The HECTOR BAT

We use the hyperelliptic curve C : y + xy = x + tx + x + t over the field F2[t]/(t 113 + t + 1) which was generated by Wouter Castryck, Katholieke Universiteit Leuven, Belgium. The choice of the finite field takes into account three aspects: Firstly, it allows for an order of the divisor class group of appropriate size for the desired security level. Secondly, the extension degree of F2 was chosen to be prime to make a Weil descent attack impossible. We point out that we explicitly avoid Mersenne and Fermat primes as extension degrees here. When performing the Weil descent using those primes, the transfer can lead to a probably easier problem, for instance when the genus of curve in the Weil restriction is minimal. A Mersenne prime is a prime number of the form 2−1. In the cryptographically important range the Mersenne primes are 3, 7, 31 and 127. A Fermat prime is a prime number of the form 2 n + 1. In the cryptographically important range 3, 5, 17 and 257 are Fermat primes. For more details on this see page 533 in [1] and [5]. As a third aspect we considered the unused bits when representing field elements as arrays of long integers, on both, 32 and 64 bit architectures this number is 15. As for the choice of the hyperelliptic curve we have chosen a genus two curve of 2-rank one. The 2-rank of a genus two curve can be 0, 1 or 2. The 2-rank equals the degree of h and since we are in the genus two case, we have 0 ≤ deg(h) ≤ 2. We a priori exclude curves of 2-rank zero since they are supersingular as the polynomial h is constant. Supersingular curves are weak under the Frey-Rück attack [2]. We prefer curves of 2-rank one over those of 2-rank two because there exist faster arithmetic in the divisor class group, more precisely the addition and doubling of divisor classes takes less operations in the underlying field. For explicit formulas see Section 14.5 in [1] and [4].