ArticlePDF Available

Abstract and Figures

This paper presents a comparative analysis of RSA (Rivest Shamir Adleman) and ECC (Elliptic Curve Cryptography). In the current digital world and public-key cryptography segment, the majority of deployments are fulfilled by the RSA based cryptosystems. Cryptosystems based on elliptic curves emerge as an alternative to the RSA cryptosystems. The security of the RSA cryptosystem is based on the integer factorization problem (IFP) whereas the security of ECC is based on the elliptic curve discrete logarithm problem (ECDLP). The significant attraction towards ECC is that the best-known algorithm for solving the ECDLP takes full exponential time while for solving IFP of RSA takes sub-exponential time. This analysis suggests that ECC takes less memory than RSA and is better than RSA, especially on memory-constrained devices.
Content may be subject to copyright.
International Journal of Applied Engineering Research ISSN 0973-4562 Volume 12, Number 19 (2017) pp. 9053-9061
© Research India Publications. http://www.ripublication.com
9053
RSA and ECC: A Comparative Analysis
Dindayal Mahto
Department of Computer Applications, National Institute of Technology Jamshedpur,
Adityapur, Saraikella-Kharsawan, Jharkhand, India.
Orcid Id: 0000-0001-5599-4928
Dilip Kumar Yadav
Department of Computer Applications, National Institute of Technology Jamshedpur,
Adityapur, Saraikella-Kharsawan, Jharkhand, India.
Orcid Id: 0000-0002-1334-7500
Abstract
This paper presents a comparative analysis of RSA (Rivest
Shamir Adleman) and ECC (Elliptic Curve Cryptography). In
the current digital world and public-key cryptography
segment, the majority of deployments are fulfilled by the RSA
based cryptosystems. Cryptosystems based on elliptic curves
emerge as an alternative to the RSA cryptosystems. The
security of the RSA cryptosystem is based on the integer
factorization problem (IFP) whereas the security of ECC is
based on the elliptic curve discrete logarithm problem
(ECDLP). The significant attraction towards ECC is that the
best-known algorithm for solving the ECDLP takes full
exponential time while for solving IFP of RSA takes sub-
exponential time. This analysis suggests that ECC takes less
memory than RSA and is better than RSA, especially on
memory-constrained devices.
Keywords: RSA, Elliptic Curve Cryptography, ECDLP, IFP,
Public-Key Cryptography.
INTRODUCTION
Nowadays we live in a digital world where a majority of our
messages or information gets exchanged between
communicating users or systems immediately through digital
devices and digital network. However, the Internet, being an
open-ended architecture, has some flaws through which
eavesdroppers perform cyber attacks on communicated
message. Using cryptographic techniques, we can curb on
such type of attacks.
Cryptography is an art and a science of secret writing. It is of
two types: symmetric-key/private-key cryptography and
asymmetric-key/public-key cryptography. Symmetric-key
cryptosystems are encryption/decryption systems which
provide message confidentiality only. An asymmetric-key
cryptography technique provides confidentiality, integrity, and
authentication of traveling/storage message. Although
symmetric-key cryptosystems are faster and efficient than
asymmetric-key cryptosystems, however, they suffer from key
distribution and key management problems, whereas,
asymmetric-key cryptosystems provide an excellent way to
distribute key and to avoid key distribution and key
management problems of symmetric-key cryptosystems.
Concerning security of RSA and ECC, the fastest algorithm
(Pollard's rho algorithm) known for solving the ECDLP takes
full exponential time, which has an expected running time of
√πn/2. As of 2003, the largest ECDLP instance solved with
Pollard's rho algorithm is an elliptic curve over a 109-bit
prime field. The best known generic factoring method is
Pollard's general number field sieve (NFS). The heuristic
expected runtime needed for the NFS to find a factor of the
composite number n is L[n] = [1/3, 1.923]. The largest integer
factored using the NFS takes sub-exponential time, is
RSA200, a 200-digit number (665 bits) which was factored in
May 2005 [1]. This means that, for the same level of security,
significantly smaller parameters can be used in ECC than
RSA. For example, to achieve 112 bits of security level, RSA
algorithm needs a key size of 2048 bits, while ECC needs a
key size of 224 bits [2] as shown in Table 1 and Figure 1.
A comparative analysis of RSA and ECC is presented on the
basis encryption and decryption times for the data of 8 bits, 64
bits, and 256 bits.
Table 1: NIST Recommended Security Bit Level
Security Bit Level
RSA
ECC
80
1024
160
112
2048
224
128
3072
256
192
7680
384
256
15360
512
International Journal of Applied Engineering Research ISSN 0973-4562 Volume 12, Number 19 (2017) pp. 9053-9061
© Research India Publications. http://www.ripublication.com
9054
Figure 1: NIST Recommended Security Bit Level
METHODS
In the literature, some of the authors have presented the
comparative/security/performance analysis of RSA and ECC
with different parameters of measurements. Gura et al. [3]
compared point multiplication operation of an elliptic curve
over RSA and ECC on two 8-bit processor computer systems
and they found that on both systems, ECC-160 point
multiplication is more efficient than the RSA-1024 private-
key operation. Bos et al. [4] assess the risk of usage of a key
on the basis of key length of RSA and ECC, and they
conclude that till 2014, use of 1024-bit RSA provides some
small risk while 160-bit ECC over a prime field may safely be
used for a much more extended period. Kute et al. [5]
concluded RSA is faster than ECC, but security wise ECC
outperforms RSA. Jansma et al. [6] compare the usages of
digital signatures in RSA and ECC and suggest, RSA may be
a good choice for the applications, where verification of
message is required more than a generation of the signature.
Alese et al. [7] suggested that currently, RSA is stronger than
ECC although they also indicated ECC outperforms than RSA
in future. Mahto et al. [8, 16-21] demonstrate that ECC
outperforms regarding operational efficiency and security
over RSA.
RSA
RSA [9] is considered as the first real life and practical
asymmetric-key cryptosystem. It becomes de facto standard
for public-key cryptography. Its security lies with integer
factorization problem. RSA’s decryption process is not
efficient as its encryption process. Many researchers have
proposed to improve the efficiency of RSA’s decryption using
Chinese Remainder Theorem (CRT). Verma et al. [22]
proposed a model to improve decryption time of the RSA
using CRT. They also proposed to generate large modulus and
cryptographic keys with small order of a matrix.
For better and stronger security of data, bigger key sizes
require, which means more overhead on the computing
systems. Nowadays small devices are playing an important
role in the digital world, which has less memory but needs
security to cope with market demand. In this scenario, RSA
becomes second thoughts.
---------------------------------------------------------------------------
RSA Algorithm
---------------------------------------------------------------------------
Key Generation
Step I. Select p, q p and q both are primes, p q
Step II. Calculate n = pq
Step III. Calculate Φ(n) = (p 1)(q 1)
Step IV. Select integer e gcd(Φ(n), e) = 1; 1 < e < Φ(n)
Step V. Calculate d d e-1 (mod Φ(n) )
Step VI. Public key PU = {e, n}
Step VII. Private key PR = {d, n}
Encryption
Step I. Plaintext: M<n
Step II. Ciphertext: C=Me mod n
Decryption
Step I. Ciphertext: C
Step II. Plaintext: M=Cd mod n
---------------------------------------------------------------------------
Here, key generation is to be done by each party, so that they
can communicate each other securely. In the RSA algorithm,
‘e’ is for encryption, should be chosen such that gcd(Φ(n), e)
is equal to 1. Once ‘e’ is selected, corresponding, ‘d’ that is
for decryption should be generated with the help of finding
the inverse of ‘e’ mod Φ(n).
In encryption process, a sender has to encrypt the message
(i.e., in decimal digit) with the help of receiver’s public key,
i.e., ‘e’ and ‘n'.
In decryption process, the receiver has to decrypt the
ciphertext with the help of his private key, i.e., ‘d’ and ‘n’.
ECC
An ECC over a prime field is defined by following general
equation in two variables with coefficients.
y2 = x3 + ax + b (1)
where, 4a3 + 27b2 ≠ 0.
International Journal of Applied Engineering Research ISSN 0973-4562 Volume 12, Number 19 (2017) pp. 9053-9061
© Research India Publications. http://www.ripublication.com
9055
ECC is other promising asymmetric key cryptosystems,
independently coined by Miller [10] and Koblitz [11] in the
late 1980s. This type of systems is most suitable for memory
constraint devices such as Palmtop, Smartphone, Smartcards,
etc. An ECC requires comparatively less or smaller
parameters for encryption and decryption than RSA, but with
equivalent levels of security.
---------------------------------------------------------------------------
ECC Algorithm
---------------------------------------------------------------------------
Global Public Elements
Step I. Eq(a, b) elliptic curve with parameters a, b, and q,
where q is a prime or integer of the form 2m.
Step II. G point on elliptic curve whose order is large value n
User Alice Key Generation
Step I. Select private key nA; nA < n
Step II. Calculate public key PA
Step III. PA = nAG
User Bob Key Generation
Step I. Select private key nB; nB < n
Step II. Calculate public key PB
Step III. PB = nBG
Calculation of Secret Key by User Alice
Step I. K = nAPB
Calculation of Secret Key by User Bob
Step I. K = nBPA
Encryption by Alice using Bob’s Public Key
Step I. Alice chooses message Pm and a random positive
integer ‘k’
Step II. Ciphertext: Cm = { kG, Pm + kPB }
Decryption by Bob using his own Private Key
Step I. Ciphertext: Cm
Step II. Plaintext: Pm = Pm + kPB - nB (kG)
= Pm + k(nBG) - nB (kG)
---------------------------------------------------------------------------
Here, Pm is a (x,y) point encoded with the help of plaintext
message ‘m’. The Pm is the point used for encryption and
decryption.
An Illustration of Elliptic Curve Cryptography
This illustration presents a data communication security
model for a message of 64-bits using ECC.
Key Exchange using Elliptic Curve Diffie-Hellman
Algorithm [12]
Here, global parameters of ECC are:
Prime number q=8209, a=2, b=7, G=(4, 1313), h=1% of
secret key (ie.K(x)), for encoding and decoding of message in
elliptic curve. Based on global parameters, the elliptic curve’s
equation becomes:
y2 mod 8209 = (x3+ 2 x + 7) mod 8209 (2)
Steps for key exchange:
Step I. Private Key of Alice is a random value:
dA=4706
Step II. Public Key of Alice is:
PA(x, y) = dA*G(x, y)
= 4706*(4, 1313)
= (7926, 5458)
Step III. Private Key of Bob is a random value:
dB = 4802
Step IV. Public Key of Bob is:
PB(x, y) = dB*G(x, y)
= 4802*(4, 1313)
= (6866, 15)
Step V. Calculation of secret-key by Alice is:
K(x, y) = dA * PB
= 4701 * (6866, 15)
= (1846, 3967)
Step VI. Calculation of secret-key by Bob is:
K(x, y) = dB * PA
= 4802 * (7926, 5458)
= (1846, 3967)
International Journal of Applied Engineering Research ISSN 0973-4562 Volume 12, Number 19 (2017) pp. 9053-9061
© Research India Publications. http://www.ripublication.com
9056
In this way, both parties get same secret key i.e.
K(x, y) = (1846, 3967). The variable ‘h’ gets rounded value of
1% of K(x) = 18.
Encryption of plain message by Alice (Sender)
Steps for encryption
Step I. Alice generates plain message as: ‘32148765
Step II. Encoding:
Alice encodes the plain message into encoded message points
in the elliptic curve as shown in Table 2 and in the Figure 2.
Step III. Encryption:
Alice encrypts the encoded message points into cipher
message points as shown in Table 3 and in the Figure 3 and
send the same to Alice.
Here the message is passed to do encryption using ECC,
which uses public key of receiver.
Decryption of cipher message points by Bob (receiver)
Steps for decryption of cipher message points
Step I. Decryption: Bob decrypts cipher message points into
encoded message points as shown as in Table 2 and
in the Figure 2.
Step II. Decoding: Bob decodes the encoded points into
plain message.
Step III. Bob gets plain message as: 32148765.
Table 2: Plain points in the elliptic curve
Pmsg(X)
Pmsg(Y)
55
3252
20
2119
38
3336
74
3399
146
3323
128
3151
110
37
93
1787
Table 3: Cipher points in the elliptic curve
Cmsg(X)
Cmsg(y)
2716
8156
2729
736
2606
515
5065
1924
4675
7807
1806
6837
3427
896
6647
6331
Figure 2: Plain points
Different Case Studies of implementation of RSA or/and
ECC in S/W Security, H/W Security, Wireless LAN
Security
Implementing Software Security
Public-key cryptography provides two important services of
information security. They are as follows:
(i) Secrecy of information: It is provided by using
encryption and decryption.
(ii) Authentication of information: It is provided by
implementing a digital signature.
Secrecy of Information
Case Study 1: Comparative Analysis of Public-Key
Encryption Schemes by BK Alese et al. [7]
This research work focuses on the comparative analysis of
RSA encryption algorithm, ElGamal Elliptic Curve
Encryption algorithm, and Menezes-Vanstone Elliptic Curve
Encryption algorithm. These elliptic curves analog of
ElGamal encryption scheme were implemented in Java, using
International Journal of Applied Engineering Research ISSN 0973-4562 Volume 12, Number 19 (2017) pp. 9053-9061
© Research India Publications. http://www.ripublication.com
9057
classes from the FlexiProvider library of ECC. The RSA
algorithm used in the comparison is the FlexiProvider
implementation. Performance evaluation of the three
algorithms based on the time lapse for their key generation,
encryption, and decryption algorithms, and encrypted data
size was carried out and compared. The results show that
their elliptic curve-based implementations are more superior
to the RSA algorithm on all corresponding parameters.
After comparing the RSA and ECC ciphers, it was proved that
ECC involves much fewer overheads compared to RSA. The
ECC has shown to have many advantages due to its ability to
provide the same level of security as RSA yet using shorter
keys. However, its disadvantage which may even hide its
attractiveness is its lack of maturity, as mathematicians,
believed that enough research has not yet been done in
ECDLP.
Figure 3: Cipher points
Authentication of Information
Case Study 1: Performance Comparison of Elliptic Curve and
RSA Digital Signatures by Nicholas Jansma et al. [6]
This paper compares the performance characteristics of two
public key cryptosystems (RSA and ECC) used in digital
signatures to determine the applicability of each in modern
technological devices and protocols that use such signatures.
Their findings suggest that RSA key generation is
significantly slower than ECC key generation for RSA key of
sizes 1024 bits and greater. RSA is comparable to ECC for
digital signature creation regarding time and is faster than
ECC for digital signature verification. Thus, for applications
requiring message verification more often than a signature
generation, RSA may be the better choice.
Case Study 2: A Secure and Efficient Remote User
Authentication Scheme for Multi-server Environments Using
ECC by Zhang, Junsong, et al. [13]
The requirements of operations are lesser in ECC-based than
other related asymmetric-key schemes, in turn, it requires a
less computational cost. The demonstration of the paper
shows that proposed scheme can solve various types of
security problems and is better suitable for memory-
constrained devices.
Implementing Hardware Security
Case Study 1: Elliptic Curve Cryptosystems by M.J.B.
Robshaw et al. [14]
In their note, they provide a high-level comparison of the RSA
public-key cryptosystem and proposals for public-key
cryptography based on elliptic curves.
There are, however, many issues to consider when making a
choice between applications based on an elliptic curve
cryptosystem and one based on RSA. In their note, they have
presented some of the issues (security, performance,
standards, and interoperability) that are perhaps most pertinent
when making such a choice. The comparisons in this note are
made, however, under the premise that an elliptic curve
cryptosystem over GF(2160) offers the same security as 1024-
bit RSA.
Case Study 2: Comparing Elliptic Curve Cryptography and
RSA on 8-Bit CPUs by Gura, Nils, et al. [3]
They propose a new algorithm to reduce the number of
memory accesses. Implementation and analysis led to three
observations: 1. Public-key cryptography is viable on small
devices without hardware acceleration. On an Atmel
ATmega128 at 8 MHz they measured 0.81s for 160-bit ECC
point multiplication and 0.43s for an RSA-1024 operation
with exponent e=216+1. 2. The relative performance advantage
of ECC point multiplication over RSA modular
exponentiation increases with the decrease in processor word
size and the increase in key size. 3. Elliptic curves over fields
using pseudo-Mersenne primes as standardized by NIST and
SECG allow for high-performance implementations and show
no performance disadvantage over optimal extension fields or
prime fields explicitly selected for a particular processor
architecture.
They compared elliptic curve point multiplication over three
SECG/NIST curves secp160r1, secp192r1, and secp224r1
with RSA-1024 and RSA-2048 on two 8-bit processor
architectures. On both platforms, ECC-160 point
multiplication outperforms the RSA-1024 private-key
operation by order of magnitude and within a factor of 2 of
the RSA-1024 public-key operation. They presented a novel
multiplication algorithm that significantly reduces the number
International Journal of Applied Engineering Research ISSN 0973-4562 Volume 12, Number 19 (2017) pp. 9053-9061
© Research India Publications. http://www.ripublication.com
9058
of memory accesses. This algorithm led to a 25% performance
increase for ECC point multiplication on the Atmel AVR
platform. Their measurements and analysis led to fundamental
observations: The relative performance of ECC over RSA
increases as the word size of the processor decreases. It stems
from the fact that the complexity of addition, subtraction and
optimized reduction based on sparse pseudo-Mersenne primes
grows linearly with the decrease of the word size whereas
Montgomery reduction grows quadratically. As a result, ECC
point multiplication on small devices becomes comparable in
performance to RSA public-key operations, and they expect it
to be higher for large key sizes.
Wireless LAN Security
Case Study 1: Comparative Performance Analysis of Public-
Key Cryptographic Operations in the WTLS Handshake
Protocol by Rodríguez-Henríquez et al. [15]
In their paper, an efficient realization of the WTLS (Wireless
Transport Layer Security) handshake protocol was
implemented on a realistic wireless scenario composed of a
typical mobile device wirelessly connected with a workstation
server. The data gathered in their experiments shows that ECC
consistently outperforms the traditional option represented by
RSA in all the scenarios tested. Additionally, their analytical
model predictions show a reasonable agreement with the
obtained real data. They proposed a model for the protocol
analysis considering the processing time of the cryptographic
operations performed in the Client and the Server during the
Negotiation protocol.
Comparative Analysis of RSA and ECC
This paper implements RSA and ECC for secrecy of
information with three sample data inputs of 8 bits, 64 bits,
256 bits and random private keys based on the
recommendation of NIST [2]. The experiments are done on
MATLAB R2008a on Intel Pentium dual-core processor (1.60
GHz, 533 MHz, 1 MB L2 cache) with 2GB DDR2 RAM
under Ms-Windows platform. The efficiency of ECC over
RSA is shown in Table 4-6 and Figure 4-12. Based on
experimentation, it is observed that RSA is very efficient in
encryption but slow in decryption while ECC is slow in
encryption but very efficient in decryption. Overall ECC is
more efficient and secure than RSA as shown in the figures
Figure [6, 9 and 12].
Table 4: 8 bits Encryption, Decryption and Total Time (in seconds)
Input: 8 bits
Encryption
Decryption
Total Time
ECC
Enc.
Time
RSA Enc.
Time
ECC Dec.
Time
RSA Dec.
Time
ECC
Total
Time
RSA Total
Time
0.4885
0.0307
1.3267
0.7543
1.8152
0.7850
2.2030
0.0299
1.5863
2.7075
3.7893
2.7375
3.8763
0.0305
1.7690
6.9409
5.6453
6.9714
4.7266
0.0489
2.0022
13.6472
6.7288
13.6962
Table 5: 64 bits Encryption, Decryption and Total Time (in seconds)
Input: 64 bits
Encryption
Decryption
Total Time
ECC
Enc.
Time
RSA Enc.
Time
ECC Dec.
Time
RSA Dec.
Time
ECC
Total
Time
RSA
Total
Time
2.1685
0.1366
5.9099
5.5372
8.0784
5.6738
9.9855
0.1635
6.9333
20.4108
16.9188
20.5743
15.0882
0.1672
7.3584
46.4782
22.4466
46.6454
20.2308
0.1385
8.4785
77.7642
28.7093
77.9027
International Journal of Applied Engineering Research ISSN 0973-4562 Volume 12, Number 19 (2017) pp. 9053-9061
© Research India Publications. http://www.ripublication.com
9059
Table 6: 256 bits Encryption, Decryption and Total Time (in seconds)
Input: 256 bits
Encryption
Decryption
Total Time
ECC
Enc.
Time
RSA Enc.
Time
ECC Dec.
Time
RSA Dec.
Time
ECC
Total
Time
RSA
Total
Time
7.9240
0.5596
22.8851
19.3177
30.8091
19.8772
39.7008
0.5815
26.3331
102.0337
66.0339
102.6153
58.4386
0.5611
27.4060
209.6086
85.8446
210.1697
77.5034
0.5718
32.1522
311.0649
109.6556
311.6368
Figure 4: 8 bits Encryption Time (in seconds)
Figure 5: 8 bits Decryption Time (in seconds)
Figure 6: 8 bits Total (Encryption and Decryption) Time (in
seconds)
Figure 7: 64 bits - Encryption Time (in seconds)
International Journal of Applied Engineering Research ISSN 0973-4562 Volume 12, Number 19 (2017) pp. 9053-9061
© Research India Publications. http://www.ripublication.com
9060
Figure 8: 64 bits - Decryption Time (in seconds)
Figure 9: 64 bits - Total (Encryption and Decryption) Time
(in seconds)
Figure 10: 256 bits Encryption Time (in seconds)
Figure 11: 256 bits Decryption Time (in seconds)
Figure 12: 256 bits Total (Encryption and Decryption)
Time (in seconds)
CONCLUSION
Security of the message is paramount during its transmission
from one user to another user or system. A cryptographic
technique provides a message security. Symmetric-key
cryptography is very good in providing security to the
message but suffers from key distribution and management
problems. To mitigate the key distribution and management
problems and to ensure confidentiality, and integrity of a
message, asymmetric-key cryptography has been invented by
Diffie-Hellmen [12]. This paper presented a comparative
analysis of RSA and ECC. The experimentation was
conducted for finding time lapse during encryption,
decryption by RSA and ECC on three sample input data of 8
bits, 64 bits, 256 bits with random keys based on NIST
recommendation. Based on experimentation, it was found that
ECC outperforms RSA regarding operational efficiency and
security with lesser parameters. An ECC is particularly most
suitable for resource constraint devises.
International Journal of Applied Engineering Research ISSN 0973-4562 Volume 12, Number 19 (2017) pp. 9053-9061
© Research India Publications. http://www.ripublication.com
9061
ACKNOWLEDGEMENT
We would like to thank our colleagues, Head of Department
of Computer Applications, Dean(R & C) and the Director of
our Institute for supporting directly or indirectly in this
research work.
REFERENCES
[1] Hankerson, D., Menezes, A.J. and Vanstone, S.,
2006. Guide to elliptic curve cryptography. Springer
Science & Business Media.
[2] Barker, E., Barker, W., Burr, W., Polk, W. and Smid,
M., 2012. Recommendation for key management part
1: General (revision 3). NIST special publication,
800(57), pp.1-147.
[3] Gura, N., Patel, A., Wander, A., Eberle, H. and
Shantz, S.C., 2004, August. Comparing elliptic curve
cryptography and RSA on 8-bit CPUs. In CHES
(Vol. 4, pp. 119-132).
[4] Bos, J., Kaihara, M., Kleinjung, T., Lenstra, A.K.
and Montgomery, P.L., 2009. On the Security of
1024-bit RSA and 160-bit Elliptic Curve
Cryptography (No. EPFL-REPORT-164549).
[5] Kute, V.B., Paradhi, P.R. and Bamnote, G.R., 2009.
A software comparison of rsa and ecc. Int. J.
Comput. Sci. Appl, 2(1), pp.43-59.
[6] Jansma, N. and Arrendondo, B., 2004. Performance
comparison of elliptic curve and rsa digital
signatures. nicj. net/files.
[7] Alese, B.K., Philemon, E.D. and Falaki, S.O., 2012.
Comparative analysis of public-key encryption
schemes. International Journal of Engineering and
Technology, 2(9), pp.1552-1568.
[8] Mahto, D., Khan, D.A. and Yadav, D.K., 2016, June.
Security Analysis of Elliptic Curve Cryptography
and RSA. In Proceedings of the World Congress on
Engineering (Vol. 1).
[9] Rivest, R.L., Shamir, A. and Adleman, L., 1978. A
method for obtaining digital signatures and public-
key cryptosystems. Communications of the ACM,
21(2), pp.120-126.
[10] Miller, V.S., 1985, August. Use of elliptic curves in
cryptography. In Conference on the Theory and
Application of Cryptographic Techniques (pp. 417-
426). Springer, Berlin, Heidelberg.
[11] Koblitz, N., 1987. Elliptic curve cryptosystems.
Mathematics of computation, 48(177), pp.203-209.
[12] Diffie, W. and Hellman, M., 1976. New directions in
cryptography. IEEE transactions on Information
Theory, 22(6), pp.644-654.
[13] Zhang, J., Ma, J., Li, X. and Wang, W., 2014. A
Secure and Efficient Remote User Authentication
Scheme for Multi-server Environments Using ECC.
TIIS, 8(8), pp.2930-2947.
[14] Robshaw, M.J.B. and Yin, Y.L., 1997. Elliptic curve
cryptosystems. An RSA Laboratories Technical Note,
1, p.997.
[15] Rodríguez-Henríquez, F., López-Peza, C.E., León-
Chávez, M.A. and Puebla, P., 2004, June.
Comparative performance analysis of public-key
cryptographic operations in the WTLS handshake
protocol. In Proceedings of the 1st International
Conference on Electrical and Electronics
Engineering (pp. 24-27).
[16] Mahto, D. and Yadav, D.K., 2013, January. Network
security using ECC with Biometric. In International
Conference on Heterogeneous Networking for
Quality, Reliability, Security and Robustness (pp.
842-853). Springer, Berlin, Heidelberg.
[17] Mahto, D. and Yadav, D.K., 2015, February.
Enhancing security of one-time password using
Elliptic Curve Cryptography with biometrics for e-
commerce applications. In Computer,
Communication, Control and Information
Technology (C3IT), 2015 Third International
Conference on (pp. 1-6). IEEE.
[18] Mahto, D. and Yadav, D.K., 2015, March. Enhancing
security of one-time password using Elliptic Curve
Cryptography with finger-print biometric. In
Computing for Sustainable Global Development
(INDIACom), 2015 2nd International Conference on
(pp. 1737-1742). IEEE.
[19] Mahto, D. and Yadav, D.K., 2016. Security
Improvement of One-Time Password Using Crypto-
Biometric Model. In Proceedings of 3rd
International Conference on Advanced Computing,
Networking and Informatics (pp. 347-353). Springer,
New Delhi.
[20] Mahto, D. and Yadav, D.K., 2017. One-Time
Password Communication Security Improvement
using Elliptic Curve Cryptography with Iris
Biometric. International Journal of Applied
Engineering Research, 12(18), pp.7105-7114.
[21] Mahto, D. and Yadav, D.K., 2017, Secure Online
Medical Consultations Using Elliptic Curve
Cryptography with Iris Biometric. International
Journal of Control Theory and Applications, 10(13),
pp.169-179.
[22] Verma, P., Mahto, D., Jha, S.K. and Yadav, D.K.,
Efficient RSA Cryptosystem with Key Generation
using Matrix. International Journal of Control
Theory and Applications, 10(13), pp.221-228.
... Previous research has proposed securing Two-Factor Authentication (2FA) for IoT devices by applying mutual authentication and message encryption to communication via the MQTT protocol between client and server [9]. However, the study conducted mutual authentication by applying the RSA algorithm, which is less effective for use on IoT devices [10]. ...
... The ECC algorithm is used because it is considered better. After all, with the same level of security between RSA and ECC, the parameters used by ECC have a smaller size, so a more suitable algorithm for IoT devices with limited resources is ECC [10], [13], [14]. Data encryption is performed using symmetric keys generated from the Elliptic Curve Diffie-Hellman (ECDH) algorithm [15] and the AES algorithm [16], [17]. ...
Article
Full-text available
The rapid development of the IoT (Internet of Things) demands speed and security of communication between connected entities via the Internet. A suitable communication protocol for this communication in terms of speed optimization is MQTT (Message Queuing Telemetry Transport). However, it has security limitations that make it vulnerable to third-party attacks. This research proposes an IoT communication system and server using the MQTT protocol and Elliptic Curve Cryptography (ECC) algorithms to secure communications. ECC efficiently uses computing resources and has a short key size compared to Rivest Shamir Adleman (RSA), so it is suitable for mutual authentication. In addition, data encryption uses the 128-bit Advanced Encryption Standard (AES), which has good security and computing efficiency. The study included testing the mutual authentication speed of ECC and RSA across different key sizes, demonstrating that ECC consistently outperformed RSA in execution time. This study also compared the speed of mutual authentication between ECC and RSA with key sizes of 256 and 3072 bits, respectively; ECC achieved an average speed of 117.33 ms, whereas RSA took 241.92 ms. Furthermore, this study was also tested for the level of security using ECC as a cryptographic algorithm. The system is tested for security by performing sniffing attacks, brute force attacks, replay attacks, and fingerprint matching accuracy by measuring the False Rejection Rate (FRR) and False Acceptance Rate (FAR). The most suitable threshold value is between 30 and 40 within an Equal Error Rate (ERR) between 20% and 30%. The overall testing results show that the system is time-efficient and resilient to attacks.
... While both RSA and Elliptic Curve Cryptography are an asymmetric cryptography which used 2 type of key, namely private key for decryption and public key for encryption, both also has different underlying structure in how the message are processed. Elliptic Curve Cryptography also has advantage of having a smaller size key for roughly the same security power as larger key of RSA or AES [5]. Use of hybrid cryptography using Elliptic Curve has been done by Hoobi [6], where Elliptic Curve is being used with DES to secure a message, and resulted a better security with Elliptic Curve and DES compared to only using DES. ...
Article
As technology advances this past decades, many businesses start to integrating technology into their business, which making transaction more convenience. However, this convenience also introducing several security threats against these transmitted data that often involving highly private data. While ideally payment services should have some security standards for its users, research show that misconfigured TLS could actually expose some security threats caused by flaw on certain revisions, which could then be potentially used in dictionary attack. In this research, the author tries to implements a hybrid cryptography implementation involving use of Elliptic Curve Cryptography algorithm and AES in form of Elliptic Curve Integrated Encryption Scheme to secure highly private message over REST APIs and assess its impact in term of performance. In the proposed system, every data that contains a personal data will be secured using end-to-end approach, where each data sent and received will be encrypted using ECIES with AES on the top HTTPS connection. As the result, there is a slight performance degradation at rate of 57 to 230 milliseconds or about 15.57% of the original implementation without any encryption involved inside the system. Although this degradation may seem minimal, it underscores the critical trade-off between performance and security. This increased duration is also still under the currently accepted standard for any transaction request maximum duration which is 8 seconds, and estimated duration for certain request to be completed by the proposed system can be predicted using following formula: y=0.01156x+1.23 with RMSE of 3.71.
... Berdasarkan masalah tersebut maka kerahasiaan proses komunikasi dalam dunia internet mulai terancam. Ancaman paling besar adalah pada algoritme kriptografi enkripsi simetris yang sampai saat ini masih digunakan untuk enkripsi pesan pada beberapa layanan komunikasi internet [5]. Salah satu cara untuk mengantisipasi hal tersebut adalah dengan mempersiapkan algoritme kriptografi yang sangat kuat seperti quantum crypto atau algoritme kriptografi kunci publik sebagai pengganti algoritme kriptografi kunci simetris. ...
Article
Background Due to their complexity and size, deploying ciphertexts for clouds is considered the most useful approach to accessing large data stores. Method However, access to a user's access legitimacy and improving a decrypted text on the cloud depending on an improved access policy (AP) specified by the data owner are the key challenges for making large data storage realistic and effective in clouds. The traditional ways either totally remove the problem of AP development or offer renewal to arbiter power, but in real-time, enhancing the AP is essential to maximising security and handling agility. Results In this paper, a safe and verifiable access control program characterised by the NTRU cryptographic system for large storage of data in the clouds is proposed. Primarily, an improved NTRU decryption protocol to deal with the decryption failures of the prime NTRU is established, and in addition, the program is analysed for its security strength and computational performance. When a new AP is specified by the data owner, the cloud server allows the program to improve ciphertext and allows the owner to verify the upgrade to oppose the cloud's fraudulent behaviour. Conclusion It enables (i) checking the user's legitimacy to access the data owner and qualified users, and (ii) allowing the user to verify the data provided by other users for the recovery of the right user. Strong analysis can prevent and block delinquency from various attacks, namely the collusion attack that could potentially target fraud users.
Chapter
highlights the potential of integrating blockchain into 5G networks and the Metaverse and proposes an enhanced blockchain protocol for various applications. It emphasizes the transformative nature of 5G and blockchain technologies and their ability to revolutionize industries. It also discusses the capabilities of blockchain, such as smart contracts and decentralized storage, and the opportunities it presents for in- novative 5G services. It also addresses the challenges and open research problems in this domain. Furthermore, it explores the application of blockchain in the Metaverse, focusing on security, privacy, and scalability concerns. The proposed innovation aims to improve the blockchain protocol to effectively support 5G, Web3, Edge Computing, Metaverse, and many more applications. It prioritizes immutability, confidentiality, and availability and offers advantages to interaction and digital experiences. The objective is to create a protocol that meets diverse industry requirements while considering different approaches to achieve its goals.
Conference Paper
Full-text available
Internet has revolutionized the data communication systems. It provides platform to get the information exchanged quickly amongst the communicating parties at the same time it also provides opportunity to adversary to attack on unsecured information. In order to provide confidentiality, integrity and authentication services to unsecured information while transit or static, cryptographic techniques are used. This paper analyses the security strength of two popular and practical public-key cryptography techniques RSA (Rivest Shamir Adleman) and ECC (Elliptic Curve Cryptography). RSA is considered first generation public-key cryptography, which is very popular since its inception while ECC is gaining popularity recently. The security of the RSA cryptosystem is based on the Integer Factorization Problem (IFP) and the security of ECC is based on elliptic curve discrete logarithm problem (ECDLP). The main attraction of ECC over RSA is that the best known algorithm for solving the ECDLP takes full exponential time while to solve IFP of RSA takes sub-exponential time. This means that significantly smaller parameters can be used in ECC than RSA, with equivalent levels of security. For example to achieve 112 bits of security level, RSA algorithm needs key size of 2048 bits, while ECC needs key size of 224-255 bits.
Conference Paper
Full-text available
In many e-commerce systems, to counter network eavesdropping/replay attack, OTP concept has been used. However if the OTP itself gets attacked and then there might be possibility of attacking the account of the legitimate client too. This paper proposes a model for improving the security of OTP using ECC with iris biometric for an e-commerce transaction. This model also offers improve security with shorter key length than the RSA and also avoids to remember the private keys as the private keys are generated dynamically as and when required.
Conference Paper
Full-text available
Security of one-time password (OTP) is essential because nowadays most of the e-commerce transactions are performed with the help of this mechanism. OTP is used to counter replay attack / eavesdropping. Replay Attack / eavesdropping is one form of attack on computing system connected to the Internet or Intranet. For achieving 112 bits of security level, RSA algorithm needs key size of 2048 bits, while Elliptic Curve Cryptography (ECC) needs key size of 224-255 bits. Another issue with most of the existing implementation of security models is storage of secret keys. Stored keys are often protected by poorly selected user passwords that can either be guessed or obtained through brute force attacks. This is a weak link in a security model and can potentially compromise the integrity of sensitive data. Combining biometrics with cryptography is seen as a possible solution. This paper suggests an enhanced security model of OTP system using ECC with finger-print biometric. This model also suggests more security with less key length and there is no need to store any private key anywhere. It focuses to create and share secret key without transmitting any private key so that no one could access the secret key except themselves.
Conference Paper
Full-text available
The popular asymmetric cryptography is RSA but most of the RSA–based hardware and software products and standards require big cryptographic keys length for higher security level. The existing asymmetric cryptography algorithms need the storage of the secret keys. Stored keys are often protected by poorly selected user passwords that can either be guessed or obtained through brute force attacks. This is a major weakness of the crypto-system. Combining biometrics with cryptography is seen as a possible solution. This paper discusses the network security using Elliptic Curve Cryptography with contactless palm vein biometric system. It provides more security with less key length and also there is no need to store any private key anywhere. It focuses to create and share secret key without transmitting any private key so that no one could access the secret key except themselves.
Conference Paper
Full-text available
Security of one-time password (OTP) is essential because nowadays most of the e-commerce transactions are performed with the help of this mechanism. OTP is used to counter replay attack/eavesdropping. Replay attack or eavesdropping is one type of attacks on network-connected computing environment or isolated computing environment. For achieving 112 bits of security level, Rivest Shamir and Adleman (RSA) algorithm needs key size of 2048 bits, while Elliptic Curve Cryptography (ECC) needs key size of 224–255 bits. Another issue with most of the existing implementation of security models is storage of secret keys. Cryptographic keys are often kept in en-secured way that can either be guessed/social-engineered or obtained through brute force attacks. This becomes a weak link and leads integrity issues of sensitive data in a security model. To overcome the above problem, biometrics is combined with cryptography for developing strong security model. This paper suggests an enhanced security model of OTP system using ECC with palm-vein biometrie. This model also suggests better security with lesser key size than other prevalent public key crypto-model. The cryptographic keys are also not required to memorize or keep anywhere, these keys are generated as and when needed.
Article
Full-text available
The introduction of public-key cryptography by Diffie and Hellman in 1976 was an important watershed in the history of cryptography. The work sparked off interest in the cryptographic research community and soon several public-key schemes were proposed and implemented. The Rivest, Shamir and Adleman (RSA), being the first realisation of this abstract model, is the most widely used public-key scheme today. However, increased processing power and availability of cheaper processing technology occasioned by the exponential growth in digital technology has generated some security concerns, necessitating the review of security parameters for enhanced security. Enhanced processing power requirement does not favour the present class of ubiquitous mobile devices that are characterised by low power consumption, limited memory and bandwidth as they may not be able to run this cryptographic algorithm due to computational burden associated with long key lengths. And since future increase in key lengths looks likely given the current technological developments, Elliptic Curve Cryptography (ECC) has been proposed as an alternative cryptosystem because it satisfies both security requirements and efficiency with shorter key lengths. This research work focuses on the comparative analysis of RSA Encryption algorithm, ElGamal Elliptic Curve Encryption algorithm and Menezes-Vanstone Elliptic Curve Encryption algorithm. These elliptic curve analogues of ElGamal Encryption scheme were implemented in Java, using classes from the Flexiprovider library of ECC. The RSA algorithm used in the comparison is the Flexiprovider implementation. Performance evaluation on the three algorithms based on the time lapse for their Key generation, encryption and decryption algorithms, and encrypted data size was carried out and compared. The results show that our elliptic curve-based implementations are more superior to the RSA algorithm on all comparative parameters.
Article
Full-text available
To meet a user's needs cryptographic algorithm needs to be selected on the basis of attributes like security and performance. One of the tasks of a cryptosystem designer is to weigh the advantages and disadvantages and select the algorithmic tools that best address the problem to be solved. RSA is the most popular public-key cryptosystem today but long-term trends such as the proliferation of smaller, simpler devices and increasing security needs will make continued reliance on RSA more challenging over time. Hence Elliptic Curve Cryptography (ECC) is a suitable alternative. This paper focuses on performance attribute of public key cryptosystems. The algorithms studied and compared are RSA, ECC. We have implemented these algorithms in Java in order to perform software tests so that we may gain insight into the relative performance of each algorithm and its associative parameters. Software based tests are performed to yield an overall analysis of key generation, message encryption and decryption. Implementations are in Java and executable in the Windows environment. Each algorithm is tested for key generation and encryption/decryption of ordinary but large files.
Article
We discuss analogs based on elliptic curves over finite fields of public key cryptosystems which use the multiplicative group of a finite field. These elliptic curve cryptosystems may be more secure, because the analog of the discrete logarithm problem on elliptic curves is likely to be harder than the classical discrete logarithm problem, especially over GF(2"). We discuss the question of primitive points on an elliptic curve modulo p, and give a theorem on nonsmoothness of the order of the cyclic subgroup generated by a global point.
Article
With the rapid growth of the communication technology, intelligent terminals (i.e. PDAs and smartphones) are widely used in many mobile applications. To provide secure communication in mobile environment, in recent years, many user authentication schemes have been proposed. However, most of these authentication schemes suffer from various attacks and cannot provide provable security. In this paper, we propose a novel remote user mutual authentication scheme for multi-server environments using elliptic curve cryptography (ECC). Unlike other ECC-based schemes, the proposed scheme uses ECC in combination with a secure hash function to protect the secure communication among the users, the servers and the registration center (RC). Through this method, the proposed scheme requires less ECC-based operations than the related schemes, and makes it possible to significantly reduce the computational cost. Security and performance analyses demonstrate that the proposed scheme can solve various types of security problems and can meet the requirements of computational complexity for low-power mobile devices.
Article
This Recommendation provides cryptographic key management guidance. It consists of three parts. Part 1 provides general guidance and best practices for the management of cryptographic keying material. Part 2 provides guidance on policy and security planning requirements for U.S. government agencies. Finally, Part 3 provides guidance when using the cryptographic features of current systems.