o date, the durability of modern asymmetric algorithms (data encryption and digital signature) is characterized by their properties to withstand all kinds of attacks and the laboriousness of the best known hacking algorithm [1][2][3][4][5][6][7][8][9].

The standards of asymmetric data encryption algorithms used in practice are based on the problems of factorizing a composite number and discrete logarithm in a finite group of large prime order.

The main problems in this class of cryptographic transformations are the low speed of such transformations, a significant increase in the size of the cryptogram compared to the size of the original message, and also the decreasing strength due to the development of mathematical methods and cryptanalysis tools.

In recent years, elliptic cryptography has been intensively developed, discovered independently by N. Koblitz and V. Miller in 1985, in which the role of a onesided function is played by scalar multiplication of a point by a constant, implemented on the basis of operations of addition and doubling of points of elliptic curves (EC) in finite fields of various characteristics [14][15].

In [11], a status of the directional encryption was considered, possibilities of implementing directional encryption in groups of points on the EC were substantiated, in [12], a method of commutative encryption was proposed using computations on the EC, which ensures the exponential strength of the commutative encryption algorithm and its performance increase compared to other algorithms [13].

For cryptosystems (symmetric and asymmetric), there exist Chosen-plaintext attack (CPA), Chosen-cipher text attack (CCA), and adaptive chosen plaintext attack (CCA-2). The CPA and CCA attacks were originally intended for active cryptanalysis of secret key cryptosystems.

The purpose of this cryptanalysis is to break the cryptosystem using open and encrypted messages received during the attack [18][19][20]. They were then adapted for cryptanalysis of public key cryptosystems.

The purpose of this work is to propose an optimal asymmetric data encryption algorithm for EC using the method of encoding messages with EC points.

In the EC encryption algorithm considered below, -bit data block of the message m is encoded by the EC point M, which is then transformed with a secret key. As a result, the cryptogram represents some point C.

The decryption procedure involves performing inverse transformations over point C, after which point M is restored and decryption is performed, leading to the receipt of message m.

Let a prime number be given p>3.Then an elliptic curve E defined over a finite prime field Fp is the set of pairs of numbers (x, y), x, y?F p , satisfying the identity

where a, b? F p and 4a 3 + 27b 2 is not comparable to zero mod p.

Analysis shows that public key cryptosystems are especially vulnerable to CCA andCCA-2 [17]. Therefore, to prevent such attacks, in practice, optimal asymmetric algorithms are used, for example RSA-OAEP [16] and etc.

.

An invariant of an elliptic curve is a magnitude J (E) that satisfies the identity

The coefficients a, b of the elliptic curve E, according to the known invariant J (E) are determined as follows

Pairs (x, y) that satisfy identity (1) are called points of the elliptic curve E; x and yare the x-and ycoordinates of the point, respectively.

The points of the elliptic curve will be denoted by G (x, y) or G. Two points of an elliptic curve are equal if their corresponding x-and y-coordinates are equal.

On the set of all points of the elliptic curve E we introduce the addition operation, which we will denote by the "+" sign. For two arbitrary points G 1 (x 1 , y 1 )and G 2 (x 2 , y 2 )of the elliptic curve E, we consider several options.

Let the coordinates of the points G 1 (x 1 , y 1 )and G 2 (x 2 , y 2 ) satisfy the condition x 1 ? x 2 . In this case, their sum will be called the point G 3 (x 3 , y 3 ), the coordinates of which are determined by t he following formula

), (mod

where ,

). (mod

In the case when the conditionx 1 =x 2 andy 1 =-y 2 (mod p) is satisfied sum of the points G 1 and G 2 will be called the zero point 0, without determining its x-and ycoordinates. In this case, the point G 2 is called the negation of the point G 1 . For the zero point 0, the equalities holds.

Where G is an arbitrary point of the elliptic curve E.

On the set of all points of the elliptic curve E, we introduce the subtraction operation which we denote by the sign "-". By the properties of points on elliptic curves, for an arbitrary point G (x, y) of an elliptic curve, the following equality holds:

i.e. a subtraction operation can be converted to an addition operation. With respect to the introduced operation of addition, the set of all points of the elliptic curve E, together with the zero point form a finite abelian (commutative) group of order w, for which the inequality [2] holds.

A point T is called a point of multiplicity k, or simply a multiple point of an elliptic curve E, if for some point N the equality

The parameters of the asymmetric data encryption algorithm are:

1. Prime number p is the modulus of an elliptic curve satisfying the inequality ?>2 255 . The upper bound of this number should be determined with a specific implementation of the asymmetric algorithm; 2. Elliptic curve E defined by its invariant J (E) or coefficientsa, b?F ? ; 3. Integer w is the order of group points of the elliptic curve E 4. Prime number n is the order of the cyclic subgroup of group points of the elliptic curve E, for which the following conditions are satisfied: The above parameters of the asymmetric encryption algorithm are subject to the following requirements:

1. The condition ? i ? 1(mod n)must be fulfilled,for all integersi=1, 2?, B , where ? satisfies the inequality B ? 31; 2. The inequality must be satisfied w ? ?.

1. The private key of the asymmetric algorithm d is an integer satisfying the inequality 0<d<n; 2. The public key of the asymmetric algorithm Q is a point of an elliptic curve with coordinates (x, y) satisfying the equality [d]G=Q .

An asymmetric encryption algorithm based on elliptic curves includes the following processes: expressing a message with elliptic curve points, encrypting a message, decrypting a message, expressing elliptic curve points as a message.

To implement these processes, each user must know the parameters of the asymmetric encryption In accordance with equality (7), for two arbitrary points G 1 (x 1 , y 1 ) and G 2 (x 2 , y 2 ) of the elliptic curve E, the subtraction operation is defined as follows: algorithm. Also, each user must have d private and Q (x, y) public keys of the encryption algorithm.

Below processes of expressing a message with elliptic curve points, encrypting, decrypting and expressing elliptic curve points as a message are given.

elliptic curve [12] Specified S -the message for the next sequence is represented by an elliptic curve point. and compare p? and S as µ -bit binary numbers (div-operation of taking quotient). If p? ? S, then go to step 6.

2. If i< 2 16 , then form a 16-bit string r, the binary value of which is i. Otherwise, display the message "The point of the elliptic curve does not exist". b) An algorithm for expressing the points of an elliptic curve in the form of a message [12] Let, M (x, y) be a point of an elliptic curve. Then the sequence of transition of a given point to S -the message goes as follows.

bits, where k 0 ,k 1 -natural numbers, ? -a character that determines the length of a given prime number p, each m iblocks, separately encrypted according to the sequence below.

2. Randomly generate l -message of length k 1 bits.

, where Hesh1hash function [10] of length

, where Hesh2 -hash function [10] of length 1 k bits.

, and go to step 12 (where | q | = 2 bits). 11. Assign 1 to the variable q and calculate

, and go to step 13. 12. Assign 0 to the variable q and calculate C 2 (x,y)=M(x,y)+R(x,y), q x t C || 2 = . 13. E i ={C 1 (x,y),t} -declare as blocks of ciphertext.

The sequence of decrypting the ciphertext E i (E i ={C 1 (x,y),t})into the plaintext is as follows.

2 nd case, (q=1 orq=3):