Extending the GLS endomorphism to speed up GHS Weil descent using Magma
Let q = 2^n, and let E / đ˝_q^â be a generalized GalbraithâLinâScott (GLS) binary curve, with â⼠2 and (â, n) = 1.We show that the GLS endomorphism on E / đ˝_q^â induces an efficient endomorphism on the Jacobian J_H(đ˝_q) of the genus-g hyperelliptic curve H corresponding to the image of the GHS Weil-descent attack applied to E/đ˝_q^â, and that this endomorphism yields a factor-n speedup when using standard index-calculus procedures for solving the Discrete Logarithm Problem (DLP) on J_H(đ˝_q). Our analysis is backed up by the explicit computation of a discrete logarithm defined on a prime-order subgroup of a GLS elliptic curve over the field đ˝_2^5¡ 31. A Magma implementation of our algorithm finds the aforementioned discrete logarithm in about 1,035 CPU-days.
READ FULL TEXT