ECC

DR. ALEKHA KUMAR MISHRA 42

Elliptive Curve
An elliptic curve is defined by an equation in two variables with coefficients.
For cryptography, the variables and coefficients are restricted to elements in a finite
field, which results in the definition of a finite abelian group.
Elliptic curves are not ellipses
In general, cubic equations for elliptic curves known as a Weierstrass equation:
y2 + axy + by = x3 + cx2 + dx + e
where a, b, c, d, e are real numbers and x and y take on values in the real numbers.
Elliptive curve over real number uses a specific form: y2 = x3 + ax + b
A single element denoted O and called the point at infinity or the zero point
To plot such a curve, we need to compute: y = x3 + ax + b
Each curve is symmetric about y = 0.

DR. ALEKHA KUMAR MISHRA 43

Elliptive Curve
Set of points E(a, b) consisting of all of the points (x, y) that satisfy
y2 = x3 + ax + b together with the element O.
Different value of the pair (a, b) results in a different set E(a, b)
A group can be defined based on the set E(a, b) for given a and b,
provided 4a3 + 27b2 ≠ 0 holds true
The operation for this group is addition (+)

DR. ALEKHA KUMAR MISHRA 44

 Elliptive Curve : Examples

y2= x3-x  E(-1, 0) y2=x3+x+1  E(1, 1),

DR. ALEKHA KUMAR MISHRA 45
 Geometric description of addition
If three points on an elliptic curve lie on a straight line, their sum is O.
O serves as the additive identity.
◦ Thus O = -O;
◦ for any point P on the elliptic curve, P + O = P. assume P ≠ O and Q ≠ O

If P = (x, y), then -P = (x, -y). Note that P + (-P) = P - P = O.

To add two points P and Q with different x coordinates
◦ Draw a straight line between them
◦ Find the third point of intersection R.
◦ There is a unique point R (unless the line is tangent to the curve at either P or Q)
◦ To form a group structure, we need to addthree points: P + Q = -R.
◦ P + Q is defined to be the mirror image of the third point of intersection

For two points, P and -P, with the same x coordinate. The points are joined by a vertical line, which can be
viewed as also intersecting the curve at the infinity point
To double a point Q, draw the tangent line and find the other point of intersection S. Then Q + Q = 2Q = -S.
With the above list of rules, The set E(a, b) is an abelian group.

DR. ALEKHA KUMAR MISHRA 46

Algebraic description of addition
For two distinct points, P = (xP, yP) and Q = (xQ, yQ), that are not negatives of
each other, the slope of the line l that joins them is
Δ = (yQ - yP)/(xQ - xP).
There is exactly one other point where l intersects the elliptic curve, and that is
the negative of the sum of P and Q.
After some algebraic manipulation, we can express the sum R = P + Q as
xR = Δ 2 - xP - xQ
yR = -yP + Δ(xP - xR)
For R = P+P
xR = ((3x2𝑃 + a )/ 2yp)2
yR = ((3x2𝑃 + a )/ 2yp) (xP - xR)- yP

DR. ALEKHA KUMAR MISHRA 47

Elliptic curves for cryptography
Elliptic curves in which the variables and coefficients are all
restricted to elements of a finite field
◦ Prime curves over Zp and
◦ Binary curves over GF(2m)

DR. ALEKHA KUMAR MISHRA 48

For elliptic curves over Zp
The variables and coefficients take on values in the set of integers from 0 through p - 1 and all
calculations are performed modulo p.
The elliptive curve equation of the form
y2 mod p = (x3 + ax + b) mod p
The set Ep(a, b) consisting of all pairs of integers (x, y) that satisfy the above equation
For example, for a = 1, b = 1, and p = 23, the equation is given by
y2 mod 23 = (x3 + x + 1) mod 23
P( 9, 7) a point satisfies this equation
For the set E23(1, 1), we are only interested in the nonnegative integers ((0,0) - (p-1,p-1))
Abelian group can be defined based on the set Ep(a, b) provided (4a2+27b2) mod p ≠ 0 mod p
In a finite group Ep(a, b) number of points in the curve is bounded by p+1-2√p ≤ N ≤ p+1+2√p

DR. ALEKHA KUMAR MISHRA 49

E23(1,1) set

DR. ALEKHA KUMAR MISHRA 50

Addition rule over Ep(a, b)
1) P+O=P
2) If P= (xP , yP) then -P = (xP , -yP)
Ex. in E23(1, 1) if P= (13,7) , the -P=(13,-7 mod 23) = (13,16)
3) If P= (xP , yP) and Q= (xQ , yQ) with P ≠ Q, the R = P+Q = (xR , yR), with
xR = (λ2 – xP - xQ ) mod p
yR = (λ(xP - xR) - yP ) mod p
Where,
yQ−yP
λ = if P ≠ Q
xQ−xP
3x2𝑃 +𝑎
= if P = Q
2𝑦𝑃
4) Multiplication is defined as repeated addition: 4P = P+P+P+P

DR. ALEKHA KUMAR MISHRA 51

An example
In E23(1, 1). let P = (3, 10) and Q = (9, 7)
Then λ = (7 – 10)/(9 – 3) mod 23 = -3/6 mod 23 = -1/2 mod 23 = 11
xR = (112 - 3 - 9) mod 23 = 109 mod 23 = 17
yR = (11(3 - 17) - 10) mod 23 = -164 mod 23 = 20, So P + Q = (17, 20).
To compute 2P, λ = (3(32) + 1 )/ (2 * 10) mod 23 = 5/20 mod 23 = ¼
mod 23 = 6
xR = (62 - 3 - 3) mod 23 = 30 mod 23 = 7
yR = (6(3 - 7) - 10) mod 23 = (-34) mod 23 = 12
So, 2P = (7, 12).

DR. ALEKHA KUMAR MISHRA 52

 Elliptive curve over m
GF(2 )
It uses a cubic equation in which variable and coefficient take value in GF(2m).
The cubic equation of the curve is y2+xy=x3+ax2+b
A finite abelian group can be defined based on the set E2𝑚 (a,b), provided that b ≠ 0
If P,Q are points in E2𝑚 (a,b), then
P+O=P
If P= (xP , yP), then –P = (xP , xP + yP)
If P= (xP , yP) and Q= (xQ , yQ) , P ≠ -Q , and P ≠ Q, then R=P+Q = (xR , yR), where
xR = (λ2 + λ + xP + xQ +a)
yR = (λ(xP+ xR) + xR + yP) , where λ = (yQ+ yP)/(xQ+ xP)
R=2P=(xR , yR), where
xR = (λ2 + λ + a)
yR = xP2 +(λ+ 1)xR ,where λ = xP+(yP/xP)

DR. ALEKHA KUMAR MISHRA 53

Elliptive curve cryptography
KEY GENERATION
Select a large integer q, (either a prime p or an integer 2m ), and parameters a and b for for the
curve.
Select a base point G = (x1, y1) in Eq(a, b) of order a large value n. The order n of a point G on an
elliptic curve is the smallest positive integer n such that nG = 0
Eq(a,b) and the point G(x1,y1) are public
Let and A and B are two users where A wish to send some secret message to B
A selects private key, an integer nA < n.
A then generates a public key PA = nA × G; a point in Eq(a, b).
B similarly selects a private key nB and computes a public key PB.
On exchanging PA, and PB ,A generates the secret key k = nA × PB and B generates the secret key
k = nB × PA.
These two step results in same key because nA × PB = nA × (nB * G) = nB × (nA × G) = nB × PA

DR. ALEKHA KUMAR MISHRA 54

Example : key generation
p = 211; Ep(0, -4), which is equivalent to the curve
y2 = x3 - 4; and G = (2, 2). One can calculate that 240G = O.
A’s private key is nA = 121, so A’s public key is PA = 121(2, 2) = (115,
48).
B’s private key is nB = 203, so B’s public key is 203(2, 2) = (130,
203).
The shared secret key is 121(130, 203) = 203(115, 48) = (161, 69).

DR. ALEKHA KUMAR MISHRA 55

Elliptive curve cryptography
ENCRYPTION
Encode the plaintext message m to be sent as an (x, y) point Pm
A chooses a random positive integer k
Produces the ciphertext Cm as a pair of points: Cm = {kG, Pm + kPB}
DECRYPTION
B multiplies the first point in Cm by B’s private key and subtracts the
result from the second point:
Pm + kPB - nB(kG) = Pm + k(nBG) - nB(kG) = Pm

DR. ALEKHA KUMAR MISHRA 56

ECC Analysis
A added kPB to Pm and A only knows the value of k
Even though PB is a public key, nobody can remove the mask k from
kPB.
If one knows the private key nB then it can be removed.
For an attacker to recover the message, the attacker would have to
compute k given G and kG, which is assumed to be hard.

DR. ALEKHA KUMAR MISHRA 57

Example
The global public elements are q = 257; Eq(a, b) = E257(0, -4), (y2 = x3 – 4); and
G = (2, 2).
Bob’s private key is nB = 101, and his public key is PB = nBG = 101(2, 2) = (197,
167).
Alice wishes to send a message to Bob that is encoded in the elliptic point Pm =
(112, 26).
Alice chooses random integer k = 41 and computes kG = 41(2, 2) = (136, 128),
kPB = 41(197, 167) = (68, 84) and Pm + kPB = (112, 26) + (68, 84) = (246, 174).
Alice sends the ciphertext Cm = (C1, C2) = {(136, 128), (246, 174)}
 Bob receives the ciphertext and computes
C2 - nBC1 = (246, 174) -101(136, 128) = (246, 174) - (68, 84) = (112, 26).

DR. ALEKHA KUMAR MISHRA 58

Comparable Key Sizes in Terms of
Computational Effort for Cryptanalysis

DR. ALEKHA KUMAR MISHRA 59