Efficient Electronic Payment Systems by Using a Sparse Elliptic Curve Cryptography

Transcription

1 International Journal of Computing & Information Science Vol., No., Augut Efficient Electronic Payment Sytem by Uing a Spare Elliptic Curve Cryptography Eam Al-Daoud, Khalid Al-Tahat and Hamed Al-Fawareh Page 9-97 Efficient Electronic Payment Sytem by Uing a Spare Elliptic Curve Cryptography Eam Al-Daoud, Khalid Al-Tahat, Hamed Al-Fawareh Faculty of Science, Computer Science Department, Zarka Private Univerity, Jordan. Abtract: Thi paper introduce new technique lgorithm to reduce the ize of the elliptic curve parameter. The baic idea i to ue pare coefficient and pare bae point. The pare element are introduced with a compact repreentation, thu the public key parameter are reduced about 7-49 percent. The elliptic curve application uch a e-payment and e-commerce can be implemented with better performance uing the uggeted approach. Keyword: Elliptic Curve Cryptography, Projective Coordinate, Spare Element, Electronic Payment. Received: March 1, 004 Revied: January 1, 005 Accepted: February 1, Introduction The main advantage of uing the finite group of elliptic curve (EC) i that it dicrete logarithm problem i believed to be harder than the dicrete logarithm problem for the multiplication group of a finite field. There i no known ub-exponential algorithm that can be applied to the elliptic curve dicrete logarithm problem. Another advantage that make elliptic curve more attractive i the poibility of optimizing the arithmetic operation in the underlying field [9]. Thi ha led to appearance of everal elliptic curve cryptography product uch a Security Builder, SSL Plu, WTLS Plu, TrutPoint etc. In addition many companie have purchaed licene to ue EC code and embed them in their product [14, 18, 11]. By uing elliptic curve cryptoytem ECC we can ue maller key ize with the ame level of cryptographic ecurity for DSA or RSA, whereby we will get maller public key certificate, fater implementation, lower power requirement and maller hardware proceor [19, ]. Subequently ECC can be applied to many ytem pplication [, 1] Elliptic curve cryptography application and protocol rely on the elliptic curve group operation uch a adding, doubling and calar multiplication, which will not be feaible unle a uitable elliptic curve finite group and efficient underlying finite field operation are ued. Thu any enhancement in the underlying finite field operation will peed up all the EC application [4, 6]. Our approach to enhance the operation i the high utilization of the pare element in GF ( n ). Several new algorithm are introduced uch a electing random pare element algorithm, finding pare bae point, compreing and decompreing the pare element. Thi new approach doe not reduce the ecurity to the fact that the elliptic curve over GF ( n ) with pare coefficient are iomorphic to the curve which have coefficient elected randomly. Furthermore, although the bae point are retricted to be pare; the number of pare bae point i till very huge and provide the uer with rich choice. The experiment how that the reult of thi improvement varie from one protocol to another baed on the rate of uing the bae point, the number of tranited bit, the key ize and the ratio of doubling to adding. The remainder of thi paper i organized a follow. Section preent the mot efficient elliptic curve projective coordinate formula. In Section we introduce the algorithm to elect and to compre the pare element. Moreover we dicu the abundance of the pare point. Section 4 dicue the electronic payment model. Finally in Section 5 we how the improvement in the pare elliptic curve electronic payment model.. EC Projective Coordinate Operation In order to find the um of two ditinct point on the elliptic curve E over (GF ( n )) by uing affine coordinate, one invere and one multiplication are needed, but to double a point one invere and two multiplication are required. Since the implementation of elliptic curve operation indicate that the invere operation i till more expenive than a field multiplication, where Hankeron and other how that the cot ratio of the inverion to the multiplication over polynomial bai i 1-10 [1, 1, 15]. Thu, the projective coordinate X, Y and Z on the curve y + xy = x + a x + a 6 over GF ( n ) are ued to

2 9 International Journal of Computing & Information Science Vol., No., Augut 004 replace the invere operation by multiplication uch that [16]: Formula 1: (X 1, Y 1, 1) + (X, Y, Z ) = (X, Y, Z ), Where X1 X U = Z +, Y1 Y S = Z +, = Z S, T Z = T, V = Z X 1, X = U + T ( U + S + Ta), Y = ( V + X )( TU + Z + Z C. ) Formula 1 need 9 field multiplication and 8 temporary variable are required. López and Dahab introduce a new doubling formula which require 5 field multiplication a follow [17, 5, 0 ]: where Formula : (X 1,Y 1,Z 1 ) =(X,Y,Z ) Z1 X1 4 4 X = X1 + a6z1, Z1 Z =, 4 4 Y = a Z Z + X ( a Z + Y + a ).. Spare Element Thi ection introduce algorithm to elect random curve have pare coefficient and pare bae point. The complexity analyi for the uggeted algorithm indicate that the time to generate pare element and bae point i relatively ignored. Moreover, the reduction of the pare element length i clarified..1. Select Random Spare Coefficient The firt tep to find a uitable elliptic curve i to elect random coefficient (a 6 ) and the election i repeated until a propective curve i found. However, there i no ecurity threat if the coefficient are retricted to be pare in GF(q ). Moreover the number of generated curve i till very huge. Algorithm 1 i uggeted to generate random curve with pare coefficient. Algorithm 1 : Generate random pare coefficient in GF( q ) Input : The finite field GF( n ), ( the maximum number of one ). Output : The pare element a 6 in GF( q ). 1- j 0 - For i =1 to rand ( )..1 - v rand ( n ).. - If x v = 1 Then i i -1 (x v i the v th bit in the element x ) Ele x v = 1. - if j=0 then a x, j 1,x 0 and goto tep Ele a 6 x 4- Return a 6... The Upper Bound of Spare Bae Point Thi ubection how that even if the bae point i retricted to be pare, the number of generated point i till very huge. Definition. Let G be a point on E(GF ( n )) repreented in the binary expand. Then the point G i pare if and only if the firt coordinate ha a few one uch that the number of one i le than 5 percent from the field ize. Moreover the point G i called pare with one if the maximum number of the one in the firt coordinate i. Theorem. Let E be any elliptic curve over GF ( n ); then the upper bound of the pare point with one on E i t 1 ( n i ) / t! Proof: Let x be any element in GF (q) and ha t one, then x can be repreented in n n! t = t!( n t)! t 1 = ( n i) / t! i= 0 different way. If the maximum number of the one in the x coordinate i, then x can be repreented in t 1 ( n i ) / t! different way. Since the quadratic equation ha two olution when x i in GF(q), then the upper bound for the number of pare point with one on E i t 1 ( n i ) / t!. The order of the elected elliptic curve mut be prime or nearly prime (the curve E j ha a nearly prime order if #E j = r j p j for mall integer r j and large prime number p j, where j i an integer ), then the approximately average number (if the tet i run over many curve E j ) of pare bae point with one i : t 1 ( n i ) / d ( t!).

3 Efficient Electronic Payment Sytem by Uing a Spare Elliptic Curve Cryptography 94 where d i the average of r j. Thu, thi number i large enough to give the uer rich choice, for example if n =160 and = 7 then the number of pare bae point are nearly However there i no ecurity threat known in cae if many uer chooe the ame bae point... Selecting a Spare Bae Point Algorithm i uggeted to find a random pare bae point P, with one for any nearly prime elliptic curve over GF ( n ), where P ha a large prime order. Algorithm : Chooing Random pare bae point with one. Input: an elliptic curve E over GF (q), the curve order rk, and the maximum number of one. Output: a pare bae point with one. 1- For i =1 to rand ( ). - v rand (n ). - If x v = 1 Then i i -1 (x v i the v th bit in the element x ) Ele x v = End For 5- Find the coordinate y, if y doe not exit go to tep 1 ele et y to one olution. 6- G (x,y) 7- P k G 8- If P = O then go to Step Q r G 10- If Q O then output wrong order and top 11- Output G. The complexity of the previou algorithm i equal to the complexity of tandard algorithm to generate random bae point..4. Compact Spare Element Repreentation To utilize the pare field element in the real communication and implementation; Algorithm and 4 are introduced to compre and decompre any pare element with one in relatively ignored time. Algorithm : Compreion of any pare element in GF( n ), where n 56 Input : Spare element x Output : Compreed repreentation array C 1- m 1 - For i =1 to n.1 - If x i 1 then continue. - C m = i. - m m Return C. Algorithm 4: Decompreion of compact repreentation Input : Compreed repreentation array C with length. Output : Spare element x 1- For i =1 to 1.1- t C m 1.- x t 1 - Return x Since the dicrete problem for elliptic curve with field ize le than 56 i ufficient for the current application t leat for next few year; dicuion will be retricted to thi field ize, but it can be extended eaily to any other field ize. Thu each element in the array C (which form the location of non zero bit in a pare element ) can be repreented in 8 bit, o the ize of the array C i (8). Table 1 how the reduction rate of the pare element. Table 1. The reduction rate of the pare element Field Size Conventional Compact reduction Rate ( n) To generate the elliptic curve public key and private key we have to ue the following tep: 1- Select a uitable elliptic curve E defined over GF(q). - Select a bae point P E(GF(q) ) of order l, where l i the elliptic curve order. - Select an integer t in the interval [1, l - 1]. 4- Compute the point Q = t P. Thu, the EC public key i ( a, a 6, P, l, Q ) and the private key i t (in the EC public key we need another two bit to recontruct EC y coordinate from x coordinate).. If a, a 6 and the firt coordinate of the bae point P are pare, then by uing the uggeted approach lgorithm; the number of pubic key bit will be reduced from (5n +) for the tandard etting to (4 + n + ). Table how the percentage of the bit reduction in the EC public key. Table. The reduction rate of the bit by uing the new approach Field ize n PK Standard PK Compact Reduction rate

4 95 International Journal of Computing & Information Science Vol., No., Augut Electronic Payment Model Electronic tranaction ue the cryptography for many purpoe uch a protect the tranaction againt attack on the network, enure the ecurity without prior arrangement between cutomer and vendor, guarantee the tranaction integrity, authenticate the cutomer, uthenticate the vendor. The developer of electronic payment model aume that the bank have full Internet connection to provide general banking ervice, opening account, iuing check, inurance etc. Currently few bank upport general banking ervice a SFNB in US ( and BankNet in UK. Figure (1) how the bank with full Internet connection [] Off Line Electronic Payment Model In thi model the payee accumulate the digital money, and then depoit it in hi account when the network traffic i low. The eential component of thi model are [10]: a) Public Key : The certificate are ued to prove the relation between the uer name and hi public key. In figure () there are two certificate. The firt certificate to prove the identity of the ervice provider (or in general the payee), it mut be igned by a truted certificate authority. The econd certificate i to prove that the bank ha iued the uer public key. Therefore the bank mut ign thi certificate. The minimum content of the certificate are the iuer name, ubject name, the validity, the public key and the certificate authority ignature. b) Smart card: Smart card or tamper- reitant ha been iued to the uer by the bank. Three purpoe of the tamper- reitant device: the firt i to keep track of the uer balance, hence the balance counter will be increaed if the uer withdraw electronically form the bank, and it will be decreaed if the uer pay to the ervice provider. The econd i to validate the bank ignature on amount of the money, before the balance counter i updated. The third i to ign any amount of money which will be paid to a payee. The ecret key are known jut to the bank and the public key are incorporated into the card. c) : The minimum content of the digital money are the amount of the money, the identity of the payee, the erial number and the ignature on thee information. Additional technique mut be ued to prevent the double pend and to enure the privacy of the payment, thee technique a the erial number and blind protocol. Bank A Cutomer Figure 1. Clearing ytem with full Internet connection. Uer Smart Card Figure. An off- line electronic payment model. Digital Cheque Uer Bank Bank Clearing Sytem Vendor Notification Bank B Figure. An on - line electronic payment model 4.. On Line Electronic Payment Model Service Provider Service Provider Several On Line electronic payment model have been uggeted [1]. The eential component for thee model are: a) Digital Cheque: The content of the digital Cheque like the digital money. The main different i that the amount of money will be reduced from the iuer account. b) Public Key : Two certificate are ued in Figure (); the firt i to recognize the ervice provider and the econd i to identify the uer entitie. c) Secure Socket Layer (SSL): SSL can be incorporated into thi mode to exchange the data eaily. SSL wa originally developed by Netcape to ecure the Internet tranaction. Three protocol are

5 Efficient Electronic Payment Sytem by Uing a Spare Elliptic Curve Cryptography 96 ued in SSL: the record protocol, the handhake protocol and the alert protocol [7]. 5. Electronic Payment Model Analyi In order to meaure the efficiency of the electronic payment model; we will dicu four factor. The factor are: The Databae Storage, the tranited data, the number of verifying the information and the ignature. Table () and (4) ummarize thee factor. Table. An off-line electronic payment model analyi. The Additional Databae Storage The Bank The Uer The Service Provider SK and PK (for each uer ) None The Sent Data The Received Data and two The Signature 1 (low 1 None frequence ) The Verifying 1 (for each cutomer). Table 4. An on -line electronic payment model analyi The Additional Databae Storage The Bank The Uer The Service Provider None None None The Sent Data Notification Digital Cheque The Received Data Digital Cheque A The Signature None 1 None The Verifying (high frequence ) 1 None A Notification To compare the ize of the model object conider the following: 1- The EC field ize i 56, which equivalent to 160 RSA key ize [8]. - The iuer name, ubject name, the validity, the amount of the money, the identity of the payee and the erial number can be repreented in 80 bit for each. - Thi model ue the minimum requirement content for the digital money and the certificate. 4- The digital ignature i part from the digital money, digital cheque and the certificate Table 5. Comparion of the object ize by different approache Digital Money RSA EC The new approach, = 6 80* *+56= 80*+56= 496 = * * * = =47 56= 1776 Secret Key Public Key From Table (5) we deduce that: the new approach i the bet for minimizing the object ize, which will lead to enhance the performance for all partie. For example in the off-line model; the total ent data from the ervice provide i reduced to 1.1 percent of the data ent by uing RSA and 7.6 percent of the data ent by uing tandard Elliptic curve. In the on-line model the total ent data from the ervice provide are reduced to. percent of the data ent by uing RSA and 64.9 percent of the data ent by uing the tandard Elliptic curve. In the ame way; the redaction can be hown for other factor ll partie. By uing the new approach the verifying and the igning time will be reduced for all partie. The offline model i better for bank performance, while the on-line model i better for the ervice provider performance. 6. Concluion To atify efficient computation and communication, everal algorithm are introduced uch a electing random pare element algorithm, finding pare bae point, compreing and decompreing the pare element. The new approache lgorithm lead to reduce in the public key parameter by 7-49 percent and did not acrifice in the elliptic curve cryptography ecurity. Therefore, the elliptic curve application uch a e-payment and e-commerce can be implemented with better performance uing the uggeted approach. 7. Reference [1] Al-Daoud, E. and Ramlan, M., Elliptic Curve Arithmetic Operation Over GF( n ) and GF(P) For Cryptoytem Purpoe, International Conference on Mathematic and it Application in the New Millennium, pp81-88, 000. [] Al-Daoud, E., and Ramlan, M., A New Addition Formula For Elliptic Curve Over GF( n ), IEEE Tranaction on Computer. Volume 51, Number 8, Augut 00, pp , 001. [] Bellare, M., et al., Variety Cah: a Multi- Purpoe Electronic Payment Sytem, In Proc. rd Uenix Workhop on Electronic Commerce, Boton, 1998.

6 97 International Journal of Computing & Information Science Vol., No., Augut 004 [4] Blake, I. F., Seroui G. and N. P. Smart., Elliptic Curve in Cryptography, Univerity Pre, London, Cambridge, [5] Brand, S., Electronic Cah on the Internet, Proceeding of the Internet Society 1995 Sympoium on Network and Ditributed Sytem Security, San Diego, California, February, 16-17, [6] Certicom, Acceed on 5 march 00. [7] Gupta, V. S. et al., Performance analyi of elliptic curve cryptography for Sl, In ACM Workhop on Wirele Security, Atlanta, Georgia. 00. [8] Gura, N. et al., Generic implementation of elliptic curve cryptography uing partial reduction, In 9th ACM Conference on Computer and Communication Security, Wahington, DC,00. [9] Gura, N. H. et al., An end-to-end ytem approach to elliptic curve cryptography, In CHES '00 Workhop on Cryptographic Hardware and Embedded Sytem, Lecture Note in Computer Science. Springer-Verlag, Redwood City, California. 00. [10] Ha., J. S. et al., Compact implementation of Elliptic Curve Cryptography Sytem uing a FPGA, The 9 th Korean conference on Semiconductor, Feb.,1-, pp [11] Hankeron, D., et al., Software Implementation of Elliptic Curve Cryptography over Binary Field, CHES' 000 LNCS No. 1965, pag [1] IEEE P16 Draft, Standard Specification for Public Key Cryptography, [1] King, B., An Improved Implementation of Elliptic Curve over GF() when Uing Projective Point Arithmetic, Selected Area in Cryptography, , 001. [14] López, J. and Dahab, R., High-Speed Software Multiplication in GF( m ), IC Technical Report, IC-00-09, Intitute of Computing, Univerity of Campina, 000. [15] López, J. and Dahab, R., Improved Algorithm for Elliptic Curve Arithmetic in GF( n ), Selected Area in Cryptography, 5 th Annual Int. Workhop, pp [16] Paar, C., Implementation option for finite field arithmetic for elliptic curve cryptoytem, Invited preentation at the rd Workhop on Elliptic Curve Cryptography (ECC '99). Univerity of Waterloo, Waterloo, Ontario, Canada, pp [17] Pederen, T. P., Electronic Payment of Small Amount, Security Protocol Workhop 59-68, [18] Robert D. Silverman, A., Cot-Baed Security Analyi of Symmetric and Aymmetric Key Length, RSA Laboratorie, [19] Roing, M., Implementing Elliptic Curve Cryptography, Manning, Greenwich [0] Smith, R. E., Internet Cryptography, Addion Weley, Harlow, England [1] Sklavo, N. and Koufopavlou, O., Mobile Communication World: Security Implementation Apect - A State of the Art, Computer Science Journal of Moldova, Intitute of Mathematic and Computer Science, Vol. 1, Number. 00. [] Weimerkirch, A., et al., Elliptic Curve Cryptography on a Palm OS Device, The 6th Autralaian Conference on Information Security and Privacy (ACISP 001), LNCS 119, Macquarie Univerity, Sydney, Autralia, pp Dr. Eam Al Daoud i an aitant profeor at the Department of Computer Science, Zarka Private Univerity. He received hi Ph.D from Univerity Putra Malayia, 001. Hi reearch intereted cryptography, data mining, quantum computing, neural network and ingular value decompoition (SVD). Dr. Khalid Al-Tahat i an aitant profeor at the Department of Software engineering, Hahimate Univerity Jordan. Dr. Hamed J. Al-Fawareh, received hi B.Sc. in Computer Science from Yarmouk Univerity, M.Sc. in Computer Science from Univerity Putra Malayia, 1998 and Ph.D. in Software Engineering from Univerity Putra Malayia 001. Currently he i a chairman of Computer Science Department, Zarka Private Univerity (Jordan). reearch interet include oftware engineering and ecurity, and Bioinformatic. He ha publihed many original contribution in the field of oftware engineering.