Distortion maps allow one to solve the Decision Diffie-Hellman problem on
subgroups of points on the elliptic curve. In the case of ordinary elliptic
curves over finite fields, it is known that in most cases there are no
distortion maps. In this article we characterize the existence of distortion
maps in the remaining cases.Comment: 3 Pages (Updated version corrects an error in the previous version

Charles, Denis

English

arXiv

Distortion maps allow one to solve the Decision Diffie-Hellman problem on subgroups of points on an elliptic curve. In the case of ordinary elliptic curves over finite fields, it is known that in most cases there are no distortion maps for the Frobenius eigenspaces. In this article we characterize the existence of distortion maps in the remaining cases

Denis Charles

Cryptology ePrint Archive

ON THE EXISTENCE OF DISTORTION MAPS ON ORDINARY ELLIPTIC CURVESDENIS CHARLES1. IntroductionAn important problem in cryptography is the so called Decision Diffie-Hellman problem (henceforth abbrevi-ated DDH). The problem is to distinguish triples of the form (ga, gb, gab) from arbitrary triples from a cyclicgroup G = 〈g〉. It turns out that for (cyclic subgroups of) the group of m-torsion points on an elliptic curveover a finite field, the DDH problem admits an efficient solution if there exists a suitable endomorphismcalled a distortion map (which can be efficiently computed) on the elliptic curve.Suppose m is relatively prime to the characteristic of a finite field Fq, then the group of m-torsion points onan elliptic curve E/Fq, denoted E[m], is isomorphic to (Z/mZ)× (Z/mZ). Fix an elliptic curve E/Fq and aprime ` that is not the characteristic of Fq. Let P and Q generate the group E[`]. A distortion map on E isan endomorphism φ of E such that φ(P ) /∈ 〈P 〉. A distortion map can be used to solve the DDH problem onthe group 〈P 〉 as follows: Given a triple R,S, T of points belonging to the group generated by P , we checkwhether e`(R,φ(S)) = e`(P, φ(T )), where e` is the Weil pairing on the `-torsion points. It follows from wellknown properties of the Weil pairing that this check succeeds if and only if R = aP , S = bP and T = abP .Under the assumptions that P and Q are both defined over Fqk , where k is not large (say, bounded by a fixedpolynomial in log(q)), and that φ can be computed in polynomial time, the DDH problem can be solved inpolynomial time using this idea. If P and Q are not eigenvectors for the Frobenius map, then in many casesone can use the trace map as a distortion map (see [GR04]). For this reason, we will concentrate only onthe subgroups that are Frobenius eigenspaces.It is known that distortion maps exist on supersingular elliptic curves ([Ver01, GR04]), and that distortionmaps that do not commute with the Frobenius do not exist on ordinary elliptic curves (see [Ver01] or[Ver04] Theorem 6). The latter implies that distortion maps do not exist for ordinary elliptic curves withembedding degree > 1. The embedding degree, (say) k, is the order of q in the group (Z/`Z)∗. A theorem ofBalasubramanian and Koblitz ([BK98] Theorem 1) says that if E(Fq) contains an `-torsion point and k > 1,then E[`] ⊆ Fqk . Thus, the only remaining cases where the existence of Distortion maps is not known are thecases when the embedding degree k is 1. If the embedding degree is 1 and E(Fq) contains an `-torsion point,then there are two possibilities: either E[`](Fq) is cyclic or E[`] ⊆ E(Fq). In the former situation there areno distortion maps (by [Ver04] Theorem 6). However, the Tate pairing can be used to solve DDH efficientlyin this case (see the comments in [GR04] following Remark 2.2). Thus, the only case in which the questionof the existence of a distortion map remains open is when E[`] ⊆ E(Fq). In this article we characterize theexistence of distortion maps for this case.2. The ProofLet k be a finite field, Fq ⊇ k and E/k be an ordinary elliptic curve. Suppose ` is a prime such that E[`] ⊆ Fqbut no point of exact order ` is defined over a smaller field.To study the existence of distortion maps, we study the reduction of the ring End(E) modulo `. Ourprincipal tool is the following observation: If α ∈ End(E) has field polynomial f(x) ∈ Z[x], then f mod ` isthe characteristic equation of the action of α on E[`].Let π be the q-th power Frobenius endomorphism on E and let φ2− tφ+q = 0 be its characteristic equation.We know that t ≡ 2 mod ` and q ≡ 1 mod ` as the full `-torsion is defined over Fq.1Let O = End(E), K = O ⊗ Q and OK the maximal order in K. We have the inclusions Z[π] ⊆ O ⊆ OK .Since t2 − 4q = 0 mod ` we have that ` divides the product [O : Z[π]][OK : O]Disc(K). The existence ofdistortion maps splits into cases depending on whether `|[OK : O] or `|Disc(K). Indeed, if `|[OK : O] thereare no distortion maps, since the reduction modulo ` of every endomorphism is just multiplication by scalar.In the following we assume that ` 6 | [OK : O] so that the conductor of O is prime to `. Under this assumptionwe have that the residue class ringsOK/(`) ∼= O/(`).Suppose that 6̀ | Disc(K) and that ` is inert in OK , then O/(`) ∼= F`2 . Let α ∈ O be an endomorphismsuch that α mod (`) does not lie in F`. Then the action of α on E[`] is irreducible since its characteristicequation is irreducible over F`. Now α gives us a distortion map on E[`] since no subgroup of order ` of E[`]is stabilized by α.Now if 6̀ | Disc(K) and ` is split in OK , then O/(`) ∼= F`[X]/(X − a)(X − b) ∼= (Z/`Z)2 (where a 6= b). Theaction of any α ∈ OK , that corresponds to the image of X in F`[X]/(X − a)(X − b) under the isomorphism,is conjugate to(γ 00 δ). Thus, distortion maps exist for all but two of the subgroups of E[`].Suppose that `|Disc(K) so that ` is ramified in OK , then O/(`) ∼= F`[X]/(X − a)2. Consider the map α ∈ Othat corresponds to the image of X in the ring F`[X]/(X − a)2. The action of α on E[`] is conjugate to(1 β0 1). Note that β 6= 0, for if β = 0 then O/(`) ∼= Z/`Z, but we know that O is rank 2 over Z/`Z since` is ramified in OK and does not divide the conductor of O. Thus, distortion maps exist for all but onesubgroup of E[`].In summary, we have:Theorem 2.1. Let k be a finite field, Fq ⊇ k and E/k be an ordinary elliptic curve whose endomorphismring is O, an order in an imaginary quadratic field O. Suppose ` is a prime such that E[`] ⊆ Fq but no pointof exact order ` is defined over a smaller field.(1) If ` | [OK : O] there are no distortion maps.(2) If 6̀ | [OK : O]Disc(K) and(a) ` is inert in OK , then there are distortion maps for every (order `) subgroup of E[`];(b) ` is split in OK , then all but two subgroups of E[`] have distortion maps.(3) If 6̀ | [OK : O] and ` | Disc(K) so that ` is ramified in OK , then all (except one) subgroups of E[`]have distortion maps.3. ExamplesIn this section, we give examples to illustrate that all the cases in Theorem 2.1 do occur.Example 3.1. Consider the elliptic curve E : y2 = x3 + x over Q. E has complex multiplication by Z[ı]and has good reduction at all odd primes. Let p be a prime such that p ≡ 1 mod 4, Ẽ be the reductionof E modulo p, and let ı2 = −1 mod p. Then Ẽ[2] ⊆ Ẽ(Fp) and Ẽ[2] is {0Ẽ , (0, 0), (ı, 0), (−ı, 0)} where0Ẽ is the identity element. The map [ı] is an endomorphism that sends (x, y) 7→ (−x, ıy). It is easy to seethat the map [ı] preserves the subgroup 〈(0, 0)〉 and interchanges the remaining two subgroups, of order 2,of Ẽ[2]. Note, that Deuring’s reduction theorem tells us that End(Ẽ) ∼= Z[i]. Furthermore, in this case thesubring Z[π] generated by the Frobenius is usually a smaller ring. Indeed, if t is the trace of Frobenius andt2 − 4p = −4b2, then the conductor of the order Z[π] is b. Now b is at least 2, since t ≡ 2 mod 4, so (t/2)is odd and we must have p = (t/2)2 + b2. Thus, case (3) of Theorem 2.1 applies and matches with what weobserve for the 2-torsion.Example 3.2. (Suggested by anonymous reviewer). Let E be the curve over F701 given by the equationy2 = x3 − 35x + 98. Then End(E) = Z[ 1+√−72 ] which is the maximal order in Q(√−7). The order Z[π]2has conductor 10 in End(E). The 5-torsion is F701 rational, and moreover, 5 is inert in End(E). Theorem2.1 (2a) shows that every subgroup of E[5] admits a distortion map. Indeed, the map corresponding tomultiplication by α = 1+√−72 is given by ([Sil94] Chapter II, Proposition 2.3.1 (iii))[α](x, y) =(α−2(x− 7(1− α)4x + α2 − 2), α−3y(1 +7(1− α)4(x + α2 − 2)2)).Let us check this for the group generated by the 5-torsion point P (with affine coordinates) P = (224, 31).Since α = 386 ∈ F701, this tells us that [α](P ) = (173, 194). One checks that the Weil pairing e5(P, [α](P )) =464 6= 1. Thus, [α] works as a distortion map for the group generated by P .Now the 5-torsion of E is generated by P and the point Q = (573, 450). A similar computation shows that[α](Q) = (463, 495). Also, e5(Q, [α]Q) = 89 6= 1. Again, this shows that [α] works as a distortion map.Given these calculations it is not hard to find the matrix of the action of [α] on E[5] relative to the basisP,Q[α] =(0 −12 1).The characteristic polynomial of this matrix is irreducible modulo 5 and thus the action on E[5] is irreducible.Example 3.3. One can use the elliptic curve E from Example 3.2 to illustrate case (2b) of Theorem 2.1. Thistime we look at E[2] (also contained in F701) which is generated by the points P = (319, 0) and Q = (389, 0).The prime 2 splits completely in End(E). The proof of Theorem 2.1 tells us that the characteristic polynomialof the action of the endomorphism [α] has two distinct roots and would work as a distortion map for all buttwo subgroups of E[2]. Now the minimal polynomial α is x2 − x + 2 and modulo 2 this splits as x(x + 1).Thus the action of [α] on E[2] will have two eigenvectors, with eigenvalues 0 and 1 respectively. It is easy tocheck given the formula for [α] that indeed [α](P ) = 0E and [α](Q) = Q.Example 3.4. In this example we illustrate that case (1) of Theorem 2.1 also occurs. Consider the curveE/Q given by the Weierstrass equationy2 = x3 − 3375121x +6750121.The j-invariant of E is 243353 and the conductor of E is 108900. E has CM by the order of conductor 2 inQ(√−3). Thus End(E) ∼= Z + 2OK where OK = Z + 12 (1 +√−3)Z. E has good reduction at the prime13 and one sees that the reduction Ẽ has F13-rational 2-torsion. Now End(Ẽ) ∼= End(E) by the Deuringreduction theorem ([Lan87] Chapter 13 §4, Theorem 12), but End(Ẽ) mod 2 ∼= (Z/2Z) and so there are nodistortion maps.References[BK98] Balasubramanian, R.; Koblitz, N.; The improbability that an elliptic curve has subexponential discrete log problemunder the Menezes-Okamoto-Vanstone Algorithm, Journal of Cryptology, Vol. 11, No. 2, 141-145, 1998.[GR04] Galbraith, S.; Rotger. V.; Easy decision Diffie-Hellman groups, LMS J. Comput. Math., 7, 201-218, 2004.[Lan87] Lang, S.; Elliptic Functions, 2nd ed., Graduate Texts in Math., vol. 112, Springer-Verlag, 1987.[Sil94] Silverman, J.; Advanced Topics in the Arithmetic of Elliptic Curves, Graduate Texts in Math. Vol. 151, Springer-Verlag,1994.[Ver01] Verheul, E., R.; Evidence that XTR is more secure than supersingular elliptic curve cryptosystems, EUROCRYPT2001, Lecture Notes in Computer Science, 2045, Springer-Verlag, 195-201, 2001.[Ver04] Verheul, E., R.; Evidence that XTR is more secure than supersingular elliptic curve cryptosystems (Journal version),Journal of Cryptology, Vol. 17, No. 4, 277-296, 2004.Microsoft Research, One Microsoft Way, Redmond, WA - 98052.E-mail address: cdx@microsoft.com3

On the existence of distortion maps on ordinary elliptic curves

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive