Selecting Elliptic Curves for Cryptography Webs（选择椭圆曲线加密网）.pdfVIP

Selecting Elliptic Curves for Cryptography A presentation for the Crypto Forum Research Group (CFRG) Joppe Bos NXP Semiconductors Craig Costello Microsoft Research Patrick Longa Microsoft Research Michael Naehrig Microsoft Research Criteria for selecting elliptic curves for cryptography ECDLP security and curve setting 鈥 Hardness of the underlying EC Discrete Logarithm Problem 鈥 Conservative choice of curve setting (curve type, group structure, etc.) 鈥 Publicly verifiable generation: minimal room for manipulation Implementation security 鈥 Resilience to exception attacks, small subgroup attacks, invalid curve attacks, side-channel attacks Efficiency (considering portability, ease of use, maintainability, scalability) 鈥 Runtime/power/memory use on different platforms: 8-bit, 32-bit, 64-bit Security coverage 鈥 Curve selection targeting different security levels: 128-bit, 192-bit, 256-bit Flexibility and robustness 鈥 Ease of adaptability to most protocols 鈥 Efficiency of different constructs: {variable-base, fixed-base, multi} scalar multiplication 鈥 Ease of curve replacement in case of disasters 1 Plan after preliminary analysis 鈥 Demonstrate potential of new curves at protocol layer (e.g., inside TLS with PFS) Constant-time, exception-free algorithms to do crypto 128-bit security 192-bit security 256-bit security Weierstrass twisted Montgomery curves Edwards curves curves Consider different families of primes for fast arithmetic 2