ZERO-KNOWLEDGE PROTOCOLS IMPLEMENTED WITH ELLIPTIC CURVES

Transcription

1 U.P.B. Sci. Bull., Seies C, Vol. 7, Iss. 3, 00 ISSN x ZERO-KNOWLEDGE PROTOCOLS IMPLEMENTED WITH ELLIPTIC CURVES Bogdan TUDOR În acest mateial se abodează potocoalele de tip cunoastee zeo în pespectiva cubelo eliptice. Elementele oiginale sunt optimizaea algoitmilo, alegeea paametilo cubelo eliptice şi calculaea împeecheii Tate. Algoitmii se încadează înt- un cadu de dezvoltae şi împeună cu funcţiile de distosiune se pot aplica pentu oice împeechee. In this pape zeo-knowledge potocols ae teated in the elliptic cuves pespective. The oiginal elementes ae the optimization of the algoithms, elliptic cuves paametes and the Tate paiing calculus. The algoithms can be teated as a famewok and though the distotion maps they can be applied on evey elliptic cuve paiing. Keywods: elliptic cuve, Tate paiin zeo-knowledge, distotion maps. Intoduction Zeo-knowledge potocols play an impotant ole in the data tansfe systems nowdays. In the case of the wieless netwoks these potocols ae being moe impotant because of the popagation medium. In this moment, confoming to the latest standads the authentication infomation is potected though the best methods available but despite to these potections thee ae always posibilities to an vitual oponent to decypt the the data though some kinds of cyptogaphic attacks [0]. The zeo-knowledge potocols solve in pat this kind of teat because the sensitive infomation is not even tansmitted to the veifie. The new cyptogaphic famewok intoduced in paagaph 3 and the new paametes computed in paagaph 5 ae the oiginal contibutions of this pape.. Potocols with paiing In the beginning of the communication setup, is the asymmetic cyptogaphic pat. The majoity of the potocols use the Diffie-Hellman o RSA methods. Using the elliptic cuves paiings is a elatively new pespective [4]. Thee of the paiings ae mostly used: Weil, Tate and Ate (a shot vesion of Tate). These paiings ae though definition bilinea mappings fo elliptic cuves. Eng., Advanced Technology Institute, Buchaest, Romania, bogdantudo74@yahoo.com

2 0 Tudo Bogdan In the pesent case two kinds of paiings ae being used: symmetic and asymmetic. The main diffeence between them is about the definition domains. Evey bilinea paiing used in cyptogaphy fo an elliptic cuve G satisfies the following popeties: ab - bilinea: e ( a bh) h) fo evey h G and b Z, in the multiplicative fom (can be witten as exponentials). - non-degeneate: fo evey geneato element g and h fom G with e(h), in this point is impotant to note that most of this pape esults ae based on Tate paiin whee e ( - computability: thee is an efficient algoithm fo calculating e ( h) An admissible map is defined as a function e : G G G whee G is an subgoup fom E(F p ) and G fom E( F ). These goups have the same ode q p and we choose g as geneato element fom G. The G goup is chosen fom the condition that the Gap Diffie-Hellman poblem is intactable (if we know the values a bg calculate the element abg in multiplicative fom). The Hufschmitt scheme [6] is a zeo-knowledge one though the value of abg obtained in l iteations compising thee steps as below. In this algoithm public paametes ae ( a b e(, v=e( ab ) and pivate key is S = abg. The public key is (a b v), who is calculated only once. The poposed scheme is backed by the following equation: + abc ab c c e ( Y ) g c( abg ) ) ( e( ) = W v Table The Hufschmitt algoithm Pove Veifie choose [ 0, q] calculate W send W to the veifie veify that c [0, k ] computes Y = g S Send Y to the veifie c choose c [0, k ] send c to the Pove Veify that e ( Y ) = W v c The pobability of guessing the c value is afte l ounds lk.

3 Zeo-knowledge potocols implemented with elliptic cuves The scheme poposed by Shao, Lu and Cao [3] is based on the secuity of the Diffie-Hellman algoithm. The public paametes ae e( and the pivate key is s ( 0, q]. The public key is v = sg. Table The Shao algoithm Pove Veifie choose [ 0, q] Calculate W = g Send W to the veifie + sβ Calculate Y = g Send Y to the veifie Choose β ( 0, q] Send β to the pove β Veifies that e ( Y, v W ) This scheme is moe efficient than those of Kim and Kim o Yao and Wang [3]. Below is a compaison between the two algoithms pesented above. Compaison between Hufschmitt and Shao algoithms Hufschmitt Shao N of exp fo pove + ε N of paiings fo pove 0 0 N of exp fo veifie ε N of paiings fo veifie Table 3 These two algoithms ae almost equals fom the calculus point of view. Balancing the calculus powe between the pove and the veifie is done based on the usage conditions. In the case of client-seve implementations (the most used case) it is an advantage in Hufschmitt algoithm. In othe applications (like smat devices) the Shao implementation is supeio. The ε numbe fom the evaluations is fom the fact that the exponent of the final veification v c is smalle than q, having only k bits. The initial calculus of e( is done only once and is possible to be done outside the system, subsequent values will be calculated based on this esult. This is the eason that numbe of paiings fo the pove is 0. As it can be seen fom the above compaison the numbe of the equied computations of paiings is, a minimum value fo the algoithms. The only opeation that can be moved fom one pat to anothe is the exponentiation one. The sum is 3 fo Shao and +ε fo Hufschmitt.

4 Tudo Bogdan Anothe pespective fo using paiings in these kinds of potocols is pesented by Zhang and Kim in [7] and has its oots in DVB (Digital Video Boadcastin. In that case is mandatoy the pesence of the thid tusted paty. That entity geneates a use s signatue and put it in the use s hadwae (usually an smat-cad). In the oiginal scheme, poposed by the Boneh and Fanklin exist a diffeence in the calculus powe needed between the use and the povide. This is the main eason of the following scheme. In the beginning the system geneates S ID =s*h(id), whee s is a secet andom paamete. The public key is P pub =sp. Pove Has ID, S ID Tansmit ID to the veifie Choose a at andom Calculate A=aP, C=H (S ID +a R Tansmit A, C to the veifie Zhang and Kim algoithm Veifie Calculate Q ID = h(id) Choose andom and R=P Tansmit R to the pove Table 4 H e ( C, P) QID, Ppub ) ( e( A, The final step (veification) is done based on the equality: e( C, P) H( S ID + a R, P) H( S ID, P) e( ar, ap) = H ( e( H( QID, sp) e( ap, ap) QID, Ppub ) e( A, Hee H is a hash function defined on R and H is a function defined on the image of the elliptic cuve with esults in R. In this context we can obseve that filteing the values of points R (fom C one cannot compute S ID ) we can dop the H ( tem which helps in diffusion of infomation. In that case: C = S ID + a R and e ( C, P) QID, Ppub ) e( A, In this way it s possible to intoduce supplementay opeations in the netwok, but the numbe of mathematical opeations needed is deceased. The same is also in the case of e ( A,, whee we can use e ( A, R) though C = S ID + a R, which educes an exponentiation fom the client and seve pat. These impovements do not affect the oveall scheme secuity, but educes the implementation effot. In a pesentation made by Xavie Boyen (A Roadmap of IBE Systems and thei applications) on NIST wokshop in 008 he teats the Shao-like algoithm as bilinea DH invesion and the famewoks deived fom it as Exponent Invesion.

5 Zeo-knowledge potocols implemented with elliptic cuves 3 3. Cyptogaphic famewok All the pevious schemes ae following the classical thee steps potocol of zeo-knowledge potocols. The Shao ones is minimal fom the computations point of view. So optimizing futhe the scheme following the classical setup is not possible (evey anothe scheme involves a minimum paiing computations). The key in this case is to minimize the numbe of steps and the message flow the potocol equies. The scheme in this case it would be composed fom only two steps, thus equiing much lowe netwok taffic. All the algoithms below will skip the fist step fom the classical zeo-knowledge potocols (the pove fist value - witness). In the classical algoithms the veifie is equied to send only one andom (challenge) value. In the new algoithm it must tansmit andom values. In the setup, some entity geneates g and e(. The pove chooses some secet value s as pivate key and publishes g s = Y as public key. Table 5 Computes Pove Choose andom t value t s X = g, Z g tb + = Send X, Z to the veifie Fist algoithm This is backed by the following equality: Veifie Choose andom values b and and tansmit them to the pove b Veify that e( Z, Y X ) b tb+ s s tb e( Z, Y X ) g, g g ) We must to analyze the computational costs involved. Compaison between fist algoithm and Shao This scheme Shao N of exp fo pove N of paiings fo pove 0 0 N of exp fo veifie N of paiings fo veifie Table 6 Fom the table above it s easy to see that these two algoithms ae compaable fom this point of view. In fact, the logical opeations in the pove pat ae the same (the invesion of the sensitive pats). The implication of and b in the final veification excludes the possibility of fogey. If one can compute

6 4 Tudo Bogdan some values X, Z with the desied popeties, he could solve the Y b equation and thus find the secet value. The poposed algoithm is vey useful in the wieless aea, whee netwok tansmissions ae expensive. Fom X and Z the veifie cannot lean anything about t and, except fo public infomation. The exta exponentiation in the veifie pat is a little exta cost fo dopping the witness value tansmission. This scheme balances the netwok load with veifie s computations. An analog scheme exists fo identification with some cedential (ID). Table 7 ID-based algoithm Pove Veifie Calculate ID h( ID) Fq Choose s secet key h(id) s Calculate Z = g, Y = g Tansmit ID, Z Calculate ID h( ID) Fq h(id) Calculate Z = g Send thee andom values a, b, c Choose t andom value and compute t X = g a* h( ID) + b* s+ c* t T = g Send X, T to veifie Veifies that c b a e( X Y Z, T ) The equality is evident and the system could be extended to moe infomations (in this case thee ae two infomations: secet key s and ID value). Fo evey piece of sensitive infomation the veifie must geneate a andom numbe. If k is the numbe of valuable infomations (like pivate key), the numbe of andom vaiables must be k+. Of couse if the numbe inceases, exta cae must be put in andom values geneation in the veifie pat. This condition appeas fom the fact that infomation must be andomized though multiplying. This completes this kind of authentication potocols with something like a famewok. Fo cuent case it is impotant to compae the numbe of opeations equied:

7 Zeo-knowledge potocols implemented with elliptic cuves 5 Table 8 Compaison between pevious ID algoithm and Zhang s one ID scheme Zhang scheme Pove expon 4 3 Pove paiings 0 0 Veifie expon 4 Veifie paiings 3 Fom the table above we see the diffeence in numbe of paiings (an opeation who is fa moe time consuming than exponentiation). Fo evey supplementay paamete we can add an exta exponentiation fo veifie. Unlike the pevious scheme the computations ae moe balanced between the pove and veifie. The schema with only two andom numbes is the same with c=0. Fom these examples we can wite the geneal case: Table 9 Genealized vesion Pove Veifie In the setup, it chooses m secet values ni n i, i = 0... m. Publish X = g, i = 0... m Computes Y = g i aibi ni and send a i Geneates m andom values Geneates an binay vecto of length m b i with b i = 0, Sends them to the pove b ai i i = Veifies e( Y, X ) e( Though the judicious use of binay vecto b i who selects what secet values ae used in veification (the exponentiation in the end of the final fomula is tivial when b i =0) the veifie can use a single step instead of using multiple steps fo minimizing the fogey pobability. This pobability is ( bi p ) whee i p i is the pobability of guessing a secet numbe n i and we omit the influence of a i paametes. When the Hamming weight of the b i vecto is sufficiently high, this pobability is not an issue. This can be seen as an analogue of genealized Feige- Fiat-Shami potocol [0] in the elliptic cuve domain. 4. Paiing computation The main pat of the algoithms consists in paiing s computation. The Tate paiing seems to be much faste and appopiate than othe paiings fo cyptogaphic applications. It is based on the degee 0 divisos fom E F ) ( q

8 6 Tudo Bogdan epesented by P P with P E( F q ). The calculus is done based on the obsevation that if we choose two points P and P ' fom E ( F q ) we can find anothe point fom the cuve B and a function G with P + P' B P = div( G). G is the equation of line though the two points and B is the negative of the sum. If we note L the above line and L the vetical line though B we can wite the following equations: div( L ) = P + P' + C 3P div( L ) = C + B P div ( L / L ) = P + P' B P = div( G) Y λ( X x ) y The G line has G = whee λ is the angle of the line X + ( x + x ) λ though P and P (o the tangent if that two points ae equal). Fo some kinds of paiings (like Weil) the esult is tivial if the points ae dependent of each othe. This situation is solved in [5] though distotion functions. In this case the paiings ae called modified paiings. The distotion function is an endomophism who tansfom an point P with ode l in anothe point of ode l but fom E ( F q k ), whee k is the embedding degee: φ ( P) E( F q k ). The advantage in using supesingula elliptic cuves is that the distotion function always exists in this case and fo egula ones does not exist (with some mino exceptions). The modified paiing can be defined in this way: ' e l ( P, Q) = el ( P, φ( Q)) Examples of distotion functions ae: Table 0 Distotion functions Chaacteistic Cuve Embedding degee φ p > 3 and p mod3 p > 3 and p 3mod 4 y = x 3 + a y = x 3 + ax Coesponding distotion functions: φ ( x, y) = ( ξx, ) whee ξ + ξ + = 0 y φ ( x, y) = ( x, iy) whee i + = 0 The definition field does the secuity level of the opeations. φ φ

9 Zeo-knowledge potocols implemented with elliptic cuves 7 5. Choosing the paametes We choose the second example whee p 3mod 4. It is possible to show that the cuve is supesingula and u = # E( Fp ) = p + = lc, whee l is the point ode and c epesents the cofacto. Because of the natue of the chosen cuve, the MOV attack is possible so the discete logaithm poblem must be defined ove a minimum field of 048 bits (a level equied by today s computing possibilities). That field is defined by F, so p must be a pime numbe of 04 bits. Fom the p pevious woks, the point ode must be at a minimum of 30 bits and the cofacto must fill the est. Fom the fact that l must be a pime numbe, follows c 0mod 4. The main citeion in choosing these paametes is the Hamming weight who has to be as low as possible. The final Hamming weight is a combination between all the paamete s weights. To find the paametes is sufficient to build a pedefined model fo seaching numbes: x y c = +, with x [ 05 l,04] and x > y > this model esults fom the condition that c is a multiple of 4. Thee ae multiple possibilities fo l but we ty the lowest Hamming: = x x y l + and l = + + whee x [ 05 l,04] and x > y > Tying all the possibilities between chosen anges pefoms seaching. The fist model cannot eveal any numbe who satisfies all the equiements. Because the tem y fom c epesentation has the main influence in final weight, it has to be as low as possible. We fix x = 704 in c epesentation and the esults fo x c 704 y z = + and l = + + ae: Table Paametes fo low Hamming weight X y z Hamming p It s obvious that lowe than 7 we cannot obtain valid Hamming weights (fo x=). So the values with 7 ae optimum values. Simila esult indicates Hamming weights of aound 0 fo 04 bits secuity [3]. The pimality tests used ae not pseudo-pimality tests, but combinations of Pocklington-Lehme and APRCL tests, which slows down entie seach pocess. These paametes ae being computed only once, so the computing time is not impotant.

10 8 Tudo Bogdan It is possible to compute f Q ( φ ( R)) instead of fφ ( Q) ( R) whee R is the andom point used in paiings. These bing the equied opeations fom the field extension in base field opeations [3]. An impotant point is finding and epesenting the tosion goup. The multiplication can be done though division polynomials, but this is slow. Instead we can use the fact that the tosion goup is geneated by at most two independent points. This goup is athe cyclic. In ou case is sufficient to take some andom points fom the cuve and multiply them with c. If the esults ae non-zeo, the points ae fom tosion goup of ode l (because lc=p+ ). We can use the fact that all the points kp with k < l ae fom the same tosion goup. Fo finding tosion points we can use thee methods [4], but in this case the useful one is that who utilizes goup stuctue. The goup c < E( F ) > * q contains all the l tosion points and the c tosion points. An algoithm fo geneating a tosion point of ode l fo a given cuve:. we choose a andom point x Fq. veifies if the cuve s equation has solutions in F q 3. compute Q = cp E( F q ) whee P = ( x, y) E( Fq ) 4. if Q = (0,,0 ) we oll back to step, if not we step out to step 5 5. Q is the l tosion point In this case, the pobability of choosing in step an element that is not on the definition field of the cuve is. If we conside the pobability of tosion l points, the final pobability in succeeding is. The second model bings us ( l + c) multiple choices fo paametes, and we choose the lowest values: 704 c = l = + + p = l * c Value of p is a pime numbe, which can be veified though moe specialized pogams. The numbe of nonzeo bits in this epesentation is minimum. That s why the numbe of computations equied by the Tate paiing is educed. In the pocess to find out points on this cuve, we can ty all the natual numbes:,, and 3. We find that 3 is a point on the cuve with coodinates: (3 : : )

11 Zeo-knowledge potocols implemented with elliptic cuves 9 Multiplying this point with c facto gives us a point of ode l fom the cuve: ( : : ) This is the point equied by the algoithms. If the pefeed epesentations of the paametes ae not these, choosing an addition/subtaction chain instead of binay chain pesented by the classical Mille algoithm can do impoving the computing speed. Thee ae many possibilities [9], among these we efe to: - Moain and Olivo s methods (based on Booth epesentations) [] - window methods by Downey and Schonhage - Koyama methods - Lee and Kim sliding method In a paticula case a method o anothe can be the best choice, but fom statistical point of view fo numbes with 5 bits the aveage chain lengths ae: Table Chain s lengths fo diffeent methods Algoithm Length binay modified binay 68.7 window methods ~606 Koyama 60.6 sliding window Fo cuent case these methods (that woks in geneal setup) cannot be applied because the numbe of the bits equal to is minimal by the selection of paametes. The effot is moved on finding paametes. That s why it is pefeed to make the effot to find optimal paametes only once in the setup stage of the algoithm instead of applying the methods above. 5. Conclusions The poposed algoithms can be seen as a famewok and intoduces the oiginal idea of skipping the fist step of potocol though an additional andom challenge. The elliptic cuve paametes ae selected fo minimum Hamming weight, thus the paiing implementation does not equie sophisticated addition/subtaction chains and it s calculus is optimal. The Hamming weight

12 0 Tudo Bogdan value of 7 obtained in table is the minimum one fo the equiements. That value is bette fom computations point of view than those found in cuent liteatue. R E F E R E N C E S. P.S.L.M. Baeto, B. Lynn, M. Scott, Constucting elliptic cuves with pescibed embedding degees, SCN, LNCS 576, pp.57 67, Spinge-Vela 00. Daniel J. Benstein, Tanja Lange, Faste addition and doubling on elliptic cuves, Pages in Advances in cyptology---asiacrypt 007, 3th intenational confeence, Decembe --6, 007 Lectue Notes in Compute Science 4833, Spinge, G. Betoni, L. Chen, P. Fagneto, K. Haison, G. Pelosi, Computing Tate Paiing on Smatcads, White Pape STMicoelectonics, D. Boneh, M. Fanklin, Identity-based encyption fom the Weil paiin SIAM J. of Computin vol. 3, No. 3, pp , 003 Extended abstact in Cypto 00, LNCS 39, pp. 3-9, T. Hadano, Elliptic cuves with a tosion point, Nagoya Math. J 66. (977) E.Hufschmitt, A zeo-knowledge identification scheme in Gap Diffie-Hellman goups, Westen Euopean Wokshop on Reseach in Cyptogaphy Wokshop Recod (005) 7. J.-S. Hwu, R.-J. Chen, Y.-B. Lin, An Efficient Identity-based Cyptosystem fo End-toend Mobile Secuity, Accepted and to appea in IEEE Tansactions on Wieless Communications 8. M.Kim, K.Kim, A new identification scheme based on the bilinea Diffie-Hellman poblem, Spinge-Velag Y. Lee, H. Kim, Expansion of sliding window method fo finding shote additionsubtaction chains, Intenational Jounal of Netwok Secuity, vol., No., pp.54-60, A.Menezes, Handbook of applied cyptogaphy, CRC Pess 996. F. Moain, J. Olivos, Speeding up computations on an elliptic cuve using additionsubtaction chains, Infom.TheoyAppl.4(90), p M. Scott, Computing the Tate paiin CT-RSA, vol of Lectue Notes in Compute Science, pages , Spinge-Vela J. Shao, R. Lu, Z. Cao, A new efficient identification scheme based on the stong Diffie- Hellman assumption, Intenational Symposium on Futue Softwae Technology 004x 4. J. Shikata, Y. Zhen Optimizing MOV algoithm fo non-supesingula elliptic cuves, Lectue Note on Compute Science, Asiacypt 99, E. Veheul, Evidence that XTR is moe secue than supesingula elliptic cuve cyptosystems, Jounal of Cyptology, vol. 7, Numbe 4, Septembe 004, pp (0),Spinge-Velag 6. G.Yao, G. Wang, Y.Wan An impoved identification scheme, Bekhause- Velag F. Zhan K. Kim, Signatue-Masked Authentication Using the Bilinea Paiings, Cyptology & Infomation Secuity Laboatoy (CAIS), Infomation and Communications Univesity, technical epot, 00.