Speeding up the Discrete Log Computation on Curves with Automorphisms

Duursma, Iwan; Gaudry, Pierrick; Morain, François

doi:10.1007/978-3-540-48000-6_10

Cited by 65 publications

(66 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The Pollard rho algorithm can be sped up by a constant factor if the presence of automorphisms on C is exploited [39,15]. Let m denote the cardinality of the automorphism group, Aut(C), which we assume is cyclic 2 with generator ψ; in genus 2, ψ extends in the natural way to J C under the canonical embedding described above.…”

Section: Preliminariesmentioning

confidence: 99%

“…It is well known that certain practical issues are encountered when exploiting the automorphism optimization [39,18,15,9,6]. Walks will end up in fruitless cycles -endless small loops where many fruitless collisions are found over-and-over again (the collisions are fruitless because they have the same a i and b i ).…”

Section: Handling Fruitless Cyclesmentioning

confidence: 99%

“…[22,12,8,2]). It is well-known that this algorithm can be optimized by a constant factor when the target curve comes equipped with an efficiently computable group automorphism [39,15]. For example, all elliptic curves can efficiently compute the inverse of a point and this negation map can be used to speed up the run-time by at most a factor √ 2.…”

Section: Introductionmentioning

confidence: 99%

“…The practical potential of genus 2 curves in public-key cryptography has recently been highlighted by the fast performance numbers presented in [7]. For cryptographically interesting curves over large prime fields, it is possible to achieve larger automorphism groups in genus 2 (see [15]). This not only aids the cryptographer (e.g.…”

Section: Introductionmentioning

confidence: 99%

“…This not only aids the cryptographer (e.g. [17,7]), but also the cryptanalyst: one can expect a larger speed-up when computing the (H)ECDLP on curves from these families [15].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Elliptic and Hyperelliptic Curves: A Practical Security Analysis

Bos

Costello

Miele

2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Motivated by the advantages of using elliptic curves for discrete logarithm-based public-key cryptography, there is an active research area investigating the potential of using hyperelliptic curves of genus 2. For both types of curves, the best known algorithms to solve the discrete logarithm problem are generic attacks such as Pollard rho, for which it is well-known that the algorithm can be sped up when the target curve comes equipped with an efficiently computable automorphism. In this paper we incorporate all of the known optimizations (including those relating to the automorphism group) in order to perform a systematic security assessment of two elliptic curves and two hyperelliptic curves of genus 2. We use our software framework to give concrete estimates on the number of core years required to solve the discrete logarithm problem on four curves that target the 128-bit security level: on the standardized NIST CurveP-256, on a popular curve from the Barreto-Naehrig family, and on their respective analogues in genus 2.

show abstract

Section: Preliminariesmentioning

confidence: 99%

Section: Handling Fruitless Cyclesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…This not only aids the cryptographer (e.g. [17,7]), but also the cryptanalyst: one can expect a larger speed-up when computing the (H)ECDLP on curves from these families [15].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Elliptic and Hyperelliptic Curves: A Practical Security Analysis

Bos

Costello

Miele

2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

Jamming resistant non‐interactive anonymous and unlinkable authentication scheme for mobile satellite networks

Ibrahim

Kumari

Das

et al. 2016

Security Comm Networks

View full text Add to dashboard Cite

Most of the previously proposed schemes use temporary identities for mobile users to provide unlinkable anonymous authentication for mobile users to the satellite network control center (NCC), where the temporary identities are picked at random after each session and agreed between a mobile user U and the NCC for the next session. Although such schemes provide full anonymity and are computationally efficient, the common problem with such strategies is that an adversary is able to desynchronize the temporary identity shared between U and NCC by means of simple jamming attack at a certain round in the authentication protocol. It results in the denial of all future sessions unless U re‐registers a new identity at the NCC. In this paper, we propose a new authentication scheme for mobile satellite networks. We avoid using synchronized temporary identities, which are always vulnerable to desynchronization attacks. We also avoid multi‐round authentication phase in order to reduce the jamming effect. Instead, a mobile user is able to create a new blinded version of his clear identity for each established session noninteractively, allowing him to anonymously authenticate himself to NCC in a fully unlinkable fashion. Moreover, in few milliseconds and one move non‐interactive way, U is able to establish a session key with NCC in a fully anonymous and authenticated way. Our new scheme uses recent advances in elliptic curve cryptography, and hence, it is efficient for implementation on mobile devices with limited resources. Through the rigorous security analysis using the broadly accepted Burrows–Abadi–Needham logic, informal security analysis, and the simulation for formal security verification using the widely known automated validation of Internet security protocols and sapplications tool, we show that our scheme is secure against various known attacks. Copyright © 2017 John Wiley & Sons, Ltd.

show abstract