Patent Application
20100208884
The present invention relates generally to cryptography, and in particular to a hashing onto points of an elliptic curve.
This section is intended to introduce the reader to various aspects of art, which may be related to various aspects of the present invention that are described and/or claimed below. This discussion is believed to be helpful in providing the reader with background information to facilitate a better understanding of the various aspects of the present invention. Accordingly, it should be understood that these statements are to be read in this light, and not as admissions of prior art.
A hash function takes as input a message (usually represented as a string) and produces a hash value (also called ‘message digest’ or ‘digital fingerprint’) of fixed length. More specifically, a hash function h maps bit-strings of arbitrary finite length onto bit-strings of fixed length (say, of l bits); h:{0,1}*→{0,1}l; mh(m). The hash value h(m) is a compact representation of input string m.
For cryptographic applications, hash functions may require additional properties:
Hash functions are used in many cryptographic applications, including digital signatures, they play a fundamental role in the design of modern encryption algorithms, and they can serve to construct message authentication codes (MACs). A MAC is a family of functions hK indexed by a secret key K. MACs are described in for example FIPS 198 and FIPS 198-1, both called “The Keyed-Hash Message Authentication Code (HMAC)” (Federal Information Processing Standards Publication), the former published March 2002 and the latter (a draft, not yet approved) in June 2007.
Several cryptographic applications require hashing onto points of an elliptic curve. This includes identity-based encryption schemes such as the one described by D. Boneh and M. Franklin in “Identity-Based Encryption from the Weil Pairing” (SIAM Journal of Computing, 32(3): 586-615, 2003), which features a much simpler public-key infrastructure than traditional certificate-based cryptography. These schemes make use of bilinear pairings on elliptic curve points. In particular, the so-called ‘extract’ procedure requires a hash function mapping arbitrary finite strings to points of a given elliptic curve.
If G represents a group (or subgroup) of points of an elliptic curve, the problem is how to design a hash function taking as input a string m and produces a hash value which represents a point of the elliptic curve H:{0,1}*→G,mH(m)∈G
One such method can be obtained from a technique described in § VI.2 of “A Course in Number Theory and Cryptography” by N. Koblitz, volume 114 of Graduate Texts in Mathematics, Springer-Verlag, 2nd edition, 1994. Let k denote a large integer corresponding to a maximum number of ‘tries’ so that the failure probability of the method is roughly 2−k, as the probability of success for a try is about 0.5. Let also E denote the elliptic curve over finite field Fq given by the Weierstraβ equation
E:y
2
+a
1
xy+a
3
y=x
3
+a
2
x
2
+a
4
x+a
6
where curve parameters ai ∈ Fq(1≦i≦6).
The set of points of the elliptic curve E is given by the pairs (x,y) that satisfy this Weierstraβ equation together with a ‘special’ point ο, which is called the point at infinity. Given an input message m, v=h(m) is first computed, where h:{0,1}*→{0,1}l is any suitable hash function (e.g. of the Secure Hash Standard (SHA) family) and v is viewed as an integer in the range [0,2l-1]. For each j=1,2, . . . ,k, m′j=vk+j is defined. If q>2lk there is a one-to-one correspondence between the so-defined integers m′j and a set of elements of Fq using a polynomial representation. xj denotes the Fq-element corresponding to m′j. Then, for j=1,2, . . . ,k the coordinate x=xj and an attempt is made to solve the Weierstraβ equation for y. If a solution exists, it is denoted yj. If ĵ denotes the smallest j in {1, . . . , k } for which a solution is found, this defines H(m)=(xj,yj) ⊂ E.
A problem with this method is that it leaks information about the input through side-channel analysis and fault analysis. This may compromise the security of the underlying application. This also introduces some bias in the output distribution, which may invalidate or weaken a security proof based on the random oracle model. Furthermore, the iterative nature of this method causes some inefficiency.
It will therefore be appreciated that there is a need for a hashing method onto points of an elliptic curve that overcomes at least some of the problems of the prior art. This invention provides such a solution.
In a first aspect, the invention is directed to a method for hashing a string of arbitrary finite length onto an element of a group. A first hash value resulting from a first hashing algorithm mapping the string to a scalar is obtained. At least a first part of the scalar is multiplied with a predetermined first element of the group to obtain a second element of the group that is output.
In a first preferred embodiment, the group comprises the points of an elliptic curve.
In a second preferred embodiment, the first hash value for the string is obtained by calculation to obtain the scalar.
In a third preferred embodiment, the first element of the group is an element of maximal order.
In a fourth preferred embodiment, the method further comprises performing scalar multiplication between a second part of the first hash value and a predetermined third element of the group to obtain a fourth element of the group; and adding the second element of the group and the fourth element of the group to obtain a fifth element of the group.
In a second aspect, the invention is directed to a device for hashing a string of arbitrary finite length onto an element of a group. The device comprises means for obtaining a first hash value resulting from a first hashing algorithm mapping the string to a scalar; means for performing scalar multiplication between the first hash value and a predetermined first element of the group to obtain a second element of the group; and means for outputting the second element of the group.
In a first preferred embodiment, the group comprises the points of an elliptic curve.
In a second preferred embodiment, the means for obtaining the first hash value is adapted to calculate the first hash value.
In a third preferred embodiment, the first element of the group is an element of maximal order.
In a third aspect, the invention is directed to a computer program product comprising stored instructions that, when executed by a processor, performs the method of any of the embodiments of the first aspect.
Preferred features of the present invention will now be described, by way of non-limiting example, with reference to the accompanying drawings, in which:
Compared to the iterative prior art solution, the present invention takes a radically different approach for hashing onto points of an elliptic curve. The method starts with a predetermined point on the elliptic curve and relies on a characteristic of groups: multiplication between an element of the group and a scalar automatically gives a, usually different, element of the group. To hash onto points of the elliptic curve, the output of a regular hashing algorithm is taken as the scalar and a point on the elliptic curve as the element of the group. The skilled person will appreciate that it is advantageous to use an element of maximal order as the predetermined point, as this enlarges the set of possible outputs.
More particularly, let h:{0,1}*→{0,1}l denote a regular hash function that maps a bit-string of arbitrary finite length to a bit-string of length l. Examples of such hash functions are Message Digest 5 (MD5) and SHA-1. Let also E denote an elliptic curve, G a subgroup thereof, and P a point of G of order at least 2l. The hashing method according to a preferred embodiment of the present invention may then be defined as:
H:{0,1}*→G:mH(m):=[h(m)]P.
This hash function is easy to implement and maps to points on the given elliptic curve. Further, for any two different input message m and m′, it follows that H(m)=H(m′) if and only if h(m)=h(m′), since ord(P)≧2l. As a result, the security of the hash function H is the same as that of the underlying hash function h. It will be appreciated that, as generic attacks against hash functions and elliptic curves are square-root attacks, the proposed construction is optimal.
The skilled person will appreciate that a number of variants of the method are possible. For instance, one or more predetermined elements of the group may be added after the multiplication. Another possibility is to perform separate scalar multiplications between the hash value and a plurality of elements in the group and thereafter to add the results (although this amounts to the same thing as multiplying the scalar with the result of the addition of the elements, as this addition yields a further element).
Yet another possibility is to obtain a scalar hash value that is separated into n, advantageously distinct, parts, perform scalar multiplication between the parts and n different elements of the group and then add the results. In other words (illustrating the variant for n=2): h(m)=h1||h2 and H(m)=[h1]P1+[h2]P2, where P1 and P2 are elements in the group.
The method of the invention may be used whenever input values must be mapped to points of elliptic curves. The method is fully generic and can accommodate any known (regular) hash function, including those recommended in cryptographic standards, such as MD5, SHA, and HMAC,. More importantly, the security of the method is the same as that of the underlying (regular) hash function.
The skilled person will appreciate that the method according to a preferred embodiment of the present invention is not limited to elliptic curves; it can readily be applied to any group, such as for example hyperelliptic curves or the multiplicative group of a finite field or finite ring, or a subgroup thereof.
Each feature disclosed in the description and (where appropriate) the claims and drawings may be provided independently or in any appropriate combination. Features described as being implemented in hardware may also be implemented in software, and vice versa. Connections may, where applicable, be implemented as wireless connections or wired, not necessarily direct or dedicated, connections.
Reference signs appearing in the claims are by way of illustration only and shall have no limiting effect on the scope of the claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 09305162.1 | Feb 2009 | EP | regional |
| 09305164.7 | Feb 2009 | EP | regional |
