@article{koblitz1987elliptic,
  author  = {Koblitz, Neal},
  title   = {Elliptic Curve Cryptosystems},
  journal = {Mathematics of Computation},
  year    = {1987},
  volume  = {48},
  number  = {177},
  pages   = {203--209},
  doi     = {10.1090/S0025-5718-1987-0866109-5}
}

@incollection{miller1985use,
  author    = {Miller, Victor S.},
  title     = {Use of Elliptic Curves in Cryptography},
  booktitle = {Advances in Cryptology --- CRYPTO '85},
  series    = {Lecture Notes in Computer Science},
  volume    = {218},
  publisher = {Springer},
  year      = {1986},
  pages     = {417--426},
  doi       = {10.1007/3-540-39799-X_31}
}

@book{silverman2009arithmetic,
  author    = {Silverman, Joseph H.},
  title     = {The Arithmetic of Elliptic Curves},
  edition   = {2nd},
  series    = {Graduate Texts in Mathematics},
  volume    = {106},
  publisher = {Springer},
  address   = {New York},
  year      = {2009},
  doi       = {10.1007/978-0-387-09494-6}
}

@book{washington2008elliptic,
  author    = {Washington, Lawrence C.},
  title     = {Elliptic Curves: Number Theory and Cryptography},
  edition   = {2nd},
  publisher = {Chapman and Hall/CRC},
  address   = {Boca Raton},
  year      = {2008},
  doi       = {10.1201/9781420071474}
}

@book{galbraith2012mathematics,
  author    = {Galbraith, Steven D.},
  title     = {Mathematics of Public Key Cryptography},
  publisher = {Cambridge University Press},
  address   = {Cambridge},
  year      = {2012},
  doi       = {10.1017/CBO9781139012843}
}

@book{hankerson2004guide,
  author    = {Hankerson, Darrel and Menezes, Alfred and Vanstone, Scott},
  title     = {Guide to Elliptic Curve Cryptography},
  publisher = {Springer},
  address   = {New York},
  year      = {2004},
  doi       = {10.1007/b97644}
}

@book{menezes1996handbook,
  author    = {Menezes, Alfred J. and van Oorschot, Paul C. and Vanstone, Scott A.},
  title     = {Handbook of Applied Cryptography},
  publisher = {CRC Press},
  address   = {Boca Raton},
  year      = {1996},
  doi       = {10.1201/9781439821916}
}

@article{schoof1985elliptic,
  author  = {Schoof, Ren{\'e}},
  title   = {Elliptic Curves over Finite Fields and the Computation of Square Roots mod $p$},
  journal = {Mathematics of Computation},
  year    = {1985},
  volume  = {44},
  number  = {170},
  pages   = {483--494},
  doi     = {10.1090/S0025-5718-1985-0777280-6}
}

@article{schoof1995counting,
  author  = {Schoof, Ren{\'e}},
  title   = {Counting Points on Elliptic Curves over Finite Fields},
  journal = {Journal de Th{\'e}orie des Nombres de Bordeaux},
  year    = {1995},
  volume  = {7},
  number  = {1},
  pages   = {219--254},
  doi     = {10.5802/jtnb.142}
}

@incollection{cohen1998efficient,
  author    = {Cohen, Henri and Miyaji, Atsuko and Ono, Takatoshi},
  title     = {Efficient Elliptic Curve Exponentiation Using Mixed Coordinates},
  booktitle = {Advances in Cryptology --- ASIACRYPT '98},
  series    = {Lecture Notes in Computer Science},
  volume    = {1514},
  publisher = {Springer},
  year      = {1998},
  pages     = {51--65},
  doi       = {10.1007/3-540-49649-1_6}
}

@techreport{solinas1999generalized,
  author      = {Solinas, Jerome A.},
  title       = {Generalized {M}ersenne Numbers},
  institution = {Centre for Applied Cryptographic Research, University of Waterloo},
  number      = {CORR 99-39},
  year        = {1999},
  url         = {https://cacr.uwaterloo.ca/techreports/1999/corr99-39.pdf}
}

@article{montgomery1987speeding,
  author  = {Montgomery, Peter L.},
  title   = {Speeding the {P}ollard and Elliptic Curve Methods of Factorization},
  journal = {Mathematics of Computation},
  year    = {1987},
  volume  = {48},
  number  = {177},
  pages   = {243--264},
  doi     = {10.1090/S0025-5718-1987-0866113-7}
}

@incollection{brier2002weierstrass,
  author    = {Brier, {\'E}ric and Joye, Marc},
  title     = {Weierstra{\ss} Elliptic Curves and Side-Channel Attacks},
  booktitle = {Public Key Cryptography --- PKC 2002},
  series    = {Lecture Notes in Computer Science},
  volume    = {2274},
  publisher = {Springer},
  year      = {2002},
  pages     = {335--345},
  doi       = {10.1007/3-540-45664-3_24}
}

@incollection{gallant2001faster,
  author    = {Gallant, Robert P. and Lambert, Robert J. and Vanstone, Scott A.},
  title     = {Faster Point Multiplication on Elliptic Curves with Efficient Endomorphisms},
  booktitle = {Advances in Cryptology --- CRYPTO 2001},
  series    = {Lecture Notes in Computer Science},
  volume    = {2139},
  publisher = {Springer},
  year      = {2001},
  pages     = {190--200},
  doi       = {10.1007/3-540-44647-8_11}
}

@article{straus1964addition,
  author  = {Straus, Ernst G.},
  title   = {Addition Chains of Vectors (Problem 5125)},
  journal = {The American Mathematical Monthly},
  year    = {1964},
  volume  = {71},
  number  = {7},
  pages   = {806--808},
  doi     = {10.2307/2310929},
  note    = {Solution to problem 5125 proposed by R. Bellman}
}

@article{pippenger1980evaluation,
  author  = {Pippenger, Nicholas},
  title   = {On the Evaluation of Powers and Monomials},
  journal = {SIAM Journal on Computing},
  year    = {1980},
  volume  = {9},
  number  = {2},
  pages   = {230--250},
  doi     = {10.1137/0209022}
}

@incollection{moller2001algorithms,
  author    = {M{\"o}ller, Bodo},
  title     = {Algorithms for Multi-exponentiation},
  booktitle = {Selected Areas in Cryptography --- SAC 2001},
  series    = {Lecture Notes in Computer Science},
  volume    = {2259},
  publisher = {Springer},
  year      = {2001},
  pages     = {165--180},
  doi       = {10.1007/3-540-45537-X_13}
}

@article{bernstein2012high,
  author  = {Bernstein, Daniel J. and Duif, Niels and Lange, Tanja and Schwabe, Peter and Yang, Bo-Yin},
  title   = {High-Speed High-Security Signatures},
  journal = {Journal of Cryptographic Engineering},
  year    = {2012},
  volume  = {2},
  number  = {2},
  pages   = {77--89},
  doi     = {10.1007/s13389-012-0027-1}
}

@incollection{naccache1994can,
  author    = {Naccache, David and M'Ra{\"i}hi, David and Vaudenay, Serge and Raphaeli, Dan},
  title     = {Can {D.S.A.} Be Improved? Complexity Trade-Offs with the Digital Signature Standard},
  booktitle = {Advances in Cryptology --- EUROCRYPT '94},
  series    = {Lecture Notes in Computer Science},
  volume    = {950},
  publisher = {Springer},
  year      = {1995},
  pages     = {77--85},
  doi       = {10.1007/BFb0053426}
}

@incollection{bellare1998fast,
  author    = {Bellare, Mihir and Garay, Juan A. and Rabin, Tal},
  title     = {Fast Batch Verification for Modular Exponentiation and Digital Signatures},
  booktitle = {Advances in Cryptology --- EUROCRYPT '98},
  series    = {Lecture Notes in Computer Science},
  volume    = {1403},
  publisher = {Springer},
  year      = {1998},
  pages     = {236--250},
  doi       = {10.1007/BFb0054130}
}

@incollection{shanks1971class,
  author    = {Shanks, Daniel},
  title     = {Class Number, a Theory of Factorization, and Genera},
  booktitle = {1969 Number Theory Institute},
  series    = {Proceedings of Symposia in Pure Mathematics},
  volume    = {20},
  publisher = {American Mathematical Society},
  year      = {1971},
  pages     = {415--440},
  doi       = {10.1090/pspum/020/0316385}
}

@article{pollard1978monte,
  author  = {Pollard, John M.},
  title   = {Monte {C}arlo Methods for Index Computation (mod $p$)},
  journal = {Mathematics of Computation},
  year    = {1978},
  volume  = {32},
  number  = {143},
  pages   = {918--924},
  doi     = {10.1090/S0025-5718-1978-0491431-9}
}

@article{pollard2000kangaroos,
  author  = {Pollard, John M.},
  title   = {Kangaroos, {M}onopoly and Discrete Logarithms},
  journal = {Journal of Cryptology},
  year    = {2000},
  volume  = {13},
  number  = {4},
  pages   = {437--447},
  doi     = {10.1007/s001450010010}
}

@article{vanoorschot1999parallel,
  author  = {van Oorschot, Paul C. and Wiener, Michael J.},
  title   = {Parallel Collision Search with Cryptanalytic Applications},
  journal = {Journal of Cryptology},
  year    = {1999},
  volume  = {12},
  number  = {1},
  pages   = {1--28},
  doi     = {10.1007/PL00003816}
}

@incollection{teske1998speeding,
  author    = {Teske, Edlyn},
  title     = {Speeding up {P}ollard's Rho Method for Computing Discrete Logarithms},
  booktitle = {Algorithmic Number Theory --- ANTS-III},
  series    = {Lecture Notes in Computer Science},
  volume    = {1423},
  publisher = {Springer},
  year      = {1998},
  pages     = {541--554},
  doi       = {10.1007/BFb0054891}
}

@article{teske2001random,
  author  = {Teske, Edlyn},
  title   = {On Random Walks for {P}ollard's Rho Method},
  journal = {Mathematics of Computation},
  year    = {2001},
  volume  = {70},
  number  = {234},
  pages   = {809--825},
  doi     = {10.1090/S0025-5718-00-01213-8}
}

@article{brent1980improved,
  author  = {Brent, Richard P.},
  title   = {An Improved {M}onte {C}arlo Factorization Algorithm},
  journal = {BIT Numerical Mathematics},
  year    = {1980},
  volume  = {20},
  number  = {2},
  pages   = {176--184},
  doi     = {10.1007/BF01933190}
}

@incollection{flajolet1990random,
  author    = {Flajolet, Philippe and Odlyzko, Andrew M.},
  title     = {Random Mapping Statistics},
  booktitle = {Advances in Cryptology --- EUROCRYPT '89},
  series    = {Lecture Notes in Computer Science},
  volume    = {434},
  publisher = {Springer},
  year      = {1990},
  pages     = {329--354},
  doi       = {10.1007/3-540-46885-4_34}
}

@incollection{shoup1997lower,
  author    = {Shoup, Victor},
  title     = {Lower Bounds for Discrete Logarithms and Related Problems},
  booktitle = {Advances in Cryptology --- EUROCRYPT '97},
  series    = {Lecture Notes in Computer Science},
  volume    = {1233},
  publisher = {Springer},
  year      = {1997},
  pages     = {256--266},
  doi       = {10.1007/3-540-69053-0_18}
}

@article{nechaev1994complexity,
  author  = {Nechaev, Vassiliy I.},
  title   = {Complexity of a Determinate Algorithm for the Discrete Logarithm},
  journal = {Mathematical Notes},
  year    = {1994},
  volume  = {55},
  number  = {2},
  pages   = {165--172},
  doi     = {10.1007/BF02113297}
}

@article{gallant2000improving,
  author  = {Gallant, Robert and Lambert, Robert and Vanstone, Scott},
  title   = {Improving the Parallelized {P}ollard Lambda Search on Anomalous Binary Curves},
  journal = {Mathematics of Computation},
  year    = {2000},
  volume  = {69},
  number  = {232},
  pages   = {1699--1705},
  doi     = {10.1090/S0025-5718-99-01119-9}
}

@incollection{wiener1999faster,
  author    = {Wiener, Michael J. and Zuccherato, Robert J.},
  title     = {Faster Attacks on Elliptic Curve Cryptosystems},
  booktitle = {Selected Areas in Cryptography --- SAC '98},
  series    = {Lecture Notes in Computer Science},
  volume    = {1556},
  publisher = {Springer},
  year      = {1999},
  pages     = {190--200},
  doi       = {10.1007/3-540-48892-8_15}
}

@incollection{duursma1999speeding,
  author    = {Duursma, Iwan and Gaudry, Pierrick and Morain, Fran{\c{c}}ois},
  title     = {Speeding up the Discrete Log Computation on Curves with Automorphisms},
  booktitle = {Advances in Cryptology --- ASIACRYPT '99},
  series    = {Lecture Notes in Computer Science},
  volume    = {1716},
  publisher = {Springer},
  year      = {1999},
  pages     = {103--121},
  doi       = {10.1007/978-3-540-48000-6_10}
}

@incollection{bos2010negation,
  author    = {Bos, Joppe W. and Kleinjung, Thorsten and Lenstra, Arjen K.},
  title     = {On the Use of the Negation Map in the {P}ollard Rho Method},
  booktitle = {Algorithmic Number Theory --- ANTS-IX},
  series    = {Lecture Notes in Computer Science},
  volume    = {6197},
  publisher = {Springer},
  year      = {2010},
  pages     = {66--82},
  doi       = {10.1007/978-3-642-14518-6_9}
}

@incollection{bernstein2011correct,
  author    = {Bernstein, Daniel J. and Lange, Tanja and Schwabe, Peter},
  title     = {On the Correct Use of the Negation Map in the {P}ollard Rho Method},
  booktitle = {Public Key Cryptography --- PKC 2011},
  series    = {Lecture Notes in Computer Science},
  volume    = {6571},
  publisher = {Springer},
  year      = {2011},
  pages     = {128--146},
  doi       = {10.1007/978-3-642-19379-8_8}
}

@incollection{bernstein2013nonuniform,
  author    = {Bernstein, Daniel J. and Lange, Tanja},
  title     = {Non-uniform Cracks in the Concrete: The Power of Free Precomputation},
  booktitle = {Advances in Cryptology --- ASIACRYPT 2013},
  series    = {Lecture Notes in Computer Science},
  volume    = {8270},
  publisher = {Springer},
  year      = {2013},
  pages     = {321--340},
  doi       = {10.1007/978-3-642-42045-0_17},
  note      = {Full version: IACR Cryptology ePrint Archive, Report 2012/318}
}

@incollection{corrigangibbs2018discrete,
  author    = {Corrigan-Gibbs, Henry and Kogan, Dmitry},
  title     = {The Discrete-Logarithm Problem with Preprocessing},
  booktitle = {Advances in Cryptology --- EUROCRYPT 2018},
  series    = {Lecture Notes in Computer Science},
  volume    = {10821},
  publisher = {Springer},
  year      = {2018},
  pages     = {415--447},
  doi       = {10.1007/978-3-319-78375-8_14},
  note      = {Full version: IACR Cryptology ePrint Archive, Report 2017/1113}
}

@misc{lee2011generic,
  author       = {Lee, Hyung Tae and Cheon, Jung Hee and Hong, Jin},
  title        = {Accelerating {ID}-based Encryption Based on Trapdoor {DL} Using Pre-computation},
  howpublished = {IACR Cryptology ePrint Archive, Report 2011/187},
  year         = {2011},
  url          = {https://eprint.iacr.org/2011/187},
  note         = {Discrete-logarithm computation with precomputation (preprocessing) in a fixed group}
}

@article{bernstein2012two,
  author  = {Bernstein, Daniel J. and Lange, Tanja},
  title   = {Two Grumpy Giants and a Baby},
  journal = {The Open Book Series},
  year    = {2013},
  volume  = {1},
  number  = {1},
  pages   = {87--111},
  doi     = {10.2140/obs.2013.1.87},
  note    = {Proceedings of ANTS X (2012)}
}

@incollection{galbraith2010interval,
  author    = {Galbraith, Steven D. and Ruprai, Raminder S.},
  title     = {Using Equivalence Classes to Accelerate Solving the Discrete Logarithm Problem in a Short Interval},
  booktitle = {Public Key Cryptography --- PKC 2010},
  series    = {Lecture Notes in Computer Science},
  volume    = {6056},
  publisher = {Springer},
  year      = {2010},
  pages     = {368--383},
  doi       = {10.1007/978-3-642-13013-7_22}
}

@article{galbraith2016recent,
  author  = {Galbraith, Steven D. and Gaudry, Pierrick},
  title   = {Recent Progress on the Elliptic Curve Discrete Logarithm Problem},
  journal = {Designs, Codes and Cryptography},
  year    = {2016},
  volume  = {78},
  number  = {1},
  pages   = {51--72},
  doi     = {10.1007/s10623-015-0146-7}
}

@article{pohlig1978improved,
  author  = {Pohlig, Stephen C. and Hellman, Martin E.},
  title   = {An Improved Algorithm for Computing Logarithms over {GF}($p$) and Its Cryptographic Significance},
  journal = {IEEE Transactions on Information Theory},
  year    = {1978},
  volume  = {24},
  number  = {1},
  pages   = {106--110},
  doi     = {10.1109/TIT.1978.1055817}
}

@article{menezes1993reducing,
  author  = {Menezes, Alfred J. and Okamoto, Tatsuaki and Vanstone, Scott A.},
  title   = {Reducing Elliptic Curve Logarithms to Logarithms in a Finite Field},
  journal = {IEEE Transactions on Information Theory},
  year    = {1993},
  volume  = {39},
  number  = {5},
  pages   = {1639--1646},
  doi     = {10.1109/18.259647}
}

@article{frey1994remark,
  author  = {Frey, Gerhard and R{\"u}ck, Hans-Georg},
  title   = {A Remark Concerning $m$-Divisibility and the Discrete Logarithm in the Divisor Class Group of Curves},
  journal = {Mathematics of Computation},
  year    = {1994},
  volume  = {62},
  number  = {206},
  pages   = {865--874},
  doi     = {10.1090/S0025-5718-1994-1218343-6}
}

@article{semaev1998evaluation,
  author  = {Semaev, Igor A.},
  title   = {Evaluation of Discrete Logarithms in a Group of $p$-Torsion Points of an Elliptic Curve in Characteristic $p$},
  journal = {Mathematics of Computation},
  year    = {1998},
  volume  = {67},
  number  = {221},
  pages   = {353--356},
  doi     = {10.1090/S0025-5718-98-00887-4}
}

@article{smart1999discrete,
  author  = {Smart, Nigel P.},
  title   = {The Discrete Logarithm Problem on Elliptic Curves of Trace One},
  journal = {Journal of Cryptology},
  year    = {1999},
  volume  = {12},
  number  = {3},
  pages   = {193--196},
  doi     = {10.1007/s001459900052}
}

@article{satoh1998fermat,
  author  = {Satoh, Takakazu and Araki, Kiyomichi},
  title   = {Fermat Quotients and the Polynomial Time Discrete Log Algorithm for Anomalous Elliptic Curves},
  journal = {Commentarii Mathematici Universitatis Sancti Pauli},
  year    = {1998},
  volume  = {47},
  number  = {1},
  pages   = {81--92},
  note    = {Errata: same journal 48 (1999), no. 2, 211--213. No DOI; bibliographic data confirmed through citing sources}
}

@misc{semaev2004summation,
  author       = {Semaev, Igor},
  title        = {Summation Polynomials and the Discrete Logarithm Problem on Elliptic Curves},
  howpublished = {IACR Cryptology ePrint Archive, Report 2004/031},
  year         = {2004},
  url          = {https://eprint.iacr.org/2004/031}
}

@article{gaudry2009index,
  author  = {Gaudry, Pierrick},
  title   = {Index Calculus for Abelian Varieties of Small Dimension and the Elliptic Curve Discrete Logarithm Problem},
  journal = {Journal of Symbolic Computation},
  year    = {2009},
  volume  = {44},
  number  = {12},
  pages   = {1690--1702},
  doi     = {10.1016/j.jsc.2008.08.005}
}

@article{diem2011discrete,
  author  = {Diem, Claus},
  title   = {On the Discrete Logarithm Problem in Elliptic Curves},
  journal = {Compositio Mathematica},
  year    = {2011},
  volume  = {147},
  number  = {1},
  pages   = {75--104},
  doi     = {10.1112/S0010437X10005075}
}

@incollection{petit2012elliptic,
  author    = {Petit, Christophe and Quisquater, Jean-Jacques},
  title     = {On Polynomial Systems Arising from a {W}eil Descent},
  booktitle = {Advances in Cryptology --- ASIACRYPT 2012},
  series    = {Lecture Notes in Computer Science},
  volume    = {7658},
  publisher = {Springer},
  year      = {2012},
  pages     = {451--466},
  doi       = {10.1007/978-3-642-34961-4_28}
}

@article{bos2012solving,
  author  = {Bos, Joppe W. and Kaihara, Marcelo E. and Kleinjung, Thorsten and Lenstra, Arjen K. and Montgomery, Peter L.},
  title   = {Solving a 112-bit Prime Elliptic Curve Discrete Logarithm Problem on Game Consoles Using Sloppy Reduction},
  journal = {International Journal of Applied Cryptography},
  year    = {2012},
  volume  = {2},
  number  = {3},
  pages   = {212--228},
  doi     = {10.1504/IJACT.2012.045590}
}

@incollection{wenger2014solving,
  author    = {Wenger, Erich and Wolfger, Paul},
  title     = {Solving the Discrete Logarithm of a 113-bit {K}oblitz Curve with an {FPGA} Cluster},
  booktitle = {Selected Areas in Cryptography --- SAC 2014},
  series    = {Lecture Notes in Computer Science},
  volume    = {8781},
  publisher = {Springer},
  year      = {2014},
  pages     = {363--379},
  doi       = {10.1007/978-3-319-13051-4_22},
  note      = {Also IACR Cryptology ePrint Archive, Report 2014/368}
}

@article{wenger2016harder,
  author  = {Wenger, Erich and Wolfger, Paul},
  title   = {Harder, Better, Faster, Stronger: Elliptic Curve Discrete Logarithm Computations on {FPGAs}},
  journal = {Journal of Cryptographic Engineering},
  year    = {2016},
  volume  = {6},
  number  = {4},
  pages   = {287--297},
  doi     = {10.1007/s13389-015-0108-z},
  note    = {Also IACR Cryptology ePrint Archive, Report 2015/143}
}

@misc{bernstein2016faster,
  author       = {Bernstein, Daniel J. and Engels, Susanne and Lange, Tanja and Niederhagen, Ruben and Paar, Christof and Schwabe, Peter and Zimmermann, Ralf},
  title        = {Faster Elliptic-Curve Discrete Logarithms on {FPGAs}},
  howpublished = {IACR Cryptology ePrint Archive, Report 2016/382},
  year         = {2016},
  url          = {https://eprint.iacr.org/2016/382}
}

@techreport{certicom2009challenge,
  author      = {{Certicom Research}},
  title       = {Certicom {ECC} Challenge},
  institution = {Certicom Corp.},
  year        = {2009},
  note        = {Original date November 6, 1997; latest update November 10, 2009},
  url         = {https://www.certicom.com/content/dam/certicom/images/pdfs/challenge-2009.pdf}
}

@article{shor1997polynomial,
  author  = {Shor, Peter W.},
  title   = {Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer},
  journal = {SIAM Journal on Computing},
  year    = {1997},
  volume  = {26},
  number  = {5},
  pages   = {1484--1509},
  doi     = {10.1137/S0097539795293172}
}

@incollection{roetteler2017quantum,
  author    = {Roetteler, Martin and Naehrig, Michael and Svore, Krysta M. and Lauter, Kristin},
  title     = {Quantum Resource Estimates for Computing Elliptic Curve Discrete Logarithms},
  booktitle = {Advances in Cryptology --- ASIACRYPT 2017},
  series    = {Lecture Notes in Computer Science},
  volume    = {10625},
  publisher = {Springer},
  year      = {2017},
  pages     = {241--270},
  doi       = {10.1007/978-3-319-70697-9_9}
}

@article{schnorr1991efficient,
  author  = {Schnorr, Claus-Peter},
  title   = {Efficient Signature Generation by Smart Cards},
  journal = {Journal of Cryptology},
  year    = {1991},
  volume  = {4},
  number  = {3},
  pages   = {161--174},
  doi     = {10.1007/BF00196725}
}

@article{pointcheval2000security,
  author  = {Pointcheval, David and Stern, Jacques},
  title   = {Security Arguments for Digital Signatures and Blind Signatures},
  journal = {Journal of Cryptology},
  year    = {2000},
  volume  = {13},
  number  = {3},
  pages   = {361--396},
  doi     = {10.1007/s001450010003}
}

@incollection{seurin2012exact,
  author    = {Seurin, Yannick},
  title     = {On the Exact Security of {S}chnorr-Type Signatures in the Random Oracle Model},
  booktitle = {Advances in Cryptology --- EUROCRYPT 2012},
  series    = {Lecture Notes in Computer Science},
  volume    = {7237},
  publisher = {Springer},
  year      = {2012},
  pages     = {554--571},
  doi       = {10.1007/978-3-642-29011-4_33}
}

@incollection{paillier2005discrete,
  author    = {Paillier, Pascal and Vergnaud, Damien},
  title     = {Discrete-Log-Based Signatures May Not Be Equivalent to Discrete Log},
  booktitle = {Advances in Cryptology --- ASIACRYPT 2005},
  series    = {Lecture Notes in Computer Science},
  volume    = {3788},
  publisher = {Springer},
  year      = {2005},
  pages     = {1--20},
  doi       = {10.1007/11593447_1}
}

@article{brown2005generic,
  author  = {Brown, Daniel R. L.},
  title   = {Generic Groups, Collision Resistance, and {ECDSA}},
  journal = {Designs, Codes and Cryptography},
  year    = {2005},
  volume  = {35},
  number  = {1},
  pages   = {119--152},
  doi     = {10.1007/s10623-003-6154-z}
}

@incollection{vaudenay2003security,
  author    = {Vaudenay, Serge},
  title     = {The Security of {DSA} and {ECDSA}},
  booktitle = {Public Key Cryptography --- PKC 2003},
  series    = {Lecture Notes in Computer Science},
  volume    = {2567},
  publisher = {Springer},
  year      = {2003},
  pages     = {309--323},
  doi       = {10.1007/3-540-36288-6_23}
}

@inproceedings{fersch2016provable,
  author    = {Fersch, Manuel and Kiltz, Eike and Poettering, Bertram},
  title     = {On the Provable Security of {(EC)DSA} Signatures},
  booktitle = {Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS 2016)},
  publisher = {ACM},
  year      = {2016},
  pages     = {1651--1662},
  doi       = {10.1145/2976749.2978413}
}

@incollection{fersch2017one,
  author    = {Fersch, Manuel and Kiltz, Eike and Poettering, Bertram},
  title     = {On the One-Per-Message Unforgeability of {(EC)DSA} and Its Variants},
  booktitle = {Theory of Cryptography --- TCC 2017},
  series    = {Lecture Notes in Computer Science},
  volume    = {10678},
  publisher = {Springer},
  year      = {2017},
  pages     = {519--534},
  doi       = {10.1007/978-3-319-70503-3_17}
}

@incollection{groth2022security,
  author    = {Groth, Jens and Shoup, Victor},
  title     = {On the Security of {ECDSA} with Additive Key Derivation and Presignatures},
  booktitle = {Advances in Cryptology --- EUROCRYPT 2022},
  series    = {Lecture Notes in Computer Science},
  volume    = {13276},
  publisher = {Springer},
  year      = {2022},
  pages     = {365--396},
  doi       = {10.1007/978-3-031-06944-4_13}
}

@article{howgravegraham2001lattice,
  author  = {Howgrave-Graham, Nick A. and Smart, Nigel P.},
  title   = {Lattice Attacks on Digital Signature Schemes},
  journal = {Designs, Codes and Cryptography},
  year    = {2001},
  volume  = {23},
  number  = {3},
  pages   = {283--290},
  doi     = {10.1023/A:1011214926272}
}

@incollection{breitner2019biased,
  author    = {Breitner, Joachim and Heninger, Nadia},
  title     = {Biased Nonce Sense: Lattice Attacks Against Weak {ECDSA} Signatures in Cryptocurrencies},
  booktitle = {Financial Cryptography and Data Security --- FC 2019},
  series    = {Lecture Notes in Computer Science},
  volume    = {11598},
  publisher = {Springer},
  year      = {2019},
  pages     = {3--20},
  doi       = {10.1007/978-3-030-32101-7_1}
}

@inproceedings{bellare2006multi,
  author    = {Bellare, Mihir and Neven, Gregory},
  title     = {Multi-signatures in the Plain Public-Key Model and a General Forking Lemma},
  booktitle = {Proceedings of the 13th ACM Conference on Computer and Communications Security (CCS 2006)},
  publisher = {ACM},
  year      = {2006},
  pages     = {390--399},
  doi       = {10.1145/1180405.1180453}
}

@article{maxwell2019simple,
  author  = {Maxwell, Gregory and Poelstra, Andrew and Seurin, Yannick and Wuille, Pieter},
  title   = {Simple {S}chnorr Multi-Signatures with Applications to {B}itcoin},
  journal = {Designs, Codes and Cryptography},
  year    = {2019},
  volume  = {87},
  number  = {9},
  pages   = {2139--2164},
  doi     = {10.1007/s10623-019-00608-x}
}

@incollection{nick2021musig2,
  author    = {Nick, Jonas and Ruffing, Tim and Seurin, Yannick},
  title     = {{MuSig2}: Simple Two-Round {S}chnorr Multi-signatures},
  booktitle = {Advances in Cryptology --- CRYPTO 2021},
  series    = {Lecture Notes in Computer Science},
  volume    = {12825},
  publisher = {Springer},
  year      = {2021},
  pages     = {189--221},
  doi       = {10.1007/978-3-030-84242-0_8}
}

@incollection{kocher1996timing,
  author    = {Kocher, Paul C.},
  title     = {Timing Attacks on Implementations of {D}iffie-{H}ellman, {RSA}, {DSS}, and Other Systems},
  booktitle = {Advances in Cryptology --- CRYPTO '96},
  series    = {Lecture Notes in Computer Science},
  volume    = {1109},
  publisher = {Springer},
  year      = {1996},
  pages     = {104--113},
  doi       = {10.1007/3-540-68697-5_9}
}

@incollection{brumley2011remote,
  author    = {Brumley, Billy Bob and Tuveri, Nicola},
  title     = {Remote Timing Attacks Are Still Practical},
  booktitle = {Computer Security --- ESORICS 2011},
  series    = {Lecture Notes in Computer Science},
  volume    = {6879},
  publisher = {Springer},
  year      = {2011},
  pages     = {355--371},
  doi       = {10.1007/978-3-642-23822-2_20}
}

@inproceedings{aldaya2020ladderleak,
  author    = {Aranha, Diego F. and Novaes, Felipe Rodrigues and Takahashi, Akira and Tibouchi, Mehdi and Yarom, Yuval},
  title     = {{LadderLeak}: Breaking {ECDSA} with Less than One Bit of Nonce Leakage},
  booktitle = {Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (CCS 2020)},
  publisher = {ACM},
  year      = {2020},
  pages     = {225--242},
  doi       = {10.1145/3372297.3417268}
}

@article{jancar2020minerva,
  author  = {Jan{\v{c}}ar, J{\'a}n and Sedl{\'a}{\v{c}}ek, Vladim{\'i}r and {\v{S}}venda, Petr and S{\'y}s, Marek},
  title   = {Minerva: The Curse of {ECDSA} Nonces},
  journal = {IACR Transactions on Cryptographic Hardware and Embedded Systems},
  year    = {2020},
  volume  = {2020},
  number  = {4},
  pages   = {281--308},
  doi     = {10.46586/tches.v2020.i4.281-308}
}

@techreport{pornin2013rfc6979,
  author      = {Pornin, Thomas},
  title       = {Deterministic Usage of the Digital Signature Algorithm ({DSA}) and Elliptic Curve Digital Signature Algorithm ({ECDSA})},
  institution = {Internet Engineering Task Force},
  type        = {RFC},
  number      = {6979},
  year        = {2013},
  doi         = {10.17487/RFC6979},
  url         = {https://www.rfc-editor.org/rfc/rfc6979}
}

@misc{wuille2020bip340,
  author       = {Wuille, Pieter and Nick, Jonas and Ruffing, Tim},
  title        = {{BIP} 340: {S}chnorr Signatures for secp256k1},
  howpublished = {Bitcoin Improvement Proposal 340},
  year         = {2020},
  url          = {https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki},
  note         = {Status: Deployed; type: Specification; assigned 2020-01-19}
}

@misc{wuille2020bip341,
  author       = {Wuille, Pieter and Nick, Jonas and Towns, Anthony},
  title        = {{BIP} 341: {T}aproot: {S}eg{W}it Version 1 Spending Rules},
  howpublished = {Bitcoin Improvement Proposal 341},
  year         = {2020},
  url          = {https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki},
  note         = {Status: Deployed; consensus layer (soft fork); requires BIP 340}
}

@misc{nakamoto2008bitcoin,
  author       = {Nakamoto, Satoshi},
  title        = {Bitcoin: A Peer-to-Peer Electronic Cash System},
  howpublished = {White paper},
  year         = {2008},
  url          = {https://bitcoin.org/bitcoin.pdf}
}

@misc{wuille2013libsecp256k1,
  author       = {Wuille, Pieter and Maxwell, Gregory and Nick, Jonas and Ruffing, Tim and others},
  title        = {libsecp256k1: Optimized {C} Library for {ECDSA} and {BIP}-340 Signatures on Curve secp256k1},
  howpublished = {Software, Bitcoin Core project, GitHub},
  year         = {2024},
  url          = {https://github.com/bitcoin-core/secp256k1},
  note         = {The GLV endomorphism $\lambda\cdot(x,y)=(\beta x,y)$ and the scalar split are implemented in \texttt{src/scalar\_impl.h}; accessed 2026-11-01}
}

@techreport{certicom2009sec1,
  author      = {{Certicom Research}},
  title       = {{SEC} 1: Elliptic Curve Cryptography, Version 2.0},
  institution = {Standards for Efficient Cryptography Group},
  year        = {2009},
  month       = may,
  note        = {May 21, 2009},
  url         = {https://www.secg.org/sec1-v2.pdf}
}

@techreport{certicom2010sec2,
  author      = {{Certicom Research}},
  title       = {{SEC} 2: Recommended Elliptic Curve Domain Parameters, Version 2.0},
  institution = {Standards for Efficient Cryptography Group},
  year        = {2010},
  month       = jan,
  note        = {January 27, 2010},
  url         = {https://www.secg.org/sec2-v2.pdf}
}

@techreport{nist2023fips186,
  author      = {{National Institute of Standards and Technology}},
  title       = {Digital Signature Standard ({DSS})},
  institution = {U.S. Department of Commerce},
  type        = {Federal Information Processing Standards Publication},
  number      = {FIPS 186-5},
  year        = {2023},
  month       = feb,
  doi         = {10.6028/NIST.FIPS.186-5}
}

@techreport{nist2015fips180,
  author      = {{National Institute of Standards and Technology}},
  title       = {Secure Hash Standard ({SHS})},
  institution = {U.S. Department of Commerce},
  type        = {Federal Information Processing Standards Publication},
  number      = {FIPS 180-4},
  year        = {2015},
  month       = aug,
  doi         = {10.6028/NIST.FIPS.180-4}
}

@misc{bernstein2014safecurves,
  author       = {Bernstein, Daniel J. and Lange, Tanja},
  title        = {{SafeCurves}: Choosing Safe Curves for Elliptic-Curve Cryptography},
  howpublished = {Web page},
  year         = {2014},
  url          = {https://safecurves.cr.yp.to},
  note         = {Accessed 2026-11-01}
}

@incollection{merkle1989one,
  author    = {Merkle, Ralph C.},
  title     = {One Way Hash Functions and {DES}},
  booktitle = {Advances in Cryptology --- CRYPTO '89},
  series    = {Lecture Notes in Computer Science},
  volume    = {435},
  publisher = {Springer},
  year      = {1990},
  pages     = {428--446},
  doi       = {10.1007/0-387-34805-0_40}
}

@incollection{damgard1989design,
  author    = {Damg{\aa}rd, Ivan Bjerre},
  title     = {A Design Principle for Hash Functions},
  booktitle = {Advances in Cryptology --- CRYPTO '89},
  series    = {Lecture Notes in Computer Science},
  volume    = {435},
  publisher = {Springer},
  year      = {1990},
  pages     = {416--427},
  doi       = {10.1007/0-387-34805-0_39}
}

@incollection{chabaud1998differential,
  author    = {Chabaud, Florent and Joux, Antoine},
  title     = {Differential Collisions in {SHA-0}},
  booktitle = {Advances in Cryptology --- CRYPTO '98},
  series    = {Lecture Notes in Computer Science},
  volume    = {1462},
  publisher = {Springer},
  year      = {1998},
  pages     = {56--71},
  doi       = {10.1007/BFb0055720}
}

@incollection{gilbert2003security,
  author    = {Gilbert, Henri and Handschuh, Helena},
  title     = {Security Analysis of {SHA-256} and Sisters},
  booktitle = {Selected Areas in Cryptography --- SAC 2003},
  series    = {Lecture Notes in Computer Science},
  volume    = {3006},
  publisher = {Springer},
  year      = {2004},
  pages     = {175--193},
  doi       = {10.1007/978-3-540-24654-1_13}
}

@incollection{wang2005finding,
  author    = {Wang, Xiaoyun and Yin, Yiqun Lisa and Yu, Hongbo},
  title     = {Finding Collisions in the Full {SHA-1}},
  booktitle = {Advances in Cryptology --- CRYPTO 2005},
  series    = {Lecture Notes in Computer Science},
  volume    = {3621},
  publisher = {Springer},
  year      = {2005},
  pages     = {17--36},
  doi       = {10.1007/11535218_2}
}

@incollection{stevens2017first,
  author    = {Stevens, Marc and Bursztein, Elie and Karpman, Pierre and Albertini, Ange and Markov, Yarik},
  title     = {The First Collision for Full {SHA-1}},
  booktitle = {Advances in Cryptology --- CRYPTO 2017},
  series    = {Lecture Notes in Computer Science},
  volume    = {10401},
  publisher = {Springer},
  year      = {2017},
  pages     = {570--596},
  doi       = {10.1007/978-3-319-63688-7_19}
}

@inproceedings{leurent2020sha1,
  author    = {Leurent, Ga{\"e}tan and Peyrin, Thomas},
  title     = {{SHA-1} is a Shambles: First Chosen-Prefix Collision on {SHA-1} and Application to the {PGP} Web of Trust},
  booktitle = {29th USENIX Security Symposium (USENIX Security 20)},
  publisher = {USENIX Association},
  year      = {2020},
  url       = {https://www.usenix.org/conference/usenixsecurity20/presentation/leurent},
  note      = {Also IACR Cryptology ePrint Archive, Report 2020/014}
}

@incollection{nikolic2008collisions,
  author    = {Nikoli{\'c}, Ivica and Biryukov, Alex},
  title     = {Collisions for Step-Reduced {SHA-256}},
  booktitle = {Fast Software Encryption --- FSE 2008},
  series    = {Lecture Notes in Computer Science},
  volume    = {5086},
  publisher = {Springer},
  year      = {2008},
  pages     = {1--15},
  doi       = {10.1007/978-3-540-71039-4_1}
}

@incollection{indesteege2008collisions,
  author    = {Indesteege, Sebastiaan and Mendel, Florian and Preneel, Bart and Rechberger, Christian},
  title     = {Collisions and Other Non-random Properties for Step-Reduced {SHA-256}},
  booktitle = {Selected Areas in Cryptography --- SAC 2008},
  series    = {Lecture Notes in Computer Science},
  volume    = {5381},
  publisher = {Springer},
  year      = {2009},
  pages     = {276--293},
  doi       = {10.1007/978-3-642-04159-4_18},
  note      = {Also IACR Cryptology ePrint Archive, Report 2008/131}
}

@incollection{sanadhya2008new,
  author    = {Sanadhya, Somitra Kumar and Sarkar, Palash},
  title     = {New Collision Attacks against Up to 24-Step {SHA-2}},
  booktitle = {Progress in Cryptology --- INDOCRYPT 2008},
  series    = {Lecture Notes in Computer Science},
  volume    = {5365},
  publisher = {Springer},
  year      = {2008},
  pages     = {91--103},
  doi       = {10.1007/978-3-540-89754-5_8},
  note      = {Also IACR Cryptology ePrint Archive, Report 2008/270}
}

@incollection{mendel2011finding,
  author    = {Mendel, Florian and Nad, Tomislav and Schl{\"a}ffer, Martin},
  title     = {Finding {SHA-2} Characteristics: Searching through a Minefield of Contradictions},
  booktitle = {Advances in Cryptology --- ASIACRYPT 2011},
  series    = {Lecture Notes in Computer Science},
  volume    = {7073},
  publisher = {Springer},
  year      = {2011},
  pages     = {288--307},
  doi       = {10.1007/978-3-642-25385-0_16}
}

@incollection{mendel2013improving,
  author    = {Mendel, Florian and Nad, Tomislav and Schl{\"a}ffer, Martin},
  title     = {Improving Local Collisions: New Attacks on Reduced {SHA-256}},
  booktitle = {Advances in Cryptology --- EUROCRYPT 2013},
  series    = {Lecture Notes in Computer Science},
  volume    = {7881},
  publisher = {Springer},
  year      = {2013},
  pages     = {262--278},
  doi       = {10.1007/978-3-642-38348-9_16},
  note      = {Also IACR Cryptology ePrint Archive, Report 2015/350}
}

@incollection{eichlseder2014branching,
  author    = {Eichlseder, Maria and Mendel, Florian and Schl{\"a}ffer, Martin},
  title     = {Branching Heuristics in Differential Collision Search with Applications to {SHA-512}},
  booktitle = {Fast Software Encryption --- FSE 2014},
  series    = {Lecture Notes in Computer Science},
  volume    = {8540},
  publisher = {Springer},
  year      = {2015},
  pages     = {473--488},
  doi       = {10.1007/978-3-662-46706-0_24},
  note      = {Also IACR Cryptology ePrint Archive, Report 2014/302}
}

@incollection{dobraunig2015analysis,
  author    = {Dobraunig, Christoph and Eichlseder, Maria and Mendel, Florian},
  title     = {Analysis of {SHA-512/224} and {SHA-512/256}},
  booktitle = {Advances in Cryptology --- ASIACRYPT 2015},
  series    = {Lecture Notes in Computer Science},
  volume    = {9453},
  publisher = {Springer},
  year      = {2015},
  pages     = {612--630},
  doi       = {10.1007/978-3-662-48800-3_25},
  note      = {Also IACR Cryptology ePrint Archive, Report 2016/374}
}

@incollection{li2024new,
  author    = {Li, Yingxin and Liu, Fukang and Wang, Gaoli},
  title     = {New Records in Collision Attacks on {SHA-2}},
  booktitle = {Advances in Cryptology --- EUROCRYPT 2024},
  series    = {Lecture Notes in Computer Science},
  volume    = {14654},
  publisher = {Springer},
  year      = {2024},
  pages     = {158--186},
  doi       = {10.1007/978-3-031-58716-0_6},
  note      = {Also IACR Cryptology ePrint Archive, Report 2024/349; extended journal version in Journal of Cryptology 39 (2026), article 27, doi:10.1007/s00145-026-09582-9}
}

@incollection{li2024first,
  author    = {Li, Yingxin and Liu, Fukang and Wang, Gaoli and Dong, Xiaoyang and Sun, Siwei},
  title     = {The First Practical Collision for 31-Step {SHA-256}},
  booktitle = {Advances in Cryptology --- ASIACRYPT 2024},
  series    = {Lecture Notes in Computer Science},
  publisher = {Springer},
  year      = {2024},
  pages     = {237--266},
  doi       = {10.1007/978-981-96-0941-3_8}
}

@misc{zhang2026collision,
  author       = {Zhang, Zhuolong and Li, Muzhou and Gao, Lei and Wang, Meiqin},
  title        = {Collision Attacks on {SHA-256} up to 37 Steps with Improved Trail Search},
  howpublished = {IACR Cryptology ePrint Archive, Report 2026/232},
  year         = {2026},
  url          = {https://eprint.iacr.org/2026/232}
}

@incollection{aoki2009preimages,
  author    = {Aoki, Kazumaro and Guo, Jian and Matusiewicz, Krystian and Sasaki, Yu and Wang, Lei},
  title     = {Preimages for Step-Reduced {SHA-2}},
  booktitle = {Advances in Cryptology --- ASIACRYPT 2009},
  series    = {Lecture Notes in Computer Science},
  volume    = {5912},
  publisher = {Springer},
  year      = {2009},
  pages     = {578--597},
  doi       = {10.1007/978-3-642-10366-7_34}
}

@incollection{khovratovich2012bicliques,
  author    = {Khovratovich, Dmitry and Rechberger, Christian and Savelieva, Alexandra},
  title     = {Bicliques for Preimages: Attacks on {Skein-512} and the {SHA-2} Family},
  booktitle = {Fast Software Encryption --- FSE 2012},
  series    = {Lecture Notes in Computer Science},
  volume    = {7549},
  publisher = {Springer},
  year      = {2012},
  pages     = {244--263},
  doi       = {10.1007/978-3-642-34047-5_15},
  note      = {Also IACR Cryptology ePrint Archive, Report 2011/286}
}

@incollection{mironov2006applications,
  author    = {Mironov, Ilya and Zhang, Lintao},
  title     = {Applications of {SAT} Solvers to Cryptanalysis of Hash Functions},
  booktitle = {Theory and Applications of Satisfiability Testing --- SAT 2006},
  series    = {Lecture Notes in Computer Science},
  volume    = {4121},
  publisher = {Springer},
  year      = {2006},
  pages     = {102--115},
  doi       = {10.1007/11814948_13}
}

@incollection{nejati2017adaptive,
  author    = {Nejati, Saeed and Liang, Jia Hui and Gebotys, Catherine and Czarnecki, Krzysztof and Ganesh, Vijay},
  title     = {Adaptive Restart and {CEGAR}-Based Solver for Inverting Cryptographic Hash Functions},
  booktitle = {Verified Software: Theories, Tools, and Experiments --- VSTTE 2017},
  series    = {Lecture Notes in Computer Science},
  volume    = {10712},
  publisher = {Springer},
  year      = {2017},
  pages     = {120--131},
  doi       = {10.1007/978-3-319-72308-2_8}
}

@inproceedings{alamgir2024sha256,
  author    = {Alamgir, Nahiyan and Nejati, Saeed and Bright, Curtis},
  title     = {{SHA-256} Collision Attack with Programmatic {SAT}},
  booktitle = {Joint Proceedings of the 9th Workshop on Practical Aspects of Automated Reasoning (PAAR) and the 9th Satisfiability Checking and Symbolic Computation Workshop (SC-Square)},
  series    = {CEUR Workshop Proceedings},
  volume    = {3717},
  publisher = {CEUR-WS.org},
  year      = {2024},
  pages     = {91--110},
  url       = {https://ceur-ws.org/Vol-3717/},
  note      = {Also arXiv:2406.20072}
}

@inproceedings{biere2020cadical,
  author    = {Biere, Armin and Fazekas, Katalin and Fleury, Mathias and Heisinger, Maximilian},
  title     = {{CaDiCaL}, {Kissat}, {Paracooba}, {Plingeling} and {Treengeling} Entering the {SAT} Competition 2020},
  booktitle = {Proceedings of SAT Competition 2020 --- Solver and Benchmark Descriptions},
  editor    = {Balyo, Tomas and Froleyks, Nils and Heule, Marijn and Iser, Markus and J{\"a}rvisalo, Matti and Suda, Martin},
  series    = {Department of Computer Science Report Series B},
  volume    = {B-2020-1},
  publisher = {University of Helsinki},
  year      = {2020},
  pages     = {50--53}
}

@incollection{biere2024cadical,
  author    = {Biere, Armin and Faller, Tobias and Fazekas, Katalin and Fleury, Mathias and Froleyks, Nils and Pollitt, Florian},
  title     = {{CaDiCaL} 2.0},
  booktitle = {Computer Aided Verification --- CAV 2024},
  series    = {Lecture Notes in Computer Science},
  volume    = {14682},
  publisher = {Springer},
  year      = {2024},
  pages     = {133--152},
  doi       = {10.1007/978-3-031-65627-9_7}
}

@incollection{demoura2008z3,
  author    = {de Moura, Leonardo and Bj{\o}rner, Nikolaj},
  title     = {{Z3}: An Efficient {SMT} Solver},
  booktitle = {Tools and Algorithms for the Construction and Analysis of Systems --- TACAS 2008},
  series    = {Lecture Notes in Computer Science},
  volume    = {4963},
  publisher = {Springer},
  year      = {2008},
  pages     = {337--340},
  doi       = {10.1007/978-3-540-78800-3_24}
}

@incollection{tseitin1983complexity,
  author    = {Tseitin, Grigori S.},
  title     = {On the Complexity of Derivation in Propositional Calculus},
  booktitle = {Automation of Reasoning: 2: Classical Papers on Computational Logic 1967--1970},
  publisher = {Springer},
  year      = {1983},
  pages     = {466--483},
  doi       = {10.1007/978-3-642-81955-1_28},
  note      = {Originally published in 1968 (Russian), translated 1970}
}

@incollection{demoura2021lean,
  author    = {de Moura, Leonardo and Ullrich, Sebastian},
  title     = {The {Lean} 4 Theorem Prover and Programming Language},
  booktitle = {Automated Deduction --- CADE 28},
  series    = {Lecture Notes in Computer Science},
  volume    = {12699},
  publisher = {Springer},
  year      = {2021},
  pages     = {625--635},
  doi       = {10.1007/978-3-030-79876-5_37}
}

@article{boving2025interactive,
  author  = {B{\"o}ving, Henrik and Bhat, Siddharth and Cicolini, Luisa and Keizer, Alex and Frenot, Leon and Mohamed, Abdalrhman and Stefanesco, Leo and Khan, Harun and Clune, Josh and Barrett, Clark and Grosser, Tobias},
  title   = {Interactive Bitvector Reasoning Using Verified Bit-Blasting},
  journal = {Proceedings of the ACM on Programming Languages},
  year    = {2025},
  volume  = {9},
  number  = {OOPSLA2},
  pages   = {3259--3285},
  doi     = {10.1145/3763167},
  note    = {The Lean 4 \texttt{bv\_decide} tactic}
}

@article{fawzi2022discovering,
  author  = {Fawzi, Alhussein and Balog, Matej and Huang, Aja and Hubert, Thomas and Romera-Paredes, Bernardino and Barekatain, Mohammadamin and Novikov, Alexander and Ruiz, Francisco J. R. and Schrittwieser, Julian and Swirszcz, Grzegorz and Silver, David and Hassabis, Demis and Kohli, Pushmeet},
  title   = {Discovering Faster Matrix Multiplication Algorithms with Reinforcement Learning},
  journal = {Nature},
  year    = {2022},
  volume  = {610},
  pages   = {47--53},
  doi     = {10.1038/s41586-022-05172-4}
}

@article{romeraparedes2024mathematical,
  author  = {Romera-Paredes, Bernardino and Barekatain, Mohammadamin and Novikov, Alexander and Balog, Matej and Kumar, M. Pawan and Dupont, Emilien and Ruiz, Francisco J. R. and Ellenberg, Jordan S. and Wang, Pengming and Fawzi, Omar and Kohli, Pushmeet and Fawzi, Alhussein},
  title   = {Mathematical Discoveries from Program Search with Large Language Models},
  journal = {Nature},
  year    = {2024},
  volume  = {625},
  pages   = {468--475},
  doi     = {10.1038/s41586-023-06924-6}
}

@article{davies2021advancing,
  author  = {Davies, Alex and Veli{\v{c}}kovi{\'c}, Petar and Buesing, Lars and Blackwell, Sam and Zheng, Daniel and Toma{\v{s}}ev, Nenad and Tanburn, Richard and Battaglia, Peter and Blundell, Charles and Juh{\'a}sz, Andr{\'a}s and Lackenby, Marc and Williamson, Geordie and Hassabis, Demis and Kohli, Pushmeet},
  title   = {Advancing Mathematics by Guiding Human Intuition with {AI}},
  journal = {Nature},
  year    = {2021},
  volume  = {600},
  pages   = {70--74},
  doi     = {10.1038/s41586-021-04086-x}
}

@article{trinh2024solving,
  author  = {Trinh, Trieu H. and Wu, Yuhuai and Le, Quoc V. and He, He and Luong, Thang},
  title   = {Solving Olympiad Geometry without Human Demonstrations},
  journal = {Nature},
  year    = {2024},
  volume  = {625},
  pages   = {476--482},
  doi     = {10.1038/s41586-023-06747-5}
}

@misc{lu2024ai,
  author       = {Lu, Chris and Lu, Cong and Lange, Robert Tjarko and Foerster, Jakob and Clune, Jeff and Ha, David},
  title        = {The {AI} Scientist: Towards Fully Automated Open-Ended Scientific Discovery},
  howpublished = {arXiv:2408.06292},
  year         = {2024},
  url          = {https://arxiv.org/abs/2408.06292}
}

@misc{novikov2025alphaevolve,
  author       = {Novikov, Alexander and V{\~u}, Ng{\^a}n and Eisenberger, Marvin and Dupont, Emilien and Huang, Po-Sen and Wagner, Adam Zsolt and Shirobokov, Sergey and Kozlovskii, Borislav and others},
  title        = {{AlphaEvolve}: A Coding Agent for Scientific and Algorithmic Discovery},
  howpublished = {arXiv:2506.13131},
  year         = {2025},
  url          = {https://arxiv.org/abs/2506.13131}
}

@incollection{sica2002analysis,
  author    = {Sica, Francesco and Ciet, Mathieu and Quisquater, Jean-Jacques},
  title     = {Analysis of the {G}allant-{L}ambert-{V}anstone Method Based on Efficient Endomorphisms: Elliptic and Hyperelliptic Curves},
  booktitle = {Selected Areas in Cryptography --- SAC 2002},
  series    = {Lecture Notes in Computer Science},
  volume    = {2595},
  publisher = {Springer},
  year      = {2003},
  pages     = {21--36},
  doi       = {10.1007/3-540-36492-7_3}
}

@article{galbraith2011endomorphisms,
  author  = {Galbraith, Steven D. and Lin, Xibin and Scott, Michael},
  title   = {Endomorphisms for Faster Elliptic Curve Cryptography on a Large Class of Curves},
  journal = {Journal of Cryptology},
  year    = {2011},
  volume  = {24},
  number  = {3},
  pages   = {446--469},
  doi     = {10.1007/s00145-010-9065-y}
}

@incollection{galbraith2009endomorphisms,
  author    = {Galbraith, Steven D. and Lin, Xibin and Scott, Michael},
  title     = {Endomorphisms for Faster Elliptic Curve Cryptography on a Large Class of Curves},
  booktitle = {Advances in Cryptology --- EUROCRYPT 2009},
  series    = {Lecture Notes in Computer Science},
  volume    = {5479},
  publisher = {Springer},
  year      = {2009},
  pages     = {518--535},
  doi       = {10.1007/978-3-642-01001-9_30}
}

@article{cheon2012speeding,
  author  = {Cheon, Jung Hee and Hong, Jin and Kim, Minkyu},
  title   = {Accelerating {P}ollard's Rho Algorithm on Finite Fields},
  journal = {Journal of Cryptology},
  year    = {2012},
  volume  = {25},
  number  = {2},
  pages   = {195--242},
  doi     = {10.1007/s00145-010-9093-7},
  note    = {Journal version of ``Speeding up the Pollard rho method on prime fields'', ASIACRYPT 2008, doi:10.1007/978-3-540-89255-7\_29 (tag tracing)}
}

@article{harris1960probability,
  author  = {Harris, Bernard},
  title   = {Probability Distributions Related to Random Mappings},
  journal = {The Annals of Mathematical Statistics},
  year    = {1960},
  volume  = {31},
  number  = {4},
  pages   = {1045--1062},
  doi     = {10.1214/aoms/1177705677}
}

@misc{bailey2009breaking,
  author       = {Bailey, Daniel V. and Batina, Lejla and Bernstein, Daniel J. and Birkner, Peter and Bos, Joppe W. and Chen, Hsieh-Chung and Cheng, Chen-Mou and van Damme, Gauthier and de Meulenaer, Giacomo and Dominguez Perez, Luis Julian and Fan, Junfeng and G{\"u}neysu, Tim and Gurkaynak, Frank and Kleinjung, Thorsten and Lange, Tanja and Mentens, Nele and Niederhagen, Ruben and Paar, Christof and Regazzoni, Francesco and Schwabe, Peter and Uhsadel, Leif and Van Herrewege, Anthony and Yang, Bo-Yin},
  title        = {Breaking {ECC2K-130}},
  howpublished = {IACR Cryptology ePrint Archive, Report 2009/541},
  year         = {2009},
  url          = {https://eprint.iacr.org/2009/541},
  note         = {Describes the planned cross-platform attack; the Certicom challenge document of November 2009 still lists ECC2K-130 as unsolved}
}

@article{stinson2002some,
  author  = {Stinson, Douglas R.},
  title   = {Some Baby-Step Giant-Step Algorithms for the Low {H}amming Weight Discrete Logarithm Problem},
  journal = {Mathematics of Computation},
  year    = {2002},
  volume  = {71},
  number  = {237},
  pages   = {379--391},
  doi     = {10.1090/S0025-5718-01-01310-2}
}

@article{hasse1936theorie,
  author  = {Hasse, Helmut},
  title   = {Zur {T}heorie der abstrakten elliptischen {F}unktionenk{\"o}rper {I}, {II}, {III}},
  journal = {Journal f{\"u}r die reine und angewandte Mathematik},
  year    = {1936},
  volume  = {175},
  pages   = {55--62, 69--88, 193--208},
  doi     = {10.1515/crll.1936.175.55},
  note    = {Parts II and III: doi:10.1515/crll.1936.175.69, doi:10.1515/crll.1936.175.193}
}

@article{deuring1941typen,
  author  = {Deuring, Max},
  title   = {Die {T}ypen der {M}ultiplikatorenringe elliptischer {F}unktionenk{\"o}rper},
  journal = {Abhandlungen aus dem Mathematischen Seminar der Universit{\"a}t Hamburg},
  year    = {1941},
  volume  = {14},
  pages   = {197--272},
  doi     = {10.1007/BF02940746}
}