This paper shows a method for checking the parity of (#Jc − 1)/2 without calculating the order #Jc, where #Jc is the order of genus 2 or 3 hyperelliptic curve

Morikawa, Yoshitaka

Nogami, Yasuyuki

Okayama University Scientific Achievement Repository

Yasuyuki NOGAMIGraduate School of Natural Scienceand Technology, Okayama University3-1-1, Tsushima-naka, Okayama, JapanYoshitaka MORIKAWAGraduate School of Natural Scienceand Technology, Okayama University3-1-1, Tsushima-naka, Okayama, JapanThis paper shows a method for checking the parity of (#JC ¡ 1)=2 without calculating theorder #JC , where #JC is the order of genus 2 or 3 hyperelliptic curve.1 INTRODUCTIONThis paper especially deals with genus 2 and 3 no two{torsion hyperelliptic curves over prime ¯eld Fp, wherea genus one curve is an elliptic curve. No two{torsionmeans that the curve has no two{torsion points, in otherwords, #JC is not divisible by 2, where #JC denotes theorder over Fp. For no two{torsion curves, this papershows a method for checking the parity of (#JC ¡ 1)=2without calculating the order #JC . This paper is theextended version of our previous work[1].Throughout this paper, characteristic p is a primenumber larger than 5. Fpm ¡ Fp denotes the set of ele-ments which belong to Fpm but not Fp.2 PRELIMINARYIn this section, we brie°y go over the fundamentalsof quadratic residue/non-residue, shift product{basedpolynomial transform (SPPT), and genus 2 and 3 hy-perelliptic curves de¯ned over prime ¯eld Fp.2.1 Quadratic residue/non-residueFor a non-zero element c 2 Fq, we can check whetherc is a quadratic residue (QR) or quadratic non-residue(QNR) in Fq as follows:c(q¡1)=2 =8<: 1 when c is a QR¡1 when c is a QNR : (1)The product of two non-zero QRs and that of two QNRsbecome QRs in Fq. On the other hand, the product ofa QR and a QNR becomes a QNR in Fq. In this paper,we use the fact that all elements in Fp are QRs in Fp2 ,in addition, whether or not a non-zero element a 2 Fpis a QR in Fp is equivalent to that in Fp3 .2.2 Shift product{based polynomialtransformShift product{based polynomial transform (SPPT) is de-¯ned as follows[1]. Let f(x) be an irreducible polyno-mial of degree m over Fp. According to SPPT[1], whenm < p and gcd(k;m) = 1, we can uniquely determineanother irreducible polynomial fk(x) of degree m overFp from the given irreducible polynomial f(x) such thatFk(x) = fk(xpk ¡ x) = f(x)pk¡1Yj=1f(x+ sj); (2)where s is a generator of F ¤pk (see App.A). Let ! be azero of f(x), a zero ¿ of fk(x) is given by ¿ = !pk¡!. Inother words, fk(x) is the minimal polynomial of !pk¡!.In what follows, we call the transformation from f(x)A Method for Checking the Parity of (#JC − 1)/2 ofGenus 2 and 3 Hyperelliptic Curves(Received December 4, 2007)This work is subjected to copyright.All rights are reserved by this author/authors.110Memoirs of the Faculty of Engineering, Okayama University, Vol. 42, pp. 110-114, January 2008to fk(x) SPPT over Fpk . SPPT is just the minimalpolynomial determination for ¿ = !pk ¡ !.2.3 Hyperelliptic curveIn this paper, let the de¯nition ¯eld be the prime ¯eldFp, we particularly deal with genus g = 2 and 3 hyper-elliptic curves in the following form :H(x; y) = f(x)¡ y2 = 0; f(x) = H(x; 0); (3)where f(x) is an irreducible polynomial of degree 2g+1over Fp. Let #JC be the order over Fp, it is given by[2]g = 2 : #JC = p2 + 1 + s1(p+ 1) + s2; (4a)s1 = M1 ¡ 1¡ p; (4b)s2 = (M2 ¡ 1¡ p2 + s21)=2; (4c)g = 3 :#JC = p3+ 1 + s1(p2+ 1) + s2(p+ 1) + s3; (5a)s1 = M1 ¡ 1¡ p; (5b)s2 = (M2 ¡ 1¡ p2 + s21)=2; (5c)s3 = (M3 ¡ 1¡ p3 ¡ s31 + 3s1s2)=3; (5d)where M1;M2, and M3 are the numbers of the ratio-nal points of the hyperelliptic curve H(x; y) = 0 overFp; Fp2 , and Fp3 , respectively[2]. Since H(x; 0) of de-gree 2g + 1 is irreducible over Fp in this paper, it isalso irreducible over the concerned extension ¯eld. Inaddition, s1; s2, and s3 are odd numbers.2.4 The number of rational points overFpNoting that the de¯nition ¯eld of hyperelliptic curveEq.(3) is prime ¯eld Fp and let the number of QRs inthe following set be N1 :fH(0; 0);H(1; 0);H(2; 0); ¢ ¢ ¢ ;H(p¡ 1; 0)g: (6)The number of rational points on H(x; y) = 0 over Fp,that is M1, is given byM1 = 2N1 + 1; (7)where we should note that H(i; 0); i 2 Fp does not be-come 0 because H(x; 0) is irreducible over Fp in thispaper. The number of QNRs is given by p¡N1. FromEq.(4b) and Eq.(7), we ¯nd that s1 becomes an oddnumber when H(x; 0) is irreducible.2.5 The number of rational points overFp2Noting that the coe±cients of H(x; y) are in Fp, as in-troduced in Sec.2.1, every element in the set Eq.(6)become QRs in Fp2 . In other words, substituting eachelement in Fp for x, we have the following 2p rationalpoints over Fp2 :³i;§pH(i; 0)´; 0 · i · p¡ 1: (8)On the other hand, for an arbitrary element ® inFp2 ¡ Fp, we can consider its conjugate ®p in Fp2 ¡ Fpand these conjugates satisfyH(®p; 0) = H(®; 0)p: (9)Therefore, H(®p; 0) is a QR in Fp2 if and only if H(®; 0)is a QR in Fp2 . For example, if H(®; 0) is a QR in Fp2 ,we have the following four rational points :µ®pi;§qH(®pi ; 0)¶; i = 0; 1: (10)In Fp2 ¡ Fp, there exist (p2 ¡ p)=2 conjugate pairs.Among them, let N 02 be the number of conjugate pairssuch that H(®; 0) and H(®p; 0) become QRs in Fp2 ,M2 = 2p+ 4N 02 + 1 = 2(p+ 2N02) + 1: (11)The number of conjugate pairs such that H(®; 0) andH(®p; 0) become QNRs in Fp2 is given by (p2¡p)=2¡N 02.From Eq.(4b), Eq.(4c) and Eq.(11), we ¯nd that s2 be-comes an odd number in this paper.2.6 The number of rational points overFp3In the same way of N 02, for an arbitrary element ® inFp3 ¡Fp, we can consider its conjugates ®p and ®p2andthese conjugates satisfyH(®p; 0) = H(®; 0)p; H(®p2; 0) = H(®; 0)p2: (12)Therefore, H(®p; 0) and H(®p2; 0) are QRs in Fp3 if andonly if H(®; 0) is a QR in Fp3 . For example, if H(®; 0)is a QR in Fp3 , we have the following 6 rational points:µ®pi;§qH(®pi ; 0)¶; i = 0; 1; 2: (13)In Fp3 ¡ Fp, there exist (p3 ¡ p)=3 conjugate pairs.Thus, let N 03 be the number of conjugate pairs such111Yasuyuki NOGAMI and Yoshitaka MORIKAWA MEM.FAC.ENG.OKA.UNI. Vol. 42that H(®; 0), H(®p; 0), and H(®p2; 0) become QRs inFp3 , using N1 that denotes the number of QRs in theset Eq.(6), we haveM3 = 2N1 + 6N 03 + 1 = 2(N1 + 3N03) + 1: (14)In this case, s3 becomes odd. The number of conju-gate pairs such that H(®; 0), H(®p; 0), and H(®p2; 0)become QNRs in Fp3 is given by (p3 ¡ p)=3¡N 03.3 MAIN RESULTCorresponding to genus g, this paper shows a methodfor checking the parity of (#JC ¡ 1)=2. We use thefollowing notations :P (n) = (¡1)n =8<: 1 when n is even¡1 when n is odd ; (15a)nl (x) =l¡1Yi=0xpi= x ¢ xp ¢ xp2 ¢ ¢ ¢xpl¡1 ; (15b)Hj(xpj ¡ x; 0) = H(x; 0)pj¡1Yi=1H(x+ si; 0); (15c)where j = 1; 2; 3 and s is a generator of F ¤pj . Accordingto our previous work[1], when g = 1, we havePµ#JC ¡ 12¶= P (N1)= ¡ (¡n3 (!p ¡ !))(p¡1)=2 ;(16a)H1(0; 0) =p¡1Yi=0H(i; 0) = ¡n3 (!p ¡ !) ; (16b)P (N1) = (¡1)N1 = ¡H1(0; 0)(p¡1)=2: (16c)3.1 The parity of (#JC ¡ 1)=2 when thegenus g = 2From Eqs.(4), by substituting Eq.(4b) into Eq.(4a) wehave the following equation :#JC =M1(p+ 1)¡ 2p+ s2: (17)Then, noting that M1 and p are odd numbers,Pµ#JC ¡ 12¶= Pµp¡ 12¶Pµs2 ¡ 12¶: (18)From Eq.(4c), Eq.(11), and noting that s1 is odd,Pµs2 ¡ 12¶= Pµp¡ 12¶P (N 02) : (19)Thus, from Eq.(18) and Eq.(19), we havePµ#JC ¡ 12¶= P (N 02) : (20)In what follows, we consider how to determine P (N 02).3.1.1 How to determine P (N 02)According to SPPT over Fp2 , we can uniquely deter-mine H2(x; 0) from H(x; 0) and Eq.(15c). Since H(x; 0)is an irreducible polynomial of degree 2g + 1 = 5 overFp, H2(x; 0) is also irreducible as introduced in Sec.2.2.Substituting x = 0, we haveH2(0; 0) = H(0; 0)p2¡1Yi=1H(si; 0): (21)The right hand side of the above equation is the productof the values that is given by substituting each elementin Fp2 into H(x; 0). Since Fp2 = Fp [ (Fp2 ¡ Fp) andFp \ (Fp2 ¡ Fp) = Á, we can rewrite Eq.(21) asH2(0; 0) =p¡1Yi=0H(i; 0)Y8®2Fp2¡FpH(®; 0): (22)For ® in Fp2 ¡ Fp, let us consider the following pair :fH(®; 0);H(®p; 0)g (23)that corresponds to the conjugate pair f®; ®pg, whereH(®p; 0) = H(®; 0)p as shown in Sec.2.5. For the pairEq.(23), we have the following relation :H(®; 0)(p2¡1)=2 = fH(®; 0)H(®; 0)pg(p¡1)=2 ; (24)where we note that H(®; 0)H(®p; 0) = H(®; 0)H(®; 0)pbecomes a certain non-zero element in Fp. The left handside of Eq.(24) is the check whether or not H(®; 0) is aQR in Fp2 . From Eq.(24), consider the following calcu-lation :H2(0; 0)(p¡1)=2 =(p¡1Yi=0H(i; 0)(p¡1)=2)£8<: Y8®2Fp2¡FpH(®; 0)(p¡1)=29=; : (25)From Sec.2.5, Eq.(16c), and Eq.(24), we haveH2(0; 0)(p¡1)=2 = ¡Pµp2 ¡ p2¡N 02¶P (N1) ; (26)January 2008 A Method for Checking the Parity of (#JC − 1)/2 of Genus 2 and 3 Hyperelliptic Curves112where N1 and N 02 are de¯ned in Sec.2.4 and Sec.2.5,respectively. Thus, we haveP (N 02) = ¡Pµp2 ¡ p2¶P (N1)H2(0; 0)(p¡1)=2= Pµp¡ 12¶fH1(0; 0)H2(0; 0)g(p¡1)=2= f¡H1(0; 0)H2(0; 0)g(p¡1)=2 : (27)3.1.2 How to calculate H1(0; 0)H2(0; 0)As introduced in Sec.2.2, let ! be a zero of H(x; 0),H1(x; 0) and H2(x; 0) are the minimal polynomials of!p ¡ ! and !p2 ¡ !, respectively. Noting that H1(0; 0)and H2(0; 0) are their constant terms, we haveH1(0; 0)H2(0; 0) = n5³(!p ¡ !)(!p2 ¡ !)´: (28)Finally, from Eq.(20), Eq.(27), and Eq.(28),Pµ#JC ¡ 12¶=³¡n5³(!p ¡ !)(!p2 ¡ !)´´(p¡1)=2: (29)3.2 The parity of (#JC ¡ 1)=2 when thegenus g = 3From Eq.(5a), we have the following equation :#JC ¡ 12=(p+ 1)(p2 + p+ 1 + s2)2+s1(p2 + 1)2+s3 ¡ 12: (30)Noting that s1; s2; s3, and p are odd numbers, we havePµ#JC ¡ 12¶= ¡Pµs3 ¡ 12¶: (31)From Eq.(5d), we have3(s3 ¡ 1)2=M3 ¡ 12¡ p3 + s312+3(s1s2 ¡ 1)2= N1 + 3N 03 ¡(p+ 1)(p2 ¡ p+ 1)2¡ (s1 ¡ 1)(s21 + s1 + 1)¡ 3(s1s2 ¡ 1)2; (32)s1s2 ¡ 12=s1(s2 ¡ 1)2+s1 ¡ 12: (33)Therefore, from Eq.(19),Pµs3 ¡ 12¶= ¡P (N1)P (N 02)P (N 03) : (34)3.2.1 How to determine P (N 03)According to SPPT over Fp3 , we can uniquely deter-mine H3(x; 0) from H(x; 0) and Eq.(15c). Since H(x; 0)is an irreducible polynomial of degree 2g + 1 = 7 overFp, H3(x; 0) is also irreducible as introduced in Sec.2.2.In the same of H2(0; 0), we haveH3(0; 0) =p¡1Yi=0H(i; 0)Y8®2Fp3¡FpH(®; 0): (35)For ® in Fp3 ¡ Fp, let us consider the following set :fH(®; 0);H(®p; 0);H(®p2 ; 0)g (36)that corresponds to the conjugates set f®; ®p; ®p2g,where H(®p; 0) = H(®; 0)p and H(®p2; 0) = H(®; 0)p2as shown in Sec.2.6. For the set Eq.(36), we haveH(®; 0)(p3¡1)=2 =Ã2Yi=0H(®; 0)pi!(p¡1)=2: (37)In the same of Eq.(25), considerH3(0; 0)(p¡1)=2 =p¡1Yi=0H(i; 0)(p¡1)=2£Y8®2Fp3¡FpH(®; 0)(p¡1)=2: (38)From Sec.2.6, Eq.(16c), and Eq.(37), we haveH3(0; 0)(p¡1)=2 = ¡Pµp3 ¡ p3¡N 03¶P (N1) ; (39)where N1 and N 03 are de¯ned in Sec.2.4 and Sec.2.6,respectively. Thus, we haveP (N 03) = ¡P (N1)H3(0; 0)(p¡1)=2= fH1(0; 0)H3(0; 0)g(p¡1)=2 (40)3.2.2 How to calculate H1(0; 0)H3(0; 0)As introduced in Sec.2.2, let ! be a zero of H(x; 0),H1(x; 0) and H3(x; 0) are the minimal polynomials of!p ¡ ! and !p3 ¡ !, respectively. Noting that H1(0; 0)and H3(0; 0) are their constant terms, we haveH1(0; 0)H3(0; 0) = n7³(!p ¡ !)(!p3 ¡ !)´: (41)Finally, from Eq.(16c), Eq.(27), Eq.(31), Eq.(34),Eq.(40), and Eq.(41), Pµ#JC ¡ 12¶is given by¡³¡n7³(!p ¡ !)(!p2 ¡ !)(!p3 ¡ !)´´(p¡1)=2: (42)113Yasuyuki NOGAMI and Yoshitaka MORIKAWA MEM.FAC.ENG.OKA.UNI. Vol. 42Using H(x; 0) as the modular polynomial, Eq.(29) andEq.(42) are calculated by arithmetic operations in Fp5and Fp7 , respectively.4 CONCLUSIONThis paper has shown a method for checking the parityof (#JC ¡ 1)=2 of genus 2 and 3 hyperelliptic curveswithout calculating the order #JC .References[1] Y.Nogami, M.Obara, and Y.Morikawa, \A Methodfor Distinguishing the Two Candidate EllipticCurves in the Complex Multiplication Method,"ETRI Journal, vol.28, no.6, pp.745-760, 2006.[2] I.Blake, G.Seroussi, and N.Smart, Elliptic Curvesin Cryptography, LNS 265, Cambridge UniversityPress, 1999.A SPPT OVER FpkLet f(x) be an irreducible polynomial of degree m overFp and let its zero be ! in Fpm . Then, for Eq.(2), notingthat s is a generator of F ¤pk , we haveFk(x) =m¡1Yi=08<:(x¡ !pi)pk¡1Yj=1(x¡ !pi + sj)9=; ; (43)using the relation xpk¡1Yj=1(x+ sj) = xpk ¡ x, we have=m¡1Yi=0n(xpk ¡ x)¡ (!pk ¡ !)pio: (44)Let ¿ = !pk¡! and let fk(x) be the minimal polynomialof ¿ , we havef(x)pk¡1Yj=1f(x+ sj) = fk(xpk ¡ x); (45)where ¿ 2 Fpm does not belong to any proper sub¯eldin Fpm as shown below.Suppose that ¿ = !pk ¡ ! belongs to a proper sub-¯eld Fpr ; m = m0r; m0 6= 1, then we show a contradic-tion. Using ¿ and !, we haver¡1Xi=0¿pi=r¡1Xi=0³!pi´pk¡r¡1Xi=0!pi= c; (46)where c 2 Fp because ¿ belongs to Fpr and the sumof all conjugates of ¿ becomes an element in Fp. Let° =Pr¡1i=0 !pi , we have °pik= ° + ic; 1 · i · p. Since! is a non-zero element in Fpm and does not belong toany proper sub¯elds of Fpm , c must be 0 because p doesnot dividem as introduced in Sec.1. Then, ° belongs toFpk , accordingly ° belongs to Fp because gcd(m; k) = 1in this paper. Since ! belongs to Fpm but not to itsproper sub¯elds, it contradicts that ° is an element inFp as0 = °p ¡ ° =Ãr¡1Xi=0!pi!p¡r¡1Xi=0!pi= !pr ¡ ! 6= 0: (47)January 2008 A Method for Checking the Parity of (#JC − 1)/2 of Genus 2 and 3 Hyperelliptic Curves114

A Method for Checking the Parity of (#Jc - 1)=2 of Genus 2 and 3 Hyperelliptic Curves

Abstract

Similar works

Full text

Available Versions

Okayama University Scientific Achievement Repository