We provide an explicit and algorithmic version of a theorem of Momose classifying isogenies of prime degree of elliptic curves over number fields, which we implement in Sage and PARI/GP. Combining this algorithm with recent work of Box-Gajović-Goodman we determine the first instances of isogenies of prime degree for cubic number fields, as well as for several quadratic fields not previously known. While the correctness of the general algorithm relies on the Generalised Riemann Hypothesis, the algorithm is unconditional for the restricted class of semistable elliptic curves.
Let $E$ be an elliptic curve over a number field $K$. If for almost all primes of $K$, the reduction of $E$ modulo that prime has rational cyclic isogeny of fixed degree, we can ask if this forces $E$ to have a cyclic isogeny of that degree over $K$. Building upon the work of Sutherland, Anni, and Banwait-Cremona in the case of prime degree, we consider this question for cyclic isogenies of arbitrary degree.
Let K be a number field. We consider a local-global principle for elliptic curves E/K that admit (or do not admit) a rational isogeny of prime degree n. For suitable K (including K=Q), we prove that this principle holds when n = 1 mod 4, and for n < 7, but find a counterexample when n = 7 for an elliptic curve with j-invariant 2268945/128. For K = Q we show that, up to isomorphism, this is the only counterexample.
We give a description of the set of exceptional pairs for a number field $K$, that is the set of pairs $(\ell, j(E))$, where $\ell$ is a prime and $j(E)$ is the $j$-invariant of an elliptic curve $E$ over $K$ which admits an $\ell$-isogeny locally almost everywhere but not globally. We obtain an upper bound for $\ell$ in such pairs in terms of the degree and the discriminant of $K$. Moreover, we prove finiteness results about the number of exceptional pairs.
We consider character sums determined by isogenies of elliptic curves over finite fields. We prove a congruence condition for character sums attached to arbitrary cyclic isogenies, and produce explicit formulas for isogenies of small degree.
Let $K$ be a quadratic field which is not an imaginary quadratic field of class number one. We describe an algorithm to compute the primes $p$ for which there exists an elliptic curve over $K$ admitting a $K$-rational $p$-isogeny. This builds on work of David, Larson-Vaintrob, and Momose. Combining this algorithm with work of Bruin-Najman, Özman-Siksek, and most recently Box, we determine the above set of primes for the three quadratic fields $\mathbb{Q}(\sqrt{-10})$, $\mathbb{Q}(\sqrt{5})$, and $\mathbb{Q}(\sqrt{7})$, providing the first such examples after Mazur's 1978 determination for $K =…
We provide examples of abelian surfaces over number fields $K$ whose reductions at almost all good primes possess an isogeny of prime degree $\ell$ rational over the residue field, but which themselves do not admit a $K$-rational $\ell$-isogeny. This builds on work of Cullinan and Sutherland. When $K=\mathbb{Q}$, we identify certain weight-$2$ newforms $f$ with quadratic Fourier coefficients whose associated modular abelian surfaces $A_f$ exhibit such a failure of a local-global principle for isogenies.
An isogeny between elliptic curves is an algebraic morphism which is a group homomorphism. Many applications in cryptography require evaluating large degree isogenies between elliptic curves efficiently. For ordinary curves of the same endomorphism ring, the previous best known algorithm has a worst case running time which is exponential in the length of the input. In this paper we show this problem can be solved in subexponential time under reasonable heuristics. Our approach is based on factoring the ideal corresponding to the kernel of the isogeny, modulo principal ideals, into a product of…
Let $\mathcal{E}/\mathbb{F}_q$ be an elliptic curve, and $P$ a point in $\mathcal{E}(\mathbb{F}_q)$ of prime order $\ell$. Vélu's formulae let us compute a quotient curve $\mathcal{E}' = \mathcal{E}/\langle{P}\rangle$ and rational maps defining a quotient isogeny $ϕ: \mathcal{E} \to \mathcal{E}'$ in $\tilde{O}(\ell)$ $\mathbb{F}_q$-operations, where the $\tilde{O}$ is uniform in $q$.This article shows how to compute $\mathcal{E}'$, and $ϕ(Q)$ for $Q$ in $\mathcal{E}(\mathbb{F}_q)$, using only $\tilde{O}(\sqrt{\ell})$ $\mathbb{F}_q$-operations, where the $\tilde{O}$ is again uniform in $q$.As a…
Let p>3 be a prime and let E, E' be supersingular elliptic curves over F_p. We want to construct an isogeny phi: E --> E'. The currently fastest algorithm for finding isogenies between supersingular elliptic curves solves this problem by performing a "meet-in-the-middle" breadth-first search in the full supersingular 2-isogeny graph over F_{p^2}. In this paper we consider the structure of the isogeny graph of supersingular elliptic curves over F_p. We give an algorithm to construct isogenies between such supersingular elliptic curves that works faster than the usual algorithm. We then discuss …
In SIDH and SIKE protocols, public keys are defined over quadratic extensions of prime fields. We present in this work a projective invariant property characterizing affine Montgomery curves defined over prime fields. We then force a secret 3-isogeny chain to repeatedly pass through a curve defined over a prime field in order to exploit the new property and inject zeros in the A-coefficient of an intermediate curve to successfully recover the isogeny chain one step at a time. Our results introduce a new kind of fault attacks applicable to SIDH and SIKE.
Let ell be a prime, and H a curve of genus 2 over a field k of characteristic not 2 or ell. If S is a maximal Weil-isotropic subgroup of Jac(H)[ell], then Jac(H)/S is isomorphic to the Jacobian of some (possibly reducible) curve X. We investigate the Dolgachev--Lehavi method for constructing the curve X, simplifying their approach and making it more explicit. The result, at least for ell=3, is an efficient and easily programmable algorithm suitable for number-theoretic calculations.
We discuss the notion of polarised isogenies of abelian varieties, that is, isogenies which are compatible with given principal polarisations. This is motivated by problems of unlikely intersections in Shimura varieties. Our aim is to show that certain questions about polarised isogenies can be reduced to questions about unpolarised isogenies or vice versa. Our main theorem concerns abelian varieties B which are isogenous to a fixed abelian variety A. It establishes the existence of a polarised isogeny A to B whose degree is polynomially bounded in n, if there exist both an unpolarised isogeny…
This article deals with the Galois representation attached to elliptic curves with an isogeny of prime degree over a number field. We first determine uniform criteria for the irreducibility of Galois representations attached to elliptic curves in some infinite families, characterised by their reduction type at some fixed places of the base field. Then, we give an explicit form for a bound that appear in a theorem of Momose. Finally, we use these results to precise a previous theorem of the author about the homotheties contained in the image of the Galois representation.
We study the isogenies of certain abelian varieties over finite fields with non-commutative endomorphism algebras with a view to potential use in isogeny-based cryptography. In particular, we show that any two such abelian varieties with endomorphism rings maximal orders in the endomorphism algebra are linked by a cyclic isogeny of prime degree.
We propose an algorithm that calculates isogenies between elliptic curves defined over an extension $K$ of $\mathbb{Q}_2$. It consists in efficiently solving with a logarithmic loss of $2$-adic precision the first order differential equation satisfied by the isogeny. We give some applications, especially computing over finite fields of characteristic 2 isogenies of elliptic curves and irreducible polynomials, both in quasi-linear time in the degree.
Let p be an odd prime number and g $\ge$ 2 be an integer. We present an algorithm for computing explicit rational representations of isogenies between Jacobians of hyperelliptic curves of genus g over an extension K of the field of p-adic numbers Qp. It relies on an efficient resolution, with a logarithmic loss of p-adic precision, of a first order system of differential equations.
Let $p$ be an odd prime number and be an integer coprime to $p$. We survey an algorithm for computing explicit rational representations of $(\ell,...,\ell)$-isogenies between Jacobians of hyperelliptic curves of arbitrary genus over an extension $K$ of the field of $p$-adic numbers $\mathbb{Q}\_p$. The algorithm has a quasi-linear complexity in $\ell$ as well as in the genus of the curves.
Isogenies occur throughout the theory of elliptic curves. Recently, the cryptographic protocols based on isogenies are considered as candidates of quantum-resistant cryptographic protocols. Given two elliptic curves $E_1, E_2$ defined over a finite field $k$ with the same trace, there is a nonconstant isogeny $β$ from $E_2$ to $E_1$ defined over $k$. This study gives out the index of $\rm{Hom}_{\it k}(\it E_{\rm 1},E_{\rm 2})β$ as a left ideal in $\rm{End}_{\it k}(\it E_{\rm 2})$ and figures out the correspondence between isogenies and kernel ideals. In addition, some results about the non-tri…
We unconditionally determine $I_\Q(d)$, the set of possible prime degrees of cyclic $K$-isogneies of elliptic curves with $\Q$-rational $j$-invariants and without complex multiplication over number fields $K$ of degree $\leq d$, for $d\leq 7$, and give an upper bound for $I_\Q(d)$ for $d>7$. Assuming Serre's uniformity conjecture, we determine $I_\Q(d)$ exactly for all positive integers $d$.
Faltings in 1983 proved that a necessary and sufficient condition for two abelian varieties $A$ and $B$ to be isogenous over a number field $K$ is that the local factors of the L-series of $A$ and $B$ are equal for almost all primes of $K$ ; for each such prime this implies that $A$ and $B$ have the same number of points over the residue field. We show in this article that for abelian varieties faithfully of type GSp (a class containing the abelian varieties with endomorphism ring $\mathbb{Z}$ and of odd dimension) `having the same number of points' may be replaced by `the number of points hav…
Faltings's isogeny theorem states that two abelian varieties are isogenous over a number field precisely when the characteristic polynomials of the reductions at almost all prime ideals of the number field agree. This implies that two abelian varieties over $\mathbb{Q}$ with the same $L$-series are necessarily isogenous, but this is false over a general number field. Let $A$ and $A'$ be two abelian varieties, defined over number fields $K$ and $K'$ respectively. Our main result is that $A$ and $A'$ are isogenous after a suitable isomorphism between $K$ and $K'$ if and only if the Dirichlet cha…
The SEA algorithm for computing the cardinality of elliptic curves over finite fields in many characteristic uses modular polynomials. These polynomials come into different flavors, and methods to compute them flourished. Once equipped with some modular polynomials for prime $\ell$, algebraic formulas are used to compute a curve $\mathcal{E}^*/\mathbb{F}_q$ that is $\ell$-isogenous to the curve of interest $\mathcal{E}$. These formulas involve derivatives of the modular polynomial that may sometime vanish. One way to overcome this problem is to use alternative trivariate polynomials $U_\ell$, …
We study quotients of principally polarized abelian varieties with real multiplication by Galois-stable finite subgroups and describe when these quotients are principally polarizable. We use this characterization to provide an algorithm to compute explicit cyclic isogenies from kernel for abelian varieties with real multiplication over finite fields. Our algorithm is polynomial in the size of the finite field as well as the degree of the isogeny and is based on Mumford's theory of theta functions and theta embeddings. Recently, the algorithm has been successfully applied to obtain new results …
Let E and E' be two elliptic curves over a number field. We prove that the reductions of E and E' at a finite place p are geometrically isogenous for infinitely many p, and draw consequences for the existence of supersingular primes. This result is an analogue for distributions of Frobenius traces of known results on the density of Noether-Lefschetz loci in Hodge theory. The proof relies on dynamical properties of the Hecke correspondences on the modular curve.
Let $\mathcal{O}$ be an order in the imaginary quadratic field $K$. For positive integers $M \mid N$, we determine the least degree of an $\mathcal{O}$-CM point on the modular curve $X(M,N)_{/K(ζ_M)}$ and also on the modular curve $X(M,N)_{/\mathbb{Q}(ζ_M)}$: that is, we treat both the case in which the complex multiplication is rationally defined and the case in which we do not assume that the complex multiplication is rationally defined. To prove these results we establish several new theorems on rational cyclic isogenies of CM elliptic curves. In particular, we extend a result of Kwon that …
The problem of computing an explicit isogeny between two given elliptic curves over F_q, originally motivated by point counting, has recently awaken new interest in the cryptology community thanks to the works of Teske and Rostovstev & Stolbunov. While the large characteristic case is well understood, only suboptimal algorithms are known in small characteristic; they are due to Couveignes, Lercier, Lercier & Joux and Lercier & Sirvent. In this paper we discuss the differences between them and run some comparative experiments. We also present the first complete implementation of Couveignes' sec…
We prove two theorems concerning isogenies of elliptic curves over function fields. The first one describes the variation of the height of the $j$-invariant in an isogeny class. The second one is an "isogeny estimate", providing an explicit bound on the degree of a minimal isogeny between two isogenous elliptic curves. We also give several corollaries of these two results.
A low storage algorithm for constructing isogenies between ordinary elliptic curves was proposed by Galbraith, Hess and Smart (GHS). We give an improvement of this algorithm by modifying the pseudorandom walk so that lower-degree isogenies are used more frequently. This is motivated by the fact that high degree isogenies are slower to compute than low degree ones. We analyse the running time of the parallel collision search algorithm when the partitioning is uneven. We also give experimental results. We conclude that our algorithm is around 14 times faster than the GHS algorithm when construct…
Let G be a linear algebraic group defined over a finite field F_q. We present several connections between the isogenies of G and the finite groups of rational points G(F_q^n). We show that an isogeny from G' to G over F_q gives rise to a subgroup of fixed index in G(F_q^n) for infinitely many n. Conversely, we show that if G is reductive the existence of a subgroup of fixed index k for infinitely many n implies the existence of an isogeny of order k. In particular, we show that every infinite sequence of subgroups is controlled by a finite number of isogenies. This result applies to classical …
We introduce a special class of supersingular curves over $\mathbb{F}_{p^2}$, characterized by the existence of non-integer endomorphisms of small degree. A number of properties of this set is proved. Most notably, we show that when this set partitions into subsets in such a way that curves within each subset have small-degree isogenies between them, but curves in distinct subsets have no small-degree isogenies between them. Despite this, we show that isogenies between these curves can be computed efficiently, giving a technique for computing isogenies between certain prescribed curves that ca…
In this paper we extend a previous investigation by us regarding an iterative construction of irreducible polynomials over finite fields of odd characteristic. In particular, we show how it is possible to iteratively construct irreducible polynomials by means of two families of transforms, which we call the $Q_k$ and $\hat{Q}_k$-transforms, related to certain degree two isogenies over elliptic curves, which split the multiplication-by-$2$ map.
Minimal degree of an isogeny between a supersingular elliptic curve and its conjugate
Université de Toulon（土伦大学）；Aix Marseille Univ, UMR 7373 CNRS（艾克斯-马赛大学，法国国家科学研究中心联合研究单位7373）；University of French Polynesia（法属波利尼西亚大学）；University of Vermont（佛蒙特大学）
We study finite dimensional vector spaces over fields of elliptic functions equipped with two commuting aotomorphisms σand τinduced by isogenies of relatively prime orders. We give a structure theorem for such objects, that reveals a connection to the classification of vector bundles on elliptic curves by Atiyah. As an application we prove an elliptic analogue of a conjecture of Loxton and van der Poorten which has been recently proved by Adamczewski and Bell.
In this note, we consider an l-isogeny descent on a pair of elliptic curves over Q. We assume that l > 3 is a prime. The main result expresses the relevant Selmer groups as kernels of simple explicit maps between finite- dimensional F_l-vector spaces defined in terms of the splitting fields of the kernels of the two isogenies. We give examples of proving the l-part of the Birch and Swinnerton-Dyer conjectural formula for certain curves of small conductor.
