Genus-2 curves and Jacobians with a given number of points

Bröker, Reinier; Howe, Everett W.; Lauter, Kristin; Stevenhagen, Peter

doi:10.1112/s1461157014000461

Cited by 21 publications

(55 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…quotients out by the action of E [3]. We may therefore identify this morphism with the multiplication-by-3 map on E. On the other hand, we find by direct calculation that the image takes the form (2) with t as specified in (4).…”

Section: Statement Of Resultsmentioning

confidence: 85%

“…where (i, j, k, l) is an even permutation of (1,2,3,4). Then specialising Λ at P = (a : b : c : d) ∈ X(9) gives a matrix whose rows (or columns) span the tangent line…”

Section: Statement Of Resultsmentioning

confidence: 99%

“…So for 3T = 0 we need a 2 = 0. For the last statement we note that ∆ = a 3 3 (a 3 1 − 27a 3 ) and E [3] has basis T = (0, 0) and T ′ = (3a 3 /(δ − a 1 ), a 3 (ζ 3 δ − a 1 )/(δ − a 1 )) where δ = 3 a 3 1 − 27a 3 . Lemma 4.2.…”

Section: Formulae In the Case Of A Rational 3-torsion Pointmentioning

confidence: 97%

“…For a ∈ K we write 3 √ a for the image of x in K[x]/(x 3 − a). Each equation involving 3 √ a in the next theorem is written as a short-hand for three equations,…”

Section: Formulae In the Case Of A Rational 3-torsion Pointmentioning

confidence: 99%

“…Finding equations for these modular curves can help with finding non-trivial pairs of n-congruent elliptic curves. Some of the potential applications are described in [1], [3], [8], [13], [19].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

On families of 9-congruent elliptic curves

Fisher

2015

Acta Arith.

View full text Add to dashboard Cite

show abstract

Section: Statement Of Resultsmentioning

confidence: 85%

“…where (i, j, k, l) is an even permutation of (1,2,3,4). Then specialising Λ at P = (a : b : c : d) ∈ X(9) gives a matrix whose rows (or columns) span the tangent line…”

Section: Statement Of Resultsmentioning

confidence: 99%

Section: Formulae In the Case Of A Rational 3-torsion Pointmentioning

confidence: 97%

“…For a ∈ K we write 3 √ a for the image of x in K[x]/(x 3 − a). Each equation involving 3 √ a in the next theorem is written as a short-hand for three equations,…”

Section: Formulae In the Case Of A Rational 3-torsion Pointmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

On families of 9-congruent elliptic curves

Fisher

2015

Acta Arith.

View full text Add to dashboard Cite

show abstract

A Direct Key Recovery Attack on SIDH

Maino

Martindale

Panny

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

We present an attack on SIDH utilising isogenies between polarized products of two supersingular elliptic curves. In the case of arbitrary starting curve, our attack (discovered independently from [8]) has subexponential complexity, thus significantly reducing the security of SIDH and SIKE. When the endomorphism ring of the starting curve is known, our attack (here derived from [8]) has polynomial-time complexity assuming the generalised Riemann hypothesis. Our attack applies to any isogeny-based cryptosystem that publishes the images of points under the secret isogeny, for example Séta [13] and B-SIDH [11]. It does not apply to CSIDH [9], CSI-FiSh [3], or SQISign [14].

show abstract

Efficient Computation of $$(3^n,3^n)$$-Isogenies

Decru

Kunzweiler

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The parametrization of (3, 3)-isogenies by Bruin, Flynn and Testa requires over 37.500 multiplications if one wants to evaluate a single isogeny in a point. We simplify their formulae and reduce the amount of required multiplications by 94%. Further we deduce explicit formulae for evaluating (3, 3)-splitting and gluing maps in the framework of the parametrization by Bröker, Howe, Lauter and Stevenhagen. We provide implementations to compute (3 n , 3 n )-isogenies between principally polarized abelian surfaces with a focus on cryptographic application. Our implementation can retrieve Alice's secret isogeny in 11 seconds for the SIKEp751 parameters, which were aimed at NIST level 5 security.standardization process for public key exchanges [23]. That same month however, Castryck and Decru published a devastating attack on SIKE, retrieving Bob's private key in minutes to hours depending on the security level [7]. Their attack relied on embedding elliptic curves into abelian surfaces, and used Kani's reducibility criterion [18] as part of their decisional oracle. The attack got improved by a quick series of follow-up works using a direct computational approach [22,24], and finally Robert managed to prove that even if the endomorphism ring of the starting curve in SIDH is unknown, there is always a polynomial-time attack by using abelian eightfolds [25].Despite these generalizations and the increasing interest in higher-dimensional cryptographic applications, most of the aforementioned implementations restrict themselves to isogenies of very low prime degree. The genus-2 version of the CGL hash function in [8] used (2, 2)-isogenies only, since they are by far easiest to compute. Kunzweiler improved further on these (2, 2)-isogeny formulae in [19], and Castyck and Decru provided a (3, 3)-version based on their multiradical isogeny setting [6]. The (now also broken) genus-2 variant of SIDH in [14] used (2, 2)and (3, 3)-isogenies to obtain a five-minute key exchange on the basic security level. The implementation of the attacks on SIKE in [7] and [22] only target Bob's private key, since this requires only using (2, 2)-isogenies. In [26], Santos, Costello and Frengley do manage to use up to (11, 11)-isogenies, but only as a decisional tool to detect (N, N )-split Jacobians.The reason for these restrictions is that computing isogenies between abelian surfaces is typically a lot harder than isogenies between elliptic curves. The general (ℓ, ℓ)-isogeny formulae by Cosset and Robert [12] have polynomial time complexity O(ℓ 2 ) or O(ℓ 4 ), depending on ℓ mod 4, but arithmetic has to be performed in the field extension where the theta coordinates are defined, which can turn expensive quickly for cryptographic purposes. The only other known general parametrization are the (3, 3)-isogeny formulae by Bruin, Flynn and Testa (BFT) [4], which were used as a basis for both the multiradical (3, 3)-hash function and the genus-2 variant of SIDH. The parametrization is complete, but the formulae require over 37.500 multiplications if on...

show abstract

Genus-2 curves and Jacobians with a given number of points

Cited by 21 publications

References 20 publications

On families of 9-congruent elliptic curves

On families of 9-congruent elliptic curves

A Direct Key Recovery Attack on SIDH

Efficient Computation of $$(3^n,3^n)$$-Isogenies

Contact Info

Product

Resources

About