This is the list of errors for the "Handbook of Elliptic and
Hyperelliptic Curve Cryptography" by Avanzi, Cohen, Doche, Frey,
Lange, Nguyen, and Vercauteren, CRC 2006.
We would like to thank all the readers who pointed out errors to
us. Naturally such a list is always incomplete. If you find mistakes,
typos or would like to point us to missing material, please send an
email to Tanja Lange .
p.7 In the line before the second displayed formula replace
"$c = m^e \bmod n$" by "$c = m^e \bmod N$".
p.40 Proposition 3.6 should end with "$v_p(0)=\infty$".
p.40 Definition 3.7: The first property should be
$v(xy)=v(x)+v(y)$
p.65 Replace "satisfying O_v=O_p" by "satisfying O_v=O_{M_v}".
O_{M_v} is the localization of K[C_a] at M_v.
p.70 bottom line. Replace $a4$ by $a_4$.
p.73 Replace "fixed points P_1 .... P_{2g+2}" by "fixed points P_1
.... P_i with i\leq 2g+2" (for odd characteristic there exist 2g+2
ramification points of w while in characteristic 2 there are at most
g+1 such points.
Replace "The space L(2(g+1)D) has dimension 3g+3. It contains the 3g+4
functions ..." by "The space L(2(g+1)D) has dimension 3g+5. It contains the
3g+6 functions ..."
p.79 The discussion starting with "The space L(D_P+D_Q+P_\infty) has
dimension one by Riemann-Roch" should be replaced by
"The dimension of L(D_P+D_Q+P_\infty )=L(P+Q-P_\infty) is one, and so
there is a function f with poles in P,Q of order one and a zero at
P_infty. Since x_1\neq x_2 we see that div(f ^{-1})=P+Q- R-P_\infty
with $R$ a prime divisor of degree 1 different from P_infty. So D_P
+D_Q is in the same class as R-P_\infty, and R is the sum of P and Q
on E.
It remains to determine R geometrically. Let l be the line l through P
and Q. Then
l(x,y): y-\lambda x-\mu=0.
It has
\lambda=\frac{y_2-y_1}{x_2-x_1} and \mu=y_1-\lambda x_1.
The divisor of l is div(l) =P+Q+ S-3P_\infty with S the third
intersection point of l with E. Hence P+Q+ S -3 P_\infty ~
P+Q-R-P_\infty or S-P_\infty ~ P_\infty-R and S+R-2P_\infty is the
divisor of a function which is a vertical line. Hence R is the point
obtained from S by reflecting at the x-axis."
p.82 l.-2. The definition of $C_{ab}$ curves is missing the highest
power of $y$ and the coefficient is wrong. The correct formula reads:
$$C: \alpha_{b,0}x^b+\alpha_{0,a}y^a+\!\!\!\sum_{ia+jb