Genus 2 Hyperelliptic Curve Families with Explicit Jacobian Order Evaluation and Pairing-Friendly Constructions

  • Aurore Guillevic
  • Damien Vergnaud
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7708)


The use of elliptic and hyperelliptic curves in cryptography relies on the ability to compute the Jacobian order of a given curve. Recently, Satoh proposed a probabilistic polynomial time algorithm to test whether the Jacobian – over a finite field \({\mathbb{F}\!}_q\) – of a hyperelliptic curve of the form Y 2 = X 5 + aX 3 + bX (with \(a,b \in {\mathbb{F}\!}_q^*\)) has a large prime factor. His approach is to obtain candidates for the zeta function of the Jacobian over \({\mathbb{F}\!}_q^*\) from its zeta function over an extension field where the Jacobian splits. We extend and generalize Satoh’s idea to provide explicit formulas for the zeta function of the Jacobian of genus 2 hyperelliptic curves of the form Y 2 = X 5 + aX 3 + bX and Y 2 = X 6 + aX 3 + b (with \(a,b \in {\mathbb{F}\!}_q^*\)). Our results are proved by elementary (but intricate) polynomial root-finding techniques. Hyperelliptic curves with small embedding degree and large prime-order subgroup are key ingredients for implementing pairing-based cryptographic systems. Using our closed formulas for the Jacobian order, we propose two algorithms which complement those of Freeman and Satoh to produce genus 2 pairing-friendly hyperelliptic curves. Our method relies on techniques initially proposed to produce pairing-friendly elliptic curves (namely, the Cocks-Pinch method and the Brezing-Weng method). We show that the previous security considerations about embedding degree are valid for an elliptic curve and can be lightened for a Jacobian. We demonstrate this method by constructing several interesting curves with ρ-values around 4 with a Cocks-Pinch-like method and around 3 with a Brezing-Weng-like method.


Hyperelliptic Curves Genus 2 Order Computation Ordinary Curves Pairing-Friendly Constructions Cocks-Pinch Method Brezing-Weng Method 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Atkin, A.O.L., Morain, F.: Elliptic curves and primality proving. Math. Comput. 61, 29–68 (1993)MathSciNetzbMATHCrossRefGoogle Scholar
  2. 2.
    Balakrishnan, J., Belding, J., Chisholm, S., Eisenträger, K., Stange, K., Teske, E.: Pairings on hyperelliptic curves. In: WIN - Women in Numbers: Research Directions in Number Theory. Fields Institute Communications, vol. 60, pp. 87–120. Amer. Math. Soc., Providence (2011)Google Scholar
  3. 3.
    Benger, N., Charlemagne, M., Freeman, D.M.: On the Security of Pairing-Friendly Abelian Varieties over Non-prime Fields. In: Shacham, H., Waters, B. (eds.) Pairing 2009. LNCS, vol. 5671, pp. 52–65. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  4. 4.
    Boneh, D., Franklin, M.K.: Identity-based encryption from the Weil pairing. SIAM J. Comput. 32(3), 586–615 (2003)MathSciNetzbMATHCrossRefGoogle Scholar
  5. 5.
    Boneh, D., Lynn, B., Shacham, H.: Short signatures from the Weil pairing. J. Cryptology 17(4), 297–319 (2004)MathSciNetzbMATHCrossRefGoogle Scholar
  6. 6.
    Bosma, W., Cannon, J., Playoust, C.: The Magma algebra system. I. The user language. J. Symbolic Comput. 24(3-4), 235–265 (1997); Computational algebra and number theory, London (1993)MathSciNetzbMATHCrossRefGoogle Scholar
  7. 7.
    Brezing, F., Weng, A.: Elliptic curves suitable for pairing based cryptography. Des. Codes Cryptography 37(1), 133–141 (2005)MathSciNetzbMATHCrossRefGoogle Scholar
  8. 8.
  9. 9.
    Cocks, C., Pinch, R.G.: ID-based cryptosystems based on the Weil pairing (2001) (unpublished manuscript)Google Scholar
  10. 10.
    Dupont, R., Enge, A., Morain, F.: Building curves with arbitrary small mov degree over finite prime fields. J. Cryptology 18(2), 79–89 (2005)MathSciNetzbMATHCrossRefGoogle Scholar
  11. 11.
    Enge, A.: CM Software (February 2012),
  12. 12.
    Freeman, D., Scott, M., Teske, E.: A taxonomy of pairing-friendly elliptic curves. J. Cryptology 23(2), 224–280 (2010)MathSciNetzbMATHCrossRefGoogle Scholar
  13. 13.
    Freeman, D., Stevenhagen, P., Streng, M.: Abelian Varieties with Prescribed Embedding Degree. In: van der Poorten, A.J., Stein, A. (eds.) ANTS-VIII 2008. LNCS, vol. 5011, pp. 60–73. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  14. 14.
    Freeman, D.M., Satoh, T.: Constructing pairing-friendly hyperelliptic curves using weil restriction. J. Number Theory 131(5), 959–983 (2011)MathSciNetzbMATHCrossRefGoogle Scholar
  15. 15.
    Furukawa, E., Kawazoe, M., Takahashi, T.: Counting Points for Hyperelliptic Curves of Type y 2 = x 5 + ax over Finite Prime Fields. In: Matsui, M., Zuccherato, R.J. (eds.) SAC 2003. LNCS, vol. 3006, pp. 26–41. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  16. 16.
    Galbraith, S.D.: Pairings. In: Blake, I.F., Seroussi, G., Smart, N.P. (eds.) Advances in Elliptic Curve Cryptography. London Mathematical Society Lecture Note Series, vol. 317, ch. 9. Cambridge Univ. Press (2004)Google Scholar
  17. 17.
    Galbraith, S.D., Hess, F., Vercauteren, F.: Hyperelliptic Pairings. In: Takagi, T., Okamoto, T., Okamoto, E., Okamoto, T. (eds.) Pairing 2007. LNCS, vol. 4575, pp. 108–131. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  18. 18.
    Galbraith, S.D., Pujolas, J., Ritzenthaler, C., Smith, B.: Distortion maps for supersingular genus two curves. J. Math. Crypt. 3(1), 1–18 (2009)MathSciNetzbMATHCrossRefGoogle Scholar
  19. 19.
    Gallant, R.P., Lambert, R.J., Vanstone, S.A.: Faster Point Multiplication on Elliptic Curves with Efficient Endomorphisms. In: Kilian, J. (ed.) CRYPTO 2001. LNCS, vol. 2139, pp. 190–200. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  20. 20.
    Gaudry, P.: Fast genus 2 arithmetic based on theta functions. J. Math. Crypt. 1(3), 243–265 (2007)MathSciNetzbMATHGoogle Scholar
  21. 21.
    Gaudry, P., Kohel, D., Smith, B.: Counting Points on Genus 2 Curves with Real Multiplication. In: Lee, D.H., Wang, X. (eds.) ASIACRYPT 2011. LNCS, vol. 7073, pp. 504–519. Springer, Heidelberg (2011)CrossRefGoogle Scholar
  22. 22.
    Gaudry, P., Schost, É.: On the Invariants of the Quotients of the Jacobian of a Curve of Genus 2. In: Bozta, S., Sphparlinski, I. (eds.) AAECC 2001. LNCS, vol. 2227, pp. 373–386. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  23. 23.
    Gaudry, P., Schost, É.: Genus 2 point counting over prime fields. J. Symb. Comput. 47(4), 368–400 (2012)MathSciNetzbMATHCrossRefGoogle Scholar
  24. 24.
    Kachisa, E.J., Schaefer, E.F., Scott, M.: Constructing Brezing-Weng Pairing-Friendly Elliptic Curves Using Elements in the Cyclotomic Field. In: Galbraith, S.D., Paterson, K.G. (eds.) Pairing 2008. LNCS, vol. 5209, pp. 126–135. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  25. 25.
    Kachisa, E.J.: Generating More Kawazoe-Takahashi Genus 2 Pairing-Friendly Hyperelliptic Curves. In: Joye, M., Miyaji, A., Otsuka, A. (eds.) Pairing 2010. LNCS, vol. 6487, pp. 312–326. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  26. 26.
    Kawazoe, M., Takahashi, T.: Pairing-Friendly Hyperelliptic Curves with Ordinary Jacobians of Type y 2 = x 5 + ax. In: Galbraith, S.D., Paterson, K.G. (eds.) Pairing 2008. LNCS, vol. 5209, pp. 164–177. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  27. 27.
    Koblitz, N.: Elliptic curve cryptosystems. Math. Comp. 48(177), 203–209 (1987)MathSciNetzbMATHCrossRefGoogle Scholar
  28. 28.
    Koblitz, N.: Hyperelliptic cryptosystems. J. Cryptology 1, 139–150 (1989)MathSciNetzbMATHCrossRefGoogle Scholar
  29. 29.
    Konstantinou, E., Kontogeorgis, A., Stamatiou, Y., Zaroliagis, C.: On the efficient generation of prime-order elliptic curves. J. Cryptology 23, 477–503 (2010)MathSciNetzbMATHCrossRefGoogle Scholar
  30. 30.
    Konstantinou, E., Stamatiou, Y., Zaroliagis, C.: Efficient generation of secure elliptic curves. International Journal of Information Security 6, 47–63 (2007)CrossRefGoogle Scholar
  31. 31.
    Lercier, R.: Algorithmique des courbes elliptiques dans les corps finis. PhD thesis, École Polytechnique (1997)Google Scholar
  32. 32.
    Lercier, R., Lubicz, D., Vercauteren, F.: Point counting on elliptic and hyperelliptic curves. In: Avanzi, R.M., Cohen, H., Doche, C., Frey, G., Lange, T., Nguyen, K., Vercauteren, F. (eds.) Handbook of Elliptic and Hyperelliptic Curve Cryptography. Discrete Mathematics and its Applications, vol. 34, ch. 17, pp. 239–263. CRC Press, Boca Raton (2005)Google Scholar
  33. 33.
    Miller, V.S.: Use of Elliptic Curves in Cryptography. In: Williams, H.C. (ed.) CRYPTO 1985. LNCS, vol. 218, pp. 417–426. Springer, Heidelberg (1986)Google Scholar
  34. 34.
    Satoh, T.: On p-adic Point Counting Algorithms for Elliptic Curves over Finite Fields. In: Fieker, C., Kohel, D.R. (eds.) ANTS 2002. LNCS, vol. 2369, pp. 43–66. Springer, Heidelberg (2002)CrossRefGoogle Scholar
  35. 35.
    Satoh, T.: Generating Genus Two Hyperelliptic Curves over Large Characteristic Finite Fields. In: Joux, A. (ed.) EUROCRYPT 2009. LNCS, vol. 5479, pp. 536–553. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  36. 36.
    Schoof, R.: Elliptic curves over finite fields and the computation of square roots mod p. Math. Comput. 44, 483–494 (1998)MathSciNetGoogle Scholar
  37. 37.
    Scott, M.: MIRACL library (August 2011),
  38. 38.
    Takashima, K.: A new type of fast endomorphisms on jacobians of hyperelliptic curves and their cryptographic application. IEICE Transactions 89-A(1), 124–133 (2006)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2013

Authors and Affiliations

  • Aurore Guillevic
    • 1
    • 2
  • Damien Vergnaud
    • 1
  1. 1.Équipe crypto DI, École Normale Supérieure, C.N.R.S., I.N.R.I.A.Paris Cedex 05France
  2. 2.Laboratoire ChiffreThales Communications & Security S.A.Colombes CedexFrance

Personalised recommendations