Arithmetic operators for pairing-based cryptography
|
|
- Jayson Short
- 5 years ago
- Views:
Transcription
1 7. Kryptotag November 9 th, 2007 Arithmetic operators for pairing-based cryptography Jérémie Detrey Cosec, B-IT, Bonn, Germany jdetrey@bit.uni-bonn.de Joint work with: Jean-Luc Beuchat Nicolas Brisebarre Eiji Okamoto Masaaki Shirase Tsuyoshi Takagi LCIS, University of Tsukuba, Japan LIP, École Normale Supérieure de Lyon, Lyon, France LCIS, University of Tsukuba, Japan IST Lab., Future University, Hakodate, Japan IST Lab., Future University, Hakodate, Japan
2 Outline of the talk 1 Pairings? Arithmetic over F 3 m Unified operator Results Final thoughts Jérémie Detrey Arithmetic operators for pairing-based cryptography 1 / 21
3 Elliptic curves 2 E defined by an equation of the form y 2 = x 3 + Ax + B E Jérémie Detrey Arithmetic operators for pairing-based cryptography 2 / 21
4 Elliptic curves 2 E defined by an equation of the form y 2 = x 3 + Ax + B E(K) set of rational points over a field K E Q P Jérémie Detrey Arithmetic operators for pairing-based cryptography 2 / 21
5 Elliptic curves 2 E defined by an equation of the form y 2 = x 3 + Ax + B E(K) set of rational points over a field K E Additive group law over E(K) Q P P + Q Jérémie Detrey Arithmetic operators for pairing-based cryptography 2 / 21
6 Elliptic curves 2 E defined by an equation of the form y 2 = x 3 + Ax + B E(K) set of rational points over a field K E Additive group law over E(K) Q Many applications in cryptography P EC-based Diffie-Hellman key exchange EC-based Digital Signature Algorithm... P + Q Jérémie Detrey Arithmetic operators for pairing-based cryptography 2 / 21
7 Elliptic curves 2 E defined by an equation of the form y 2 = x 3 + Ax + B E(K) set of rational points over a field K E Additive group law over E(K) Q Many applications in cryptography P EC-based Diffie-Hellman key exchange EC-based Digital Signature Algorithm... P + Q But there s more: bilinear pairings Jérémie Detrey Arithmetic operators for pairing-based cryptography 2 / 21
8 Bilinear pairings 3 G 1 = P an additively-written group G 2 a multiplicatively-written group Jérémie Detrey Arithmetic operators for pairing-based cryptography 3 / 21
9 Bilinear pairings 3 G 1 = P an additively-written group G 2 a multiplicatively-written group A bilinear pairing on (G 1, G 2 ) is a map that satisfies the following conditions: ê : G 1 G 1 G 2 computability: ê can be efficiently computed non-degeneracy: ê(p, P) 1 G2 bilinearity: for all Q 1, Q 2 and R G 1, ê(q 1 + Q 2, R) = ê(q 1, R)ê(Q 2, R) and ê(r, Q 1 + Q 2 ) = ê(r, Q 1 )ê(r, Q 2 ) Jérémie Detrey Arithmetic operators for pairing-based cryptography 3 / 21
10 Bilinear pairings 3 G 1 = P an additively-written group G 2 a multiplicatively-written group A bilinear pairing on (G 1, G 2 ) is a map that satisfies the following conditions: ê : G 1 G 1 G 2 computability: ê can be efficiently computed non-degeneracy: ê(p, P) 1 G2 bilinearity: for all Q 1, Q 2 and R G 1, ê(q 1 + Q 2, R) = ê(q 1, R)ê(Q 2, R) and ê(r, Q 1 + Q 2 ) = ê(r, Q 1 )ê(r, Q 2 ) Immediate property: for any integer a, ê(ap, P) = ê(p, ap) = ê(p, P) a Jérémie Detrey Arithmetic operators for pairing-based cryptography 3 / 21
11 Pairings in cryptography 4 At first, used to reduce discrete logarithm problems to simpler instances Menezes-Okamoto-Vanstone (MOV) attack, 1993 Jérémie Detrey Arithmetic operators for pairing-based cryptography 4 / 21
12 Pairings in cryptography 4 At first, used to reduce discrete logarithm problems to simpler instances Menezes-Okamoto-Vanstone (MOV) attack, 1993 One-round three-party key agreement (Joux, 2000) Identity-based encryption Boneh-Franklin, 2001 Sakai-Kasahara, Short signatures Boneh-Lynn-Shacham (BLS), 2001 Zang-Safavi-Naini-Susilo (ZSS), Jérémie Detrey Arithmetic operators for pairing-based cryptography 4 / 21
13 Pairings over elliptic curves 5 E defined over a finite field F p m, with p prime and m 1 An integer l not divisible by p Jérémie Detrey Arithmetic operators for pairing-based cryptography 5 / 21
14 Pairings over elliptic curves 5 E defined over a finite field F p m, with p prime and m 1 An integer l not divisible by p Additive group, F p m-rational l-torsion points: G 1 = E(F p m)[l] Multiplicative group, l-th roots of unity: G 2 = µ l F p km k is the embedding degree of the curve E Jérémie Detrey Arithmetic operators for pairing-based cryptography 5 / 21
15 Pairings over elliptic curves 5 E defined over a finite field F p m, with p prime and m 1 An integer l not divisible by p Additive group, F p m-rational l-torsion points: G 1 = E(F p m)[l] Multiplicative group, l-th roots of unity: G 2 = µ l F p km k is the embedding degree of the curve E ê : E(F p m)[l] E(F p m)[l] µ l Jérémie Detrey Arithmetic operators for pairing-based cryptography 5 / 21
16 Pairings over elliptic curves 6 Which embedding degree? Jérémie Detrey Arithmetic operators for pairing-based cryptography 6 / 21
17 Pairings over elliptic curves 6 Which embedding degree? ordinary curves? usually very large k Jérémie Detrey Arithmetic operators for pairing-based cryptography 6 / 21
18 Pairings over elliptic curves 6 Which embedding degree? ordinary curves? usually very large k supersingular curves? Finite field F p m Maximal k m even 3 m odd, p = 2 4 m odd, p = 3 6 m odd, p > 3 2 Jérémie Detrey Arithmetic operators for pairing-based cryptography 6 / 21
19 Pairings over elliptic curves 6 Which embedding degree? ordinary curves? usually very large k supersingular curves? Finite field F p m Maximal k m even 3 m odd, p = 2 4 m odd, p = 3 6 m odd, p > 3 2 Jérémie Detrey Arithmetic operators for pairing-based cryptography 6 / 21
20 Pairings over elliptic curves 6 Which embedding degree? ordinary curves? usually very large k supersingular curves? Finite field F p m Maximal k m even 3 m odd, p = 2 4 m odd, p = 3 6 m odd, p > 3 2 Which pairing? Weil pairing Tate pairing η T pairing Ate pairing Jérémie Detrey Arithmetic operators for pairing-based cryptography 6 / 21
21 Pairings over elliptic curves 6 Which embedding degree? ordinary curves? usually very large k supersingular curves? Finite field F p m Maximal k m even 3 m odd, p = 2 4 m odd, p = 3 6 m odd, p > 3 2 Which pairing? Weil pairing Tate pairing η T pairing Ate pairing Jérémie Detrey Arithmetic operators for pairing-based cryptography 6 / 21
22 η T pairing in characteristic 3 7 Need for arithmetic over: F 3 m F 3 6m ηˆ T : E(F 3 m)[l] E(F 3 m)[l] µ l F 3 6m Jérémie Detrey Arithmetic operators for pairing-based cryptography 7 / 21
23 η T pairing in characteristic 3 7 Need for arithmetic over: ηˆ T : E(F 3 m)[l] E(F 3 m)[l] µ l F 3 6m F 3 m F 3 6m arithmetic on the underlying field F 3 m Jérémie Detrey Arithmetic operators for pairing-based cryptography 7 / 21
24 η T pairing in characteristic 3 7 Need for arithmetic over: ηˆ T : E(F 3 m)[l] E(F 3 m)[l] µ l F 3 6m F 3 m F 3 6m arithmetic on the underlying field F 3 m Operations over F 3 m: Operation Count m = 97 +/ 121 m m a 3 17 m a Jérémie Detrey Arithmetic operators for pairing-based cryptography 7 / 21
25 η T pairing in characteristic 3 7 Need for arithmetic over: ηˆ T : E(F 3 m)[l] E(F 3 m)[l] µ l F 3 6m F 3 m F 3 6m arithmetic on the underlying field F 3 m Operations over F 3 m: Arithmetic over F 3 m: Operation Count m = 97 +/ 121 m m a 3 17 m a Polynomial basis: F 3 m = F 3 [x]/(f (x)) Degree-m irreducible polynomial f (x) carefully chosen Jérémie Detrey Arithmetic operators for pairing-based cryptography 7 / 21
26 8 Addition over F 3 m a(x) b(x) a(x) + b(x) Jérémie Detrey Arithmetic operators for pairing-based cryptography 8 / 21
27 8 Addition over F 3 m a(x) b(x) a m 1 b m 1 a 1 b 1 a 0 b 0 a(x) + b(x) (a m 1 + b m 1 ) mod 3 (a 1 + b 1 ) mod 3 (a 0 + b 0 ) mod 3 coefficient-wise addition over F 3 Jérémie Detrey Arithmetic operators for pairing-based cryptography 8 / 21
28 8 Addition over F 3 m a(x) b(x) a(x) + b(x) a m 1 b m 1 (a m 1 + b m 1 ) mod 3 a 1 b 1 (a 1 + b 1 ) mod 3 a 0 b 0 (a 0 + b 0 ) mod coefficient-wise addition over F 3 addition over F 3 : small look-up table Jérémie Detrey Arithmetic operators for pairing-based cryptography 8 / 21
29 9 Addition, subtraction and accumulation over F 3 m load c 0 add/sub c 2 enable c 5 a(x) b(x) +/ +/ 0 r(x) c 1 load c 3 add/sub c 4 accumulate sign selection: multiplication by 1 or 2 feedback loop for accumulation a(x) 2a(x) (mod 3) Jérémie Detrey Arithmetic operators for pairing-based cryptography 9 / 21
30 10 Multiplication over F 3 m Parallel-serial multiplication multiplicand loaded in a parallel register multiplier loaded in a shift register Most significant coefficients first D coefficients processed at each iteration: m D iterations per multiplication Jérémie Detrey Arithmetic operators for pairing-based cryptography 10 / 21
31 11 Multiplication over F 3 m load c 0 a(x) PPG PPG x mod f (x) enable clear c 3 c 4 b(x) shift register PPG x 2 mod f (x) r(x) c 1 load c 2 shift x 3 mod f (x) partial product generator (PPG): m multiplications over F 3 multiplication by x i : only wiring simple modular reductions Jérémie Detrey Arithmetic operators for pairing-based cryptography 11 / 21
32 12 Cubing over F 3 m Cubing in characteristic 3 is the Frobenius map We compute the normal form of a(x) 3 mod f (x) Jérémie Detrey Arithmetic operators for pairing-based cryptography 12 / 21
33 12 Cubing over F 3 m Cubing in characteristic 3 is the Frobenius map We compute the normal form of a(x) 3 mod f (x) Example: m = 97 and f (x) = x 97 + x a(x) 3 mod f (x) = (a 32 x 96 + a 64 x 95 + a 96 x a 33 x 2 + a 65 x + a 0 ) 1 + ( 0 + a 60 x 95 + a 88 x a 61 x + a 89 ) 1 + ( 0 + a 60 x 95 + a 92 x a 61 x + a 93 ) 1 Jérémie Detrey Arithmetic operators for pairing-based cryptography 12 / 21
34 12 Cubing over F 3 m Cubing in characteristic 3 is the Frobenius map We compute the normal form of a(x) 3 mod f (x) Example: m = 97 and f (x) = x 97 + x a(x) 3 mod f (x) = (a 32 x 96 + a 64 x 95 + a 96 x a 33 x 2 + a 65 x + a 0 ) 1 + ( 0 + a 60 x 95 + a 88 x a 61 x + a 89 ) 1 + ( 0 + a 60 x 95 + a 92 x a 61 x + a 93 ) 1 = w 1 ν 1 (x) + w 2 ν 2 (x) + w 3 ν 3 (x) Required hardware: only wires to compute the ν i (x) s possibly multiplications over F 3 multi-operand addition over F 3 m Jérémie Detrey Arithmetic operators for pairing-based cryptography 12 / 21
35 13 Cubing over F 3 m select load c 0 c 1 sign c 2 a(x) ±w3 ±w2 ±w1 ν 1 (x) ν 2 (x) ν 3 (x) enable c 3 r(x) feedback loop for successive cubings sign selection for computing either a(x) 3 or a(x) 3 Jérémie Detrey Arithmetic operators for pairing-based cryptography 13 / 21
36 14 Inversion over F 3 m Extended Euclidean algorithm? Jérémie Detrey Arithmetic operators for pairing-based cryptography 14 / 21
37 14 Inversion over F 3 m Extended Euclidean algorithm? fast computation... but need for additional hardware Jérémie Detrey Arithmetic operators for pairing-based cryptography 14 / 21
38 14 Inversion over F 3 m Extended Euclidean algorithm? fast computation... but need for additional hardware Preferred solution: Fermat s little theorem a(x) 1 = a(x) 3m 2 on F 3 m Jérémie Detrey Arithmetic operators for pairing-based cryptography 14 / 21
39 14 Inversion over F 3 m Extended Euclidean algorithm? fast computation... but need for additional hardware Preferred solution: Fermat s little theorem a(x) 1 = a(x) 3m 2 on F 3 m algorithm by Itoh and Tsujii requires only multiplications and cubings over F 3 m Jérémie Detrey Arithmetic operators for pairing-based cryptography 14 / 21
40 14 Inversion over F 3 m Extended Euclidean algorithm? fast computation... but need for additional hardware Preferred solution: Fermat s little theorem a(x) 1 = a(x) 3m 2 on F 3 m algorithm by Itoh and Tsujii requires only multiplications and cubings over F 3 m only one inversion for the full pairing: delay overhead is negligible (< 1%) Jérémie Detrey Arithmetic operators for pairing-based cryptography 14 / 21
41 The full processing element 15 a(x) b(x) addition multiplication r(x) cubing control Jérémie Detrey Arithmetic operators for pairing-based cryptography 15 / 21
42 The full processing element 15 a(x) b(x) addition multiplication r(x) cubing control For the η T pairing: almost no parallelism between additions, multiplications and cubings Can we share hardware resources between the three operators? Jérémie Detrey Arithmetic operators for pairing-based cryptography 15 / 21
43 Unified operator 16 select c 0 load c 1 cubing c 6 multiplication c 8 a(x) b(x) c 2 c 3 select load shift register PPG PPG PPG ν 1 (x) ν 2 (x) x 2 ν 3 (x) mod f (x) x mod f (x) enable c 10 r(x) d(x) c 4 c 5 x 3 mod f (x) 0 load shift c 7 c 9 multiplication accumulate Jérémie Detrey Arithmetic operators for pairing-based cryptography 16 / 21
44 Unified operator 16 select load cubing multiplication c 0 c 1 c 6 c 8 a(x) b(x) c 2 c 3 select load shift register PPG PPG PPG ν 1 (x) ν 2 (x) x 2 ν 3 (x) mod f (x) x mod f (x) enable c 10 r(x) d(x) c 4 c 5 x 3 mod f (x) 0 load shift c 7 c 9 multiplication accumulate Jérémie Detrey Arithmetic operators for pairing-based cryptography 16 / 21
45 Unified operator 16 select load cubing multiplication c 0 c 1 c 6 c 8 a(x) b(x) c 2 c 3 select load shift register PPG PPG PPG ν 1 (x) ν 2 (x) x 2 ν 3 (x) mod f (x) x mod f (x) enable c 10 r(x) d(x) c 4 c 5 x 3 mod f (x) 0 load shift c 7 c 9 multiplication accumulate Jérémie Detrey Arithmetic operators for pairing-based cryptography 16 / 21
46 Unified operator 16 select load cubing multiplication c 0 c 1 c 6 c 8 a(x) b(x) c 2 c 3 select load shift register PPG PPG PPG ν 1 (x) ν 2 (x) x 2 ν 3 (x) mod f (x) x mod f (x) enable c 10 r(x) d(x) c 4 c 5 x 3 mod f (x) 0 load shift c 7 c 9 multiplication accumulate Jérémie Detrey Arithmetic operators for pairing-based cryptography 16 / 21
47 Results 17 Full co-processor for computation of the η T pairing field: F 3 97 with f (x) = x 97 + x processing element: unified operator with D = 3 prototype on a Xilinx Virtex-II Pro 4 FPGA Jérémie Detrey Arithmetic operators for pairing-based cryptography 17 / 21
48 Results 17 Full co-processor for computation of the η T pairing field: F 3 97 with f (x) = x 97 + x processing element: unified operator with D = 3 prototype on a Xilinx Virtex-II Pro 4 FPGA Area: 1833 slices (63% of the FPGA) and 6 memory blocks (21%) Clock frequency: 145 MHz Full η T pairing: clock cycles Computation time: 192 µs Jérémie Detrey Arithmetic operators for pairing-based cryptography 17 / 21
49 Comparisons 18 Architecture Area Time FPGA Proposed solution 1833 slices 192 µs Virtex-II Pro (CHES 07) Grabher and Page 4481 slices 432 µs Virtex-II Pro (CHES 05) Kerins et al slices 850 µs Virtex-II Pro (CHES 05) Ronan et al slices 178 µs Virtex-II Pro (ITNG 07) Beuchat et al LEs 33 µs Cyclone II (Arith 07 & WAIFI 07) ( 9000 slices) Jiang slices 21 µs Virtex-4 LX (Univ. Honk Kong, 2007) Jérémie Detrey Arithmetic operators for pairing-based cryptography 18 / 21
50 Conclusion 19 Unified operator generator Arithmetic over F p m = F p [x]/(f (x)) for given p, m and f (x) Support for the following operations: addition multiplication Frobenius map (a(x) p mod f (x)) inverse Frobenius map ( p a(x) mod f (x)) Jérémie Detrey Arithmetic operators for pairing-based cryptography 19 / 21
51 Future work 20 Characteristic 2 simpler arithmetic better suited to FPGAs (fast multiplication) Jérémie Detrey Arithmetic operators for pairing-based cryptography 20 / 21
52 Future work 20 Characteristic 2 simpler arithmetic better suited to FPGAs (fast multiplication) Pairing on hyperelliptic curves Jérémie Detrey Arithmetic operators for pairing-based cryptography 20 / 21
53 Future work 20 Characteristic 2 simpler arithmetic better suited to FPGAs (fast multiplication) Pairing on hyperelliptic curves Ate pairing Side-channel Jérémie Detrey Arithmetic operators for pairing-based cryptography 20 / 21
54 Thank you for your attention 21 Questions? Jérémie Detrey Arithmetic operators for pairing-based cryptography 21 / 21
Arithmetic Operators for Pairing-Based Cryptography
Arithmetic Operators for Pairing-Based Cryptography J.-L. Beuchat 1 N. Brisebarre 2 J. Detrey 3 E. Okamoto 1 1 University of Tsukuba, Japan 2 École Normale Supérieure de Lyon, France 3 Cosec, b-it, Bonn,
More informationArithmetic Operators for Pairing-Based Cryptography
Arithmetic Operators for Pairing-Based Cryptography Jean-Luc Beuchat Laboratory of Cryptography and Information Security Graduate School of Systems and Information Engineering University of Tsukuba 1-1-1
More informationAn Algorithm for the η T Pairing Calculation in Characteristic Three and its Hardware Implementation
An Algorithm for the η T Pairing Calculation in Characteristic Three and its Hardware Implementation Jean-Luc Beuchat 1 Masaaki Shirase 2 Tsuyoshi Takagi 2 Eiji Okamoto 1 1 Graduate School of Systems and
More informationArithmetic Operators for Pairing-Based Cryptography
Arithmetic Operators for Pairing-Based Cryptography Jean-Luc Beuchat 1, Nicolas Brisebarre 2,3, Jérémie Detrey 3, and Eiji Okamoto 1 1 Laboratory of Cryptography and Information Security, University of
More informationSome Efficient Algorithms for the Final Exponentiation of η T Pairing
Some Efficient Algorithms for the Final Exponentiation of η T Pairing Masaaki Shirase 1, Tsuyoshi Takagi 1, and Eiji Okamoto 2 1 Future University-Hakodate, Japan 2 University of Tsukuba, Japan Abstract.
More informationOn the complexity of computing discrete logarithms in the field F
On the complexity of computing discrete logarithms in the field F 3 6 509 Francisco Rodríguez-Henríquez CINVESTAV-IPN Joint work with: Gora Adj Alfred Menezes Thomaz Oliveira CINVESTAV-IPN University of
More informationOptimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves
CT-RSA 2012 February 29th, 2012 Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves Joint work with: Nicolas Estibals CARAMEL project-team, LORIA, Université de Lorraine / CNRS / INRIA,
More informationConstructing Pairing-Friendly Elliptic Curves for Cryptography
Constructing Pairing-Friendly Elliptic Curves for Cryptography University of California, Berkeley, USA 2nd KIAS-KMS Summer Workshop on Cryptography Seoul, Korea 30 June 2007 Outline 1 Pairings in Cryptography
More informationHardware Acceleration of the Tate Pairing in Characteristic Three
Hardware Acceleration of the Tate Pairing in Characteristic Three CHES 2005 Hardware Acceleration of the Tate Pairing in Characteristic Three Slide 1 Introduction Pairing based cryptography is a (fairly)
More informationModular Multiplication in GF (p k ) using Lagrange Representation
Modular Multiplication in GF (p k ) using Lagrange Representation Jean-Claude Bajard, Laurent Imbert, and Christophe Nègre Laboratoire d Informatique, de Robotique et de Microélectronique de Montpellier
More informationA Comparison between Hardware Accelerators for the Modified Tate Pairing over F 2
A Comparison between Hardware Accelerators for the Modified Tate Pairing over F m and F 3 m Jean-Luc Beuchat 1, Nicolas Brisebarre,Jérémie Detrey 3, Eiji Okamoto 1,andFranciscoRodríguez-Henríquez 4 1 Graduate
More informationKatherine Stange. ECC 2007, Dublin, Ireland
in in Department of Brown University http://www.math.brown.edu/~stange/ in ECC Computation of ECC 2007, Dublin, Ireland Outline in in ECC Computation of in ECC Computation of in Definition A integer sequence
More informationA Dierential Power Analysis attack against the Miller's Algorithm
A Dierential Power Analysis attack against the Miller's Algorithm Nadia El Mrabet (1), G. Di Natale (2) and M.L. Flottes (2) (1) Team Arith, (2) Team CCSI/LIRMM, Université Montpellier 2 Prime 2009, UCC,
More informationOptimised versions of the Ate and Twisted Ate Pairings
Optimised versions of the Ate and Twisted Ate Pairings Seiichi Matsuda 1, Naoki Kanayama 1, Florian Hess 2, and Eiji Okamoto 1 1 University of Tsukuba, Japan 2 Technische Universität Berlin, Germany Abstract.
More informationPairings for Cryptography
Pairings for Cryptography Michael Naehrig Technische Universiteit Eindhoven Ñ ÐÖÝÔØÓ ºÓÖ Nijmegen, 11 December 2009 Pairings A pairing is a bilinear, non-degenerate map e : G 1 G 2 G 3, where (G 1, +),
More informationArithmetic Operators for Pairing-Based Cryptography
Arithmetic Operators for Pairing-Based Cryptography Jean-Luc Beuchat 1, Nicolas Brisebarre 2,3,Jérémie Detrey 3, and Eiji Okamoto 1 1 Graduate School of Systems and Information Engineering, University
More informationImplementing the Weil, Tate and Ate pairings using Sage software
Sage days 10, Nancy, France Implementing the Weil, Tate and Ate pairings using Sage software Nadia EL MRABET LIRMM, I3M, Université Montpellier 2 Saturday 11 th October 2008 Outline of the presentation
More informationEfficient multiplication in characteristic three fields
Efficient multiplication in characteristic three fields Murat Cenk and M. Anwar Hasan Department of Electrical and Computer Engineering University of Waterloo, Waterloo, Ontario, Canada N2L 3G1 mcenk@uwaterloo.ca
More informationEfficient Computation of Tate Pairing in Projective Coordinate Over General Characteristic Fields
Efficient Computation of Tate Pairing in Projective Coordinate Over General Characteristic Fields Sanjit Chatterjee, Palash Sarkar and Rana Barua Cryptology Research Group Applied Statistics Unit Indian
More informationFaster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves
Faster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves Junfeng Fan, Frederik Vercauteren and Ingrid Verbauwhede Katholieke Universiteit Leuven, COSIC May 18, 2009 1 Outline What is
More informationSM9 identity-based cryptographic algorithms Part 1: General
SM9 identity-based cryptographic algorithms Part 1: General Contents 1 Scope... 1 2 Terms and definitions... 1 2.1 identity... 1 2.2 master key... 1 2.3 key generation center (KGC)... 1 3 Symbols and abbreviations...
More informationMontgomery Algorithm for Modular Multiplication with Systolic Architecture
Montgomery Algorithm for Modular Multiplication with ystolic Architecture MRABET Amine LIAD Paris 8 ENIT-TUNI EL MANAR University A - MP - Gardanne PAE 016 1 Plan 1 Introduction for pairing Montgomery
More informationEfficient Tate Pairing Computation Using Double-Base Chains
Efficient Tate Pairing Computation Using Double-Base Chains Chang an Zhao, Fangguo Zhang and Jiwu Huang 1 Department of Electronics and Communication Engineering, Sun Yat-Sen University, Guangzhou 510275,
More informationHardware Acceleration of the Tate Pairing in Characteristic Three
Hardware Acceleration of the Tate Pairing in Characteristic Three P. Grabher and D. Page Institute for Applied Information Processing and Communications, Graz University of Technology, Inffeldgasse 16a,
More informationConstructing Abelian Varieties for Pairing-Based Cryptography
for Pairing-Based CWI and Universiteit Leiden, Netherlands Workshop on Pairings in Arithmetic Geometry and 4 May 2009 s MNT MNT Type s What is pairing-based cryptography? Pairing-based cryptography refers
More informationAn Introduction to Pairings in Cryptography
An Introduction to Pairings in Cryptography Craig Costello Information Security Institute Queensland University of Technology INN652 - Advanced Cryptology, October 2009 Outline 1 Introduction to Pairings
More informationABHELSINKI UNIVERSITY OF TECHNOLOGY
On Repeated Squarings in Binary Fields Kimmo Järvinen Helsinki University of Technology August 14, 2009 K. Järvinen On Repeated Squarings in Binary Fields 1/1 Introduction Repeated squaring Repeated squaring:
More informationReprésentation RNS des nombres et calcul de couplages
Représentation RNS des nombres et calcul de couplages Sylvain Duquesne Université Rennes 1 Séminaire CCIS Grenoble, 7 Février 2013 Sylvain Duquesne (Rennes 1) RNS et couplages Grenoble, 07/02/13 1 / 29
More informationAspects of Pairing Inversion
Applications of Aspects of ECC 2007 - Dublin Aspects of Applications of Applications of Aspects of Applications of Pairings Let G 1, G 2, G T be groups of prime order r. A pairing is a non-degenerate bilinear
More informationShort Signature Scheme From Bilinear Pairings
Sedat Akleylek, Barış Bülent Kırlar, Ömer Sever, and Zaliha Yüce Institute of Applied Mathematics, Middle East Technical University, Ankara, Turkey {akleylek,kirlar}@metu.edu.tr,severomer@yahoo.com,zyuce@stm.com.tr
More informationBreaking pairing-based cryptosystems using η T pairing over GF (3 97 )
Breaking pairing-based cryptosystems using η T pairing over GF (3 97 ) Takuya Hayashi 1, Takeshi Shimoyama 2, Naoyuki Shinohara 3, and Tsuyoshi Takagi 1 1 Kyushu University 2 FUJITSU LABORATORIES Ltd.
More information標数 3 の超特異楕円曲線上の ηt ペアリングの高速実装
九州大学学術情報リポジトリ Kyushu University Institutional Repository 標数 3 の超特異楕円曲線上の ηt ペアリングの高速実装 川原, 祐人九州大学大学院数理学府 https://doi.org/10.15017/21704 出版情報 :Kyushu University, 2011, 博士 ( 機能数理学 ), 課程博士バージョン :published
More informationAsymmetric Pairings. Alfred Menezes (joint work with S. Chatterjee, D. Hankerson & E. Knapp)
Asymmetric Pairings Alfred Menezes (joint work with S. Chatterjee, D. Hankerson & E. Knapp) 1 Overview In their 2006 paper "Pairings for cryptographers", Galbraith, Paterson and Smart identified three
More informationA Pipelined Karatsuba-Ofman Multiplier over GF(3 97 ) Amenable for Pairing Computation
A Pipelined Karatsuba-Ofman Multiplier over GF(3 97 ) Amenable for Pairing Computation Nidia Cortez-Duarte 1, Francisco Rodríguez-Henríquez 1, Jean-Luc Beuchat 2 and Eiji Okamoto 2 1 Computer Science Departament,
More informationNon-generic attacks on elliptic curve DLPs
Non-generic attacks on elliptic curve DLPs Benjamin Smith Team GRACE INRIA Saclay Île-de-France Laboratoire d Informatique de l École polytechnique (LIX) ECC Summer School Leuven, September 13 2013 Smith
More informationConstructing Families of Pairing-Friendly Elliptic Curves
Constructing Families of Pairing-Friendly Elliptic Curves David Freeman Information Theory Research HP Laboratories Palo Alto HPL-2005-155 August 24, 2005* cryptography, pairings, elliptic curves, embedding
More informationBackground of Pairings
Background of Pairings Tanja Lange Department of Mathematics and Computer Science Technische Universiteit Eindhoven The Netherlands tanja@hyperelliptic.org 04.09.2007 Tanja Lange Background of Pairings
More informationA Remark on Implementing the Weil Pairing
A Remark on Implementing the Weil Pairing Cheol Min Park 1, Myung Hwan Kim 1 and Moti Yung 2 1 ISaC and Department of Mathematical Sciences, Seoul National University, Korea {mpcm,mhkim}@math.snu.ac.kr
More informationParshuram Budhathoki FAU October 25, Ph.D. Preliminary Exam, Department of Mathematics, FAU
Parshuram Budhathoki FAU October 25, 2012 Motivation Diffie-Hellman Key exchange What is pairing? Divisors Tate pairings Miller s algorithm for Tate pairing Optimization Alice, Bob and Charlie want to
More informationIntroduction to Elliptic Curve Cryptography. Anupam Datta
Introduction to Elliptic Curve Cryptography Anupam Datta 18-733 Elliptic Curve Cryptography Public Key Cryptosystem Duality between Elliptic Curve Cryptography and Discrete Log Based Cryptography Groups
More informationAte Pairing on Hyperelliptic Curves
Ate Pairing on Hyperelliptic Curves R. Granger, F. Hess, R. Oyono, N. Thériault F. Vercauteren EUROCRYPT 2007 - Barcelona Pairings Pairings Let G 1, G 2, G T be groups of prime order l. A pairing is a
More informationReducing the Key Size of Rainbow using Non-Commutative Rings
Reducing the Key Size of Rainbow using Non-Commutative Rings Takanori Yasuda (Institute of systems, Information Technologies and Nanotechnologies (ISIT)), Kouichi Sakurai (ISIT, Kyushu university) and
More informationFinite Fields. SOLUTIONS Network Coding - Prof. Frank H.P. Fitzek
Finite Fields In practice most finite field applications e.g. cryptography and error correcting codes utilizes a specific type of finite fields, namely the binary extension fields. The following exercises
More informationNumber Theory in Cryptology
Number Theory in Cryptology Abhijit Das Department of Computer Science and Engineering Indian Institute of Technology Kharagpur October 15, 2011 What is Number Theory? Theory of natural numbers N = {1,
More informationHigh Speed Cryptoprocessor for η T Pairing on 128-bit Secure Supersingular Elliptic Curves over Characteristic Two Fields
High Speed Cryptoprocessor for η T Pairing on 128-bit Secure Supersingular Elliptic Curves over Characteristic Two Fields Santosh Ghosh, Dipanwita Roychowdhury, and Abhijit Das Computer Science and Engineering
More informationHardware Architectures of Elliptic Curve Based Cryptosystems over Binary Fields
Hardware Architectures of Elliptic Curve Based Cryptosystems over Binary Fields Chang Shu Doctoral Dissertation Defense Feb. 8, 007 Advisor: Dr. Kris Gaj Dept. of Electrical & Computer Engineering George
More informationMulti-core Implementation of the Tate Pairing over Supersingular Elliptic Curves
Multi-core Implementation of the Tate Pairing over Supersingular Elliptic Curves Jean-Luc Beuchat 1, Emmanuel López-Trejo, Luis Martínez-Ramos 3, Shigeo Mitsunari 4, and Francisco Rodríguez-Henríquez 3
More informationEfficient Implementation of Cryptographic pairings. Mike Scott Dublin City University
Efficient Implementation of Cryptographic pairings Mike Scott Dublin City University First Steps To do Pairing based Crypto we need two things l Efficient algorithms l Suitable elliptic curves We have
More informationKatherine Stange. Pairing, Tokyo, Japan, 2007
via via Department of Mathematics Brown University http://www.math.brown.edu/~stange/ Pairing, Tokyo, Japan, 2007 Outline via Definition of an elliptic net via Definition (KS) Let R be an integral domain,
More informationOne can use elliptic curves to factor integers, although probably not RSA moduli.
Elliptic Curves Elliptic curves are groups created by defining a binary operation (addition) on the points of the graph of certain polynomial equations in two variables. These groups have several properties
More informationCyclic Groups in Cryptography
Cyclic Groups in Cryptography p. 1/6 Cyclic Groups in Cryptography Palash Sarkar Indian Statistical Institute Cyclic Groups in Cryptography p. 2/6 Structure of Presentation Exponentiation in General Cyclic
More informationSecure Bilinear Diffie-Hellman Bits
Secure Bilinear Diffie-Hellman Bits Steven D. Galbraith 1, Herbie J. Hopkins 1, and Igor E. Shparlinski 2 1 Mathematics Department, Royal Holloway University of London Egham, Surrey, TW20 0EX, UK Steven.Galbraith@rhul.ac.uk,
More informationGenerating more Kawazoe-Takahashi Genus 2 Pairing-friendly Hyperelliptic Curves
Generating more Kawazoe-Takahashi Genus 2 Pairing-friendly Hyperelliptic Curves Ezekiel J Kachisa School of Computing Dublin City University Ireland ekachisa@computing.dcu.ie Abstract. Constructing pairing-friendly
More informationElliptic curves: Theory and Applications. Day 4: The discrete logarithm problem.
Elliptic curves: Theory and Applications. Day 4: The discrete logarithm problem. Elisa Lorenzo García Université de Rennes 1 14-09-2017 Elisa Lorenzo García (Rennes 1) Elliptic Curves 4 14-09-2017 1 /
More informationElliptic Curve Cryptography
The State of the Art of Elliptic Curve Cryptography Ernst Kani Department of Mathematics and Statistics Queen s University Kingston, Ontario Elliptic Curve Cryptography 1 Outline 1. ECC: Advantages and
More informationPolynomial Interpolation in the Elliptic Curve Cryptosystem
Journal of Mathematics and Statistics 7 (4): 326-331, 2011 ISSN 1549-3644 2011 Science Publications Polynomial Interpolation in the Elliptic Curve Cryptosystem Liew Khang Jie and Hailiza Kamarulhaili School
More informationEfficient Algorithms for Pairing-Based Cryptosystems
Efficient Algorithms for Pairing-Based Cryptosystems Paulo S. L. M. Barreto 1, Hae Y. Kim 1, Ben Lynn 2, and Michael Scott 3 1 Universidade de São Paulo, Escola Politécnica. Av. Prof. Luciano Gualberto,
More informationHardware implementations of ECC
Hardware implementations of ECC The University of Electro- Communications Introduction Public- key Cryptography (PKC) The most famous PKC is RSA and ECC Used for key agreement (Diffie- Hellman), digital
More informationPairings at High Security Levels
Pairings at High Security Levels Michael Naehrig Eindhoven University of Technology michael@cryptojedi.org DoE CRYPTODOC Darmstadt, 21 November 2011 Pairings are efficient!... even at high security levels.
More informationFormulas for cube roots in F 3 m
Discrete Applied Mathematics 155 (2007) 260 270 www.elsevier.com/locate/dam Formulas for cube roots in F 3 m Omran Ahmadi a, Darrel Hankerson b, Alfred Menezes a a Department of Combinatorics and Optimization,
More informationOptimal TNFS-secure pairings on elliptic curves with even embedding degree
Optimal TNFS-secure pairings on elliptic curves with even embedding degree Georgios Fotiadis 1 and Chloe Martindale 2 1 University of the Aegean, Greece gfotiadis@aegean.gr 2 Technische Universiteit Eindhoven,
More informationImplementing Pairing-Based Cryptosystems
Implementing Pairing-Based Cryptosystems Zhaohui Cheng and Manos Nistazakis School of Computing Science, Middlesex University White Hart Lane, London N17 8HR, UK. {m.z.cheng, e.nistazakis}@mdx.ac.uk Abstract:
More informationHigh Speed Cryptoprocessor for η T Pairing on 128-bit Secure Supersingular Elliptic Curves over Characteristic Two Fields
High Speed Cryptoprocessor for η T Pairing on 128-bit Secure Supersingular Elliptic Curves over Characteristic Two Fields Santosh Ghosh, Dipanwita Roy Chowdhury, and Abhijit Das Computer Science and Engineering
More informationAn FPGA-based Accelerator for Tate Pairing on Edwards Curves over Prime Fields
. Motivation and introduction An FPGA-based Accelerator for Tate Pairing on Edwards Curves over Prime Fields Marcin Rogawski Ekawat Homsirikamol Kris Gaj Cryptographic Engineering Research Group (CERG)
More informationGF(2 m ) arithmetic: summary
GF(2 m ) arithmetic: summary EE 387, Notes 18, Handout #32 Addition/subtraction: bitwise XOR (m gates/ops) Multiplication: bit serial (shift and add) bit parallel (combinational) subfield representation
More informationHardware Implementation of Elliptic Curve Point Multiplication over GF (2 m ) for ECC protocols
Hardware Implementation of Elliptic Curve Point Multiplication over GF (2 m ) for ECC protocols Moncef Amara University of Paris 8 LAGA laboratory Saint-Denis / France Amar Siad University of Paris 8 LAGA
More informationPairings on Generalized Huff Curves
Pairings on Generalized Huff Curves Abdoul Aziz Ciss and Djiby Sow Laboratoire d Algèbre, Codage, Cryptologie, Algèbre et Applications Université Cheikh Anta Diop de Dakar, Sénégal BP: 5005, Dakar Fann
More information[6] was based on the quadratic residuosity problem, whilst the second given by Boneh and Franklin [3] was based on the Weil pairing. Originally the ex
Exponent Group Signature Schemes and Ecient Identity Based Signature Schemes Based on Pairings F. Hess Dept. Computer Science, University of Bristol, Merchant Venturers Building, Woodland Road, Bristol,
More informationSEMINAR SECURITY - REPORT ELLIPTIC CURVE CRYPTOGRAPHY
SEMINAR SECURITY - REPORT ELLIPTIC CURVE CRYPTOGRAPHY OFER M. SHIR, THE HEBREW UNIVERSITY OF JERUSALEM, ISRAEL FLORIAN HÖNIG, JOHANNES KEPLER UNIVERSITY LINZ, AUSTRIA ABSTRACT. The area of elliptic curves
More informationEfficient Algorithms for Pairing-Based Cryptosystems
Efficient Algorithms for Pairing-Based Cryptosystems Paulo S.L.M. Barreto 1, Hae Y. Kim 1, Ben Lynn 2, and Michael Scott 3 1 Universidade de São Paulo, Escola Politécnica Av. Prof. Luciano Gualberto, tr.
More informationTate Bilinear Pairing Core Specification. Author: Homer Hsing
Tate Bilinear Pairing Core Specification Author: Homer Hsing homer.hsing@gmail.com Rev. 0.1 March 4, 2012 This page has been intentionally left blank. www.opencores.org Rev 0.1 ii Revision History Rev.
More informationElGamal type signature schemes for n-dimensional vector spaces
ElGamal type signature schemes for n-dimensional vector spaces Iwan M. Duursma and Seung Kook Park Abstract We generalize the ElGamal signature scheme for cyclic groups to a signature scheme for n-dimensional
More informationElliptic Curve Discrete Logarithm Problem
Elliptic Curve Discrete Logarithm Problem Vanessa VITSE Université de Versailles Saint-Quentin, Laboratoire PRISM October 19, 2009 Vanessa VITSE (UVSQ) Elliptic Curve Discrete Logarithm Problem October
More informationTampering attacks in pairing-based cryptography. Johannes Blömer University of Paderborn September 22, 2014
Tampering attacks in pairing-based cryptography Johannes Blömer University of Paderborn September 22, 2014 1 / 16 Pairings Definition 1 A pairing is a bilinear, non-degenerate, and efficiently computable
More informationEfficient Finite Field Multiplication for Isogeny Based Post Quantum Cryptography
Efficient Finite Field Multiplication for Isogeny Based Post Quantum Cryptography Angshuman Karmakar 1 Sujoy Sinha Roy 1 Frederik Vercauteren 1,2 Ingrid Verbauwhede 1 1 COSIC, ESAT KU Leuven and iminds
More informationDual-Field Arithmetic Unit for GF(p) and GF(2 m ) *
Institute for Applied Information Processing and Communications Graz University of Technology Dual-Field Arithmetic Unit for GF(p) and GF(2 m ) * CHES 2002 Workshop on Cryptographic Hardware and Embedded
More informationABHELSINKI UNIVERSITY OF TECHNOLOGY
Identity-Based Cryptography T-79.5502 Advanced Course in Cryptology Billy Brumley billy.brumley at hut.fi Helsinki University of Technology Identity-Based Cryptography 1/24 Outline Classical ID-Based Crypto;
More informationA Simple Architectural Enhancement for Fast and Flexible Elliptic Curve Cryptography over Binary Finite Fields GF(2 m )
A Simple Architectural Enhancement for Fast and Flexible Elliptic Curve Cryptography over Binary Finite Fields GF(2 m ) Stefan Tillich, Johann Großschädl Institute for Applied Information Processing and
More informationAn Optimized Hardware Architecture of Montgomery Multiplication Algorithm
An Optimized Hardware Architecture of Montgomery Multiplication Algorithm Miaoqing Huang 1, Kris Gaj 2, Soonhak Kwon 3, and Tarek El-Ghazawi 1 1 The George Washington University, Washington, DC 20052,
More informationNo.6 Selection of Secure HC of g = divisors D 1, D 2 defined on J(C; F q n) over F q n, to determine the integer m such that D 2 = md 1 (if such
Vol.17 No.6 J. Comput. Sci. & Technol. Nov. 2002 Selection of Secure Hyperelliptic Curves of g = 2 Based on a Subfield ZHANG Fangguo ( ) 1, ZHANG Futai ( Ξ) 1;2 and WANG Yumin(Π±Λ) 1 1 P.O.Box 119 Key
More informationPairings for Cryptographers
Pairings for Cryptographers Steven D. Galbraith 1, Kenneth G. Paterson 1, and Nigel P. Smart 2 1 Information Security Group, Royal Holloway, University of London, Egham, Surrey, TW20 0EX, United Kingdom.
More informationEfficient hash maps to G 2 on BLS curves
Efficient hash maps to G 2 on BLS curves Alessandro Budroni 1 and Federico Pintore 2 1 MIRACL Labs, London, England - budroni.alessandro@gmail.com 2 Department of Mathematics, University of Trento, Italy
More informationConstructing Tower Extensions of Finite Fields for Implementation of Pairing-Based Cryptography
Constructing Tower Extensions of Finite Fields for Implementation of Pairing-Based Cryptography Naomi Benger and Michael Scott, 1 School of Computing, Dublin City University, Ireland nbenger@computing.dcu.ie
More informationUSING ABELIAN VARIETIES TO IMPROVE PAIRING-BASED CRYPTOGRAPHY
USING ABELIAN VARIETIES TO IMPROVE PAIRING-BASED CRYPTOGRAPHY K. RUBIN AND A. SILVERBERG Abstract. We show that supersingular abelian varieties can be used to obtain higher MOV security per bit, in all
More informationImplementing Cryptographic Pairings on Smartcards
Implementing Cryptographic Pairings on Smartcards Michael Scott, Neil Costigan, and Wesam Abdulwahab School of Computer Applications Dublin City University Ballymun, Dublin 9, Ireland. mike@computing.dcu.ie
More informationThe Elliptic Curve in https
The Elliptic Curve in https Marco Streng Universiteit Leiden 25 November 2014 Marco Streng (Universiteit Leiden) The Elliptic Curve in https 25-11-2014 1 The s in https:// HyperText Transfer Protocol
More informationGenerating more MNT elliptic curves
Generating more MNT elliptic curves Michael Scott 1 and Paulo S. L. M. Barreto 2 1 School of Computer Applications Dublin City University Ballymun, Dublin 9, Ireland. mike@computing.dcu.ie 2 Universidade
More informationID-Based Blind Signature and Ring Signature from Pairings
ID-Based Blind Signature and Ring Signature from Pairings Fangguo Zhang and Kwangjo Kim International Research center for Information Security (IRIS) Information and Communications University(ICU), 58-4
More informationEfficient Implementation of Cryptographic pairings. Mike Scott Dublin City University
Efficient Implementation of Cryptographic pairings Mike Scott Dublin City University First Steps To do Pairing based Crypto we need two things Efficient algorithms Suitable elliptic curves We have got
More informationOn Near Prime-Order Elliptic Curves with Small Embedding Degrees
On Near Prime-Order Elliptic Curves with Small Embedding Degrees Duc-Phong Le, Nadia El Mrabet, Tan Chik How To cite this version: Duc-Phong Le, Nadia El Mrabet, Tan Chik How. On Near Prime-Order Elliptic
More informationSide-Channel Attacks on Quantum-Resistant Supersingular Isogeny Diffie-Hellman
Side-Channel Attacks on Quantum-Resistant Supersingular Isogeny Diffie-Hellman Presenter: Reza Azarderakhsh CEECS Department and I-Sense, Florida Atlantic University razarderakhsh@fau.edu Paper by: Brian
More informationAre standards compliant Elliptic Curve Cryptosystems feasible on RFID?
Are standards compliant Elliptic Curve Cryptosystems feasible on RFID? Sandeep S. Kumar and Christof Paar Horst Görtz Institute for IT Security, Ruhr-Universität Bochum, Germany Abstract. With elliptic
More informationNumber Theory. CSS322: Security and Cryptography. Sirindhorn International Institute of Technology Thammasat University CSS322. Number Theory.
CSS322: Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 29 December 2011 CSS322Y11S2L06, Steve/Courses/2011/S2/CSS322/Lectures/number.tex,
More informationOn near prime-order elliptic curves with small embedding degrees (Full version)
On near prime-order elliptic curves with small embedding degrees (Full version) Duc-Phong Le 1, Nadia El Mrabet 2, and Chik How Tan 1 1 Temasek Laboratories, National University of Singapore {tslld,tsltch}@nus.edu.sg
More informationThe Number Field Sieve for Barreto-Naehrig Curves: Smoothness of Norms
The Number Field Sieve for Barreto-Naehrig Curves: Smoothness of Norms by Michael Shantz A thesis presented to the University of Waterloo in fulfillment of the thesis requirement for the degree of Master
More informationTable-Based Polynomials for Fast Hardware Function Evaluation
ASAP 05 Table-Based Polynomials for Fast Hardware Function Evaluation Jérémie Detrey Florent de Dinechin Projet Arénaire LIP UMR CNRS ENS Lyon UCB Lyon INRIA 5668 http://www.ens-lyon.fr/lip/arenaire/ CENTRE
More informationA TAXONOMY OF PAIRING-FRIENDLY ELLIPTIC CURVES
A TAXONOMY OF PAIRING-FRIENDLY ELLIPTIC CURVES DAVID FREEMAN 1, MICHAEL SCOTT 2, AND EDLYN TESKE 3 1 Department of Mathematics University of California, Berkeley Berkeley, CA 94720-3840 USA dfreeman@math.berkeley.edu
More informationA Note on Scalar Multiplication Using Division Polynomials
1 A Note on Scalar Multiplication Using Division Polynomials Binglong Chen, Chuangqiang Hu and Chang-An Zhao Abstract Scalar multiplication is the most important and expensive operation in elliptic curve
More informationFPGA accelerated multipliers over binary composite fields constructed via low hamming weight irreducible polynomials
FPGA accelerated multipliers over binary composite fields constructed via low hamming weight irreducible polynomials C. Shu, S. Kwon and K. Gaj Abstract: The efficient design of digit-serial multipliers
More informationCounting points on elliptic curves over F q
Counting points on elliptic curves over F q Christiane Peters DIAMANT-Summer School on Elliptic and Hyperelliptic Curve Cryptography September 17, 2008 p.2 Motivation Given an elliptic curve E over a finite
More information