Elliptic Curve Cryptography

1. Elliptic Curve Cryptography Ofer Schwarz, Winter 2012-2013 Advisor: BarukhZiv The EC Discrete Logarithm problem and Pollard’s Rho attack

2. Background ECDLP; The ECDLP attack; Project goals

3. Elliptic Curves • Elliptic curves may be defined over any field • Solutions to the equation • Obtain a simpler equation through variable change • Over • Over • Define an additive group structure using geometry • “Point an infinity” serves as the unit element Calculating over :

4. ECDLP • Elliptic Curve Discrete Logarithm Problem • Computational hardness of DLP is the basis for many cryptographic systems (e.g., DSA, ElGamal) • Given a finite field , • An elliptic curve over , • A point of order [], • And another point • The problem: find

5. ECDLP using collisions • The idea: find such that • Then we have • Simple method to find a collision: birthday paradox • Very heavy memory requirements • Pollard’s Rho attack: same time, negligible memory • The means: random functions

6. Pollard’s Rho • Every function over a finite spaceis composed of finite chains • Each chain has a cycle, and a collision: such that • In a random function: • Expected tail length • Expected cycle length • Use any cycle-detection method • E.g., Floyd’s algorithm: EC operations • Use a specific family of functions for which given it is easy to find s.t.

7. Additive walks • Partition the curve into disjoint subsets • E.g., according to the least bits of coordinate • Choose random integers for • For , define • For starting element, choose random

8. Pohlig-Hellman reduction • Assume • Reduces ECDLP of order to instances of order for • Uses Chinese remainder theorem and group structure • Significance: ECDLP of order is only as hard as the largest prime factor of • Usually the parameters are chosen so is prime

9. Project goals • Implement a generic EC arithmetic library • Implement the ECDLP attack • Research and implement various improvements and optimizations for the attack • Ultimate goal: solve 64-bit ECDLP (i.e., )

10. Improvements and optimizations Nivasch’s algorithm; Montgomery trick and distinguished point method; Negation map

11. 1. Nivasch’s algorithm • Cycle detection using stacks • The idea: find the smallest value in the cycle • Keep a stack of values encountered so far • For each new value, remove all values larger than it • Stack is ordered by , increasing in both • Improvement: use stacks, with partitioning • Look for smallest value on cycle in each subset separately • Expected runtime: • Expected memory:

12. 2. The Montgomery trick • Inversion is the most expensive field operation • Compute several inversions simultaneously • The trick: use accumulating products: • Substitute inversions with multiplications and inversion

13. Local parallelization • Montgomery’s trick requires several parallel instances (all running locally) • Naïve parallelization only results in a speedup • The distinguished point method yields a speedup factor of • The result: we can use Montgomery’s trick without losing efficiency!

14. Distinguished points • Pollard’s Rho chains may intersect • Use same function in all instances • Keep a hash table of points • Only insert “distinguished” points • Common method: least bits of the coordinate are all 0 • Gives the same speedup factor, but saves a factor of in memory

15. 3. Negation map • Method for improving the attack by a factor of • The idea: given a point , it’s very easy to calculate • In prime curves: • The idea: “group” each point and its negative as a single element • E.g., use the one with an even coordinate

16. Fruitless cycles • Problem with negation map in additive walks • If and , then • “Fruitless” because linear combination is the same • Happens with every step ( = partition factor) • Longer even-length cycles are also possible • Probability is exponential in cycle length

17. Resolving fruitless cycles • The simplest idea actually works: just check! • Check for 2-cycles every steps • When calculating for • Check if • If so, define • Still easy to calculate the linear combination • Do the same for larger even lengths • Analysis shows that optimal • Only need to check up to

18. Implementation and results EC arithmetic library; Collision library; Challenges and results

19. Curve arithmetic library • Generic EC arithmetic library in C++ • Support for various different curves and algorithms • Extensible syntax that allows adding even more curves and algorithms • Fast field arithmetic using GMP and NTL • Incl. complex operations, e.g., Chinese remainders, modular square roots

20. Collision library • Generic (templated) C++ library for finding collisions • Only need to supply the function • Currently implemented: • Floyd’s algorithm • Nivasch’s stack algorithm • Distinguished point method for parallelization

21. Challenges • 4 ECDLP challenges of increasing difficulty • 30, 40, 50 and 64 bits • 1 Extra challenge with non-prime order for testing Pohlig-Hellman reduction

22. Results! • 64-bit challenge solved in ~16 hours, ~ iterations • Results from previous group: 60 bits in 5-6 days • Best result to date: 112 bits in 3.5 months • Used a cluster of 218 PlayStation 3 consoles • Single-Instruction, Multiple-Data architecture • Heavy optimizations on all levels

23. Results!

24. Optimization tests • Check every improvement against vanilla version • Nivasch: 2.16 times less iterations, 1.4 speedup • Montgomery: 1.43 speedup factor for 40 bits, 1.33 factor for 30 bits • Negation map: 1.1 times less iterations, no speedup • (Actually about 1.07 times slower)

25. Improvement ideas • Distributed attack • Low-level optimizations • Integer arithmetic • Field arithmetic (probably harder since NTL is very good at that) • In-place operations instead of constructors and copying • Use SIMD architecture (e.g., GPUs)

26. The End