Bits security of the elliptic curve Diffie-Hellman secret keys

Abstract

We show that the least significant bits (LSB) of the elliptic curve Diffie-Hellman secret keys are hardcore. More precisely, we prove that if one can efficiently predict the LSB with non-negligible advantage on a polynomial fraction of all the curves defined over a given finite field , then with polynomial factor overhead, one can compute the entire Diffie-Hellman secret on a polynomial fraction of all the curves over the same finite field. Our approach is based on random self-reducibility (assuming GRH) of the Diffie-Hellman problem among elliptic curves of the same order. As a part of the argument, we prove a refinement of H. W. Lenstra's lower bounds on the sizes of the isogeny classes of elliptic curves, which may be of independent interest. © International Association for Cryptologic Research 2008.