Computing the endomorphism ring of an ordinary elliptic curve
|
|
- Jayson Sherman
- 5 years ago
- Views:
Transcription
1 Computing the endomorphism ring of an ordinary elliptic curve Massachusetts Institute of Technology April 3, 2009 joint work with Gaetan Bisson
2 Elliptic curves An elliptic curve E/F is a smooth projective curve of genus 1 with a distinguished rational point 0. The set E(F) of rational points on E form an abelian group. For char(f) 2, 3 we define E with an affine equation y 2 = x 3 + Ax + B, where 4A B 2 0. The j-invariant of E is j(e) = A 3 4A B 2. If F = F then j(e) uniquely identifies E (but not in F q ).
3 Elliptic curves over finite fields Consider F = F q. The size of the group E(F q ) is #E(F q ) = q + 1 t, for some integer t with t 2 q. The SEA algorithm computes t in polynomial time (very fast in practice). Typically t is nonzero in F q, in which case E is called ordinary. Some useful facts about t = t(e): 1. t(e 1 ) = t(e 2 ) E 1 and E 2 are isogenous. 2. j(e 1 ) = j(e 2 ) and t(e 1 ) = t(e 2 ) E 2 = E2. 3. j(e 1 ) = j(e 2 ) = t(e 1 ) = t(e 2 ) for j(e 1 ) / {0, 12 3 }.
4 Maps between elliptic curves An isogeny φ : E 1 E 2 is a rational map (defined over F) with φ(0) = 0. It induces a homomorphism from E 1 (F) to E 2 (F). The endomorphism ring End(E) contains all φ : E E. We have Z End E, but for F = F q, equality never holds. If E/F q is ordinary, then End(E) = O(D) where O(D) = Z + D + D Z 2 is the imaginary quadratic order of some discriminant D. We want to compute D.
5 The Frobenius endomorphism The endomorphism π : (x, y) (x q, y q ) on E(F q ) satisfies π 2 tπ + q = 0. If we set D π = t 2 4q and fix an isomorphism End E = O(D) we may regard π = t+ D π 2 as an element of O(D). Thus O(D π ) O(D), which implies D D π and that D and D π have the same fundamental discriminant D K. By factoring D π = v 2 D K we may determine D K and v. We then have D = u 2 D K for some u v. We want to compute u. This is easy if v is small (or smooth), but may be hard if not.
6 Computing isogenies We call a (separable) isogeny φ an l-isogeny if # ker φ = l. We restrict to prime l, in which case ker φ is cyclic. The classical modular polynomial Φ l Z[X, Y ] has the property Φ l ( j(e1 ), j(e 2 ) ) = 0 E 1 and E 2 are l-isogenous. The l-isogeny graph G l (F q ) has vertex set E(F q ) = {j(e/f q )} = F q, and edges (j 1, j 2 ) for Φ l (j 1, j 2 ) = 0 (note Φ l is symmetric). Φ l is big: O(l 3+ɛ ) bits.
7 The structure of the l-isogeny graph [Kohel] The connected components of G l (F q ) are l-volcanoes. An l-volcano of height h has vertices in level V 0,..., V h. Vertices in V 0 have endomorphism ring O(D 0 ) with l u 0. Vertices in V k have endomorphism ring O(l 2k D 0 ). 1. The subgraph on V 0 is a cycle (the surface). All other edges lie between V k and V k+1 for some k. 2. For k > 0 each vertex in V k has one neighbor in V k For k < h every vertex in V k has degree l + 1. See [Kohel 1996], [Fouquet-Morain 2002], or [S 2009] for more details.
8 A 3-volcano of height 2 with a 4-cycle
9 Algorithms to compute u Isogeny climbing: computes l-isogenies for prime l v to determine the power of l dividing u in. Probabilistic complexity O(q 3/2+ɛ ). Kohel s algorithm: computes the kernel of n-isogenies, where n = O(q 1/6 ) need not be a divisor of v. Deterministic complexity O(q 1/3+ɛ ) (GRH). New algorithm: computes the cardinality of smooth relations using isogenies of subexponential degree. Probabilistic complexity L[1/2, 3/2](q) (GRH+). ( L [α, c] (x) = exp (c + o(1)) (log x) α (log log x) 1 α). All algorithms have unconditionally correct output.
10 The action of the class group [CM theory] For an invertible ideal a O D = End(E), let E[a] be the subgroup of points annihilated by all a a. The map j(e) j(e/e[a]) corresponds to an isogeny of degree N(a). This defines a group action by the ideal group on the set {j(e/f q ) : End(E) = O(D)}. This action factors through the class group cl(o(d)) = cl(d). The action is faithful and transitive. See the books of [Cox], [Lang], or [Silverman] for more on CM theory.
11 Walking isogeny cycles ( ) If l v and D l = 1, the l-volcano containing j(e) is a cycle of length α, where α cl(d) contains an ideal of norm l. We can compute α (without knowing D) by walking a path j 0, j 1,... in G l (F q ) starting from j 0 = j(e): 1. Let j 1 be one of the two roots of Φ l ( X, j0 ) in Fq. 2. Let j k+1 be the unique root of Φ l ( X, jk ) /(X jk 1 ) in F q. The choice of j 1 is arbitrary (we cannot distinguish α and α 1 ). In either case, α (and α 1 ) is the least n for which j n = j 0. Step 2 finds the unique root of a degree l polynomial f (X) over F q. Complexity is T (l) = O(l 2 + M(l) log q) operations in F q.
12 Computing End(E) with class groups (naïvely) Given E/F q, let #E = q + 1 t and 4q = t 2 v 2 D K, so that End(E) = O(D) where D = u 2 D K for some u v. If u 1,..., u m are the divisors of v, then u = u i for some i. Pick any l v satisfying ( DK l ) = 1. For each D i = u 2 i D K there is an element α i cl(d i ) containing an ideal of norm l, but α i typically varies with i. We can compare α i to the length of the l-isogeny cycle containing j(e). These must be equal if u = u i. This is too slow, but we can exploit this idea.
13 Relations A relation R is a pair of vectors (l 1,..., l k ) and (e 1,..., e k ). We say R holds in cl(d) if for each i there is an α i cl(d) containing an ideal of norm l i such that α e 1 1 αe k k = 1. More generally, we define the cardinality of R in cl(d) by { #R/D = # τ {±1} k : } α τ i e i i = 1 in cl(d). #R/D does not depend on the choice of α i.
14 Counting relations Given a relation R with (l 1,..., l k ) and (e 1,..., e k ): 1. Set J 0 be a list containing the single element j(e). 2. For each element in J i walk e i steps in both directions of the l i cycle and append the two end points to the list J i #R/E is the number of times j(e) appears in the list J k. The complexity is k i=1 2i e i T (l i ) operations in F q.
15 The key lemma Lemma: If O(D 1 ) O(D 2 ) then #R/D 1 #R/D 2. Proof: There is a norm-preserving map from O(D 1 ) to O(D 2 ) that induces a group homomorphism from cl(d 1 ) to cl(d 2 ). Corollary: Let p v and set D 1 = (v/p) 2 D K and D 2 = p 2 D K. Let R be a relation with #R/D 1 > #R/D 2. If u is the conductor of O(D) = End(E) then Theorem: Such an R exists. p u #R/E < #R/D 1. Conjecture: Almost all R that hold in cl(d 1 ) don t hold in cl(d 2 ).
16 Algorithm to compute End(E) Given E/F q, the following algorithm computes D = u 2 D K, the discriminant of the order isomorphic to End(E). 1. Compute t = q + 1 #E, v, and D k, with 4q = t 2 v 2 D K. 2. For primes p v, find a relation R satisfying the corollary. Count #R/E in the isogeny graph to test whether p u. 3. Output u 2 D K. The algorithm above assumes v is square-free.
17 Finding smooth relations The following algorithm is adapted from Hafner/McCurley. We seek a smooth relation in cl(d 1 ). Pick a smoothness bound B and a small constant k 0 (say 3). 1. Let l 1,..., l n be the primes up to B with ( D1 l i ) = 1, and let α i cl(d 1 ) contain an ideal of norm l i. 2. Generate β = α x i i where all but k 0 of the x i are zero and the other x i are suitably bounded. 3. For each β, test whether N(b) is B-smooth, where b is a the reduced representative of β. 4. If so write α x i i = α y i i and compute R. Verify that #R/D 1 > #R/D 2 (almost always true). For suitable B, the complexity is L[1/2, 3/2]( D )
18 An example of cryptographic size (200 bits) We have 4q = t 2 v 2 D K where t = 212, D K = 7 and v = }{{} }{{} p 1 p 2. After finding 2 u and 127 u we test p 1 u by computing R 1 = (2 2533, , 29 2, 37 47, 79 1, 113 1, 149 1, 151 2, 347 1, ), which holds in cl(p 2 2 D K ) but not cl(p 2 1 D K ).We test p 2 u using R 2 = (2 23, 11 5, 43 1, 71 2 ), which holds in cl(p 2 1 D K ) but not in cl(p 2 2 D K ). Total time to compute End(E) is under 30 minutes
19 Certifying the endomorphism ring To verify a claimed value of u, it suffices to have a relation R p for each prime divisor of v such that: 1. For each prime p (v/u), we have #R p /E > #R p /p 2 D K. 2. For each prime p u, we have #R p /(u/p) 2 D K > #R p /E. Certificate size is O(log 2+ɛ q). Note that either D 1 u 2 D K or D 1 = (u/p) 2 D K. We always have D 1 D. Very useful when D D π. This yields an algorithm to compute u with complexity L [1/2 + o(1), 1] ( D ) + L [1/3, c] (q) which depends primarily on D, not q.
Modular polynomials and isogeny volcanoes
Modular polynomials and isogeny volcanoes Andrew V. Sutherland February 3, 010 Reinier Bröker Kristin Lauter Andrew V. Sutherland (MIT) Modular polynomials and isogeny volcanoes 1 of 9 Isogenies An isogeny
More informationComputing modular polynomials with the Chinese Remainder Theorem
Computing modular polynomials with the Chinese Remainder Theorem Andrew V. Sutherland Massachusetts Institute of Technology ECC 009 Reinier Bröker Kristin Lauter Andrew V. Sutherland (MIT) Computing modular
More informationComputing the modular equation
Computing the modular equation Andrew V. Sutherland (MIT) Barcelona-Boston-Tokyo Number Theory Seminar in Memory of Fumiyuki Momose Andrew V. Sutherland (MIT) Computing the modular equation 1 of 8 The
More informationElliptic Curves Spring 2015 Lecture #23 05/05/2015
18.783 Elliptic Curves Spring 2015 Lecture #23 05/05/2015 23 Isogeny volcanoes We now want to shift our focus away from elliptic curves over C and consider elliptic curves E/k defined over any field k;
More informationIdentifying supersingular elliptic curves
Identifying supersingular elliptic curves Andrew V. Sutherland Massachusetts Institute of Technology January 6, 2012 http://arxiv.org/abs/1107.1140 Andrew V. Sutherland (MIT) Identifying supersingular
More informationElliptic curve cryptography in a post-quantum world: the mathematics of isogeny-based cryptography
Elliptic curve cryptography in a post-quantum world: the mathematics of isogeny-based cryptography Andrew Sutherland MIT Undergraduate Mathematics Association November 29, 2018 Creating a shared secret
More informationExplicit Complex Multiplication
Explicit Complex Multiplication Benjamin Smith INRIA Saclay Île-de-France & Laboratoire d Informatique de l École polytechnique (LIX) Eindhoven, September 2008 Smith (INRIA & LIX) Explicit CM Eindhoven,
More information14 Ordinary and supersingular elliptic curves
18.783 Elliptic Curves Spring 2015 Lecture #14 03/31/2015 14 Ordinary and supersingular elliptic curves Let E/k be an elliptic curve over a field of positive characteristic p. In Lecture 7 we proved that
More informationIsogenies in a quantum world
Isogenies in a quantum world David Jao University of Waterloo September 19, 2011 Summary of main results A. Childs, D. Jao, and V. Soukharev, arxiv:1012.4019 For ordinary isogenous elliptic curves of equal
More informationOn the evaluation of modular polynomials
On the evaluation of modular polynomials Andrew V. Sutherland Massachusetts Institute of Technology ANTS X July 10, 2012 http://math.mit.edu:/ drew 1 / 16 Introduction Let l be a prime and let F q be a
More informationIsogeny graphs of abelian varieties and applications to the Discrete Logarithm Problem
Isogeny graphs of abelian varieties and applications to the Discrete Logarithm Problem Chloe Martindale 26th January, 2018 These notes are from a talk given in the Séminaire Géométrie et algèbre effectives
More informationIntroduction to Arithmetic Geometry Fall 2013 Lecture #24 12/03/2013
18.78 Introduction to Arithmetic Geometry Fall 013 Lecture #4 1/03/013 4.1 Isogenies of elliptic curves Definition 4.1. Let E 1 /k and E /k be elliptic curves with distinguished rational points O 1 and
More informationConstructing genus 2 curves over finite fields
Constructing genus 2 curves over finite fields Kirsten Eisenträger The Pennsylvania State University Fq12, Saratoga Springs July 15, 2015 1 / 34 Curves and cryptography RSA: most widely used public key
More informationMappings of elliptic curves
Mappings of elliptic curves Benjamin Smith INRIA Saclay Île-de-France & Laboratoire d Informatique de l École polytechnique (LIX) Eindhoven, September 2008 Smith (INRIA & LIX) Isogenies of Elliptic Curves
More informationComputing the image of Galois
Computing the image of Galois Andrew V. Sutherland Massachusetts Institute of Technology October 9, 2014 Andrew Sutherland (MIT) Computing the image of Galois 1 of 25 Elliptic curves Let E be an elliptic
More informationarxiv: v3 [math.nt] 7 May 2013
ISOGENY VOLCANOES arxiv:1208.5370v3 [math.nt] 7 May 2013 ANDREW V. SUTHERLAND Abstract. The remarkable structure and computationally explicit form of isogeny graphs of elliptic curves over a finite field
More informationClass invariants by the CRT method
Class invariants by the CRT method Andreas Enge Andrew V. Sutherland INRIA Bordeaux-Sud-Ouest Massachusetts Institute of Technology ANTS IX Andreas Enge and Andrew Sutherland Class invariants by the CRT
More informationON ISOGENY GRAPHS OF SUPERSINGULAR ELLIPTIC CURVES OVER FINITE FIELDS
ON ISOGENY GRAPHS OF SUPERSINGULAR ELLIPTIC CURVES OVER FINITE FIELDS GORA ADJ, OMRAN AHMADI, AND ALFRED MENEZES Abstract. We study the isogeny graphs of supersingular elliptic curves over finite fields,
More informationGenus 2 Curves of p-rank 1 via CM method
School of Mathematical Sciences University College Dublin Ireland and Claude Shannon Institute April 2009, GeoCrypt Joint work with Laura Hitt, Michael Naehrig, Marco Streng Introduction This talk is about
More informationIsogeny graphs, modular polynomials, and point counting for higher genus curves
Isogeny graphs, modular polynomials, and point counting for higher genus curves Chloe Martindale July 7, 2017 These notes are from a talk given in the Number Theory Seminar at INRIA, Nancy, France. The
More informationA Candidate Group with Infeasible Inversion
A Candidate Group with Infeasible Inversion Salim Ali Altuğ Yilei Chen September 27, 2018 Abstract Motivated by the potential cryptographic application of building a directed transitive signature scheme,
More informationCOMPUTING MODULAR POLYNOMIALS
COMPUTING MODULAR POLYNOMIALS DENIS CHARLES AND KRISTIN LAUTER 1. Introduction The l th modular polynomial, φ l (x, y), parameterizes pairs of elliptic curves with an isogeny of degree l between them.
More informationJournal of Number Theory
Journal of Number Theory 131 (2011) 815 831 Contents lists available at ScienceDirect Journal of Number Theory www.elsevier.com/locate/jnt Special Issue: Elliptic Curve Cryptography Computing the endomorphism
More informationElliptic Curves Spring 2015 Lecture #7 02/26/2015
18.783 Elliptic Curves Spring 2015 Lecture #7 02/26/2015 7 Endomorphism rings 7.1 The n-torsion subgroup E[n] Now that we know the degree of the multiplication-by-n map, we can determine the structure
More informationGraph structure of isogeny on elliptic curves
Graph structure of isogeny on elliptic curves Université Versailles Saint Quentin en Yvelines October 23, 2014 1/ 42 Outline of the talk 1 Reminder about elliptic curves, 2 Endomorphism ring of elliptic
More informationCONSTRUCTING SUPERSINGULAR ELLIPTIC CURVES. Reinier Bröker
CONSTRUCTING SUPERSINGULAR ELLIPTIC CURVES Reinier Bröker Abstract. We give an algorithm that constructs, on input of a prime power q and an integer t, a supersingular elliptic curve over F q with trace
More informationISOGENY GRAPHS OF ORDINARY ABELIAN VARIETIES
ERNEST HUNTER BROOKS DIMITAR JETCHEV BENJAMIN WESOLOWSKI ISOGENY GRAPHS OF ORDINARY ABELIAN VARIETIES PRESENTED AT ECC 2017, NIJMEGEN, THE NETHERLANDS BY BENJAMIN WESOLOWSKI FROM EPFL, SWITZERLAND AN INTRODUCTION
More informationIntroduction to Elliptic Curves
IAS/Park City Mathematics Series Volume XX, XXXX Introduction to Elliptic Curves Alice Silverberg Introduction Why study elliptic curves? Solving equations is a classical problem with a long history. Starting
More informationYou could have invented Supersingular Isogeny Diffie-Hellman
You could have invented Supersingular Isogeny Diffie-Hellman Lorenz Panny Technische Universiteit Eindhoven Πλατανιάς, Κρήτη, 11 October 2017 1 / 22 Shor s algorithm 94 Shor s algorithm quantumly breaks
More informationNon-generic attacks on elliptic curve DLPs
Non-generic attacks on elliptic curve DLPs Benjamin Smith Team GRACE INRIA Saclay Île-de-France Laboratoire d Informatique de l École polytechnique (LIX) ECC Summer School Leuven, September 13 2013 Smith
More informationSection II.1. Free Abelian Groups
II.1. Free Abelian Groups 1 Section II.1. Free Abelian Groups Note. This section and the next, are independent of the rest of this chapter. The primary use of the results of this chapter is in the proof
More informationCounting points on elliptic curves over F q
Counting points on elliptic curves over F q Christiane Peters DIAMANT-Summer School on Elliptic and Hyperelliptic Curve Cryptography September 17, 2008 p.2 Motivation Given an elliptic curve E over a finite
More informationON THE EVALUATION OF MODULAR POLYNOMIALS
ON THE EVALUATION OF MODULAR POLYNOMIALS ANDREW V. SUTHERLAND Abstract. We present two algorithms that, given a prime l and an elliptic curve E/F q, directly compute the polynomial Φ l (j(e), Y ) F q[y
More informationCounting points on genus 2 curves over finite
Counting points on genus 2 curves over finite fields Chloe Martindale May 11, 2017 These notes are from a talk given in the Number Theory Seminar at the Fourier Institute, Grenoble, France, on 04/05/2017.
More informationThe Sato-Tate conjecture for abelian varieties
The Sato-Tate conjecture for abelian varieties Andrew V. Sutherland Massachusetts Institute of Technology March 5, 2014 Mikio Sato John Tate Joint work with F. Fité, K.S. Kedlaya, and V. Rotger, and also
More informationAVERAGE RECIPROCALS OF THE ORDER OF a MODULO n
AVERAGE RECIPROCALS OF THE ORDER OF a MODULO n KIM, SUNGJIN Abstract Let a > be an integer Denote by l an the multiplicative order of a modulo integers n We prove that l = an Oa ep 2 + o log log, n,n,a=
More informationw d : Y 0 (N) Y 0 (N)
Upper half-plane formulas We want to explain the derivation of formulas for two types of objects on the upper half plane: the Atkin- Lehner involutions and Heegner points Both of these are treated somewhat
More informationMA 162B LECTURE NOTES: THURSDAY, FEBRUARY 26
MA 162B LECTURE NOTES: THURSDAY, FEBRUARY 26 1. Abelian Varieties of GL 2 -Type 1.1. Modularity Criteria. Here s what we ve shown so far: Fix a continuous residual representation : G Q GLV, where V is
More informationEvaluating Large Degree Isogenies between Elliptic Curves
Evaluating Large Degree Isogenies between Elliptic Curves by Vladimir Soukharev A thesis presented to the University of Waterloo in fulfillment of the thesis requirement for the degree of Master of Mathematics
More informationIgusa Class Polynomials
Genus 2 day, Intercity Number Theory Seminar Utrecht, April 18th 2008 Overview Igusa class polynomials are the genus 2 analogue of the classical Hilbert class polynomial. For each notion, I will 1. tell
More informationHow many elliptic curves can have the same prime conductor? Alberta Number Theory Days, BIRS, 11 May Noam D. Elkies, Harvard University
How many elliptic curves can have the same prime conductor? Alberta Number Theory Days, BIRS, 11 May 2013 Noam D. Elkies, Harvard University Review: Discriminant and conductor of an elliptic curve Finiteness
More informationFrobenius Distributions
Frobenius Distributions Edgar Costa (MIT) September 11th, 2018 Massachusetts Institute of Technology Slides available at edgarcosta.org under Research Polynomials Write f p (x) := f(x) mod p f(x) = a n
More informationComputing isogeny graphs using CM lattices
Computing isogeny graphs using CM lattices David Gruenewald GREYC/LMNO Université de Caen GeoCrypt, Corsica 22nd June 2011 Motivation for computing isogenies Point counting. Computing CM invariants. Endomorphism
More informationarxiv: v1 [math.nt] 29 Oct 2013
COMPUTING ISOGENIES BETWEEN SUPERSINGULAR ELLIPTIC CURVES OVER F p CHRISTINA DELFS AND STEVEN D. GALBRAITH arxiv:1310.7789v1 [math.nt] 29 Oct 2013 Abstract. Let p > 3 be a prime and let E, E be supersingular
More informationA gentle introduction to isogeny-based cryptography
A gentle introduction to isogeny-based cryptography Craig Costello Tutorial at SPACE 2016 December 15, 2016 CRRao AIMSCS, Hyderabad, India Part 1: Motivation Part 2: Preliminaries Part 3: Brief SIDH sketch
More informationWEIL DESCENT ATTACKS
WEIL DESCENT ATTACKS F. HESS Abstract. This article is to appear as a chapter in Advances in Elliptic Curve Cryptography, edited by I. Blake, G. Seroussi and N. Smart, Cambridge University Press, 2004.
More informationPairing the volcano. 1 Introduction. Sorina Ionica 1 and Antoine Joux 1,2
Pairing the volcano Sorina Ionica 1 and Antoine Joux 1,2 1 Université de Versailles Saint-Quentin-en-Yvelines, 45 avenue des États-Unis, 78035 Versailles CEDEX, France 2 DGA sorina.ionica,antoine.joux@m4x.org
More information2,3,5, LEGENDRE: ±TRACE RATIOS IN FAMILIES OF ELLIPTIC CURVES
2,3,5, LEGENDRE: ±TRACE RATIOS IN FAMILIES OF ELLIPTIC CURVES NICHOLAS M. KATZ 1. Introduction The Legendre family of elliptic curves over the λ-line, E λ : y 2 = x(x 1)(x λ), is one of the most familiar,
More informationIsogeny invariance of the BSD conjecture
Isogeny invariance of the BSD conjecture Akshay Venkatesh October 30, 2015 1 Examples The BSD conjecture predicts that for an elliptic curve E over Q with E(Q) of rank r 0, where L (r) (1, E) r! = ( p
More informationPUBLIC-KEY CRYPTOSYSTEM BASED ON ISOGENIES
PUBLIC-KEY CRYPTOSYSTEM BASED ON ISOGENIES Alexander Rostovtsev and Anton Stolbunov Saint-Petersburg State Polytechnical University, Department of Security and Information Protection in Computer Systems,
More informationCOMPUTING MODULAR POLYNOMIALS
COMPUTING MODULAR POLYNOMIALS DENIS CHARLES AND KRISTIN LAUTER 1. Introduction The l th modular polynomial, φ l (x, y), parameterizes pairs of elliptic curves with a cyclic isogeny of degree l between
More informationHONDA-TATE THEOREM FOR ELLIPTIC CURVES
HONDA-TATE THEOREM FOR ELLIPTIC CURVES MIHRAN PAPIKIAN 1. Introduction These are the notes from a reading seminar for graduate students that I organised at Penn State during the 2011-12 academic year.
More informationElliptic Curves Spring 2013 Lecture #14 04/02/2013
18.783 Elliptic Curves Spring 2013 Lecture #14 04/02/2013 A key ingredient to improving the efficiency of elliptic curve primality proving (and many other algorithms) is the ability to directly construct
More informationOn elliptic curves in characteristic 2 with wild additive reduction
ACTA ARITHMETICA XCI.2 (1999) On elliptic curves in characteristic 2 with wild additive reduction by Andreas Schweizer (Montreal) Introduction. In [Ge1] Gekeler classified all elliptic curves over F 2
More informationA p-adic ALGORITHM TO COMPUTE THE HILBERT CLASS POLYNOMIAL. Reinier Bröker
A p-adic ALGORITHM TO COMPUTE THE HILBERT CLASS POLYNOMIAL Reinier Bröker Abstract. Classicaly, the Hilbert class polynomial P Z[X] of an imaginary quadratic discriminant is computed using complex analytic
More informationHard Homogeneous Spaces
Hard Homogeneous Spaces Jean-Marc Couveignes August 24, 2006 Abstract This note was written in 1997 after a talk I gave at the séminaire de complexité et cryptographie at the École Normale Supérieure After
More information20 The modular equation
18.783 Elliptic Curves Spring 2015 Lecture #20 04/23/2015 20 The modular equation In the previous lecture we defined modular curves as quotients of the extended upper half plane under the action of a congruence
More informationTorsion subgroups of rational elliptic curves over the compositum of all cubic fields
Torsion subgroups of rational elliptic curves over the compositum of all cubic fields Andrew V. Sutherland Massachusetts Institute of Technology April 7, 2016 joint work with Harris B. Daniels, Álvaro
More informationIndependence of Heegner Points Joseph H. Silverman (Joint work with Michael Rosen)
Independence of Heegner Points Joseph H. Silverman (Joint work with Michael Rosen) Brown University Cambridge University Number Theory Seminar Thursday, February 22, 2007 0 Modular Curves and Heegner Points
More informationAn introduction to supersingular isogeny-based cryptography
An introduction to supersingular isogeny-based cryptography Craig Costello Summer School on Real-World Crypto and Privacy June 8, 2017 Šibenik, Croatia Towards quantum-resistant cryptosystems from supersingular
More informationIgusa Class Polynomials
, supported by the Leiden University Fund (LUF) Joint Mathematics Meetings, San Diego, January 2008 Overview Igusa class polynomials are the genus 2 analogue of the classical Hilbert class polynomials.
More informationConstructing Abelian Varieties for Pairing-Based Cryptography
for Pairing-Based CWI and Universiteit Leiden, Netherlands Workshop on Pairings in Arithmetic Geometry and 4 May 2009 s MNT MNT Type s What is pairing-based cryptography? Pairing-based cryptography refers
More informationTC10 / 3. Finite fields S. Xambó
TC10 / 3. Finite fields S. Xambó The ring Construction of finite fields The Frobenius automorphism Splitting field of a polynomial Structure of the multiplicative group of a finite field Structure of the
More informationFORMAL GROUPS OF CERTAIN Q-CURVES OVER QUADRATIC FIELDS
Sairaiji, F. Osaka J. Math. 39 (00), 3 43 FORMAL GROUPS OF CERTAIN Q-CURVES OVER QUADRATIC FIELDS FUMIO SAIRAIJI (Received March 4, 000) 1. Introduction Let be an elliptic curve over Q. We denote by ˆ
More informationModular forms and the Hilbert class field
Modular forms and the Hilbert class field Vladislav Vladilenov Petkov VIGRE 2009, Department of Mathematics University of Chicago Abstract The current article studies the relation between the j invariant
More informationComputing modular polynomials in dimension 2 ECC 2015, Bordeaux
Computing modular polynomials in dimension 2 ECC 2015, Bordeaux Enea Milio 29/09/2015 Enea Milio Computing modular polynomials 29/09/2015 1 / 49 Computing modular polynomials 1 Dimension 1 : elliptic curves
More informationON THE HARDNESS OF COMPUTING ENDOMORPHISM RINGS OF SUPERSINGULAR ELLIPTIC CURVES
ON THE HARDNESS OF COMPUTING ENDOMORPHISM RINGS OF SUPERSINGULAR ELLIPTIC CURVES KIRSTEN EISENTRÄGER, SEAN HALLGREN, AND TRAVIS MORRISON Abstract. Cryptosystems based on supersingular isogenies have been
More informationL-Polynomials of Curves over Finite Fields
School of Mathematical Sciences University College Dublin Ireland July 2015 12th Finite Fields and their Applications Conference Introduction This talk is about when the L-polynomial of one curve divides
More informationBad reduction of genus 3 curves with Complex Multiplication
Bad reduction of genus 3 curves with Complex Multiplication Elisa Lorenzo García Universiteit Leiden Joint work with Bouw, Cooley, Lauter, Manes, Newton, Ozman. October 1, 2015 Elisa Lorenzo García Universiteit
More informationCOMPLEX MULTIPLICATION: LECTURE 14
COMPLEX MULTIPLICATION: LECTURE 14 Proposition 0.1. Let K be any field. i) Two elliptic curves over K are isomorphic if and only if they have the same j-invariant. ii) For any j 0 K, there exists an elliptic
More informationALGORITHMS FOR ALGEBRAIC CURVES
ALGORITHMS FOR ALGEBRAIC CURVES SUMMARY OF LECTURE 3 In this text the symbol Θ stands for a positive constant. 1. COMPLEXITY THEORY AGAIN : DETERMINISTIC AND PROBABILISTIC CLASSES We refer the reader to
More informationClassical and Quantum Algorithms for Isogeny-based Cryptography
Classical and Quantum Algorithms for Isogeny-based Cryptography by Anirudh Sankar A thesis presented to the University of Waterloo in fulfillment of the thesis requirement for the degree of Master of Mathematics
More informationComputing endomorphism rings of abelian varieties of dimension two
Computing endomorphism rings of abelian varieties of dimension two Gaetan Bisson University of French Polynesia Abstract Generalizing a method of Sutherland and the author for elliptic curves [5, 1] we
More informationAn Introduction to Supersingular Elliptic Curves and Supersingular Primes
An Introduction to Supersingular Elliptic Curves and Supersingular Primes Anh Huynh Abstract In this article, we introduce supersingular elliptic curves over a finite field and relevant concepts, such
More informationCurves, Cryptography, and Primes of the Form x 2 + y 2 D
Curves, Cryptography, and Primes of the Form x + y D Juliana V. Belding Abstract An ongoing challenge in cryptography is to find groups in which the discrete log problem hard, or computationally infeasible.
More informationDivisibility Sequences for Elliptic Curves with Complex Multiplication
Divisibility Sequences for Elliptic Curves with Complex Multiplication Master s thesis, Universiteit Utrecht supervisor: Gunther Cornelissen Universiteit Leiden Journées Arithmétiques, Edinburgh, July
More informationLECTURE 2 FRANZ LEMMERMEYER
LECTURE 2 FRANZ LEMMERMEYER Last time we have seen that the proof of Fermat s Last Theorem for the exponent 4 provides us with two elliptic curves (y 2 = x 3 + x and y 2 = x 3 4x) in the guise of the quartic
More informationElliptic Curves Spring 2019 Problem Set #7 Due: 04/08/2019
18.783 Elliptic Curves Spring 2019 Problem Set #7 Due: 04/08/2019 Description These problems are related to the material covered in Lectures 13-14. Instructions: Solve problem 1 and then solve one of Problems
More informationThe Kummer Pairing. Alexander J. Barrios Purdue University. 12 September 2013
The Kummer Pairing Alexander J. Barrios Purdue University 12 September 2013 Preliminaries Theorem 1 (Artin. Let ψ 1, ψ 2,..., ψ n be distinct group homomorphisms from a group G into K, where K is a field.
More informationLecture 2: Elliptic curves
Lecture 2: Elliptic curves This lecture covers the basics of elliptic curves. I begin with a brief review of algebraic curves. I then define elliptic curves, and talk about their group structure and defining
More informationVARIETIES WITHOUT EXTRA AUTOMORPHISMS II: HYPERELLIPTIC CURVES
VARIETIES WITHOUT EXTRA AUTOMORPHISMS II: HYPERELLIPTIC CURVES BJORN POONEN Abstract. For any field k and integer g 2, we construct a hyperelliptic curve X over k of genus g such that #(Aut X) = 2. We
More information13 Endomorphism algebras
18.783 Elliptic Curves Lecture #13 Spring 2017 03/22/2017 13 Endomorphism algebras The key to improving the efficiency of elliptic curve primality proving (and many other algorithms) is the ability to
More informationConstructing Permutation Rational Functions From Isogenies
Constructing Permutation Rational Functions From Isogenies Gaetan Bisson 1 and Mehdi Tibouchi 1 University of French Polynesia NTT Secure Platform Laboratories Abstract. A permutation rational function
More informationElliptic Curve Primality Proving
Università degli Studi Roma Tre Facoltà di Scienze Matematiche, Fisiche e Naturali Corso di Laurea Magistrale in Matematica Tesi di Laurea Magistrale in Matematica Elliptic Curve Primality Proving SINTESI
More informationElliptic curves and modularity
Elliptic curves and modularity For background and (most) proofs, we refer to [1]. 1 Weierstrass models Let K be any field. For any a 1, a 2, a 3, a 4, a 6 K consider the plane projective curve C given
More informationc Copyright 2012 Wenhan Wang
c Copyright 01 Wenhan Wang Isolated Curves for Hyperelliptic Curve Cryptography Wenhan Wang A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy University
More informationFINITE GROUPS AND EQUATIONS OVER FINITE FIELDS A PROBLEM SET FOR ARIZONA WINTER SCHOOL 2016
FINITE GROUPS AND EQUATIONS OVER FINITE FIELDS A PROBLEM SET FOR ARIZONA WINTER SCHOOL 2016 PREPARED BY SHABNAM AKHTARI Introduction and Notations The problems in Part I are related to Andrew Sutherland
More information8 Point counting. 8.1 Hasse s Theorem. Spring /06/ Elliptic Curves Lecture #8
18.783 Elliptic Curves Lecture #8 Spring 2017 03/06/2017 8 Point counting 8.1 Hasse s Theorem We are now ready to prove Hasse s theorem. Theorem 8.1 (Hasse). Let E/ be an elliptic curve over a finite field.
More information6 Ideal norms and the Dedekind-Kummer theorem
18.785 Number theory I Fall 2016 Lecture #6 09/27/2016 6 Ideal norms and the Dedekind-Kummer theorem Recall that for a ring extension B/A in which B is a free A-module of finite rank, we defined the (relative)
More informationCounting points on elliptic curves: Hasse s theorem and recent developments
Counting points on elliptic curves: Hasse s theorem and recent developments Igor Tolkov June 3, 009 Abstract We introduce the the elliptic curve and the problem of counting the number of points on the
More informationConstructing Families of Pairing-Friendly Elliptic Curves
Constructing Families of Pairing-Friendly Elliptic Curves David Freeman Information Theory Research HP Laboratories Palo Alto HPL-2005-155 August 24, 2005* cryptography, pairings, elliptic curves, embedding
More informationEven sharper upper bounds on the number of points on curves
Even sharper upper bounds on the number of points on curves Everett W. Howe Center for Communications Research, La Jolla Symposium on Algebraic Geometry and its Applications Tahiti, May 2007 Revised slides
More informationIgusa class polynomials
Number Theory Seminar Cambridge 26 April 2011 Elliptic curves An elliptic curve E/k (char(k) 2) is a smooth projective curve y 2 = x 3 + ax 2 + bx + c. Q P P Q E is a commutative algebraic group Endomorphisms
More informationREDUCTION OF ELLIPTIC CURVES OVER CERTAIN REAL QUADRATIC NUMBER FIELDS
MATHEMATICS OF COMPUTATION Volume 68, Number 228, Pages 1679 1685 S 0025-5718(99)01129-1 Article electronically published on May 21, 1999 REDUCTION OF ELLIPTIC CURVES OVER CERTAIN REAL QUADRATIC NUMBER
More informationRiemann surfaces with extra automorphisms and endomorphism rings of their Jacobians
Riemann surfaces with extra automorphisms and endomorphism rings of their Jacobians T. Shaska Oakland University Rochester, MI, 48309 April 14, 2018 Problem Let X be an algebraic curve defined over a field
More informationPoint counting and real multiplication on K3 surfaces
Point counting and real multiplication on K3 surfaces Andreas-Stephan Elsenhans Universität Paderborn September 2016 Joint work with J. Jahnel. A.-S. Elsenhans (Universität Paderborn) K3 surfaces September
More informationHyperelliptic curves
1/40 Hyperelliptic curves Pierrick Gaudry Caramel LORIA CNRS, Université de Lorraine, Inria ECC Summer School 2013, Leuven 2/40 Plan What? Why? Group law: the Jacobian Cardinalities, torsion Hyperelliptic
More informationElliptic Curves, Group Schemes,
Elliptic Curves, Group Schemes, and Mazur s Theorem A thesis submitted by Alexander B. Schwartz to the Department of Mathematics in partial fulfillment of the honors requirements for the degree of Bachelor
More informationEXTENSIONS OF CM ELLIPTIC CURVES AND ORBIT COUNTING ON THE PROJECTIVE LINE
EXTENSIONS OF CM ELLIPTIC CURVES AND ORBIT COUNTING ON THE PROJECTIVE LINE JULIAN ROSEN AND ARIEL SHNIDMAN Abstract. There are several formulas for the number of orbits of the projective line under the
More informationΓ 1 (N) given by the W -operator W =. It would be interesting to show
Hodge structures of type (n, 0,..., 0, n) Burt Totaro Completing earlier work by Albert, Shimura found all the possible endomorphism algebras (tensored with the rationals) for complex abelian varieties
More information