Fault attacks on hyperelliptic curve discrete logarithm problem over binary field

In this paper, we present invalid-curve attacks that apply to the hyperelliptic curve scalar multi- plication （HECSM） algorithm proposed by Avanzi et al. on the genus 2 hyperelliptic curve over binary field. We observe some new properties of the HECSM. Our attacks are based on these new properties and the obser- vation that the parameters f0 and fl of the hyperelliptic curve equation are not utilized for the HECSM. We show that with different ＂values＂ for curve parameters f0, fl, there exsit cryptographically weak groups in the Koblitz hyperelliptic curve. Also, we compute the theoretical probability of getting a weak Jacobian group of hyperelliptic curve whose cardinality is an smooth integer.