Capacity factor

In cryptography, XTR is an algorithm for public-key encryption. XTR stands for ‘ECSTR’, which is an abbreviation for Efficient and Compact Subgroup Trace Representation. It is a method to represent elements of a subgroup of a multiplicative group of a finite field. To do so, it uses the trace over $GF(p^2)$ to represent elements of a subgroup of $GF(p^6{)}^{*}$.

From a security point of view, XTR relies on the difficulty of solving Discrete Logarithm related problems in the full multiplicative group of a finite field. Unlike many cryptographic protocols that are based on the generator of the full multiplicative group of a finite field, XTR uses the generator $g$ of a relatively small subgroup of some prime order $q$ of a subgroup of $GF(p^6{)}^{*}$. With the right choice of $q$, computing Discrete Logarithms in the group, generated by $g$, is, in general, as hard as it is in $GF(p^6{)}^{*}$ and thus cryptographic applications of XTR use $GF(p^2)$ arithmetics while achieving full $GF(p^6)$ security leading to substantial savings both in communication and computational overhead without compromising security. Some other advantages of XTR are its fast key generation, small key sizes and speed.

Fundamentals of XTR

XTR uses a subgroup, commonly referred to as XTR subgroup or just XTR group, of a subgroup called XTR supergroup, of the multiplicative group of a finite field $GF(p^6)$ with $p^6$ elements. The XTR supergroup is of order $p^2-p+1$, where p is a prime such that a sufficiently large prime q divides $p^2-p+1$. The XTR subgroup has now order q and is, as a subgroup of $GF(p^6{)}^{*}$, a cyclic group $⟨g⟩$ with generator g. The following three paragraphs will describe how elements of the XTR supergroup can be represented using an element of $GF(p^2)$ instead of an element of $GF(p^6)$ and how arithmetic operations take place in $GF(p^2)$ instead of in $GF(p^6)$.

Arithmetic operations in $GF(p^2)$

Let p be a prime such that p PROPERTY builders did not have the simplest year, what with the cooling measures imposed in January and the loan curbs in June, but some still managed to do effectively while others made their first foray abroad.

As a public-listed company and a pioneer in the improvement of landed properties in Singapore, we have now been constructing some of Singapore's nicely-recognized, established residential estates for over 50 years. Our many developments in Singapore are an affidavit of our steady want to create not just high quality houses however communities for you and your family members Hotel Properties Limited (HPL) was listed on the Inventory Trade of Singapore in 1982. Beginning with simply the Hilton Lodge in Singapore, HPL has expanded rapidly through the years. As we speak HPL has pursuits in 19 resorts with almost 4000 rooms in 8 countries. An Choice or Settlement/Contract for the Buy of a Home or Flat will be formedin many ways e.g. A gaggle of persons, whether in partnership or otherwise

Certainly one of Asia's premier property firms, Keppel Land is recognised for its sterling portfolio of award-profitable residential developments and funding-grade business properties as well as excessive requirements of company governance and transparency. Keppel Land is without doubt one of the largest listed property corporations by total assets on the Singapore Change. The Group's total assets amounted to about $13.eight billion as at 31 March 2014. Additionally it is a component of a number of stock indices including the FTSE ST Real Property Index, FTSE ST China Prime Index, FTSE All-World Index, FTSE Asia Pacific ex-Japan Index, FTSE EPRA/NAREIT World Real Estate Index and EPRA/NAREIT Index. WOODSVALE PERSONAL CONDOMINIUM CONDOMINIUM WOODSVALE CLOSE, SINGAPORE (DISTRICT thirteen) Industrial

LINCOLN RESIDENCES, THE NON-PUBLIC CONDOMINIUM APARTMENT SURREY STREET, SINGAPORE (DISTRICT eleven) LUCIDA NON-PUBLIC CONDOMINIUM APARTMENT SUFFOLK ROAD, SINGAPORE (DISTRICT 11) LUMOS, THE PRIVATE CONDOMINIUM APARTMENT LEONIE HILL, SINGAPORE (DISTRICT 09) LUXURIE, THE PRIVATE CONDOMINIUM CONDOMINIUM COMPASSVALE BOW, SINGAPORE (DISTRICT 19) M66 NON-PUBLIC CONDOMINIUM RESIDENCE MOONSTONE LANE, SINGAPORE (DISTRICT 12) MARINA BAY SUITES PRIVATE CONDOMINIUM CONDOMINIUM CENTRAL BOULEVARD, SINGAPORE (DISTRICT 01) MEIER SUITES PERSONAL CONDOMINIUM house in singapore MARGATE STREET, SINGAPORE (DISTRICT 15) MKZ, THE NON-PUBLIC CONDOMINIUM CONDO MACKENZIE STREET, SINGAPORE (DISTRICT 09) MONTCLAIR @ WHITLEY CLUSTER STRATA HOUSE WHITLEY HIGHWAY, SINGAPORE (DISTRICT 11) Condominiums by District

The Singapore Property Awards recognise excellence in actual estate development initiatives or individual properties in terms of design, aesthetics, functionality, contribution to the constructed atmosphere and neighborhood at massive. It represents an outstanding achievement which developers, professionals and property house owners aspire to achieve. It bestows upon the winner the correct to use the coveted award emblem recognised extensively throughout the FIABCI network.

ADRIA NON-PUBLIC CONDOMINIUM CONDOMINIUM DERBYSHIRE HIGHWAY, THOMSON ROAD, SINGAPORE (DISTRICT eleven) AMBER RESIDENCES (PREPARED HOUSES) PRIVATE CONDOMINIUM RESIDENCE AMBER STREET, SINGAPORE (DISTRICT 15) ARC AT TAMPINES GOVERNMENT CONDOMINIUM APARTMENT TAMPINES AVENUE 8, SINGAPORE (DISTRICT 18) ARDMORE RESIDENCE NON-PUBLIC CONDOMINIUM CONDO ARDMORE PARK, SINGAPORE (DISTRICT 10) ARISTO @ AMBER , THE PRIVATE CONDOMINIUM CONDOMINIUM AMBER STREET, SINGAPORE (DISTRICT 15) ASPEN LINQ NON-PUBLIC CONDOMINIUM RESIDENCE INSTITUTION HILL, SINGAPORE (DISTRICT 09) BARTLEY RESIDENCES NON-PUBLIC CONDOMINIUM HOUSE BARTLEY HIGHWAY, SINGAPORE (DISTRICT 19) BEACON HEIGHTS PERSONAL CONDOMINIUM CONDO MAR THOMA STREET, SINGAPORE (DISTRCT 12) title searches and authorized requisitions on the property; and

Hongkong Land is a number one property funding, administration and growth group with a serious portfolio in Hong Kong and different property pursuits in Asia. As considered one of Singapore's largest property gamers, Singapore Land (SingLand) is synonymous with premier property developments in both prime and suburban areas. YHS made its first foray into property improvement with Tivoli Gardens, a 59-unit landed estate in District 19. This was adopted by the launch of The Sterling, a freehold condominium in Bukit Timah, and landed projects resembling Tai Keng Villas, Parry Inexperienced, Chuan Villas and Princeton Vale. Its newest growth is JARDIN, an exclusive property nestled alongside Bukit Timah/Dunearn Highway Learn More Can Singapore safely deflate its property market?

GPS Funding Sales operates like an entrepreneur group drawing on wealth of experiences with in depth insight locally and having a global perspective. We are in a position to provide investment methods that tailor-made to the clients profile. Our purchasers starting from Wealth Fund managers, Multinational Companies, Small Medium Enterprise companies, Property Developers and Ultra Networth Individual. En-bloc Sales Department Sustainability, property growth, sustainability initiatives, tripple backside line, measuring sustainability, reporting, metrics and benchmarks When you've loved what you've got read thus far why not sign up for our FREE property alert and online journal PropertyWire Confidential. District 23, ninety nine years Leasehold condominium BUILD TO ALTER 2 mod 3 and p² - p + 1 has a sufficiently large prime factor q. Since p² PROPERTY builders did not have the simplest year, what with the cooling measures imposed in January and the loan curbs in June, but some still managed to do effectively while others made their first foray abroad.

As a public-listed company and a pioneer in the improvement of landed properties in Singapore, we have now been constructing some of Singapore's nicely-recognized, established residential estates for over 50 years. Our many developments in Singapore are an affidavit of our steady want to create not just high quality houses however communities for you and your family members Hotel Properties Limited (HPL) was listed on the Inventory Trade of Singapore in 1982. Beginning with simply the Hilton Lodge in Singapore, HPL has expanded rapidly through the years. As we speak HPL has pursuits in 19 resorts with almost 4000 rooms in 8 countries. An Choice or Settlement/Contract for the Buy of a Home or Flat will be formedin many ways e.g. A gaggle of persons, whether in partnership or otherwise

Certainly one of Asia's premier property firms, Keppel Land is recognised for its sterling portfolio of award-profitable residential developments and funding-grade business properties as well as excessive requirements of company governance and transparency. Keppel Land is without doubt one of the largest listed property corporations by total assets on the Singapore Change. The Group's total assets amounted to about $13.eight billion as at 31 March 2014. Additionally it is a component of a number of stock indices including the FTSE ST Real Property Index, FTSE ST China Prime Index, FTSE All-World Index, FTSE Asia Pacific ex-Japan Index, FTSE EPRA/NAREIT World Real Estate Index and EPRA/NAREIT Index. WOODSVALE PERSONAL CONDOMINIUM CONDOMINIUM WOODSVALE CLOSE, SINGAPORE (DISTRICT thirteen) Industrial

LINCOLN RESIDENCES, THE NON-PUBLIC CONDOMINIUM APARTMENT SURREY STREET, SINGAPORE (DISTRICT eleven) LUCIDA NON-PUBLIC CONDOMINIUM APARTMENT SUFFOLK ROAD, SINGAPORE (DISTRICT 11) LUMOS, THE PRIVATE CONDOMINIUM APARTMENT LEONIE HILL, SINGAPORE (DISTRICT 09) LUXURIE, THE PRIVATE CONDOMINIUM CONDOMINIUM COMPASSVALE BOW, SINGAPORE (DISTRICT 19) M66 NON-PUBLIC CONDOMINIUM RESIDENCE MOONSTONE LANE, SINGAPORE (DISTRICT 12) MARINA BAY SUITES PRIVATE CONDOMINIUM CONDOMINIUM CENTRAL BOULEVARD, SINGAPORE (DISTRICT 01) MEIER SUITES PERSONAL CONDOMINIUM house in singapore MARGATE STREET, SINGAPORE (DISTRICT 15) MKZ, THE NON-PUBLIC CONDOMINIUM CONDO MACKENZIE STREET, SINGAPORE (DISTRICT 09) MONTCLAIR @ WHITLEY CLUSTER STRATA HOUSE WHITLEY HIGHWAY, SINGAPORE (DISTRICT 11) Condominiums by District

The Singapore Property Awards recognise excellence in actual estate development initiatives or individual properties in terms of design, aesthetics, functionality, contribution to the constructed atmosphere and neighborhood at massive. It represents an outstanding achievement which developers, professionals and property house owners aspire to achieve. It bestows upon the winner the correct to use the coveted award emblem recognised extensively throughout the FIABCI network.

ADRIA NON-PUBLIC CONDOMINIUM CONDOMINIUM DERBYSHIRE HIGHWAY, THOMSON ROAD, SINGAPORE (DISTRICT eleven) AMBER RESIDENCES (PREPARED HOUSES) PRIVATE CONDOMINIUM RESIDENCE AMBER STREET, SINGAPORE (DISTRICT 15) ARC AT TAMPINES GOVERNMENT CONDOMINIUM APARTMENT TAMPINES AVENUE 8, SINGAPORE (DISTRICT 18) ARDMORE RESIDENCE NON-PUBLIC CONDOMINIUM CONDO ARDMORE PARK, SINGAPORE (DISTRICT 10) ARISTO @ AMBER , THE PRIVATE CONDOMINIUM CONDOMINIUM AMBER STREET, SINGAPORE (DISTRICT 15) ASPEN LINQ NON-PUBLIC CONDOMINIUM RESIDENCE INSTITUTION HILL, SINGAPORE (DISTRICT 09) BARTLEY RESIDENCES NON-PUBLIC CONDOMINIUM HOUSE BARTLEY HIGHWAY, SINGAPORE (DISTRICT 19) BEACON HEIGHTS PERSONAL CONDOMINIUM CONDO MAR THOMA STREET, SINGAPORE (DISTRCT 12) title searches and authorized requisitions on the property; and

Hongkong Land is a number one property funding, administration and growth group with a serious portfolio in Hong Kong and different property pursuits in Asia. As considered one of Singapore's largest property gamers, Singapore Land (SingLand) is synonymous with premier property developments in both prime and suburban areas. YHS made its first foray into property improvement with Tivoli Gardens, a 59-unit landed estate in District 19. This was adopted by the launch of The Sterling, a freehold condominium in Bukit Timah, and landed projects resembling Tai Keng Villas, Parry Inexperienced, Chuan Villas and Princeton Vale. Its newest growth is JARDIN, an exclusive property nestled alongside Bukit Timah/Dunearn Highway Learn More Can Singapore safely deflate its property market?

GPS Funding Sales operates like an entrepreneur group drawing on wealth of experiences with in depth insight locally and having a global perspective. We are in a position to provide investment methods that tailor-made to the clients profile. Our purchasers starting from Wealth Fund managers, Multinational Companies, Small Medium Enterprise companies, Property Developers and Ultra Networth Individual. En-bloc Sales Department Sustainability, property growth, sustainability initiatives, tripple backside line, measuring sustainability, reporting, metrics and benchmarks When you've loved what you've got read thus far why not sign up for our FREE property alert and online journal PropertyWire Confidential. District 23, ninety nine years Leasehold condominium BUILD TO ALTER 1 mod 3 we see that p generates $(\mathbb{\mathbb{Z}}/3\mathbb{\mathbb{Z}}{)}^{*}$ and thus the third cyclotomic polynomial ${\mathrm{\Phi }}_3(x)=x^2+x+1$ is irreducible over $GF(p)$. It follows that the roots $\alpha$ and ${\alpha }^p$ form an optimal normal basis for $GF(p^2)$ over $GF(p)$ and

$GF(p^2)\cong \{x_1\alpha +x_2{\alpha }^p:x_1,x_2\in GF(p)\}.$

Considering that p PROPERTY builders did not have the simplest year, what with the cooling measures imposed in January and the loan curbs in June, but some still managed to do effectively while others made their first foray abroad.

As a public-listed company and a pioneer in the improvement of landed properties in Singapore, we have now been constructing some of Singapore's nicely-recognized, established residential estates for over 50 years. Our many developments in Singapore are an affidavit of our steady want to create not just high quality houses however communities for you and your family members Hotel Properties Limited (HPL) was listed on the Inventory Trade of Singapore in 1982. Beginning with simply the Hilton Lodge in Singapore, HPL has expanded rapidly through the years. As we speak HPL has pursuits in 19 resorts with almost 4000 rooms in 8 countries. An Choice or Settlement/Contract for the Buy of a Home or Flat will be formedin many ways e.g. A gaggle of persons, whether in partnership or otherwise

Certainly one of Asia's premier property firms, Keppel Land is recognised for its sterling portfolio of award-profitable residential developments and funding-grade business properties as well as excessive requirements of company governance and transparency. Keppel Land is without doubt one of the largest listed property corporations by total assets on the Singapore Change. The Group's total assets amounted to about $13.eight billion as at 31 March 2014. Additionally it is a component of a number of stock indices including the FTSE ST Real Property Index, FTSE ST China Prime Index, FTSE All-World Index, FTSE Asia Pacific ex-Japan Index, FTSE EPRA/NAREIT World Real Estate Index and EPRA/NAREIT Index. WOODSVALE PERSONAL CONDOMINIUM CONDOMINIUM WOODSVALE CLOSE, SINGAPORE (DISTRICT thirteen) Industrial

LINCOLN RESIDENCES, THE NON-PUBLIC CONDOMINIUM APARTMENT SURREY STREET, SINGAPORE (DISTRICT eleven) LUCIDA NON-PUBLIC CONDOMINIUM APARTMENT SUFFOLK ROAD, SINGAPORE (DISTRICT 11) LUMOS, THE PRIVATE CONDOMINIUM APARTMENT LEONIE HILL, SINGAPORE (DISTRICT 09) LUXURIE, THE PRIVATE CONDOMINIUM CONDOMINIUM COMPASSVALE BOW, SINGAPORE (DISTRICT 19) M66 NON-PUBLIC CONDOMINIUM RESIDENCE MOONSTONE LANE, SINGAPORE (DISTRICT 12) MARINA BAY SUITES PRIVATE CONDOMINIUM CONDOMINIUM CENTRAL BOULEVARD, SINGAPORE (DISTRICT 01) MEIER SUITES PERSONAL CONDOMINIUM house in singapore MARGATE STREET, SINGAPORE (DISTRICT 15) MKZ, THE NON-PUBLIC CONDOMINIUM CONDO MACKENZIE STREET, SINGAPORE (DISTRICT 09) MONTCLAIR @ WHITLEY CLUSTER STRATA HOUSE WHITLEY HIGHWAY, SINGAPORE (DISTRICT 11) Condominiums by District

The Singapore Property Awards recognise excellence in actual estate development initiatives or individual properties in terms of design, aesthetics, functionality, contribution to the constructed atmosphere and neighborhood at massive. It represents an outstanding achievement which developers, professionals and property house owners aspire to achieve. It bestows upon the winner the correct to use the coveted award emblem recognised extensively throughout the FIABCI network.

ADRIA NON-PUBLIC CONDOMINIUM CONDOMINIUM DERBYSHIRE HIGHWAY, THOMSON ROAD, SINGAPORE (DISTRICT eleven) AMBER RESIDENCES (PREPARED HOUSES) PRIVATE CONDOMINIUM RESIDENCE AMBER STREET, SINGAPORE (DISTRICT 15) ARC AT TAMPINES GOVERNMENT CONDOMINIUM APARTMENT TAMPINES AVENUE 8, SINGAPORE (DISTRICT 18) ARDMORE RESIDENCE NON-PUBLIC CONDOMINIUM CONDO ARDMORE PARK, SINGAPORE (DISTRICT 10) ARISTO @ AMBER , THE PRIVATE CONDOMINIUM CONDOMINIUM AMBER STREET, SINGAPORE (DISTRICT 15) ASPEN LINQ NON-PUBLIC CONDOMINIUM RESIDENCE INSTITUTION HILL, SINGAPORE (DISTRICT 09) BARTLEY RESIDENCES NON-PUBLIC CONDOMINIUM HOUSE BARTLEY HIGHWAY, SINGAPORE (DISTRICT 19) BEACON HEIGHTS PERSONAL CONDOMINIUM CONDO MAR THOMA STREET, SINGAPORE (DISTRCT 12) title searches and authorized requisitions on the property; and

Hongkong Land is a number one property funding, administration and growth group with a serious portfolio in Hong Kong and different property pursuits in Asia. As considered one of Singapore's largest property gamers, Singapore Land (SingLand) is synonymous with premier property developments in both prime and suburban areas. YHS made its first foray into property improvement with Tivoli Gardens, a 59-unit landed estate in District 19. This was adopted by the launch of The Sterling, a freehold condominium in Bukit Timah, and landed projects resembling Tai Keng Villas, Parry Inexperienced, Chuan Villas and Princeton Vale. Its newest growth is JARDIN, an exclusive property nestled alongside Bukit Timah/Dunearn Highway Learn More Can Singapore safely deflate its property market?

GPS Funding Sales operates like an entrepreneur group drawing on wealth of experiences with in depth insight locally and having a global perspective. We are in a position to provide investment methods that tailor-made to the clients profile. Our purchasers starting from Wealth Fund managers, Multinational Companies, Small Medium Enterprise companies, Property Developers and Ultra Networth Individual. En-bloc Sales Department Sustainability, property growth, sustainability initiatives, tripple backside line, measuring sustainability, reporting, metrics and benchmarks When you've loved what you've got read thus far why not sign up for our FREE property alert and online journal PropertyWire Confidential. District 23, ninety nine years Leasehold condominium BUILD TO ALTER 2 mod 3 we can reduce the exponents modulo 3 to get

$GF(p^2)\cong \{y_1\alpha +y_2{\alpha }^2:{\alpha }^2+\alpha +1=0,y_1,y_2\in GF(p)\}.$

The cost of arithmetic operations is now given in the following Lemma labeled Lemma 2.21 in "An overview of the XTR public key system":

Lemma

• Computing x^p is done without using multiplication
• Computing x² takes two multiplications in $GF(p)$
• Computing xy takes three multiplications in $GF(p)$
• Computing xz-yzp takes four multiplications in $GF(p)$.

Traces over $GF(p^2)$

The trace in XTR is always considered over $GF(p^2)$. In other words, the conjugates of $h\in GF(p^6)$ over $GF(p^2)$ are $h,h^{p^2}$ and $h^{p^4}$ and the trace of $h$ is their sum:

$Tr(h)=h+h^{p^2}+h^{p^4}.$

Note that $Tr(h)\in GF(p^2)$ since

$\begin{array}{ll}Tr(h{)}^{p^2}& =h^{p^2}+h^{p^4}+h^{p^6}\\ & =h+h^{p^2}+h^{p^4}\\ & =Tr(h)\end{array}$

Consider now the generator $g$ of the XTR subgroup of a prime order $q$. Remember that $⟨g⟩$ is a subgroup of the XTR supergroup of order $p^2-p+1$, so $q\mid p^2-p+1$. In the following section we will see how to choose $p$ and $q$, but for now it is sufficient to assume that $q>3$. To compute the trace of $g$ note that modulo $p^2-p+1$ we have

$p^2=p-1$ and

$p^4=(p-1{)}^2=p^2-2p+1=-p$

and thus

$\begin{array}{ll}Tr(g)& =g+g^{p^2}+g^{p^4}\\ & =g+g^{p-1}+g^{-p}.\end{array}$

Note also that the product of the conjugates of $g$ equals $1$, i.e., that $g$ has norm 1.

The crucial observation in XTR is that the minimal polynomial of $g$ over $GF(p^2)$

$(x-g)(x-g^{p-1})(x-g^{-p})$

simplifies to

$x^3-Tr(g)x^2+Tr(g{)}^{p}x-1$

which is fully determined by $Tr(g)$. Consequently, conjugates of $g$, as roots of the minimal polynomial of $g$ over $GF(p^2)$, are completely determined by the trace of $g$. The same is true for any power of $g$: conjugates of $g^n$ are roots of polynomial

$x^3-Tr(g^n)x^2+Tr(g^n{)}^{p}x-1$

and this polynomial is completely determined by $Tr(g^n)$.

The idea behind using traces is to replace $g^n\in GF(p^6)$ in cryptographic protocols, e.g. the Diffie-Hellman key exchange by $Tr(g^n)\in GF(p^2)$ and thus obtaining a factor of 3 reduction in representation size. This is, however, only useful if there is a quick way to obtain $Tr(g^n)$ given $Tr(g)$. The next paragraph gives an algorithm for the efficient computation of $Tr(g^n)$. In addition, computing $Tr(g^n)$ given $Tr(g)$ turns out to be quicker than computing $g^n$ given $g$.

Algorithm for the quick computation of $Tr(g^n)$ given $Tr(g)$

A. Lenstra and E. Verheul give this algorithm in their paper titled The XTR public key system in. All the definitions and lemmas necessary for the algorithm and the algorithm itself presented here, are taken from that paper.

Definition For c in $GF(p^2)$ define

$F(c,X)=X^3-c{X}^2+c^{p}X-1\in GF(p^2)[X].$

Definition Let $h_0,h_1,h_2$ denote the, not necessarily distinct, roots of $F(c,X)$ in $GF(p^6)$ and let $n$ be in $\mathbb{\mathbb{Z}}$. Define

$c_n=h_0^n+h_1^n+h_2^n.$

Properties of $c_n$ and $F(c,X)$

1. $c=c_1$
2. $c_{-n}=c_{np}=c_n^p$
3. $c_n\in GF(p^2)\text{ for }n\in \mathbb{\mathbb{Z}}$
4. $c_{u+v}=c_u{c}_v-c_v^p{c}_{u-v}+c_{u-2v}\text{ for }u,v\in \mathbb{\mathbb{Z}}$
5. Either all $h_j$ have order dividing $p^2-p+1$ and $>3$ or all $h_j$ are in $GF(p^2)$. In particular, $F(c,X)$ is irreducible if and only if its roots have order diving $p^2-p+1$ and $>3$.
6. $F(c,X)$ is reducible over $GF(p^2)$ if and only if $c_{p+1}\in GF(p)$

Lemma Let $c,c_{n-1},c_n,c_{n+1}$ be given.

1. Computing $c_{2n}=c_n^2-2c_n^p$ takes two multiplication in $GF(p)$.
2. Computing $c_{n+2}=c_{n+1}\cdot c-c^p\cdot c_n+c_{n-1}$ takes four multiplication in $GF(p)$.
3. Computing $c_{2n-1}=c_{n-1}\cdot c_n-c^p\cdot c_n^p+c_{n+1}^p$ takes four multiplication in $GF(p)$.
4. Computing $c_{2n+1}=c_{n+1}\cdot c_n-c\cdot c_n^p+c_{n-1}^p$ takes four multiplication in $GF(p)$.

Definition Let $S_n(c)=(c_{n-1},c_n,c_{n+1})\in GF(p^2{)}^3$.

Algorithm 1 for computation of $S_n(c)$ given $n$ and $c$

• If $n<0$ apply this algorithm to $-n$ and $c$, and apply Property 2 to the resulting value.
• If $n=0$, then $S_0(c)=(c^p,3,c)$.
• If $n=1$, then $S_1(c)=(3,c,c^2-2c^p)$.
• If $n=2$, use the computation of $c_{n+2}=c_{n+1}\cdot c-c^p\cdot c_n+c_{n-1}$ and $S_1(c)$ to find $c_3$ and thereby $S_2(c)$.
• If $n>2$, to compute $S_n(c)$ define

${\overline{S}}_i(c)=S_{2i+1}(c)$

and $\overline{m}=n$ if n is odd and $\overline{m}=n-1$ otherwise. Let $\overline{m}=2m+1,k=1$ and compute ${\overline{S}}_k(c)=S_3(c)$ using the Lemma above and $S_2(c)$. Let further

$m=\sum _{j=0}^r{m}_j{2}^j$

with $m_j\in 0,1$ and $m_r=1$. For $j=r-1,r-2,...,0$ in succession, do the following:

• If $m_j=0$, use ${\overline{S}}_k(c)$ to compute ${\overline{S}}_{2k}(c)$.
• If $m_j=1$, use ${\overline{S}}_k(c)$ to compute ${\overline{S}}_{2k+1}(c)$.
• Replace $k$ by $2k+m_j$.

When these iterations finish, $k=m$ and $S_{\overline{m}}(c)={\overline{S}}_m(c)$. If n is even use $S_{\overline{m}}(c)$ to compute ${\overline{S}}_{m+1}(c)$.

Parameter selection

Finite field and subgroup size selection

In order to take advantage of the above described representations of elements with their traces and furthermore ensure sufficient security, that will be discussed below, we need to find primes $p$ and $q$, where $p$ denotes the characteristic of the field $GF(p^6)$ with $p\equiv 2\text{mod}3$ and $q$ is the size of the subgroup, such that $q$ divides $p^2-p+1$.

We denote with $P$ and $Q$ the sizes of $p$ and $q$ in bits. To achieve security comparable to 1024-bit RSA, we should choose $6P$ about 1024, i.e. $P\approx 170$ and $Q$ can be around 160.

A first easy algorithm to compute such primes $p$ and $q$ is the next Algorithm A:

Algorithm A

1. Find $r\in \mathbb{\mathbb{Z}}$ such that $q=r^2-r+1$ is a $Q$-bit prime.
2. Find $k\in \mathbb{\mathbb{Z}}$ such that $p=r+k\cdot q$ is a $P$-bit prime with $p\equiv 2\text{mod}3$.

Correctness of Algorithm A:

It remains to check that $q\mid p^2-p+1$ because all the other necessary properties are obviously satisfied per definition of $p$ and $q$. We easily see that $p^2-p+1=r^2+2rkq+k^2{q}^2-r-kq+1=r^2-r+1+q(2rk+k^{2}q-k)=q(1+2rk+k^{2}q-k)$ which implies that $q\mid p^2-p+1$.

Algorithm A is very fast and can be used to find primes $p$ that satisfy a degree-two polynomial with small coefficients. Such $p$ lead to fast arithmetic operations in $GF(p)$. In particular if the search for $k$ is restricted to $k=1$, which means looking for an $r$ such that both $r^2-r+1\text{ and }{r}^2+1$ are prime and such that $r^2+1\equiv 2\text{ mod }3$, the primes $p$ have this nice form. Note that in this case $r$ must be even and $r\equiv 1\text{ mod }4$.

On the other hand such $p$ may be undesirable from a security point of view because they may make an attack with the Discrete Logarithm variant of the Number Field Sieve easier.

The following Algorithm B doesn't have this disadvantage, but it also doesn't have the fast arithmetic modulo $p$ Algorithm A has in that case.

Algorithm B

1. Select a $Q$-bit prime $q$ so that $q\equiv 7\text{mod}12$.
2. Find the roots $r_1$ and $r_2$ of $X^2-X+1\text{mod}q$.
3. Find a $k\in \mathbb{\mathbb{Z}}$ such that $p=r_i+k\cdot q$ is a $P$-bit prime with $p\equiv 2\text{mod}3$ for $i\in \{1,2\}$

Correctness of Algorithm B:

Since we chose $q\equiv 7\text{mod}12$ it follows immediately that $q\equiv 1\text{mod}3$ (because $7\equiv 1\text{mod}3$ and $3\mid 12$). From that and quadratic reciprocity we can deduce that $r_1$ and $r_2$ exist.

To check that $q\mid p^2-p+1$ we consider again $p^2-p+1$ for $r_i\in \{1,2\}$ and get that $p^2-p+1=r_i^2+2r_{i}kq+k^2{q}^2-r_i-kq+1=r_i^2-r_i+1+q(2rk+k^{2}q-k)=q(2rk+k^{2}q-k)$, since $r_1$ and $r_2$ are roots of $X^2-X+1$ and hence $q\mid p^2-p+1$.

Subgroup selection

In the last paragraph we have chosen the sizes $p$ and $q$ of the finite field $GF(p^6)$ and the multiplicative subgroup of $GF(p^6{)}^{*}$, now we have to find a subgroup $⟨g⟩$ of $GF(p^6{)}^{*}$ for some $g\in GF(p^6)$ such that $\mid ⟨g⟩\mid =q$.

However, we do not need to find an explicit $g\in GF(p^6)$, it suffices to find an element $c\in GF(p^2)$ such that $c=Tr(g)$ for an element $g\in GF(p^6)$ of order $q$. But, given $Tr(g)$, a generator $g$ of the XTR (sub)group can be found by determining any root of $F(Tr(g),X)$ which has been defined above. To find such a $c$ we can take a look at property 5 of $F(c,X)$ here stating that the roots of $F(c,X)$ have an order dividing $p^2-p+1$ if and only if $F(c,X)$ is irreducible. After finding such $c$ we need to check if it really is of order $q$, but first we focus on how to select $c\in GF(p^2)$ such that $F(c,X)$ is irreducible.

An initial approach is to select $c\in GF(p^2)\mathrm{\setminus }GF(p)$ randomly which is justified by the next lemma.

Lemma: For a randomly selected $c\in GF(p^2)$ the probability that $F(c,X)=X^3-c{X}^2+c^{p}X-1\in GF(p^2)[X]$ is irreducible is about one third.

Now the basic algorithm to find a suitable $Tr(g)$ is as follows:

Outline of the algorithm

1. Pick a random $c\in GF(p^2)\mathrm{\setminus }GF(p)$.
2. If $F(c,X)$ is reducible, then return to Step 1.
3. Use Algorithm 1 to compute $d=c_{(p^2-p+1)/q}$.
4. If $d$ is not of order $q$, return to Step 1.
5. Let $Tr(g)=d$.

It turns out that this algorithm indeed computes an element of $GF(p^2)$ that equals $Tr(g)$ for some $g\in GF(p^6)$ of order $q$.

More details to the algorithm, its correctness, runtime and the proof of the Lemma can be found in "An overview of the XTR public key system" in.

Cryptographic schemes

In this section it is explained how the concepts above using traces of elements can be applied to cryptography. In general, XTR can be used in any cryptosystem that relies on the (subgroup) Discrete Logarithm problem. Two important applications of XTR are the Diffie-Hellman key agreement and the ElGamal encryption. We will start first with Diffie-Hellman.

XTR-DH key agreement

We suppose that both Alice and Bob have access to the XTR public key data $(p,q,Tr(g))$ and intend to agree on a shared secret key $K$. They can do this by using the following XTR version of the Diffie-Hellman key exchange:

1. Alice picks $a\in \mathbb{\mathbb{Z}}$ randomly with $1<a<q-2$, computes with Algorithm 1 $S_a(Tr(g))=(Tr(g^{a-1}),Tr(g^a),Tr(g^{a+1}))\in GF(p^2{)}^3$ and sends $Tr(g^a)\in GF(p^2)$ to Bob.
2. Bob receives $Tr(g^a)$ from Alice, selects at random $b\in \mathbb{\mathbb{Z}}$ with $1<b<q-2$, applies Algorithm 1 to compute $S_b(Tr(g))=(Tr(g^{b-1}),Tr(g^b),Tr(g^{b+1}))\in GF(p^2{)}^3$ and sends $Tr(g^b)\in GF(p^2)$ to Alice.
3. Alice receives $Tr(g^b)$ from Bob, computes with Algorithm 1 $S_a(Tr(g^b))=(Tr(g^{(a-1)b}),Tr(g^{ab}),Tr(g^{(a+1)b}))\in GF(p^2{)}^3$ and determines $K$ based on $Tr(g^{ab})\in GF(p^2)$.
4. Bob analogously applies Algorithm 1 to compute $S_b(Tr(g^a))=(Tr(g^{a(b-1)}),Tr(g^{ab}),Tr(g^{a(b+1)}))\in GF(p^2{)}^3$ and also determines $K$ based on $Tr(g^{ab})\in GF(p^2)$.

XTR ElGamal encryption

For the ElGamal encryption we suppose now that Alice is the owner of the XTR public key data $(p,q,Tr(g))$ and that she has selected a secret integer $k$, computed $Tr(g^k)$ and published the result. Given Alice's XTR public key data $(p,q,Tr(g),Tr(g^k))$, Bob can encrypt a message $M$, intended for Alice, using the following XTR version of the ElGamal encryption:

1. Bob selects randomly a $b\in \mathbb{\mathbb{Z}}$ with $1<b<q-2$ and computes with Algorithm 1 $S_b(Tr(g))=(Tr(g^{b-1}),Tr(g^b),Tr(g^{b+1}))\in GF(p^2{)}^3$.
2. Bob next applies Algorithm 1 to compute $S_b(Tr(g^k))=(Tr(g^{(b-1)k}),Tr(g^{bk}),Tr(g^{(b+1)k}))\in GF(p^2{)}^3$.
3. Bob determines a symmetric encryption key $K$ based on $Tr(g^{bk})\in GF(p^2)$.
4. Bob uses an agreed upon symmetric encryption method with key $K$ to encrypt his message $M$, resulting in the encryption $E$.
5. Bob sends $(Tr(g^b),E)$ to Alice.

Upon receipt of $(Tr(g^b),E)$, Alice decrypts the message in the following way:

1. Alice computes $S_k(Tr(g^b))=(Tr(g^{b(k-1)}),Tr(g^{bk}),Tr(g^{b(k+1)}))\in GF(p^2{)}^3$.
2. Alice determines the symmetric key $K$ based on $Tr(g^{bk})\in GF(p^2)$.
3. Alice uses the agreed upon symmetric encryption method with key $K$ to decrypt $E$, resulting in the original message $M$.

The here described encryption scheme is based on a common hybrid version of the ElGamal encryption, where the secret key $K$ is obtained by an asymmetric public key system and then the message is encrypted with a symmetric key encryption method Alice and Bob agreed to.

In the more traditional ElGamal encryption the message is restricted to the key space, which would here be $GF(p^2)$, because $Tr(g)\in GF(p^2)\mathrm{\forall }p\in GF(p^6{)}^{*}$. The encryption in this case is the multiplication of the message with the key, which is an invertible operation in the key space $GF(p^2)$.

Concretely this means if Bob wants to encrypt a message $M{}^{\prime }$, first he has to convert it into an element $M$ of $GF(p^2)$ and then compute the encrypted message $E$ as $E=K\cdot M\in GF(p^2)$. Upon receipt of the encrypted message $E$ Alice can recover the original message $M$ by computing $M=E\cdot K^{-1}$, where $K^{-1}$ is the inverse of $K$ in $GF(p^2)$.

Security

In order to say something about the security properties of the above explained XTR encryption scheme, first it is important to check the security of the XTR group, which means how hard it is to solve the Discrete Logarithm problem there. The next part will then state the equivalency between the Discrete Logarithm problem in the XTR group and the XTR version of the discrete logarithm problem, using only the traces of elements.

Discrete logarithms in a general $GF\left(p^t\right)$

Let now $⟨\gamma ⟩$ be a multiplicative group of order $\omega$. The security of the Diffie-Hellman protocol in $⟨\gamma ⟩$ relies on the Diffie-Hellman (DH) problem of computing ${\gamma }^{xy}\text{ given }\gamma ,{\gamma }^x\text{ and }{\gamma }^y$. We write $DH({\gamma }^x,{\gamma }^y)={\gamma }^{xy}$. There are two other problems related to the DH problem. The first one is the Diffie-Hellman Decision (DHD) problem to determine if $c=DH(a,b)$ for given $a,b,c\in ⟨\gamma ⟩$ and the second one is the Discrete Logarithm (DL) problem to find $x=DL(a)$ for a given $a={\gamma }^x\in ⟨\gamma ⟩\text{ with }0\le x<\omega$.

The DL problem is at least as difficult als the DH problem and it is generally assumed that if the DL problem in $⟨\gamma ⟩$ is intractable, then so are the other two.

Given the prime factorization of $\omega$ the DL problem in $⟨\gamma ⟩$ can be reduced to the DL problem in all subgroups of $⟨\gamma ⟩$ with prime order due to the Pohlig-Hellman algorithm. Hence $\omega$ can safely be assumed to be prime.

For a subgroup $⟨\gamma ⟩$ of prime order $\omega$ of the multiplicative group $GF{\left(p^t\right)}^{*}$ of an extension field $GF(p^t)$ of $GF(p)$ for some $t$, there are now two possible ways to attack the system. One can either focus on the whole multiplicative group or on the subgroup. To attack the multiplicative group the best known method is the Discrete Logarithm variant of the Number Field Sieve or alternatively in the subgroup one can use one of several methods that take $\mathcal{𝒪}(\sqrt{\omega })$ operations in $⟨\gamma ⟩$, such as Pollard's rho method.

For both approaches the difficulty of the DL problem in $⟨\gamma ⟩$ depends on the size of the minimal surrounding subfield of $⟨\gamma ⟩$ and on the size of its prime order $\omega$. If $GF\left(p^t\right)$ itself is the minimal surrounding subfield of $⟨\gamma ⟩$ and $\omega$ is sufficiently large, then the DL problem in $⟨\gamma ⟩$ is as hard as the general DL problem in $GF\left(p^t\right)$.

The XTR parameters are now chosen in such a way that $p$ is not small, $q$ is sufficiently large and $⟨g⟩$ cannot be embedded in a true subfield of $GF(p^6)$, since $q\mid p^2-p+1$ and $p^2-p+1$ is a divisor of $\mid GF(p^6{)}^{*}\mid =p^6-1$, but it does not divide $p^s-1\text{ for }s\in \{1,2,3\}$ and thus $⟨g⟩$ cannot be a subgroup of $GF(p^s{)}^{*}$ for $s\in \{1,2,3\}$. It follows that the DL problem in the XTR group may be assumed as hard as the DL problem in $GF(p^6)$.

Security of XTR

Cryptographic protocols that are based on Discrete Logarithms can use many different types of subgroups like groups of points of elliptic curves or subgroups of the multiplicative group of a finite field like the XTR group. As we have seen above the XTR versions of the Diffie-Hellman and ElGamal encryption protocol replace using elements of the XTR group by using their traces. This means that the security of the XTR versions of these encryption schemes is no longer based on the original DH, DHD or DL problems. Therefore the XTR versions of those problems need to be defined and we will see that they are equivalent (in the sense of the next definition) to the original problems.

Definitions:

• We define the XTR-DH problem as the problem of computing $Tr(g^{xy})$ given $Tr(g^x)$ and $Tr(g^y)$ and we write $XDH(g^x,g^y)=g^{xy}$.
• The XTR-DHD problem is the problem of determining whether $XDH(a,b)=c$ for $a,b,c\in Tr(⟨g⟩)$.
• Given $a\in Tr(⟨g⟩)$, the XTR-DL problem is to find $x=XDL(a)$, i.e. $0\le x<q$ such that $a=Tr(g^x)$.
• We say that problem $\mathcal{𝒜}$ is (a,b)-equivalent to problem $\mathcal{ℬ}$, if any instance of problem $\mathcal{𝒜}$ (or $\mathcal{ℬ}$) can be solved by at most a (or b) calls to an algorithm solving problem $\mathcal{ℬ}$ (or $\mathcal{𝒜}$).

After introducing the XTR versions of these problems the next theorem is an important result telling us the connection between the XTR and the non-XTR problems, which are in fact equivalent. This implies that the XTR representation of elements with their traces is, as can be seen above, faster by a factor of 3 than the usual representation without compromising security.

Theorem The following equivalencies hold:

i. The XTR-DL problem is (1,1)-equivalent to the DL problem in $⟨g⟩$.

ii. The XTR-DH problem is (1,2)-equivalent to the DH problem in $⟨g⟩$.

iii. The XTR-DHD problem is (3,2)-equivalent to the DHD problem in $⟨g⟩$.

This means that an algorithm solving either XTR-DL, XTR-DH or XTR-DHD with non-negligible probability can be transformed into an algorithm solving the corresponding non-XTR problem DL, DH or DHD with non-negligible probability and vice versa. In particular part ii. implies that determining the small XTR-DH key (being an element of $GF(p^2)$) is as hard as determining the whole DH key (being an element of $GF(p^6)$ ) in the representation group $⟨g⟩$.

References

• Template:Cite paper
• Template:Cite paper

43 year old Petroleum Engineer Harry from Deep River, usually spends time with hobbies and interests like renting movies, property developers in singapore new condominium and vehicle racing. Constantly enjoys going to destinations like Camino Real de Tierra Adentro.