The Gallant-Lambert-Vanstone Decomposition Revisited

Abstract

The Gallant-Lambert-Vanstone method accelerates the computation of scalar multiplication $[k]P$ of a point (or a divisor) $P$ of prime order $r$ on some algebraic curve (or its Jacobian) by using an efficient endomorphism $\phi$ on such curve. Suppose $\phi$ has minimal polynomial $h(x)=\sum _{i=0}^d a_ix^i \in \mathbb {Z}[x]$, the question how to efficiently decompose the scalar $k$ as $[k]P=\sum _{i=0}^{d-1}[k_i]\phi ^i(P)$ with $\max _i \log |k_i| \approx \frac{1}{d}\log r$ has drawn a lot of attention. In this paper we show the link between the lattice based decomposition and the division in $\mathbb {Z}[\phi ]$ decomposition, and propose a hybrid method to decompose $k$ with $\max _i |k_i| \le 2^{(d-5)/4}d (dN(h))^{(d-1)/2}r^{1/d}$, where $N(h)= \sum _{i=0}^{d-1} a_i^2$. In particular, we give explicit and efficient GLV decompositions for some genus $1$ and $2$ curves with efficient endomorphisms through decomposing the Frobenius map in $\mathbb {Z}[\phi ]$, which also indicate that the complex multiplication usually implies good properties for GLV decomposition. Our results well support the GLV method for faster implementations of scalar multiplications on desired curves.