An Attack on a Trace-Zero Cryptosystem

It was recently proposed in the literature that the discretelogarithm problem (DLP) in trace-zero groups of genus 2 curves withrespect to constant field extensions of degree 3 is a fast and secure al-ternative to the well established cryptographic primitive of the DLP in elliptic curves over prime fields. We present a novel attack on this primitive. We show that the DLP inthe trace-zero group can always be transferred into the DLP in the classgroup of a curve of genus at most 6 over the prime field. Asymptotically,the DLP can be solved faster by transferring it into the DLP in the classgroup of this curve and using index calculus methods than by attackingit directly via generic methods. The speed-up one obtains correspondsto a reduction of 1/6th of the bit length. We discuss practical aspects of our attack and argue that for crypto-graphically relevant group sizes (even for “low security” applications of128 bit length), our attack always leads to a considerable speed-up inthe calculation of the DLP in relation to generic attacks.