4.4 Menezes-Vanstone Elliptic Curve Cryptosystem
A more efficient variation has been found by Menezes and Vanstone. In
this variation, the elliptic curve is used for "masking", and
plaintexts and ciphertexts are allowed to be arbitrary ordered pairs
of (nonzero) elements (i.e., they are not required to be points on
E).This yields a message expansion factor of two, the same as
in the original ElGamal Cryptosystem.
Let E be an elliptic curve defined over Zp
(p > 3 prime) such that E contains a cyclic subgroup
H in which the discrete log problem is intractible.
Let P = Zp* ×
Zp*, C = E ×
Zp* ×
Zp*, and define
K = {(E, alpha, a, beta): beta =
aalpha},
where alpha in E. The values alpha and beta are
public, and a is secret.
For K = (E, alpha, a, beta), for a (secret)
random number k in Z|H|, and for
x = (x1, x2) in
Zp* ×
Zp*, define
eK(x, k) =
(y0, y1, y2),
where
y0 = k alpha,
(c1, c2) =
k beta,
y1 = c1
x1 (mod p), and
y2 = c2
x2 (mod p).
For a ciphertext y = (y0,
y1, y2), define
dK(y) = (y1
c1-1 (mod p), y2
c2-1 (mod p)),
where
ay0 =
(c1, c2).
4.4 Menzes-Vanstone Elliptic Curve Cryptosystem: Sample applet for small numbers
source
