Montgomery Ladder for All Genus 2 Curves in Characteristic 2

  • Sylvain Duquesne
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5130)


Using the Kummer surface, we generalize Montgomery ladder for scalar multiplication to the Jacobian of genus 2 curves in characteristic 2. Previously this method was known for elliptic curves and for genus 2 curves in odd characteristic. We obtain an algorithm that is competitive compared to usual methods of scalar multiplication and that has additional properties such as resistance to simple side-channel attacks. Moreover it provides a significant speed-up of scalar multiplication in many cases. This new algorithm has very important applications in cryptography using hyperelliptic curves and more particularly for people interested in cryptography on embedded systems (such as smart cards).


Hyperelliptic curves Characteristic 2 Kummer surface Cryptography Scalar multiplication 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Brier, E., Joye, M.: Weierstrass Elliptic Curves and Side-Channel Attacks. In: Naccache, D., Paillier, P. (eds.) PKC 2002. LNCS, vol. 2274. Springer, Heidelberg (2002)CrossRefGoogle Scholar
  2. 2.
    Byramjee, B., Duquesne, S.: Classification of genus 2 curves over \(\mathbb{F}_{2^n}\) and optimization of their arithmetic. Cryptology ePrint Archive 107 (2004)Google Scholar
  3. 3.
    Cantor, D.G.: Computing on the Jacobian of a hyperelliptic curve. Math. Comp. 48, 95–101 (1987)zbMATHCrossRefMathSciNetGoogle Scholar
  4. 4.
    Choie, Y., Yun, D.: Isomorphism classes of hyperelliptic curves of genus 2 over Open image in new window. In: Batten, L.M., Seberry, J. (eds.) ACISP 2002. LNCS, vol. 2384, pp. 190–202. Springer, Heidelberg (2002)CrossRefGoogle Scholar
  5. 5.
    Cohen, H., Frey, G.: Handbook of elliptic and hyperelliptic curve cryptography, Discrete Math. Appl. Chapman & Hall/CRC, Boca Raton (2006)Google Scholar
  6. 6.
    Duquesne, S.: Montgomery scalar multiplication for genus 2 curves. In: Buell, D.A. (ed.) ANTS 2004. LNCS, vol. 3076, pp. 153–168. Springer, Heidelberg (2004)Google Scholar
  7. 7.
    Duquesne, S.: Traces of the group law on the Kummer surface of a curve of genus 2 in characteristic 2, preprint, available at [8]Google Scholar
  8. 8.
    Duquesne, S.: Formulas for traces of the group law on the Kummer surface of a curve of genus 2 in characteristic 2,
  9. 9.
    Flynn, E.V.: The group law on the Jacobian of a curve of genus 2. J. reine angew. Math. 439, 45–69 (1993)zbMATHMathSciNetGoogle Scholar
  10. 10.
    Galbraith, S.: Supersingular curves in cryptography. In: Boyd, C. (ed.) ASIACRYPT 2001. LNCS, vol. 2248, pp. 495–513. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  11. 11.
    Gaudry, P., Hess, F., Smart, N.: Constructive and destructive facets of Weil descent on elliptic curves. J. Cryptology 15(1), 19–46 (2002)CrossRefMathSciNetGoogle Scholar
  12. 12.
    Gaudry, P.: Fast genus 2 arithmetic based on Theta functions. Journal of Mathematical Cryptology 1, 243–265 (2007)zbMATHCrossRefMathSciNetGoogle Scholar
  13. 13.
    Gaudry, P.: Variants of the Montgomery form based on Theta functions, Toronto (November 2006)Google Scholar
  14. 14.
    Gaudry, P., Lubicz, D.: The arithmetic of characteristic 2 Kummer surfaces. Cryptology ePrint Archive 133 (2008)Google Scholar
  15. 15.
    Harley, R.: Fast arithmetic on genus 2 curves (2000),
  16. 16.
    Imbert, L., Peirera, A., Tisserand, A.: A Library for Prototyping the Computer Arithmetic Level in Elliptic Curve Cryptography. In: Proc. SPIE, vol. 6697, 66970N (2007) Google Scholar
  17. 17.
    Koblitz, N.: Elliptic curve cryptosystems. Math. Comp. 48, 203–209 (1987)zbMATHCrossRefMathSciNetGoogle Scholar
  18. 18.
    Kocher, P.C.: Timing attacks on implementations of DH, RSA, DSS and other systems. In: Koblitz, N. (ed.) CRYPTO 1996. LNCS, vol. 1109, pp. 104–113. Springer, Heidelberg (1996)Google Scholar
  19. 19.
    Kocher, P.C., Jaffe, J., Jun, B.: Differential power analysis. In: Wiener, M.J. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 388–397. Springer, Heidelberg (1999)Google Scholar
  20. 20.
    Lange, T.: Arithmetic on binary genus 2 curves suitable for small devices. In: Proceedings ECRYPT Workshop on RFID and Lightweight Crypto., Graz, Austria, July 14-15 (2005)Google Scholar
  21. 21.
    Lange, T.: Formulae for arithmetic on genus 2 hyperelliptic curves. Appl. Algebra Engrg. Comm. Comput. 15(5), 295–328 (2005)zbMATHCrossRefMathSciNetGoogle Scholar
  22. 22.
    Lange, T., Mishra, P.K.: SCA resistant parallel explicit formula for addition and doubling of divisors in the Jacobian of hyperelliptic curves of genus 2. In: Maitra, S., Veni Madhavan, C.E., Venkatesan, R. (eds.) INDOCRYPT 2005. LNCS, vol. 3797, pp. 403–416. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  23. 23.
    Lopez, J., Dahab, R.: Improved algorithms for elliptic curve arithmetic in GF(2n). In: Tavares, S., Meijer, H. (eds.) SAC 1998. LNCS, vol. 1556, pp. 201–212. Springer, Heidelberg (1999)CrossRefGoogle Scholar
  24. 24.
    Lopez, J., Dahab, R.: Fast multiplication on elliptic curves over GF(2m) without precomputation. In: Koç, Ç.K., Paar, C. (eds.) CHES 1999. LNCS, vol. 1717, pp. 316–327. Springer, Heidelberg (1999)CrossRefGoogle Scholar
  25. 25.
    Menezes, A., Wu, Y.H., Zuccherato, R.: An elementary introduction to hyperelliptic curves. In: Koblitz, N. (ed.) Algebraic aspects of cryptography. Algorithms and Computation in Mathematics, vol. 3, pp. 155–178 (1998)Google Scholar
  26. 26.
    Miller, V.S.: Use of elliptic curves in cryptography. In: Williams, H.C. (ed.) CRYPTO 1985. LNCS, vol. 218, pp. 417–426. Springer, Heidelberg (1986)Google Scholar
  27. 27.
    Montgomery, P.L.: Speeding the Pollard and elliptic curve methods of factorization. Math. Comp. 48, 164–243 (1987)CrossRefGoogle Scholar
  28. 28.
    Mumford, D.: Tata lectures on Theta II. Birkhäuser, Basel (1984)zbMATHGoogle Scholar
  29. 29.
    Okeya, O., Sakurai, K.: Efficient Elliptic Curve Cryptosystems from a Scalar Multiplication Algorithm with Recovery of the y-Coordinate on a Montgomery-Form Elliptic Curve. In: Koç, Ç.K., Naccache, D., Paar, C. (eds.) CHES 2001. LNCS, vol. 2162, pp. 126–141. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  30. 30.
    Quisquater, J.J., Samyde, D.: ElectroMagnetic Analysis (EMA): Measures and Countermeasures for Smart Cards. In: Attali, S., Jensen, T. (eds.) E-smart 2001. LNCS, vol. 2140, pp. 200–210. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  31. 31.
    Smart, N., Siksek, S.: A fast Diffe-Hellman protocol in genus 2. Journal of Cryptology 12, 67–73 (1999)zbMATHCrossRefMathSciNetGoogle Scholar
  32. 32.
    Stam, M.: On Montgomery-Like Representations for Elliptic Curves over GF(2k). In: Desmedt, Y.G. (ed.) PKC 2003. LNCS, vol. 2567, pp. 240–253. Springer, Heidelberg (2002)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2008

Authors and Affiliations

  • Sylvain Duquesne
    • 1
  1. 1.Laboratoires I3M, UMR CNRS 5149 and LIRMM, UMR CNRS 5506Université Montpellier IIMontpellier CedexFrance

Personalised recommendations