here - Sites personnels de TELECOM ParisTech - Télécom ParisTech

5.4. Elliptic curves in cryptography 155Algorithm 5.4: Cornacchia’s algorithmInput: Co-prime positive integers d and nOutput: Positive integers x and y such that x 2 + y 2 d = n if they exist1 Compute a solution n/2 < r 0 < n to r0 2 ≡ −d (mod n)2 Write n = qr 0 + r 1 using the Euclidean algorithm3 Set k = 14 while r k ≥ √ n do5 Write r k = qr k+1 + r k+2 using the Euclidean algorithm6 k = k + 17 s =√n−r 2 kd8 if s ∈ Z then9 return (r k , s)10 return ∅5.4.2 The MOV/Frey–Rück attackPairings can be used to transport the discrete logarithm problem from the group of rationalpoints of an elliptic curve into the multiplicative subgroup of a finite field [18, Section V.2], [19,Section IX.9]. There exist subexponential algorithms to compute the discrete logarithm in finitefields. Hence, if the size of the base field does not grow too much, it is much more efficient tosolve the discrete logarithm in the target finite field rather than in the original group of pointsof the elliptic curve. This attack was first proposed by Menezes, Okamoto and Vanstone [192],using the Weil pairing, and by Frey and Rück [104], using the Tate pairing. It is described inAlgorithm 5.5. If E is an elliptic curve defined over F q of characteristic p and P ∈ E(F q ) is ofprime order l ≠ p, Q a multiple of P , we want to compute λ ∈ Z such that Q = [λ]P .Algorithm 5.5: The MOV/Frey–Rück AttackInput: P, Q ∈ E(F q ) such that P is of prime order l ≠ p and Q is a multiple of POutput: λ ∈ Z such that Q = [λ]P1 Compute k such that l|q k − 12 Compute S ∈ E(F q k) such that e(P, S) ≠ 13 ζ 1 ← e(P, S)4 ζ 2 ← e(Q, S)5 Compute λ such that ζ 2 = ζ λ 1 in F q k6 return λThe following proposition shows that the Tate pairing is already faster to compute than theWeil pairing.Proposition 5.4.1 ([10], [19, Theorem IX.12]). Suppose that l|#E(F q ) is prime, l ≠ p andl ̸ |q − 1. Then E[l] ⊂ E(F q k) if and only if l|q k − 1.To compute a Weil pairing, not only must two Tate pairings be computed, but the base fieldK(E[m]) is also larger than K(µ l ). In practice, more efficient pairing such as the eta or the atepairings [131] are used.It should be remarked that the discrete logarithm can be transported in a potentially strictsubfield F p ord l (p) of F q k [133]. The integer ord l (p) is the smallest integer such that F ∗ p ord l (p)