Results 1  10
of
41
Guide to Elliptic Curve Cryptography
, 2004
"... Elliptic curves have been intensively studied in number theory and algebraic geometry for over 100 years and there is an enormous amount of literature on the subject. To quote the mathematician Serge Lang: It is possible to write endlessly on elliptic curves. (This is not a threat.) Elliptic curves ..."
Abstract

Cited by 382 (17 self)
 Add to MetaCart
Elliptic curves have been intensively studied in number theory and algebraic geometry for over 100 years and there is an enormous amount of literature on the subject. To quote the mathematician Serge Lang: It is possible to write endlessly on elliptic curves. (This is not a threat.) Elliptic curves also figured prominently in the recent proof of Fermat's Last Theorem by Andrew Wiles. Originally pursued for purely aesthetic reasons, elliptic curves have recently been utilized in devising algorithms for factoring integers, primality proving, and in publickey cryptography. In this article, we aim to give the reader an introduction to elliptic curve cryptosystems, and to demonstrate why these systems provide relatively small block sizes, highspeed software and hardware implementations, and offer the highest strengthperkeybit of any known publickey scheme.
Aspects of Hyperelliptic Curves over Large Prime Fields in Software Implementations
, 2004
"... Abstract. We present an implementation of elliptic curves and of hyperelliptic curves of genus 2 and 3 over prime fields. To achieve a fair comparison between the different types of groups, we developed an adhoc arithmetic library, designed to remove most of the overheads that penalize implementati ..."
Abstract

Cited by 37 (5 self)
 Add to MetaCart
Abstract. We present an implementation of elliptic curves and of hyperelliptic curves of genus 2 and 3 over prime fields. To achieve a fair comparison between the different types of groups, we developed an adhoc arithmetic library, designed to remove most of the overheads that penalize implementations of curvebased cryptography over prime fields. These overheads get worse for smaller fields, and thus for larger genera for a fixed group size. We also use techniques for delaying modular reductions to reduce the amount of modular reductions in the formulae for the group operations. The result is that the performance of hyperelliptic curves of genus 2 over prime fields is much closer to the performance of elliptic curves than previously thought. For groups of 192 and 256 bits the difference is about 14 % and 15 % respectively.
Construction of secure random curves of genus 2 over prime fields
 Advances in Cryptology – EUROCRYPT 2004, volume 3027 of Lecture Notes in Comput. Sci
, 2004
"... Abstract. For counting points of Jacobians of genus 2 curves defined over large prime fields, the best known method is a variant of Schoof’s algorithm. We present several improvements on the algorithms described by Gaudry and Harley in 2000. In particular we rebuild the symmetry that had been broken ..."
Abstract

Cited by 37 (12 self)
 Add to MetaCart
Abstract. For counting points of Jacobians of genus 2 curves defined over large prime fields, the best known method is a variant of Schoof’s algorithm. We present several improvements on the algorithms described by Gaudry and Harley in 2000. In particular we rebuild the symmetry that had been broken by the use of Cantor’s division polynomials and design a faster division by 2 and a division by 3. Combined with the algorithm by Matsuo, Chao and Tsujii, our implementation can count the points on a Jacobian of size 164 bits within about one week on a PC. 1
Low Cost Security: Explicit Formulae for Genus 4 Hyperelliptic Curves
, 2003
"... It is widely believed that genus four hyperelliptic curve cryptosystems (HECC) are not attractive for practical applications because of their complexity compared to systems based on lower genera, especially elliptic curves. Our contribution shows that for low cost security applications genus4 hyper ..."
Abstract

Cited by 24 (11 self)
 Add to MetaCart
It is widely believed that genus four hyperelliptic curve cryptosystems (HECC) are not attractive for practical applications because of their complexity compared to systems based on lower genera, especially elliptic curves. Our contribution shows that for low cost security applications genus4 hyperelliptic curves (HEC) can outperform genus2 HEC and that we can achieve a performance similar to genus3 HEC. Furthermore our implementation results show that a genus4 HECC is an alternative cryptosystem to systems based on elliptic curves. In the work at hand...
The 2adic CM method for genus 2 curves with application to cryptography
 in ASIACRYPT ‘06, Springer LNCS 4284
, 2006
"... Abstract. The complex multiplication (CM) method for genus 2 is currently the most efficient way of generating genus 2 hyperelliptic curves defined over large prime fields and suitable for cryptography. Since low class number might be seen as a potential threat, it is of interest to push the method ..."
Abstract

Cited by 18 (1 self)
 Add to MetaCart
Abstract. The complex multiplication (CM) method for genus 2 is currently the most efficient way of generating genus 2 hyperelliptic curves defined over large prime fields and suitable for cryptography. Since low class number might be seen as a potential threat, it is of interest to push the method as far as possible. We have thus designed a new algorithm for the construction of CM invariants of genus 2 curves, using 2adic lifting of an input curve over a small finite field. This provides a numerically stable alternative to the complex analytic method in the first phase of the CM method for genus 2. As an example we compute an irreducible factor of the Igusa class polynomial system for the quartic CM field Q(i p 75 + 12 √ 17), whose class number is 50. We also introduce a new representation to describe the CM curves: a set of polynomials in (j1, j2, j3) which vanish on the precise set of triples which are the Igusa invariants of curves whose Jacobians have CM by a prescribed field. The new representation provides a speedup in the second phase, which uses Mestre’s algorithm to construct a genus 2 Jacobian of prime order over a large prime field for use in cryptography. 1
Faster scalar multiplication on Koblitz curves combining point halving with the Frobenius endomorphism
 in Proceedings of the 7th International Workshop on Theory and Practice in Public Key Cryptography, PKC 2004
"... on occasion of the birth of his daughter Seraina. Abstract. Let E be an elliptic curve defined over F2n. The inverse operation of point doubling, called point halving, can be done up to three times as fast as doubling. Some authors have therefore proposed to perform a scalar multiplication by an “ha ..."
Abstract

Cited by 16 (9 self)
 Add to MetaCart
on occasion of the birth of his daughter Seraina. Abstract. Let E be an elliptic curve defined over F2n. The inverse operation of point doubling, called point halving, can be done up to three times as fast as doubling. Some authors have therefore proposed to perform a scalar multiplication by an “halveandadd ” algorithm, which is faster than the classical doubleandadd method. If the coefficients of the equation defining the curve lie in a small subfield of F2n, one can use the Frobenius endomorphism τ of the field extension to replace doublings. Since the cost of τ is negligible if normal bases are used, the scalar multiplication is written in “base τ ” and the resulting “τandadd ” algorithm gives very good performance. For elliptic Koblitz curves, this work combines the two ideas for the first time to achieve a novel decomposition of the scalar. This gives a new scalar multiplication algorithm which is up to 14.29 % faster than the Frobenius method, without any additional precomputation.
Implementation of tate pairing on hyperelliptic curves of genus 2
 International Conference on Information Security and Cryptology (ICISC 2003), Lecture Notes in Computer Science 2971
, 2004
"... Abstract. Since Tate pairing was suggested to construct a cryptosystem, fast computation of Tate pairing has been researched recently. Barreto et. al[3] and Galbraith[8] provided efficient algorithms for Tate pairing on y 2 = x 3 − x + b in characteristic 3 and Duursma and Lee[6] gave a closed fo ..."
Abstract

Cited by 14 (3 self)
 Add to MetaCart
Abstract. Since Tate pairing was suggested to construct a cryptosystem, fast computation of Tate pairing has been researched recently. Barreto et. al[3] and Galbraith[8] provided efficient algorithms for Tate pairing on y 2 = x 3 − x + b in characteristic 3 and Duursma and Lee[6] gave a closed formula for Tate pairing on y 2 = x p − x + d in characteristic p. In this paper, we present completely general and explicit formulae for computing of Tate pairing on hyperelliptic curves of genus 2. We have computed Tate parings on a supersingular hyperelliptic curve over prime fields and the detailed algorithms are explained. This is the first attempt to present the implementation results for Tate pairing on a hyperelliptic curve of genus bigger than 1. Keywords elliptic curve cryptosystem, Tate pairing implementation, hyperelliptic curve cryptosystem 1
High Performance Arithmetic for Hyperelliptic Curve Cryptosystems of Genus Two
, 2003
"... Nowadays, there exists a manifold variety of cryptographic applications: from low level embedded crypto implementations up to high end cryptographic engines for servers. The latter require a exible implementation of a variety of cryptographic primitives in order to be capable of communicating wi ..."
Abstract

Cited by 13 (6 self)
 Add to MetaCart
Nowadays, there exists a manifold variety of cryptographic applications: from low level embedded crypto implementations up to high end cryptographic engines for servers. The latter require a exible implementation of a variety of cryptographic primitives in order to be capable of communicating with several clients. On the other hand, on the client it only requires an implementation of one speci c algorithm with xed parameters such as a xed eld size or xed curve parameters if using ECC/ HECC. In particular for embedded environments like PDAs or mobile communication devices, xing these parameters can be crucial regarding speed and power consumption. In this contribution, we propose a highly ecient algorithm for a hyperelliptic curve cryptosystem of genus two, well suited for these constraint devices.
Rethinking low genus hyperelliptic jacobian arithmetic over binary fields: Interplay of field arithmetic and explicit formulae
"... Abstract. In this paper, we present several improvements on the best known explicit formulæ for hyperelliptic curves of genus three and four in characteristic two, including the issue of reducing memory requirements. To show the effectiveness of these improvements and to allow a fair comparison of t ..."
Abstract

Cited by 12 (5 self)
 Add to MetaCart
Abstract. In this paper, we present several improvements on the best known explicit formulæ for hyperelliptic curves of genus three and four in characteristic two, including the issue of reducing memory requirements. To show the effectiveness of these improvements and to allow a fair comparison of the curves of different genera, we implement all formulæ using a highly optimized software library for arithmetic in binary fields. This library was designed to minimize the impact of a whole series of overheads which have a larger significance as the genus of the curves increases. The current state of the art in attacks against the discrete logarithm problem is taken into account for the choice of the field and group sizes. Performance tests are done on two personal computers with very different architectures. Our results can be shortly summarized as follows: Curves of genus three provide performance similar, or better, to that of curves of genus two, and these two types of curves can perform faster than elliptic curves – indeed on some processors often twice as fast. Curves of genus four attain a performance level comparable to elliptic curves. A large choice of curves is therefore available for the deployment of curvebased cryptography, with curves of genus three and four providing their own advantages as larger cofactors can be allowed for the group order.