Deterministic Elliptic Curve Hashing for Constant-Time Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing hash functions for elliptic curves, particularly those over finite fields of characteristic 3, are vulnerable to covert channel attacks due to non-uniform running times, as they involve solving quadratic or cubic equations, leading to probabilistic and non-deterministic execution times.
Innovation Solution
A deterministic method is proposed for associating a message with a point on a non-supersingular elliptic curve over a finite field GF(3n), involving the computation of a pre-determined quadratic non-residue, a point on a conic, and an element verifying a specific linear equation, ensuring constant time execution by using pre-computed inverse matrices to simplify calculations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing hash functions for elliptic curves over GF(3n) are used, then the curves can be utilized for cryptographic schemes, but the running time becomes non-uniform and vulnerable to covert channel attacks
Solution Approach 1:
The patent pre-computes the inverse matrix A and stores it in a lookup table before the actual hash computation. This preliminary action eliminates the need for matrix inversion during the hashing process, ensuring that the computation time remains constant and uniform regardless of the input message, thereby preventing timing-based covert channel attacks while maintaining security
Solution Approach 2:
The patent replaces the probabilistic mechanical process of solving quadratic or cubic equations with a deterministic algebraic approach using pre-computed inverse matrices. This substitution transforms the hash function from a non-deterministic process with variable execution times to a deterministic process with constant time complexity, eliminating timing vulnerabilities
2Ease of operation
If probabilistic methods are used to associate messages with curve points, then the hash function can be implemented, but the execution time becomes non-deterministic and exposes information through timing analysis
Solution Approach 1:
The inverse matrix A is pre-computed and stored in a lookup table during system initialization. This preliminary computation eliminates the need for complex matrix inversion operations during actual hashing, reducing the hash computation to simple matrix multiplication and vector operations that execute in constant time, thereby preventing timing information leakage while maintaining ease of implementation
Solution Approach 2:
The patent uses a fixed, pre-computed inverse matrix A that is copied into memory during initialization. This copied matrix is then reused for all subsequent hash computations, eliminating the need to recompute the inverse matrix for each message. This copying approach ensures consistent execution time across all hash operations while simplifying the implementation to standard linear algebra operations
Data Source
AI summary
A cryptographic method is provided of a type with public key over a non-supersingular elliptic curve E, determined by the simplified Weirstrass equation y2=x3+a·x2+b over a finite field GF(3n), with n being an integer greater than or equal to 1. The method includes associating an element t of said finite field with a point P′ of the elliptic field. The step of associating includes: obtaining a pre-determined quadratic non-residue η on GF(3n); obtaining a pre-determined point P=(zP, yP) belonging to a conic C defined by the following equation: a·η·z2−y2+b =0; obtaining a point Q=(zQ, yQ), distinct from the point P belonging to the conic C and a straight line D defined by the following equation: y=t·z+yP−t·zP; obtaining the element ξ of GF(3n) verifying the following linear equation over GF(3): −η·ξ=(η2·zQ)/a; and associating, with the element t of the finite field, the point P′ of the elliptic curve, for which the coordinates are defined by the pair (η·zQ/ξ, yQ).