Generating Genus Two Hyperelliptic Curves over Large Characteristic Finite Fields

Abstract

In hyperelliptic curve cryptography, finding a suitable hyperelliptic curve is an important fundamental problem. One of necessary conditions is that the order of its Jacobian is a product of a large prime number and a small number. In the paper, we give a probabilistic polynomial time algorithm to test whether the Jacobian of the given hyperelliptic curve of the form Y 2 = X 5 + uX 3 + vX satisfies the condition and, if so, to give the largest prime factor. Our algorithm enables us to generate random curves of the form until the order of its Jacobian is almost prime in the above sense. A key idea is to obtain candidates of its zeta function over the base field from its zeta function over the extension field where the Jacobian splits.

Four-Dimensional GLV via the Weil Restriction

“…It was shown [15,18,9, §2, §3, §4.1 resp.] that the Jacobian of C 1 is isogenous to E 1,c × E 1,c , where…”

“…More precisely, the Jacobian of C 1 is isogenous to E 1,c × E 1,c and the Jacobian of C 2 is isogenous to E 2,c × E 2,−c . These two Jacobians were proposed for use in cryptography by Satoh [18] and Freeman and Satoh [9], who showed that they are isogenous over F p to the Weil restriction of a curve of the form E 1,c or E 2,c . This property is exploited to derive fast point counting algorithms and pairing-friendly constructions [18,9,13].…”

Deterministic Encoding and Hashing to Odd Hyperelliptic Curves

“…This has numerous applications, e.g. to encryption; -in genus 1, it provides an encoding to supersingular elliptic curves, similar to Boneh and Franklin's construction [4], but for different base fields; -in higher genus, many cryptographically interesting curves are of the form H, including the curves considered in [14,16,25]; -many constructions of pairing-friendly hyperelliptic curves yield curves of the form H [21,13]; -since the encoding has a simple geometric description, it is easy to obtain well-behaved hash functions from it, and the corresponding regularity bounds are optimally tight.…”

“…-the supersingular elliptic curves of Joux [19]: y 2 = x 3 + ax; -the genus 2 curves studied by Furukawa et al [14] and their extension to genus g by Haneda et al [16]: y 2 = x 2g+1 + ax (for which one can compute the zeta function); -in particular, the Type II pairing-friendly curves of genus 2 constructed by Kawazoe and Takahashi [21]; -the genus 2 hyperelliptic curves for which Satoh [25] gave an efficient class group counting algorithm: y 2 = x 5 + ax 3 + bx; -in particular, some of the pairing-friendly genus 2 curves constructed by Freeman and Satoh [13] (although the case q ≡ 1 (mod 4) is more common).…”

“…-In the general case, we see that #H(F q n ) = q n + 1 for any odd extension degree n. This gives some constraints on the zeta function of H, but in genus g ≥ 2, many isogeny classes are possible for the Jacobian J of H nonetheless, so the proposed encoding applies to a wide range of curves. It is not always easy to determine the order of J(F q ): an approach is given by Satoh in [25] for g = 2.…”