Index Calculus Attack for Hyperelliptic Curves of Small Genus - PowerPoint PPT Presentation

Index Calculus Attack for Hyperelliptic Curves of Small Genus Nicolas Thériault nicolast@exp-math.uni-essen.de University of Toronto / IEM – Universität Duisburg–Essen

Slide index Discrete Log Problem Large primes Hyperelliptic Jacobians Algorithms Generic Attacks Running time analysis Attacks for Hyperelliptic Curves Optimizations Index Calculus Comparison Factor Base Memory Nicolas Thériault – The index calculus attack – p.1

The Discrete Log Problem Let C be a nonsingular hyperelliptic curve of genus g with a single point at infinity defined over the finite field F q . Let D 1 , D 2 be two elements of Jac ( C )( F q ) such that D 2 ∈ � D 1 � . The discrete log problem for the pair ( D 1 , D 2 ) on Jac ( C )( F q ) consist in computing the smallest integer λ ∈ N such that D 2 = λD 1 . Nicolas Thériault – The index calculus attack – p.2 [ ⇐ ]

Hyperelliptic Jacobians C is of the form C : Y 2 + h ( X ) Y = f ( X ) with deg( h ) ≤ g and deg( f ) = 2 g + 1 . Jac ( C )( F q ) is the divisor class group, which is isomorphic to the ideal class group. � √ q − 1 � √ q + 1 � 2 g ≤ | Jac ( C )( F q ) | ≤ � 2 g , i.e. | Jac ( C )( F q ) | = q g + O gq g − 1 / 2 � � . Reduced divisors in Jac ( C )( F q ) can be added in O ( g 2 (log q ) 2 ) bit operations (Cantor). Nicolas Thériault – The index calculus attack – p.3 [ ⇐ ]

Hyperelliptic Jacobians To a point P ∈ C ( F q ) we associate the divisor D ( P ) = P − ∞ . Every reduced divisor D ∈ Jac ( C )( F q ) , � k D = i =1 D ( P i ) , can be represented uniquely by a pair of polynomials [ a ( x ) , b ( x )] , a ( x ) , b ( x ) ∈ F q [ x ] , with � k a ( x ) = i =1 ( x − x i ) b ( x i ) = y i and such that deg( b ) < deg( a ) and a ( x ) divides b ( x ) 2 + h ( x ) b ( x ) − f ( x ) . Nicolas Thériault – The index calculus attack – p.3 [ ⇐ ]

Hyperelliptic Jacobians A reduced divisor D = [ a ( x ) , b ( x )] is in Jac ( C )( F q ) if and only if a ( x ) , b ( x ) ∈ F q [ x ] . Nicolas Thériault – The index calculus attack – p.3 [ ⇐ ]

Hyperelliptic Jacobians A reduced divisor D = [ a ( x ) , b ( x )] is in Jac ( C )( F q ) if and only if a ( x ) , b ( x ) ∈ F q [ x ] . To know if the points P i associated to a reduced divisor are in C ( F q ) , we can check if a ( x ) splits completely in F q [ x ] . To find the points P i associated to a reduced divisor, we need to completely factor a ( x ) . Nicolas Thériault – The index calculus attack – p.3 [ ⇐ ]

Hyperelliptic Jacobians A reduced divisor D = [ a ( x ) , b ( x )] is in Jac ( C )( F q ) if and only if a ( x ) , b ( x ) ∈ F q [ x ] . To know if the points P i associated to a reduced divisor are in C ( F q ) , we can check if a ( x ) splits completely in F q [ x ] . To find the points P i associated to a reduced divisor, we need to completely factor a ( x ) . D ( − P ) = − D ( P ) . Nicolas Thériault – The index calculus attack – p.3 [ ⇐ ]

Generic attacks Three main types of attack: Shank’s Baby Step - Giant Step algorithm; Pollard’s ρ method; Pollard’s λ (kangaroo) method. They work for every abelian group. They require �� � O group order group operations to solve the discrete log. Nicolas Thériault – The index calculus attack – p.4 [ ⇐ ]

Attacks for hyperelliptic curves Weil descent attack: Frey / Gaudry, Hess and Smart, for some curves defined over field extensions. Index calculus attack for large genus: Adleman, DeMarrais and Huang Nicolas Thériault – The index calculus attack – p.5 [ ⇐ ]

Attacks for hyperelliptic curves Weil descent attack: Frey / Gaudry, Hess and Smart, for some curves defined over field extensions. Index calculus attack for large genus: Adleman, DeMarrais and Huang Index calculus attack for small genus: Gaudry, for curves of genus > 4 , variation (Harley) for curves of genus > 3 , Nicolas Thériault – The index calculus attack – p.5 [ ⇐ ]

Attacks for hyperelliptic curves Weil descent attack: Frey / Gaudry, Hess and Smart, for some curves defined over field extensions. Index calculus attack for large genus: Adleman, DeMarrais and Huang Index calculus attack for small genus: Gaudry, for curves of genus > 4 , variation (Harley) for curves of genus > 3 , can be improved for curves of genus > 2 . Nicolas Thériault – The index calculus attack – p.5 [ ⇐ ]

Index calculus We want to find a good set of “points” (the factor base) P 1 , P 2 , . . . , P t and “random” linear combinations t � α i D 1 + β i D 2 = c ij P j . j =1 Nicolas Thériault – The index calculus attack – p.6 [ ⇐ ]

Index calculus We want to find a good set of “points” (the factor base) P 1 , P 2 , . . . , P t and “random” linear combinations t � α i D 1 + β i D 2 = c ij P j . j =1 We then find γ i ’s such that for every j s � γ i c ij = 0 . i =1 Nicolas Thériault – The index calculus attack – p.6 [ ⇐ ]

Index calculus This gives us t � s � � � 0 = γ i c ij P j j =1 i =1 Nicolas Thériault – The index calculus attack – p.6 [ ⇐ ]

Index calculus This gives us t � s � � � 0 = γ i c ij P j j =1 i =1 s � t � � � = γ i c ij P j i =1 j =1 Nicolas Thériault – The index calculus attack – p.6 [ ⇐ ]

Index calculus This gives us t � s � � � 0 = γ i c ij P j j =1 i =1 s � t � � � = γ i c ij P j i =1 j =1 s � = γ i ( α i D 1 + β i D 2 ) i =1 Nicolas Thériault – The index calculus attack – p.6 [ ⇐ ]

Index calculus This gives us t � s � � � 0 = γ i c ij P j j =1 i =1 s � t � � � = γ i c ij P j i =1 j =1 s � = γ i ( α i D 1 + β i D 2 ) i =1 � s � � s � � � = γ i α i D 1 + γ i β i D 2 i =1 i =1 Nicolas Thériault – The index calculus attack – p.6 [ ⇐ ]

Index calculus This gives us t � s � � � 0 = γ i c ij P j j =1 i =1 s � t � � � = γ i c ij P j i =1 j =1 s � = γ i ( α i D 1 + β i D 2 ) i =1 � s � � s � � � = γ i α i D 1 + γ i β i D 2 i =1 i =1 = αD 1 + βD 2 Nicolas Thériault – The index calculus attack – p.6 [ ⇐ ]

Index calculus If β � = 0 , we can solve for D 2 : D 2 = − α β D 1 , i.e. − α λ = β s � − γ i α i i =1 = . s � γ i β i i =1 Nicolas Thériault – The index calculus attack – p.6 [ ⇐ ]

Smooth divisors Let P = C ( F q ) , i.e. P is the set of points of C over F q . Let B be a subset of P . Nicolas Thériault – The index calculus attack – p.7 [ ⇐ ]

Smooth divisors Let P = C ( F q ) , i.e. P is the set of points of C over F q . Let B be a subset of P . A divisor is smooth relative to B if it is reduced and it can be written in the form k � D ( P i ) i =1 with the P i ’s in B and k ≤ g . Nicolas Thériault – The index calculus attack – p.7 [ ⇐ ]

Smooth divisors Let P = C ( F q ) , i.e. P is the set of points of C over F q . Let B be a subset of P . A divisor is smooth relative to B if it is reduced and it can be written in the form k � D ( P i ) i =1 with the P i ’s in B and k ≤ g . In this case, B is called the factor base . Nicolas Thériault – The index calculus attack – p.7 [ ⇐ ]

Smooth divisors Let P = C ( F q ) , i.e. P is the set of points of C over F q . Let B be a subset of P . A divisor is smooth relative to B if it is reduced and it can be written in the form k � D ( P i ) i =1 with the P i ’s in B and k ≤ g . In this case, B is called the factor base . A potentially smooth divisor is smooth relative to P . Nicolas Thériault – The index calculus attack – p.7 [ ⇐ ]

Working with the factor base Make use of the equality D ( − P ) = − D ( P ) . Nicolas Thériault – The index calculus attack – p.8 [ ⇐ ]

Working with the factor base Make use of the equality D ( − P ) = − D ( P ) . If P is in the factor base, − P is also in the factor base, but we use only P for the factorization. Example of representation: D ( P 1 )+ D ( − P 29 )+ D ( − P 103 ) = D ( P 1 ) − D ( P 29 ) − D ( P 103 ) Nicolas Thériault – The index calculus attack – p.8 [ ⇐ ]

Working with the factor base Make use of the equality D ( − P ) = − D ( P ) . If P is in the factor base, − P is also in the factor base, but we use only P for the factorization. Example of representation: D ( P 1 )+ D ( − P 29 )+ D ( − P 103 ) = D ( P 1 ) − D ( P 29 ) − D ( P 103 ) The “size” of the factor base is | B | / 2 for the linear algebra. This decreases the running time for the search by 50% and time for the linear algebra by 75% . Nicolas Thériault – The index calculus attack – p.8 [ ⇐ ]

Large primes Given a factor base B ⊂ P , a point P ∈ P is called a large prime if P / ∈ B . Nicolas Thériault – The index calculus attack – p.9 [ ⇐ ]

Large primes Given a factor base B ⊂ P , a point P ∈ P is called a large prime if P / ∈ B . A reduced divisor k � D = D ( P i ) i =1 is said to be almost-smooth if: all but one of the P i ’s are in B ; the remaining P i is a large prime. Nicolas Thériault – The index calculus attack – p.9 [ ⇐ ]