Solving Elliptic Curve Discrete Logarithm Problem on Twisted Edwards Curves Using Quantum Annealing and Index Calculus Method

Elliptic curves cryptography was introduced independently by Victor Miller (Miller, 1986) and Neal Koblitz (Koblitz, 1987(Koblitz, ) in 1985. .At that time elliptic curve cryptography was not actually seen as a promising cryptographic technique.As time progress and further research and intensive development done especially on the implementation side, elliptic curve cryptography is now being implemented widely.Elliptic curves cryptography offers smaller key size, bandwidth savings and faster in implementations when compared to the RSA (Rivest-Shamir-Adleman) cryptography which based its security on the integer factorization problem.The most interesting feature of the elliptic curves is the group structure of the points generated by the curves, where points on the elliptic curves form a group.The security of elliptic curves cryptography relies on the elliptic curves discrete logarithm problem.The elliptic curve discrete logarithm problem is analogous to the ordinary algebraic discrete logarithm problem, l = g x , where given the l and g, it is infeasible to compute the x.Elliptic curve discrete logarithm problem deals with solving for n the relation P = nG.Given the point P and the point G, then it is very hard to find the integer n.To implement the discrete logarithm problem in elliptic curve cryptography, the main task is to compute the order of group of the curves or in other words the number of points on the curve.Computation to find the number of points on a curve, has given rise to several point counting algorithms.The Schoof and the SEA (Schoof-Elkies-Atkin) point counting algorithms will be part of the discussion in this chapter.This chapter is organized as follows: Section 2, gives some preliminaries on elliptic curves, and in section 3, elliptic curve discrete logarithm problem is discussed.Some relevant issues on elliptic curve cryptography is discussed in section 4, in which the Diffie-Hellman key exchange scheme, ElGamal elliptic curve cryptosystem and elliptic curve digital signature scheme are discussed here accompanied with some examples.Section 5 discussed the two point counting algorithms, Schoof algorithm and the SEA (Schoof-Elkies-Atkin) algorithm.Following the discussion in section 5, section 6 summaries some similarities and the differences between these two algorithms.Section 7 gives some brief literature on these two point counting algorithms.Finally, section 8 is the concluding remarks for this chapter. Elliptic curvesElliptic curves obtained their name from their relation to elliptic integrals that arise from the computation of the arc length of ellipses (Lawrence & Wade, 2006).Elliptic curves are www.intechopen.com Cryptography and Security in Computing1 1 2 3 4 2 2 4 Fig. 1.1. 2(1 ) (1 ) yx x x   www.intechopen.com

The discrete logarithm problem with auxiliary inputs (DLP-wAI) is a special discrete logarithm problem. Cheon first proposed a novel algorithm to solve the discrete logarithm problem with auxiliary inputs. Given a cyclic group $${\mathbb {G}}=\langle P\rangle $$G=?P? of order p and some elements $$P,\alpha P,\alpha ^2 P,\ldots , \alpha ^d P\in {\mathbb {G}}$$P,?P,?2P,?,?dP?G, an attacker can recover $$\alpha \in {\mathbb {Z}}_p^*$$??Zp? in the case of $$d|(p\pm 1)$$d|(p±1) with running time of $${\mathcal {O}}(\sqrt{(p\pm 1)/d}+d^i)$$O((p±1)/d+di) group operations by using $${\mathcal {O}}(\text {max}\{\sqrt{(p\pm 1)/d}, \sqrt{d}\})$$O(max{(p±1)/d,d}) storage ($$i=\frac{1}{2}$$i=12 or 1 for $$d|(p-1)$$d|(p-1) case or $$d|(p+1)$$d|(p+1) case, respectively). In this paper, we propose a new algorithm to solve another form of elliptic curve discrete logarithm problem with auxiliary inputs (ECDLP-wAI). We show that if some points $$P,\alpha P,\alpha ^k P,\alpha ^{k^2} P,\alpha ^{k^3} P,\ldots ,\alpha ^{k^{\varphi (d)-1}}P\in {\mathbb {G}}$$P,?P,?kP,?k2P,?k3P,?,?k?(d)-1P?G and multiplicative cyclic group $$K=\langle k \rangle $$K=?k? are given, where d is a prime, $$\varphi (d)$$?(d) is the order of K and $$\varphi $$? is the Euler totient function, the secret key $$\alpha \in {\mathbb {Z}}_p^*$$??Zp? can be solved in $${\mathcal {O}}(\sqrt{(p-1)/d}+d)$$O((p-1)/d+d) group operations by using $${\mathcal {O}}(\sqrt{(p-1)/d})$$O((p-1)/d) storage.

In 2008 and 2009, Gaudry and Diem proposed an index calculus method for the resolution of the discrete logarithm on the group of points of an elliptic curve defined over a small degree extension field $\mathbb{F}_{q^{n}}$ . In this paper, we study a variation of this index calculus method, improving the overall asymptotic complexity when $n = \varOmega(\sqrt [3]{\log_{2} q})$ . In particular, we are able to successfully obtain relations on $E(\mathbb{F}_{q^{5}})$ , whereas the more expensive computational complexity of Gaudry and Diem's initial algorithm makes it impractical in this case. An important ingredient of this result is a variation of Faugere's Grobner basis algorithm F4, which significantly speeds up the relation computation. We show how this index calculus also applies to oracle-assisted resolutions of the static Diffie---Hellman problem on these elliptic curves.

Since Semaev introduced summation polynomials in 2004, a number of studies have been devoted to improving the index calculus method for solving the elliptic curve discrete logarithm problem (ECDLP) with better complexity than generic methods such as Pollard’s rho method and the baby-step and giant-step method (BSGS). In this paper, we provide a deep analysis of Gröbner basis computation for solving polynomial systems appearing in the point decomposition problem (PDP) in Semaev’s naive index calculus method. Our analysis relies on linear algebra under simple statistical assumptions on summation polynomials. We show that the ideal derived from PDP has a special structure and Gröbner basis computation for the ideal is regarded as an extension of the extended Euclidean algorithm. This enables us to obtain a lower bound on the cost of Gröbner basis computation. With the lower bound, we prove that the naive index calculus method cannot be more efficient than generic methods.

This paper investigates how to reduce the elliptic curve discrete logarithm problem over prime fields to the quadratic unconstrained binary optimization (QUBO) problem in order to obtain as few logical qubits as possible. In the best case scenario, if n is the bitlength of a characteristic of prime field Fp, approximately 3n³ logical qubits are required for such a reduction in the Edwards curve case. We present a practical attack on an elliptic curve discrete logarithm problem over the 3-bit prime field F7 for an elliptic curve with the subgroup of order 8. We solved this problem using the D-Wave Advantage QPU. To the best of the authors' knowledge, no one has made, so far, a practical attack on the elliptic curve discrete logarithm over a prime field using the direct quantum method.

Quantum computations are very important branch of modern cryptology. According to the number of working physical qubits available in general-purpose quantum computers and in quantum annealers, there is no coincidence, that nowadays quantum annealers allow to solve larger problems. In this paper we focus on solving discrete logarithm problem (DLP) over binary fields using quantum annealing. It is worth to note, that however solving DLP over prime fields using quantum annealing has been considered before, no author, until now, has considered DLP over binary fields using quantum annealing. Therefore, in this paper, we aim to bridge this gap. We present a polynomial transformation of the discrete logarithm problem over binary fields to the Quadratic Unconstrained Binary Optimization (QUBO) problem, using approximately 3n2 logical variables for the binary field F2n. In our estimations, we assume the existence of an optimal normal base in the given fields. Such a QUBO instance can then be solved using quantum annealing.

There have been many digital signature schemes were developed based on the discrete logarithm problem on a finite field. In this study, we use the elliptic curve discrete logarithm problem to build new collective signature schemes. The cryptosystem on elliptic curve allows to generate digital signatures with the same level of security as other cryptosystems but with smaller keys. To extend practical applicability and enhance the security level of the group signature protocols, we propose two new types of collective digital signature schemes based on the discrete logarithm problem on the elliptic curve: i) the collective digital signature scheme shared by several signing groups and ii) the collective digital signature scheme shared by several signing groups and several individual signers. These two new types of collective signatures have combined the advantages of group digital signatures and collective digital signatures. These signatures have a fixed size and do not depend on the number of members participating in the creation of the final collective signature. One of the advantages of the proposed collective signature protocols is that they can be deployed on top of the available public key infrastructures.

A new anonymous conference key distribution system based on the elliptic curve discrete logarithm problem

The elliptic curve discrete logarithm problem is considered a secure cryptographic primitive. The purpose of this paper is to propose a paradigm shift in attacking the elliptic curve discrete logarithm problem. In this paper, we will argue that initial minors are a viable way to solve this problem. This paper will present necessary algorithms for this attack. We have written a code to verify the conjecture of initial minors using Schur complements. We were able to solve the problem for groups of order up to $2^{50}$.

Wireless Sensor Networks (WSNs) pose a number of unique security challenges that demand innovation in several areas including the design of cryptographic primitives and protocols. Despite recent progress, the efficient implementation of Elliptic Curve Cryptography (ECC) for WSNs is still a very active research topic and techniques to further reduce the time and energy cost of ECC are eagerly sought. This paper presents an optimized ECC implementation that we developed from scratch to comply with the severe resource constraints of 8-bit sensor nodes such as the MICAz and IRIS motes. Our ECC software uses Optimal Prime Fields (OPFs) as underlying algebraic structure and supports two different families of elliptic curves, namely Weierstraß-form and twisted Edwards-form curves. Due to the combination of efficient field arithmetic and fast group operations, we achieve an execution time of 5.8 · 106 clock cycles for a full 158-bit scalar multiplication on an 8-bit ATmega128 micro-controller, which is 2.78 times faster than the widely-used TinyECC library. Our implementation also shows that the energy cost of scalar multiplication on a MICAz (or IRIS) mote amounts to just 19~mJ when using a twisted Edwards curve over a 160-bit OPF. This result compares fairly well with the energy figures of two recently-presented hardware designs of ECC based on twisted Edwards curves.

Elliptic curve cryptography was invented by Neal Koblitz and Victor Miller in 1985. However, for many years its security was viewed with suspicion by cryptographers. These fears were not entirely meritless, especially in light of the subsequent (and ongoing) development of innovative algorithms for solving special instances of the elliptic curve discrete logarithm problem (ECDLP) and the discrete logarithm problem in the divisor class groups of other families of algebraic curves. Surprisingly, cryptographers seem to have cast aside their fears after the invention of pairing-based cryptography in 2000. I will overview progress made on algorithms for solving the ECDLP and related problems, and will examine the long and curious struggle for ECC acceptance.

The elliptic curve discrete logarithm problem is one of the most important problems in cryptography. In recent years, several index calculus algorithms have been introduced for elliptic curves defined over extension fields, but the most important curves in practice, defined over prime fields, have so far appeared immune to these attacks. In this paper we formally generalize previous attacks from binary curves to prime curves. We study the efficiency of our algorithms with computer experiments and we discuss their current and potential impact on elliptic curve standards. Our algorithms are only practical for small parameters at the moment and their asymptotic analysis is limited by our understanding of Grobner basis algorithms. Nevertheless, they highlight a potential vulnerability on prime curves which our community needs to explore further.

An addition law for an elliptic curve is complete if it is defined for all possible pairs of input points on the elliptic curve. In Elliptic Curve Cryptography (ECC), a complete addition law provides a natural protection against side-channel attacks which are based on Simple Power Analysis (SPA). Montgomery curves are a specific family of elliptic curves that play a crucial role in ECC because of its well-known Montgomery ladder, particularly in the Elliptic Curve Diffie-Hellman Key Exchange (ECDHKE) protocol and the Elliptic Curve factorization Method (ECM). However, the complete addition law for Montgomery curves, as stated in the literature, has a computational cost of 14M+ 2D, where M,D denote the costs of a field multiplication and a field multiplication by a constant, respectively. The lack of a competitive complete addition law has led implementers towards twisted Edwards curves, which offer a complete addition law at a lower cost of 8M+ 1D for appropriately chosen curve constants.In this paper, we introduce extended Montgomery coordinates as a novel representation for points on Montgomery curves. This coordinate system enables us to define birational multiplication-free maps between the extended twisted Edwards coordinates and extended Montgomery coordinates. Using this map, we can transfer the complete addition laws from twisted Edwards curves to Montgomery curves without incurring additional multiplications or squarings. In addition, we employ a technique known as scaling to refine the addition laws for twisted Edwards curves, which results in having i) Complete addition laws with the costs varying between 8M+1D and 9M+1D for a broader range of twisted Edwards curves, ii) Incomplete addition laws for twisted Edwards curves with the cost of 8M. Consequently, by leveraging our birational multiplication-free maps, we present complete addition laws for Montgomery curves with the cost of 8M+1D. This shows a significant improvement for complete addition law for Montgomery curves by reducing the computational cost by 6M+ 1D. This improvement makes Montgomery curves a more attractive option for applications where an efficient complete addition law is essential.

This paper examines the cryptographic security of fixed versus random elliptic curves over the field GF(p). Its basic assumption is that a large precomputation to aid in breaking the elliptic curve discrete logarithm problem (ECDLP) can be made for a fixed curve. We take this into account when examining curve security as well as considering a variation of Pollard's rho method where computations from solutions of previous ECDLPs can be used to solve subsequent ECDLPs on the same curve. We present a lower bound on the expected time to solve such ECDLPs using this method, as well as an approximation of the expected time remaining to solve an ECDLP when a given size of precomputation is available. We conclude that adding 5 bits to the size of a fixed curve to avoid general software attacks and an extra 6 bits to avoid attacks on special moduli and a parameters provides an equivalent level of security.

A pairing over an elliptic curve E(F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pm</sub> ) to an extension field of F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pmk</sub> has begun to be attractive in cryptosystems, where k is called the embedding degree. The cryptosystems using a pairing are called the pairing-based cryptosystems. The embedding degree k is also an indicator of the relationship between the elliptic curve discrete logarithm problem (ECDLP) and the discrete logarithm problem (DLP), where ECDLP over E(F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pm</sub> ) is reduced to DLP over F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pmk</sub> . An elliptic curve is determined by j-invarient or order, however the explicit condition between these parameters and an embedding degree has been described only in some degrees. In this paper, we investigate a new condition of the existence of elliptic curves with pre-determined embedding degrees, and present some examples of the elliptic curves over 160-bit, 192-bit and 224-bit F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pm</sub> .