Exploring Isogeny Graphs Around the Volcano in 2 80 Days Luca De Feo - PowerPoint PPT Presentation

Exploring Isogeny Graphs Around the Volcano in 2 80 Days Luca De Feo hand drawings by Rachel Deyts Université Paris Saclay – UVSQ Dec 14, 2018, UVSQ, Versailles

✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... An algebraic curve, Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 2 / 38

Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... R Q P An algebraic curve, A group. P ✰ Q Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 2 / 38

Why should I care? (Diffie–Hellman key exchange) Goal: Alice and Bob have never met before. They are chatting over a public channel, and want to agree on a shared secret to start a private conversation. Setup: They agree on a (large) cyclic group E ✭ ❋ p ✮ ❂ ❤ P ✐ of (prime) order q . Alice Bob pick random a ✷ ❩ ❂ q ❩ pick random b ✷ ❩ ❂ q ❩ compute A ❂ ❬ a ❪ P compute B ❂ ❬ b ❪ P A B Shared secret is ❬ a ❪ B ❂ ❬ ab ❪ P ❂ ❬ b ❪ A Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 3 / 38

Why should I care? But, also: Elliptic Curve Factoring Method (Lenstra ’85); Elliptic Curve Primality Proving (Atkin, Morain ’86-’93); Efficient normal bases for finite fields (Couveignes, Lercier ’10); ... Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 4 / 38

Why should I care? R Q P P ✰ Q Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 5 / 38

✰ Why should I care? Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 5 / 38

✰ Why should I care? Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 5 / 38

✰ Why should I care? Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 5 / 38

✰ Why should I care? Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 5 / 38

✰ Why should I care? Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 5 / 38

Elliptic curves I power 70% of WWW traffic! Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 6 / 38

✱ ✣ ✵ ✦ � ✦ � ✦ � ✦ ✵ ✵ ✿ ❂ ❂ What is scalar multiplication? ❬ n ❪ ✿ P ✼✦ P ✰ P ✰ ✁ ✁ ✁ ✰ P ⑤ ④③ ⑥ n times A map E ✦ E , a group morphism, with finite kernel (the torsion group E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 ), surjective (in the algebraic closure), given by rational maps of degree n 2 . Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 7 / 38

✱ ✣ ✵ ✦ � ✦ � ✦ � ✦ ✵ ✵ ✿ ❂ ❂ What is /////// scalar///////////////// multiplication an isogeny? ❬ n ❪ ✿ P ✼✦ P ✰ P ✰ ✁ ✁ ✁ ✰ P ⑤ ④③ ⑥ n times A map E ✦ E , a group morphism, with finite kernel (the torsion group E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 ), surjective (in the algebraic closure), given by rational maps of degree n 2 . Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 7 / 38

✱ ✣ ✵ ✦ � ✦ � ✦ � ✦ ✵ ✵ ✿ ❂ ❂ What is /////// scalar///////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣ ✭ P ✮ A map E ✦ E , a group morphism, with finite kernel (the torsion group E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 ), surjective (in the algebraic closure), given by rational maps of degree n 2 . Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 7 / 38

✱ ✣ ✵ ✦ � ✦ � ✦ � ✦ ✵ ✵ ✿ ❂ ❂ What is /////// scalar///////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣ ✭ P ✮ // E ✵ , A map E ✦ E a group morphism, with finite kernel (the torsion group E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 ), surjective (in the algebraic closure), given by rational maps of degree n 2 . Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 7 / 38

✱ ✣ ✵ ✦ � ✦ � ✦ � ✦ ✵ ✵ ✿ ❂ ❂ What is /////// scalar///////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣ ✭ P ✮ // E ✵ , A map E ✦ E a group morphism, with finite kernel E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 any finite subgroup H ✚ E ), (//// the///////// torsion//////// group ///////////////////// surjective (in the algebraic closure), given by rational maps of degree n 2 . Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 7 / 38

✱ ✣ ✵ ✦ � ✦ � ✦ � ✦ ✵ ✵ ✿ ❂ ❂ What is /////// scalar///////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣ ✭ P ✮ // E ✵ , A map E ✦ E a group morphism, with finite kernel E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 any finite subgroup H ✚ E ), (//// the///////// torsion//////// group ///////////////////// surjective (in the algebraic closure), n 2 ★ H . given by rational maps of degree/// Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 7 / 38

What is /////// scalar///////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣ ✭ P ✮ // E ✵ , A map E ✦ E a group morphism, with finite kernel E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 any finite subgroup H ✚ E ), (//// the///////// torsion//////// group ///////////////////// surjective (in the algebraic closure), n 2 ★ H . given by rational maps of degree/// (Separable) isogenies ✱ finite subgroups: ✣ ✦ E ✵ ✦ 0 0 � ✦ H � ✦ E � The kernel H determines the image curve E ✵ up to isomorphism def ❂ E ✵ ✿ E ❂ H Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 7 / 38

✼✦ ❋ ✄ Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x ✥ ✦ x 2 ✰ 1 y x 2 � 1 ✣ ✭ x ❀ y ✮ ❂ ❀ x 2 x Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 8 / 38

Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x Kernel generator in red. ✥ ✦ x 2 ✰ 1 y x 2 � 1 This is a degree 2 map. ✣ ✭ x ❀ y ✮ ❂ ❀ x 2 x Analogous to x ✼✦ x 2 in ❋ ✄ q . Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 8 / 38

❵ ✚ ❵ ⑦ ✭ ❵ ✮ Computing Isogenies Vélu’s formulas Input: A subgroup H ✚ E , Output: The isogeny ✣ ✿ E ✦ E ❂ H . Complexity: O ✭ ❵ ✮ — Vélu 1971, ... Why? Evaluate isogeny on points P ✷ E ; Walk in isogeny graphs. Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 9 / 38

Computing Isogenies Vélu’s formulas Input: A subgroup H ✚ E , Output: The isogeny ✣ ✿ E ✦ E ❂ H . Complexity: O ✭ ❵ ✮ — Vélu 1971, ... Why? Evaluate isogeny on points P ✷ E ; Walk in isogeny graphs. Explicit Isogeny Problem Input: Curve E , (prime) integer ❵ Output: All subgroups H ✚ E of order ❵ . Complexity: ⑦ O ✭ ❵ 2 ✮ — Elkies 1992 Why? List all isogenies of given degree; Count points of elliptic curves; Compute endomorphism rings of elliptic curves; Walk in isogeny graphs. Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 9 / 38

❀ ✵ ✣ ✿ ✦ ✵ Computing Isogenies Explicit Isogeny Problem (2) Input: Curves E ❀ E ✵ , isogenous of degree ❵ . Output: The isogeny ✣ ✿ E ✦ E ✵ of degree ❵ . Complexity: O ✭ ❵ 2 ✮ — Elkies 1992; Couveignes 1996; Lercier and Sirvent 2008; De Feo 2011; De Feo, Hugounenq, Plût, and Éric Schost 2016; Lairez and Vaccon 2016, ... Why? Count points of elliptic curves. Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 10 / 38

Computing Isogenies Explicit Isogeny Problem (2) Input: Curves E ❀ E ✵ , isogenous of degree ❵ . Output: The isogeny ✣ ✿ E ✦ E ✵ of degree ❵ . Complexity: O ✭ ❵ 2 ✮ — Elkies 1992; Couveignes 1996; Lercier and Sirvent 2008; De Feo 2011; De Feo, Hugounenq, Plût, and Éric Schost 2016; Lairez and Vaccon 2016, ... Why? Count points of elliptic curves. Isogeny Walk Problem Input: Isogenous curves E ❀ E ✵ . Output: An isogeny ✣ ✿ E ✦ E ✵ of smooth degree. Complexity: Generically hard — Galbraith, Hess, and Smart 2002, ... Why? Cryptanalysis (ECC); Foundational problem for isogeny-based cryptography. Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 10 / 38

Isogeny graphs ✣ We look at the graph of elliptic curves with E E ✵ isogenies up to isomorphism. We say two isogenies ✣❀ ✣ ✵ are isomorphic if: ❡ ✣ ✵ E ✵ Example: Finite field, ordinary case, graph of isogenies of degree 3 . Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 11 / 38

What do isogeny graphs look like? Torsion subgroups ( ❵ prime) In an algebraically closed field: E ❬ ❵ ❪ ❂ ❤ P ❀ Q ✐ ✬ ✭ ❩ ❂❵ ❩ ✮ 2 ✰ There are exactly ❵ ✰ 1 cyclic subgroups H ✚ E of order ❵ : ❤ P ✐ ❀ ❤ P ✰ Q ✐ ❀ ✿ ✿ ✿ ❤ P ✰ ✭ ❵ � 1 ✮ Q ✐ ✰ There are exactly ❵ ✰ 1 distinct (non-CM) 2 -isogeny graph over ❈ isogenies of degree ❵ . Luca De Feo (UVSQ) Exploring Isogeny Graphs Dec 14, 2018, UVSQ, Versailles 12 / 38