Search

Formulas for doubling, differential addition and point recovery after compression were given for many standard models of elliptic curves, and allow for scalar multiplication after compression using the Montgomery ladder algorithm and point recovery on a curve after this multiplication. In this paper we give such formulas for the twisted Jacobi intersection au2 + v2 = 1, bu2 + w2 = 1. To our knowledge such formulas were not given for this model or for the Jacobi intersection. In projective coordinates these formulas have cost 2M +2S +6D for doubling and 5M + 2S + 6D for differential addition, where M; S; D are multiplication, squaring and multiplication by constants in a field, respectively, choosing suitable curve parameters cost of D may be small. [ABSTRACT FROM AUTHOR]

In this paper for elliptic curves provided by Huff's equation Ha,b: ax(y²-1 = by (x² -1) and general Huff's equation ... and degree 2 compression function f(x, y) = xy on these curves, herein we provide formulas for doubling and differential addition after compression, which for Huff's curves are as efficient as Montgomery's formulas for Montgomery's curves B y² = x³ + Ax² + x. For these curves we also provided point recovery formulas after compression, which for a point P on these curves allows to compute [n] f(P) after compression using the Montgomery ladder algorithm, and then recover [n] P. Using formulas of Moody and Shumow for computing odd degree isogenies on general Huff's curves, we have also provide formulas for computing odd degree isogenies after compression for these curves. Moreover, it is shown herein how to apply obtained formulas using compression to the ECM algorithm. [ABSTRACT FROM AUTHOR]

Daniel Bernstein and Tanja Lange [9] proved that two given addition formulas on twisted Edwards elliptic curves ax² +y² = 1+dxy are complete (i.e. the sum of any two points on a curve can be computed using one of these formulas). In this paper we give simple verification of completeness of these formulas using a program written in Magma, which is based on the fact that completeness means that some systems of polynomial equations have no solutions. This method may also be useful to verify completeness of additions formulas on other models of elliptic curves. [ABSTRACT FROM AUTHOR]

E. Bach showed that factorization of an integer n can be reduced in probabilistic polynomial time to the problem of computing exponents of elements in ℤ n * (in particular the group order of ℤ n * ). It is also known that factorization of square-free integer n can be reduced to the problem of computing the group order of an elliptic curve E/ℤn. In this paper we describe the analogous reduction for computing the orders of Jacobians over ℤn of hyperelliptic curves C over ℤn using the Mumford representation of divisor classes and Cantor's algorithm for addition. These reductions are based on the group structure of the Jacobian. We also propose other reduction of factorization to the problem of determining the number of points |C(ℤn)|, which makes use of elementary properties of twists of hyperelliptic curves. [ABSTRACT FROM AUTHOR]

Let E be an elliptic curve given by any model over a field K. A rational function f : E → K of degree 2 such that f(P) = f(Q) ⇔ Q = ±P can be used as a point compression on E. Then there exists induced from E multiplication of values of f by integers given by [n]f(P) := f([n]P), which can be computed using the Montgomery ladder algorithm. For this algorithm one needs the generalized Montgomery formulas for differential addition and doubling that is rational functions A(X1, X2, X3) ∈ K(X1, X2, X3) and [2] ∈ K(X) such that f(P + Q) = A(f(P), f(Q), f(Q − P)) and [2]f(P) = f([2]P) for generic P,Q ∈ E. For most standard models of elliptic curves generalized Montgomery formulas are known. To use compression for scalar multiplication [n]P for P ∈ E, one can compute after compression [n]f(P), which is followed by [n + 1]f(P) in the Montgomery ladder algorithm, then one can recover [n]P on E, since there exists a rational map B such that [n]P = B(P, [n]f(P), [n + 1]f(P)) for generic P ∈ E and n ∈ Z. Such a map B is known for Weierstrass and Edwards curves, but to our knowledge it seems that it was not given for other models of elliptic curves. In this paper for an elliptic curve E and the above compression function f we give an algorithm to search for generalized Montgomery formulas, functions on K induced after compression by endomorphisms of E, and the above map B for point recovering. All these tasks require searching for solutions of similar type problems for which we describe an algorithm based on Gröbner bases. As applications we give formulas for differential addition, doubling and the above map B for Jacobi quartic, Huff curves, and twisted Hessian curves. [ABSTRACT FROM AUTHOR]

The GLV method allows to improve scalar multiplication on an elliptic curve E/Fq with an efficiently computable endomorphism Φ : E → E over Fq. For points in a subgroup of large prime order r this requires decomposition of scalar k = k0 + k1λ mod r, where Φ acts on the subgroup of order r as multiplication by λ ∊ Fr and k0, k1 are integers O(√r) . In this note we consider the case when λ is of the form λ = 2s + a, where a is a small integer and λ=O(√r), which allows very easy and fast decomposition of k especially in hardware implementations. We give a method to construct such elliptic curves based on the complex multiplication method, and give examples of elliptic curves for λ ∊ {2s, 2s - 1} and various security levels. [ABSTRACT FROM AUTHOR]

Abstract: In this note we study the following problem. Let k be an algebraically closed field and X be an affine variety over k. Suppose that are two hypersurfaces such that there exists an automorphism f of satisfying for some . Does this imply that there exists an automorphism of X such that ? We give an affirmative solution if one hypersurface is not k-uniruled and a counterexample in general. [Copyright &y& Elsevier]

Given two affine algebraic varieties X and Y such that X ×  ≅ Y × , it may happen that X and Y are not isomorphic. This is shown, for example, by so-called “Danielewski surfaces.” In this note, we give a simple construction of such varieties X, Y of an arbitrary dimension n > 1. [ABSTRACT FROM AUTHOR]

This paper presents method for obtaining high-degree compression functions using natural symmetries in a given model of an elliptic curve. Such symmetries may be found using symmetry of involution [–1] and symmetry of translation morphism τT = P + T, where T is the n-torsion point which naturally belongs to the E() for a given elliptic curve model. We will study alternative models of elliptic curves with points of order 2 and 4, and specifically Huff's curves and the Hessian family of elliptic curves (like Hessian, twisted Hessian and generalized Hessian curves) with a point of order 3. We bring up some known compression functions on those models and present new ones as well. For (almost) every presented compression function, differential addition and point doubling formulas are shown. As in the case of high-degree compression functions manual investigation of differential addition and doubling formulas is very difficult, we came up with a Magma program which relies on the Gröbner basis. We prove that if for a model E of an elliptic curve exists an isomorphism φ : E → EM, where EM is the Montgomery curve and for any P ∈ E() holds that φ(P) = (φx(P), φy(P)), then for a model E one may find compression function of degree 2. Moreover, one may find, defined for this compression function, differential addition and doubling formulas of the same efficiency as Montgomery's. However, it seems that for the family of elliptic curves having a natural point of order 3, compression functions of the same efficiency do not exist. [ABSTRACT FROM AUTHOR]