Results 1 
6 of
6
Pairingbased Cryptography at High Security Levels
 Proceedings of Cryptography and Coding 2005, volume 3796 of LNCS
, 2005
"... Abstract. In recent years cryptographic protocols based on the Weil and Tate pairings on elliptic curves have attracted much attention. A notable success in this area was the elegant solution by Boneh and Franklin [7] of the problem of efficient identitybased encryption. At the same time, the secur ..."
Abstract

Cited by 77 (2 self)
 Add to MetaCart
Abstract. In recent years cryptographic protocols based on the Weil and Tate pairings on elliptic curves have attracted much attention. A notable success in this area was the elegant solution by Boneh and Franklin [7] of the problem of efficient identitybased encryption. At the same time, the security standards for public key cryptosystems are expected to increase, so that in the future they will be capable of providing security equivalent to 128, 192, or 256bit AES keys. In this paper we examine the implications of heightened security needs for pairingbased cryptosystems. We first describe three different reasons why highsecurity users might have concerns about the longterm viability of these systems. However, in our view none of the risks inherent in pairingbased systems are sufficiently serious to warrant pulling them from the shelves. We next discuss two families of elliptic curves E for use in pairingbased cryptosystems. The first has the property that the pairing takes values in the prime field Fp over which the curve is defined; the second family consists of supersingular curves with embedding degree k = 2. Finally, we examine the efficiency of the Weil pairing as opposed to the Tate pairing and compare a range of choices of embedding degree k, including k = 1 and k = 24. Let E be the elliptic curve 1.
Elliptic Curve Discrete Logarithms and the Index Calculus
"... . The discrete logarithm problem forms the basis of numerous cryptographic systems. The most effective attack on the discrete logarithm problem in the multiplicative group of a finite field is via the index calculus, but no such method is known for elliptic curve discrete logarithms. Indeed, Miller ..."
Abstract

Cited by 23 (4 self)
 Add to MetaCart
. The discrete logarithm problem forms the basis of numerous cryptographic systems. The most effective attack on the discrete logarithm problem in the multiplicative group of a finite field is via the index calculus, but no such method is known for elliptic curve discrete logarithms. Indeed, Miller [23] has given a brief heuristic argument as to why no such method can exist. IN this note we give a detailed analysis of the index calculus for elliptic curve discrete logarithms, amplifying and extending miller's remarks. Our conclusions fully support his contention that the natural generalization of the index calculus to the elliptic curve discrete logarithm problem yields an algorithm with is less efficient than a bruteforce search algorithm. 0. Introduction The discrete logarithm problem for the multiplicative group F q of a finite field can be solved in subexponential time using the Index Calculus method, which appears to have been first discovered by Kraitchik [14, 15] in the 192...
Asymptotically optimal communication for torusbased cryptography
 In Advances in Cryptology (CRYPTO 2004), Springer LNCS 3152
, 2004
"... Abstract. We introduce a compact and efficient representation of elements of the algebraic torus. This allows us to design a new discretelog based publickey system achieving the optimal communication rate, partially answering the conjecture in [4]. For n the product of distinct primes, we construct ..."
Abstract

Cited by 11 (1 self)
 Add to MetaCart
Abstract. We introduce a compact and efficient representation of elements of the algebraic torus. This allows us to design a new discretelog based publickey system achieving the optimal communication rate, partially answering the conjecture in [4]. For n the product of distinct primes, we construct efficient ElGamal signature and encryption schemes in a subgroup of F ∗ qn in which the number of bits exchanged is only a φ(n)/n fraction of that required in traditional schemes, while the security offered remains the same. We also present a DiffieHellman key exchange protocol averaging only φ(n) log2 q bits of communication per key. For the cryptographically important cases of n = 30 and n = 210, we transmit a 4/5 and a 24/35 fraction, respectively, of the number of bits required in XTR [14] and recent CEILIDH [24] cryptosystems. 1
Computing Discrete Logarithms with Quadratic Number Rings
 Advances in Cryptology  EUROCRYPT '98, LNCS 1403
, 1998
"... At present, there are two competing index calculus variants for computing discrete logarithms in (Z/pZ) * in practice. The purpose of this paper is to summarize the recent practical experience with a generalized implementation covering both a variant of the Number Field Sieve and the Gaussian intege ..."
Abstract

Cited by 6 (1 self)
 Add to MetaCart
At present, there are two competing index calculus variants for computing discrete logarithms in (Z/pZ) * in practice. The purpose of this paper is to summarize the recent practical experience with a generalized implementation covering both a variant of the Number Field Sieve and the Gaussian integer method. By this implementation we set a record with p consisting of 85 decimal digits. With regard to computational results, including the running time, we provide a comparison of the two methods for this value of p.
Speeding up Exponentiation using an Untrusted Computational Resource
 MEMO 469, MIT CSAIL COMPUTATION STRUCTURES GROUP
, 2003
"... We present protocols for speeding up fixedbase exponentiation and variablebase exponentiation using an untrusted computation resource. In the fixedbase protocols, the base and exponent may be blinded. If the exponent is fixed, the base may be blinded in the variablebase exponentiation protocol ..."
Abstract

Cited by 5 (0 self)
 Add to MetaCart
We present protocols for speeding up fixedbase exponentiation and variablebase exponentiation using an untrusted computation resource. In the fixedbase protocols, the base and exponent may be blinded. If the exponent is fixed, the base may be blinded in the variablebase exponentiation protocols. The protocols are the first ones for accelerating exponentiation with the aid of an untrusted resource in arbitrary cyclic groups. We also describe how to use the protocols to construct protocols that do, with the aid of an untrusted resource, exponentiation modular an integer where the modulus is the product of primes with single multiplicity. One application of the protocols is to speed up exponentiationbased verification in discrete logbased signature and credential schemes. For example, the protocols can be applied to speeding up, on small devices, the verification of signatures in DSS, El Gamal, and Schnorr’s signature schemes, and the verification of digital credentials in Brands’ credential system. The protocols use precomputation and we prove that they are unconditionally secure. We analyze the performance of our variable base protocols where the exponentiation is modulo a prime p: the protocols provide an asymptotic speedup of about O(0.24 ( k log k) 2 3), where k = log p, over the squareandmultiply algorithm, without compromising security.
On partial lifting and the elliptic curve discrete logarithm problem
 PROCEEDING OF THE 15TH ANNUAL INTERNATIONAL SYMPOSIUM ON ALGORITHMS AND COMPUTATION, 342–351, LNCS 3341
"... It has been suggested that a major obstacle in finding an index calculus attack on the elliptic curve discrete logarithm problem lies in the difficulty of lifting points from elliptic curves over finite fields to global fields. We explore the possibility of circumventing the problem of explicitly ..."
Abstract

Cited by 1 (0 self)
 Add to MetaCart
It has been suggested that a major obstacle in finding an index calculus attack on the elliptic curve discrete logarithm problem lies in the difficulty of lifting points from elliptic curves over finite fields to global fields. We explore the possibility of circumventing the problem of explicitly lifting points by investigating whether partial information about the lifting would be sufficient for solving the elliptic curve discrete logarithm problem. Along this line, we show that the elliptic curve discrete logarithm problem can be reduced to three partial lifting problems. Our reductions run in random polynomial time assuming certain conjectures, which are based on some wellknown and widely accepted conjectures concerning the expected ranks of elliptic curves over the rationals. Should the elliptic curve discrete logarithm problem admit no subexponential time attack, then our results suggest that gaining partial information about lifting would be at least as hard.