We present an algorithm that, on input of a positive integer N together with its prime factorization, constructs a finite field F and an elliptic curve E over F for which E(F) has order N. Although it is unproved that this can be done for all N, a heuristic analysis shows that the algorithm has an expected run time that is polynomial in 2^omega(N) log N, where omega(N) is the number of distinct prime factors of N. In the cryptographically relevant case where N is prime, an expected run time O((log N)^{4+epsilon}) can be achieved. We illustrate the efficiency of the algorithm by constructing elliptic curves with point groups of order N=10^2004 and N=nextprime(10^{2004})=10^{2004}+4863.
Given a non-isotrivial elliptic curve over an arithmetic surface, one obtains a lisse $\ell$-adic sheaf of rank two over the surface. This lisse sheaf has a number of straightforward properties: cyclotomic determinant, finite ramification, rational traces of Frobenius, and somewhere not potentially good reduction. We prove that any lisse sheaf of rank two possessing these properties comes from an elliptic curve.
I provide methods of constructing elliptic and hyperelliptic curves over global fields with interesting rational points over the given fields or over large field extensions. I also provide a elliptic curves defined over any given number field equipped with a rational point, (resp. with two rational points) of infinite order over the given number field, and elliptic curves over the rationals with two rational points over `simplest cubic fields.' I also provide hyperelliptic curves of genus exceeding any given number over any given number fields with points (over the given number field) which sp…
We give several new constructions for moderate rank elliptic curves over $\mathbb{Q}(T)$. In particular we construct infinitely many rational elliptic surfaces (not in Weierstrass form) of rank 6 over $\mathbb{Q}$ using polynomials of degree two in $T$. While our method generates linearly independent points, we are able to show the rank is exactly 6 \emph{without} having to verify the points are independent. The method generalizes; however, the higher rank surfaces are not rational, and we need to check that the constructed points are linearly independent.
We present a very efficient algorithm to construct an elliptic curve E and a finite field F such that the order of the point group E(F) is a given prime number N. Heuristically, this algorithm only takes polynomial time Otilde((\log N)^3), and it is so fast that it may profitably be used to tackle the related problem of finding elliptic curves with point groups of prime order of prescribed size. We also discuss the impact of the use of high level modular functions to reduce the run time by large constant factors and show that recent gonality bounds for modular curves imply limits on the time r…
For a given elliptic curve $E_0$ defined over a number field $k$, we construct two families of elliptic curves whose mod 3 representations are isomorphic to that of $E_0$. The isomorphisms in the first family are symplectic, and those in the second family are anti-symplectic. Our construction is based on the notion of Hessian and Cayleyan curves in classical geometry.
The problem of constructing elliptic curves suitable for pairing applications has received a lot of attention. To solve this, we propose a variant algorithm of a known method by Brezing and Weng. We produce new families of parameters using our algorithm for pairing-friendly elliptic curves of embedding degree 8, and we actually compute some explicit curves as numerical examples.
We present a general framework for constructing families of elliptic curves of prime order with prescribed embedding degree. We demonstrate this method by constructing curves with embedding degree k = 10, which solves an open problem posed by Boneh, Lynn, and Shacham. We show that our framework incorporates existing constructions for k = 3, 4, 6, and 12, and we give evidence that the method is unlikely to produce infinite families of curves with embedding degree k > 12.
We present a method for constructing optimized equations for the modular curve X_1(N) using a local search algorithm on a suitably defined graph of birationally equivalent plane curves. We then apply these equations over a finite field F_q to efficiently generate elliptic curves with nontrivial N-torsion by searching for affine points on X_1(N)(F_q), and we give a fast method for generating curves with (or without) a point of order 4N using X_1(2N).
Elliptic curves over finite fields with predefined conditions in the order are practically constructed using the theory of complex multiplication. The stage with longest calculations in this method reconstructs some polynomial with integer coefficients. We will prove theoretical results and give a detailed account of the method itself and how one can use a divisor of the mentioned polynomial with coefficients in some extension of the field of rational numbers.
We introduce a procedure for constructing a generalized elliptic curve from a genus-one twisted curve, and we use this procedure to define an explicit, modular isomorphism between two compactifications of moduli stacks of elliptic curves with level structure.
We generalize a construction of families of moderate rank elliptic curves over $\mathbb{Q}$ to number fields $K/\mathbb{Q}$. The construction, originally due to Steven J. Miller, Álvaro Lozano-Robledo and Scott Arms, invokes a theorem of Rosen and Silverman to show that computing the rank of these curves can be done by controlling the average of the traces of Frobenius, the construction for number fields proceeds in essentially the same way. One novelty of this method is that we can construct families of moderate rank without having to explicitly determine points and calculating determinants o…
If P is an algebraic point on a commutative group scheme A/K, then P is _almost_rational_ if no two non-trivial Galois conjugates sigma(P), tau(P), have sum equal to 2P. In this paper, we classify almost rational torsion points on semistable elliptic curves over Q.
Using a multidimensional large sieve inequality, we obtain a bound for the mean square error in the Chebotarev theorem for division fields of elliptic curves that is as strong as what is implied by the Generalized Riemann Hypothesis. As an application we prove a theorem to the effect that, according to height, almost all elliptic curves are Serre curves, where a Serre curve is an elliptic curve whose torsion subgroup, roughly speaking, has as much Galois symmetry as possible.
A positive integer that is the area of some rational right triangle is called a congruent number. In an algebraic point of view, being a congruent number means satisfying a system of equations. As early as the 1800s, it is understood that if $n$ is a congruent number, then the equation $nm^2 = uv(u^2 - v^2)$ has a solution in $\mathbb{Z}$. Using the relation between congruent numbers and elliptic curves $E_n: y^2 = x^3 - n^2 x$ which was established in the 1900s, we will prove that the converse of this two century-old result holds as well. In addition to this, we present another proof of the c…
Elliptic curves with a known number of points over a given prime field with n elements are often needed for use in cryptography. In the context of primality proving, Atkin and Morain suggested the use of the theory of complex multiplication to construct such curves. One of the steps in this method is the calculation of a root modulo n of the Hilbert class polynomial H(X) for a fundamental discriminant D. The usual way is to compute H(X) over the integers and then to find the root modulo n. We present a modified version of the Chinese remainder theorem (CRT) to compute H(X) modulo n directly fr…
The Shafarevich-Tate and Selmer groups arise in the context of Kummer theory for elliptic curves. The finiteness of the Shafarevich-Tate group of an elliptic curve $E$ over the field of rational numbers is included in the Birch and Swinnerton-Dyer conjectures, and is still an open question. We present an overview of the Shafarevich-Tate and Selmer groups of an elliptic curve in the framework of Galois cohomology. Known results on the finiteness of the Shafarevich-Tate group are mentioned, including results of Coates and Wiles, Rubin, Gross and Zagier, and Kolyvagin. We then prove the vanishing…
This paper focuses on the proof of Serge Lang's Heights Conjecture in a form that is completely effective. As a complementary result the author provides a new proof of Mazur-Merel theorem about a bound for the torsion of elliptic curves in terms of the degree of the ground field and improves the known result by providing a small polynomial bound in terms of this degree. (Submitted)
We present an explicit basis for orders of arbitrary level N>1 in definite rational quaternion algebras. These orders have applications to computations of spaces of elliptic and quaternionic modular forms.
We give a new algorithm for constructing Picard curves over a finite field with a given endomorphism ring. This has important applications in cryptography since curves of genus 3 allow for smaller key sizes than elliptic curves. For a sextic CM-field $K$ containing the cube roots of unity, we define and compute certain class polynomials modulo small primes and then use the Chinese Remainder Theorem to construct the class polynomials over the rationals. We also give some examples.
Let O be a maximal order in the quaternion algebra B_p over Q ramified at p and infinity. The paper is about the computational problem: Construct a supersingular elliptic curve E over F_p such that End(E) = O. We present an algorithm that solves this problem by taking gcds of the reductions modulo p of Hilbert class polynomials. New theoretical results are required to determine the complexity of our algorithm. Our main result is that, under certain conditions on a rank three sublattice O^T of O, the order O is effectively characterized by the three successive minima and two other short vectors…
A theorem of Serre states that almost all plane conics over $\mathbb{Q}$ have no rational point. We prove an analogue of this for families of conics parametrised by elliptic curves using elliptic divisibility sequences and a version of the Selberg sieve for elliptic curves. We also give more general results for specialisations of Brauer groups, which yields applications to norm form equations.
Given two elliptic curves over a finite field having the same cardinality and endomorphism ring, it is known that the curves admit an isogeny between them, but finding such an isogeny is believed to be computationally difficult. The fastest known classical algorithm takes exponential time, and prior to our work no faster quantum algorithm was known. Recently, public-key cryptosystems based on the presumed hardness of this problem have been proposed as candidates for post-quantum cryptography. In this paper, we give a subexponential-time quantum algorithm for constructing isogenies, assuming th…
Let $F/F_0$ be a quadratic extension of totally real number fields, and let $E$ be an elliptic curve over $F$ which is isogenous to its Galois conjugate over $F_0$. A quadratic extension $M/F$ is said to be almost totally complex (ATC) if all archimedean places of $F$ but one extend to a complex place of $M$. The main goal of this note is to provide a new construction of a supply of Darmon-like points on $E$, which are conjecturally defined over certain ring class fields of $M$. These points are constructed by means of an extension of Darmon's ATR method to higher dimensional modular abelian v…
The second part of the Birch and Swinnerton-Dyer (BSD) conjecture gives a conjectural formula for the order of the Shafarevich-Tate group of an elliptic curve in terms of other computable invariants of the curve. Cremona and Mazur initiated a theory that can often be used to verify the BSD conjecture by constructing non-trivial elements of the Shafarevich-Tate group of an elliptic curve by means of the Mordell-Weil group of an ambient curve. In this paper, we generalize Cremona and Mazur's work and give precise conditions under which such a construction can be made for the Shafarevich-Tate gro…
We study the existence of rational points on modular curves of $\cal{D}$-elliptic sheaves over local fields and the structure of special fibres of these curves. We discuss some applications which include finding presentations for arithmetic groups arising from quaternion algebras, finding the equations of modular curves of $\cal{D}$-elliptic sheaves, and constructing curves violating the Hasse principle.
We present a new method for constructing genus 2 curves over a finite field with a given number of points on its Jacobian. This method has important applications in cryptography, where groups of prime order are used as the basis for discrete-log based cryptosystems. Our algorithm provides an alternative to the traditional CM method for constructing genus 2 curves. For a quartic CM field K with primitive CM type, we compute the Igusa class polynomials modulo p for certain small primes p and then use the Chinese remainder theorem (CRT) and a bound on the denominators to construct the class polyn…
We compute a lower bound of the canonical height on quadratic twists of certain elliptic curves. Also we show a simple method for constructing families of quadratic twists with an explicit rational point. % from cubic polynomials. Using the above lower bound, we show that the explicit rational point is primitive as an element of the Mordell--Weil group.
A low storage algorithm for constructing isogenies between ordinary elliptic curves was proposed by Galbraith, Hess and Smart (GHS). We give an improvement of this algorithm by modifying the pseudorandom walk so that lower-degree isogenies are used more frequently. This is motivated by the fact that high degree isogenies are slower to compute than low degree ones. We analyse the running time of the parallel collision search algorithm when the partitioning is uneven. We also give experimental results. We conclude that our algorithm is around 14 times faster than the GHS algorithm when construct…
We investigate the number of curves having a rational point of almost minimal height in the family of quadratic twists of a given elliptic curve. This problem takes its origin in the work of Hooley, who asked this question in the setting of real quadratic fields. In particular, he showed an asymptotic estimate for the number of such fields with almost minimal fundamental unit. Our main result establishes the analogue asymptotic formula in the setting of quadratic twists of a fixed elliptic curve.
Modular Galois representations into GL_2(F_p) with cyclotomic determinant arise from elliptic curves for p = 2,3,5. We show (by constructing explicit examples) that such elliptic curves cannot be chosen to have conductor as small as possible at all primes other than p. Our proof involves finding all elliptic curves of conductor 85779, a custom computation carried out for us by Cremona. This leads to a counterexample to a conjecture of Lario and Rio. For p > 5, we construct irreducible representations with cyclotomic determinant that do not arise from any elliptic curve over Q.
Let $E$ be an elliptic curve over $\Q$ without complex multiplication, and which is not isogenous to a curve with non-trivial rational torsion. For each prime $p$ of good reduction, let $|E(\F_p)|$ be the order of the group of points of the reduced curve over $\F_p$. We prove in this paper that, under the GRH, there are at least $2.778 C_E^{\rm twin} x / (\log{x})^2$ primes $p$ such that $|E(\F_p)|$ has at most 8 prime factors, counted with multiplicity. This improves previous results of Steuding & Weng and Murty & Miri. This is also the first result where the dependence on the conjectural con…
The aim of this paper is to justify the common cryptographic practice of selecting elliptic curves using their order as the primary criterion. We can formalize this issue by asking whether the discrete log problem (DLOG) has the same difficulty for all curves over a given finite field with the same order. We prove that this is essentially true by showing polynomial time random reducibility of DLOG among such curves, assuming the Generalized Riemann Hypothesis (GRH). We do so by constructing certain expander graphs, similar to Ramanujan graphs, with elliptic curves as nodes and low degree isoge…
We investigate how various invariants of elliptic curves, such as the discriminant, Kodaira type, Tamagawa number and real and complex periods, change under an isogeny of prime degree p. For elliptic curves over l-adic fields, the classification is almost complete (the exception is wild potentially supersingular reduction when l=p), and is summarised in a table.
The arithmetic of elliptic curves, namely polynomial addition and scalar multiplication, can be described in terms of global sections of line bundles on $E\times E$ and $E$, respectively, with respect to a given projective embedding of $E$ in $\mathbb{P}^r$. By means of a study of the finite dimensional vector spaces of global sections, we reduce the problem of constructing and finding efficiently computable polynomial maps defining the addition morphism or isogenies to linear algebra. We demonstrate the effectiveness of the method by improving the best known complexity for doubling and tripli…
We first normalize the derivative Weierstrass $\wp'$-function appearing in Weierstrass equations which give rise to analytic parametrizations of elliptic curves by the Dedekind $η$-function. And, by making use of this normalization of $\wp'$ we associate certain elliptic curve to a given imaginary quadratic field $K$ and then generate an infinite family of ray class fields over $K$ by adjoining to $K$ torsion points of such elliptic curve. We further construct some ray class invariants of imaginary quadratic fields by utilizing singular values of the normalization of $\wp'$, as the $y$-coordin…
For E/k an elliptic curve with CM by O, we determine a formula for (a generalization of) the arithmetic local constant of [4] at almost all primes of good reduction. We apply this formula to the CM curves defined over Q and are able to describe extensions F/Q over which the O-rank of E grows.
Given a family of quadratic twists of a fixed elliptic curve defined over $\mathbb{Q}$, we investigate the average rank in the subfamily of twists having a nontorsion rational point of almost minimal height. We show in particular that the average analytic rank is greater than one.
We explore the relationship between elliptic Korselt numbers of Type I, a class of pseudoprimes introduced by Silverman in [20], and anomalous primes. We generalize a result in [20] that gives sufficient conditions for an elliptic Korselt number of Type I to be a product of anomalous primes. Finally, we prove that almost all elliptic Korselt numbers of Type I of the form n=pq are a product of anomalous primes
We bound Selmer groups attached to Grossencharacters of CM elliptic curves by the appropriate $L$-value. Our method is to use Kato's explicit reciprocity law and the Main Conjecture as proved by Rubin. These results are then used together with work of Han and fundamental results of Nekovar to bound the torsion in the image of the $p$-adic cycle class map for self products of CM elliptic curves. Our results are valid for Chow groups of arbitrary codimension for almost all $p$.
The "defect" of a curve over a finite field is the difference between the number of rational points on the curve and the Weil-Serre bound for the curve. We present a construction for producing genus-4 double covers of genus-2 curves over finite fields such that the defect of the double cover is not much more than the defect of the genus-2 curve. We give an algorithm that uses this construction to produce genus-4 curves with small defect. Heuristically, for all sufficiently large primes and for almost all prime powers q, the algorithm is expected to produce a genus-4 curve over F_q with defect …
We introduce a type of graph integrals on elliptic curves from the heat kernel. We show that such graph integrals have modular properties under the modular group $SL(2, \Z)$, and prove the polynomial nature of the anti-holomorphic dependence.
