In this article, we give an algorithm for decomposing given element of Jacobian gruop into the sum of the decomposed factor, which consists of certain subset of the points of curve

Koh-ichi Nagao

We give an algorithm for decomposing given element of Jacobian gruop
into the sum of the decomposed factor, which consists of certain subset of the points of curve

Cryptology ePrint Archive

Decomposition formula of the Jacobian group of planecurve (Draft)Koh-ichi Nagao (nagao@kanto-gakuin.ac.jp)Fac. of Engineering, Kanto Gakuin Univ.,Joint-work with Kazuto Matsuo(Kanagawa Univ.,) and Tsuyoshi Takagi(Kyushu Univ.))Abstract. In this article, we give an algorithm for decomposing given element ofJacobian gruop into the sum of the decomposed factor, which consists of certain subsetof the points of curve.Keywords Decomposition Attack, ECDLPrevise 6 Nov First version of this manuscript, we use Weil descent like techinique andthe decomposition problem of Jacobian reduces to solving exact g number equations system.However, Proposition 3 is not true and this thechnique can not be used. So, we re-write §4 andshow that the decomposition problem of Jacobian reduces to solving some equations system(however, the number of the equations is quite large).1 IntroductionIn this article, we give an algorithm for decomposing given element of Jacobian gruop into thesum of the decomposed factor, which consists of the points of curve. This is the generalizationof the Semaev’s formula [9] and by leading this formuls, we use the Riemann-Roch spacetechnique similar as [6]. Recently, French researchers [3], [8], propose the algorithm for solvingECDLP over binary extension field by subexponential complexities of extension degree n.This algorithm uses the fact that the system of the equations obtained by decomposing givenelement of elliptic curve into decomposed fatcor contains many hidden equations and thecomplexity for decomposing a point of elliptic curve into d = nc (0 < c < 1/2 is a constant 1 )elements of decomposed factor, is subexponential. These arguments seems to have some gaps,but, any way, there is some posibility that ECDLP is subexponential. By using thier argumentto the Jacobian of plane curve, we similarly get that the DLP of the Jacobian of plane curveof small genus over binaly extension field /or its generalization to small characterristic fieldalso subexponential.2 NotationsIn this article, let C : f(x, y) = 0 be a plane curve of small genus g over Fpn , ∞ be a fixedpoint at infinity, D0 = Q1 + Q2 + ... + Qg − g∞ be a fixed element of Jac(C/Fpn). We alsoput dy := degy f(x, y) and φ1(x) :=∏gi=1 x− x(Qi).3 Riemann-Roch SpaceProposition 1 (Riemann-Roch). Let D be a divisor such that deg D ≥ 2g − 1. ThendimL(D) = deg D − g + 1.Let d be an integer such that d > 2g−1. Put D := d∞−D0 = (d+g)∞−Q1−Q2− ...−Qg.Then form Riemann-Roch theorem(Proposition 1), there are independent elements of functionfield fi(x, y) ∈ Fpn(C) (i = 0, 1, .., d− g) such that fi(x, y) = 0 at all Q1, .., Qg, fi(x, y) does1 Taking d = O(n1/3) is best possible for the complexitynot has a pole except∞, ord∞fi(x, y) < −d−g for i = 1, 2, .., d−g and ord∞f0(x, y) = −d−g.Moreover, form Riemann-Roch Theorem, the element h(x, y) of function field Fpn(C) suchthat h(x, y) = 0 at all Q1, .., Qg, h(x, y) does not has a pole except ∞, and ord∞h(x, y) =−d − g, is written by h(x, y) = f0(x, y) + a1f1(x, y) + .... + ad−gfd−g(x, y) (ai ∈ Fpn) up toconstant multiplication.Let us denoteH(x, y) := f0(x, y) + A1f1(x, y) + .... + Ad−gfd−g(x, y)where Ai are variables and let S(x) := resultanty(f(x, y),H(x, y)).Lemma 1. 1. degx S(x) = d + g.2. φ1(x) |S(x)3. Put g(x) := S(x)/φ1(x) and we have degx g(x) = d.4. Put Ci be the i-th coefficients of g(x) (i.e. g(x) =∑di=0 Cixi). Then we have Ci is apolynomial of A1, ..., Ad−g with total degree ≤ dy.4 System of equationsFrom the discussion of §3, we have the following lemma;Lemma 2. Let Pi = (xi, yi) ∈ C(Fp) (i = 1, 2, .., d) and Put si by the xi coefficient ofthe polynomial∏di=1(x − xi). When D0 + P1 + ... + Pd − d∞ ∼ 0, there are some ai ∈ Fp(i = 1, 2, .., d− g) satisfying the following:1. h(x, y) = Constant×H(x, y)|Ai=ai ,2. si · Cd|Ai=ai = Ci|Ai=ai (i = 0, 1, .., d− 1).Further let Xi (i = 1, .., d) be variables and put Si = Si(X1, .., Xd) ∈ Fpn [X1, .., Xd] byxi-th coefficient of∏di=1(X −Xi). Putgi(A1, .., Ad−g;X1, .., Xd) := Si(X1, .., Xd)Cd(A1, .., Ad−g)−Ci(A1, .., Ad−g), (i = 0, .., d−1)and consider the equation systemEQS1 : {gi(A1, .., Ad−g; X1, .., Xd) = 0|i = 0, .., d− 1}.Lemma 3. When EQS1 has a solution (a1, ..ad−g; x1, .., xd) ∈ A2d−g(Fp), there are somePi ∈ C(Fp) (i = 1, .., d) such that D0 + P1 + ... + Pd − d∞ ∼ 0 and x(Pi) = xi (i = 1, .., d).Proof. Put h(x, y) = f0(x, y) +∑d−gi=1 aifi(x, y), and let Pi’s be the points on C(Fp) whichmeet h(x, y) = 0 except Q1, .., Qg. So, we have {x(Pi)|i = 1, .., d} = {x1, .., xd} and finish theproof.From Lemma 2, and Lemma 3, we have the following;Proposition 2. The following (1) (2) are equivalent;1) EQS1 has solution (a1, .., ad−g; x1, .., xd) ∈ A2d−g(Fp)2) There are some Pi ∈ C(Fp) (i = 1, .., d) satisfying x(Pi) = xi (i = 1, .., d) and D0 + P1 +... + Pd ∼ 0.Let T1, ..., Tg be new variables and puthi(A1, .., Ad−g; X1, .., Xd; T1, .., Tg) := gi(A1, .., Ad−g;X1, .., Xd), (i = 0, .., d− g − 1),hd−g(A1, .., Ad−g; X1, .., Xd; T1, .., Tg) :=∑gi=1 Ti · gi+d−g−1(A1, .., Ad−g; X1, .., Xd), and con-sider the equation systemEQS2 : {hi(A1, .., Ad−g;X1, .., Xd; T1, .., Tg) = 0|i = 0, .., d− g}.5 Absolute resultantIn this section, we study the absolute resultant of EQS2 (cf [1] §3). Here, we consider {Ai}as variables and {Xi} ∪ {Ti} as constants and eliminate {Ai} from EQS2. For the precisediscussion, we must use the homogenious polynomial system. However, it is complicated andwe continue the discussion using non-homogenious polynomial system.Let Di := deg{Xi} hi(≤ dy) (i = 0, .., d− g) and D =∑d−gi=0 Di− (d− g)(≤ (d− g)dy). LetMall be the set of monomials ofA1, .., Ad−g of degree ≤ D. The number of such momomial#Mall is estimated by(d− g + Dd− g)≤((d− g)(dy − 1)d− g)and from Stirling formula, whichstates N ! ∼ √2πNNNexp(−N), we have #Mall ≤√dy+12π(d−g)dy {(dy+1)dy+1ddyy}d−g. LetS0 := {m ∈ Mall |deg{Ai}m ≤ D −D0},S1 := {m ∈ Mall |deg{Ai}m > D −D0, AD11 |m},S2 := {m ∈ Mall |deg{Ai}m > D −D0, AD11 6 |m,AD22 |m},· · · · · ·Sd−g := {m ∈ Mall | deg{Ai}m > D −D0, AD11 6 |m, · · · , ADd−g−1d−g−1 6 |m,ADd−gd−g |m},Note that it is well known that #Sd−g = D0D1...Dd−g−1 and Mall = ∪d−gi=0 Si (disjoint divisionof Mall).Put Mall = {−→M1, ...,−→M#Mall} and ∪d−gi=0 {him |m ∈ Si} = {G1, ..., G#Mall}. Let Gij ∈Fp[{Xi} ∪ {Ti}] be the polymomials such that Gi =∑#Mallj=1 Gij−→M j andRes(X1, .., Xd; T1, .., Tg) = determinant of the matrix[Gij ]1≤i,j≤#Mall ∈ Fp[{Xi} ∪ {Ti}].Res is known as absolute resultant and we have the following; 2Lemma 4. Let (x1, ..., xd) ∈ Ad(Fp). The follwoing (1) (2) are (essentially) equivalent;1) Res(x1, .., xd;T1, .., Tg) = 0 (Ti’s are still variables).2) There are some (a1, ..., ad−g) ∈ Ad−g(Fp) satisfying (a1, .., ad−g; x1, .., xg) is a solution ofEQS1.Lemma 5. 1) deg{Ti}Res(X1, .., Xd; T1, .., Tg) ≤ dd−gy .2) deg{Xi}Res(X1, .., Xd; T1, .., Tg) ≤ d ·#Mall ≤ d ·√dy+12π(d−g)dy {(dy+1)dy+1ddyy}d−g.Proof. The number of the row that Ti appears equals to #Sd−g = D0D1...Dd−g−1 ≤ dd−gyand the degree of {Ti} of each element of the the matrix is 1. So, we have 1). The degree of{Xi} of each element of the the matrix is ≤ d and the size of the matrix is #Mall. So, wehave 2).Let {m1, ..., mN} be the set of monomial of {T1, .., Tg} which divide some monomial ofRes(X1, .., Xd;T1, .., Tg) and putRes(X1, .., Xd;T1, .., Tg) =∑Ni=1 Hi(X1, .., Xd) ·mi. From Lemma 5, we have deg{Ti}Res ≤dd−gy and N =(deg{Ti}Res + gg)≤ (dd−gy +g)gg! . From Lemma 5,we also have deg{Xi}Hi(X1, .., Xd) ≤ d√dy+12π(d−g)dy {(dy+1)dy+1ddyy}d−g (i = 1, .., N).From Lemma 4 and Proposition 2, we have the following;Proposition 3. Let (x1, ..., xd) ∈ Ad(Fp). The follwoing (1) (2) are (essentially) equivalent;1) Hi(x1, .., xd) = 0 (i = 1, .., N).2) There are some Pi ∈ C(Fp) (i = 1, .., d) satisfying x(Pi) = xi (i = 1, .., d) and D0 + P1 +... + Pd ∼ 0.2 We do not use homogenious polynomial system and projective variety. So, there is some gap.However, it seems to negligible and continue the discussion.Thus, the decomposition problem of Jacobian of a plane curve reduced to solve some theequations system.6 Hyper elliptic curve caseIn this section, we consider the hyper elliptic curve case. Let C : f(x, y) = y2 + b′1xy + .. −x2g+1−b2gx2g− ...−a0 = 0 be a hyper elliptic curve of small genus g over Fpn , ∞ be a uniquepoint at infinity, D0 = Q1+Q2+...+Qg−g∞ be a fixed element of Jac(C/Fpn). From Munfordrepresentation, D0 is also represented by using two polynomials φ1(x) :=∏gi=1 x−x(Qi) andφ2(x) which has the properties deg φ2(x) ≤ g − 1 and y(Qi) = φ2(x(Qi)).Let d be an integer such that d > 2g−1. Put D := d∞−D0 = (d+g)∞−Q1−Q2−...−Qg.Then form Riemann-Roch theorem(Proposition 1), the base of the vector spaceL(D) := {h ∈ C(Fpn)|h has zero at all Q1, .., Qg and has pole only at ∞, ord∞h ≤ −d− g}is written by{φ1(x), φ1(x)x, ..., φ1(x)xM1 , (y − φ2(x)), (y − φ2(x))x, ..., (y − φ2(x))xM2}where M1 = b(d−g)/2c and M2 = b(d−g−1)/2c. Note that when 2|(d−g), ord∞φ1(x)xM1 =g + d and when 2 6 |(d− g), ord∞(y − φ2(x))xM2 = g + d.So put f0(x, y) :={φ1(x)xM1 2|(d− g)(y − φ2(x))xM2 2 6 |(d− g) and putfi(x, y) (1 ≤ i ≤ d − g) by otherbases of L(D) and exceeds the simailar argument of Section 2. Let us denoteH(x, y) := f0(x, y) + A1f1(x, y) + .... + Anfn(x, y)where Ai are variables and let S(x) := ±resultanty(f(x, y),H(x, y)).Lemma 6. 1. S(x) is monic polynomial of x and degx S(x) = d + g.2. φ1(x) |S(x)3. Put g(x) := S(x)/φ1(x). g(x) is a monic polynomial of x and degx g(x) = d.4. Put Ci be the i-th coefficients of g(x) (i.e. g(x) = xd +∑d−1i=0 Cixi). Then we have Ci is apolynomial of A1, ..., Ad−g with total degree 2. (Note that Cd = 1 form g(x) being monic.)Similarly let Xi (i = 1, 2, .., d) be variables and put Si = Si(X1, .., Xd) by the Xi coefficientof the polynomial∏di=1(X −Xi).Consider the system of the equationsEQS3 : {Si(X1, ..., Xd) = Ci(A1, .., Ad−g) | i = 0, 1, .., d− 1} (1)Proposition 4. Let (x1, .., xd) ∈ Ad(Fp). The condition that there are some Pi = (xi, yi)(i = 1, 2, .., d) such that D0 + P1 + ... + Pd− d∞ ∼ 0 and x(Pi) = xi (i = 1, .., d) is equivalentto the condition that the equations system EQS3 of the variables{Ai} and {Xi} has somesolution satisfying Xi = xi.Note that the variables {Ai} can be eliminated by the technique of previous section.7 Decomposed factorIn 2009, Diem [2] proposes the way of taking decomposed factor, called Diem-variant, andshows ECDLP of elliptic curves over Fpn satisfying log p = O(n2) has subexponential complex-ity when input size n log p goes to infinity. In 2005 or 2006, soon after the Semaev’s formula isdiscoverd, Matsuo also found the simmilar and more general way of taking decomposed factor(for exapmle distinct or non-equal size decomposed factor). Matsuo tries to decompose anelement of elliptic curve over around 120-bit size binary field, but, huge memory workstationdoes not returns the reply and it it not presented and only the researchers around him knowsthis.Here, we propose the way of taking decomposed factor of Jacobian of the curve, which isthe generalization of Matsuo’s decomposed factor. Fix [w1, ..., wn] be the base of Fpn/Fp. Letn1, ..nd be the positive integers satisfying n1 + ... + nd ≈ ng. PutB′i := {nj∑j=1xi,jwj |xi,j ∈ Fp} (i = 1, 2, ..., d).Let r1, ..., rd be elements of Fpn 3 and take decomposed factor Bi byBi := {P−∞ ∈ Jac(C/Fpn)|P ∈ C(Fpn), ∃x ∈ B′i such that x(P ) = x+ri} (i = 1, 2, ..., d),and consider the decomposition (of D0)D0 +d∑i=1(Pi −∞) = 0 (Pi −∞) ∈ Biin Jacobian group.Note that Bi’s are essentially disjoint, |Bi| ≈ pni , and the probability that the decompo-sition success is O(pn1+...+nd−ng) ≈ 1. From the disjointness, it is improved that the term of1/d! in the probability is omitted. (Remark that it is needed to compute gaussian eliminationof d-times size matrix in the last step.)So, we have the following proposition, which is a generalization of Diem’s result:Proposition 5. DLP of the Jacobian group of a plane curve of small genus g over extensionfield Fpn satisfying log p = O((ng)2) (since g is constant, it is equivalent to log p = O(n2))has subexponential complexity when input size N = ng log p goes to infinity. .Proof. We consider the case d = ng, n1 = n2 = ... = nd = 1 and compute the decomposi-tion of given divissor D0. In this case, D0 is decomposed by the divisor∑ngi=1(Pi −∞) suchthat x(Pi) = (xi,1w1 + ri) with xi,1 ∈ Fp. From Proposition ??, in order to find such {xi,1},it it sufficient to solve the 2ng equations Fj,k ∈ Fp[{xi,1}] obtained by Weil descent fromFj(x1,1w1 + r1, ..., xng,1w1 + rng) = 0 (j = 1, 2, ..., g). (Note that put Fj,k be the polymo-nials obtained by Fj(x1,1w1 + r1, ..., xng,1w1 + rng) =∑nk=1 Fj,k(x1,1, ..., xng,1)wk ). FromProposition ??,the degree of the equations obtained by Weil descent is ≤ Constd1 = Constng1 .So the upper bound of the cost of finding the value of {xi,1} by using Gröbner basis is es-timated by (Constng1 )ng×Const2 = exp(Const3 n2g2) = exp(N2/3+o(1)). In order to solve theDLP, we must have obtain dp = ngp decomposition and compute the Gaussian eliminationof the dp = ngp size matrix. Since ngp = exp(log(ng) + log p) = exp(N2/3+o(1)), we also haveboth of the costs of ngp decomposition and Gaussian elimination are exp(N2/3+o(1)).References1. D. Cox, J.Little, D. O’Shea, Using Algebraic Geometry, Springer, 1997.2. C. Diem, On the discrete logarithm problem in class groups II, preprint, 2011.3. J-C. Faugére, L. Perret, C. Petit, and G. Renault, Improving the complexity of index calculusalgorithms in elliptic curves over binary fields, EUROCRYPTO 2012, LNCS 7237, pp.27-44.4. F.S. Macaulay, The algebraic Theory of modular systems, 1916, Cambridge.5. K. Nagao, Index calculus for Jacobian of hyperelliptic curve of small genus using two large primes,Japan Journal of Industrial and Applied Mathematics, 24, no.3, 2007.6. K. Nagao, Decomposition Attack for the Jacobian of a Hyperelliptic Curve over an ExtensionField, 9th International Symposium,ANTS-IX., Nancy, France, July 2010, Proceedings LNCS6197,Springer, pp.285–300, 2010.3 Take ri+1 ∈ Fpn \ ∪ij=1B′j and disjoint decomposed factor is constracted7. K. Nagao, Equations System coming from Weil descent and subexponential attack for algebraiccurve cryptosystem, draft, 2013.8. C. Petit and J-J. Quisquater. On Polynomial Systems Arising from a Weil Descent, Asiacrypt2012, Springer LNCS 7658, Springer, pp.451-466.9. I. Semaev. Summation polynomials and the discrete logarithm problem on elliptic curves. Preprint,2004.

Decomposition formula of the Jacobian group of plane curve

http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.380.2441

Decomposition formula of the Jacobian group of plane curve

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive