Fast method for testing the smoothness of polynomials Jean-Franc - PowerPoint PPT Presentation

page.1 Fast method for testing the smoothness of polynomials Jean-Franc ¸ois Biasse Mike Jacobson University of Calgary October 2013 Biasse-Jacobson (U of C) Fast smoothness test October 2013 1 / 24

page.2 Presentation of the problem Let K be a finite field. Let B > 0 a bound. We want to test if a given P ∈ K [ X ] is B -smooth, that is if P = P e 1 1 · · · P e n with ∀ i ≤ k deg( P i ) ≤ B . n , Biasse-Jacobson (U of C) Fast smoothness test October 2013 2 / 24

page.3 Presentation of the problem Let K be a finite field. Let B > 0 a bound. We want to test if a given P ∈ K [ X ] is B -smooth, that is if P = P e 1 1 · · · P e n with ∀ i ≤ k deg( P i ) ≤ B . n , This occurs in the resolution of the disrete logarithm problem (DLP) : Function field sieve in ( F p m ) ∗ . Biasse-Jacobson (U of C) Fast smoothness test October 2013 2 / 24

page.4 Presentation of the problem Let K be a finite field. Let B > 0 a bound. We want to test if a given P ∈ K [ X ] is B -smooth, that is if P = P e 1 1 · · · P e n with ∀ i ≤ k deg( P i ) ≤ B . n , This occurs in the resolution of the disrete logarithm problem (DLP) : Function field sieve in ( F p m ) ∗ . Random walk method in J ( C ). Biasse-Jacobson (U of C) Fast smoothness test October 2013 2 / 24

page.5 Presentation of the problem Let K be a finite field. Let B > 0 a bound. We want to test if a given P ∈ K [ X ] is B -smooth, that is if P = P e 1 1 · · · P e n with ∀ i ≤ k deg( P i ) ≤ B . n , This occurs in the resolution of the disrete logarithm problem (DLP) : Function field sieve in ( F p m ) ∗ . Random walk method in J ( C ). Quadratic sieve method in the Jacobian of J ( C ). where J ( C ) is the Jacobian of a hyperelliptic curve C over a finite field. Biasse-Jacobson (U of C) Fast smoothness test October 2013 2 / 24

page.6 1 Motivation 2 Bernstein’s approach 3 Complexity analysis 4 Practical examples Biasse-Jacobson (U of C) Fast smoothness test October 2013 2 / 24

page.7 The jacobian of a hyperelliptic curve Let K be a finite field, a hyperelliptic curve C of genus g is defined by Y 2 + h ( X ) Y + f ( X ) = 0 , where h , f ∈ K [ X ], deg( h ) ≤ g and deg( f ) = 2 g + 1 or 2 g + 2. Biasse-Jacobson (U of C) Fast smoothness test October 2013 3 / 24

page.8 The jacobian of a hyperelliptic curve Let K be a finite field, a hyperelliptic curve C of genus g is defined by Y 2 + h ( X ) Y + f ( X ) = 0 , where h , f ∈ K [ X ], deg( h ) ≤ g and deg( f ) = 2 g + 1 or 2 g + 2. The Jacobian variety A hyperelliptic curve is associated to a group J ( C ) with |J ( C ) | ≈ q g where K = F q . Solving the DLP at fixed g is exponential in log( q ). Biasse-Jacobson (U of C) Fast smoothness test October 2013 3 / 24

page.9 The jacobian of a hyperelliptic curve Let K be a finite field, a hyperelliptic curve C of genus g is defined by Y 2 + h ( X ) Y + f ( X ) = 0 , where h , f ∈ K [ X ], deg( h ) ≤ g and deg( f ) = 2 g + 1 or 2 g + 2. The Jacobian variety A hyperelliptic curve is associated to a group J ( C ) with |J ( C ) | ≈ q g where K = F q . Solving the DLP at fixed g is exponential in log( q ). The DLP in |J ( C ) | in an essential topic in cryptography. Elliptic curves are the special case g = 1. Biasse-Jacobson (U of C) Fast smoothness test October 2013 3 / 24

page.10 Smoothness in J ( C ) Elements of J ( C ) can be represented by ( u ( X ) , v ( X )) where deg( u ) ≤ g is the degree of ( u ( X ) , v ( X )). deg( v ) < deg( v ). Biasse-Jacobson (U of C) Fast smoothness test October 2013 4 / 24

page.11 Smoothness in J ( C ) Elements of J ( C ) can be represented by ( u ( X ) , v ( X )) where deg( u ) ≤ g is the degree of ( u ( X ) , v ( X )). deg( v ) < deg( v ). Smoothness of divisors We say that a ∈ J ( C ) is B -smooth if a = p 1 · · · p n for some n > 0 , with ∀ i , deg( p i ) ≤ B . Biasse-Jacobson (U of C) Fast smoothness test October 2013 4 / 24

page.12 Smoothness in J ( C ) Elements of J ( C ) can be represented by ( u ( X ) , v ( X )) where deg( u ) ≤ g is the degree of ( u ( X ) , v ( X )). deg( v ) < deg( v ). Smoothness of divisors We say that a ∈ J ( C ) is B -smooth if a = p 1 · · · p n for some n > 0 , with ∀ i , deg( p i ) ≤ B . If u ( X ) is B -smooth for B ≤ g , then ( u ( X ) , v ( X )) is B -smooth in J ( C ). Biasse-Jacobson (U of C) Fast smoothness test October 2013 4 / 24

page.13 Solving the DLP in J ( C ) from relations Let a , b ∈ J ( C ), we want to find x ∈ Z such that b = a x . Let p 1 , · · · , p n generating J ( C ). Biasse-Jacobson (U of C) Fast smoothness test October 2013 5 / 24

page.14 Solving the DLP in J ( C ) from relations Let a , b ∈ J ( C ), we want to find x ∈ Z such that b = a x . Let p 1 , · · · , p n generating J ( C ).   p m 1 , 1 · · · p m 1 , n = 1 0 0 m 1 , 1 m 1 , n n 1     p m k , 1 · · · p m k , n m l , 1 m l , n 0 0 = 1   n 1   =   M p m k +1 , 1 · · · p m k +1 , n m l +1 , 1 m l +1 , n 1 0 b = 1   n 1     m l +2 , 1 m l +2 , n 0 1 p m k +2 , 1 · · · p m k +2 , n a = 1 n 1 A : l + 2 rows n + 1 columns Biasse-Jacobson (U of C) Fast smoothness test October 2013 5 / 24

page.15 Solving the DLP in J ( C ) from relations Let a , b ∈ J ( C ), we want to find x ∈ Z such that b = a x . Let p 1 , · · · , p n generating J ( C ).   p m 1 , 1 · · · p m 1 , n = 1 0 0 m 1 , 1 m 1 , n n 1     p m k , 1 · · · p m k , n m l , 1 m l , n 0 0 = 1   n 1   =   M p m k +1 , 1 · · · p m k +1 , n m l +1 , 1 m l +1 , n 1 0 b = 1   n 1     m l +2 , 1 m l +2 , n 0 1 p m k +2 , 1 · · · p m k +2 , n a = 1 n 1 A : l + 2 rows n + 1 columns If XA = (0 , · · · , 0 , 1), then ∃ y ∈ Z such that XM = (0 , · · · , 0 , 1 , y ). This means ba y = 1, so x = − y is a solution. Biasse-Jacobson (U of C) Fast smoothness test October 2013 5 / 24

page.16 Relations in J ( C ) from random walk We can solve the DLP in J ( C ) from relations p 1 · · · p n = 1 where B := { p 1 · · · p n } generates J ( C ). B = { p = ( u , v ) ∈ J ( C ) | u prime , deg( u ) ≤ B } . Biasse-Jacobson (U of C) Fast smoothness test October 2013 6 / 24

page.17 Relations in J ( C ) from random walk We can solve the DLP in J ( C ) from relations p 1 · · · p n = 1 where B := { p 1 · · · p n } generates J ( C ). B = { p = ( u , v ) ∈ J ( C ) | u prime , deg( u ) ≤ B } . Random walk strategy We repeat the following steps. Draw p e 1 1 · · · p e n n = ( u , v ) at random. Test if u ∈ F q [ X ] is B -smooth. i p e i Each time u is B -smooth, we have a relation � i = � j q j . Biasse-Jacobson (U of C) Fast smoothness test October 2013 6 / 24

page.18 Relations in J ( C ) from random walk We can solve the DLP in J ( C ) from relations p 1 · · · p n = 1 where B := { p 1 · · · p n } generates J ( C ). B = { p = ( u , v ) ∈ J ( C ) | u prime , deg( u ) ≤ B } . Random walk strategy We repeat the following steps. Draw p e 1 1 · · · p e n n = ( u , v ) at random. Test if u ∈ F q [ X ] is B -smooth. i p e i Each time u is B -smooth, we have a relation � i = � j q j . The two main contribution to the cost are Arithmetic in J ( C ). Smoothness test of u . Biasse-Jacobson (U of C) Fast smoothness test October 2013 6 / 24

page.19 Sieving in a fonction field Let P ∈ K [ x ][ y ] of degree g . Let B > 0 and S ⊂ K [ x ] g +1 . We want to find ( a i ( x )) ∈ S such that P ( a 0 ( x ) , · · · , a g ( x )) is B − smooth . Biasse-Jacobson (U of C) Fast smoothness test October 2013 7 / 24

page.20 Sieving in a fonction field Let P ∈ K [ x ][ y ] of degree g . Let B > 0 and S ⊂ K [ x ] g +1 . We want to find ( a i ( x )) ∈ S such that P ( a 0 ( x ) , · · · , a g ( x )) is B − smooth . Sieving methods Using roots of P mod p i where deg( p i ) ≤ B , we Preselect rapidly candidates Q 1 ( x ) , · · · , Q l ( x ) where Q j ∈ P ( S ). Then we test the ( Q i ( x )) i ≤ l for smoothness. Biasse-Jacobson (U of C) Fast smoothness test October 2013 7 / 24

page.21 Sieving in a fonction field Let P ∈ K [ x ][ y ] of degree g . Let B > 0 and S ⊂ K [ x ] g +1 . We want to find ( a i ( x )) ∈ S such that P ( a 0 ( x ) , · · · , a g ( x )) is B − smooth . Sieving methods Using roots of P mod p i where deg( p i ) ≤ B , we Preselect rapidly candidates Q 1 ( x ) , · · · , Q l ( x ) where Q j ∈ P ( S ). Then we test the ( Q i ( x )) i ≤ l for smoothness. Sieving is faster than testing P ( a 0 ( x ) , · · · , a g ( x )) for all ( a i ( x )) ∈ S . It still involves smoothness tests of elements in K [ x ]. Biasse-Jacobson (U of C) Fast smoothness test October 2013 7 / 24

page.22 Relations in J ( C ) from sieving Let C : Y 2 + h ( X ) Y + f ( X ) = F ( X , Y ) = 0 with deg( f ) = 2 g + 1. Let O := F q [ X ][ Y ] / F ( X , Y ) be the equation order. Cl ( O ) := { ideals of O} / { principal ideals } ≃ J ( C ). Biasse-Jacobson (U of C) Fast smoothness test October 2013 8 / 24