Looking beyond XTR

Abstract

Abstract. XTR is a general method that can be applied to discrete logarithm based cryptosystems in extension fields of degree six, providing a compact representation of the elements involved. In this paper we present a precise formulation of the Brouwer-Pellikaan-Verheul conjecture, originally posed in [4], concerning the size of XTR-like representations of elements in extension fields of arbitrary degree. If true this conjecture would provide even more compact representations of elements than XTR in extension fields of degree thirty. We test the conjecture by experiment, showing that in fact it is unlikely that such a compact representation of elements can be achieved in extension fields of degree thirty.

Torus-Based Cryptography

“…While Lucas-based systems and XTR are essentially restricted to exponentiation, we are able to perform multiplication as well. We also disprove the open conjectures from [2], and give a new algebro-geometric interpretation of the approach in that paper and of LUC and XTR. …”

“…We also show that a certain conjecture about algebraic tori has as a consequence new torus-based cryptosystems that would generalize and improve on CEILIDH and XTR. Further, we disprove the open conjectures from [2], and thereby show that the approach to generalizing XTR that was suggested in [2] cannot succeed.…”

On the Complexity of Computing Discrete Logarithms over Algebraic Tori

“…We now prove (2), one can also compute the prime factorizations of Φ p (p k ) and p k − 1 in time polynomial in . Let …”

“…* There has been several researches on the torus-based cryptosystems [2], [7], [13]- [15], [17], and most of them are related to security arguments against subexponential attacks and to proposal for admissible parameters based on the arguments. On the other hand, there is few known asymptotic analysis on the hardness of the discrete logarithm problem over algebraic tori so far.…”

Asymptotically Optimal Communication for Torus-Based Cryptography

“…For n the product of the first k primes, φ(n)/n → 0 as k → ∞, so the savings get better and better. In [3,24], evidence that the techniques of [4] cannot generalize to arbitrary n was presented, and in [3,24], some specific versions of the conjecture in [4] made in [3] were shown to be false. Also in [24,25,23] it is shown that the group of order Φ n (q) is isomorphic to the well-studied algebraic torus T n (F q ) [30] and that a positive answer to the conjecture in [4] is possible if one can construct an efficient rational parameterization of T n (F q ).…”