arXiv subjects
Publications and source records attributed to François Morain.
The list of norm-Euclidean imaginary quadratic fields is known and finite. For each known case, we give a division algorithm that finds a remainder at distance less than the Euclidean minimum of the field.
We give a Euclidean division algorithm for the real quadratic fields $\mathbb{Q}(\sqrt{m})$ for $m \in \{2, 3, 6, 7, 11, 19\}$, with the property that the norm of the remainder depends on the first Euclidean minimum of the field. In each case, we cover the square $[-1/2, 1/2] \times [-1/2, 1/2]$ with hyperbolas and give a list of these, together with regions covered. We mechanize the proofs as much as we can, using exact computations, in order to be able to reproduce them.
Let $\mathcal{E}$ be an elliptic curve over a field $\mathbf{K}$ and $\ell$ a prime. There exists an elliptic curve $\mathcal{E}^*$ related to $\mathcal{E}$ by an isogeny of degree $\ell$ only if $Φ_\ell^t(X, j(\mathcal{E})) = 0$, where $Φ_\ell^t(X, Y)$ is the traditional modular polynomial. Moreover, $Φ_\ell^t$ gives the coefficients of $\mathcal{E}^*$, together with parameters needed to build the isogeny explicitly. Since $Φ_\ell^t$ has very large coefficients, many families with smaller coefficients can be used instead, as described by Elkies, Atkin and others. In this work, we concentrate on the computation of the family of modular polynomials introduced by Fricke and more recently used by Charlap, Coley and Robbins. In some cases, the resulting polynomials are small, which justifies the interest of this study. We review and adapt the known algorithms to perform the computations of these polynomials. After describing the use of series computations, we investigate fast algorithms using floating point numbers based on fast numerical evaluation of Eisenstein series. We also explain how to use isogeny volcanoes as an alternative. The last part is concerned with finding explicit formulas for computing the coefficients of $\mathcal{E}^*$. To this we add tables of numerical examples.
The SEA algorithm for computing the cardinality of elliptic curves over finite fields in many characteristic uses modular polynomials. These polynomials come into different flavors, and methods to compute them flourished. Once equipped with some modular polynomials for prime $\ell$, algebraic formulas are used to compute a curve $\mathcal{E}^*/\mathbb{F}_q$ that is $\ell$-isogenous to the curve of interest $\mathcal{E}$. These formulas involve derivatives of the modular polynomial that may sometime vanish. One way to overcome this problem is to use alternative trivariate polynomials $U_\ell$, $V_\ell$, and $W_\ell$ introduced by Charlap, Coley and Robbins to overcome some difficulties in the first versions of Elkies's approach. We give properties of these polynomials, as well as formulas to compute the isogenous curve that were sketched by Atkin. Also we investigate another suggestion of Atkin using modular polynomials associated to a power product of Dedekind's $η$ function.
Let $\mathcal{E}$ be an elliptic curve over a field $K$ and $\ell$ a prime. There exists an elliptic curve $\mathcal{E}^*$ related to $\mathcal{E}$ by anisogeny (rational map that is also a group homomorphisms) of degree $\ell$ if and only $Φ_\ell(X, j(\mathcal{E})) = 0$, where $Φ_\ell(X, Y)$ is the traditional modular polynomial. Moreover, the modular polynomial gives the coefficients of $\mathcal{E}^*$, together with parameters needed to build the isogeny explicitly. Since the traditional modular polynomial has large coefficients, many families with smaller coefficients can be used instead, as described by Elkies, Atkin and others. In this work, we concentrate on the computation of the family of modular polynomials introduced by Charlap, Coley and Robbins. It has the advantage of giving directly the coefficients of $\mathcal{E}^*$ as roots of these polynomials. We review and adapt the known algorithms to perform the computations of modular polynomials. After describing the use of series computations, we investigate fast algorithms using floating point numbers based on fast numerical evaluation of Eisenstein series. We also explain how to use isogeny volcanoes as an alternative.
We propose various strategies for improving the computation of discrete logarithms in non-prime fields of medium to large characteristic using the Number Field Sieve. This includes new methods for selecting the polynomials; the use of explicit automorphisms; explicit computations in the number fields; and prediction that some units have a zero virtual logarithm. On the theoretical side, we obtain a new complexity bound of $L_{p^n}(1/3,\sqrt[3]{96/9})$ in the medium characteristic case. On the practical side, we computed discrete logarithms in $F_{p^2}$ for a prime number $p$ with $80$ decimal digits.Warning: This unpublished version contains some inexact statements.
Shor's factoring algorithm (SFA), by its ability to efficiently factor large numbers, has the potential to undermine contemporary encryption. At its heart is a process called order finding, which quantum mechanics lets us perform efficiently. SFA thus consists of a \emph{quantum order finding algorithm} (QOFA), bookended by classical routines which, given the order, return the factors. But, with probability up to $1/2$, these classical routines fail, and QOFA must be rerun. We modify these routines using elementary results in number theory, improving the likelihood that they return the factors. The resulting quantum factoring algorithm is better than SFA at factoring safe semiprimes, an important class of numbers used in cryptography. With just one call to QOFA, our algorithm almost always factors safe semiprimes. As well as a speed-up, improving efficiency gives our algorithm other, practical advantages: unlike SFA, it does not need a randomly picked input, making it simpler to construct in the lab; and in the (unlikely) case of failure, the same circuit can be rerun, without modification. We consider generalizing this result to other cases, although we do not find a simple extension, and conclude that SFA is still the best algorithm for general numbers (non safe semiprimes, in other words). Even so, we present some simple number theoretic tricks for improving SFA in this case.
Pairing based cryptography is in a dangerous position following the breakthroughs on discrete logarithms computations in finite fields of small characteristic. Remaining instances are built over finite fields of large characteristic and their security relies on the fact that the embedding field of the underlying curve is relatively large. How large is debatable. The aim of our work is to sustain the claim that the combination of degree 3 embedding and too small finite fields obviously does not provide enough security. As a computational example, we solve the DLP on a 170-bit MNT curve, by exploiting the pairing embedding to a 508-bit, degree-3 extension of the base field.
We present a specialized point-counting algorithm for a class of elliptic curves over F\_{p^2} that includes reductions of quadratic Q-curves modulo inert primes and, more generally, any elliptic curve over F\_{p^2} with a low-degree isogeny to its Galois conjugate curve. These curves have interesting cryptographic applications. Our algorithm is a variant of the Schoof--Elkies--Atkin (SEA) algorithm, but with a new, lower-degree endomorphism in place of Frobenius. While it has the same asymptotic asymptotic complexity as SEA, our algorithm is much faster in practice.
A generalised Weber function is given by $\w_N(z) = η(z/N)/η(z)$, where $η(z)$ is the Dedekind function and $N$ is any integer; the original function corresponds to $N=2$. We classify the cases where some power $\w_N^e$ evaluated at some quadratic integer generates the ring class field associated to an order of an imaginary quadratic field. We compare the heights of our invariants by giving a general formula for the degree of the modular equation relating $\w_N(z)$ and $j(z)$. Our ultimate goal is the use of these invariants in constructing reductions of elliptic curves over finite fields suitable for cryptographic use.
Cheng and Wan have related the decoding of Reed-Solomon codes to the computation of discrete logarithms over finite fields, with the aim of proving the hardness of their decoding. In this work, we experiment with solving the discrete logarithm over GF(q^h) using Reed-Solomon decoding. For fixed h and q going to infinity, we introduce an algorithm (RSDL) needing O (h! q^2) operations over GF(q), operating on a q x q matrix with (h+2) q non-zero coefficients. We give faster variants including an incremental version and another one that uses auxiliary finite fields that need not be subfields of GF(q^h); this variant is very practical for moderate values of q and h. We include some numerical results of our first implementations.
The classical modular equations involve bivariate polynomials that can be seen to be univariate with coefficients in the modular invariant $j$. Kiepert found modular equations relating some $η$-quotients and the Weber functions $γ_2$ and $γ_3$. In the present work, we extend this idea to double $η$-quotients and characterize all the parameters leading to this kind of equation. We give some properties of these equations, explain how to compute them and give numerical examples.
Edwards curves are a particular form of elliptic curves that admit a fast, unified and complete addition law. Relations between Edwards curves and Montgomery curves have already been described. Our work takes the view of parameterizing elliptic curves given by their j-invariant, a problematic that arises from using curves with complex multiplication, for instance. We add to the catalogue the links with Kubert parameterizations of X0(2) and X0(4). We classify CM curves that admit an Edwards or Montgomery form over a finite field, and justify the use of isogenous curves when needed.
The elliptic curve primality proving (ECPP) algorithm is one of the current fastest practical algorithms for proving the primality of large numbers. Its running time cannot be proven rigorously, but heuristic arguments show that it should run in time O ((log N)^5) to prove the primality of N. An asymptotically fast version of it, attributed to J. O. Shallit, runs in time O ((log N)^4). The aim of this article is to describe this version in more details, leading to actual implementations able to handle numbers with several thousands of decimal digits.