This paper provides a probabilistic algorithm to determine generators of the
m-torsion subgroup of the Jacobian of a hyperelliptic curve of genus two.Comment: 6 page

Ravnshoj, Christian Robenhagen

English

arXiv

Abstract. This paper provides a probabilistic algorithm to determine generators of the m-torsion subgroup of the Jacobian of a hyperelliptic curve of genus two. 1

Christian Robenhagen Ravnshøj

CiteSeerX

GENERATORS OF JACOBIANS OF HYPERELLIPTIC CURVES

This paper provides a probabilistic algorithm to determine generators of the m-torsion subgroup of the Jacobian of a hyperelliptic curve of genus two

Christian Robenhagen Ravnshoj

Cryptology ePrint Archive

GENERATORS OF JACOBIANS OF HYPERELLIPTIC CURVESCHRISTIAN ROBENHAGEN RAVNSHØJAbstract. This paper provides a probabilistic algorithm to determine gene-rators of the m-torsion subgroup of the Jacobian of a hyperelliptic curve ofgenus two.1. IntroductionLet C be a hyperelliptic curve of genus two defined over a prime field Fp, and JCthe Jacobian of C. Consider the rational subgroup JC(Fp). JC(Fp) is a finiteabelian group, andJC(Fp) ' Z/n1Z⊕ Z/n2Z⊕ Z/n3Z⊕ Z/n4Z,where ni | ni+1 and n2 | p − 1. Frey and Rück (1994) shows that if m | p − 1,then the discrete logarithm problem in the rational m-torsion subgroup JC(Fp)[m]of JC(Fp) can be reduced to the corresponding problem in F×p (Frey and Rück,1994, corollary 1). In the proof of this result it is claimed that the non-degeneracyof the Tate pairing can be used to determine whether r random elements of thefinite group JC(Fp)[m] in fact is an independent set of generators of JC(Fp)[m].This paper provides an explicit, probabilistic algorithm to determine generators ofJC(Fp)[m].In short, the algorithm outputs elements γi of the Sylow-` subgroup Γ` of therational subgroup Γ = JC(Fp), such that Γ` =⊕i〈γi〉 in the following steps:(1) Choose random elements γi ∈ Γ` and hj ∈ JC(Fp), i, j ∈ {1, . . . , 4}.(2) Use the non-degeneracy of the tame Tate pairing τ to diagonalize the sets{γi}i and {hj}j with respect to τ ; i.e. modify the sets such that τ(γi, hj) =1 if i 6= j and τ(γi, hi) is an `th root of unity.(3) If∏i |γi| < |Γ`| then go to step 1.(4) Output the elements γ1, γ2, γ3 and γ4.The key ingredient of the algorithm is the diagonalization in step 2; this processwill be explained in section 5.We will write 〈γi|i ∈ I〉 = 〈γi〉i and⊕i∈I〈γi〉 =⊕i〈γi〉 if the index set I is clearfrom the context.2. Hyperelliptic curvesA hyperelliptic curve is a smooth, projective curve C ⊆ Pn of genus at leasttwo with a separable, degree two morphism φ : C → P1. In the rest of thisDate: April 25, 2007. The author is a Ph.D.-student at the Department of MathematicalSciences, Faculty of Science, University of Aarhus.2000 Mathematics Subject Classification. Primary 14H40; Secondary 14Q05, 94A60.Key words and phrases. Jacobians, hyperelliptic curves, complex multiplication, cryptography.Research supported in part by a Ph.D. grant from CRYPTOMAThIC.12 C.R. RAVNSHØJpaper, let C be a hyperelliptic curve of genus two defined over a prime field Fpof characteristic p > 2. By the Riemann-Roch theorem there exists an embeddingψ : C → P2, mapping C to a curve given by an equation of the formy2 = f(x),where f ∈ Fp[x] is of degree six and have no multiple roots (see Cassels and Flynn,1996, chapter 1).The set of principal divisors P(C) on C constitutes a subgroup of the degree zerodivisors Div0(C). The Jacobian JC of C is defined as the quotientJC = Div0(C)/P(C).Consider the subgroup JC(Fp) < JC of Fp-rational elements. There exist num-bers ni, such that(1) JC(Fp) ' Z/n1Z⊕ Z/n2Z⊕ Z/n3Z⊕ Z/n4Z,where ni | ni+1 and n2 | p− 1 (see Frey and Lange, 2006, proposition 5.78, p. 111).We wish to determine generators of the m-torsion subgroup JC(Fp)[m] < JC(Fp),where m | |JC(Fp)| is the largest number such that ` | p−1 for every prime number` | m.3. Finite abelian groupsMiller (2004) shows the following theorem.Theorem 1. Let G be a finite abelian group of torsion rank r. Then for s ≥ r theprobability that a random s-tuple of elements of G generates G is at leastCrlog log |G|if s = r, and at least Cs if s > r, where Cs > 0 is a constant depending only on s(and not on |G|).Proof. (Miller, 2004, theorem 3, p. 251) Combining theorem 1 and equation (1), we expect to find generators of Γ[m] bychoosing 4 random elements γi ∈ Γ[m] in approximately log log |Γ[m]|C4 attempts.To determine whether the generators are independent, i.e. if 〈γi〉i =⊕i〈γi〉, weneed to know the subgroups of a cyclic `-group G. These are determined uniquelyby the order of G, since{0} < 〈`n−1g〉 < 〈`n−2g〉 < · · · < 〈`g〉 < Gare the subgroups of the group G = 〈g〉 of order `n. The following corollary is animmediate consequence of this observation.Corollary 2. Let U1 and U2 be cyclic subgroups of a finite group G. Assume U1and U2 are `-groups. Let 〈ui〉 < Ui be the subgroups of order `. ThenU1 ∩ U2 = {e} ⇐⇒ 〈u1〉 ∩ 〈u2〉 = {e}.Here e ∈ G is the neutral element.GENERATORS OF JACOBIANS OF HYPERELLIPTIC CURVES 34. The tame Tate pairingLet Γ = JC(Fp) be the rational subgroup of the Jacobian. Consider a numberλ | gcd(|Γ|, p− 1). Let g ∈ Γ[λ] and h =∑i aiPi ∈ Γ be divisors with no points incommon, and leth ∈ Γ/λΓdenote the class containing the divisor h. Furthermore, let f ∈ Fp(C) be a rationalfunction on C with divisor div(f) = λg. Set f(h) =∏i f(Pi)ai . Theneλ(g, h) = f(h)is a well-defined pairing Γ[λ]×Γ/λΓ −→ F×p /(F×p )λ, the Tate pairing ; cf. Galbraith(2005). Raising to the power p−1λ gives a well-defined element in the subgroupµλ < F×p of the λth roots of unity. This pairingτλ : Γ[λ]× Γ/λΓ −→ µλis called the tame Tate pairing.Since the class h is represented by the element h ∈ Γ, we will write τλ(g, h)instead of τλ(g, h). Furthermore, we will omit the subscript λ and just write τ(g, h),since the value of λ will be clear from the context.Hess (2004) gives a short and elementary proof of the following theorem.Theorem 3. The tame Tate pairing τ is bilinear and non-degenerate.Corollary 4. For every element g ∈ Γ of order λ an element h ∈ Γ exists, suchthat µλ = 〈τ(g, h)〉.Proof. (Silverman, 1986, corollary 8.1.1., p. 98) gives a similar result for ellipticcurves and the Weil pairing. The proof of this result only uses that the pairing isbilinear and non-degenerate. Hence it applies to corollary 4. Remark 5. In the following we only need the existence of the element h ∈ Γ, suchthat µλ = 〈τ(g, h)〉; we do not need to find it.5. Generators of Γ[m]As in the previous section, let Γ = JC(Fp) be the rational subgroup of theJacobian. We are searching for elements γi ∈ Γ[m] such that Γ[m] =⊕i〈γi〉. Asan abelian group, Γ[m] is the direct sum of its Sylow subgroups. Hence, we onlyneed to find generators of the Sylow subgroups of Γ[m].Set N = |Γ| and let ` | gcd(N, p − 1) be a prime number. Choose four randomelements γi ∈ Γ. Let Γ` < Γ be the Sylow-` subgroup of Γ, and set N` = |Γ`|. ThenNN`γi ∈ Γ`. Hence, we may assume that γi ∈ Γ`. If all the elements γi are equal tozero, then we choose other elements γi ∈ Γ. Hence, we may assume that some ofthe elements γi are non-zero.Let |γi| = λi, and re-enumerate the γi’s such that λi ≤ λi+1. Since some of theγi’s are non-zero, we may choose an index ν ≤ 4, such that λν 6= 1 and λi = 1 fori < ν. Choose λ0 minimal such that λ = λνλ0 | p− 1. Then Fp contains an elementζ of order λ. Now set gi = λiλ γi, ν ≤ i ≤ 4. Then gi ∈ Γ[λ], ν ≤ i ≤ 4. Finally,choose four random elements hi ∈ Γ.Letτ : Γ[λ]× Γ/λΓ −→ 〈ζ〉4 C.R. RAVNSHØJbe the tame Tate pairing. Define remainders αij modulo λ byτ(gi, hj) = ζαij .By corollary 4, for any of the elements gi we can choose an element h ∈ Γ, suchthat |τ(gi, h)| = λ. Assume that Γ/λΓ = 〈h1, h2, h3, h4〉. Then h =∑i qihi, and soτ(gi, h) = ζαi1q1+αi2q2+αi3q3+αi4q4 .If αij ≡ 0 (mod `), 1 ≤ j ≤ 4, then |τ(gi, h)| < λ. Hence, if Γ/λΓ = 〈h1, h2, h3, h4〉,then for all i ∈ {ν, . . . , 4} we can choose a j ∈ {1, . . . , 4}, such that αij 6≡ 0 (mod `).Enumerate the hi such that α44 6≡ 0 (mod `). Now assume a number j < 4exists, such that α4j 6≡ 0 (mod λ). Then ζα4j = ζβ1α44 , and replacing hj withhj − β1h4 gives α4j ≡ 0 (mod λ). So we may assume thatα41 ≡ α42 ≡ α43 ≡ 0 (mod λ) and α44 6≡ 0 (mod `).Assume similarly that a number j < 4 exists, such that αj4 6≡ 0 (mod λ). Nowset β2 ≡ α−144 αj4 (mod λ). Then τ(gj − β2g4, h4) = 1. So we may also assume thatα14 ≡ α24 ≡ α34 ≡ 0 (mod λ).Repeating this process recursively, we may assume thatαij ≡ 0 (mod λ) and α44 6≡ 0 (mod `).Again ν ≤ i ≤ 4 and 1 ≤ j ≤ 4.The discussion above is formalized in the following algorithm.Algorithm 1. As input we are given a hyperelliptic curve C of genus two definedover a prime field Fp, the number N = |Γ| of Fp-rational elements of the Jacobian,and a prime factor ` | gcd(N, p−1). The algorithm outputs elements γi ∈ Γ` of theSylow-` subgroup Γ` of Γ, such that 〈γi〉i =⊕i〈γi〉 in the following steps.(1) Compute the order N` of the Sylow-` subgroup of Γ.(2) Choose elements γi ∈ Γ, i ∈ I := {1, 2, 3, 4}. Set γi := NN` γi.(3) Choose elements hj ∈ Γ, j ∈ J := {1, 2, 3, 4}.(4) Set K := {1, 2, 3, 4}.(5) For k′ from 0 to 3 do the following:(a) Set k := 4− k′.(b) If γi = 0, then set I := I \ {i}. If |I| = 0, then go to step 2.(c) Compute the orders λκ := |γκ|, κ ∈ K. Re-enumerate the γκ’s suchthat λκ ≤ λκ+1, κ ∈ K. Set I := {5− |I|, 6− |I|, . . . , 4}.(d) Set ν := min(I), and choose λ0 minimal such that λ := λνλ0 | p− 1. Setgκ := λκλ γκ, κ ∈ I ∩K.(i) If gk = 0, then go to step 6.(ii) If τ(gk, hj)λ/` = 1 for all j ≤ k, then go to step 3.(e) Choose a primitive λth root of unity ζ ∈ Fp. Compute αkj and ακkfrom τ(gk, hj) = ζαkj and τ(gκ, hk) = ζακk , 1 ≤ j < k, κ ∈ I ∩ K.Re-enumerate h1, . . . , hk such that αkk 6≡ 0 (mod `).(f) For 1 ≤ j < k, set β ≡ α−1kk αkj (mod λ) and hj := hj − βhk.(g) For κ ∈ I ∩K \ {k}, set β ≡ α−1kk ακk (mod λ) and γκ := γκ − βλkλκγk.(h) Set K := K \ {k}.(6) Output γ1, γ2, γ3 and γ4.GENERATORS OF JACOBIANS OF HYPERELLIPTIC CURVES 5Remark 6. Algorithm 1 consists of a small number of(1) calculations of orders of elements γ ∈ Γ`,(2) multiplications of elements γ ∈ Γ with numbers a ∈ Z,(3) additions of elements γ1, γ2 ∈ Γ,(4) evaluations of pairings of elements γ1, γ2 ∈ Γ and(5) solving the discrete logarithm problem in Fp, i.e. to determine α from ζand ξ = ζα.By (Miller, 2004, proposition 9), the order |γ| of an element γ ∈ Γ` can be calculatedin timeO(log3N`)AΓ, where AΓ is the time for adding two elements of Γ. A multipleaγ or a sum γ1 + γ2 is computed in time O(AΓ). By Frey and Rück (1994), thepairing τ(γ1, γ2) of two elements γ1, γ2 ∈ Γ can be evaluated in time O(logN`).Finally, by Pohlig and Hellmann (1978) the discrete logarithm problem in Fp canbe solved in time O(log p). We may assume that addition in Γ is easy, i.e. thatAΓ < O(log p). Hence algorithm 1 runs in expected time O(log p).Careful examination of algorithm 1 gives the following lemma.Lemma 7. Let Γ` be the Sylow-` subgroup of Γ, ` | p− 1. Algorithm 1 determineselements γi ∈ Γ` and hi ∈ Γ, 1 ≤ i ≤ 4, such that one of the following cases holds.(1) α11α22α33α44 6≡ 0 (mod `) and αij ≡ 0 (mod λ), i 6= j, i, j ∈ {1, 2, 3, 4}.(2) γ1 = 0, α22α33α44 6≡ 0 (mod `) and αij ≡ 0 (mod λ), i 6= j, i, j ∈ {2, 3, 4}.(3) γ1 = γ2 = 0, α33α44 6≡ 0 (mod `) and αij ≡ 0 (mod λ), i 6= j, i, j ∈ {3, 4}.(4) γ1 = γ2 = γ3 = 0.If |γi| = λi, then λi ≤ λi+1. Set ν = min{i|λi 6= 1}, and define λ0 as the leastnumber, such that λ = λνλ0 | p− 1. Set gi =λiλ γi, ν ≤ i ≤ 4. Then the numbers αijabove are determined byτ(gi, hj) = ζαij ,where τ is the tame Tate pairing Γ[λ]× Γ/λΓ → µλ = 〈ζ〉.Theorem 8. Algorithm 1 determines elements γ1, γ2, γ3 and γ4 of the Sylow-`subgroup of Γ, ` | p− 1, such that 〈γi〉i =⊕i〈γi〉.Proof. Choose elements γi, hi ∈ Γ such that the conditions of lemma 7 are fulfilled.Set λi = |γi|, and let ν = min{i|λi 6= 1}. Define λ0 as the least number, such thatλ = λνλ0 | p− 1. Set gi =λiλ γi. Then the αij ’s from lemma 7 are determined byτ(gi, hj) = ζαij .We only consider case 1 of lemma 7, since the other cases follow similarly. We startby determining 〈γ3〉 ∩ 〈γ4〉. Assume that g3 = ag4. Then1 = τ(g3, h4) = τ(ag4, h4) = ζaα44 ,i.e. a ≡ 0 (mod λ). Hence 〈γ3〉 ∩ 〈γ4〉 = {0}. Then we determine 〈γ2〉 ∩ 〈γ3, γ4〉.Assume g2 = ag3 + bg4. Then1 = τ(g2, h3) = τ(ag3, h3) = ζaα33 ,i.e. a ≡ 0 (mod λ). In the same way,1 = τ(g2, h4) = ζbα44 ,i.e. b ≡ 0 (mod λ). Hence 〈γ2〉 ∩ 〈γ3, γ4〉 = {0}. Similarly 〈γ1〉 ∩ 〈γ2, γ3, γ4〉 = {0}.Hence 〈γi〉i =⊕i〈γi〉. 6 C.R. RAVNSHØJFrom theorem 8 we get the following probabilistic algorithm to determine gene-rators of the m-torsion subgroup Γ[m] < Γ, where m | |Γ| is the largest divisor of|Γ| such that ` | p− 1 for every prime number ` | m.Algorithm 2. As input we are given a hyperelliptic curve C of genus two definedover a prime field Fp, the number N = |Γ| of Fp-rational elements of the Jacobian,and the prime factors p1, . . . , pn of gcd(N, p− 1). The algorithm outputs elementsγi ∈ Γ[m] such that Γ[m] =⊕i〈γi〉 in the following steps.(1) Set γi := 0, 1 ≤ i ≤ 4. For ` ∈ {p1, . . . , pn} do the following:(a) Use algorithm 1 to determine elements γ̃i ∈ Γ`, 1 ≤ i ≤ 4, such that〈γ̃i〉i =⊕i〈γ̃i〉.(b) If∏i |γ̃i| < |Γ`|, then go to step 1a.(c) Set γi := γi + γ̃i, 1 ≤ i ≤ 4.(2) Output γ1, γ2, γ3 and γ4.Remark 9. By remark 6, algorithm 2 has expected running time O(log p). Hencealgorithm 2 is an efficient, probabilistic algorithm to determine generators of them-torsion subgroup Γ[m] < Γ, where m | |Γ| is the largest divisor of |Γ| such that` | p− 1 for every prime number ` | m.Remark 10. The strategy of algorithm 1 can be applied to any finite, abelian groupΓ with bilinear, non-degenerate pairings into cyclic groups. For the strategy to beefficient, the pairings must be efficiently computable, and the discrete logarithmproblem in the cyclic groups must be easy.ReferencesJ.W.S. Cassels and E.V. Flynn. Prolegomena to a Middlebrow Arithmetic ofCurves of Genus 2. London Mathematical Society Lecture Note Series. Cam-bridge University Press, 1996.G. Frey and T. Lange. Varieties over Special Fields. In H. Cohen and G. Frey,editors, Handbook of Elliptic and Hyperelliptic Curve Cryptography, pp. 87–113.Chapman & Hall/CRC, 2006.G. Frey and H.-G. Rück. A remark concerning m-divisibility and the discretelogarithm in the divisor class group of curves. Math. Comp., vol. 62, pp. 865–874,1994.S. Galbraith. Pairings. In I.F. Blake, G. Seroussi and N.P. Smart, editors, Ad-vances in Elliptic Curve Cryptography. London Mathematical Society LectureNote Series, vol. 317, pp. 183–213. Cambridge University Press, 2005.F. Hess. A note on the Tate pairing of curves over finite fields. Arch. Math., no. 82,pp. 28–32, 2004.V.S. Miller. The Weil Pairing and Its Efficient Calculation. J. Cryptology, no. 17,pp. 235–261, 2004.S. Pohlig and M. Hellmann. An improved algorithm for computing logarithmsover GF (p) and its cryptographic significance. IEEE Trans. Inform. Theory,vol. 24, pp. 106–110, 1978.J.H. Silverman. The Arithmetic of Elliptic Curves. Springer, 1986.Department of Mathematical Sciences, University of Aarhus, Ny Munkegade,Building 1530, DK-8000 Aarhus CE-mail address: cr@imf.au.dk

Generators of Jacobians of Hyperelliptic Curves

Abstract

Similar works

Full text

Available Versions

CiteSeerX

Cryptology ePrint Archive