The Twist-AUgmented Technique for Key Exchange

Abstract

Abstract. Key derivation refers to the process by which an agreed upon large random number, often named master secret, is used to derive keys to encrypt and authenticate data. Practitioners and standardization bodies have usually used the random oracle model to get key material from a Diffie-Hellman key exchange. However, formal proofs in the standard model require randomness extractors to formally extract the entropy of the random master secret into a seed prior to derive other keys. Whereas this is a quite simple tool, it is not easy to use in practice -or it is easy to misuse it-. In addition, in many standards, the acronym PRF (Pseudo-Random Functions) is used for several tasks, and namely the randomness extraction. While randomness extractors and pseudo-random functions are a priori distinct tools, we first study whether such an application is correct or not. We thereafter study DH-key exchange, in the cases of prime subgroups of Z p (and namely where p is a safe-prime) and of elliptic curves, since in IPSec, for example, only these groups are considered. We present very efficient and provable randomness extraction techniques for these groups under the DDH assumption. In the special case of elliptic curves, we present a new technique -the so-called 'Twist-AUgmented' technique-an alternative to randomness extractors which exploits specific properties of some elliptic curves. We finally compare the efficiency of this method with other solutions.

How to Hash into Elliptic Curves

“…Another technique consists in using a curve and its twist as suggested in [5]. Given a curve defined by equation (1), one can define the twisted curve of equation…”

Cryptographic Extraction and Key Derivation: The HKDF Scheme

“…In the latter case, one can consider deterministic extractors. Examples of such source-specific extractors in the cryptographic setting include the well-known hard-core schemes for RSA [2,15] and for discrete-log based functions [21,34], and the recent elegant extraction functions specific to some Diffie-Hellman groups in [11,16]. For most of our study we focus on generic extractors, i.e., those that can extract randomness from any source with sufficient min-entropy, and hence require some non-secret salt.…”

“…Both [5,6] offer interesting perspectives on the use of randomness extractors in practice that complement our work; our HKDF design is well suited for use also in the settings studied by these works. A good discussion of extraction issues in the context of KDFs in the Diffie-Hellman setting can be found in [11] where a dedicated deterministic extractor for specific DH groups is presented. Another such extractor (very different in techniques and applicability) is presented in [16].…”

Extractors for binary elliptic curves

“…Another extractor for elliptic curves over prime fields is proposed by Gürel in the same paper. However, the latter extracts essentially less than half of the bits of the abscissa of P. One more extractor for elliptic curves over prime fields is the TAU technique of Chevassut et al [5]. This technique allows to extract almost all the bits of the abscissa of a point of the union of an elliptic curve and its quadratic twist.…”