Attacking a Binary GLS Elliptic Curve with Magma

  • Jesús-Javier Chi
  • Thomaz Oliveira
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9230)


In this paper we present a complete Magma implementation for solving the discrete logarithm problem (DLP) on a binary GLS curve defined over the field \(\mathbb {F}_{2^{62}}\). For this purpose, we constructed a curve vulnerable against the gGHS Weil descent attack and adapted the algorithm proposed by Enge and Gaudry to solve the DLP on the Jacobian of a genus-32 hyperelliptic curve. Furthermore, we describe a mechanism to check whether a randomly selected binary GLS curve is vulnerable against the gGHS attack. Such method works with all curves defined over binary fields and can be applied to each element of the isogeny class.



The authors would like to thank Sorina Ionica, Gora Adj and the reviewers for their valuable comments and suggestions.

Supplementary material


  1. 1.
    Barbulescu, R., Gaudry, P., Joux, A., Thomé, E.: A heuristic quasi-polynomial algorithm for discrete logarithm in finite fields of small characteristic. In: Nguyen, P.Q., Oswald, E. (eds.) EUROCRYPT 2014. LNCS, vol. 8441, pp. 1–16. Springer, Heidelberg (2014) CrossRefGoogle Scholar
  2. 2.
    Bos, J.W., Costello, C., Hisil, H., Lauter, K.: High-performance scalar multiplication using 8-dimensional GLV/GLS decomposition. In: Bertoni, G., Coron, J.-S. (eds.) CHES 2013. LNCS, vol. 8086, pp. 331–348. Springer, Heidelberg (2013) CrossRefGoogle Scholar
  3. 3.
    Cohen, H., Frey, G., Avanzi, R., Doche, C., Lange, T., Nguyen, K., Vercauteren, F.: Handbook of Elliptic and Hyperelliptic Curve Cryptography, (2nd edn). Chapman & Hall/CRC (2012)Google Scholar
  4. 4.
    Diem, C.: On the discrete logarithm problem in elliptic curves. Compositio Mathematica 147, 75–104 (2011)zbMATHMathSciNetCrossRefGoogle Scholar
  5. 5.
    Dierks, T., Rescorla, E.: The Transport Layer Security (TLS) Protocol Version 1.2. RFC 5246 (Proposed Standard) (2008).
  6. 6.
    Enge, A., Gaudry, P.: A general framework for subexponential discrete logarithm algorithms. Acta Arithmetica 102(1), 83–103 (2002)zbMATHMathSciNetCrossRefGoogle Scholar
  7. 7.
    Faugère, J.-C., Perret, L., Petit, C., Renault, G.: Improving the complexity of index calculus algorithms in elliptic curves over binary fields. In: Pointcheval, D., Johansson, T. (eds.) EUROCRYPT 2012. LNCS, vol. 7237, pp. 27–44. Springer, Heidelberg (2012) CrossRefGoogle Scholar
  8. 8.
    Faz-Hernández, A., Longa, P., Sánchez, A.H.: Efficient and secure algorithms for GLV-based scalar multiplication and their implementation on GLV-GLS curves. In: Benaloh, J. (ed.) CT-RSA 2014. LNCS, vol. 8366, pp. 1–27. Springer, Heidelberg (2014) CrossRefGoogle Scholar
  9. 9.
    Frey, G.: How to disguise an elliptic curve. In: Talk at ECC 1998 (Workshop on Elliptic Curve Cryptography), Waterloo (1998).
  10. 10.
    Galbraith, S.D.: Mathematics of Public Key Cryptography, 1st edn. Cambridge University Press, New York, NY, USA (2012)zbMATHCrossRefGoogle Scholar
  11. 11.
    Galbraith, S.D., Hess, F., Smart, N.P.: Extending the GHS Weil Descent Attack. In: Knudsen, L.R. (ed.) EUROCRYPT 2002. LNCS, vol. 2332, pp. 29–44. Springer, Heidelberg (2002) CrossRefGoogle Scholar
  12. 12.
    Galbraith, S.D., Lin, X., Scott, M.: Endomorphisms for Faster Elliptic Curve Cryptography on a Large Class of Curves. J. Cryptology 24(3), 446–469 (2011)zbMATHMathSciNetCrossRefGoogle Scholar
  13. 13.
    Galbraith, S.D., Smart, N.P.: A cryptographic application of weil descent. In: Walker, M. (ed.) Cryptography and Coding 1999. LNCS, vol. 1746, pp. 191–200. Springer, Heidelberg (1999) CrossRefGoogle Scholar
  14. 14.
    Gallant, R.P., Lambert, R.J., Vanstone, S.A.: Faster point multiplication on elliptic curves with efficient endomorphisms. In: Kilian, J. (ed.) CRYPTO 2001. LNCS, vol. 2139, pp. 190–200. Springer, Heidelberg (2001) CrossRefGoogle Scholar
  15. 15.
    Gaudry, P.: An Algorithm for Solving the Discrete Log Problem on Hyperelliptic Curves. In: Preneel, B. (ed.) EUROCRYPT 2000. LNCS, vol. 1807, pp. 19–34. Springer, Heidelberg (2000) CrossRefGoogle Scholar
  16. 16.
    Gaudry, P.: Index calculus for abelian varieties of small dimension and the elliptic curve discrete logarithm problem. J. Symbolic Comput. 44(12), 1690–1702 (2009)zbMATHMathSciNetCrossRefGoogle Scholar
  17. 17.
    Gaudry, P., Hess, F., Smart, N.P.: Constructive and destructive facets of Weil descent on elliptic curves. J. Cryptology 15(1), 19–46 (2002)MathSciNetCrossRefGoogle Scholar
  18. 18.
    Gaudry, P., Thomé, E., Thériault, N., Diem, C.: A double large prime variation for small genus hyperelliptic index calculus. Math. Comput. 76, 475–492 (2007)zbMATHCrossRefGoogle Scholar
  19. 19.
    Hankerson, D., Karabina, K., Menezes, A.: Analyzing the Galbraith-Lin-Scott point multiplication method for elliptic curves over binary fields. IEEE Trans. Comput. 58(10), 1411–1420 (2009)MathSciNetCrossRefGoogle Scholar
  20. 20.
    Hess, F.: Generalising the GHS attack on the elliptic curve discrete logarithm problem. LMS J. Comput. Math. 7, 167–192 (2004)MathSciNetCrossRefGoogle Scholar
  21. 21.
    Hu, Z., Longa, P., Xu, M.: Implementing the 4-dimensional GLV method on GLS elliptic curves with j-invariant 0. Des. Codes Crypt. 63(3), 331–343 (2012)zbMATHMathSciNetCrossRefGoogle Scholar
  22. 22.
    Joux, A., Vitse, V.: Cover and decomposition index calculus on elliptic curves made practical. In: Pointcheval, D., Johansson, T. (eds.) EUROCRYPT 2012. LNCS, vol. 7237, pp. 9–26. Springer, Heidelberg (2012) CrossRefGoogle Scholar
  23. 23.
    Koblitz, N.: Elliptic curve cryptosystems. Math. Comput. 48(177), 203–209 (1987)zbMATHMathSciNetCrossRefGoogle Scholar
  24. 24.
    Longa, P., Sica, F.: Four-dimensional Gallant-Lambert-Vanstone scalar multiplication. J. Cryptology 27(2), 248–283 (2014)zbMATHMathSciNetCrossRefGoogle Scholar
  25. 25.
    Menezes, A., Qu, M.: Analysis of the Weil descent attack of Gaudry, Hess and Smart. In: Naccache, D. (ed.) CT-RSA 2001. LNCS, vol. 2020, pp. 308–318. Springer, Heidelberg (2001) CrossRefGoogle Scholar
  26. 26.
    Menezes, A., Teske, E., Weng, A.: Weak Fields for ECC. In: Okamoto, T. (ed.) CT-RSA 2004. LNCS, vol. 2964, pp. 366–386. Springer, Heidelberg (2004) CrossRefGoogle Scholar
  27. 27.
    Menezes, A.J., Okamoto, T., Vanstone, S.A.: Reducing elliptic curve logarithms to logarithms in a finite field. IEEE Trans. Inf. Theor. 39(5), 1639–1646 (1993)MathSciNetCrossRefGoogle Scholar
  28. 28.
    Miller, V.S.: Use of elliptic curves in cryptography. In: Williams, H.C. (ed.) CRYPTO 1985. LNCS, vol. 218, pp. 417–426. Springer, Heidelberg (1986) Google Scholar
  29. 29.
    Nagao, K.: Decomposition attack for the Jacobian of a hyperelliptic curve over an extension field. In: Hanrot, G., Morain, F., Thomé, E. (eds.) ANTS-IX. LNCS, vol. 6197, pp. 285–300. Springer, Heidelberg (2010) CrossRefGoogle Scholar
  30. 30.
    National Institute of Standards and Technology: FIPS PUB 186–4. Digital Signature Standard (DSS), Department of Commerce, U.S (2013)Google Scholar
  31. 31.
    Oliveira, T., López, J., Aranha, D.F., Rodríguez-Henríquez, F.: Two is the fastest prime: lambda coordinates for binary elliptic curves. J. Cryptographic Eng. 4(1), 3–17 (2014)CrossRefGoogle Scholar
  32. 32.
    Pollard, J.: Monte Carlo methods for index computation (mod p). Math. Comput. 32, 918–924 (1978)MathSciNetGoogle Scholar
  33. 33.
    Sarkar, P., Singh, S.: A New Method for Decomposition in the Jacobian of Small Genus Hyperelliptic Curves. Cryptology ePrint Archive, Report 2014/815 (2014).
  34. 34.
    Sarkar, P., Singh, S.: A simple method for obtaining relations among factor basis elements for special hyperelliptic curves. Cryptology ePrint Archive, Report 2015/179 (2015).
  35. 35.
    Semaev, I.: Summation polynomials and the discrete logarithm problem on elliptic curves. Cryptology ePrint Archive, Report 2004/031 (2004).
  36. 36.
    Stebila, D.: Elliptic Curve Algorithm Integration in the Secure Shell Transport Layer. RFC 5656 (Proposed Standard) (2009).
  37. 37.
    Tate, J.: Endomorphisms of abelian varieties over finite fields. Inventiones math. 2(2), 134–144 (1966)zbMATHMathSciNetCrossRefGoogle Scholar
  38. 38.
    Teske, E.: Speeding up Pollard’s Rho method for computing discrete logarithms. In: Buhler, J.P. (ed.) ANTS 1998. LNCS, vol. 1423, pp. 541–554. Springer, Heidelberg (1998) CrossRefGoogle Scholar

Copyright information

© Springer International Publishing Switzerland 2015

Authors and Affiliations

  1. 1.Computer Science DepartmentCINVESTAV-IPNMexico CityMexico

Personalised recommendations