Hostname: page-component-848d4c4894-m9kch Total loading time: 0 Render date: 2024-05-15T01:32:04.715Z Has data issue: false hasContentIssue false

Analysis of the GHS Weil Descent Attack on the ECDLP over Characteristic Two Finite Fields of Composite Degree

Published online by Cambridge University Press:  01 February 2010

Markus Maurer
Affiliation:
Department of Combinatorics and Optimization, University of Waterloo, Canada
Alfred Menezes
Affiliation:
Department of Combinatorics and Optimization, University of Waterloo, Canada, ajmeneze@uwaterloo.ca
Edlyn Teske
Affiliation:
Department of Combinatorics and Optimization, University of Waterloo, Canada, eteske@uwaterloo.ca

Abstract

Core share and HTML view are not available for this content. However, as you have access to this content, a full PDF is available via the ‘Save PDF’ action button.

In this paper, the authors analyze the Gaudry-Hess-Smart (GHS) Weil descent attack on the elliptic curve discrete logarithm problem (ECDLP) for elliptic curves defined over characteristic two finite fields of composite extension degree. For each such field F2N, where N is in [100,600], elliptic curve parameters are identified such that: (i) there should exist a cryptographically interesting elliptic curve E over F2N with these parameters; and (ii) the GHS attack is more efficient for solving the ECDLP in E(F2N) than for solving the ECDLP on any other cryptographically interesting elliptic curve over F2N. The feasibility of the GHS attack on the specific elliptic curves is examined over F2176, F2208, F2272, F2304 and F2368, which are provided as examples in the ANSI X9.62 standard for the elliptic curve signature scheme ECDSA. Finally, several concrete instances are provided of the ECDLP over F2N, N composite, of increasing difficulty; these resist all previously known attacks, but are within reach of the GHS attack.

Type
Research Article
Copyright
Copyright © London Mathematical Society 2002