twisted curve

Et - read E twist

Et(Fq) : y^2 = x^3+ d^2Ax+ d^3B

Where d is any Quadratic Non Residue mod q

more on Quadratic Non Residue mod q later

Torsion points and bilinear pairing

if you have a point P where mP=O, then you have a point of order m in the group E
If you have a set of points E[m]={P belongs to E:[m]P=O}
these points are points of finite order, they are called torsion points!

E[m] is a subgroup af E

the great "news" ;Bilinear pairing, is that every point P can be written as a linear combination
P = aP1 + bP2 for unique choice of a and b (in Z/mZ)

If m is large its difficult to find a and b. If b=0, then finding a is solving ECDLP!
P=aP1.

Weil - some light please

Weil:

input two points P and Q on E so that Dvs mP= O og mQ=O
output: m'th root of unity
.......................
P,Q with order m, meaning belongs to E[m]
em(P,Q)=(fP(Q+S)/fP(S))/(fQ(P-S)/fQ(-S)), S not being O,P,-P,Q or -Q
fP and fQ are rational functions on E so that
div(fP)= m[P]-m[O] and div(fQ)= m[Q]-m[O]
(the value of em(P,Q) does for some reason not depend on the choice of fP and fQ)

and the nice thing is that em(P,Q)^m = 1
that means that em(P,Q) is an m'th root of unity

more properties:
em(P,P) = 1 which implies that em(P,Q)= em(Q,P)^-1

if em(P,Q) = 1 for all Q then P=O
..............................................................

What does m'th root of unity means

Normally
2nd root of unity means= square x equals 1 x^2 = 1
and cubic for m=3
A primitiv m'th root of unity means is one where there is no solution to
x^k=1 for every k smaller than m

Koblitz curves

Elliptic curve defined over F2 on the form
Y^2 + XY = X^3 + aX^2 +1, with a 1 or 0. Koblitz idea: define the curve in F2, but take points on E with coordinates i F2^k.
An easy way to calculate the order of the curve - i.e. the number of points on E(F2^k) (with a=0) is
#E(F2^k) = 2^k + 1 - ((-1+sqrt(-7))/2)^k - ((-1-sqrt(-7))/2)^k

for k=11
we have a cute tiny one with order 2116

for k=97
it's a little larger:
158456325028528296935114828764

for k=163
the number of points is:
11692013098647223345629473816263631617836683539492

for k=233
the number of points is:
13803492693581127574869511724554051042283763955449008505312348098965372

for k= 283
the number of points is:
15541351137805832567355695254588151253139246935172245297183499990119263\
318817690415492

k=409 gives:
13221119375804971979038306160655420796568093659285624385692975800915228\
45156996764202693033831109832056385466362470925434684

k=571 gives:
7729075046034516689390703781863974688597854659412869997314470502903038\
2845791208490725359140908268473388268512033014058450946998962664692477\
18729686468370014222934741106692

isn't that amazing?

Galois fields - F2^n

Elliptic curves over F2^n:
characteristic: 2 expansion degree: n
Elements in F2^4
0000, 0001, 0010, 0011, 0100, 0101, 0110, 0111, 1000, 1001, 1010, 1011, 1100, 1101, 1110, 1111
characteristic 2, expansion degree 4
Other fields:
Elements in F3^2
00,01,02,10,11,,12,20,21,22
characteristic 3, expansion degree 2
suitable for cryptography:
y^2 + xy = x^3 + ax^2 + b
b cannot be zero, a may be zero.

Supersingular curve not suitable for cryptography:
y^2 + y = x^3 + ax + b
points (x,y) are variables in F2^n and plus operations is the just XOR of x bits with y bits.

...to be tested!

random curve with point

If you just need any short form weierstrass curve at random with a random point the easiest way is to create the point first, then the curve.
suitable for lenstra.
Given a composite you would like to factor.
toy example:
given N= 1289
random point P=(x,y)=(235,156)
random A= 21
calculate B as
B=y^2 -x^3 - A*x mod N
156^2-235^3-21*235 mod 1289 gives B=-157
then you got your random curve:
Y^2=X^3 + 21X-157 with a point P that by construction is on the curve.

the solution for B ofcourse can be plus/minus any multiplication of N. equivalence class: B + Z/ZN
More about lenstra later

Double and Add algorithm

Very much like the fast powering algorithm - binary expansion can be used to calculate Q= nP fast.
ex n=947 = 2^9+2^8+2^7+2^5+2^4+2^1+2^0

which means that 947P = P+2P+16P+32P+128P+256P+512P. Thats 9 doublings and 6 additions, much better than 946 additions....
if we allow subtraction as well (ternary expansion) its even better.

want to calculate nP?

algorithm:

1. input point P from E(Fp) and n>=1
2. set Q=P and R=Ø (point at infinity)
3. loop while n>0{
     if n = 1 (mod2) set R= R+Q
     set Q=2Q and n=n/2 (floor)}
4.return R (which equals nP)

I've now posted working sourcecode available at http://christelbach.com
(source code contained in master thesis)

for instance this:
//double and add algorithm

private BigInteger[] calculatenP(BigInteger x, BigInteger y, BigInteger n, BigInteger A, BigInteger modp)
{
BigInteger[] Q = { x, y };
BigInteger[] R = { 0, 0 };
while (n > 0)
{
   BigInteger t = BigInteger.ModPow(n, 1, 2); 
   if ((t) == 1)
   {
   R = addPoints(Q[0], Q[1], R[0], R[1], modp);
   } 
   Q = doublePoints(Q[0], Q[1], A, modp);
   n = n / 2;
}
BigInteger[] resPoint = { R[0], R[1] };
return resPoint;
}

Look in the pdf file for the methods addPoints() and doublePoints()

square roots modulus

IF a has a square root modulus p,we can solve it like this:

we have x^2= a mod p, then
b= a^((p+1)/4)mod p
will be a solution. It will satisfy b^2=a mod p.
Isn't that a miracle!

Remember ONLY if a has a squareroot mod p...that certainly not allways the case.

more inverse

how could I forget fermat's little..
a^(p-1) = 1 mod p if p does not devide a, and 0 otherwise.
Multiply a^(p-2) with a and we will get:

a^(-1)= a^(p-2) mod p


together with fast powering algorithm this is handy and to some limit efficient!
An alternativ to the euclidian algorithm.

About fast powering algorithm:

toy example

5^11 mod 13
write 11 as a sum of power of 2 (like binary)
11= 1011, which means 11= 5^(2^3+2^1+2^0)= 5^(2^3)*5^2*5. Reduce mod 13 in each step and the numbers will stay low
so the result is 1*12*5= 60 mod 13= 8

In general:
create a table with relevant powers mod p to some limit, The easy part is that each number is just the square of the preceding one.

Multiplicative inverse modulus p

JavaScript snippet that will implement this nicely.

Use approprite html elements that fits the script.

window.onload= initForm;

function initForm(){
document.getElementById("ok").onclick = calcInverse;
}

function calcInverse(){

var n= parseInt(document.getElementById("nn").value);
var p= parseInt(document.getElementById("pp").value);

var x = 1;
var y = 0;
var a=p;
var b=n;
var q,t;
var res;
while (b != 0) {
                t = b;
                q = Math.floor(a/t);
                b = a - q*t;
                a = t;
                t = x;
                x = y - q*t;
                y = t;
        }
if(y<0){
res= y+p;
}  
else{
res=y;
}

document.getElementById("r1").innerHTML="a^-1  er "+res;
return false;

}

The hunt for multiplicative inverses

The inverse of a, a^1=z mod m. Calculation aint easy for large m, this is where all the computing power goes.
a does have an inverse mod m if and only if a*z=1 mod m. Otherwice there is no inverse.
If our finite field is prime, then all members sport this property

We can find the inverse by using euclid. We know that in the Euclidean Algorithm you repeatedly divide the divisor by the remainder until the remainder is 0.
The gcd is then the last non-zero remainder.
We can write
za + mb = 1. This says that za = 1 + (-b)m, which means za=1 (mod m). We dont care about -b in this case of cause. So z is the inverse of a.

The extended version gives us z.
Nice tiny toy example here:
http://www-math.cudenver.edu/~wcherowi/courses/m5410/exeucalg.html

projective space and homogenous coordinates.

Guess I've got the projective space right now. Love the explanation at wiki.
http://en.wikipedia.org/wiki/Projective_space
But its urgent to really understand that and the homogeneous coordinates.
Projective space: really a projection! 3d space projected into a tiny 2d picture. A projection from 3d to 2d.

Quote:'the set of equivalence classes of R3\(0, 0, 0), i.e. 3-space without the origin, where two points P = (x, y, z) and Pˈ = (xˈ, yˈ, zˈ) are equivalent if there is a nonzero real number λ such that P = λ·Pˈ, i.e. x = λxˈ, y = λyˈ, z = λzˈ. The usual way to write an element of the projective plane, i.e. the equivalence class corresponding to an honest point (x, y, z) in R3, is

[x : y : z].

The last formula goes under the name of homogeneous coordinates'

You can homogenize like this: you add z until all parts of the equation have the same degree:

y^2=x^3 + Ax + B becomes y^2z=x^3 + Axz^2+Bz^3

Calculating in projective space gives us a way to work with the point at infinity without just panicking. The point at infinity just becomes a special plane i a 3 dimensional space, where parallel lines meet.
lucky bastards.

change of language

ok, I'll change the main language of this blog.
Today I found an indonesian girl doing exaclty the same as I, trying to focus and trying to study elliptic curves and implement some cryptography using EC. I was so happy she was not writing in whatever language - indonesian probably..

So if you read this blog, you'll have to deal with my not so perfect language skills.

Feel free to ask me translate any of my articles if some of them seems to be relevant for you.

Suitable curves

english summary:
Curves suitable for cryptography according to Rosing:
Elliptic Curves over Galois Fields.
Meaning curves over F2^n, meaning fields with characteristic 2 - and only nonsupersingular.
y^2 + xy = x^3 + a2x^2 + a6.
a6 cannot be zero
a2 can be zero.
.........
Ifølge Michael Rosing er de eneste kurver der er velegnede til kryptografisk brug kurver over Galois legemer. Dvs kurver på F2^n , med andre ord kurver med karakteristikken 2, og udvidelsesgraden n.- og det da kun hvis de ikke er supersingulære. Med andre ord skal de være af formen:

y^2 + xy = x^3 + a2x^2 + a6.
a6 må IKKE være nul.
a2 kan godt være nul.
Jeg tror fortsat polynominal basis er rarere at regne med end optinormal basis.

Hvordan mon denne klasse af anbefalede kurver matcher de i suite B angivne kurver. To be tested.

Punktaddition

Simpelt demonstationseksempel på R, med værdier max 'integer' størrelse:
Der konstrueres passende felter i html dokument der matcher id'erne i denne kode.
Denne meget lille primitive løsning tester IKKE for om punkterne overhovedet ligger på kurven - det er på eget ansvar. Det er kun i tilfældet P1=p2 hvor y1 er forskellig fra nul at kurvens koeficienter direkte indgår i additionsberegningen - og derfor der fejlkilden skal findes.
fgl placeres i eksternt javascript

window.onload= initForm;
function initForm(){
document.getElementById("ok").onclick = calcPoint;
}
function calcPoint(){
var x1= parseInt(document.getElementById("xx1").value);
var y1= parseInt(document.getElementById("yy1").value);

var x2= parseInt(document.getElementById("xx2").value);
var y2= parseInt(document.getElementById("yy2").value);
if((x2-x1) != 0 ){
var m = (y2-y1)/(x2-x1);
var x3 = (m*m)-x1-x2;
var y3= m*(x1-x3)-y1;
document.getElementById("r1").innerHTML="P3, (x3,y3) er "+x3+","+y3;
}
else if (((x2-x1) == 0) && ((y2-y1) != 0)){
alert("det er farligt at dividere med nul, P1 + P2 giver punktet i uendelig");}
else if ((x2-x1)==0 && (y2-y1)==0){
if(y2 != 0){
var A= parseInt(document.getElementById("AA").value);
var m = ((3*x1*x1)+A)/(2*y1);
var x3 = (m*m)-2*x1;
var y3= m*(x1-x3)-y1;
document.getElementById("r1").innerHTML="P3, (x3,y3) er "+x3+","+y3;
}
else{
alert("P1 + P2 giver punktet i uendelig");
document.getElementById("r1").innerHTML="eternal sunshine in a spotless mind";
}
}
else{
alert("noget gik helt galt");
document.getElementById("r1").innerHTML="42";
}

return false;
}

Litteraturliste

Så er der en relevant litteraturliste med links til bøgerne på Amazon.co.uk
Alle bøgerne står på min reol og omhandler enten talteori generelt, kryptering generelt eller specifikt matematik og kryptering med elliptiske kurver

support af Suite B i .NET

En stribe interessante muligheder for at få sat strøm i suite B:
Som sædvanlig byder Certicom sig til:
http://www.certicom.com/index.php/net

DOTNET, .NET har nu i version 3.5 fuld understøttelse af div suite B algoritmer
Læse her på MSDN:
http://msdn.microsoft.com/en-us/library/bb332048.aspx
cirka midt på siden.
To relevante klasser er beskrevet her:

Digital Signatur med EC: Elliptic Curve Digital Signature Algorithm (ECDSA).
http://msdn.microsoft.com/en-us/library/system.security.cryptography.ecdsacng.aspx

Diverse kryptografiske operationer med EC Diffie-Hellman
http://msdn.microsoft.com/en-us/library/system.security.cryptography.ecdiffiehellmancng.aspx

Måske trækker det op til lidt applied cryptography..

keyboard destruction

C i 21 days, C for total complete idiots, php for morons, C# fresh and crisp, Objective C in a tiny bucket the size of the moon, fast and furious keyboard destroyer.
Jo jeg blev istand til at programmere i en bunke forskellige underlige sprog, men lige meget hjælper det hvis man ikke sætter sig på sin dertil indrettede og beslutter sig for progression.

2 jobs senere, 3-4 sprog senere, adskillige keyboards senere viser det sig at det stadig er et spørgsmål om canvas og blikket stift rettet mod bog med spidset blyant.