Weak Fields for ECC

  • Alfred Menezes
  • Edlyn Teske
  • Annegret Weng
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 2964)


We demonstrate that some finite fields, including \(\mathbb{F}_{{2}^{210}}\), are weak for elliptic curve cryptography in the sense that any instance of the elliptic curve discrete logarithm problem for any elliptic curve over these fields can be solved in significantly less time than it takes Pollard’s rho method to solve the hardest instances. We discuss the implications of our observations to elliptic curve cryptography, and list some open problems.


Elliptic Curve Elliptic Curf Isomorphism Class Magic Number Discrete Logarithm 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Adleman, L., DeMarrais, J., Huang, M.: A subexponential algorithm for discrete logarithms over the rational subgroup of the jacobians of large genus hyperelliptic curves over finite fields. In: Huang, M.-D.A., Adleman, L.M. (eds.) ANTS 1994. LNCS, vol. 877, pp. 28–40. Springer, Heidelberg (1994)Google Scholar
  2. 2.
    Barrett, P.: Implementing the Rivest Shamir and Adleman public key encryption algorithm on a standard digital signal processor. In: Odlyzko, A.M. (ed.) CRYPTO 1986. LNCS, vol. 263, pp. 311–323. Springer, Heidelberg (1987)Google Scholar
  3. 3.
    Bernstein, D.: Circuits for integer factorization: A proposal, preprint (2001)Google Scholar
  4. 4.
    Cantor, D.: Computing in the jacobian of a hyperelliptic curve. Math. Comp. 48, 95–101 (1987)zbMATHMathSciNetCrossRefGoogle Scholar
  5. 5.
    Cantor, D., Zassenhaus, H.: A new algorithm for factoring polynomials over finite fields. Math. Comp. 36, 587–592 (1981)zbMATHMathSciNetCrossRefGoogle Scholar
  6. 6.
    Coppersmith, D., Odlyzko, A., Schroeppel, R.: Discrete logarithms in GF(p). Algorithmica 1, 1–15 (1986)zbMATHCrossRefMathSciNetGoogle Scholar
  7. 7.
    Enge, A., Gaudry, P.: A general framework for subexponential discrete logarithm algorithms. Acta Arithmetica 102, 83–103 (2002)zbMATHCrossRefMathSciNetGoogle Scholar
  8. 8.
    FIPS 186-2, Digital signature standard (DSS), Federal Information Processing Standards Publication 186–2, National Institute of Standards and Technology (2000)Google Scholar
  9. 9.
    Flassenberg, R., Paulus, S.: Sieving in function fields. Experimental Mathematics 8, 339–349 (1999)zbMATHMathSciNetGoogle Scholar
  10. 10.
    Fouquet, M.: Anneau d’endomorphismes et cardinalité des courbes elliptiques: aspects algorithmiques, PhD thesis, École polytechnique, Palaiseau Cedex (2001)Google Scholar
  11. 11.
    Frey, G.: Applications of arithmetical geometry to cryptographic constructions. In: Proceedings of the Fifth International Conference on Finite Fields and Applications, Springer-Verlag, pp. 128–161. Springer, Heidelberg (2001)Google Scholar
  12. 12.
    Frey, G., Rück, H.: A remark concerning m-divisibility and the discrete logarithm in the divisor class group of curves. Math. Comp. 62, 865–874 (1994)zbMATHMathSciNetGoogle Scholar
  13. 13.
    Galbraith, S.: Constructing isogenies between elliptic curves over finite fields. LMS Journal of Computation and Mathematics 2, 118–138 (1999)zbMATHMathSciNetGoogle Scholar
  14. 14.
    Galbraith, S.: Weil descent of jacobians. Discrete Applied Mathematics 12, 165–180 (2003)CrossRefMathSciNetGoogle Scholar
  15. 15.
    Galbraith, S., Hess, F., Smart, N.: Extending the GHS Weil descent attack. In: Knudsen, L.R. (ed.) EUROCRYPT 2002. LNCS, vol. 2332, pp. 29–44. Springer, Heidelberg (2002)CrossRefGoogle Scholar
  16. 16.
    Gallant, R., Lambert, R., Vanstone, S.: Improving the parallelized Pollard lambda search on anomalous binary curves. Math. Comp. 69, 1699–1705 (2000)zbMATHCrossRefMathSciNetGoogle Scholar
  17. 17.
    Gaudry, P.: An algorithm for solving the discrete log problem in hyperelliptic curves. In: Preneel, B. (ed.) EUROCRYPT 2000. LNCS, vol. 1807, pp. 19–34. Springer, Heidelberg (2000)CrossRefGoogle Scholar
  18. 18.
    Gaudry, P., Hess, F., Smart, N.: Constructive and destructive facets of Weil descent on elliptic curves. J. Cryptology 15, 19–46 (2002)CrossRefMathSciNetGoogle Scholar
  19. 19.
    Hankerson, D.: personal communication (2003)Google Scholar
  20. 20.
    Hess, F.: The GHS attack revisited. In: Biham, E. (ed.) EUROCRYPT 2003. LNCS, vol. 2656, pp. 374–387. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  21. 21.
    Hess, F.: personal communication (2003)Google Scholar
  22. 22.
    Jacobson, M.: personal communication (2003)Google Scholar
  23. 23.
    Jacobson, M., Menezes, A., Stein, A.: Solving elliptic curve discrete logarithm problems using Weil descent. Journal of the Ramanujan Mathematical Society 16, 231–260 (2001)zbMATHMathSciNetGoogle Scholar
  24. 24.
    Jacobson, M., van der Poorten, A.: Computational aspects of NUCOMP. In: Fieker, C., Kohel, D.R. (eds.) ANTS 2002. LNCS, vol. 2369, pp. 120–133. Springer, Heidelberg (2002)CrossRefGoogle Scholar
  25. 25.
    Kohel, D.: Endomorphism rings of elliptic curves over finite fields, PhD thesis, University of California, Berkeley (1996)Google Scholar
  26. 26.
    Kuhn, F., Struik, R.: Random walks revisited: Extensions of Pollard’s rho algorithm for computing multiple discrete logarithms. In: Vaudenay, S., Youssef, A.M. (eds.) SAC 2001. LNCS, vol. 2259, pp. 212–229. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  27. 27.
    López, J., Dahab, R.: High-speed software multiplication in \(\mathbb{F}\) 2 m. In: Roy, B., Okamoto, E. (eds.) INDOCRYPT 2000. LNCS, vol. 1977, pp. 203–212. Springer, Heidelberg (2000)Google Scholar
  28. 28.
    Maurer, M., Menezes, A., Teske, E.: Analysis of the GHS Weil descent attack on the ECDLP over characteristic two finite fields of composite degree. LMS Journal of Computation and Mathematics 5, 127–174 (2002)zbMATHMathSciNetGoogle Scholar
  29. 29.
    Menezes, A., Okamoto, T., Vanstone, S.: Reducing elliptic curve logarithms to logarithms in a finite field. IEEE Transactions on Information Theory 39, 1639–1646 (1993)zbMATHCrossRefMathSciNetGoogle Scholar
  30. 30.
    Menezes, A., Qu, M.: Analysis of the Weil descent attack of Gaudry, Hess and Smart. In: Naccache, D. (ed.) CT-RSA 2001. LNCS, vol. 2020, pp. 308–318. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  31. 31.
    van Oorschot, P., Wiener, M.: Parallel collision search with cryptanalytic applications. J. Cryptology 12, 1–28 (1999)zbMATHCrossRefMathSciNetGoogle Scholar
  32. 32.
    Orman, H.: The OAKLEY key determination protocol. RFC 2412 (1998), Available from
  33. 33.
    Paulus, S., Stein, A.: Comparing real and imaginary arithmetics for divisor class groups of hyperelliptic curves. In: Buhler, J.P. (ed.) ANTS 1998. LNCS, vol. 1423, pp. 576–591. Springer, Heidelberg (1998)CrossRefGoogle Scholar
  34. 34.
    Pollard, J.: Monte Carlo methods for index computation mod p. Math. Comp. 32, 918–924 (1978)zbMATHMathSciNetGoogle Scholar
  35. 35.
    Satoh, T., Araki, K.: Fermat quotients and the polynomial time discrete log algorithm for anomalous elliptic curves. Commentarii Mathematici Universitatis Sancti Pauli 47, 81–92 (1998)zbMATHMathSciNetGoogle Scholar
  36. 36.
    Semaev, I.: Evaluation of discrete logarithms in a group of p-torsion points of an elliptic curve in characteristic p. Math. Comp. 67, 353–356 (1998)zbMATHCrossRefMathSciNetGoogle Scholar
  37. 37.
    Shoup, V.: NTL: A library for doing Number Theory, Available from
  38. 38.
    Smart, N.: The discrete logarithm problem on elliptic curves of trace one. J. Cryptology 12, 193–196 (1999)zbMATHCrossRefMathSciNetGoogle Scholar
  39. 39.
    Smart, N.P.: How secure are elliptic curves over composite extension fields? In: Pfitzmann, B. (ed.) EUROCRYPT 2001. LNCS, vol. 2045, pp. 30–39. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  40. 40.
    Solinas, J.: Efficient arithmetic on Koblitz curves. Designs, Codes and Cryptography 19, 195–249 (2000)zbMATHCrossRefMathSciNetGoogle Scholar
  41. 41.
    Teske, E.: Speeding up Pollard’s rho method for computing discrete logarithms. In: Buhler, J.P. (ed.) ANTS 1998. LNCS, vol. 1423, pp. 541–554. Springer, Heidelberg (1998)CrossRefGoogle Scholar
  42. 42.
    Teske, E.: On random walks for Pollard’s rho method. Math. Comp. 70, 809–825 (2000)CrossRefMathSciNetGoogle Scholar
  43. 43.
    Teske, E.: An elliptic curve trapdoor system, Cryptology ePrint Archive Report 2003/058 (2003)Google Scholar
  44. 44.
    Wiener, M.: The full cost of cryptanalytic attacks. J. Cryptology (to appear)Google Scholar
  45. 45.
    Wiener, M., Zuccherato, R.: Faster attacks on elliptic curve cryptosystems. In: Tavares, S., Meijer, H. (eds.) SAC 1998. LNCS, vol. 1556, pp. 190–200. Springer, Heidelberg (1999)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2004

Authors and Affiliations

  • Alfred Menezes
    • 1
  • Edlyn Teske
    • 1
  • Annegret Weng
    • 2
  1. 1.University of WaterlooCanada
  2. 2.University of EssenGermany

Personalised recommendations