SEC 1: Elliptic Curve Cryptography

ly a finite field consists of a finite set of objects called field elements together with the description of two operations addition and multiplication that can be performed on pairs of field elements. These operations must possess certain properties. It turns out that there is a finite field containing q field elements if and only if q is a power of a prime number, and furthermore that in fact for each such q t ere is precisely one finite field. The finite field containingq elements is denoted by Fq. Here only two types of finite fields Fq are used — finite fields F p with q= p, p an odd prime which are called prime finite fields, and finite fields F2m with q= 2m for somem 1 which are called characteristic 2 finite fields. It is necessary to describe these fields concretely in order to precisely specify cryptographic schemes based on ECC. Section 2.1.1 describes prime finite fields and Section 2.1.2 describes characteristic 2 finite fields. 2.1.1 The Finite FieldF p The finite fieldF p is the prime finite field containingp elements. Although there is only one prime finite field F p for each odd primep, there are many different ways to represent the elements of F p. Here the elements of F p should be represented by the set of integers: f0;1; : : : ; p 1g with addition and multiplication defined as follows: Addition: If a;b2 F p, thena+b= r in F p, wherer 2 [0; p 1] is the remainder when the integer a+b is divided byp. This is known as addition modulo p and writtena+b r (modp). Multiplication: If a;b2 F p, thena:b= s in F p, wheres2 [0; p 1] is the remainder when the integer ab is divided byp. This is known as multiplication modulo p and writtena:b s (modp). Page 4 SEC 1: Elliptic Curve Cryptography Ver. 0.5 Addition and multiplication inF p can be calculated efficiently using standard algorithms for ordinary integer arithmetic. In this representation of F p, the additive identity or zero element is the integer 0, and the multiplicative identity is the integer 1. It is convenient to define subtraction and division of field elements just as it is convenient to define subtraction and division of integers. To do so, the additive inverse (or negative) and multiplicative inverse of a field element must be described: Additive inverse: Ifa2 F p, then the additive inverse ( a) of a in F p is the unique solution to the equationa+x 0 (modp). Multiplicative inverse: Ifa2 F p, a 6= 0, then the multiplicative inverse a 1 of a in F p is the unique solution to the equation a:x 1 (modp). Additive inverses and multiplicative inverses in F p can be calculated efficiently. Multiplicative inverses are calculated using the extended Euclidean algorithm. Division and subtraction are defined in terms of additive and multiplicative inverses: a b mod p is a+( b) mod p anda=b mod p is a:(b 1) mod p. Here the prime finite fields F p used should have: dlog2 pe 2 f112;128;160;192;224;256;384;521g: This restriction is designed to facilitate interoperability, while enabling implementers to deploy implementations which are efficient in terms of computation and communication since p is aligned with word size, and which are capable of furnishing all commonly required security levels. Inclusion of dlog2 pe= 521 instead of dlog2 pe= 512 is an anomaly chosen to align this document with other standards efforts in particular with the U.S. government’s recommended elliptic curve domain parameters [67]. 2.1.2 The Finite FieldF2m The finite fieldF2m is the characteristic 2 finite field containing 2 m elements. Although there is only one characteristic 2 finite field F2m for each power 2 m of 2 with m 1, there are many different ways to represent the elements of F2m. Here the elements of F2m should be represented by the set of binary polynomials of degree m 1 or less: fam 1x +am 2x 2+ +a1x+a0 : ai 2 f0;1gg with addition and multiplication defined in terms of an irreducible binary polynomial f (x) of degreem, known as the reduction polynomial, as follows: Addition: If a= am 1x 1+ +a0, b= bm 1x 1+ +b0 2 F2m, thena+b= r in F2m, where r = rm 1x 1+ + r0 with ri ai +bi (mod 2). Multiplication: If a = am 1x 1+ +a0, b = bm 1x 1+ +b0 2 F2m, thena:b= s in F2m, wheres= sm 1x 1+ +s0 is the remainder when the polynomial ab is divided by f (x) with all coefficient arithmetic performed modulo 2. 2 Mathematical Foundations Page 5 Addition and multiplication inF2m can be calculated efficiently using standard algorithms for ordinary integer and polynomial arithmetic. In this representation of F2m, the additive identity or zero element is the polynomial 0, and the multiplicative identity is the polynomial 1. Again it is convenient to define subtraction and division of field elements. To do so the additive inverse (or negative) and multiplicative inverse of a field element must be described: Additive inverse: Ifa2 F2m, then the additive inverse ( a) of a in F2m is the unique solution to the equationa+x= 0 in F2m. Multiplicative inverse: Ifa 2 F2m, a 6= 0, then the multiplicative inverse a 1 of a in F2m is the unique solution to the equation a:x= 1 in F2m. Additive inverses and multiplicative inverses in F2m can be calculated efficiently using the extended Euclidean algorithm. Division and subtraction are defined in terms of additive and multiplicative inverses: a b in F2m is a+( b) in F2m anda=b in F2m is a:(b 1) in F2m. Here the characteristic 2 finite fields F2m used should have: m2 f113;131;163;193;233;239;283;409;571g and addition and multiplication in F2m should be performed using one of the irreducible binary polynomials of degreem in Table 1. As before this restriction is designed to facilitate interoperability while enabling implementers to deploy efficient implementations capable of meeting common security requirements. Field Reduction Polynomial(s) F2113 f (x) = x 113+x9+1 F2131 f (x) = x 131+x8+x3+x2+1 F2163 f (x) = x 163+x7+x6+x3+1 F2193 f (x) = x 193+x15+1 F2233 f (x) = x 233+x74+1 F2239 f (x) = x 239+x36+1 orx239+x158+1 F2283 f (x) = x 283+x12+x7+x5+1 F2409 f (x) = x 409+x87+1 F2571 f (x) = x 571+x10+x5+x2+1 Table 1: Representations of F2m Page 6 SEC 1: Elliptic Curve Cryptography Ver. 0.5 The rule used to pick acceptable m’s was: in each interval between integers in the set: f112;128;160;192;224;256;384;512;1024g; if such anmexists, select the smallest primein the interval with the property that there exists a Koblitz curve whose order is 2 or 4 times a prime over F2m; otherwise simply select the smallest primein the interval. (A Koblitz curve is an elliptic curve over F2m with a;b2 f0;1g.) The inclusion ofm= 239 is an anomaly chosen since it has already been widely used in practice. The inclusion of m= 283 instead of m= 277 is an anomaly chosen to align this document with other standards efforts in particular with the U.S. government’s recommended elliptic curve domain parameters [67]. Composite m was avoided to align this specification with other standards efforts and to address concerns expressed by some experts about the security of elliptic curves defined over F2m with m composite see, for example, [32]. The rule used to pick acceptable reduction polynomials was: if a degree m binary irreducible trinomial: f (x) = xm+xk+1 with m> k 1 exists, use the irreducible trinomial with k as small as possible; otherwise use the degree m binary irreducible pentanomial: f (x) = xm+xk3 +xk2 +xk1 +1 with m> k3 > k2 > k1 1 with (1) k3 as small as possible, (2) k2 as small as possible given k3, and (3)k1 as small as possible givenk3 andk2. These polynomials enable efficient calculation of field operations. The second reduction polynomial atm= 239 is an anomaly chosen since it has been widely deployed. 2.2 Elliptic Curves An elliptic curve overFq is defined in terms of the solutions to an equation in Fq. The form of the equation defining an elliptic curve over Fq differs depending on whether the field is a prime finite field or a characteristic 2 finite field. Section 2.2.1 describes elliptic curves over prime finite fields, and Section 2.2.2 describes elliptic curves over characteristic 2 finite fields. 2.2.1 Elliptic Curves overF p Let F p be a prime finite field so that p is an odd prime number, and let a;b2 F p satisfy 4:a3+27:b2 6 0 (modp). Then an elliptic curveE(F p) overF p defined by the parameters a;b2 F p consists of the set of solutions or pointsP= (x;y) for x;y2 F p to the equation: y2 x3+a:x+b (modp) together with an extra point O called the point at infinity. The equation y2 x3 +a:x+b (modp) is called the defining equation of E(F p). For a given pointP= (xP;yP), xP is called thex-coordinate ofP, andyP is called they-coordinate ofP. 2 Mathematical Foundations Page 7 The number of points on E(F p) is denoted by # E(F p). The Hasse Theorem states that: p+1 2pp #E(F p) p+1+2pp: It is possible to define an addition rule to add points on E. The addition rule is specified as follows: 1. Rule to add the point at infinity to itself: