Skip to main content
SpringerLink
Log in

Improving Bounds on Elliptic Curve Hidden Number Problem for ECDH Key Exchange

  • Conference paper
  • First Online:
Advances in Cryptology – ASIACRYPT 2022 (ASIACRYPT 2022)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 13793))

Abstract

Elliptic Curve Hidden Number Problem (EC-HNP) was first introduced by Boneh, Halevi and Howgrave-Graham at Asiacrypt 2001. To rigorously assess the bit security of the Diffie–Hellman key exchange with elliptic curves (ECDH), the Diffie–Hellman variant of EC-HNP, regarded as an elliptic curve analogy of the Hidden Number Problem (HNP), was presented at PKC 2017. This variant can also be used for practical cryptanalysis of ECDH key exchange in the situation of side-channel attacks.

In this paper, we revisit the Coppersmith method for solving the involved modular multivariate polynomials in the Diffie–Hellman variant of EC-HNP and demonstrate that, for any given positive integer d, a given sufficiently large prime p, and a fixed elliptic curve over the prime field \(\mathbb {F}_p\), if there is an oracle that outputs about \(\frac{1}{d+1}\) of the most (least) significant bits of the x-coordinate of the ECDH key, then one can give a heuristic algorithm to compute all the bits within polynomial time in \(\log _2 p\). When \(d>1\), the heuristic result \(\frac{1}{d+1}\) significantly outperforms both the rigorous bound \(\frac{5}{6}\) and heuristic bound \(\frac{1}{2}\). Due to the heuristics involved in the Coppersmith method, we do not get the ECDH bit security on a fixed curve. However, we experimentally verify the effectiveness of the heuristics on NIST curves for small dimension lattices.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 89.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 119.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    The diagonal component of the coefficient vector of \(g(x_0X, x_1X, \cdots , x_nX)\) corresponds to the leading term of \(g(x_0, x_1, \cdots , x_n)\). Specifically, the diagonal component is equal to the leading coefficient of \(g(x_0X, x_1X, \cdots , x_nX)\).

  2. 2.

    There is a one-to-one correspondence between helpful polynomials and helpful vectors. The coefficient vector of \(g(x_0X, x_1X, \cdots , x_nX)\) is a helpful vector if and only if \(g(x_0, x_1, \cdots , x_n)\) is a helpful polynomial.

References

  1. Akavia, A.: Solving hidden number problem with one bit oracle and advice. In: Halevi, S. (ed.) CRYPTO 2009. LNCS, vol. 5677, pp. 337–354. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-03356-8_20

    Chapter  Google Scholar 

  2. Albrecht, M.R., Heninger, N.: On bounded distance decoding with predicate: breaking the “Lattice Barrier’’ for the hidden number problem. In: Canteaut, A., Standaert, F.-X. (eds.) EUROCRYPT 2021. LNCS, vol. 12696, pp. 528–558. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-77870-5_19

    Chapter  Google Scholar 

  3. Boneh, D.: The decision Diffie-Hellman problem. In: Buhler, J.P. (ed.) ANTS 1998. LNCS, vol. 1423, pp. 48–63. Springer, Heidelberg (1998). https://doi.org/10.1007/BFb0054851

    Chapter  Google Scholar 

  4. Boneh, D., Halevi, S., Howgrave-Graham, N.: The modular inversion hidden number problem. In: Boyd, C. (ed.) ASIACRYPT 2001. LNCS, vol. 2248, pp. 36–51. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-45682-1_3

    Chapter  Google Scholar 

  5. Boneh, D., Shparlinski, I.E.: On the unpredictability of bits of the elliptic curve Diffie-Hellman scheme. In: Kilian, J. (ed.) CRYPTO 2001. LNCS, vol. 2139, pp. 201–212. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-44647-8_12

    Chapter  Google Scholar 

  6. Boneh, D., Venkatesan, R.: Hardness of computing the most significant bits of secret keys in Diffie-Hellman and related schemes. In: Koblitz, N. (ed.) CRYPTO 1996. LNCS, vol. 1109, pp. 129–142. Springer, Heidelberg (1996). https://doi.org/10.1007/3-540-68697-5_11

    Chapter  MATH  Google Scholar 

  7. Boneh, D., Venkatesan, R.: Rounding in lattices and its cryptographic applications. In: Saks, M.E. (ed.) Proceedings of the Eighth Annual ACM-SIAM Symposium on Discrete Algorithms, 5–7 January 1997, New Orleans, Louisiana, USA, pp. 675–681. ACM/SIAM (1997)

    Google Scholar 

  8. Coppersmith, D.: Finding a small root of a bivariate integer equation; factoring with high bits known. In: Maurer, U. (ed.) EUROCRYPT 1996. LNCS, vol. 1070, pp. 178–189. Springer, Heidelberg (1996). https://doi.org/10.1007/3-540-68339-9_16

    Chapter  Google Scholar 

  9. Coppersmith, D.: Finding a small root of a univariate modular equation. In: Maurer, U. (ed.) EUROCRYPT 1996. LNCS, vol. 1070, pp. 155–165. Springer, Heidelberg (1996). https://doi.org/10.1007/3-540-68339-9_14

    Chapter  Google Scholar 

  10. Coron, J.-S., Zeitoun, R.: Improved factorization of \(N=p^rq^s\). In: Smart, N.P. (ed.) CT-RSA 2018. LNCS, vol. 10808, pp. 65–79. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-76953-0_4

    Chapter  Google Scholar 

  11. Faugère, J.-C., Gianni, P.M., Lazard, D., Mora, T.: Efficient computation of zero-dimensional Gröbner Bases by change of ordering. J. Symb. Comput. 16(4), 329–344 (1993)

    Article  MATH  Google Scholar 

  12. Galbraith, S.D.: Mathematics of Public Key Cryptography. Cambridge University Press, Cambridge (2012)

    Google Scholar 

  13. Hashemi, A., Lazard, D.: Sharper complexity bounds for zero-dimensional Gröbner bases and polynomial system solving. Int. J. Algebra Comput. 21(5), 703–713 (2011)

    Article  MATH  Google Scholar 

  14. Howgrave-Graham, N.: Finding small roots of univariate modular equations revisited. In: Darnell, M. (ed.) Cryptography and Coding 1997. LNCS, vol. 1355, pp. 131–142. Springer, Heidelberg (1997). https://doi.org/10.1007/BFb0024458

    Chapter  Google Scholar 

  15. Jancar, J., Sedlacek, V., Svenda, P., Sýs, M.: Minerva: the curse of ECDSA nonces systematic analysis of lattice attacks on noisy leakage of bit-length of ECDSA nonces. IACR Trans. Cryptogr. Hardw. Embed. Syst. 2020(4), 281–308 (2020)

    Article  Google Scholar 

  16. Jao, D., Jetchev, D., Venkatesan, R.: On the bits of elliptic curve Diffie-Hellman keys. In: Srinathan, K., Rangan, C.P., Yung, M. (eds.) INDOCRYPT 2007. LNCS, vol. 4859, pp. 33–47. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-77026-8_4

    Chapter  Google Scholar 

  17. Jetchev, D., Venkatesan, R.: Bits security of the elliptic curve Diffie–Hellman secret keys. In: Wagner, D. (ed.) CRYPTO 2008. LNCS, vol. 5157, pp. 75–92. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-85174-5_5

    Chapter  Google Scholar 

  18. Jochemsz, E., May, A.: A strategy for finding roots of multivariate polynomials with new applications in attacking RSA variants. In: Lai, X., Chen, K. (eds.) ASIACRYPT 2006. LNCS, vol. 4284, pp. 267–282. Springer, Heidelberg (2006). https://doi.org/10.1007/11935230_18

    Chapter  MATH  Google Scholar 

  19. Jochemsz, E., May, A.: A polynomial time attack on rsa with private CRT-exponents smaller than N0.073. In: Menezes, A. (ed.) CRYPTO 2007. LNCS, vol. 4622, pp. 395–411. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-74143-5_22

    Chapter  Google Scholar 

  20. Lenstra, A.K., Lenstra, H.W., Lovász, L.: Factoring polynomials with rational coefficients. Mathematische Annalen 261(4), 515–534 (1982)

    Google Scholar 

  21. Ling, S., Shparlinski, I.E., Steinfeld, R., Wang, H.: On the modular inversion hidden number problem. J. Symbol. Comput. 47(4), 358–367 (2012)

    Google Scholar 

  22. May, A.: Using LLL-reduction for solving RSA and factorization problems. In: Nguyen, P., Vallée, B. (eds.) The LLL Algorithm. Information Security and Cryptography, pp. 315–348. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-02295-1_10

  23. Merget, R., Brinkmann, M., Aviram, N., Somorovsky, J., Mittmann, J., Schwenk, J.: Raccoon attack: finding and exploiting most-significant-bit-oracles in TLS-DH(E). In: 30th USENIX Security Symposium (USENIX Security 2021). USENIX Association, Vancouver, B.C., August 2021

    Google Scholar 

  24. Nemec, M., Sýs, M., Svenda, P., Klinec, D., Matyas, V.: The return of Coppersmith’s attack: practical factorization of widely used RSA moduli. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, 30 October–03 November 2017, pp. 1631–1648 (2017)

    Google Scholar 

  25. Neumaier, A., Stehlé, D.: Faster LLL-type reduction of lattice bases. In: Abramov, S.A., Zima, E.V., Gao, X.-S. (eds.) Proceedings of the ACM on International Symposium on Symbolic and Algebraic Computation, ISSAC 2016, Waterloo, ON, Canada, 19–22 July 2016, pp. 373–380. ACM (2016)

    Google Scholar 

  26. Nguyen, P.Q., Stehlé, D.: An LLL algorithm with quadratic complexity. SIAM J. Comput. 39(3), 874–903 (2009)

    Article  MATH  Google Scholar 

  27. Ryan, K.: Return of the hidden number problem. A widespread and novel key extraction attack on ECDSA and DSA. IACR Trans. Cryptogr. Hardw. Embed. Syst. 2019(1), 146–168 (2019)

    Google Scholar 

  28. Shani, B.: On the bit security of elliptic curve Diffie–Hellman. In: Fehr, S. (ed.) PKC 2017. LNCS, vol. 10174, pp. 361–387. Springer, Heidelberg (2017). https://doi.org/10.1007/978-3-662-54365-8_15

    Chapter  Google Scholar 

  29. Takayasu, A., Kunihiro, N.: Better lattice constructions for solving multivariate linear equations modulo unknown divisors. In: Information Security and Privacy - 18th Australasian Conference, ACISP 2013, Brisbane, Australia, 1–3 July 2013. Proceedings, pp. 118–135 (2013)

    Google Scholar 

  30. Takayasu, A., Lu, Y., Peng, L.: Small CRT-exponent RSA revisited. In: Coron, J.-S., Nielsen, J.B. (eds.) EUROCRYPT 2017. LNCS, vol. 10211, pp. 130–159. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-56614-6_5

    Chapter  Google Scholar 

  31. von zur Gathen, J., Gerhard, J.: Modern Computer Algebra, 3rd edn. Cambridge University Press, Cambridge (2013)

    Google Scholar 

  32. Jun, X., Lei, H., Sarkar, S.: Cryptanalysis of elliptic curve hidden number problem from PKC 2017. Des. Codes Cryptogr. 88(2), 341–361 (2020)

    Article  MATH  Google Scholar 

  33. Jun, X., Sarkar, S., Lei, H., Huang, Z., Peng, L.: Solving a class of modular polynomial equations and its relation to modular inversion hidden number problem and inversive congruential generator. Des. Codes Cryptogr. 86(9), 1997–2033 (2018)

    Article  MATH  Google Scholar 

  34. Xu, J., Sarkar, S., Hu, L., Wang, H., Pan, Y.: New results on modular inversion hidden number problem and inversive congruential generator. In: Boldyreva, A., Micciancio, D. (eds.) CRYPTO 2019. LNCS, vol. 11692, pp. 297–321. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-26948-7_11

    Chapter  Google Scholar 

Download references

Acknowledgment

The authors would like to thank anonymous reviewers for their helpful comments and suggestions. Jun Xu and Lei Hu was supported the National Natural Science Foundation of China (Grants 61732021, 62272454). Huaxiong Wang was supported by the National Research Foundation, Singapore under its Strategic Capability Research Centres Funding Initiative and Singapore Ministry of Education under Research Grant MOE2019-T2-2-083.

Author information

Authors and Affiliations

  1. State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100093, China

    Jun Xu & Lei Hu

  2. School of Cyber Security, University of Chinese Academy of Sciences, Beijing, 100049, China

    Jun Xu & Lei Hu

  3. Indian Institute of Technology Madras, Sardar Patel Road, Chennai, 600036, India

    Santanu Sarkar

  4. Division of Mathematical Sciences, School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore, Singapore

    Huaxiong Wang

Authors
  1. Jun Xu
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Santanu Sarkar
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Huaxiong Wang
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Lei Hu
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Santanu Sarkar .

Editor information

Editors and Affiliations

  1. Indian Institute of Technology Madras, Chennai, India

    Shweta Agrawal

  2. Chinese Academy of Sciences, Beijing, China

    Dongdai Lin

Rights and permissions

Reprints and permissions

Copyright information

© 2022 International Association for Cryptologic Research

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Xu, J., Sarkar, S., Wang, H., Hu, L. (2022). Improving Bounds on Elliptic Curve Hidden Number Problem for ECDH Key Exchange. In: Agrawal, S., Lin, D. (eds) Advances in Cryptology – ASIACRYPT 2022. ASIACRYPT 2022. Lecture Notes in Computer Science, vol 13793. Springer, Cham. https://doi.org/10.1007/978-3-031-22969-5_26

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-22969-5_26

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-22968-8

  • Online ISBN: 978-3-031-22969-5

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation