Generalizing Vlus formulas and some applications ECC 2010 Romain - - PowerPoint PPT Presentation

▶
generalizing v lu s formulas and some applications
SMART_READER_LITE
LIVE PREVIEW

Generalizing Vlus formulas and some applications ECC 2010 Romain - - PowerPoint PPT Presentation

Jun 18, 2023 489 likes •1.22k views

Generalizing Vlus formulas and some applications ECC 2010 Romain Coss et 1 , David L ubicz 2,3 , Damien Robert 4 1 Nancy Universit, CNRS, Inria Nancy Grand Est 2 CLAR 3 IRMAR, Universit de Rennes 1 4 Inria Bordeaux Sud-Ouest 21/10/2010

slide-1
SLIDE 1

Generalizing Vélu’s formulas and some applications

ECC 2010 Romain Cosset1, David Lubicz2,3, Damien Robert4

1Nancy Université, CNRS, Inria Nancy Grand Est 2CÉLAR 3IRMAR, Université de Rennes 1 4Inria Bordeaux Sud-Ouest

21/10/2010 (Redmond)

slide-2
SLIDE 2

Isogenies Theory Implementation Examples and Applications

Outline

1

Isogenies

2

Tieory

3

Implementation

4

Examples and Applications

slide-3
SLIDE 3

Isogenies Theory Implementation Examples and Applications

Abelian varieties

Defjnition An Abelian variety is a complete connected group variety over a base fjeld k. (Polarised) abelian varieties = higher dimensional equivalent of elliptic curves. If C is a curve of genus , it’s Jacobian is a (principally polarised) abelian variety of dimension . For C ∶ y2 ≙ f (x) (deg f ≙ 2 − 1) hyperelliptic curve, Mumford coordinates: D ≙

k

∑

i≙1

(Pi − P∞) k ⩽ , −Pi ≠ Pj ≙ (u, v) with u ≙ ∏(x − xi), v(xi) ≙ yi.

slide-4
SLIDE 4

Isogenies Theory Implementation Examples and Applications

Isogenies

Defjnition A (separable) isogeny is a fjnite surjective (separable) morphism between two Abelian varieties. Isogenies ⇔ Finite subgroups. (f ∶ A → B) ↦ Ker f (A → A/H) ↤ H Tie kernel of the dual isogeny ̂ f is the Cartier dual of the kernel of f ⇒ pairings! We want isogenies compatible with the polarizations ⇒ isotropic kernels.

slide-5
SLIDE 5

Isogenies Theory Implementation Examples and Applications

Cryptographic usage of isogenies

Transfer the DLP from one Abelian variety to another. Point counting algorithms (ℓ-adic or p-adic) ⇒ Verify a curve is secure. Compute the class fjeld polynomials (CM-method) ⇒ Construct a secure curve. Compute the modular polynomials ⇒ Compute isogenies. Determine End(A) ⇒ CRT method for class fjeld polynomials.

slide-6
SLIDE 6

Isogenies Theory Implementation Examples and Applications

Explicit isogeny computation

Given an isotropic subgroup K ⊂ A(k) compute the isogeny A ↦ A/K. (Vélu’s formula.) Given an abelian variety compute all the isogeneous varieties. (Modular polynomials.) Given two isogeneous abelian variety A and B fjnd the isogeny A ↦ B. (‘‘Inverse Vélu’s formula’’ ⇒ SEA algorithm).

slide-7
SLIDE 7

Isogenies Theory Implementation Examples and Applications

Explicit isogeny computation

Given an isotropic subgroup K ⊂ A(k) compute the isogeny A ↦ A/K. (Vélu’s formula.) Given an abelian variety compute all the isogeneous varieties. (Modular polynomials.) Given two isogeneous abelian variety A and B fjnd the isogeny A ↦ B. (‘‘Inverse Vélu’s formula’’ ⇒ SEA algorithm).

slide-8
SLIDE 8

Isogenies Theory Implementation Examples and Applications

Explicit isogeny computation

Given an isotropic subgroup K ⊂ A(k) compute the isogeny A ↦ A/K. (Vélu’s formula.) Given an abelian variety compute all the isogeneous varieties. (Modular polynomials.) Given two isogeneous abelian variety A and B fjnd the isogeny A ↦ B. (‘‘Inverse Vélu’s formula’’ ⇒ SEA algorithm).

slide-9
SLIDE 9

Isogenies Theory Implementation Examples and Applications

Explicit isogeny computation

Given an isotropic subgroup K ⊂ A(k) compute the isogeny A ↦ A/K. (Vélu’s formula.) Given an abelian variety compute all the isogeneous varieties. (Modular polynomials.) Given two isogeneous abelian variety A and B fjnd the isogeny A ↦ B. (‘‘Inverse Vélu’s formula’’ ⇒ SEA algorithm).

slide-10
SLIDE 10

Isogenies Theory Implementation Examples and Applications

Vélu’s formula

Tieorem Let E ∶ y2 ≙ f (x) be an elliptic curve and G ⊂ E(k) a fjnite subgroup. Tien E/G is given by Y 2 ≙ (X) where X(P) ≙ x(P) + ∑

Q∈G∖{0E}

(x(P + Q) − x(Q)) Y(P) ≙ y(P) + ∑

Q∈G∖{0E}

(y(P + Q) − y(Q)) . Uses the fact that x and y are characterised in k(E) by v0E(x) ≙ −2 vP(x) ⩾ 0 if P ≠ 0E v0E(y) ≙ −3 vP(y) ⩾ 0 if P ≠ 0E y2/x3(0E) ≙ 1 No such characterisation in genus  ⩾ 2 for Mumford coordinates.

slide-11
SLIDE 11

Isogenies Theory Implementation Examples and Applications

Tie modular polynomial

Defjnition Modular polynomial ϕn(x, y) ∈ Z∥x, y∥: ϕn(x, y) ≙ 0 ⇔ x ≙ j(E) and y ≙ j(E′) with E and E′ n-isogeneous. If E ∶ y2 ≙ x3 + ax + b is an elliptic curve, the j-invariant is j(E) ≙ 1728 4a3 4a3 + 27b2 Roots of ϕn(j(E), .) ⇔ elliptic curves n-isogeneous to E. In genus 2, modular polynomials use Igusa invariants. Tie height explodes. ⇒ Genus 2: (2, 2)-isogenies [Richelot]. Genus 3: (2, 2, 2)-isogenies [Smi09]. ⇒ Moduli space given by invariants with more structure. ⇒ Fix the form of the isogeny and look for compatible coordinates.

slide-12
SLIDE 12

Isogenies Theory Implementation Examples and Applications

Tie modular polynomial

Defjnition Modular polynomial ϕn(x, y) ∈ Z∥x, y∥: ϕn(x, y) ≙ 0 ⇔ x ≙ j(E) and y ≙ j(E′) with E and E′ n-isogeneous. If E ∶ y2 ≙ x3 + ax + b is an elliptic curve, the j-invariant is j(E) ≙ 1728 4a3 4a3 + 27b2 Roots of ϕn(j(E), .) ⇔ elliptic curves n-isogeneous to E. In genus 2, modular polynomials use Igusa invariants. Tie height explodes. ⇒ Genus 2: (2, 2)-isogenies [Richelot]. Genus 3: (2, 2, 2)-isogenies [Smi09]. ⇒ Moduli space given by invariants with more structure. ⇒ Fix the form of the isogeny and look for compatible coordinates.

slide-13
SLIDE 13

Isogenies Theory Implementation Examples and Applications

Complex abelian varieties and theta functions of level n

(ϑi)i∈Z(n): basis of the theta functions of level n. (Z(n) :≙ Z/nZ) ⇔ A∥n∥ ≙ A1∥n∥ ⊕ A2∥n∥: symplectic decomposition. (ϑi)i∈Z(n) ≙ {coordinates system n ⩾ 3 coordinates on the Kummer variety A/ ± 1 n ≙ 2 Tieta null point: ϑi(0)i∈Z(n) ≙ modular invariant. Example (k ≙ C) Abelian variety over C: A ≙ C/(Z + ΩZ); Ω ∈ H(C) the Siegel upper half space (Ω symmetric, Im Ω positive defjnite). ϑi :≙ Θ [ 0

i/n ](z, Ω/n).

slide-14
SLIDE 14

Isogenies Theory Implementation Examples and Applications

Tie difgerential addition law (k ≙ C)

( ∑

t∈Z(2)

χ(t)ϑi+t(x + y)ϑ j+t(x − y)).( ∑

t∈Z(2)

χ(t)ϑk+t(0)ϑl+t(0)) ≙ ( ∑

t∈Z(2)

χ(t)ϑ−i′+t(y)ϑ j′+t(y)).( ∑

t∈Z(2)

χ(t)ϑk′+t(x)ϑl ′+t(x)). where χ ∈ ˆ Z(2), i, j, k, l ∈ Z(n) (i′, j′, k′, l′) ≙ A(i, j, k, l) A ≙ 1 2 ⎛ ⎜ ⎜ ⎜ ⎝ 1 1 1 1 1 1 −1 −1 1 −1 1 −1 1 −1 −1 1 ⎞ ⎟ ⎟ ⎟ ⎠

slide-15
SLIDE 15

Isogenies Theory Implementation Examples and Applications

Tie isogeny theorem

Tieorem Let ℓ ∧ n ≙ 1, and ϕ ∶ Z(n) → Z(ℓn), x ↦ ℓ.x be the canonical embedding. Let K0 ≙ A∥ℓ∥2 ⊂ A∥ℓn∥2. Let (ϑA

i )i∈Z(ℓn) be the theta functions of level ℓn on A ≙ C/(Z + ΩZ).

Let (ϑB

i )i∈Z(n) be the theta functions of level n of

B ≙ A/K0 ≙ C/(Z + Ω

ℓ Z).

We have: (ϑB

i (x))i∈Z(n) ≙ (ϑA ϕ(i)(x))i∈Z(n)

Example π ∶ (x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11) ↦ (x0, x3, x6, x9) is a 3-isogeny between elliptic curves.

slide-16
SLIDE 16

Isogenies Theory Implementation Examples and Applications

Tie modular space of theta null points of level n (car k ∤ n)

Defjnition Tie modular space Mn of theta null points is: ∑

t∈Z(2)

ax+tay+t ∑

t∈Z(2)

au+tav+t ≙ ∑

t∈Z(2)

ax′+tay′+t ∑

t∈Z(2)

au′+tav′+t, with the relations of symmetry ax ≙ a−x. Abelian varieties with a n-structure = open locus of Mn.

slide-17
SLIDE 17

Isogenies Theory Implementation Examples and Applications

Isogenies and modular correspondence [FLR09]

(ai)i∈Z(ℓn) ∈ Mℓn(k) Ak, Ak∥ℓn∥ ≙ Ak∥ℓn∥1 ⊕ Ak∥ℓn∥2 determines Bk, Bk∥n∥ ≙ Bk∥n∥1 ⊕ Bk∥n∥2 π (bi)i∈Z(n) ∈ Mn(k) ϕ1 ̂ π Every isogeny (with isotropic kernel K) comes from a modular solution. We can detect degenerate solutions.

slide-18
SLIDE 18

Isogenies Theory Implementation Examples and Applications

Isogenies and modular correspondence [FLR09]

(ai)i∈Z(ℓn) ∈ Mℓn(k) Ak, Ak∥ℓn∥ ≙ Ak∥ℓn∥1 ⊕ Ak∥ℓn∥2 determines Bk, Bk∥n∥ ≙ Bk∥n∥1 ⊕ Bk∥n∥2 π (bi)i∈Z(n) ∈ Mn(k) ϕ1 ̂ π Every isogeny (with isotropic kernel K) comes from a modular solution. We can detect degenerate solutions.

slide-19
SLIDE 19

Isogenies Theory Implementation Examples and Applications

Isogenies and modular correspondence [FLR09]

(ai)i∈Z(ℓn) ∈ Mℓn(k) Ak, Ak∥ℓn∥ ≙ Ak∥ℓn∥1 ⊕ Ak∥ℓn∥2 determines Bk, Bk∥n∥ ≙ Bk∥n∥1 ⊕ Bk∥n∥2 π (bi)i∈Z(n) ∈ Mn(k) ϕ1 ̂ π Every isogeny (with isotropic kernel K) comes from a modular solution. We can detect degenerate solutions.

slide-20
SLIDE 20

Isogenies Theory Implementation Examples and Applications

Tie contragredient isogeny [LR10a]

y ∈ B z ∈ A ̂ π x ∈ A π ∥ℓ∥ Let π ∶ A → B be the isogeny associated to (ai)i∈Z(ℓn). Let y ∈ B and x ∈ A be one of the ℓ antecedents. Tien ̂ π(y) ≙ ℓ.x

slide-21
SLIDE 21

Isogenies Theory Implementation Examples and Applications

Tie contragredient isogeny [LR10a]

y ∈ B z ∈ A ̂ π x ∈ A π ∥ℓ∥ Let π ∶ A → B be the isogeny associated to (ai)i∈Z(ℓn). Let y ∈ B and x ∈ A be one of the ℓ antecedents. Tien ̂ π(y) ≙ ℓ.x

slide-22
SLIDE 22

Isogenies Theory Implementation Examples and Applications

Tie contragredient isogeny [LR10a]

y ∈ B z ∈ A ̂ π x ∈ A π ∥ℓ∥ Let π ∶ A → B be the isogeny associated to (ai)i∈Z(ℓn). Let y ∈ B and x ∈ A be one of the ℓ antecedents. Tien ̂ π(y) ≙ ℓ.x

slide-23
SLIDE 23

Isogenies Theory Implementation Examples and Applications

Tie contragredient isogeny [LR10a]

y ∈ B z ∈ A ̂ π x ∈ A π ∥ℓ∥ Let π ∶ A → B be the isogeny associated to (ai)i∈Z(ℓn). Let y ∈ B and x ∈ A be one of the ℓ antecedents. Tien ̂ π(y) ≙ ℓ.x 1 Ω 3Ω R0 R1 R2 y

slide-24
SLIDE 24

Isogenies Theory Implementation Examples and Applications

Tie contragredient isogeny [LR10a]

y ∈ B z ∈ A ̂ π x ∈ A π ∥ℓ∥ Let π ∶ A → B be the isogeny associated to (ai)i∈Z(ℓn). Let y ∈ B and x ∈ A be one of the ℓ antecedents. Tien ̂ π(y) ≙ ℓ.x 1 Ω 3Ω R0 R1 R2 y

slide-25
SLIDE 25

Isogenies Theory Implementation Examples and Applications

Tie contragredient isogeny [LR10a]

y ∈ B z ∈ A ̂ π x ∈ A π ∥ℓ∥ Let π ∶ A → B be the isogeny associated to (ai)i∈Z(ℓn). Let y ∈ B and x ∈ A be one of the ℓ antecedents. Tien ̂ π(y) ≙ ℓ.x 1 Ω 3Ω R0 R1 R2 y

slide-26
SLIDE 26

Isogenies Theory Implementation Examples and Applications

Tie contragredient isogeny [LR10a]

y ∈ B z ∈ A ̂ π x ∈ A π ∥ℓ∥ Let π ∶ A → B be the isogeny associated to (ai)i∈Z(ℓn). Let y ∈ B and x ∈ A be one of the ℓ antecedents. Tien ̂ π(y) ≙ ℓ.x 1 Ω 3Ω R0 R1 R2 y x

slide-27
SLIDE 27

Isogenies Theory Implementation Examples and Applications

Tie contragredient isogeny [LR10a]

y ∈ B z ∈ A ̂ π x ∈ A π ∥ℓ∥ Let π ∶ A → B be the isogeny associated to (ai)i∈Z(ℓn). Let y ∈ B and x ∈ A be one of the ℓ antecedents. Tien ̂ π(y) ≙ ℓ.x Explicit isogenies algorithm (Compressed) modular point from K: ( + 1)/2 ℓth-roots and ( + 1)/2 ⋅ O(log(ℓ)) chain additions. ⇒ (Compressed) isogeny:  ⋅ O(log(ℓ)) chain additions.

slide-28
SLIDE 28

Isogenies Theory Implementation Examples and Applications

Example

B: elliptic curve y2 ≙ x3 + 23x + 3 over k ≙ F31 ⇒ Tieta null point of level 4: (3 ∶ 1 ∶ 18 ∶ 1) ∈ M4(F31). K ≙ {(3 ∶ 1 ∶ 18 ∶ 1), (22 ∶ 15 ∶ 4 ∶ 1), (18 ∶ 29 ∶ 23 ∶ 1)} ⇒ modular solution: (3, η14233, η2317, 1, η1324, η5296, 18, η5296, η1324, 1, η2317, η14233) (η3 + η + 28 ≙ 0). y ≙ (η19406, η19805, η10720, 1); ̂ π(y)?

slide-29
SLIDE 29

Isogenies Theory Implementation Examples and Applications

Example

R1 ≙ (η1324, η5296, η2317, η14233) y ≙ (η19406, η19805, η10720, 1) y ⊕ R1 ≙ λ1(η2722, η28681, η26466, η2096)

slide-30
SLIDE 30

Isogenies Theory Implementation Examples and Applications

Example

R1 ≙ (η1324, η5296, η2317, η14233) y ≙ (η19406, η19805, η10720, 1) y ⊕ R1 ≙ λ1(η2722, η28681, η26466, η2096) y + 2R1 ≙ λ2

1 (η28758, η11337, η27602, η22972)

y + 3R1 ≙ λ3

1(η18374, η18773, η9688, η28758) ≙ y/η1032

so λ3

1 ≙ η28758

slide-31
SLIDE 31

Isogenies Theory Implementation Examples and Applications

Example

R1 ≙ (η1324, η5296, η2317, η14233) y ≙ (η19406, η19805, η10720, 1) y ⊕ R1 ≙ λ1(η2722, η28681, η26466, η2096) y + 2R1 ≙ λ2

1 (η28758, η11337, η27602, η22972)

y + 3R1 ≙ λ3

1(η18374, η18773, η9688, η28758) ≙ y/η1032

so λ3

1 ≙ η28758

2y + R1 ≙ λ2

1 (η17786, η12000, η16630, η365)

3y + R1 ≙ λ3

1(η7096, η11068, η8089,η20005) ≙ η5772R1

slide-32
SLIDE 32

Isogenies Theory Implementation Examples and Applications

Example

R1 ≙ (η1324, η5296, η2317, η14233) y ≙ (η19406, η19805, η10720, 1) y ⊕ R1 ≙ λ1(η2722, η28681, η26466, η2096) y + 2R1 ≙ λ2

1 (η28758, η11337, η27602, η22972)

y + 3R1 ≙ λ3

1(η18374, η18773, η9688, η28758) ≙ y/η1032

so λ3

1 ≙ η28758

2y + R1 ≙ λ2

1 (η17786, η12000, η16630, η365)

3y + R1 ≙ λ3

1(η7096, η11068, η8089,η20005) ≙ η5772R1

̂ π(y) ≙ (3, η21037, η15925, 1, η8128, η18904, 18, η12100, η14932, 1, η9121, η27841)

slide-33
SLIDE 33

Isogenies Theory Implementation Examples and Applications

Changing level by taking an isogeny

B A, A∥ℓ∥ ≙ A∥ℓ∥1 ⊕ A∥ℓ∥2 B ≙ A/A∥ℓ∥2 A C ≙ A/A∥ℓ∥1 ∥ℓ∥ ̂ π π π2 π2 ○ ̂ π: ℓ2 isogeny in level n. Modular points (corresponding to K) ⇔ A∥ℓ∥ ≙ A∥ℓ∥1 ⊕ ̂ π(B∥ℓ∥) ⇔ ℓ2-isogenies B → C.

slide-34
SLIDE 34

Isogenies Theory Implementation Examples and Applications

Changing level by taking an isogeny

B A, A∥ℓ∥ ≙ A∥ℓ∥1 ⊕ A∥ℓ∥2 B ≙ A/A∥ℓ∥2 A C ≙ A/A∥ℓ∥1 ∥ℓ∥ ̂ π π π2 π2 ○ ̂ π: ℓ2 isogeny in level n. Modular points (corresponding to K) ⇔ A∥ℓ∥ ≙ A∥ℓ∥1 ⊕ ̂ π(B∥ℓ∥) ⇔ ℓ2-isogenies B → C.

slide-35
SLIDE 35

Isogenies Theory Implementation Examples and Applications

Changing level without taking isogenies

Tieorem (Koizumi-Kempf) Let L be the space of theta functions of level ℓn and L′ the space of theta functions of level n. Let F ∈ Mr(Z) be such that tFF ≙ ℓ Id, and f ∶ Ar → Ar the corresponding isogeny. We have L ≙ f ∗L′ and the isogeny f is given by f ∗(ϑL′

i1 ⋆ . . . ⋆ ϑL′ ir ) ≙ λ

∑

(j1,..., jr)∈K1(L′)×...×K1(L′) f (j1,..., jr)≙(i1,...,ir)

ϑL

j1 ⋆ . . . ⋆ ϑL jr

F ≙ ( 1 −1

−1 1 ) gives the Riemann relations. (For general ℓ, use the

quaternions.) ⇒ Go up and down in level without taking isogenies [Cosset+R].

slide-36
SLIDE 36

Isogenies Theory Implementation Examples and Applications

A complete generalisation of Vélu’s algorithm [Cosset+R]

Compute the isogeny B → A while staying in level n. No need of ℓ-roots. Need only O(#K) difgerential additions in B + O(ℓ) or O(ℓ2) multiplications ⇒ fast. Tie formulas are rational if the kernel K is rational. Blocking part: compute K ⇒ compute all the ℓ-torsion on B.  ≙ 2: ℓ-torsion, ̃ O(ℓ6) vs O(ℓ2) or O(ℓ4) for the isogeny. ⇒ Work in level 2. ⇒ Convert back and forth to Mumford coordinates: B A Jac(C1) Jac(C2) ̂ π

slide-37
SLIDE 37

Isogenies Theory Implementation Examples and Applications

Avisogenies

Avisogenies: Magma code written by Bisson, Cosset and R.

Released under LGPL 2+. Implement isogeny computation (and applications thereof) for abelian varieties using theta functions. Current alpha release: isogenies in genus 2.

slide-38
SLIDE 38

Isogenies Theory Implementation Examples and Applications

Implementation

H hyperelliptic curve of genus 2 over k ≙ Fq, J ≙ Jac(H), ℓ odd prime, 2ℓ ∧ car k ≙ 1. Compute all rational (ℓ, ℓ)-isogenies J ↦ Jac(H′) (we suppose the zeta function known):

1

Compute the extension Fqn where the geometric points of the maximal isotropic kernel of J∥ℓ∥ lives.

2

Compute a ‘‘symplectic’’ basis of J∥ℓ∥(Fqn).

3

Find the rational maximal isotropic kernels K.

4

For each kernel K, convert its basis from Mumford to theta coordinates

  • f level 2. (Rosenhain then Tiomae).

5

Compute the other points in K in theta coordinates using difgerential additions.

6

Apply the change level formula to recover the theta null point of J/K.

7

Compute the Igusa invariants of J/K (‘‘Inverse Tiomae’’).

8

Distinguish between the isogeneous curve and its twist.

slide-39
SLIDE 39

Isogenies Theory Implementation Examples and Applications

Implementation

H hyperelliptic curve of genus 2 over k ≙ Fq, J ≙ Jac(H), ℓ odd prime, 2ℓ ∧ car k ≙ 1. Compute all rational (ℓ, ℓ)-isogenies J ↦ Jac(H′) (we suppose the zeta function known):

1

Compute the extension Fqn where the geometric points of the maximal isotropic kernel of J∥ℓ∥ lives.

2

Compute a ‘‘symplectic’’ basis of J∥ℓ∥(Fqn).

3

Find the rational maximal isotropic kernels K.

4

For each kernel K, convert its basis from Mumford to theta coordinates

  • f level 2. (Rosenhain then Tiomae).

5

Compute the other points in K in theta coordinates using difgerential additions.

6

Apply the change level formula to recover the theta null point of J/K.

7

Compute the Igusa invariants of J/K (‘‘Inverse Tiomae’’).

8

Distinguish between the isogeneous curve and its twist.

slide-40
SLIDE 40

Isogenies Theory Implementation Examples and Applications

Implementation

H hyperelliptic curve of genus 2 over k ≙ Fq, J ≙ Jac(H), ℓ odd prime, 2ℓ ∧ car k ≙ 1. Compute all rational (ℓ, ℓ)-isogenies J ↦ Jac(H′) (we suppose the zeta function known):

1

Compute the extension Fqn where the geometric points of the maximal isotropic kernel of J∥ℓ∥ lives.

2

Compute a ‘‘symplectic’’ basis of J∥ℓ∥(Fqn).

3

Find the rational maximal isotropic kernels K.

4

For each kernel K, convert its basis from Mumford to theta coordinates

  • f level 2. (Rosenhain then Tiomae).

5

Compute the other points in K in theta coordinates using difgerential additions.

6

Apply the change level formula to recover the theta null point of J/K.

7

Compute the Igusa invariants of J/K (‘‘Inverse Tiomae’’).

8

Distinguish between the isogeneous curve and its twist.

slide-41
SLIDE 41

Isogenies Theory Implementation Examples and Applications

Implementation

H hyperelliptic curve of genus 2 over k ≙ Fq, J ≙ Jac(H), ℓ odd prime, 2ℓ ∧ car k ≙ 1. Compute all rational (ℓ, ℓ)-isogenies J ↦ Jac(H′) (we suppose the zeta function known):

1

Compute the extension Fqn where the geometric points of the maximal isotropic kernel of J∥ℓ∥ lives.

2

Compute a ‘‘symplectic’’ basis of J∥ℓ∥(Fqn).

3

Find the rational maximal isotropic kernels K.

4

For each kernel K, convert its basis from Mumford to theta coordinates

  • f level 2. (Rosenhain then Tiomae).

5

Compute the other points in K in theta coordinates using difgerential additions.

6

Apply the change level formula to recover the theta null point of J/K.

7

Compute the Igusa invariants of J/K (‘‘Inverse Tiomae’’).

8

Distinguish between the isogeneous curve and its twist.

slide-42
SLIDE 42

Isogenies Theory Implementation Examples and Applications

Implementation

H hyperelliptic curve of genus 2 over k ≙ Fq, J ≙ Jac(H), ℓ odd prime, 2ℓ ∧ car k ≙ 1. Compute all rational (ℓ, ℓ)-isogenies J ↦ Jac(H′) (we suppose the zeta function known):

1

Compute the extension Fqn where the geometric points of the maximal isotropic kernel of J∥ℓ∥ lives.

2

Compute a ‘‘symplectic’’ basis of J∥ℓ∥(Fqn).

3

Find the rational maximal isotropic kernels K.

4

For each kernel K, convert its basis from Mumford to theta coordinates

  • f level 2. (Rosenhain then Tiomae).

5

Compute the other points in K in theta coordinates using difgerential additions.

6

Apply the change level formula to recover the theta null point of J/K.

7

Compute the Igusa invariants of J/K (‘‘Inverse Tiomae’’).

8

Distinguish between the isogeneous curve and its twist.

slide-43
SLIDE 43

Isogenies Theory Implementation Examples and Applications

Implementation

H hyperelliptic curve of genus 2 over k ≙ Fq, J ≙ Jac(H), ℓ odd prime, 2ℓ ∧ car k ≙ 1. Compute all rational (ℓ, ℓ)-isogenies J ↦ Jac(H′) (we suppose the zeta function known):

1

Compute the extension Fqn where the geometric points of the maximal isotropic kernel of J∥ℓ∥ lives.

2

Compute a ‘‘symplectic’’ basis of J∥ℓ∥(Fqn).

3

Find the rational maximal isotropic kernels K.

4

For each kernel K, convert its basis from Mumford to theta coordinates

  • f level 2. (Rosenhain then Tiomae).

5

Compute the other points in K in theta coordinates using difgerential additions.

6

Apply the change level formula to recover the theta null point of J/K.

7

Compute the Igusa invariants of J/K (‘‘Inverse Tiomae’’).

8

Distinguish between the isogeneous curve and its twist.

slide-44
SLIDE 44

Isogenies Theory Implementation Examples and Applications

Implementation

H hyperelliptic curve of genus 2 over k ≙ Fq, J ≙ Jac(H), ℓ odd prime, 2ℓ ∧ car k ≙ 1. Compute all rational (ℓ, ℓ)-isogenies J ↦ Jac(H′) (we suppose the zeta function known):

1

Compute the extension Fqn where the geometric points of the maximal isotropic kernel of J∥ℓ∥ lives.

2

Compute a ‘‘symplectic’’ basis of J∥ℓ∥(Fqn).

3

Find the rational maximal isotropic kernels K.

4

For each kernel K, convert its basis from Mumford to theta coordinates

  • f level 2. (Rosenhain then Tiomae).

5

Compute the other points in K in theta coordinates using difgerential additions.

6

Apply the change level formula to recover the theta null point of J/K.

7

Compute the Igusa invariants of J/K (‘‘Inverse Tiomae’’).

8

Distinguish between the isogeneous curve and its twist.

slide-45
SLIDE 45

Isogenies Theory Implementation Examples and Applications

Implementation

H hyperelliptic curve of genus 2 over k ≙ Fq, J ≙ Jac(H), ℓ odd prime, 2ℓ ∧ car k ≙ 1. Compute all rational (ℓ, ℓ)-isogenies J ↦ Jac(H′) (we suppose the zeta function known):

1

Compute the extension Fqn where the geometric points of the maximal isotropic kernel of J∥ℓ∥ lives.

2

Compute a ‘‘symplectic’’ basis of J∥ℓ∥(Fqn).

3

Find the rational maximal isotropic kernels K.

4

For each kernel K, convert its basis from Mumford to theta coordinates

  • f level 2. (Rosenhain then Tiomae).

5

Compute the other points in K in theta coordinates using difgerential additions.

6

Apply the change level formula to recover the theta null point of J/K.

7

Compute the Igusa invariants of J/K (‘‘Inverse Tiomae’’).

8

Distinguish between the isogeneous curve and its twist.

slide-46
SLIDE 46

Isogenies Theory Implementation Examples and Applications

Implementation

H hyperelliptic curve of genus 2 over k ≙ Fq, J ≙ Jac(H), ℓ odd prime, 2ℓ ∧ car k ≙ 1. Compute all rational (ℓ, ℓ)-isogenies J ↦ Jac(H′) (we suppose the zeta function known):

1

Compute the extension Fqn where the geometric points of the maximal isotropic kernel of J∥ℓ∥ lives.

2

Compute a ‘‘symplectic’’ basis of J∥ℓ∥(Fqn).

3

Find the rational maximal isotropic kernels K.

4

For each kernel K, convert its basis from Mumford to theta coordinates

  • f level 2. (Rosenhain then Tiomae).

5

Compute the other points in K in theta coordinates using difgerential additions.

6

Apply the change level formula to recover the theta null point of J/K.

7

Compute the Igusa invariants of J/K (‘‘Inverse Tiomae’’).

8

Distinguish between the isogeneous curve and its twist.

slide-47
SLIDE 47

Isogenies Theory Implementation Examples and Applications

Computing the right extension

J ≙ Jac(H) abelian variety of dimension 2. χ(X) the corresponding zeta function. Degree of a point of ℓ-torsion ∣ the order of X in Fℓ∥X∥/χ(X). If K rational, K(k) ≃ (Z/ℓZ)2, the degree of a point in K ∣ the LCM of

  • rders of X in Fℓ∥X∥/P(X) for P ∣ χ of degree two.

Since we are looking to K maximal isotropic, J∥ℓ∥ ≃ K ⊕ K′ and we know that P ∣ χ is such that χ(X) ≡ P(X)P(X) mod ℓ where X ≙ q/X represents the Verschiebung. Remark Tie degree n is ⩽ ℓ2 − 1. If ℓ is totally split in Z∥π, π∥ then n ∣ ℓ − 1.

slide-48
SLIDE 48

Isogenies Theory Implementation Examples and Applications

Computing the ℓ-torsion

We want to compute J(Fqn)∥ℓ∥. From the zeta function χ(X) we can compute random points in J(Fqn)∥ℓ∞∥ uniformly. If P is in J(Fqn)∥ℓ∞∥, ℓmP ∈ J(Fqn)∥ℓ∥ for a suitable m. Tiis does not give uniform points of ℓ-torsion but we can correct the points obtained. Example Suppose J(Fqn)∥ℓ∞∥ ≙< P1, P2 > with P1 of order ℓ2 and P2 of order ℓ. First random point Q1 ≙ P1 ⇒ we recover the point of ℓ-torsion: ℓ.P1. Second random point Q2 ≙ αP1 + βP2. If α ≠ 0 we recover the point of ℓ-torsion αℓP1 which is not a new generator. We correct the original point: Q′

2 ≙ Q2 − αQ1 ≙ βP2.

slide-49
SLIDE 49

Isogenies Theory Implementation Examples and Applications

Weil pairing

Used to decompose a point P ∈ J∥ℓ∥ in term of a basis of the ℓ-torsion (and to construct a symplectic basis). Tie magma implementation is extremely slow in genus 2 for non degenerate divisors. But since we convert the points in theta coordinates we can use the pairing in theta coordinates [LR10b].

slide-50
SLIDE 50

Isogenies Theory Implementation Examples and Applications

Timings for isogenies computations (ℓ ≙ 7)

Jacobian of Hyperelliptic Curve defined by y^2 = t^254*x^6 + t^223*x^5 + t^255*x^4 + t^318*x^3 + t^668*x^2 + t^543*x + t^538 over GF(3^6) > time RationallyIsogenousCurvesG2(J,7); ** Computing 7 -rationnal isotropic subgroups

  • - Computing the 7 -torsion over extension of deg 4

!! Basis: 2 points in Finite field of size 3^24

  • - Listing subgroups

1 subgroups over Finite field of size 3^24

  • - Convert the subgroups to theta coordinates

Time: 0.060 Computing the 1 7 -isogenies ** Precomputations for l= 7 Time: 0.180 ** Computing the 7 -isogeny Computing the l-torsion Time: 0.030 Changing level Time: 0.210 Time: 0.430 Time: 0.490 [ <[ t^620, t^691, t^477 ], Jacobian of Hyperelliptic Curve defined by y^2 = t^615*x^6 + t^224*x^5 + t^37*x^4 + t^303*x^3 + t^715*x^2 + t^128*x

slide-51
SLIDE 51

Isogenies Theory Implementation Examples and Applications

Timings for isogenies computations (ℓ ≙ 5)

Jacobian of Hyperelliptic Curve defined by y^2 = 39*x^6 + 4*x^5 + 82*x^4 + 10*x^3 + 31*x^2 + 39*x + 2 over GF(83) > time RationallyIsogenousCurvesG2(J,5); ** Computing 5 -rationnal isotropic subgroups

  • - Computing the 5 -torsion over extension of deg 24

Time: 0.940 !! Basis: 4 points in Finite field of size 83^24

  • - Listing subgroups

Time: 1.170 6 subgroups over Finite field of size 83^24

  • - Convert the subgroups to theta coordinates

Time: 0.360 Time: 2.630 Computing the 6 5 -isogenies Time: 0.820 Time: 3.460 [ <[ 36, 69, 38 ], Jacobian of Hyperelliptic Curve defined by y^2 = 27*x^6 + 63*x^5 + 5*x^4 + 24*x^3 + 34*x^2 + 6*x + 76 over GF(83)>, ...]

slide-52
SLIDE 52

Isogenies Theory Implementation Examples and Applications

Timings for isogeny graphs (ℓ ≙ 3)

Jacobian of Hyperelliptic Curve defined by y^2 = 41*x^6 + 131*x^5 + 55*x^4 + 57*x^3 + 233*x^2 + 225*x + 51 over GF(271) time isograph,jacobians:=IsoGraphG2(J,{3}: save_mem:=-1); Computed 540 isogenies and found 135 curves. Time: 14.410

Core 2 with 4BG of RAM. Computing kernels: ≈ 5s. Computing isogenies: ≈ 7s (Torsion: ≈ 2s, Changing level: ≈ 3.5s.)

slide-53
SLIDE 53

Isogenies Theory Implementation Examples and Applications

Going further (ℓ ≙ 53)

Jacobian of Hyperelliptic Curve defined by y^2 = 97*x^6 + 77*x^5 + 62*x^4 + 14*x^3 + 33*x^2 + 18*x + 40 over GF(113) > time RationallyIsogenousCurvesG2(J,53); ** Computing 53 -rationnal isotropic subgroups

  • - Computing the 53 -torsion over extension of deg 52 Time: 8.610

!! Basis: 3 points in Finite field of size 113^52

  • - Listing subgroups Time: 1.210

2 subgroups over Finite field of size 113^52

  • - Convert the subgroups to theta coordinates Time: 0.100

Time: 9.980 Computing the 2 53 -isogenies ** Precomputations for l= 53 Time: 0.240 ** Computing the 53 -isogeny Computing the l-torsion Time: 7.570 Changing level Time: 1.170 Time: 8.840 ** Computing the 53 -isogeny Time: 8.850 Time: 27.950

slide-54
SLIDE 54

Isogenies Theory Implementation Examples and Applications

Going further (ℓ ≙ 19)

Jacobian of Hyperelliptic Curve defined by y^2 = 194*x^6 + 554*x^5 + 606*x^4 + 523*x^3 + 642*x^2 + 566*x + 112 over GF(859) > time RationallyIsogenousCurvesG2(J,19); ** Computing 19 -rationnal isotropic subgroups (extension degree 18) Time: 0.760 Computing the 2 19 -isogenies ** Precomputations for l= 19 Time: 11.160 ** Computing the 19 -isogeny Computing the l-torsion Time: 0.250 Changing level Time: 18.590 Time: 18.850 ** Computing the 19 -isogeny Computing the l-torsion Time: 0.250 Changing level Time: 18.640 Time: 18.900 Time: 51.060 [ <[ 341, 740, 389 ], Jacobian of Hyperelliptic Curve defined by y^2 = 724 680*x^5 + 538*x^4 + 613*x^3 + 557*x^2 + 856*x + 628 over GF(859)>, ... ]

slide-55
SLIDE 55

Isogenies Theory Implementation Examples and Applications

A record isogeny computation! (ℓ ≙ 1321)

J Jacobian of y2 = x5 + 41691x4 + 24583x3 + 2509x2 + 15574x over F42179. #J = 21013212.

> time RationallyIsogenousCurvesG2(J,1321:ext_degree:=1); ** Computing 1321 -rationnal isotropic subgroups Time: 0.350 Computing the 1 1321 -isogenies ** Precomputations for l= 1321 Time: 1276.950 ** Computing the 1321 -isogeny Computing the l-torsion Time: 1200.270 Changing level Time: 1398.780 Time: 5727.250 Time: 7004.240 Time: 7332.650 [ <[ 9448, 15263, 31602 ], Jacobian of Hyperelliptic Curve defined by y^2 = 33266*x^6 + 20155*x^5 + 31203*x^4 + 9732*x^3 + 4204*x^2 + 18026*x + 29732 over GF(42179)> ]

Core 2 with 32GB of RAM.

slide-56
SLIDE 56

Isogenies Theory Implementation Examples and Applications

Isogeny graphs: ℓ ≙ q1q2 ≙ Q1Q1Q2Q2 (Q ↦ K0 ↦ K)

slide-57
SLIDE 57

Isogenies Theory Implementation Examples and Applications

Isogeny graphs: ℓ ≙ q1q2 ≙ Q1Q1Q2Q2 (Q ↦ K0 ↦ K)

slide-58
SLIDE 58

Isogenies Theory Implementation Examples and Applications

Isogeny graphs: ℓ ≙ q ≙ QQ (Q ↦ K0 ↦ K)

slide-59
SLIDE 59

Isogenies Theory Implementation Examples and Applications

Isogeny graphs: ℓ ≙ q1q2 ≙ Q1Q1Q2

2

(Q ↦ K0 ↦ K)

slide-60
SLIDE 60

Isogenies Theory Implementation Examples and Applications

Isogeny graphs: ℓ ≙ q2 ≙ Q2Q

2

(Q ↦ K0 ↦ K)

slide-61
SLIDE 61

Isogenies Theory Implementation Examples and Applications

Isogeny graphs: ℓ ≙ q2 ≙ Q4 (Q ↦ K0 ↦ K)

slide-62
SLIDE 62

Isogenies Theory Implementation Examples and Applications

Non maximal isogeny graphs (ℓ ≙ q ≙ QQ)

slide-63
SLIDE 63

Isogenies Theory Implementation Examples and Applications

Non maximal isogeny graphs (ℓ ≙ q ≙ QQ)

12 12 3 24 3 12 3 24 3 3 3 72 3

slide-64
SLIDE 64

Isogenies Theory Implementation Examples and Applications

Non maximal isogeny graphs (ℓ ≙ q ≙ QQ)

27 243 243 27 27 243 27 3 27 243 243 243 243 243 243 27 243 243 243 27 243 27 243 243 27 243 243 27 27 243 3 27 243 27 27 243 3 243 27 1 243 243 27 3 27 27 243 243 243 27 3 243 243 243 27 243 243 243 3 1 243 243 243 243 243 243 243 27 243 3 243 243 27 243 243 243 27 243 3 1 1 243 243 243 243 243 243 243 243 243 243 243 243 243 243 243 243 243 243 243 27 243 243 243 243 243 243 243

slide-65
SLIDE 65

Isogenies Theory Implementation Examples and Applications

Non maximal isogeny graphs (ℓ ≙ q1q2 ≙ Q1Q1Q2Q2)

slide-66
SLIDE 66

Isogenies Theory Implementation Examples and Applications

Non maximal isogeny graphs (ℓ ≙ q1q2 ≙ Q1Q1Q2Q2)

slide-67
SLIDE 67

Isogenies Theory Implementation Examples and Applications

Non maximal isogeny graphs (ℓ ≙ q1q2 ≙ Q1Q1Q2Q2)

slide-68
SLIDE 68

Isogenies Theory Implementation Examples and Applications

Non maximal isogeny graphs (ℓ ≙ q ≙ Q2)

slide-69
SLIDE 69

Isogenies Theory Implementation Examples and Applications

Non maximal isogeny graphs (ℓ ≙ q ≙ Q2)

1 9 9 9 9 9 9 1

slide-70
SLIDE 70

Isogenies Theory Implementation Examples and Applications

Applications of isogenies to higher genus

Computing endomorphism ring. Generalize [BS09] to higher genus, work by Bisson. Class polynomials in genus 2 using the CRT. If K is a CM fjeld and J/Fp is such that End(J) ⊗Z Q ≙ K, use isogenies to fjnd the Jacobians whose endomorphism ring is OK. Work by Lauter+R. Modular polynomials in genus 2 using theta null points: computed by Gruenewald using analytic methods for ℓ ≙ 3. Question How to compute (ℓ, 1)-isogenies in genus 2?

slide-71
SLIDE 71

Isogenies Theory Implementation Examples and Applications

Tiank you for your attention!

slide-72
SLIDE 72

Isogenies Theory Implementation Examples and Applications

Bibliography

[BS09]

  • G. Bisson and A.V. Sutherland. “Computing the endomorphism ring of an ordinary

elliptic curve over a finite field”. In: Journal of Number Theory (2009). (Cit. on p. 70). [FLR09] Jean-Charles Faugère, David Lubicz, and Damien Robert. Computing modular correspondences for abelian varieties. May 2009. arXiv: 0910.4668. (Cit. on pp. 17–19). [LR10a] David Lubicz and Damien Robert. Computing isogenies between abelian varieties. Jan.

  • 2010. arXiv: 1001.2016. (Cit. on pp. 20–27).

[LR10b] David Lubicz and Damien Robert. Efficient pairing computation with theta functions.

  • Ed. by Guillaume Hanrot, François Morain, and Emmanuel Thomé. 9th International

Symposium, Nancy, France, ANTS-IX, July 19-23, 2010, Proceedings. Jan. 2010. url:

http://www.normalesup.org/~robert/pro/publications/articles/pairings.pdf.

(Cit. on p. 49). [Smi09] Benjamin Smith. Isogenies and the Discrete Logarithm Problem in Jacobians of Genus 3 Hyperelliptic Curves. Feb. 2009. arXiv: 0806.2995. (Cit. on pp. 11, 12).