Cyclic Groups and Cryptography

The discrete logarithm problem with auxiliary inputs (DLP-wAI) is a special discrete logarithm problem. Cheon first proposed a novel algorithm to solve the discrete logarithm problem with auxiliary inputs. Given a cyclic group $${\mathbb {G}}=\langle P\rangle $$G=?P? of order p and some elements $$P,\alpha P,\alpha ^2 P,\ldots , \alpha ^d P\in {\mathbb {G}}$$P,?P,?2P,?,?dP?G, an attacker can recover $$\alpha \in {\mathbb {Z}}_p^*$$??Zp? in the case of $$d|(p\pm 1)$$d|(p±1) with running time of $${\mathcal {O}}(\sqrt{(p\pm 1)/d}+d^i)$$O((p±1)/d+di) group operations by using $${\mathcal {O}}(\text {max}\{\sqrt{(p\pm 1)/d}, \sqrt{d}\})$$O(max{(p±1)/d,d}) storage ($$i=\frac{1}{2}$$i=12 or 1 for $$d|(p-1)$$d|(p-1) case or $$d|(p+1)$$d|(p+1) case, respectively). In this paper, we propose a new algorithm to solve another form of elliptic curve discrete logarithm problem with auxiliary inputs (ECDLP-wAI). We show that if some points $$P,\alpha P,\alpha ^k P,\alpha ^{k^2} P,\alpha ^{k^3} P,\ldots ,\alpha ^{k^{\varphi (d)-1}}P\in {\mathbb {G}}$$P,?P,?kP,?k2P,?k3P,?,?k?(d)-1P?G and multiplicative cyclic group $$K=\langle k \rangle $$K=?k? are given, where d is a prime, $$\varphi (d)$$?(d) is the order of K and $$\varphi $$? is the Euler totient function, the secret key $$\alpha \in {\mathbb {Z}}_p^*$$??Zp? can be solved in $${\mathcal {O}}(\sqrt{(p-1)/d}+d)$$O((p-1)/d+d) group operations by using $${\mathcal {O}}(\sqrt{(p-1)/d})$$O((p-1)/d) storage.

Identity-based signatures (IBS) can be verified using the signer identity information as the public key, and hence, there is no need for certificate management that proves the corresponding public key ownership. Unfortunately, none of the existing IBS schemes has security proven as tight as the discrete logarithm (DL) problem, the hardest problem in the cyclic group setting, under the standard EUF-CMA security model. Recently, the introduction of proving security in the algebraic group model (AGM), where the adversary’s computation is algebraic, enables some ordinary signature schemes to be proven tightly reducible under DL assumption and EUF-CMA. To date, however, it remains unknown whether IBS schemes can also be proven as secure as the DL problem in the AGM. Achieving tight security in IBS schemes under standard EUF-CMA is challenging, due to the need to take extra precautions against adaptive queries on user private keys by the adversary. In this work, we show, for the first time, an IBS scheme with tight security under DL assumption and EUF-CMA in the AGM. The scheme features a minimal signature size of two group elements, with a reduction loss factor of two.

Research in the field of public key cryptography in general and digital signatures in particular is often considered and evaluated at two levels: The first level is considering the mathematical basis for constructing cryptographic and digital signature algorithms, especially these difficult problems: factorizing a large integer into prime factors, finding root problem, discrete logarithm problem, discrete logarithm problem on elliptic curve... The second level is constructing cryptographic and digital signatures algorithms on these hard problems including RSA, DSA, Schnorr, GOST R34.10-94. At the first level, research focuses mainly on improving algorithms for finding large primes, structures for strong primes and algorithms to attack these problems efficiently. At the second level, the research concentrates on improving the existing algorithms to enhance the safety or effective performance of the algorithm. In this article, the authors propose a solution to improve the security of digital signature schemes, implemented in both levels of digital signatures. At the first level, the authors propose a new hard problem - different from the hard problems used before and hasn’t been solved by anyone so far (except by "brute force attack" method). At the second level, the authors propose a method to construct new digital signature algorithms that can help create not only one but also a family of new digital signature algorithms with high security level for practical applications.

The concept of public key cryptography was first introduced by Diffie and Hellman in 1976 using discrete logarithm problem as base of difficulty. In 1985, T. ElGamal proposed public key cryptosystem scheme based on discrete logarithm problem. Elliptic curve cryptosystems were first proposed in 1985 independently by Neil Koblitz and Victor Miller. Elliptic curve cryptosystems are unique in using elliptic curve groups for arithmetic. This cryptosystem is based on discrete logarithm problem in the group of points of an elliptic curve defined over a finite field. The discrete logarithm problem in an elliptic curve group appears to be much harder than the discrete logarithm problem in other groups. Hence elliptic curves cryptosystem can match the security of other cryptosystems while using smaller key. In this paper we will discuss a VLSl implementation of elliptic curves cryptosystem for ElGamal encryption scheme.

A number of public key cryptosystems such as El Gamal [2] are based on the difficulty of solving the discrete logarithm problem in certain groups, that is, solving g x = h for x, where g and h are given group elements. The computational difficulty of the discrete logarithm depends on the representation of the group. The additive version in ℤ m is essentially trivial, involving only the solution of a linear congruence. However, in \({\Bbb F}_{{p^d}}^*\), the multiplicative group of the finite field with p d elements, the problem is intractable if p d is large enough, even though it is isomorphic to the cyclic group \({{\Bbb Z}_{{p^d} - 1}}\). The computation appears even somewhat more difficult in groups based on elliptic and hyperelliptic curves, with some exceptions such as supersingular curves.

Elliptic curves cryptography was introduced independently by Victor Miller (Miller, 1986) and Neal Koblitz (Koblitz, 1987(Koblitz, ) in 1985. .At that time elliptic curve cryptography was not actually seen as a promising cryptographic technique.As time progress and further research and intensive development done especially on the implementation side, elliptic curve cryptography is now being implemented widely.Elliptic curves cryptography offers smaller key size, bandwidth savings and faster in implementations when compared to the RSA (Rivest-Shamir-Adleman) cryptography which based its security on the integer factorization problem.The most interesting feature of the elliptic curves is the group structure of the points generated by the curves, where points on the elliptic curves form a group.The security of elliptic curves cryptography relies on the elliptic curves discrete logarithm problem.The elliptic curve discrete logarithm problem is analogous to the ordinary algebraic discrete logarithm problem, l = g x , where given the l and g, it is infeasible to compute the x.Elliptic curve discrete logarithm problem deals with solving for n the relation P = nG.Given the point P and the point G, then it is very hard to find the integer n.To implement the discrete logarithm problem in elliptic curve cryptography, the main task is to compute the order of group of the curves or in other words the number of points on the curve.Computation to find the number of points on a curve, has given rise to several point counting algorithms.The Schoof and the SEA (Schoof-Elkies-Atkin) point counting algorithms will be part of the discussion in this chapter.This chapter is organized as follows: Section 2, gives some preliminaries on elliptic curves, and in section 3, elliptic curve discrete logarithm problem is discussed.Some relevant issues on elliptic curve cryptography is discussed in section 4, in which the Diffie-Hellman key exchange scheme, ElGamal elliptic curve cryptosystem and elliptic curve digital signature scheme are discussed here accompanied with some examples.Section 5 discussed the two point counting algorithms, Schoof algorithm and the SEA (Schoof-Elkies-Atkin) algorithm.Following the discussion in section 5, section 6 summaries some similarities and the differences between these two algorithms.Section 7 gives some brief literature on these two point counting algorithms.Finally, section 8 is the concluding remarks for this chapter. Elliptic curvesElliptic curves obtained their name from their relation to elliptic integrals that arise from the computation of the arc length of ellipses (Lawrence & Wade, 2006).Elliptic curves are www.intechopen.com Cryptography and Security in Computing1 1 2 3 4 2 2 4 Fig. 1.1. 2(1 ) (1 ) yx x x   www.intechopen.com

Over the last year or two, a large number of attacks have been found by the authors and others on protocols based on the discrete logarithm problem, such as ElGamal signature and Diffie Hellman key exchange. These attacks depend on causing variables to assume values whose discrete logarithms can be calculated, whether by forcing a protocol exchange into a smooth subgroup or by choosing degenerate values directly. We survey these attacks and discuss how to build systems that are robust against them. In the process we elucidate a number of the design decisions behind the US Digital Signature Standard

We propose a Diffie-Hellman-like key agreement protocol based on the computational intractability of reversing group action. The concept of a group action generalizes exponentiation and provides an algorithmic problem harder than the discrete logarithm problem. Using the action of the general linear group on the direct product of two cyclic groups, we invent a key agreement protocol secure against an attacker who has power to solve the discrete logarithm problem. We discuss a semantic secure asymmetric encryption scheme as well. Its security is evaluated in terms of a generic algorithm, which is a model of probabilistic algorithms over black box groups (similar to a straight-line program) and does not depend on any specific property of the group representation.

In 1976 Diffie and Hellman [152] described the framework for public-key cryptography. It was not until 1978 that three designs for public-key cryptosystems were published. Rivest, Shamir, and Adleman [431] showed how the discrete logarithm and factorization problems could be used to construct a public-key cryptosystem. This is the well-known RSA cryptosystem. Merkle and Hellman [339] used the knapsack problem in their construction. McEliece [329] built a system based on error correcting codes. Later in 1985 ElGamal [163] designed a public-key cryptosystem using the discrete logarithm problem. Koblitz [283] and Miller [346] suggested the use of elliptic curves in the design of public-key cryptosystems. Nowadays, there are quite a few more suggestions as to how to design public-key cryptosystems, but none so popular as the RSA and ElGamal cryptosystems.

This paper introduces a new public key cryptosystem based on two hard problems : the cube root extraction modulo a composite moduli (which is equivalent to the factorisation of the moduli) and the discrete logarithm problem. These two hard problems are combined during the key generation, encryption and decryption phases. By combining the IFP and the DLP we introduce a secure and efficient public key cryptosystem. To break the scheme, an adversary may solve the IFP and the DLP separately which is computationally infeasible. The key generation is a simple operation based on the discrete logarithm modulo a composite moduli. The encryption phase is based both on the cube root computation and the DLP. These operations are computationally efficient.

The paper proposes the use of more than one hard problem in the design of cryptographic protocols to enhance their security. Specifically, both the discrete logarithm problem and the factorisation problem are embedded in the process of signing to enhance the security of the original El Gamal signature scheme.

ElGamal system was introduced by Taher ElGamal in his landmark paper in 1985 [1]. ElGamal is an important asymmetric cryptosystem that is based on the discrete logarithm problem. In brief, this cryptosystem relies on the difficulty of computing discrete logarithms over finite fields [1]. Towards solving discrete logarithms, Shor demonstrated the existence of a polynomial algorithm that can solve these logarithms on quantum machines [2]. In this paper we propose the Convolution Power Cryptosystem (CPC-H2); an extension to the ElGamal cryptosystem that is based on a novel hard problem. CPC-H2 is designed to defend against a Chosen Ciphertext Attack. We show that CPC-H2 is less complicated and has a higher security level than the Number Theory Research Unit (NTRU).

The security of public-key cryptography relies on well-studied hard problems, problems for which we do not have efficient algorithms. Factorization and discrete logarithm are the two most known and used hard problems. Unfortunately, they can be easily solved on a quantum computer by Shor's algorithm. Also, the research area of cryptography demands for crypto-diversity which says that we should offer a range of hard problems for public-key cryptography. If one hard problem proves to be easy, we should be able to provide alternative solutions. Some of the candidates for post-quantum hard problems, i.e. problems which are believed to be hard even on a quantum computer, are the Learning Parity with Noise (LPN), the Learning with Errors (LWE) and the Shortest Vector Problem (SVP). A thorough study of these problems is needed in order to assess their hardness. In this thesis we focus on the algorithmic study of LPN. LPN is a hard problem that is attractive, as it is believed to be post-quantum resistant and suitable for lightweight devices. In practice, it has been employed in several encryption schemes and authentication protocols. At the beginning of this thesis, we take a look at the existing LPN solving algorithms. We provide the theoretical analysis that assesses their complexity. We compare the theoretical results with practice by implementing these algorithms. We study the efficiency of all LPN solving algorithms which allow us to provide secure parameters that can be used in practice. We push further the state of the art by improving the existing algorithms with the help of two new frameworks. In the first framework, we split an LPN solving algorithm into atomic steps. We study their complexity, how they impact the other steps and we construct an algorithm that optimises their use. Given an LPN instance that is characterized by the noise level and the secret size, our algorithm provides the steps to follow in order to solve the instance with optimal complexity. In this way, we can assess if an LPN instance provides the security we require and we show what are the secure instances for the applications that rely on LPN. The second framework handles problems that can be decomposed into steps of equal complexity. Here, we assume that we have an adversary that has access to a finite or infinite number of instances of the same problem. The goal of the adversary is to succeed in just one instance as soon as possible. Our framework provides the strategy that achieves this. We characterize an LPN solving algorithm in this framework and show that we can improve its complexity in the scenario where the adversary is restricted. We show that other problems, like password guessing, can be modeled in the same framework.

The discrete logarithm problem (DLP) plays an important role in modern cryptography since it cannot be efficiently solved on a classical computer. Currently, the DLP based on the hyperelliptic curve of genus 2 (HCDLP) is widely used in industry and also a research field of hot interest. At the same time, quantum computing, a new paradigm for computing based on quantum mechanics, provides the ability to solve certain hard problems that cannot be efficiently solved on classical computers. In this paper, we consider the problem of solving the HCDLP in the paradigm of quantum computing. We propose a quantum algorithm for solving the HCDLP by applying the framework of quantum algorithm designed by Shor. The key of the algorithm is the realization of divisor addition. We solve the key problem and get analytical results for divisor addition by geometric meaning of the group addition. Therefore, the procedure can be efficiently realized on a quantum computer using the basic modular arithmetic operations. Finally, we conclude that the HCDLP defined over an n-bit prime field $$\mathbb {F}_{p}$$ can be computed on a quantum computer with at most $$13n+2\lfloor \log _{2}n\rfloor +10$$ qubits using $$2624n^{3} \log _{2}n-2209.2n^{3} + 1792n^{2} \log _{2}n-3012.8n^{2}$$ Toffoli gates. For current parameters at comparable classical security levels, there are fewer qubits and Toffoli gates to solve the HCDLP than the ones to solve the DLP based on elliptic curves.

For a finite group G to be used in the MOR public key cryptosystem, it is necessary that the discrete logarithm problem(DLP) over the inner automorphism group Inn (G) of G must be computationally hard to solve. In this paper, under the assumption that the special conjugacy problem of G is easy, we show that the complexity of the MOR system over G is about log |G| times larger than that of DLP over G in a generic sense. We also introduce a group-theoretic method, called the group extension, to analyze the MOR cryptosystem. When G is considered as a group extension of H by a simple abelian group, we show that DLP over Inn (G) can be ‘reduced’ to DLP over Inn (H). On the other hand, we show that the reduction from DLP over Inn (G) to DLP over G is also possible for some groups. For example, when G is a nilpotent group, we obtain such a reduction by the central commutator attack.