. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi Chapter

Generalized Mersenne Numbers in Pairing-Based Cryptography

Lecture notes in computer sciences; 218 on Advances in cryptology---CRYPTO 85

/pdf/generalized-mersenne-numbers-in-pairing-based-cryptography-3vfovy8vk1.pdf

We examine the relative efficiency of four methods for finite field representation in the context of elliptic curve cryptography (ECC). We conclude that a set of fields called the Optimized Extension Fields (OEFs) give greater performance, even when used with affine coordinates, when compared against the type of fields recommended in the emerging ECC standards. Although this performance advantage is only marginal and hence there is probably no need to change the current standards to allow OEF fields in standards compliant implementations.

methods

A comparison of different finite fields for use in elliptic curve cryptosystems

Generalized Mersenne Prime.

Let p be a prime number and n a positive integer, and let q=pn. Adleman and Huang [Inform. and Comput., 151 (1999), pp. 5--16] have described a version of the function field sieve which is conjectured to compute a logarithm in the field of q elements in expected time Lq[1/3;(32/9)1/3+o(1)], where Lq[s;c]=exp(c(log q)s(log log q)1-s) and the o(1) is for $q\to\infty$ under the constraint that p6\leq n$. In this paper, we present a modification of their method which runs conjecturally in expected time Lq[1/3;(32/9)1/3+o(1)] so long as $q\to\infty$ with $p\leq n^{o(\sqrt{n})}$. The technique we use can also be applied to the special number field sieve and results in an algorithm which, in expected time Lp[1/3;(32/9)1/3+o(1)], is conjectured to compute a logarithm in a prime field whose cardinality p is of the form $r^e-s$, with r and s small in absolute value.

The Special Function Field Sieve

This contribution introduces a class of Galois field used to achieve fast finite field arithmetic which we call an Optimal Extension Field (OEF). This approach is well suited for implementation of public-key cryptosystems based on elliptic and hyperelliptic curves. Whereas previous reported optimizations focus on finite fields of the form GF(p) and GF(2 m ), an OEF is the class of fields GF(p m ), for p a prime of special form and m a positive integer. Modern RISC workstation processors are optimized to perform integer arithmetic on integers of size up to the word size of the processor. Our construction employs well-known techniques for fast finite field arithmetic which fully exploit the fast integer arithmetic found on these processors. In this paper, we describe our methods to perform the arithmetic in an OEF and the methods to construct OEFs. We provide a list of OEFs tailored for processors with 8, 16, 32, and 64 bit word sizes. We report on our application of this approach to construction of elliptic curve cryptosystems and demonstrate a substantial performance improvement over all previous reported software implementations of Galois field arithmetic for elliptic curves.

https://link.springer.com/content/pdf/10.1007%2FBFb0055748.pdf

Optimal Extension Fields for Fast Arithmetic in Public-Key Algorithms

We define the weight of an integer N to be the smallest w such that N can be represented as Σ w i=1 ∈ i 2 ci , with ∈ 1 ,..., ∈ w ∈ {1,—1}. Since arithmetic modulo a prime of low weight is particularly efficient, it is tempting to use such primes in cryptographic protocols. In this paper we consider the difficulty of the discrete logarithm problem modulo a prime N of low weight, as well as the difficulty of factoring an integer N of low weight. We describe a version of the number field sieve which handles both problems. In the case that w = 2, the method is the same as the special number field sieve, which runs conjecturally in time exp(((32/9) 1/3 +o(1))(log N) 1/3 (log log N) 2/3 ) for N→ oo. For fixed w > 2, we conjecture that there is a constant ξ less than (32/9) 1/3 ((2w - 3)/(w - 1)) 1/3 such that the running time of the algorithm is at most exp((ξ + o(1))(log N) 1/3 (log log N) 2/3 ) for N →∞. We further conjecture that no ξ less than (32/9) 1/3 ((√2w - 2√2 + 1)/(w - 1)) 2/3 has this property. Our analysis reveals that on average the method performs significantly better than it does in the worst case. We consider all the examples given in a recent paper of Koblitz and Menezes and demonstrate that in every case but one, our algorithm runs faster than the standard versions of the number field sieve.

/pdf/the-number-field-sieve-for-integers-of-low-weight-2msj3q9x68.pdf

Generalized Mersenne Numbers in Pairing-Based Cryptography

Citations

Lecture notes in computer sciences; 218 on Advances in cryptology---CRYPTO 85

References

A comparison of different finite fields for use in elliptic curve cryptosystems

Generalized Mersenne Prime.

The Special Function Field Sieve

Optimal Extension Fields for Fast Arithmetic in Public-Key Algorithms

The number field sieve for integers of low weight.

Related Papers (5)

On a generalized sum of the Mersenne Numbers

On the generalized sums of Mersenne, Fermat, Cullen and Woodall Numbers

On the k-Mersenne–Lucas numbers

Mersenne Lucas numbers and complete homogeneous symmetric functions

SOME IDENTITIES OF k-MERSENNE NUMBERS