Ordinary abelian varieties having small embedding degree
0 likes430 views
The document discusses the properties of ordinary abelian varieties with small embedding degrees, focusing on the embedding degree's relation to finite fields and cryptographic applications. It introduces MNT curves and explores their extensions with co-factors, particularly in the genus 2 case. Various methods for construction and analysis of these curves, including handling different polynomial cases, are also presented.
![Suitable elliptic curves
• supersingular
• MNT curves (Miyaji, Nakabayashi, Takano) : for
k ∈ {3, 4, 6} (ϕ(k) = 2), find q(l), t(l) ∈ Z[l] s.t.
n(l) := q(l) − t(l) + 1 | Φk (q(l))
k q t n
3 12l2 − 1 −1 ± 6l 12l2 ± 6l + 1
4 l2 + l + 1 −l, l + 1 l2 + 2l + 2, l2 + 1
6 4l2 + 1 1 ± 2l 4l2 ± 2l + 1
Ordinary abelian varieties having small embedding degree – p. 5/1](https://image.slidesharecdn.com/pic150605-090617204353-phpapp01/85/Ordinary-abelian-varieties-having-small-embedding-degree-8-320.jpg)
![Extending these methods
• Extending MNT curves with co-factors
• The genus 2 case
• Embedding degree k ∈ {5, 8, 10, 12} (ϕ(k) = 4)
• Heuristics suggest similar results (in frequency)
• . . . but the earlier method no longer applies
Alternative approach: consider q = q(l) as a quadratic
polynomial in Z[l] and note that we are looking to factorise
Φk (q(l)) = n1 (l)n2 (l)
Ordinary abelian varieties having small embedding degree – p. 10/1](https://image.slidesharecdn.com/pic150605-090617204353-phpapp01/85/Ordinary-abelian-varieties-having-small-embedding-degree-18-320.jpg)
![Factoring Φk (q(l))
1. Let q(l) be a quadratic polynomial over Q[l]. Then, one
of two cases may occur:
(a) Φk (q(l)) is irreducible over the rationals, with degree
2ϕ(k)
(b) Φk (q(l)) = n1 (l)n2 (l), where n1 (l), n2 (l) are
irreducible over the rationals, degree ϕ(k)
2. A criterion for case (b) is q(z) = ζk having a solution in
Q(ζk ), where ζk is a primitive complex k-th root of unity.
(Note: applies to both elliptic and hyperelliptic curves. . . )
Ordinary abelian varieties having small embedding degree – p. 11/1](https://image.slidesharecdn.com/pic150605-090617204353-phpapp01/85/Ordinary-abelian-varieties-having-small-embedding-degree-19-320.jpg)
![Retrieving the MNT curves
Here k ∈ {3, 4, 6} and [Q(ζk ) : Q] = 2.
Example (k = 6): Completing the square and clearing
denominators, we get
w2 + b = cζ6
where b, c ∈ Z and w ∈ Z(ζ6 ). Writing w = A + Bζ6 , leads
to solving
B(2A + B) = c
B 2 − A 2 =b
and, by fixing b, retrieving the previous examples.
Ordinary abelian varieties having small embedding degree – p. 13/1](https://image.slidesharecdn.com/pic150605-090617204353-phpapp01/85/Ordinary-abelian-varieties-having-small-embedding-degree-21-320.jpg)
![Hyperelliptic curves (genus 2)
Here k ∈ {5, 8, 10, 12} and [Q(ζk ) : Q] = 4.
As before, w2 + b = cζk , but
2 3
w = A + Bζk + Cζk + Dζk
which now leads to four quadratics in integers A, B, C and
D, two of which homogeneous that must vanish.
Ordinary abelian varieties having small embedding degree – p. 14/1](https://image.slidesharecdn.com/pic150605-090617204353-phpapp01/85/Ordinary-abelian-varieties-having-small-embedding-degree-22-320.jpg)
Ordinary abelian varieties having small embedding degree
- 1. Ordinary abelian varieties having small embedding degree Paula Cristina Valenca ¸ joined work with Steven Galbraith and James McKee P.Valenca@rhul.ac.uk Royal Holloway University of London Ordinary abelian varieties having small embedding degree – p. 1/1
- 2. Plan • On the problem of using abelian varieties with small embedding degree • Introducing the MNT curves • Extending MNT curves with co-factors • The genus 2 case Ordinary abelian varieties having small embedding degree – p. 2/1
- 3. Embedding degree Fq finite field, J/Fq Jacobian of a curve. The embedding degree is the smallest positive integer k r | qk − 1 where r is the largest prime divisor of #J. In particular, r | Φk (q) (k-cyclotomic polynomial). Ordinary abelian varieties having small embedding degree – p. 3/1
- 4. Embedding degree Fq finite field, J/Fq Jacobian of a curve. The embedding degree is the smallest positive integer k r | qk − 1 where r is the largest prime divisor of #J. In particular, r | Φk (q) (k-cyclotomic polynomial). Motivation: use of Weil and Tate pairings in cryptographic protocols - provide a mapping from G ⊂ J to F∗k . q Ordinary abelian varieties having small embedding degree – p. 3/1
- 5. Cyclotomic Polynomials n ϕ(n) Φn (q) 1 1 q−1 2 1 q+1 3 2 q2 + q + 1 4 2 q2 + 1 5 4 q4 + q3 + q2 + q + 1 6 2 q2 − q + 1 7 6 q6 + q5 + q4 + q3 + q2 + q + 1 8 4 q4 + 1 9 6 q6 + q3 + 1 10 4 q4 − q3 + q2 − q + 1 11 10 q 10 + q 9 + q 8 + q 7 + q 6 + q 5 + q 4 + q 3 + q 2 + q + 1 12 4 q4 − q2 + 1 Ordinary abelian varieties having small embedding degree – p. 4/1
- 6. Suitable elliptic curves • supersingular • MNT curves (Miyaji, Nakabayashi, Takano) Ordinary abelian varieties having small embedding degree – p. 5/1
- 7. Suitable elliptic curves • supersingular : for example, • q = 32m , n = 32m ± 3m + 1 (k = 3) • q = 32m+1 , n = 32m+1 ± 3m+1 + 1 (k = 6) • MNT curves (Miyaji, Nakabayashi, Takano) Ordinary abelian varieties having small embedding degree – p. 5/1
- 8. Suitable elliptic curves • supersingular • MNT curves (Miyaji, Nakabayashi, Takano) : for k ∈ {3, 4, 6} (ϕ(k) = 2), find q(l), t(l) ∈ Z[l] s.t. n(l) := q(l) − t(l) + 1 | Φk (q(l)) k q t n 3 12l2 − 1 −1 ± 6l 12l2 ± 6l + 1 4 l2 + l + 1 −l, l + 1 l2 + 2l + 2, l2 + 1 6 4l2 + 1 1 ± 2l 4l2 ± 2l + 1 Ordinary abelian varieties having small embedding degree – p. 5/1
- 9. Extending these methods • Extending MNT curves with co-factors • The genus 2 case Ordinary abelian varieties having small embedding degree – p. 6/1
- 10. Extending these methods • Extending MNT curves with co-factors • instead of n | Φk (q), have r | Φk (q) where n = hr (r is the largest such factor) • The genus 2 case Ordinary abelian varieties having small embedding degree – p. 6/1
- 11. co-factors: k = 6 Write λr = Φ6 (q) = q 2 − q + 1 Ordinary abelian varieties having small embedding degree – p. 7/1
- 12. co-factors: k = 6 Write λr = Φ6 (q) = q 2 − q + 1 n t2 ⇒ (q + t + 1) − λ/h = 3 − q q Ordinary abelian varieties having small embedding degree – p. 7/1
- 13. co-factors: k = 6 Write λr = Φ6 (q) = q 2 − q + 1 n t2 ⇒ (q + t + 1) − λ/h = 3 − q q Writing λ/h = λ/h + , > 0 (gcd(λ, h) = 1) and using Hasse’s bound −4/3 + < q + t + 1 − λ/h < 3 + < 4 for q > 64, and so v := q + t + 1 − λ/h ∈ {−1, 0, 1, 2, 3} Ordinary abelian varieties having small embedding degree – p. 7/1
- 14. co-factors (cont.) Substituting v in n(v − ) = 3q − t2 leads to solving a quadratic in t whose discriminant must be a square. Writing = u/h, find x s.t. x2 = M + N q where M, N ∈ Z, depending solely on u and h. Ordinary abelian varieties having small embedding degree – p. 8/1
- 15. co-factors (cont.) Substituting v in n(v − ) = 3q − t2 leads to solving a quadratic in t whose discriminant must be a square. Writing = u/h, find x s.t. x2 = M + N q where M, N ∈ Z, depending solely on u and h. M must be a quadratic residue mod N . Ordinary abelian varieties having small embedding degree – p. 8/1
- 16. Valid pairs (q, t) for k = 6 h q t 1 4l2 + 1 ±2l + 1 2 8l2 + 6l + 3 2l + 2 24l2 + 6l + 1 −6l 3 12l2 + 4l + 3 −2l + 1 84l2 + 16l + 1 −14l − 1 84l2 + 128l + 49 14l + 11 ... ... ... • Curves can be constructed by using Complex Multiplication, solving a Pell-type equation. Ordinary abelian varieties having small embedding degree – p. 9/1
- 17. Extending these methods • Extending MNT curves with co-factors • The genus 2 case • Embedding degree k ∈ {5, 8, 10, 12} (ϕ(k) = 4) • Heuristics suggest similar results (in frequency) • . . . but the earlier method no longer applies Ordinary abelian varieties having small embedding degree – p. 10/1
- 18. Extending these methods • Extending MNT curves with co-factors • The genus 2 case • Embedding degree k ∈ {5, 8, 10, 12} (ϕ(k) = 4) • Heuristics suggest similar results (in frequency) • . . . but the earlier method no longer applies Alternative approach: consider q = q(l) as a quadratic polynomial in Z[l] and note that we are looking to factorise Φk (q(l)) = n1 (l)n2 (l) Ordinary abelian varieties having small embedding degree – p. 10/1
- 19. Factoring Φk (q(l)) 1. Let q(l) be a quadratic polynomial over Q[l]. Then, one of two cases may occur: (a) Φk (q(l)) is irreducible over the rationals, with degree 2ϕ(k) (b) Φk (q(l)) = n1 (l)n2 (l), where n1 (l), n2 (l) are irreducible over the rationals, degree ϕ(k) 2. A criterion for case (b) is q(z) = ζk having a solution in Q(ζk ), where ζk is a primitive complex k-th root of unity. (Note: applies to both elliptic and hyperelliptic curves. . . ) Ordinary abelian varieties having small embedding degree – p. 11/1
- 20. Two approaches Two equivalent approaches present themselves 1. expand Φk (q(l)) = n1 (l)n2 (l) and try to solve the Diophantine system of equations 2. solve q(z) = ζk over Q(ζk ) Ordinary abelian varieties having small embedding degree – p. 12/1
- 21. Retrieving the MNT curves Here k ∈ {3, 4, 6} and [Q(ζk ) : Q] = 2. Example (k = 6): Completing the square and clearing denominators, we get w2 + b = cζ6 where b, c ∈ Z and w ∈ Z(ζ6 ). Writing w = A + Bζ6 , leads to solving B(2A + B) = c B 2 − A 2 =b and, by fixing b, retrieving the previous examples. Ordinary abelian varieties having small embedding degree – p. 13/1
- 22. Hyperelliptic curves (genus 2) Here k ∈ {5, 8, 10, 12} and [Q(ζk ) : Q] = 4. As before, w2 + b = cζk , but 2 3 w = A + Bζk + Cζk + Dζk which now leads to four quadratics in integers A, B, C and D, two of which homogeneous that must vanish. Ordinary abelian varieties having small embedding degree – p. 14/1
- 23. An example: k = 8 k = 8: 2AD + 2BC =0 2AC + B 2 − D2 =0 ⇒ D3 − B 2 D + 2BC 2 = 0 Ordinary abelian varieties having small embedding degree – p. 15/1
- 24. An example: k = 8 k = 8: 2AD + 2BC =0 2AC + B 2 − D2 =0 ⇒ D3 − B 2 D + 2BC 2 = 0 • latter corresponds to an elliptic curve with rank 0 • none of its four points leads to a solution to the system Ordinary abelian varieties having small embedding degree – p. 15/1
- 25. An example: k = 8 k = 8: 2AD + 2BC =0 2AC + B 2 − D2 =0 ⇒ D3 − B 2 D + 2BC 2 = 0 • latter corresponds to an elliptic curve with rank 0 • none of its four points leads to a solution to the system • there exists no rational quadratic polynomial q(l) s.t. Φ8 (q(l)) splits. Ordinary abelian varieties having small embedding degree – p. 15/1
- 26. Some solutions k h q 5 1 l2 404 1010l2 + 525l + 69 10 4 10l2 + 5l + 2 11 11l2 + 10l + 3 11 55l2 + 40l + 8 12 1 22m+1 q = 2l2 , 6l2 ( k = 12 ) q = 5l2 ( k = 5 ) Ordinary abelian varieties having small embedding degree – p. 16/1
- 27. Questions P.Valenca@rhul.ac.uk Ordinary abelian varieties having small embedding degree – p. 17/1