Constructive and destructive facets of Weil descent on elliptic curves

Abstract

Abstract. In this paper we look in detail at the curves which arise in the method of Galbraith and Smart for producing curves in the Weil restriction of an elliptic curve over a nite eld of characteristic two of composite degree. We explain how this method can be used to construct hyperelliptic cryptosystems which could be as secure as cryptosystems based on the original elliptic curve. On the other hand, we show that the same technique may provide a way of attacking the original elliptic curve cryptosystem using recent advances in the study of the discrete logarithm problem on hyperelliptic curves.We examine the resulting higher genus curves in some detail and propose an additional check on elliptic curve systems de ned over elds of characteristic two so as to make them immune from the methods in this paper. IntroductionIn this paper we address two problems: how to construct hyperelliptic cryptosystems and how to attack elliptic curve cryptosystems de ned over elds of composite degree over F 2 .As explained in 17], there is currently no practical method which generates cryptographically secure Jacobians of hyperelliptic curves that have no special added structure. We shall present a method that will produce a hyperelliptic Jacobian related to a`random' elliptic curve, which is secure assuming one believes the discrete logarithm problem on the elliptic curve is itself hard.For the second problem we turn our construction of hyperelliptic cryptosystems on its head and argue that this provides evidence for the weakness of the original elliptic curve discrete logarithm problem. We stress that this does not provide evidence for the weakness of elliptic curve systems in general, but only those which are de ned over the special nite elds considered in this paper. These elds are extensions of composite degree over the eld F 2 .Let

How Secure Are Elliptic Curves over Composite Extension Fields?

“…The main result from [8] is the following: From an ECDLP in E(K), i.e. P 2 = [λ]P 1 with λ ∈ (Z/sZ) * , one can construct a hyperelliptic curve H of genus g over k and two divisors D 1 and D 2 of order s in Jac k (H) such that…”

“…We note that the construction of [8] is very fast and that the genus g is almost always equal to 2 n−1 for curves of cryptographic interest. There is a small probability that the construction does not actually work in practice, but for real life examples this can usually be ignored.…”

“…In [8] it is argued that for small fixed n, and hence essentially fixed g, this provides evidence for the weakness of the ECDLP on curves defined over composite extension fields, at least asymptotically. However, the asymptotic complexity hides a very bad dependence on g, and hence such a conclusion may not be able to be substantiated on curves over field sizes of cryptographic interest.…”

“…However, recent work of Frey, Galbraith, Gaudry, Hess and Smart, see [5], [6] and [8], has cast doubt on the claim that composite extension fields offer about the same security as those fields defined in the standards. This recent work is based on the technique of Weil descent.…”

“…We shall concentrate solely on the case of characteristic two, which is important in applications. In section 2 we shall review the method of Weil restriction from [8]. In section 3 we examine in more detail Gaudry's method and explain a very efficient implementation of it.…”