CM-Curves with Good Cryptographic Properties

Our purpose is to describe elliptic curves with complex multiplication which in characteristic 2 have the following useful properties for constructing Diffie-HeUman type cryptosystems: (1) they are nonsupersingular (so that one cannot use the Menezes-Okamoto-Vanstone reduction of discrete log from elliptic curves to finite fields); (2) the order of the group h a s a large prime factor (so that discrete logs cannot be computed by giant-step/baby-step or the PolIard rho method); (3) doubling of points can be carried out almost as efficiently as in the case of the supersingular curves used by Vanstone; (4) the curves are easy to find. 1 Introduction In Atkin's version of the Goldwasser-Kilian primality test ([l], [9]) one starts with a quadratic imaginary field Ii' = Q(m) and then constructs an elliptic curve over a finite field which is the reduction of an elliptic curve with complex multiplication by K. This idea can also be applied to the search for elliptic curvea which are suitable for the type of cryptosystem described in [3], [8]. 4 s in the primality test, we are looking for elliptic curves whose number of points is equal to a large prime number times a small factor. However, unlike in the prirnality test, where the curves are defined over very large prime fields. our curves will be defined over small fields. Morcover, we shall be interested in an additional property of the curves, the property of having a small trace of Frobenius. In particular, we shall stirdy curves over small fields of characteristic 2 for which the trace of the Frobenius map is kl, i.e., for which the complexmultiplicationfield is Q(m) for D = 2'+2-1 a Mersenne number. Such curves lend themselves to particularly efficient computation, since the doubling of points (more precisely, multiplying points by 2 k) can be speeded up when this condition holds.