Point counting on hyperelliptic curves: to genus 3 and beyond Simon Abelard Université de Lorraine, Nancy Joint work with P. Gaudry and P.-J. Spaenlehauer January 25, 2018 CARAMBA /* */ E,C, /* */ c,r, /* */ u,l, e,s, i=5, d[5],Q[999 ]={0};main(n ){for (;i--;e=scanf("%" "d",d+i));for(C =*d; ++i<C ;++Q[ i*i% C],c= i[Q]? c:i); for(;i --;) for(u =C;u --;n +=!u*Q [l%C ],e+= Q[(C +l*l- c*s* s%C) %C]) for( l=i,s=u,r=4;r;E= i*l+c*u*s,s=(u*l +i*s) %C,l=E%C+r --[d]);printf ("%d" "\n", (e+n* n)/2 /* cc caramba.c; echo f3 f2 f1 f0 p | ./a.out */ -C);} Simon Abelard Point counting January 25, 2018 1 / 18
It’s all about generating series. . . A first example How many solutions of y 2 = x 7 − 7 x 5 + 14 x 3 − 7 x + 1 in F 23 k ? Goal: generating series associated to these numbers of solutions. This series is rational so small k ’s are sufficient ( ≤ 3 in this case). Simon Abelard Point counting January 25, 2018 2 / 18
It’s all about generating series. . . A first example How many solutions of y 2 = x 7 − 7 x 5 + 14 x 3 − 7 x + 1 in F 23 k ? Goal: generating series associated to these numbers of solutions. This series is rational so small k ’s are sufficient ( ≤ 3 in this case). Curves and points Let f ∈ F q [ X ] be monic, squarefree of degree 2 g + 1. Equation Y 2 = f ( X ) → hyperelliptic curve C of genus g over F q . If C defined over F q , P = ( x , y ) ∈ C is rational if ( x , y ) ∈ ( F q ) 2 . Simon Abelard Point counting January 25, 2018 2 / 18
It’s all about generating series. . . A first example How many solutions of y 2 = x 7 − 7 x 5 + 14 x 3 − 7 x + 1 in F 23 k ? Goal: generating series associated to these numbers of solutions. This series is rational so small k ’s are sufficient ( ≤ 3 in this case). Curves and points Let f ∈ F q [ X ] be monic, squarefree of degree 2 g + 1. Equation Y 2 = f ( X ) → hyperelliptic curve C of genus g over F q . If C defined over F q , P = ( x , y ) ∈ C is rational if ( x , y ) ∈ ( F q ) 2 . � � ( x , y ) ∈ ( F q i ) 2 | y 2 = f ( x ) Let C ( F q i ) = ∪ {∞} . Point counting: computing # C ( F q i ) for 1 ≤ i ≤ g . Simon Abelard Point counting January 25, 2018 2 / 18
. . . Or rather polynomials Let C be a hyperelliptic curve of genus g . Weil conjectures to the rescue Point counting over F q is computing the local ζ function of C : �� � # C ( F q k ) s k Λ( s ) thm ζ ( s ) = exp = (1 − s )(1 − qs ) . k k With Λ ∈ Z [ X ] of degree 2 g having bounded coefficients. Simon Abelard Point counting January 25, 2018 3 / 18
. . . Or rather polynomials Let C be a hyperelliptic curve of genus g . Weil conjectures to the rescue Point counting over F q is computing the local ζ function of C : �� � # C ( F q k ) s k Λ( s ) thm ζ ( s ) = exp = (1 − s )(1 − qs ) . k k With Λ ∈ Z [ X ] of degree 2 g having bounded coefficients. Point counting Input: f ∈ F q [ X ] defining a hyperelliptic curve Output: the polynomial Λ Simon Abelard Point counting January 25, 2018 3 / 18
. . . Or rather polynomials Let C be a hyperelliptic curve of genus g . Weil conjectures to the rescue Point counting over F q is computing the local ζ function of C : �� � # C ( F q k ) s k Λ( s ) thm ζ ( s ) = exp = (1 − s )(1 − qs ) . k k With Λ ∈ Z [ X ] of degree 2 g having bounded coefficients. Point counting Input: f ∈ F q [ X ] defining a hyperelliptic curve Output: the polynomial Λ We study the complexity of such algorithms. Simon Abelard Point counting January 25, 2018 3 / 18
A broad range of related problems Finding ‘nice’ curves Cryptography: g ≤ 2 and q large, needed to assess security. Error-correcting codes: need curves with many rational points. Arithmetic geometry Conjectures in number theory e.g. Sato -Tate in genus ≥ 2. p A p / p s with A p = # C ( F p ) / √ p . � L -functions associated: L ( s , C ) = Computing them relies on point-counting primitives. Simon Abelard Point counting January 25, 2018 4 / 18
A broad range of related problems Finding ‘nice’ curves Cryptography: g ≤ 2 and q large, needed to assess security. Error-correcting codes: need curves with many rational points. Arithmetic geometry Conjectures in number theory e.g. Sato -Tate in genus ≥ 2. p A p / p s with A p = # C ( F p ) / √ p . � L -functions associated: L ( s , C ) = Computing them relies on point-counting primitives. Two families of algorithms p -adic methods: polynomial in g , exponential in log p Satoh’99, Kedlaya’01, Lauder’04 ℓ -adic methods: exponential in g , polynomial in log q Schoof’85, Gaudry-Schost’12 Simon Abelard Point counting January 25, 2018 4 / 18
Overview and contributions Asymptotic complexities (hyperelliptic case) Our result Pila’90 Huang-Ierardi’98 Adleman-Huang’01 (log q ) O ( g 2 log g ) (log q ) g O (1) (log q ) O g (1) O g ((log q ) cg ) Simon Abelard Point counting January 25, 2018 5 / 18
Overview and contributions Asymptotic complexities (hyperelliptic case) Our result Pila’90 Huang-Ierardi’98 Adleman-Huang’01 (log q ) O ( g 2 log g ) (log q ) g O (1) (log q ) O g (1) O g ((log q ) cg ) Practical algorithms Genus Complexity Authors O (log 4 q ) � g = 1 Schoof-Elkies-Atkin O (log 8 q ) � g = 2 Gaudry-Schost O (log 14 q ) ? � g = 3 O (log 5 q ) � g = 2 with RM Gaudry-Kohel-Smith O (log 6 q ) � g = 3 with RM Our result Simon Abelard Point counting January 25, 2018 5 / 18
From curves to groups R R 2 Q Q 1 P 2 P R 1 P 1 Q 2 P + Q + R = 0 P 1 + P 2 + Q 1 + Q 2 + R 1 + R 2 = 0 Simon Abelard Point counting January 25, 2018 6 / 18
Counting points on hyperelliptic curves Let C : y 2 = f ( x ) be a hyperelliptic curve over F q . Let J be its Jacobian and g its genus. (Hasse-Weil) coefficients of Λ are bounded integers. 1 ℓ -torsion J [ ℓ ] = { D ∈ J | ℓ D = 0 } ≃ ( Z /ℓ Z ) 2 g 2 Frobenius π : ( x , y ) �→ ( x q , y q ) acts linearly on J [ ℓ ] 3 For χ the char. polynomial of π , χ rev = Λ mod ℓ 4 Algorithm a la Schoof For each prime ℓ ≤ (9 g + 3) log q Describe I ℓ the ideal of ℓ -torsion Compute χ mod ℓ by testing char. eq. of π in I ℓ Deduce Λ mod ℓ Recover Λ by CRT Simon Abelard Point counting January 25, 2018 7 / 18
Counting points on hyperelliptic curves Let C : y 2 = f ( x ) be a hyperelliptic curve over F q . Let J be its Jacobian and g its genus. (Hasse-Weil) coefficients of Λ are bounded integers. 1 ℓ -torsion J [ ℓ ] = { D ∈ J | ℓ D = 0 } ≃ ( Z /ℓ Z ) 2 g 2 Frobenius π : ( x , y ) �→ ( x q , y q ) acts linearly on J [ ℓ ] 3 For χ the char. polynomial of π , χ rev = Λ mod ℓ 4 Algorithm a la Schoof For each prime ℓ ≤ (9 g + 3) log q Describe I ℓ the ideal of ℓ -torsion Compute χ mod ℓ by testing char. eq. of π in I ℓ Deduce Λ mod ℓ Recover Λ by CRT Simon Abelard Point counting January 25, 2018 7 / 18
Counting points on hyperelliptic curves Let C : y 2 = f ( x ) be a hyperelliptic curve over F q . Let J be its Jacobian and g its genus. (Hasse-Weil) coefficients of Λ are bounded integers. 1 ℓ -torsion J [ ℓ ] = { D ∈ J | ℓ D = 0 } ≃ ( Z /ℓ Z ) 2 g 2 Frobenius π : ( x , y ) �→ ( x q , y q ) acts linearly on J [ ℓ ] 3 For χ the char. polynomial of π , χ rev = Λ mod ℓ 4 Algorithm a la Schoof For each prime ℓ ≤ (9 g + 3) log q Describe I ℓ the ideal of ℓ -torsion Compute χ mod ℓ by testing char. eq. of π in I ℓ Deduce Λ mod ℓ Recover Λ by CRT Simon Abelard Point counting January 25, 2018 7 / 18
Counting points on hyperelliptic curves Let C : y 2 = f ( x ) be a hyperelliptic curve over F q . Let J be its Jacobian and g its genus. (Hasse-Weil) coefficients of Λ are bounded integers. 1 ℓ -torsion J [ ℓ ] = { D ∈ J | ℓ D = 0 } ≃ ( Z /ℓ Z ) 2 g 2 Frobenius π : ( x , y ) �→ ( x q , y q ) acts linearly on J [ ℓ ] 3 For χ the char. polynomial of π , χ rev = Λ mod ℓ 4 Algorithm a la Schoof For each prime ℓ ≤ (9 g + 3) log q Describe I ℓ the ideal of ℓ -torsion Compute χ mod ℓ by testing char. eq. of π in I ℓ Deduce Λ mod ℓ Recover Λ by CRT Simon Abelard Point counting January 25, 2018 7 / 18
Handling the torsion Goal: represent J [ ℓ ], ideal of ℓ -torsion. Method: write ℓ D = 0 formally, then ‘solve’ that system. Here comes trouble. . . How to model and solve it efficiently? Simon Abelard Point counting January 25, 2018 8 / 18
Handling the torsion Goal: represent J [ ℓ ], ideal of ℓ -torsion. Method: write ℓ D = 0 formally, then ‘solve’ that system. Here comes trouble. . . How to model and solve it efficiently? − → multihomogeneous structure Simon Abelard Point counting January 25, 2018 8 / 18
Modelling the ℓ -torsion Writing ℓ D = 0 Formally, D = P 1 + · · · + P g , coordinates of P i ( x i , y i ) are variables. Compute ℓ P i , then apply zero-test to ℓ D = � i ℓ P i . Simon Abelard Point counting January 25, 2018 9 / 18
Modelling the ℓ -torsion Writing ℓ D = 0 Formally, D = P 1 + · · · + P g , coordinates of P i ( x i , y i ) are variables. Compute ℓ P i , then apply zero-test to ℓ D = � i ℓ P i . ⇒ there is a ϕ ( X , Y ) = P ( X ) + YQ ( X ) such that ℓ D = ( ϕ ). Simon Abelard Point counting January 25, 2018 9 / 18
Recommend
More recommend
