# Integrating Elliptic Curve Cryptography with the Modbus TCP SCADA Communication Protocol
## 3 Elliptic Curve Cryptography
Let \(n=[\log_{2}q]\) be the size of the underlying field \(F_{q}\) of the elliptic curve \(E\big{(}F_{q}\big{)}\) and \(N=[\log_{2}p]\) the size of \(F_{p}\). Note that according to Hasse's Theorem (see, e.g., [23]) the _actual_ number of elements of \(E\big{(}F_{q}\big{)}\) ranges from \(q+1-2\sqrt{q}\) up to \(q+1+2\sqrt{q}\) and, thus, for our purposes, this number can be approximated by \(n=[\log_{2}q]\), with respect to order of magnitude. We, now, define the following function, where \(c\) is a positive real constant and the \"log\" without a subscript denotes natural logarithms (base \(e\)) that are, customarily, denoted by \"\(\ln\)\":  
\[L(p,v,c)=e^{c(\log p)^{v}(\log_{2}p)^{1-v}}, \tag{1}\]  
The behavior of this function depends, heavily, on the values of \(v\). When \(v=0\), this function is reduced to the following:  
\[L(p,0,c)=e^{c\text{loglog }p}=(\log p)^{c}, \tag{2}\]  
which is polynomial in the _size_ of \(p\). When \(v=1\), then the function becomes _exponential_ in the _size_ of \(p\):  
\[L(p,1,c)=e^{c\log p}=p^{c}, \tag{3}\]  
Finally, for \(v\) in the _open_ interval (0,1), the function lies between the polynomial and the exponential extremes, and it is called sub-exponential. It can then be shown that the discrete logarithm problem in \(F_{p}\) can be solved in time proportional to [23; 24; 25; 26; 27; 28; 29]  
\[L\bigg{(}p,\frac{1}{3},c_{0}\bigg{)}=e^{c_{0}(\log p)^{\frac{1}{3}}(\log_{2} p)^{\frac{2}{3}}}, \tag{4}\]  
where the value of the constant \(c_{0}\) is approximately 1.92. If by \(C_{CONV}(N)\) denotes the complexity of solving the discrete logarithm problem in a cryptosystem based on \(F_{p}\) with \(n=[\log_{2}q]\), then the following holds:  
\[C_{conv}(N)=e^{c_{0}N^{\frac{2}{3}}(\log N)^{\frac{2}{3}}}, \tag{5}\]  
which is sub-exponential in the size of the field \(F_{p}\). However, if by \(C_{EC}(n)\) denotes the complexity of solving the discrete logarithm problem on \(E\big{(}F_{q}\big{)}\), with \(n=[\log_{2}q]\), the best-known algorithms to date can solve it in time proportional to  
\[C_{EC}(n)=2^{\frac{n}{2}}=\sqrt{q}, \tag{6}\]  
which is exponential in the size of the field \(E\big{(}F_{q}\big{)}\). We proceed by setting \(C_{CONV}(N)=C_{EC}(n)\), so as to equate the security level for both cryptosystems and then solve for \(N\) in order to deduce the key size in bits (i.e., \(N\)) required by a conventional cryptosystem to attain security levels equivalent to an Elliptic Curve based cryptosystem with key size n. In other words, we use this equation to see for a given value of key size \(n\) of an Elliptic Curve cryptosystem, which key size \(N\) corresponds for a conventional cryptosystem that attains equivalent security levels. After solving this equation for \(N\), we derive the following (see [23] for an expression without the involved constants):  
\[N=\frac{1}{4}\frac{n^{3}}{LambertW(\frac{1}{2}\sqrt{ln2}\sqrt{\frac{n^{3}}{b^{3 }c^{3}}})^{2}b^{3}c^{3}}, \tag{7}\]  
with \(b\) approximately equal to 4.91 and \(c\) approximately equal to 1.92 (please [24] for a derivation of these values). The plot of (7) in Figure 1, shows, visually, a comparison of key sizes of equivalent security EC-based (with key size \(n\)) and conventional cryptosystems (with key size \(N\)). Equation (7), in essence, reflects the well-founded by theoretical and applied research results, that the discrete logarithm problem defined for the additive groups of elliptic curves is, computationally, harder than the discrete logarithm problem for the multiplicative groups \(Z_{q}^{*}\), where \(q\) is a prime, deployed by conventional cryptosystems [15].