Elliptic Nets How To Catch an Elliptic Curve Katherine Stange USC Women in Math Seminar November 7,

Transcription

1 Elliptic Nets How To Catch an Elliptic Curve Katherine Stange USC Women in Math Seminar November 7,

2 Part I: Elliptic Curves are Groups

3 Elliptic Curves Frequently, we may use the simpler equation,

4 A Typical Elliptic Curve E E : Y2 = X3 5X + 8 The lack of shame involved in the theft of this slide from Joe Silverman s website should make any graduate student proud.

5 Adding Points P + Q on E R Q P P+Q The lack of shame involved in the theft of this slide from Joe Silverman s website should make any graduate student proud. -5-

6 Doubling a Point P on E Tangent Line to E at P R P 2*P The lack of shame involved in the theft of this slide from Joe Silverman s website should make any graduate student proud. -6-

7 Vertical Lines and an Extra Point at Infinity O Add an extra point O at infinity. The point Olies on every vertical line. P Q = P Vertical lines have no third intersection point The lack of shame involved in the theft of this slide from Joe Silverman s website should make any graduate student proud.

8 Elliptic Curve Group Law

9 Part II: Elliptic Divisibility Sequences

10 Elliptic Divisibility Sequences: Seen In Their Natural Habitat

11

12 Division Polynomials

13 An Elliptic Divisibility Sequence is a sequence satisfying the following recurrence relation.

14 Curves give Sequences

15 Some Example Sequences 0,, 2, 3, 4, 5, 6, 7, 8, 9, 0,, 2, 3, 4, 5, 6, 7, 8, 9, 20, 2, 22, 23, 24, 25, 26, 27, 28, 29, 30, 3, 32, 33, 34, 35, 36, 37, 38, 39, 40, 4, 42, 43, 44, 45, 46, 47, 48, 49, 50, 5, 52, 53, 54, 55, 56, 57, 58, 59, 60, 6, 62, 63, 64, 65, 66, 67, 68, 69, 70, 7, 72, 73, 74, 75, 76, 77,

16 Some Example Sequences, 3, 8, 2, 55, 44, 377, 987, 2584, 6765, 77, 46368, 2393, 378, , , , , , , , , , , , , , , , ,...

17 Some Example Sequences 0,,, -,, 2, -, -3, -5, 7, -4, -23, 29, 59, 29, -34, -65, 529, -3689, -8209, -6264, 8333, 3689, , , , 70047, , , , , , ,

18 Our First Example 0,,, -3,, 38, 249, -2357, 8767, , , , , , , , , , , , ,

19 Some more terms 0,,, -3,, 38, 249, -2357, 8767, , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,...

20 Part III: Division Polynomials

21 Division Polynomials The nth division polynomial has as zeroes the n2 n-torsion points Therefore a sequence associated to a point of order n has Wnk = 0 for all integers k.

22 Division Polynomials These are polynomials in x,y,a,b Integer coefficients So by a change of coordinates x u2x, y u3y (which implies A u4a, B u6b), we can obtain an integer sequence.

23 Curve Sequence Correspondence Theorem (Morgan Ward, 948) The following sets are in bijection. E an elliptic curve + P a point on E Wn an elliptic divisibility sequence W = W 2W 3 0 P, [2]P, [3]P 0 (The bijection is given by explicit formulae.)

24 Part IV: Reduction Mod p

25 Reduction of a curve mod p X 3 (0,-3)

26 Reduction Mod p 0,,, -3,, 38, 249, -2357, 8767, , , , , , , , , , , , , 0,,, 8, 0, 5, 7, 8, 0,, 9, 0, 0, 3, 7, 6, 0, 3,, 0, 0,,0, 8, 0, 5, 4, 8, 0,, 2, 0, 0, 3, 4, 6, 0, 3, 0, 0, 0,,, 8, 0, 5, 7, 8, 0, This is the elliptic divisibility sequence associated to the curve reduced modulo

27 Zeroes of the Sequence

28 Reduction Mod p 0,,, -3,, 38, 249, -2357, 8767, , , , , , , , , , , , , 0,,, 8, 0, 5, 7, 8, 0,, 9, 0, 0, 3, 7, 6, 0, 3,, 0, 0,,0, 8, 0, 5, 4, 8, 0,, 2, 0, 0, 3, 4, 6, 0, 3, 0, 0, 0,,, 8, 0, 5, 7, 8, 0, The point has order 4, but the sequence has period 40! The sequence is not a function of the point [n]p.

29 Periodicity of Sequences Due to Morgan Ward.

30 Periodicity Example 0,,, 8, 0, 5, 7, 8, 0,, 9, 0, 0, 3, 7, 6, 0, 3,, 0, 0,

31 Research (Partial List) Applications to Elliptic Curve Discrete Logarithm Problem in cryptography (R. Shipsey) Finding integral points (M. Ayad) Study of nonlinear recurrence sequences (Fibonacci numbers, Lucas numbers, and integers are special cases of EDS) Appearance of primes (G. Everest, T. Ward, ) EDS are a special case of Somos Sequences (A. van der Poorten, J. Propp, M. Somos, C. Swart, ) p-adic & function field cases (J. Silverman) Continued fractions & elliptic curve group law (W. Adams, A. van der Poorten, M. Razar) Sigma function perspective (A. Hone, ) Hyper-elliptic curves (A. Hone, A. van der Poorten, ) More

32 Part V: Elliptic Nets: Jacking up the Dimension

33 The Mordell-Weil Group

34 From Sequences to Nets Suppose we take the denominators of linear combinations [n]p + [m]q of two (or n) points. Does this array of numbers Wn,m satisfy a recurrence relation and have properties similar to those we've seen for elliptic divisibility sequences? (Question asked by Elkies in 200)

35

36

37

38

39

40 Example Q P

41 Example Q P

42 Example Q P

43 Example Q P

44 Example Q P

45 Generalising Division Polynomials ψn,m(p,q) should... be defined on ExE be zero exactly when [n]p + [m]q = 0 on the curve be the denominator of [n]p + [m]q up to sign. be the usual division polynomials when (n,m) = (n,0) or (0,m)

46 Net Polynomials

47 Elliptic Nets Define an elliptic net to be any function W: Zn Q satisfying for p,q,r,s in Zn.

48 Curve Net Correspondence Theorem (S) The following sets are in bijection. E an elliptic curve + P,Q points on E Wn,m an elliptic net W,0 = W0, =W, =, W,- 0 P,Q, P+Q, P-Q 0 (The bijection is given by explicit formulae. Works for higher rank as well.)

49 Part VI: Nets Mod p

50 Example Q P

51 Example Q P

52 Divisibility Property Consider nets that take integer values. (By a change of coordinates, we can always obtain such a net.) If W is associated to a curve E...

53 Example Q P

54 Example Q P

55

56 Periodicity in two dimensions Theorem (S) Suppose r = (r, r2 ) such that [r ]P + [r2 ]Q = 0. Then there are ar, br, cr such that for all s = (s, s2 ),

57

58

59 Part VII: Elliptic Curve Cryptography

60 Elliptic Curve Cryptography For cryptography you need something that is easy to do but difficult to undo. Like multiplying vs. factoring. Or getting pregnant. (No one has realised any cryptographic protocols based on this: Possible thesis topic anyone?)

61 The (Elliptic Curve) Discrete Log Problem Let A be a group and let P and Q be known elements of A. The Discrete Logarithm Problem (DLP) is to find an m summands integer m satisfying Q = P + P + + P = mp. Hard but not too hard in Fp*. Koblitz and Miller (985) independently suggested using the group E(Fp) of points modulo p on an elliptic curve. It seems pretty hard there.

62 Elliptic Curve Diffie-Hellman Key Exchange Public Knowledge: A group E(Fp) and a point P of order n. BOB ALICE Choose secret 0 < b < n Choose secret 0 < a < n Compute QBob = bp Compute QAlice = ap Send QBob to Bob Compute bqalice to Alice Send QAlice Compute aqbob Bob and Alice have the shared value bqalice = abp = aqbob Presumably(?) recovering abp from ap and bp requires solving the elliptic curve discrete logarithm problem. Yeah, I stole this one too.

63 The Tate Pairing fp is the function with a pole of order m at 0 and a zero of order m at P independent of S This is a bilinear pairing:

64 Tate Pairing in Cryptography: Tripartite Diffie-Hellman Key Exchange Public Knowledge: A group E(Fp) and a point P of order n. ALICE BOB CHANTAL 0<a<n 0<b<n 0<c<n Compute QAlice = ap QBob = bp QChantal = cp Reveal QBob QChantal Secret QAlice Compute τn(qbob,qchantal)a τn(qalice,qchantal)b τn(qalice,qbob)c These three values are equal to τn(p,p)abc Security (presumably?) relies on Discrete Log Problem in Fp*

65 Part VIII: Elliptic Nets and the Tate Pairing

66 Tate Pairing from Elliptic Nets

67 This is just the value of a from the periodicity relation Choosing a Nice Net

68

69 Calculating the Net (Rank 2) Based on an algorithm by Rachel Shipsey Double DoubleAdd

70 Calculating the Tate Pairing Find the initial values of the net associated to E, P, Q (there are simple formulae) Use a Double & Add algorithm to calculate the block centred on m Use the terms in this block to calculate

71 Calculating the Tate Pairing About % of the time taken by the other known algorithm due to Victor Miller (which has been extensively optimised). May be more efficient in certain special cases.

72 References Morgan Ward. Memoir on Elliptic Divisibility Sequences. American Journal of Mathematics, 70:374, 948. Christine S. Swart. Elliptic Curves and Related Sequences. PhD thesis, Royal Holloway and Bedford New College, University of London, Graham Everest, Alf van der Poorten, Igor Shparlinski, and Thomas Ward. Recurrence Sequences. Mathematical Surveys and Monographs, vol 04. American Mathematical Society, Slides, preprint, scripts at