Security of algebraic curves in cryptography

椭圆曲线密码术(ECC)和超椭圆曲线密码术等推广代表了当今可用于给定安全级别的最有效的可实现公钥密码系统。所有其他公钥密码系统，如RSA(Rivest-Shamir-Adleman)，要么承认次指数时间攻击，要么在足够长的时间内没有受到足够长时间的相同水平的审查，以保证其安全性。因此，ECC在国际标准中被广泛采用，成为安全敏感或资源受限环境下的首选密码体制。ECC的一个值得注意的应用是在移动电话安全领域，计算能力较低通常会阻止使用效率较低的替代方案。 虽然人们普遍认为ECC是安全的，但椭圆曲线提供的确切安全级别仍然是一个悬而未决的问题。与RSA等传统密码系统不同的是，给定参数大小的所有系统都是同等安全的，而相同大小的椭圆曲线是否提供相同的安全性是未知的。曲线的选择在实践中非常重要，因为不同的曲线可能会导致不同的性能配置文件或功能集。例如，与其他曲线相比，Koblitz曲线具有更快的实现速度，并且配对友好的曲线允许使用需要配对的密码协议。关于这类曲线安全性的不确定性导致在国际标准文件中提出相互矛盾的建议。一些文档建议使用基于增加的特征集的配对友好曲线，而另一些文档则以安全考虑为由禁止使用配对友好曲线。 我的研究旨在通过计算各种可能的曲线之间的显式代数安全约简来回答椭圆曲线的安全性是否随曲线的选择而变化的问题。此外，这项研究有望产生(并在过去已经产生)新的基于椭圆曲线的密码系统，更快的实现，以及对基于ECC的协议的新的攻击和密码分析。

Elliptic curve cryptography (ECC) and generalizations such as hyperelliptic curve cryptography represent the most efficiently implementable public key cryptosystems available today for a given level of security. All other public key cryptosystems, such as RSA (Rivest-Shamir-Adleman) either admit subexponential time attacks or have not been subjected to the same level of scrutiny for a sufficiently long period of time to warrant confidence in their security. For this reason, ECC has been widely adopted in international standards as the preferred cryptosystem for security sensitive or resource constrained environments. A notable application of ECC is in the area of security for mobile phones, where lower computational power often precludes the use of less efficient alternatives. Although ECC is widely believed to be secure, the exact level of security provided by elliptic curves remains an open question. Unlike traditional cryptosystems such as RSA, where all systems of a given parameter size are equally secure, it is not known whether elliptic curves of the same size provide equal security. The choice of curve is highly relevant in practice because different curves can lead to different performance profiles or feature sets. For example, Koblitz curves have faster implementations compared to other curves, and pairing-friendly curves enable the use of cryptographic protocols that require pairings. Uncertainty regarding the security of such curves has led to the development of conflicting recommendations within international standards documents. Some documents recommend the use of pairing-friendly curves based on their increased feature set, while others forbid the use of pairing-friendly curves, citing security concerns. My research aims to answer the question of whether elliptic curve security varies depending on the choice of curve, by computing explicit algebraic security reductions between the various possible choices of curves. In addition, this research is expected to produce (and has produced in the past) new elliptic-curve based cryptosystems, faster implementations, and new attacks and cryptanalysis of ECC-based protocols.