A low storage algorithm for constructing isogenies between ordinary elliptic curves was proposed by Galbraith, Hess and Smart (GHS). We give an improvement of this algorithm by modifying the pseudorandom walk so that lower-degree isogenies are used more frequently. This is motivated by the fact that high degree isogenies are slower to compute than low degree ones. We analyse the running time of the parallel collision search algorithm when the partitioning is uneven. We also give experimental results. We conclude that our algorithm is around 14 times faster than the GHS algorithm when constructing horizontal isogenies between random isogenous elliptic curves over a 160-bit prime field.
The results apply to generic adding walks and the more general group action inverse problem; a speed-up is obtained whenever the cost of computing edges in the graph varies significantly.
We give a detailed presentation of $\ell$-isogeny graphs associated with ordinary elliptic curves defined over $\mathbb{F}_p$. We then focus on the following inverse problem: given an abstract volcano $V$, do there always exist primes $\ell, p \in \mathbb{N}$ such that the ordinary $\ell$-isogeny graph over $\mathbb{F}_p$ contains $V$ as a connected component? We provide an affirmative answer to this question.
Let $\mathcal{E}$ be a $\mathbb{Q}$-isogeny class of elliptic curves defined over $\mathbb{Q}$. The isogeny graph associated to $\mathcal{E}$ is a graph which has a vertex for each elliptic curve in the $\mathbb{Q}$-isogeny class $\mathcal{E}$, and an edge for each cyclic $\mathbb{Q}$-isogeny of prime degree between elliptic curves in the isogeny class, with the degree recorded as a label of the edge. In this paper, we define an isogeny-torsion graph to be an isogeny graph where, in addition, we label each vertex with the abstract group structure of the torsion subgroup over $\mathbb{Q}$ of th…
We describe the structure of Tate-Shafarevich groups of a constant elliptic curves over function fields by exploiting the volcano structure of isogeny graphs of elliptic curves over finite fields.
We show that the distribution of elliptic curves in isogeny classes of curves with a given value of the Frobenius trace $t$ becomes close to uniform even when $t$ is averaged over very short intervals inside the Hasse-Weil interval.
We work out the complete descent via 4-isogeny for a family of rational elliptic curves with a rational point of order 4; such a family is of the form $y^2 + x y + a y = x^3 + a x^2$ where $\sqrt{-a} \in \mathbb Q^\times$. In the process we exhibit the 4-isogeny and the isogenous curve, explicitly present the principal homogeneous spaces, and discuss examples by computing the rank.
Let $\mathcal{E}$ be a $\mathbb{Q}$-isogeny class of elliptic curves defined over $\mathbb{Q}$ without CM. The isogeny graph associated to $\mathcal{E}$ is a graph which has a vertex for each elliptic curve in $\mathcal{E}$ and an edge for each $\mathbb{Q}$-isogeny of prime degree that maps one elliptic curve in $\mathcal{E}$ to another elliptic curve in $\mathcal{E}$, with the degree recorded as a label of the edge. An isogeny-torsion graph is an isogeny graph where, in addition, we label each vertex with the abstract group structure of the torsion subgroup over $\mathbb{Q}$ of the correspond…
Let $\mathcal{E}$ be a $\mathbb{Q}$-isogeny class of elliptic curves defined over $\mathbb{Q}$. The isogeny graph associated to $\mathcal{E}$ is a graph which has a vertex for each element of $\mathcal{E}$ and an edge for each $\mathbb{Q}$-isogeny of prime degree that maps one elliptic curve in $\mathcal{E}$ to another elliptic curve in $\mathcal{E}$, with the degree of the isogeny recorded as a label of the edge. The isogeny-torsion graph associated to $\mathcal{E}$ is the isogeny graph associated to $\mathcal{E}$ where, in addition, we label each vertex with the abstract group structure of t…
We describe the neighborhood of the vertex $[E_0]$ (resp. $[E_{1728}]$) in the $\ell$-isogeny graph $\mathcal{G}_\ell(\mathbb{F}_{p^2}, -2p)$ of supersingular elliptic curves over the finite field $\mathbb{F}_{p^2}$ when $p>3\ell^2$ (resp. $p>4\ell^2$) with $E_0: y^2=x^3+1$ (resp. $E_{1728}: y^2=x^3+x$) supersingular.
Let K be a number field and E/K a modular elliptic curve, with modular parametrization $X_0(N) \to E$ defined over K. The purpose of this note is to study the images in E of classes of isogenous points in X_0(N).
In this note, we consider an l-isogeny descent on a pair of elliptic curves over Q. We assume that l > 3 is a prime. The main result expresses the relevant Selmer groups as kernels of simple explicit maps between finite- dimensional F_l-vector spaces defined in terms of the splitting fields of the kernels of the two isogenies. We give examples of proving the l-part of the Birch and Swinnerton-Dyer conjectural formula for certain curves of small conductor.
Let E be an elliptic curve over a number field K which admits a cyclic p-isogeny with p odd and semistable at primes above p. We determine the root number and the parity of the p-Selmer rank for E/K, in particular confirming the parity conjecture for such curves. We prove the analogous results for p=2 under the additional assumption that E is not supersingular at primes above 2.
Let $p$ be a prime and $K$ a number field of degree $p$. We count the number of elliptic curves, up to $\bar{K}$-isomorphism, having a prescribed property, where this property is either that the curve contains a fixed torsion group as a subgroup, or that it has an isogeny of prescribed degree.
We revisit the ordinary isogeny-graph based cryptosystems of Couveignes and Rostovtsev-Stolbunov, long dismissed as impractical. We give algorithmic improvements that accelerate key exchange in this framework, and explore the problem of generating suitable system parameters for contemporary pre-and post-quantum security that take advantage of these new algorithms. We also prove the session-key security of this key exchange in the Canetti-Krawczyk model, and the IND-CPA security of the related public-key encryption scheme, under reasonable assumptions on the hardness of computing isogeny walks.…
An elliptic curve $E$ defined over a $p$-adic field $K$ with a $p$-isogeny $ϕ:E\rightarrow E^\prime$ comes equipped with an invariant $α_{ϕ/K}$ that measures the valuation of the leading term of the formal group homomorphism $Φ:\hat E \rightarrow \hat E^\prime$. We prove that if $K/\mathbb{Q}_p$ is unramified and $E$ has additive, potentially supersingular reduction, then $α_{ϕ/K}$ is determined by the number of distinct geometric components on the special fibers of the minimal proper regular models of $E$ and $E^\prime$.
Let $\mathcal{E}$ be a $\mathbb{Q}$-isogeny class of elliptic curves defined over $\mathbb{Q}$. The isogeny graph associated to $\mathcal{E}$ is a graph which has a vertex for each element of $\mathcal{E}$ and an edge for each $\mathbb{Q}$-isogeny of prime degree that maps one element of $\mathcal{E}$ to another element of $\mathcal{E}$, with the degree recorded as a label of the edge. The isogeny-torsion graph associated to $\mathcal{E}$ is the isogeny graph associated to $\mathcal{E}$ where, in addition, we label each vertex with the abstract group structure of the torsion subgroup over $\ma…
For a fixed $j$-invariant $j_0$ of an elliptic curve without complex multiplication we bound the number of $j$-invariants $j$ that are algebraic units and such that elliptic curves corresponding to $j$ and $j_0$ are isogenous. Our bounds are effective. We also modify the problem slightly by fixing a singular modulus $α$ and looking at all $j$ such that $j-α$ is an algebraic unit and such that elliptic curves corresponding to $j$ and $j_0$ are isogenous. The number of such $j$ can again be bounded effectively.
We count the number of rational elliptic curves of bounded naive height that have a rational $N$-isogeny, for $N \in \{2,3,4,5,6,8,9,12,16,18\}$. For some $N$, this is done by generalizing a method of Harron and Snowden. For the remaining cases, we use the framework of Ellenberg, Satriano and Zureick-Brown, in which the naive height of an elliptic curve is the height of the corresponding point on a moduli stack.
Let $n>1$ be an integer such that $X_{0}\!\left( n\right) $ has genus $0$, and let $K$ be a field of characteristic $0$ or relatively prime to $6n$. In this article, we explicitly classify the isogeny graphs of all rational elliptic curves that admit a non-trivial isogeny over $\mathbb{Q}$. We achieve this by introducing $56$ parameterized families of elliptic curves $\mathcal{C}_{n,i}(t,d)$ defined over $K(t,d)$, which have the following two properties for a fixed $n$: the elliptic curves $\mathcal{C}_{n,i}(t,d)$ are isogenous over $K(t,d)$, and there are integers $k_{1}$ and $k_{2}$ such tha…
Let h be a p-isogeny of elliptic curves. We describe how to perform h-descents on the nontrivial elements in the Shafarevich-Tate group which are killed by the dual isogeny h'. This makes computation of p-Selmer groups of elliptic curves admitting a p-isogeny over Q feasible for p = 5,7 in cases where an isogeny descent is insufficient and a full p-descent would be infeasible. As an application we complete the verification of the full Birch and Swinnerton-Dyer conjectural formula for all elliptic curves over Q of rank zero or one and conductor less than 5000.
We show that if $E$ is an elliptic curve over $\mathbf{Q}$ with a $\mathbf{Q}$-rational isogeny of degree 7, then the image of the 7-adic Galois representation attached to $E$ is as large as allowed by the isogeny, except for the curves with complex multiplication by $\mathbf{Q}(\sqrt{-7})$. The analogous result with 7 replaced by a prime $p > 7$ was proved by the first author in [7]. The present case $p = 7$ has additional interesting complications. We show that any exceptions correspond to the rational points on a certain curve of genus 12. We then use the method of Chabauty to show that the…
We study Tamagawa numbers of elliptic curves with torsion $\mathbb{Z}/2\mathbb{Z}\oplus \mathbb{Z}/14\mathbb{Z}$ over cubic fields and of elliptic curves with an $n-$isogeny over $\mathbb{Q}$, for $n\in\{6,8,10,12,14,16,17,18,19,37,43,67,163\}$. Bruin and Najman proved that every elliptic curve with torsion $\mathbb{Z}/2\mathbb{Z}\oplus \mathbb{Z}/14\mathbb{Z}$ over a cubic field is a base change of an elliptic curve defined over $\mathbb{Q}$. We find that Tamagawa numbers of elliptic curves defined over $\mathbb{Q}$ with torsion $\mathbb{Z}/2\mathbb{Z}\oplus \mathbb{Z}/14\mathbb{Z}$ over a cu…
Fix an ordinary abelian variety defined over a finite field. The ideal class group of its endomorphism ring acts freely on the set of isogenous varieties with same endomorphism ring, by complex multiplication. Any subgroup of the class group, and generating set thereof, induces an isogeny graph on the orbit of the variety for this subgroup. We compute (under the Generalized Riemann Hypothesis) some bounds on the norms of prime ideals generating it, such that the associated graph has good expansion properties. We use these graphs, together with a recent algorithm of Dudeanu, Jetchev and Robert …
We explain a method for computing the Cassels-Tate pairing on the 3-isogeny Selmer groups of an elliptic curve. This improves the upper bound on the rank of the elliptic curve coming from a descent by 3-isogeny, to that coming from a full 3-descent. One ingredient of our work is a new algorithm for solving cubic norm equations, that avoids the need for any S-unit computations. As an application, we show that the elliptic curves with torsion subgroup of order 3 and rank at least 13, found by Eroshkin, have rank exactly 13.
Let p>3 be a prime and let E, E' be supersingular elliptic curves over F_p. We want to construct an isogeny phi: E --> E'. The currently fastest algorithm for finding isogenies between supersingular elliptic curves solves this problem by performing a "meet-in-the-middle" breadth-first search in the full supersingular 2-isogeny graph over F_{p^2}. In this paper we consider the structure of the isogeny graph of supersingular elliptic curves over F_p. We give an algorithm to construct isogenies between such supersingular elliptic curves that works faster than the usual algorithm. We then discuss …
The elliptic curve $E_k \colon y^2 = x^3 + k$ admits a natural 3-isogeny $ϕ_k \colon E_k \to E_{-27k}$. We compute the average size of the $ϕ_k$-Selmer group as $k$ varies over the integers. Unlike previous results of Bhargava and Shankar on $n$-Selmer groups of elliptic curves, we show that this average can be very sensitive to congruence conditions on $k$; this sensitivity can be precisely controlled by the Tamagawa numbers of $E_k$ and $E_{-27k}$. As consequences, we prove that the average rank of the curves $E_k$, $k\in\mathbb Z$, is less than 1.21 and over $23\%$ (resp. $41\%$) of the cur…
Computing endomorphism rings of supersingular elliptic curves is an important problem in computational number theory, and it is also closely connected to the security of some of the recently proposed isogeny-based cryptosystems. In this paper we give a new algorithm for computing the endomorphism ring of a supersingular elliptic curve $E$ that runs, under certain heuristics, in time $O((\log p)^2p^{1/2})$. The algorithm works by first finding two cycles of a certain form in the supersingular $\ell$-isogeny graph $G(p,\ell)$, generating an order $Λ\subseteq \operatorname{End}(E)$. Then all maxi…
Fix a prime number $\ell$. Graphs of isogenies of degree a power of $\ell$ are well-understood for elliptic curves, but not for higher-dimensional abelian varieties. We study the case of absolutely simple ordinary abelian varieties over a finite field. We analyse graphs of so-called $\mathfrak l$-isogenies, resolving that they are (almost) volcanoes in any dimension. Specializing to the case of principally polarizable abelian surfaces, we then exploit this structure to describe graphs of a particular class of isogenies known as $(\ell, \ell)$-isogenies: those whose kernels are maximal isotropi…
Consider a rational point on an elliptic curve under an isogeny. Suppose that the action of Galois partitions the set of its pre-images into n orbits. It is shown that all such points above a certain height have their denominator divisible by at least n distinct primes. This generalizes Siegel's theorem and more recent results of Everest et al. For multiplication by a prime l, it is shown that if n>1 then either the point is l times a rational point or the elliptic curve emits a rational l-isogeny.
We prove two theorems concerning isogenies of elliptic curves over function fields. The first one describes the variation of the height of the $j$-invariant in an isogeny class. The second one is an "isogeny estimate", providing an explicit bound on the degree of a minimal isogeny between two isogenous elliptic curves. We also give several corollaries of these two results.
Let $E$ be an ordinary elliptic curve over a finite field and $g$ be a positive integer. Under some technical assumptions, we give an algorithm to span the isomorphism classes of principally polarized abelian varieties in the isogeny class of $E^g$. The varieties are first described as hermitian lattices over (not necessarily maximal) quadratic orders and then geometrically in terms of their algebraic theta null point. We also show how to algebraically compute Siegel modular forms of even weight given as polynomials in the theta constants by a careful choice of an affine lift of the theta null…
We investigate fine Selmer groups for elliptic curves and for Galois representations over a number field. More specifically, we discuss Conjecture A, which states that the fine Selmer group of an elliptic curve over the cyclotomic extension is a finitely generated $\mathbb{Z}_p$-module. The relationship between this conjecture and Iwasawa's classical $μ=0$ conjecture is clarified. We also present some partial results towards the question whether Conjecture A is invariant under isogenies.
We propose a conjectural explicit isogeny from the Jacobians of hyperelliptic Drinfeld modular curves to the Jacobians of hyperelliptic modular curves of $\mathcal{D}$-elliptic sheaves. The kernel of the isogeny is a subgroup of the cuspidal divisor group constructed by examining the canonical maps from the cuspidal divisor group into the component groups.
Minimal degree of an isogeny between a supersingular elliptic curve and its conjugate
Université de Toulon（土伦大学）；Aix Marseille Univ, UMR 7373 CNRS（艾克斯-马赛大学，法国国家科学研究中心联合研究单位7373）；University of French Polynesia（法属波利尼西亚大学）；University of Vermont（佛蒙特大学）
The remarkable structure and computationally explicit form of isogeny graphs of elliptic curves over a finite field has made them an important tool for computational number theorists and practitioners of elliptic curve cryptography. This expository paper recounts the theory behind these graphs and examines several recently developed algorithms that realize substantial (often dramatic) performance gains by exploiting this theory.
For an elliptic curve $E$ over a number field $K$, one consequence of the Birch and Swinnerton-Dyer conjecture is the parity conjecture: the global root number matches the parity of the Mordell-Weil rank. Assuming finiteness of $\mathrm{Sha}(E/K)[p^\infty]$ for a prime $p$ this is equivalent to the $p$-parity conjecture: the global root number matches the parity of the $\mathbb{Z}_p$-corank of the $p^\infty$-Selmer group. We complete the proof of the $p$-parity conjecture for elliptic curves that have a $p$-isogeny for $p > 3$ (the cases $p \le 3$ were known). T. and V. Dokchitser have showed …
Fix an elliptic curve $E_0$ without CM and a non-isotrivial elliptic scheme over a smooth irreducible curve, both defined over the algebraic numbers. Consider the union of all images of a fixed finite-rank subgroup (of arbitrary rank) of $E_0^g$, also defined over the algebraic numbers, under all isogenies between $E_0^g$ and some fiber of the $g$-th fibered power $\mathcal{A}$ of the elliptic scheme, where $g$ is a fixed natural number. As a special case of a slightly more general result, we characterize the subvarieties (of arbitrary dimension) inside $\mathcal{A}$ that have potentially Zari…
An isogeny graph is a graph whose vertices are principally polarized abelian varieties and whose edges are isogenies between these varieties. In his thesis, Kohel described the structure of isogeny graphs for elliptic curves and showed that one may compute the endomorphism ring of an elliptic curve defined over a finite field by using a depth first search algorithm in the graph. In dimension 2, the structure of isogeny graphs is less understood and existing algorithms for computing endomorphism rings are very expensive. Our setting considers genus 2 jacobians with complex multiplication, with …
An abelian variety over a number field is called L-abelian variety if, for any element of the absolute Galois group of a number field L, the conjugated abelian variety is isogenous to the given one by means of an isogeny that preserves the Galois action on the endomorphism rings. We can think of them as generalizations of abelian varieties defined over L with endomorphisms also defined over L. In the one dimensional case, an elliptic curve defined over L gives rise to a Galois representation provided by the Galois action on its Tate module. This classical Galois representation has been a centr…
