Evidence that XTR Is More Secure than Supersingular Elliptic Curve Cryptosystems

Abstract

Abstract. We show that finding an efficiently computable injective homomorphism from the XTR subgroup into the group of points over GF(p 2 ) of a particular type of supersingular elliptic curve is at least as hard as solving the Diffie-Hellman problem in the XTR subgroup. This provides strong evidence for a negative answer to the question posed by S. Vanstone and A. Menezes at the Crypto 2000 Rump Session on the possibility of efficiently inverting the MOV embedding into the XTR subgroup. As a side result we show that the Decision Diffie-Hellman problem in the group of points on this type of supersingular elliptic curves is efficiently computable, which provides an example of a group where the Decision Diffie-Hellman problem is simple, while the Diffie-Hellman and discrete logarithm problem are presumably not. The cryptanalytical tools we use also lead to cryptographic applications of independent interest. These applications are an improvement of Joux's one round protocol for tripartite Diffie-Hellman key exchange and a non refutable digital signature scheme that supports escrowable encryption. We also discuss the applicability of our methods to general elliptic curves defined over finite fields.

Elliptic curve cryptography: The serpentine course of a paradigm shift

“…In 2000 supersingular elliptic curves were still viewed as too weak for cryptography. Verheul took up the challenge of Menezes-Vanstone, and was able to prove a striking theorem [105,106]: If an efficiently computable isomorphism existed from the XTR group to the curve, then the Diffie-Hellman problem would be easy in both groups. Since that was unlikely, he concluded that the map goes only one way.…”

Signcryption with Non-interactive Non-repudiation

“…A modified version of the Tate or Weil pairing may be used with some of these groups to give the required map. This technique was first described in [32] and may be used for supersingular elliptic curves. Recently these groups have been used constructively to build identity-based cryptosystems [12,14,23,27,31].…”

Closed formulae for the Weil pairing inversion

“…For simplicity, here we assume that their order is a prime l. We also assume the existence of a distortion map δ which is a feasibly computable group isomorphism from G 2 to G 1 . Verheul [24,Section 3] proved the following remarkable result. Let f be a group isomorphism from T to G 1 (such an isomorphism is now called the Verheul map).…”

“…In spite of the importance of cryptographic consequences of pairing inversion problems, there are few articles on the topic after Verheul [24]. Some attempts are the use of division polynomials for polynomial interpolation of the Verheul maps (Satoh [20]), polynomial interpolation of the Verheul map by the Eisenstein series (Satoh [21]), the eta pairing computation without the final exponentiation (Galbraith, Ó hÉigeartaigh and Sheedy [8]), inverting the ate pairing computation process (Galbraith, Hess and Vercauteren [7]).…”