Weil descent attacks provide means of attacking the DLP for elliptic curves, or for more general algebraic curves such as hyperelliptic curves, when they are used over finite extension fields, i.e., non-prime fields.

The application of the original basic idea, the Weil restriction of scalars for elliptic curves, to cryptography and the ECDLP was first suggested in [124]. An important step forward was made in [145] using explicit covering techniques, relating the ECDLP to a potentially easier HCDLP. Since then, variations, generalizations and ramifications of the employed methodology have been investigated in some detail.

The aim of this chapter is to explain the basic ideas, to summarize the main results about Weil descent attacks for elliptic curves and to discuss the relevance to ECC.

Introduction — the Weil Descent Methodology

Throughout this chapter we let K/k denote an extension of finite fields of degree n. The characteristic and cardinality of k are p and q = pr, respectively.

Curves in the Weil Restriction. Let ε be an elliptic curve over K. The initial motivation for the Weil descent attacks came from the consideration of the Weil restriction ResK/k(ε) of ε with respect to K/k, suggested by Frey [124].

The Weil restriction ResK/k(ε) is an abelian variety of dimension n defined over k, as opposed to ε, which is an abelian variety of dimension one over K.

Introduction

Background. The Elliptic Curve Digital Signature Algorithm is now in many standards or recommendations, such as [ANSI X9.62], [SECG], [FIPS 186.2], [IEEE 1363], [ISO 15946-2], [NESSIE] and [RFC 3278]. Organizations chose ECDSA because they regarded its reputational security sufficient, on the grounds that (a) it is a very natural elliptic curve analogue of DSA, and that (b) both elliptic curve cryptography and DSA were deemed to have sufficiently high reputational security. The standardization of ECDSA has created more intense public scrutiny. Despite this, no substantial weaknesses in ECDSA have been found, and thus its reputational security has increased.

At one point, proofs of security, under certain assumptions, were found for digital signature schemes similar to DSA and ECDSA. The proof techniques in these initial proofs did not, and still do not, appear applicable to DSA and ECDSA. Thus, for a time, provable security experts suggested a change to the standardization of reputationally secure schemes, because slight modifications could improve provable security.

Further investigation, however, led to new provable security results for ECDSA. New proof techniques and assumptions were found that overcame or avoided the difficulty in applying the initial techniques to ECDSA. This chapter describes some of these results, sketches their proofs, and discusses the impact and interpretation of these results.

Side-channel analysis (SCA) or information leakage analysis (ILA), refers to a new and emerging type of cryptanalysis that uses leaked side-channel information from a cryptographic device to determine the secret key. The traditional cryptographic model consists of two parties, Alice and Bob, who wish to communicate secretly over an insecure channel. To protect against a potential eavesdropper, cryptographic algorithms are used to ensure the secrecy of the communication. In this traditional model, the security of the system relies solely on the secrecy of the key and the mathematical properties of the cryptographic algorithm used.

However, in a more practical scenario the communicating parties are mostly computing devices, such as personal computers, smart cards or mobile phones. On such devices, a cryptographic algorithm is implemented and executed whenever a cryptographic protocol requires its computation. Although these devices operate in potentially hostile environments and are subject to attacks themselves, they are supposed to protect the secret key. Furthermore, such devices can act as a source of information. Depending on the data they process, they might consume different amounts of power, emit different amounts of electromagnetic emanations, produce different types of noises, need different running times or output different error messages; see Figure IV.1.

It is now more than five years since we started working on the book Elliptic Curves in Cryptography and more than four years since it was published. We therefore thought it was time to update the book since a lot has happened in the intervening years. However, it soon became apparent that a simple update would not be sufficient since so much has been developed in this area. We therefore decided to develop a second volume by inviting leading experts to discuss issues which have arisen.

Highlights in the intervening years which we cover in this volume include:

Provable Security. There has been considerable work in the last few years on proving various practical encryption and signature schemes secure. In this new volume we will examine the proofs for the ECDSA signature scheme and the ECIES encryption scheme.

Side-Channel Analysis. The use of power and timing analysis against cryptographic tokens, such as smart cards, is particularly relevant to elliptic curves since elliptic curves are meant to be particularly suited to the constrained environment of smart cards. We shall describe what side-channel analysis is and how one can use properties of elliptic curves to defend against it.

Point Counting. In 1999 the only method for computing the group order of an elliptic curve was the Schoof-Elkies-Atkin algorithm.

Provable security in an encryption setting is very similar to provable security in a digital signature setting (see Chapter II). In both cases we aim to make meaningful, mathematically rigorous statements about the security of cryptosystems and provide proofs that these statements are correct.

Generally, a security proof attempts to show how difficult “breaking” a cryptographic scheme is, in terms of how difficult it is to solve some mathematical problem. If we can show that the difference between breaking the cryptographic scheme and solving the underlying mathematical problem is only small, and we assume that solving the underlying problem is difficult to do, then we can have some measure of assurance in the security of the cryptographic scheme. The main difference between proving security in the signature setting and in the encryption setting is deciding what is meant by “breaking” the scheme.

Before we launch into the complicated and arcane world of provable security, it is useful to take a moment to consider its history. The field of provable security for public-key encryption schemes has a history almost as long as public-key encryption itself. The most significant early papers on provable security are by Rabin in 1979 [279] and Goldwasser and Micali in 1984 [149].

Introduction

This chapter presents a survey of positive applications of pairings in cryptography. We assume the reader has a basic understanding of concepts from cryptography such as public-key encryption, digital signatures, and key exchange protocols. A solid grounding in the general area of cryptography can be obtained by reading [240].

We will attempt to show how pairings (as described in Chapter IX) have been used to construct a wide range of cryptographic schemes, protocols and infrastructures supporting the use of public-key cryptography. Recent years have seen an explosion of interest in this topic, inspired mostly by three key contributions: Sakai, Ohgishi and Kasahara's early and much overlooked work introducing pairing-based key agreement and signature schemes [284]; Joux's three-party key agreement protocol as presented in [183]; and Boneh and Franklin's identity-based encryption (IBE) scheme built from pairings [38]. The work of Verheul [335] has also been influential because it eases the cryptographic application of pairings. We will give detailed descriptions of these works as the chapter unfolds. To comprehend the rate of increase of research in this area, note that the bibliography of an earlier survey [273] written in mid-2002 contains 28 items, while, at the time of writing in early 2004, Barreto's website [15] lists over 100 research papers.