# A Cryptographic Application of Weil Descent

@inproceedings{Galbraith1999ACA, title={A Cryptographic Application of Weil Descent}, author={Steven D. Galbraith and Nigel P. Smart}, booktitle={IMACC}, year={1999} }

This paper gives some details about howWeil descent can be used to solve the discrete logarithm problem on elliptic curves which are defined over finite fields of small characteristic. The original ideas were first introduced into cryptography by Frey. We discuss whether these ideas are a threat to existing public key systems based on elliptic curves.

## 97 Citations

Solving Elliptic Curve Discrete Logarithm Problems Using Weil Descent

- Computer Science, MathematicsIACR Cryptol. ePrint Arch.
- 2001

We provide the first cryptographically interesting instance of the elliptic curve discrete logarithm problem which resists all previously known attacks, but which can be solved with modest computer…

Advances in Elliptic Curve Cryptography: Weil Descent Attacks

- Mathematics, Computer Science
- 2005

This chapter summarises the main aspects of the existing literature on Weil descent attacks and contains some new material on the GHS attack in even characteristic.

EVALUATION REPORT FOR CRYPTREC: SECURITY LEVEL OF CRYPTOGRAPHY – ECDLP MATHEMATICAL PROBLEM

- Mathematics, Computer Science
- 2002

The elliptic curve discrete logarithm problem and the known methods to solve it are discussed and the implications of these methods for choosing the domain parameters in elliptic Curve based cryptographic schemes are considered.

How Secure Are Elliptic Curves over Composite Extension Fields?

- Mathematics, Computer ScienceEUROCRYPT
- 2001

The method of Weil descent for solving the ECDLP is compared against the standard method of parallelised Pollard rho and it is shown that composite degree extensions of degree divisible by four should be avoided.

Limitations of constructive Weil descent

- Mathematics, Computer Science
- 2001

Weil restriction of scalars can be used to construct curves suitable for cryptography whose Jacobian has known group order, but only a small proportion of the set of all curves can be constructed in this way.

Software Implementation of Elliptic Curve Cryptography over Binary Fields

- Computer Science, MathematicsCHES
- 2000

This paper presents an extensive and careful study of the software implementation on workstations of the NIST-recommended elliptic curves over binary fields. We also present the results of our…

Weil Descent of Elliptic Curves over Finite Fields of Characteristic Three

- Mathematics, Computer ScienceASIACRYPT
- 2000

The paper shows that some of elliptic curves over finite fields of characteristic three of composite degree are attacked by a more effective algorithm than Pollard's ρ method. For such an elliptic…

Weil descent attack for Kummer extensions

- Mathematics, Computer Science
- 2003

The Weil descent attack of Gaudry, Hess and Smart can be adapted to work for some hyperelliptic curves defined over fields of odd characteristic, and it is shown that those are the only families of nonsingular curves defining Kummer extensions for which this method will work.

## References

SHOWING 1-10 OF 25 REFERENCES

A subexponential algorithm for discrete logarithms over the rational subgroup of the jacobians of large genus hyperelliptic curves over finite fields

- Mathematics, Computer ScienceANTS
- 1994

This paper gives a heuristic argument that under certain assumptions, there exists a c e ℜ>0 such that for all sufficiently large g e Z>0, for all odd primes p with log p ≤ (2g + 1).

An Algorithm of Subexponential Type Computing the Class Group of Quadratic Orders over Principal Ideal Domains

- Mathematics, Computer ScienceANTS
- 1996

We present an algorithm which computes the class group of a quadratic order over a principal ideal domain that fulfills some properties which are implicated by computational requirements. It is a…

Analysis of the Xedni Calculus Attack

- MathematicsDes. Codes Cryptogr.
- 2000

The practicality of the xedni calculus attack on the elliptic curve discrete logarithm problem (ECDLP) is analyzed, finding that asymptotically the algorithm is virtually certain to fail, because of an absolute bound on the size of the coefficients of a relation satisfied by the lifted points.

Primality Testing and Abelian Varieties over Finite Fields

- Mathematics, Philosophy
- 1992

Acknowledgement.- Overview of the algorithm and the proof of the main theorem.- Reduction of main theorem to three propositions.- Proof of proposition 1.- Proof of proposition 2.- Proof of…

Frobenius maps of Abelian varieties and finding roots of unity in finite fields

- Mathematics
- 1990

"If 'twere done when 'tis done, then 'twere well/ It were done quickly."-Macbeth. Abstract. We give a generalization to Abelian varieties over finite fields of the algorithm of Schoof for elliptic…

Efficient Algorithms for the Riemann-Roch Problem and for Addition in the Jacobian of a Curve

- Mathematics, Computer ScienceJ. Symb. Comput.
- 1994

A factorization-free polynomial-time algorithm is produced which improves the complexity of Noether's algorithm for the effective Riemann-Roch problem by an order of magnitude and also present further improvements which yield an algorithm with complexity which is linear in the size of the given divisor.

Computing in the jacobian of a plane algebraic curve

- MathematicsANTS
- 1994

An algorithm which extends the classical method of adjoints due to Brill and Noether for carrying out the addition operation in the Jacobian variety of a plane algebraic curve defined over an algebraic number field K with arbitrary singularities is described and it is proved that the answers it produces are defined over K.

Counting Points on Curves over Finite Fields

- MathematicsJ. Symb. Comput.
- 1998

We consider the problem of counting the number of points on a plane curve, defined by a homogeneous polynomialF(x,y,z) ?Fqx,y,z, which are rational over a ground field Fq. More precisely, we show…

The Xedni Calculus and the Elliptic Curve Discrete Logarithm Problem

- Mathematics, Computer ScienceDes. Codes Cryptogr.
- 2000

A new algorithm, termed the Xedni Calculus, is given, which might be used to solve the ECDLP and is applicable to the classical discrete logarithm problem for $${\mathbb{F}}_p^*$$ and to the integer factorization problem.

A rigorous subexponential algorithm for computation of class groups

- Mathematics
- 1989

Let C(-d) denote the Gauss Class Group of quadratic forms of a negative discriminant -d (or equivalently, the class group of the imaginary quadratic field Q(A/=') ). We give a rigorous proof that…