Abstract
The discrete logarithm problem forms the basis of numerous cryptographic systems. The most effective attack on the discrete logarithm problem in the multiplicative group of a finite field is via the index calculus, but no such method is known for elliptic curve discrete logarithms. Indeed, Miller [23] has given a brief heuristic argument as to why no such method can exist. IN this note we give a detailed analysis of the index calculus for elliptic curve discrete logarithms, amplifying and extending miller’s remarks. Our conclusions fully support his contention that the natural generalization of the index calculus to the elliptic curve discrete logarithm problem yields an algorithm with is less effecient than a brute-force search algorithm.
Chapter PDF
Similar content being viewed by others
Keywords
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.
References
Adleman, L., A subexponential algorithm for the discrete logarithm problem with applications to cryptography, Proc. 20th IEEE Found. Comp. Sci. Symp., 1979, pp. 55–60.
L. Adleman, J. DeMarrais and M. Huang,, A subexponential algorithm for discrete logarithms over the rational subgroup of the jacobians of large genus hyperelliptic curves over finite fields, Algorithmic Number Theory, Lecture Notes in Computer Science, volume 877, Springer-Verlag, 1994, pp. 28–40.
A.O. Atkins, The number of points on an elliptic curve modulo a prime, preprint, 1988.
R. Balasubramanian and N. Koblitz,, The improbability that an elliptic curve has subexponential discrete log problem under the Menezes-Okamoto-Vanstone algorithm, Journal of Cryptology (to appear).
Canfield, E.R., Erdös, P., Pomerance, C., On a problem of Oppenheim concerning ‘Factorisation Numerorum’, Journal Number Theory 17 (1983), 1–28.
Certicom White Paper, Remarks on the security of the elliptic curve cryptosystem, http://www.certicom.com/ecc/wecc3.htm.
T. ElGamal, A public-key cryptosystem and a signature scheme based on discrete logarithms, IEEE Transactions on Information Theory 31 (1985), 469–472.
N. Elkies, Explicit isogenies, preprint, 1991.
G. Frey and H. Rück, A remark concerning m-divisibility and the discrete logarithm in the divisor class group of curves, Mathematics of Computation 62 (1994), 865–874.
D. Gordon, Discrete logarithms in GF(p) using the number field sieve, SIAM Journal on Discrete Mathematics 6 (1993), 124–138.
M. Hindry and J. Silverman, The canonical height and integral points on elliptic curves, Invent. Math. 93 (1988), 419–450.
N. Koblitz, Elliptic curve cryptosystems, Mathematics of Computation 48 (1987), 203–209.
—, CM-curves with good cryptographic properties, Advances in Cryptology-CRYPTO’ 91, Lecture Notes in Computer Science, volume 576, Springler-Verlag, 1992, pp. 279–287.
Kraitchik, M., Théorie des Nombres, volume 1, Gauthier-Villars, 1922.
—, Reserches sur la théorie des nombres, Gauthier-Villars, 1924.
B.A. LaMacchia and A.M. Odlyzko, Computation of discrete logarithms in prime fields, Designs, Codes and Cryptography 1 (1991), 47–62.
S. Lang, Fundamentals of Diophantine Geometry, Springer-Verlag, New York, 1983.
—, Elliptic Curves: Diophantine Analysis, Springer-Verlag, New York, 1978.
R. Martin and W. McMillen, An elliptic curve over 2e with rank at least 23, announcement, June 1997.
A. Menezes, T. Okamoto and S. Vanstone, Reducing elliptic curve logarithms to logarithms in a finite field, IEEE Transactions on Information Theory 39 (1993), 1639–1646.
J.F. Mestre, Formules explicites et minoration de conducteurs de variétés algébriques, Compositio Math. 58 (1986), 209–232.
—, Constructiuon d’une courbe elliptique de rang ≥ 12, C.R. Acad. Sc. Paris t. 295 (1982), 643–644.
V.S. Miller, Use of elliptic curves in cryptography, Advances in Cryptology CRYPTO’ 85 (Lecture Notes in Computer Science, vol. 218), Springer-Verlag, 1986, pp. 417–426.
A. Miyaji, On ordinary elliptic curve cryptosystems, Advances in Cryptology-ASIACRYPT’ 91, Lecture Notes in Computer Science, volume 218, Springer-Verlag, 1993, pp. 460–469.
S. Pohlig and M. Hellman, An improved algorithm for computing logarithms over GF(p) and its cryptographic significance, IEEE Transactions on Information Theory 24 (1978), 106–110.
J. Pollard, Monte Carlo methods for index computation mod p, Mathematics of Computation 32 (1978), 918–924.
H. H. Rück, On the discrete logarithms on some elliptic curves, preprint, 1997.
T. Satoh and K. Araki, Fermat quotients and the polynomial time discrete log algorithm for anomalous elliptic curves, preprint.
O. Schirokauer, D. Weber, and Th. Denny, Discrete logarithms: The effectiveness of the index calculus method, Algorithmic Number Theory, (ANTS-II, Talence, France, 1996), Lect. Notes in Computer Sci., vol. 1122, Springer-Verlag, 1996, pp. 337–362.
R. Schoof, Elliptic curves over finite fields and the computation of square roots modulo p, Math. Comp. 44 (1985), 483–494.
I. Semaev, Evaluation of discrete logarithms in a group of p-torsion points of an elliptic curve in characteristic p, Mathematics of Computation 67 (1998), 353–356.
V. Shoup, Lower bounds for discrete logarithms and related problems, Advances in Cryptology-EUROCRYPT’ 97, Lecture Notes in Computer Science, volume 1233, Springer-Verlag, 1997, pp. 256–266.
J.H. Silverman, The Arithmetic of Elliptic Curves, Graduate Texts in Math., vol. 106, Springer-Verlag, Berlin and New York, 1986.
—, Advanced Topics in the Arithmetic of Elliptic Curves, Graduate Texts in Math., vol. 151, Springer-Verlag, Berlin and New York, 1994.
—, Lower bound for the canonical height on elliptic curves, Duke Math. J. 48 (1981), 633–648.
—, The difference between the Weil height and the canonical height on elliptic curves, Math. Comp. 192 (1990), 723–743.
—, Computing heights on elliptic curves, Math. Comp. 51 (1988), 339–358.
—, Computing canonical heights with little (or no) factorization, Math. Comp. 66 (1997), 787–805.
N. Smart, Announcement of an attack on the ECDLP for anomalous elliptic curves, preprint, 1997.
J. Solinas, An improved algorithm for arithmetic on a family of elliptic curves, Advances in Cryptology-CRYPTO’ 97, Lecture Notes in Computer Science, volume 1294, Springer-Verlag, 1997, pp. 357–371.
J. Voloch, The discrete logarithm problem on elliptic curves and descents, preprint, 1997.
Weber, D., Computing discrete logarithms with the general number field sieve, Algorithmic Number Theory, (ANTS-II, Talence, France, 1996), Lect. Notes in Computer Sci., vol. 1122, Springer-Verlag, 1996, pp. 391–403.
A.E. Western and J.C.P. Miller, Tables of Indices and Primitive Roots, Royal Society Mathematical Tables, vol. 9, Cambridge Univ. Press, 1968.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 1998 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Silverman, J.H., Suzuki, J. (1998). Elliptic Curve Discrete Logarithms and the Index Calculus. In: Ohta, K., Pei, D. (eds) Advances in Cryptology — ASIACRYPT’98. ASIACRYPT 1998. Lecture Notes in Computer Science, vol 1514. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-49649-1_10
Download citation
DOI: https://doi.org/10.1007/3-540-49649-1_10
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-65109-3
Online ISBN: 978-3-540-49649-6
eBook Packages: Springer Book Archive