ECC optimization on Sandy Bridge The cost of cofactor h = 1 Daan - PowerPoint PPT Presentation

ECC optimization on Sandy Bridge The cost of cofactor h = 1 Daan Sprenkels hello@dsprenkels.com Radboud University Nijmegen 1 April 2019 Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 1 / 30

Outline Introduction Preliminaries Cofactor security ECC implementation Results Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 2 / 30

Outline Introduction Preliminaries Cofactor security ECC implementation Results Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 2 / 30

Elliptic curves E : y 2 = x 3 + ax + b Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 3 / 30

Elliptic curves E : y 2 = x 3 + ax + b 4 2 0 y − 2 − 4 − 4 − 2 0 2 4 x Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 3 / 30

Elliptic curves: addition E : y 2 = x 3 + ax + b 4 − R Q 2 P 0 y − 2 R − 4 − 4 − 2 0 2 4 x Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 3 / 30

Elliptic curves: doubling E : y 2 = x 3 + ax + b 4 − R P 2 0 y − 2 R − 4 − 4 − 2 0 2 4 x Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 3 / 30

Elliptic curves ◮ Coordinates include the point at infinity O ◮ Define P + O = P Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 4 / 30

Elliptic curves ◮ Coordinates include the point at infinity O ◮ Define P + O = P ◮ Curve equation: E : y 2 = x 3 + ax + b Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 4 / 30

Elliptic curves ◮ Coordinates include the point at infinity O ◮ Define P + O = P ◮ Curve equation: E : y 2 = x 3 + ax + b ◮ Coordinates are defined over a field F q ◮ I.e. integers modulo q Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 4 / 30

Elliptic curves: actually E : y 2 = x 3 − 3 x + 1 defined over F 11 5 4 3 2 1 0 y − 1 − 2 − 3 − 4 − 5 0 1 2 3 4 5 6 7 8 9 10 11 x Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 5 / 30

Elliptic curves: actual addition E : y 2 = x 3 − 3 x + 1 defined over F 11 5 R 4 3 Q 2 1 0 y − 1 P − 2 − 3 − 4 − R − 5 0 1 2 3 4 5 6 7 8 9 10 11 x Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 5 / 30

Group arithmetic ◮ We can do arithmetic with these rules! :) ◮ Addition: P + Q ◮ Subtraction: P − Q ◮ Neutral element: O , i.e. “zero” Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 6 / 30

Group arithmetic ◮ We can do arithmetic with these rules! :) ◮ Addition: P + Q ◮ Subtraction: P − Q ◮ Neutral element: O , i.e. “zero” ◮ Scalar multiplication: [ k ] P = P + P + ... + P � �� � k times Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 6 / 30

Group arithmetic ◮ We can do arithmetic with these rules! :) ◮ Addition: P + Q ◮ Subtraction: P − Q ◮ Neutral element: O , i.e. “zero” ◮ Scalar multiplication: [ k ] P = P + P + ... + P � �� � k times ◮ Discrete log problem: given P , Q where [ k ] P = Q , hard to find k Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 6 / 30

Elliptic curves are cyclic ◮ Points form a cycle: O + P + P + P + P → ... + P + P − − → P − − → [2] P − − → [3] P − − − − → [ n − 1] P − − → O Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 7 / 30

Elliptic curves are cyclic ◮ Points form a cycle: O + P + P + P + P → ... + P + P − − → P − − → [2] P − − → [3] P − − − − → [ n − 1] P − − → O � �� � n steps ◮ The order n should contain a large prime factor ◮ Only one cycle if n is prime Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 7 / 30

Cofactors ◮ If n is not a prime Then n = h · ℓ ◮ I.e. small loops are possible: + T 4 + T 4 + T 4 + T 4 E.g. if 4 | n , then there is a point T 4 : O − − → T 4 − − → [2] T 4 − − → [3] T 4 − − → O � �� � only 4 steps! Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 8 / 30

Cofactors ◮ If n is not a prime Then n = h · ℓ ◮ I.e. small loops are possible: + T 4 + T 4 + T 4 + T 4 E.g. if 4 | n , then there is a point T 4 : O − − → T 4 − − → [2] T 4 − − → [3] T 4 − − → O � �� � only 4 steps! ◮ h is called the cofactor Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 8 / 30

Cofactors ◮ If n is not a prime Then n = h · ℓ ◮ I.e. small loops are possible: + T 4 + T 4 + T 4 + T 4 E.g. if 4 | n , then there is a point T 4 : O − − → T 4 − − → [2] T 4 − − → [3] T 4 − − → O � �� � only 4 steps! ◮ h is called the cofactor ◮ This property is often harmless Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 8 / 30

Cofactors ◮ If n is not a prime Then n = h · ℓ ◮ I.e. small loops are possible: + T 4 + T 4 + T 4 + T 4 E.g. if 4 | n , then there is a point T 4 : O − − → T 4 − − → [2] T 4 − − → [3] T 4 − − → O � �� � only 4 steps! ◮ h is called the cofactor ◮ This property is often harmless ◮ I.e. sometimes it’s the opposite of harmless Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 8 / 30

A brief history... ◮ 1999: elliptic curves popularized Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 9 / 30

A brief history... ◮ 1999: elliptic curves popularized ◮ 2006: Curve25519 published by Bernstein ◮ “Safe” for implementors Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 9 / 30

A brief history... ◮ 1999: elliptic curves popularized ◮ 2006: Curve25519 published by Bernstein ◮ “Safe” for implementors ◮ Super fast Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 9 / 30

A brief history... ◮ 1999: elliptic curves popularized ◮ 2006: Curve25519 published by Bernstein ◮ “Safe” for implementors ◮ Super fast ◮ Has cofactor h = 8 Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 9 / 30

A brief history... ◮ 1999: elliptic curves popularized ◮ 2006: Curve25519 published by Bernstein ◮ “Safe” for implementors ◮ Super fast ◮ Has cofactor h = 8 ◮ 2014: Monero cryptocurrency ◮ Uses Curve25519 Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 9 / 30

A brief history... ◮ 1999: elliptic curves popularized ◮ 2006: Curve25519 published by Bernstein ◮ “Safe” for implementors ◮ Super fast ◮ Has cofactor h = 8 ◮ 2014: Monero cryptocurrency ◮ Uses Curve25519 ◮ 2017: vulnerability in Monero found ◮ Allowed anyone to create coins out of thin air Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 9 / 30

The Monero vulnerability ◮ Transaction involves a ring signature Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 10 / 30

The Monero vulnerability ◮ Transaction involves a ring signature ◮ Double-spending is prevented by a key image I Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 10 / 30

The Monero vulnerability ◮ Transaction involves a ring signature ◮ Double-spending is prevented by a key image I ◮ I binds the transaction to signer’s public key P Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 10 / 30

The Monero vulnerability ◮ Transaction involves a ring signature ◮ Double-spending is prevented by a key image I ◮ I binds the transaction to signer’s public key P ◮ Binding is in zero-knowledge Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 10 / 30

The Monero vulnerability ◮ Transaction involves a ring signature ◮ Double-spending is prevented by a key image I ◮ I binds the transaction to signer’s public key P ◮ Binding is in zero-knowledge ◮ Key image I should be unique Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 10 / 30

Monero transactions ◮ Have generators G 1 , G 2 ; private key x ; public key P ; key image I . ◮ sign x ( m ) ◮ Sign m with private key x ◮ Choose commitment u ∈ R h Z ℓ ◮ Compute a 2 = [ u ] G 2 ; c = H ( m , a 1 , a 2 ); r = u + cx ◮ Output signature s = ( a 1 , a 2 , r ) Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 11 / 30

Monero transactions ◮ Have generators G 1 , G 2 ; private key x ; public key P ; key image I . ◮ sign x ( m ) ◮ Sign m with private key x ◮ Choose commitment u ∈ R h Z ℓ ◮ Compute a 2 = [ u ] G 2 ; c = H ( m , a 1 , a 2 ); r = u + cx ◮ Output signature s = ( a 1 , a 2 , r ) ◮ verify P , I ( m , s ) ? ◮ [ r ] G 1 = a 1 + [ c ] P ? ◮ [ r ] G 2 = a 2 + [ c ] I ◮ I unique? Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 11 / 30

Attacking Monero signatures ◮ Challenge. Find some signature+keypair a 2 , c , r , and I , s.t. [ r ] G 2 = a 2 + [ c ] I = a 2 + [ c ] I ′ , where I � = I ′ . Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 12 / 30

Attacking Monero signatures ◮ Challenge. Find some signature+keypair a 2 , c , r , and I , s.t. [ r ] G 2 = a 2 + [ c ] I = a 2 + [ c ] I ′ , where I � = I ′ . ◮ Solution. Choose I ′ = I + T α , where α | c and [ α ] T α = O . Daan Sprenkels ECC optimization on Sandy Bridge 1 April 2019 12 / 30