Henri Cohen

Handbook of Elliptic and Hyperelliptic Curve Cryptography

Preface Introduction to Public-Key Cryptography Mathematical Background Algebraic Background Background on p-adic Numbers Background on Curves and Jacobians Varieties Over Special Fields Background on Pairings Background on Weil Descent Cohomological Background on Point Counting Elementary Arithmetic Exponentiation Integer Arithmetic Finite Field Arithmetic Arithmetic of p-adic Numbers Arithmetic of Curves Arithmetic of Elliptic Curves Arithmetic of Hyperelliptic Curves Arithmetic of Special Curves Implementation of Pairings Point Counting Point Counting on Elliptic and Hyperelliptic Curves Complex Multiplication Computation of Discrete Logarithms Generic Algorithms for Computing Discrete Logarithms Index Calculus Index Calculus for Hyperelliptic Curves Transfer of Discrete Logarithms Applications Algebraic Realizations of DL Systems Pairing-Based Cryptography Compositeness and Primality Testing-Factoring Realizations of DL Systems Fast Arithmetic Hardware Smart Cards Practical Attacks on Smart Cards Mathematical Countermeasures Against Side-Channel Attacks Random Numbers-Generation and Testing References

Efficient elliptic curve exponentiation

Elliptic curve cryptosystems, proposed by Koblitz([8]) and Miller([11]), can be constructed over a smaller definition field than the ElGamal cryptosystems([5]) or the RSA cryptosystems( [16]). This is why elliptic curve cryptosystems have begun to attract notice. There are mainly two types in elliptic curve cryptosystems, elliptic curves E over IF2r and E over IFp. Some current systems based on ElGamal or RSA may often use modulo arithmetic over IFp. Therefore it is convenient to construct fast elliptic curve cryptosystems over IFp. In this paper, we investigate how to implement elliptic curve cryptosystems on E/IFp.

Primality testing and Jacobi sums

We present a theoretically and algorithmically simplified version of a primality testing algorithm that was recently invented by Adleman and Rumely. The new algorithm performs well in practice. It is the first pnmality test in existence that can routinely handle numbers of hundreds of decimal digits.

Convergence acceleration of alternating series.

We discuss some linear acceleration methods for alternating series which are in theory and in practice much better than that of Euler–Van Wijngaarden. One of the algorithms, for instance, allows one to calculate Σ(−1)kak with an error of about 17.93–n from the first n terms for a wide class of sequences {ak}. Such methods are useful for high precision calculations frequently appearing in number theory.

Computing ray class groups, conductors and discriminants

We use the algorithmic computation of exact sequences of Abelian groups to compute the complete structure of (Z K /m) * for an ideal m of a number field K, as well as ray class groups of number fields, and conductors and discriminants of the corresponding Abelian extensions. As an application we give several number fields with discriminants less than previously known ones.

Hermite and Smith normal form algorithms over Dedekind domains

We show how the usual algorithms valid over Euclidean domains, such as the Hermite Normal Form, the modular Hermite Normal Form and the Smith Normal Form can be extended to Dedekind rings. In a sequel to this paper, we will explain the use of these algorithms for computing in relative extensions of number fields.

On amicable and sociable numbers

An exhaustive search has yielded 236 amicable pairs of which the lesser number is smaller than 108, 57 pairs being new. It has also yielded 9 new sociable groups of order 10 or less, of which the lesser number is smaller than 6.107; the 9 sociable groups are all of order 4. The sequence of iterates of the function s(n) = (X(n) - n starting with 276 has also been extended to 119 terms.

Subexponential algorithms for class group and unit computations

Abstract We describe in detail the implementation of an algorithm which computes the class group and the unit group of a general number field, and solves the principal ideal problem. The basic ideas of this algorithm are due to J. Buchmann. New ideas are the use of LLL-reduction of an ideal in a given direction which replaces the notion of neighbour, and the use of complex logarithmic embeddings of elements which plays a crucial role. Heuristically the algorithm performs in sub-exponential time with respect to the discriminant for fixed degree, and performs well in practice.

Counting cubic extensions with given quadratic resolvent

Abstract Given a number field k and a quadratic extension K 2 , we give an explicit asymptotic formula for the number of isomorphism classes of cubic extensions of k whose Galois closure contains K 2 as quadratic subextension, ordered by the norm of their relative discriminant ideal. The main tool is Kummer theory. We also study in detail the error term of the asymptotics and show that it is O ( X α ) , for an explicit α 1 .

A Survey of Discriminant Counting

We give a survey of known results on the asymptotic and exact enumeration of discriminants of number fields, both in the absolute and relative case. We give no proofs, and refer instead to the bibliography.