Key improvements to XTR

In [\textit{A. E. Brouwer}, \textit{R. Pellikaan} and \textit{E. R. Verheul}, Doing more with fewer bits, Proceedings Asiacrypt99, Lect. Notes Comput. Sci. 1716, 321-332 (1999; Zbl 0977.94025)] it was shown that conjugates of elements of a subgroup of \(GF(p^6)^*\) of order dividing \(\varphi_6 (p)=p^2- p+1\) can be represented using \(2\log_2(p)\) bits, as opposed to the \(6 \log_2(p)\) bits that would be required for their traditional representation. In [\textit{A. K. Lenstra} and \textit{E. R. Verheul}, The XTR public key system, Proceeding Crypto 2000, Lect. Notes Comput. Sci. 1880, 1-19 (2000)] an improved version of the method was introduced that achieves the same communication advantage at a much lower computational cost. The resulting representation method is referred to as XTR, which stands for efficient and compact subgroup trace representation. This paper describes improved methods for XTR key representation and parameter generation. If the field characteristic is properly chosen, the size of the XTR public key for signature applications can be reduced by a factor of three at the cost of a small one time computation for the recipient of the key. Furthermore, the parameter set-up for an XTR system can be simplified because the trace of a proper subgroup generator can, with very high probability, be computed directly, thus avoiding the probabilistic approach from the authors' earlier paper (loc. cit.). These non-trivial extensions further enhance the practical potential of XTR. For the entire collection see [Zbl 0952.00064].

Recommendations

Cited in

(17)

This page was built for publication: Key improvements to XTR

Report a bug (only for logged in users!)Click here to report a bug for this page (MaRDI item Q2707417)