An Improved Implementation of Elliptic Curve Digital Signature by Using Sparse Elements

Transcription

1 The International Arab Journal of Information Technology, Vol. 1, No., July An Improved Implementation of Elliptic Curve Digital Signature by Uing Spare Element Eam Al-Daoud Computer Science Department, Zarka Private Univerity, Jordan Abtract: Thi paper introduce everal new technique and algorithm to peed up the elliptic curve digital ignature and reduce the ize of the tranited parameter. The baic idea i to ue pare element for the curve coefficient and the firt bae point coordinate. The implementation analyi how that the addition formula calculation are improved about 40 percent. The pare element are introduced with a compact repreentation, thu the digital ignature calculation are peeded up about percent, and the public key parameter are reduced about 7-48 percent. Keyword: Elliptic curve cryptography, projective coordinate, pare element, elliptic curve digital ignature. Received July 14, 00; accepted September 4, Introduction The main advantage of uing the finite group of Elliptic Curve (EC) i that it dicrete logarithm problem i believed to be harder than the dicrete logarithm problem for the multiplication group of a finite field. There i no known ub-exponential algorithm that can be applied to the elliptic curve dicrete logarithm problem. Another advantage that make elliptic curve more attractive i the poibility of optimizing the arithmetic operation in the underlying field [6]. Thi ha led to appearance of everal elliptic curve cryptography product uch a ecurity builder, SSL plu, WTLS pu, TrutPoint etc. In addition many companie have purchaed licene to ue EC code and embed them in their product [4, 5, 7]. By uing Elliptic Curve Cryptoytem ECC we can ue maller key ize with the ame level of cryptographic ecurity for DSA or RSA, whereby we will get maller public key certificate, fater implementation, lower power requirement and maller hardware proceor [15, 8]. Subequently ECC can be applied to many ytem and application [17, 18]. Elliptic curve cryptography application and protocol rely on the elliptic curve group operation uch a adding, doubling and calar multiplication, which will not be feaible unle a uitable elliptic curve finite group and efficient underlying finite field operation are ued. Thu any enhancement in the underlying finite field operation will peed up all the EC application [, 16]. Our approach to enhance the operation i the high utilization of the pare element in GF( n ). Several new algorithm are introduced uch a electing random pare element algorithm, finding pare bae point, compreing and decompreing the pare element and pare multiplication over a polynomial bai. The new algorithm improve the EC in three apect namely: Speed up the curve coefficient multiplication, peed up the multiplication of the firt bae point coordinate and reduce the ize of the tranited parameter. Thi new approach doe not reduce the ecurity to the fact that the elliptic curve over GF( n ) with pare coefficient are iomorphic to the curve which have coefficient elected randomly. Furthermore, although the bae point are retricted to be pare; the number of pare bae point i till very huge and provide the uer with rich choice. The experiment how that the reult of thi improvement varie from one protocol to another baed on the rate of uing the bae point, the number of tranited bit, the key ize and the ratio of doubling to adding. The remainder of thi paper i organized a follow. Section preent the mot efficient elliptic curve projective coordinate formula. In ection, we introduce the algorithm to elect and to compre the pare element. Moreover, we dicu the abundance of the pare point. Section 4 introduce the pare multiplication over polynomial bai. Finally, in ection 5, we how the improvement in elliptic curve digital ignature by uing the uggeted approache.. EC Projective Coordinate Operation In order to find the um of two ditinct point on the elliptic curve E over (GF( n )) by uing affine coordinate, one invere and one multiplication are needed, but to double a point one invere and two multiplication are required. Since the implementation of elliptic curve operation indicate that the invere operation i till more expenive than a field

2 04 The International Arab Journal of Information Technology, Vol. 1, No., July 004 multiplication, where Hankeron and other how that the cot ratio of the inverion to the multiplication over polynomial bai i 1-10 [, 9, 10]. Thu, the projective coordinate X, Y and Z on the curve y + xy= x + a x + a 6 over GF( n ) are ued to replace the invere operation by multiplication uch that [1]: Formula 1: (X 1, Y 1, 1) + (X, Y, Z )= (X, Y, Z ), where U = Z + X1 X Y1 Y T Z S = Z +, = S, Z = T V = Z X, ( ) 1 X = U + T U + S + Ta Y = ( V + X )( TU + Z + Z C ) Formula 1 need 9 field multiplication and 8 temporary variable are required. López and Dahab introduce a new doubling formula which require 5 field multiplication a follow [11-1]: Formula : (X 1, Y 1, Z 1 )= (X, Y, Z ), where Z = Z1 X1 4 4 = X1 a6z1 X + 4 Y = a6z1 Z + X ( a Z + Y1 + a6z. Spare Element Thi ection introduce algorithm to elect random curve have pare coefficient and pare bae point. The complexity analyi for the uggeted algorithm indicate that the time to generate pare element and bae point i relatively ignored. Moreover, the reduction of the pare element length i clarified..1. Select Random Spare Coefficient The firt tep to find a uitable elliptic curve i to elect random coefficient (a and a 6 ) and the election i repeated until a propective curve i found. However, there i no ecurity threat if the coefficient are retricted to be pare in GF(q). Moreover the number of generated curve i till very huge. Algorithm 1 i uggeted to generate random curve with pare coefficient. Algorithm 1: Generate random pare coefficient in GF( q) Input: The finite field GF( n ), (the maximum number of one) Output: The pare element a and a 6 in GF(q) 1. j 0. For i= 1 to rand () v rand (n ) If x v = 1 Then i i -1 (x v i the v th bit in the element x) 4 1 ) Ele x v = 1. If j= 0 then a x, j 1, x 0 and goto tep Ele a 6 x 4. Return a and a 6... The Upper Bound of Spare Bae Point Thi ubection how that even if the bae point i retricted to be pare, the number of generated point i till very huge. Definition: Let G be a point on E (GF( n )) repreented in the binary expand. Then the point G i pare if and only if the firt coordinate ha a few one o that the number of one i le than 5 percent from the field ize. Moreover the point G i called pare with one if the maximum number of the one in the firt coordinate i. Theorem: Let E be any elliptic curve over GF( n ); then the upper bound of the pare point with one on E i ( n i ) / t! i = 0 Proof: Let x be any element in GF(q) and ha t one, then x can be repreented in n n! = t t!( n t)! = t 1 i= 0 ( n i) / t! different way. If the maximum number of the one in the x coordinate i, then x can be repreented in ( n i ) / t! i = 0 different way. Since the quadratic equation ha two olution when x i in GF(q), then the upper bound for the number of pare point with one on E i ( n i ) / t! i = 0 The order of the elected elliptic curve mut be prime or nearly prime (the curve E j ha a nearly prime order if #E j = r j p j for mall integer r j and large prime number p j, where j i an integer), then the approximately average number (if the tet i run over many curve E j ) of pare bae point with one i: i = 0 ( n i ) / d ( t!) where d i the average of r j. Thu, thi number i large enough to give the uer rich choice, for example if n= 160 and = 7 then the number of pare bae point are

3 An Improved Implementation of Elliptic Curve Digital Signature by Uing Spare Element 05 nearly However there i no ecurity threat known in cae if many uer chooe the ame bae point... Selecting a Spare Bae Point Algorithm i uggeted to find a random pare bae point P, with one for any nearly prime elliptic curve over GF( n ), where P ha a large prime order. Algorithm : Chooing Random pare bae point with one. Input: An elliptic curve E over GF(q), the curve order rk, and the maximum number of one. Output: A pare bae point with one. 1. For i=1 to rand (). v rand (n ). If xv= 1 Then i i -1 (xv i the vth bit in the element x) Ele xv= 1 4. End For 5. Find the coordinate y by olving the quadratic equation, if y doe not exit go to tep 1 ele et y to one olution of the quadratic equation (randomly). 6. G (x,y) 7. P k G 8. If P= O then go to tep 1 9. Q r G 10. If Q O then output wrong order and top 11. Output G. The complexity of the previou algorithm i equal to the complexity of tandard algorithm to generate random bae point..4. Compact Spare Element Repreentation To utilize the pare field element in the real communication and implementation; Algorithm and 4 are introduced to compre and decompre any pare element with one in relatively ignored time. Algorithm : Compreion of any pare element in GF( n ), where n 56 Input: Spare element x. Output: Compreed repreentation array C. 1. m 1. For i=1 to n If x i 1 then continue C m = i m m + 1. Return C Algorithm 4: Decompreion of compact repreentation Input: Compreed repreentation array C with length. Output: Spare element x 1. For i=1 to t C m x t 1. Return x Since the dicrete problem for elliptic curve with field ize le than 56 i ufficient for the current application and at leat for next few year; dicuion will be retricted to thi field ize, but it can be extended eaily to any other field ize. Thu each element in the array C (which form the compact repreentation for a pare element) can be repreented in 8 bit, o the ize of the array C i (8). Table 1 how the reduction rate of the pare element. Table 1. The reduction rate of the pare element. Reduction Conventional Compact Size (n) Rate Spare Multiplication Over Polynomial Bai The field multiplication i the mot time conuming operation for adding two elliptic curve point particularly in the projective coordinate. Therefore thi ection how the great improvement whenever pare field element are ued over polynomial bai. Algorithm 5 [1] i ued to find firt the polynomial multiplication and then the reult i reduced by the irreducible polynomial f(x). The following notation are ued; if a(x) i element in GF( n ) then a(x) i aociated with the binary vector a= (a n-1,..., a, a 1, a 0 ), w i the word ize, t i the number of word that are neceary to repreent the vector a, thu the array A= (A[t-1],..., A[], A[1], A[0]) where A[h] i the h th word in the vector a, if C= (C[m],..., C[1], C[0]) then the truncated vector i C{ j}= (C[m],..., C[ j+1], C[j]) Algorithm 5: Polynomial multiplication (Right to left). Input: The polynomial a(x) and b(x) in GF( n ). Output: c(x)= a(x). b(x). 1. C 0. For k= 0 to w-1 do For j= 0 to t 1 do If the k th bit of A[j] i 1 then add B to C{j} If k w-1 then C C x. Return c

4 06 The International Arab Journal of Information Technology, Vol. 1, No., July 004 The previou algorithm need w-1 hift operation and nearly n/ addition operation. Algorithm 6 i uggeted to compute the pare element multiplication in the polynomial bai repreentation. Algorithm 6: Spare polynomial multiplication. Input: The array A with length (the compreed repreentation of a(x) ) and the polynomial b(x) in GF( m ). Output: c(x)= a(x). b(x). 1. For i=1 to T= b<< (A i 1) c= c T. Return c The number of left hift and bit wie addition in the previou algorithm i equal to the number of one in the pare element. To implify the calculation, aume that the left hift cot i equal to the addition operation. Then Table ummarize the improvement by uing pare multiplication algorithm over the general field multiplication in algorithm 5 for word ize w=. Table. Comparion between the multiplication of pare and random field element in polynomial bai. Size (n) Algorithm (5) #Operation Algorithm (6) = 6 #Operation The Cot Ratio if a, a 6 and the firt coordinate of the bae point are pare, then formula 1 can be implemented with only 5 general field multiplication and 4 pare element multiplication. While formula can be implemented with only general field multiplication and pare element multiplication. 5. The Improvement in EC Digital Signature The digital ignature i an important algorithm that relie on public key technology, therefore any enhancement in the ignature generation or ignature verification will have impact on the e-commerce, e- payment and other application. The curve and bae point generation i the firt tep to implement a digital ignature baed on elliptic curve cryptography; the econd i generating the key which are ued to ign a meage and verify the ignature. Thee tep can be decribed a follow [, 14]: EC and Bae Point Generation: The firt party A doe the following: 1. Select a uitable elliptic curve E defined over GF(q),. Select a bae point P E(GF(q)) of order l, where l i the elliptic curve order. EC Key Generation: 1. Select an integer t in the interval [1, l - 1].. Compute the point Q= t P. A' public key i (a, a 6, P, l, Q) and A' private key i t. EC Signature Generation: To ign a meage m, A doe the following: 1. Select an integer k in the interval [1, l - 1].. Compute G= kp= (x 1, y 1 ).. Compute the firt ignature component r= x 1 mod l. (Here x 1 i the firt coordinate in the point G.) If r= 0, go to tep Compute k -1 mod l and e= h(m). 5. Compute = k -l {e + t r} mod l, where h i any Secure Hah Algorithm. 6. If = 0, then go to tep 1. The ignature for the meage m i the pair of integer (r, ). EC Signature Verification: To verify A ignature (r, ): 1. Obtain a copy of A' public key (a, a 6, P, l, Q).. Verify that r and are integer in the interval [1, l - 1].. Compute w= -1 mod l and f = h(m). 4. Compute u 1 = f w mod l. 5. Compute u = r w mod l. 6. Compute u 1 P + u Q= (x 0, y 0 ) and v= x 0 mod l. 7. Accept the ignature if and only if v= r. If a, a 6 and the firt coordinate of the bae point P are pare, then by uing the uggeted approach and algorithm; the number of public key bit will be reduced to (4 + n + ) from (5n +) for the tandard etting. Subequently reducing the neceary time for ending and receiving the EC digital ignature. Table how the percentage of the bit reduction in the public digital ignature parameter. Table. The reduction rate of the bit by uing the new approach. PK PK Reduction Size (n) Standard Compact Rate Aume that the curve order l, t, k, u 1 and u are equal to the field ize n, d i the ratio of doubling to adding. If the Formula 1 i ued for adding and Formula i ued for doubling, then number of multiplication over

5 An Improved Implementation of Elliptic Curve Digital Signature by Uing Spare Element 07 GF( n ) for the ignature generation and key generation are given by the equation Number of Multiplication= 5*(The number of doubling)+9*(the number of adding) So #mult=5n+9(n/d)= n (5+9/d) (1) and the verification: #mult= n( /d ) () while the number of multiplication for the ignature generation and key generation by uing the new approach are reduced to #mult= n( general field + pare +5/d general field +4/d pare () and the verification proce are reduced to #mult= n(6 general field + 4 pare +1/d general field +5/d pare ) (4) Thu the improvement in digital ignature i (1-multiplication cot of (1)/ cot of ()) * 100 and the improvement in the verification i (1-multiplication cot of ()/ cot of (4)) * 100 By uing the data in Table we can conider that the pare multiplication i approximately 10 time fater than the general field multiplication, therefore the improvement in the key generation, the ignature generation, and the verification proce are hown in Table 4. Table 4. The improvement in the digital ignature by uing the new approach. Size (n) Doubling/ Adding (d) 6. Concluion Signature Generation Improvement % Verification Proce Improve ment % 16 / / / / / To atify efficient computation and communication, everal algorithm are introduced uch a electing random pare element algorithm, finding pare bae point, compreing and decompreing the pare element, pare multiplication over polynomial bai. The new approache and algorithm lead to enhance the digital ignature implementation about percent, high reduction in the public key parameter by 7-48 percent and did not acrifice in the elliptic curve cryptography ecurity. Therefore, the elliptic curve application a e-cah and e-commerce can be implemented with better performance uing the uggeted approach. Reference [1] Al-Daoud E. and Ramlan M., A New Addition Formula for Elliptic Curve Over GF( n ), IEEE Tranaction on Computer, vol. 51, no. 8, pp , Augut 00. [] Al-Daoud E. and Ramlan M., Elliptic Curve Arithmetic Operation Over GF( n ) and GF(P) for Cryptoytem Purpoe, in Proceeding of the International Conference on Mathematic and it Application in the New Millennium, pp , 000. [] Blake I. F., Seroui G., and Smart N. P., Elliptic Curve in Cryptography, Univerity Pre, London, Cambridge, [4] Certicom, acceed on March 5, 00. [5] Gupta V., Gupta S., and Sheueling C., Performance Analyi of Elliptic Curve Cryptography for SSL, in Proceeding of ACM Workhop on Wirele Security, Atlanta, Georgia, 00. [6] Gura N., Eberle H., and Shantz S. H., Generic Implementation of Elliptic Curve Cryptography Uing Partial Reduction, in Proceeding of 9 th ACM Conference on Computer and Communication Security, Wahington DC, 00. [7] Gura N., Shantz S. C., Eberle H., Fincheltein D., Gupta S., Gupta V., and Stebila D., An End-to- End Sytem Approach to Elliptic Curve Cryptography, in Proceeding of CHES'00 Workhop on Cryptographic Hardware and Embedded Sytem, Lecture Note in Computer Science, Springer-Verlag, Redwood City, California, 00. [8] Ha J. S., Kim Y. H., and Lee K. Y., Compact Implementation of Elliptic Curve Cryptography Sytem Uing a FPGA, in Proceeding of the 9 th Korean Conference on Semiconductor, pp , 00. [9] Hankeron D., López J. and Meneze A. J., Software Implementation of Elliptic Curve Cryptography over Binary, in Proceeding of CHES'000, LNCS 1965, pp. 1-4, 000. [10] IEEE P16 Draft, Standard Specification for Public Key Cryptography, org/group/16/, verion D1, [11] King B., An Improved Implementation of Elliptic Curve Over GF() When Uing Projective Point Arithmetic, in Proceeding of 8 th Annual International Workhop on Selected Area in Cryptography (SAC'001), pp , 001. [1] López J. and Dahab R., High-Speed Software Multiplication in GF( m ), IC Technical Report, IC-00-09, Intitute of Computing, Univerity of Campina, 000. [1] López J. and Dahab R., Improved Algorithm for Elliptic Curve Arithmetic in GF( n ), in

6 08 The International Arab Journal of Information Technology, Vol. 1, No., July 004 Proceeding of 5 th Annual International Workhop on Selected Area in Cryptography (SAC'98), pp. 01-1, [14] Meneze A. J., Oorchot P. C., and Vantone S. A., Handbook of Applied Cryptography, CRC Pre, Boca Raton, [15] Paar C., Implementation Option for Finite Arithmetic for Elliptic Curve Cryptoytem, in Proceeding of Invited Preentation at the rd Workhop on Elliptic Curve Cryptography (ECC'99), Univerity of Waterloo, Waterloo, Canada, pp. 1-, [16] Roing M., Implementing Elliptic Curve Cryptography, Manning, Greenwich, [17] Sklavo N. and Koufopavlou O., Mobile Communication World: Security Implementation Apect- A State of the Art, Computer Science Journal of Moldova, Intitute of Mathematic and Computer Science, vol. 1, no., 00. [18] Weimerkirch A., Paar C., and Shantz C. S., Elliptic Curve Cryptography on a Palm OS Device, in Proceeding of the 6 th Autralaian Conference on Information Security and Privacy (ACISP'001), LNCS 119, Macquarie Univerity, Sydney, Autralia, pp , 001. Eam Al-Daoud graduated from Mu tah Univerity in He continued hi mater tudy at Al Al- Bayt Univerity majoring in numerical analyi. He recieved hi PhD from Univerity Putra Malayia. Hi reearch interet are namely pare matrice and cryptoytem.