The GHS attack revisited

Authors:
Florian Hess
Affiliations:
Computer Science Department, University of Bristol, UK
Venue:
EUROCRYPT'03 Proceedings of the 22nd international conference on Theory and applications of cryptographic techniques
Year:
2003

Citing 7
Cited 2

A remark concerning m-divisibility and the discrete logarithm in the divisor class group of curves

Mathematics of Computation
Elliptic curves in cryptography

Elliptic curves in cryptography
Computing Riemann---Roch spaces in algebraic function fields and related topics

Journal of Symbolic Computation
Analysis of the Weil Descent Attack of Gaudry, Hess and Smart

CT-RSA 2001 Proceedings of the 2001 Conference on Topics in Cryptology: The Cryptographer's Track at RSA
Extending the GHS Weil Descent Attack

EUROCRYPT '02 Proceedings of the International Conference on the Theory and Applications of Cryptographic Techniques: Advances in Cryptology
A Secure Family of Composite Finite Fields Suitable for Fast Implementation of Elliptic Curve Cryptography

INDOCRYPT '01 Proceedings of the Second International Conference on Cryptology in India: Progress in Cryptology
Analysis of the GHS Weil Descent Attack on the ECDLP over Characteristic Two Finite Fields of Composite Degree

INDOCRYPT '01 Proceedings of the Second International Conference on Cryptology in India: Progress in Cryptology

Elliptic Curve Cryptosystems in the Presence of Permanent and Transient Faults

Designs, Codes and Cryptography
Index calculus for abelian varieties of small dimension and the elliptic curve discrete logarithm problem

Journal of Symbolic Computation

Quantified Score

Hi-index	0.00

Visualization

Abstract

We generalize the Weil descent construction of the GHS attack to arbitrary Artin-Schreier extensions. We give a formula for the characteristic polynomial of Frobenius of the obtained curves and prove that the large cyclic factor of the input elliptic curve is not contained in the kernel of the composition of the conorm and norm maps. As an application we almost square the number of elliptic curves which succumb to the basic GHS attack, thereby weakening curves over F2155 further. We also discuss other possible extensions or variations of the GHS attack and conclude that they are not likely to yield further improvements.