E. [. Avanzi and . Cesena, Trace Zero Varieties over Fields of Characteristic 2 for Cryptographic Applications, Algebraic Geometry and Its Applications, pp.188-215, 2007.
DOI : 10.1142/9789812793430_0010

R. Avanzi, H. Cohen, C. Doche, G. Frey, T. Lange et al., Handbook of elliptic and hyperelliptic curve cryptography, Discrete Mathematics and its Applications A subexponential algorithm for discrete logrithms over the rational subgroup of the Jacobians of large genus hyperelliptic curves over finite fields, Algorithmic Number Theory, LNCS, vol.877, pp.28-40, 1994.

J. [. Bosma, C. Cannon, and . Playoust, The Magma Algebra System I: The User Language, Journal of Symbolic Computation, vol.24, issue.3-4, pp.235-265, 1997.
DOI : 10.1006/jsco.1996.0125

L. Bettale, J. Faugère, and L. Perret, Hybrid approach for solving multivariate systems over finite fields, Journal of Mathematical Cryptology, vol.3, issue.3, pp.1-22, 2008.
DOI : 10.1515/JMC.2009.009

URL : https://hal.archives-ouvertes.fr/hal-01148127

M. Bardet, J. Faugère, B. Salvy, and B. Yang, Asymptotic behaviour of the index of regularity of quadratic semi-regular polynomial systems, The Effective Methods in Algebraic Geometry Conference, MEGA '05) (P. Gianni, pp.1-14, 2005.

R. B?-arbulescu, P. Gaudry, A. Joux, and E. Thomé, A quasi-polynomial algorithm for discrete logarithm in finite fields of small characteristic, Proceedings of EUROCRYPT '14, 2013.

. W. Bkk-+-09-]-j, M. E. Bos, T. Kaihara, A. K. Kleinjung, P. L. Lenstra et al., Playstation 3 computing breaks 2 60 barrier: 112-bit prime ECDLP solved, Available at http://lacal.epfl.ch/112bit_prime On the correct use of the negation map in the Pollard rho method, LNCS, vol.6571, pp.128-146, 2009.

C. Bouvier, The filtering step of discrete logarithm and integer factorization algorithms [Ces10] E. Cesena, Trace zero varieties in pairing-based cryptography, Cop84] D. Coppersmith, Fast evalution of logarithms in fields of characteristic two, pp.587-594, 1984.

]. C. Die03 and . Diem, The GHS attack in odd characteristic [Die06] , An index calculus algorithm for plane curves of small degree, Algorithmic Number Theory, Die11] , On the discrete logarithm problem in elliptic curves, pp.1-32, 2003.

S. Diem and . Kochinke, On the discrete logarithm problem in elliptic curves II, elliptic curves II, pp.1281-1323, 2003.
DOI : 10.2140/ant.2013.7.1281

P. [. Enge and . Gaudry, A general framework for subexponential discrete logarithm algorithms, Acta Arith, pp.83-103, 2002.

L. [. An, 3 + ?) algorithm for the discrete logarithm problem for low degree curves/3) discrete logarithm algorithm for low degree curves, Advances in Cryptology: Proceedings of EUROCRYPT '07, pp.379-393, 2007.

K. [. Eberly and . Kaltofen, On randomized Lanczos algorithms, Proceedings of the 1997 international symposium on Symbolic and algebraic computation , ISSAC '97, pp.176-183, 1997.
DOI : 10.1145/258726.258776

]. A. Eng02 and . Enge, Computing discrete logarithms in high-genus hyperelliptic Jacobians in provably subexponential time, Math. Comp, vol.71, pp.729-742, 2002.

J. Faugère, P. Gaudry, L. Huot, and G. Renault, Using symmetries and fast change of ordering in the index calculus for elliptic curves discrete logarithm, Proceedings of the Third International Conference on Symbolic Computation and Cryptography (SCC '12), pp.113-118, 2012.

J. Faugère, P. Gianni, D. Lazard, and T. Mora, Efficient Computation of Zero-dimensional Gr??bner Bases by Change of Ordering, Journal of Symbolic Computation, vol.16, issue.4, pp.329-344, 1993.
DOI : 10.1006/jsco.1993.1051

J. Faugère, L. Perret, C. Petit, and G. Renault, Improving the Complexity of Index Calculus Algorithms in Elliptic Curves over Binary Fields, Advances in Cryptology: Proceedings of EUROCRYPT '12, pp.27-44, 2012.
DOI : 10.1007/978-3-642-29011-4_4

]. G. Fre98 and . Frey, How to disguise an elliptic curve, Talk at the 2nd workshop on Elliptic Curve Cryptography (ECC '98), 1998. [Fre99] , Applications of arithmetical geometry to cryptographic constructions, Proceedings of the 5th International Conference on Finite Fields and ApplicationsGau00] P. Gaudry, An algorithm for solving the discrete log problem on hyperelliptic curves, Advances in Cryptology: Proceedings of EUROCRYPT '00 (B. Preneel, pp.128-161, 1999.

F. Gölo?-glu, R. Granger, G. Mcguire, and J. Zumbrägel, On the function field sieve and the impact of higher splitting probabilities: Application to discrete logarithms in F 2 Solving a 6120-bit DLP on a desktop computer, Proceedings of CRYPTO '13 Proceedings of SAC '13, 1971.

P. Gaudry, F. Hess, and N. P. Smart, Constructive and destructive facets of Weil descent on elliptic curves, Journal of Cryptology, vol.44, issue.1, pp.19-46, 2002.
DOI : 10.1007/s00145-001-0011-x

URL : https://hal.archives-ouvertes.fr/inria-00512763

A. [. Granger, V. Joux, and . Vitse, New timings for oracle-assisted SDHP on the IPSEC Oakley 'well known group' 3 curve, NMBRTHRY list, available at https://listserv.nodak.edu/cgi-bin/wa.exe?A2=ind1007&L=NMBRTHRY&P=R156&1=NMBRTHRY&9=A&J=on&d=No+Match%3BMatch Endomorphisms for faster elliptic curve cryptography on a large class of curves, J. Cryptology, vol.24, issue.3, pp.446-469, 2010.

R. [. Gallant, S. A. Lambert, and . Vanstone, Faster Point Multiplication on Elliptic Curves with Efficient Endomorphisms, Advances in Cryptology: Proceedings of CRYPTO '01, pp.190-200, 2001.
DOI : 10.1007/3-540-44647-8_11

M. [. Gorla, D. M. Massierer, and . Gordon, An optimal representation for the trace zero variety, Preprint, 2013. [GM14] , Point compression for the trace zero subgroup over a small degree extension field, To appear in Des, Discrete logarithms in GF(p) using the number field sieve, SIAM J. Discrete Math, pp.124-138, 1993.

]. E. Gor11 and . Gorla, Torus-based cryptography, Encyclopedia of Cryptography, pp.1306-1308, 2011.

N. [. Galbraith and . Smart, A cryptographic application of Weil descent, Cryptography and Coding, Proceedings of the 7th IMA International Conference, pp.191-200, 1999.

B. [. Galbraith and . Smith, Discrete logarithms in generalized Jacobians, 2006.
URL : https://hal.archives-ouvertes.fr/inria-00537887

P. Gaudry, E. Thomé, N. Thériault, and C. Diem, A double large prime variation for small genus hyperelliptic index calculus, Mathematics of Computation, vol.76, issue.257, pp.475-492, 2007.
DOI : 10.1090/S0025-5718-06-01900-4

URL : https://hal.archives-ouvertes.fr/inria-00000897

F. [. Granger and . Vercauteren, On the discrete logarithm problem on algebraic tori Advances in Cryptology, Proceedings of CRYPTO '05 (V. Shoup, pp.66-85, 2005.

]. J. Gvzg99, J. Gerhard, H. Von-zur-gathen, ]. Jeljeli, R. Joux et al., Modern computer algebra Accelerating iterative SpMV for discrete logarithm problem using GPUs Available at http://hal.inria.fr/hal-00734975 Resolution of linear algebra for the discrete logarithm problem using GPU and multi-core architectures The function field sieve is quite special, Algorithmic Number Theory LNCS, vol.2369, pp.431-445, 1999.

]. K. Nag10 and . Nagao, Decomposition attack for the Jacobian of a hyperelliptic curve over an extension field, Algorithmic Number Theory, LNCS, vol.6197, pp.285-300, 2010.

J. [. Petit and . Quisquater, On polynomial systems arising from a Weil descent Advances in Cryptology, Proceedings of ASIACRYPT '12, pp.2012-451

A. [. Rubin and . Silverberg, Supersingular abelian varieties in cryptology Advances in Cryptology: Proceedings of CRYPTO '02, LNCS, vol.2442, pp.336-353, 2002.

M. Shantz and E. Teske, The special function field sieve [Sem04] I. Semaev, Summation polynomials of the discrete logarithm problem on elliptic curves, Available at http://eprint.iacr.org Solving the elliptic curve discrete logarithm problem using Semaev polynomials, Weil descent and Gröbner basis methods ? an experimental study Index calculus attack for hyperelliptic curves of small genus, Advances in Cryptology: Proceedings of ASIACRYPT '03 (C. S. Laih Proceedings of the 1988 international symposium on Symbolic and algebraic computation (ISSAC '88), pp.330-364, 1988.

. D. Vjs14-]-m, M. J. Velichka, J. Jacobson, and A. Stein, Computing discrete logarithms in the Jacobian of high-genus hyperelliptic curves over even characteristic finite fields, Math. Comp, vol.83, issue.286, pp.935-963, 2014.

]. D. Wie86 and . Wiedemann, Solving sparse linear equations over finite fields, IEEE Trans. Inform. Theory IT, vol.32, issue.1, pp.54-62, 1986.

N. T. Chen and . Courtois, On asymptotic security estimates in XL and Gröbner bases-related algebraic cryptanalysis, Information and Communications Security (ICICS '04, LNCS, vol.3269, pp.401-413, 2004.

E. Gorla, Institut de mathématiques, Rue Emile-Argand Neuchâtel, vol.11, 2000.

M. Massierer and M. Institut, Rheinsprung 21, 4051 Basel, Switzer- land E-mail address: maike.massierer@unibas