FR3097093A1 - Procédé et dispositif de calcul sur courbes elliptiques par des dispositifs à ressources limitées - Google Patents

Procédé et dispositif de calcul sur courbes elliptiques par des dispositifs à ressources limitées Download PDF

Info

Publication number
FR3097093A1
FR3097093A1 FR1906089A FR1906089A FR3097093A1 FR 3097093 A1 FR3097093 A1 FR 3097093A1 FR 1906089 A FR1906089 A FR 1906089A FR 1906089 A FR1906089 A FR 1906089A FR 3097093 A1 FR3097093 A1 FR 3097093A1
Authority
FR
France
Prior art keywords
elliptic curve
point
twisted
over
quadratic
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
FR1906089A
Other languages
English (en)
Inventor
Giulio Follero
Rosario BOSCO
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
STMicroelectronics SRL
Original Assignee
STMicroelectronics SRL
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by STMicroelectronics SRL filed Critical STMicroelectronics SRL
Priority to FR1906089A priority Critical patent/FR3097093A1/fr
Priority to US16/890,801 priority patent/US11502835B2/en
Priority to EP20178130.9A priority patent/EP3748611B1/fr
Publication of FR3097093A1 publication Critical patent/FR3097093A1/fr
Pending legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G09—EDUCATION; CRYPTOGRAPHY; DISPLAY; ADVERTISING; SEALS
    • G09C—CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY
    • G09C1/00—Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/10—Complex mathematical operations
    • G06F17/11—Complex mathematical operations for solving equations, e.g. nonlinear equations, general mathematical optimization problems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F7/00—Methods or arrangements for processing data by operating upon the order or content of the data handled
    • G06F7/60—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
    • G06F7/72—Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
    • G06F7/724—Finite field arithmetic
    • G06F7/725—Finite field arithmetic over elliptic curves
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H04L9/0841—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H04L9/3066—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/08—Randomization, e.g. dummy operations or using noise
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/76—Proxy, i.e. using intermediary entity to perform cryptographic operations

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Pure & Applied Mathematics (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Physics (AREA)
  • Mathematical Optimization (AREA)
  • Computational Mathematics (AREA)
  • Computing Systems (AREA)
  • Algebra (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Operations Research (AREA)
  • Databases & Information Systems (AREA)
  • Software Systems (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Optical Communication System (AREA)
  • Storage Device Security (AREA)

Abstract

Procédé et dispositif de calcul sur courbes elliptiques par des dispositifs à ressources limitées La présente invention concerne un procédé de calcul cryptographique sur des courbes elliptiques comprenant : la torsion, par un premier dispositif à partir d’un indice de torsion quadratique ou d’ordre supérieur (d), d’un premier point (P’KB) d’une première courbe elliptique sur une autre courbe elliptique tordue par rapport à la première courbe elliptique pour produire une clé tordue (PKB) ; la transmission de la clé tordue (PKB) à un autre dispositif ; la réception, en provenance de l'autre dispositif, d’une valeur de retour (ShS) à partir de la clé tordue (PKB) ; et la torsion, par le premier dispositif à partir du premier indice de torsion quadratique ou d’ordre supérieur (d), de la valeur de retour (ShS) sur la première courbe elliptique pour produire un résultat (ShS’) du calcul d’ECC. Figure pour l’Abrégé : Fig. 3

Description

Method and device for elliptic curve computations by low resource devices
The present disclosure relates generally to the field of cryptography, and in particular to a method and device for performing elliptic curve cryptography.
Elliptic curve cryptography (ECC) is used for a variety of cryptographic tasks, including for key generation/agreement and signature generation and verification. An advantage of ECC over non-elliptic curve cryptography is that a far smaller key can provide equivalent security.
However, such ECC tasks generally involve relatively complex computations, which, for computational efficiency, are generally performed by a dedicated cryptographic coprocessor.
In some applications, it would be desirable to allow devices with relatively low levels of processing resources, and in particular devices that do not include a dedicated cryptographic coprocessor, to benefit from the advantages of ECC. However, there are technical difficulties in providing such a solution while maintaining security among the actors involved in the system.
According to one aspect, there is provided a method of performing an elliptic curve cryptography computation comprising: twisting, by a first device based on a first index of quadratic or higher order twist, a first point on a first elliptic curve over a further elliptic curve twisted with respect to the first elliptic curve to generate a twisted key; transmitting the twisted key to a further device; receiving, from the further device, a return value generated based on the twisted key; and twisting, by the first device based on the first index of quadratic or higher order twist, the return value over the first elliptic curve to generate a result of the ECC computation.
According to one embodiment, the first variable is not communicated to the further device.
According to one embodiment, the first point on the first elliptic curve is a public key of a second device.
According to one embodiment, the return value is a point on the further elliptic curve.
According to one embodiment, the first point on the first elliptic curve is a point of the further elliptic curve that has been twisted over the first elliptic curve based on the first index of quadratic or higher order twist.
According to one embodiment, the further elliptic curve is of the form:
where a2, a4and a6are elements of a finite field over which the further elliptic curve is defined, and wherein the first elliptic curve is defined over an extension of the finite field, the first elliptic curve being isomorphic to the further elliptic curve over an algebraic closure of the finite field.
According to one embodiment, the first elliptic curve is of the form:
where d is the index of quadratic or higher order twist, which is a non-zero element of the finite field.
According to one embodiment, the further elliptic curve is of the form:
where the coefficients a and b are elements of the finite field FP, and where:
According to one embodiment, the first elliptic curve is of the form:
where
According to one embodiment, twisting the first point on the first elliptic curve over the further elliptic curve involves determining a point H, corresponding to the first point (P’KB), as follows:
According to a further aspect, there is provided a method of generating a shared secret between first and second devices comprising: - implementing the above method, wherein the twisted key is transmitted to the further device along with a private key, the return value corresponding to the shared secret.
According to one embodiment, the method further comprises, prior to twisting the first point on the first elliptic curve, transmitting to a second device the index of quadratic or higher order twist, wherein the first point on the first elliptic curve corresponds to an original public key of the second device twisted over the first elliptic curve based on the index of quadratic or higher order twist.
According to one embodiment, the method further comprises, prior to twisting the first point on the first elliptic curve: twisting, by the first device based on the index of quadratic or higher order twist, a further point over the first elliptic curve to generate a public key of the first device; and transmitting the public key of the first device to the second device.
The foregoing features and advantages, as well as others, will be described in detail in the following description of specific embodiments given by way of illustration and not limitation with reference to the accompanying drawings, in which:
Figure 1 schematically illustrates a device with cryptographic coprocessor according to an example embodiment;
Figure 2 schematically illustrates a system in which an ECC computation is performed according to a non-optimal approach;
Figure 3 illustrates the execution of an ECC computation according to an example embodiment of the present disclosure; and
Figure 4 is a flow diagram illustrating operations in a method of implementing an ECC commutation according to an example embodiment of the present disclosure.
Like features have been designated by like references in the various figures. In particular, the structural and/or functional features that are common among the various embodiments may have the same references and may dispose identical structural, dimensional and material properties.
For the sake of clarity, only the operations and elements that are useful for an understanding of the embodiments described herein have been illustrated and described in detail. For example, techniques for key agreement based on ECC, involving the computation of a shared secret based on a private key and on the public key of a third party, are well know by those skilled in the art and will not be described in detail.
Unless indicated otherwise, when reference is made to two elements connected together, this signifies a direct connection without any intermediate elements other than conductors, and when reference is made to two elements linked or coupled together, this signifies that these two elements can be connected or they can be linked or coupled via one or more other elements.
Unless specified otherwise, the expressions "around", "approximately", “substantially” and "in the order of" signify within 10 %, and preferably within 5 %.
Figure 1 schematically illustrates a device 100 configured for performing ECC computations according to an example embodiment.
The device 100 for example comprises a main processor (MAIN PROCESSOR) 102, which is for example a host processor of the device 100, and a cryptographic coprocessor (CRYPTOGRAPHIC COPROCESSOR) 104. The device 100 further comprises a memory (MEMORY) 106 storing instructions (INSTRUCTIONS) 108 for controlling the main processor 102 and coprocessor 104. A communications interface (COMMS INTERFACE) 110 is for example coupled to the main processor 102, and for example permits wireless communications via a wireless communications network, and/or wired communications, for example over a LAN (Local Area Network – not illustrated).
The device 100, and in particular the cryptographic coprocessor 104, is for example capable of performing ECC computations such as generating a shared secret, for example based on ECDH (Elliptic Curve Diffie-Hellman) and/or a cryptographic signature generation and/or verification, for example based on ECDSA (Elliptic Curve Digital Signature Algorithm).
Figure 2 schematically illustrates a system 200 in which a cryptographic task, and in particular an ECC computation, is executed according to a non-optimal approach.
Figure 2 illustrates three devices 202, 204, 206, corresponding respectively to parties ALICE, BOB and CHARLIE. Charlie and Bob’s devices 204 and 206 are for example devices similar or identical to the device 100 of Figure 1, and are thus capable of executing EEC computations. Alice’s device 202 is, however, a device having relatively low computational resources. For example, this device 202 is similar to the device 100 of Figure 1 in that it comprises the main processor 102, memory 106 and communications interface 110, but it does not have a cryptographic coprocessor 104.
In some embodiments, the device 202 could be an embedded secure element forming part of a mobile communications device and having no integrated cryptographic coprocessor. For example, the device 202 could be an eUICC (embedded Universal Integrated Circuit Card). Alternatively, the device 202 could form part of a mobile IoT (Internet of Things) device, such as a sensor or the like. ECC computations using the device 202, such as key generation/agreement, ECDH (Elliptic Curves Deffie-Hellman), and signature generation/verification, are for example inefficient in terms of processing time and power, or even impossible to implement.
Alice and Bob each have a corresponding public/private key pair, in particular the public key PKA and private key SKA in the case of Alice, and the public key PKB and private key SKB in the case of Bob. They for example wish to establish a shared secret ShS, which can be used, for example, to establish a key for symmetric encryption.
Alice and Bob exchange their public keys PKA, PKB. Bob is thus able to derive a shared secret (DERIVED SHARED SECRET) based on his private key SKB and Alice’s public key PKA. However, Alice does not have processing resources permitting her to derive, in an efficient manner, the same shared secret based on her private key SKA and Bob’s public key PKB.
A solution could be for Alice to rely on a third party, Charlie, to compute the shared secret ShS. Charlies is for example a trusted entity for Alice, and therefore Alice for example transmits to Charlie her private key SKA. However, if Alice also transmits to Charlie the public key PKB of Bob, then, from Bob’s viewpoint, the security would be compromised, as Charlie would know Alice’s public/private key pair. This situation is therefore non-optimal for cases in which Charlie is not a trusted third party for Bob. Furthermore, each of the actors Alice and Bob should have one, and only one, secret key SKA, SKB associated with their public key.
Figure 3 illustrates a method of executing a cryptographic task according to an example embodiment of the present disclosure.
As with the example of Figure 2, the method of Figure 3 for example involves an exchange of public keys between Alice and Bob, without sharing their private keys. However, rather than Alice and Bob exchanging their original public keys PKA, PKB, in the example of Figure 4, Alice and Bob exchange twisted public keys P’KA, P’KB, that are generated based on a quadratic or higher order twist. For example, Alice applies a function Twist(PKA,d) to generate a twisted public key P’KA, and Bob applies a function Twist(PKB,d) to generate a twisted public key P’KB. In some embodiments, the parameter d is generated by Alice, for example randomly or pseudo randomly, and transmitted to Bob so that Bob can apply the same quadratic or higher order twist as Alice. In alternative embodiments, the parameter d could be generated by Bob, for example randomly or pseudo randomly, and transmitted to Alice so that Alice can apply the same quadratic or higher order twist as Bob.
As known by those skilled in the art, an ECC method applied between Alice and Bob for example involves defining a common elliptic curve E defined over a finite field Fp, wherein p is a prime number specifying the size of the finite field. The elliptic curve E for example has the form (eq. 1): where the coefficients a2, a4and a6are elements of the finite field FP. In the case of the short Weierstrass form, the elliptic curve E for example has the form (eq. 2): where the coefficients a and b are elements of the finite field FP, where:
However, the Weierstrass and short Weierstrass forms are merely two examples of ways of describing the curve. Those skilled in the art will understand that there are many other forms for writing an elliptic curve, e.g. the Legendre form, and the embodiments described herein are not limited to any particular form.
As also known by those skilled in the art, an elliptic curve E can be defined by the following parameters:
- the prime p specifying the size of the finite field;
- the coefficients of the elliptic curve equation, such as the coefficients a2, a4and a6of the equation eq.1 above, or the coefficients a and b of the equation eq.2 above;
- a base point G on the curve that generates the selected subgroup;
- the order n of the subgroup; and
- the cofactor h of the subgroup.
The private keys SKA, SKB of Alice and Bob each for example correspond to a random integer r chosen from the group {1,…,n-1}, where n is the order of the subgroup.
The original public keys PKA, PKB for example correspond to points H=(x,y)=rG on the curve, where G is the base point of the subgroup, and rG corresponds to a scalar multiplication of r and G, modulo p.
Twisting an elliptic curve E corresponds for example to a rotation of the elliptic curve E, resulting in another curve E’, which is isomorphic to E over the algebraic closure of Fp.
As an example, the quadratic twist of the curve of eq. 1 above could be as follows:
defined over the extension: of the field Fp.
In the case that the elliptic curve E has the short Weierstrass form, applying a quadratic twist to a public key based on a variable d for example involves a substitution of x and y by x’ and y’ respectively such that the curve becomes:
where (eqs. 3)
The equations eqs. 3 above can for example be found in section 2.1 of the publication entitled “Twisting an elliptic curve to speed up cryptographic algorithms”, by Burkhard Englert, Darin Goldstein and Will Murray (2005), the contents of which is hereby incorporated by reference to the extent permitted by the law.
Thus, applying a quadratic twist to a public key based on a parameter d corresponds to twisting a point H=(x,y) on the original elliptic curve E over a further curve that is twisted based on an index of quadratic twist d. The equations that convert the original point H=(x,y) to the twisted value H’ are then as follows:
Referring again to Figure 3, Bob is for example able to compute a shared secret ShS’ based on Alice’s twisted public key P’KA and his private key SKB. In some embodiments, this involves a scalar multiplication rBHA’, where rBis the random integer corresponding to Charlie’s private key, and HA’ is the point on the twisted elliptic curve E’ corresponding to Alice’s public key. The shared secret ShS’ is thus for example a point on the twisted elliptic curve E’.
Alice for example relies on Charlie for part of the generation of the shared secret. Before doing so, Alice for example twists the public key P’KB, provided by Bob, over the untwisted elliptic curve E. For example, this involves applying a function Twist’(P’KB,d) to Bob’s public key P’KB, where this twisting operation is for example the reverse of the operation applied by Bob to his original public key PKB, and thus results in regenerating Bob’s original public key PKB.
An example of the equations that convert the twisted point H’ back to the original point H is:
Alice then for example transmits Bob’s public key PKB, and her private key SKA, to the device 206 of Charlie. In some embodiments, Alice and Bob have a pre-shared further key, based on which they are able to communicate over a secure channel using symmetric or asymmetric cryptography. However, Charlie is not a trusted actor for Bob, and so Bob and Charlie do not for example exchange information without passing via Alice.
Charlie is then for example able to compute a shared secret ShS based on Bob’s public key PKB and Alice’s private key SKA. In some embodiments, this involves a scalar multiplication rAHB, where rAis the random integer corresponding to Alice’s private key, and HBis the point on the untwisted elliptic curve E corresponding to Bob’s public key.
Alice then for example receives the shared secret ShS, and computes the shared secret ShS’ by twisting the value ShS over the twisted elliptic curve E’. For example, this involves applying a function Twist(ShS,d) to the result ShS.
Figure 4 is a flow diagram illustrating operations in a method of executing a cryptographic task according to an example embodiment of the present disclosure. This method is for example implemented by the main processor 102 of the device 202 of Figure 2.
In an operation 401 of Figure 4, the device 202 twists a point on a shared elliptic curve over a twisted elliptic curve based on an index of quadratic or higher order twist d. The shared elliptic curve is the elliptic curve based on which public keys have been generated and exchanged. For example, in the embodiment of Figure 3, the shared elliptic curve is the twisted curve E’, and the device 202 of Alice receives the public key P’KB of Bob corresponding to a point on the curve E’, and twists this point over the elliptic curve E. Just as the curve E’ can be said to be twisted with respect to the curve E, the inverse is also true, the curve E being twisted with respect to the curve E’ based on the index d.
In an operation 402, the twisted point is transmitted to a further device, such as to the device 206 of Charlie. In some cases, the communications between Alice and Charlie are at least partially via a wireless network, although in alternative embodiments the communications could be entirely over one or more wired connections. The further device 206 is capable of performing EEC commutations, and for example generates the shared secret ShS in the embodiment of Figure 3.
In an operation 403, the device 202 of Alice receives a return value from the further device 206, corresponding to the shared secret ShS in the embodiment of Figure 3. This return value for example corresponds to a point on the “twisted” curve E.
In an operation 404, the device 202 of Alice twists the return value over the shared elliptic curve to generate the result of the ECC commutation. For example, in some embodiments, the result is a secret shared between Alice and Bob corresponding to a point on the shared twisted elliptic curve. This shared secret can for example be used as a basis for symmetric encryption between Alice and Bob. For example, the x coordinate of the point corresponding to the shared secret can be used as the secret key for the symmetric encryption, or the secret key for the symmetric encryption can be derived based, in part, on this x coordinate.
An advantage of the embodiments described herein is that the index d of quadratic or higher order twist is used as a further secret not known to Charlie, and thus enables Alice to delegate part of the ECC computation to Charlie without disclosing the public key/private key pair used between Alice and Bob. In the embodiment of Figure 3, the index d becomes a shared secret between Alice and Bob.
Various embodiments and variants have been described. Those skilled in the art will understand that certain features of these embodiments can be combined and other variants will readily occur to those skilled in the art. For example, while some specific examples of quadratic twists have been described, it will be apparent to those skilled in the art that there are other types of quadratic twist that could be employed. Furthermore, it will be apparent to those skilled in the art that high order twists could also be used, such as cubic or quartic twists. Indeed, any linear twist transformation that preserves the group operation can for example be used.
Furthermore, while embodiments relating to key agreement have been described, it will be apparent to those skilled in the art that the principles described herein could be applied to any ECC computations based on one or more points of an elliptic curve.
Finally, the practical implementation of the embodiments and variants described herein is within the capabilities of those skilled in the art based on the functional description provided hereinabove. For example, the implementation of operations such as point addition and scalar multiplication in the field of ECC are well known to those skilled in the art.

Claims (13)

  1. A method of performing an elliptic curve cryptography (ECC) computation comprising:
    - twisting, by a first device (202) based on a first index of quadratic or higher order twist (d), a first point (P’KB) on a first elliptic curve (E’) over a further elliptic curve (E) twisted with respect to the first elliptic curve to generate a twisted key (PKB);
    - transmitting the twisted key (PKB) to a further device (206);
    - receiving, from the further device (206), a return value (ShS) generated based on the twisted key (PKB); and
    - twisting, by the first device (202) based on the first index of quadratic or higher order twist (d), the return value (ShS) over the first elliptic curve (E’) to generate a result (ShS’) of the ECC computation.
  2. The method of claim 1, wherein the first variable (d) is not communicated to the further device (206).
  3. The method of claim 1 or 2, wherein the first point (P’KB) on the first elliptic curve (E’) is a public key of a second device (204).
  4. The method of any of claims 1 to 3, wherein the return value (ShS) is a point on the further elliptic curve (E).
  5. The method of any of claims 1 to 4, wherein the first point (P’KB) on the first elliptic curve (E’) is a point of the further elliptic curve (E) that has been twisted over the first elliptic curve (E’) based on the first index of quadratic or higher order twist (d).
  6. The method of claim 5, wherein the further elliptic curve (E) is of the form:


    where a2, a4and a6are elements of a finite field (Fp) over which the further elliptic curve (E) is defined, and wherein the first elliptic curve (E’) is defined over an extension of the finite field (Fp), the first elliptic curve (E’) being isomorphic to the further elliptic curve (E) over an algebraic closure of the finite field (Fp).
  7. The method of claim 6, wherein the first elliptic curve (E’) is of the form:


    where d is the index of quadratic or higher order twist, which is a non-zero element of the finite field (Fp).
  8. The method of claim 5, wherein the further elliptic curve (E) is of the form:


    where the coefficients a and b are elements of the finite field (FP), and where:
  9. The method of claim 8, wherein the first elliptic curve (E’) is of the form:


    where

  10. The method of claim 9, wherein twisting the first point (P’KB) on the first elliptic curve (E’) over the further elliptic curve (E) involves determining a point H, corresponding to the first point (P’KB), as follows:

  11. A method of generating a shared secret (ShS’) between first and second devices (202, 204) comprising:
    - implementing the method of any of claims 1 to 10, wherein the twisted key (PKB) is transmitted to the further device (206) along with a private key (SKA), the return value corresponding to the shared secret (ShS’).
  12. The method of claim 11, further comprising, prior to twisting the first point (P’KB) on the first elliptic curve (E’), transmitting to a second device (204) the index of quadratic or higher order twist (d), wherein the first point (P’KB) on the first elliptic curve (E’) corresponds to an original public key (PKB) of the second device twisted over the first elliptic curve (E’) based on the index of quadratic or higher order twist (d).
  13. The method of claim 12, further comprising, prior to twisting the first point (P’KB) on the first elliptic curve (E’):
    - twisting, by the first device (202) based on the index of quadratic or higher order twist (d), a further point (PKA) over the first elliptic curve (E’) to generate a public key (P’KA) of the first device (202); and
    - transmitting the public key (P’KA) of the first device (202) to the second device (204).
FR1906089A 2019-06-07 2019-06-07 Procédé et dispositif de calcul sur courbes elliptiques par des dispositifs à ressources limitées Pending FR3097093A1 (fr)

Priority Applications (3)

Application Number Priority Date Filing Date Title
FR1906089A FR3097093A1 (fr) 2019-06-07 2019-06-07 Procédé et dispositif de calcul sur courbes elliptiques par des dispositifs à ressources limitées
US16/890,801 US11502835B2 (en) 2019-06-07 2020-06-02 Method and device for elliptic curve computations by low resource devices
EP20178130.9A EP3748611B1 (fr) 2019-06-07 2020-06-03 Procédé et dispositif pour des calculs de courbe elliptique par des dispositifs à faibles ressources

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
FR1906089A FR3097093A1 (fr) 2019-06-07 2019-06-07 Procédé et dispositif de calcul sur courbes elliptiques par des dispositifs à ressources limitées
FR1906089 2019-06-07

Publications (1)

Publication Number Publication Date
FR3097093A1 true FR3097093A1 (fr) 2020-12-11

Family

ID=68987752

Family Applications (1)

Application Number Title Priority Date Filing Date
FR1906089A Pending FR3097093A1 (fr) 2019-06-07 2019-06-07 Procédé et dispositif de calcul sur courbes elliptiques par des dispositifs à ressources limitées

Country Status (3)

Country Link
US (1) US11502835B2 (fr)
EP (1) EP3748611B1 (fr)
FR (1) FR3097093A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210027294A1 (en) * 2018-03-23 2021-01-28 nChain Holdings Limited Computer-implemented system and method for trustless zero-knowledge contingent payment

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR3097093A1 (fr) * 2019-06-07 2020-12-11 Stmicroelectronics S.R.L. Procédé et dispositif de calcul sur courbes elliptiques par des dispositifs à ressources limitées

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020108041A1 (en) * 2001-01-10 2002-08-08 Hideaki Watanabe Public key certificate issuing system, public key certificate issuing method, information processing apparatus, information recording medium, and program storage medium
EP3232603A1 (fr) * 2015-01-16 2017-10-18 Nippon Telegraph and Telephone Corporation Procédé d'échange de clé, système d'échange de clé, dispositif à clé, dispositif terminal et programme

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8184803B2 (en) * 2008-12-29 2012-05-22 King Fahd University Of Petroleum And Minerals Hash functions using elliptic curve cryptography
US8705740B2 (en) * 2008-12-30 2014-04-22 King Fahd University Of Petroleum And Minerals Elliptic curve-based message authentication code system and method
US8189775B2 (en) * 2010-02-18 2012-05-29 King Fahd University Of Petroleum & Minerals Method of performing cipher block chaining using elliptic polynomial cryptography
US8331558B2 (en) * 2010-02-18 2012-12-11 King Fahd University Of Petroleum And Minerals Method of cipher block chaining using elliptic curve cryptography
FR3071081B1 (fr) * 2017-09-13 2020-08-21 Commissariat Energie Atomique Methode cryptographique sur courbes elliptiques binaires d'edwards.
WO2019198516A1 (fr) * 2018-04-11 2019-10-17 日本電信電話株式会社 Système de distribution de clés, dispositif terminal, procédé de distribution de clés, et programme
FR3097093A1 (fr) * 2019-06-07 2020-12-11 Stmicroelectronics S.R.L. Procédé et dispositif de calcul sur courbes elliptiques par des dispositifs à ressources limitées

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020108041A1 (en) * 2001-01-10 2002-08-08 Hideaki Watanabe Public key certificate issuing system, public key certificate issuing method, information processing apparatus, information recording medium, and program storage medium
EP3232603A1 (fr) * 2015-01-16 2017-10-18 Nippon Telegraph and Telephone Corporation Procédé d'échange de clé, système d'échange de clé, dispositif à clé, dispositif terminal et programme

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
BURKHARD ENGLERT ET AL: "Twisting an elliptic curve to speed up cryptographic algorithms", 1 January 2006 (2006-01-01), XP055682898, Retrieved from the Internet <URL:http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.68.1916&rep=rep1&type=pdf> [retrieved on 20200403] *
BURKHARD ENGLERTDARIN GOLDSTEINWILL MURRAY, TWISTING AN ELLIPTIC CURVE TO SPEED UP CRYPTOGRAPHIE ALGORITHMS, 2005
VALENTA LUKE ET AL: "In Search of CurveSwap: Measuring Elliptic Curve Implementations in the Wild", 2018 IEEE EUROPEAN SYMPOSIUM ON SECURITY AND PRIVACY (EUROS&P), IEEE, 24 April 2018 (2018-04-24), pages 384 - 398, XP033373218, DOI: 10.1109/EUROSP.2018.00034 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210027294A1 (en) * 2018-03-23 2021-01-28 nChain Holdings Limited Computer-implemented system and method for trustless zero-knowledge contingent payment
US11797984B2 (en) 2018-03-23 2023-10-24 Nchain Licensing Ag Computer-implemented system and method for exchange of data
US11995648B2 (en) 2018-03-23 2024-05-28 Nchain Licensing Ag Computer-implemented system and method for enabling zero-knowledge proof
US12014364B2 (en) * 2018-03-23 2024-06-18 Nchain Licensing Ag Computer-implemented system and method for trustless zero-knowledge contingent payment

Also Published As

Publication number Publication date
EP3748611A1 (fr) 2020-12-09
EP3748611B1 (fr) 2022-01-05
US11502835B2 (en) 2022-11-15
US20200389308A1 (en) 2020-12-10

Similar Documents

Publication Publication Date Title
Bernstein et al. Elligator: elliptic-curve points indistinguishable from uniform random strings
Smart Identity-based authenticated key agreement protocol based on Weil pairing
Galbraith Elliptic curve Paillier schemes
US7929691B2 (en) Use of bilinear mappings in cryptographic applications
US10218494B1 (en) Performing block form reductions modulo non-Mersenne primes in cryptographic protocols
Reyad Text message encoding based on elliptic curve cryptography and a mapping methodology
US10812265B1 (en) Using cryptographic co-processors in a supersingular isogeny-based cryptosystem
US10630476B1 (en) Obtaining keys from broadcasters in supersingular isogeny-based cryptosystems
Banerjee et al. ECC based encryption algorithm for lightweight cryptography
EP3748611B1 (fr) Procédé et dispositif pour des calculs de courbe elliptique par des dispositifs à faibles ressources
Jeng et al. An ECC-based blind signature scheme
Pateriya et al. Elliptic curve cryptography in constrained environments: a review
Huang et al. Two-party authenticated multiple-key agreement based on elliptic curve discrete logarithm problem
Joglekar et al. Lightweight Elliptical curve cryptography (ECC) for data integrity and user authentication in smart transportation IoT system
Peng et al. Comparing and implementation of public key cryptography algorithms on smart card
Gupta et al. A secure identity-based three-party authenticated key agreement protocol using bilinear pairings
JP2002082609A (ja) 依頼計算を用いた演算装置、及び記録媒体
Abbas et al. Data security for cloud computing based on elliptic curve integrated encryption scheme (ECIES) and modified identity based cryptography (MIBC)
Mora-Afonso et al. Strong authentication on smart wireless devices
US10805081B1 (en) Processing batches of point evaluations in a supersingular isogeny-based cryptosystem
US10880278B1 (en) Broadcasting in supersingular isogeny-based cryptosystems
Chopra Comparative analysis of key exchange algorithms in cryptography and its implementation
WO2010024312A1 (fr) Dispositif de calcul, dispositif de décodage, dispositif de cryptage, système de partage d&#39;informations, système de calcul à 2 filtres dynamiques de bruit, dispositif de génération de signature, dispositif d&#39;authentification de signature, système de traitement de signature, système d&#39;authentification de signature, méthode de calcul et programme de calcul
Chen et al. Blockchain as a CA: A provably secure signcryption scheme leveraging blockchains
Shi et al. Identity-based undetachable digital signature for mobile agents in electronic commerce

Legal Events

Date Code Title Description
PLFP Fee payment

Year of fee payment: 2

PLSC Publication of the preliminary search report

Effective date: 20201211

RX Complete rejection

Effective date: 20210412