{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,11]],"date-time":"2026-03-11T17:39:40Z","timestamp":1773250780158,"version":"3.50.1"},"reference-count":54,"publisher":"Wiley","issue":"A","license":[{"start":{"date-parts":[[2014,8,1]],"date-time":"2014-08-01T00:00:00Z","timestamp":1406851200000},"content-version":"unspecified","delay-in-days":212,"URL":"https:\/\/www.cambridge.org\/core\/terms"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["LMS J. Comput. Math."],"published-print":{"date-parts":[[2014]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>This paper introduces \u2018hyper-and-elliptic-curve cryptography\u2019, in which a single high-security group supports fast genus-2-hyperelliptic-curve formulas for variable-base-point single-scalar multiplication (for example, Diffie\u2013Hellman shared-secret computation) and at the same time supports fast elliptic-curve formulas for fixed-base-point scalar multiplication (for example, key generation) and multi-scalar multiplication (for example, signature verification).<\/jats:p>","DOI":"10.1112\/s1461157014000394","type":"journal-article","created":{"date-parts":[[2014,8,5]],"date-time":"2014-08-05T10:34:15Z","timestamp":1407234855000},"page":"181-202","source":"Crossref","is-referenced-by-count":18,"title":["Hyper-and-elliptic-curve cryptography"],"prefix":"10.1112","volume":"17","author":[{"given":"Daniel J.","family":"Bernstein","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tanja","family":"Lange","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"311","published-online":{"date-parts":[[2014,8,1]]},"reference":[{"key":"S1461157014000394_r52","doi-asserted-by":"publisher","DOI":"10.1145\/1145768"},{"key":"S1461157014000394_r51","first-page":"281","article-title":"Weil descent attack for Kummer extensions","volume":"18","author":"Th\u00e9riault","year":"2003","journal-title":"J. Ramanujan Math. Soc."},{"key":"S1461157014000394_r50","unstructured":"50. A. V. Sutherland , \u2018Isogeny volcanoes\u2019, in ANTS X [ 32 ], 2013, http:\/\/arxiv.org\/abs\/1208.5370 (citations in this document:\u00a0\u00a7\u00a05)."},{"key":"S1461157014000394_r46","unstructured":"46. M. K. Reiter and P. Samarati (eds), CCS 2001, proceedings of the 8th ACM conference on computer and communications security, Philadelphia, Pennsylvania, USA, November 6\u20138, 2001 (Association for Computing Machinery, 2001) ISBN 1-58113-385-5, see [ 29 ]."},{"key":"S1461157014000394_r40","doi-asserted-by":"crossref","unstructured":"40. V. S. Miller , \u2018Use of elliptic curves in cryptography\u2019, in [ 54 ], 1986, 417\u2013426; MR 88b:68040 (citations in this document:\u00a0\u00a7\u00a01.1).","DOI":"10.1007\/3-540-39799-X_31"},{"key":"S1461157014000394_r38","unstructured":"38. A. Langley , \u2018Protecting data for the long term with forward secrecy\u2019, 2011,http:\/\/googleonlinesecurity.blogspot.nl\/2011\/11\/protecting-data-for-long-term-with.html (citations in this document:\u00a0\u00a7\u00a01)."},{"key":"S1461157014000394_r37","doi-asserted-by":"crossref","DOI":"10.1007\/3-540-44709-1","volume-title":"Cryptographic hardware and embedded systems \u2014 CHES 2001, third international workshop, Paris, France, May 14\u201316, 2001","author":"Ko\u00e7","year":"2001"},{"key":"S1461157014000394_r36","doi-asserted-by":"publisher","DOI":"10.1090\/S0025-5718-1987-0866109-5"},{"key":"S1461157014000394_r33","unstructured":"33. T. Iijima , F. Momose and J. Chao , \u2018Classification of elliptic\/hyperelliptic curves with weak coverings against GHS attack under an isogeny condition\u2019, 2013, http:\/\/eprint.iacr.org\/2013\/487 (citations in this document:\u00a0\u00a7\u00a02)."},{"key":"S1461157014000394_r29","doi-asserted-by":"crossref","unstructured":"29. S. Haber and B. Pinkas , \u2018Securely combining public key cryptosystems\u2019, in CCS 2001 [ 46 ]\u00a02001, 215\u2013224 (citations in this document:\u00a0\u00a7\u00a01.3).","DOI":"10.1145\/501983.502013"},{"key":"S1461157014000394_r28","unstructured":"28. D. Giry , \u2018Cryptographic key length recommendation\u2019, 2014, http:\/\/keylength.com (citations in this document:\u00a0\u00a7\u00a01.1)."},{"key":"S1461157014000394_r26","doi-asserted-by":"publisher","DOI":"10.1007\/s00145-001-0011-x"},{"key":"S1461157014000394_r24","doi-asserted-by":"crossref","unstructured":"24. P. Gaudry , \u2018Variants of the Montgomery form based on theta functions\u2019, 2006, see also newer version\u00a0[ 25 ], http:\/\/www.loria.fr\/\u223cgaudry\/publis\/toronto.pdf (citations in this document:\u00a0\u00a7\u00a01.1).","DOI":"10.1515\/JMC.2007.012"},{"key":"S1461157014000394_r21","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnt.2010.06.003"},{"key":"S1461157014000394_r20","unstructured":"20. E. V. Flynn , \u2018Genus 2 site\u2019, 2007, http:\/\/people.maths.ox.ac.uk\/flynn\/genus2 (citations in this document:\u00a0\u00a7\u00a04.4, \u00a7\u00a04.4)."},{"key":"S1461157014000394_r19","doi-asserted-by":"crossref","unstructured":"19. A. Faz-Hernandez , P. Longa and A. H. Sanchez , \u2018Efficient and secure algorithms for GLV-based scalar multiplication and their implementation on GLV\u2013GLS curves\u2019, 2013, https:\/\/eprint.iacr.org\/2013\/158 (citations in this document:\u00a0\u00a7\u00a01.1).","DOI":"10.1007\/978-3-319-04852-9_1"},{"key":"S1461157014000394_r18","volume-title":"Topics in cryptology, CT-RSA 2012, the cryptographers\u2019 track at the RSA Conference 2012, San Francisco, CA, USA, February 27\u2013March 2, 2012","author":"Dunkelman","year":"2012"},{"key":"S1461157014000394_r17","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.1976.1055638"},{"key":"S1461157014000394_r16","unstructured":"16. C. Diem and J. Scholten , \u2018An attack on a trace-zero cryptosystem\u2019, 2004,http:\/\/www.math.uni-leipzig.de\/\u223cdiem\/preprints\/trace-zero.pdf (citations in this document:\u00a0\u00a7\u00a02)."},{"key":"S1461157014000394_r15","unstructured":"15. C. Diem and J. Scholten , \u2018Cover attacks: a report for the AREHCC project\u2019, 2003,http:\/\/www.math.uni-leipzig.de\/\u223cdiem\/preprints\/cover-attacks.pdf (citations in this document:\u00a0\u00a7\u00a02)."},{"key":"S1461157014000394_r12","doi-asserted-by":"publisher","DOI":"10.1090\/S0025-5718-09-02295-9"},{"key":"S1461157014000394_r8","doi-asserted-by":"publisher","DOI":"10.1006\/jsco.1996.0125"},{"key":"S1461157014000394_r7","doi-asserted-by":"crossref","unstructured":"7. J. W. Bos , C. Costello , H. Hisil and K. Lauter , \u2018High-performance scalar multiplication using 8-dimensional GLV\/GLS decomposition\u2019, in CHES 2013 [ 5 ], 2013, 331\u2013348,\u00a0https:\/\/eprint.iacr.org\/2013\/146 (citations in this document:\u00a0\u00a7\u00a01.1).","DOI":"10.1007\/978-3-642-40349-1_19"},{"key":"S1461157014000394_r6","unstructured":"6. J. W. Bos , C. Costello , H. Hisil and K. Lauter , \u2018Fast cryptography in genus 2\u2019, in Eurocrypt 2013 [ 34 ], 2013, 194\u2013210, https:\/\/eprint.iacr.org\/2012\/670 (citations in this document:\u00a0\u00a7\u00a01.1, \u00a7\u00a01.2, \u00a7\u00a04.1, \u00a7\u00a04.1, \u00a7\u00a04.1, \u00a7\u00a04.4, \u00a7\u00a04.4, \u00a7\u00a04.4, \u00a7\u00a06)."},{"key":"S1461157014000394_r4","unstructured":"4. D. J. Bernstein , C. Chuengsatiansup , T. Lange and P. Schwabe , \u2018Kummer strikes back: new DH speed records\u2019, 2014, https:\/\/eprint.iacr.org\/2014\/134 (citations in this document:\u00a0\u00a7\u00a01.1, \u00a7\u00a01.1, \u00a7\u00a01.1, \u00a7\u00a04.4, \u00a7\u00a06)."},{"key":"S1461157014000394_r3","doi-asserted-by":"crossref","unstructured":"3. D. J. Bernstein , P. Birkner , M. Joye , T. Lange and C. Peters , \u2018Twisted Edwards curves\u2019, in Africacrypt 2008 [ 53 ], 2008, 389\u2013405, https:\/\/eprint.iacr.org\/2008\/013 (citations in this document:\u00a0\u00a7\u00a05).","DOI":"10.1007\/978-3-540-68164-9_26"},{"key":"S1461157014000394_r2","unstructured":"2. S. Arita , K. Matsuo , K. Nagao and M. Shimura , \u2018A Weil descent attack against elliptic curve cryptosystems over quartic extension fields\u2019, 2004, https:\/\/eprint.iacr.org\/2004\/240 (citations in this document:\u00a0\u00a7\u00a02, \u00a7\u00a02, \u00a7\u00a02, \u00a7\u00a03.2)."},{"key":"S1461157014000394_r1","volume-title":"Public-key cryptography and computational number theory, proceedings of the international conference held in Warsaw, September 11\u201315, 2000","author":"Alster","year":"2001"},{"key":"S1461157014000394_r53","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-540-68164-9","volume-title":"Progress in cryptology \u2014 AFRICACRYPT 2008, first international conference on cryptology in Africa, Casablanca, Morocco, June 11\u201314, 2008","author":"Vaudenay","year":"2008"},{"key":"S1461157014000394_r34","volume-title":"Advances in cryptology \u2014 EUROCRYPT 2013, 32nd annual international conference on the theory and applications of cryptographic techniques, Athens, Greece, May 26\u201330, 2013","author":"Johansson","year":"2013"},{"key":"S1461157014000394_r31","unstructured":"31. J. Hoffman-Andrews , \u2018Forward secrecy at Twitter\u2019, 2013,https:\/\/blog.twitter.com\/2013\/forward-secrecy-at-twitter-0 (citations in this document:\u00a0\u00a7\u00a01)."},{"key":"S1461157014000394_r42","doi-asserted-by":"crossref","unstructured":"42. M. B. Monagan and R. Pearce , \u2018Rational simplification modulo a polynomial ideal\u2019, in ISSAC 2006 [ 52 ], 2006, 239\u2013245 (citations in this document:\u00a0\u00a7\u00a03.2).","DOI":"10.1145\/1145768.1145809"},{"key":"S1461157014000394_r49","volume-title":"Sage Mathematics Software (Version 6.1.1)","author":"Stein","year":"2014"},{"key":"S1461157014000394_r54","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-39799-X"},{"key":"S1461157014000394_r5","volume-title":"Cryptographic hardware and embedded systems, CHES 2013, 15th international workshop, Santa Barbara, CA, USA, August 20\u201323, 2013","author":"Bertoni","year":"2013"},{"key":"S1461157014000394_r45","doi-asserted-by":"crossref","unstructured":"45. K. G. Paterson , J. C. N. Schuldt , M. Stam and S. Thomson , \u2018On the joint security of encryption and signature, revisited\u2019, in Asiacrypt 2011 [ 39 ] 2011, 161\u2013178, https:\/\/eprint.iacr.org\/2011\/486 (citations in this document:\u00a0\u00a7\u00a01.3).","DOI":"10.1007\/978-3-642-25385-0_9"},{"key":"S1461157014000394_r27","doi-asserted-by":"publisher","DOI":"10.1016\/j.jsc.2011.09.003"},{"key":"S1461157014000394_r10","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511526084"},{"key":"S1461157014000394_r44","doi-asserted-by":"crossref","unstructured":"44. T. Oliveira , J. L\u00f3pez , D. F. Aranha and F. Rodr\u00edguez-Henr\u00edquez , \u2018Lambda coordinates for binary elliptic curves\u2019, in CHES 2013 [ 5 ], 2013, 311\u2013330, https:\/\/eprint.iacr.org\/2013\/131 (citations in this document:\u00a0\u00a7\u00a01.1).","DOI":"10.1007\/978-3-642-40349-1_18"},{"key":"S1461157014000394_r30","unstructured":"30. H. Hisil , K. K.-H. Wong , G. Carter and E. Dawson , \u2018Faster group operations on elliptic curves\u2019, in AISC 2009 [ 9 ], 2009, 7\u201319, https:\/\/eprint.iacr.org\/2007\/441 (citations in this document:\u00a0\u00a7\u00a03.2)."},{"key":"S1461157014000394_r43","doi-asserted-by":"crossref","unstructured":"43. K. Okeya and K. Sakurai , \u2018Efficient elliptic curve cryptosystems from a scalar multiplication algorithm with recovery of the $\\def \\xmlpi #1{}\\def \\mathsfbi #1{\\boldsymbol {\\mathsf {#1}}}\\let \\le =\\leqslant \\let \\leq =\\leqslant \\let \\ge =\\geqslant \\let \\geq =\\geqslant \\def \\Pr {\\mathit {Pr}}\\def \\Fr {\\mathit {Fr}}\\def \\Rey {\\mathit {Re}}y$ -coordinate on a Montgomery-form elliptic curve\u2019, in CHES 2001 [ 37 ], 2001, 126\u2013141 (citations in this document:\u00a0\u00a7\u00a04.6).","DOI":"10.1007\/3-540-44709-1_12"},{"key":"S1461157014000394_r11","doi-asserted-by":"publisher","DOI":"10.1016\/0196-8858(86)90023-0"},{"key":"S1461157014000394_r22","unstructured":"22. G. Frey , \u2018How to disguise an elliptic curve (Weil descent)\u2019, Presentation at ECC 1998, 1998,http:\/\/www.cacr.math.uwaterloo.ca\/conferences\/1998\/ecc98\/slides.html (citations in this document:\u00a0\u00a7\u00a02)."},{"key":"S1461157014000394_r32","volume-title":"Tenth algorithmic number theory symposium","author":"Howe","year":"2013"},{"key":"S1461157014000394_r41","unstructured":"41. F. Momose and J. Chao , \u2018Scholten forms and elliptic\/hyperelliptic curves with weak Weil restrictions\u2019, 2005, http:\/\/eprint.iacr.org\/2005\/ (citations in this document:\u00a0\u00a7\u00a02)."},{"key":"S1461157014000394_r13","doi-asserted-by":"crossref","unstructured":"13. J. P. Degabriele , A. Lehmann , K. G. Paterson , N. P. Smart and M. Strefler , \u2018On the joint security of encryption and signature in EMV\u2019, in CT-RSA 2012 [ 18 ], 2012, 116\u2013135,http:\/\/www.isg.rhul.ac.uk\/\u223cpsai074\/publications\/EMV_Joint_Sec.pdf (citations in this document:\u00a0\u00a7\u00a01.3).","DOI":"10.1007\/978-3-642-27954-6_8"},{"key":"S1461157014000394_r25","doi-asserted-by":"publisher","DOI":"10.1515\/JMC.2007.012"},{"key":"S1461157014000394_r47","doi-asserted-by":"crossref","unstructured":"47. T. Satoh , \u2018Generating genus two hyperelliptic curves over large characteristic finite fields\u2019, in EUROCRYPT 2009 [ 35 ], 2009, 536\u2013553 (citations in this document:\u00a0\u00a7\u00a02).","DOI":"10.1007\/978-3-642-01001-9_31"},{"key":"S1461157014000394_r48","unstructured":"48. J. Scholten , \u2018Weil restriction of an elliptic curve over a quadratic extension\u2019, 2003,http:\/\/citeseerx.ist.psu.edu\/viewdoc\/download?doi=10.1.1.118.7987&rep=rep1&type=pdf (citations in this document:\u00a0\u00a7\u00a02, \u00a7\u00a02, \u00a7\u00a02, \u00a7\u00a02, \u00a7\u00a02.1, \u00a7\u00a03.1)."},{"key":"S1461157014000394_r9","volume-title":"Seventh Australasian information security conference (AISC 2009), Wellington, New Zealand, Conferences in Research and Practice in Information Technology (CRPIT) 98","author":"Brankovic","year":"2009"},{"key":"S1461157014000394_r23","unstructured":"23. S. D. Galbraith , \u2018Limitations of constructive Weil descent\u2019, in [ 1 ], 2001, 59\u201370; MR 2002m:11052 (citations in this document:\u00a0\u00a7\u00a02, \u00a7\u00a06)."},{"key":"S1461157014000394_r39","volume-title":"Advances in cryptology \u2014 ASIACRYPT 2011, 17th international conference on the theory and application of cryptology and information security, Seoul, South Korea, December 4\u20138, 2011","author":"Lee","year":"2011"},{"key":"S1461157014000394_r14","first-page":"1","article-title":"The GHS attack in odd characteristic","volume":"18","author":"Diem","year":"2003","journal-title":"J. Ramanujan Math. Soc."},{"key":"S1461157014000394_r35","volume-title":"Advances in cryptology \u2014 EUROCRYPT 2009, 28th annual international conference on the theory and applications of cryptographic techniques, Cologne, Germany, April 26\u201330, 2009","author":"Joux","year":"2009"}],"container-title":["LMS Journal of Computation and Mathematics"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.cambridge.org\/core\/services\/aop-cambridge-core\/content\/view\/S1461157014000394","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,7,15]],"date-time":"2023-07-15T18:45:04Z","timestamp":1689446704000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.cambridge.org\/core\/product\/identifier\/S1461157014000394\/type\/journal_article"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014]]},"references-count":54,"journal-issue":{"issue":"A","published-print":{"date-parts":[[2014]]}},"alternative-id":["S1461157014000394"],"URL":"https:\/\/doi.org\/10.1112\/s1461157014000394","relation":{},"ISSN":["1461-1570"],"issn-type":[{"value":"1461-1570","type":"electronic"}],"subject":[],"published":{"date-parts":[[2014]]}}}