MATH491

Summer Research Project

2006-2007

A MATLAB Implementation of Elliptic Curve

Cryptography

Hamish Silverwood

Department of Mathematics and Statistics

University of Canterbury

Math 491 Project: A MATLAB Implementation of Elliptic Curve

Cryptography
Hamish G. M. Silverwood
Abstract
The ultimate purpose of this project has been the implementation in MATLAB of an Elliptic Curve
Cryptography (ECC) system, primarily the Elliptic Curve Diffie-Hellman (ECDH) key exchange. We
first introduce the fundamentals of Elliptic Curves, over both the real numbers and the integers modulo
p where p is prime. Then the theoretical underpinnings of the ECDH system are covered, including a
brief look at how this system is broken. Next we develop the individual elements that will be needed in
the implementation of ECDH, such as functions for calculating modular square roots and the addition
of points on an EO. We then bring these elements together to create a working ECDH program, and
discuss the limitations of the MATLAB environment in which it was created. Finally we look at the real
world application of ECC and its future in the realm of cryptography.

Introduction

The goal of this report is to first give a description of the mathematics behind Elliptic Curve Cryptography
(ECC), in particular the Elliptic Curve Diffie-Hellman (ECDH) key exchange system, and secondly to describe and develop the algorithms and methods necessary for the implementation of the ECDH system in
the MATLAB environment.
Section 2 introduces the fundamental mathematics of the Elliptic Curve, over both the real numbers and
the integers modulo p, where p is prime. This includes the addition law denoted by EB, and the construction of the abelian elliptic curve group. Next, in Section 3, we look at the ECDH key exchange system.
The basis of this system is the Elliptic Curve Discrete Logarithm Problem (ECDLP), which is discussed
in some detail. After outlining the steps necessary to perform an ECDH key exchange between two people, we give a brief overview of the methods available to solve the ECDLP and hence break the ECDH system.
From Section 4 onwards our focus changes away from the theoretical foundations and towards the practical
application of ECC. We describe and develop the tools, methods and algorithms necessary for ECC, starting
with the basic operations of modular exponentiation and the calculation of inverses over finite fields, and
moving on to the more complicated tasks of finding modular square roots and the addition of points on the
EC. In Section 5 we bring these individual pieces together to construct a functional ECDH system, and then
discuss the limitations of this program and the MATLAB environment it was created in. Finally we discuss
how ECC is implemented in the real world, and its future use and standardization.

Fundamentals of Elliptic Curves

Elliptic Curves are a type of algebraic curve with a general form described by the Diophantine equation

(1)
They were utilised by Andrew Wiles in his proof of Fermat's Last Theorem, and they are gaining popularity
in the realm of cryptography for their security and efficiency over current cryptographic methods. They form
a large part of US National Security Agency's (NSA) Suite B of cryptographic algorithms that will, over
the next decade, replace those currently in use, such as RSA and the Diffie-Hellman Key Exchange [NSA,
a]. An illustration of the superiority of ECC over older methods can be seen by looking at the comparative
key size needed to ensure a similar level of security: where RSA would need a key size of 1024 bits, methods
based on ECs would only require one of 160 bits [NSA, b].
The elliptic curve can be defined over many fields, ranging from the complex numbers C and the rationals

Q to the real numbers IR and integers modulo p as covered in Sections 2.1 and 2.2 [Silverman, 2005, pg.
100-104]. For any field K we can in general find a group (E(K),EB), that consists of pairs of elements in
K that are solutions to Equation 1, plus an abstract point denoted by oo, which will b.e discussed further
below. The EB operator that acts upon the elements of the group remains the same algebraicly for each field,
though the procedure for calculating it may vary slightly.

2.1

Elliptic Curves over lR

An elliptic curve over the field IR, denoted as E (IR), is the set of real solutions to equation 1, with a, b, c,
dE IR and a# 0, i.e. the set { (x, y) E IR 2 Iy2 = ax 3 + bx 2 +ex+ d}, with the addition of an abstract point
oo [Martin, 2006, pg. 5]. We must also state the condition that to be an elliptic curve Equation 1 should
have three distinct roots when y = 0, either real or complex. This guarantees that the graph of the curve is
non-singular [Silverman, 2005, pg. 94], and hence a tangent line can be found at every point, the importance
of which will become apparent later.

'
'

'

r---J

'

\__...~

'

.,
'

/
\

y 2 = x 3 + 4x 2

.,

y2

+ 4x + 3

x3 - 7x + 6

Figure 1: Elliptic Curve Graphs [Vercauteren, 2005]

The graph produced by plotting the elliptic curve on the x and y axes has one of the following forms:
From this elliptic curve we can construct an Abelian group by introducing the binary operation EE, called
the addition law onE, which over lR!. can be given by a simple geometric construction [Martin, 2006, pg. 8].

Definition 1. : EE over lR!.

Let P1, P2 E E(JR), with P1
Case One:

(xl,Yl) and P2

(x2,Y2)

Case Two:
P1 EE P2

oo : if x1 = x2 and Yl
{ oo : if x1
x2 and Y1

f Y2
= Y2 = 0

Case Three:
If Case One and Two are not met, we then have:

where
X3

Ys

b m2
+ -a
a
-yl + m(x1- xs)
-Xl -

X2 -

(2)
(3)

(4)

To illustrate the geometrical intepretation of the addition law its best to first consider Case Three. Taking
the two points H and P2, we connect them with a straight line. This line is gauranteed to intersect the
elliptic curve at one other location - we denote this point as P3 1. We then reflect P 3 1 along the x axis, and

this gives us our answer P 3 .

The gradient of this connecting line is m, and is calculated using different formulas depending on whether the
points are distinct or identical. If the points are distinct the gradient is easily calculated using the standard
high school method that ammounts to 'rise over run'. If the points are identical then we must instead use
the tangent line at the point, the gradient of which is found by implicit differentiation; i.e.

dy
3ax1 2 + 2bxl + c
m=-=-----dx
2yl

Cases One and Two are then variations upon this idea. The point oo can be thought of as lying an infinite
distance above (or below) the x axis, so if P2 is oo and P 1 is somewhere on the elliptic curve then the
straight line connecting the two is considered vertical. P 3 1 is then directly below (or above) P1, and thus
the reflection in the x-axis returns us to P 1 Case Two occurs when the two points have the same x value,
resulting in P 3 being oo.

2.2

Elliptic Curves over Zp

Despite the utility offered by elliptic curves over JR!., it is only when one uses them over a finite field lF that
they can become the basis for practical cryptographic schemes. This is because we work with finite computers that are unable to accurately store and manipulate the elements of an infinite field such as (R), which
has an infinite number of elements, some of which will be infinitely recuring decimals. We hence use finite
fields, primarily 7/,P (integers modulo p), where pis a prime.
The Elliptic Curve given in Equation 1 now has the limitation that the coefficients a, b, c, d are integers
reduced modulo p, as are the variables x and y. We then define our Elliptic Curve as the set of integer
solutions modulo p to equation 1 with the addition of the oo point, and denote it as E (Zp)
Although the geometrical interpretation of EE that we used in section 2.1 is no longer applicable, its algebraic
definition can still be used, albeit with a slightly modified computational procedure.

Definition 2. : EE over E (Zp)

Let P1, P2 E E(Zp), with P1 = (xl,Yl) and P2
Case One:

= (x2,y2).

Case Two:
P1 EE P2 =

oo : if x1 = x2 and Yl f Y2
{ oo : if X1 = x2 and Yl = Y2 = 0

Case Three:
If Case One and Two are not met, we then have:

where
X3

= -XI - X2 -

Ys

-yl

ba-l + m 2a-l

+ m(x1 -

(5)
(6)

xs)

(Y2- YI)(x2- XI)- 1

m = { (3iixi 2 + 2bx1

+ c)2- 1yi -I

:if pl

I= p2

:if pl

= p2

(7)

As with the elliptic curves over lR, an abelian group can be formed by combining E (Zp) with the EE operator
of Definition 2. Thus, as an abelian group, (.E (Zp), EE) has the following properties, stated without proof
[Silverman, 2005, pg. 98]:
Identity: P EE oo = oo EE P = P
Inverse: P EE - P

= oo

Associativity: (PEE Q) EE R =PEE (Q EE R)

Commutativity: PEE Q = Q EE P
for all P, Q, R E

E (Zp)

While the group (.E (Zp), EE) is not in general cyclic, a cyclic subgroup can be generated with the elements
{oo, P, 2P, 3P, ... },where Pis any point on the EC.

The Elliptic Curve Diffie-Hellman Key Exchange

The Diffie-Hellman key exchange scheme is designed to allow two parties to exchange a key securely across
insecure communication lines. This key, once transferred, would most likely be then used as the key for
a symmetric encryption system. Diffie-Hellman relies on aspects of group theory, namely the Discrete
Logarithm Problem (DLP), and now that we have a suitable group structure we can begin to apply our
Elliptic Curves to this cryptographic scheme.

3.1

The Elliptic Curve Discrete Logarithm Problem

The generalised form of the Discrete Logarithm Problem (DLP) [Stinson, 2002, pg. 227] involves first taking
a multiplicative group (G, ),an element a E G with order n, and an element fJ E (a) (the cyclic subgroup
generated by a). The problem is to try to find the unique integer a, 0:::; a:::; n- 1, such that
aa = fJ.

(8)

Calculating fJ from a and a is computationally very easy; all it requires is the repeated application of the
operator. However, the reverse, calculating a from a and {J, is (probably) difficult (see section 3.3 below)
[Stinson, 2002, pg. 227]. If we fix a we can define the DLP in terms of the function f(a) = aa = fJ (i.e.
f : Z --+ G). This function f is an example of a 'one way' function: given any x in the domain of such a
function f, it is easy to compute f(x), but given any yin the range off it is computationally infeasible to
calculate the inverse x = f- 1 (y) [Menezes eta!., 1997, pg. 327].
The Elliptic Curve group (.E (Zp), EE) has the necessary properties to be used as the multiplicitive group in
the Discrete Logarithm Problem. Firstly however, we must set our notation. We use additive notation for
this group [Martin, 2006, pg. 12]:
If H & P2 E E (Zp) then

 for the inverse we write - P 1 rather than P 1-l, and - P 1 is called the negative or additive inverse of P1
the identity for the group is oo, as seen in Case One of the definition.
if n is an integer, we write nP1 instead of P 1n
Also note that
if n E N then (-nP1) means - (nP1), or the additive inverse of nP1.
if mE N then m(nP1) = (mn)H
As a result of using the Elliptic Curve Group as the base group for the DLP, we get what is known as the
Elliptic Curve Discrete Logarithm Problem (ECDLP). Given the elements P, Q E E (Zp) such that

(9)

Q=nP

for some n EN, the problem is to find n knowing only P and Q. As with the DLP, calculating Q from n
and Pis a trivial matter, requiring only the repeated application of the EB operator. However calculating n
knowing only P and Q is difficult, and it is this difficulty that gives the Diffie-Hellman scheme security.

3.2

The Elliptic Curve Diffie-Hellman Key Exchange system

Consider the hypothetical situation where Alice and Bob wish to talk over an insecure communication channel
without their enemy Eve eavesdropping on their conversation. By utilising the following protocol, Alice and
Bob each generate an identical key, with which they can then encrypt their conversation using a symmetric
encryption system such as the Advanced Encryption Standard (AES), Twofish or Serpent.
Alice and Bob first agree on a specific Elliptic Curve, a prime p and an element P E
information is public, and does not need to be kept secret.

E (Zp) This

Alice then chooses a secret value a EN, computes A= aP and sends A to Bob.

= bP and sends B to Alice.

by calculating K = bA, and Bob calculates K = bA.

Bob also chooses a secret value bEN, then computes B

Alice then finds the Diffie-Hellman Key

Both Alice and Bob end up with the same key K because:
KAlice

= aB = a(bP) = (ab)P = b(aP) = bA = KBab

(10)

The security of the system comes from the fact that if Eve wishes to find the key K using only public
information the only avenue currently open to her is to solve the ECDLP [Buchmann, 2004, pg. 189]. As
shown in Equation 10 calculation of the key requires one or both of the secret numbers a and b. Since she
does not have access to these, Eve would have to solve either A= aP, or B = bP for a and b respectively,
which are both forms of the ECDLP.

3.3

Breaking the Diffie-Hellman Key Exchange system

Although the focus of this report is the implementation of ECC systems rather than the cryptanalysis used
to break them, it is nonetheless important to discuss briefly the potential methods of attack and their effectiveness.
Due to the dependence of ECDH on the ECDLP, the fundamental attack on this cryptographic system is
to solve the ECDLP. Several methods currently exist to do this. For a general ECDLP the fastest known
algorithms are the so called 'Collision Methods', such as Pollard's p Algorithm, which over the Elliptic Curve
E (Zp) has a running time of 0 ( Vft) [Silverman, 2005, pg. 109]. (This means that for a large enough p the
5

maximum running time of the algorithm is cVfi where cis a positive constant [Carmen et al., 2001, pg. 44]).
However, these methods are still fully exponential in the bit length l of the prime: if we write p = 21, then
the running time becomes 0 (2 112 ), or 0 (2(l)) [Hankerson et al., 2004, pg. 16]. Thus a prime number p
with a suitably large bit length will ensure security from this attack: it is currently considered infeasible to
solve the ECDLP for p > 2160 [Silverman, 2005, pg. 109].
Regarding the security of the ECDLP a caveat must be added: it has not been proved that an efficient
algorithm to solve the ECDLP does not exist [Hankerson et al., 2004, pg. 154]. In other words it is possible
that at some time in the future an algorithm will be created that will be able to solve the ECDLP with a
running time that is polynomial in l, and hence demolish ECDH and many other cryptographic systems. This
issue has links to the famous P versus N P problem, a long standing open question in theoretical computer
science and one of the Clay Mathematics Institute's 'Millenium Problems'. P and NP refer to two classes
of problems: for those in the first, there exists a method or algorithm to find a solution in polynomial time,
while those in the latter group only need to have a method of verifying a given solution in polynomial time
[Odifreddi, 2004, pg. 177]. The question is whether or not a problem in the N P class is automatically also
a member of the P class; i.e. if there exists a method of verifying a solution to the problem in polynomial
time, does there also have to be a method of finding a solution in polynomial time? The ECDLP as stated
in Section 3.1 is part of the N P class: we can easily (in time polynomial in l ) verify a given solution n
simply by calculating nP and checking if the result matches Q. If an algorithm was created that could find
a solution in time polynomial in l then the ECDLP would also belong to the P class, proving that P = N P.
On the other hand if it were shown that such an algorithm does not exist, then that would imply that
P =f. N P [Hankerson et al., 2004, pg. 154], but in either case the author would end up very wealthy.

Elements Necessary for Elliptic Curve Cryptography

Before we can create a functional ECDH program, we need to develop a number of MATLAB functions to
perform the various operations required:
Modular Exponentiation (modexp.m): This function, based on an algorithm from Garrett [2001, pg.
207-208], calculates y = xe mod m for large x and e.
Multiplicitive Inverses over Finite Fields (zmmlinv .m): Here we use the Extended Euclidean Algorithm
[Garrett, 2001, pg. 124-126] to calculate the inverse of an element a over the finite field Zp.
Modular Square Roots (sqrtmod. m): This function uses the Shanks Algorithm to calculate the square
root of a modulo p, where p is a prime - in other words it finds x such that x 2 = a mod p. See Appendix
A.1 for the full MATLAB code.
Addition over an Elliptic Curve (elcaddmod.m): Based on Definition 2, this function finds the result
of the addition of two points on an EC.
Multiplication over an Elliptic Curve (elcmultmod.m): This function uses the repeated application of
elcaddmod. m to calculate the result of the 'multiplication' of a single point on an EC.
Elliptic Curve Populate (ecpop.m): This small function produces a list of all the points on a specified
elliptic curve.
Elliptic Curve Point Verification (isecptmod.m): This function verifies that a given point is on a
specified elliptic curve, returning a true or false accordingly.
I have written MATLAB code to implement these functions, some of which is included in Appendix A.

4.1

Modular Exponentiation

One of the fundamental limitations of the MATLAB software package is its inability to deal with the large
integers routinely found in number theory and cryptography. One area where this becomes apparent is
modular exponentiaion, i.e. y = xe mod m. For small x and e it is possible to calculate the result of the
exponentiation first and then calculate the answer modulo m. However, for large x and e the result of xe
can easily become too large for MATLAB to store accurately (see Section 5.2). Even if the result of the
modular exponentiation is below the necessary limits, the intermediate result of xe can breach the bounds
and hence introduce errors. To combat this problem the calculation of xe must be performed in a series of
steps with a modulo reduction done after each step.
The implementation set out below closely follows Garrett [2001, pg. 207-208], and is based on expressing e
as a binary integer:

where

ei E

(0, 1). We can then represent xe as a composite of powers of two:

X

e _ X eo ( X

2)e1 (X 4)e2

(X

g)ea (X z4)e 4... (X zn)en

The powers of two can be easily calculated by sucessive squaring:

The algorithm implementing this method of modulo arithmetic is very simple. We use three variables, X,
E and Y, which are initialised to x, e and 1 respectively. Each step of the algorithm then consists of the
following steps:
If E is odd, then replace Y with XY mod m and replace E with E - 1.
If E is even, replace X with X 2 mod m and replace E with E /2

When E reaches zero the current value of Y is xe mod m.

In MATLAB this is performed using the following code:

X=x;
E=e;
Y=l;
while E

rv

=0

iseven(E)

X = mod((r 2), m);

E = E/2;
elseif rviseven(E)

Y = mod((X*Y), m);
E = E-1 i

end
end

4.2

Calculating Multiplicative Inverses over Finite Fields

When working with Elliptic Curves over the real numbers the calculation of inverses is simple: we just to
performing the calculation a- 1 = ~ However, ECC is instead performed over the finite field made up of
the integers modulo p. This complicates the process of calculating inverses somewhat; instead of calculating
a simple fraction, calculating the inverse of a now means finding the element b of the finite field such that
a.b 1 modp.

Finding the inverse of an element a in Zp is not as simple as it was for the real numbers, where calculating the
fraction ~ would be sufficient. It is possible to employ a 'brute force' checking method, where all elements of
the finite field are checked until one element b satisfies the necessary condition that a.b = 1 mod p. However
this would be extremely laborious for large fields, so a more efficient method is required. One such method
is the Extended Euclidean Algorithm, laid out in detail in Garrett [2001, pg. 124-126]. In the course of this
project I implemented this algorithm in MATLAB.

4.3

The Shanks Algorithm and Modular Square Roots

To perform ECC, we need to be able to find points that lie on a particular elliptic curve. One approach would
be to generate random x and y values, and check whether or not they satisfy the elliptic curve equation.
However, a better method is to instead calculate random x values, then calculate the RHS of Equation 1,
giving us a y 2 value from which we can calculate the necessary y value if one exists. Although vastly more
efficient, this method requires the calculation of modular square roots. This is the purpose of the Shanks
Algorithm, also known as the Shanks-Tonelli Algorithm.
Given an element a of the finite field, the square root of a is defined as the element x such that
x 2 =a modp
If a has such a square root, it is called a quadratic residue. Those elements which do not have a square root
are called quadratic non-residues [Garrett, 2001, pg. 231]. In Zp
elements will be quadratic residues
and and equal number will be quadratic non-residues [Lauritzen, 2003, pg. 37].

Before analysing the Shanks Algorithm, we must first lay out a few definitions and ideas:
Let a be input to the square root function; i.e. we are attempting to find x such that x 2

= a.

Let p be an odd prime number, with a and p relatively prime.

The order of an element a of the finite field integers modulo p, writen ordp(a) is the smallest integer
j such that
ai

=1 modp.

[Garrett, 2001, pg. 137]

If integer r divides integer q we writer I q

[Garrett, 2001, pg. 62].

Euler's Criterion [Garrett, 2001, pg. 232]

E.::.!
2

1 : if a has a square root

-1 : if a does not have a square root

Lagrange's Theorem for Groups: If aq

= 1 mod p then ordp(a) I q

[Garrett, 2001, pg. 269] .

Lemma 1. If y 2

=1 mod

p, then y

=1 mod

p.

Proof.
y
2

y -1

= 1 modp

=0

:. PI

modp

(y2- 1)

P 1 (y

+ 1)(y- 1)

if a prime divides a product, then the prime must also divide one of the factors, so

PI (y 1)
y 1
:. y

=0

modp

= 1 modp
D

The general idea of the algorithm is to first calculate a likely candidate for the square root then check its
validity. If it is not the correct answer we alter it by a 'fudge factor', and check it again. This fudge factor
is updated with every cycle of the algorithm, and we are guaranteed to eventually find the correct square
root. The structure of the Shanks Algorithm has been sourced from Brown [1999, pg 90-94], but much of
the analysis performed below was skipped in his paper, such as lemmas 2 and 5.
We now analyse each step of the algorithm.
Step One
We first must obtain and check the input variables. The inputs are the integer a and the prime number p.
A check is performed to determine if a and p are relatively prime.
Step Two
We then Check Euler's Criterion. a~ mod p is calculated and if the result is equal to -1 then a has no
quadratic residue, and the algorithm is forced to terminate. If, however, the result is equal to 1, a does
indeed have a quadratic residue, and the algorithm can continue.
Step Three
We then have to find an element n of the finite field that is a quadratic non-residue; i.e. n ~
-1 mod p.
This is always possible as p;l elements of the field will be quadratic non-residues. Several methods can be
used to find n. A random search will eventually yield a quadratic non-residue as will a sequential search from
the first element of the field. Each method has its relative advantages. A random search could potentially
yield an answer on the first couple of tries, but could also theoretically search through all ~ quadratic
residues before finding a non-residue. The sequential search is however guaranteed to find a non-residue with
far fewer than p;l steps; if the extended Riemann hypothesis is correct, then the first quadratic non-residue

will always be less than s(l~p) [Wedeniwski, 2001, pg. 122].

2

Step Four
Taking the prime number p, we factorise p - 1 so that
p-1

= s.2

where s is odd and e is greater than zero. This is performed by the following MATLAB code:

s = 0;
e = 0;
while rem(s,2) rv=1
e = e + 1;
s=(p-1)/(2~ e);

end

Step Five
We now initialise the variables x, b, g and r. Note that all variables for the rest of this section are calculated
modp.
xo =a

tl!
2

bo

= a

9o
ro

= n
=e

x 0 is our first guess at the square root - it will become apparent later why this is a good choice. b0 will form
the basis of our 'fudge factor' if it is needed further on in the algorithm.

Also note the following result:

xo =a
xo2

tl!
2

= a+l
=aa
8

=boa

Step Six
We now turn our attention to the variable b, and more specifically, its order.

s.2r
=a_2_

=a
= 1

E.::.!
2

by Euler's Criterion

by Euler's Criterion. Hence by employing Lagrange's Theorem we can say that ordp(b) I 2r-l. We can
therefore set ordp(b) =2m, where m is an integer such that 0 S m S r -1. The aim of Step Six is to find
this integer m. This is done by a simple sequential search, starting at m = 0 and calculating b2 m for each
value of m until we find one for which b2 m = 1 .

Step Seven
Depending on the value of m, we enter one of two cases:
Case One: mo = 0
If m 0 = 0 then the algorithm has succedded and is terminated. For reasons that will be laid out below, xo
is the square root of a.

10

Case Two: mo of 0
If, on the other hand, m 0

of 0, then we update the variables:

2ri-mi-1

Xi+l

= Xi9i

bi+l

= bi9i2ri-mi

9i+l

= 9i
= mi

2ri-mi

ri+l

Once the variables have been updated, we return to Step Six of the Algorithm, and try to find the integer
mi+l
0
It is here that we find the main loop of the algorithm, and several questions must be answered. Will the
loop terminate, or is it possible that the algorithm will continue indefinitely? If the loop does terminate, is
the calculated answer, the variable x, the square root of a?
Before continuing, we shall state and prove two lemmas regarding the variables g and b that will be utilised
further on.

Proof. We perform a proof by induction. For i = 0 we have:

go= n
902ro-1

= ns2ro-1
= ns2e-l

= -1
as n is a quadratic non-residue.
Assuming it holds fori= n, i.e. 9n

2rn-l

= -1, we attempt to prove the i = n + 1 case:

2rn-mn

9n+l
2rn+t-1

9n+l

but
9n+l
9n+l

= 9n
2rn-mn+rn+t-1
= 9n

Tn+l = mn
2 rn+t-1

= 9n2

2rn+t-1 -

rn-1

-1

0
A similar result is possible for the variable b:

11

Proof.
y= bi

Let

2mi-1

Y2

= bi2mi

y2

=1

:. y :=: 1 by Lemma 1
y " 1

but
as

ordp(bi)

= 2m' f.

2mt-l

:.y = -1
bi

m;-1 _

= -1
D

We now introduce a lemma that will answer the first question we asked regarding the termination of the
algorithm.
Lemma 4. If the order of bi is 2m, then the order of bi+l is at most 2mt- 1 .

Proof.

= -1.- 1
,', = 1

by Lemmas 2 & 3

Thus by Lagrange's Theorem ordp(bH 1 ) ::::; 2m-l, and our Lemma is proved. This guarantees that the order
of the variable b will decrease through successive steps, and thus ensure that the algorithm will eventually
terminate.
D
The second question we asked about the algorithm was if it indeed terminated, was the final x value the
correct square root of a? We perform an analysis of the general case, where i is any non-negative integer.
It was noted above that x 0 2
Lemma 5. Xi

= b0 a mod p, but this result can be generalised.

= bia

Proof. This is proved using induction. We already have the proof for i=O, so we assume that it holds for
i

= n:

12

We then test the i

= n + 1 case:
2rn-mn-1

Xn+l
Xn+l

= Xn9n
2
2rn-mn
= Xn 9n
=: bna9n 2"n-mn

=bnBn
=bn+la

2"n-mn

So if on the ith iteration of the algorithm we find that the integer

correct square root of a?
First note that b; 2 m;

=b; =1

as 2m;

= 1.

m; =

0, the loop will terminate. Is

x;

the

So from Lemma 5 we have

x;

= b;a
= l.a
=a

Thus the algorithm produces the correct square root of a.

4.4

Implementation of the Addition Law over E (Zp)

The primary function used in Elliptic Curve encryption schemes is ffi, as described above in 2.2. Thus we
require a MATLAB implementation of this, and also other functions in order to verify its efficacy. The
functions fulfilling this need are elcmul tmod. m and elcaddmod. m. The latter calculates P 3 = P 1 ffi P 2, while
the former utilises the latter to calculate Q 2 = nQ 1 , or Q2 = Q1 ffi Q1 ffi ... ffi Q1 n times.
4.4.1

Elliptic Curve Addition: elcaddmod.m

The inputs to this functiona are the x and y coordinates of two points, P1 and P2, the coefficients a, b,
c and d that define the elliptic curve, and the prime that defines the finite field over which we are working. The oo point that was introduced in section 2.2 is represented by using the string 'I' as the point's x
andy coordinates. For example, the following command would add the point (x, y) = (19, 21) to the oo point:
[x3, y3] = elcaddmod(19, 21, 'I', 'I', 12, 8, 9, 15, 29) .

The structure of the program is very similar to that of Definition 2; we test the x and y coordinates of the
two points to determine which case they fit into, and calculate an answer accordingly. Case One simply
involves checking if one of the points is oo, and if so, setting the answer as equal to the other point.
Case Two deals with situations where the x coordinates are equal, and they coordinates are either different
or both equal to zero. If this arises, the output is set to the oo point.
Finally, if Cases One and Two are not satisfied, and error checking has not revealed any input errors, the
program will enter Case Three. Here we first calculate m. When working with the Elliptic curve over ffi:. this
quantity is the gradient of the line connecting the two points, and is calculated accordingly. The resultant
formulas are easily transfered to the elliptic curve over the finite field IF, with each variable and parameter
restricted to the elements of IF, and inverses being calculated using the function discussed in section 4.2

13

Once the correct m value has been calculated, it is then a simple matter to calculate the x and y coordinates
of the resulting point, using Equations 5 and 6.
4.4.2

Elliptic Curve Multiplication: elcmul tmod. m

One of the primary calculations used in the ECDH key exchange is what could be called multiplication in
the additive notation we are using; i.e. Q2 = nQ 1 . This involves 'adding' Q1 to itself n times. Althought
this function is little more that repeated usage of elcaddmod. m, it is convenient to place it into a single
function as it is used repeatedly in the implementation of the Key Exchange.

4.5

Verification of the Addition Law Functions

Before applying them to any cryptographic implementation it was necessary to test the Addition Law
functions elcaddmod. m and elcmultmod. m. Several functions were writen to do this.
4.5.1

Elliptic Curve Populate: ecpop.m

The purpose of this function is to generate a list of all the points on a finite field Elliptic Curve. For example, the EC defined by (a, b, c, d) = (4, 14, 9, 17) with p = 19 was populated with this function, yielding the
following list of points:

-------- -------0
13
1
14
2
3
4
18
5
0
9
14
10
15
11
3
12
3
15
14
17
2

------6
5
16
1

0
5
4
16
16
5
17

This list and others like it allow us to confirm that the function elcaddmod. m is preserving the closure of
the group - if two points from the list are inputted to the function the output should also be on the list. For
testing purposes it was only possible to use ECs over small finite fields, with prime values ranging up to 19.
Using this method it was determined that the implementations of the Addition Law were indeed correct.
4.5.2

Elliptic Curve Point Verify: isecptmod. m

This function, given a point, will determine whether the point lies on a specific elliptic curve, returning true
and false (1 and -1) results accordingly. The true/false output of the function means that the function can
be easily integrated into other functions as a form of error detection, as was done with elcmultmod.
Having, in effect, an integrated verification system, elcmultmod was easily debugged and verified.

14

5
5.1

Implementation of Elliptic Curve Cryptography

MATLAB implementation of Elliptic Curve Diffie-Hellman

In section 3 the theoretical underpinnings of ECDH were introduced, and in section 4 the necessary tools
to implement this system were developed. We now put these two together to produce a working ECDH key
exchange system. Note that the program has been written from the perspective of Alice, with the variable
names corresponding to her part in the system. The full MATLAB program is listed in Appendix A.2
The first step in the process is gathering the required data. This consists of the coefficients a, b, c and d
that determine the Elliptic Curve, the prime p that specifies the finite field, and a point P on this curve.
All this information is public, and is to be agreed upon by Alice and Bob. At this stage the program
checks that the inputted p is indeed prime and, using isecptmod, that the given point P lies on the Elliptic Curve. Alice and Bob then have to each choose a secret number, and this too is inputted into the program.
The first of the main calculations can now take place. By using elcmultmod.m the program calculates
A= aP, and outputs it to the console. Alice can then send this number to Bob.
Once Alice receives B from Bob, she inputs it into the console. The program first checks for any transmission
errors by verifying that the point lies on the elliptic curve, and then calculates the key K = aB. The key is
then displayed on the console, and the program is complete.
This implementation of ECDH has has been successfully tested with primes ranging up top= 19999423, or
roughly 25 bits. While this is nothing near the level of security required in real world circumstances, it is
limited by certain aspects of MATLAB which will be discussed further in Section 5.2.
To aid in the use of this program, a function has been created to locate a random point on the Elliptic Curve
to be used as the puplic point P. This is performed by first generating a random x E Zp, then calculating
the corresponding y value using sqrtmod. m. If no such y value exists, another x is generated, and the process
repeated until one can be found.

5.2

Limitations of MATLAB

As metioned earlier MATLAB is incapable of accurately dealing with the large integers that we encounter
in cryptography. The problems this creates can sometimes be overcome, often through the use of alternative
algorithms like that used for modular exponentiation above. However, this is not always possible; beyond a
certain point even basic operations like squaring creates numbers that are too big for MATLAB to properly
store.
The fundamental limitation is a result of the way MATLAB stores numbers. The double precision IEEE
floating point form that MATLAB normally uses can accurately store integers up to 4,503,599,627,370,495
(52 bits). Any number that excedes this limit will have some of its least significant digits rounded out of
existence, and hence loose accuracy. It is possible to store numbers as 64 bit unsigned integers, increasing
the limit to 18,446,744,073,709,551,615, but MATLAB cannot perform arithmetic on numbers in such a
form. Future versions of MATLAB that incorporate a proposed new IEEE standard will probably be able to
accurately store integers with a bit length roughly double the current maximum, but even then it will still
be unable to properly deal with the 160 bit numbers required to maintain security.

15

5.3

Elliptic Curve Cryptography in the Real World

Given the limitations of MATLAB discussed above, how is ECC implemented in the real world? The answer
lies in the concept of arbitrary precision arithmetic, which allows calculations to be performed on integers
of any length. There does not appear to be any packages to implement arbitrary precision arithmetic in
MATLAB, but there are several such packages available for other languages like C/0++ and Java. Hence
it is in these languages that real world ECC systems are created.
In 2005 the US National Security Agency (NSA) rel~ased Suite B, a group of five cryptographic algorithms
that will over the next decade replace those currently in use by the US Government and Military. Three of
the five algorithms are based on Elliptic Curves: ECDH, Elliptic Curve Menezes-Qu-Vanstone (ECMQV),
another key exchange system, and Elliptic Curve Digital Signiture Algorithm (ECDSA) [NSA, a]. The reason
for this is the efficiency that EO cryptography offers compared to more traditional non-EO based schemes.
As mentioned in Section 3.3 the ECDH system is considered secure when a prime larger than 2160 is used,
but in order to gain a similar level of security from the older RSA system it is necessary to use primes
larger than 21000 [Silverman, 2005, pg. 109]. Despite the extra complications involved in carrying out the
EB operation compared to the modular multiplication used in RSA, the dramatic reduction in the size of the
stored integers makes ECDH and other EO based systems faster and more efficient.
In Section 3.3 it was stated that for a general ECDLP the fastest known algorithms had running times of
0 (.;p). However in certain special cases there are algorithms that have significantly faster running times,
making ECDH insecure even for sufficiently large primes. In any practial implementation of ECDH and EC
cryptography schemes in general it is necessary to avoid these special cases. To this end the US National
Institute of Standards and Technology have published a list of suitable elliptic curves and their corresponding
finite fields in Appendix Six of NIS [2000].

Conclusion

Elliptic Curves offer a rich variety of behaviour which we can utilize for the purposes of cryptography. As
shown in Section 2 we can develop an abelian group structure that is then used as the basis for cryptographic
schemes such as the ECDH key exchange. The security of these schemes relies on the difficulty of solving
the ECDLP, as introduced in Section 3.1.
Over the course of this project I have created a limited but functional implementation of the ECDH key
exchange system, using the MATLAB software package. This program, listed below in Appendix A.2, allows
two parties, Alice and Bob, to generate identical keys with which to then symmetrically encrypt a conversation. If their enemy Eve wishes to eavesdrop on the conversation she must first break the ECDLP. For the
relatively small numbers used here this could be done easily, but for real-world programs using very large
numbers this would be computationally infeasible.
The limited nature of the implementation is due to the method by which MATLAB stores and works
with large integers, and the apparent absence of any package that would allow MATLAB to deal with
them differently. However, looking back at the work completed, we can see that many of the required
algorithms and methods already developed and discussed are independent of the language they are eventually
implemented in. Thus if we wanted to create a more effective program capable of handling the large numbers
that would ensure security we merely have to 'translate' our current methods into a superior language such
as 0/C++, instead of starting again from scratch.

16

References
Ezra Brown. Square roots from 1; 24, 51, 10 to Dan Shanks. The College Mathematics Journal, 30(2):82-95,
Mar 1999.
Johannes A. Buchmann. Introduction to Cryptography. Springer, 2nd edition, 2004.
Thomas H. Cormen, Charles E. Leiserson, Ronald L. Rivest, and Clifford Stein. Introduction to Algorithms.
MIT Press, 2nd edition, 2001.
Paul Garrett. Making, Breaking Codes. Prentice Hall, 2001.
Darrel Hankerson, Alfred J. Menezes, and Scott Vanstone. Guide to Elliptic Curve Cryptography. Springer,
1st edition, 2004.
Niels Lauritzen. Concrete Abstract Algebra: Prom numbers to Grabner Bases. Cambridge University Press,
2003.
Ben Martin. Elliptic curve cryptography. Math 409 Notes, University of Canterbury, 2006.
Alfred J. Menezes, Paul C. van Oorschot, and Scot A. Vanstone. Handbook of Applied Cryptography. CRC
Press, 1997.
Federal Information Processing Standards Publication 186: Digital Signature Standard. NIST (National
Institute of Standards and Technology), Jan 2000.
Fact Sheet:
NSA
Suite B
Cryptography.
NSA (National Security
http: I lwww. nsa.govlialindustrylcrypto_suite_b. cfm (Accessed 7 February 2007).

Agency),

Fact Sheet: The Case for Elliptic Curve Cryptography.

NSA (National Security Agency),
http: I lwww. nsa.govlialindustrylcrypto_elliptic_curve. cfm (Accessed 7 February 2007).

a.
b.

Piergiorgio Odifreddi. The Mathematical Century: The 30 Greatest Problems of the Last 100 Years. Princeton
University Press, 2004.
Joseph H. Silverman. Elliptic curves and cryptography. In Paul Garrett and Daniel Lieman, editors, PublicKey Cryptography. American Mathematical Society, 2005.
Douglas R. Stinson. Cryptography: Theory and Practice. Chapman & Hall/CRC, 2002.
F. Vercauteren. Elliptic curve discrete logarithm problem. Lecture Slides, Katholieke Universiteit Leuven,
2005.
Sebastian Wedeniwski. Primality Tests of Commutator Curves. PhD thesis, Eberhard Karls University of
Tiibingen, 2001.

17

A
A.l

MATLAB .m Files
sqrtmod.m

function X=sqrtmod(a, p)
%SQRTMOD square root modulo prime p
% function sqrtmod finds the square root of integer a modulo p if it exists

%
%

Date

Programmer

Description of Change

15/12/06
20/12/06

H. Silverwood
H. Silverwood

Original Code
Modified to include fast modular
exponentiation

%
%
%

%
%

%Calling Sequence:
% X=sqrtmod(a,p)

%
% Inputs:
a
p

%
%

integer
prime number, >2

& relatively prime to a

%
%Outputs:
% X
%

square root of a
'E' if there is no square root

%
%Check conditions on p
%---------------------------------------%
%Check that prime is greater than 2
if p<=2
error('p must be greater than 2: p>2')
end
%Check relative primality of a and p
if gcd(a,p)-=1
X='E'; %a and p not relatively prime
return
end

%---------------------------------------%
%Check Euler's Criterion

%---------------------------------------%
Eu=modexp(a, (p-1)/2, p);
if Eu==(p-1)
X='E'; %Square root does not exist
return
elseif Eu-=1
error('Eu does not equal 1 or negative 1')
end

%---------------------------------------%
%Factorise Prime Number

18

%---------------------------------------%
s=O;
e=O;
while rem(s,2)-=1
e=e+1;
s=(p-1)/(2~e);

end
%---------------------------------------%
%Find suitable n value
%---------~-----------------------------%

n=1;
nres=O;
while nres-=(p-1)
n=n+1;
nres=modexp(n, (p-1)/2, p);
end
%---------------------------------------%
%Perform Variable Initialization
%---------------------------------------%
x=modexp(a, (s+1)/2, p);
b=modexp(a, s, p);
g=modexp(n, s, p);
r=e;
%---------------------------------------%
%Primary Calculations
%---------------------------------------%
m=1; %Initialise m
while m-=o
%Reset m
m=O;
%Find m
bres=b;
while bres-=1
bres=mod(bres~(2),p);

m=m+1;
end
%Replace Variables
xtemp=modexp(2, (r-m-1), p);
x=mod(x*(modexp(g, xtemp, p)), p);
temp=modexp(2, (r-m), p);
gtemp=modexp(g, temp, p);
b=mod(b*gtemp, p);
g=gtemp;
r=mod (m, p) ;
end
X=x;

19

return
%---------------------------------------%

A.2

DiffieHellman.m

%Script file: Diffie-Hellman Key Exchange

%
%Purpose: To implement the Elliptic Curve Diffie-Hellman Key Exchange system

%
% Date
%
% 10/01/07
%
% Inputs:
% a,b,c,d
% p
% p
% a
%
% Outputs:
% A
% K
%

Programmer

Description of Change

H. Silverwood

Original Code

Elliptic Curve parameters

prime modulus of EC
Coordinates of point on Elliptic Curve [Px Py]
natural number (secret)

aP (sent to counterpart)
common key

%Display Header
disp('~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~')

disp('
Elliptic Curve Diffie-Hellman Key Exchange')
disp(' ')
disp('This program implements the Elliptic Curve ')
disp('Diffie-Hellman Key Exchange system with sub')
disp('64-bit numbers.')
disp(' ')
%Enter Public Information
disp('Enter public information:')
disp(' ')
ECp=input(' EC parameters [abc d]
');
disp (' ')
p=input(' Prime number p = ');
%Check Primality
if isprime(p)==O
error('Input is not prime')
end
disp(' ')
P=input('
Px=P(1);
Py=P(2);

Point P

[Px Py]

') j

%Verify that point P is on the EC

PECflag=isecptmod(Px, Py, ECp(1), ECp(2), ECp(3), ECp(4), p);
i f PECflag==O
error('Point P does not lie on the specified Elliptic Curve')

20

end
disp(' ')
disp('Enter Private Information:')
a=input('
Natural Number a=');
%Perform A=aP calculations
[Ax, Ay]=elcmultmod(a, Px, Py, ECp(1), ECp(2), ECp(3), ECp(4), p);
A=[Ax, Ay];
disp('Send the following EC point to counterpart')
fprintf('
A = [%3d %3d ]\n\n', Ax, Ay)
%Enter Recieved data
disp('Enter EC point recieved from counterpart')
B=input('
Point B = [Bx By] = ');
Bx=B(1);
By=B(2);
%Verify that point B is on the EC
BECflag=isecptmod(Bx, By, ECp(1), ECp(2), ECp(3), ECp(4), p);
while -BECflag
disp ('Point B does not lie on the specified EC;')
disp ('Enter new Point B value:')
B=input ('
Point B = [Bx By] = ');
Bx=B(1);
By=B(2);
BECflag=isecptmod(Bx, By, ECp(1), ECp(2), ECp(3), ECp(4), p);
end
%Calculate Key K
[Kx, Ky]=elcmultmod(a, Bx, By, ECp(1), ECp(2), ECp(3), ECp(4), p);
K=[Kx, Ky];
%Output Key K
fprintf('The key is K = [%3d %3d ]\n\n', Kx, Ky)
disp(>>)

21