Deterministic Encoding and Hashing to Odd Hyperelliptic Curves

Abstract

Abstract. In this paper we propose a very simple and efficient encoding function from Fq to points of a hyperelliptic curve over Fq of the form H :where f is an odd polynomial. Hyperelliptic curves of this type have been frequently considered in the literature to obtain Jacobians of good order and pairing-friendly curves.Our new encoding is nearly a bijection to the set of Fq-rational points on H. This makes it easy to construct well-behaved hash functions to the Jacobian J of H, as well as injective maps to J(Fq) which can be used to encode scalars for such applications as ElGamal encryption.The new encoding is already interesting in the genus 1 case, where it provides a well-behaved encoding to Joux's supersingular elliptic curves.

Verified indifferentiable hashing into elliptic curves

“…A number of highly relevant cryptographic constructions, including identity based schemes [8] and password based key exchange protocols [7], require hashing into elliptic curves. Indeed, there have been a number of proposals for such hash functions, see for instance [17,21,27]. Recently, Farashahi et al [15] developed powerful techniques to show the indifferentiability of hash function constructions based on deterministic encodings.…”

Injective Encodings to Elliptic Curves

“…the point at infinity and those of the form (x, 0)), and T ⊂ F q the set of roots of f in F q . In [9], we proved:…”

“…We can thus use the results of [9] to obtain an "almost bijective" map F q → H 0 (F q ), as well as a ν − O(1) -injective encoding to the Jacobian of H 0 . Therefore, we concentrate on the case when g is even, which we study in more details from now.…”

“…This gives, again, an optimal injective encoding to G = E(F q ). Similarly, the genus 1 case of the construction we proposed in [9] provides an optimal injective encoding to supersingular elliptic curves of the form:…”

“…Our construction is based on the bijective encoding from [9] to certain hyperelliptic curves of genus 2 and 3, and on the observation from [10] that those curves are quadratic covers of elliptic curves.…”