Generic attacks The discrete-logarithm problem and index calculus - PowerPoint PPT Presentation

Generic attacks The discrete-logarithm problem and index calculus Define ♣ = 1000003. D. J. Bernstein Easy to prove: ♣ is prime. University of Illinois at Chicago Can we find an integer ♥ ✷ ❢ 1 ❀ 2 ❀ 3 ❀ ✿ ✿ ✿ ❀ ♣ � 1 ❣ such that 5 ♥ mod ♣ = 262682? Easy to prove: ♥ ✼✦ 5 ♥ mod ♣ permutes ❢ 1 ❀ 2 ❀ 3 ❀ ✿ ✿ ✿ ❀ ♣ � 1 ❣ . So there exists an ♥ such that 5 ♥ mod ♣ = 262682. Could find ♥ by brute force. Is there a faster way?

Generic attacks The discrete-logarithm problem Typical cryptanalytic index calculus Define ♣ = 1000003. Imagine ♣ Bernstein Easy to prove: ♣ is prime. in the Diffie-Hellman University of Illinois at Chicago Can we find an integer User cho ♥ ♥ ♥ ✷ ❢ 1 ❀ 2 ❀ 3 ❀ ✿ ✿ ✿ ❀ ♣ � 1 ❣ publishes ♣ such that 5 ♥ mod ♣ = 262682? Can attack Easy to prove: ♥ ✼✦ 5 ♥ mod ♣ the discrete- ♥ permutes ❢ 1 ❀ 2 ❀ 3 ❀ ✿ ✿ ✿ ❀ ♣ � 1 ❣ . Given public ♣ So there exists an ♥ quickly find ♥ such that 5 ♥ mod ♣ = 262682. (Warning: Could find ♥ by brute force. to attack Is there a faster way? Maybe there

The discrete-logarithm problem Typical cryptanalytic calculus Define ♣ = 1000003. Imagine standard ♣ Easy to prove: ♣ is prime. in the Diffie-Hellman Illinois at Chicago Can we find an integer User chooses secret ♥ publishes 5 ♥ mod ♣ ♥ ✷ ❢ 1 ❀ 2 ❀ 3 ❀ ✿ ✿ ✿ ❀ ♣ � 1 ❣ such that 5 ♥ mod ♣ = 262682? Can attacker quickly Easy to prove: ♥ ✼✦ 5 ♥ mod ♣ the discrete-logarithm Given public key 5 ♥ permutes ❢ 1 ❀ 2 ❀ 3 ❀ ✿ ✿ ✿ ❀ ♣ � 1 ❣ . ♣ So there exists an ♥ quickly find secret ♥ such that 5 ♥ mod ♣ = 262682. (Warning: This is Could find ♥ by brute force. to attack the proto Is there a faster way? Maybe there are b

The discrete-logarithm problem Typical cryptanalytic application: Define ♣ = 1000003. Imagine standard ♣ = 1000003 Easy to prove: ♣ is prime. in the Diffie-Hellman protocol. Chicago Can we find an integer User chooses secret key ♥ , publishes 5 ♥ mod ♣ = 262682. ♥ ✷ ❢ 1 ❀ 2 ❀ 3 ❀ ✿ ✿ ✿ ❀ ♣ � 1 ❣ such that 5 ♥ mod ♣ = 262682? Can attacker quickly solve Easy to prove: ♥ ✼✦ 5 ♥ mod ♣ the discrete-logarithm problem? Given public key 5 ♥ mod ♣ , permutes ❢ 1 ❀ 2 ❀ 3 ❀ ✿ ✿ ✿ ❀ ♣ � 1 ❣ . So there exists an ♥ quickly find secret key ♥ ? such that 5 ♥ mod ♣ = 262682. (Warning: This is one way Could find ♥ by brute force. to attack the protocol. Is there a faster way? Maybe there are better ways.)

The discrete-logarithm problem Typical cryptanalytic application: Define ♣ = 1000003. Imagine standard ♣ = 1000003 Easy to prove: ♣ is prime. in the Diffie-Hellman protocol. Can we find an integer User chooses secret key ♥ , publishes 5 ♥ mod ♣ = 262682. ♥ ✷ ❢ 1 ❀ 2 ❀ 3 ❀ ✿ ✿ ✿ ❀ ♣ � 1 ❣ such that 5 ♥ mod ♣ = 262682? Can attacker quickly solve Easy to prove: ♥ ✼✦ 5 ♥ mod ♣ the discrete-logarithm problem? Given public key 5 ♥ mod ♣ , permutes ❢ 1 ❀ 2 ❀ 3 ❀ ✿ ✿ ✿ ❀ ♣ � 1 ❣ . So there exists an ♥ quickly find secret key ♥ ? such that 5 ♥ mod ♣ = 262682. (Warning: This is one way Could find ♥ by brute force. to attack the protocol. Is there a faster way? Maybe there are better ways.)

discrete-logarithm problem Typical cryptanalytic application: Relations ♣ = 1000003. Imagine standard ♣ = 1000003 1. Some to prove: ♣ is prime. in the Diffie-Hellman protocol. to elliptic-curve Use in evaluating e find an integer User chooses secret key ♥ , security publishes 5 ♥ mod ♣ = 262682. ♥ ✷ ❢ ❀ 2 ❀ 3 ❀ ✿ ✿ ✿ ❀ ♣ � 1 ❣ that 5 ♥ mod ♣ = 262682? 2. Some Can attacker quickly solve Use in evaluating to prove: ♥ ✼✦ 5 ♥ mod ♣ the discrete-logarithm problem? advantages Given public key 5 ♥ mod ♣ , ermutes ❢ 1 ❀ 2 ❀ 3 ❀ ✿ ✿ ✿ ❀ ♣ � 1 ❣ . compared there exists an ♥ quickly find secret key ♥ ? that 5 ♥ mod ♣ = 262682. 3. Tricky: (Warning: This is one way extra applications find ♥ by brute force. to attack the protocol. See Tanja there a faster way? Maybe there are better ways.) on Weil

discrete-logarithm problem Typical cryptanalytic application: Relations to ECC: ♣ 1000003. Imagine standard ♣ = 1000003 1. Some DL techniques ♣ is prime. in the Diffie-Hellman protocol. to elliptic-curve DL Use in evaluating integer User chooses secret key ♥ , security of an elliptic publishes 5 ♥ mod ♣ = 262682. ♥ ✷ ❢ ❀ ❀ ❀ ✿ ✿ ✿ ❀ ♣ � 1 ❣ ♥ d ♣ = 262682? 2. Some techniques Can attacker quickly solve Use in evaluating ♥ ✼✦ 5 ♥ mod ♣ the discrete-logarithm problem? advantages of elliptic Given public key 5 ♥ mod ♣ , ❢ ❀ ❀ ❀ ✿ ✿ ✿ ❀ ♣ � 1 ❣ . compared to multiplication. an ♥ quickly find secret key ♥ ? ♥ d ♣ = 262682. 3. Tricky: Some techniques (Warning: This is one way extra applications ♥ brute force. to attack the protocol. See Tanja Lange’s way? Maybe there are better ways.) on Weil descent etc.

roblem Typical cryptanalytic application: Relations to ECC: ♣ Imagine standard ♣ = 1000003 1. Some DL techniques also ♣ in the Diffie-Hellman protocol. to elliptic-curve DL problems. Use in evaluating User chooses secret key ♥ , security of an elliptic curve. publishes 5 ♥ mod ♣ = 262682. ♥ ✷ ❢ ❀ ❀ ❀ ✿ ✿ ✿ ❀ ♣ � ❣ ♥ ♣ 262682? 2. Some techniques don’t apply Can attacker quickly solve Use in evaluating ♥ mod ♣ the discrete-logarithm problem? ♥ ✼✦ advantages of elliptic curves Given public key 5 ♥ mod ♣ , ❢ ❀ ❀ ❀ ✿ ✿ ✿ ❀ ♣ � 1 ❣ . compared to multiplication. ♥ quickly find secret key ♥ ? ♥ ♣ 262682. 3. Tricky: Some techniques (Warning: This is one way extra applications to some curves. ♥ rce. to attack the protocol. See Tanja Lange’s talk Maybe there are better ways.) on Weil descent etc.

Typical cryptanalytic application: Relations to ECC: Imagine standard ♣ = 1000003 1. Some DL techniques also apply in the Diffie-Hellman protocol. to elliptic-curve DL problems. Use in evaluating User chooses secret key ♥ , security of an elliptic curve. publishes 5 ♥ mod ♣ = 262682. 2. Some techniques don’t apply. Can attacker quickly solve Use in evaluating the discrete-logarithm problem? advantages of elliptic curves Given public key 5 ♥ mod ♣ , compared to multiplication. quickly find secret key ♥ ? 3. Tricky: Some techniques have (Warning: This is one way extra applications to some curves. to attack the protocol. See Tanja Lange’s talk Maybe there are better ways.) on Weil descent etc.

ypical cryptanalytic application: Relations to ECC: Understanding Imagine standard ♣ = 1000003 1. Some DL techniques also apply Can compute 5 1 mod ♣ Diffie-Hellman protocol. to elliptic-curve DL problems. 5 2 mod ♣ Use in evaluating chooses secret key ♥ , 5 3 mod ♣ security of an elliptic curve. ✿ ✿ ✿ publishes 5 ♥ mod ♣ = 262682. 5 8 mod ♣ 2. Some techniques don’t apply. 5 9 mod ♣ attacker quickly solve ✿ ✿ ✿ Use in evaluating discrete-logarithm problem? 5 1000002 ♣ advantages of elliptic curves public key 5 ♥ mod ♣ , compared to multiplication. At some ♥ quickly find secret key ♥ ? with 5 ♥ mo ♣ 3. Tricky: Some techniques have rning: This is one way extra applications to some curves. Maximum attack the protocol. See Tanja Lange’s talk ✔ ♣ � 1 ♣ there are better ways.) on Weil descent etc. ✔ ♣ � 1 that does

cryptanalytic application: Relations to ECC: Understanding brute rd ♣ = 1000003 1. Some DL techniques also apply Can compute successively 5 1 mod ♣ = 5, Diffie-Hellman protocol. to elliptic-curve DL problems. 5 2 mod ♣ = 25, Use in evaluating secret key ♥ , 5 3 mod ♣ = 125, ✿ ✿ ✿ security of an elliptic curve. ♥ d ♣ = 262682. 5 8 mod ♣ = 390625, 2. Some techniques don’t apply. 5 9 mod ♣ = 953122, ✿ ✿ ✿ quickly solve Use in evaluating 5 1000002 mod ♣ = 1. rithm problem? advantages of elliptic curves 5 ♥ mod ♣ , compared to multiplication. At some point we’ll ♥ secret key ♥ ? with 5 ♥ mod ♣ = 262682. 3. Tricky: Some techniques have is one way extra applications to some curves. Maximum cost of rotocol. See Tanja Lange’s talk ✔ ♣ � 1 mults by 5 ♣ better ways.) on Weil descent etc. ✔ ♣ � 1 nanoseconds that does 1 mult/nanosecond.

application: Relations to ECC: Understanding brute force ♣ 1000003 1. Some DL techniques also apply Can compute successively 5 1 mod ♣ = 5, rotocol. to elliptic-curve DL problems. 5 2 mod ♣ = 25, Use in evaluating ♥ , 5 3 mod ♣ = 125, ✿ ✿ ✿ , security of an elliptic curve. ♥ ♣ 262682. 5 8 mod ♣ = 390625, 2. Some techniques don’t apply. 5 9 mod ♣ = 953122, ✿ ✿ ✿ , Use in evaluating 5 1000002 mod ♣ = 1. roblem? advantages of elliptic curves ♥ ♣ , compared to multiplication. At some point we’ll find ♥ ♥ with 5 ♥ mod ♣ = 262682. 3. Tricky: Some techniques have y extra applications to some curves. Maximum cost of computation: See Tanja Lange’s talk ✔ ♣ � 1 mults by 5 mod ♣ ; ys.) on Weil descent etc. ✔ ♣ � 1 nanoseconds on a CPU that does 1 mult/nanosecond.