2
$\begingroup$

I am reading in literature articles and journals about Super Elliptic Curves and Super Singular Elliptic Curves such as this: https://arxiv.org/pdf/1906.02373

I have 2 questions:

  1. Do Super Elliptic Curves have anything to do with Hyper Elliptic Curves?
  2. Can we use Super/Super-Singular Elliptic Curves in Cryptography? If yes, why there is not any known commercial approach?
Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

Supersingular curves have weaknesses and thus are not used in Elliptic Curve Cryptography. This has been known for a long time, see for example, the statement in the PhD thesis on page 11, available here ($\ell$ is the order of the generator):

the embedding degree of $E$ (i.e., the order of $p \in \mathbb{F}^*$ if $\ell$ is prime) should be large enough (e.g., at least $20$ for the current parameter sizes), otherwise the MOV attack based on multiplicative transfer using the Weil and Tate pairings applies [Sem96; FR94; MOV93] - in particular, this rules out all super singular curves;

If one uses much larger base-field sizes as pointed out in the comments then this negates the efficiency gains of ECC. At the same time, the application to constructing pairing-friendly curves is a plus.

Improve this answer
$\endgroup$
7
  • $\begingroup$ Can this weakness be fixed? I mean, If I choose large primes? as it occurs with RSA for example... $\endgroup$
    – someone
    Commented Jul 16 at 4:28
  • 3
    $\begingroup$ Supersingular elliptic curves can be used, one just has to use much larger base-field sizes than "expected" to protect against the MOV attack. In fact, supersingular curves are the most straightforward way of constructing pairing-friendly curves. $\endgroup$
    – yyyyyyy
    Commented Jul 16 at 14:34
  • 2
    $\begingroup$ Yes, The move attack turns the Dlog on the curve points, into DLog in the finite field where one needs a much bigger size to be secure, see the records $\endgroup$
    – kelalaka
    Commented Jul 16 at 18:38
  • $\begingroup$ As I read in various articles "Supersingular isogeny key exchange" is broken (?!). Are there any other secure applications for Supersingular Elliptic Curves? $\endgroup$
    – someone
    Commented Jul 18 at 15:31
  • 2
    $\begingroup$ @someone It is designed for Quantum Secure, AFAIK, the weekend laptop algorithm, is not an improvement to the MOV attack. $\endgroup$
    – kelalaka
    Commented Jul 18 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.