We give a function field specific, algebraic proof of the main results of class field theory for abelian extensions of degree coprime to the characteristic. By adapting some methods known for number fields and combining them in a new way, we obtain a different and much simplified proof, which builds directly on a standard basic knowledge of the theory of function fields. Our methods are explicit and constructive and thus relevant for algorithmic applications. We use generalized forms of the Tate-Lichtenbaum and Ate pairings, which are well-known in cryptography, as an important tool.

Consider a scenario in which parties use a public-key encryption scheme and a signature scheme with a single public key/private key pair—so the private key sk is used for both signing and decrypting. Such a simultaneous use of a key is in general considered poor cryptographic practice, but from an efficiency point of view looks attractive.We offer security notions to analyze such violations of key separation. For both the identity- and the non-identity-based setting, we show that—although being insecure in general—for schemes of interest the resulting combined scheme can offer strong security guarantees.

We consider a tower of function fields F=(F_n)_{n\geq 0} over a finite field F_q and a finite extension E/F_0 such that the sequence \mathcal{E):=(EF_n)_{n\goq 0} is a tower over the field F_q. Then we deal with the following: What can we say about the invariants of \mathcal{E}; i.e., the asymptotic number of places of degree r for any r\geq 1 in \mathcal{E}, if those of F are known? We give a method based on explicit extensions for constructing towers of function fields over F_q with finitely many prescribed invariants being positive, and towers of function fields over F_q, for q a square, with at least one positive invariant and certain prescribed invariants being zero. We show the existence of recursive towers attaining the Drinfeld-Vladut bound of order r, for any r\geq 1 with q^r a square. Moreover, we give some examples of recursive towers with all but one invariants equal to zero.

The use of generalised Jacobians in discrete logarithm based cryptosystems has so far been rather limited since they offer no advantage over traditional discrete logarithm based systems. In this paper we continue the search for possible applications in two directions. Firstly, we investigate pairings on generalised Jacobians and show that these are insecure. Secondly, generalising and extending prior work, we show how the discrete logarithm problem in generalised Jacobians can be reduced to the minimal non zero weight word and maximum likelihood decoding problems in generalised algebraic geometric codes.

“He, first of Men, with awful Wing pursu’d the Comet tro’ the long Elliptic Curve.”

Consider a scenario in which parties use a public key encryption scheme and a signature scheme with a single public key/private key pair—so the private key sk is used for both signing and decrypting. Such a simultaneous use of a key is in general considered poor cryptographic practice, but from an efficiency point of view looks attractive. We offer security notions to analyze such violations of key separation. For both the identityand the non-identity-based setting, we show that— although being insecure in general—for schemes of interest the resulting combined (identity-based) public key scheme can offer strong security guarantees.

We provide a convenient mathematical framework that essentially encompasses all known pairing functions based on the Tate pairing and also applies to the Weil pairing. We prove non-degeneracy and bounds on the lowest possible degree of these pairing functions and show how endomorphisms can be used to achieve a further degree reduction.

In this paper, we discuss some applications of the pairing inversion problem and outline some potential approaches for solving it. Our analysis of these approaches gives further evidence that pairing inversion is a difficult problem.

We observe a natural generalisation of the ate and twisted ate pairings, which allow for performance improvements in non standard applications of pairings to cryptography like composite group orders. We also give a performance comparison of our pairings and the Tate, ate and twisted ate pairings for certain polynomial families based on operation count estimations and on an implementation, showing that our pairings can achieve a speedup of a factor of up to two over the other pairings.

We survey recent research on pairings on hyperelliptic curves and present a comparison of the performance characteristics of pairings on elliptic curves and hyperelliptic curves. Our analysis indicates that hyperelliptic curves are not more efficient than elliptic curves for general pairing applications.

In this paper we show that the Ate pairing, originally defined for elliptic curves, generalises to hyperelliptic curves and in fact to arbitrary algebraic curves. It has the following surprising properties: The loop length in Miller's algorithm can be up to g times shorter than for the Tate pairing, with g the genus of the curve, and the pairing is automatically reduced, i.e. no final exponentiation is needed.

In this paper, we simplify and extend the Eta pairing, originally discovered in the setting of supersingular curves by Barreto , to ordinary curves. Furthermore, we show that by swapping the arguments of the Eta pairing, one obtains a very efficient algorithm resulting in a speed-up of a factor of around six over the usual Tate pairing, in the case of curves that have large security parameters, complex multiplication by an order of Qopf (radic-3), and when the trace of Frobenius is chosen to be suitably small. Other, more minor savings are obtained for more general curves

We show that the elliptic curve analogue of the linear congruential generator produces sequences with high linear complexity and good multidimensional distribution.

This article is to appear as a chapter in Advances in Elliptic Curve Cryptography, edited by I. Blake, G. Seroussi and N. Smart, Cambridge University Press, 2004. It summarises the main aspects of the existing literature on Weil descent attacks and contains some new material on the GHS attack in even characteristic.

We discuss the security of the verifiably-encrypted signature scheme of Boneh, Gentry, Lynn and Shacham. It is quite realistic to allow adversaries access to adjudication oracles for different users but the same adjudicator. This presents an extension of the security model considered by Boneh, Gentry, Lynn and Shacham and we describe an efficient attack on their scheme in that model. We then show how to obtain security in this extended model by applying a small modification to their scheme.

We develop an algorithm for computing isomorphisms and automorphisms of algebraic function fields of transcendence degree one in characteristic zero and positive characteristic.

Let k be a global field with maximal order 0k and let m0 be an ideal of 0k. We present algorithms for the computation of the multiplicative group (0k/m0)* of the residue class ring 0k/m0 and the discrete logarithm therein based on the explicit representation of the group of principal units. We show how these algorithms can be combined with other methods in order to obtain more efficient algorithms. They are applied to the computation of the ray class group Clkm modulo m = m0m∞, where m∞ denotes a formal product of real infinite places, and also to the computation of conductors of ideal class groups and of discriminants and genera of class fields.

We develop an efficient identity based signature scheme based on pairings whose security relies on the hardness of the Diffie-Hellman problem in the random oracle model. We describe how this scheme is obtained as a special version of a more general generic scheme which yields further new provably secure identity based signature schemes if pairings are used. The generic scheme also includes traditional public key signature schemes. We further. discuss issues of key escrow and the distribution of keys to multiple trust authorities. The appendix contains a brief description of the relevant properties of supersingular elliptic curves and the Weil and Tate pairings.

We generalize the Weil descent construction of the GHS attack to arbitrary Artin-Schreier extensions. We give a formula for the characteristic polynomial of Frobenius of the obtained curves and prove that the large cyclic factor of the input elliptic curve is not contained in the kernel of the composition of the conorm and norm maps. As an application we almost square the number of elliptic curves which succumb to the basic GHS attack, thereby weakening curves over F2155 further. We also discuss other possible extensions or variations of the GHS attack and conclude that they are not likely to yield further improvements.