Results 1 
2 of
2
Constructing Elliptic Curve Cryptosystems in Characteristic 2
, 1998
"... Since the group of an elliptic curve defined over a finite field F_q... The purpose of this paper is to describe how one can search for suitable elliptic curves with random coefficients using Schoof's algorithm. We treat the important special case of characteristic 2, where one has certain simplific ..."
Abstract

Cited by 17 (1 self)
 Add to MetaCart
Since the group of an elliptic curve defined over a finite field F_q... The purpose of this paper is to describe how one can search for suitable elliptic curves with random coefficients using Schoof's algorithm. We treat the important special case of characteristic 2, where one has certain simplifications in some of the algorithms.
DiscreteLog with Compressible Exponents
 Advances in Cryptology — CRYPTO ’90, LNCS
, 1998
"... Introduction Many key distribution systems are based on the assumption that the DiscreteLog (DL) problem is hard. The implementations could be more efficient if a significantly smaller exponent could be used, without lowering the complexity of the DL problem. When the exponent is known to reside ..."
Abstract

Cited by 2 (0 self)
 Add to MetaCart
Introduction Many key distribution systems are based on the assumption that the DiscreteLog (DL) problem is hard. The implementations could be more efficient if a significantly smaller exponent could be used, without lowering the complexity of the DL problem. When the exponent is known to reside in interval of size w, the DL problem can be computed in time O(v/G), using Pollard's "Lambda method for catching Kangaroos" [P]. This is a randomized algorithm, with controllable error probability e > 0, which 640 can be made arbitrarily small, at the cost of increasing the runtime. The increase is linear in v/log(l/e). Suppose we want a level of security of 300 years on a 1 MIP machine, with 1K bit operations per instruction. Then w = 2 '7 currently seems sufficient (with a 512 bit modulus). It is not clear, however, whether methods other than "Kangaroo" exist, with lower complexity. bit exponent? Let s and m denote the number of squarings and multiplications, respectively, required