Aspects of Hyperelliptic Curves over Large Prime Fields in Software Implementations

Abstract

Abstract. We present an implementation of elliptic curves and of hyperelliptic curves of genus 2 and 3 over prime fields. To achieve a fair comparison between the different types of groups, we developed an ad-hoc arithmetic library, designed to remove most of the overheads that penalize implementations of curve-based cryptography over prime fields. These overheads get worse for smaller fields, and thus for larger genera for a fixed group size. We also use techniques for delaying modular reductions to reduce the amount of modular reductions in the formulae for the group operations.The result is that the performance of hyperelliptic curves of genus 2 over prime fields is much closer to the performance of elliptic curves than previously thought. For groups of 192 and 256 bits the difference is about 14% and 15% respectively.

Curve25519: New Diffie-Hellman Speed Records

“…See, e.g., [18] or [3]. Unfortunately, even if A is selected so that y 2 = x 3 + Ax 2 + x is isomorphic to a curve y 2 = x 3 − 3x − a 6 , each doubling in known coordinate systems takes at least 8 field multiplications, and each general addition takes even more.…”

Efficient Doubling on Genus Two Curves over Binary Fields

“…It is a rather recent result that they can compete with elliptic curves in terms of efficiency of the group law [Ava03,Lan04a]. The security of low genus hyperelliptic curves is assumed to be similar to that of elliptic curves of the same group size.…”

Efficient Explicit Formulae for Genus 2 Hyperelliptic Curves over Prime Fields and Their Implementations

“…And then we consider the following two cases: a. If res(U 1 , U ) = 0 then there is no point in the support of D 1 which is equal to a point or its opposite in the support of D .…”

“…During the past few years, hyperelliptic curve cryptosystems (HECC) have become increasing popular for use in practice to provide an alternative to the widely used elliptic curve cryptosystems (ECC) because of much shorter operand length than that of ECC. Moreover, recent research has also shown that HECC are well suited for various software and hardware platforms and their performance is compatible to that of ECC [1,4,21,22].…”