algorithms on abelian varieties for...
TRANSCRIPT
![Page 1: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/1.jpg)
Algorithms on abelian varieties forcryptography
Damien Robert1
1Microsoft Research
17/01/2012 (LIX)
![Page 2: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/2.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Outline
1 Public-key cryptography
2 Abelian varieties
3 Theta functions
4 Isogenies
5 Examples
![Page 3: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/3.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Discrete logarithm
Definition (DLP)
Let G = ⟨g ⟩ be a cyclic group of prime order. Let x N and h = g x . Thediscrete logarithm logg (h) is x .
Exponentiation: O(log p ). DLP: eO(pp ) (in a generic group). So wecan use the DLP for public key cryptography.
⇒ We want to find secure groups with efficient addition law andcompact representation.
![Page 4: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/4.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Pairing-based cryptography
Definition
A pairing is a bilinear application e : G1×G1→G2.
Example
If the pairing e can be computed easily, the difficulty of the DLPin G1 reduces to the difficulty of the DLP in G2.
⇒ MOV attacks on supersingular elliptic curves.
Identity-based cryptography [BF03].
Short signature [BLS04].
One way tripartite Diffie–Hellman [Jou04].
Self-blindable credential certificates [Ver01].
Attribute based cryptography [SW05].
Broadcast encryption [GPS+06].
![Page 5: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/5.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Example of applications
Tripartite Diffie–Helman
Alice sends g a , Bob sends g b , Charlie sends g c . The common key is
e (g , g )ab c = e (g b , g c )a = e (g c , g a )b = e (g a , g b )c G2.
Example (Identity-based cryptography)
Master key: (P, s P), s . s N, P G1.
Derived key: Q , sQ . Q G1.
Encryption, m G2: m ′ =m ⊕ e (Q , s P)r , r P . r N.Decryption: m =m ′⊕ e (sQ , r P).
![Page 6: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/6.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Elliptic curves
Definition (car k = 2, 3)
An elliptic curve is a plan curve of equation
y 2 = x 3+a x +b 4a 3+27b 2 = 0.
-2
-1
0
1
2
-1.5 -1 -0.5 0 0.5 1 1.5 2
P
Q
R
-R
P +Q =−R
= (xR ,−yR )
λ=yQ − yP
xQ −xP
xR =λ2−xP −xQ
yR = yP +λ(xR −xP )
Addition on the
elliptic curve y 2 =x 3−x .
![Page 7: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/7.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Abelian varieties
Definition
An Abelian variety is a complete connected group variety over a basefield k .
Abelian variety = points on a projective space (locus ofhomogeneous polynomials) + an abelian group law given byrational functions.
Abelian variety of dimension 1 = elliptic curves.
⇒ Abelian varieties are just the generalization of elliptic curves inhigher dimension.
Pairings on abelian varieties
The Weil and Tate pairings on abelian varieties are the only knownexamples of cryptographic pairings.
eW : A[ℓ]×A[ℓ]→µℓ ⊂F∗q k .
![Page 8: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/8.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Abelian surfaces
Abelian varieties of dimension 2 are given by: 5 quadratic equations inP7.
(4a 1a 2+4a 5a 6)X1X6+(4a 1a 2+4a 5a 6)X2X5 =
(4a 3a 44a 4a 3)X3X4+(4a 3a 44a 4a 3)X7X8;
(2a 1a 5+2a 2a 6)X 21 +(2a 1a 5+2a 2a 6)X 2
2 +(−2a 23−2a 2
4−2a 23−2a 2
4)X3X3 =
(2a 23+2a 2
4+2a 23+2a 2
4)X4X8+(−2a 1a 5−2a 2a 6)X 25 +(−2a 1a 5−2a 2a 6)X 2
6 ;
(4a 1a 6+4a 2a 5)X1X2+(−4a 3a 4−4a 3a 4)X3X8 =
(4a 3a 4+4a 3a 4)X4X7+(−4a 1a 6−4a 2a 5)X5X6;
(2a 21+2a 2
2+2a 25+2a 2
6)X1X5+(2a 21+2a 2
2+2a 25+2a 2
6)X2X6+(−2a 3a 3−2a 4a 4)X 23 =
(2a 3a 3+2a 4a 4)X 24 +(2a 3a 3+2a 4a 4)X 2
7 +(2a 3a 3+2a 4a 4)X 28 ;
(2a 21−2a 2
2+2a 25−2a 2
6)X1X5+(−2a 21+2a 2
2−2a 25+2a 2
6)X2X6+(−2a 3a 3+2a 4a 4)X 23 =
(−2a 3a 3+2a 4a 4)X 24 +(2a 3a 3−2a 4a 4)X 2
7 +(−2a 3a 3+2a 4a 4)X 28 ;
where the parameters satisfy 2 quartic equations in P5:
a 31a 5+a 2
1a 2a 6+a 1a 22a 5+a 1a 3
5+a 1a 5a 26+a 3
2a 6+a 2a 25a 6+a 2a 3
6−2a 43−4a 2
3a 24−2a 4
4 = 0;
a 21a 2a 6+a 1a 2
2a 5+a 1a 5a 26+a 2a 2
5a 6−4a 23a 2
4 = 0
The most general form actually use 72 quadratic equations in 16variables.
![Page 9: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/9.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Jacobian of hyperelliptic curves
C : y 2 = f (x ), hyperelliptic curve of genus g . (deg f = 2g +1)
Divisor: formal sum D =∑
n i Pi ,deg D =∑
n i .Pi C (k ).
Principal divisor:∑
PC (k ) vP ( f ).P; f k (C ).Jacobian of C =Divisors of degree 0 modulo principal divisors
+ Galois action= Abelian variety of dimension g .
Divisor class D ⇒ unique representative (Riemann–Roch):
D =k∑
i=1
(Pi −P∞) k ¶ g , symmetric Pi = Pj
Mumford coordinates: D = (u , v ) ⇒ u =∏
(x −x i ), v (x i ) = yi .
Cantor algorithm: addition law.
![Page 10: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/10.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Abelian varieties as Jacobians
Dimension 2: Jacobians of hyperelliptic curves of genus 2:y 2 = f (x ), deg f = 5.
D = P1+ P
2− 2∞
D ′ =Q1+Q
2− 2∞
bP
1
b P2
b
Q1
b Q2
b
bb
b
![Page 11: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/11.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Abelian varieties as Jacobians
Dimension 2: Jacobians of hyperelliptic curves of genus 2:y 2 = f (x ), deg f = 5.
D = P1+ P
2− 2∞
D ′ =Q1+Q
2− 2∞
bP
1
b P2
b
Q1
b Q2
bR′
1
bR′
2b
b
![Page 12: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/12.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Abelian varieties as Jacobians
Dimension 2: Jacobians of hyperelliptic curves of genus 2:y 2 = f (x ), deg f = 5.
D = P1+ P
2− 2∞
D ′ =Q1+Q
2− 2∞
bP
1
b P2
b
Q1
b Q2
bR′
1
bR′
2bR1
bR
2
D +D ′ = R1+R
2− 2∞
![Page 13: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/13.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Abelian varieties as Jacobians
Dimension 3Jacobians of hyperelliptic curves ofgenus 3.
Jacobians of quartics.
-40
-30
-20
-10
0
10
20
30
40
-4 -3 -2 -1 0 1 2 3 4
-1
-0.5 0
0.5 1
-1-0
.5 0
0.5
1
![Page 14: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/14.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Abelian varieties as Jacobians
Dimension 4
Abelian varieties do not come from a curve generically.
![Page 15: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/15.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Security of abelian varieties
g # points DLP
1 O(q ) eO(q 1/2)2 O(q 2) eO(q )
3 O(q 3)eO(q 4/3) (Jacobian of an hyperelliptic curve)eO(q ) (Jacobian of a quartic)
gO(q g )eO(q 2−2/g )
g > log(q ) L 1/2(q g )= exp(O(1) log(x )1/2 log log(x )1/2)
Security of the DLP
Weak curves (MOV attack, Weil descent, anomal curves).
![Page 16: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/16.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Complex abelian varieties
Abelian variety over C: A =Cg / (Zg +ΩZg ), where Ω Hg (C) theSiegel upper half space.
The theta functions with characteristic are analytic (quasiperiodic) functions on Cg .
ϑa
b
(z ,Ω)=∑
nZg
eπi t (n+a )Ω(n+a )+2πi t (n+a )(z+b ) a ,b Qg
Quasi-periodicity:
ϑa
b
(z+m1Ω+m2,Ω)= e 2πi (t a ·m2−t b ·m1)−πi t m1Ωm1−2πi t m1 ·zϑa
b
(z ,Ω).
Projective coordinates:
A −→ Pn g−1C
z 7−→ (ϑi (z ))iZ (n )where Z (n ) =Zg /nZg and ϑi = ϑ
h
0in
i
(., Ωn).
![Page 17: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/17.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Theta functions of level n
Translation by a point of n -torsion:
ϑi (z +m1
nΩ+
m2
n) = e−
2πin
t i ·m1ϑi+m2 (z ).
(ϑi )iZ (n ): basis of the theta functions of level n⇔ A[n ] = A1[n ]⊕A2[n ]: symplectic decomposition.
(ϑi )iZ (n ) =¨
coordinates system n ¾ 3
coordinates on the Kummer variety A/±1 n = 2
Theta null point: ϑi (0)iZ (n ) =modular invariant.
![Page 18: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/18.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
The differential addition law (k =C)
∑
t Z (2)χ(t )ϑi+t (x + y )ϑj+t (x − y )
.
∑
t Z (2)χ(t )ϑk+t (0)ϑl+t (0)
=
∑
t Z (2)χ(t )ϑ−i ′+t (y )ϑj ′+t (y )
.
∑
t Z (2)χ(t )ϑk ′+t (x )ϑl ′+t (x )
.
where χ Z (2), i , j , k , l Z (n )(i ′, j ′, k ′, l ′) = A(i , j , k , l )
A =1
2
1 1 1 11 1 −1 −11 −1 1 −11 −1 −1 1
![Page 19: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/19.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Example: addition in genus 1 and in level 2
Differential Addition Algorithm:Input: P = (x1 : z 1), Q = (x2 : z 2)and R = P −Q = (x3 : z 3) with x3z 3 = 0.Output: P +Q = (x ′ : z ′).
1 x0 = (x 21 + z 2
1)(x22 + z 2
2);2 z 0 = A2
B 2 (x 21 − z 2
1)(x22 − z 2
2);3 x ′ = (x0+ z 0)/x3;4 z ′ = (x0− z 0)/z 3;5 Return (x ′ : z ′).
![Page 20: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/20.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Cost of the arithmetic with low level theta functions(car k = 2)
Mumford Level 2Level 4
Doubling 34M +7S7M +12S+9m0 49M +36S+27m0Mixed Addition 37M +6S
Multiplication cost in genus 2 (one step).
Montgomery Level 2 Jacobians coordinatesDoubling
5M +4S+1m0 3M +6S+3m03M +5S
Mixed Addition 7M +6S+1m0
Multiplication cost in genus 1 (one step).
![Page 21: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/21.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
The Weil pairing on elliptic curves
Let E : y 2 = x 3+a x +b be an elliptic curve over k (car k = 2, 3).
Let P,Q E [ℓ] be points of ℓ-torsion.
Let f P be a function associated to the principal divisor ℓ(P −0),and fQ to ℓ(Q −0). We define:
eW,ℓ(P,Q) =fQ (P −0)f P (Q −0)
.
The application eW,ℓ : E [ℓ]×E [ℓ]→µℓ(k ) is a non degeneratepairing: the Weil pairing.
![Page 22: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/22.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
The Weil and Tate pairing with theta coordinates
P and Q points of ℓ-torsion.
0A P 2P . . . ℓP =λ0P 0A
Q P ⊕Q 2P +Q . . . ℓP +Q =λ1PQ
2Q P +2Q
. . . . . .
ℓQ =λ0Q 0A P + ℓQ =λ1
Q P
eW,ℓ(P,Q) =λ1
Pλ0Q
λ0Pλ
1Q.
If P =Ωx1+x2 and Q =Ωy1+ y2, then eW,ℓ(P,Q) = e−2πiℓ(t x1 ·y2−t y1 ·x2).
eT,ℓ(P,Q) = λ1P
λ0P.
![Page 23: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/23.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Why does it works?
0A αP α4(2P) . . . αℓ2 (ℓP) =λ′0P 0A
βQ γ(P ⊕Q) γ2α2
β(2P +Q) . . . γℓαℓ(ℓ−1)
β ℓ−1 (ℓP +Q) =λ′1PβQ
β 4(2Q) γ2β 2
α(P +2Q)
. . . . . .
β ℓ2 (ℓQ) =λ′0Q 0A
γℓβ ℓ(ℓ−1)
αℓ−1 (P + ℓQ) =λ′1QαP
We then have
λ′0P =α
ℓ2λ0
P , λ′0Q =β
ℓ2λ0
Q , λ′1P =γℓα(ℓ(ℓ−1)
β ℓλ1
P , λ′1Q =γℓβ (ℓ(ℓ−1)
αℓλ1
Q ,
e ′W,ℓ(P,Q) =λ′1Pλ
′0Q
λ′0Pλ′1Q
=λ1
Pλ0Q
λ0Pλ
1Q
= eW,ℓ(P,Q),
e ′T,ℓ(P,Q) =λ′1Pλ′0P=γℓ
αℓβ ℓλ1
P
λ0P
=γℓ
αℓβ ℓeT,ℓ(P,Q).
![Page 24: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/24.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Isogenies
Definition
A (separable) isogeny is a finite surjective (separable) morphismbetween two Abelian varieties.
Isogenies = Rational map + group morphism + finite kernel.
Isogenies⇔ Finite subgroups.
( f : A→ B ) 7→Ker f
(A→ A/H ) 7→H
Example: Multiplication by ℓ (⇒ ℓ-torsion), Frobenius (nonseparable).
![Page 25: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/25.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Cryptographic usage of isogenies
Transfer the DLP from one Abelian variety to another.
Point counting algorithms (ℓ-adic or p -adic) ⇒ Verify a curve issecure.
Compute the class field polynomials (CM-method) ⇒ Construct asecure curve.
Compute the modular polynomials ⇒ Compute isogenies.
Determine End(A) ⇒ CRT method for class field polynomials.
![Page 26: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/26.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Vélu’s formula
Theorem
Let E : y 2 = f (x ) be an elliptic curve and G ⊂ E (k ) a finite subgroup. ThenE/G is given by Y 2 = g (X ) where
X (P) = x (P)+∑
QG \0E
(x (P +Q)−x (Q))
Y (P) = y (P)+∑
QG \0E
y (P +Q)− y (Q)
.
Uses the fact that x and y are characterised in k (E ) by
v0E (x ) =−2 vP (x )¾ 0 if P = 0E
v0E (y ) =−3 vP (y )¾ 0 if P = 0E
y 2/x 3(0E ) = 1
No such characterisation in genus g ¾ 2 for Mumfordcoordinates.
![Page 27: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/27.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
The isogeny theorem
Theorem
Let ϕ : Z (n )→Z (ℓn ),x 7→ ℓ.x be the canonical embedding.Let K = A2[ℓ]⊂ A2[ℓn ].
Let (ϑAi )iZ (ℓn ) be the theta functions of level ℓn on A =Cg /(Zg +ΩZg ).
Let (ϑBi )iZ (n ) be the theta functions of level n of
B = A/K =Cg /(Zg + ΩℓZg ).
We have:(ϑB
i (x ))iZ (n ) = (ϑAϕ(i )(x ))iZ (n )
Example
π : (x0,x1,x2,x3,x4,x5,x6,x7,x8,x9,x10,x11) 7→ (x0,x3,x6,x9) is a 3-isogenybetween elliptic curves.
![Page 28: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/28.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
An example with g = 1, n = 2, ℓ= 3
z Cg /(Zg + ℓΩZg ), level ℓn
z Cg /(Zg +ΩZg ), level n
π
ℓz Cg /(Zg + ℓΩZg ), level ℓn
bπ
[ℓ]
![Page 29: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/29.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
An example with g = 1, n = 2, ℓ= 3
z Cg /(Zg + ℓΩZg ), level ℓn
z Cg /(Zg +ΩZg ), level n
π
ℓz Cg /(Zg + ℓΩZg ), level ℓn
bπ
[ℓ]
![Page 30: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/30.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
An example with g = 1, n = 2, ℓ= 3
z Cg /(Zg + ℓΩZg ), level ℓn
z Cg /(Zg +ΩZg ), level n
π
ℓz Cg /(Zg + ℓΩZg ), level ℓn
bπ
[ℓ]
![Page 31: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/31.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
An example with g = 1, n = 2, ℓ= 3
z Cg /(Zg + ℓΩZg ), level ℓn
z Cg /(Zg +ΩZg ), level n
π
ℓz Cg /(Zg + ℓΩZg ), level ℓn
bπ
[ℓ]
1
Ω 3ΩR0
R1
R2
y
![Page 32: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/32.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
An example with g = 1, n = 2, ℓ= 3
z Cg /(Zg + ℓΩZg ), level ℓn
z Cg /(Zg +ΩZg ), level n
π
ℓz Cg /(Zg + ℓΩZg ), level ℓn
bπ
[ℓ]
1
Ω 3ΩR0
R1
R2
y
![Page 33: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/33.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
An example with g = 1, n = 2, ℓ= 3
z Cg /(Zg + ℓΩZg ), level ℓn
z Cg /(Zg +ΩZg ), level n
π
ℓz Cg /(Zg + ℓΩZg ), level ℓn
bπ
[ℓ]
1
Ω 3ΩR0
R1
R2
y
![Page 34: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/34.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
An example with g = 1, n = 2, ℓ= 3
z Cg /(Zg + ℓΩZg ), level ℓn
z Cg /(Zg +ΩZg ), level n
π
ℓz Cg /(Zg + ℓΩZg ), level ℓn
bπ
[ℓ]
1
Ω 3ΩR0
R1
R2
y x
![Page 35: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/35.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Changing level
Theorem (Koizumi–Kempf)
Let F be a matrix of rank r such that t F F = ℓ Idr . Let X (Cg )r andY = F (X ) (Cg )r . Let j (Qg )r and i = F (j ). Then we have
ϑ
0i 1
(Y1,Ωn) . . .ϑ
0i r
(Yr ,Ωn) =∑
t1,...,tr 1ℓZg /Zg
F (t1,...,tr )=(0,...,0)
ϑ
0j1
(X1+ t1,Ωℓn) . . .ϑ
0jr
(Xr + tr ,Ωℓn),
(This is the isogeny theorem applied to FA : Ar → Ar .)
If ℓ= a 2+b 2, we take F =
a b−b a
, so r = 2.
In general, ℓ= a 2+b 2+ c 2+d 2, we take F to be the matrix ofmultiplication by a +b i + c j +d k in the quaternions, so r = 4.
⇒ We have a complete algorithm to compute the isogeny A 7→ A/Kgiven the kernel K [Cosset, Lubicz, R.].
![Page 36: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/36.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
AVIsogenies
AVIsogenies: Magma code written by Bisson, Cosset and R.http://avisogenies.gforge.inria.fr
Released under LGPL 2+.
Implement isogeny computation (and applications thereof) forabelian varieties using theta functions.
Current release 0.2: isogenies in genus 2.
![Page 37: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/37.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Implementation
H hyperelliptic curve of genus 2 over k =Fq , J = Jac(H ), ℓ odd prime,2ℓ∧ car k = 1. Compute all rational (ℓ,ℓ)-isogenies J 7→ Jac(H ′) (wesuppose the zeta function known):
1 Compute the extension Fq n where the geometric points of themaximal isotropic kernel of J [ℓ] lives.
2 Compute a “symplectic” basis of J [ℓ](Fq n ).3 Find the rational maximal isotropic kernels K .4 For each kernel K , convert its basis from Mumford to theta
coordinates of level 2. (Rosenhain then Thomae).5 Compute the other points in K in theta coordinates using
differential additions.6 Apply the change level formula to recover the theta null point of
J /K .7 Compute the Igusa invariants of J /K (“Inverse Thomae”).8 Distinguish between the isogeneous curve and its twist.
![Page 38: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/38.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Implementation
H hyperelliptic curve of genus 2 over k =Fq , J = Jac(H ), ℓ odd prime,2ℓ∧ car k = 1. Compute all rational (ℓ,ℓ)-isogenies J 7→ Jac(H ′) (wesuppose the zeta function known):
1 Compute the extension Fq n where the geometric points of themaximal isotropic kernel of J [ℓ] lives.
2 Compute a “symplectic” basis of J [ℓ](Fq n ).3 Find the rational maximal isotropic kernels K .4 For each kernel K , convert its basis from Mumford to theta
coordinates of level 2. (Rosenhain then Thomae).5 Compute the other points in K in theta coordinates using
differential additions.6 Apply the change level formula to recover the theta null point of
J /K .7 Compute the Igusa invariants of J /K (“Inverse Thomae”).8 Distinguish between the isogeneous curve and its twist.
![Page 39: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/39.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Implementation
H hyperelliptic curve of genus 2 over k =Fq , J = Jac(H ), ℓ odd prime,2ℓ∧ car k = 1. Compute all rational (ℓ,ℓ)-isogenies J 7→ Jac(H ′) (wesuppose the zeta function known):
1 Compute the extension Fq n where the geometric points of themaximal isotropic kernel of J [ℓ] lives.
2 Compute a “symplectic” basis of J [ℓ](Fq n ).3 Find the rational maximal isotropic kernels K .4 For each kernel K , convert its basis from Mumford to theta
coordinates of level 2. (Rosenhain then Thomae).5 Compute the other points in K in theta coordinates using
differential additions.6 Apply the change level formula to recover the theta null point of
J /K .7 Compute the Igusa invariants of J /K (“Inverse Thomae”).8 Distinguish between the isogeneous curve and its twist.
![Page 40: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/40.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Implementation
H hyperelliptic curve of genus 2 over k =Fq , J = Jac(H ), ℓ odd prime,2ℓ∧ car k = 1. Compute all rational (ℓ,ℓ)-isogenies J 7→ Jac(H ′) (wesuppose the zeta function known):
1 Compute the extension Fq n where the geometric points of themaximal isotropic kernel of J [ℓ] lives.
2 Compute a “symplectic” basis of J [ℓ](Fq n ).3 Find the rational maximal isotropic kernels K .4 For each kernel K , convert its basis from Mumford to theta
coordinates of level 2. (Rosenhain then Thomae).5 Compute the other points in K in theta coordinates using
differential additions.6 Apply the change level formula to recover the theta null point of
J /K .7 Compute the Igusa invariants of J /K (“Inverse Thomae”).8 Distinguish between the isogeneous curve and its twist.
![Page 41: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/41.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Implementation
H hyperelliptic curve of genus 2 over k =Fq , J = Jac(H ), ℓ odd prime,2ℓ∧ car k = 1. Compute all rational (ℓ,ℓ)-isogenies J 7→ Jac(H ′) (wesuppose the zeta function known):
1 Compute the extension Fq n where the geometric points of themaximal isotropic kernel of J [ℓ] lives.
2 Compute a “symplectic” basis of J [ℓ](Fq n ).3 Find the rational maximal isotropic kernels K .4 For each kernel K , convert its basis from Mumford to theta
coordinates of level 2. (Rosenhain then Thomae).5 Compute the other points in K in theta coordinates using
differential additions.6 Apply the change level formula to recover the theta null point of
J /K .7 Compute the Igusa invariants of J /K (“Inverse Thomae”).8 Distinguish between the isogeneous curve and its twist.
![Page 42: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/42.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Implementation
H hyperelliptic curve of genus 2 over k =Fq , J = Jac(H ), ℓ odd prime,2ℓ∧ car k = 1. Compute all rational (ℓ,ℓ)-isogenies J 7→ Jac(H ′) (wesuppose the zeta function known):
1 Compute the extension Fq n where the geometric points of themaximal isotropic kernel of J [ℓ] lives.
2 Compute a “symplectic” basis of J [ℓ](Fq n ).3 Find the rational maximal isotropic kernels K .4 For each kernel K , convert its basis from Mumford to theta
coordinates of level 2. (Rosenhain then Thomae).5 Compute the other points in K in theta coordinates using
differential additions.6 Apply the change level formula to recover the theta null point of
J /K .7 Compute the Igusa invariants of J /K (“Inverse Thomae”).8 Distinguish between the isogeneous curve and its twist.
![Page 43: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/43.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Implementation
H hyperelliptic curve of genus 2 over k =Fq , J = Jac(H ), ℓ odd prime,2ℓ∧ car k = 1. Compute all rational (ℓ,ℓ)-isogenies J 7→ Jac(H ′) (wesuppose the zeta function known):
1 Compute the extension Fq n where the geometric points of themaximal isotropic kernel of J [ℓ] lives.
2 Compute a “symplectic” basis of J [ℓ](Fq n ).3 Find the rational maximal isotropic kernels K .4 For each kernel K , convert its basis from Mumford to theta
coordinates of level 2. (Rosenhain then Thomae).5 Compute the other points in K in theta coordinates using
differential additions.6 Apply the change level formula to recover the theta null point of
J /K .7 Compute the Igusa invariants of J /K (“Inverse Thomae”).8 Distinguish between the isogeneous curve and its twist.
![Page 44: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/44.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Implementation
H hyperelliptic curve of genus 2 over k =Fq , J = Jac(H ), ℓ odd prime,2ℓ∧ car k = 1. Compute all rational (ℓ,ℓ)-isogenies J 7→ Jac(H ′) (wesuppose the zeta function known):
1 Compute the extension Fq n where the geometric points of themaximal isotropic kernel of J [ℓ] lives.
2 Compute a “symplectic” basis of J [ℓ](Fq n ).3 Find the rational maximal isotropic kernels K .4 For each kernel K , convert its basis from Mumford to theta
coordinates of level 2. (Rosenhain then Thomae).5 Compute the other points in K in theta coordinates using
differential additions.6 Apply the change level formula to recover the theta null point of
J /K .7 Compute the Igusa invariants of J /K (“Inverse Thomae”).8 Distinguish between the isogeneous curve and its twist.
![Page 45: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/45.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Implementation
H hyperelliptic curve of genus 2 over k =Fq , J = Jac(H ), ℓ odd prime,2ℓ∧ car k = 1. Compute all rational (ℓ,ℓ)-isogenies J 7→ Jac(H ′) (wesuppose the zeta function known):
1 Compute the extension Fq n where the geometric points of themaximal isotropic kernel of J [ℓ] lives.
2 Compute a “symplectic” basis of J [ℓ](Fq n ).3 Find the rational maximal isotropic kernels K .4 For each kernel K , convert its basis from Mumford to theta
coordinates of level 2. (Rosenhain then Thomae).5 Compute the other points in K in theta coordinates using
differential additions.6 Apply the change level formula to recover the theta null point of
J /K .7 Compute the Igusa invariants of J /K (“Inverse Thomae”).8 Distinguish between the isogeneous curve and its twist.
![Page 46: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/46.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Computing the right extension
J = Jac(H ) abelian variety of dimension 2. χ(X ) the correspondingzeta function.
Degree of a point of ℓ-torsion | the order of X in Fℓ[X ]/χ(X ).If K rational, K (k )≃ (Z/ℓZ)2, the degree of a point in K | the LCMof orders of X in Fℓ[X ]/P(X ) for P |χ of degree two.
Since we are looking to K maximal isotropic, J [ℓ]≃ K ⊕K ′ andwe know that P |χ is such that χ(X )≡ P(X )P(X ) mod ℓ whereX =q/X represents the Verschiebung.
Remark
The degree n is ¶ ℓ2−1. If ℓ is totally split in Z[π,π] then n | ℓ−1.
![Page 47: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/47.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Computing the ℓ-torsion
We want to compute J (Fq n )[ℓ].
From the zeta function χ(X ) we can compute random points inJ (Fq n )[ℓ∞] uniformly.
If P is in J (Fq n )[ℓ∞], ℓm P J (Fq n )[ℓ] for a suitable m . This does notgive uniform points of ℓ-torsion but we can correct the pointsobtained.
Example
Suppose J (Fq n )[ℓ∞] =< P1, P2 > with P1 of order ℓ2 and P2 of orderℓ.
First random point Q1 = P1 ⇒ we recover the point of ℓ-torsion:ℓ.P1.
Second random point Q2 =αP1+βP2. If α = 0 we recover thepoint of ℓ-torsion αℓP1 which is not a new generator.
We correct the original point: Q ′2 =Q2−αQ1 =βP2.
![Page 48: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/48.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Isogeny graphs for elliptic curves
![Page 49: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/49.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Horizontal isogeny graphs: ℓ=q1q2 =Q1Q1Q2Q2
![Page 50: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/50.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Horizontal isogeny graphs: ℓ=q1q2 =Q1Q1Q2Q2
![Page 51: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/51.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Horizontal isogeny graphs: ℓ=q =QQ (Q 7→ K0 7→ K )
![Page 52: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/52.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Horizontal isogeny graphs: ℓ=q1q2 =Q1Q1Q22
![Page 53: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/53.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Horizontal isogeny graphs: ℓ=q 2 =Q2Q2
![Page 54: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/54.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Horizontal isogeny graphs: ℓ=q 2 =Q4
![Page 55: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/55.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
General isogeny graphs (ℓ=q =QQ)
12
12
3
24
3
12
3
24
3 3 3
72
3
![Page 56: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/56.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
General isogeny graphs (ℓ=q =QQ)
27
243
243
27
27
243
27
3
27
243 243
243
243
243
243
27
243
243
243
27
243
27
243
243
27
243
243
27
27
243
3
27
243
27
27
243
3
243
27
1
243
243
27
3
27
27
243
243
243
27
3
243
243
243
27
243
243
243
31
243
243
243
243
243
243
243
27
243
3
243
243
27243
243
243
27
243
3
11
243
243
243
243
243
243
243
243
243
243
243
243
243
243
243
243
243
243
243
27
243
243
243
243
243
243
243
![Page 57: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/57.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
General isogeny graphs (ℓ=q1q2 =Q1Q1Q2Q2)
![Page 58: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/58.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
General isogeny graphs (ℓ=q1q2 =Q1Q1Q2Q2)
![Page 59: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/59.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
General isogeny graphs (ℓ=q1q2 =Q1Q1Q2Q2)
![Page 60: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/60.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Isogeny graph and lattice of orders in genus 2
3 3
3 3
![Page 61: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/61.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Isogeny graph and lattice of orders in genus 2
3 3
3 3
![Page 62: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/62.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Isogeny graph and lattice of orders in genus 2
![Page 63: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/63.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Isogeny graph and lattice of orders in genus 2
![Page 64: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/64.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Isogeny graph and lattice of orders in genus 2
![Page 65: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/65.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Isogeny graph and lattice of orders in genus 2
![Page 66: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/66.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Isogeny graph and lattice of orders in genus 2
![Page 67: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/67.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Isogeny graph and lattice of orders in genus 2
![Page 68: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/68.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Applications and perspectives
Modular polynomials in genus 2.
Isogenies using rational coordinates?
How to compute cyclic isogenies in genus 2?
Dimension 3.
![Page 69: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/69.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Thank you for your attention!
![Page 70: Algorithms on abelian varieties for cryptographyrobert/pro/publications/slides/2012-01-LIX-Paris.pdfPublic-keycryptography Abelianvarieties Thetafunctions Isogenies Examples Outline](https://reader030.vdocuments.us/reader030/viewer/2022041302/5e12782040d88214781b5556/html5/thumbnails/70.jpg)
Public-key cryptography Abelian varieties Theta functions Isogenies Examples
Bibliography[BF03] D. Boneh and M. Franklin. “Identity-based encryption from the Weil pairing”. In:
SIAM Journal on Computing 32.3 (2003), pp. 586–615 (cit. on p. 4).
[BLS04] D. Boneh, B. Lynn, and H. Shacham. “Short signatures from the Weil pairing”. In:Journal of Cryptology 17.4 (2004), pp. 297–319 (cit. on p. 4).
[GPS+06] V. Goyal, O. Pandey, A. Sahai, and B. Waters. “Attribute-based encryption forfine-grained access control of encrypted data”. In: Proceedings of the 13th ACMconference on Computer and communications security. ACM. 2006, p. 98 (cit. on p. 4).
[Jou04] A. Joux. “A one round protocol for tripartite Diffie–Hellman”. In: Journal ofCryptology 17.4 (2004), pp. 263–276 (cit. on p. 4).
[SW05] A. Sahai and B. Waters. “Fuzzy identity-based encryption”. In: Advances inCryptology–EUROCRYPT 2005 (2005), pp. 457–473 (cit. on p. 4).
[Ver01] E. Verheul. “Self-blindable credential certificates from the Weil pairing”. In:Advances in Cryptology—ASIACRYPT 2001 (2001), pp. 533–551 (cit. on p. 4).