zo staat het op de site:
http://www.nd.edu/~cmonico/eccp109/<HR>What are we doing?
<HR>
We are coordinating a distributed effort to solve Certicom's ECCp-109 challenge. The challenge is to solve a particular elliptic curve discrete logarithm problem.
The Elliptic Curve Discrete Logarithm Problem (ECDLP) is the basis for a powerful cryptosystem. The very rudimentary idea of our particular problem is the following:
We have a curve, C, of the form:
y2 = x3 +ax +b
For some constants 'a' and 'b'. We're also given some fixed large prime 'p'. A "point on the curve" is a pair of integers (u,v) that satisfy this equation modulo 'p'. This means, simply, that 'p' divides v2-u3-au-b. Now the leap of faith: There is a method by which we can "add" two points on the curve to get another point on the curve. We call it addition, but it looks nothing like what we normally think of as addition. Just think of it as a rule that tells us how to obtain a third point on the curve from two given points. If you know a little algebra, I'll tell you that these points together with this operation form an abelian group.
Here's the point of the challenge: Certicom has chosen a point, 'P', on this curve and a very big integer 'k'. They then computed Q := kP. This means that they added 'P' to itself 'k' times and called the result 'Q'. But there is a clever way to do this with only log(k) operations. So they can choose a REALLY big 'k', and still compute kP. Now, we know 'P' and 'Q' and our mission is to find 'k'. But 'k' is far too big to simply start trying k=1,k=2,k=3,... so we need to do it in a smarter way. Here are the exact challenge parameters for ECCp-109:
p =564538252084441556247016902735257
y2 = x3 +321094768129147601892514872825668x +430782315140218274262276694323197
P = (97339010987059066523156133908935, 149670372846169285760682371978898)
Q = (44646769697405861057630861884284, 522968098895785888047540374779097)
What does this have to do with cryptography? One of the major problems of cryptography is to achieve secure communication over an insecure channel. Think of it in the following way: You're about to buy something on the internet, from company X. To do this, you need to give them your credit card number. But the internet is an inherintly insecure channel. That is, there are eavesdroppers everywhere just watching all your communications with company X. Let's call one of the eavesdroppers Eve. So how will you give them your credit card without Eve getting it as well? Of course, the answer is by encrypting it. But a little thought quickly convinces you that it's not that simple. You and company X have to agree on some encryption which both of you can 'do' and 'undo'. But Eve is listening while you try to agree on this. So here's my point: you and company X need to agree on some secret information that you will both know but Eve will not. And elliptic curves provide one way of doing this. Here's how it works (this is Diffie-Hellman key exchange with elliptic curves):
You and X agree on some elliptic curve and some point 'P' on the curve. X secretly chooses some large integer 's' and computes the point A := sP. That is, A is 'P' added to itself 's' times. X then tells you the point 'A' but not the integer 's'. You do something similar, and secretly pick a large integer 't'. You then add 'P' to itself 't' times to get the point B := tP. You tell X what the point 'B' is, but not the integer 't'.
Now you know the point A and your secret integer 't'. You add A to itself 't' times, and obtain Z := tA. Company X does something similar and adds your point B to itself 's' times to get Z := sB. I have not accidentally used the same 'Z' twice - these two calculations actually give the same point, since
Z = tA = t(sP)=(ts)P = (st)P = s(tP) = sB
This is your secret information that the eavesdropper will not know. It's a small technical detail of how you use this secret information to make an encryption scheme. But if you think about it, it's not that far of a leap. Once you two know something that nobody else knows, you can find a way to do encryption with it.
Why doesn't the eavesdropper know it? Let's look carefully at what Eve sees you and X exchange. She sees the elliptic curve you agree on and the point 'P'. She sees the points that you exchange: 'A' and 'B'. But this is all that she knows: She knows neither 's' nor 't'. How could she try to figure out the secret piece of information 'Z'? Certainly she can add A and B, but this doesn't help since:
A+B = sP + tP = (s+t)P
and this is not the same point as Z=(st)P. If she could figure out one of the integers 's' or 't', she could get Z. But how does she figure out one of these integers? This is exactly the elliptic curve discrete log problem: She knows, for example, P and A and must find an integer 's' so that P = sA. So, she must solve the same problem that we're trying to solve in this challenge. This is also part of the reason for this series of challenges that Certicom has proposed: To see exactly what Eve can actually solve. Since we're going to solve this challenge, you would actually use larger parameters so that Eve could not solve it. Specifically, the problem gets harder as the prime 'p' gets larger. Our prime 'p' is a 109 bit integer for this challenge, so you and X would use something larger than 109 bits (maybe 200 bits). I should mention that we are going to _barely_ solve this problem. That is, if the prime were 131 bits, our attack would not work. It would take about 65536 times longer (or need 65536 times as many machines to do it in the same amount of time).