierstraß : (( x 1 − x 2 ) 2 ( x 1 + x 2 + x ) − f ( x 1 ) 2 − f ( x 2 ) 2 ) 2 +4 f ( x 1 ) f ( x 2 ) = 0 9

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p x 1 = u 1 + αv 1 , x 2 = u 2 + αv 2 x = u + αv g 0 ( u 1 , v 1 , u 2 , v 2 , u, v ) + α g 1 ( u 1 , v 1 , u 2 , v 2 , u, v ) = 0 9

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p x 1 = u 1 + αv 1 , x 2 = u 2 + αv 2 x = u + αv g 0 ( u 1 , v 1 , u 2 , v 2 , u, 0) + α g 1 ( u 1 , v 1 , u 2 , v 2 , u, 0) = 0 9

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p x 1 = u 1 + αv 1 , x 2 = u 2 + αv 2 x = u + αv g ′ 0 ( u 1 , v 1 , u 2 , v 2 , u ) + α g ′ 1 ( u 1 , v 1 , u 2 , v 2 , u ) = 0 9

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p x 1 = u 1 + αv 1 , x 2 = u 2 + αv 2 x = u + αv g ′ 0 ( u 1 , v 1 , u 2 , v 2 , u ) + α g ′ 1 ( u 1 , v 2 , u 1 , v 2 , u ) = 0 � �� � � �� � =0 =0 = ⇒ We can eliminate u 9

Computing the Join P 1 = ( x 1 , y 1 ) , P 2 = ( x 2 , y 2 ) Check if ( x, y ) = P 1 + P 2 satisfy x ∈ F p x 1 = u 1 + αv 1 , x 2 = u 2 + αv 2 x = u + αv f ( u 1 , v 1 , u 2 , v 2 ) = 0 9

The Zero-Join Problem ZJ-Problem Given • A polynomial f ∈ F p [ X 1 , . . . X 4 ] , deg( f ) constant p s.t. | A || B | = p 3 / 2 • Two lists A , B of points ( u i , v i ) (resp. ( u j , v j ) ) in F 2 Compute the list C of all points ( u i , v i , u j , v j ) s.t. f ( u i , v i , u j , v j ) = 0 10

The Zero-Join Problem ZJ-Problem Given • A polynomial f ∈ F p [ X 1 , . . . X 4 ] , deg( f ) constant p s.t. | A || B | = p 3 / 2 • Two lists A , B of points ( u i , v i ) (resp. ( u j , v j ) ) in F 2 Compute the list C of all points ( u i , v i , u j , v j ) s.t. f ( u i , v i , u j , v j ) = 0 How to solve this? � p 3 / 2 � • Naive algorithm O ( | A || B | ) = O • Can we do better? • Can we solve this in o ( p ) ? 10

The Zero-Join Problem ZJ-Problem Given • A polynomial f ∈ F p [ X 1 , . . . X 4 ] , deg( f ) constant p s.t. | A || B | = p 3 / 2 • Two lists A , B of points ( u i , v i ) (resp. ( u j , v j ) ) in F 2 Compute the list C of all points ( u i , v i , u j , v j ) s.t. f ( u i , v i , u j , v j ) = 0 How to solve this? � p 3 / 2 � • Naive algorithm O ( | A || B | ) = O • Can we do better? Yes! • Can we solve this in o ( p ) ? We don’t know yet... 10

Sub-quadratic algorithm for the ZJ-problem ( u i , v i ) ( u j , v j ) All ( u i , v i , u j , v j ) s.t. f ( u i , v i , u j , v j ) = 0 11

Sub-quadratic algorithm for the ZJ-problem f i = f ( u i , v i , X, Y ) ( u j , v j ) All ( f i , ( u j , v j )) s.t. f i ( u j , v j ) = 0 11

Sub-quadratic algorithm for the ZJ-problem × f i = f ( u i , v i , X, Y ) ( u j , v j ) × All ( f i , ( u j , v j )) s.t. f i ( u j , v j ) = 0 11

Sub-quadratic algorithm for the ZJ-problem × f i = f ( u i , v i , X, Y ) ( u j , v j ) All ( f i , ( u j , v j )) s.t. f i ( u j , v j ) = 0 11

Sub-quadratic algorithm for the ZJ-problem F = � i f i ∀ ( u j , v j ) s.t. F ( u j , v j ) = 0 , find f i s.t f i ( u j , v j ) = 0 11

Sub-quadratic algorithm for the ZJ-problem f i ∀ ( u j , v j ) s.t. F ( u j , v j ) = 0 , find f i s.t f i ( u j , v j ) = 0 11

Complexity analysis • Start with √ p polynomials f i ( X, Y ) and p points ( u j , v j ) 12

Complexity analysis • Start with √ p polynomials f i ( X, Y ) and p points ( u j , v j ) • Compute F = � T = ˜ i f i O ( p ) 12