# Integrating Elliptic Curve Cryptography with the Modbus TCP SCADA Communication Protocol
## 3 Elliptic Curve Cryptography  
The use of elliptic curves in cryptography was introduced independently by [PERSON] [20] and [PERSON] [21] in 1986-1987. Elliptic Curve based cryptography has a number of merits over conventional cryptography which we discuss, briefly, below. Elliptic curves, in general, offer greater flexibility in the definition of a suitable underlying group structure for cryptographic use. For instance, for a specific prime \(p\) there is only one multiplicative/additive group over \(p\). As we will explain, however, although elliptic curves are, also, defined over the elements of \(F_{p}\), they also incorporate two more parameters that may be varied and, thus, give rise to numerous different additive groups for the _same_ underlying field \(F_{p}\) for the specific prime \(p\). Moreover, most attacks on elliptic curve cryptosystems rely on solving the _Elliptic Curve Discrete Logarithm Problem or ECDLP_. As of today, no subexponential algorithm is known for this problem, while subexponential algorithms exist for the underlying problems of other, conventional, cryptosystems such as ElGamal. Formally, an elliptic curve is defined as follows ([22]):  
Definition 1 (Elliptic Curve): Let \(F\) be a field with operations \"\(+\)\" (\"addition\") and \"\(*\)\" (\"multiplication\") and characteristic (denoted by char(\(F\))) other than 2 and 3. The characteristic of a field \(F\) with the multiplication operation denoted by \"\(*\)\", is the least natural number \(n\) (if there exists such a number at all) such that \(nr=0\) for every \(r\) in \(F\). Also let \(a\) and \(b\) be two members of \(F\) such that \(4a^{3}+27b^{2}\
eq 0\) in \(F\). The condition \(4a^{3}+27b^{2}\
eq 0\) guarantees that the equation \(y^{2}=x^{3}+ax+b\) does not have multiple roots in the field \(F\). Then the elliptic curve of the equation \(y^{2}=x^{3}+ax+b\) over the field \(F\), denoted by \(E(F)\), is the set of pairs \((x,y)\) of elements of \(F\) that make the equation hold along with a special point denoted by \"\({}^{\circ}\)\" called the point at infinity. The expression \(-16\big{(}4a^{3}+27b^{2}\big{)}\) is called the discriminant of \(E(F)\) and it is denoted by \(\Delta(E(F))\). The point at infinity \"\({}^{\circ}\)\" may be thought of as a point infinitely away from the 0 point on the y-axis, where all lines parallel to this axis \"intersect\". It can be shown that the points defined over an elliptic curve form an additive group. The definition for the Elliptic Curve Discrete Logarithm Problem (ECDLP) is as follows:  
Definition 2 (Elliptic Curve Discrete Logarithm Problem-ECDLP): Let \(E\) be an elliptic curve over a finite field \(F_{q}\), \(P\) a point on \(E(F_{q})\) of order \(n\) and \(Q\) a point on \(E(F_{q})\) such that \(Q=tP\), with \(0\leq|t|<n-1\). The ECDLP consists in determining the value of \(t\). The ECDLP is computationally hard, and the security of EC-based cryptography relies on this hardness property. More precisely, what makes the groups defined on elliptic curves exceptional, cryptographically, compared to groups used in conventional cryptography is that the best-known algorithms for solving the ECDLP require exponential (in the key size) expected time complexity. It, thus, appears that there is no apparent characteristics of general elliptic curve groups that can be exploited in order to reduce this time complexity to subexponential. In some more detail, we will now compare the key sizes, for _equivalent_ security levels, of an EC-based cryptosystem depending on \(E\big{(}F_{q}\big{)}\), i.e., the additive group formed by a suitably chosen elliptic curve over a finite field \(F_{q}\), and a conventional cryptosystem relying on the multiplicative group of the finite field \(F_{p}\), for primes \(p\) and \(q\) (\(p\) and \(q\) may be equal, but not necessarily). The key for this comparison is the difficulty of solving the discrete logarithm problem in each of these two cryptosystems (see [23; 24; 25; 26; 27; 28; 29]). Our discussion below follows the excellent exposition given in [23].