10:00 - 10:30 | Registration |

10:30 - 10:40 | Opening Remarks |

10:40 - 12:10 | ECC Autumn School I (Coordinator: Akinori Kawachi) |

10:40 - 12:10 | Mehdi Tibouchi(NTT Corporation): Classical Attacks on Elliptic Curve Cryptosystems: An Overview
Abstract: This lecture will provide a short survey of various attacks proposed over the years against elliptic curve-based cryptosystems and pairing-based schemes. Some of those attacks target weak families of elliptic curves, others improperly chosen parameters, and others yet implementations that fail to perform necessary consistency checks. |

12:10 - 13:10 | Lunch |

13:10 - 16:20 | ECC Autumn School II (Coordinator: Naoto Yanai) |

13:10 - 14:40 | Kazuo Sakiyama(The University of Electro-Communications ): Introduction to Hardware Implementation of ECC
Abstract: Hardware implementation of Elliptic Curve Cryptography (ECC) requires basic knowledge about modular operations. In the hierarchical design approach of ECC hardware, modular multiplication is the most critical building block that determines hardware cost and speed performance. In this lecture, we will learn several techniques to implement an efficient modular multiplier based on arithmetic modules. |

14:40 - 14:50 | Short Break |

14:50 - 16:20 | Chloe Martindale(Technical University of Eindhoven): CSIDH: A Post-Quantum Drop-in Replacement for ECDH
Abstract: We will study the mathematical background required to understand the CSIDH protocol. Many classical (pre-quantum) cryptographic protocols such as the Diffie-Hellman key exchange rely on the hardness of the discrete logarithm problem in a given group, such as the multiplicative group of a finite field, or the rational points on an elliptic curve defined over a finite field. Shor's algorithm exploits the group structure to break these protocols with the use of a quantum computer. CSIDH or `commutative supersingular isogeny Diffie-Hellman' describes a set together with a group *action* with which a Diffie-Hellman style key exchange can be performed - but as the key exchange is performed on the set Shor's algorithm does not apply. The set contains supersingular elliptic curves defined over a prime field, and the action comes from isogenies. We will review group actions, give definitions and examples of isogenies, and explain the CSIDH group action and its translation to a Diffie-Hellman style non-interactive key exchange. No prior knowledge of supersingular elliptic curves or isogenies will be assumed. |

16:20 - 16:30 | Coffee Break |

16:30 - 18:00 | ECC Autumn School III(Coordinator: Seiko Arita) |

16:30 - 18:00 | Tung Chou(Osaka University): Software Implementations of ECC: Security and Efficiency |

18:30 - 20:30 | *Dinner* |

09:00 - 12:20 | ECC Autumn School IV (Coordinator: Yuji Suga) |

09:00 - 10:30 | Roger Wattenhofer(ETH Zurich): Blockchain: Fundamental and Advanced Topics |

10:30 - 10:50 | Coffee Break |

10:50 - 12:20 | David Jao(University of Waterloo/evolutionQ, Inc.,Waterloo): An Introduction to SIDH |