A Security Analysis of the NIST SP 800-90 Elliptic Curve Random Number Generator

Abstract

Abstract. An elliptic curve random number generator (ECRNG) has been approved in a NIST standard and proposed for ANSI and SECG draft standards. This paper proves that, if three conjectures are true, then the ECRNG is secure. The three conjectures are hardness of the elliptic curve decisional Diffie-Hellman problem and the hardness of two newer problems, the x-logarithm problem and the truncated point problem. The x-logarithm problem is shown to be hard if the decisional DiffieHellman problem is hard, although the reduction is not tight. The truncated point problem is shown to be solvable when the minimum amount of bits allowed in NIST standards are truncated, thereby making it insecure for applications such as stream ciphers. Nevertheless, it is argued that for nonce and key generation this distinguishability is harmless.

Optimal Randomness Extraction from a Diffie-Hellman Element

“…One main practical consequence of the result for elliptic curve is that, we can avoid the Truncated Point Problem (TPP) assumption used in the security proof of the NIST Elliptic Curve Dual Random Bit Generator (DRBG) [7,24].…”

“…The first improvement reduces the number of assumptions on which the security proof relies. The second one decreases the implicit security bound given in [7].…”

“…Next, in Section 4, we prove the same kind of result for the group of points of an elliptic curve. Finally, in Section 5, we show some applications of our proofs to the security of the NIST EC DRBG [7,24] and the key derivation from a DH element.…”

“…Based on the elliptic curves, the design of this random bit generator (RBG) is adapted from the Blum-Micali generator. At Crypto '07, Brown and Gjøsteen [7] adapted the Blum-Micali RNG security proof to show that the DRBG output is indistinguishable from a uniformly distributed bit-string for all computationally limited adversaries. In this section, we show that our result allows to improve this security result at two different places.…”

Extractors for binary elliptic curves

“…An efficient pseudorandom generator based on elliptic curves is proposed by Barker and Kelsey [1]. Unfortunately, their generator (called Dual Elliptic Curve generator) is insecure the reason being that random bits are extracted from random points of the elliptic curve in an improper way [4,8,29]. Replacing the extractor used by Barker and Kelsey with one of our extractors yields a pseudorandom generator which is provably secure under the DDH assumption and the x-logarithm assumption [4].…”