An efficient computation of the commutator pairing Octobre 2010, - PowerPoint PPT Presentation

An efficient computation of the commutator pairing Octobre 2010, Réunion CHIC David Lubicz 1 , 2 , Damien Robert 3 1 CÉLAR 2 IRMAR, Université de Rennes 1 3 Nancy Université, CNRS, Inria Nancy Grand Est

Pairings and isogeny David Lubicz, Damien Robert Octobre 2010, Réunion CHIC The commutator pairing 2 / 1 Let f : A → B be an isogeny between two abelian varieties defined over an algebrically closed field k . f 0 0 K A B ˆ f ˆ ˆ ˆ 0 A B K 0 ˆ K is the Cartier dual of K . The isogeny f gives a pairing e f : K × ˆ K → k Let Q ∈ ˆ K . Q is a line bundle on B and ˆ f ( Q ) = f ∗ Q = 0 so f ∗ Q = ( g Q ) . e f ( P,Q ) = g Q ( x + P ) g Q ( x )

Pairings and isogeny David Lubicz, Damien Robert Octobre 2010, Réunion CHIC The commutator pairing 2 / 1 Let f : A → B be an isogeny between two abelian varieties defined over an algebrically closed field k . f 0 0 K A B ˆ f ˆ ˆ ˆ 0 A B K 0 ˆ K is the Cartier dual of K . The isogeny f gives a pairing e f : K × ˆ K → k Let Q ∈ ˆ K . Q is a line bundle on B and ˆ f ( Q ) = f ∗ Q = 0 so f ∗ Q = ( g Q ) . e f ( P,Q ) = g Q ( x + P ) g Q ( x )

Reformulations David Lubicz, Damien Robert Octobre 2010, Réunion CHIC The commutator pairing 3 / 1 ψ Q f ∗ Q O A ψ P e f ( P,Q ) τ ∗ P ψ Q τ ∗ P f ∗ Q τ ∗ P O A ( ψ P is the normalized isomorphism.) e f ( P,Q ) = g Q ( x + P ) g Q ( x ) Since ( g Q ) ℓ = ℓ ( g Q ) = ℓf ∗ Q = f ∗ lQ = f ∗ ( h Q ) = ( h Q ○ f ) , we see that e f ( P,Q ) m = 1 . Since f ∗ Q is trivial, by Grothendieck descent theory Q is the quotient of A × A 1 by an action of K . g x . ( t,λ ) = ( t + x,g 0 x ( t )( λ )) where the cocycle g 0 x is a character χ (Appell-Humbert). e f ( P,Q ) = χ ( P )

Reformulations David Lubicz, Damien Robert Octobre 2010, Réunion CHIC The commutator pairing 3 / 1 ψ Q f ∗ Q O A ψ P e f ( P,Q ) τ ∗ P ψ Q τ ∗ P f ∗ Q τ ∗ P O A ( ψ P is the normalized isomorphism.) e f ( P,Q ) = g Q ( x + P ) g Q ( x ) Since ( g Q ) ℓ = ℓ ( g Q ) = ℓf ∗ Q = f ∗ lQ = f ∗ ( h Q ) = ( h Q ○ f ) , we see that e f ( P,Q ) m = 1 . Since f ∗ Q is trivial, by Grothendieck descent theory Q is the quotient of A × A 1 by an action of K . g x . ( t,λ ) = ( t + x,g 0 x ( t )( λ )) where the cocycle g 0 x is a character χ (Appell-Humbert). e f ( P,Q ) = χ ( P )

Reformulations David Lubicz, Damien Robert Octobre 2010, Réunion CHIC The commutator pairing 3 / 1 ψ Q f ∗ Q O A ψ P e f ( P,Q ) τ ∗ P ψ Q τ ∗ P f ∗ Q τ ∗ P O A ( ψ P is the normalized isomorphism.) e f ( P,Q ) = g Q ( x + P ) g Q ( x ) Since ( g Q ) ℓ = ℓ ( g Q ) = ℓf ∗ Q = f ∗ lQ = f ∗ ( h Q ) = ( h Q ○ f ) , we see that e f ( P,Q ) m = 1 . Since f ∗ Q is trivial, by Grothendieck descent theory Q is the quotient of A × A 1 by an action of K . g x . ( t,λ ) = ( t + x,g 0 x ( t )( λ )) where the cocycle g 0 x is a character χ (Appell-Humbert). e f ( P,Q ) = χ ( P )

Pairings and polarization an isomorphism Octobre 2010, Réunion CHIC The commutator pairing David Lubicz, Damien Robert 4 / 1 Let L be a line bundle on A . The polarization f L : A → ˆ A is given by x L ⊗ L − 1 x ↦ τ ∗ We note K ( L ) the kernel of the polarization. We have ˆ f L = f L so e L is defined on K ( L ) × K ( L ) . The Theta group G ( L ) is the group { ( x,ψ x ) } where x ∈ K ( L ) and ψ x is ψ x : L → τ ∗ x L x ψ y ○ ψ x ) . The composition is given by ( y,ψ y ) . ( x,ψ x ) = ( y + x,τ ∗ G ( L ) is an Heisenberg group : k ∗ 1 G ( L ) K ( L ) 0

The commutator pairing David Lubicz, Damien Robert Octobre 2010, Réunion CHIC The commutator pairing 5 / 1 The following diagram is commutative up to a multiplication by e L ( P,Q ) : ψ P τ ∗ L P L τ ∗ ψ Q P ψ Q τ ∗ Q ψ P τ ∗ τ ∗ Q L P + Q L Let g P = ( P,ψ P ) ∈ G ( L ) and g Q = ( Q,ψ Q ) ∈ G ( L ) . e L ( P,Q ) = g P g Q g − 1 P g − 1 Q

The commutator pairing David Lubicz, Damien Robert Octobre 2010, Réunion CHIC The commutator pairing 5 / 1 The following diagram is commutative up to a multiplication by e L ( P,Q ) : ψ P τ ∗ L P L τ ∗ ψ Q P ψ Q τ ∗ Q ψ P τ ∗ τ ∗ Q L P + Q L Let g P = ( P,ψ P ) ∈ G ( L ) and g Q = ( Q,ψ Q ) ∈ G ( L ) . e L ( P,Q ) = g P g Q g − 1 P g − 1 Q

The Weil pairing We have the following diagram : Octobre 2010, Réunion CHIC The commutator pairing David Lubicz, Damien Robert Définition 6 / 1 associated to the polarization Let L 0 be a principal polarization on A . The Weil pairing e ℓ is the pairing [ ℓ ] L 0 ˆ A A A f ∗ M ˆ A A ˆ f f M ˆ B B This mean that e [ ℓ ] ∗ L 0 = e ℓ 2 and if ℓP ′ = P and ℓQ ′ = Q we have : e ℓ ( P,Q ) = e [ ℓ ] ∗ L 0 ( P ′ ,Q ′ ) ℓ

The Weil pairing We have the following diagram : Octobre 2010, Réunion CHIC The commutator pairing David Lubicz, Damien Robert Définition 6 / 1 associated to the polarization Let L 0 be a principal polarization on A . The Weil pairing e ℓ is the pairing [ ℓ ] L 0 ˆ A A A f ∗ M ˆ A A ˆ f f M ˆ B B This mean that e [ ℓ ] ∗ L 0 = e ℓ 2 and if ℓP ′ = P and ℓQ ′ = Q we have : e ℓ ( P,Q ) = e [ ℓ ] ∗ L 0 ( P ′ ,Q ′ ) ℓ

The extended commutator pairing David Lubicz, Damien Robert The commutator pairing Octobre 2010, Réunion CHIC 7 / 1 Let ( A, L ) be a polarized abelian variety of degree n . There exist a theta structure Θ n of level n such that the embedding A → P n g − 1 is given by the theta functions ( ϑ i ) i ∈Z n . We suppose that 4 ∣ n , and that n ∤ char k . Let ℓ be prime to n , P,Q ∈ A [ ℓ ] . Let P ′ ,Q ′ ∈ ( A, [ ℓ ] ∗ L ) be such that ℓP ′ = P , ℓQ ′ = Q . We want to compute e L ,ℓ ( P,Q ) = e [ ℓ ] ∗ L ( P ′ ,Q ′ ) ℓ

The addition relations (1) Octobre 2010, Réunion CHIC The commutator pairing David Lubicz, Damien Robert Théorème where 8 / 1 [ ∑ χ ( t ) ϑ i + t ( x + y ) ϑ j + t ( x − y ) [ . [ ∑ χ ( t ) ϑ k + t (0) ϑ l + t (0) [ = t ∈Z 2 t ∈Z 2 [ ∑ χ ( t ) ϑ − i ′ + t ( y ) ϑ j ′ + t ( y ) [ . [ ∑ χ ( t ) ϑ k ′ + t ( x ) ϑ l ′ + t ( x ) [ . t ∈Z 2 t ∈Z 2 ⎡ ⎡ 1 1 1 1 ⎢ ⎢ ⎢ ⎢ − 1 − 1 A = 1 ⎢ ⎢ 1 1 ⎢ ⎢ ⎢ − 1 − 1 ⎢ 1 1 2 ⎢ ⎢ ⎢ ⎢ − 1 − 1 1 1 ⎣ ⎣ χ ∈ ˆ Z 2 ,i,j,k,l ∈ Z n ( i ′ ,j ′ ,k ′ ,l ′ ) = A ( i,j,k,l )

Computing the pairing using chain additions Corollaire Octobre 2010, Réunion CHIC The commutator pairing David Lubicz, Damien Robert 9 / 1 ℓP = λ 0 0 A P 2 P ... P 0 A ℓP + Q = λ 1 P + Q 2 P + Q Q ... P Q 2 Q P + 2 Q ... ... ℓQ = λ 0 P + ℓQ = λ 1 Q 0 A Q P λ 1 P λ 0 Q e ℓ ( P,Q ) = λ 1 Q λ 0 P By using a Montgomery ladder, we can compute e ℓ ( P,Q ) with two fast addition chains of length ℓ , hence we need O ( log ( ℓ )) additions.

Computing the pairing using chain additions Corollaire Octobre 2010, Réunion CHIC The commutator pairing David Lubicz, Damien Robert 9 / 1 ℓP = λ 0 0 A P 2 P ... P 0 A ℓP + Q = λ 1 P + Q 2 P + Q Q ... P Q 2 Q P + 2 Q ... ... ℓQ = λ 0 P + ℓQ = λ 1 Q 0 A Q P λ 1 P λ 0 Q e ℓ ( P,Q ) = λ 1 Q λ 0 P By using a Montgomery ladder, we can compute e ℓ ( P,Q ) with two fast addition chains of length ℓ , hence we need O ( log ( ℓ )) additions.

The Tate pairing Hence the half pairing Corollaire We can compute the Tate pairing using half as many additions. David Lubicz, Damien Robert The commutator pairing Octobre 2010, Réunion CHIC 10 / 1 If we change P + Q by λ ( P + Q ) , ℓP + Q is changed by λ ℓ . e ( P,Q ) = λ 1 ∈ k ∗ /( k ∗ ) ℓ P λ 0 P

The Tate pairing Hence the half pairing Corollaire We can compute the Tate pairing using half as many additions. David Lubicz, Damien Robert The commutator pairing Octobre 2010, Réunion CHIC 10 / 1 If we change P + Q by λ ( P + Q ) , ℓP + Q is changed by λ ℓ . e ( P,Q ) = λ 1 ∈ k ∗ /( k ∗ ) ℓ P λ 0 P

The Kummer surface the symmetric pairing : 11 / Octobre 2010, Réunion CHIC The commutator pairing David Lubicz, Damien Robert 1 relations). Riemann equations but by some other equations from the addition (And the homogeneous equations of the embedding are not given by (Gaudry-Lubicz). If n = 2 , we have fast chain addition law in genus 1 and 2 The embedding given by the theta functions ( ϑ i ) i ∈Z 2 is the embedding of the Kummer surface K = A / ± 1 . Since P = − P and Q = − Q in K , the pairing e ℓ ( P,Q ) lives in k ∗ , ± 1 . e ℓ is compatible with the Z -structure on K and k ∗ , ± 1 . We represent a class { x, 1/ x } ∈ k ∗ , ± 1 by x + 1/ x ∈ k ∗ . We want to compute e ( P,Q ) = e ℓ ( P,Q ) + e ℓ ( − P,Q )

The Kummer surface the symmetric pairing : 11 / Octobre 2010, Réunion CHIC The commutator pairing David Lubicz, Damien Robert 1 relations). Riemann equations but by some other equations from the addition (And the homogeneous equations of the embedding are not given by (Gaudry-Lubicz). If n = 2 , we have fast chain addition law in genus 1 and 2 The embedding given by the theta functions ( ϑ i ) i ∈Z 2 is the embedding of the Kummer surface K = A / ± 1 . Since P = − P and Q = − Q in K , the pairing e ℓ ( P,Q ) lives in k ∗ , ± 1 . e ℓ is compatible with the Z -structure on K and k ∗ , ± 1 . We represent a class { x, 1/ x } ∈ k ∗ , ± 1 by x + 1/ x ∈ k ∗ . We want to compute e ( P,Q ) = e ℓ ( P,Q ) + e ℓ ( − P,Q )