Abstract

In this paper, we aim at characterizing elliptic curve traces by FR-reduction and investigate explicit conditions of traces vulnerable or secure against FR-reduction. We show new explicit conditions of elliptic curve traces for FRreduction. We also present algorithms to construct such elliptic curves, which have relation to famous number theory problems. key words: elliptic curve cryptosystems, trace, FRreduction 1. Introduction Koblitzand Miller proposed ind end tly a public key cryptosystembased on an elliptic curve E d2EO8 over a finitefield F q (q = p r )([19], [ 5]). If elliptic curve cryptosystems satisfy socalled FRcondO0GO2 ([11], [17], [ 4])and avoid anomalous elliptic curve over F q ([3], [33], [35]), then the only known attacks are the Pollard #-method ([ 7])and the Pohlig-Hellman method ([ 6]). Hence with current knowledEL we can construct elliptic curve cryptosystems over a smallerdaller2L field than thede2OAOS logarithm problem(DLP)-based cryptosystems like the ElGamal cryptosystems ([13]) or the DSA ([1 ])and RSA cryptosystems ([ 8]). Elliptic curve cryptosystems with a 160-bit key are Manuscript received August 31, 2000. Manuscript revised August 31, 2000. The author is with Japan Advanced Institute of Science and Technology, Ishikawa-ken, 923-1292 Japan. The author is with Matsushita Communication Industrial Co., Ltd., Kanagawa-ken, 223-8639 Japan. This work was conducted when he was with JAIST. thus believed to have the same security as both the ElGamal cryptosystemsand RSA cryptosystems with a 1,0 4-bit key. Recently some researches on comparing MOV and FR-redgAGSSE have been reported in [15], [18]. These attacks imbed a subgroup # E(F q )toF # q k for an extensionfield F q kand red -2 ECDLPbased on # E(F q ) to DLP based ...

Citations