{"entities":{"Q2499265":{"pageid":2510008,"ns":120,"title":"Item:Q2499265","lastrevid":49892263,"modified":"2026-01-11T17:15:35Z","type":"item","id":"Q2499265","labels":{"en":{"language":"en","value":"An elliptic curve trapdoor system"}},"descriptions":{"en":{"language":"en","value":"scientific article; zbMATH DE number 5045612"}},"aliases":{},"claims":{"P31":[{"mainsnak":{"snaktype":"value","property":"P31","hash":"fd5912e4dab4b881a8eb0eb27e7893fef55176ad","datavalue":{"value":{"entity-type":"item","numeric-id":56887,"id":"Q56887"},"type":"wikibase-entityid"},"datatype":"wikibase-item"},"type":"statement","id":"Q2499265$9DDC3C54-4B31-4C5A-B2DE-57DAB71C7480","rank":"normal"}],"P159":[{"mainsnak":{"snaktype":"value","property":"P159","hash":"15764894efd5f553f14c06829a610e9c19526d1e","datavalue":{"value":{"text":"An elliptic curve trapdoor system","language":"en"},"type":"monolingualtext"},"datatype":"monolingualtext"},"type":"statement","id":"Q2499265$73BECA0B-D545-451E-A45D-D35AF104D94C","rank":"normal"}],"P225":[{"mainsnak":{"snaktype":"value","property":"P225","hash":"d4ffc7691f61982a40e8732d703c2b3134f2e9bd","datavalue":{"value":"1099.14012","type":"string"},"datatype":"external-id"},"type":"statement","id":"Q2499265$2255B232-6B47-4657-AA23-44028A14BC94","rank":"normal"}],"P16":[{"mainsnak":{"snaktype":"value","property":"P16","hash":"ce248613f92a3e6b8e8d637fc8e54f4491fc3d92","datavalue":{"value":{"entity-type":"item","numeric-id":1300625,"id":"Q1300625"},"type":"wikibase-entityid"},"datatype":"wikibase-item"},"type":"statement","id":"Q2499265$2BCC96C8-777D-4363-9BB1-0EAE303675B1","rank":"normal"}],"P200":[{"mainsnak":{"snaktype":"value","property":"P200","hash":"d5eab3bbb3b6673353b9ed770934b15d004ef795","datavalue":{"value":{"entity-type":"item","numeric-id":166358,"id":"Q166358"},"type":"wikibase-entityid"},"datatype":"wikibase-item"},"type":"statement","id":"Q2499265$FEAF34FC-DD21-4C13-A50B-0A5ACD60E3F2","rank":"normal"}],"P28":[{"mainsnak":{"snaktype":"value","property":"P28","hash":"2d16893a2881e21dd54b3d85e13a15572e7a543f","datavalue":{"value":{"time":"+2006-08-14T00:00:00Z","timezone":0,"before":0,"after":0,"precision":11,"calendarmodel":"http://www.wikidata.org/entity/Q1985727"},"type":"time"},"datatype":"time"},"type":"statement","id":"Q2499265$A873D702-F82E-452D-A4FE-156985E09343","rank":"normal"}],"P1448":[{"mainsnak":{"snaktype":"value","property":"P1448","hash":"5b45169dc447d2e442af1fb3bc6343f8cdb019b3","datavalue":{"value":"The paper proposes a trapdoor system based on a pair \\((E_s, E_{pb})\\)\\, of isogenous elliptic curves defined over the field \\(\\mathbb F_{2^{161}}\\),\\, which can be useful in cryptographic key escrow applications (allowing wire tapping under legal authorization). The pair \\((E_s, E_{pb})\\)\\, is defined as follows: The (secret) curve \\(E_s\\)\\, is a cryptographically interesting elliptic curve over \\(\\mathbb F_{2^{161}}= \\mathbb F_{{(2^{23})}^7} \\),\\, such that the GHS Weil attack [see \\textit{P. Gaudry, F. Hess}, and \\textit{N. P. Smart}, J. Crypto. 15, 19--46 (2002; Zbl 0996.94036)] produces a hyperelliptic curve over \\(\\mathbb F_{2^{23}}\\)\\, of genus 7 (i.e. \\(m=4\\), and \\(g=2^{m-1}-1\\), where \\(m\\)\\, is the magic number for \\(E\\)). This only happens for a small fraction of all elliptic curves over \\(\\mathbb F_{2^{161}}\\). For technical reasons \\(E_s\\) is also chosen with square free discriminant D (then for any elliptic curve \\(E\\),\\, isogenous to \\(E_s\\), the ring End\\((E)\\)\\, is the maximal order of \\(Q(\\sqrt D)\\), and for any prime \\(l\\) the volcano of \\(l\\)-isogenies of \\(E\\) reduces to the crater, see \\textit{D. Kohel} [PhD. Thesis, U. of California (1996)]). The curve \\(E_{pb}\\)\\, is isogenous to \\(E_s\\)\\, (selected by a pseudo-random walk in the isogeny class of \\(E_s\\)) but with \\(m=7\\). \\(E_{pb}\\) is public and can be used for implementation of the elliptic curve discrete logarithm problem (ECDLP) while \\(E_s\\)\\, is kept by a trusted authority. The GHS attack allows to reduce the ECDLP over \\(E_s\\)\\, to a HCDLP over a hyperelliptic curve of genus 7, problem feasible using the \\textit{A. Enge, P. Gaudry} index calculus method [Acta Arith. 102, 83--103 (2002; Zbl 1028.11079)], but not trivial: in the author's words \\` \\` can be solved in an estimated 25.000 days on a 1 GHz workstation''. This way the authority, knowing \\(E_s\\)\\, and perhaps the isogeny relating \\(E_s\\) and \\(E_{pb}\\)\\, can, if necessary, solve any instance of ECDLP over \\(E_{pb}\\), but \\` \\` has to invest a considerable amount of computation, which make applications such as widespread wire-tapping impossible''. The first two sections of the paper are introductory. Section 3 studies the behavior of the magic number \\(m\\) under isogenies. Details of the construction of the trapdoor system are given in section 4, its security is analyzed in section 5 and its efficiency in section 6. Section 7 studies other (binary) finite fields which can also be used for a similar trapdoor: Table 3 list all finite fields \\(\\mathbb F_{2^N},\\, (150