Results 1  10
of
62
Short signatures from the Weil pairing
, 2001
"... Abstract. We introduce a short signature scheme based on the Computational DiffieHellman assumption on certain elliptic and hyperelliptic curves. The signature length is half the size of a DSA signature for a similar level of security. Our short signature scheme is designed for systems where signa ..."
Abstract

Cited by 743 (28 self)
 Add to MetaCart
(Show Context)
Abstract. We introduce a short signature scheme based on the Computational DiffieHellman assumption on certain elliptic and hyperelliptic curves. The signature length is half the size of a DSA signature for a similar level of security. Our short signature scheme is designed for systems where signatures are typed in by a human or signatures are sent over a lowbandwidth channel. 1
Pairingfriendly elliptic curves of prime order
 In Selected Areas in Cryptography – SAC 2005
, 2006
"... Abstract. Previously known techniques to construct pairingfriendly curves of prime or nearprime order are restricted to embedding degree k � 6. More general methods produce curves over Fp where the bit length of p is often twice as large as that of the order r of the subgroup with embedding degree ..."
Abstract

Cited by 216 (13 self)
 Add to MetaCart
(Show Context)
Abstract. Previously known techniques to construct pairingfriendly curves of prime or nearprime order are restricted to embedding degree k � 6. More general methods produce curves over Fp where the bit length of p is often twice as large as that of the order r of the subgroup with embedding degree k; the best published results achieve ρ ≡ log(p) / log(r) ∼ 5/4. In this paper we make the first step towards surpassing these limitations by describing a method to construct elliptic curves of prime order and embedding degree k = 12. The new curves lead to very efficient implementation: nonpairing operations need no more than Fp4 arithmetic, and pairing values can be compressed to one third of their length in a way compatible with point reduction techniques. We also discuss the role of large CM discriminants D to minimize ρ; in particular, for embedding degree k = 2q where q is prime we show that the ability to handle log(D) / log(r) ∼ (q − 3)/(q − 1) enables building curves with ρ ∼ q/(q − 1).
The Eta Pairing Revisited
 IEEE TRANSACTIONS ON INFORMATION THEORY
, 2006
"... In this paper we simplify and extend the Eta pairing, originally discovered in the setting of supersingular curves by Barreto et al., to ordinary curves. Furthermore, we show that by swapping the arguments of the Eta pairing, one obtains a very efficient algorithm resulting in a speedup of a fact ..."
Abstract

Cited by 114 (9 self)
 Add to MetaCart
(Show Context)
In this paper we simplify and extend the Eta pairing, originally discovered in the setting of supersingular curves by Barreto et al., to ordinary curves. Furthermore, we show that by swapping the arguments of the Eta pairing, one obtains a very efficient algorithm resulting in a speedup of a factor of around six over the usual Tate pairing, in the case of curves which have large security parameters, complex multiplication by an order of Q ( √ −3), and when the trace of Frobenius is chosen to be suitably small. Other, more minor savings are obtained for more general curves.
A taxonomy of pairingfriendly elliptic curves
, 2006
"... Elliptic curves with small embedding degree and large primeorder subgroup are key ingredients for implementing pairingbased cryptographic systems. Such “pairingfriendly” curves are rare and thus require specific constructions. In this paper we give a single coherent framework that encompasses all ..."
Abstract

Cited by 110 (11 self)
 Add to MetaCart
(Show Context)
Elliptic curves with small embedding degree and large primeorder subgroup are key ingredients for implementing pairingbased cryptographic systems. Such “pairingfriendly” curves are rare and thus require specific constructions. In this paper we give a single coherent framework that encompasses all of the constructions of pairingfriendly elliptic curves currently existing in the literature. We also include new constructions of pairingfriendly curves that improve on the previously known constructions for certain embedding degrees. Finally, for all embedding degrees up to 50, we provide recommendations as to which pairingfriendly curves to choose to best satisfy a variety of performance and security requirements.
Efficient implementation of pairingbased cryptosystems
 Journal of Cryptology
, 2004
"... ii ..."
(Show Context)
K.: Signatures for network coding
 In: International Journal on Information and Coding
, 2006
"... Abstract. This paper presents a practical digital signature scheme to be used in conjunction with network coding. This signature scheme seems to be the first example of a homomorphic signature scheme. Furthermore, our idea simultaneously provides authentication and detects malicious nodes that inten ..."
Abstract

Cited by 79 (2 self)
 Add to MetaCart
Abstract. This paper presents a practical digital signature scheme to be used in conjunction with network coding. This signature scheme seems to be the first example of a homomorphic signature scheme. Furthermore, our idea simultaneously provides authentication and detects malicious nodes that intentionally corrupt content on the network. 1.
On the Selection of PairingFriendly Groups
, 2003
"... We propose a simple algorithm to select group generators suitable for pairingbased cryptosystems. The selected parameters are shown to favor implementations of the Tate pairing that are at once conceptually simple and very efficient, with an observed performance about 2 to 10 times better than prev ..."
Abstract

Cited by 55 (13 self)
 Add to MetaCart
(Show Context)
We propose a simple algorithm to select group generators suitable for pairingbased cryptosystems. The selected parameters are shown to favor implementations of the Tate pairing that are at once conceptually simple and very efficient, with an observed performance about 2 to 10 times better than previously reported implementations.
Authenticated idbased key exchange and remote login with insecure token and pin number. http://eprint.iacr.org/2002/164
, 2002
"... ..."
(Show Context)
Elliptic Curves Suitable for Pairing Based Cryptography
 Designs, Codes and Cryptography
, 2003
"... We give a method for constructing ordinary elliptic curves over finite prime field Fp with small security parameter k with respect to a prime l dividing the group order #E(Fp) such that p << l² ..."
Abstract

Cited by 51 (1 self)
 Add to MetaCart
(Show Context)
We give a method for constructing ordinary elliptic curves over finite prime field Fp with small security parameter k with respect to a prime l dividing the group order #E(Fp) such that p << l&sup2;
Compressed Pairings
 In Advances in cryptology – Crypto’2004
, 2004
"... Pairingbased cryptosystems rely on bilinear nondegenerate maps called pairings, such as the Tate and Weil pairings defined over certain elliptic curve groups. In this paper we show how to compress pairing values, how to couple this technique with that of point compression, and how to benefit f ..."
Abstract

Cited by 47 (9 self)
 Add to MetaCart
Pairingbased cryptosystems rely on bilinear nondegenerate maps called pairings, such as the Tate and Weil pairings defined over certain elliptic curve groups. In this paper we show how to compress pairing values, how to couple this technique with that of point compression, and how to benefit from the compressed representation to speed up exponentiations involving pairing values, as required in many pairing based protocols.