How Secure Are Elliptic Curves over Composite Extension Fields?

We compare the method of Weil descent for solving the ECDLP, over extensions fields of composite degree in characteristic two, against the standard method of parallelised Pollard rho. We give details of a theoretical and practical comparison and then use this to analyse the difficulty of actually solving the ECDLP for curves of the size needed in practical cryptographic systems. We show that composite degree extensions of degree divisible by four should be avoided. We also examine the elliptic curves proposed in the Oakley key determination protocol and show that with current technology they remain secure.

• Type: Conference
• Year: 2001
• Where: EUROCRYPT
• Authors: Nigel P. Smart
• Keywords: Composite Degree, Composite Degree Extensions, Cryptology, EUROCRYPT 2001, Parallelised Pollard Rho