67 research outputs found
Families of fast elliptic curves from Q-curves
We construct new families of elliptic curves over \FF_{p^2} with
efficiently computable endomorphisms, which can be used to accelerate elliptic
curve-based cryptosystems in the same way as Gallant-Lambert-Vanstone (GLV) and
Galbraith-Lin-Scott (GLS) endomorphisms. Our construction is based on reducing
\QQ-curves-curves over quadratic number fields without complex
multiplication, but with isogenies to their Galois conjugates-modulo inert
primes. As a first application of the general theory we construct, for every
, two one-parameter families of elliptic curves over \FF_{p^2}
equipped with endomorphisms that are faster than doubling. Like GLS (which
appears as a degenerate case of our construction), we offer the advantage over
GLV of selecting from a much wider range of curves, and thus finding secure
group orders when is fixed. Unlike GLS, we also offer the possibility of
constructing twist-secure curves. Among our examples are prime-order curves
equipped with fast endomorphisms, with almost-prime-order twists, over
\FF_{p^2} for and
The Q-curve construction for endomorphism-accelerated elliptic curves
We give a detailed account of the use of -curve reductions to
construct elliptic curves over with efficiently computable
endomorphisms, which can be used to accelerate elliptic curve-based
cryptosystems in the same way as Gallant--Lambert--Vanstone (GLV) and
Galbraith--Lin--Scott (GLS) endomorphisms. Like GLS (which is a degenerate case
of our construction), we offer the advantage over GLV of selecting from a much
wider range of curves, and thus finding secure group orders when is fixed
for efficient implementation. Unlike GLS, we also offer the possibility of
constructing twist-secure curves. We construct several one-parameter families
of elliptic curves over equipped with efficient
endomorphisms for every p \textgreater{} 3, and exhibit examples of
twist-secure curves over for the efficient Mersenne prime
.Comment: To appear in the Journal of Cryptology. arXiv admin note: text
overlap with arXiv:1305.540
Easy scalar decompositions for efficient scalar multiplication on elliptic curves and genus 2 Jacobians
The first step in elliptic curve scalar multiplication algorithms based on
scalar decompositions using efficient endomorphisms-including
Gallant-Lambert-Vanstone (GLV) and Galbraith-Lin-Scott (GLS) multiplication, as
well as higher-dimensional and higher-genus constructions-is to produce a short
basis of a certain integer lattice involving the eigenvalues of the
endomorphisms. The shorter the basis vectors, the shorter the decomposed scalar
coefficients, and the faster the resulting scalar multiplication. Typically,
knowledge of the eigenvalues allows us to write down a long basis, which we
then reduce using the Euclidean algorithm, Gauss reduction, LLL, or even a more
specialized algorithm. In this work, we use elementary facts about quadratic
rings to immediately write down a short basis of the lattice for the GLV, GLS,
GLV+GLS, and Q-curve constructions on elliptic curves, and for genus 2 real
multiplication constructions. We do not pretend that this represents a
significant optimization in scalar multiplication, since the lattice reduction
step is always an offline precomputation---but it does give a better insight
into the structure of scalar decompositions. In any case, it is always more
convenient to use a ready-made short basis than it is to compute a new one
The geometry of efficient arithmetic on elliptic curves
The arithmetic of elliptic curves, namely polynomial addition and scalar
multiplication, can be described in terms of global sections of line bundles on
and , respectively, with respect to a given projective embedding
of in . By means of a study of the finite dimensional vector
spaces of global sections, we reduce the problem of constructing and finding
efficiently computable polynomial maps defining the addition morphism or
isogenies to linear algebra. We demonstrate the effectiveness of the method by
improving the best known complexity for doubling and tripling, by considering
families of elliptic curves admiting a -torsion or -torsion point
Easy scalar decompositions for efficient scalar multiplication on elliptic curves and genus 2 Jacobians
International audienceThe first step in elliptic curve scalar multiplication algorithms based on scalar decompositions using efficient endomorphisms---including Gallant--Lambert--Vanstone (GLV) and Galbraith--Lin--Scott (GLS) multiplication, as well as higher-dimensional and higher-genus constructions---is to produce a short basis of a certain integer lattice involving the eigenvalues of the endomorphisms. The shorter the basis vectors, the shorter the decomposed scalar coefficients, and the faster the resulting scalar multiplication. Typically, knowledge of the eigenvalues allows us to write down a long basis, which we then reduce using the Euclidean algorithm, Gauss reduction, LLL, or even a more specialized algorithm. In this work, we use elementary facts about quadratic rings to immediately write down a short basis of the lattice for the GLV, GLS, GLV+GLS, and Q-curve constructions on elliptic curves, and for genus 2 real multiplication constructions. We do not pretend that this represents a significant optimization in scalar multiplication, since the lattice reduction step is always an offline precomputation---but it does give a better insight into the structure of scalar decompositions. In any case, it is always more convenient to use a ready-made short basis than it is to compute a new one
Computing cardinalities of Q-curve reductions over finite fields
We present a specialized point-counting algorithm for a class of elliptic
curves over F\_{p^2} that includes reductions of quadratic Q-curves modulo
inert primes and, more generally, any elliptic curve over F\_{p^2} with a
low-degree isogeny to its Galois conjugate curve. These curves have interesting
cryptographic applications. Our algorithm is a variant of the
Schoof--Elkies--Atkin (SEA) algorithm, but with a new, lower-degree
endomorphism in place of Frobenius. While it has the same asymptotic asymptotic
complexity as SEA, our algorithm is much faster in practice.Comment: To appear in the proceedings of ANTS-XII. Added acknowledgement of
Drew Sutherlan
FourQ: four-dimensional decompositions on a Q-curve over the Mersenne prime
We introduce FourQ, a high-security, high-performance elliptic curve that targets the 128-bit security level. At the highest arithmetic level, cryptographic scalar multiplications on FourQ can use a four-dimensional Gallant-Lambert-Vanstone decomposition to minimize the total number of elliptic curve group operations. At the group arithmetic level, FourQ admits the use of extended twisted Edwards coordinates and can therefore exploit the fastest known elliptic curve addition formulas over large prime characteristic fields. Finally, at the finite field level, arithmetic is performed modulo the extremely fast Mersenne prime . We show that this powerful combination facilitates scalar multiplications that are significantly faster than all prior works. On Intel\u27s Broadwell, Haswell, Ivy Bridge and Sandy Bridge architectures, our software computes a variable-base scalar multiplication in 50,000, 56,000, 69,000 cycles and 72,000 cycles, respectively; and, on the same platforms, our software computes a Diffie-Hellman shared secret in 80,000, 88,000, 104,000 cycles and 112,000 cycles, respectively. These results show that, in practice, FourQ is around four to five times faster than the original NIST P-256 curve and between two and three times faster than curves that are currently under consideration as NIST alternatives, such as Curve25519
Fast and Frobenius: Rational Isogeny Evaluation over Finite Fields
Consider the problem of efficiently evaluating isogenies of
elliptic curves over a finite field , where the kernel is a cyclic group of odd (prime) order: given , , and a
point (or several points) on , we want to compute . This
problem is at the heart of efficient implementations of group-action- and
isogeny-based post-quantum cryptosystems such as CSIDH. Algorithms based on
V{\'e}lu's formulae give an efficient solution to this problem when the kernel
generator is defined over . However, for general isogenies,
is only defined over some extension , even though
as a whole (and thus ) is defined over the base field
; and the performance of V{\'e}lu-style algorithms degrades
rapidly as grows. In this article we revisit the isogeny-evaluation problem
with a special focus on the case where . We improve
V{\'e}lu-style isogeny evaluation for many cases where using special
addition chains, and combine this with the action of Galois to give greater
improvements when
Fast algorithms for computing isogenies between elliptic curves
We survey algorithms for computing isogenies between elliptic curves defined
over a field of characteristic either 0 or a large prime. We introduce a new
algorithm that computes an isogeny of degree ( different from the
characteristic) in time quasi-linear with respect to . This is based in
particular on fast algorithms for power series expansion of the Weierstrass
-function and related functions
- …