{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,27]],"date-time":"2026-06-27T16:06:15Z","timestamp":1782576375085,"version":"3.54.5"},"publisher-location":"Cham","reference-count":231,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783031834899","type":"print"},{"value":"9783031834905","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-3-031-83490-5_7","type":"book-chapter","created":{"date-parts":[[2025,3,12]],"date-time":"2025-03-12T06:24:27Z","timestamp":1741760667000},"page":"124-191","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":6,"title":["Safe curves for elliptic-curve cryptography"],"prefix":"10.1007","author":[{"given":"Daniel J.","family":"Bernstein","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tanja","family":"Lange","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2025,3,13]]},"reference":[{"key":"7_CR1","unstructured":"\u2014 (no editor), 1997 IEEE symposium on security and privacy, May 4\u20137, 1997, Oakland, CA, USA, IEEE Computer Society, 1997. ISBN 0-8186-7828-3. URL: https:\/\/ieeexplore.ieee.org\/xpl\/conhome\/4693\/proceeding. See [191]."},{"key":"7_CR2","unstructured":"\u2014 (no editor), 27th IEEE symposium on computer arithmetic, ARITH 2020, Portland, OR, USA, June 7\u201310, 2020, IEEE, 2020. ISBN 978-1-7281-7120-3. URL: https:\/\/ieeexplore.ieee.org\/xpl\/conhome\/9146973\/proceeding. See [56]."},{"key":"7_CR3","unstructured":"\u2014 (no editor), 2020 IEEE symposium on security and privacy, SP 2020, San Francisco, CA, USA, May 18\u201321, 2020, IEEE, 2020. URL: https:\/\/ieeexplore.ieee.org\/xpl\/conhome\/9144328\/proceeding. See [221]."},{"key":"7_CR4","doi-asserted-by":"publisher","unstructured":"\u2014 (no editor), 30th IEEE annual international symposium on field-programmable custom computing machines, FCCM 2022, New York City, NY, USA, May 15\u201318, 2022, IEEE, 2022. ISBN 978-1-6654-8332-2. https:\/\/doi.org\/10.1109\/FCCM53951.2022. See [230].","DOI":"10.1109\/FCCM53951.2022"},{"key":"7_CR5","doi-asserted-by":"publisher","unstructured":"\u2014 (no editor), IEEE European symposium on security and privacy, EuroS &P 2023\u2014workshops, Delft, Netherlands, July 3\u20137, 2023, IEEE, 2023. ISBN 979-8-3503-2720-5. https:\/\/doi.org\/10.1109\/EuroSPW59978.2023. See [169].","DOI":"10.1109\/EuroSPW59978.2023"},{"key":"7_CR6","unstructured":"\u201cBushing\u201d, Hector Martin \u201cmarcan\u201d Cantero, Segher Boessenkool, Sven Peter, PS3 epic fail (2010).URL: https:\/\/events.ccc.de\/congress\/2010\/Fahrplan\/attachments\/1780_27c3_console_hacking_2010.pdf. Citations in this document: \u00a7\u00a0A."},{"key":"7_CR7","unstructured":"Joe Abernathy, The following is the written response to my request for an interview with the NSA (1992). URL: https:\/\/archive.epic.org\/crypto\/dss\/nsa_abernathy_letter.html. Citations in this document: \u00a71.4."},{"key":"7_CR8","unstructured":"Accredited Standards Committee X9, ANSI x9.62-1999: Public key cryptography for the financial services industry: the elliptic curve digital signature algorithm (ECDSA) (1999). Citations in this document: \u00a71.1, \u00a75, \u00a77.1, \u00a710."},{"key":"7_CR9","unstructured":"Accredited Standards Committee X9, ANSI X9.63-2001: Public key cryptography for the financial services industry: key agreement and key transport using elliptic curve cryptography (2001). URL: https:\/\/web.archive.org\/web\/20010724160111\/https:\/\/grouper.ieee.org\/groups\/1363\/Research\/Other.html. Citations in this document: \u00a71.1."},{"key":"7_CR10","doi-asserted-by":"crossref","unstructured":"Onur Acii\u00e7mez, Billy Bob Brumley, Philipp Grabher, New results on instruction cache attacks, in CHES 2010 [168] (2010), 110\u2013124. URL: https:\/\/iacr.org\/archive\/ches2010\/62250105\/62250105.pdf. Citations in this document: \u00a78.3.","DOI":"10.1007\/978-3-642-15031-9_8"},{"key":"7_CR11","doi-asserted-by":"publisher","unstructured":"Alejandro Cabrera Aldaya, Billy Bob Brumley, When one vulnerable primitive turns viral: novel single-trace attacks on ECDSA and RSA, IACR Trans. Cryptogr. Hardw. Embed. Syst. 2020 (2020), 196\u2013221. URL: https:\/\/eprint.iacr.org\/2020\/055. https:\/\/doi.org\/10.13154\/tches.v2020.i2.196-221. Citations in this document: \u00a7\u00a0A.","DOI":"10.13154\/tches.v2020.i2.196-221"},{"key":"7_CR12","doi-asserted-by":"crossref","unstructured":"Thomas Allan, Billy Bob Brumley, Katrina Falkner, Joop van de Pol, Yuval Yarom, Amplifying side channels through performance degradation, in ACSAC 2016 [210] (2016), 422\u2013435 URL: https:\/\/eprint.iacr.org\/2015\/1141. Citations in this document: \u00a7\u00a0A.","DOI":"10.1145\/2991079.2991084"},{"key":"7_CR13","doi-asserted-by":"publisher","unstructured":"Diego F. Aranha, Felipe Rodrigues Novaes, Akira Takahashi, Mehdi Tibouchi, Yuval Yarom, LadderLeak: breaking ECDSA with less than one bit of nonce leakage, in CCS 2020 [164] (2020), 225\u2013242. URL: https:\/\/eprint.iacr.org\/2020\/615. https:\/\/doi.org\/10.1145\/3372297.3417268. Citations in this document: \u00a7\u00a0A.","DOI":"10.1145\/3372297.3417268"},{"key":"7_CR14","doi-asserted-by":"publisher","unstructured":"Christophe Arene, David R. Kohel, Christophe Ritzenthaler,Complete addition laws on abelian varieties, LMS J. Comput. Math. 15 (2012). 308\u2013316. https:\/\/doi.org\/10.1112\/s1461157012001027. Citations in this document: \u00a710.3.","DOI":"10.1112\/s1461157012001027"},{"key":"7_CR15","unstructured":"Vijay Atluri, Claudia D\u00edaz (editors), Computer security\u2014ESORICS 2011\u201416th European symposium on research in computer security, Leuven, Belgium, September 12\u201314, 2011, proceedings, Lecture Notes in Computer Science, 6879, Springer, 2011. ISBN 978-3-642-23821-5. See [75]."},{"key":"7_CR16","unstructured":"Daniel V. Bailey, Brian Baldwin, Lejla Batina, Daniel J. Bernstein, Peter Birkner, Joppe W. Bos, Gauthier van Damme, Giacomo de Meulenaer, Junfeng Fan, Tim G\u00fcneysu, Frank Gurkaynak, Thorsten Kleinjung, Tanja Lange, Nele Mentens, Christof Paar, Francesco Regazzoni, Peter Schwabe, Leif Uhsadel, Breaking ECC2K-130 (2009). URL: https:\/\/eprint.iacr.org\/2009\/466. Citations in this document: \u00a7\u00a0B."},{"key":"7_CR17","doi-asserted-by":"crossref","unstructured":"R. Balasubramanian, Neal Koblitz, The improbability that an elliptic curve has subexponential discrete log problem under the Menezes\u2013Okamoto\u2013Vanstone algorithm, J. Cryptol. 11 (1988), 141\u2013145. Citations in this document: \u00a75.","DOI":"10.1007\/s001459900040"},{"key":"7_CR18","unstructured":"James Bamford, The NSA is building the country\u2019s biggest spy center (watch what you say) (2012). URL: https:\/\/www.wired.com\/2012\/03\/ff-nsadatacenter\/. Citations in this document: \u00a7\u00a0D.3."},{"key":"7_CR19","doi-asserted-by":"crossref","unstructured":"Mihir Bellare (editor), Advances in cryptology\u2014CRYPTO 2000, 20th annual international cryptology conference, Santa Barbara, California, USA, August 20\u201324, 2000, proceedings, Lecture Notes in Computer Science, 1880, Springer, 2000. ISBN 3-540-67907-3. See [54].","DOI":"10.1007\/3-540-44598-6"},{"key":"7_CR20","doi-asserted-by":"crossref","unstructured":"Andreas Bender, Guy Castagnoli, On the implementation of elliptic curve cryptosystems, in [68] (1990), 186\u2013192. MR 91d:11154. Citations in this document: \u00a72.2.","DOI":"10.1007\/0-387-34805-0_18"},{"key":"7_CR21","unstructured":"Daniel J. Bernstein, A software implementation of NIST P-224 (29 Oct 2001). URL: https:\/\/cr.yp.to\/talks.html#2001.10.29. Citations in this document: \u00a79.4."},{"key":"7_CR22","unstructured":"Daniel J. Bernstein, Re: Current consensus on ECC (1 Nov 2001). URL: https:\/\/groups.google.com\/g\/sci.crypt\/c\/mu_paShEU3w\/m\/m491pYxHbtAJ. Citations in this document: \u00a79.4."},{"key":"7_CR23","unstructured":"Daniel J. Bernstein, Curve25519: new Diffie-Hellman speed records, in PKC 2006 [231] (2006), 207\u2013228. URL: https:\/\/cr.yp.to\/papers.html#curve25519. Citations in this document: \u00a71.3, \u00a72.1, \u00a78.2, \u00a78.2, \u00a78.5, \u00a79.4, \u00a710, \u00a7\u00a0B, \u00a7\u00a0E.2."},{"key":"7_CR24","unstructured":"Daniel J. Bernstein, Complete addition laws for all elliptic curves over finite fields (2009). URL: https:\/\/cr.yp.to\/talks.html#2009.07.17. Citations in this document: \u00a710.3, \u00a710.3."},{"key":"7_CR25","unstructured":"Daniel J. Bernstein, Why EdDSA held up better than ECDSA against Minerva (2019). URL: https:\/\/blog.cr.yp.to\/20191024-eddsa.html. Citations in this document: \u00a710."},{"key":"7_CR26","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Cryptographic competitions, Journal of Cryptology 37 (2024) article 7. URL: https:\/\/cr.yp.to\/papers.html#competitions. Citations in this document: \u00a77.","DOI":"10.1007\/s00145-023-09467-1"},{"key":"7_CR27","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Peter Birkner, Marc Joye, Tanja Lange, Christiane Peters, Twisted Edwards curves, in Africacrypt 2008 [223] (2008), 389\u2013405. Citations in this document: \u00a78.6, \u00a710.2.","DOI":"10.1007\/978-3-540-68164-9_26"},{"key":"7_CR28","unstructured":"Daniel J. Bernstein, Tung Chou, CryptAttackTester: formalizing attack analyses, in Crypto 2024, to appear (2023). URL: https:\/\/eprint.iacr.org\/2023\/940. Citations in this document: \u00a7\u00a0B.1."},{"key":"7_CR29","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Tung Chou, Chitchanok Chuengsatiansup, Andreas H\u00fclsing, Eran Lambooij, Tanja Lange, Ruben Niederhagen, Christine van Vredendaal, How to manipulate curve standards: A white paper for the black hat, in [79] (2015), 109\u2013139. URL: https:\/\/bada55.cr.yp.to. Citations in this document: \u00a77.2, \u00a77.3.","DOI":"10.1007\/978-3-319-27152-1_6"},{"key":"7_CR30","doi-asserted-by":"publisher","unstructured":"Daniel J. Bernstein, Chitchanok Chuengsatiansup, David Kohel, Tanja Lange, Twisted Hessian curves, in Latincrypt 2015 [161] (2015), 269\u2013294. URL: https:\/\/eprint.iacr.org\/2015\/781. https:\/\/doi.org\/10.1007\/978-3-319-22174-8_15. Citations in this document: \u00a710.3.","DOI":"10.1007\/978-3-319-22174-8_15"},{"key":"7_CR31","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, Bo-Yin Yang, High-speed high-security signatures, in CHES 2011 [199] (2011), 124\u2013142; see also newer version [31]. Citations in this document: \u00a710, \u00a710, \u00a710.2.","DOI":"10.1007\/978-3-642-23951-9_9"},{"key":"7_CR32","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, Bo-Yin Yang, High-speed high-security signatures, Journal of Cryptographic Engineering 2 (2012), 77\u201389; see also older version [31]. URL: https:\/\/eprint.iacr.org\/2011\/368. Citations in this document: \u00a710.2, \u00a7\u00a0E.2.","DOI":"10.1007\/s13389-012-0027-1"},{"key":"7_CR33","unstructured":"!bibitemch72016spsbernsteinspssect113r2 Daniel J. Bernstein, Susanne Engels, Tanja Lange, Ruben Niederhagen, Christof Paar, Peter Schwabe, Ralf Zimmermann, Faster elliptic-curve discrete logarithms on FPGAs (2016). URL: https:\/\/eprint.iacr.org\/2016\/382. Citations in this document: \u00a7\u00a0B.3."},{"key":"7_CR34","unstructured":"Daniel J. Bernstein, Mike Hamburg, Anna Krasnova, Tanja Lange, Elligator: elliptic-curve points indistinguishable from uniform random strings, in CCS 2013 [207] (2013), 967\u2013980. URL: https:\/\/eprint.iacr.org\/2013\/325. Citations in this document: \u00a711.2, \u00a711.2, \u00a711.4, \u00a711.4, \u00a711.4, \u00a711.4."},{"key":"7_CR35","unstructured":"Daniel J. Bernstein, David Kohel, Tanja Lange, Projective coordinates for twisted Hessian curves (2009). URL: https:\/\/hyperelliptic.org\/EFD\/g1p\/auto-twistedhessian-projective.html. Citations in this document: \u00a710.3."},{"key":"7_CR36","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Tanja Lange, Faster addition and doubling on elliptic curves, in Asiacrypt 2007 [157] (2007). 29\u201350. URL: https:\/\/eprint.iacr.org\/2007\/286. Citations in this document: \u00a73, \u00a710.2.","DOI":"10.1007\/978-3-540-76900-2_3"},{"key":"7_CR37","unstructured":"Daniel J. Bernstein, Tanja Lange, Explicit-Formulas Database (2007), first posted in 2007, also updated afterwards. URL: https:\/\/hyperelliptic.org\/EFD\/. Citations in this document: \u00a78.1."},{"key":"7_CR38","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Tanja Lange, Analysis and optimization of elliptic-curve single-scalar multiplication, Contemporary Mathematics 46 (2008), 1\u201320. URL: https:\/\/eprint.iacr.org\/2007\/455. Citations in this document: \u00a78.1.","DOI":"10.1090\/conm\/461\/08979"},{"key":"7_CR39","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Tanja Lange, Type-II optimal polynomial bases, in WAIFI 2010 [128] (2010), 41\u201361. URL: https:\/\/eprint.iacr.org\/2010\/069. Citations in this document: \u00a7\u00a0B.","DOI":"10.1007\/978-3-642-13797-6_4"},{"key":"7_CR40","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Tanja Lange, Computing small discrete logarithms faster, in INDOCRYPT 2012 [110] (2012), 317\u2013338. URL: https:\/\/eprint.iacr.org\/2012\/458. Citations in this document: \u00a74.2.","DOI":"10.1007\/978-3-642-34931-7_19"},{"key":"7_CR41","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Tanja Lange, Two grumpy giants and a baby, in ANTS 2012 [132] (2013), 87\u2013111. URL: https:\/\/eprint.iacr.org\/2012\/294. Citations in this document: \u00a7\u00a0B.1.","DOI":"10.2140\/obs.2013.1.87"},{"key":"7_CR42","unstructured":"Daniel J. Bernstein, Tanja Lange, Security dangers of the NIST curves (31 May 2013). URL: https:\/\/cr.yp.to\/talks.html#2013.05.31. Citations in this document: \u00a71.4, \u00a77.2."},{"key":"7_CR43","unstructured":"Daniel J. Bernstein, Tanja Lange, SafeCurves: choosing safe curves for elliptic-curve cryptography (2013). URL: https:\/\/safecurves.cr.yp.to. Citations in this document: \u00a71.2, \u00a71.3, \u00a71.4, \u00a77.2, \u00a77.6, \u00a7\u00a0D.1."},{"key":"7_CR44","unstructured":"Daniel J. Bernstein, Tanja Lange, Failures in NIST\u2019s ECC standards (2016). URL: https:\/\/cr.yp.to\/papers.html#nistecc. Citations in this document: \u00a71.4."},{"key":"7_CR45","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Tanja Lange, Montgomery curves and the Montgomery ladder, in [61] (2017), 82\u2013115. Citations in this document: \u00a78.4, \u00a710, \u00a710.","DOI":"10.1017\/9781316271575.005"},{"key":"7_CR46","unstructured":"Daniel J. Bernstein, Tanja Lange, Failures in NIST\u2019s ECC standards, part 2 (2020). URL: https:\/\/csrc.nist.gov\/files\/pubs\/sp\/800\/186\/final\/docs\/sp800-186-draft-comments-received.pdf. Citations in this document: \u00a71.4."},{"key":"7_CR47","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Tanja Lange, Reza Rezaeian Farashahi, Binary Edwards curves, in CHES 2008 [190] (2008), 244\u2013265 URL: https:\/\/cr.yp.to\/papers.html#edwards2. Citations in this document: \u00a710.3.","DOI":"10.1007\/978-3-540-85053-3_16"},{"key":"7_CR48","doi-asserted-by":"publisher","unstructured":"Daniel J. Bernstein, Tanja Lange, Chloe Martindale, Lorenz Panny, Quantum circuits for the CSIDH: optimizing quantum evaluation of isogenies, in Eurocrypt 2019 [140] (2019), 409\u2013441. URL: https:\/\/cr.yp.to\/papers.html#qisog. https:\/\/doi.org\/10.1007\/978-3-030-17656-3_15. Citations in this document: \u00a7\u00a0B, \u00a7\u00a0B, \u00a7\u00a0B.3, \u00a7\u00a0D.1.","DOI":"10.1007\/978-3-030-17656-3_15"},{"key":"7_CR49","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Tanja Lange, Ruben Niederhagen, Dual EC: A standardized back door, in [206] (2016), 256\u2013281. URL: https:\/\/www.projectbullrun.org\/dual-ec\/index.html. Citations in this document: \u00a77, \u00a7\u00a0A.","DOI":"10.1007\/978-3-662-49301-4_17"},{"key":"7_CR50","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Tanja Lange, Peter Schwabe, On the correct use of the negation map in the Pollard rho method, in PKC 2011 [77], (2011), 128\u2013146. URL: https:\/\/eprint.iacr.org\/2011\/003. Citations in this document: \u00a74.5, \u00a74.5.","DOI":"10.1007\/978-3-642-19379-8_8"},{"key":"7_CR51","unstructured":"Daniel J. Bernstein, Kaushik Nath, lib25519 (2024). URL: https:\/\/lib25519.cr.yp.to. Citations in this document: \u00a78.2, \u00a7\u00a0E.1."},{"key":"7_CR52","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Peter Schwabe, NEON crypto, in CHES 2012 [200] (2012), 320\u2013339. URL: https:\/\/cr.yp.to\/papers.html#neoncrypto. Citations in this document: \u00a7\u00a0E.2.","DOI":"10.1007\/978-3-642-33027-8_19"},{"key":"7_CR53","doi-asserted-by":"crossref","unstructured":"Daniel J. Bernstein, Bo-Yin Yang, Fast constant-time gcd computation and modular inversion, IACR Trans. Cryptogr. Hardw. Embed. Syst. 2019 (2019), 340\u2013398. URL: https:\/\/tches.iacr.org\/index.php\/TCHES\/article\/view\/8298. Citations in this document: \u00a78.1.","DOI":"10.46586\/tches.v2019.i3.340-398"},{"key":"7_CR54","doi-asserted-by":"crossref","unstructured":"Ingrid Biehl, Bernd Meyer, Volker M\u00fcller, Differential fault attacks on elliptic curve cryptosystems, in Crypto 2000 [19] (2000), 131\u2013146. URL: https:\/\/www.iacr.org\/archive\/crypto2000\/18800131\/18800131.pdf. Citations in this document: \u00a79, \u00a79.2, \u00a7\u00a0A, \u00a7\u00a0A.","DOI":"10.1007\/3-540-44598-6_8"},{"key":"7_CR55","doi-asserted-by":"publisher","unstructured":"Eli Biham, Lior Neumann, Breaking the Bluetooth pairing\u2014the fixed coordinate invalid curve attack, in SAC 2019 [192] (2019), 250\u2013273. https:\/\/doi.org\/10.1007\/978-3-030-38471-5_11. Citations in this document: \u00a79.2, \u00a7\u00a0A.","DOI":"10.1007\/978-3-030-38471-5_11"},{"key":"7_CR56","doi-asserted-by":"publisher","unstructured":"Mojtaba Bisheh-Niasar, Rami El Khatib, Reza Azarderakhsh. Mehran Mozaffari Kermani, Fast, small, and area-time efficient architectures for key-exchange on Curve25519, in ARITH 2020 [2] (2020), 72\u201379. https:\/\/doi.org\/10.1109\/ARITH48897.2020.00019. Citations in this document: \u00a7\u00a0E.2.","DOI":"10.1109\/ARITH48897.2020.00019"},{"key":"7_CR57","unstructured":"BITMAIN, Bitcoin Miner S21 (2023). URL: https:\/\/shop.bitmain.com\/product\/detail?pid=00020240311180613891frupBW6406B2. Citations in this document: \u00a74.1."},{"key":"7_CR58","unstructured":"Blockchain.com, Total Hash Rate (TH\/s), (2024), accessed 15 June 2024. URL: https:\/\/www.blockchain.com\/explorer\/charts\/hash-rate. Citations in this document: \u00a77.4."},{"key":"7_CR59","doi-asserted-by":"crossref","unstructured":"Joppe W. Bos, J. Alex Halderman, Nadia Heninger, Jonathan Moore, Michael Naehrig, Eric Wustrow, Elliptic curve cryptography in practice, in FC 2014 [81] (2014), 157\u2013175. URL: https:\/\/eprint.iacr.org\/2013\/734. Citations in this document: Citations in this document: \u00a7\u00a0A.","DOI":"10.1007\/978-3-662-45472-5_11"},{"key":"7_CR60","doi-asserted-by":"crossref","unstructured":"Joppe W. Bos, Thorsten Kleinjung, Arjen K. Lenstra, On the use of the negation map in the Pollard rho method, in ANTS 2010 [125] (2010), 66\u201382. URL: https:\/\/www.joppebos.com\/files\/negation.pdf. Citations in this document: \u00a74.5.","DOI":"10.1007\/978-3-642-14518-6_9"},{"key":"7_CR61","unstructured":"Joppe W. Bos, Arjen K. Lenstra (editors), Topics in computational number theory inspired by Peter L. Montgomery, Cambridge University Press, 2017. ISBN 978-1107109353. See [45]."},{"key":"7_CR62","doi-asserted-by":"publisher","unstructured":"Joppe W. Bos, Martijn Stam (editors), Computational cryptography: algorithmic aspects of cryptology, Cambridge University Press, 2021. https:\/\/doi.org\/10.1017\/9781108854207. See [121].","DOI":"10.1017\/9781108854207"},{"key":"7_CR63","doi-asserted-by":"crossref","unstructured":"Wieb Bosma, Hendrik W. Lenstra, Jr., Complete systems of two addition laws for elliptic curves, Journal of Number Theory 53 (1995), 229\u2013240. MR 96f:11079. URL: https:\/\/www.math.ru.nl\/~bosma\/pubs\/JNT1995.pdf. Citations in this document: \u00a710.1.","DOI":"10.1006\/jnth.1995.1088"},{"key":"7_CR64","doi-asserted-by":"crossref","unstructured":"Colin Boyd, Paul Montague, Khanh Quoc Nguyen, Elliptic curve based password authenticated key exchange protocols, in [222] (2001), 487\u2013501. Citations in this document: \u00a79.6, \u00a711.2, \u00a711.2, \u00a711.2.","DOI":"10.1007\/3-540-47719-5_38"},{"key":"7_CR65","doi-asserted-by":"publisher","unstructured":"Colin Boyd, Leonie Simpson (editors), Information security and privacy\u201418th Australasian conference, ACISP 2013, Brisbane, Australia, July 1\u20133, 2013, proceedings, Lecture Notes in Computer Science, 7959, Springer, 2013. ISBN 978-3-642-39058-6. https:\/\/doi.org\/10.1007\/978-3-642-39059-3. See [103].","DOI":"10.1007\/978-3-642-39059-3"},{"key":"7_CR66","unstructured":"ECC Brainpool, ECC Brainpool standard curves and curve generation (2005). URL: https:\/\/web.archive.org\/web\/20070814070853\/http:\/\/www.ecc-brainpool.org\/download\/Domain-parameters.pdf. Citations in this document: \u00a71.1, \u00a71.3, \u00a72.2, \u00a72.4, \u00a75, \u00a77.2."},{"key":"7_CR67","unstructured":"Luis Brandao, Rene Peralta, Deniable and not self-harming trapdoors, Talk at Rump session of Crypto 2014 (2014). URL: https:\/\/crypto.2014.rump.cr.yp.to\/7bad0b876b1c65ff7d0727be9afcbcf8.pdf. Citations in this document: \u00a77.4."},{"key":"7_CR68","doi-asserted-by":"crossref","unstructured":"Gilles Brassard (editor), Advances in cryptology\u2014CRYPTO \u201989, Lecture Notes in Computer Science, 435, Springer, Berlin, 1990. ISBN 0\u2013387\u201397317\u20136. MR 91b:94002. See [20].","DOI":"10.1007\/0-387-34805-0"},{"key":"7_CR69","unstructured":"Luca Breveglieri, Shay Gueron, Israel Koren, David Naccache, Jean-Pierre Seifert (editors), Fifth international workshop on fault diagnosis and tolerance in cryptography, 2008, FDTC 2008, Washington, DC, USA, 10 August 2008, IEEE Computer Society, 2008. ISBN 978-0-7695-3314-8. URL: https:\/\/ieeexplore.ieee.org\/xpl\/conhome\/4599542\/proceeding. See [102]."},{"key":"7_CR70","doi-asserted-by":"crossref","unstructured":"Eric Brier, Marc Joye, Weierstra\u00df elliptic curves and side-channel attacks, in PKC 2002 [179] (2002), 335\u2013345. URL: https:\/\/marcjoye.github.io\/papers\/BJ02espa.pdf. Citations in this document: \u00a78.7.","DOI":"10.1007\/3-540-45664-3_24"},{"key":"7_CR71","doi-asserted-by":"publisher","unstructured":"Eric Brier, Marc Joye, Fast point multiplication on elliptic curves through isogenies, in AAECC 2003 [101] (2003), 43\u201350 URL: https:\/\/marcjoye.github.io\/papers\/BJ03isog.pdf. https:\/\/doi.org\/10.1007\/3-540-44828-4_6. Citations in this document: \u00a73.1.","DOI":"10.1007\/3-540-44828-4_6"},{"key":"7_CR72","unstructured":"Nicolai Brown, Things that use Curve25519 (2024). URL: https:\/\/ianix.com\/pub\/curve25519-deployment.html. Citations in this document: \u00a79.3."},{"key":"7_CR73","unstructured":"Nicolai Brown, Things that use Ed25519 (2024). URL: https:\/\/ianix.com\/pub\/ed25519-deployment.html. Citations in this document: \u00a79.3."},{"key":"7_CR74","doi-asserted-by":"publisher","unstructured":"Billy Bob Brumley, Risto M. Hakala, Cache-timing template attacks, in Asiacrypt 2009 [170] (2009), 667\u2013684. URL: https:\/\/www.iacr.org\/archive\/asiacrypt2009\/59120664\/59120664.pdf. https:\/\/doi.org\/10.1007\/978-3-642-10366-7_39. Citations in this document: \u00a78.3, \u00a7\u00a0A.","DOI":"10.1007\/978-3-642-10366-7_39"},{"key":"7_CR75","doi-asserted-by":"crossref","unstructured":"Billy Bob Brumley, Nicola Tuveri, Remote timing attacks are still practical, in ESORICS 2011 [75] (2011), 355\u2013371. URL: https:\/\/eprint.iacr.org\/2011\/232. Citations in this document: \u00a78.5, \u00a7\u00a0A.","DOI":"10.1007\/978-3-642-23822-2_20"},{"key":"7_CR76","unstructured":"Srdjan Capkun, Franziska Roesner (editors), 29th USENIX security symposium, USENIX Security 2020, August 12\u201314, 2020, USENIX Association, 2020. ISBN 978-1-939133-17-5. URL: https:\/\/www.usenix.org\/conference\/usenixsecurity20. See [176]."},{"key":"7_CR77","unstructured":"Dario Catalano, Nelly Fazio, Rosario Gennaro, Antonio Nicolosi (editors), Public key cryptography\u2014PKC 2011\u201414th international conference on practice and theory in public key cryptography, Taormina, Italy, March 6\u20139, 2011, proceedings, Lecture Notes in Computer Science, 6571, Springer, 2011. ISBN 978-3-642-19378-1. See [50]."},{"key":"7_CR78","unstructured":"Certicom, Letter to IEEE (2002). URL: https:\/\/www.ieee802.org\/15\/pub\/Patent_Letters\/15.3\/certicom%2015.3.pdf. Citations in this document: \u00a79.3."},{"key":"7_CR79","unstructured":"Liqun Chen, Shin\u2019ichiro Matsuo (editors), Security standardisation research\u2014second international conference, SSR 2015, Tokyo, Japan, December 15\u201316, 2015, proceedings, Lecture Notes in Computer Science, 9497, Springer, 2015. ISBN 978-3-319-27151-4. See [29]."},{"key":"7_CR80","doi-asserted-by":"publisher","unstructured":"Tung Chou, Sandy2x: New Curve25519 speed records, in SAC 2015 [93] (2015), 145\u2013160. URL: https:\/\/eprint.iacr.org\/2015\/943. https:\/\/doi.org\/10.1007\/978-3-319-31301-6_8. Citations in this document: \u00a7\u00a0E.2.","DOI":"10.1007\/978-3-319-31301-6_8"},{"key":"7_CR81","doi-asserted-by":"crossref","unstructured":"Nicolas Christin, Reihaneh Safavi-Naini (editors), Financial cryptography and data decurity: 18th international conference, FC 2014, Christ Church, Barbados, March 3\u20137, 2014, Lecture Notes in Computer Science, 8437, Springer, 2014. See [59].","DOI":"10.1007\/978-3-662-45472-5"},{"key":"7_CR82","unstructured":"David V. Chudnovsky, Gregory V. Chudnovsky, Sequences of numbers generated by addition in formal groups and new primality and factorization tests, Advances in Applied Mathematics 7 (1986) 385\u2013434. MR 88h:11094. Citations in this document: \u00a73.1, \u00a73.1, \u00a73.1, \u00a78, \u00a78.1, \u00a78.2."},{"key":"7_CR83","doi-asserted-by":"crossref","unstructured":"Henri Cohen, Atsuko Miyaji, Takatoshi Ono, Efficient elliptic curve exponentiation using mixed coordinates, in Asiacrypt 1998 [186] (1998), 51\u201365. URL: https:\/\/dspace02.jaist.ac.jp\/dspace\/bitstream\/10119\/4458\/1\/73-53.pdf. Citations in this document: \u00a78.1.","DOI":"10.1007\/3-540-49649-1_6"},{"key":"7_CR84","doi-asserted-by":"crossref","unstructured":"Neil Costigan, Peter Schwabe, Fast elliptic-curve cryptography on the Cell Broadband Engine, in Africacrypt 2009 [198] (2009), 368\u2013385. URL: https:\/\/cryptojedi.org\/users\/peter\/#celldh. Citations in this document: \u00a7\u00a0E.2.","DOI":"10.1007\/978-3-642-02384-2_23"},{"key":"7_CR85","unstructured":"Brooke Crothers, Intel has bug-repair program (1997). URL: https:\/\/www.cnet.com\/tech\/tech-industry\/intel-has-bug-repair-program\/. Citations in this document: \u00a7\u00a0D.2."},{"key":"7_CR86","unstructured":"Agence nationale de la s\u00e9curit\u00e9 des syst\u00e8mes d\u2019information, Publication d\u2019un param\u00e9trage de courbe elliptique visant des applications de passeport \u00e9lectronique et de l\u2019administration \u00e9lectronique fran\u00e7aise (Nov 2011). URL: https:\/\/www.ssi.gouv.fr\/fr\/anssi\/publications\/publications-scientifiques\/autres-publications\/publication-d-un-parametrage-de-courbe-elliptique-visant-des-applications-de.html. Citations in this document: \u00a71.1."},{"key":"7_CR87","doi-asserted-by":"crossref","unstructured":"Yvo Desmedt (editor), Public Key Cryptography\u2014PKC 2003, 6th international workshop on theory and practice in public key cryptography, Miami, FL, USA, January 6\u20138, 2003, proceedings, Lecture Notes in Computer Science, 2567, Springer, 2002. ISBN 3-540-00324-X. See [142].","DOI":"10.1007\/3-540-36288-6"},{"key":"7_CR88","unstructured":"Nafissatou Diarra, Djiby Sow, Ahmed Youssef Ould Cheikh Khlil, On indifferentiable deterministic hashing into elliptic curves, European Journal of Pure and Applied Mathematics 10 (2017), 363\u2013391. URL: https:\/\/ejpam.com\/index.php\/ejpam\/article\/view\/2623. Citations in this document: \u00a711.4."},{"key":"7_CR89","doi-asserted-by":"publisher","unstructured":"Claus Diem, On the discrete logarithm problem in elliptic curves, Compositio Mathematica 147 (2011), 75\u2013104. https:\/\/doi.org\/10.1112\/S0010437X10005075. Citations in this document: \u00a72.1, \u00a7\u00a0A.","DOI":"10.1112\/S0010437X10005075"},{"key":"7_CR90","doi-asserted-by":"crossref","unstructured":"Claus Diem, Emmanuel Thom\u00e9, Index calculus in class groups of non-hyperelliptic curves of genus three, J. Cryptol. 21 (2008), 593\u2013611. URL: https:\/\/members.loria.fr\/EThome\/files\/non-he-genus3.pdf. Citations in this document: \u00a77.6.","DOI":"10.1007\/s00145-007-9014-6"},{"key":"7_CR91","doi-asserted-by":"crossref","unstructured":"Whitfield Diffie, Martin Hellman, New directions in cryptography, IEEE Transactions on Information Theory 22 (1976), 644\u2013654. ISSN 0018\u20139448. MR 55:10141. URL: https:\/\/ee.stanford.edu\/~hellman\/publications\/24.pdf. Citations in this document: \u00a71.","DOI":"10.1109\/TIT.1976.1055638"},{"key":"7_CR92","doi-asserted-by":"crossref","unstructured":"Michael D\u00fcll, Bj\u00f6rn Haase, Gesine Hinterw\u00e4lder, Michael Hutter, Christof Paar, Ana Helena S\u00e1nchez, Peter Schwabe, High-speed Curve25519 on 8-bit, 16-bit, and 32-bit microcontrollers, Designs, Codes and Cryptography 77 (2015), 493\u2013514. URL: https:\/\/link.springer.com\/article\/10.1007\/s10623-015-0087-1\/fulltext.html. Citations in this document: \u00a7\u00a0E.2.","DOI":"10.1007\/s10623-015-0087-1"},{"key":"7_CR93","doi-asserted-by":"publisher","unstructured":"Orr Dunkelman, Liam Keliher (editors), Selected areas in cryptography\u2014SAC 2015\u201422nd international conference, Sackville, NB, Canada, August 12\u201314, 2015, revised selected papers, Lecture Notes in Computer Science, 9566, Springer, 2016. ISBN 978-3-319-31300-9. https:\/\/doi.org\/10.1007\/978-3-319-31301-6. See [80].","DOI":"10.1007\/978-3-319-31301-6"},{"key":"7_CR94","doi-asserted-by":"crossref","unstructured":"Iwan M. Duursma, Pierrick Gaudry, Fran\u00e7ois Morain, Speeding up the discrete log computation on curves with automorphisms, in Asiacrypt 1999 [158] (1999), 103\u2013121. URL: https:\/\/inria.hal.science\/inria-00511639\/PDF\/automorphisms.pdf. Citations in this document: \u00a74.5.","DOI":"10.1007\/978-3-540-48000-6_10"},{"key":"7_CR95","doi-asserted-by":"crossref","unstructured":"Harold M. Edwards, A normal form for elliptic curves, Bulletin of the American Mathematical Society 44 (2007), 393\u2013422. URL: https:\/\/www.ams.org\/bull\/2007-44-03\/S0273-0979-07-01153-6\/home.html. Citations in this document: \u00a73, \u00a710.2.","DOI":"10.1090\/S0273-0979-07-01153-6"},{"key":"7_CR96","unstructured":"Adrian Escott, Implementing a parallel Pollard rho attack on ECC (1998). URL: https:\/\/cacr.uwaterloo.ca\/conferences\/1998\/ecc98\/escott.ps. Citations in this document: \u00a74.5."},{"key":"7_CR97","unstructured":"Wolfgang Ettlinger, Multiple vulnerabilities in Openpgp.js (2019). URL: https:\/\/sec-consult.com\/vulnerability-lab\/advisory\/multiple-vulnerabilities-in-openpgp-js\/. Citations in this document: \u00a79, \u00a7\u00a0A."},{"key":"7_CR98","unstructured":"Federation of American Scientists, Intelligence agency budgets: Commission recommends no release but releases them anyway (1996). URL: https:\/\/irp.fas.org\/commission\/budget.htm. Citations in this document: \u00a7\u00a0D.3."},{"key":"7_CR99","doi-asserted-by":"publisher","unstructured":"Marc Fischlin, Jean-S\u00e9bastien Coron (editors), Advances in cryptology\u2014EUROCRYPT 2016\u201435th annual international conference on the theory and applications of cryptographic techniques, Vienna, Austria, May 8\u201312, 2016, proceedings, part I, Lecture Notes in Computer Science, 9665, Springer, 2016. ISBN 978-3-662-49889-7. https:\/\/doi.org\/10.1007\/978-3-662-49890-3. See [202].","DOI":"10.1007\/978-3-662-49890-3"},{"key":"7_CR100","unstructured":"Agner Fog, Instruction tables: Lists of instruction latencies, throughputs and micro-operation breakdowns for Intel, AMD and VIA CPUs (2024). URL: https:\/\/agner.org\/optimize\/. Citations in this document: \u00a7\u00a0D.1."},{"key":"7_CR101","doi-asserted-by":"publisher","unstructured":"Marc P. C. Fossorier, Tom H\u00f8holdt, Alain Poli (editors), Applied algebra, algebraic algorithms and error-correcting codes, 15th international symposium, aaecc-15, toulouse, France, May 12\u201316, 2003, proceedings, 2643, Springer, 2003. ISBN 3-540-40111-3. https:\/\/doi.org\/10.1007\/3-540-44828-4. See [71].","DOI":"10.1007\/3-540-44828-4"},{"key":"7_CR102","doi-asserted-by":"publisher","unstructured":"Pierre-Alain Fouque, Reynald Lercier, Denis R\u00e9al, Fr\u00e9d\u00e9ric Valette, Fault attack on elliptic curve Montgomery ladder implementation, in FDTC 2008 [69] (2008), 92\u201398. URL: https:\/\/www.di.ens.fr\/~fouque\/pub\/fdtc08.pdf. https:\/\/doi.org\/10.1109\/FDTC.2008.15. Citations in this document: \u00a79.4.","DOI":"10.1109\/FDTC.2008.15"},{"key":"7_CR103","doi-asserted-by":"publisher","unstructured":"Pierre-Alain Fouque, Antoine Joux, Mehdi Tibouchi, Injective encodings to elliptic curves, in ACISP 2013 [65] (2013), 203\u2013218. https:\/\/doi.org\/10.1007\/978-3-642-39059-3_14. Citations in this document: \u00a711.4.","DOI":"10.1007\/978-3-642-39059-3_14"},{"key":"7_CR104","unstructured":"Gerhard Frey, How to disguise an elliptic curve (Weil descent) (1998). URL: https:\/\/cacr.uwaterloo.ca\/conferences\/1998\/ecc98\/slides.html. Citations in this document: \u00a72.1, \u00a7\u00a0A."},{"key":"7_CR105","doi-asserted-by":"crossref","unstructured":"Gerhard Frey, Hans-Georg R\u00fcck, A remark concerning m-divisibility and the discrete logarithm problem in the divisor class group of curves, Math. Comp. 62 (1994), 865\u2013874. URL: https:\/\/www.ams.org\/journals\/mcom\/1994-62-206\/S0025-5718-1994-1218343-6\/. Citations in this document: \u00a75.1, \u00a7\u00a0A.","DOI":"10.1090\/S0025-5718-1994-1218343-6"},{"key":"7_CR106","doi-asserted-by":"publisher","unstructured":"Hayato Fujii, Diego F. Aranha, Curve25519 for the Cortex-M4 and beyond, in LatinCrypt 2017 [159] (2017), 109\u2013127. https:\/\/doi.org\/10.1007\/978-3-030-25283-0_6. Citations in this document: \u00a7\u00a0E.2.","DOI":"10.1007\/978-3-030-25283-0_6"},{"key":"7_CR107","unstructured":"Tobias Funke, David Rupprecht, Invalid curve attack on the 5G SUCI privacy feature (2023). URL: https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-content\/uploads\/2023\/10\/0073-invalid_curve.pdf. Citations in this document: \u00a79, \u00a79, \u00a79, \u00a7\u00a0A."},{"key":"7_CR108","unstructured":"Tim G\u00fcneysu, Helena Handschuh (editors), Cryptographic hardware and embedded systems\u2014CHES 2015\u201417th international workshop, Saint-Malo, France, September 13\u201316, 2015, proceedings, Lecture Notes in Computer Science, 9293, Springer, 2015. ISBN 978-3-662-48323-7. See [133]."},{"key":"7_CR109","unstructured":"Steven Galbraith, Climbing and descending tall volcanos (2024), ANTS 2024. URL: https:\/\/eprint.iacr.org\/2024\/924. Citations in this document: \u00a77.5."},{"key":"7_CR110","unstructured":"Steven D. Galbraith, Mridul Nandi (editors), Progress in cryptology\u2014INDOCRYPT 2012, 13th international conference on cryptology in India, Kolkata, India, December 9\u201312, 2012, proceedings, Lecture Notes in Computer Science, 7668, Springer, 2012. ISBN 978-3-642-34930-0. See [40]."},{"key":"7_CR111","doi-asserted-by":"crossref","unstructured":"Robert P. Gallant, Robert J. Lambert, Scott A. Vanstone, Improving the parallelized Pollard lambda search on anomalous binary curves, Math. Comput. 69 (2000), 1699\u20131705. URL: https:\/\/www.ams.org\/journals\/mcom\/2000-69-232\/S0025-5718-99-01119-9\/. Citations in this document: \u00a76.2, \u00a7\u00a0A.","DOI":"10.1090\/S0025-5718-99-01119-9"},{"key":"7_CR112","doi-asserted-by":"crossref","unstructured":"Robert P. Gallant, Robert J. Lambert, Scott A. Vanstone, Faster point multiplication on elliptic curves with efficient endomorphisms, in Crypto 2001 [150] (2001), 190\u2013200. URL: https:\/\/iacr.org\/archive\/crypto2001\/21390189.pdf. Citations in this document: \u00a76.","DOI":"10.1007\/3-540-44647-8_11"},{"key":"7_CR113","doi-asserted-by":"publisher","unstructured":"Qingguan Gao, Kaisheng Sun, Jiankuo Dong, Fangyu Zheng, Jingqiang Lin, Yongjun Ren, Zhe Liu V-Curve25519: efficient implementation of Curve25519 on RISC-V architecture, in Inscrypt 2023 [117] (2023), 130\u2013149. https:\/\/doi.org\/10.1007\/978-981-97-0945-8_8. Citations in this document: \u00a7\u00a0E.2.","DOI":"10.1007\/978-981-97-0945-8_8"},{"key":"7_CR114","doi-asserted-by":"crossref","unstructured":"Pierrick Gaudry, Index calculus for abelian varieties of small dimension and the elliptic curve discrete logarithm problem, J. Symb. Comput. 44 (2009), 1690\u20131702. URL: https:\/\/inria.hal.science\/inria-00337631. Citations in this document: \u00a72.1, \u00a7\u00a0A.","DOI":"10.1016\/j.jsc.2008.08.005"},{"key":"7_CR115","unstructured":"Pierrick Gaudry, Emmanuel Thom\u00e9, The mp$$\\mathbb{F}_q$$library and implementing curve-based key exchanges (2009). URL: https:\/\/inria.hal.science\/inria-00168429. Citations in this document: \u00a7\u00a0E.2."},{"key":"7_CR116","doi-asserted-by":"crossref","unstructured":"Pierrick Gaudry, Florian Hess, Nigel P. Smart, Constructive and destructive facets of Weil descent on elliptic curves, Journal of Cryptology 15(1) (2002), 19\u201346. URL: https:\/\/inria.hal.science\/inria-00512763. Citations in this document: \u00a72.1, \u00a7\u00a0A.","DOI":"10.1007\/s00145-001-0011-x"},{"key":"7_CR117","doi-asserted-by":"publisher","unstructured":"Chunpeng Ge, Moti Yung (editors), Information security and cryptology\u201419th international conference, Inscrypt 2023, Hangzhou, China, December 9\u201310, 2023, revised selected papers, part II, Lecture Notes in Computer Science, 14527, Springer, 2024. ISBN 978-981-97-0944-1. https:\/\/doi.org\/10.1007\/978-981-97-0945-8. See [113].","DOI":"10.1007\/978-981-97-0945-8"},{"key":"7_CR118","doi-asserted-by":"publisher","unstructured":"Rosario Gennaro, Matthew Robshaw (editors), Advances in cryptology\u2014CRYPTO 2015\u201435th annual cryptology conference, Santa Barbara, CA, USA, August 16\u201320, 2015, proceedings, part I, Lecture Notes in Computer Science, 9215, Springer, 2015. ISBN 978-3-662-47988-9. https:\/\/doi.org\/10.1007\/978-3-662-47989-6. See [123].","DOI":"10.1007\/978-3-662-47989-6"},{"key":"7_CR119","unstructured":"Diana Goehringer, Marco Domenico Santambrogio, Jo\u00e3o M. P. Cardoso, Koen Bertels (editors), Reconfigurable computing: architectures, tools, and applications\u201410th international symposium, ARC 2014, Vilamoura, Portugal, April 14\u201316, 2014, proceedings (2014). ISBN 978-3-319-05959-4. See [208]."},{"key":"7_CR120","unstructured":"Go Project, CVE-2023-24532: Incorrect calculation on P256 curves in crypto\/internal\/nistec (2023). URL: https:\/\/www.cve.org\/CVERecord?id=CVE-2023-24532. Citations in this document: \u00a710.3, \u00a7\u00a0A."},{"key":"7_CR121","doi-asserted-by":"crossref","unstructured":"Robert Granger, Antoine Joux, Computing discrete logarithms, in [62] (2021), 106\u2013139. URL: https:\/\/eprint.iacr.org\/2021\/1140. Citations in this document: \u00a71.","DOI":"10.1017\/9781108854207.007"},{"key":"7_CR122","unstructured":"Tom R. Halfhill, Intel ups the ante, BYTE Magazine FEB (1996), 156\u2013156. URL: https:\/\/web.archive.org\/web\/19981206022744\/http:\/\/byte.com\/art\/9602\/sec14\/art2.htm. Citations in this document: \u00a7\u00a0D.2."},{"key":"7_CR123","doi-asserted-by":"publisher","unstructured":"Mike Hamburg, Decaf: eliminating cofactors through point compression, in Crypto 2015 [118] (2015), 705\u2013723. URL: https:\/\/eprint.iacr.org\/2015\/673. https:\/\/doi.org\/10.1007\/978-3-662-47989-6_34. Citations in this document: \u00a711.5.","DOI":"10.1007\/978-3-662-47989-6_34"},{"key":"7_CR124","doi-asserted-by":"crossref","unstructured":"Mike Hamburg, Faster Montgomery and double-add ladders for short Weierstrass curves, IACR Trans. Cryptogr. Hardw. Embed. Syst. 2020 (2020), 189\u2013208. URL: https:\/\/tches.iacr.org\/index.php\/TCHES\/article\/view\/8681. Citations in this document: \u00a78.7, \u00a78.7.","DOI":"10.46586\/tches.v2020.i4.189-208"},{"key":"7_CR125","unstructured":"Guillaume Hanrot, Fran\u00e7ois Morain, Emmanuel Thom\u00e9 (editors), Algorithmic number theory, 9th international symposium, ANTS-IX, Nancy, France, July 19\u201323, 2010, proceedings, Lecture Notes in Computer Science, 6197, Springer, 2010. ISBN 978-3-642-14517-9. See [60]."},{"key":"7_CR126","doi-asserted-by":"publisher","unstructured":"Feng Hao, Sushmita Ruj, Sourav Sen Gupta (editors), Progress in cryptology\u2014INDOCRYPT 2019\u201420th international conference on cryptology in India, Hyderabad, India, December 15\u201318, 2019, proceedings, Lecture Notes in Computer Science, 11898, Springer, 2019. ISBN 978-3-030-35422-0. https:\/\/doi.org\/10.1007\/978-3-030-35423-7. See [211].","DOI":"10.1007\/978-3-030-35423-7"},{"key":"7_CR127","doi-asserted-by":"publisher","unstructured":"Greg Harper, Alfred Menezes, Scott A. Vanstone, Public-key cryptosystems with very small key length, in Eurocrypt 1992 [205] (1992), 163\u2013173. https:\/\/doi.org\/10.1007\/3-540-47555-9_14. Citations in this document: \u00a79.3.","DOI":"10.1007\/3-540-47555-9_14"},{"key":"7_CR128","unstructured":"M. Anwar Hasan, Tor Helleseth (editors), Arithmetic of finite fields, third international workshop, WAIFI 2010, Istanbul, Turkey, June 27\u201330, 2010, proceedings, Springer, 2010. ISBN 978-3-642-13796-9. See [39]."},{"key":"7_CR129","doi-asserted-by":"publisher","unstructured":"Florian Hess, Sebastian Pauli, Michael E. Pohst (editors), Algorithmic number theory, 7th international symposium, ANTS-VII, Berlin, Germany, July 23\u201328, 2006, proceedings, Lecture Notes in Computer Science, 4076, Springer, 2006. ISBN 3-540-36075-1. https:\/\/doi.org\/10.1007\/11792086. See [216].","DOI":"10.1007\/11792086"},{"key":"7_CR130","unstructured":"Huseyin Hisil, Kenneth Koon-Ho Wong, Gary Carter, Ed Dawson, Twisted Edwards curves revisited, in Asiacrypt 2008 [196] (2008). URL: https:\/\/eprint.iacr.org\/2008\/522. \u00a71.3, \u00a73, \u00a710.2, \u00a710.2, \u00a710.2, \u00a711.5."},{"key":"7_CR131","doi-asserted-by":"crossref","unstructured":"Yvonne Hitchcock, Paul Montague, Gary Carter, Ed Dawson, The efficiency of solving multiple discrete logarithm problems and the implications for the security of fixed elliptic curves, Int. J. Inf. Sec. 3 (2004), 86\u201398. Citations in this document: \u00a74.2.","DOI":"10.1007\/s10207-004-0045-9"},{"key":"7_CR132","unstructured":"Everett W. Howe, Kiran S. Kedlaya (editors), ANTS X: proceedings of the tenth algorithmic number theory symposium, San Diego 2012, Mathematical Sciences Publishers, 2013. ISBN 978-1-935107-01-9. See [41]."},{"key":"7_CR133","doi-asserted-by":"crossref","unstructured":"Michael Hutter, J\u00fcrgen Schilling, Peter Schwabe, Wolfgang Wieser, NaCl\u2019s crypto_box in hardware, in CHES 2015 [108] (2015), 81\u2013101. URL: https:\/\/cryptojedi.org\/papers\/#naclhw. Citations in this document: \u00a7\u00a0E.2.","DOI":"10.1007\/978-3-662-48324-4_5"},{"key":"7_CR134","unstructured":"Institute of Electrical and Electronics Engineers, IEEE Std 1363-2000: IEEE standard specifications for public key cryptography (2000). URL: https:\/\/perso.telecom-paristech.fr\/guilley\/recherche\/cryptoprocesseurs\/ieee\/00891000.pdf. Citations in this document: \u00a71.1, \u00a75, \u00a78.1."},{"key":"7_CR135","unstructured":"Intel, Pentium Processor Family Developer\u2019s Manual, volume 3: Architecture and Programming Manual (1995). URL: https:\/\/stuff.mit.edu\/afs\/sipb\/contrib\/doc\/specs\/ic\/cpu\/x86\/pentium\/vol3.pdf. Citations in this document: \u00a7\u00a0D.1, \u00a7\u00a0D.1, \u00a7\u00a0D.1."},{"key":"7_CR136","unstructured":"Intel, Intel delivers the next level of computing with the new Pentium II processor (1997). URL: https:\/\/www.intel.com\/pressroom\/archive\/releases\/1997\/DP050797.HTM. Citations in this document: \u00a7\u00a0D.1, \u00a7\u00a0D.2, \u00a7\u00a0D.2."},{"key":"7_CR137","unstructured":"Intel, Form 10-K (1998). URL: https:\/\/www.intc.com\/filings-reports\/annual-reports\/content\/0000050863-98-000031\/0000050863-98-000031.pdf. Citations in this document: \u00a7\u00a0D.1, \u00a7\u00a0D.2."},{"key":"7_CR138","unstructured":"Intel, Pentium II processor at 233 MHz, 266 MHz, 300 MHz, and 333 MHz (1998). URL: https:\/\/web.archive.org\/web\/20240413014621\/https:\/\/datasheets.chipdb.org\/Intel\/x86\/Pentium%20II\/24333503.PDF. Citations in this document: \u00a7\u00a0D.1."},{"key":"7_CR139","unstructured":"Intel, Intel Architecture Optimization Reference Manual (1999). URL: https:\/\/download.intel.com\/design\/PentiumII\/manuals\/24512701.pdf. Citations in this document: \u00a7\u00a0D.1."},{"key":"7_CR140","doi-asserted-by":"publisher","unstructured":"Yuval Ishai, Vincent Rijmen (editors), Advances in cryptology\u2014EUROCRYPT 2019\u201438th annual international conference on the theory and applications of cryptographic techniques, Darmstadt, Germany, May 19\u201323, 2019, proceedings, part II, Lecture Notes in Computer Science, 11477, Springer, 2019. ISBN 978-3-030-17655-6. https:\/\/doi.org\/10.1007\/978-3-030-17656-3. See [48].","DOI":"10.1007\/978-3-030-17656-3"},{"key":"7_CR141","doi-asserted-by":"publisher","unstructured":"Tetsuya Izu, Jun Kogure, Masayuki Noro, Kazuhiro Yokoyama, Efficient implementation of Schoof\u2019s algorithm, in Asiacrypt 1998 [186] (1998), 66\u201379. https:\/\/doi.org\/10.1007\/3-540-49649-1_7. Citations in this document: \u00a77.1.","DOI":"10.1007\/3-540-49649-1_7"},{"key":"7_CR142","doi-asserted-by":"crossref","unstructured":"Tetsuya Izu, Tsuyoshi Takagi, Exceptional procedure attack on elliptic curve cryptosystems, in PKC 2003 [87] (2002), 224\u2013239. URL: https:\/\/www.iacr.org\/archive\/pkc2003\/25670224\/25670224.pdf. Citations in this document: \u00a710, \u00a7\u00a0A.","DOI":"10.1007\/3-540-36288-6_17"},{"key":"7_CR143","doi-asserted-by":"publisher","unstructured":"Tibor Jager, J\u00f6rg Schwenk, Juraj Somorovsky, Practical invalid curve attacks on TLS-ECDH, in ESORICS 2015 [193] (2015), 407\u2013425. URL: https:\/\/www.nds.rub.de\/research\/publications\/ESORICS15\/. https:\/\/doi.org\/10.1007\/978-3-319-24174-6_21. Citations in this document: \u00a7\u00a0A.","DOI":"10.1007\/978-3-319-24174-6_21"},{"key":"7_CR144","doi-asserted-by":"publisher","unstructured":"Jan Jancar, Vladimir Sedlacek, Petr Svenda, Marek S\u00fds, Minerva: the curse of ECDSA nonces: systematic analysis of lattice attacks on noisy leakage of bit-length of ECDSA nonces, IACR Trans. Cryptogr. Hardw. Embed. Syst. 2020 (2020), 281\u2013308. https:\/\/doi.org\/10.13154\/tches.v2020.i4.281-308. Citations in this document: \u00a710, \u00a710, \u00a710, \u00a7\u00a0A.","DOI":"10.13154\/tches.v2020.i4.281-308"},{"key":"7_CR145","unstructured":"Thomas R. Johnson, American cryptology during the cold war, 1945\u20131989, Book III: retrenchment and reform, 1972\u20131980, 2013, distributed inside NSA in 1998, partially declassified in 2013. URL: https:\/\/archive.org\/details\/cold_war_iii-nsa. Citations in this document: \u00a7\u00a0D.3."},{"key":"7_CR146","unstructured":"Thomas R. Johnson, American cryptology during the cold war, 1945\u20131989, Book IV: cryptologic rebirth, 1981\u20131989, 2013, distributed inside NSA in 1999, partially declassified in 2013. URL: https:\/\/archive.org\/details\/cold_war_iv-nsa. Citations in this document: \u00a7\u00a0D.3."},{"key":"7_CR147","unstructured":"Burton S. Kaliski Jr, Elliptic curves and cryptography: A pseudorandom bit generator and other tools, Ph.D. thesis, MIT, 1988. URL: https:\/\/dspace.mit.edu\/handle\/1721.1\/14709. Citations in this document: \u00a79.6."},{"key":"7_CR148","doi-asserted-by":"publisher","unstructured":"Burton S. Kaliski Jr., A pseudo-random bit generator based on elliptic logarithms, in Crypto 1986 [185] (1986), 84\u2013103. https:\/\/doi.org\/10.1007\/3-540-47721-7_7. Citations in this document: \u00a79.6.","DOI":"10.1007\/3-540-47721-7_7"},{"key":"7_CR149","doi-asserted-by":"crossref","unstructured":"Burton S. Kaliski Jr. (editor), Advances in cryptology\u2014CRYPTO \u201997, 17th annual international cryptology conference, Santa Barbara, California, USA, August 17\u201321, 1997, proceedings, Lecture Notes in Computer Science, 1294, Springer, 1997. ISBN 3-540-63384-7. See [165].","DOI":"10.1007\/BFb0052223"},{"key":"7_CR150","doi-asserted-by":"crossref","unstructured":"Joe Kilian (editor), Advances in cryptology\u2014CRYPTO 2001, 21st annual international cryptology conference, Santa Barbara, California, USA, August 19\u201323, 2001, proceedings, Lecture Notes in Computer Science, 2139, Springer, 2001. ISBN 3-540-42456-3. See [112].","DOI":"10.1007\/3-540-44647-8"},{"key":"7_CR151","doi-asserted-by":"crossref","unstructured":"Ann Hibner Koblitz, Neal Koblitz, Alfred Menezes, Elliptic curve cryptography: The serpentine course of a paradigm shift, Journal of Number Theory 131 (2011), 781\u2013814. URL: https:\/\/eprint.iacr.org\/2008\/390. Citations in this document: \u00a77.6.","DOI":"10.1016\/j.jnt.2009.01.006"},{"key":"7_CR152","doi-asserted-by":"crossref","unstructured":"Neal Koblitz, Elliptic curve cryptosystems, Mathematics of Computation 48 (1987), 203\u2013209. ISSN 0025\u20135718. MR 88b:94017. URL: https:\/\/www.ams.org\/journals\/mcom\/1987-48-177\/S0025-5718-1987-0866109-5\/. Citations in this document: \u00a71.1.","DOI":"10.1090\/S0025-5718-1987-0866109-5"},{"key":"7_CR153","doi-asserted-by":"publisher","unstructured":"Neal Koblitz, Alfred Menezes,A riddle wrapped in an enigma, IEEE Security & Privacy 14 (2016), 34\u201342 URL: https:\/\/eprint.iacr.org\/2015\/1018. https:\/\/doi.org\/10.1109\/MSP.2016.120. Citations in this document: \u00a77.1, \u00a77.4, \u00a77.4, \u00a77.5, \u00a77.5, \u00a7\u00a0D.","DOI":"10.1109\/MSP.2016.120"},{"key":"7_CR154","unstructured":"Maurice Kraitchik, Th\u00e9orie des nombres I, Gauthier-Villars, 1922. URL: https:\/\/archive.org\/details\/thoriedesnombres01krai. Citations in this document: \u00a71."},{"key":"7_CR155","unstructured":"Maurice Kraitchik, Th\u00e9orie des nombres II, Gauthier-Villars, 1926. URL: https:\/\/archive.org\/details\/thoriedesnombres02krai. Citations in this document: \u00a71."},{"key":"7_CR156","doi-asserted-by":"crossref","unstructured":"Fabian Kuhn, Rene Struik, Random walks revisited: extensions of Pollard\u2019s rho algorithm for computing multiple discrete logarithms, in [224] (2001), 212\u2013229. URL: https:\/\/www.distcomp.ethz.ch\/publications.html. Citations in this document: \u00a74.2.","DOI":"10.1007\/3-540-45537-X_17"},{"key":"7_CR157","unstructured":"Kaoru Kurosawa (editor), Advances in cryptology\u2014ASIACRYPT 2007, 13th international conference on the theory and application of cryptology and information security, Kuching, Malaysia, December 2\u20136, 2007, proceedings, Lecture Notes in Computer Science, 4833, Springer, 2007. ISBN 978-3-540-76899-9. See [36]."},{"key":"7_CR158","unstructured":"Kwok-Yan Lam, Eiji Okamoto, Chaoping Xing (editors), Advances in cryptology\u2014ASIACRYPT \u201999, international conference on the theory and applications of cryptology and information security, Singapore, November 14\u201318, 1999, proceedings, Lecture Notes in Computer Science, 1716, Springer, 1999. ISBN 3-540-66666-4. See [94]."},{"key":"7_CR159","doi-asserted-by":"publisher","unstructured":"Tanja Lange, Orr Dunkelman (editors), Progress in cryptology\u2014LATINCRYPT 2017\u20145th international conference on cryptology and information security in Latin America, Havana, Cuba, September 20\u201322, 2017, revised selected papers, Lecture Notes in Computer Science, 11368, Springer, 2019. ISBN 978-3-030-25282-3. https:\/\/doi.org\/10.1007\/978-3-030-25283-0. See [106].","DOI":"10.1007\/978-3-030-25283-0"},{"key":"7_CR160","unstructured":"Adam Langley, Andrew Moon, Implementations of a fast elliptic-curve Digital Signature Algorithm (2013). URL: https:\/\/github.com\/floodyberry\/ed25519-donna. Citations in this document: \u00a7\u00a0E.2."},{"key":"7_CR161","doi-asserted-by":"publisher","unstructured":"Kristin E. Lauter, Francisco Rodr\u00edguez-Henr\u00edquez (editors), Progress in cryptology\u2014LATINCRYPT 2015\u20144th international conference on cryptology and information security in Latin America, Guadalajara, Mexico, August 23\u201326, 2015, proceedings, Lecture Notes in Computer Science, 9230, Springer 2015. ISBN 978-3-319-22173-1. https:\/\/doi.org\/10.1007\/978-3-319-22174-8. See [30].","DOI":"10.1007\/978-3-319-22174-8"},{"key":"7_CR162","unstructured":"Hyung Tae Lee, Jung Hee Cheon, Jin Hong, Accelerating ID-based encryption based on trapdoor DL using pre-computation (2011). URL: https:\/\/eprint.iacr.org\/2011\/187. Citations in this document: \u00a74.2."},{"key":"7_CR163","unstructured":"Donald J. Lewis (editor), 1969 Number Theory Institute, Proceedings of Symposia in Pure Mathematics, 20, American Mathematical Society, Providence, Rhode Island, 1971. ISBN 0\u20138218\u20131420\u20136. MR 47:3286. See [217]."},{"key":"7_CR164","doi-asserted-by":"publisher","unstructured":"Jay Ligatti, Xinming Ou, Jonathan Katz, Giovanni Vigna (editors), CCS \u201920: 2020 ACM SIGSAC conference on computer and communications security, virtual event, USA, November 9\u201313, 2020, ACM, 2020. ISBN 978-1-4503-7089-9. https:\/\/doi.org\/10.1145\/3372297. See [13].","DOI":"10.1145\/3372297"},{"key":"7_CR165","doi-asserted-by":"publisher","unstructured":"Chae Hoon Lim, Pil Joong Lee, A key recovery attack on discrete log-based schemes using a prime order subgroup, in Crypto 1997 [149] (1997), 249\u2013263. https:\/\/doi.org\/10.1007\/BFb0052240. Citations in this document: \u00a79.1.","DOI":"10.1007\/BFb0052240"},{"key":"7_CR166","unstructured":"Luigi1111, Riccardo Spagni, Disclosure of a major bug in CryptoNote based currencies (2017). URL: https:\/\/www.getmonero.org\/2017\/05\/17\/disclosure-of-a-major-bug-in-cryptonote-based-currencies.html. Citations in this document: \u00a711.5."},{"key":"7_CR167","unstructured":"Eric M. Mah\u00e9, Jean-Marie Chauvet, Fast GPGPU-based elliptic curve scalar multiplication (2014). URL: https:\/\/eprint.iacr.org\/2014\/198. Citations in this document: \u00a7\u00a0E.2."},{"key":"7_CR168","unstructured":"Stefan Mangard, Fran\u00e7ois-Xavier Standaert (editors), Cryptographic Hardware and Embedded Systems, CHES 2010, 12th international workshop, Santa Barbara, CA, USA, August 17\u201320, 2010, proceedings, Lecture Notes in Computer Science, 6225, Springer, 2010. ISBN 978-3-642-15030-2. See [10]."},{"key":"7_CR169","doi-asserted-by":"publisher","unstructured":"Dimitri Mankowski, Thom Wiggers, Veelasha Moonsamy, TLS$$\\rightarrow $$post-quantum TLS: inspecting the TLS landscape for PQC adoption on Android, in EuroSPW [5] (2023), 526\u2013538. https:\/\/doi.org\/10.1109\/EuroSPW59978.2023.00065. Citations in this document: \u00a79.3.","DOI":"10.1109\/EuroSPW59978.2023.00065"},{"key":"7_CR170","doi-asserted-by":"publisher","unstructured":"Mitsuru Matsui (editor), Advances in cryptology\u2014ASIACRYPT 2009, 15th international conference on the theory and application of cryptology and information security, Tokyo, Japan, December 6\u201310, 2009, proceedings, Lecture Notes in Computer Science, 5912, Springer, 2009. ISBN 978-3-642-10365-0. https:\/\/doi.org\/10.1007\/978-3-642-10366-7. See [74].","DOI":"10.1007\/978-3-642-10366-7"},{"key":"7_CR171","doi-asserted-by":"publisher","unstructured":"Mohamad Ali Mehrabi, Christophe Doche, Low-cost, low-power FPGA implementation of ED25519 and CURVE25519 point multiplication, Inf. 10 (2019), 285. https:\/\/doi.org\/10.3390\/info10090285. Citations in this document: \u00a7\u00a0E.2.","DOI":"10.3390\/info10090285"},{"key":"7_CR172","doi-asserted-by":"publisher","unstructured":"Alfred J. Menezes, Tatsuaki Okamoto, Scott A. Vanstone, Reducing elliptic curve logarithms to a finite field, IEEE Transactions on Information Theory 39 (1993), 1639\u20131646. https:\/\/doi.org\/10.1145\/103418.103434. Citations in this document: \u00a75.1, \u00a7\u00a0A.","DOI":"10.1145\/103418.103434"},{"key":"7_CR173","unstructured":"Microsoft, Windows CryptoAPI spoofing vulnerability (2020). URL: https:\/\/msrc.microsoft.com\/update-guide\/en-US\/advisory\/CVE-2020-0601. Citations in this document: \u00a77.8, \u00a7\u00a0A."},{"key":"7_CR174","doi-asserted-by":"publisher","unstructured":"Victor S. Miller, Use of elliptic curves in cryptography, in Crypto 1985 [229] (1986), 417\u2013426. MR 88b:68040. https:\/\/doi.org\/10.1007\/3-540-39799-X_31. Citations in this document: \u00a71.1, \u00a78.7, \u00a78.7, \u00a711.4.","DOI":"10.1007\/3-540-39799-X_31"},{"key":"7_CR175","unstructured":"MITRE, CVE-2023-46324 (2023). URL: https:\/\/www.cve.org\/CVERecord?id=CVE-2023-46324. Citations in this document: \u00a79."},{"key":"7_CR176","unstructured":"Daniel Moghimi, Berk Sunar, Thomas Eisenbarth, Nadia Heninger, TPM-FAIL: TPM meets timing and lattice attacks, in USENIX Security 2020 [76] (2020), 2057\u20132073. URL: https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/moghimi-tpm. Citations in this document: \u00a710, \u00a7\u00a0A."},{"key":"7_CR177","unstructured":"Peter L. Montgomery, Speeding the Pollard and elliptic curve methods of factorization, Mathematics of Computation 48 (1987), 243\u2013264. ISSN 0025\u20135718. MR 88e:11130. URL: https:\/\/www.ams.org\/journals\/mcom\/1987-48-177\/S0025-5718-1987-0866113-7\/. Citations in this document: \u00a71.3, \u00a73, \u00a78, \u00a78, \u00a78.2."},{"key":"7_CR178","unstructured":"Mozilla Foundation, Security Advisory 2023-56 (2023). URL: https:\/\/www.mozilla.org\/en-US\/security\/advisories\/mfsa2023-56\/. Citations in this document: \u00a710, \u00a7\u00a0A."},{"key":"7_CR179","unstructured":"David Naccache, Pascal Paillier (editors), Public Key Cryptography, 5th international workshop on practice and theory in public key cryptosystems, PKC 2002, Paris, France, February 12\u201314, 2002, proceedings, Lecture Notes in Computer Science, 2274, Springer, 2002. ISBN 3-540-43168-3. See [70]."},{"key":"7_CR180","doi-asserted-by":"publisher","unstructured":"Kaushik Nath, Palash Sarkar, Efficient arithmetic in (pseudo-)Mersenne prime order fields, Adv. Math. Commun. 16 (2022), 303\u2013348. https:\/\/doi.org\/10.3934\/amc.2020113. Citations in this document: \u00a7\u00a0E.2.","DOI":"10.3934\/amc.2020113"},{"key":"7_CR181","doi-asserted-by":"publisher","unstructured":"Kaushik Nath, Palash Sarkar, Security and efficiency trade-offs for elliptic curve Diffie-Hellman at the 128-bit and 224-bit security levels, J. Cryptogr. Eng. 12 (2022), 107\u2013121. https:\/\/doi.org\/10.1007\/s13389-021-00261-y. Citations in this document: \u00a7\u00a0E.2.","DOI":"10.1007\/s13389-021-00261-y"},{"key":"7_CR182","doi-asserted-by":"publisher","unstructured":"Kaushik Nath, Palash Sarkar, Efficient 4-way vectorizations of the Montgomery ladder, IEEE Trans. Computers 71 (2022). 712\u2013723. https:\/\/doi.org\/10.1109\/TC.2021.3060505. Citations in this document: \u00a7\u00a0E.2.","DOI":"10.1109\/TC.2021.3060505"},{"key":"7_CR183","unstructured":"National Institute of Standards and Technology, Request for Comments on FIPS 186-5 and SP 800-186, Federal Register 84 (2019), 58373\u201358375. URL: https:\/\/www.federalregister.gov\/documents\/2019\/10\/31\/2019-23742\/request-for-comments-on-fips-186-5-and-sp-800-186. Citations in this document: \u00a71.4, \u00a71.4, \u00a71.4."},{"key":"7_CR184","unstructured":"National Security Agency, Fact Sheet NSA Suite B Cryptography (2005). URL: https:\/\/web.archive.org\/web\/20051125141648\/https:\/\/www.nsa.gov\/ia\/industry\/crypto_suite_b.cfm. Citations in this document: \u00a71.1."},{"key":"7_CR185","doi-asserted-by":"crossref","unstructured":"Andrew M. Odlyzko (editor), Advances in cryptology\u2014CRYPTO \u201986, Santa Barbara, California, USA, 1986, proceedings, Lecture Notes in Computer Science, 263, Springer, 1987. See [148].","DOI":"10.1007\/3-540-47721-7"},{"key":"7_CR186","doi-asserted-by":"publisher","unstructured":"Kazuo Ohta, Dingyi Pei (editors), Advances in cryptology\u2014ASIACRYPT \u201998, International conference on the theory and applications of cryptology and information security, Beijing, China, October 18\u201322, 1998, proceedings, Lecture Notes in Computer Science, 1514, Springer, 1998. ISBN 3-540-65109-8. https:\/\/doi.org\/10.1007\/3-540-49649-1. See [83], [141].","DOI":"10.1007\/3-540-49649-1"},{"key":"7_CR187","doi-asserted-by":"publisher","unstructured":"Paul C. van Oorschot, Michael Wiener, Parallel collision search with cryptanalytic applications, Journal of Cryptology 12 (1999), 1\u201328. ISSN 0933\u20132790. https:\/\/doi.org\/10.1007\/PL00003816. Citations in this document: \u00a74.4, \u00a74.5.","DOI":"10.1007\/PL00003816"},{"key":"7_CR188","unstructured":"OpenSSL Project, Bignum squaring may produce incorrect results (CVE-2014-3570) (2015). URL: https:\/\/www.openssl.org\/news\/secadv\/20150108.txt. Citations in this document: \u00a7\u00a0A, \u00a7\u00a0A."},{"key":"7_CR189","unstructured":"OpenSSL Project, OpenSSL 3.2.2 (2024). URL: https:\/\/www.openssl.org\/source\/. Citations in this document: \u00a7\u00a0E.1."},{"key":"7_CR190","unstructured":"Elisabeth Oswald, Pankaj Rohatgi (editors), Cryptographic hardware and embedded systems\u2014CHES 2008, 10th International Workshop, Washington, D.C., USA, August 10\u201313, 2008, Proceedings, Lecture Notes in Computer Science, 5154, Springer, 2008. ISBN 978-3-540-85052-6. See [47]."},{"key":"7_CR191","doi-asserted-by":"publisher","unstructured":"Sarvar Patel, Number theoretic attacks on secure password schemes, in S &P 1997 [1] (1997), 236\u2013247. https:\/\/doi.org\/10.1109\/SECPRI.1997.601340. Citations in this document: \u00a711.2.","DOI":"10.1109\/SECPRI.1997.601340"},{"key":"7_CR192","doi-asserted-by":"publisher","unstructured":"Kenneth G. Paterson, Douglas Stebila (editors), Selected areas in cryptography\u2014SAC 2019\u201426th international conference, Waterloo, ON, Canada, August 12\u201316, 2019, revised selected papers, Lecture Notes in Computer Science, 11959, Springer, 2020. ISBN 978-3-030-38470-8. https:\/\/doi.org\/10.1007\/978-3-030-38471-5. See [55].","DOI":"10.1007\/978-3-030-38471-5"},{"key":"7_CR193","doi-asserted-by":"publisher","unstructured":"G\u00fcnther Pernul, Peter Y. A. Ryan, Edgar R. Weippl (editors), Computer security\u2014ESORICS 2015\u201420th European symposium on research in computer security, Vienna, Austria, September 21\u201325, 2015, proceedings, part I, Lecture Notes in Computer Science, 9326, Springer, 2015. ISBN 978-3-319-24173-9. https:\/\/doi.org\/10.1007\/978-3-319-24174-6. See [143].","DOI":"10.1007\/978-3-319-24174-6"},{"key":"7_CR194","doi-asserted-by":"crossref","unstructured":"L\u00e9o Perrin, Partitions in the S-box of Streebog and Kuznyechik, IACR Trans. Symmetric Cryptol. 2019 (2019), 302\u2013329. URL: https:\/\/who.paris.inria.fr\/Leo.Perrin\/pi.html. Citations in this document: \u00a77.","DOI":"10.46586\/tosc.v2019.i1.302-329"},{"key":"7_CR195","doi-asserted-by":"crossref","unstructured":"Christophe Petit, Jean-Jacques Quisquater, On polynomial systems arising from a Weil descent, in Asiacrypt 2012 [225] (2012), 451\u2013466. URL: https:\/\/www.iacr.org\/archive\/ asiacrypt2012\/76580446\/76580446.pdf. Citations in this document: \u00a72.1, \u00a7\u00a0A.","DOI":"10.1007\/978-3-642-34961-4_28"},{"key":"7_CR196","unstructured":"Josef Pieprzyk (editor), Advances in cryptology \u2014 ASIACRYPT 2008, 14th international conference on the theory and application of cryptology and information security, Melbourne, Australia, December 7\u201311, 2008, Lecture Notes in Computer Science, 5350, 2008. ISBN 978-3-540-89254-0. See [130]."},{"key":"7_CR197","doi-asserted-by":"crossref","unstructured":"John M. Pollard, Monte Carlo methods for index computation mod p, Mathematics of Computation 32 (1978), 918\u2013924. URL: https:\/\/www.ams.org\/journals\/mcom\/1978-32-143\/S0025-5718-1978-0491431-9\/. Citations in this document: \u00a74, \u00a74.5, \u00a74.5, \u00a79.1.","DOI":"10.1090\/S0025-5718-1978-0491431-9"},{"key":"7_CR198","doi-asserted-by":"crossref","unstructured":"Bart Preneel (editor), Progress in cryptology\u2014AFRICACRYPT 2009, second international conference on cryptology in Africa, Gammarth, Tunisia, June 21\u201325, 2009, proceedings, Lecture Notes in Computer Science, 5580, Springer, 2009. See [84].","DOI":"10.1007\/978-3-642-02384-2"},{"key":"7_CR199","unstructured":"Bart Preneel (editors), Tsuyoshi Takagi, Cryptographic Hardware and Embedded Systems\u2014CHES 2011\u201413th international workshop, Nara, Japan, September 28\u2013October 1, 2011, proceedings, Lecture Notes in Computer Science, 6917, Springer, 2011. ISBN 978-3-642-23950-2. See [31]."},{"key":"7_CR200","unstructured":"Emmanuel Prouff, Patrick Schaumont (editors), Cryptographic hardware and embedded systems\u2014CHES 2012\u201414th international workshop, Leuven, Belgium, September 9\u201312, 2012, proceedings, Lecture Notes in Computer Science, 7428, Springer, 2012. ISBN 978-3-642-33026-1. See [52]."},{"key":"7_CR201","unstructured":"Red Hat, CVE-2021-3798 (2022). URL: https:\/\/www.cve.org\/CVERecord?id=CVE-2021-3798. Citations in this document: \u00a79, \u00a7\u00a0A, \u00a7\u00a0A."},{"key":"7_CR202","doi-asserted-by":"publisher","unstructured":"Joost Renes, Craig Costello, Lejla Batina, Complete addition formulas for prime order elliptic curves, in Eurocrypt 2016 [99] (2016), 403\u2013428. URL: https:\/\/eprint.iacr.org\/2015\/1060. https:\/\/doi.org\/10.1007\/978-3-662-49890-3_16. Citations in this document: \u00a710.3, \u00a710.3, \u00a710.3, \u00a710.3.","DOI":"10.1007\/978-3-662-49890-3_16"},{"key":"7_CR203","unstructured":"Certicom Research, SEC 2: recommended elliptic curve domain parameters, version 1.0 (2000). URL: https:\/\/www.secg.org\/SEC2-Ver-1.0.pdf. Citations in this document: \u00a71.1, \u00a75, \u00a77.1."},{"key":"7_CR204","doi-asserted-by":"crossref","unstructured":"Ronald L. Rivest, Martin E. Hellman, John C. Anderson, John W. Lyons, Responses to NIST\u2019s proposal, Communications of the ACM 35 (1992), 41\u201354. URL: https:\/\/people.csail.mit.edu\/rivest\/pubs\/RHAL92.pdf. Citations in this document: \u00a71.4.","DOI":"10.1145\/129902.129905"},{"key":"7_CR205","doi-asserted-by":"publisher","unstructured":"Rainer A. Rueppel (editor), Advances in cryptology\u2014EUROCRYPT \u201992, workshop on the theory and application of of cryptographic techniques, Balatonf\u00fcred, Hungary, May 24\u201328, 1992, proceedings, Lecture Notes in Computer Science, 658, Springer, 1993. ISBN 3-540-56413-6. https:\/\/doi.org\/10.1007\/3-540-47555-9. See [127].","DOI":"10.1007\/3-540-47555-9"},{"key":"7_CR206","unstructured":"Peter Y. A. Ryan, David Naccache (editors), Jean-Jacques Quisquater, The New Codebreakers\u2014Essays dedicated to David Kahn on the occasion of his 85th birthday, Lecture Notes in Computer Science, 9100, Springer, 2016. ISBN 978-3-662-49300-7. See [49]."},{"key":"7_CR207","unstructured":"Ahmad-Reza Sadeghi, Virgil D. Gligor (editors), Moti Yung, 2013 ACM SIGSAC conference on computer and communications security, CCS\u201913, Berlin, Germany, November 4\u20138, 2013, ACM, 2013. ISBN 978-1-4503-2477-9. See [34]."},{"key":"7_CR208","unstructured":"Pascal Sasdrich, Tim G\u00fcneysu, Efficient elliptic-curve cryptography using Curve25519 on reconfigurable devices, in ARC 2014 [119] (2014), 25\u201336. URL: https:\/\/citeseerx.ist.psu.edu\/document?repid=rep1&type=pdf &doi=ddbd39a27e4db00813a4c5d2da0e19d6fb50bbcb. Citations in this document: \u00a7\u00a0E.2."},{"key":"7_CR209","unstructured":"Takakzu Satoh, Kiyomichi Araki, Fermat quotients and the polynomial time discrete log algorithm for anomalous elliptic curves, Commentarii Mathematici Universitatis Sancti Pauli 47 (1998), 81\u201392. URL: https:\/\/rikkyo.repo.nii.ac.jp\/records\/9910. Citations in this document: \u00a75.1, \u00a7\u00a0A."},{"key":"7_CR210","doi-asserted-by":"publisher","unstructured":"Stephen Schwab, William K. Robertson, Davide Balzarotti (editors), Proceedings of the 32nd annual conference on computer security applications, ACSAC 2016, Los Angeles, CA, USA, December 5\u20139, 2016, ACM, 2016. ISBN 978-1-4503-4771-6. https:\/\/doi.org\/10.1145\/2991079. See [12].","DOI":"10.1145\/2991079"},{"key":"7_CR211","doi-asserted-by":"publisher","unstructured":"Peter Schwabe, Amber Sprenkels, The complete cost of cofactor$$h=1$$, in INDOCRYPT 2019 [126] (2019), 375\u2013397. URL: https:\/\/eprint.iacr.org\/2019\/1166. https:\/\/doi.org\/10.1007\/978-3-030-35423-7_19. Citations in this document: \u00a710.3.","DOI":"10.1007\/978-3-030-35423-7_19"},{"key":"7_CR212","unstructured":"Michael Scott, Re: NIST annouces set of Elliptic Curves. (1999). URL: https:\/\/groups.google.com\/g\/sci.crypt\/c\/mFMukSsORmI\/m\/FpbHDQ6hM_MJ. Citations in this document: \u00a77.1."},{"key":"7_CR213","doi-asserted-by":"publisher","unstructured":"Igor A. Semaev, On computing logarithms on elliptic curves, Diskretnaya Matematika 8 (1996), 65\u201371, in Russian; see also newer version [214]. https:\/\/doi.org\/10.4213\/dm516.","DOI":"10.4213\/dm516"},{"key":"7_CR214","doi-asserted-by":"publisher","unstructured":"Igor A. Semaev, On computing logarithms on elliptic curves, Discrete Mathematics and Applications 6 (1996), 69\u201376; see also older version [213]. https:\/\/doi.org\/10.1515\/dma.1996.6.1.69. Citations in this document: \u00a75.1, \u00a7\u00a0A.","DOI":"10.1515\/dma.1996.6.1.69"},{"key":"7_CR215","doi-asserted-by":"crossref","unstructured":"Igor A. Semaev, Evaluation of discrete logarithms in a group of p-torsion points of an elliptic curve in characteristic p, Mathematics of Computation 67 (1998), 353\u2013356. URL: https:\/\/www.ams.org\/journals\/mcom\/1998-67-221\/S0025-5718-98-00887-4\/. Citations in this document: \u00a75.1, \u00a7\u00a0A.","DOI":"10.1090\/S0025-5718-98-00887-4"},{"key":"7_CR216","doi-asserted-by":"publisher","unstructured":"Andrew Shallue, Christiaan E. van de Woestijne, Construction of rational points on elliptic curves over finite fields, in ANTS 2006 [129] (2006), 510\u2013524. https:\/\/doi.org\/10.1007\/11792086_36. Citations in this document: \u00a711.4.","DOI":"10.1007\/11792086_36"},{"key":"7_CR217","doi-asserted-by":"crossref","unstructured":"Daniel Shanks, Class number, a theory of factorization, and genera, in [163] (1971), 415\u2013440. MR 47:4932. Citations in this document: \u00a74.5, \u00a74.5.","DOI":"10.1090\/pspum\/020\/0316385"},{"key":"7_CR218","doi-asserted-by":"publisher","unstructured":"Nigel P. Smart, The discrete logarithm problem on elliptic curves of trace one, Journal of Cryptology 12(3) (1999), 193\u2013196. https:\/\/doi.org\/10.1007\/s001459900052. Citations in this document: \u00a75.1, \u00a7\u00a0A.","DOI":"10.1007\/s001459900052"},{"key":"7_CR219","unstructured":"David L. Sobel, New NIST\/NSA Revelations (1993). URL: https:\/\/web.archive.org\/web\/20200229145033\/https:\/\/catless.ncl.ac.uk\/Risks\/14\/59#subj7. Citations in this document: \u00a77."},{"key":"7_CR220","unstructured":"National Institute for Standards and Technology, Digital signature standard, Federal Information Processing Standards Publication 186-2 (2000). URL: https:\/\/csrc.nist.gov\/publications\/fips\/archive\/fips186-2\/fips186-2.pdf. Citations in this document: \u00a71.1, \u00a71.3, \u00a77.1."},{"key":"7_CR221","doi-asserted-by":"publisher","unstructured":"Mathy Vanhoef, Eyal Ronen, Dragonblood: analyzing the Dragonfly handshake of WPA3 and EAP-pwd, in S &P 2020 [3] (2020), 517\u2013533. URL: https:\/\/eprint.iacr.org\/2019\/383. https:\/\/doi.org\/10.1109\/SP40000.2020.00031. Citations in this document: \u00a711.3, \u00a711.3, \u00a711.3, \u00a711.3, \u00a7\u00a0A.","DOI":"10.1109\/SP40000.2020.00031"},{"key":"7_CR222","unstructured":"Vijay Varadharajan, Yi Mu (editors), Information security and privacy, 6th Australasian conference, ACISP 2001, Sydney, Australia, July 11\u201313, 2001, proceedings, Lecture Notes in Computer Science, 2119, Springer, 2001. ISBN 3-540-42300-1. See [64]."},{"key":"7_CR223","doi-asserted-by":"crossref","unstructured":"Serge Vaudenay (editor), Progress in Cryptology\u2014AFRICACRYPT 2008, First international conference on cryptology in Africa, Casablanca, Morocco, June 11\u201314, 2008, proceedings, Lecture Notes in Computer Science, 5023, Springer, 2008. ISBN 978-3-540-68159-5. See [27].","DOI":"10.1007\/978-3-540-68164-9"},{"key":"7_CR224","unstructured":"Serge Vaudenay, Amr M. Youssef (editors), Selected Areas in Cryptography: 8th annual international workshop, SAC 2001, Toronto, Ontario, Canada, August 16\u201317, 2001, revised papers, Lecture Notes in Computer Science, 2259, Springer, 2001. ISBN 3\u2013540\u201343066\u20130. MR 2004k:94066. See [156]."},{"key":"7_CR225","unstructured":"Xiaoyun Wang, Kazue Sako (editors), Advances in cryptology\u2014ASIACRYPT 2012\u201418th international conference on the theory and application of cryptology and information security, Beijing, China, December 2\u20136, 2012, proceedings, Lecture Notes in Computer Science, 7658, Springer, 2012. ISBN 978-3-642-34960-7. See [195]."},{"key":"7_CR226","unstructured":"A.E. Western, Jeffery Charles Percy Miller, Tables of indices and primitive roots (1968). URL: https:\/\/books.google.com\/books?id=amw5wwEACAAJ. Citations in this document: \u00a71."},{"key":"7_CR227","unstructured":"Zack Whittaker, New leaked documents detail secret U.S. intelligence \u2018black budget\u2019 figures (2013). URL: https:\/\/www.zdnet.com\/article\/new-leaked-documents-detail-secret-u-s-intelligence-black-budget-figures\/. Citations in this document: \u00a7\u00a0D.3."},{"key":"7_CR228","unstructured":"Michael J. Wiener, Robert J. Zuccherato, Faster attacks on elliptic curve cryptosystems (1998). URL: https:\/\/grouper.ieee.org\/groups\/1363\/Research\/contributions\/attackEC.ps. Citations in this document: \u00a74.5, \u00a7\u00a0A."},{"key":"7_CR229","doi-asserted-by":"crossref","unstructured":"Hugh C. Williams (editor), Advances in cryptology: CRYPTO \u201985, Lecture Notes in Computer Science, 218, Springer, Berlin, 1986. ISBN 3\u2013540\u201316463\u20134. See [174].","DOI":"10.1007\/3-540-39799-X"},{"key":"7_CR230","doi-asserted-by":"publisher","unstructured":"Guiming Wu, Qianwen He, Jiali Jiang, Zhenxiang Zhang, Xin Long, Yuan Zhao, Yinchao Zou, A high-performance hardware architecture for ECC point multiplication over Curve25519, in FCCM 2022 [4] (2022), 1\u20139. https:\/\/doi.org\/10.1109\/FCCM53951.2022.9786192. Citations in this document: \u00a7\u00a0E.2.","DOI":"10.1109\/FCCM53951.2022.9786192"},{"key":"7_CR231","doi-asserted-by":"crossref","unstructured":"Moti Yung, Yevgeniy Dodis, Aggelos Kiayias, Tal Malkin (editors), Public Key Cryptography\u2014PKC 2006\u20149th international conference on theory and practice in public-key cryptography, New York, NY, USA, April 24\u201326, 2006, proceedings, Lecture Notes in Computer Science, 3958, Springer, 2006. ISBN 978-3-540-33851-2. See [23].","DOI":"10.1007\/11745853"}],"container-title":["Lecture Notes in Computer Science","Information Security in a Connected World"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-83490-5_7","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,3,12]],"date-time":"2025-03-12T06:25:28Z","timestamp":1741760728000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-83490-5_7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"ISBN":["9783031834899","9783031834905"],"references-count":231,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-83490-5_7","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]},"assertion":[{"value":"13 March 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}}]}}