Trace zero cryptography
In 1998 Gerhard Frey firstly proposed using trace zero varieties for cryptographic purpose. These varieties are subgroups of the divisor class group on a low genus hyperelliptic curve defined over a finite field. These groups can be used to establish asymmetric cryptography using the discrete logarithm problem as cryptographic primitive. Trace zero varieties feature a better scalar multiplication performance than elliptic curves. This allows fast arithmetic in these groups, which can speed up the calculations with a factor 3 compared with elliptic curves and hence speed up the cryptosystem. Another advantage is that for groups of cryptographically  relevant size, the order of the group can simply be calculated using the characteristic polynomial of the Frobenius endomorphism. This is not the case, for example, in elliptic curve cryptography when the group of points of an elliptic curve over a prime field is used for cryptographic purpose. However to represent an element of the trace zero variety more bits are needed compared with elements of elliptic or hyperelliptic curves. Another disadvantage, is the fact, that it is possible to reduce the security of the TZV of / of the bit length using cover attack. Mathematical background. A hyperelliptic curve "C  of genus g" over a prime field formula_1 where "q" = "p" ("p" prime) of odd characteristic is defined as where "f" monic, deg("f") = 2"g" + 1 and deg("h") ≤ g. The curve has at least one formula_1-rational Weierstraßpoint. The Jacobian variety formula_4 of "C" is for all finite extension formula_5 isomorphic to the ideal class group formula_6. With the "Mumford's representation" it is possible to represent the elements of formula_4 with a pair of polynomials "[u, v]", where "u", "v" ∈ formula_8. The "Frobenius endomorphism" σ is used on an element "[u, v]" of formula_4 to  raise the power of each coefficient of that element to "q": σ("[u, v]") = ["u"(x), v(x)]. The characteristic polynomial of this endomorphism has the following form: where a in ℤ With the "Hasse–Weil theorem" it is possible to receive the group order of any extension field formula_5 by using the complex roots τ of χ("T"): Let "D" be an element of the formula_4 of "C", then it is possible to define an endomorphism of formula_4, the so-called "trace of D": Based on this endomorphism one can reduce the Jacobian variety to a subgroup "G" with the property, that  every element is of trace zero: "G" is the kernel of the trace endomorphism and thus "G" is a group, the so-called trace zero (sub)variety (TZV) of formula_4. The intersection of "G" and formula_18 is produced by the "n"-torsion elements of formula_18. If the greatest common divisor formula_20 the intersection is empty and one can compute the group order of "G": The actual group used in cryptographic applications is a subgroup "G" of "G" of a large prime order "l". This group may be "G" itself. There exist three different cases of cryptographical relevance for TZV: Arithmetic. The arithmetic  used in the TZV group "G" based on the arithmetic for the whole group formula_4, But it is possible to use the "Frobenius endomorphism" σ to speed up the scalar multiplication. This can be archived if "G" is generated by "D" of order "l" then "σ(D) = sD", for some integers "s". For the given cases of TZV "s" can be computed as follows, where "a" come from the characteristic polynomial of the Frobenius endomorphism : Knowing this, it is possible to replace any scalar multiplication "mD (|m| ≤ l/2)" with: With this trick the multiple scalar product can be reduced  to about 1/("n" − 1) of doublings necessary for calculating "mD", if the implied constants are small enough. Security. The security of cryptographic systems based on trace zero subvarieties according to the results of the papers comparable to the security of hyper-elliptic curves of low genus "g' " over formula_27, where "p' " ~ ("n" − 1)("g/g' ") for "|G|" ~128 bits. For the cases where "n" = 3, "g" = 2 and "n" = 5, "g" = 1 it is possible to reduce the security for at most 6 bits, where "|G|" ~ 2, because one can not be sure  that "G" is contained in a Jacobian of a curve of genus 6. The security of curves of genus 4 for similar fields are far less secure. Cover attack on a trace zero crypto-system. The attack published in shows, that the DLP in trace zero groups of genus 2 over finite fields of characteristic diverse than 2 or 3 and a field extension of degree 3 can be transformed into a DLP in a class group of degree 0 with genus of at most 6 over the base field. In this new class group the DLP can be attacked  with the index calculus methods. This leads to a reduction of the bit length /.