Weil Descent Research Articles

The Weil descent functor in the category of algebras with free operators

We prove that there exists a version of Weil descent, or Weil restriction, in the category of D-algebras. The objects of this category are k-algebras R equipped with a homomorphism e:R→R⊗kD for some fixed field k and finite-dimensional k-algebra D. We do this under a mild assumption on the so-called associated endomorphisms. In particular, this yields the existence of the Weil descent functor in the category of difference algebras, which, to our knowledge, does not appear elsewhere.

Differential Weil descent

In this note a differential version of the classical Weil descent is established in all characteristics. This yields a ready-to-deploy tool of differential restriction of scalars for differential varieties over finite differential field extensions.

On the last fall degree of Weil descent polynomial systems

Given a polynomial system F over a finite field k which is not necessarily of dimension zero, we consider the Weil descent F′ of F over a subfield k′. We prove a theorem which relates the last fall degrees of F1 and F1′, where the zero set of F1 corresponds bijectively to the set of k-rational points of F, and the zero set of F1′ is the set of k′-rational points of the Weil descent F′. As an application we derive upper bounds on the last fall degree of F1′ in the case where F is a set of linearized polynomials.

On the first fall degree of summation polynomials

Abstract We improve on the first fall degree bound of polynomial systems that arise from a Weil descent along Semaev’s summation polynomials relevant to the solution of the Elliptic Curve Discrete Logarithm Problem via Gröbner basis algorithms.

On the last fall degree of zero-dimensional Weil descent systems

In this article we will discuss a mostly theoretical framework for solving zero-dimensional polynomial systems. Complexity bounds are obtained for solving such systems using a new parameter, called the last fall degree, which does not depend on the choice of a monomial order. The method is similar to certain MutantXL algorithms, but our abstract formulation has advantages. For example, we can prove that the cryptographic systems multi-HFE and HFE are insecure.More generally, let k be a finite field of cardinality qn and let k′ be the subfield of cardinality q. Let F⊂k[X0,…,Xm−1] be a finite subset generating a zero-dimensional ideal. We give an upper bound of the last fall degree of the Weil descent system of F from k to k′, which depends on q, m, the last fall degree of F, the degree of F and the number of solutions of F, but not on n. This shows that such Weil descent systems can be solved efficiently if n grows and the other parameters are fixed. In particular, one can apply these results to show a weakness in the cryptographic protocols HFE and multi-HFE.

A Note on the Kernel of Group Homomorphism from the Weil Descent Method

In this article, we demonstrate some properties of the kernel of homomorphism, obtained from the Weil descent attack on the elliptic curves over a field of characteristic 2, in particular, its nondegeneracy under some conditions.

Class pairings and isogenies on elliptic curves

In [Bue76,Bue77] a non-trivial homomorphism δ was constructed from Q-rational points on an elliptic curve to the ideal class group of a quadratic field K=Q(D). In [MT83] it was conjectured that δ was related to a pairing on points of E(K), which has come to be known as the ideal class pairing. In this paper we will show how to write the ideal class pairing in an explicit and easy-to-compute manner, and we will prove by direct calculation that the homomorphism δ is identical to the ideal class pairing with one argument fixed. For any elliptic curve E over a number field K, we will show how to extend the ideal class pairing to a full pairing on E(K), called simply the elliptic curve class pairing, which maps into an extension of the idele class group of K. The explicit formulas we will derive for the elliptic curve class pairing will enable us to prove that there is a natural relationship between this pairing and the Weil descent pairing. The kernel of the elliptic curve class pairing will be determined in many cases where one argument is taken to be a fixed torsion point and, as a corollary, the kernel of δ will be computed for a class of elliptic curves over imaginary quadratic fields.

First fall degree and Weil descent

Polynomial systems arising from a Weil descent have many applications in cryptography, including the HFE cryptosystem and the elliptic curve discrete logarithm problem over small characteristic fields. Understanding the exact complexity of solving these systems is essential for the applications. A first step in that direction is to study the first fall degree of the systems. In this paper, we establish a rigorous general bound on the first fall degree of polynomial systems arising from a Weil descent. We also provide experimental data to study the tightness of our bound in general and its plausible consequences on the complexity of polynomial systems arising from a Weil descent.

Empirical optimization of divisor arithmetic on hyperelliptic curves over $\mathbb{F}_{2^m}$

A significant amount of effort has been devoted to improving divisor arithmetic on low-genus hyperelliptic curves via explicit versions of generic algorithms. Moderate and high genus curves also arise in cryptographic applications, for example, via the Weil descent attack on the elliptic curve discrete logarithm problem, but for these curves, the generic algorithms are to date the most efficient available. Nagao [22] described how some of the techniques used in deriving efficient explicit formulas can be used to speed up divisor arithmetic using Cantor's algorithm on curves of arbitrary genus. In this paper, we describe how Nagao's methods, together with a sub-quadratic complexity partial extended Euclidean algorithm using the half-gcd algorithm can be applied to improve arithmetic in the degree zero divisor class group. We present numerical results showing which combination of techniques is more efficient for hyperelliptic curves over $\mathbb{F}_{2^n}$ of various genera.

Computing discrete logarithms in the Jacobian of high-genus hyperelliptic curves over even characteristic finite fields

We describe improved versions of index-calculus algorithms for solving discrete logarithm problems in Jacobians of high-genus hyperelliptic curves de ned over even characteristic elds. Our rst improvement is to incorporate several ideas for the low-genus case by Gaudry and Theriault, including the large prime variant and using a smaller factor base, into the large-genus algorithm of Enge and Gaudry. We extend the analysis in [24] to our new algorithm, allowing us to predict accurately the number of random walk steps required to nd all relations, and to select optimal degree bounds for the factor base. Our second improvement is the adaptation of sieving techniques from Flassenberg and Paulus, and Jacobson to our setting. The new algorithms are applied to concrete problem instances arising from the Weil descent attack methodology for solving the elliptic curve discrete logarithm problem, demonstrating signi cant improvements in practice.

On the number of rational points on curves over finite fields with many automorphisms

Using Weil descent, we give bounds for the number of rational points on two families of curves over finite fields with a large abelian group of automorphisms: Artin–Schreier curves of the form yq−y=f(x) with f∈Fqr[x], on which the additive group Fq acts, and Kummer curves of the form yq−1e=f(x), which have an action of the multiplicative group Fq⋆. In both cases we can remove a q factor from the Weil bound when q is sufficiently large.

The generalized Rédei-matrix for function fields

Let F be a finite geometric separable extension of the rational function field Fq(T). Let E be a finite cyclic extension of F with degree ℓ, where ℓ is a prime number. Assume that the ideal class number of the integral closure OF of Fq[T] in F is not divisible by ℓ. In analogy with the number field case [Q. Yue, The generalized Rédei-matrix, Math. Z. 261 (2009) 23–37], we define the generalized Rédei-matrix RE/F of local Hilbert symbols with coefficients in Fℓ. Using this generalized Rédei-matrix we give an analogue of the Rédei–Reichardt formula for E. Furthermore, we explicitly determine the generalized Rédei-matrices for Kummer extensions, biquadratic extensions and Artin–Schreier extensions of Fq(T). Finally, using the generalized Rédei-matrix given in this paper, we completely determine the 4-ranks of the ideal class groups for a large class of Artin–Schreier extensions. In cryptanalysis, this class of Artin–Schreier extensions has been used in [P. Gaudry, F. Hess, N.P. Smart, Constructive and destructive facets of Weil descent on elliptic curves, J. Cryptology 15 (2002) 19–46] to perform the Weil descent, which may lead to a possible method of attack against the ECDLP, so-called GHS attack.

On the asymptotic effectiveness of Weil descent attacks

In this paper we investigate the asymptotic effectiveness of the Gaudry–Hess–Smart Weil descent attack and its generalization to the discrete logarithm problem for elliptic curves over characteristic-two finite fields. In particular we obtain nontrivial lower and upper bounds on the smallest possible genus to which it can lead.

A Weil Descent Attack against Elliptic Curve Cryptosystems over Quartic Extension Fields

This paper proposes a Weil descent attack against elliptic curve cryptosystems over quartic extension fields. The scenario of the attack is as follows: First, one reduces a DLP on a Weierstrass form over the quartic extention of a finite field k to a DLP on a special form, called Scholten form, over the same field. Second, one reduces the DLP on the Scholten form to a DLP on a genus two hyperelliptic curve over the quadratic extension of k. Then, one reduces the DLP on the hyperelliptic curve to one on a Cab model over k. Finally, one obtains the discrete-log of original DLP by applying the Gaudry method to the DLP on the Cab model. In order to carry out the scenario, this paper shows that many of elliptic curve discrete-log problems over quartic extension fields of odd characteristics are reduced to genus two hyperelliptic curve discrete-log problems over quadratic extension fields, and that almost all of the genus two hyperelliptic curve discrete-log problems over quadratic extension fields of odd characteristics come under Weil descent attack. This means that many of elliptic curve cryptosystems over quartic extension fields of odd characteristics can be attacked uniformly.

Cryptographic implications of Hess' generalized GHS attack

A finite field K is said to be weak for elliptic curve cryptography if all instances of the discrete logarithm problem for all elliptic curves over K can be solved in significantly less time than it takes Pollard's rho method to solve the hardest instances. By considering the GHS Weil descent attack, it was previously shown that characteristic two finite fields are weak. In this paper, we examine characteristic two finite fields for weakness under Hess' generalization of the GHS attack. We show that the fields are potentially partially weak in the sense that any instance of the discrete logarithm problem for half of all elliptic curves over , namely those curves E for which is divisible by 4, can likely be solved in significantly less time than it takes Pollard's rho method to solve the hardest instances. We also show that the fields are partially weak, that the fields are potentially weak, and that the fields are potentially partially weak. Finally, we argue that the other fields where N is not divisible by 3, 5, 6, 7 or 8, are not weak under Hess' generalized GHS attack.

An Elliptic Curve Trapdoor System

We propose an elliptic curve trapdoor system which is of interest in key escrow applications. In this system, a pair (Es, Epb) of elliptic curves over F2 161 is constructed with the following properties: (i) the Gaudry-Hess-Smart Weil descent attack reduces the elliptic curve discrete logarithm problem (ECDLP) in Es(F2 161) to a hyperelliptic curve DLP in the Jacobian of a curve of genus 7 or 8, which is computationally feasible, but by far not trivial; (ii) Es is isogenous to Es; (iii) the best attack on the ECDLP in Es(F2 161) is the parallelized Pollard rho method. The curve Es is used just as usual in elliptic curve cryptosystems. The curve Es is submitted to a trusted authority for the purpose of key escrow. The crucial difference from other key escrow scenarios is that the trusted authority has to invest a considerable amount of computation to compromise a user's private key, which makes applications such as widespread wire-tapping impossible.

An Extension of GHSWeil Descent Attack

The Weil descent attack, suggested by Frey, has been implemented by Gaudry, Hess and Smart (the so-called GHS attack), on elliptic curves over finite fields of characteristic two of composite degrees. The GHS attack has been extended by Galbraith to hyperelliptic curves of characteristic two. Recently, Diem presented a general treatment of GHS attack to hyperelliptic curves over finite fields of arbitrary characteristics. This paper shows that Diem's approach can be extended to curves of which the function fields are cyclic Galois extension. In particular, existance of GHS Weil restriction, triviality of the kernel of GHS conorm-norm homomorphism, and lower/upper bounds of genera of the restricted function field are discussed.

Generalising the GHS Attack on the Elliptic Curve Discrete Logarithm Problem

AbstractThe Weil descent construction of the GHS attack on the elliptic curve discrete logarithm problem (ECDLP) is generalised in this paper, to arbitrary Artin-Schreier extensions. A formula is given for the characteristic polynomial of Frobenius for the curves thus obtained, as well as a proof that the large cyclic factor of the input elliptic curve is not contained in the kernel of the composition of the conorm and norm maps. As an application, the number of elliptic curves that succumb to the basic GHS attack is considerably increased, thereby further weakening curves over GF2155.Other possible extensions or variations of the GHS attack are discussed, leading to the conclusion that they are unlikely to yield further improvements.

Weil descent of Jacobians

The technique of Weil restriction of scalars has significant implications for elliptic curve cryptography. In this paper we apply these ideas to the case of the discrete logarithm problem in the Jacobian of a curve of genus greater than one over a finite field F q n where n>1.

On the characterization of complex Shimura varieties

In this paper we recall basic properties of complex Shimura varieties and show that they actually characterize them. This characterization immediately implies the explicit form of Kazhdan's theorem on the conjugation of Shimura varieties. It also implies the existence of unique equivariant models over the reflex field of Shimura varieties corresponding to adjoint groups and the existence of a p-adic uniformization of certain unitary Shimura varieties. In the appendix we give a modern formulation and a proof of Weil's descent theorem.