Weil descent attacks provide means of attacking the DLP for elliptic curves, or for more general algebraic curves such as hyperelliptic curves, when they are used over finite extension fields, i.e., non-prime fields.

The application of the original basic idea, the Weil restriction of scalars for elliptic curves, to cryptography and the ECDLP was first suggested in [124]. An important step forward was made in [145] using explicit covering techniques, relating the ECDLP to a potentially easier HCDLP. Since then, variations, generalizations and ramifications of the employed methodology have been investigated in some detail.

The aim of this chapter is to explain the basic ideas, to summarize the main results about Weil descent attacks for elliptic curves and to discuss the relevance to ECC.

Introduction — the Weil Descent Methodology

Throughout this chapter we let K/k denote an extension of finite fields of degree n. The characteristic and cardinality of k are p and q = pr, respectively.

Curves in the Weil Restriction. Let ε be an elliptic curve over K. The initial motivation for the Weil descent attacks came from the consideration of the Weil restriction ResK/k(ε) of ε with respect to K/k, suggested by Frey [124].

The Weil restriction ResK/k(ε) is an abelian variety of dimension n defined over k, as opposed to ε, which is an abelian variety of dimension one over K.