New point compression method for elliptic [formula omitted]-curves of j-invariant 0

Abstract

In the article we propose a new compression method (to 2⌈log2⁡(q)⌉+3 bits) for the Fq2-points of an elliptic curve Eb:y2=x3+b (for b∈Fq2⁎) of j-invariant 0. It is based on Fq-rationality of some generalized Kummer surface GKb. This is the geometric quotient of the Weil restriction Rb:=RFq2/Fq(Eb) under the order 3 automorphism restricted from Eb. More precisely, we apply the theory of conic bundles (i.e., conics over the function field Fq(t)) to obtain explicit and quite simple formulas of a birational Fq-isomorphism between GKb and A2. Our point compression method consists in computation of these formulas. To recover (in the decompression stage) the original point from Eb(Fq2)=Rb(Fq) we find an inverse image of the natural map Rb→GKb of degree 3, i.e., we extract a cubic root in Fq. For q≢1(mod27) this is just a single exponentiation in Fq, hence the new method seems to be much faster than the classical one with x-coordinate, which requires two exponentiations in Fq.