5
$\begingroup$

From BSI-TR-03111 (PDF), on page 15:

The class number of the principal order belonging to the endomorphism ring of E SHOULD be at least 200.

This value commonly is referred to as $h$ in that publication.

I‘ve got two questions related to this:

  1. What does $h$ mean/denote?
  2. Why should it be 200 or larger?
$\endgroup$

1 Answer 1

1
$\begingroup$

Don't confuse h which is commonly adopted for the cofactor in EC (Cf p13 of the doc). The class number $\mathcal{H}(K)$ for any number field K is the cardinal of the class group Cl(K). Take a look to any course in algebraic number theory and specially H. COHEN and his famous book " A course in computational Alg. Numb Th ..." The ring theory is very vast, and the link with EC lies in the structure of its endomorphism Ring which can be viewed as an Order in a quadratic field. In H. COHEN you can understand that computing the class number for an random EC is not so easy, this is the reason why this value can't be chosen too small.

$\endgroup$
6
  • 1
    $\begingroup$ why does it need to be large? safecurves.cr.yp.to/disc.html says "the class number, a quantity related to D," and "there is no evidence of serious problems with either small |D| or large |D|"... $\endgroup$ Commented Jun 17, 2015 at 2:13
  • $\begingroup$ @lilywilson, EC for cryptographic purpose must be selected randomly. Look at the footnote page 15 of the document, that indicate that randomly EC have with a high probability a large class number. To observe the link between D and class number, I recommand you the beautiful book of J. Cox about prime numbers of certain form. Hope this answer to your question. $\endgroup$ Commented Jun 17, 2015 at 7:06
  • 1
    $\begingroup$ it doesn't answer my question. for example, the secp256k1 curve (the one used by bitcoin) is not selected randomly and has D very small (so I would assume the class number is also small). is there some problem with using such curves for cryptographic purposes? $\endgroup$ Commented Jun 17, 2015 at 16:15
  • 1
    $\begingroup$ "you can understand that computing the class number for an random EC is not so easy, this is the reason why this value can't be chosen too small." I don't get this implication. Why is it the case that only because it's hard to find the number it needs to be high? Are there any attacks if that value's too low? BTW: You may reference the book from here in the future. $\endgroup$
    – SEJPM
    Commented Jun 17, 2015 at 19:15
  • $\begingroup$ @lilywilson, in the ref doc you've mentionned, EC with large Discr. are however prefered for SafeCurves. Yes, Actually no attacks are know against EC with small D, but in the near future no one can garantee. $\endgroup$ Commented Jun 17, 2015 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.