## An analysis of the vector decomposition problem ⋆

Citations: | 3 - 1 self |

### BibTeX

@MISC{Galbraith_ananalysis,

author = {Steven D. Galbraith and Eric R. Verheul},

title = {An analysis of the vector decomposition problem ⋆},

year = {}

}

### OpenURL

### Abstract

Abstract. The vector decomposition problem (VDP) has been proposed as a computational problem on which to base the security of public key cryptosystems. We give a generalisation and simplification of the results of Yoshida on the VDP. We then show that, for the supersingular elliptic curves which can be used in practice, the VDP is equivalent to the computational Diffie-Hellman problem (CDH) in a cyclic group. For the broader class of pairing-friendly elliptic curves we relate VDP to various co-CDH problems and also to a generalised discrete logarithm problem 2-DL which in turn is often related to discrete logarithm problems in cyclic groups. Keywords: Vector decomposition problem, elliptic curves, Diffie-Hellman problem, generalised discrete logarithm problem. 1

### Citations

818 |
The arithmetic of elliptic curves
- Silverman
- 1986
(Show Context)
Citation Context ...or π, and for elliptic curves there can be no such maps. We begin with three lemmas to deal with the case of embedding degree 3 (i.e., r | #E(Fq) has r | (q 3 −1)). For background in this section see =-=[4, 8, 19]-=- Lemma 6. Let E be an elliptic curve over F q 2 with #E(F q 2) = q 2 ± q + 1. Then j(E) = 0. Proof. Let π be the q 2 -power Frobenius map, which has degree q 2 and is purely inseparable. Since E is su... |

559 | Short signatures from the weil pairing
- Lynn, Shacham
- 2001
(Show Context)
Citation Context ... is permitted that the VDP be easy for a negligible proportion of triples in G 3 . 2.1 Diffie-Hellman problems and relation with VDP We recall the co-CDH problem as defined by Boneh, Lynn and Shacham =-=[5]-=-. Definition 4. Let G1 and G2 be cyclic groups of order r. The co-Computational Diffie-Hellman problem co-CDH(G1, G2) is: Given P, aP ∈ G1 and Q ∈ G2, compute aQ. Note that having a perfect algorithm ... |

291 | Efficient Algorithms for PairingBased Cryptosystems
- Barreto, Kim, et al.
- 2002
(Show Context)
Citation Context ...which case we may assume that E is the elliptic curve E : y 2 + y = x 3 + x + b over F2m where b = 0 or 1 and m is odd. The field F24m has elements s, t such that s2 = s + 1 and t2 = t + s. Following =-=[3]-=- we consider the distortion map φ(x, y) = (x + s2 , y + sx + t). Note that φ and φ−1 are easily computed. It is immediate that if P ∈ E(F2m) then π2 (φ(P )) = −φ(P ). Hence, (P, φ(P )) is a distortion... |

284 |
Elliptic curve public key cryptosystems
- Menezes
- 1993
(Show Context)
Citation Context ... → 〈Q〉 for which φ and φ−1 can be computed in polynomial time. In characteristic 2, there are only finitely many Fq-isomorphism classes of supersingular elliptic curves and we have k ≤ 4 (see Menezes =-=[18]-=-). For applications we take k = 4, in which case we may assume that E is the elliptic curve E : y 2 + y = x 3 + x + b over F2m where b = 0 or 1 and m is odd. The field F24m has elements s, t such that... |

189 | A remark concerning m-divisibility and the discrete logarithm problem in the divisor class group of curves - Frey, Rück - 1994 |

136 | An efficient off-line electronic cash system based on the representation problem
- Brands
- 1993
(Show Context)
Citation Context ...if it exists) such that Q = aP . The discrete logarithm problem has been generalized by many authors in different ways. For example, if G1 is a cyclic group of prime order and P1, P2 ∈ G1 then Brands =-=[6]-=- defined the representation problem: Given Q ∈ G1 find (a, b) such that Q = aP1 + bP2. It is easy to show that the the representation problem in the cyclic group G1 is equivalent to the DLP in G1. For... |

107 |
Handbook of elliptic and hyperelliptic curve cryptography. Discrete mathematics and its applications
- Cohen, Frey, et al.
- 2006
(Show Context)
Citation Context ...or π, and for elliptic curves there can be no such maps. We begin with three lemmas to deal with the case of embedding degree 3 (i.e., r | #E(Fq) has r | (q 3 −1)). For background in this section see =-=[4, 8, 19]-=- Lemma 6. Let E be an elliptic curve over F q 2 with #E(F q 2) = q 2 ± q + 1. Then j(E) = 0. Proof. Let π be the q 2 -power Frobenius map, which has degree q 2 and is purely inseparable. Since E is su... |

87 | Supersingular Curves in Cryptography
- Galbraith
- 2001
(Show Context)
Citation Context ...ring-friendly. Again, there are two cases. (a) Supersingular. These curves are necessarily pairing-friendly. There are many examples of supersingular hyperelliptic curves given in the literature (see =-=[13]-=-). (b) Non-supersingular. For example the curves with complex multiplication presented by Duursma and Kiyavash [9]. 4. The subgroup of order r2 in (Z/nZ) ∗ where n = pq is a product of two primes such... |

78 | A taxonomy of pairing-friendly elliptic curves. Preprint 2006, Available at http://eprint.iacr
- Freeman, Scott, et al.
- 1994
(Show Context)
Citation Context ... q k. Such curves are automatically ‘pairing-friendly’. There are two cases: (a) Supersingular curves. 12(b) Ordinary curves. There are many methods to generate pairing-friendly ordinary curves (see =-=[11]-=- for a survey). 3. Subgroups of exponent r and order r2 of the divisor class group of a curve of genus g ≥ 2 over Fqk. In this case, the full r-torsion is not necessarily defined over Fqk and so the d... |

76 | Evidence that XTR is more secure than supersingular elliptic curve cryptosystems (full version - Verheul |

75 |
The improbability that an elliptic curve has subexponential discrete log problem under the Menezes-Okamoto-Vanstone algorithm
- Balasubramanian, Koblitz
- 1998
(Show Context)
Citation Context ...robenius map. Then E[r] has a distortion eigenvector basis with respect to F = π. Proof. Let π be the q-power Frobenius. Since r | #E(Fq) and E[r] ̸⊆ E(Fq) it follows from Balasubramanian and Koblitz =-=[1]-=- that k > 1. Hence q ̸≡ 1 (mod r). Furthermore, E[r] has a basis {P, Q} such that π(P ) = P (i.e., P ∈ E(Fq)) and π(Q) = qQ. It remains to prove the existence of a homomorphism φ : 〈P 〉 → 〈Q〉 for whic... |

69 | Towards the equivalence of breaking the Diffie-Hellman protocol and computing discrete logarithms - Maurer - 1994 |

37 | The relationship between breaking the diffie–hellman protocol and computing discrete logarithms
- Maurer, Wolf
- 1999
(Show Context)
Citation Context ...o the above result if additional conditions hold (e.g., for supersingular elliptic curves). Note that if one can solve CDH(G1) and one has a suitable auxiliary elliptic curve for the Maurer reduction =-=[15, 16]-=- then one can solve the DLP in G1 and hence solve co-CDH(G1, G2). Hence it is natural to conjecture that CDH(G1) and co-CDH(G1, G2) are equivalent. However, it could conceivably be the case that there... |

26 | Variations of Diffie-Hellman problem
- Bao, Deng, et al.
- 2003
(Show Context)
Citation Context ...(G1). It would follow from Theorem 1 below that VDP is a strictly harder problem than CDH(G1) for these groups. The following computational problem is similar to the problem DCDH defined by Bao et al =-=[2]-=-, who also proved equivalence with CDH. For completeness we give a trivial Lemma which is needed later. Definition 5. The co-Divisional Computational Diffie-Hellman problem co-DCDH(G1, G2) is, given (... |

24 |
Abelian varieties over finite fields, Ann. Sci. École Norm. Sup., 4th series
- Waterhouse
- 1969
(Show Context)
Citation Context ...then φ(P ) ∈ E(F q 3)[r] is a q-power Frobenius eigevector with eigenvalue q. Proof. Let π be the q-power Frobenius. Then security parameter 3/2 or 3 implies that π satisfies π2 ±qπ+q = 0. Waterhouse =-=[21]-=- implies q = p2m where p ≡ 2 (mod 3). Hence, by Lemma 6, E is of the form y2 = x3 +A. Further, by Lemma 7, E is of the form y2 = x3 + A where A ∈ Fq2 is not a cube. We now define a distortion map on E... |

17 |
Easy decision Diffie-Hellman groups
- Galbraith, Rotger
(Show Context)
Citation Context ...singular elliptic curves used in practice have a distortion eigenvector basis. The restriction to “curves used in practice” is because for the case of elliptic curves over Fp we use an algorithm from =-=[14]-=- whose complexity is exponential in the class number h of the CM field Q( √ t 2 − 4p). Although this algorithm has exponential complexity in general, it has polynomial complexity if the class number i... |

6 | N.: The vector decomposition problem for elliptic and hyperelliptic curves
- Duursma, Kiyavash
- 2005
(Show Context)
Citation Context ...s condition. It follows that CDH and VDP are equivalent in practice for supersingular curves. We also prove this equivalence for the non-supersingular genus 2 curves proposed by Duursma and Kiyavasch =-=[9]-=-. Our results therefore completely resolve the issue of the difficulty of the VDP in the groups considered by [22, 23, 9, 10]. Duursma and Park [10] proposed a signature scheme based on VDP. Our resul... |

5 | On the existence of distortion maps on ordinary elliptic curves. Cryptology ePrint Archive Report 2006/128. http://eprint.iacr.org/2006/128
- Charles
(Show Context)
Citation Context ...ector base one must take F to be an endomorphism which is not in Z[π] (where π is the q-power Frobenius) but which has (at least) two eigenspaces. Such endomorphisms may or may not exist (see Charles =-=[7]-=-). Distortion eigenvector bases do not exist when k = 1 since a further endomorphism is required which does not commute with F or π, and for elliptic curves there can be no such maps. We begin with th... |

5 | Further attacks on server-aided RSA cryptosystems. Unpublished manuscript
- McKee, Pinch
- 1998
(Show Context)
Citation Context ... of order r2 in (Z/nZ) ∗ where n = pq is a product of two primes such that r | (p − 1) and r | (q − 1). Care must be taken that r is not too large, or else it is easy to factor n (see McKee and Pinch =-=[17]-=-). This case has a very different flavour to the other groups described above, and the methods of the paper do not seem to apply in this case. Note that not all of the above groups will necessarily ha... |

3 |
Vector decomposition problem and the trapdoor inseparable multiplex transmission scheme based problem
- Yoshida, Mitsunari, et al.
- 2003
(Show Context)
Citation Context ...rithm problem. 1 Introduction The vector decomposition problem (VDP) is a computational problem in non-cyclic groups G (see Section 2 for the definition of this problem). It was introduced by Yoshida =-=[22, 23]-=- as an alternative to the discrete logarithm or Diffie-Hellman problems for the design of cryptographic systems. Yoshida proved that if certain conditions hold then the VDP is at least as hard as the ... |

3 |
Inseparable multiplex transmission using the pairing on elliptic curves and its application to watermarking
- Yoshida
- 2003
(Show Context)
Citation Context ...rithm problem. 1 Introduction The vector decomposition problem (VDP) is a computational problem in non-cyclic groups G (see Section 2 for the definition of this problem). It was introduced by Yoshida =-=[22, 23]-=- as an alternative to the discrete logarithm or Diffie-Hellman problems for the design of cryptographic systems. Yoshida proved that if certain conditions hold then the VDP is at least as hard as the ... |

1 | ElGamal type signature schemes for n-dimensional vector spaces, eprint 2006/311 - Duursma, Park |