Isogenies occur throughout the theory of elliptic curves. Recently, the cryptographic protocols based on isogenies are considered as candidates of quantum-resistant cryptographic protocols. Given two elliptic curves $E_1, E_2$ defined over a finite field $k$ with the same trace, there is a nonconstant isogeny $β$ from $E_2$ to $E_1$ defined over $k$. This study gives out the index of $\rm{Hom}_{\it k}(\it E_{\rm 1},E_{\rm 2})β$ as a left ideal in $\rm{End}_{\it k}(\it E_{\rm 2})$ and figures out the correspondence between isogenies and kernel ideals. In addition, some results about the non-trivial minimal degree of isogenies between the two elliptic curves are also provided.
We consider character sums determined by isogenies of elliptic curves over finite fields. We prove a congruence condition for character sums attached to arbitrary cyclic isogenies, and produce explicit formulas for isogenies of small degree.
We propose an algorithm that calculates isogenies between elliptic curves defined over an extension $K$ of $\mathbb{Q}_2$. It consists in efficiently solving with a logarithmic loss of $2$-adic precision the first order differential equation satisfied by the isogeny. We give some applications, especially computing over finite fields of characteristic 2 isogenies of elliptic curves and irreducible polynomials, both in quasi-linear time in the degree.
In this note, we will apply the results of Gross-Zagier, Gross-Kohnen-Zagier and their generalizations to give a short proof that the differences of singular moduli are not units. As a consequence, we obtain a result on isogenies between reductions of CM elliptic curves.
Let p>3 be a prime and let E, E' be supersingular elliptic curves over F_p. We want to construct an isogeny phi: E --> E'. The currently fastest algorithm for finding isogenies between supersingular elliptic curves solves this problem by performing a "meet-in-the-middle" breadth-first search in the full supersingular 2-isogeny graph over F_{p^2}. In this paper we consider the structure of the isogeny graph of supersingular elliptic curves over F_p. We give an algorithm to construct isogenies between such supersingular elliptic curves that works faster than the usual algorithm. We then discuss …
A classical result of Dirichlet shows that certain elementary character sums compute class numbers of quadratic imaginary number fields. We obtain analogous relations between class numbers and a weighted character sum associated to a 2-isogeny of elliptic curves.
Let $E$ be an elliptic curve over $\mathbb{Q}$ such that $\mathrm{End}_{\bar{\mathbb{Q}}}(E)=\mathbb{Z}$ and which admits a non-trivial cyclic $\mathbb{Q}$-isogeny. We prove that, for $p>37$, the residual mod $p$ Galois representation $\barρ_{E,p}:G_{\mathbb{Q}}\rightarrow\mathrm{GL}_2(\mathbb{F}_p)$ is surjective.
Let $\mathcal{O}$ be an order in the imaginary quadratic field $K$. For positive integers $M \mid N$, we determine the least degree of an $\mathcal{O}$-CM point on the modular curve $X(M,N)_{/K(ζ_M)}$ and also on the modular curve $X(M,N)_{/\mathbb{Q}(ζ_M)}$: that is, we treat both the case in which the complex multiplication is rationally defined and the case in which we do not assume that the complex multiplication is rationally defined. To prove these results we establish several new theorems on rational cyclic isogenies of CM elliptic curves. In particular, we extend a result of Kwon that …
We show that a character sum attached to a family of 3-isogenies defined on the fibers of a certain elliptic surface over $\mathbb{F}_p$ relates to the class number of the quadratic imaginary number field $\Q(\sqrt{-p})$. In this sense, this provides a higher-dimensional analog of some recent class number formulas associated to 2-isogenies of elliptic curves.
p-jets of finite flat maps of schemes are generally neither finite nor flat. This phenomenon can be seen already in the case of p-isogenies of group schemes. However, for p-divisible groups, this pathology tends to disappear mod p "in the limit". We illustrate this in the case of the p-divisible groups of elliptic curves and of formal groups of finite height; in the case of ordinary elliptic curves the structure in the limit depends on the Serre-Tate parameter.
We study the failure of a local-global principle for the existence of $l$-isogenies for elliptic curves over number fields $K$. Sutherland has shown that over $\mathbb{Q}$ there is just one failure, which occurs for $l=7$ and a unique $j$-invariant, and has given a classification of such failures when $K$ does not contain the quadratic subfield of the $l$'th cyclotomic field. In this paper we provide a classification of failures for number fields which do contain this quadratic field, and we find a new `exceptional' source of such failures arising from the exceptional subgroups of $\mbox{PGL}_…
The problem of computing an explicit isogeny between two given elliptic curves over F_q, originally motivated by point counting, has recently awaken new interest in the cryptology community thanks to the works of Teske and Rostovstev & Stolbunov. While the large characteristic case is well understood, only suboptimal algorithms are known in small characteristic; they are due to Couveignes, Lercier, Lercier & Joux and Lercier & Sirvent. In this paper we discuss the differences between them and run some comparative experiments. We also present the first complete implementation of Couveignes' sec…
We prove two theorems concerning isogenies of elliptic curves over function fields. The first one describes the variation of the height of the $j$-invariant in an isogeny class. The second one is an "isogeny estimate", providing an explicit bound on the degree of a minimal isogeny between two isogenous elliptic curves. We also give several corollaries of these two results.
We describe the use of explicit isogenies to translate instances of the Discrete Logarithm Problem (DLP) from Jacobians of hyperelliptic genus 3 curves to Jacobians of non-hyperelliptic genus 3 curves, where they are vulnerable to faster index calculus attacks. We provide explicit formulae for isogenies with kernel isomorphic to $(\ZZ/2\ZZ)^3$ (over an algebraic closure of the base field) for any hyperelliptic genus 3 curve over a field of characteristic not 2 or 3. These isogenies are rational for a positive fraction of all hyperelliptic genus 3 curves defined over a finite field of character…
An isogeny between elliptic curves is an algebraic morphism which is a group homomorphism. Many applications in cryptography require evaluating large degree isogenies between elliptic curves efficiently. For ordinary curves of the same endomorphism ring, the previous best known algorithm has a worst case running time which is exponential in the length of the input. In this paper we show this problem can be solved in subexponential time under reasonable heuristics. Our approach is based on factoring the ideal corresponding to the kernel of the isogeny, modulo principal ideals, into a product of…
We unconditionally determine $I_\Q(d)$, the set of possible prime degrees of cyclic $K$-isogneies of elliptic curves with $\Q$-rational $j$-invariants and without complex multiplication over number fields $K$ of degree $\leq d$, for $d\leq 7$, and give an upper bound for $I_\Q(d)$ for $d>7$. Assuming Serre's uniformity conjecture, we determine $I_\Q(d)$ exactly for all positive integers $d$.
This article deals with the Galois representation attached to elliptic curves with an isogeny of prime degree over a number field. We first determine uniform criteria for the irreducibility of Galois representations attached to elliptic curves in some infinite families, characterised by their reduction type at some fixed places of the base field. Then, we give an explicit form for a bound that appear in a theorem of Momose. Finally, we use these results to precise a previous theorem of the author about the homotheties contained in the image of the Galois representation.
We survey algorithms for computing isogenies between elliptic curves defined over a field of characteristic either 0 or a large prime. We introduce a new algorithm that computes an isogeny of degree $\ell$ ($\ell$ different from the characteristic) in time quasi-linear with respect to $\ell$. This is based in particular on fast algorithms for power series expansion of the Weierstrass $\wp$-function and related functions.
Let K be a number field. We consider a local-global principle for elliptic curves E/K that admit (or do not admit) a rational isogeny of prime degree n. For suitable K (including K=Q), we prove that this principle holds when n = 1 mod 4, and for n < 7, but find a counterexample when n = 7 for an elliptic curve with j-invariant 2268945/128. For K = Q we show that, up to isomorphism, this is the only counterexample.
Let $E$ be an elliptic curve over a number field $K$. If for almost all primes of $K$, the reduction of $E$ modulo that prime has rational cyclic isogeny of fixed degree, we can ask if this forces $E$ to have a cyclic isogeny of that degree over $K$. Building upon the work of Sutherland, Anni, and Banwait-Cremona in the case of prime degree, we consider this question for cyclic isogenies of arbitrary degree.
Let E and E' be two elliptic curves over a number field. We prove that the reductions of E and E' at a finite place p are geometrically isogenous for infinitely many p, and draw consequences for the existence of supersingular primes. This result is an analogue for distributions of Frobenius traces of known results on the density of Noether-Lefschetz loci in Hodge theory. The proof relies on dynamical properties of the Hecke correspondences on the modular curve.
We construct three-dimensional families of hyperelliptic curves of genus 6, 12, and 14, two-dimensional families of hyperelliptic curves of genus 3, 6, 7, 10, 20, and 30, and one-dimensional families of hyperelliptic curves of genus 5, 10 and 15, all of which are equipped with an an explicit isogeny from their Jacobian to another hyperelliptic Jacobian. We show that the Jacobians are generically absolutely simple, and describe the kernels of the isogenies. The families are derived from Cassou--Noguès and Couveignes' explicit classification of pairs $(f,g)$ of polynomials such that $f(x_1) - g(…
We provide explicit bounds on the difference of heights of the $j$-invariants of isogenous elliptic curves defined over $\overline{\mathbb{Q}}$. The first one is reminiscent of a classical estimate for the Faltings height of isogenous abelian varieties, which is indeed used in the proof. We also use an explicit version of Silverman's inequality and isogeny estimates by Gaudron and Rémond. We give applications to the study of Vélu's formulas and of modular polynomials.
Let ell be a prime, and H a curve of genus 2 over a field k of characteristic not 2 or ell. If S is a maximal Weil-isotropic subgroup of Jac(H)[ell], then Jac(H)/S is isomorphic to the Jacobian of some (possibly reducible) curve X. We investigate the Dolgachev--Lehavi method for constructing the curve X, simplifying their approach and making it more explicit. The result, at least for ell=3, is an efficient and easily programmable algorithm suitable for number-theoretic calculations.
Let $p$ be an odd prime number and be an integer coprime to $p$. We survey an algorithm for computing explicit rational representations of $(\ell,...,\ell)$-isogenies between Jacobians of hyperelliptic curves of arbitrary genus over an extension $K$ of the field of $p$-adic numbers $\mathbb{Q}\_p$. The algorithm has a quasi-linear complexity in $\ell$ as well as in the genus of the curves.
Let p be an odd prime number and g $\ge$ 2 be an integer. We present an algorithm for computing explicit rational representations of isogenies between Jacobians of hyperelliptic curves of genus g over an extension K of the field of p-adic numbers Qp. It relies on an efficient resolution, with a logarithmic loss of p-adic precision, of a first order system of differential equations.
Elliptic $K$-curves are elliptic curves defined over some field extension $L/K$ that are isogenous to all of their Galois conjugates. We present a new result on $K$-curves $E$ that are given by a $K$-rational orbit $\{τ, -1/Nτ\}$ of the Fricke involution on $Y_0(N)$, giving a simple Diophantine condition on the extension $L/K$ that determines which twists of $E$ allow the isogeny between Galois conjugates to be defined over $L$. To support and illustrate this result, we also discuss parameterizations of cyclic $N$-isogenies corresponding to points on modular curves $X_0(N)$ of genus $0$. These…
A low storage algorithm for constructing isogenies between ordinary elliptic curves was proposed by Galbraith, Hess and Smart (GHS). We give an improvement of this algorithm by modifying the pseudorandom walk so that lower-degree isogenies are used more frequently. This is motivated by the fact that high degree isogenies are slower to compute than low degree ones. We analyse the running time of the parallel collision search algorithm when the partitioning is uneven. We also give experimental results. We conclude that our algorithm is around 14 times faster than the GHS algorithm when construct…
The SEA algorithm for computing the cardinality of elliptic curves over finite fields in many characteristic uses modular polynomials. These polynomials come into different flavors, and methods to compute them flourished. Once equipped with some modular polynomials for prime $\ell$, algebraic formulas are used to compute a curve $\mathcal{E}^*/\mathbb{F}_q$ that is $\ell$-isogenous to the curve of interest $\mathcal{E}$. These formulas involve derivatives of the modular polynomial that may sometime vanish. One way to overcome this problem is to use alternative trivariate polynomials $U_\ell$, …
We describe a framework for constructing an efficient non-interactive key exchange (NIKE) protocol for n parties for any n >= 2. Our approach is based on the problem of computing isogenies between isogenous elliptic curves, which is believed to be difficult. We do not obtain a working protocol because of a missing step that is currently an open mathematical problem. What we need to complete our protocol is an efficient algorithm that takes as input an abelian variety presented as a product of isogenous elliptic curves, and outputs an isomorphism invariant of the abelian variety. Our framework …
Given two elliptic curves over a finite field having the same cardinality and endomorphism ring, it is known that the curves admit an isogeny between them, but finding such an isogeny is believed to be computationally difficult. The fastest known classical algorithm takes exponential time, and prior to our work no faster quantum algorithm was known. Recently, public-key cryptosystems based on the presumed hardness of this problem have been proposed as candidates for post-quantum cryptography. In this paper, we give a subexponential-time quantum algorithm for constructing isogenies, assuming th…
Let $n$ be an integer such that the modular curve $X_0(n)$ is hyperelliptic of genus $\ge2$ and such that the Jacobian of $X_0(n)$ has rank $0$ over $\mathbb Q$. We determine all points of $X_0(n)$ defined over quadratic fields, and we give a moduli interpretation of these points. As a consequence, we show that up to $\overline{\mathbb Q}$-isomorphism, all but finitely many elliptic curves with $n$-isogenies over quadratic fields are in fact $\mathbb Q$-curves, and we list all exceptions. We also show that, again with finitely many exceptions up to $\overline{\mathbb Q}$-isomorphism, every $\m…
We give a description of the set of exceptional pairs for a number field $K$, that is the set of pairs $(\ell, j(E))$, where $\ell$ is a prime and $j(E)$ is the $j$-invariant of an elliptic curve $E$ over $K$ which admits an $\ell$-isogeny locally almost everywhere but not globally. We obtain an upper bound for $\ell$ in such pairs in terms of the degree and the discriminant of $K$. Moreover, we prove finiteness results about the number of exceptional pairs.
Schoof's classic algorithm allows point-counting for elliptic curves over finite fields in polynomial time. This algorithm was subsequently improved by Atkin, using factorizations of modular polynomials, and by Elkies, using a theory of explicit isogenies. Moving to Jacobians of genus-2 curves, the current state of the art for point counting is a generalization of Schoof's algorithm. While we are currently missing the tools we need to generalize Elkies' methods to genus 2, recently Martindale and Milio have computed analogues of modular polynomials for genus-2 curves whose Jacobians have real …
This is an updated version of ANT-0166. Generalizing results of Stroeker and Top we show that the 2-ranks of the Tate-Shafarevich groups of the elliptic curves $y^2 = (x+k)(x^2+k^2)$ can become arbitrarily large. We also present a conjecture on the rank of the Selmer groups attached to rational 2-isogenies of elliptic curves.
Let $K$ be a quadratic field which is not an imaginary quadratic field of class number one. We describe an algorithm to compute the primes $p$ for which there exists an elliptic curve over $K$ admitting a $K$-rational $p$-isogeny. This builds on work of David, Larson-Vaintrob, and Momose. Combining this algorithm with work of Bruin-Najman, Özman-Siksek, and most recently Box, we determine the above set of primes for the three quadratic fields $\mathbb{Q}(\sqrt{-10})$, $\mathbb{Q}(\sqrt{5})$, and $\mathbb{Q}(\sqrt{7})$, providing the first such examples after Mazur's 1978 determination for $K =…
