Abstract. Elliptic curves with small embedding degree and large prime-order subgroup are key ingredients for implementing pairingbased cryptographic systems. Such "pairing-friendly" curves are rare and thus require specific constructions. In this paper we give a single coherent framework that encompasses all of the constructions of pairing-friendly elliptic curves currently existing in the literature. We also include new constructions of pairing-friendly curves that improve on the previously known constructions for certain embedding degrees. Finally, for all embedding degrees up to 50, we provide recommendations as to which pairing-friendly curves to choose to best satisfy a variety of performance and security requirements.

In Pollard's rho method, an iterating function f is used to define a sequence (yi) by yi+l = f(yi) for i = 0, 1, 2,..., with some starting value yo. In this paper, we define and discuss new iterating functions for computing discrete logarithms with the rho method. We compare their performances in experiments with elliptic curve groups. Our experiments show that one of our newly defined functions is expected to reduce the number of steps by a factor of approximately 0.8, in comparison with Pollard's originally used function, and we show that this holds independently of the size of the group order. For group orders large enough such that the run time for precomputation can be neglected, this means a real-time speed-up of more than 1.2. IntroductionLet G be a finite cyclic group, written multiplicatively, and generated by the group element g. Given an element h in G, we wish to find the least non-negative number x such that g~ = h. This problem is the discrete logarithm problem (DLP) in G, and x is the discrete logarithm of h to the base g. We write x = logg h. We write (g) to denote the cyclic group generated by g, and [(g)t, or IG[, to denote the order of g, which is the least positive number x such that gX = 1. An efficient method to solve the DLP is based on the rho method: Assume we are given a function f : G -+ G. We select a starting value Y0 E G and then compute the sequence (yi) formed by the rule yi+l -~ f(Yi), for i = 0, 1, 2,....Since G is finite, this sequence is ultimately periodic so that there exist two uniquely determined smallest integers # _> 0 and )~ _> 1 such that Yi = Yi+a for all i >_ ~. We call # the preperiod and )~ the period of (Yi) and any pair (yi,Yj) with Yi = yj and i r j a match. If the function f, which we refer to as the iterating function, is a random function in the sense that each of the [G] Ivl functions f : G -+ G is equally probable, the expected value for )~ + # is close to ~/r]G]/2 = 1.253 iv/~. Pollard [12] showed how this theory can be applied to solve the DLP in expected run time O(x/IG ] ) multiplications in G.Pollard's algorithm [12] is generic in the sense that it can be applied to any group for which the following is satisfied.

Abstract. We consider Pollard's rho method for discrete logarithm computation. Usually, in the analysis of its running time the assumption is made that a random walk in the underlying group is simulated. We show that this assumption does not hold for the walk originally suggested by Pollard: its performance is worse than in the random case. We study alternative walks that can be efficiently applied to compute discrete logarithms. We introduce a class of walks that lead to the same performance as expected in the random case. We show that this holds for arbitrarily large prime group orders, thus making Pollard's rho method for prime group orders about 20% faster than before.

Abstract. We present new algorithms for computing orders of elements, discrete logarithms, and structures of finite abelian groups. We estimate the computational complexity and storage requirements, and we explicitly determine the O-constants and Ω-constants. We implemented the algorithms for class groups of imaginary quadratic orders and present a selection of our experimental results.Our algorithms are based on a modification of Shanks' baby-step giantstep strategy, and have the advantage that their computational complexity and storage requirements are relative to the actual order, discrete logarithm, or size of the group, rather than relative to an upper bound on the group order.

No abstract