A Security Analysis of the NIST SP 800-90 Elliptic Curve Random Number Generator

An elliptic curve random number generator (ECRNG) has been approved in a NIST standard and proposed for ANSI and SECG draft standards. This paper proves that, if three conjectures are true, then the ECRNG is secure. The three conjectures are hardness of the elliptic curve decisional Diffie-Hellman problem and the hardness of two newer problems, the x-logarithm problem and the truncated point problem. The x-logarithm problem is shown to be hard if the decisional Diffie-Hellman problem is hard, although the reduction is not tight. The truncated point problem is shown to be solvable when the minimum amount of bits allowed in NIST standards are truncated, thereby making it insecure for applications such as stream ciphers. Nevertheless, it is argued that for nonce and key generation this distinguishability is harmless.

[1]  Manuel Blum,et al.  How to generate cryptographically strong sequences of pseudo random bits , 1982, 23rd Annual Symposium on Foundations of Computer Science (sfcs 1982).

[2]  Burton S. Kaliski,et al.  A Pseudo-Random Bit Generator Based on Elliptic Logarithms , 1986, CRYPTO.

[3]  Michael Luby,et al.  Pseudorandomness and cryptographic applications , 1996, Princeton computer science notes.

[4]  Moni Naor,et al.  Number-theoretic constructions of efficient pseudo-random functions , 1997, Proceedings 38th Annual Symposium on Foundations of Computer Science.

[5]  Dan Boneh,et al.  The Decision Diffie-Hellman Problem , 1998, ANTS.

[6]  Simon Blake-Wilson,et al.  SEC 1: Elliptic Curve Cryptography , 1999 .

[7]  Oded Goldreich,et al.  Foundations of Cryptography: Basic Tools , 2000 .

[8]  Oded Goldreich,et al.  Foundations of Cryptography: List of Figures , 2001 .

[9]  Igor E. Shparlinski,et al.  On the Uniformity of Distribution of Congruential Generators over Elliptic Curves , 2001, SETA.

[10]  Oded Goldreich.  Foundations of Cryptography: Index , 2001 .

[11]  Nigel P. Smart,et al.  A note on the x-coordinate of points on an elliptic curve in characteristic two , 2001, Inf. Process. Lett..

[12]  Moni Naor,et al.  Number-theoretic constructions of efficient pseudo-random functions , 2004, JACM.

[13]  Nicolas Gürel.  Extracting bits from coordinates of a point of an elliptic curve , 2005, IACR Cryptol. ePrint Arch..

[14]  Berry Schoenmakers,et al.  Cryptanalysis of the Dual Elliptic Curve Pseudorandom Generator , 2006, IACR Cryptol. ePrint Arch..

[15]  Reza Rezaeian Farashahi,et al.  Efficient Pseudorandom Generators Based on the DDH Assumption , 2007, Public Key Cryptography.