Families of Fast Elliptic Curves from ℚ-curves

Abstract

AbstractWe construct new families of elliptic curves over \(\mathbb{F}_{p^2}\) with efficiently computable endomorphisms, which can be used to accelerate elliptic curve-based cryptosystems in the same way as Gallant–Lambert–Vanstone (GLV) and Galbraith–Lin–Scott (GLS) endomorphisms. Our construction is based on reducing quadratic ℚ-curves (curves defined over quadratic number fields, without complex multiplic’ation, but with isogenies to their Galois conjugates) modulo inert primes. As a first application of the general theory we construct, for every prime p > 3, two one-parameter families of elliptic curves over \(\mathbb{F}_{p^2}\) equipped with endomorphisms that are faster than doubling. Like GLS (which appears as a degenerate case of our construction), we offer the advantage over GLV of selecting from a much wider range of curves, and thus finding secure group orders when p is fixed. Unlike GLS, we also offer the possibility of constructing twist-secure curves. Among our examples are prime-order curves over \(\mathbb{F}_{p^2}\), equipped with fast endomorphisms, and with almost-prime-order twists, for the particularly efficient primes p = 2127 − 1 and p = 2255 − 19.KeywordsElliptic curve cryptographyendomorphismsGLVGLSexponentiationscalar multiplicationℚ-curves