Skip to main content
Log in

A new public key cryptosystem based on Edwards curves

Journal of Applied Mathematics and Computing Aims and scope Submit manuscript

Cite this article


The elliptic curve cryptography plays a central role in various cryptographic schemes and protocols. For efficiency reasons, Edwards curves and twisted Edwards curves have been introduced. In this paper, we study the properties of twisted Edwards curves on the ring \({\mathbb {Z}}/n{\mathbb {Z}}\) where \(n=p^rq^s\) is a prime power RSA modulus and propose a new scheme and study its efficiency and security.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions


  1. Bernstein, D.J., Birkner, T.P., Joye, M., Lange, T., Peters, C.: Twisted Edwards curves. In: Vaudenay, S. (ed.) AFRICACRYPT 2008, Springer Lecture Notes in Computer Science, vol. 5023, pp. 389–405. Springer (2008)

  2. Bernstein, D.J., Lange, T.: Faster addition and doubling on elliptic curves. In: Kurosawa, K. (eds.) Advances in Cryptology-ASIACRYPT 2007. ASIACRYPT 2007. Lecture Notes in Computer Science, vol. 4833, pp. 29–50. Springer, Berlin (2007)

  3. Bernstein, D.J., Lange, T.: Explicit-formulas database. (2007)

  4. Boneh, D., Durfee, G., Howgrave-Graham, N.: Factoring \(N = p^rq\) for large \(r\). In: Wiener, M. (eds.) Advances in Cryptology-CRYPTO’ 99. CRYPTO 1999. Lecture Notes in Computer Science, vol. 1666, pp. 326–337. Springer, Berlin (1999)

  5. Boudabra, M., Nitaj, A.: A new generalization of the KMOV cryptosystem. J. Appl. Math. Comput. 57(1–2), 229–245 (2017)

    MathSciNet  MATH  Google Scholar 

  6. Bressoud, D.M.: Factorization and Primality Testing, Undergraduate Texts in Mathematics, 1989th edn. Springer, Berlin (1989)

    Book  Google Scholar 

  7. Compaq Computer Corporation: Cryptography Using Compaq MultiPrime Technology in a Parallel Processing Environment (2000).

  8. Coppersmith, D.: Small solutions to polynomial equations, and low exponent RSA vulnerabilities. J. Cryptol. 10(4), 233–260 (1997)

    Article  MathSciNet  Google Scholar 

  9. Edwards, H.M.: A normal form for elliptic curves. Bull. Am. Math. Soc. 44, 393–422 (2007)

    Article  MathSciNet  Google Scholar 

  10. Fujioka, A., Okamoto, T., Miyaguchi, S.: ESIGN: an efficient digital signature implementation for smard cards. In: EUROCRYPT 1991, Lecture Notes in Computer Science, vol. 547, pp. 446–457 (1991)

  11. Ireland, K., Rosen, M.: A Classical Introduction to Modern Number Theory. Springer, Berlin (1990)

    Book  Google Scholar 

  12. Koyama, K., Maurer, U.M., Okamoto, T., Vanstone S.A.: New public-key schemes based on elliptic curves over the ring \({\mathbb{Z}}_n\). In: Advances in Cryptology-CRYPTO’91, Lecture Notes in Computer Science, pp. 252–266. Springer (1991)

  13. Lenstra, H.: Factoring integers with elliptic curves. Ann. Math. 126, 649–673 (1987)

    Article  MathSciNet  Google Scholar 

  14. Lenstra, A.K., Lenstra Jr., H.W. (eds.): The Development of the Number Field Sieve. Lecture Notes in Mathematics, vol. 1554. Springer, Berlin (1993)

    MATH  Google Scholar 

  15. Nitaj, A., Rachidi, T.: New attacks on RSA with moduli \(N=p^{r}q\). In: El Hajji, S., Nitaj, A., Carlet, C., Souidi, E. (eds.) Codes, Cryptology, and Information Security. C2SI 2015. Lecture Notes in Computer Science, vol. 9084, pp. 352–360. Springer, Cham (2015)

  16. Okamoto, T., Uchiyama, S.: A new public key cryptosystem as secure as factoring. In: EUROCRYPT 1998, Lecture Notes in Computer Science, vol. 1403, pp. 308–318 (1998)

    Google Scholar 

  17. Rivest, R., Shamir, A., Adleman, L.: A Method for obtaining digital signatures and public-key cryptosystems. Commun. ACM 21(2), 120–126 (1978)

    Article  MathSciNet  Google Scholar 

  18. Sarkar, S.: Revisiting prime power RSA. Discrete Appl. Math. 203(C), 127–133 (2016)

    Article  MathSciNet  Google Scholar 

  19. Schmitt, S., Zimmer, H.G.: Elliptic Curves: A Computational Approach. Walter de Gruyter, Berlin (2003)

    MATH  Google Scholar 

  20. Takagi, T.: Fast RSA-type cryptosystem modulo \(p^kq\). In: Krawczyk, H. (eds) Advances in Cryptology-CRYPTO’98. CRYPTO 1998. Lecture Notes in Computer Science, vol. 1462. Springer, Berlin (1998)

  21. Washington, L.C.: Elliptic Curves: Number Theory and Cryptography, 2nd edn. CRC Press, Taylor & Francis Group, London (2008)

    Book  Google Scholar 

Download references

Author information

Authors and Affiliations


Corresponding author

Correspondence to Abderrahmane Nitaj.

Additional information

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.


A: Proof of Theorem 1

Let \(p>2\) be a prime number. Suppose that d is a non-square in \({\mathbb {Z}}/p{\mathbb {Z}}\) and a a square with \(a\equiv b^2\pmod p\). Let \((x_{1},y_{1})\), \((x_{2},y_{2})\) be two points on the curve \(E_{a,d,p}\). Suppose that \(dx_{1}y_{1}x_{2}y_{2}\equiv \delta \equiv \pm 1\pmod p\). Then \(x_{1}y_{1}x_{2}y_{2}\ne 0\pmod p\) and

$$\begin{aligned} \begin{aligned} ax_{1}^{2}+y_{1}^{2}&\equiv dx_{1}^{2}y_{1}^{2}+1\\&\equiv dx_{1}^{2}y_{1}^{2}+d^{2}x_{1}^{2}y_{1}^{2}x_{2}^{2}y_{2}^{2}\pmod p\\&\equiv dx_{1}^{2}y_{1}^{2}\left( 1+dx_{2}^{2}y_{2}^{2}\right) \pmod p\\&\equiv dx_{1}^{2}y_{1}^{2}\left( ax_{2}^{2}+y_{2}^{2}\right) \pmod p. \end{aligned} \end{aligned}$$

Hence, since \(\delta ^2\equiv 1\pmod p\) and \(ax_{1}^{2}+y_{1}^{2}\equiv dx_{1}^{2}y_{1}^{2}\left( ax_{2}^{2}+y_{2}^{2}\right) \pmod p\), we get

$$\begin{aligned} (bx_{1}+ \delta y_{1})^{2}&=b^{2}x_{1}^{2}+y_{1}^{2}+ 2b\delta x_{1}y_{1}\\&\equiv dx_{1}^{2}y_{1}^{2}\left( ax_{2}^{2}+y_{2}^{2}\right) +2bdx_{1}^{2}y_{1}^{2}x_{2}y_{2}\pmod p\\&\equiv dx_{1}^{2}y_{1}^{2}\left( b^{2}x_{2}^{2}+y_2^{2}+2bx_{2}y_{2}\right) \pmod p\\&\equiv dx_{1}^{2}y_{1}^{2}(bx_{2}+y_{2})^{2}\pmod p. \end{aligned}$$

If \(bx_{2}+y_{2}\not \equiv 0\pmod p\), then, since \(x_{1}y_{1}\ne 0\pmod p\), we have \(\gcd (x_{1}y_{1}(bx_{2}+y_{2}),p)=1\), and

$$\begin{aligned} d\equiv \frac{(bx_{1}+\delta y_{1})^{2}}{x_{1}^{2}y_{1}^{2}(bx_{2}+y_{2})^{2}}\pmod p, \end{aligned}$$

is a square which is a contradiction. Similarly, we have

$$\begin{aligned} (bx_{1}-\delta y_{1})^{2}\equiv dx_{1}^{2}y_{1}^{2}(bx_{2}-y_{2})^{2}\pmod p. \end{aligned}$$

If \(bx_{2}-y_{2}\not \equiv 0\pmod p\), then \(\gcd (x_{1}y_{1}(bx_{2}-y_{2}),p)=1\), and

$$\begin{aligned} d\equiv \frac{(bx_{1}-\delta y_{1})^{2}}{x_{1}^{2}y_{1}^{2}(bx_{2}-y_{2})^{2}}\pmod p, \end{aligned}$$

is a square which is a contradiction. It follows that \(bx_{2}+y_{2}\equiv 0\pmod p\) and \(bx_{2}-y_{2}\equiv 0\pmod p\), from which we deduce \(x_{2}\equiv 0\pmod p\) and \(y_{2}\equiv 0\pmod p\). This is also a contradiction. As a consequence, we have always \(\delta \not \equiv \pm 1\pmod p\) and the denominators in the addition law never vanish. This terminates the proof.

B: Proof of Lemma 2

Let (xy) be a point on the curve \(ax^{2}+y^{2}\equiv 1+dx^{2}y^{2}\pmod p\) with \(ad(a-d)\ne 0\). If \(x\ne 0\), then \(y\ne \pm 1\) and

$$\begin{aligned} \frac{1-y^{2}}{x^{2}}\equiv a-dy^{2}\pmod p. \end{aligned}$$

Since \(d\ne a\) and \(y\ne \pm 1\), then multiplying both sides by \(\frac{4(1+y)}{(1-y)^{3}(a-d)}\), we get

$$\begin{aligned} \frac{4(1+y)^{2}}{(1-y)^{2}(a-d)x^{2}}\equiv \frac{4\left( a-dy^{2}\right) (1+y)}{(1-y)^{3}(a-d)}\pmod p. \end{aligned}$$

Setting \(Y\equiv \frac{2(1+y)}{(1-y)x}\pmod p\) and transforming the right side, we get

$$\begin{aligned} \frac{1}{a-d}Y^{2}\equiv \frac{(1+y)^{3}}{(1-y)^{3}}+\frac{((a+3d)y+3a+d)(1+y)}{(1-y)^{2}(a-d)}\pmod p. \end{aligned}$$

Setting \(X\equiv \frac{1+y}{1-y}\pmod p\) and plugging it in the right side of the former equality, we get

$$\begin{aligned} \frac{1}{a-d}Y^{2}\equiv X^{3}+\frac{2(a+d)}{a-d}X^{2}+X\pmod p. \end{aligned}$$

Multiplying by \((a-d)^{3}\), we get

$$\begin{aligned} (a-d)^{2}Y^{2}\equiv (a-d)^{3}X^{3}+2(a+d)(a-d)^{2}X^{2}+(a-d)^{3}X\pmod p. \end{aligned}$$

Setting \(U\equiv (a-d)X\pmod p\) and \(V\equiv (a-d)Y\pmod p\), this transforms to \(V^{2}=U^{3}+2(a+d)U^{2}+(a-d)^{2}U\pmod p\) which can be rewritten as

$$\begin{aligned} V^{2}\equiv \left( U+\frac{2(a+d)}{3}\right) ^{3}-\frac{4(a+d)^{2}}{3}U-\frac{8(a+d)^{3}}{27} +(a-d)^{2}U\pmod p, \end{aligned}$$

that is

$$\begin{aligned} V^{2}\equiv \left( U+\frac{2(a+d)}{3}\right) ^{3}-\frac{a^{2} +14ad+d^{2}}{3}U-\frac{8(a+d)^{3}}{27}\pmod p. \end{aligned}$$

Let \(u\equiv U+\frac{2(a+d)}{3}\pmod p\) and \(v\equiv V\pmod p\). Then using u and v, we get

$$\begin{aligned} v^{2}\equiv u^{3}-\frac{1}{3}\left( a^{2}+14ad+d^{2}\right) u -\frac{2}{27}(a+d)\left( a^{2}-34ad+d^{2}\right) \pmod p.\nonumber \\ \end{aligned}$$

Summarizing the transformations, we get for \(x\ne 0\),

$$\begin{aligned} u\equiv \frac{5a-d+(a-5d)y}{3(1-y)}\pmod p,\quad v\equiv \frac{2(a-d)(1+y)}{(1-y)x}\pmod p.\ \ \end{aligned}$$

Now, if \(x=0\), then \(y^{2}=1\) and \(y=\pm 1\). If \(y=1\), then the transformations (3) are not valid and the point (0, 1) is transformed to the point at infinity \({\mathcal {O}}\). If \(y=-1\), then \(u\equiv \frac{2}{3}(a+d)\pmod p\). Plugging this in the Eq. (2), we get \(v=0\). Hence, the point \((0,-1)\) on \(E_{a,d,p}\) is transformed to the point \(\left( \frac{2}{3}(a+d),0\right) \) on the Eq. (2). This terminates the proof.

C: Proof of Lemma 3

Since \({\mathcal {O}}\) and (0, 1) are the neutral elements in \(W_{a,d,p}\) and \(E_{a,d,p}\) respectively, then they correspond to each other. For \(u\ne \frac{5d-a}{3}\) and \(v\ne 0\), we can invert (3) to get

$$\begin{aligned} (x,y)=\left( \frac{2(3u-2a-2d)}{3v},\frac{3u-5a+d}{3u+a-5d}\right) . \end{aligned}$$

Observe that (4) is not defined for \(v=0\) and for \(3u+a-5d\equiv 0\pmod p\).

First, for \(v=0\), suppose that \((u,0)\in W_{a,d,p}\). Then u satisfies the equation

$$\begin{aligned} \left( u-\frac{2(a+d)}{3}\right) \left( u+\frac{a+d+6\sqrt{ad}}{3}\right) \left( u+\frac{a+d-6\sqrt{ad}}{3}\right) \equiv 0\pmod p.\nonumber \\ \end{aligned}$$

The first root of (5) is \(u=\frac{2}{3}(a+d)\). Plugging this in the second coordinate of (4), we get \(y=-1\). Plugging \(y=-1\) in the equation \(ax^{2}+y^{2}=1+dx^{2}y^{2}\) of \(E_{a,d,p}\), we get \(ax^{2}=dx^{2}\). Since \(a\ne d\), then \(x=0\). Therefore the point \((\frac{2}{3}(a+d),0)\in W_{a,d,p}\) is mapped to \((0,-1)\in E_{a,d,p}\).

In the case ad is a square in \({\mathbb {Z}}/p{\mathbb {Z}}\), then the second and third roots of (5) are \(u=-\frac{1}{3}\left( a+d\pm 6\sqrt{ad}\right) \). Then the second coordinate of (4) is

$$\begin{aligned} y=\frac{3u-5a+d}{3u+a-5d}=\pm \sqrt{\frac{a}{d}}. \end{aligned}$$

Plugging \(y=\mp \sqrt{\frac{a}{d}}\) in the equation of \(E_{a,d,p}\), we get \(ax^{2}+\frac{a}{d}=1+ax^{2}\) and \(\frac{a}{d}=1\). Since \(a\ne d\), then this is impossible. Therefore the points \((u,v)=\left( -\frac{1}{3}\left( a+d\pm 6\sqrt{ad}\right) ,0\right) \in W_{a,d,p}\) are not mapped in \(E_{a,d,p}\).

Second, for \(3u+a-5d\equiv 0\pmod 0\) we have \(u\equiv -\frac{1}{3}(a-5d)\pmod p\). Suppose that there exists v such that \((u,v)=\left( -\frac{1}{3}(a-5d),v\right) \in W_{a,d,p}\). Then v satisfies

$$\begin{aligned} v^{2}\equiv 4d(a-d)^{2}\pmod p. \end{aligned}$$

Hence, if d is a square in \({\mathbb {Z}}/p{\mathbb {Z}}\), then \(v\equiv \pm 2\sqrt{d}(a-d)\pmod p\). Plugging \((u,v)=\left( -\frac{1}{3}(a-5d),\pm 2\sqrt{d}(a-d)\right) \) in the first coordinate of (4), we get \(x=\mp \frac{\sqrt{d}}{d}\). Plugging this in the equation of \(W_{a,d,p}\), we get \(\frac{a}{d}+y^{2}=1+y^{2}\) and \(\frac{a}{d}=1\), which is impossible since \(a\ne d\). Consequently, the points \((u,v)=\left( -\frac{1}{3}(a-5d),\pm 2\sqrt{d}(a-d)\right) \in W_{a,d,p}\) are not mapped on the twisted Edwards curve \(E_{a,d,p}\).

Rights and permissions

Reprints and Permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Boudabra, M., Nitaj, A. A new public key cryptosystem based on Edwards curves. J. Appl. Math. Comput. 61, 431–450 (2019).

Download citation

  • Received:

  • Published:

  • Issue Date:

  • DOI:


Mathematics Subject Classification