Parameterized Splitting Systems for the Discrete Logarithm

Hoffstein and Silverman suggested the use of low Hamming weight product (LHWP) exponents to accelerate group exponentiation while maintaining the security level. With LHWP exponents, the computation costs on GF(2 ⁿ) or Koblitz elliptic curves can be reduced significantly, where the cost of squaring and elliptic curve doubling is much lower than that of multiplication and elliptic curve addition, respectively. In this paper, we present a parameterized splitting system with an additional property, which is a refinement version of the system introduced in PKC´08. We show that it yields an algorithm for the discrete logarithm problem (DLP) with LHWP exponents with lower complexity than that of any previously known algorithms. To demonstrate its application, we attack the GPS identification scheme modified by Coron, Lefranc, and Poupard in CHES´05 and the DLP with Hoffstein and Silverman´s (2,2,11)-exponent. The time complexity of our key recovery attack against the GPS scheme is 2 ^61.82 , which was expected to be 2 ⁷⁸. Hoffstein and Silverman´s (2,2,11)-exponent can be recovered with a time complexity of 2 ^53.02 , which is the lowest among the known attacks.