Scalable and Transparent Proofs over All Large Fields, via Elliptic Curves

For a vector space \({\mathbb{F}^n}\) over a field \(\mathbb{F}\), an (η, β)-dimension expander of degree d is a collection of d linear maps \({\Gamma _j}:{\mathbb{F}^n} \rightarrow {\mathbb{F}^n}\) such that for every subspace U of \({\mathbb{F}^n}\) of dimension at most ηn, the image of U under all the maps, ∑ dj=1 Γj(U), has dimension at least α dim(U). Over a finite field, a random collection of d = O(1) maps Γj offers excellent “lossless” expansion whp: β≈d for η ≥ Ω(1/d). When it comes to a family of explicit constructions (for growing n), however, achieving even modest expansion factor β = 1+ ε with constant degree is a non-trivial goal.We present an explicit construction of dimension expanders over finite fields based on linearized polynomials and subspace designs, drawing inspiration from recent progress on list decoding in the rank metric. Our approach yields the following: Lossless expansion over large fields; more precisely β ≥ (1 − ε)d and \(\eta \ge {{1 - \varepsilon} \over d}\) with d = Oε(1), when \(\left| \mathbb{F} \right| \ge \Omega \left(n \right)\). Optimal up to constant factors expansion over fields of arbitrarily small polynomial size; more precisely β ≥ Ω(δd) and η ≥ Ω(1/(δd)) with d = Oδ(1), when \(\left| \mathbb{F} \right| \ge {n^\delta}\). Previously, an approach reducing to monotone expanders (a form of vertex expansion that is highly non-trivial to establish) gave (Ω(1), 1 + Ω(1))-dimension expanders of constant degree over all fields. An approach based on “rank condensing via subspace designs” led to dimension expanders with \(\beta \mathbin{\lower.3ex\hbox{$\buildrel>\over {\smash{\scriptstyle\sim}\vphantom{_x}}$}} \sqrt d \) over large finite fields. Ours is the first construction to achieve lossless dimension expansion, or even expansion proportional to the degree.

In Chen-Cramer Crypto 2006 paper \cite{cc} algebraic geometric secret sharing schemes were proposed such that the Fundamental Theorem in Information-Theoretically Secure Multiparty Computation by Ben-Or, Goldwasser and Wigderson \cite{BGW88} and Chaum, Crepeau and Damgard \cite{CCD88} can be established over constant-size base finite fields. These algebraic geometric secret sharing schemes defined by a curve of genus $g$ over a constant size finite field ${\bf F}_q$ is quasi-threshold in the following sense, any subset of $u \leq T-1$ players (non qualified) has no information of the secret and any subset of $u \geq T+2g$ players (qualified) can reconstruct the secret. It is natural to ask that how far from the threshold these quasi-threshold secret sharing schemes are? How many subsets of $u \in [T, T+2g-1]$ players can recover the secret or have no information of the secret? In this paper it is proved that almost all subsets of $u \in [T,T+g-1]$ players have no information of the secret and almost all subsets of $u \in [T+g,T+2g-1]$ players can reconstruct the secret when the size $q$ goes to the infinity and the genus satisfies $\lim \frac{g}{\sqrt{q}}=0$. Then algebraic geometric secret sharing schemes over large finite fields are asymptotically threshold in this case. We also analyze the case when the size $q$ of the base field is fixed and the genus goes to the infinity.

A simple probabilistic algorithm is presented to find the irreducible factors of a bivariate polynomial over a large finite field. For a polynomial f ( x , y ) f(x,y) over F q {F_q} of total degree n , our algorithm takes at most \[ n 4.89 log 2 n log ⁡ q {n^{4.89}}{\log ^2}n\log q \] operations in F q {F_q} to factor f ( x , y ) f(x,y) completely. This improves a probabilistic factorization algorithm of von zur Gathen and Kaltofen, which takes \[ O ( n 11 log ⁡ n log ⁡ q ) O({n^{11}}\log n\log q) \] operations to factor f ( x , y ) f(x,y) completely over F q {F_q} . The algorithm can be easily generalized to factor multivariate polynomials over finite fields. We shall give two further applications of the idea involved in the algorithm. One is concerned with exponential sums; the other is related to permutational polynomials over finite fields (a conjecture of Chowla and Zassenhaus).

Recently S. D. Cohen resolved a conjecture of Chowla and Zassenhaus (1968) in the affirmative by showing that, if f ( x ) f(x) and g ( x ) g(x) are integral polynomials of degree n ≥ 2 n \geq 2 and p is a prime exceeding ( n 2 − 3 n + 4 ) 2 {({n^2} - 3n + 4)^2} for which f and g are both permutation polynomials of the finite field F p {F_p} , then their difference h = f − g h = f - g cannot be such that h ( x ) = c x h(x) = cx for some integer c not divisible by p. In this note we provide a significant generalization by proving that, if h is not a constant in F p {F_p} and t is the degree of h, then t ≥ 3 n / 5 t \geq 3n/5 and, provided t ≤ n − 3 t \leq n - 3 , t and n are not relatively prime. In a sense this measures the isolation of permutation polynomials of the same degree over large finite prime fields.

Cryptographic schemes, such as authentication, confidentiality, and integrity, rely on computations in very large finite fields, whose hardware realization may require millions of logic gates. In a straightforward design, even a single fault in such a complex circuit is likely to yield an incorrect result and may be exploited by an attacker to break the cryptosystem. In this regard, we consider computing over finite fields in presence of certain faults in multiplier circuits. Our work reported here deals with errors caused by such faults in polynomial basis multipliers over finite fields of characteristic two and presents a scheme to correct single errors. Towards this, pertinent theoretical results are derived, and both bit-parallel and bit-serial fault tolerant multipliers are proposed.

This paper reviews some of the known algorithms for factoring polynomials over finite fields and presents a new deterministic procedure for reducing the problem of factoring an arbitrary polynomial over the Galois field GF(p m) to the problem of finding the roots in GF(p) of certain other polynomials over GF(p). The amount of computation and the storage space required by these algorithms are algebraic in both the degree of the polynomial to be factored and the logarithm of the order of the finite field. Certain observations on the application of these methods to the factorization of polynomials over the rational integers are also included.

In this paper, we present a method to compute all the irreducible and primitive polynomials of degree m over a finite field. We also describe two concrete implementations of our method with respective time complexities O(m2 + m log m) and O(m2 + log m). These implementations, using in parallel different devices introduced to operate in these fields [1], [7], allows us to reduce the time complexity of our method below that of the best previously known methods [3]. Our algorithm is especially well-suited for applications using large finite fields.

Using the reduction theory of Nrron we give necessary conditions for the existence of points of order q on elliptic curves E rational over global fields. An application is the determination of all elliptic cu rves /Q with integer j and torsion points, generalizing Olson [8]. Another application is a theorem about semistable reduction whose consequences generalize a theorem of Olson [9] ( K = Q) and give divisibility conditions for the discriminant and the coefficients of E related with the paper of Zimmer [13] as well as diophantine equations related with Fermat's equation that are discussed for K Q and K a function field. We are interested in elliptic curves over global fields K (i.e. : K is a finite number field or K is a function field of one variable over a finite field) and especially in the torsion group of E(K), where E(K) is the group of K-rational points of E. It is well known that E(K) is finitely generated, it is conjectured that if K is a number field then the order of the torsion group of E(K) is bounded by some number depending only on K (cf. Demjanenko [1]). In any case in order to handle with E(K) the first step is to determine the torsion group. In principle this is not so difficult; if one uses the results of Lutz [6] and Zimmer [13], one sees immediately that for every E there exist points of q-power-order only for a finite number of primes q, as the equations for points of order q are known (in principle) one has only t ~ test what orders really occur. But as the computational work grows very rapidly with q it is usefull to look for sharper necessary conditions, and this shall be done in this paper.

The main topic of this thesis is related to the state of the art in designing cryptographic primitives from a hardware point of view. A special emphasis is dedicated to low-power/low-energy CMOS design. A set of solutions is proposed including an LFSR based stream cipher with self-synchronizing capabilities, a new memory-less Rijndael block cipher architecture and a public key scheme in the class of discrete logarithm. The former is based on arithmetic in large finite field, mainly Galois extension field GF(2‴). These solutions are droved using low-energy techniques, in order to decrease both the switching activity and the total delay. The fundamental motivation supporting this work, is to demonstrate that practical solutions can be obtained for implementing such complex primitives in large scaled circuits, that arc at once, high performance architectures (low-power, high-speed) and cryptographicaly strong, using the well known trade-off between area-speed or area-power. Security constraint has been duly considered, mainly by increasing the key-size. In this work, we explore the general aspects of designing the above mentioned cryptographic functions. We give an extensive survey of some cryptographic primitives from the hardware point of view and expose their security properties. The thesis favours stream cipher and public-key schemes, as currently the most promising advance to capture the notion of key generation and establishment and data bulk encryption. One contribution is the convenient notation for expressing cryptographic self-synchronizing stream ciphers SSSC schemes and our SSMG proposal, a scheme based on packet fingerprint identification, that relies on keyed cryptographic hash function to achieve the security requirements. We maintain an important distinction between hardware implementation and algorithm's security, because the security of cryptographic primitives cannot be based on mathematically strong functions only but requires an extensive cryptanalysis at different levels including the application. This causes a concern for a formalization of the security of an implemented cryptographic primitive. Nevertheless, while some schemes arc well known to be secure such as DL based public key schemes and enough cryptanalyzed such as the new standard Rijndael, some security aspects of the SSMG are discussed. A part of this work studies the specific aspects related to hardware implementation of Rijndael block cipher, the new standard designed to be a substitute for DES. An efficient architecture is developed targeting FPGA implementation, by simply avoiding memory blocks dedicated to the implementation of S-boxes and replacing them by on-chip forward computation using composite Galois field. This technique helps to reduce considerably the amount of hardware required at the cost of little increase of the switching activity. The main conclusion is that, while security constraint of cryptographic primitives increases the hardware complexity and reduces the performances, practical solutions exist for reducing such complexities while keeping or increasing the level of security. Nevertheless, major open questions remain both for a firm theoretical foundation and the proper cryptanalysis of certain solutions.

Abstruct- Elliptic cuwe cryptosystems have the potential to provide relatively small block size, high-security public key schemes that can be efficiently implemented. As with other known public key schemes, such as RSA and discrete exponentiation in a finite field, some care must be exercised when selecting the parameters involved, in this case the elliptic curve and the underlying field. Specific classes of cuwes that give little or no advantage over previously known schemes are discussed. The main result of the paper is to demonstrate the reduction of the elliptic curve logarithm problem to the logarithm problem in the multiplicative group of an extension of the underlying finite field. For the class of supersingular elliptic curves, the reduction takes probabilistic polynomial time, thus providing a probabilistic subexponential time algorithm for the former problem. Index Tem- Discrete logarithms, elliptic curves, public key CryPtOSraPhY.

Following the idea of Xing et al., we investigate a general method for constructing families of pseudorandom sequences with low correlation and large linear complexity from elliptic curves over finite fields in this correspondence. With the help of the tool of exponential sums on elliptic curves, we study their periods, linear complexities, linear complexity profiles, distributions of r-patterns, periodic correlation, partial period distributions, and aperiodic correlation in detail. The results show that they have nice randomness.

We analyze precisely the parameters entering the sliding window powering method, and apply this to the case of an elliptic curve over a large finite prime field.

Let F3d be a finite field of order 3d with d∈ N*. In this paper, we study the elliptic curve over the finite ring F3d[ε] :=F3d[X] / (X4 -X3), where ε4 = ε3 of characteristic 3 given by the homogeneous Weierstrass equation of the form Y2Z = X3 + aX2Z + bZ3, where a, b ∈F3d[ε], such that we study the arithmetic operations of this ring and define the elliptic curve over it. Next, we show that EΠ0(a), Π0(b)(F3d) and EΠ1(a), Π1(b)(F3d) are two elliptic curves over the finite field F3d, such that Π0 is a canonical projection and Π1 is a sum projection of coordinate of element in F3d[ε] and we conclude by given a classification of elements in elliptic curve over the finite ring F3d[ε].

We show that finding an efficiently computable injective homomorphism from the XTR subgroup into the group of points over GF(p2) of a particular type of supersingular elliptic curve is at least as hard as solving the Diffie–Hellman problem in the XTR subgroup. This provides strong evidence for a negative answer to the question posed by Vanstone and Menezes at the Crypto 2000 Rump Session on the possibility of efficiently inverting the MOV embedding into the XTR subgroup. As a side result we show that the Decision Diffie–Hellman problem in the group of points on this type of supersingular elliptic curves is efficiently computable, which provides an example of a group where the Decision Diffie–Hellman problem is simple, while the Diffie–Hellman and discrete logarithm problems are presumably not. So-called distortion maps on groups of points on elliptic curves that play an important role in our cryptanalysis also lead to cryptographic applications of independent interest. These applications are an improvement of Joux’s one round protocol for tripartite Diffie–Hellman key exchange and a non-refutable digital signature scheme that supports escrowable encryption. We also discuss the applicability of our methods to general elliptic curves defined over finite fields which includes a classification of elliptic curve groups where distortion maps exist.

Index form surfaces and construction of elliptic curves over large finite fields