Week of April 25

Final Formulas

Graph of y^{2} = x^{3} + Ax + B (the (short) **Weierstrass**
form)

What does this have to do with an ellipse? Elliptic curves come up when trying to find the arc length of an ellipse.

Early goal for elliptic curves: find all the rational (or integral) solutions.

Rational solutions for x^{3} + y^{3}
= 1 would correspond to solutions of u^{3} + v^{3} = w^{3},
which do not exist by the Fermat-Wiles theorem.

Elliptic product a⊕b: the graphical construction over **R**
(the "chord and tangent" algorithm); see www.desmos.com/calculator/ialhd71we3.

Adding a point at infinity

Associativity

Formula for elliptic product: Boneh & Shoup p 614 (of version 0.5): "The Addition Law" (toc.cryptobook.us, chapter 14 "Elliptic curve cryptography")

If you are looking for rational solutions of an elliptic curve, the chord-and-tangent product is a way of generating lots of them.

Note that if you have two roots r_{1} and r_{2} of a
cubic ax^{3} + bx^{2} + cx +d, then the product of all the
roots is d/a, and so r_{3} = d/ar_{1}r_{2}.

Finite fields: graui.de/code/elliptic2.

An elliptic curve is a cubic equation, and the product idea comes down to
the fact that with two roots of a cubic, you can find a third. This gives
a binary operation *only* for cubics, though some of the ideas do
generalize to other degrees.

**Find the finite-field generator g (or base b)**

Taking multiples of g: k*g = g⊕g⊕...⊕g, k times. Repeated-squaring algorithm for very large k, working in O(log k) time

Size of E(F_{p}) solution set: roughly p. Here's a justification,
though not a proof: for each x, half the time there are no solutions for y
and half the time there are two (+y, -y). On average there is one, so
total number of solutions is ~p.

**Group Structure** of E(F_{p}): if you are looking
at the group Z_{p}^{+} of integers modulo p under
multiplication, this is always **cyclic**: that is, there is
a generator. This is often not true for E(F_{p}); a common
structure is a generator that generates only 1/8 of all the elements.

**Montgomery** form: y^{2} = x^{3} + Ax^{2}
+ x. You can convert to the Weierstrass form with a change of variable x
-> (x-c).

Diffie-Hellman-Merkle for basic elliptic curve

For classic Diffie-Hellman-Merkle, Alice chooses an integer a<p, and
Bob chooses b<p. Alice and Bob **publish** g^{a}
and g^{b} respectively, where g is the chosen generator. If Alice
wants to create a key to use for encrypting a message to Bob, she
calculates (g^{b})^{a} = g^{ab}. Similarly, Bob
can calculate (g^{a})^{b} = g^{ab} to decrypt.
Nobody else can; you have to know either a or b.

For **elliptic** curves, Alice again chooses an integer
a<p, and Bob chooses b<p. Alice and Bob **publish**
a*g and b*g, respectively, where again g is a generator (possibly not of
the *entire* group; see below). Again, knowing g and knowing a*g
does not give you a reasonable method for finding a. The rest of the
mechanism works exactly as with the classic case.

**Edwards** form: x^{2} + y^{2} = 1 + Dx^{2}y^{2}.
The elliptic product here does not involve cases! There is a rational
conversion from Edwards to Montgomery, something like (x,y) ->
((1+y)/(1-y), (1+y)/(x-xy)). Once you work it out, it's very fast in
software, and the elliptic product simplification is a big deal.

The prime here is p = 2^{255} - 19, which is easy to find in
python. The curve is y^{2} = x^{3} + 486662x^{2} +
x. (Where does 486662 come from?)

This same curve, in Edwards form, is x^{2} + y^{2} = 1 +
(121665/121666)x^{2}y^{2}. (Remember that fraction is
evaluated mod p.)

Size of E(F_{p}) = 8q, where q is prime; q = 2**252 +
27742317777372353535851937790883648493 (I have no idea how to show this).
There is a generator for a cycle of q elements.

Use Diffie-Hellman-Merkle to choose a common secret, and then use a hash of that secret as a conventional encryption key.

Base point for Curve25519: (9, 14781619447589544791020593568409986887264606134616475288964881837755586237401). This has order q, above, in the group.

How did I get this? RFC8032 page 21, though somewhat indirectly.

If we plug x=9 into the Curve25519 formula, we get x^{3} +
486662x^{2} + x = X = 39420360. But how do we solve y^{2}
= X mod p?

Fact: if p is prime, then there is a generator g of Z_{p}^{+},
the non-zero elements under multiplication. That is, for every nonzero a,
a=g^{k} for some k.

Solving for y: First try Y1 = X^{(p+3)/8}. If we square this, we
get X^{(p+3)/4}. = X * X^{(p-1)/4}. So Y1 would work, **if**
Z = X^{(p-1)/4} = 1. And we know by Fermat's theorem that, if a
solution to y^{2} = X mod p exists, then X^{(p-1)/2} = y^{(p-1)}
= 1 mod p, so Z= X^{(p-1)/4} satisfies Z^{2} = 1, so X^{(p-1)/4}
= +1 or -1 (because we can factor Z^{2} = 1 as (Z+1)(Z-1)=0)

But what if Z = -1? For this case we have a trick. Let sm1 = 2^{(p-1)/4}
mod p. We know sm1^{4} = 2^{(p-1)} = 1. Could we have sm1^{2}
= 1? It is not obvious, but this would imply 2 was a square mod p

Proof: suppose sm1^{2} = 1 and yet 2
is **not** a square mod p. Let g be a generator. Then g^{2k+1}
= 2 for some odd number 2k+1. Then 1 = sm1^{2} = 2^{(p-1)/2}
= g^{(2k+1)(p-1)/2} = g^{k(p-1)}*g^{(p-1)/2}
= g^{(p-1)/2}. But *this cannot happen for a generator*;
the smallest positive exponent e for which g^{e} = 1 is p-1.

But 2 is **not** a square mod p. (This is
also not obvious. There is a theorem that says 2 is a square mod p if and
only if p = ±1 mod 8, and our 25519 p is 5 mod 8.)

So sm1^{2} = -1 (and the name stands for **s**quare
root of **m**inus **1**). This means that if X^{(p-1)/4}
= -1, we try Y2 = Y1*sm1. Then Y2^{2} = Y1^{2}*(-1) =
X*(-1)(-1) = X.

We should end up with y = 14781619447589544791020593568409986887264606134616475288964881837755586237401

(This is a general way of finding "square roots" mod p, but we have used 2 here to derive a specific "square root of -1" and for arbitrary primes p, 2 does not necessarily work. Also, for arbitrary primes, (p-3)/8 might not be an integer.)

Why did Bernstein use the Montgomery form? For fast calculation, and to avoid the need to store y. Why did he choose 486662? See the last paragraph of his paper. Why did he use x=9 for the generator? I have no idea

Adding a parity bit is useful for detecting 1-bit errors. Is there a
generalization to 2 bits? Not exactly, in that we cannot add two
additional bits that will detect all 2-bit errors. But there *are*
CRC codes.