We present two algorithms to compute the endomorphism ring of an ordinary elliptic curve E defined over a finite field F_q. Under suitable heuristic assumptions, both have subexponential complexity. We bound the complexity of the first algorithm in terms of log q, while our bound for the second algorithm depends primarily on log |D_E|, where D_E is the discriminant of the order isomorphic to End(E). As a byproduct, our method yields a short certificate that may be used to verify that the endomorphism ring is as claimed.
We present a new algorithm for computing the endomorphism ring of an ordinary abelian surface over a finite field which is subexponential and generalizes an algorithm of Bisson and Sutherland for elliptic curves. The correctness of this algorithm only requires the heuristic assumptions required by the algorithm of Biasse and Fieker which computes the class group of an order in a number field in subexponential time. Thus we avoid the multiple heuristic assumptions on isogeny graphs and polarized class groups which were previously required. The output of the algorithm is an ideal in the maximal …
For an elliptic curve $E$ over a finite field we define the point sequence $(P_n)$ recursively by $P_n=\vartheta (P_{n-1})=\vartheta ^n(P_0)$ with an endomorphism $\vartheta \in\mathrm{End}(E)$ and with some initial point $P_0$ on $E$. We study the distribution and the linear complexity of sequences obtained from $(P_n)$.
Let $E/\mathbb{Q}$ be a non-CM elliptic curve. Assuming GRH, we prove that, for a set of primes $p$ of density $1$, the absolute discriminant of the $\mathbb{F}_p$-endomorphism ring of the reduction of $E$ modulo $p$ is close to maximal.
Computing endomorphism rings of supersingular elliptic curves is an important problem in computational number theory, and it is also closely connected to the security of some of the recently proposed isogeny-based cryptosystems. In this paper we give a new algorithm for computing the endomorphism ring of a supersingular elliptic curve $E$ that runs, under certain heuristics, in time $O((\log p)^2p^{1/2})$. The algorithm works by first finding two cycles of a certain form in the supersingular $\ell$-isogeny graph $G(p,\ell)$, generating an order $Λ\subseteq \operatorname{End}(E)$. Then all maxi…
We relate the endomorphism rings of certain $D$-elliptic sheaves of finite characteristic to hereditary orders in central division algebras over function fields.
Let $k$ be a global field, let $A$ be a Dedekind domain with $\text{Quot}(A) = k$, and let $K$ be a finitely generated field. Using a unified approach for both elliptic curves and Drinfeld modules $M$ defined over $K$ and having a trivial endomorphism ring, with $k= \mathbb{Q}$, $A = \mathbb{Z}$ in the former case and $k$ a global function field, $A$ its ring of functions regular away from a fixed prime in the latter case, for any nonzero ideal $\mathfrak{a} \lhd A$ we prove best possible estimates in the norm $|\mathfrak{a}|$ for the degrees over $K$ of the subfields of the $\mathfrak{a}$-div…
We present a deterministic and explicit algorithm to compute the endomorphism rings of supersingular elliptic curves. As an example we compute the endomorphism rings of all supersingular elliptic curves defined over characteristic p=29,...,97.
Let E be an elliptic curve with complex multiplication by R, where R is an order of discriminant D<-4 of an imaginary quadratic field K . If a prime number p is decomposed completely in the ring class field associated with R, then E has good reduction at a prime ideal P of K dividing p and there exist positive integers u and v such that 4p=u^2-Dv^2. It is well known that square of the trace a_P of Frobenius endomorphism of the reduction of E modulo P is equal to u^2. We determine whether a_P=u or a_P=-u in the case the class number of R is 2 or 3 and D is divided by 3,4 or 5. This article is a…
In this paper we present an iterative construction of irreducible polynomials over finite fields based upon repeated applications of transforms induced by endomorphisms of odd prime degree of ordinary elliptic curves.
We design a probabilistic algorithm for computing endomorphism rings of ordinary elliptic curves defined over finite fields that we prove has a subexponential runtime in the size of the base field, assuming solely the generalized Riemann hypothesis. Additionally, we improve the asymptotic complexity of previously known, heuristic, subexponential methods by describing a faster isogeny-computing routine.
Chevyrev and Galbraith recently devised an algorithm which inputs a maximal order of the quaternion algebra ramified at one prime and infinity and constructs a supersingular elliptic curve whose endomorphism ring is precisely this maximal order. They proved that their algorithm is correct whenever it halts, but did not show that it always terminates. They did however prove that the algorithm halts under a reasonable assumption which they conjectured to be true. It is the purpose of this paper to verify their conjecture and in turn prove that their algorithm always halts. More precisely, Chevyr…
Generalizing a method of Sutherland and the author for elliptic curves, we design a subexponential algorithm for computing the endomorphism rings of ordinary abelian varieties of dimension two over finite fields. Although its correctness and complexity analysis rest on several assumptions, we report on practical computations showing that it performs very well and can easily handle previously intractable cases.
We give a detailed account of the use of $\mathbb{Q}$-curve reductions to construct elliptic curves over $\mathbb{F}\_{p^2}$ with efficiently computable endomorphisms, which can be used to accelerate elliptic curve-based cryptosystems in the same way as Gallant--Lambert--Vanstone (GLV) and Galbraith--Lin--Scott (GLS) endomorphisms. Like GLS (which is a degenerate case of our construction), we offer the advantage over GLV of selecting from a much wider range of curves, and thus finding secure group orders when \(p\) is fixed for efficient implementation. Unlike GLS, we also offer the possibilit…
In this paper we extend a previous investigation by us regarding an iterative construction of irreducible polynomials over finite fields of odd characteristic. In particular, we show how it is possible to iteratively construct irreducible polynomials by means of two families of transforms, which we call the $Q_k$ and $\hat{Q}_k$-transforms, related to certain degree two isogenies over elliptic curves, which split the multiplication-by-$2$ map.
In this paper we present and analyse a construction of irreducible polynomials over odd prime fields via the transforms which take any polynomial $f \in \mathbf{F}_p[x]$ of positive degree $n$ to $\left(\frac{x}{k} \right)^n \cdot f(k(x+x^{-1}))$, for some specific values of the odd prime $p$ and $k \in \mathbf{F}_p$.
We classify the endomorphism algebras of factors of the Jacobian of certain hypergeometric curves over a field of characteristic zero. Other than a few exceptional cases, the endomorphism algebras turn out to be either a cyclotomic field $E=\mathbb{Q}(ζ_q)$, or a quadratic extension of $E$, or $E\oplus E$. This result may be viewed as a generalization of the well known results of the classification of endomorphism algebras of elliptic curves over $\mathbb{C}$.
Let O be a maximal order in the quaternion algebra B_p over Q ramified at p and infinity. The paper is about the computational problem: Construct a supersingular elliptic curve E over F_p such that End(E) = O. We present an algorithm that solves this problem by taking gcds of the reductions modulo p of Hilbert class polynomials. New theoretical results are required to determine the complexity of our algorithm. Our main result is that, under certain conditions on a rank three sublattice O^T of O, the order O is effectively characterized by the three successive minima and two other short vectors…
Let $E$ be an elliptic curve without CM that is defined over a number field $K$. For all but finitely many nonarchimedean places $v$ of $K$ there is the reduction $E(v)$ of $E$ at $v$ that is an elliptic curve over the residue field $k(v)$ at $v$. The set of $v$'s with ordinary $E(v)$ has density 1 (Serre). For such $v$ the endomorphism ring $End(E(v))$ of $E(v)$ is an order in an imaginary quadratic field. We prove that for any pair of relatively prime positive integers $N$ and $M$ there are infinitely many nonarchimedean places $v$ of $K$ such that the discriminant $Δ(v)$ of $End(E(v))$ is d…
Let $E$ be an elliptic curve, $\mathcal{K}_1$ its Kummer curve $E/\{\pm1\}$, $E^2$ its square product, and $\mathcal{K}_2$ the split Kummer surface $E^2/\{\pm1\}$. The addition law on $E^2$ gives a large endomorphism ring, which induce endomorphisms of $\mathcal{K}_2$. With a view to the practical applications to scalar multiplication on $\mathcal{K}_1$, we study the explicit arithmetic of $\mathcal{K}_2$.
Let $p>3$ be a fixed prime. For a supersingular elliptic curve $E$ over $\mathbb{F}_p$ with $j$-invariant $j(E)\in \mathbb{F}_p\backslash\{0, 1728\}$, it is well known that the Frobenius map $π=((x,y)\mapsto (x^p, y^p))\in \mathrm{End}(E)$ satisfies $π^2=-p$. A result of Ibukiyama tells us that $\mathrm{End}(E)$ is a maximal order in $\mathrm{End}(E)\otimes \mathbb{Q}$ associated to a (minimal) prime $q$ satisfying $q\equiv 3 \bmod 8$ and the quadratic residue $\bigl(\frac{p}{q}\bigr)=-1$ according to $\frac{1+π}{2}\notin \mathrm{End}(E)$ or $\frac{1+π}{2}\in \mathrm{End}(E)$. Let $q_j$ denote…
We construct new families of elliptic curves over \(\FF_{p^2}\) with efficiently computable endomorphisms, which can be used to accelerate elliptic curve-based cryptosystems in the same way as Gallant-Lambert-Vanstone (GLV) and Galbraith-Lin-Scott (GLS) endomorphisms. Our construction is based on reducing \(\QQ\)-curves-curves over quadratic number fields without complex multiplication, but with isogenies to their Galois conjugates-modulo inert primes. As a first application of the general theory we construct, for every \(p > 3\), two one-parameter families of elliptic curves over \(\FF_{p^2}\…
We study the problem of generating the endomorphism ring of a supersingular elliptic curve by two cycles in $\ell$-isogeny graphs. We prove a necessary and sufficient condition for the two endomorphisms corresponding to two cycles to be linearly independent, expanding on the work in Kohel's thesis. We also give a criterion under which the order generated by two cycles is not a maximal order. We give some examples in which we compute cycles which generate the full endomorphism ring. The most difficult part of these computations is the calculation of the trace of these cycles. We show that a gen…
Fix an ordinary abelian variety defined over a finite field. The ideal class group of its endomorphism ring acts freely on the set of isogenous varieties with same endomorphism ring, by complex multiplication. Any subgroup of the class group, and generating set thereof, induces an isogeny graph on the orbit of the variety for this subgroup. We compute (under the Generalized Riemann Hypothesis) some bounds on the norms of prime ideals generating it, such that the associated graph has good expansion properties. We use these graphs, together with a recent algorithm of Dudeanu, Jetchev and Robert …
We consider the problem of checking whether an elliptic curve defined over a given number field has complex multiplication. We study two polynomial time algorithms for this problem, one randomized and the other deterministic. The randomized algorithm can be adapted to yield the discriminant of the endomorphism ring of the curve.
Distortion maps allow one to solve the Decision Diffie-Hellman problem on subgroups of points on the elliptic curve. In the case of ordinary elliptic curves over finite fields, it is known that in most cases there are no distortion maps. In this article we characterize the existence of distortion maps in the remaining cases.
We present here explicit relations between the traces of Frobenius endomorphisms of certain families of elliptic curves and special values of ${_{2}}F_1$-hypergeometric functions over $\mathbb{F}_q$ for $q \equiv 1 (\text{mod} 6)$ and $q \equiv 1 (\text{mod} 4)$.
In this paper, we find a power series expansion of the invariant differential $ω_E$ of an elliptic curve $E$ defined over $\mathbb{Q}$, where $E$ is described by certain families of Weierstrass equations. In addition, we introduce several congruence relations satisfied by the trace of the Frobenius endomorphism of $E$.
This is the first in a series of articles where we will study the Iwasawa theory of an elliptic modular form f along the anticyclotomic Zp-tower of an imaginary quadratic field K where the prime p splits completely. Our goal in this portion is to prove the Iwasawa main conjecture for suitable twists of f assuming that f is p-ordinary, both in the definite and indefinite setups simultaneously, via an analysis of Beilinson-Flach elements.
We introduce an analogue of the Mertens conjecture for elliptic curves over finite fields. Using a result of Waterhouse, we classify the isogeny classes of elliptic curves for which this conjecture holds in terms the size of the finite field and the trace of the Frobenius endomorphism acting on the curve.
Given an abelian algebraic group $A$ over a global field $F$, $α\in A(F)$, and a prime $\ell$, the set of all preimages of $α$ under some iterate of $[\ell]$ generates an extension of $F$ that contains all $\ell$-power torsion points as well as a Kummer-type extension. We analyze the Galois group of this extension, and for several classes of $A$ we give a simple characterization of when the Galois group is as large as possible up to constraints imposed by the endomorphism ring or the Weil pairing. This Galois group encodes information about the density of primes $\p$ in the ring of integers of…
We study isogeny classes of Drinfeld $A$-modules over finite fields $k$ with commutative endomorphism algebra $D$, in order to describe the isomorphism classes in a fixed isogeny class. We study when the minimal order $A[π]$ of $D$ occurs as an endomorphism ring by proving when it is locally maximal at $π$, and show that this happens if and only if the isogeny class is ordinary or $k$ is the prime field. We then describe how the monoid of fractional ideals of the endomorphism ring $\mathcal{E}$ of a Drinfeld module $ϕ$ up to $D$-linear equivalence acts on the isomorphism classes in the isogeny…
An isogeny graph is a graph whose vertices are principally polarized abelian varieties and whose edges are isogenies between these varieties. In his thesis, Kohel described the structure of isogeny graphs for elliptic curves and showed that one may compute the endomorphism ring of an elliptic curve defined over a finite field by using a depth first search algorithm in the graph. In dimension 2, the structure of isogeny graphs is less understood and existing algorithms for computing endomorphism rings are very expensive. Our setting considers genus 2 jacobians with complex multiplication, with …
We determine the set of geometric endomorphism algebras of geometrically split abelian surfaces defined over $\mathbb{Q}$. In particular we find that this set has cardinality 92. The essential part of the classification consists in determining the set of quadratic imaginary fields $M$ with class group $\mathrm{C}_2 \times \mathrm{C}_2$ for which there exists an abelian surface $A$ defined over $\mathbb{Q}$ which is geometrically isogenous to the square of an elliptic curve with CM by $M$. We first study the interplay between the field of definition of the geometric endomorphisms of $A$ and the…
Main conjectures for non-CM elliptic curves at good ordinary primes
Academy of Mathematics and Systems Science, Chinese Academy of Sciences（中国科学院数学与系统科学研究院）；Beijing Institute of Mathematical Sciences and Applications（北京应用数学与计算科学研究所）；Yau Mathematical Sciences Center, Tsinghua University（清华大学丘成桐数学科学中心）
We study $\mathscr{D}$-elliptic sheaves in terms of their associated modules, which we call Drinfeld-Stuhler modules. We prove some basic results about Drinfeld-Stuhler modules and their endomorphism rings, and then examine the existence and properties of Drinfeld-Stuhler modules with large endomorphism algebras, which are analogous to CM and supersingular Drinfeld modules. Finally, we examine the fields of moduli of Drinfeld-Stuhler modules.
In this paper we will give a global description of the Frobenius for the division fields of an elliptic curve E which is strictly analogous to the cyclotomic case. This is then applied to determine the splitting of a prime p in subfields of such a division field. Such fields include a large class of non-solvable quintic extensions and our application provides an arithmetic counterpart to Klein's "solution" of quintic equations using elliptic functions. A central role is played by the discriminant of the ring of endomorphisms of the elliptic curve reduced modulo p.
We present here a formula for expressing the trace of the Frobenius endomorphism of an elliptic curve $E$ over $\mathbb{F}_q$ satisfying $j(E)\neq 0,1728$ and $q\equiv 1 \pmod{12}$ in terms of special values of Gaussian hypergeometric series. This paper uses methods introduced in Fuselier's work for one parameter families of curves to express the trace of Frobenius of $E$ as a function of its $j$-invariant and discriminant instead of a parameter, which are more intrinsic characteristics of the curve.
The problem of computing an explicit isogeny between two given elliptic curves over F_q, originally motivated by point counting, has recently awaken new interest in the cryptology community thanks to the works of Teske and Rostovstev & Stolbunov. While the large characteristic case is well understood, only suboptimal algorithms are known in small characteristic; they are due to Couveignes, Lercier, Lercier & Joux and Lercier & Sirvent. In this paper we discuss the differences between them and run some comparative experiments. We also present the first complete implementation of Couveignes' sec…
Eötvös Loránd University（罗兰大学）；University of Arizona（亚利桑那大学）；University of Auckland（奥克兰大学）；University of Alberta – Augustana Campus（阿尔伯塔大学奥古斯塔纳学院）；University of French Polynesia（法属波利尼西亚大学）；University of Vermont（佛蒙特大学）
本文研究了超奇异椭圆曲线的格的极小值，探讨了第三极小值D_3与曲线j不变量在有限域上的关系，以及当p≡3 mod 4时的更细致的环结构信息。
