elliptic curve hash and sign
play

Elliptic Curve Hash (and Sign) ECOH (and the 1-up problem for ECDSA) - PowerPoint PPT Presentation

Apr 01, 2023 •620 likes •1.37k views

Elliptic Curve Hash (and Sign) ECOH (and the 1-up problem for ECDSA) Daniel R. L. Brown Certicom Research ECC 2008, Utrecht, Sep 22-24 2008 Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 1 / 43 Outline ECOH 1 Background

  1. Elliptic Curve Hash (and Sign) ECOH (and the 1-up problem for ECDSA) Daniel R. L. Brown Certicom Research ECC 2008, Utrecht, Sep 22-24 2008 Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 1 / 43

  2. Outline ECOH 1 Background Evolution Implementation CFV One-Up Problem for ECDSA 2 Conclusion 3 Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 2 / 43

  3. ECOH Elliptic Curve Only Hash Definition (High level) Pad message block M i into a point P i . � T = P i (1) i Do the same for T . Truncate to get hash H . Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 3 / 43

  4. ECOH Background Motivation: SHA-3 Wang, Feng, Lai, Yu: collision FOUND in MD5. Wang, Yin, Yu: 2 69 collision algorithm for SHA-1 Wang, Yao, Yao: 2 63 collision algorithm for SHA-1 NIST: please use SHA-2 NIST: is SHA-2 ok? NIST: SHA-3 competition, AES-style Some like to call “AHS” Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 4 / 43

  5. ECOH Background Motivation: SHA-3 Wang, Feng, Lai, Yu: collision FOUND in MD5. Wang, Yin, Yu: 2 69 collision algorithm for SHA-1 Wang, Yao, Yao: 2 63 collision algorithm for SHA-1 NIST: please use SHA-2 NIST: is SHA-2 ok? NIST: SHA-3 competition, AES-style Some like to call “AHS” Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 4 / 43

  6. ECOH Background Motivation: SHA-3 Wang, Feng, Lai, Yu: collision FOUND in MD5. Wang, Yin, Yu: 2 69 collision algorithm for SHA-1 Wang, Yao, Yao: 2 63 collision algorithm for SHA-1 NIST: please use SHA-2 NIST: is SHA-2 ok? NIST: SHA-3 competition, AES-style Some like to call “AHS” Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 4 / 43

  7. ECOH Background Motivation: SHA-3 Wang, Feng, Lai, Yu: collision FOUND in MD5. Wang, Yin, Yu: 2 69 collision algorithm for SHA-1 Wang, Yao, Yao: 2 63 collision algorithm for SHA-1 NIST: please use SHA-2 NIST: is SHA-2 ok? NIST: SHA-3 competition, AES-style Some like to call “AHS” Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 4 / 43

  8. ECOH Background Motivation: SHA-3 Wang, Feng, Lai, Yu: collision FOUND in MD5. Wang, Yin, Yu: 2 69 collision algorithm for SHA-1 Wang, Yao, Yao: 2 63 collision algorithm for SHA-1 NIST: please use SHA-2 NIST: is SHA-2 ok? NIST: SHA-3 competition, AES-style Some like to call “AHS” Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 4 / 43

  9. ECOH Background Motivation: SHA-3 Wang, Feng, Lai, Yu: collision FOUND in MD5. Wang, Yin, Yu: 2 69 collision algorithm for SHA-1 Wang, Yao, Yao: 2 63 collision algorithm for SHA-1 NIST: please use SHA-2 NIST: is SHA-2 ok? NIST: SHA-3 competition, AES-style Some like to call “AHS” Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 4 / 43

  10. ECOH Background Motivation: SHA-3 Wang, Feng, Lai, Yu: collision FOUND in MD5. Wang, Yin, Yu: 2 69 collision algorithm for SHA-1 Wang, Yao, Yao: 2 63 collision algorithm for SHA-1 NIST: please use SHA-2 NIST: is SHA-2 ok? NIST: SHA-3 competition, AES-style Some like to call “AHS” Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 4 / 43

  11. ECOH Background Discrete Log Hash: CHP Definition (Chaum, van Heijst, Pfitzmann (1991)) H ( m , n ) = mP + nQ Theorem A collision in H gives log P ( Q ) . Proof. If H ( a , b ) = H ( c , d ), then aP + bQ = cP + dQ (2) and solving log P ( Q ) = a − c d − b mod n . Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 5 / 43

  12. ECOH Background Discrete Log Hash: CHP Definition (Chaum, van Heijst, Pfitzmann (1991)) H ( m , n ) = mP + nQ Theorem A collision in H gives log P ( Q ) . Proof. If H ( a , b ) = H ( c , d ), then aP + bQ = cP + dQ (2) and solving log P ( Q ) = a − c d − b mod n . Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 5 / 43

  13. ECOH Background Discrete Log Hash: CHP Definition (Chaum, van Heijst, Pfitzmann (1991)) H ( m , n ) = mP + nQ Theorem A collision in H gives log P ( Q ) . Proof. If H ( a , b ) = H ( c , d ), then aP + bQ = cP + dQ (2) and solving log P ( Q ) = a − c d − b mod n . Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 5 / 43

  14. ECOH Background CHP Pros and Cons Provably secure assuming ECDLP hard. 3 m / 2 EC adds per 2 m bits. Compression factor 2, must be iterated. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 6 / 43

  15. ECOH Background Discrete Log Hash 2: MuHASH Definition (Bellare and Micciancio (1997)) Let P i = F ( i � M i ), where F is a “random oracle”. Let � H = P i (3) i Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 7 / 43

  16. ECOH Background MuHASH Advantages One EC add per m bits. ◮ E.g. 384 times faster than CHP. Parallelizable. Incremental: ◮ H ′ = H − P i + P ′ i Provably secure, assuming ECDLP hard and F random oracle. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 8 / 43

  17. ECOH Background MuHASH Disadvantages Assumes F is a random oracle. Insecure if F insecure. ◮ Must already have a collision-resistant F . ◮ SHA-1? SHA-2? SHA-3? Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 9 / 43

  18. ECOH Evolution ECOH’s Design Rationale Leverage from MuHASH: ◮ Speed. ◮ Parallelizability. ◮ Incrementality. Avoid reliance on pre-existing F . Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 10 / 43

  19. ECOH Evolution EECH Replace F by fixed key block cipher: � H = F ( i � M i ) (4) i Encrypted Elliptic Curve Hash (EECH) born. No collisions in F , guaranteed. Model F by ideal cipher. Rehash Bellare and Micciancio’s security proof. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 11 / 43

  20. ECOH Evolution EECH Replace F by fixed key block cipher: � H = F ( i � M i ) (4) i Encrypted Elliptic Curve Hash (EECH) born. No collisions in F , guaranteed. Model F by ideal cipher. Rehash Bellare and Micciancio’s security proof. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 11 / 43

  21. ECOH Evolution EECH Replace F by fixed key block cipher: � H = F ( i � M i ) (4) i Encrypted Elliptic Curve Hash (EECH) born. No collisions in F , guaranteed. Model F by ideal cipher. Rehash Bellare and Micciancio’s security proof. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 11 / 43

  22. ECOH Evolution EECH Replace F by fixed key block cipher: � H = F ( i � M i ) (4) i Encrypted Elliptic Curve Hash (EECH) born. No collisions in F , guaranteed. Model F by ideal cipher. Rehash Bellare and Micciancio’s security proof. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 11 / 43

  23. ECOH Evolution EECH Replace F by fixed key block cipher: � H = F ( i � M i ) (4) i Encrypted Elliptic Curve Hash (EECH) born. No collisions in F , guaranteed. Model F by ideal cipher. Rehash Bellare and Micciancio’s security proof. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 11 / 43

  24. ECOH Evolution Oops: Not 1-way Unlike MuHASH, F now invertible. If adversary knows M 1 and M 3 but not M 2 , then 2 � M 2 = F − 1 ( H ( M 1 , M 2 , M 3 ) − F (1 � M 1 ) − F (3 � M 3 )) (5) Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 12 / 43

  25. ECOH Evolution Oops: Not 1-way Unlike MuHASH, F now invertible. If adversary knows M 1 and M 3 but not M 2 , then 2 � M 2 = F − 1 ( H ( M 1 , M 2 , M 3 ) − F (1 � M 1 ) − F (3 � M 3 )) (5) Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 12 / 43

  26. ECOH Evolution Fix it up. Post-process with one-way function? ◮ Scalar multiply? ◮ EECH again? ◮ Pairing? ◮ Checksum in extra block? Seems to thwart block inversion attack. Interferes with incrementality. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 13 / 43

  27. ECOH Evolution Ouch: Not collision resistant! Let 2 � D = F − 1 ( F (1 � A ) + F (2 � B ) − F (1 � C )) (6) Probability of index 2 appearing depends its bit length. Try that many C values, until it works. Then F (1 � A ) + F (2 � B ) = F (1 � C ) + F (2 � D ) , (7) i.e. a collision H ( A , B ) = H ( C , D ). Second preimage attack! Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 14 / 43

  28. ECOH Evolution Fix it again. Pad M i , before applying F . If F random enough, inverting will not give requisite padding. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 15 / 43

  29. ECOH Evolution ECOH Now that EECH is all fixed ... just set F to the identity function. Elliptic Curve Only Hash. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 16 / 43

  30. ECOH Evolution ECOH Now that EECH is all fixed ... just set F to the identity function. Elliptic Curve Only Hash. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 16 / 43

  31. ECOH Evolution ECOH Now that EECH is all fixed ... just set F to the identity function. Elliptic Curve Only Hash. Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 16 / 43

  32. ECOH Evolution ECOH vs. EECH Purity of ECOH. No dependence on ideal cipher model. No performance cost of enciphering. ◮ ECOH is already slow enough. Is it more crazy to: ◮ encrypt with a fixed key, ◮ do nothing? Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 17 / 43

Recommend

Quick Review: Quadratic Residues Koblitzs Method We want to solve equations like: All of the

Quick Review: Quadratic Residues Koblitzs Method We want to solve equations like: All of the

Elliptic Curves Suppose F is a field and a 1 , . . . , a 6 F . Elliptic Curve Cryptography Definition 1. An elliptic curve E over a field F is a curve given by an equation: Jim Royer Y 2 + a 1 XY + a 3 Y X 3 + a 2 X 2 + a 4 X + a 6 = (1)

337 views • 5 slides
Elliptic Curve Cryptography Applications of Elliptic Curve Cryptography Elliptic Curve

Elliptic Curve Cryptography Applications of Elliptic Curve Cryptography Elliptic Curve

Cryptography Elliptic Curve Cryptography Overview of Elliptic Curve Cryptography Elliptic Curve Cryptography Applications of Elliptic Curve Cryptography Elliptic Curve Cryptography Cryptography in OpenSSL School of Engineering and

857 views • 17 slides
Hyper-and-elliptic-curve cryptography (which is not the same as: hyperelliptic-curve

Hyper-and-elliptic-curve cryptography (which is not the same as: hyperelliptic-curve

Hyper-and-elliptic-curve cryptography (which is not the same as: hyperelliptic-curve cryptography and elliptic-curve cryptography) Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Tanja Lange

318 views • 29 slides
Hyper-and-elliptic-curve cryptography (which is not the same as: hyperelliptic-curve

Hyper-and-elliptic-curve cryptography (which is not the same as: hyperelliptic-curve

Hyper-and-elliptic-curve cryptography (which is not the same as: hyperelliptic-curve cryptography and elliptic-curve cryptography) Daniel J. Bernstein Through our inefficient use of University of Illinois at Chicago & energy (gas

1.07k views • 76 slides
Motivation Given an elliptic curve E over a finite field F q . Is the Discrete Logarithm Problem

Motivation Given an elliptic curve E over a finite field F q . Is the Discrete Logarithm Problem

Counting points on elliptic curves over F q Christiane Peters DIAMANT-Summer School on Elliptic and Hyperelliptic Curve Cryptography September 17, 2008 Motivation Given an elliptic curve E over a finite field F q . Is the Discrete Logarithm

587 views • 30 slides
Elliptic Curves over the Rational Mordells Theorem Numbers Q An elliptic curve is a

Elliptic Curves over the Rational Mordells Theorem Numbers Q An elliptic curve is a

Elliptic Curves over the Rational Mordells Theorem Numbers Q An elliptic curve is a nonsingular plane cu- Theorem (Mordell). The group E ( Q ) of rational points on an bic curve with a rational point (possibly at elliptic curve is a

402 views • 7 slides
The AGM- X 0 ( N ) Algorithm Heegner point lifting with application to elliptic curve point

The AGM- X 0 ( N ) Algorithm Heegner point lifting with application to elliptic curve point

The AGM- X 0 ( N ) Algorithm Heegner point lifting with application to elliptic curve point counting David R. Kohel School of Mathematics and Statistics University of Sydney I Elliptic Curves in Cryptography An elliptic curve E/ F p r for

415 views • 18 slides
Elliptic Curve Cryptography Meghana Doddapaneni University of Maryland 5 December 2018

Elliptic Curve Cryptography Meghana Doddapaneni University of Maryland 5 December 2018

Elliptic Curve Cryptography Meghana Doddapaneni University of Maryland 5 December 2018 Introduction y 2 = x 3 + ax + b en.wikipedia.org/wiki/Elliptic curve Elliptic Curve Addition P = ( x p .y p ), Q = ( x q , y q ), R = ( x r .y r ) =

187 views • 16 slides
Elliptic Curves over Q Peter Birkner Technische Universiteit Eindhoven DIAMANT Summer School on

Elliptic Curves over Q Peter Birkner Technische Universiteit Eindhoven DIAMANT Summer School on

Elliptic Curves over Q Peter Birkner Technische Universiteit Eindhoven DIAMANT Summer School on Elliptic and Hyperelliptic Curve Cryptography 16 September 2008 What is an elliptic curve? (1) An elliptic curve E over a field k in Weierstra

298 views • 25 slides
Elliptic-curve cryptography Tanja Lange Technische Univesiteit Eindhoven The Netherlands July

Elliptic-curve cryptography Tanja Lange Technische Univesiteit Eindhoven The Netherlands July

Elliptic-curve cryptography Tanja Lange Technische Univesiteit Eindhoven The Netherlands July 23, 2014 1 / 12 Elliptic-curve cryptography: signatures and key exchange Given: some elliptic curve E , point P on E of known order . Key

885 views • 16 slides
Efficient Finite Field and Elliptic Curve Arithmetic Laurent Imbert CNRS, LIRMM, Universit e

Efficient Finite Field and Elliptic Curve Arithmetic Laurent Imbert CNRS, LIRMM, Universit e

Efficient Finite Field and Elliptic Curve Arithmetic Laurent Imbert CNRS, LIRMM, Universit e Montpellier 2 Summer School ECC 2011 Nancy, September 12-16, 2011 Part 2 Elliptic curve arithmetic 1/41 The two facets of an elliptic curve

606 views • 42 slides
Further Reading A. H. Koblitz, N. Koblitz, A. Menezes, Elliptic curve cryptography: The

Further Reading A. H. Koblitz, N. Koblitz, A. Menezes, Elliptic curve cryptography: The

Twenty-Three Years of Elliptic Curve Cryptography Alfred Menezes University of Waterloo September 3 2008 1 Further Reading A. H. Koblitz, N. Koblitz, A. Menezes, Elliptic curve cryptography: The serpentine course of a paradigm

300 views • 18 slides
Next-generation elliptic-curve cryptography (ECC) Daniel J. Bernstein Cryptographic

Next-generation elliptic-curve cryptography (ECC) Daniel J. Bernstein Cryptographic

Next-generation elliptic-curve cryptography (ECC) Daniel J. Bernstein Cryptographic Implementations group: eindhoven.cr.yp.to working closely with the Coding Theory and Cryptology group: www.win.tue.nl/cc/ Next-generation elliptic-curve

456 views • 18 slides
Elliptic Curve Cryptography An Introduction Dr. F . Vercauteren Katholieke Universiteit Leuven

Elliptic Curve Cryptography An Introduction Dr. F . Vercauteren Katholieke Universiteit Leuven

Cryptography Elliptic Curves EC Cryptographic Primitives Pairings Elliptic Curve Cryptography An Introduction Dr. F . Vercauteren Katholieke Universiteit Leuven 22 April 2008 Dr. F. Vercauteren Elliptic Curve Cryptography An Introduction

491 views • 32 slides
A Brief Introduction to Elliptic Curve Cryptography Or: A headache in 15 minutes Don Owen March

A Brief Introduction to Elliptic Curve Cryptography Or: A headache in 15 minutes Don Owen March

A Brief Introduction to Elliptic Curve Cryptography A Brief Introduction to Elliptic Curve Cryptography Or: A headache in 15 minutes Don Owen March 21 st , 2016 1/13 A Brief Introduction to Elliptic Curve Cryptography Elliptic Curve 2/13 A

385 views • 13 slides
elliptic curve cryptography Craig Costello Summer School on Real-World Crypto and Privacy June

elliptic curve cryptography Craig Costello Summer School on Real-World Crypto and Privacy June

A gentle introduction to elliptic curve cryptography Craig Costello Summer School on Real-World Crypto and Privacy June 11, 2018 ibenik , Croatia Part 1: Motivation Part 2: Elliptic Curves Part 3: Elliptic Curve Cryptography Part 4:

1.38k views • 48 slides
Efficient arithmetic on elliptic curves in large characteristic D. J. Bernstein University of

Efficient arithmetic on elliptic curves in large characteristic D. J. Bernstein University of

Efficient arithmetic on elliptic curves in large characteristic D. J. Bernstein University of Illinois at Chicago Fix a field and an elliptic curve. e.g. NIST P-224: the elliptic curve a 6 over Z =p . y 2 = x 3 3 x + p = 2 224 2 96 + 1

417 views • 23 slides
The elliptic-curve zoo D. J. Bernstein University of Illinois at Chicago EC point counting 1983

The elliptic-curve zoo D. J. Bernstein University of Illinois at Chicago EC point counting 1983

The elliptic-curve zoo D. J. Bernstein University of Illinois at Chicago EC point counting 1983 (published 1985) Schoof: Algorithm to count points on elliptic curves over finite fields. Input: prime power q ; F q such that 6(4

784 views • 47 slides
Elliptic Curve Primality Proving Jared Asuncion PhD Away Days Bordeaux-Luxembourg 19 October

Elliptic Curve Primality Proving Jared Asuncion PhD Away Days Bordeaux-Luxembourg 19 October

Elliptic Curve Primality Proving Jared Asuncion PhD Away Days Bordeaux-Luxembourg 19 October 2019 Jared Asuncion https://shorturl.at/krtxD PhD Away Days 1 / 11 Definition An elliptic curve over k ( char k = 2 , 3 ) is a smooth projective

596 views • 38 slides
Elliptic Curve Cryptography and Security of Embedded Devices Ph.D. Defense Vincent Verneuil

Elliptic Curve Cryptography and Security of Embedded Devices Ph.D. Defense Vincent Verneuil

Elliptic Curve Cryptography and Security of Embedded Devices Ph.D. Defense Vincent Verneuil Institut de Math ematiques de Bordeaux Inside Secure June 13th, 2012 V. Verneuil - Elliptic Curve Cryptography and Security of Embedded Devices 1

1.72k views • 143 slides
Elliptic Curve Cryptography: Invention and Impact: The invasion of the Number Theorists Victor S.

Elliptic Curve Cryptography: Invention and Impact: The invasion of the Number Theorists Victor S.

Elliptic Curve Cryptography: Invention and Impact: The invasion of the Number Theorists Victor S. Miller IDA Center for Communications Research Princeton, NJ 08540 USA 24 May, 2007 Victor S. Miller (CCR) Elliptic Curve Cryptography 24 May,

1.08k views • 69 slides
Bitcoin II & Introduction to Elliptic Curve Cryptography Sep. 11, 2019 Overview

Bitcoin II & Introduction to Elliptic Curve Cryptography Sep. 11, 2019 Overview

Bitcoin II & Introduction to Elliptic Curve Cryptography Sep. 11, 2019 Overview Bitcoin Transactions Elliptic Curve Cryptography Introduction Arithmetics Signature Bitcoin, the protocol A blockchain Each

992 views • 52 slides
Introduction to Elliptic Curve Cryptography Rana Barua Indian Statistical Institute Kolkata May

Introduction to Elliptic Curve Cryptography Rana Barua Indian Statistical Institute Kolkata May

Introduction to Elliptic Curve Cryptography Rana Barua Indian Statistical Institute Kolkata May 19, 2017 university-logo-isi Rana Barua Introduction to Elliptic Curve Cryptography ElGamal Public Key Cryptosystem, 1984 Key Generation: Choose

417 views • 16 slides
Exploiting dummy codes in Elliptic Curve Cryptography Andy Russon 4 June 2020 2/20 About me

Exploiting dummy codes in Elliptic Curve Cryptography Andy Russon 4 June 2020 2/20 About me

Exploiting dummy codes in Elliptic Curve Cryptography Andy Russon 4 June 2020 2/20 About me PhD thesis on elliptic curves Orange, and Universit de Rennes 1 Risk assessment and audit Interest: challenges (root-me, CryptoHack), korean

1.15k views • 54 slides

More recommend