The recent introduction of Edwards curves has significantly reduced the cost of addition on elliptic curves. This paper presents new explicit formulae for pairing implementation in Edwards coordinates. We prove our method gives performances similar to those of Miller’s algorithm in Jacobian coordinates and is thus of cryptographic interest when one chooses Edwards curve implementations of proto...

Finding suitable non-supersingular elliptic curves becomes an important issue for the growing area of pairing-based cryptosystems. For this purpose, many methods have been proposed when embedding degree k and cofactor h are taken different values. In this paper we propose a new method to find pairing-friendly elliptic curves without restrictions on embedding degree k and cofactor h. We propose ...

It is proved that the supersingular parameters α of the elliptic curve E3(α) : Y 2 + αXY + Y = X3 in Deuring normal form satisfy α = 3 + γ3, where γ lies in the finite field Fp2 . This is accomplished by finding explicit generators for the normal closure N of the finite extension k(α)/k(j(α)), where α is an indeterminate over k = Fp2 and j(α) is the j-invariant of E3(α). The function field N is...

Isogeny-based cryptography using supersingular elliptic curves — most prominently, the constructions of De Feo-Jao-Plut — is one of the few practical candidates for post-quantum public key cryptography. Its formidable security claim is earned through the continual exploration of quantum algorithms for ‘isogeny problems’ and the assessment of the threat they pose to supersingular isogeny-based c...

Distortion maps are a useful tool for pairing based cryptography. Compared with elliptic curves, the case of hyperelliptic curves of genus g > 1 is more complicated since the full torsion subgroup has rank 2g. In this paper we prove that distortion maps always exist for supersingular curves of genus g > 1 and we give several examples in genus 2.

Let A be an abelian variety defined over a non-prime finite field Fq that has embedding degree k with respect to a subgroup of prime order r. In this paper we give explicit conditions on q, k, and r that imply that the minimal embedding field of A with respect to r is Fqk . When these conditions hold, the embedding degree k is a good measure of the security level of a pairing-based cryptosystem...

We show that for all odd primes p, there exist ordinary elliptic curves over Fp(x) with arbitrarily high rank and constant j-invariant. This shows in particular that there are elliptic curves with arbitrarily high rank over these fields for which the corresponding elliptic surface is not supersingular. The result follows from a theorem which states that for all odd prime numbers p and l, there ...

The purpose of this paper is to study the Hodge-Arakelov theory of elliptic curves (cf. [Mzk1-4]) in positive characteristic. The first two §’s (§1,2) are devoted to studying the relationship of the Frobenius and Verschiebung morphisms of an elliptic curve in positive characteristic to the Hodge-Arakelov theory of elliptic curves. We begin by deriving a “Verschiebung-Theoretic Analogue of the H...

The factorization of the Legendre polynomial of degree (p− e)/4, where p is an odd prime, is studied over the finite field Fp. It is shown that this factorization encodes information about the supersingular elliptic curves in Legendre normal form which admit the endomorphism √ −2p, by proving an analogue of Deuring’s theorem on supersingular curves with multiplier √ −p. This is used to count th...

Constructing non-supersingular elliptic curves for pairing-based cryptosystems have attracted much attention in recent years. The best previous technique builds curves with ρ = lg(q)/lg(r) ≈ 1 (k = 12) and ρ = lg(q)/lg(r) ≈ 1.25 (k = 24). When k > 12, most of the previous works address the question by representing r(x) as a cyclotomic polynomial. In this paper, we propose a new method to find m...