Families of fast elliptic curves from Q-curves

We construct new families of elliptic curves over Fp2 with efficiently computable endomorphisms, which can be used to accelerate elliptic curvebased cryptosystems in the sameway asGallant–Lambert–Vanstone (GLV) and Galbraith–Lin–Scott (GLS) endomorphisms. Our construction is based on reducingQ-curves—curves over quadratic number fields without complex multiplication, butwith isogenies to their Galois conjugates—modulo inert primes. As a first application of the general theory we construct, for every p > 3, two one-parameter families of elliptic curves over Fp2 equipped with endomorphisms that are faster than doubling. Like GLS (which appears as a degenerate case of our construction), we offer the advantage over GLV of selecting from a much wider range of curves, and thus finding secure group orders when p is fixed. Unlike GLS, we also offer the possibility of constructing twist-secure curves. Among our examples are prime-order curves equipped with fast endomorphisms, with almost-prime-order twists, over Fp2 for p = 2 127 −1 and p = 2255−19.