ECC Point Serialization: Compressed vs Uncompressed

TL;DR

No, not all ECC field elements can be safely serialized as compressed points and then restored to their uncompressed form. This is because the compression process loses information about the y-coordinate, which can lead to ambiguity when reconstructing the point. Specifically, if a point’s y-coordinate has two possible values (positive or negative), deserialization will fail or produce an incorrect point.

Understanding ECC Point Serialization

Elliptic Curve Cryptography (ECC) uses points on an elliptic curve defined over a finite field. These points are often represented as (x, y) coordinates. Serializing these points is necessary for storage and transmission. Two common methods exist:

• Uncompressed Points: Store both the x and y coordinates explicitly. This requires more space but is unambiguous.
• Compressed Points: Only store the x-coordinate and a single bit indicating whether the y-coordinate is even or odd. This saves space, but introduces potential ambiguity.

The Problem with Compression

Consider an elliptic curve equation of the form y2 = x3 + ax + b (mod p), where ‘p’ is a prime number defining the finite field. For any given x-coordinate, there are typically two possible y-coordinates that satisfy this equation. The compression process discards one of these possibilities by only storing whether the y-coordinate is even or odd.

Step-by-step Guide to Serialization and Restoration

1. Serialization (Compression):

• Calculate the x and y coordinates of your ECC point.
• Determine if the y-coordinate is even or odd. This can be done using a modulo operation: y % 2. If the result is 0, the y-coordinate is even; otherwise, it’s odd.
• Store the x-coordinate and the parity bit (0 for even, 1 for odd).

Restoration (Decompression):

• Retrieve the compressed point data (x-coordinate and parity bit).
• Solve the elliptic curve equation for y given x: y2 = x3 + ax + b (mod p). This will generally yield two solutions, y₁ and y₂.
• Check if the parity of y₁ matches the stored parity bit. If it does, use y₁ as the y-coordinate for your restored point.
• If the parity of y₁ doesn’t match, check the parity of y₂. If it matches, use y₂.
• If neither y₁ nor y₂ has the correct parity, the decompression fails! This means the original point cannot be uniquely restored from the compressed representation.

Example in Python (Conceptual)

def decompress_point(x, parity, a, b, p):
  # Solve for y: y^2 = x^3 + ax + b mod p
  # This is simplified and assumes you have a function to find square roots modulo p.
  y1, y2 = find_square_roots(x**3 + a*x + b, p)

  if (y1 % 2) == parity:
    return x, y1
  elif (y2 % 2) == parity:
    return x, y2
  else:
    return None # Decompression failed!

Points That Cause Issues

The following points are problematic:

• Points with y = 0: If the y-coordinate is zero, both positive and negative values have the same parity.
• Points where x satisfies certain conditions: The specific conditions depend on the curve parameters (a, b, p). These are points where the two possible y-coordinates have the same parity.

Mitigation Strategies

1. Avoid problematic points: If possible, design your ECC system to avoid generating or using points that cannot be uniquely restored from their compressed representation.
2. Explicitly check for ambiguity: Before serializing a point, verify that it can be unambiguously decompressed.
3. Use uncompressed points: If space is not a critical constraint, use uncompressed points to avoid the ambiguity altogether.

Conclusion

While compressed ECC point serialization offers space savings, it’s crucial to understand its limitations and potential for ambiguity. Always ensure that your chosen points can be safely restored before relying on compressed representations in a cyber security application.