Last Fall Degree, HFE, and Weil Descent Attacks on ECDLP

This paper presents an approach to solving the elliptic curve discrete logarithm problem on alternative curve models over prime fields using a quantum annealing and index calculus method. Part of the algorithm, relation searching, is transformed into the Quadratic Unconstrained Boolean Optimization (QUBO) problem and then is efficiently solved using the D-Wave computer by quantum annealing. As Faugère et al. showed, twisted Edwards curves, because of their symmetric shape, allow us to obtain solutions of relations searching step using Groebner basis faster than in the case of Weierstrass curves. Because of symmetries, a system of equations of relations searching step for twisted Edwards curves has many symmetric solutions. Using the Groebner basis and having many system solutions makes it easier to find any of them. The same is true using quantum annealing - it is easier to find any solution to the QUBO problem if many are correct. In this paper, we used this observation to find out that a properly constructed QUBO problem for the relations searching step for twisted Edwards curves allows us to find a solution faster for the same size of the base field than in the case of Weierstrass curves. Using the presented approach, we solved the discrete logarithm problem using quantum annealing and index calculus method for elliptic curve discrete logarithm problem defined on twisted Edwards curve over a field 𝔽1021 with order equal to 4 · 241. It is now the biggest field and size of the group, where the elliptic curve discrete logarithm problem was solved using quantum methods.

Elliptic curves cryptography was introduced independently by Victor Miller (Miller, 1986) and Neal Koblitz (Koblitz, 1987(Koblitz, ) in 1985. .At that time elliptic curve cryptography was not actually seen as a promising cryptographic technique.As time progress and further research and intensive development done especially on the implementation side, elliptic curve cryptography is now being implemented widely.Elliptic curves cryptography offers smaller key size, bandwidth savings and faster in implementations when compared to the RSA (Rivest-Shamir-Adleman) cryptography which based its security on the integer factorization problem.The most interesting feature of the elliptic curves is the group structure of the points generated by the curves, where points on the elliptic curves form a group.The security of elliptic curves cryptography relies on the elliptic curves discrete logarithm problem.The elliptic curve discrete logarithm problem is analogous to the ordinary algebraic discrete logarithm problem, l = g x , where given the l and g, it is infeasible to compute the x.Elliptic curve discrete logarithm problem deals with solving for n the relation P = nG.Given the point P and the point G, then it is very hard to find the integer n.To implement the discrete logarithm problem in elliptic curve cryptography, the main task is to compute the order of group of the curves or in other words the number of points on the curve.Computation to find the number of points on a curve, has given rise to several point counting algorithms.The Schoof and the SEA (Schoof-Elkies-Atkin) point counting algorithms will be part of the discussion in this chapter.This chapter is organized as follows: Section 2, gives some preliminaries on elliptic curves, and in section 3, elliptic curve discrete logarithm problem is discussed.Some relevant issues on elliptic curve cryptography is discussed in section 4, in which the Diffie-Hellman key exchange scheme, ElGamal elliptic curve cryptosystem and elliptic curve digital signature scheme are discussed here accompanied with some examples.Section 5 discussed the two point counting algorithms, Schoof algorithm and the SEA (Schoof-Elkies-Atkin) algorithm.Following the discussion in section 5, section 6 summaries some similarities and the differences between these two algorithms.Section 7 gives some brief literature on these two point counting algorithms.Finally, section 8 is the concluding remarks for this chapter. Elliptic curvesElliptic curves obtained their name from their relation to elliptic integrals that arise from the computation of the arc length of ellipses (Lawrence & Wade, 2006).Elliptic curves are www.intechopen.com Cryptography and Security in Computing1 1 2 3 4 2 2 4 Fig. 1.1. 2(1 ) (1 ) yx x x   www.intechopen.com

The elliptic curve discrete logarithm problem is considered a secure cryptographic primitive. The purpose of this paper is to propose a paradigm shift in attacking the elliptic curve discrete logarithm problem. In this paper, we will argue that initial minors are a viable way to solve this problem. This paper will present necessary algorithms for this attack. We have written a code to verify the conjecture of initial minors using Schur complements. We were able to solve the problem for groups of order up to $2^{50}$.

This paper examines the cryptographic security of fixed versus random elliptic curves over the field GF(p). Its basic assumption is that a large precomputation to aid in breaking the elliptic curve discrete logarithm problem (ECDLP) can be made for a fixed curve. We take this into account when examining curve security as well as considering a variation of Pollard's rho method where computations from solutions of previous ECDLPs can be used to solve subsequent ECDLPs on the same curve. We present a lower bound on the expected time to solve such ECDLPs using this method, as well as an approximation of the expected time remaining to solve an ECDLP when a given size of precomputation is available. We conclude that adding 5 bits to the size of a fixed curve to avoid general software attacks and an extra 6 bits to avoid attacks on special moduli and a parameters provides an equivalent level of security.

In this chapter we shall first discuss the Elliptic Curve Discrete Logarithm Problem (ECDLP) and the classical solutions to ECDLP, then we shall present some quantum algorithms for solving the ECDLP problem and for attacking the ECDLP-based cryptography.

This paper investigates how to reduce the elliptic curve discrete logarithm problem over prime fields to the quadratic unconstrained binary optimization (QUBO) problem in order to obtain as few logical qubits as possible. In the best case scenario, if n is the bitlength of a characteristic of prime field Fp, approximately 3n³ logical qubits are required for such a reduction in the Edwards curve case. We present a practical attack on an elliptic curve discrete logarithm problem over the 3-bit prime field F7 for an elliptic curve with the subgroup of order 8. We solved this problem using the D-Wave Advantage QPU. To the best of the authors' knowledge, no one has made, so far, a practical attack on the elliptic curve discrete logarithm over a prime field using the direct quantum method.

The discrete logarithm problem with auxiliary inputs (DLP-wAI) is a special discrete logarithm problem. Cheon first proposed a novel algorithm to solve the discrete logarithm problem with auxiliary inputs. Given a cyclic group $${\mathbb {G}}=\langle P\rangle $$G=?P? of order p and some elements $$P,\alpha P,\alpha ^2 P,\ldots , \alpha ^d P\in {\mathbb {G}}$$P,?P,?2P,?,?dP?G, an attacker can recover $$\alpha \in {\mathbb {Z}}_p^*$$??Zp? in the case of $$d|(p\pm 1)$$d|(p±1) with running time of $${\mathcal {O}}(\sqrt{(p\pm 1)/d}+d^i)$$O((p±1)/d+di) group operations by using $${\mathcal {O}}(\text {max}\{\sqrt{(p\pm 1)/d}, \sqrt{d}\})$$O(max{(p±1)/d,d}) storage ($$i=\frac{1}{2}$$i=12 or 1 for $$d|(p-1)$$d|(p-1) case or $$d|(p+1)$$d|(p+1) case, respectively). In this paper, we propose a new algorithm to solve another form of elliptic curve discrete logarithm problem with auxiliary inputs (ECDLP-wAI). We show that if some points $$P,\alpha P,\alpha ^k P,\alpha ^{k^2} P,\alpha ^{k^3} P,\ldots ,\alpha ^{k^{\varphi (d)-1}}P\in {\mathbb {G}}$$P,?P,?kP,?k2P,?k3P,?,?k?(d)-1P?G and multiplicative cyclic group $$K=\langle k \rangle $$K=?k? are given, where d is a prime, $$\varphi (d)$$?(d) is the order of K and $$\varphi $$? is the Euler totient function, the secret key $$\alpha \in {\mathbb {Z}}_p^*$$??Zp? can be solved in $${\mathcal {O}}(\sqrt{(p-1)/d}+d)$$O((p-1)/d+d) group operations by using $${\mathcal {O}}(\sqrt{(p-1)/d})$$O((p-1)/d) storage.

A new anonymous conference key distribution system based on the elliptic curve discrete logarithm problem

Elliptic curve discrete logarithm problem (ECDLP) is the basis of security of elliptic curve cryptography (ECC). The security evaluation of ECC has been studied by solving an ECDLP. We need a large amount of computational resources for the evaluation. This paper proposes a new system collecting computational resources with Web-based volunteer computing (Web-based VC). In the system, web applications are allocated to volunteer participants (workers) as jobs. Web applications are built by utilizing technologies called Native Client (NaCl) and Portable NaCl (PNaCl). This paper evaluates the performance of the system and solves 70-bit ECDLP with Web-based VC. The performance of the web application utilizing NaCl is approximately 6.4 times higher than that of the web application written in JavaScript. Also, the performance of the web application utilizing PNaCl is approximately 4.2 times higher. In the case of NaCl, 70-bit ECDLP is solved in only 1389 seconds. If we collect 100,000 PCs by Web-based VC, 114-bit ECDLP will be solved in only approximately 1 day.

With the rapid development of the Internet, many users start to take action putting personal or company information on it, and share with everyone. The Internet is public as it were, if we do not control its limit of authority to assure security, it's possible that those attackers do illegal access of important information and destroy them. Not only personal privacy is invaded, but the mass property damage. Therefore, effective access control system has been more and more emphasized these days. To fight against these network attacks, it is necessary to establish an effective and safe access control system; here we proposed a scheme, a key management which called Lagrange interpolation mainly takes access control model as framework, and use Elliptic Curve Cryptography system to enhance security. The fact we choose Lagrange interpolation is the key we use is randomized, no relationship between each key, so is relatively hard. As Elliptic Curve Cryptography system, we want attackers to encounter Elliptic Curve Discrete Logarithm Problem. Once the prime number is big enough, attackers will have trouble deciphering the key. Access control is so comprehensive, such as electronic documents, online television system sand wireless networks and so on, from previous literature; mobile agent technology applied in access control and key management would waste space and do exist some flaws in security, also we still have a lot of works to do on medical application. Hence, we propose these schemes in mobile agent in order to reach improvement, and then analyze of security and try to simulate what attackers will do. We conclude four common attacks: External Collective Attack, Internal Attack, Collusion Attacks and Equation Breaking Attack. As results, attackers are hard to decipher the key because of no relationship between each key and will face Elliptic Curve Discrete Logarithm Problem. We confirm that the proposed schemes can be more efficiently and safety to protect mobile agent.

Elliptic curve cryptography is a public key cryptosystem based on the elliptic curve discrete logarithm problem. The reason for the attractiveness of ECC is that there is no sub-exponential algorithm known to solve the elliptic curve discrete logarithm problem. This leads to lower memory requirements, lower computation requirements and higher security than other public key cryptosystems. This project describes an implementation of a micro coded elliptic curve processor using FPGA technology. This processor implements optimal normal basis field operations. The design is generated by a parameterized module generator which can accommodate arbitrary n and also produce field multipliers with different speed/area tradeoffs. The control part of the processor is micro coded, enabling curve operations to be incorporated into the processor hence reducing the chip's I/O requirements. The micro coded approach also facilitates rapid development and algorithmic optimization. for example, projective and affine coordinates were supported using different sets of micro codes. The design was successfully tested on a Xilinx Spartan -II kit device. Elliptic curve processor is particularly suitable for recourse limited devices because of its lower requirements of memory and computation. It is applicable to be implanted into smart cards, cellular phones and other hand-held devices so that secure communication can be provided. For based on implement the FPGA Using Verilog HDL.

Cryptanalysis and improvement of the Tzeng–Hwang authenticated encryption scheme based on elliptic curve discrete logarithm problem

A promising direction for constructing cryptographically stable pseudo-random sequence generators is an application of transformations in a group of points of elliptic and hypereliptic curves. This will allow building evidence-stable crypto algorithms, the problem of finding the private key in which is associated with solving a theoretically complex elliptic curve discrete logarithm problem. This paper proposes a method for generating pseudo-random sequences of the maximal period using transformations on elliptic curves. This method consists in the application of recurrent transformations with sequential formation of elements of points group of elliptic curves. This allows providing the maximum period of pseudo-random sequences with the reduction of the problem of finding the private key to the solution of the theoretically complex elliptic curve discrete logarithm problem. The block diagram of the device for generating pseudo-random sequences and the scheme for generating the internal states of the generator are given. We also present the results of statistical testing of some generators, which show that the generated sequences are indistinguishable in a statistical sense from truly random ones.KeywordsPseudo-random sequencesElliptic curvesMaximum period

There have been many digital signature schemes were developed based on the discrete logarithm problem on a finite field. In this study, we use the elliptic curve discrete logarithm problem to build new collective signature schemes. The cryptosystem on elliptic curve allows to generate digital signatures with the same level of security as other cryptosystems but with smaller keys. To extend practical applicability and enhance the security level of the group signature protocols, we propose two new types of collective digital signature schemes based on the discrete logarithm problem on the elliptic curve: i) the collective digital signature scheme shared by several signing groups and ii) the collective digital signature scheme shared by several signing groups and several individual signers. These two new types of collective signatures have combined the advantages of group digital signatures and collective digital signatures. These signatures have a fixed size and do not depend on the number of members participating in the creation of the final collective signature. One of the advantages of the proposed collective signature protocols is that they can be deployed on top of the available public key infrastructures.

Since Semaev introduced summation polynomials in 2004, a number of studies have been devoted to improving the index calculus method for solving the elliptic curve discrete logarithm problem (ECDLP) with better complexity than generic methods such as Pollard’s rho method and the baby-step and giant-step method (BSGS). In this paper, we provide a deep analysis of Gröbner basis computation for solving polynomial systems appearing in the point decomposition problem (PDP) in Semaev’s naive index calculus method. Our analysis relies on linear algebra under simple statistical assumptions on summation polynomials. We show that the ideal derived from PDP has a special structure and Gröbner basis computation for the ideal is regarded as an extension of the extended Euclidean algorithm. This enables us to obtain a lower bound on the cost of Gröbner basis computation. With the lower bound, we prove that the naive index calculus method cannot be more efficient than generic methods.