Analysis of the Fault Attack ECDLP over Prime Field

Abstract

In 2000, Biehl et al. proposed a fault-based attack on elliptic curve cryptography. In this paper, we refined the fault attack method. An elliptic curve 𝐸 is defined over prime field 𝔽_𝑝 with base point 𝑃∈𝐸(𝔽_𝑝). Applying the fault attack on these curves, the discrete logarithm on the curve can be computed in subexponential time of 𝐿_𝑝(1/2,1+𝑜(1)). The runtime bound relies on heuristics conjecture about smooth numbers similar to the ones used by Lenstra, 1987.

1. Introduction

In 1996, a fault analysis attack was introduced by Boneh et al. [1]. Biehl et al. [2] proposed the first fault-based attack on elliptic curve cryptography [3, 4]. Their basic idea is to change the input points, elliptic curve parameters, or the base field in order to perform the operations in a weaker group where solving the elliptic curve discrete logarithm problem (ECDLP) is feasible. A basic assumption for this attack is that one of the two parameters of the governing elliptic curve equation is not involved for point operations formulas. In this way, the computation could be performed in a cryptographically less secure elliptic curve.

In [2], it is claimed that the attacker can get the secret multiplier 𝑘 with subexponential time, but the authors did not give the proof or even an outline of the proof. I find that this is not a trivial result. Since the distribution of the cardinality of elliptic curves over finite field 𝔽_𝑞 is not uniform in the interval [𝑞+1−2√𝑞,𝑞+1+2√𝑞].

In practice, in order to get a better function, the cryptosystem may be based on some special family of elliptic curve. Here, we assume that the fault attack is restricted on the following elliptic curve defined over prime field 𝔽_𝑝:𝑦²=𝑥³+𝐴𝑥²+𝐵, (1.1) which is denoted by 𝐸_𝐴,𝐵. In this paper, we prove that the attacker can get the secret multiplier 𝑘 with subexponential time when the fault attack is restricted to the elliptic curve family of 𝐸_𝐴,𝐵. It is noted that we can get a simpler proof when the fault attack is based on the general elliptic curves.

In Section 2, the fault attack method is described in detail and some improvements of the fault attack are introduced. Firstly, we can control the order of the fault point in 𝐸_𝐴,𝐵 by a suitable choice of the random key 𝑑. On the other hand, some points in 𝐸_𝐴,𝐵 can be chosen as fault point to increase the probability of success of the fault attack.

Our analysis depends on the number of ♯𝐸_𝐴,𝐵(𝔽_𝑝) with 𝐵∈𝔽_𝑝. In Section 3, we research the isomorphism classes of the elliptic curves expressed by form (1.1). By Deuring [5], we find that the density of ♯𝐸_𝐴,𝐵(𝔽_𝑝) with 𝐵∈𝔽_𝑝 in [𝑝+1−2√𝑝,𝑝+1+2√𝑝] is large enough to ensure our method success.

The analysis of our method in this paper shows that the performance of the algorithm is largely determined by the density of numbers built up from small primes in the neighborhood of 𝑝+1 and the number of isomorphism classes of the elliptic curves which can be expressed by form (1.1). If a reasonable conjecture concerning the density of smooth integers is assumed, then the following can be proved.

Suppose that 0≤𝛼≤1 and 𝑐 is a positive constant; let 𝐿_𝑥(𝛼,𝑐) denoteexp𝑐log𝑥^𝛼loglog𝑥^1−𝛼. (1.2) There is a function 𝐾:ℝ_>0→ℝ_>0 with 𝐾(𝑥)=𝐿_𝑥(1/2,1+𝑜(1)) for 𝑥→∞. Then, with a suitable choice of parameters, ECDLP in the family of elliptic curves (1.1) can be determined by the attacker with probability at least 1−𝑒^−ℎ within time 𝐾(𝑝)𝑀(𝑝), where 𝑀(𝑝)=𝑂((log𝑝)¹¹) and ℎ is the number of times Algorithm 2 is applied.

The paper is organized as follows. In Section 2, we describe the scalar multiplication algorithm and elliptic curve discrete logarithm problem and refine the fault attack method. In Section 3, we discuss the isomorphism class of elliptic curves expressed by form (1.1). In Section 4, the efficiency of the attack algorithm is considered.

2. Preliminaries

2.1. Scalar Multiplication Algorithm

Let 𝐸_𝐴,𝐵 be an elliptic curve of form (1.1) defined over finite field 𝔽_𝑝 with 𝑝≠2,3 and 𝑃_𝑖=∶(𝑥_𝑖,𝑦_𝑖)∈𝐸_𝐴,𝐵(𝔽_𝑝), 𝑖=1,2,3, such that 𝑃₁+𝑃₂=𝑃₃. The algorithm below is a description of the elliptic curve scalar multiplication (ECSM) on curves defined in its most common form:𝑥₃=𝜆²−𝐴−𝑥₁−𝑥₂,𝑦₃=−𝑦₁−𝑥₃−𝑥₁𝜆 (2.1) with𝜆=3𝑥²₁+2𝐴𝑥₁2𝑦₁if𝑥₁=𝑥₂,and𝑦₁=𝑦₂,𝑦₁−𝑦₂𝑥₁−𝑥₂,otherwise. (2.2)

The fault attack is based on the fact that the curve coefficient 𝐵 is not used in any of the addition formulas given above.

2.2. Elliptic Curve Discrete Logarithm Problem

Let 𝐸 be an elliptic curve and 𝑃=(𝑥_𝑃,𝑦_𝑃)∈𝐸. Given 𝑄=(𝑥_𝑄,𝑦_𝑄)∈⟨𝑃⟩, the discrete logarithm problem asks for the integer 𝑘 such that 𝑄=𝑘𝑃.

If the order of the base point 𝑃 does not contain at least a large prime factor, then it is possible to use an extension for ECC of the Silver-Pohlig-Hellman algorithm [6] to solve the ECDLP as presented in Algorithm 1. Let 𝑛 be the order of the base point 𝑃 with a prime factor 𝑛=∏^𝑗−1_𝑖=0𝑝^𝑒𝑖_𝑖, where 𝑝_𝑖<𝑝_𝑖+1, 𝑖=0,…,𝑗−2.

Input:  𝑃∈𝐸(𝔽𝑝), 𝑄∈⟨𝑃⟩, 𝑛=∏𝑗−1𝑖=0𝑝𝑒𝑖𝑖, where 𝑝𝑖<𝑝𝑖+1, 𝑖=0,…,𝑗−2. Output:  𝑘mod𝑛.  (1) For 𝑖=0 to 𝑗−1 do      (1.1) 𝑄′←𝒪, 𝑘𝑖←0.      (1.2) 𝑃𝑖←(𝑛/𝑝𝑖)𝑃.      (1.3) For 𝑡=0 to (𝑒𝑖−1) do          (1.3.1) 𝑄𝑡,𝑖←(𝑛/𝑝𝑖𝑡+1)(𝑄+𝑄′).          (1.3.2) 𝑊𝑡,𝑖←log𝑃𝑖𝑄𝑡,𝑖.{ECDLP in a subgroup of order ord(𝑃𝑖).}          (1.3.3) 𝑄′←𝑄′−𝑊𝑡,𝑖𝑝𝑡𝑖𝑃.          (1.3.4) 𝑘𝑖←𝑘𝑖+𝑝𝑡𝑖𝑊𝑡,𝑖.  (2) Use the CRT to solve the system of congruences 𝑘≡𝑘𝑖mod𝑝𝑒𝑖𝑖.      This gives us 𝑘mod𝑛  (3) Return (𝑘)

Algorithm 1 

Silver-Pohlig-Hellman algorithm for solving the ECDLP.

Input:  𝐸𝐴 and 𝑃=(𝑥𝑃,𝑦𝑃)∈𝐸𝐴(𝔽𝑝),𝑄=(𝑥𝑄,𝑦𝑄)=𝑘𝑃, 𝑤 is a parameter to be chosen later and 𝑞 is the order of point 𝑃. Output: Scalar 𝑘 partially with a probability. (1) Randomly choose 𝑥𝑃𝑃,𝑦∈𝔽𝑝.     (1.1) 𝐵←𝑦2𝑃−𝑥3𝑃−𝐴𝑥2𝑃. (2) 𝑃𝑃𝑃←(𝑥,𝑦).     (2.1) Obtain 𝑛=ord(𝑃) in elliptic curve 𝐸𝐴,𝐵(𝔽𝑝).     (2.2) Choose an integer 1<𝑑<ord(𝑃), compute 𝑑𝑃. (3) Apply decryption oracle to compute 𝑥𝑘𝑑𝑃.     (3.1) 𝑦𝑘𝑑𝑃←𝑥3𝑘𝑑𝑃+𝐴𝑥2𝑘𝑑𝑃+𝐵. (4) If all the prime factors of 𝑛 are smaller than 𝑤, then     (4.1) Utilize Algorithm 2 with (𝑑𝑃,𝑘𝑑𝑃,𝑛) to obtain 𝑘mod𝑛. (5) Return (𝑘mod𝑛)

Algorithm 2 

Basic fault attack on ECSM algorithm.

Without losing generality, we assume that the order of the base point 𝑃 is a prime number which is large enough for practical cryptosystems.

2.3. Fault Attack

In this section, we consider the following EC ElGamal cryptosystem. Let 𝐸_𝐴,𝐵 be an elliptic curve of form (1.1) defined over a prime field 𝔽_𝑝. Given a point 𝑃=(𝑥_𝑃,𝑦_𝑃)∈𝐸_𝐴(𝔽_𝑝), we assume that 𝑄=(𝑥_𝑄,𝑦_𝑄)=𝑘𝑃 is the public key and 1≤𝑘<ord(𝑃) the secret key of some user, where ord(𝑃) denotes the order of the base point 𝑃.Encryption: Input message 𝑚, choose 1<𝑑<ord(𝑃) randomly, and return (𝑑𝑃,𝑥_𝑑𝑄⨁𝑚).Decryption: Input (𝐻,𝑚^′), compute 𝑘𝐻, and return (𝑚^′⨁𝑥_𝑘𝐻).

The fault attack is that the attacker randomly chooses an elliptic curve 𝐸_𝐴,𝐵 defined over prime field 𝔽_𝑝, finds a point 𝑃𝑃𝑃=(𝑥,𝑦)∈𝐸_𝐴,𝐵(𝔽_𝑝), and inputs (𝑑𝑃,𝑚^′) to the decryption oracle, then the attacker can get the 𝑥-coordinate of 𝑘𝑑𝑃. Having 𝑥_𝑘𝑑𝑃, we compute 𝑦_𝑘𝑑𝑃 by𝑦_𝑘𝑑𝑃=𝑥³_𝑘𝑑𝑃+𝐴𝑥²_𝑘𝑑𝑃+𝐵. (2.3)

In practice, we can compute 𝐸_𝐴,𝐵 and 𝑃∈𝐸_𝐴,𝐵(𝔽_𝑝) as follows. Fix an element 𝑥𝑃∈𝔽_𝑝, for any 𝑦𝑃∈𝔽_𝑝, and define𝐵=∶𝑦²𝑃−𝑥³𝑃−𝐴𝑥²𝑃. (2.4) Let 𝐸_𝐴,𝐵 be an elliptic curve of form (1.1) as follows:𝑦²=𝑥³+𝐴𝑥²+𝐵, (2.5) clearly 𝑃𝑃𝑃=∶(𝑥,𝑦)∈𝐸_𝐴,𝐵(𝔽_𝑝).

Having the points pair 𝑑𝑃,𝑘𝑑𝑃∈𝐸_𝐴,𝐵(𝔽_𝑝), one can obtain 𝑘mod𝑛, where 𝑛=ord(𝑑𝑃). This would be possible if all the prime factors of ♯𝐸_𝐴,𝐵(𝔽_𝑝) are smaller than order of 𝑃. The complete attack procedure is presented as Algorithm 2.

By repeating Algorithm 2, then applying CRT, we can get 𝑘 from the congruences 𝑘mod𝑛. The following lemma is useful for us to increase the efficiency of Algorithm 2.

Lemma 2.1. Let 𝐸 be an elliptic curve defined over finite filed 𝔽_𝑞. Then, 𝐸𝔽_𝑞≃ℤ_𝑛1×ℤ_𝑛2 (2.6) with 𝑛₁∣𝑛₂ and 𝑛₁∣𝑞−1.

For giving an elliptic curve 𝐸_𝐴,𝐵 defined over finite field 𝔽_𝑝, we assume that 𝐸_𝐴,𝐵(𝔽_𝑞)≃ℤ_𝑛1×ℤ_𝑛2. Then there exists a point 𝑃 such that ord(𝑃)=𝑛₂. The number of such points is 𝑛₁𝜙(𝑛₂), where 𝜙(⋅) is the Euler function. Let 𝑛₂=𝑛_2𝑤𝑛^′₂, where 𝑛_2𝑤 is the product of all the prime factors of 𝑛₂ which are smaller than 𝑤. If, in Step (2.2), we choose 𝑑 satisfying 𝑛^′₂∣𝑑 and (𝑑,𝑛_2𝑤)=1, then the order of 𝑑𝑃 is a 𝑤 smooth integer.

Certainly, of course, we can choose a point 𝑃 in 𝐸_𝐴,𝐵(𝔽_𝑝). The procedure of choosing such a point is similar as above.

3. The Isomorphism Classes

In this section, we count the number of isomorphism classes over 𝔽_𝑝 of elliptic curves (1.1) defined over a prime field 𝔽_𝑝.

It is easy to see that the discriminant Δ and the 𝑗 invariant of the formula (1.1) are equal to −16((4/27)𝐴⁴(1−𝐴²)+4𝐴²𝐵+27𝐵²) and −(4³𝐴⁶)/Δ, respectively. Hence, the number of elliptic curves over the prime field 𝔽_𝑝 with 𝐴 fixed is the number of 𝐵∈𝔽_𝑝 with4𝐴27⁴1−𝐴²+4𝐴²𝐵+27𝐵²≠0. (3.1) Let 𝑇 be the number of the solutions of the following equation in 𝔽_𝑝:27𝑥²+4𝐴²4𝑥+𝐴27⁴1−𝐴²=0. (3.2) It is easy to see that 𝑇≤2. Hence, we conclude that the number of elliptic curves over 𝔽_𝑝 with 𝐵 fixed is equal to 𝑝−𝑇.

𝐸_𝐴,𝐵 is isomorphic to 𝐸_𝐴,𝐵 if and only if there exists an admissible transform:𝑥=𝑢²𝑥+𝑟,𝑦=𝑢³𝑦+𝑢²𝑠𝑥+𝑡, (3.3) where 𝑟,𝑠,𝑡∈𝔽_𝑝 and 𝑢∈𝔽^∗_𝑝. Therefore, 𝐸_𝐴,𝐵≅𝐸_𝐴,𝐵 if and only if there exist 𝑢∈𝔽^∗_𝑝,𝑟∈𝔽_𝑝 such that the following conditions hold:(i)𝑢⁶=1 and 𝐴=𝐴𝑢⁴+3𝑢⁴𝑟;(ii)3𝑢²𝑟²+2𝑢²𝑟𝐴=0 and 𝐴𝑟²+𝑟³+𝐵=𝐵.

Given 𝐴,𝐵,𝐵, let 𝑇^′ denote the number of the solutions (𝑢,𝑟) of (i) and (ii); it is easy to see that 𝑇^′≤6. For any 𝑝≠2,3, the number of the automorphism of elliptic curve 𝐸_𝐴,𝐵 is at most 3. Hence, we have^𝐸_𝐴,𝐵^′1♯Aut𝐸_𝐴,𝐵≥𝑝−𝑇6, (3.4) where ∑^′_𝐸𝐴,𝐵is over a set of representatives of the isomorphism classes. We express this by writing♯^′𝐸_𝐴,𝐵∶𝐸_𝐴,𝐵ellipticcurveofform(1.1)with𝐵∈𝔽_𝑝≅_𝔽𝑝, (3.5) and in similar expression below, ♯^′ denotes the weighted cardinality, the isomorphism class of 𝐸_𝐴,𝐵 being counted with the weight 1/(♯Aut(𝐸_𝐴,𝐵)).

For any elliptic curve 𝐸 over 𝔽_𝑝, we have♯𝐸𝔽_𝑝=𝑝+1−𝑡,with𝑡∈ℤ,|𝑡|≤2√𝑝, (3.6) which is obtained by a theorem of Hasse. Let, conversely, 𝑝 be a prime >3 and let 𝑡 be an integer satisfying |𝑡|≤2√𝑝. Then, the weighted number of elliptic curves 𝐸 over 𝔽_𝑝 with ♯𝐸(𝔽_𝑝)=𝑝+1−𝑡, up to isomorphism is given by a formula that is basically due to Deuring [5]; see also [7–9]:♯^′𝐸∶𝐸ellipticcurveover𝔽_𝑝,♯𝐸𝔽_𝑝=𝑝+1−𝑡≅_𝔽𝑝=𝐻𝑡²−4𝑝, (3.7) where 𝐻(𝑡²−4𝑝) denotes the Kronecker class number of 𝑡²−4𝑝.

For the Kronecker class number, the following result is useful.

Lemma 3.1 (see [10]). There exist effectively computable positive constants 𝑐₁,𝑐₂ such that for each 𝑧∈ℤ_>1 there is Δ^∗=Δ^∗(𝑧)<−4 such that 𝑐₁√−Δ(Δ)log𝑧≤𝐻≤𝑐₂√−Δlog|Δ|loglog|Δ| (3.8) for all Δ∈ℤ with −𝑧≤Δ<0,Δ≡0,or1mod4, except that the left inequality may be invalid if Δ₀=Δ^∗, where Δ₀ is the fundamental discriminant associated with Δ.

Let♯^′𝐸_𝐴,𝐵∶𝐵∈𝔽_𝑝,♯𝐸_𝐴,𝐵𝔽_𝑝=𝑝+1−𝑡≅_𝔽𝑝=∶𝐻_𝑡. (3.9)

In order to apply Algorithm 2, we divide 𝔽_𝑝 into two parts 𝑆^𝑝_𝑄𝑅 and 𝑆^𝑝_𝑁𝑄𝑅 as follows:𝑆^𝑝_𝑄𝑅=𝐵∶𝐵∈𝔽_𝑝,and𝑥³𝑃+𝐴𝑥²𝑃+𝐵isaquadraticresiduein𝔽_𝑝,𝑆^𝑝_𝑄𝑁𝑅=𝐵∶𝐵∈𝔽_𝑝,and𝑥³𝑃+𝐴𝑥²𝑃+𝐵isaquadraticnonresiduein𝔽_𝑝. (3.10) Since 𝐻_𝑡≤𝐻(𝑡²−4𝑝), Lemma 2.1 cannot be applied directly in the following estimation. In order to apply Lemma 2.1, 𝑆^𝑝_𝑄𝑅 should be partitioned into two parts 𝑆^𝑝_𝑄𝑅1 and 𝑆^𝑝_𝑄𝑅2 as follows:𝑆^𝑝_𝑄𝑅1=𝐵∶𝐵∈𝑆^𝑝_𝑄𝑅,♯𝐸_𝐴,𝐵𝔽_𝑝=𝑝+1−𝑡,with𝐻_𝑡≥√𝑝,𝑆log𝑝_{𝑝𝑄𝑅2}=𝐵∶𝐵∈𝑆^𝑝_𝑄𝑅,♯𝐸_𝐴,𝐵𝔽_𝑝=𝑝+1−𝑡,with𝐻_𝑡<√𝑝.log𝑝 (3.11)

Let𝑇^𝑝_𝑄𝑅1=𝑠∶𝑠∈ℤ,andthereexists𝐵∈𝑆^𝑝_𝑄𝑅1suchthat𝑠=♯𝐸_𝐴,𝐵𝔽_𝑝. (3.12)

Theorem 3.2. There exist an effectively computable positive constant 𝑐₃ such that, for each prime number 𝑝>3, the following assertion is valid. If 𝑆 is a set of integers 𝑠∈𝑇^𝑝_𝑄𝑅1 with 𝑠−𝑝+1≤√𝑝, (3.13) then ♯𝐸_𝐴,𝐵∶𝐵∈𝑆^𝑝_𝑄𝑅1,♯𝐸_𝐴,𝐵𝔽_𝑝∈𝑆≅_𝔽𝑝≥𝑐₃()√♯𝑆−2𝑝log𝑝. (3.14)

Proof. The proof of Theorem 3.3 is similar to the proof of (1.9) in [10]; for self-containdeness, we give it here. The left-hand side of the inequality equals _{𝑡∈ℤ,𝑝+1−𝑡∈𝑆}𝐻_𝑡. (3.15) Applying Lemma 3.1 with 𝑧=4𝑝, we note that |𝑡²−4𝑝|≥3𝑝 if 𝑝+1−𝑡∈𝑆. Since 𝑆⊆𝑇^𝑝_𝑄𝑅1, it suffices to prove that there are at most two integers 𝑡, |𝑡|≤√𝑝, for which the fundamental discriminant associated with 𝑡²−4𝑝 equals Δ^∗. Let 𝐿=√Δ^∗, and let 𝑡 be such an integer. Then, the zeros 𝛼,𝛼 of 𝑋²−𝑡𝑋+𝑝 (3.16) belong to the ring of integers 𝒪_𝐿 of 𝐿. Also, 𝛼𝛼=𝑝, and by the unique prime ideal factorization in 𝒪_𝐿 and the fact that 𝐴^∗={1,−1} (because Δ^∗<−4) this determines 𝛼 up to conjugation and sign. Hence, 𝑡=𝛼+𝛼 is determined up to sign, as required. This completes the proof.

Theorem 3.3. There is a positive effectively computable constant 𝑐₄ such that, for each prime number 𝑝>3, the following assertion is valid. Let 𝑆 be a set of integers 𝑠∈𝑇^𝑝_𝑄𝑅1 with 𝑠−𝑝+1≤√𝑝, (3.17) and let 𝑦𝑃 be defined as above. Then, the number 𝑁 of pair (𝑃𝐵,𝑥)∈𝔽²_𝑝 for which 4𝐴²+27𝐵≠0,♯𝐸_𝐴,𝐵𝔽_𝑝∈𝑆, (3.18) where 𝑥³𝑃+𝐴𝑥²𝑃+𝐵=𝑦²𝑃, is at least 𝑐₄(♯𝑆−2)(√𝑝³/log𝑝).

Proof. The number to be estimated equals the number of pairs (𝑃𝐵,𝑦)∈𝔽²_𝑝 for which 𝐸_𝐴,𝐵 is an elliptic curve over 𝔽_𝑝 with 𝑃𝑃(𝑥,𝑦)∈𝐸_𝐴,𝐵(𝔽_𝑝) and ♯𝐸_𝐴,𝐵(𝔽_𝑝)∈𝑆. Each elliptic curve 𝐸_𝐴 over 𝔽_𝑝 is isomorphic to 𝐸_𝐴,𝐵 for exactly 𝑇^′/♯Aut𝐸, value of 𝐴∈𝔽_𝑝. Each 𝐸_𝐴,𝐵 exactly gives rise to two points 𝑃𝑃(𝑥,𝑦). Thus, the number to be estimated equals ^𝐸𝐴,𝐵^′2𝑇^′♯Aut𝐸_𝐴,𝐵, (3.19) where the sum ranges over the elliptic curves 𝐸_𝐴,𝐵 over 𝔽_𝑝, up to isomorphism, for which ♯𝐸_𝐴,𝐵(𝔽_𝑝)∈𝑆. Applying Theorem 3.2, we obtain the result.

Theorem 3.4. There exists a positive effectively computable constant 𝑐₅ such that, for each prime number 𝑝>3, the following assertion is valid. Let 𝑆_𝑤=𝑠∈𝑇^𝑝_𝑄𝑅1∶𝑠−𝑝+1<√𝑝,andeachprimedividing𝑠is≤𝑤, (3.20) and let 𝑦𝑃 be defined as above. Then, the number 𝑁 of triple (𝑃𝐵,𝑥)∈𝔽²_𝑝 for which 4𝐴²+27𝐵≠0,♯𝐸_𝐴,𝐵𝔽_𝑝∈𝑆_𝑤, (3.21) where 𝑥³𝑃+𝐴𝑥²𝑃+𝐵=𝑦²𝑃, is at least 𝑐₅(♯𝑆_𝑤−2√𝑝³/log𝑝).

Proof. This can be deduced from Theorem 3.3 immediately.

Theorem 3.5. There exists a positive effectively computable constant 𝑐₆ such that the cardinality of 𝑇^𝑝_𝑄𝑅1 is at least 𝑐₆√𝑝/(log𝑝(loglog𝑝)).

Proof. The map 𝜙∶𝔽_𝑝⟼𝔽_𝑝𝐵⟼𝑥³𝑃+𝐴𝑥²𝑃+𝐵 (3.22) is a bijective map. By the definition of 𝑆^𝑝_𝑄𝑅 and 𝑆^𝑝_𝑄𝑁𝑅, we have ♯𝑆^𝑝_𝑄𝑅=♯𝑆^𝑝_𝑄𝑁𝑅=(𝑝−1)/2. By (3.6), the trace 𝑡 of any elliptic curve 𝐸 over 𝔽_𝑝 satisfies |𝑡|≤2√𝑝; hence, the cardinality of 𝑆^𝑝_𝑄𝑅2 is at most 2√𝑝√𝑝𝑝log𝑝≤2log𝑝. (3.23) Therefore, the cardinality of 𝑆^𝑝_𝑄𝑅1 is 𝑆^𝑝_𝑄𝑅−𝑆^𝑝_𝑄𝑅2𝑝≥𝑝−2log𝑝. (3.24) From the discussion about the isomorphism classes of elliptic curves and the fact that 𝐻_𝑡≤𝐻(𝑡²−4𝑝), we have ♯𝑇^𝑝_𝑄𝑅1≥♯𝑆^𝑝_𝑄𝑅1−𝑇𝐻(Δ). (3.25) Applying Lemma 2.1, we get the proof of the result.
Let 𝑇₁=𝑇^𝑝_𝑄𝑅1⋂(𝑝+1−√𝑝,𝑝+1+√𝑝). Our attack method depends on the following reasonable heuristic assumption.Heuristic Assumption: The set 𝑇^𝑝_𝑄𝑅1 is uniformly distributed in the interval (𝑝+1−2√𝑝,𝑝+1+2√𝑝).
By the assumption, one can deduce that ♯𝑇^𝑝_𝑄𝑅1≈2♯𝑇₁.

Theorem 3.6. There exists an effectively computable constant 𝑐₇>1 with the following property. Let 𝑤∈ℤ_>1 and ♯𝑆_𝑤=𝑠∈𝑇^𝑝_𝑄𝑅1∶𝑠−𝑝+1<√𝑝,andeachprimedividing𝑠is≤𝑤. (3.26) Let 𝑓(𝑤)=♯𝑆_𝑤/♯𝑇₁ denotes the probability that a random integer in the interval (𝑝+1−√𝑝,𝑝+1+√𝑝) has all its prime factors <𝑤. The probability of success of Algorithm 2 on input 𝑃,𝑄∈𝐸_𝐴,𝐵,𝑤 is at least 1−𝑐^{−ℎ𝑓(𝑤)/(log𝑝)2(loglog}₇^𝑝), where ℎ is the number of times that Algorithm 2 is applied.

Proof. By Theorem 3.5, the failure probability of repeating Algorithm 2  ℎ times equals (1−𝑁/𝑝²)^ℎ, where 𝑁𝑝²≥𝑐₅♯𝑆_𝑤−2♯𝑇₁♯𝑇₁√𝑝log𝑝≥𝑐₅𝑓(𝑤)♯𝑇₁√𝑝log𝑝≥𝑐₅𝑐₆𝑓(𝑤)log𝑝²loglog𝑝. (3.27) It follows that 𝑁1−𝑝^2ℎ≤𝑒^{−𝑐5𝑐6ℎ(𝑓(𝑤)/((log𝑝)2(loglog𝑝)))}. (3.28) Consequently, the desired result follows.

4. Efficiency

In the case of factoring, the best rigorously analyzed result is Corollary 1.2 of [11], which states that all prime factors of 𝑛 that are less than 𝑤 can be found in time 𝐿_𝑤(2/3,𝑐)log²𝑛. Schoof [12] presents a deterministic algorithm to compute the number of 𝔽_𝑝-points of an elliptic curve that is defined over a finite field 𝔽_𝑝 and takes 𝑂(log⁹𝑝) elementary operations.

Theorem 3.6 shows that, in order to have a reasonable chance of success, one should choose the number ℎ of the same order of magnitude as 𝑂((log𝑝)²(loglog𝑝)/𝑓(𝑤)). In Algorithm 2, for any 𝑦𝑃, we can obtain 𝐵∈𝑆^𝑝_𝑄𝑅. From the discussion in Theorem 3.6, the probability of 𝐵∈𝑆^𝑝_𝑄𝑅2 is approximately 1/log𝑝. Hence, the cases of 𝐵∈𝑆^𝑝_𝑄𝑅2 are neglected, which does not affect the analysis result. Therefore, the time spent on Algorithm 2 is 𝑂(ℎ𝐿_𝑤(2/3,𝑐)𝑀(𝑝)), where 𝑀(𝑝)=𝑂(log¹¹𝑝). The time required by Algorithm 2 is √𝑤. Hence, to minimize the estimated running time, the number 𝑤 should be chosen such that 𝐿_𝑤(2/3,𝑐)/𝑓(𝑤)+√𝑤 is minimal.

A theorem of Canfield et al. [13] implies the following result. Let 𝛼 be a positive real number. Then, the probability that a random positive integer 𝑠<𝑥 has all its prime factors less than 𝐿_𝑥(1/2,1)^𝛼 is 𝐿_𝑥(1/2,1)^{−1/2𝛼+𝑜(1)} for 𝑥→∞. The conjecture we need is that the same result is valid if 𝑠 is a random integer in the interval (𝑥+1−√𝑥,𝑥+1+√𝑥). Putting 𝑥=𝑝, we see that the conjecture implies that𝑓𝐿_𝑝12,1^𝛼=𝐿_𝑝12,1^{−1/2𝛼+𝑜(1)}for𝑝⟶∞, (4.1) for any fixed positive 𝛼, with 𝑓(𝑤)=♯𝑆_𝑤/♯𝑇₁.

The following identities are useful for our estimation:𝐿_𝑝𝛼,𝑐_𝛼𝐿_𝑝𝛽,𝑐_𝛽=𝐿_𝑝max𝛼,𝛽,𝑐_{max{𝛼,𝛽}},𝐿_{𝐿𝑝(𝛼,𝑐𝛼)}𝛽,𝑐_𝛽=𝐿_𝑝𝛼𝛽,𝑐_𝛽𝑐^𝛽_𝛼, (4.2) where lower-order terms in the exponent are neglected.

With 𝑤=𝐿_𝑝(1/2,1)^𝛼, the conjecture would imply that𝐿_𝑤(2/3,𝑐)𝑓(𝑤)+√𝑤=𝐿_𝑝12,1^{1/2𝛼+𝑜(1)}+𝐿_𝑝12,1^𝛼/2,for𝑝⟶∞, (4.3) which suggests that for the optimal choice of 𝑤 we have𝑤=𝐿_𝑝12,𝐿,1^𝑤(2/3,𝑐)𝑓(𝑤)=𝐿_𝑝12,1^1+𝑜(1),for𝑝⟶∞. (4.4)

These arguments lead to the following conjectural running time estimation for solving the discrete logarithm problem on elliptic curve of form (1.1) over prime field.

Theorem 4.1. There is a function 𝐾∶ℝ_>0→ℝ_>0 with 𝐾(𝑥)=𝐿_𝑥12,1+𝑜(1)for𝑥⟶∞ (4.5) such that the following assertion is true. Let 𝑝 be a prime number that is not 2 or 3. Then, we can find the discrete logarithm of Montgomery elliptic curve over prime filed 𝔽_𝑝 within time 𝑂(𝐾(𝑝)𝑀(𝑝)).

Acknowledgments

One of the authors gratefully acknowledges the helpful comments and suggestions of the anonymous reviewers, which have improved the presentation. This work was supported by NSFC project under (Grant no. 60873041), Nature Science of Shandong Province (Grant no. Y2008G23), Doctoral Fund of Ministry of Education of China (Grant no. 20090131120012), and IIFSDU (Grant no. 2010ST075).