A. Menezes, Y. Wu, R. Zuccherato. An Elementary Introduction to Hyperelliptic Curves. Technical Report CORR 96-19, University of Waterloo(1996), Canada. Available at http://www.cacr.math.uwaterloo.ca.  Home/Search   Document Not in Database   Summary   Related Articles   Check

.... the set of divisors which can be defined by functions k(x; y) 2 F q (x; y) y f(x)y h(x) the principal divisors) The more detailed definition is more complicated, and will be postponed to another Cryptography Workinggroup Day (maybe ) however, the interested reader can find a reference in [20]. To get the Jacobian we consider the quotientgroup J = D =P. The number of elements of the Jacobian is bounded by the theorem of Weil, which tells that: q 1) #J ( q 1) 3.1 Counting points on hyperelliptic curves It is much harder to count the points on hyperelliptic ....

Alfred J. Menezes, Yi--Hong Wu, Robert J. Zuccherato, An elementary introduction to hyperelliptic curves, Algebraic Aspects of Cryptography, (Neal Koblitz), ACM 3, Springer--Verlag, Berlin (1996).

....of such curves to obtain short signatures keeping the same MOV exponent. However, our approach starts from an ordinary curve and was already given by the author in her thesis [19] 2 Background for the Construction For a basic introduction to hyperelliptic curves see Menezes, Wu, and Zuccherato [25], more mathematical background can be found in Lorenzini [23] and Stichtenoth [34] We brie y state what is needed on general hyperelliptic curves in the sequel. A hyperelliptic curve of genus g over a prime eld of odd characteristic having at least one IF p rational Weierstra point can be ....

A. Menezes, Y.-H. Wu, and R. Zuccherato. An Elementary Introduction to Hyperelliptic Curves. In N. Koblitz, editor, Algebraic Aspects of Cryptography, pages 155-178. Springer, 1998.

....DeMarrais and Huang gave a sub exponential time algorithm to solve HCDLP in [1] Further study by Gaudry in [7] suggested that g 4. Therefore, We will consider hyperelliptic curves C : y h(x)y = f(x) of genus g 4 over F q , and 2 . When q is prime, according to Lemma 2 in [13], Equation (1) can be transformed to the form = f(x) by replacing y by y h(x) 2. Here f(x) has a degree 2g 1. When q = 2 , the following propositions hold. Proposition 1. 5] Let C be a genus 2 curve over F 2 m of the form y by = f(x) where f(x) is monic of degree 5 and b F # ....

....curve C, denoted by #J(C,F q ) should be chosen such that #J(C,F q ) contains a large prime divisor. Suppose that #J(C,F q ) vn, where n is a prime. Then the best known algorithm up to now for the HCDLP is of complexity O( # n) In this sequel, we limit v . According to Corollary 55 in [13], we have ( # q 1) #J(C,F q ) # q 1) Then we can use log ( # q 1) bit to represent #J(C,F q ) Let t = q 1 #J(C,F q ) It is easy to see that t # j=1 # g j 2 ( 1) 2gq . Hence t has 1 log 2 (2gq ) bits. It is easy to see that #J(C,F q ) is ....

A. Menezes, Y. Wu, R. Zuccherato, An Elementary Introduction to Hyperelliptic Curves. In: Koblitz, N., Algebraic Aspects of Cryptography, Springer-Verlag Berlin Heidelberg 1998. Available at http://www.cacr.math.uwaterloo.ca/techreports/1997/tech reports97.html

....on Elliptic and Hyperelliptic Curves In this section we brie y sketch what is needed in the remainder of this paper. As elliptic curves are hyperelliptic curves of genus 1 the results stated below apply to this case as well. The interested reader is referred to Menezes, Wu, and Zuccherato [12], Lorenzini [10] and Stichtenoth [19] for more details and proofs. Let IF q be a nite eld of characteristic p; q = p , and let IF q denote the algebraic closure of IF q . De nition 2.1 Let IF q (C) IF q be a quadratic function eld de ned via an equation h(x)y = f(x) in IF q [x; ....

A. Menezes, Y.-H. Wu, and R. Zuccherato. An Elementary Introduction to Hyperelliptic Curves. In Algebraic Aspects of Cryptography [5].

.... Discrete Logarithm Problem (DLP) in the group of points defined by an elliptic curve over a finite field, we require field sizes of roughly 2 150 to 2 256 elements [Xx98a] For algorithms based on the DLP in the jacobian of a hyperelliptic curve, we require 2 30 to 2 130 elements [Pau96] Alf96] In this report we are primarly concerned with elliptic curve systems. 4.1 Addition and Subtraction Addition and subtraction of two field elements is implemented in a straightforward manner by adding or subtracting the coefficients of their polynomial representation and if necessary, ....

Alfred J. Menezes, Yi-Hong Wu, and Robert J. Zuccherato. An elementary introduction to hyperelliptic curves. Personal correspondence, November 1996.

....software cryptography for smart cards requires more radical changes to the approach. Second possibility is to use optimal extension fields to make calculations faster [20] Further, the use of hyperelliptic curves and public key cryptography based on them has been suggested by some mathematicians [22]. Hyperelliptic curves are, however, mathematically even more challenging than elliptic curves. Some of the details, which are essential from the implementation point of view, like the representation of the point entities, have not yet been standardized [23] Yet another approach is to use ....

A. Menezes, Y. Wu and R. Zuccherato, An Elementary Introduction to Hyperelliptic Curves, In: N. Koblitz: Algebraic Aspects of Cryptography. Springer-Verlag, Berlin Heidelberg New York (1998).

....Finally we describe the cryptographic setting which underlies our comparative study in Section 1.4. 1 1. 1 Hyperelliptic curves and their Jacobians We introduce some basic facts about hyperelliptic curves; proofs can be found in the excellent elementary introduction by Menezes, Wu and Zuccherato [MWZ98]. Let K = F q = F p m be the nite eld of characteristic p with q elements and K its algebraic closure. A hyperelliptic curve of genus g is the projective closure of a non singular ane curve of the type H : Y 2 hY = f; where h 2 K[X] is of degree at most g and f 2 K[X] is monic of degree ....

.... 1 u 1 a 1 (b 2 b 1 ) u 3 (f b 2 1 b 1 h) d mod a: This composition algorithm goes back to Gau , who described an analogous procedure for composing binary quadratic forms in [Gau01] Article 242; its ecient application is due to Shanks ( Sha71] Note that the formula for b in Algorithm 1 of [MWZ98] is less ecient than the one presented here, which is the generalisation of Formula (C 3a ) in [Can87] to the arbitrary characteristic case. The extended Euclidian algorithm To complete the description of the composition step and to x the notation for the rest of this article, we recall the ....

[Article contains additional citation context not shown here]

Alfred J. Menezes, Yi-Hong Wu, and Robert J. Zuccherato. An elementary introduction to hyperelliptic curves. In [Kob98], pages 155-178. Springer-Verlag, 1998.

....curve cryptosystems have been introduced by Neal Koblitz [10] in 1989 and turned out to be a rich source of finite abelian groups for defining one way functions. Cantor s algorithm [2] provides an effective algorithm for performing the group law in the Jacobian of a hyperelliptic curve (see also [13, 15, 24, 25] for improvements or efficient realizations) An analysis [25] shows that doubling and adding have about the same complexity. A generalization of the methods in [6, 28] shows that one can speed up the attack to hyperelliptic cryptosystems by a factor of p 2l, if the curve has an automorphism of ....

....can be even shortened and give numerical evidence for the speed up. Speeding up the Arithmetic on Koblitz Curves of Genus Two 4 2 Hyperelliptic Curves 2.1 Basic Definitions In this section we provide the basic definitions and properties of hyperelliptic curves over finite fields. We refer to [10, 15, 2, 26]. Let F be a finite field. A (non singular) hyperelliptic curve of genus g is defined by the equation C : v 2 h(u)v = f(u) in F[u; v] 2.1) where h(u) f(u) 2 F[u] deg u (h) g, f(u) monic, deg u (f) 2g 1, and if y 2 h(x)y = f(x) for (x; y) 2 F Theta F, then 2y h(x) 6= 0 h 0 ....

[Article contains additional citation context not shown here]

Menezes, A., Wu, Y., Zuccherato, R.: An Elementary Introduction to Hyperelliptic Curves. In: Koblitz, N.: Algebraic Aspects of Cryptography. Springer-Verlag, Berlin Heidelberg New York (1998)

....properly. Finally we compose all partial results to prove the desired subexponential running time. 2 Hyperelliptic Jacobians In this section we briefly present hyperelliptic curves and their Jacobians, relating all results without proof. An excellent elementary introduction is given in [17]. While we are chiefly interested in curves over finite fields, the results hold in full generality. Let K = F q be the finite field with q elements and K its algebraic closure. A hyperelliptic curve of genus g over K is the projective closure of a nonsingular affine curve of the type H : Y 2 ....

Alfred J. Menezes, Yi-Hong Wu, and Robert J. Zuccherato. An elementary introduction to hyperelliptic curves. In [14], pages 155--178. Springer-Verlag, 1998.

....index calculus algorithms for the HCDLP. Finally, some research problems in hyperelliptic curve cryptography are listed in Section 6. 2 Hyperelliptic curve arithmetic We provide a brief introduction to the arithmetic of hyperelliptic curves. For a more detailed (but elementary) exposition, see [51, 77]. 2.1 Basic de nitions. Let k = F q be a nite eld with q elements, and let k = S n 1 F q n be its algebraic closure. A non singular (imaginary quadratic) hyperelliptic curve C of genus g over k is de ned by an equation of the form C : v h(u)v = f(u) where h; f 2 k[u] f is monic, ....

A. Menezes, Y. Wu and R. Zuccherato, \An elementary introduction to hyperelliptic curves", appendix in Algebraic Aspects of Cryptography by N. Koblitz, SpringerVerlag, 1998, 155-178.

....elds is given in x5. The cryptographic implications of our results are discussed in x6. Our conclusions are stated in x7. 2 Hyperelliptic Curves We provide a brief overview of the theory of hyperelliptic curves that is relevant to this paper. For a more detailed (but elementary) exposition, see [30]. Hyperelliptic Curves. Let k = F q denote the nite eld of order q. The algebraic closure of F q is k = S n 1 F q n . A hyperelliptic curve C of genus g over k is de ned by a non singular equation v 2 h(u)v = f(u) where h; f 2 k[u] deg f = 2g 1, and deg h g. Let L be an ....

A. Menezes, Y. Wu and R. Zuccherato, \An elementary introduction to hyperelliptic curves", appendix in Algebraic Aspects of Cryptography by N. Koblitz, Springer-Verlag, 1998, 155-178.

No context found.

A. Menezes, Y. Wu, R. Zuccherato. An Elementary Introduction to Hyperelliptic Curves. Technical Report CORR 96-19, University of Waterloo(1996), Canada. Available at http://www.cacr.math.uwaterloo.ca.

No context found.

A.Menezes, Y.Wu and R.Zuccherato. An Elementary Introduction to Hyperelliptic Curve. Technical

No context found.

A.Menezes, Y.Wu and R.Zuccherato.: An Elementary Introduction to Hyperelliptic Curve. Technical Report CORR 96-19, University of Waterloo, 1996, Canada. Available at http://www.cacr.math.uwaterloo.ca

No context found.

A. J. Menezes and Y. H. Wu, and R. J. Zuccherato. An Elementary Introduction to Hyperelliptic Curves. Personal correspondence, November 1996.

No context found.

A. Menezes, Y. Wu, R. Zuccherato. An Elementary Introduction to Hyperelliptic Curves. Technical Report CORR 96-19, University of Waterloo(1996), Canada. Available at http://www.cacr.math.uwaterloo.ca.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC