Group Law Computations on Jacobians of Hyperelliptic Curves

Abstract

We derive an explicit method of computing the composition step in Cantor's algorithm for group operations on Jacobians of hyperelliptic curves. Our technique is inspired by the geometric description of the group law and applies to hyperelliptic curves of arbitrary genus. While Cantor's general composition involves arithmetic in the polynomial ring Fq[x], the algorithm we propose solves a linear system over the base field which can be written down directly from the Mumford coordinates of the group elements. We apply this method to give more efficient formulas for group operations in both affine and projective coordinates for cryptographic systems based on Jacobians of genus 2 hyperelliptic curves in general form.

On an integrable system on the plane with velocity-dependent potential

“…4 , входящие в уравне-ния (2.6), зависят от времени, а пятый корень λ не зависит от времени. Соответствующая ордината неподвижной точки пересечения…”

“…С точки зрения современной криптографии, на гиперэллиптических кривых пара то-чек с координатами (x 1,2 , y 1,2 ) являются «сообщением», точки с координатами (x 3,4 , y 3,4 ) являются «криптограммой», а неподвижная точка с координатами (λ, μ) является откры-тым «ключом», с помощью которого мы шифруем или дешифруем сообщения [4]. Основное отличие в том, что в криптографии мы изучаем преобразования (2.11) и (2.12) над полем целых чисел или более сложным полем.…”

Elliptic and Hyperelliptic Curves: A Practical Security Analysis

“…If enough concurrent walks are used, then the amortized cost of each individual field inversion becomes roughly 3 field multiplications -this makes affine Weierstrass coordinates the fastest known coordinate system to work with for cryptanalysis. On elliptic curves, such amortized point additions require 5 F q multiplications, 1 F q squaring and 6 F q additions; on genus 2 curves, these additions cost 20 F q multiplications, 4 F q squarings and 48 F q additions [14] -see Table 1 in Section 4.…”

“…In the worst case, the cost of finding this representative is six multiplications, one squaring, three additions and two negations in F q ; it takes three multiplications, three additions and a negation (this time we use ζ 4 = −(ζ 3 + ζ 2 + ζ + 1) to save a multiplication) to first determine the minimum value in {ζ i u 1 } for 0 ≤ i ≤ 4, another two multiplications to compute the corresponding ζ 2i u 0 and ±ζ 4i v 1 , and finally one negation for the v 0 -coordinate. To comply with the formulas in [14], we must also recompute the two extended coordinates u 1 u 0 and u 2 1 , which additionally incurs a multiplication and a squaring. Updating the (a i , b i ) pair costs two multiplications in Z/nZ.…”

Jacobian Coordinates on Genus 2 Curves

“…Here we make a brief comparison with the previous works in [29] and [12], by considering the two most common operations in the context of cryptographic scalar multiplications: a point doubling (denoted DBL), and a mixed-doubling-and-addition (denoted mDBLADD) between two points. These two operations constitute the bottleneck of most state-of-the-art scalar multiplication routines, since the multiplication of a point in the Jacobian by an n-bit scalar typically requires α DBL operations and β mDBLADD operations, where α + β ≈ n. Thus, the improved operation counts in Table 1 give a rough idea of the speedups that we can expect when plugging these formulas into an existing genus 2 scalar multiplication routine that uses the formulas from [29] or [12]. (We give a better indication of the improvements over previous formulas by reporting concrete implementation numbers in Section 8.)…”