87 research outputs found
Explicit endomorphisms and correspondences
In this work, we investigate methods for computing explicitly with homomorphisms (and particularly endomorphisms) of Jacobian varieties of algebraic curves. Our principal tool is the theory of correspondences, in which homomorphisms of Jacobians are represented by divisors on products of curves. We give families of hyperelliptic curves of genus three, five, six, seven, ten and fifteen whose Jacobians have explicit isogenies (given in terms of correspondences) to other hyperelliptic Jacobians. We describe several families of hyperelliptic curves whose Jacobians have complex or real multiplication; we use correspondences to make the complex and real multiplication explicit, in the form of efficiently computable maps on ideal class representatives. These explicit endomorphisms may be used for efficient integer multiplication on hyperelliptic Jacobians, extending Gallant--Lambert--Vanstone fast multiplication techniques from elliptic curves to higher dimensional Jacobians. We then describe Richelot isogenies for curves of genus two; in contrast to classical treatments of these isogenies, we consider all the Richelot isogenies from a given Jacobian simultaneously. The inter-relationship of Richelot isogenies may be used to deduce information about the endomorphism ring structure of Jacobian surfaces; we conclude with a brief exploration of these techniques
Easy scalar decompositions for efficient scalar multiplication on elliptic curves and genus 2 Jacobians
The first step in elliptic curve scalar multiplication algorithms based on
scalar decompositions using efficient endomorphisms-including
Gallant-Lambert-Vanstone (GLV) and Galbraith-Lin-Scott (GLS) multiplication, as
well as higher-dimensional and higher-genus constructions-is to produce a short
basis of a certain integer lattice involving the eigenvalues of the
endomorphisms. The shorter the basis vectors, the shorter the decomposed scalar
coefficients, and the faster the resulting scalar multiplication. Typically,
knowledge of the eigenvalues allows us to write down a long basis, which we
then reduce using the Euclidean algorithm, Gauss reduction, LLL, or even a more
specialized algorithm. In this work, we use elementary facts about quadratic
rings to immediately write down a short basis of the lattice for the GLV, GLS,
GLV+GLS, and Q-curve constructions on elliptic curves, and for genus 2 real
multiplication constructions. We do not pretend that this represents a
significant optimization in scalar multiplication, since the lattice reduction
step is always an offline precomputation---but it does give a better insight
into the structure of scalar decompositions. In any case, it is always more
convenient to use a ready-made short basis than it is to compute a new one
Families of fast elliptic curves from Q-curves
We construct new families of elliptic curves over \FF_{p^2} with
efficiently computable endomorphisms, which can be used to accelerate elliptic
curve-based cryptosystems in the same way as Gallant-Lambert-Vanstone (GLV) and
Galbraith-Lin-Scott (GLS) endomorphisms. Our construction is based on reducing
\QQ-curves-curves over quadratic number fields without complex
multiplication, but with isogenies to their Galois conjugates-modulo inert
primes. As a first application of the general theory we construct, for every
, two one-parameter families of elliptic curves over \FF_{p^2}
equipped with endomorphisms that are faster than doubling. Like GLS (which
appears as a degenerate case of our construction), we offer the advantage over
GLV of selecting from a much wider range of curves, and thus finding secure
group orders when is fixed. Unlike GLS, we also offer the possibility of
constructing twist-secure curves. Among our examples are prime-order curves
equipped with fast endomorphisms, with almost-prime-order twists, over
\FF_{p^2} for and
Counting Points on Genus 2 Curves with Real Multiplication
We present an accelerated Schoof-type point-counting algorithm for curves of
genus 2 equipped with an efficiently computable real multiplication
endomorphism. Our new algorithm reduces the complexity of genus 2 point
counting over a finite field (\F_{q}) of large characteristic from
(\widetilde{O}(\log^8 q)) to (\widetilde{O}(\log^5 q)). Using our algorithm we
compute a 256-bit prime-order Jacobian, suitable for cryptographic
applications, and also the order of a 1024-bit Jacobian
Counting points on hyperelliptic curves with explicit real multiplication in arbitrary genus
We present a probabilistic Las Vegas algorithm for computing the local zeta
function of a genus- hyperelliptic curve defined over with
explicit real multiplication (RM) by an order in a degree-
totally real number field.
It is based on the approaches by Schoof and Pila in a more favorable case
where we can split the -torsion into kernels of endomorphisms, as
introduced by Gaudry, Kohel, and Smith in genus 2. To deal with these kernels
in any genus, we adapt a technique that the author, Gaudry, and Spaenlehauer
introduced to model the -torsion by structured polynomial systems.
Applying this technique to the kernels, the systems we obtain are much smaller
and so is the complexity of solving them.
Our main result is that there exists a constant such that, for any
fixed , this algorithm has expected time and space complexity as grows and the characteristic is large enough. We prove that
and we also conjecture that the result still holds for .Comment: To appear in Journal of Complexity. arXiv admin note: text overlap
with arXiv:1710.0344
The Q-curve construction for endomorphism-accelerated elliptic curves
We give a detailed account of the use of -curve reductions to
construct elliptic curves over with efficiently computable
endomorphisms, which can be used to accelerate elliptic curve-based
cryptosystems in the same way as Gallant--Lambert--Vanstone (GLV) and
Galbraith--Lin--Scott (GLS) endomorphisms. Like GLS (which is a degenerate case
of our construction), we offer the advantage over GLV of selecting from a much
wider range of curves, and thus finding secure group orders when is fixed
for efficient implementation. Unlike GLS, we also offer the possibility of
constructing twist-secure curves. We construct several one-parameter families
of elliptic curves over equipped with efficient
endomorphisms for every p \textgreater{} 3, and exhibit examples of
twist-secure curves over for the efficient Mersenne prime
.Comment: To appear in the Journal of Cryptology. arXiv admin note: text
overlap with arXiv:1305.540
Easy scalar decompositions for efficient scalar multiplication on elliptic curves and genus 2 Jacobians
International audienceThe first step in elliptic curve scalar multiplication algorithms based on scalar decompositions using efficient endomorphisms---including Gallant--Lambert--Vanstone (GLV) and Galbraith--Lin--Scott (GLS) multiplication, as well as higher-dimensional and higher-genus constructions---is to produce a short basis of a certain integer lattice involving the eigenvalues of the endomorphisms. The shorter the basis vectors, the shorter the decomposed scalar coefficients, and the faster the resulting scalar multiplication. Typically, knowledge of the eigenvalues allows us to write down a long basis, which we then reduce using the Euclidean algorithm, Gauss reduction, LLL, or even a more specialized algorithm. In this work, we use elementary facts about quadratic rings to immediately write down a short basis of the lattice for the GLV, GLS, GLV+GLS, and Q-curve constructions on elliptic curves, and for genus 2 real multiplication constructions. We do not pretend that this represents a significant optimization in scalar multiplication, since the lattice reduction step is always an offline precomputation---but it does give a better insight into the structure of scalar decompositions. In any case, it is always more convenient to use a ready-made short basis than it is to compute a new one
Horizontal isogeny graphs of ordinary abelian varieties and the discrete logarithm problem
Fix an ordinary abelian variety defined over a finite field. The ideal class
group of its endomorphism ring acts freely on the set of isogenous varieties
with same endomorphism ring, by complex multiplication. Any subgroup of the
class group, and generating set thereof, induces an isogeny graph on the orbit
of the variety for this subgroup. We compute (under the Generalized Riemann
Hypothesis) some bounds on the norms of prime ideals generating it, such that
the associated graph has good expansion properties.
We use these graphs, together with a recent algorithm of Dudeanu, Jetchev and
Robert for computing explicit isogenies in genus 2, to prove random
self-reducibility of the discrete logarithm problem within the subclasses of
principally polarizable ordinary abelian surfaces with fixed endomorphism ring.
In addition, we remove the heuristics in the complexity analysis of an
algorithm of Galbraith for explicitly computing isogenies between two elliptic
curves in the same isogeny class, and extend it to a more general setting
including genus 2.Comment: 18 page
Fast Endomorphism for any Genus 2 Hyperelliptic Curve over a Finite Field of Even Characteristic
In EUROCRYPT 2009, Galbraith, Lin and Scott constructed an efficiently computable endomorphism for a large family of elliptic curves defined over finite fields of large characteristic. They demonstrated that the endomorphism can be used to accelerate scalar multiplication in the elliptic curve cryptosystem based on these curves. In this paper we extend the method to any genus 2 hyperelliptic curve defined over a finite field of even characteristic. We propose an efficient algorithm to generate a random genus 2 hyperelliptic curve and its quadratic twist equipped with a fast endomorphism on the Jacobian. The analysis of the operation amount of the scalar multiplication is also given
Distortion maps for genus two curves
Distortion maps are a useful tool for pairing based cryptography. Compared
with elliptic curves, the case of hyperelliptic curves of genus g > 1 is more
complicated since the full torsion subgroup has rank 2g. In this paper we prove
that distortion maps always exist for supersingular curves of genus g>1 and we
construct distortion maps in genus 2 (for embedding degrees 4,5,6 and 12).Comment: 16 page
- …