Re: Elliptic Curve RSA

hassan.jameel@gmail.com wrote:
> Hi ... consider the following construction:
>
> Let p,q be two primes and let n=pq. Let 'e' be the public key and 'd'
> be the private key such that ed is congruent to 1 mod phi(n) . (just as
> in RSA). Now let EC denote an elliptic curve over the field Zn, where
> 'n=pq' as above. Let M be a message which is also a point on the EC.
> Define encryption as C = eM and define decryption as M=dC.
>
> Do you think this scheme would work? ... In other words the encrypted
> ciphertext would be decrypted to the same message? ...

Yes, elliptic curve RSA is possible. Probably the best known such
scheme
is called KMOV by Koyama, Maurer Okamoto and Vanstone. It was presented
at CRYPTO 91. The scheme does not appear to be much more or much less
secure than RSA, though analysing it's properties might still be an
interesting task.

Daniel Bleichenbacher
Received on Mon May 1 02:06:19 2006