How Secure Are Elliptic Curves over Composite Extension Fields?

Authors:
Nigel P. Smart
Affiliations:
-
Venue:
EUROCRYPT '01 Proceedings of the International Conference on the Theory and Application of Cryptographic Techniques: Advances in Cryptology
Year:
2001

Citing 9
Cited 2

Use of elliptic curves in cryptography

Lecture notes in computer sciences; 218 on Advances in cryptology---CRYPTO 85
Hyperelliptic cryptosystems

Journal of Cryptology
Euclid's algorithm and the lanczos method over finite fields

Mathematics of Computation
Elliptic curves in cryptography

Elliptic curves in cryptography
Analysis of the Weil Descent Attack of Gaudry, Hess and Smart

CT-RSA 2001 Proceedings of the 2001 Conference on Topics in Cryptology: The Cryptographer's Track at RSA
The Solution of McCurley's Discrete Log Challenge

CRYPTO '98 Proceedings of the 18th Annual International Cryptology Conference on Advances in Cryptology
An Algorithm of Subexponential Type Computing the Class Group of Quadratic Orders over Principal Ideal Domains

ANTS-II Proceedings of the Second International Symposium on Algorithmic Number Theory
Comparing Real and Imaginary Arithmetics for Divisor Class Groups of Hyperelliptic Curves

ANTS-III Proceedings of the Third International Symposium on Algorithmic Number Theory
An algorithm for solving the discrete log problem on hyperelliptic curves

EUROCRYPT'00 Proceedings of the 19th international conference on Theory and application of cryptographic techniques

A Secure Family of Composite Finite Fields Suitable for Fast Implementation of Elliptic Curve Cryptography

INDOCRYPT '01 Proceedings of the Second International Conference on Cryptology in India: Progress in Cryptology
A Low-Power Design for an Elliptic Curve Digital Signature Chip

CHES '02 Revised Papers from the 4th International Workshop on Cryptographic Hardware and Embedded Systems

Quantified Score

Hi-index	0.01

Visualization

Abstract

We compare the method of Weil descent for solving the ECDLP, over extensions fields of composite degree in characteristic two, against the standard method of parallelised Pollard rho. We give details of a theoretical and practical comparison and then use this to analyse the difficulty of actually solving the ECDLP for curves of the size needed in practical cryptographic systems. We show that composite degree extensions of degree divisible by four should be avoided. We also examine the elliptic curves proposed in the Oakley key determination protocol and show that with current technology they remain secure.