Abstract

Abstract. We show that finding an efficiently computable injective homomorphism from the XTR subgroup into the group of points over GF(p 2) of a particular type of supersingular elliptic curve is at least as hard as solving the Diffie-Hellman problem in the XTR subgroup. This provides strong evidence for a negative answer to the question posed by S. Vanstone and A. Menezes at the Crypto 2000 Rump Session on the possibility of efficiently inverting the MOV embedding into the XTR subgroup. As a side result we show that the Decision Diffie-Hellman problem in the group of points on this type of supersingular elliptic curves is efficiently computable, which provides an example of a group where the Decision Diffie-Hellman problem is simple, while the Diffie-Hellman and discrete logarithm problem are presumably not. The cryptanalytical tools we use also lead to cryptographic applications of independent interest. These applications are an improvement of Joux’s one round protocol for tripartite Diffie-Hellman key exchange and a non refutable digital signature scheme that supports escrowable encryption. We also discuss the applicability of our methods to general elliptic curves defined over finite fields. 1

Citations

961	A public key cryptosystem and a signature scheme based on discrete logarithms - ElGamal - 1985
687	The arithmetic of elliptic curves - Silverman - 1985
394	A practical public key cryptosystem provably secure against adaptive chosen ciphertext attack - Cramer, Shoup - 1998
262	Elliptic Curve Public Key Cryptosystems - Menezes - 1993
256	An improved algorithm for computing logarithms over GF (p) and its cryptographic significance - Pohlig, Hellman - 1978
220	A one round protocol for tripartite Diffie-Hellman - Joux - 2000
180	A Secure and Optimally Efficient Multi-Authority Election Scheme - Cramer, Gennaro, et al. - 1997
78	The XTR public key system - Lenstra, Verheul - 2000
66	N.: The improbability that an elliptic curve has subexponential discrete log problem under the menezes-okamoto-vanstone algorithm - Balasubramanian, Koblitz - 1998
57	Separating decision diffie-hellman from diffie-hellman in cryptographic groups. Cryptology ePrint Archive, Report 2001/003 - Joux, Nguyen - 2001
53	The Weil and Tate Pairings as Building Blocks for Public Key Cryptosystems - Joux - 2002
37	Reducing elliptic curve logarithms to a finite field - Menezes, Okamoto, et al. - 1993
35	A public-key cryptosystem and a digital signature system based on the Lucas function analogue to discrete logarithms - Smith, Skinner - 1994
29	Identity-based Encryption from the Weil - Boneh, Franklin
28	Public-Key Cryptosystems Based on Cubic Finite Field Extensions - Gong, Harn - 1999
28	An elliptic curve implementation of the finite field digital signature algorithm - Koblitz - 1998
13	Key improvements to XTR - Lenstra, Verheul
8	Fast irreducibility and subgroup membership testing - Lenstra, Verheul
6	ECSTR (XTR): Elliptic Curve Singular Trace Representation”, Rump Session of Crypto 2000 - Menezes, Vanstone
1	The 4th workshop on Elliptic Curve Cryptography (ECC 2000 - Koblitz