Introduction to the principle of ECC encryption algorithm

Objective

Like RSA (Ron Rivest,adi Shamir,len Adleman three-bit genius), ECC (Elliptic Curves cryptography, Elliptic curve cryptography) also belongs to the public key algorithm. At present, the domestic detailed introduction of ECC in the public literature is not much (anyway I did not find). Some profiles, but also generalities, after reading still can not understand the essence of ECC (perhaps my understanding is too poor). Some days ago I found some material from the foreign website, after reading to ECC seems ignorant. So I want to put my understanding of ECC, and to share with you. Of course, ECC broad and profound, my understanding is very superficial, the article is a lot of mistakes, welcome all the way master criticism, my brother I am all ears, and timely correction. The article will be a serial way, I write a little bit to post a little. This article focuses on the theory, code implementation is not involved. This requires you to have a little bit of math skills. It is best that you understand the RSA algorithm and have an understanding of the public key algorithm. "The basic of Modern algebra," "Elementary number Theory," such as books, it is best for you to turn first, which is helpful for you to understand this article. Don't be afraid, I try to make the language more popular, I hope this article can become a stepping stone to learn ECC.

First, from parallel lines.

Parallel lines, never intersect. No one doubts that: but in modern times this conclusion has been questioned. Will parallel lines intersect far and far away? No one has actually seen it. So "parallel lines, never intersect" just assume (everyone think of junior high school learning parallel axiom, is not proven). Since it is possible to assume that parallel lines never intersect, you can also assume that parallel lines intersect far and far away. That is, parallel lines intersect at Infinity Point p∞ (Please close your eyes, imagine that Infinity Point p∞,p∞ is not very unreal, in fact, it is not so much a mathematical exercise of the abstract ability of people, rather than exercise people's imagination). Give a picture to help you understand:



The advantage of having a p∞ point on a line is that all straight lines intersect with only one intersection. This unifies the parallel and intersect of the straight line. To distinguish it from the Infinity Point, the point on the original plane is called the normal point.

The following are several properties of the Infinity Point.

▲ The Infinity Point on the line L can only have one.
(can be derived directly from the definition)
A group of parallel lines on a plane has a common infinity point.
(can be derived directly from the definition)
There are different infinity points on the plane of any intersecting two straight lines l1,l2.
(otherwise L1 and L2 have a common infinity point P, then L1 and L2 have two intersection A, p, so the hypothesis is wrong.) ）
▲ all the infinity points on the plane form ainfinitely far line。 (Imagine this straight line yourself)
▲ all the infinity point on the plane and the common point constituteprojective plane。




Second, projective plane coordinate system

The projective plane coordinate system is an extension to the normal plane Cartesian coordinate system (the Cartesian plane Cartesian coordinate system we learned at the beginning). We know that the normal plane Cartesian coordinate system does not design coordinates for infinity points, and cannot represent infinity points. In order to represent the infinity point, the projective plane coordinate system is produced, and the projective plane coordinate system can also represent the old normal point very well (mathematics is also "backwards compatible").



We transform the coordinates of point a (x, y) on the normal planar Cartesian coordinate system as follows:
Make x=x/z, y=y/z (z≠0); a point can be represented as (x:y:z).
becomes a coordinate point with three parameters, which establishes a new coordinate system for the point on the plane.

Example 2.1: Finding the coordinates of a point in a new coordinate system.
Solution: ∵x/z=1, y/z=2 (z≠0) ∴x=z,y=2z∴ coordinates (Z:2Z:Z), z≠0. That is (1:2:1) (2:4:2) (1.2:2.4:1.2) and other shapes such as (z:2z:z), z≠0 coordinates, are (all) in the new coordinate system coordinates.

We can also get a straight line equation ax+by+cz=0 (think about why?) Tip: The general equation of straight line in normal plane Cartesian coordinates is ax+by+c=0. Can the new coordinate system represent an infinity point? Let's think about where the infinity point is. Based on the knowledge in the previous section, we know that the Infinity Point is the intersection of two parallel lines. So, how do you find the intersection coordinates of two lines? This is the knowledge of the middle school, that is, two straight lines corresponding to the equation to solve. The equations for parallel lines are:
ax+by+c1z =0; ax+by+c2z =0 (C1≠C2);
Why Hint: can be considered from the slope, because parallel lines slope the same);

The two equations are solved. There are c2z= c1z=-(Ax+by), ∵c1≠c2∴z=0∴ax+by=0;
So the infinity point is that form (x:y:0). Note that the usual point z≠0, Infinity Point z=0, so the Infinity line corresponds to the equation is z=0.

Example 2.2: To find the parallel line l1:x+2y+3z=0 and l2:x+2y+z=0 intersection of the Infinity Point.
Solution: Because L1∥L2 so have z=0, x+2y=0; so the coordinates are ( -2y:y:0), y≠0. That is, ( -2:1:0) ( -4:2:0) ( -2.4:1.2:0) and other shapes such as ( -2y:y:0), y≠0 coordinates, all represent this infinity point.

It seems that this new coordinate system can represent all the points on the projective plane, and we will call this coordinate system that can represent all the points on the projective plane calledprojective plane coordinate system。


Practice:
1. Find the coordinates of point A (2,4) in the projective plane coordinate system.
2, to find the projective plane coordinate system under the point (4.5:3:0.5), in the normal plane Cartesian coordinates.
3. Seek the coordinates of the Infinity point on the line x+y+z=0.
4, Judge: The line ax+by+cz=0 on the Infinity Point and the Infinity Line and the line ax+by=0 intersection, is it the same point?


Three, Elliptic curve

In the previous section, we established the projective plane coordinate system, which we will set up in this coordinate system to establish the elliptic curve equation. Because we know that the curves in coordinates can be represented by equations (for example, the unit circle equation is x2+y2=1). Elliptic curves are curves, and natural elliptic curves have equations.

Definition of elliptic curve:
An elliptic curve satisfies the equation on the projective plane
Y2z+a1xyz+a3yz2=x3+a2x2z+a4xz2+a6z3----------------[3-1]
The set of all points, and each point on the curve is non-singular (or smooth).

Definition of the explanation:

▲Y2Z+A1XYZ+A3YZ2 = x3+a2x2z+a4xz2+a6z3 is a Weierstrass equation (Weierstrass, Karl Theodor Wilhelm weierstrass,1815-1897), which is a homogeneous equation.

The shape of the elliptic curve is not elliptical. Just because of the description equation of an elliptic curve, which is analogous to the equation for calculating the circumference of an ellipse (the equation for calculating the perimeter of an ellipse, I have not seen, and the Elliptic line integral (with a density of 1) is not obtained. Who knows this equation, please tell me ah ^_^), hence the name.

Let's see what the elliptic curve looks like.





▲ the so-called "non-singular" or "smooth", in mathematics refers to any point on the curve of the derivative fx (x, y, z), Fy (x, Y, z), Fz (x, y, z) can not be 0. If you have not studied advanced mathematics, you can understand this word, that is, any point that satisfies the equation has a tangent.

The following two equations are not elliptic curves, although they are in the form of equation [3-1].




Because they do not have tangents at (0:0:1) points (i.e. origin).

There is an infinity point o∞ (0:1:0) on the elliptic curve, because this point satisfies the equation [3-1].

Know the infinity point on the elliptic curve. We can put the elliptic curve in the normal plane Cartesian coordinate system. Because the normal plane Cartesian coordinate system is only less infinitely far point than the projective plane coordinate system. In the normal plane Cartesian coordinate system, we find the curve equation of all the ordinary points on the elliptic curve, plus the Infinity Point o∞ (0:1:0), do not constitute the elliptic curve?

We set x=x/z, the y=y/z generation equation [3-1] to get:
y2+a1xy+a3y = X3+a2x2+a4x+a6-------------------------[3-2]

That is to say, the smooth curve of satisfying equation [3-2] plus an infinity point o∞, the elliptic curve is formed. In order to facilitate operation, expression, and comprehension, the future discussion of elliptic curves will be mainly used in the form of [3-2].

At the end of this section, we discuss the tangent slope of the elliptic curve.
It is known from the definition of elliptic curve that the elliptic curve is smooth, so the normal point on the elliptic curve has tangent. And the most important parameter of tangent is the slope K.

Example 3.1: The slope K of the tangent of the normal point a (x, y) is obtained on the elliptic curve equation y2+a1xy+a3y=x3+a2x2+a4x+a6.
Solution: Make f (x, y) = Y2+a1xy+a3y-x3-a2x2-a4x-a6
Seeking partial derivative
Fx (x, y) = A1y-3x2-2a2x-a4
Fy (x, y) = 2y+a1x +a3
The derivative is: F ' (x) =-Fx (x, y)/Fy (x, y) =-(A1Y-3X2-2A2X-A4)/(2y+a1x +a3)
= (3x2+2a2x+a4-a1y)/(2y+a1x +a3)
So k= (3x2+2a2x+a4-a1y)/(2y+a1x +a3)------------------------[3-3]

Do not understand the problem-solving process is not related, remember the conclusion [3-3] can be.


Practice:
1. The elliptic curve equation y2z=x3-xz2 and y2z=x3+xz2+z3 of the legend are converted to the equations on the normal plane Cartesian coordinate system.


Iv. addition on an elliptic curve

In the previous section, we've seen the image of an elliptical curve, but there seems to be no connection between points and points. Can we create an algorithm similar to the addition on the real axis? The genius mathematician found this algorithm.

☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
Since the introduction of the concept of group, ring and Domain in the recent century, the algebra operation has achieved a high degree of unification. For example, mathematicians summed up the main features of general addition, and proposed Dabigatran (also called commutative group, or Abel (abelian) group), in the eyes of the group. There is no difference between the addition of real numbers and the addition of elliptic curves. This may be the mathematical abstraction:). For the specific concepts of group and Group, please refer to the Mathematics Book of modern algebra.
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆

Algorithm: Arbitrarily take the elliptic curve on the two point P, Q (if p, q two points coincident, then do the tangent of the P-point) to do a straight line in the elliptic curve of the other R ', over R ' to do the y-axis parallel intersection of R. We stipulate p+q=r. （）





The law is detailed:
▲ Here the + is not the ordinary addition of the real number, but the addition from the ordinary addition, he has some ordinary addition of some properties, but the specific algorithm is obviously different from ordinary addition.

▲ According to this law, you can know that the elliptic curve Infinity Point o∞ and the elliptic curve point P's connection to P ', over P ' as the parallel line of the Y axis in P, so there is an infinity point o∞+ p = p. Thus, the function of Infinity Point o∞ is equivalent to zero in ordinary addition (0+2=2), we call Infinity Point o∞0 USD。 At the same time we put P ' called P'sNegative Element(abbreviation, negative P; record,-P). See



▲ According to this rule, the following conclusions can be obtained: if the three points a, B, C on the elliptic curve are in the same line, then their sum equals 0 yuan, namely a+b+c= o∞

▲k the same point P added, we remember it as KP. such as: P+p+p = 2p+p = 3P.



Below, we use the coordinates of P, Q points (x1,y1), (X2,y2), to find the coordinates of the R=P+Q (X4,Y4).

Example 4.1: To find the elliptic curve equation Y2+a1xy+a3y=x3+a2x2+a4x+a6, the normal point P (x1,y1), Q (X2,y2) and R (x4,y4) coordinates.
Solution: (1) First seek point-R (X3,y3)
Because the P,q,-r three-point collinear, the collinear equation is y=kx+b, in which
If P≠q (p,q two points do not coincide) then
Linear slope k= (y1-y2)/(X1-X2)
If the p=q (p,q two points coincident) the line is the tangent of the elliptic curve, it is known from Example 3.1:
k= (3x2+2a2x+a4-a1y)/(2Y+A1X+A3)

So the coordinate value of the P,q,-r three point is the equation set:
Y2+a1xy+a3y=x3+a2x2+a4x+a6-----------------[1]
Y= (kx+b)-----------------[2]
The solution.

Will [2], substituting [1] has
(kx+b) 2+a1x (kx+b) +a3 (kx+b) =x3+a2x2+a4x+a6--------[3]
for [3] into the general equation, according to the three-time equation root and coefficient relationship (when the three-time term coefficient is 1 o'clock;-x1x2x3 equals constant term coefficients, x1x2+x2x3+x3x1 equals the first-order coefficient,-(x1+x2+x3) equals two times the coefficient. ）
So-(X1+X2+X3) =A2-KA1-K2
x3=k2+ka1+a2+x1+x2;---------------------find out the horizontal axis of the point-R
Because k= (y1-y3)/(X1-X3)
Y3=y1-k (x1-x3);-------------------------------find out the ordinate of the point-R

(2) using the-R to seek R
Apparently there were x4=x3= k2+ka1+a2+x1+x2; ------------Find out the horizontal axis of the point R
And Y3 Y4 is the solution of the x=x4 equation y2+a1xy+a3y=x3+a2x2+a4x+a6
To the general equation y2+ (a1x+a3) y (x3+a2x2+a4x+a6) =0, according to the two-time equation root and coefficient relationship:
-(A1X+A3) =y3+y4
therefore y4=-y3-(A1X+A3) =k (x1-x4)-y1-(A1X4+A3); ---------------find out the ordinate of point R
That
x4=k2+ka1+a2+x1+x2;
Y4=k (x1-x4)-y1-a1x4-a3;

At the end of this section, it is important to note that previously provided images may give you an illusion that the elliptic curve is symmetric about the x-axis. In fact, elliptic curves are not necessarily about x-axis symmetry. such as the y2-xy=x3+1


V. Elliptic curves in cryptography

We now have a basic understanding of the elliptic curve, which is to be pleased. However, please note that the elliptic curve learned in the preceding is continuous and not suitable for encryption, so we have to turn the elliptic curve into a discrete point.
Let's think about why the elliptic curve is continuous. Because the coordinates of the points on the elliptic curve are real numbers (that is, the elliptic curves described above are defined on the real number field), the real numbers are contiguous, resulting in the continuous curve. Therefore, we want to define the elliptic curve on a finite field (as the name implies, a finite field is a domain consisting of only a finite number of elements).

☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆
The concept of a domain is abstracted from the operation of our rational number and real numbers, and strict definitions refer to the number of modern algebra. Simply put, the elements in the domain, like the rational number, have their own addition, multiplication, Division, Unit (1), 0 (0), and meet the exchange rate, allocation rate.
☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆☆

Below, we give a finite field FP, which has only a finite number of elements.

Only P (p is prime) element 0,1,2 in FP ... p-2,p-1;
The addition (a+b) rule of the Fp is a+b≡c (mod p); that is, the remainder of (a+c) ÷p is the same as the remainder of C÷p.
The rule of the Fp multiplication (AXB) is axb≡c (mod p);
The Fp Division (a÷b) rule is a/b≡c (mod p), which is axb-1≡c (mod p); (B-1 is also an integer between 0 and p-1, but satisfies the bxb-1≡1 (mod p); The specific method can refer to the elementary number theory, or my other article).
The unit element of the FP is 1, and 0 yuan is 0.

At the same time, not all elliptic curves are suitable for encryption. Y2=x3+ax+b is a class of elliptic curves that can be used for encryption, and is the simplest. Let's define the Y2=x3+ax+b curve on the FP:

Select two nonnegative integers a, b with less than P (p as prime number) that meet the following conditions
4a3+27b2≠0 (mod p)
All points (x, y) of the following equations are satisfied, plus the Infinity Point o∞ to form an elliptic curve.
Y2=x3+ax+b (mod p)
where x, y belongs to an integer between 0 and P-1, and this elliptic Curve is recorded as EP (A, B).

Let's take a look at the image of Y2=x3+x+1 (mod 23)



Does it feel weird? Elliptic curve, how to become such a shape, become a discrete point?
Elliptic curves appear differently in different number fields, but their nature is still an elliptic curve. To cite an inappropriate example, like water, which is liquid at room temperature, when it is below zero, the water becomes ice and becomes solid, and the temperature rises to 100 degrees and the water becomes vapour. But its essence is still H2O.

The elliptic curve on FP also has addition, but it can't give the explanation of geometrical meaning. However, the rule of addition is almost the same as the real number field, so the reader should compare itself.

1 Infinity Point o∞ is 0 yuan, there is o∞+ o∞= o∞,o∞+p=p
2 P (x, y) negative element is (x,-y), with p+ (-p) = o∞
3 P (x1,y1), Q (X2,y2) and R (X3,Y3) have the following relationship:
X3≡K2-X1-X2 (mod p)
Y3≡k (x1-x3)-y1 (mod p)
If P=q k= (3x2+a)/2y1 if p≠q, then k= (y2-y1)/(X2-X1)


Example 5.1 known E23 (two points P (3,10), Q (9,7), 1)-p,2) p+q,3) 2P.
Solution 1) The value of –p is (3,-10)
2) k= (7-10)/(9-3) =-1/2,2 multiplication inverse is 12 because 2*12≡1 (mod 23)
K≡-1*12 (mod 23) so k=11.
X=112-3-9=109≡17 (mod 23);
y=11[3-(-6)]-10=89≡20 (mod 23)
So the coordinates of P+Q are (17,20)
3) k=[3 (32) +1]/(2*10) =1/4≡6 (mod 23)
X=62-3-3=30≡20 (mod 23)
Y=6 (3-7) -10=-34≡12 (mod 23)
So the coordinates of 2P are (7,12)

Finally, let's talk about the order of points on the elliptic curve.
If there is a point p on the elliptic curve, there is a minimum positive integer n, which makes the multiply np=o∞, then n is called POrder, if n does not exist, we say P is an infinite order.
In fact, the order n of all points on the elliptic curve defined on the finite field are present (proof, refer to the book on modern Algebra)


Practice:
1 Find all the points on E11 (1,6).
2 known E11 (1,6) on a little G (2,7), 2G to 13G all values.


Vi. Simple encryption/decryption on elliptic curves

Public key algorithms are always based on a mathematical puzzle. For example, RSA is based on: given two prime numbers p, Q is easy to multiply to get N, but the factorization of n is relatively difficult. What's the problem with the elliptic curve?

Consider the following equation:
k=kg [where K,g is a point on EP (A, B) and K is an integer less than n (n is the order of Point G)]
It is not difficult to find that given K and G, it is easy to calculate k according to the rule of addition, but given K and G, it is relatively difficult to find K.
This is the problem that Elliptic curve encryption algorithm adopts. We refer to point G as base Point, K (k
Now we describe a process for encrypting communication using an elliptic curve:

1, User A selected an Elliptic Curve EP (A, B), and take the elliptic curve point, as the base point G.
2, User A selects a private key K, and generates a public key k=kg.
3. User A transmits EP (A, B) and point k,g to User B.
4, User B received the message, the text to be transmitted to the Code to the EP (A, B) a point m (many coding methods, not discussed here), and produce a random integer R (r
5, User B compute point c1=m+rk;c2=rg.
6. User B passes C1 and C2 to User A.
7, User A received information, calculate C1-KC2, the result is point M. Because
C1-kc2=m+rk-k (RG) =m+rk-r (KG) =m
Then decode the point m to get the plaintext.

In this encrypted communication, if there is a peeping H, he can only see the EP (A, B), K, G, C1, C2 and by K, G K or through the C2, G to seek r is relatively difficult. Therefore, H cannot get the plaintext information transmitted between A and B.



In cryptography, an elliptic curve on an FP is described, commonly used to six parameters:
T= (p,a,b,g,n,h).
(P, a, b are used to determine an elliptic curve,
G is the base point,
n is the order of point G,
h is the integer portion of the number m and N of all points on an elliptic curve)

The choice of these parameters has a direct effect on the security of encryption. Parameter values are generally required to meet the following conditions:

1, p of course, the larger the more secure, but the larger the calculation speed will be slow, around 200 can meet the general safety requirements;
2, P≠nxh;
3, pt≠1 (mod n),1≤t<20;
4, 4a3+27b2≠0 (mod p);
5, N is the prime number;
6, H≤4.


Application of elliptic curve in software registration protection

We know that the advantage of using public key algorithm as a software registration algorithm is that cracker is difficult to get keygen by the tracking verification algorithm. Next, we will introduce a method for software registration using the FP (A, B) elliptic curve.


The software author makes the registration machine (also known as the signature process) as follows

1, select an Elliptic Curve EP (A, B), and the base point G;
2. Select the private key K (k
3. Generate a random integer R (r
4, the user name and point r coordinate value x, y as the parameter, calculate SHA (Secure Hash algorithm safe hash algorithm, similar to MD5) value, namely Hash=sha (Username,x,y);
5. Calculate Sn≡r-hash * k (mod n)
6, the SN and hash as the user name username serial number

The software verification process is as follows: (The software has an Elliptic Curve EP (A, B), and a base point g, public key K)

1, from the user input serial number, the extraction of SN and hash;
2, calculate the point r≡sn*g+hash*k (mod p), if the SN, Hash is correct, its value is equal to the software author signature process midpoint R (x, y) coordinates, because
Sn≡r-hash*k (mod n)
So
Sn*g + hash*k
= (r-hash*k) *g+hash*k
=rg-hash*kg+hash*k
=rg-hash*k+ Hash*k
=rg=r;
3, the user name and point r coordinate value x, y as the parameter, calculates H=sha (username,x,y);
4, if H=hash is registered successfully. If H≠hash, the registration fails (why?) Note the relevance of the point r to the hash).

A simple comparison of two processes:
The author's signature is used: Elliptic Curve EP (A, B), base point g, private key k, and random number R.
Software validation is used for: Elliptic Curve EP (A, B), base point g, public key K.
Cracker to make a registration machine, only through the software in the EP (A, B), point G, public key k, and use k=kg this relationship to obtain K, only then. And it is very difficult to ask for K.


Practice:
Below is also a commonly used in software protection registration algorithm, please read carefully, and try to answer the signature process and verification process have used those parameters, cracker want to make keygen, how to do.

The software author makes the registration machine (also known as the signature process) as follows
1, select an Elliptic Curve EP (A, B), and the base point G;
2. Select the private key K (k
3. Generate a random integer R (r
4, the user name as a parameter, calculate Hash=sha (username);
5. Calculate x ' =x (mod n)
6. Calculate sn≡ (hash+x ' *k)/R (mod n)
7, the SN and X ' as the user name username serial number

The software verification process is as follows: (The software has an Elliptic Curve EP (A, B), and a base point g, public key K)
1, from the user input serial number, the extraction of SN and X ';
2, the user name as a parameter, calculate Hash=sha (username);
3, Calculate r= (hash*g+x ' *k)/sn, if SN, Hash is correct, its value is equal to the software author signature process midpoint R (x, y), because
Sn≡ (hash+x ' *k)/R (mod n)
So
(Hash*g+x ' *k)/sn
= (hash*g+x ' *k)/[(hash+x ' *k)/R]
= (hash*g+x ' *k)/[(hash*g+x ' *k*g)/(RG)]
=rg*[(hash*g+x ' *k)/(Hash*g+x ' *k)]
=rg=r (mod p)
4, v≡x (mod n)
5, if V=x ' is registered successfully. If V≠x ', the registration fails.
</n), Compute Point R (x, y) =rg;/></n), using the base point G to calculate the public key k=kg;/>

Viii. Conclusion

After more than half a month of intermittent writing, this piece of my book finally counted. To write this article, I looked up a lot of information, but in order to make the article more easy to understand, I try to avoid involving professional terminology, elliptic curve on the f2n field is not involved in this article. However, some of the terms described may not be very accurate, I hope that the readers of the issue of the article, a lot of criticism. I also just take this article as a first draft, I will keep revising his. Finally thanks to see snow, Sunbird, CCG and all the members of the Snow Forum to my support, thanks to all the people who helped me, without your encouragement, this article I do not have the power to write, thank you, thank you!


2003-5-3 Draft, at the Snow Forum
2004-7-11 two draft, fix a picture

< end of the full >


Main reference documents

Schouten, foundation of modern algebra, higher Education Press, 1978
Minsihe Shijin, "Elementary Number Theory", Higher Education Press, 1982
Tangqiu, "Network information security," the third, Peking University computer Department
Michael Rosing, Chapter5 "Implementing Elliptic Curve Cryptography", softbound,1998
"SEC 1:elliptic Curve Cryptography", Certicom corp.,2000
"IEEE p1363a/d9", 2001

Original: http://blog.csdn.net/sahusoft/article/details/6868016

Introduction to the principle of ECC encryption algorithm