We focus on the implementation and security aspects of cryptographic protocols that use Type 1 and Type 4 pairings. On the implementation front, we report improved timings for Type 1 pairings derived from supersingular elliptic curves in characteristic 2 and 3 and the first timings for supersingular genus-2 curves in characteristic 2 at the 128-bit security level. In the case of Type 4 pairings...

Let C be a supersingular genus-2 curve over an algebraically closed field of characteristic 3. We show that if C is not isomorphic to the curve y = x + 1 then up to isomorphism there are exactly 20 degree-3 maps φ from C to the elliptic curve E with j-invariant 0. We study the coarse moduli space of triples (C, E, φ), paying particular attention to questions of rationality. The results we obtai...

Elliptic curve cryptosystems([19, 25]) are based on the elliptic curve discrete logarithm problem(ECDLP). If elliptic curve cryptosystems avoid FR-reduction([11, 17]) and anomalous elliptic curve over Fq ([34, 3, 36]), then with current knowledge we can construct elliptic curve cryptosystems over a smaller de nition eld. ECDLP has an interesting property that the security deeply depends on elli...

Elliptic curve cryptosystems([19],[25]) are based on the elliptic curve discrete logarithm problem(ECDLP). If elliptic curve cryptosystems avoid FRreduction([11],[17]) and anomalous elliptic curve over Fq ([3], [33], [35]), then with current knowledge we can construct elliptic curve cryptosystems over a smaller definition field. ECDLP has an interesting property that the security deeply depends...

Let E be an elliptic curve over Q. We assume that E has good supersingular reduction at a prime p, and for simplicity, assume p is odd and ap = p+ 1− #E(Fp) is zero. Then, as the second author showed, the p-adic L-function Lp,α(E) of E corresponding to α = ±√−p (by Amice-Vélu and Vishik) can be written as Lp,α(E) = f log+p +g logp α by using two Iwasawa functions f and g ∈ Zp[[Gal(Q∞/Q)]] ([20]...

We present new candidates for quantum-resistant public-key cryptosystems based on the conjectured difficulty of finding isogenies between supersingular elliptic curves. The main technical idea in our scheme is that we transmit the images of torsion bases under the isogeny in order to allow the two parties to arrive at a common shared key despite the noncommutativity of the endomorphism ring. Ou...