Score:2

Encoding a message as points on elliptic curve

cn flag

I want to encode my plaintexts as points on some given elliptic curve $E$ defined over a finite field $F_q$. Suppose I want to use Koblitz's method. Does the size of the message I want to encode matter? Can I encode the message in the size I want? What should I do with very long messages?

Score:2
ru flag

Answer to the Question

In section 3 of his paper Elliptic Curve Cryptosystems, Koblitz describes three methods to encode plaintext messages as elliptic curve points. Method (2) is the one usually described as Koblitz's method and assumes that we are working over a prime field and that plaintext is represented as a non-negative integer $m$ less than $p/1000-1$. To encode one tests in turn putative $x$ co-ordinates $x=1000m, 1000m+1,\ldots,1000m+999$ until we find one where $x^3+ax+b$ is a square modulo $p$ and then compute the corresponding $y$. Decoding is achieved by deleting the last 3 digits of the $x$-coordinate of an elliptic curve point.

The condition $0\le m<p/1000-1$ sets a limit on the size of the message and long messages will have to be encoded in multiple points. If we bound the size of integers as $B<p/1000-1$, writing the message in base-$B$ allows us to encode a message cooresponding to the integer $L$ in $\lfloor\log L/\log B\rfloor+1$ points.

Additional information beyond the scope of the question

The value 1000 is somewhat arbitrary, but should be chosen to minimise the chance of failure to encode. As each of our candidate $x$ values will produce a square value of $x^3+ax+b$ with heuristic probability close to 1/2, we might expect that this method to fail with probability $\approx 2^{-1000}$ which is highly improbable. Replacing 1000 with a smaller number $k$ (and changing the decoding procedure accordingly) will give an increased plaintext space by a factor $\approx 1000/k$ failure rate of $2^-k$. One should consider the effect of adversarially chosen messages before selecting $k$ too small.

One should also note that the decoding process works whether the correct encoding process was followed or not. This means that multiple points (roughly 500) on the curve decode to the same plaintext. This could provide a covert channel in a malicious implementation.

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.