We give explicit formulae for the logarithmic class group pairing on an elliptic curve defined over a number field. Then we relate it to the descent relative to a suitable cyclic isogeny. This allows us to connect the resulting Selmer group with the logarithmic class group of the base. These constructions are explicit and suitable for computer experimentation. From a conceptual point of view, the questions that arise here are analogues of "visibility" questions in the sense of Cremona and Mazur.
We explicitly compute the Cassels-Tate pairing on the 2-Selmer group of an elliptic curve using the Albanese-Albanese definition of the pairing given by Poonen and Stoll. This leads to a new proof that a pairing defined by Cassels on the 2-Selmer groups of elliptic curves agrees with the Cassels-Tate pairing.
In our previous study of duality for complete discrete valuation fields with perfect residue field, we treated coefficients in finite flat group schemes. In this paper, we treat abelian varieties. This in particular implies Grothendieck's conjecture on the perfectness of his pairing between the Neron component groups of an abelian variety and its dual. The point is that our formulation is well-suited with Galois descent. From the known case of semistable abelian varieties, we deduce the perfectness in full generality. We also treat coefficients in tori and, more generally, 1-motives.
We explain how recent work on 3-descent and 4-descent for elliptic curves over Q can be combined to search for generators of the Mordell-Weil group of large height. As an application we show that every elliptic curve of prime conductor in the Stein-Watkins database has rank at least as large as predicted by the conjecture of Birch and Swinnerton-Dyer.
The problem of constructing elliptic curves suitable for pairing applications has received a lot of attention. To solve this, we propose a variant algorithm of a known method by Brezing and Weng. We produce new families of parameters using our algorithm for pairing-friendly elliptic curves of embedding degree 8, and we actually compute some explicit curves as numerical examples.
We present algorithms for computing the squared Weil and Tate pairings on elliptic curves and the squared Tate pairing for hyperelliptic curves. The squared pairings introduced in this paper have the advantage that our algorithms for evaluating them are deterministic and do not depend on a random choice of points. Our pairings save about 20-30% over the usual pairings.
We give an elementary and self-contained introduction to pairings on elliptic curves over finite fields. For the first time in the literature, the three different definitions of the Weil pairing are stated correctly and proved to be equivalent using Weil reciprocity. Pairings with shorter loops, such as the ate, ate$_i$, R-ate and optimal pairings, together with their twisted variants, are presented with proofs of their bilinearity and non-degeneracy. Finally, we review different types of pairings in a cryptographic context. This article can be seen as an update chapter to A. Enge, Elliptic Cu…
We present a heuristic asymptotic formula as $x\to \infty$ for the number of isogeny classes of pairing-friendly elliptic curves with fixed embedding degree $k\geq 3$, with fixed discriminant, with rho-value bounded by a fixed $ρ_0$ such that $1<ρ_0<2$, and with prime subgroup order at most $x$.
Let $k=2^mp^n$ for an odd prime $p$ and integers $m\ge 0$ and $n\ge 0$. We obtain lower bounds for the $ρ$-values of cyclotomic families of pairing-friendly elliptic curves with embedding degree $k$ and $r(x)=Φ_k(x)$. Our bounds imply that none of these families are ideal.
We extend the method of Cassels for computing the Cassels-Tate pairing on the 2-Selmer group of an elliptic curve, to the case of 3-Selmer groups. This requires significant modifications to both the local and global parts of the calculation. Our method is practical in sufficiently small examples, and can be used to improve the upper bound for the rank of an elliptic curve obtained by 3-descent.
A rational perfect cuboid is a rectangular parallelepiped whose edges and face diagonals are given by rational numbers and whose space diagonal is equal to unity. Recently it was shown that the Diophantine equations describing such a cuboid lead to a couple of parametric families of elliptic curves. Two and three descent methods for calculating their ranks are discussed in the present paper. The elliptic curves in each parametric family are subdivided into two subsets admitting 2-descent and 3-descent methods respectively.
We consider the practical computation of rational points on y^2=x(x^2+ax+b). The algebra necessary for a 4-descent procedure is described. A simple further descent is then described which only uses integer arithmetic. Numerous examples are given to illustrate the effectiveness of this extra descent. Currently, the largest point found has height 51.15 or 102.3, depending on which height normalisation you use.
Let $E$ be an elliptic curve over a number field $K$. Descent calculations on $E$ can be used to find upper bounds for the rank of the Mordell-Weil group, and to compute covering curves that assist in the search for generators of this group. The general method of 4-descent, developed in the PhD theses of Siksek, Womack and Stamminger, has been implemented in Magma (when $K={\mathbb Q}$) and works well for elliptic curves with sufficiently small discriminant. By extending work of Bremner and Cassels, we describe the improvements that can be made when $E$ has a rational 2-torsion point. In parti…
We work out the complete descent via 4-isogeny for a family of rational elliptic curves with a rational point of order 4; such a family is of the form $y^2 + x y + a y = x^3 + a x^2$ where $\sqrt{-a} \in \mathbb Q^\times$. In the process we exhibit the 4-isogeny and the isogenous curve, explicitly present the principal homogeneous spaces, and discuss examples by computing the rank.
We present an algorithm which speeds scalar multiplication on a general elliptic curve by an estimated 3.8 % to 8.5 % over the best known general methods when using affine coordinates. This is achieved by eliminating a field multiplication when we compute 2P+Q from given points P, Q on the curve. We give applications to simultaneous multiple scalar multiplication and to the Elliptic Curve Method of factorization. We show how this improvement together with another idea can speed the computation of the Weil and Tate pairings by up to 7.8 %.
For an elliptic curve $E$ over any field $K$, the Weil pairing $e_n$ is a bilinear map on $n$-torsion. For $K$ of characteristic $p>0$, the map $e_n$ is degenerate if and only if $n$ is divisible by $p$. In this paper, we consider $E$ over the dual numbers $K[ε]$ and define a non-degenerate ``Weil pairing on $p$-torsion" which shares many of the same properties of the Weil pairing. We also show that the discrete logarithm attacks on $p$-torsion subgroups of Semaev and Rück may be viewed as Weil-pairing-based attacks, just like the MOV attack. Finally, we describe an attack on the discrete loga…
This is the first in a series of papers in which we study the n-Selmer group of an elliptic curve, with the aim of representing its elements as genus one normal curves of degree n. The methods we describe are practical in the case n=3 for elliptic curves over the rationals, and have been implemented in Magma.
Let p be a prime and let C be a genus one curve over a number field k representing an element of order dividing p in the Shafarevich-Tate group of its Jacobian. We describe an algorithm which computes the set of D in the Shafarevich-Tate group such that pD = C and obtains explicit models for these D as curves in projective space. This leads to a practical algorithm for performing 9-descents on elliptic curves over the rationals.
In this note, we consider an l-isogeny descent on a pair of elliptic curves over Q. We assume that l > 3 is a prime. The main result expresses the relevant Selmer groups as kernels of simple explicit maps between finite- dimensional F_l-vector spaces defined in terms of the splitting fields of the kernels of the two isogenies. We give examples of proving the l-part of the Birch and Swinnerton-Dyer conjectural formula for certain curves of small conductor.
We show that the average number of integral points on elliptic curves, counted modulo the natural involution on a punctured elliptic curve, is bounded from above by $2.1 \times 10^8$. To prove it, we design a descent map, whose prototype goes at least back to Mordell, which associates a pair of binary forms to an integral point on an elliptic curve. Other ingredients of the proof include the upper bounds for the number of solutions of a Thue equation by Evertse and Akhtari-Okazaki, and the estimation of the number of binary quartic forms by Bhargava-Shankar. Our method applies to $S$-integral …
We explain a method for computing the Cassels-Tate pairing on the 3-isogeny Selmer groups of an elliptic curve. This improves the upper bound on the rank of the elliptic curve coming from a descent by 3-isogeny, to that coming from a full 3-descent. One ingredient of our work is a new algorithm for solving cubic norm equations, that avoids the need for any S-unit computations. As an application, we show that the elliptic curves with torsion subgroup of order 3 and rank at least 13, found by Eroshkin, have rank exactly 13.
This is the third in a series of papers in which we study the n-Selmer group of an elliptic curve, with the aim of representing its elements as curves of degree n in P^{n-1}. The methods we describe are practical in the case n=3 for elliptic curves over the rationals, and have been implemented in Magma. One important ingredient of our work is an algorithm for trivialising central simple algebras. This is of independent interest: for example, it could be used for parametrising Brauer-Severi surfaces.
Pairing-based cryptographic schemes require so-called pairing-friendly elliptic curves, which have special properties. The set of pairing-friendly elliptic curves that are generated by given polynomials form a complete family. Although a complete family with a $ρ$-value of 1 is the ideal case, there is only one such example that is known, this was given by Barreto and Naehrig. We prove that there are no ideal families with embedding degree 3, 4, or 6 and that many complete families with embedding degree 8 or 12 are nonideal, even if we chose noncyclotomic families.
A positive integer that is the area of some rational right triangle is called a congruent number. In an algebraic point of view, being a congruent number means satisfying a system of equations. As early as the 1800s, it is understood that if $n$ is a congruent number, then the equation $nm^2 = uv(u^2 - v^2)$ has a solution in $\mathbb{Z}$. Using the relation between congruent numbers and elliptic curves $E_n: y^2 = x^3 - n^2 x$ which was established in the 1900s, we will prove that the converse of this two century-old result holds as well. In addition to this, we present another proof of the c…
Let E be an elliptic curve over Q (or, more generally, a number field). Then on the one hand, we have the finitely generated abelian group E(Q), on the other hand, there is the Shafarevich-Tate group Sha(Q,E). Descent is a general method of getting information on both of these objects - ideally complete information on the Mordell-Weil group E(Q), and usually partial information on Sha(Q,E). What descent does is to compute (for a given n > 1) the n-Selmer group Sel^(n)(Q,E); it sits in an exact sequence 0 --> E(Q)/nE(Q) --> Sel^(n)(Q,E) --> Sha(Q,E)[n] --> 0 and thus contains combined informati…
Let h be a p-isogeny of elliptic curves. We describe how to perform h-descents on the nontrivial elements in the Shafarevich-Tate group which are killed by the dual isogeny h'. This makes computation of p-Selmer groups of elliptic curves admitting a p-isogeny over Q feasible for p = 5,7 in cases where an isogeny descent is insufficient and a full p-descent would be infeasible. As an application we complete the verification of the full Birch and Swinnerton-Dyer conjectural formula for all elliptic curves over Q of rank zero or one and conductor less than 5000.
Let $e_1,e_2,e_3$ be nonzero integers satisfying $e_1+e_2+e_3=0$. Let $(a,b,c)$ be a primitive triple of odd integers satisfying $e_1a^2+e_2b^2+e_3c^2=0$. Denote by $E: y^2=x(x-e_1)(x+e_2)$ and $\mathcal E: y^2=x(x-e_1a^2)(x+e_2b^2)$. Assume that the $2$-Selmer groups of $E$ and $\mathcal E$ are minimal. Let $n$ be a positive square-free odd integer, where the prime factors of $n$ are nonzero quadratic residues modulo each odd prime factor of $e_1e_2e_3abc$. Then under certain conditions, the $2$-Selmer group and the Cassels pairing of the quadratic twist $E^{(n)}$ coincide with those of $\mat…
This is the second in a series of papers in which we study the n-Selmer group of an elliptic curve. In this paper, we show how to realize elements of the n-Selmer group explicitly as curves of degree n embedded in P^{n-1}. The main tool we use is a comparison between an easily obtained embedding into P^{n^2-1} and another map into P^{n^2-1} that factors through the Segre embedding P^{n-1} x P^{n-1} --> P^{n^2-1}. The comparison relies on an explicit version of the local-to-global principle for the n-torsion of the Brauer group of the base field.
Descent via an isogeny on an elliptic curve is used to construct two subrings of the field of rational numbers, which are complementary in a strong sense, and for which Hilbert's Tenth Problem is undecidable. This method further develops that of Poonen, who used elliptic divisibility sequences to obtain undecidability results for some large subrings of the rational numbers.
We present a general framework for constructing families of elliptic curves of prime order with prescribed embedding degree. We demonstrate this method by constructing curves with embedding degree k = 10, which solves an open problem posed by Boneh, Lynn, and Shacham. We show that our framework incorporates existing constructions for k = 3, 4, 6, and 12, and we give evidence that the method is unlikely to produce infinite families of curves with embedding degree k > 12.
A cycle of elliptic curves is a list of elliptic curves over finite fields such that the number of points on one curve is equal to the size of the field of definition of the next, in a cyclic way. We study cycles of elliptic curves in which every curve is pairing-friendly. These have recently found notable applications in pairing-based cryptography, for instance in improving the scalability of distributed ledger technologies. We construct a new cycle of length 4 consisting of MNT curves, and characterize all the possibilities for cycles consisting of MNT curves. We rule out cycles of length 2 …
Ideal class pairings map the rational points of rank $r\geq 1$ elliptic curves $E/\Q$ to the ideal class groups $\CL(-D)$ of certain imaginary quadratic fields. These pairings imply that $$h(-D) \geq \frac{1}{2}(c(E)-\varepsilon)(\log D)^{\frac{r}{2}} $$ for sufficiently large discriminants $-D$ in certain families, where $c(E)$ is a natural constant. These bounds are effective, and they offer improvements to known lower bounds for many discriminants.
Cassels has described a pairing on the 2-Selmer group of an elliptic curve which shares some properties with the Cassels-Tate pairing. In this article, we prove that the two pairings are the same.
Transcendental Brauer elements are notoriously difficult to compute. Work of Wittenberg, and later, Ieronymou, gives a method for computing 2-torsion transcendental classes on surfaces that have a genus 1 fibration with rational 2-torsion in the Jacobian fibration. We use ideas from a descent paper of Poonen and Schaefer to remove this assumption on the rational 2-torsion.
We introduce the use of $p$-descent techniques for elliptic surfaces over a perfect field of characteristic not $2$ or $3$. Under mild hypotheses, we obtain an upper bound for the rank of a non-constant elliptic surface. When $p=2$, this bound is an arithmetic refinement of a well-known geometric bound for the rank deduced from Igusa's inequality. This answers a question raised by Ulmer. We give some applications to rank bounds for elliptic surfaces over the rational numbers.
We prove new results on splitting Brauer classes by genus 1 curves, settling in particular the case of degree 7 classes over global fields. Though our method is cohomological in nature, and proceeds by considering the more difficult problem of splitting $μ_N$-gerbes, we use crucial input from the arithmetic of modular curves and explicit $N$-descent on elliptic curves.
Efficient computations of pairings with Miller Algorithm have recently received a great attention due to the many applications in cryptography. In this work, we give formulae for the optimal Ate pairing in terms of elliptic nets associated to twisted Barreto-Naehrig (BN) curve, Barreto-Lynn-Scott(BLS) curves and Kachisa-Schaefer-Scott(KSS) curves considered at the $128$, $192$ and $256$-bit security levels, and Scott-Guillevic curve with embedding degree $54$. We show how to parallelize the computation of these pairings when the elliptic net algorithm instead is used and we obtain except in th…
We split the program of explicit descent of elliptic curves into two parts. For $n=3$ and $n=5,$ we first display a model for the universal elliptic curve $E$ with full level $n$ structure and describe the map of rational points of $E$ to the cohomology group $H^1(G, E[n]).$ Second, we find models in $\PP^{n-1}$ of principal homogeneous spaces of $E$ corresponding to all possible elements of $H^1(G, E[n]),$ i.e. for those elements with trivial period-index obstruction. For this we use the relationship established in \cite{me2} between the period-index obstruction and the norm symbol, a general…
We give a construction of unramified cyclic octic extensions of certain complex quadratic number fields. The binary quadratic form used in this construction also shows up in the theory of 2-descents on Pell conics and elliptic curves, as well as in the explicit description of cyclic quartic extensions.
In this paper, we give an explicit formula as well as a practical algorithm for computing the Cassels-Tate pairing on $\text{Sel}^{2}(J) \times \text{Sel}^{2}(J)$ where $J$ is the Jacobian variety of a genus two curve under the assumption that all points in $J[2]$ are $K$-rational. We also give an explicit formula for the Obstruction map $\text{Ob}: H^1(G_K, J[2]) \rightarrow \text{Br}(K)$ under the same assumption. Finally, we include a worked example demonstrating we can indeed improve the rank bound given by a 2-descent via computing the Cassels-Tate pairing.
We use the invariant theory of binary quartics to give a new formula for the Cassels-Tate pairing on the $2$-Selmer group of an elliptic curve. Unlike earlier methods, our formula does not require us to solve any conics. An important role in our construction is played by a certain $K3$ surface defined by a $(2,2,2)$-form.
For an elliptic curve over the rational number field and a prime number $p$, we study the structure of the classical Selmer group of $p$-power torsion points. In our previous paper \cite{Ku6}, assuming the main conjecture and the non-degeneracy of the $p$-adic height pairing, we proved that the structure of the Selmer group with respect to $p$-power torsion points is determined by some analytic elements $\tildeδ_{m}$ defined from modular symbols. In this paper, we do not assume the main conjecture nor the non-degeneracy of the $p$-adic height pairing, and study the structure of Selmer groups, …
Extending the idea of \cite{dab2} and using the 2-descent method, we provide three general families of elliptic curves over Q such that a positive proportion of prime-twists of such elliptic curves have rank zero simultaneously.
We define a new canonical height pairing on the rational points of elliptic curves over global function fields which takes values in the multiplicative group of a completion of the function field. This height serves as an analogue of both the classical Neron-Tate height and analytic p-adic heights. Our main result is that under some general hypotheses this pairing is non-degenerate.
We give a direct proof that the Mazur-Tate and Coleman-Gross heights on elliptic curves coincide. The main ingredient is to extend the Coleman-Gross height to the case of divisors with non-disjoint support and, doing some $p$-adic analysis, show that, in particular, its component above $p$ gives, in the special case of an ordinary elliptic curve, the $p$-adic sigma function. We use this result to give a short proof of a theorem of Kim characterizing integral points on elliptic curves in some cases under weaker assumptions. As a further application, we give new formulas to compute double Colema…
Pairings have been widely used since their introduction to cryptography. They can be applied to identity-based encryption, tripartite Diffie-Hellman key agreement, blockchain and other cryptographic schemes. The Acceleration of pairing computations is crucial for these cryptographic schemes or protocols. In this paper, we will focus on the Elliptic Net algorithm which can compute pairings in polynomial time, but it requires more storage than Miller's algorithm. We use several methods to speed up the Elliptic Net algorithm. Firstly, we eliminate the inverse operation in the improved Elliptic Ne…
We consider models for genus one curves of degree 5, which arise in explicit 5-descent on elliptic curves. We prove a theorem on the existence of minimal models with the same invariants as the minimal model of the Jacobian elliptic curve and give an algorithm for computing such models. Finally we describe how to reduce genus one models of degree 5 defined over Q.
We heuristically analyze the Cocks-Pinch method by using the Bateman-Horn conjecture. Especially, we present the first known heuristic which suggests that any efficient construction of pairing-friendly elliptic curves can efficiently generate such curves over pairing-friendly fields, naturally including the Cocks-Pinch method. Finally, some numerical evidence is given.
Given an elliptic curve over a field of characteristic different from 2,3, its discriminant defines a $μ_{12}$-torsor over the field. In this paper, we give an explicit description of this $μ_{12}$-torsor in terms of the 3-torsion points and of the 4-torsion points on the given elliptic curve. %In addition, we show that such a description involves the Weil pairing in a certain way. As an application, we generalize a result of Coates on the 12-th root of the discriminant of an elliptic curve.
