## Torus-Based Cryptography (2003)

### Cached

### Download Links

- [eprint.iacr.org]
- [www.iacr.org]
- [eprint.iacr.org]
- [www.math.uci.edu]
- DBLP

### Other Repositories/Bibliography

Venue: | In Advances in Cryptology (CRYPTO 2003), Springer LNCS 2729 |

Citations: | 26 - 2 self |

### BibTeX

@INPROCEEDINGS{Rubin03torus-basedcryptography,

author = {Karl Rubin and Alice Silverberg},

title = {Torus-Based Cryptography},

booktitle = {In Advances in Cryptology (CRYPTO 2003), Springer LNCS 2729},

year = {2003},

pages = {349--365},

publisher = {Springer}

}

### Years of Citing Articles

### OpenURL

### Abstract

We introduce cryptography based on algebraic tori, give a new public key system called CEILIDH, and compare it to other discrete log based systems including LUC and XTR. Like those systems, we obtain small key sizes. While LUC and XTR are essentially restricted to exponentiation, we are able to perform multiplication as well. We also disprove the open conjectures from [2], and give a new algebro-geometric interpretation of the approach in that paper and of LUC and XTR.

### Citations

2467 | S.: Handbook of Applied Cryptography
- Menezes, Oorschot, et al.
- 1996
(Show Context)
Citation Context ...hertext ( ; ) to Alice. (iii) Decryption: Alice computes M = ( () ( ) a ) 2 F m q . TORUS-BASED CRYPTOGRAPHY 11 The torus-based encryption protocol is the generalized ElGamal protocol (see p. 297 of [=-=8-=-]) applied to T n . Similarly, the torus-based signature scheme is the generalized ElGamal signature scheme (see p. 458 of [8]) for the group T n , where as above the maps andsare used to go back and... |

80 | The XTR public key system
- Lenstra, Verheul
- 2000
(Show Context)
Citation Context ...actor of n=m = 2, 3=2, and 3, respectively. See Rubin was partially supported by NSF grant DMS-0140378. 1 2 KARL RUBIN AND ALICE SILVERBERG [9, 12, 13, 16, 17, 1] for Lucas-based systems and LUC, and =-=[3, 6, 7]-=- for XTR and related work. The cryptosystems based on algebraic tori introduced in this paper accomplish the same goal of attaining discrete log security in theseld F p n while requiring the transmiss... |

47 |
Adeles and algebraic groups
- Weil
- 1982
(Show Context)
Citation Context ... of T . If T is isomorphic to (Gm) d over Fqn, then one says that Fqn splits T . Let k = Fq and L = Fq n. Writing Res L/k for the Weil restriction of scalars from L to k (see §3.12 of [17] or §1.3 of =-=[19]-=- for the definition and properties), thensTorus-Based Cryptography 7 Res L/kGm is a torus. The universal property of the Weil restriction of scalars gives an isomorphism: (Res L/kGm)(k) ∼ = Gm(L) = L ... |

45 | Supersingular abelian varieties in cryptology
- Rubin, Silverberg
- 2002
(Show Context)
Citation Context ...g for n = 30 or 210). In §7 we reinterpret the Lucas-based cryptosystems, XTR, and the point of view in [2] in terms of algebraic tori, and compare these systems to our torus-based systems. Note that =-=[12]-=- gives another example, this time in the context of elliptic curves rather than multiplicative groups of fields, where the Weil restriction of scalars is used to obtain n log(q) bits of security from ... |

41 |
A p + 1 method of factoring
- Williams
(Show Context)
Citation Context ...of information, they are more ecient than Die-Hellman by a factor of n=m = 2, 3=2, and 3, respectively. See Rubin was partially supported by NSF grant DMS-0140378. 1 2 KARL RUBIN AND ALICE SILVERBERG =-=[9, 12, 13, 16, 17, 1]-=- for Lucas-based systems and LUC, and [3, 6, 7] for XTR and related work. The cryptosystems based on algebraic tori introduced in this paper accomplish the same goal of attaining discrete log security... |

39 |
A public-key cryptosystem and a digital signature system based on the Lucas function analogue to discrete Logarithms
- Smith, Skinner
- 2004
(Show Context)
Citation Context ...of information, they are more ecient than Die-Hellman by a factor of n=m = 2, 3=2, and 3, respectively. See Rubin was partially supported by NSF grant DMS-0140378. 1 2 KARL RUBIN AND ALICE SILVERBERG =-=[9, 12, 13, 16, 17, 1]-=- for Lucas-based systems and LUC, and [3, 6, 7] for XTR and related work. The cryptosystems based on algebraic tori introduced in this paper accomplish the same goal of attaining discrete log security... |

32 |
Public-key cryptosystems based on cubic finite field extensions
- Gong, Harn
- 1999
(Show Context)
Citation Context ..., namely, d copies of the multiplicative group. For the tori we consider, the group operation is just the usual multiplication in a (larger)sniteseld. The Lucas-based systems, the cubicseld system in =-=[4]-=-, and XTR have the discrete log security of theseld F p n , for n = 2, 3, and 6, resp., while the data required to be transmitted consists of m = '(n) elements of F p . Since these systems have n log ... |

31 | A New Public Key System
- Smith, Lennon
- 1993
(Show Context)
Citation Context ...of information, they are more ecient than Die-Hellman by a factor of n=m = 2, 3=2, and 3, respectively. See Rubin was partially supported by NSF grant DMS-0140378. 1 2 KARL RUBIN AND ALICE SILVERBERG =-=[9, 12, 13, 16, 17, 1]-=- for Lucas-based systems and LUC, and [3, 6, 7] for XTR and related work. The cryptosystems based on algebraic tori introduced in this paper accomplish the same goal of attaining discrete log security... |

29 |
Algebraic groups and their birational invariants
- Voskresenskii
- 1998
(Show Context)
Citation Context ...ave computed additional examples that show that no choice of four of the values a 8 (h); : : : ; a 14 (h) determines the other three. 3. Algebraic tori A good reference for algebraic tori is the book =-=[1-=-4]. Denition 6. An algebraic torus T over F q is an algebraic group dened over F q that over somesnite extensionseld is isomorphic to (G m ) d , where G m is the multiplicative group and d is necessar... |

27 | Doing more with fewer bits
- Brouwer, Pellikaan, et al.
- 1999
(Show Context)
Citation Context ... (recall that the norm of an element is the product of its conjugates). Define the torus Tn to be the intersection of the kernels of the norm maps NL/F , for all subfields k ⊂ F � L. [ ] Tn := ker By =-=(3)-=-, for k-points we have: Res L/kGm ⊕N L/F −−−−−→ ∼ = � F × ⊕ k⊆F �L Res F/kGm Tn(k) ∼ = {α ∈ L × : N L/F (α) = 1 whenever k ⊂ F � L}. (4) The dimension of Tn is ϕ(n) (see [17]). The group Tn(Fq) is a s... |

20 |
Some public-key crypto-functions as intractable as factorization, Cryptologia 9
- Williams
- 1985
(Show Context)
Citation Context ... Since these systems have n log p bits of security when exchanging ϕ(n) log p bits of information, they are more efficient than Diffie-Hellman by a factor of n/ϕ(n) = 2, 3/2, and 3, respectively. See =-=[10, 15, 16, 20, 21, 1]-=- for Lucas-based systems and LUC, and [3, 7, 8] for XTR and related work. ⋆ Rubin was partially supported by NSF grant DMS-0140378.s2 K. Rubin and A. Silverberg What makes discrete log based cryptosys... |

19 |
Arithmetic of algebraic tori
- Ono
- 1961
(Show Context)
Citation Context ...h) ∈ F49. We have computed additional examples that show that no choice of four of the values a8(h), . . . , a14(h) determines the other three. 3 Algebraic Tori Good references for algebraic tori are =-=[11, 17]-=-. Definition 6 An algebraic torus T over Fq is an algebraic group defined over Fq that over some finite extension field is isomorphic to (Gm) d , where Gm is the multiplicative group and d is necessar... |

16 |
Some remarks on Lucas-based cryptosystems
- Bleichenbacher, Bosma, et al.
- 1995
(Show Context)
Citation Context |

13 | Looking beyond XTR
- Bosma, Hutton, et al.
- 2002
(Show Context)
Citation Context ...ike those systems, we obtain small key sizes. While LUC and XTR are essentially restricted to exponentiation, we are able to perform multiplication as well. We also disprove the open conjectures from =-=[2]-=-, and give a new algebro-geometric interpretation of the approach in that paper and of LUC and XTR. 1. Introduction This paper accomplishes several goals. We introduce a new concept, namely torusbased... |

12 |
Some remarks on public-key cryptosystems
- Müller, Nöbauer
- 1981
(Show Context)
Citation Context |

8 |
On the rationality of tori with cyclic splitting field, in Arithmetic and geometry of varieties, Kuybyshev Univ
- Klyachko
- 1988
(Show Context)
Citation Context ... obtain an even better bound. Conjecture 9 (Voskresenskii [14]). The torus Tn is rational. The conjecture is true for n if n is a prime power (see Chapter 2 of [14]) or a product of two prime powers (=-=[5]-=-; see also §6.3 of [14]). In the next section we will exhibit explicit rational parametrizations when n = 6 and 2. When n is divisible by more than two distinct primes the conjecture is still open. No... |

8 |
de Bruijn, On the factorization of cyclic groups
- G
- 1955
(Show Context)
Citation Context ... 1 = � j|t Φj(q), we have that Φn(q) divides c. There are polynomials at(u) ∈ Z[u] such that � t|n,t�=n at(u) un − 1 u t − 1 = Φn(u) � . (3)s8 K. Rubin and A. Silverberg (see for example Theorem 1 of =-=[4]-=- or Theorem 2 of [14] 2 ), and so c divides Φn(q) as well. Thus c = Φn(q), so Tn(Fq) ∼ = Gq,n by (5) and the definition of Gq,n. Part (ii) follows from (i). Part (iii) now follows from Lemma 1 of [2].... |

8 |
A note on the cyclotomic polynomial, Mathematika 11
- Schoenberg
- 1964
(Show Context)
Citation Context ... have that Φn(q) divides c. There are polynomials at(u) ∈ Z[u] such that � t|n,t�=n at(u) un − 1 u t − 1 = Φn(u) � . (3)s8 K. Rubin and A. Silverberg (see for example Theorem 1 of [4] or Theorem 2 of =-=[14]-=- 2 ), and so c divides Φn(q) as well. Thus c = Φn(q), so Tn(Fq) ∼ = Gq,n by (5) and the definition of Gq,n. Part (ii) follows from (i). Part (iii) now follows from Lemma 1 of [2]. 4 Rationality of Tor... |

4 |
An overview of the XTR public key system, in Publickey cryptography and computational number theory (Warsaw, 2000), de Gruyter
- Lenstra, Verheul
- 2001
(Show Context)
Citation Context ...nging ϕ(n) log p bits of information, they are more efficient than Diffie-Hellman by a factor of n/ϕ(n) = 2, 3/2, and 3, respectively. See [10, 15, 16, 20, 21, 1] for Lucas-based systems and LUC, and =-=[3, 7, 8]-=- for XTR and related work. ⋆ Rubin was partially supported by NSF grant DMS-0140378.s2 K. Rubin and A. Silverberg What makes discrete log based cryptosystems work is that they are based on the mathema... |

4 |
Algebraic tori in cryptography, to appear
- Rubin, Silverberg
(Show Context)
Citation Context ... + 9i 5 + 4i 9 6 + 8i 9 + 10i 8 + i 1 + 4i 8 + 9i 5 + 4i 9 Table 4. Values of aj(h) ∈ F121 for certain h ∈ G11,30 Remark 4 Using these examples and some algebraic geometry, we prove in Theorem 5.3 of =-=[13]-=- that Conjectures (p, 1, 30)-BPV ′ and (p, 2, 15)-BPV ′ are each false for almost every prime p. Remark 5 For d = 1 and e = 30, the last two lines of Table 1 (resp., Table 2) show that even the larger... |

2 |
On the rationality of tori with cyclic splitting in Arithmetic and geometry of varieties
- Klyachko
- 1988
(Show Context)
Citation Context ...obtain an even better bound. Conjecture 9 (Voskresenskii [14]). The torus T n is rational. The conjecture is true for n if n is a prime power (see Chapter 2 of [14]) or a product of two prime powers (=-=[5]-=-; see also x6.3 of [14]). In the next section we will exhibit explicit rational parametrizations when n = 6 and 2. When n is divisible by more than two distinct primes the conjecture is still open. No... |

2 |
rational algebraic tori, Les XXèmes Journées Arithmétiques
- Stably
- 1997
(Show Context)
Citation Context ...so x6.3 of [14]). In the next section we will exhibit explicit rational parametrizations when n = 6 and 2. When n is divisible by more than two distinct primes the conjecture is still open. Note that =-=[15]-=- claims a proof of a result that would imply that for every n, T n is rational over F q for almost all q. However, there is a serioussaw in the proof. Even the case n = 30, which would have interestin... |

1 |
Stably rational algebraic tori, Les XXèmes Journées Arithmétiques
- Voskresenskii
- 1997
(Show Context)
Citation Context ...so §6.3 of [17]). In the next section we will exhibit explicit rational parametrizations when n = 6 and 2. When n is divisible by more than two distinct primes the conjecture is still open. Note that =-=[18]-=- claims a proof of a result that would imply that for every n, Tn is rational over Fq for almost all q. However, there is a serious flaw in the proof. Even the case n = 30, which would have interestin... |