## The elliptic curve discrete logarithm problem and equivalent hard . . . (2008)

Citations: | 2 - 1 self |

### BibTeX

@MISC{Lauter08theelliptic,

author = {Kristin E. Lauter and Katherine E. Stange},

title = {The elliptic curve discrete logarithm problem and equivalent hard . . . },

year = {2008}

}

### OpenURL

### Abstract

We define

### Citations

285 |
Reducing elliptic curve logarithms to logarithms in a finite field
- Menezes, Okamoto, et al.
- 1993
(Show Context)
Citation Context ...= fP(DQ), em(P, Q) = fP(DQ)fQ(DP) −1 . Both are non-degenerate bilinear pairings, while the Weil pairing is alternating. For details, see [4, 9]. The Tate pairing and Weil pairing are used in the MOV =-=[12]-=- and Frey-Rück [8] attacks on the ECDLP. These use the Weil and Tate pairings, respectively, to translate an instance of the ECDLP into an F∗ q DLP equation, where index calculus methods may be used. ... |

189 |
A remark concerning m-divisibility and the discrete logarithm in the divisor class group of curves
- Frey, Rück
- 1994
(Show Context)
Citation Context ...= fP(DQ)fQ(DP) −1 . Both are non-degenerate bilinear pairings, while the Weil pairing is alternating. For details, see [4, 9]. The Tate pairing and Weil pairing are used in the MOV [12] and Frey-Rück =-=[8]-=- attacks on the ECDLP. These use the Weil and Tate pairings, respectively, to translate an instance of the ECDLP into an F∗ q DLP equation, where index calculus methods may be used. The basic idea, il... |

108 | The arithmetic of elliptic curves, volume 106 of Graduate Texts in Mathematics - Silverman - 1986 |

55 | Field inversion and point halving revisited
- Fong, Hankerson, et al.
- 2004
(Show Context)
Citation Context ...If k is odd, find Q ′ such that [2]Q′ = Q − P. (3) Set Q = Q ′ and return to step 1. In Step 2, since the cyclic group 〈P 〉 has odd order, there is a unique Q ′. It can be found in O(log q) time (see =-=[11]-=- for methods). Furthermore, Q ′ = [k′]P where k ′ = { k/2 k even (k − 1)/2 k odd . Then k ′ is the minimal multiplier for Q ′ with respect to P. At the end of this process, the value of the original k... |

53 | Memoir on elliptic divisibility sequences - Ward |

19 | Elliptic Curves and Related Sequences - Swart - 2003 |

15 | Primitive divisors of elliptic divisibility sequences
- Everest, Mclaren, et al.
- 2006
(Show Context)
Citation Context ...an elliptic divisibility sequence. This relationship is the basis of our work here. The general theory has been developed by Swart [21], Ayad [1], Silverman [14, 15], Everest, McLaren and Thomas Ward =-=[5]-=- and, more recently, generalised to higher rank elliptic nets by Stange [18, 20]. For an overview of research, see [6]. Sections 2 and 3 provide brief background on elliptic divisibility sequences and... |

14 | H.G.: A remark concerning m-divisibility and the discrete logarithm problem in the divisor class group of curves - Frey, Rück - 1994 |

12 | p-adic properties of division polynomials and elliptic divisibility sequences
- Silverman
(Show Context)
Citation Context ...(n) = Ψn(P) for some fixed point P on E is an elliptic divisibility sequence. This relationship is the basis of our work here. The general theory has been developed by Swart [21], Ayad [1], Silverman =-=[14, 15]-=-, Everest, McLaren and Thomas Ward [5] and, more recently, generalised to higher rank elliptic nets by Stange [18, 20]. For an overview of research, see [6]. Sections 2 and 3 provide brief background ... |

11 |
Prime Numbers: A
- Crandall, Pomerance
(Show Context)
Citation Context ... ◦ ◦ ◦ ◦ • t −s −s −s In this picture of Z 2 , u = (−3, 1), s = (5, 0) and t = (0, 5). Vectors u and s generate the lattice of zero-apparition Λ for some elliptic net W associated to points P and Q = =-=[3]-=-P of order 5. The vector t is also in Λ. One coset of Z 2 modulo Λ is shown as the solid discs. Theorem 2.4 shows the transformation relative to translation by a vector r ∈ Λ: it relates W(v + r) to W... |

9 | Common divisors of elliptic divisibility sequences over function fields
- Silverman
(Show Context)
Citation Context ...(n) = Ψn(P) for some fixed point P on E is an elliptic divisibility sequence. This relationship is the basis of our work here. The general theory has been developed by Swart [21], Ayad [1], Silverman =-=[14, 15]-=-, Everest, McLaren and Thomas Ward [5] and, more recently, generalised to higher rank elliptic nets by Stange [18, 20]. For an overview of research, see [6]. Sections 2 and 3 provide brief background ... |

7 | Algorithmic number theory. Vol. 1. Foundations of Computing Series - Bach, Shallit - 1996 |

5 | The Tate pairing via elliptic nets
- Stange
- 2007
(Show Context)
Citation Context ...ed to an F∗ q DLP; this works in exactly the cases that the MOV or Frey-Rück attack applies. These sorts of ‘alternate versions’ of the MOV/Frey-Rück attack do have a relation to the Tate pairing. In =-=[19]-=-, Stange proves the following. Theorem 5.1 (Stange, [19]). Let E be an elliptic curve, m ≥ 4, and P ∈ E[m]. Let Q, S ∈ E be such that S ∈ {O, Q}. Let W be an elliptic net of rank n, associated to poi... |

5 | Background on curves and Jacobians. In Handbook of elliptic and hyperelliptic curve cryptography - Frey, Lange - 2006 |

4 |
Elliptic Divibility Sequences
- Shipsey
- 2001
(Show Context)
Citation Context ...n elliptic curve over a finite field K. Suppose there are points P, Q ∈ E(K) given such that Q ∈ 〈P 〉. Determine k such that Q = [k]P. This article is inspired by work of Rachel Shipsey in her thesis =-=[13]-=-, relating the ECDLP to elliptic divisibility sequences. An elliptic divisibility sequence is a recurrence sequence W(n) satisfying the relation W(n + m)W(n − m) = W(n + 1)W(n − 1)W(m) 2 − W(m + 1)W(m... |

4 |
Périodicité (mod q) des suites elliptiques et points S-entiers sur les courbes elliptiques
- Ayad
- 1993
(Show Context)
Citation Context ...f the form WE,P(n) = Ψn(P) for some fixed point P on E is an elliptic divisibility sequence. This relationship is the basis of our work here. The general theory has been developed by Swart [21], Ayad =-=[1]-=-, Silverman [14, 15], Everest, McLaren and Thomas Ward [5] and, more recently, generalised to higher rank elliptic nets by Stange [18, 20]. For an overview of research, see [6]. Sections 2 and 3 provi... |

4 |
Background on pairings. In Handbook of elliptic and hyperelliptic curve cryptography
- Duquesne, Frey
- 2006
(Show Context)
Citation Context ...m 10and Weil pairing by em : E(K)[m] × E(K)[m] → µm τm(P, Q) = fP(DQ), em(P, Q) = fP(DQ)fQ(DP) −1 . Both are non-degenerate bilinear pairings, while the Weil pairing is alternating. For details, see =-=[4, 9]-=-. The Tate pairing and Weil pairing are used in the MOV [12] and Frey-Rück [8] attacks on the ECDLP. These use the Weil and Tate pairings, respectively, to translate an instance of the ECDLP into an F... |

4 |
Elliptic functions, volume 281
- Chandrasekharan
(Show Context)
Citation Context ...K) be a point of order not less than 4. The x-coordinate of [n]P, x([n]P), can be calculated from WE,P(n − 1), WE,P(n), WE,P(n + 1). 6Proof. See any classic text on elliptic function theory (such as =-=[2]-=-) for the following identity: (4) WE,P(n − 1)WE,P(n + 1) WE,P(n) 2 = x(P) − x([n]P). Theorem 4.2 (Shipsey [13]). Let E be an elliptic curve over K, and P ∈ E(K) a point of order not less than 4. Given... |

3 | Elliptic nets and elliptic curves - Stange |

3 | In: Advances in elliptic curve cryptography. Volume 317 - Galbraith - 2005 |

3 | S.: An efficient algorithm for deciding quadratic residuosity in finite fields GF(p m - Itoh, Tsujii - 1989 |

2 | T.: Elliptic Divisibility Sequences. In: Recurrence Sequences - Everest, Poorten, et al. - 2003 |

2 | R.: Using somos sequences for cryptography - Gosper, Schroeppel |

2 |
Elliptic nets, generalised Jacobians and bi-extensions
- Stange
(Show Context)
Citation Context ...en t∏ ∏ WE,P(T tr (ei +ej)) vivj (2) WE,P(T tr (v)) = WE,T(P)(v) i=1 WE,P(T tr (ei)) v2 P i −vi( j=i vj) From this we can derive several useful corollaries. 3 1≤i<j≤tTheorem 2.3 (Ward [22], Stange, =-=[17, 20]-=-). Suppose that WE,P(m) = 0. Then for all l, v ∈ Z, we have where a = WE,P(lm + v) = WE,P(v)a vl b l2 WE,P(m + 2) WE,P(m + 1)WE,P(2) , b = WE,P(m + 1) 2 WE,P(2) WE,P(m + 2) Furthermore, a m = b 2 . Th... |

2 |
elliptic curve cryptography, volume 317
- Pairings
- 2005
(Show Context)
Citation Context ...m 10and Weil pairing by em : E(K)[m] × E(K)[m] → µm τm(P, Q) = fP(DQ), em(P, Q) = fP(DQ)fQ(DP) −1 . Both are non-degenerate bilinear pairings, while the Weil pairing is alternating. For details, see =-=[4, 9]-=-. The Tate pairing and Weil pairing are used in the MOV [12] and Frey-Rück [8] attacks on the ECDLP. These use the Weil and Tate pairings, respectively, to translate an instance of the ECDLP into an F... |

2 |
Elliptic Nets
- Stange
(Show Context)
Citation Context ...rk here. The general theory has been developed by Swart [21], Ayad [1], Silverman [14, 15], Everest, McLaren and Thomas Ward [5] and, more recently, generalised to higher rank elliptic nets by Stange =-=[18, 20]-=-. For an overview of research, see [6]. Sections 2 and 3 provide brief background on elliptic divisibility sequences and elliptic nets, more information about which can be found in [18, 19, 20]. The p... |

1 |
Elliptic nets and elliptic curves.http://arxiv.org/abs/0710.1316v1, submitted
- Stange
- 2007
(Show Context)
Citation Context ...rk here. The general theory has been developed by Swart [21], Ayad [1], Silverman [14, 15], Everest, McLaren and Thomas Ward [5] and, more recently, generalised to higher rank elliptic nets by Stange =-=[18, 20]-=-. For an overview of research, see [6]. Sections 2 and 3 provide brief background on elliptic divisibility sequences and elliptic nets, more information about which can be found in [18, 19, 20]. The p... |