Prime Numbers

8.1 Cryptography 393
just to generate random curves and assess their orders via Algorithm 7.5.6.
Another is to use Algorithm 7.5.9 or 7.5.10 to generate possible orders, and
when a prime order is found, go ahead and specify a curve with that order.
But there are clever variants of these basic approaches (see Exercise 8.27). It
should be remarked that some cryptographers accept curves of order #E = fr,
where f may consist of small prime factors while r is a large prime. For such
curves, one still prefers to find points of the prime order r, and this can be
done very simply:
Algorithm 8.1.7 (Find a point of prime order). Given an elliptic curve
Ea,b(Fp) of order #E = fr, where r is prime, this algorithm endeavors to find a
point P ∈ E of order r.
1. [Find starting point]
Choose a random point P ∈ E, via Algorithm 7.2.1;
2. [Check multiple]
Q =[f]P ;
if(Q == O) goto [Find starting point];
return Q; // A point of prime order r.
The algorithm is admittedly almost trivial, but important in cryptography
applications. One such application is elliptic signature. There is a standard
elliptic-curve digital signature scheme that runs like so, with the prerequisite
of a point of prime order evident right at the outset:
Algorithm 8.1.8 (Elliptic curve digital signature algorithm (ECDSA)).
This algorithm provides functions for key generation, signing, and verification
of messages. A message is generally denoted by M, an integer, and it is assumed
that a suitable hash function h is in hand.
1. [Alice generates key]
Alice chooses a curve E, whose order #E = fr with r a “large” prime;
Alice finds point P ∈ E of order r, via Algorithm 8.1.7;
Alice chooses random d ∈ [2,r− 2];
Q =[d]P ;
Alice publishes public key (E,P,r,Q); // Private key is d.
2. [Alice signs]
Alice chooses random k ∈ [2,r− 2];
(x1,y1) =[k]P ;
R = x1 mod r; // Note that R = 0.
s = k −1 (h(M)+Rd) modr;
if(s == 0) goto [Alice signs];
Alice’s signature is the pair (R, s), transmitted with message M;
3. [Bob verifies]
Bob obtains Alice’s public key (E,P,r,Q);
w = s −1 mod r;
u1 = h(M)w mod r;
u2 = Rw mod r;