I. INTRODUCTION

To date, the durability of modern asymmetric algorithms (data encryption and digital signature) is characterized by their properties to withstand all kinds of attacks and the laboriousness of the best known hacking algorithm [1-9].

The standards of asymmetric data encryption algorithms used in practice are based on the problems of factorizing a composite number and discrete logarithm in a finite group of large prime order.

The main problems in this class of cryptographic transformations are the low speed of such transformations, a significant increase in the size of the cryptogram compared to the size of the original message, and also the decreasing strength due to the development of mathematical methods and cryptanalysis tools.

In recent years, elliptic cryptography has been intensively developed, discovered independently by N. Koblitz and V. Miller in 1985, in which the role of a one-sided function is played by scalar multiplication of a point by a constant, implemented on the basis of operations of addition and doubling of points of elliptic curves (EC) in finite fields of various characteristics [14-15].

In [11], a status of the directional encryption was considered, possibilities of implementing directional encryption in groups of points on the EC were substantiated, in [12], a method of commutative encryption was proposed using computations on the EC, which ensures the exponential strength of the commutative encryption algorithm and its performance increase compared to other algorithms [13].

For cryptosystems (symmetric and asymmetric), there exist Chosen-plaintext attack (CPA), Chosen-cipher text attack (CCA), and adaptive chosen plaintext attack (CCA-2). The CPA and CCA attacks were originally intended for active cryptanalysis of secret key cryptosystems.

The purpose of this cryptanalysis is to break the cryptosystem using open and encrypted messages received during the attack $[18-20]$. They were then adapted for cryptanalysis of public key cryptosystems.

Analysis shows that public key cryptosystems are especially vulnerable to CCA and CCA-2 [17]. Therefore, to prevent such attacks, in practice, optimal asymmetric algorithms are used, for example RSA-OAEP [16] and etc.

The purpose of this work is to propose an optimal asymmetric data encryption algorithm for EC using the method of encoding messages with EC points.

In the EC encryption algorithm considered below, - bit data block of the message m is encoded by the EC point M, which is then transformed with a secret key. As a result, the cryptogram represents some point C.

The decryption procedure involves performing inverse transformations over point C, after which point M is restored and decryption is performed, leading to the receipt of message m.

II. MAINPART

Let a prime number be given p>3. Then an elliptic curve E defined over a finite prime field Fp is the set of pairs of numbers $(x,y)$, $x,y\in F_p$, satisfying the identity

where $a,b\in F_p$ and $4a^3+27b^2$ is not comparable to zero mod p.

An invariant of an elliptic curve is a magnitude J (E) that satisfies the identity

The coefficients a, b of the elliptic curve E, according to the known invariant $J(E)$ are determined as follows

Pairs $(x,y)$ that satisfy identity (1) are called points of the elliptic curve E; x and y are the x- and y-coordinates of the point, respectively.

The points of the elliptic curve will be denoted by $G(x,y)$ or G. Two points of an elliptic curve are equal if their corresponding x- and y-coordinates are equal.

On the set of all points of the elliptic curve E we introduce the addition operation, which we will denote by the "+" sign. For two arbitrary points $G_1(x_1,y_1)$ and $G_2(x_2,y_2)$ of the elliptic curve E, we consider several options.

Let the coordinates of the points $G_1(x_1,y_1)$ and $G_2(x_2,y_2)$ satisfy the condition $x_1\ne x_2$. In this case, their sum will be called the point $G_3(x_3,y_3)$, the coordinates of which are determined by t he following formula

If the equalities $hold{x}_1=x_{2}and{y}_1=y_2\ne 0$, then we define the coordinates of the point $G_3$, as follows

Where,

In the case when the condition $x_1=x_2$ and $y_1=-y_2$ (mod p) is satisfied sum of the points $G_1$ and $G_2$ will be called the zero point 0, without determining its x- and y-coordinates. In this case, the point $G_2$ is called the negation of the point $G_1$. For the zero point 0, the equalities hold.

Where G is an arbitrary point of the elliptic curve E.

On the set of all points of the elliptic curve E, we introduce the subtraction operation which we denote by the sign "-". By the properties of points on elliptic curves, for an arbitrary point $G(x,y)$ of an elliptic curve, the following equality holds:

In accordance with equality (7), for two arbitrary points $G_1(x_1,y_1)$ and $G_2(x_2,y_2)$ of the elliptic curve E, the subtraction operation is defined as follows:

i.e. a subtraction operation can be converted to an addition operation.

With respect to the introduced operation of addition, the set of all points of the elliptic curve E, together with the zero point form a finite abelian (commutative) group of order w, for which the inequality [2] holds.

A point T is called a point of multiplicity k, or simply a multiple point of an elliptic curve E, if for some point N the equality

III. ASYMMETRIC ENCRYPTION ALGORITHM PARAMETERS

The parameters of the asymmetric data encryption algorithm are:

1. Prime number p is the modulus of an elliptic curve satisfying the inequality . The upper bound of this number should be determined with a specific implementation of the asymmetric algorithm;

2. Elliptic curve $E$ defined by its invariant $J(E)$ or coefficientsa, $b\in F_p$;

3. Integer w is the order of group points of the elliptic curve E

4. Prime number n is the order of the cyclic subgroup of group points of the elliptic curve E, for which the following conditions are satisfied:

5. point G≠0 of the elliptic curve E, with coordinates $(x_0,y_0)$, satisfying the equality[n]G=0.

The above parameters of the asymmetric encryption algorithm are subject to the following requirements:

1. The condition $p^i\ne 1(\text{mod }n)$ must be fulfilled, for all integers i = 1, 2..., B, where B satisfies the inequality $B\ge 31$;

2. The inequality must be satisfied $w\ne p$.

Each user of the asymmetric encryption algorithm must have private keys:

1. The private key of the asymmetric algorithm d is an integer satisfying the inequality 0<d<n;

2. The public key of the asymmetric algorithm $Q$ is a point of an elliptic curve with coordinates $(x,y)$ satisfying the equality $[d]G=Q$.

An asymmetric encryption algorithm based on elliptic curves includes the following processes: expressing a message with elliptic curve points, encrypting a message, decrypting a message, expressing elliptic curve points as a message.

To implement these processes, each user must know the parameters of the asymmetric encryption algorithm. Also, each user must have d private and Q (x, y) public keys of the encryption algorithm.

Below processes of expressing a message with elliptic curve points, encrypting, decrypting and expressing elliptic curve points as a message are given.

a) Algorithm for expressing a message by points of an elliptic curve [12]

Specified S - the message for the next sequence is represented by an elliptic curve point.

1. Assign value of the counter i = 0, calculate the value $p^{\prime }=p\mathbf{\nabla }\mathbf{\cdot }{2}^{16}$ and compare $p^{\prime }$ and S as $\mu$ -bit binary numbers (div-operation of taking quotient). If $p^{\prime }\le S$, then go to step 6.

2. If , then form a 16-bit string r, the binary value of which is i. Otherwise, display the message "The point of the elliptic curve does not exist".

3. Assign r || s to the variable x, where the sign "||" denotes a concatenation operation and calculate the value$w=(x^3+ax+b)\mathrm{mod}p$

4. Calculate the Legendre symbol $(p)$. If $\lambda =-1$, then increase the counter $(i=i+1)$ and gotostep 2.

5. Calculate two root values $y_{1,2}=\pm \sqrt{w(\text{mod }p)}$ where $y_{1,2}\in \{1,2,\dots ,p-1\}$, assign the larger value of $y_{1,2}$ to y and go to step 10.

6. If , then form a 15-bit string r, the binary value of which is equal toi. Otherwise, display the message

"No elliptic curve point exists".

7. Assign the value S || r to the variable x and calculate the value $w=(x^3+ax+b)\mathrm{mod}p$

8. Calculate the Legendre symbol $(p)$. If $\lambda =-1$, then increase the counter $(i=i+1)$ and go to step6.

9. Calculate two root values $y_{1,2}=\pm \sqrt{w}(\text{mod }p)$ where $y_{1,2}\in \{1,2,\dots ,p-1\}$, assign the larger value of $y_{1,2}$ toy.

10. Output a pair of values $(x,y)$ as coordinates of the point M $(x,y)$ of the elliptic curve for the given message S.

b) An algorithm for expressing the points of an elliptic curve in the form of a message [12]

Let, M(x, y) be a point of an elliptic curve. Then the sequence of transition of a given point to S - the message goes as follows.

1. Calculate the value $w=(x^3+ax+b)\mathrm{mod}p$.

2. Calculate two root values $y_{1,2}=\pm \sqrt{w}(\text{mod }p)$, where $y_{1,2}\in \{1,2,\dots ,p-1\}$

3. If $y=y_1$ then, $S=x\text{div }{2}^{15}$. Otherwise, calculate $S=x\text{div }{2}^{16}$ and $S-$ announced by the corresponding message of the point $M(x,y)$.

c) Encryption process Given M message by conditions $\mu =\pi -k_0-k_1-16$ divided into blocks $M=\{m_1,m_2,...,m_{\nu }\}$, length $|m_i|=\mu$ bits, where $k_0,k_1$ – natural numbers, $\pi$ - a character that determines the length of a given prime number p, each $m_i$ - blocks, separately encrypted according to the sequence below.

1. Generate a random integer k satisfying the inequality 0<k<n, calculate $C_1=[k]G$ and R=[k]Qelliptic curve points.

2. Randomly generate I - message of length $k_1$ bits.

3. Calculate $S_1=(m_i\parallel 0^{k_0})\oplus Hesh1(l)$, where Hesh1 - hash function [10] of length $\mu +k_0$ bits.

4. Calculate $S_2=l\oplus Hesh2(S_1)$, where Hesh2 - hash function [10] of length $k_1$ bits.

5. Perform the operation $S=S_1\parallel S_2$

6. It is checked whether the message S is an elliptic curve point. If the message is not an elliptic curve point,

7. Using the x - coordinate of the point M (x, y), calculate the value $w=(x^3+ax+b)\mathrm{mod}p$

8. Calculate $y_{1,2}=\pm \sqrt{w}(\text{mod }p)$

9. If $y=min(y_1,y_2)$ then, go to step 12.

10. Assign3 to the variable q and calculate $C_2(x,y)=M(x,y)+R(x,y)$, $t=x_{C_2}\parallel q$, and go to step 12 (where $|q|=2$ bits).

11. Assign 1 to the variable $q$ and calculate $C_2(x,y)=M(x,y)+R(x,y),t=x_{C_2}\parallel q$, and go to step 13.

12. Assign 0 to the variable $q$ and calculate $C_2(x,y)=M(x,y)+R(x,y),t=x_{C_2}\parallel q$.

13. $E_i=\{C_1(x,y),t\}$ –declare as blocks of ciphertext.

d) Decryption of cipher texts blocks

The sequence of decrypting the ciphertext $E_i$ ( $E_i=\{C_1(x,y),t\}$ ) into the plaintext is as follows.

1. Calculate $U(x_u,y_u)=[d]C_1$

2. If q=0, then calculate $S=x_{C_2}\oplus x_U$ and go to step 10.

3. Calculate $w=(x_{C_2}^3+a{x}_{C_2}+b)\mathrm{mod}p$

4. Calculate $y_{1,2}=\pm \sqrt{w}(\text{mod }p)$

6. Calculate $y=min(y_1,y_2)$ and go to step 7.

7. Calculate $y=max(y_1,y_2)$.

8. Calculate $M(x,y)=(x_{C_2},y)-U(x_U,y_U)$

9. M (x, y) is expressed as message S.

10. Set the initial $\mu +k_0$ bit of message S to $S_1$, the last $k_1$ bit to $S_2$. i.e. $S_1\mid |S_2=S$.

11. Calculate $l=S_2\oplus Hesh2(S_1)$.

12. Calculate $Sm=S_1\oplus Hesh1(l)$.

13. If the last $k_0$ bit of the Sm message ends with zero values, then the message is genuine and the start $\mu$ bit is declared as a plaintext block $m_i$. Otherwise, the message is not genuine.

e) Correctness of the proposed algorithm

$1^{\mathrm{st}}$ case, $(q=0)$:

$2^{nd}$ case, $(q=1\text{ or }q=3)$:

Below a comparison of the software results of the proposed optimal encryption algorithm (EA), elliptic curve (EC)encryption algorithm (EA) is given, RSA and RSA-OAEP (Table1 and 2)