Characterization of Elliptic Curve Traces under FR-Reduction

Elliptic curve cryptosystems([19, 25]) are based on the elliptic curve discrete logarithm problem(ECDLP). If elliptic curve cryptosystems avoid FR-reduction([11, 17]) and anomalous elliptic curve over Fq ([34, 3, 36]), then with current knowledge we can construct elliptic curve cryptosystems over a smaller de nition eld. ECDLP has an interesting property that the security deeply depends on elliptic curve traces rather than de nition elds, which does not occur in the case of the discrete logarithm problem(DLP). Therefore it is important to characterize elliptic curve traces explicitly from the security point of view. As for FR-reduction, supersingular elliptic curves or elliptic curve E=Fq with trace 2 have been reported to be vulnerable. However unfortunately these have been only results that characterize elliptic curve traces explicitly for FRor MOV-reductions. More importantly, the secure trace against FRreduction has not been reported at all. Elliptic curves with the secure trace means that the reduced extension degree is always higher than a certain level. In this paper, we aim at characterizing elliptic curve traces by FRreduction and investigate explicit conditions of traces vulnerable or secure against FR-reduction. We show new explicit conditions of elliptic curve traces for FR-reduction. We also present algorithms to construct such elliptic curves, which have relation to famous number theory problems. key words: elliptic curve cryptosystems, trace, FR-reduction, number theory