Custom static Diffie-Hellman groups
View Patent ↗Methods for choosing groups for a static Diffie-Hellman key agreement protocol to inhibit active attacks by an adversary are provided. In mod p groups, an even h is chosen of value approximately ( 9/16)(log 2 n) 2 , values r and n are determined using sieving and primality testing on r and n, and a value t is found to compute p=tn+1 wherein p is prime. In elliptic curve groups defined over a binary filed, a random curve is chosen, the number of points on the curve is counted and this number is checked for value of 2n wherein n is prime and n−1 meets preferred criteria. In elliptic curve groups defined over a prime field of order q, a value n=hr+1 is computed, wherein n is prime and n−1 meets preferred criteria, and a complex multiplication method is applied on n to produce a value q and an elliptic curve E defined over q and having an order n.
1. A method of establishing an order p of a finite field Z p , and an order n of a subgroup of a multiplicative group Z p * of said finite field Z p , the method being performed by a correspondent in a data communication system, the correspondent having a cryptographic unit for performing cryptographic operations, the method comprising the steps of:
i) the cryptographic unit obtaining a value of n of the form n=hr+1 where h is an integer, r is a prime integer, r is greater than n 2/3 , and all factors of n−1 are significantly smaller or bigger than n 1/3 ;
ii) the cryptographic unit obtaining an even integer t and computing tn+1to produce a computed value;
iii) the cryptographic unit checking whether the computed value is prime; and
iv) the cryptographic unit utilizing the computed value as the prime order p of the finite field if said computed value is prime, and the cryptographic unit utilizing the value n as the order n of the subgroup of the multiplicative group.
2. The method of claim 1 wherein n is required to be prime and further comprising the step of the cryptographic unit checking if n is prime.
3. The method of claim 2 wherein r and n are selected by sieving to exclude values having small primes.
4. The method of claim 2 wherein step i) includes the cryptographic unit first obtaining desired values for n and h, and then computing r to satisfy n=hr+1.
5. The method of claim 1 wherein h is less than 2( 9/16)(log 2 n) 2 .
6. The method of claim 5 wherein h is greater than 0.5( 9/16)(log 2 n) 2 .
7. A non-transitory computer-readable medium having stored thereon computer-executable instructions for performing a method of establishing an order p of a finite field Z p , and an order n of a subgroup of a multiplicative group Z p * of said finite field, the method being performed by a correspondent in a data communication system, the correspondent having a cryptographic unit, the computer-executable instructions comprising instructions for:
the cryptographic unit obtaining a value of n of the form n=hr+1, where h is an integer, r is a prime integer, r is greater than n 2/3 , and all factors of n−1 are significantly smaller or bigger than n 1/3 ;
the cryptographic unit obtaining an even integer t and computing tn+1 to produce a computed value;
the cryptographic unit checking whether said computed value is prime; and
the cryptographic unit utilizing said computed value as the prime order p of the finite field if said computed value is prime, and utilizing the value n as the order n of the subgroup of the multiplicative group.
8. The non-transitory computer-readable medium of claim 7 wherein n is required to be prime, the computer-executable instructions further comprising instructions for the cryptographic unit checking if n is prime.
9. The non-transitory computer-readable medium of claim 8 , the computer-executable instructions further comprising instructions for the cryptographic unit selecting r and n by sieving to exclude values having small primes.
10. The non-transitory computer-readable medium of claim 8 , the computer-executable instructions further comprising instructions for the cryptographic unit first obtaining desired values for n and h, and then computing r to satisfy n=hr+1.
11. The non-transitory computer-readable medium of claim 7 wherein h is less than 2( 9/16)(log 2 n) 2 .
12. The non-transitory, computer-readable medium of claim 11 wherein h is greater than 0.5( 9/16)(log 2 n) 2 .
13. A method of verifying domain parameters for use in a cryptographic system, the method being performed by a correspondent in the cryptographic system and comprising the steps of
(a) a cryptographic unit of the correspondent checking that n=hr+1, where h is an integer, r is a prime integer, r is greater than n 2/3 , and all factors of n−1 are significantly smaller or bigger than n 1/3 ; and
(b) the cryptographic unit checking that p=tn+1 where t is an even integer.
14. A method for establishing an order of a subgroup of an elliptic curve group, the method being performed by a correspondent in a data communication system, the correspondent having a cryptographic unit for performing cryptographic operations, the method comprising the steps of:
a) the cryptographic unit obtaining a value n of the form n=hr+1 where h is an integer, r is a prime integer, r is greater than n 2/3 , and all factors of n−1 are significantly smaller or bigger than n 1/3 ; and
b) the cryptographic unit utilizing the value n as the order of the subgroup of the elliptic curve group.
15. The method of claim 14 wherein said value n is prime.
16. The method of claim 15 wherein step a) includes the steps of:
i) the cryptographic unit generating a random elliptic curve group;
ii) the cryptographic unit testing whether a prime factor of an order of the elliptic curve group can be expressed as n=hr+1; and
iii) if the prime factor n can be expressed as n=hr+1, then utilizing said random elliptic curve group as said elliptic curve group.
17. The method of claim 15 further comprising the step of the cryptographic unit using the value n in a complex multiplication algorithm to establish coefficients defining an equation of the elliptic curve group.
18. The method of claim 17 further comprising the step of the cryptographic unit generating an order q of a prime field over which the elliptic curve group is defined, and using the order q and the value n in the complex multiplication algorithm to establish the coefficients defining the equation of the elliptic curve group.
19. The method of claim 18 wherein the cryptographic unit specifies the form of the order q.
20. The method of claim 15 wherein r and n are selected by sieving to exclude values having small primes.
21. The method of claim 15 wherein step a) includes the cryptographic unit first obtaining desired values for n and h, and then computing r to satisfy n=hr+1.
22. The method of claim 14 wherein h is less than 2( 9/16)(log 2 n) 2 .
23. The method of claim 22 wherein h is greater than 0.5( 9/16)(log 2 n) 2 .
24. A non-transitory computer-readable medium having stored thereon computer-executable instructions for performing a method of establishing an order of a subgroup of an elliptic curve group, the method being performed by a correspondent in a data communication system, the correspondent having a cryptographic unit, the computer-executable instructions comprising instructions for:
the cryptographic unit obtaining a value n of the form n=hr+1 where h is an integer, r is a prime integer, r is greater than n 2/3 , and all factors of n−1 are significantly smaller or bigger than n 1/3 ; and
the cryptographic unit utilizing the value n as the order of the subgroup of the elliptic curve group.
25. The non-transitory computer-readable medium of claim 24 wherein said value n is prime.
26. The non-transitory computer-readable medium of claim 25 , the computer-executable instructions further comprising instructions for:
the cryptographic unit generating a random elliptic curve group;
the cryptographic unit testing whether a prime factor of an order of the elliptic curve group can be expressed as n=hr+1; and
if the prime factor n can be expressed as n=hr+1, then the cryptographic unit utilizing said random elliptic curve group as said elliptic curve group.
27. The non-transitory computer-readable medium of claim 25 , the computer-executable instructions further comprising instructions for the cryptographic unit using the value n in a complex multiplication algorithm to establish coefficients defining an equation of the elliptic curve group.
28. The non-transitory computer-readable medium of claim 27 , the computer-executable instructions further comprising instructions for the cryptographic unit generating an order q of a prime field over which the elliptic curve group is defined, and using the order q and the value n in the complex multiplication algorithm to establish the coefficients defining the equation of the elliptic curve group.
29. The non-transitory computer-readable medium of claim 28 , the computer-executable instructions further comprising instructions for the cryptographic unit specifying the form of the order q.
30. The non-transitory computer-readable medium of claim 25 , the computer-executable instructions further comprising instructions for the cryptographic unit selecting r and n by sieving to exclude values having small primes.
31. The non-transitory computer-readable medium of claim 25 , the computer-executable instructions further comprising instructions for the cryptographic unit first obtaining desired values for n and h, and then computing r to satisfy n=hr+1.
32. The non-transitory computer-readable medium of claim 24 wherein h is less than 2( 9/16)(log 2 n) 2 .
33. The non-transitory computer-readable medium of claim 32 wherein h is greater than 0.5( 9/16)(log 2 n) 2 .