Algorithms for algebraic curves and applications to cryptography, II

Size: px

Start display at page:

Download "Algorithms for algebraic curves and applications to cryptography, II"

Theresa Stanley
5 years ago
Views:

1 Algorithms for algebraic curves and applications to cryptography, II J.-M. Couveignes Institut de Mathématiques de Bordeaux & INRIA Bordeaux Sud-Ouest Chern Institute of Mathematics, Nankai University July 2015

2 Deterministic point on elliptic curve Given p, a, b, finding a solution (x, y) F p to y 2 = x 3 + ax + b is Las Vegas probabilistic polynomial. Deterministic polynomial time algorithm? Useful for cryptographic protocols. Shallue, Woestijne, Skalba (2006) : poly. time for any finite field. Icart (2009) : (log q) 2+o(1) for q = 2 mod 3. Geometric construction + finite field trick.

3 Shallue, Woestijne, Skalba Assume K is finite and car(k) 5. Assume E has affine equation y 2 = f(x) with deg(f) = 3. Consider the 3-fold V with equation f(x 1 )f(x 2 )f(x 3 ) = y 2. This is a (Z/2Z) 2 quotient of E 3. Skalba constructs a map A 1 V. Shallue, Woestijne : given non-zero elements b, a 1, a 2, a 3 in K such that b 2 = a 1 a 2 a 3 one can find some i {1, 2, 3} and a square root of a i in deterministic polynomial time in log q.

4 Given x (Z/pZ) define Computing roots v(x) = v 2 (ord(x)). If p 1 = 2 e q with q odd then 0 v(x) e. If v(x) = e then x is not a square. If v(x) = 0 then computing a square-root is trivial. Set G k = {x (Z/pZ) v(x) k}. We have and G k+1 /G k Z/2Z. G 0 G 1 G e 1 G e = (Z/pZ)

5 Computing roots v(x) = v 2 (ord(x)) If p 1 = 2 e q with q odd then 0 v(x) e. Set G k = {x (Z/pZ) v(x) k}. We have and G k+1 /G k Z/2Z. G 0 G 1 G e 1 G e = (Z/pZ) Example p = 103 and x = 46. So p 1 = 2.51 and 0 v(x) 1. We check that mod 103 so 46 is a square modulo 103 and v(x) = 0. Since 1/2 mod 51 = 26, we compute y = x 26 mod 103 = 46 mod 103 using fast exponentiation.

6 Computing roots p = 101 and x = 13 mod 101. Now p 1 = so 0 v(x) 2. Check that x 50 1 mod 101 so x is a square and v(x) < 2. Check that x 25 = 1 so v(x) = 1. Auxiliary z = 46, a non-square modulo 101. Indeed z 50 = 1 mod 101. So v(z) = 2. And v(z 2 ) = 1. Set X = xz 2 = 36 mod 101 and check that X 25 = x 25 z 50 = 1 mod 101 so v(x) = 0. Compute a square root Y of X as Y = X 1/2 = X 13 = 95 mod 101. Set y = Yz 1 and check that y 2 = Y 2 z 2 = Xz 2 = x. So y = 95/46 = 35 mod 101 is a square-root of x. Woestijne : if we know some z with v(z) > v(x) then we can deterministically compute a square-root of x.

7 Shallue and Woestijne Given non-zero elements b, a 1, a 2, a 3 in Z/pZ such that b 2 = a 1 a 2 a 3 one can find some i {1, 2, 3} and a square root of a i in deterministic polynomial time in log q. If v(a 1 ) > v(a 2 ) we can compute a square root of a 2. If v(a 1 ) = v(a 2 ) = v(a 3 ) then v(a 1 a 2 ) < v(a 1 ) and we can compute a square root c of a 1 a 2. Then (b/c) 2 = a 3.

8 Farashahi and Icart Find P C with x P, y P K(t, 3 R(t)). This is a parameterization by a cubic radical. If q = #K odd and q 2 mod 3 then set λ = (q 2)/3 and check x 1 3 = x λ for x K. Examples of parameterizations by Icart, Kammerer, Lercier, Renault, Farashahi. Interresting topic in itself. Special case y 2 = x is trivial. Not so simple in general x 3 + ax + b y 2 = 0.

9 Contents 1 Solving cubic equations, 2 Duality in the projective plane, 3 A general recipe, 4 The geometry of flex tangents to a cubic, 5 Old and new parameterizations, 6 Rational curves on a K3 surface.

10 Tartaglia, Cardan, Viète,... Let K with car(k) {2, 3}. Choose ζ 3 K. Consider h(x) = x 3 s 1 x 2 + s 2 x s 3 K[x] with h(x) = (x r 0 )(x r 1 )(x r 2 ) K[x]. Set δ = 3(r 1 r 0 )(r 2 r 1 )(r 0 r 2 ). So = δ 2 = 81s s 3s 1 s 2 3s 2 1 s s3 1 s s 3 2 K.

11 Tartaglia, Cardan, Viète,... Set L = K(ζ 3,δ) K and M = L(r 1, r 2, r 0 ) K. Assume L M and apply Kummer theory. Let σ Gal(M/L) with σ(r i ) = r i+1. Set ρ = r 0 +ζ 1 3 r 1 +ζ 2 3 r 2. So σ(ρ) = ζ 3 ρ, thus R = ρ 3 is invariant by σ. Indeed Similarly R = ρ 3 = s s s 1s δ. ρ = r 0 +ζ 3 r 1 +ζ 2 3 r 2 and R = ρ 3 = s s s 1s δ. Bonus ρρ = r r r 2 2 r 0r 1 r 1 r 2 r 2 r 0 = s 2 1 3s 2.

12 Summary : Tartaglia, Cardan, Viète,... = δ 2 = 81s s 3s 1 s 2 3s 2 1 s s3 1 s s 3 2, R = ρ 3 = s s s 1s δ, ρρ = r r r 2 2 r 0r 1 r 1 r 2 r 2 r 0 = s 2 1 3s 2, And does not involve ζ 3. r 0 + r 1 + r 2 = s 1 r 0 +ζ 1 3 r 1 +ζ 3 r 2 = ρ r 0 +ζ 3 r 1 +ζ 1 3 r 2 = ρ r 0 = s 1 +ρ+ρ 3

13 Viète Algebraic geometrist, cryptographer, politician. Use of letters as parameters in equations, Cryptanalysis, Algebraic equations.

14 Duality in the projective plane Let E = K 3 and Ê its dual. U = (1, 0, 0), V = (0, 1, 0), W = (0, 0, 1), canonical basis of E, and (X, Y, Z) the dual basis. Set P = Proj(E) = Proj K[X, Y, Z] and ˆP = Proj(Ê) = Proj K[U, V, W]. The point [U : V : W] ˆP represents the line with equation UX + VY + WZ = 0 P.

15 Dual of a plane curve Let C P with equation F(X, Y, Z) = 0. Set F X = F X, F Y = F Y, F Z = F Z. Tangent at P has equation F X (X P, Y P, Z P )U + F Y (X P, Y P, Z P )V + F Z (X P, Y P, Z P )W = 0. The corresponding point in ˆP is Gauss map [F X (X P, Y P, Z P ) : F Y (X P, Y P, Z P ) : F Z (X P, Y P, Z P )]. ω C : C ˆP [X : Y : Z] [F X (X, Y, Z) : F Y (X, Y, Z) : F Z (X, Y, Z)] The dual curve Ĉ = ω C(C).

16 Dual of a cubic Assume F(X, Y, Z) = X 3 + Y 3 + Z 3 3aXYZ, then F X = 3X 2 3aYZ, F Y = 3Y 2 3aXZ, F Z = 3Z 2 3aXY. The dual Ĉ = ω C(C) has degree 6, 9 cusps, and equation G(U, V, W) = U 6 + V 6 + W 6 6a 2 (U 4 VW + UV 4 W + UVW 4 ) +(4a 3 2)(U 3 V 3 + U 3 W 3 + V 3 W 3 )+(12a 3a 4 )U 2 V 2 W 2.

17 An example The cubic X 3 + Y 3 + Z 3 = 0 and the sextic U 6 + V 6 + W 6 2U 3 V 3 2V 3 W 3 2U 3 W 3 = 0.

18 Flexes F(X, Y, Z) = X 3 + Y 3 + Z 3 3aXYZ, ω C : (X : Y : Z) (X 2 ayz : Y 2 axz : Z 2 axy) Flexes of C Cusps of Ĉ (0 : 1 : 1) (a : 1 : 1) ( 1 : 1 : 0) (1 : 1 : a) (1 : 0 : 1) (1 : a : 1) ( 1 : ζ 3 : 0) (ζ3 2 : ζ 3 : a) (ζ 3 : 0 : 1) (ζ 3 : a : ζ3 2) (0 : 1 : ζ 3 ) (a : ζ3 2 : ζ 3) (ζ 3 : 1 : 0) (ζ 3 : ζ3 2 : a) ( 1 : 0 : ζ 3 ) (ζ3 2 : a : ζ 3) (0 : ζ 3 : 1) (a : ζ 3 : ζ3 2)

19 Automorphisms The sextic Ĉ with equation U 6 + V 6 + W 6 2U 3 V 3 2V 3 W 3 2U 3 W 3 = 0. σ 1 : [U : V : W] [V, W, U], σ 2 : [U : V : W] [U,ζ 3 V,ζ 2 3 W], σ 3 : [U : V : W] [V, U, W]. < σ 1,σ 2 > acts simply transitively on the 9 cusps.

20 Pseudo-parameterization of a cubic Assume a a 3 is surjective. Let a 3 a a section. We look for K C(K). General recipe : find a line D P and compute D.C. Hope there is a rational point in this intersection, and we can compute it. If D has equation UX + VY + WZ = 0, the intersection D.C is given by a binary cubic form. The only obstacle to the existence of a rational point in the intersection is the discriminant (U, V, W). This (U, V, W) is the equation of the dual curve Ĉ.

21 Pseudo-parameterization of a cubic Restrict to a well chosen family of lines (D t ) t with equation U(t)X + V(t)Y + W(t)Z = 0. This family of lines corresponds to a rational curve L ˆP. This is the image in ˆP of φ : t [U(t) : V(t) : W(t)]. We ask that the discriminant (U(t), V(t), W(t)) be a square in K(t). A rough geometric interpretation of this condition is that the unicursal curve L intersect Ĉ with all even multiplicities. So we look for a unicursal curve L ˆP having even intersection with Ĉ.

22 Flexes F(X, Y, Z) = X 3 + Y 3 + Z 3 3aXYZ, ω C : (X : Y : Z) (X 2 ayz : Y 2 axz : Z 2 axy) Flexes of C Cusps of Ĉ (0 : 1 : 1) (a : 1 : 1) ( 1 : 1 : 0) (1 : 1 : a) (1 : 0 : 1) (1 : a : 1) ( 1 : ζ 3 : 0) (ζ3 2 : ζ 3 : a) (ζ 3 : 0 : 1) (ζ 3 : a : ζ3 2) (0 : 1 : ζ 3 ) (a : ζ3 2 : ζ 3) (ζ 3 : 1 : 0) (ζ 3 : ζ3 2 : a) ( 1 : 0 : ζ 3 ) (ζ3 2 : a : ζ 3) (0 : ζ 3 : 1) (a : ζ 3 : ζ3 2)

23 The coconics Lemma Let C a plane cubic over K with p {2, 3}. Assume j 0. Remove three colinear flex points. The tangents at the six remaining points are coconic. The conic UW av 2 = 0 meets Ĉ at (a : 1 : 1), (1 : 1 : a), (ζ3 2 : ζ 3 : a), (a : ζ3 2 : ζ 3), (ζ 3 : ζ3 2 : a), (a : ζ 3 : ζ3 2). (1 : 0 : 1), (ζ 3 : 0 : 1), (1 : 0 : ζ 3 ) lye on Y = 0. U 2 + V 2 + W 2 +(a+1)(uv + UW + VW) = 0, and X + Y + Z = 0. U 2 +ζ 3 V 2 +ζ3 2W 2 +(a+1)(ζ3 2UV +ζ 3UW + VW) = 0 and X +ζ 3 Y +ζ3 2Z = 0. ζ 3 U 2 + V 2 3 W 2 +(a+ζ3 2)(UV +ζ2 3UW + VW) = 0 and ζ 3 X + Y +ζ 3 Z = 0.

24 The coconics again Let C the Hessian cubic with a 3 1. Let L the conic UW av 2 = 0. Let U(t) = 1, V(t) = t, W(t) = at 2 a parameterization. The line D t is X ty + at 2 Z = 0. Replacing X by ty at 2 Z in the equation of C we find (t 3 + 1)Y 3 3at(t 3 + 1)Y 2 Z + 3a 2 t 2 (t 3 + 1)YZ 2 +(1 a 3 t 6 )Z 3 and (t) = ( 9(1+a 3 t 3 ) 1+t 3 ) 2. s 1 = 3at, s 2 = 3a 2 t 2, s 3 = a3 t 6 1 t 3 + 1, δ = 9(1+a3 t 3 ) 1+t 3, R = 27 a3 t t 3 + 1, R = 0, a y = at 3 t t 3 + 1, x = X/Z = ty a at2 = t 3 t t

25 A nice quartic Lemma C a smooth plane cubic over K with p {2, 3}. Assume j 0. Let Ô a cusp on Ĉ. There is a rational quartic Q that cuts Ĉ at Ô with multiplicity 8 and the 8 remaining cusps with multiplicity 2. U 4 +a(v 4 +W 4 ) 2a(U 3 V+U 3 W+V 3 W+VW 3 ) (a 3 +1)U(V 3 +W 3 )+3a 2 U 2 (V 2 +W 2 )+ (a 4 +2a)V 2 W 2 +(1 a 3 )UVW(V+W)=0. U(t) = a 2 t 4 2at 3 +(a 3 +2)t 2 2a 2 t+a, V(t) = a 4 t 4 +(1 3a 3 )t 3 +3a 2 t 2 2at+1, W(t) = at 4 (a 3 +1)t 3 +3a 2 t 2 2at+1. G(U(t),V(t),W(t))= t 6 (t+1) 2 (t 2 t+1) 2 (at 2) 2 ((a+1)t 1) 2 ((a 2 a+1)t 2 +(1 2a)t+1) 2 (a 2 t 2 +1 at) 2.

26 Weierstrass cubic C the cubic F(X, Y, Z) = Y 2 Z X 3 axz 2 bz 3, with a 0, O = (0 : 1 : 0) and Ô = (0 : 0 : 1). Then Q is U 4 3V 4 + 6UV 2 W = 0, and U(t) = 6t 2, (1) V(t) = 6t 3, W(t) = 3at 4 1.

27 The quartic again Let C the Weierstrass cubic. Let L the quartic Q. The line D t is 6t 2 X + 6t 3 Y +(3at 4 1)Z = 0. Set x = X/Z, y = Y/Z and substitute y by 1/(6t 3 ) at/2 x/t in the Weierstrass equation. We find x 3 s 1 x 2 + s 2 x s 3 with s 1 = 1/t 2, s 2 = 1/(3t 4 ), s 3 = (1/t 6 6a/t 2 36b + 9a 2 t 2 )/36, δ = ( 1/t 6 108b 18a/t a 2 t 2 )/12, R = 0, R = ( 1/t 6 108b 18a/t a 2 t 2 )/4, x = 1 a 3t t t 6 b a 6t 2, y = Y/Z = 1 6t 3 at/2 x/t.

28 Rational curves on a surface We have constructed solutions (u, v, h) to h 2 = G(u, v, 1), (2) where u = U(t)/W(t), v = V(t)/W(t), h = δ(t)/w 3 (t) in K(t). We call S the minimal model of the surface in Equation (2). Blow up ˆP at each of the 9 cusps of Ĉ. Let S be the normal closure in k(a)(u, v, h). Call E i, F i the two components above the i-th cusp. Let H be the inverse image by S ˆP of any line in ˆP. S is a K3 surface : q = 0 and K S = 0.

29 K3 surfaces ) ( ) q = dim C (H 1 (S,O S ) = dim C H 0 (S,Ω S ) = 1 2 dim R(H 1 (S,R)) = b 1 2 = 0. A = H 1 (S,O S )/ H 1 (S,Z) = 0. 0 A Pic(S) NS(S) 0. χ(o S ) = h 0 (O S ) h 1 (O S )+h 2 (O S ) = 1 q + h 0 (O S (K)) = 2. Nœther formula χ(o S ) = 1 ( 12 K 2 +χ top (S) ) implies χ top (S) = 24 and b 2 = 22 and r = dim(ns(s) Z R) 22.

30 Rational curves on K3 surfaces We are looking for rational curves on S. The Néron-Severi group NS(S) classifies divisors on S up to algebraic (linear) equivalence. It is a free Z-module with rank 22. There is a quadratic (intersection) form. Over Z[1/6, a] this rank is 19. According to the genus formula 2g(C) 2 = C.C + C.K S, smooth rational curves have self intersection 2. Compute intersections.

31 Intersection multiplicities E i.f i = 1, E 2 i = 2, F 2 i = 2, E i.e j = 0 for i j, E i.f j = 0 for i j, E i.h = 0, F i.h = 0, H 2 = 2. Discriminant If we add the rational curves constructed above...

32 Nice curves The 12 conics give rise to 24 rational curves. One of them has class I 0,1,2,3,4,5 where 3I 0,1,2,3,4,5 = 3H 2(E 0 + E 1 + E 2 ) (F 1 + F 2 + F 3 ) (E 3 + E 4 + E 5 ) 2(F 3 + F 4 + F 5 ). The 9 quartics gives rise to 18 rational curves. One of them has class J 0 such that 3J 0 = 6H 5E 0 4F 0 (2E i + F i ). 1 i 8 The resulting lattice has dimension 19 and discriminant 54. This is NS(S) generically.

33 Elliptic Fibration The set of classes with self intersection 2 is not a group but... Let D a generic line in ˆP through B 0. The intersection D.Ĉ is 2B 0 plus an effective degree four divisor. So the inverse image of D in S is the union of E 0, F 0 and a genus one curve with at least two rational points : the intersection points with E 0 and F 0. Elliptic fibration f : S P 1 of S, with two sections E 0 and F 0. S is an elliptic K3 surface. Any section of f is a smooth rational curve on S.

34 The Mordell-Weil group The Mordell-Weil group of the generic fiber of f is isomorphic to NS(S)/T. Since E i + F i + G i = H E 0 F 0 does not depend on i for 1 i 8, the rank of T is 18 and the rank of NS(S) is one. There are infinitely many rational curves on S. U(t) = 4at 6 + 4t 2 /27, (3) V(t) = t(4at 6 + 4t 2 /27), W(t) = a 2 t 8 + 2at 4 /27+4bt 6 + 1/81.

35 Another example One more rational curve having even intersection with Ĉ.

The geometry of flex tangents to a cubic curve and its parameterizations

The geometry of flex tangents to a cubic curve and its parameterizations Jean-Marc Couveignes, Jean-Gabriel Kammerer To cite this version: Jean-Marc Couveignes, Jean-Gabriel Kammerer. The geometry of flex