Algebraic Approaches for the Elliptic Curve Discrete Logarithm Problem over Prime Fields

Abstract

The elliptic curve discrete logarithm problem is one of the most important problems in cryptography. In recent years, several index calculus algorithms have been introduced for elliptic curves defined over extension fields, but the most important curves in practice, defined over prime fields, have so far appeared immune to these attacks. In this paper we formally generalize previous attacks from binary curves to prime curves. We study the efficiency of our algorithms with computer experiments and we discuss their current and potential impact on elliptic curve standards. Our algorithms are only practical for small parameters at the moment and their asymptotic analysis is limited by our understanding of Gröbner basis algorithms. Nevertheless, they highlight a potential vulnerability on prime curves which our community needs to explore further.

On the security properties of Russian standardized elliptic curves

“…p group should not have many small subgroups. In 2016 Petit, Kosters and Messeng [20] had proposed an algorithm that solves DLP in the groups of elliptic curve points defined over finite fields of large characteristic. This algorithm is based on the factor base algorithm.…”

“…Here we give a brief description of the algorithm proposed by Petit, Kosters and Messeng in [20] and prove Estimate. Here we denote by K the algebraic closure of a field K and by the expression "a ∈ R B" we mean "a is taken uniformly random from the set B".…”

“…The algorithm proposed by Petit, Kosters and Messeng in [20] uses so called factor bases (see [21]). Suppose Ω is some factor base which consists of elliptic curve points.…”

“…, x m,1 . The authors of [20] write down these constraints as a system of additional polynomial equations which are satisfied if and only if a point specified by its coordinates belongs to Ω.…”

“…The authors of [20] propose to define factor base Ω as a set of points having abscissas belonging to some subgroup of a multiplicative group of a finite field the curve is defined on. Suppose the following equality holds:…”