Band 3, Heft 1

Distortion maps are a useful tool for pairing based cryptography. Compared with elliptic curves, the case of hyperelliptic curves of genus g > 1 is more complicated, since the full torsion subgroup has rank 2 g . In this paper, we prove that distortion maps always exist for supersingular curves of genus g > 1. We also give several examples of curves of genus 2 with explicit distortion maps for embedding degrees 4, 5, 6, and 12.

In cryptographic applications, hyperelliptic curves of small genus have the advantage of providing a group of comparable size to that of elliptic curves, while working over a field of smaller size. Pairing-friendly hyperelliptic curves are those for which the order of the Jacobian is divisible by a large prime, whose embedding degree is small enough for pairing computations to be feasible, and whose minimal embedding field is large enough for the discrete logarithm problem in it to be difficult. We give a sequence of 𝔽 q -isogeny classes for a family of Jacobians of genus 2 curves over 𝔽 q , for q = 2 m , and the corresponding small embedding degrees. We give examples of the parameters for such curves with embedding degree k < (log q ) 2 , such as k = 8, 13, 16, 23, 26. For secure and efficient implementation of pairing-based cryptography on genus g curves over 𝔽 q , it is desirable that the ratio be approximately 1, where N is the order of the subgroup with embedding degree k . We show that for our family of curves, ρ is between 1 and 2. We also give a sequence of 𝔽 q -isogeny classes for a family of Jacobians of genus 2 curves over 𝔽 q for which the minimal embedding field is much smaller than the finite field indicated by the embedding degree k . That is, the extension degrees in this example differ by a factor of m , where q = 2 m , demonstrating that the embedding degree can be a far from accurate measure of security. As a result, we use an indicator to examine the cryptographic security of our family of curves.

We consider the problem of securely evaluating the Greater Than (GT) predicate and its extension – transferring one of two secrets, depending on the result of comparison. We generalize our solutions and show how to securely decide membership in the union of a set of intervals. We then consider the related problem of comparing two encrypted numbers. We show how to efficiently apply our solutions to practical settings, such as auctions with the semi-honest auctioneer, proxy selling, etc. All of our protocols are one round. We propose new primitives, Strong Conditional Oblivious Transfer (SCOT) and Conditional Encrypted Mapping (CEM), which capture common security properties of one round protocols in a variety of settings, which may be of independent interest.

We provide two necessary conditions on hash functions for the Schnorr signature scheme to be secure, assuming compact group representations such as those which occur in elliptic curve groups. We also show, via an argument in the generic group model, that these conditions are sufficient. Our hash function security requirements are variants of the standard notions of preimage and second preimage resistance. One of them is in fact equivalent to the Nostradamus attack by Kelsey and Kohno (Eurocrypt, Lecture Notes in Computer Science 4004: 183–200, 2006), and, when considering keyed compression functions, both are closely related to the ePre and eSec notions by Rogaway and Shrimpton (FSE, Lecture Notes in Computer Science 3017: 371–388, 2004). Our results have a number of interesting implications in practice. First, since security does not rely on the hash function being collision resistant, Schnorr signatures can still be securely instantiated with SHA-1/SHA-256, unlike DSA signatures. Second, we conjecture that our properties require O (2 n ) work to solve for a hash function with n -bit output, thereby allowing the use of shorter hashes and saving twenty-five percent in signature size. And third, our analysis does not reveal any significant difference in hardness between forging signatures and computing discrete logarithms, which plays down the importance of the loose reductions in existing random-oracle proofs, and seems to support the use of “normal-size” groups.