Remark 3 To resist generic attacks on the discrete logarithm problem, elliptic curve cryptosystems are implemented in the prime order cyclic subgroup of maximal cardinality n inside E(Fq). For representing group elements with the minimum number of bits, it is desirable that the curve order itself be prime. Except for special cases (see Section 1.3 and [59, 61, 65]), only generic attacks are kno...

Recently, Eisenträger et al. proposed a very elegant method for speeding up scalar multiplication on elliptic curves. Their method relies on improved formulas for evaluating S = (2P + Q) from given points P and Q on an elliptic curve. Compared to the naive approach, the improved formulas save a field multiplication each time the operation is performed. This paper proposes a variant which is fas...

The main problem on caps, posed originally by Segre in the fifties, is to determine the values of k for which there exists a complete k-cap. In the present paper, we construct in PG(3, q), for odd prime q, a family of ~ (q2 + 7)-caps which have 2 points on a line external to an elliptic quadric E and the remaining points on E. We conjecture that they are complete.

We describe an equivalence between the notion of balanced twisted curve introduced by Abramovich and Vistoli, and a new notion of log twisted curve, which is a nodal curve equipped with some logarithmic data in the sense of Fontaine and Illusie. As applications of this equivalence, we construct a universal balanced twisted curve, prove that a balanced twisted curve over a general base scheme ad...

There are 26 possibilities for the torsion group of elliptic curves de ned over quadratic number elds. We present examples of high rank elliptic curves with given torsion group which give the current records for most of the torsion groups. In particular, we show that for each possible torsion group, except maybe for Z/15Z, there exist an elliptic curve over some quadratic eld with this torsion ...

Elliptic curve cryptosystem protocols use two main operations, the scalar multiplication and the pairing computation. Both of them are done through a chain of basic operation on the curve. In this paper we present new formulas for supersingular elliptic curve in characteristic 2 and 3. We improve best known formulas by at least one multiplication in the field.

We propose several new methods to protect the scalar multiplication on an elliptic curve against Differential Analysis. The basic idea consists in transforming the curve through various random morphisms to provide a non-deterministic execution of the algorithm. The solutions we suggest complement and improve the state-of-the-art, but also provide a practical toolbox of efficient countermeasures...

The remarkable structure and computationally explicit form of isogeny graphs of elliptic curves over a finite field has made them an important tool for computational number theorists and practitioners of elliptic curve cryptography. This expository paper recounts the theory behind these graphs and examines several recently developed algorithms that realize substantial (often dramatic) performan...

This paper analyzes the cost of breaking ECC under the following assumptions: (1) ECC is using a standardized elliptic curve that was actually chosen by an attacker; (2) the attacker is aware of a vulnerability in some curves that are not publicly known to be vulnerable. This cost includes the cost of exploiting the vulnerability, but also the initial cost of computing a curve suitable for sabo...