0

I'm trying to decrypt a sent set of points (kB, Pm+k.Pb) of an elliptic curve over a prime field. However, I am getting the wrong result. My guess is that something is wrong in point subtraction. Can someone please help?

I have followed all the procedures for implementing ECC as described in the book, "Guide to Elliptic Curve Cryptography" by Darrel Hankerson, Alfred Menezes, and Scott Vanstone. According to those, I have written the code and tested the functions the add() and sclr_mult() seem to be working fine. However, I cannot seem to be able to decrypt messages properly. My suspicion is that I have messed up somewhere in the point subtraction part. This program is meant as a proof of concept and not actual implementation so I've taken the values of the a,b, and p as small numbers. I am not really concerned with the optimization of the process currently, although as soon as I get it working, I'll be looking into that. I have taken point (0,0) as the origin point and have modified the add() as such. I would really appreciate the help to make this work as well as other suggestions. Please feel free to ask for the entire code. I can mail it to you for further examination. Thank you.

#include <stdio.h>
#include <stdlib.h>
#include <math.h>

//Information about the curve and finite field

int a=4;//coefficient for elliptic curve
int b=20;//coefficient for elliptic curve
int p=29;//prime number to provide finite field

int points[1000][2];//to store a set of points satisfying the curve

//Information required for Encryption and Decryption

//Private Information
int PrivKey=11;//Private Key of Receiver

//Public Information
int PubKey[2]={0,0};//Public key of Receiver
int random=11;//Random Number required for Encoding
int Pbase[2]={0,0};//Base point for all operations

//Encrypted Point
int Enc[4]={0,0,0,0};

//Functions Used
int * sclr_mult(int k,int point[2]);
int * add(int A[2],int B[2]);
int inverse(int num);
int * encode(int m,int Pb[2],int random,int Pbase[2]);//(Message,Public Key)
int * genKey(int X,int P[2]);//(Private Key,Base Point)
int decode(int Enc[4],int PrivKey);//(Encrypted Message, Private key of the Receiver) Outputs Message
void generate();

int main()
{
    int *temp;

    generate();
    Pbase[0]=points[5][0];//Deciding the base point here
    Pbase[1]=points[5][1];

    temp=genKey(PrivKey,Pbase);
    PubKey[0]=*temp;
    PubKey[1]=*(temp+1);
    printf("\nThe Public Key is (%d,%d)\n",PubKey[0],PubKey[1]);

    int message[2];
    message[0]=points[5][0];
    message[1]=points[5][1];
    printf("The message point is (%d,%d)\n",message[0],message[1]);

    int P[2];
    temp=sclr_mult(random,Pbase);
    P[0]=*temp;
    P[1]=*(temp+1);

    int Q[2];
    temp=sclr_mult(random,PubKey);
    Q[0]=*temp;
    Q[1]=*(temp+1);

    int R[2];
    temp=add(message,Q);
    R[0]=*temp;
    R[1]=*(temp+1);

    printf("The encrypted point is [(%d,%d),(%d,%d)]\n",P[0],P[1],R[0],R[1]);

    temp=sclr_mult(PrivKey,P);
    int O[2];
    O[0]=*temp;
    O[1]=p-*(temp+1);

    temp=add(R,O);
    O[0]=*temp;
    O[1]=*(temp+1);
    printf("The message point is (%d,%d)\n",O[0],O[1]);
    return 0;
}

int * sclr_mult(int k,int P[2])//using LSB first algorithm
{
    int *temp,i;
    int *Q = calloc(2,sizeof(int));
    Q[0]=0;
    Q[1]=0;
    for(i=31;i>=0;i--)
    {
        if((k>>i)&1)
            break;
    }
    for(int j=0;j<=i;j++)
    {
        if((k>>j)&1)
        {
            temp=add(Q,P);
            Q[0]=*temp;
            Q[1]=*(temp+1);
        }
        temp=add(P,P);
        P[0]=*temp;
        P[1]=*(temp+1);
    }
    return Q;
}

int * add(int A[2],int B[2])
{
    int *C = calloc(2,sizeof(int));
    int x=0;
    if (A[0]==0 || A[1]==0)
    {
        return B;
    }
    if (B[0]==0 || B[1]==0)
    {
        return A;
    }
    if (A[1]==(p-B[1]))
    {
        return C;
    }
    if ((A[0]==B[0]) && (A[1]==B[1]))
    {
        x=((3*(A[0]*A[0]))+a)*inverse(2*A[1]);
        C[0]=((x*x)-(2*A[0]))%p;
        C[1]=((x*(A[0]-C[0]))-A[1])%p;
        //C[0]=((A[0]*A[0])%p+(b*inverse(A[0]*A[0]))%p)%p;//For Binary Curves
        //C[1]=((A[0]*A[0])%p+((A[0]+(A[1]*inverse(A[0]))*C[0]))%p+(C[0])%p)%p;//For Binary Curves
    }
    else
    {
        x=(B[1]-A[1])*inverse(B[0]-A[0]);
        C[0]=((x*x)-(A[0]+B[0]))%p;
        C[1]=((x*(A[0]-C[0]))-A[1])%p;
        //C[0]=((((A[1]+B[1])*inverse(A[0]+B[0]))*((A[1]+B[1])*inverse(A[0]+B[0])))%p + ((A[1]+B[1])*inverse(A[0]+B[0]))%p + A[0]%p + B[0]%p + a%p)%p;//For Binary Curves
        //C[1]=((((A[1]+B[1])*inverse(A[0]+B[0]))*(A[0]+C[0]))+C[0]+A[1])%p;//For Binary Curves
    }
    if (C[0]<0)
        C[0]=p+C[0];
    if (C[1]<0)
        C[1]=p+C[1];
    return C;
}
int inverse(int num)
{
    int i=1;
    if (num<0)
        num=p+num;
    for (i=1;i<p;i++)
    {
        if(((num*i)%p)==1)
            break;
    }
    //printf("inverse=%d,%d",i,num);
    return i;
}

void generate()
{
    int rhs,lhs,i=0;//to find set of points that satisfy the elliptic curve
    for(int x=0;x<p;x++)
    {
        rhs=((x*x*x)+(a*x)+b)%p;
        for(int y=0;y<p;y++)
        {
            lhs=(y*y)%p;
            if (lhs==rhs)
            {
                points[i][0]=x;
                points[i][1]=y;
                i+=1;
            }
        }
    }
    printf("\nNumber of points found on the curve is %d \n",i);
    for(int k=0;k<i;k++)
    {
        printf("%d(%d,%d)\n",(k),points[k][0],points[k][1]);
    }
}

int * genKey(int X,int P[2])
{
    int *temp;
    int *Q = calloc(2,sizeof(int));
    temp=sclr_mult(X,P);
    Q[0]=*temp;
    Q[1]=*(temp+1);
    return Q;
}

I am not getting errors. However, I am not getting the result that I am expecting.

Support Ukraine
  • 42,271
  • 4
  • 38
  • 63
Shubham Annigeri
  • 13
  • 1
  • 2

1 Answers1

0

The sclr_mult method generally changes the 2nd parameter. In the current example, Pbase has in

temp = genKey(PrivKey, Pbase); // calls sclr_mult

the value (2,23) and then in

temp = sclr_mult(random, Pbase);

the value (8,19). Since Pbase is the reference point on the elliptic curve, this is the cause of the wrong result. The solution can either be to pass a copy of Pbase or to adapt sclr_mult accordingly. With this change, the current example works:

The public key is                               (16,27)
The message point is                            (2,23)
The shared secret (random * PubKey) is          (6,17)
The encrypted point is                          [(16,27),(16,27)]
The shared secret (PrivKey * P) is              (6,17)
The inverse of the shared secret is             (6,12)
The decrypted message point is                  (2,23)

The following points are also problematic, but don't cause an error in the current example:

  • The add method returns for the case A = (0,0) and B != (0,0) the result B, which means that (0,0) represents the PAI (point at infinity, see here, pages 17 - 19). (0,0) is not the best choice, because there are also curves (b = 0) that have (0,0) as a regular point. For the current curve (b = 7), however, (0,0) is not a regular point, so it can be defined as PAI.

    Note: If a point other than (0,0) is used as PAI (e.g. (p,p)), Q must be initialized in sclr_mult with the point representing the PAI!

  • The add method must consider the following three cases (here, p. 20):

    PAI + PAI = PAI   
A + PAI = A    
PAI + B = B

    In addition, the two cases of a vertical secant (point addition) and tangent (point doubling) must be taken into account (here, p. 3):

    (B[0] - A[0]) % p == 0    vertical secant     
A[1] % p == 0             vertical tangent

    The add method could be modified as follows to consider these cases:

    int * add(int A[2], int B[2])
{
    int *C = (int *)calloc(2, sizeof(int));
    int x = 0;

    if (isPAI(A) && isPAI(B))  // PAI + PAI = PAI
    {
        return getPAI(C);
    }
    else if (isPAI(A))         // PAI + B = B
    {
        return B;
    }
    else if (isPAI(B))         // A + PAI = A
    {
        return A;
    }
    else if ((A[0] == B[0]) && (A[1] == B[1]))
    {
        // Point doubling

        if (A[1] % p == 0)              // Vertical tangent
        {
            return getPAI(C);
        }

        // as in current code
        // ... 
    }
    else
    {
        // Point addition

        if ((B[0] - A[0]) % p == 0)    // Vertical secant
        {
            return getPAI(C);
        }

        // as in current code
        // ... 
    }

    // as in current code
    // ... 
}

    with

    bool isPAI(int *point) 
{
    return point[0] == 0 && point[1] == 0;
}

int* getPAI(int *point) 
{
    point[0] = 0;
    point[1] = 0;
    return point;
}

  • Example: a = 1, b = 7, p = 17, (here)

    Points:

    (1,3), (1,14), (2,0), (5,1), (5,16), (6,5), (6,12), (7,0), (8,0), (12,8), (12,9)

    Result of current add method:

    (1,3) + (1,3) = (6,5)
(6,5) + (1,3) = (2,0)
(2,0) + (1,3) = (1,3)
...

    Result of modified add-method:

    (1,3) + (1,3) = (6,5)
(6,5) + (1,3) = (2,0)
(2,0) + (1,3) = (6,12)
(6,12)+ (1,3) = (1,14)
(1,14)+ (1,3) = (0,0)   // PAI
(0,0) + (1,3) = (1,3)
...
Topaco
  • 40,594
  • 4
  • 35
  • 62