Re: [Cfrg] Preliminary disclosure on twist security ...

[Dan Brown <[e-mail]>]

> -----Original Message-----
> From: Watson Ladd 
> 
> The patent in question is US6563928.
> 
> The claim cited reads as follows:
> 
> "53. A method of establishing a session key for encryption of data between a
> pair of correspondents comprising the steps of one of said correspondents
> selecting a finite group G, establishing a subgroup S having an order q of the
> group G, determining an element α of the subgroup S to generate greater than
> a predetermined number of the q elements of the subgroup S and utilising said
> element α to generate a session key at said one correspondent."
> 
> "59: 58. A method according to claim 53 wherein said order of said subgroup is
> of the form utilising an integral number of a product of a plurality of large
> primes.
> 59. A method according to claim 58 wherein the order of said subgroup is of
> the form nrr′ where n, r and r′ are each integers and r and r′ are each prime
> numbers."
> 
> This doesn't appear to have anything to do that directly with twist security. 

Well, this is what I was thinking:

Let F_p be the underlying field.

Let E be the twist-secure curve, with size #E(F_p) = hr, where h is a small cofactor and r a large prime.  Its twist E' has size h'r' where h' to the another small cofactor and r' is another large prime.

Now G be the group of F_p^2 rational points, which is a group of size hh'rr', right?  Then let S be the subgroup with of G of size q = rr'.

Let alpha be the element of S used to generate the yet smaller subgroup of size, i.e. the conventional DH prime-order subgroup of E(F_p).  Now alpha generates r elements, which is greater than a predetermined number, e.g. 2^250.

This means putting n =1 in Claim 59.

Best regards,

Dan