Prime Numbers

392 Chapter 8 THE UBIQUITY OF PRIME NUMBERS
Algorithm 8.1.6 (ECC key exchange). Two individuals, Alice and Bob,
agree on a public elliptic curve E and a public point P ∈ E whose point order
is n. (In many scenarios, n is prime, or admits of a large prime factor.) This
algorithm produces a mutual key.
1. [Alice generates public key]
Alice chooses random KA ∈ [2,n− 2]; // Alice’s secret key.
Q =[KA]P ; // Point Q is Alice’s public key.
2. [Bob generates public key]
Bob chooses random KB ∈ [2,n− 2]; // Bob’s secret key.
R =[KB]P ; // Point R is Bob’s public key.
3. [Each individual creates the unique mutual key]
Bob computes point K =[KB]Q;
Alice computes point K =[KA]R. // Results agree.
That the mutual key is unique follows directly from the group rules, as
[KB]([KA]P )=[KBKA]P =[KAKB]P =[KA]([KB]P ).
Again the notion of the difficulty of Bob, say, discovering Alice’s private key
KA is presumably the difficulty of EDL. That is, if EDL is easy, then the ECC
key exchange is not secure; and, it is thought that the converse is true as well.
Note that in ECC implementations, private keys are integers, usually roughly
thesizeofp (but could be larger than p—recall that the group order #E can
itself slightly exceed p), while public keys and the exchanged mutual key are
points. Typically, some bits of a mutual key would be used in, say, a block
cipher; for example, one might take the bits of the x-coordinate.
A primary result in regard to the EDL problem is the so-called “MOV
theorem,” which states essentially that the EDL problem over Fp is equivalent
to the normal DL problem over F∗ pB,forsomeB [Menezes et al. 1993]. There is
a practical test for the estimated level of security in an ECC system—call this
level the MOV threshold—see [Solinas 1998]. In practice, the MOV threshold
B is “about 10,” but depends, of course, on the prevailing complexity estimate
for the DL problem in finite fields. Note, however, that “supersingular” curves,
having order #E = p+1, are particularly susceptible, having EDL complexity
known to be no worse than that of the DL problem in Fpk, some k ≤ 6
[Menezes et al. 1993]. Such curves can be ruled out a priori for the reason
stated.
There is also the so-called Semaev–Smart–Satoh–Araki attack, when the
order is #E = p, based on p-adic arithmetic. (The 1998 announcement in
[Smart 1999] caused a noticeable ripple in the cryptography field, although
the theoretical knowledge is older than the announcement; see [Semaev 1998],
[Satoh and Araki 1998].) More modern attacks, some of which involve the
real-timing of elliptic ladders, are discussed in may references; for example,
see V. Müller’s site [Müller 2004].
Incidentally, the question of how one finds elliptic curves of prime order
(and so having elements of prime order) is itself interesting. One approach is