Number theory seminar in memory of F. Momose

Hyperelliptic curve cryptosystems are based on the discrete logarithm problem (DLP) of hyperelliptic curves defined over finite fields.


Mahoro Shimura


Let $k$ be a finite field, and let $k_d$ be its extension field of degree $d$. If an hyperelliptic curve $C_0$ defined over $k_d$ has a covering curve $C$ defined over $k$, we can transfer the DLP of $J(C_0 )$ into the DLP of $J(C)$ ($J(C)$ is the Jacobian variety of $C$). When the latter is easier than former, this attack (so-called GHS attack) works and we call $C_0$ is a weak curve. In this talk, we present a classification of hyperelliptic curves defined over $k_d$ with even characteristic, which have $(2, 2, ...2)$-coverings over $k$ therefore can be attacked by GHS attack. In particular, we show the density of the weak curves in the case that $C_0$ are elliptic curves. When the degree of $k$ over $\mathbb{F}_2$ is even, the density of weak curves is about $3/4$, and when the degree is odd, the density is about a half. Therefore the even characteristic case has more weak curves than the odd characteristic case.


No files available for download