公钥密码学研究与进展.pptVIP

Key Lengths Don B. Johnson, “ECC, Future Resiliency and High Security Systems” ECC Attacks Pohlig-Hellman Attack Shanks Baby-step, Giant-step Tame Wild Kangaroos (Pollard) The tame kangaroo is given a spade told to dig a hole every 10 jump If both kangaroo are jumping around a field, the wild will fall down MOV Attack (Menezes, Okamoto, Vanstone) Discovered a reduction of the DLP in Fq to Fqk, for some small integers k, if qk = 1 (mod #E(Fq)) the ECDLP can be solved in sub-exponential time Supersingular curves(#E(Fq) = q+1-m?char(E)) were susceptible Anomalous Curve Attacks Anomalous curve is introduced because it resists to MOV attack, Curves where #E(Fq) = q ECDLP can be solved by p-adic numbers They jump to random direction, but assumes the direction will depend on the current point When we choose curve for ECC, we have to check these conditions Selecting a Curve Randon selection : max #E = smax Draw E at random in Fq -- coefficients Compute #E(Fq) ? SEA Algorithm Check MOV anomalous conditions Attempt to factor #E(Fq) in reasonable time If #E(Fq) = s?r, ssmax, r is prime, then return CM(Complex Multiplication) Method CM : endomorphism φ : C/L? C/L, φ(z) = cz There is Galois extension Kn = Q(i)(C[n]) which is endomorphism by CM Given n = #E(Fq), determine p and D, then calculate Kn by CM Curves from Standard : proved, interoperable Computing order is the biggest issue in ECC ! ECC Encryption ElGamal Encryption for ECC version: Encryption: Let (x,y=xP) is a secret/public key pair of the receiver. The sender randomly chooses a number t, the ciphertext for message m is (C1,C2)=(tP, m+t y) Decryption: m= C2-x C1 Difficulties: 1、Message embedding algorithm; 2、CCA2 attack. Please refer to /wiki/Integrated_Encryption_Scheme ECC 标准化 国外已有用椭圆曲线进行加解密的产品出现在市场上。美国NeXT Computer公司已开发出快速椭圆曲线加密(FEE)算法，其秘密钥为容易记忆的字串。加拿大Certicom公司也开发出了可实用的椭圆曲线密码体制的集成电路，可实现高效加密、数字签字、认证和密钥管理等（）。3COM/Palm Computing、Motorala、Verifone、AtallaLorp、terling Commerce、日本Mitsushita及NTT