91 research outputs found
Modular polynomials via isogeny volcanoes
We present a new algorithm to compute the classical modular polynomial Phi_n
in the rings Z[X,Y] and (Z/mZ)[X,Y], for a prime n and any positive integer m.
Our approach uses the graph of n-isogenies to efficiently compute Phi_n mod p
for many primes p of a suitable form, and then applies the Chinese Remainder
Theorem (CRT). Under the Generalized Riemann Hypothesis (GRH), we achieve an
expected running time of O(n^3 (log n)^3 log log n), and compute Phi_n mod m
using O(n^2 (log n)^2 + n^2 log m) space. We have used the new algorithm to
compute Phi_n with n over 5000, and Phi_n mod m with n over 20000. We also
consider several modular functions g for which Phi_n^g is smaller than Phi_n,
allowing us to handle n over 60000.Comment: corrected a typo in equation (14), 31 page
On the evaluation of modular polynomials
We present two algorithms that, given a prime ell and an elliptic curve E/Fq,
directly compute the polynomial Phi_ell(j(E),Y) in Fq[Y] whose roots are the
j-invariants of the elliptic curves that are ell-isogenous to E. We do not
assume that the modular polynomial Phi_ell(X,Y) is given. The algorithms may be
adapted to handle other types of modular polynomials, and we consider
applications to point counting and the computation of endomorphism rings. We
demonstrate the practical efficiency of the algorithms by setting a new
point-counting record, modulo a prime q with more than 5,000 decimal digits,
and by evaluating a modular polynomial of level ell = 100,019.Comment: 19 pages, corrected a typo in equation (8) and added equation (9
Hard isogeny problems over RSA moduli and groups with infeasible inversion
We initiate the study of computational problems on elliptic curve isogeny
graphs defined over RSA moduli. We conjecture that several variants of the
neighbor-search problem over these graphs are hard, and provide a comprehensive
list of cryptanalytic attempts on these problems. Moreover, based on the
hardness of these problems, we provide a construction of groups with infeasible
inversion, where the underlying groups are the ideal class groups of imaginary
quadratic orders.
Recall that in a group with infeasible inversion, computing the inverse of a
group element is required to be hard, while performing the group operation is
easy. Motivated by the potential cryptographic application of building a
directed transitive signature scheme, the search for a group with infeasible
inversion was initiated in the theses of Hohenberger and Molnar (2003). Later
it was also shown to provide a broadcast encryption scheme by Irrer et al.
(2004). However, to date the only case of a group with infeasible inversion is
implied by the much stronger primitive of self-bilinear map constructed by
Yamakawa et al. (2014) based on the hardness of factoring and
indistinguishability obfuscation (iO). Our construction gives a candidate
without using iO.Comment: Significant revision of the article previously titled "A Candidate
Group with Infeasible Inversion" (arXiv:1810.00022v1). Cleared up the
constructions by giving toy examples, added "The Parallelogram Attack" (Sec
5.3.2). 54 pages, 8 figure
Computing Hilbert class polynomials with the Chinese Remainder Theorem
We present a space-efficient algorithm to compute the Hilbert class
polynomial H_D(X) modulo a positive integer P, based on an explicit form of the
Chinese Remainder Theorem. Under the Generalized Riemann Hypothesis, the
algorithm uses O(|D|^(1/2+o(1))log P) space and has an expected running time of
O(|D|^(1+o(1)). We describe practical optimizations that allow us to handle
larger discriminants than other methods, with |D| as large as 10^13 and h(D) up
to 10^6. We apply these results to construct pairing-friendly elliptic curves
of prime order, using the CM method.Comment: 37 pages, corrected a typo that misstated the heuristic complexit
Computing cardinalities of Q-curve reductions over finite fields
We present a specialized point-counting algorithm for a class of elliptic
curves over F\_{p^2} that includes reductions of quadratic Q-curves modulo
inert primes and, more generally, any elliptic curve over F\_{p^2} with a
low-degree isogeny to its Galois conjugate curve. These curves have interesting
cryptographic applications. Our algorithm is a variant of the
Schoof--Elkies--Atkin (SEA) algorithm, but with a new, lower-degree
endomorphism in place of Frobenius. While it has the same asymptotic asymptotic
complexity as SEA, our algorithm is much faster in practice.Comment: To appear in the proceedings of ANTS-XII. Added acknowledgement of
Drew Sutherlan
Isogeny graphs of ordinary abelian varieties
Fix a prime number . Graphs of isogenies of degree a power of
are well-understood for elliptic curves, but not for higher-dimensional abelian
varieties. We study the case of absolutely simple ordinary abelian varieties
over a finite field. We analyse graphs of so-called -isogenies,
resolving that they are (almost) volcanoes in any dimension. Specializing to
the case of principally polarizable abelian surfaces, we then exploit this
structure to describe graphs of a particular class of isogenies known as
-isogenies: those whose kernels are maximal isotropic subgroups
of the -torsion for the Weil pairing. We use these two results to write
an algorithm giving a path of computable isogenies from an arbitrary absolutely
simple ordinary abelian surface towards one with maximal endomorphism ring,
which has immediate consequences for the CM-method in genus 2, for computing
explicit isogenies, and for the random self-reducibility of the discrete
logarithm problem in genus 2 cryptography.Comment: 36 pages, 4 figure
- …