2014/09/16 by Benjamin Smith, Smith, Benjamin
Computer Science · Mathematics · #Coding theory and cryptography #Cryptographic Implementations and Security #Cryptography and Residue Arithmetic #cs.CR #math.NT
paper · pdf · doi:10.48550/arxiv.1409.4526
To appear in the Journal of Cryptology. arXiv admin note: text overlap with arXiv:1305.5400
arxiv created 2015/03/24 · arxiv updated 2015/03/25
We give a detailed account of the use of ℚ-curve reductions to construct elliptic curves over \mathbbF_p2 with efficiently computable endomorphisms, which can be used to accelerate elliptic curve-based cryptosystems in the same way as Gallant--Lambert--Vanstone (GLV) and Galbraith--Lin--Scott (GLS) endomorphisms. Like GLS (which is a degenerate case of our construction), we offer the advantage over GLV of selecting from a much wider range of curves, and thus finding secure group orders when \(p\) is fixed for efficient implementation. Unlike GLS, we also offer the possibility of constructing twist-secure curves. We construct several one-parameter families of elliptic curves over \mathbbF_p2 equipped with efficient endomorphisms for every p \textgreater 3, and exhibit examples of twist-secure curves over \mathbbF_p2 for the efficient Mersenne prime p = 2127-1.