Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ such that a ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ such that a ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ such that a ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ such that a ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ such that a ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ such that a ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ such that a ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ such that a ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ such that a ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ such that a ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ a such that ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ a such that ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ a such that ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ a such that ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ a such that ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if there exist ☛ ✷ ❈ a such that ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if a there exist ☛ ✷ ❈ such that ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
Homotheties Two lattices are homothetic if a there exist ☛ ✷ ❈ such that ☛ ✄ 1 ❂ ✄ 2 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 12 / 82
The j -invariant We want to classify complex lattices/tori up to homothety. Eisenstein series Let ✄ be a complex lattice. For any integer k ❃ 0 define ❳ ✦ � 2 k ✿ G 2 k ✭✄✮ ❂ ✦ ✷ ✄ ♥❢ 0 ❣ Also set g 2 ✭✄✮ ❂ 60 G 4 ✭✄✮ ❀ g 3 ✭✄✮ ❂ 140 G 6 ✭✄✮ ✿ Modular j -invariant Let ✄ be a complex lattice, the modular j -invariant is g 2 ✭✄✮ 3 j ✭✄✮ ❂ 1728 g 2 ✭✄✮ 3 � 27 g 3 ✭✄✮ 2 ✿ Two lattices ✄ ❀ ✄ ✵ are homothetic if and only if j ✭✄✮ ❂ j ✭✄ ✵ ✮ . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 13 / 82
Elliptic curves over ❈ Weierstrass ⑥ function Let ✄ be a complex lattice, the Weierstrass ⑥ function associated to ✄ is the series ⑥ ✭ z ❀ ✄✮ ❂ 1 ✒ ✭ z � ✦ ✮ 2 � 1 1 ✓ ❳ z 2 ✰ ✿ ✦ 2 ✦ ✷ ✄ ♥❢ 0 ❣ Fix a lattice ✄ , then ⑥ and its derivative ⑥ ✵ are elliptic functions: ⑥ ✵ ✭ z ✰ ✦ ✮ ❂ ⑥ ✵ ✭ z ✮ ⑥ ✭ z ✰ ✦ ✮ ❂ ⑥ ✭ z ✮ ❀ for all ✦ ✷ ✄ . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 14 / 82
Uniformization theorem Let ✄ be a complex lattice. The curve E ✿ y 2 ❂ 4 x 3 � g 2 ✭✄✮ x � g 3 ✭✄✮ is an elliptic curve over ❈ . The map ❈ ❂ ✄ ✦ E ✭ ❈ ✮ ❀ 0 ✼✦ ✭ 0 ✿ 1 ✿ 0 ✮ ❀ z ✼✦ ✭ ⑥ ✭ z ✮ ✿ ⑥ ✵ ✭ z ✮ ✿ 1 ✮ is an isomorphism of Riemann surfaces and a group morphism. Conversely, for any elliptic curve E ✿ y 2 ❂ x 3 ✰ ax ✰ b there is a unique complex lattice ✄ such that g 2 ✭✄✮ ❂ � 4 a ❀ g 3 ✭✄✮ ❂ � 4 b ✿ Moreover j ✭✄✮ ❂ j ✭ E ✮ . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 15 / 82
❬ ❪ ❬ ❪ Multiplication a Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 16 / 82
❬ ❪ Multiplication ❬ 3 ❪ a a Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 16 / 82
❬ ❪ Multiplication ❬ 3 ❪ a a Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 16 / 82
Torsion subgroups The ❵ -torsion subgroup is made up by the points ✒ i ✦ 1 ❵ ❀ j ✦ 2 ✓ ❵ It is a group of rank two E ❬ ❵ ❪ ❂ ❤ a ❀ b ✐ b ✬ ✭ ❩ ❂❵ ❩ ✮ 2 a Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 17 / 82
Isogenies Let a ✷ ❈ ❂ ✄ 1 be an ❵ -torsion point, and let ✄ 2 ❂ a ❩ ✟ ✄ 1 Then ✄ 1 ✚ ✄ 2 and we define a degree p ❵ cover ✣ ✿ ❈ ❂ ✄ 1 ✦ ❈ ❂ ✄ 2 ✣ is a morphism of complex Lie a groups and is called an isogeny. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 18 / 82
Isogenies Let a ✷ ❈ ❂ ✄ 1 be an ❵ -torsion point, and let ✄ 2 ❂ a ❩ ✟ ✄ 1 Then ✄ 1 ✚ ✄ 2 and we define a degree p ❵ cover ✣ ✿ ❈ ❂ ✄ 1 ✦ ❈ ❂ ✄ 2 ✣ is a morphism of complex Lie a groups and is called an isogeny. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 18 / 82
Isogenies Let a ✷ ❈ ❂ ✄ 1 be an ❵ -torsion point, and let ✄ 2 ❂ a ❩ ✟ ✄ 1 Then ✄ 1 ✚ ✄ 2 and we define a degree ❵ cover p ✣ ✿ ❈ ❂ ✄ 1 ✦ ❈ ❂ ✄ 2 ✣ is a morphism of complex Lie a groups and is called an isogeny. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 18 / 82
Isogenies Taking a point b not in the kernel of ✣ , we obtain a new degree ❵ cover ❫ ✣ ✿ ❈ ❂ ✄ 2 ✦ ❈ ❂ ✄ 3 The composition ❫ ✣ ✍ ✣ has degree ❵ 2 p and is homothetic to the b multiplication by ❵ map. ❫ ✣ is called the dual isogeny of ✣ . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 18 / 82
Isogenies Taking a point b not in the kernel of ✣ , we obtain a new degree ❵ cover ❫ ✣ ✿ ❈ ❂ ✄ 2 ✦ ❈ ❂ ✄ 3 The composition ❫ ✣ ✍ ✣ has degree ❵ 2 p and is homothetic to the b multiplication by ❵ map. ❫ ✣ is called the dual isogeny of ✣ . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 18 / 82
Isogenies Taking a point b not in the kernel of ✣ , we obtain a new degree ❵ cover ❫ ✣ ✿ ❈ ❂ ✄ 2 ✦ ❈ ❂ ✄ 3 The composition ❫ ✣ ✍ ✣ has degree ❵ 2 and is homothetic to the b multiplication by ❵ p map. ❫ ✣ is called the dual isogeny of ✣ . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 18 / 82
Isogenies: back to algebra Let ✣ ✿ E ✦ E ✵ be an isogeny defined over a field k of characteristic p . k ✭ E ✮ is the field of all rational functions from E to k ; ✣ ✄ k ✭ E ✵ ✮ is the subfield of k ✭ E ✮ defined as ✣ ✄ k ✭ E ✵ ✮ ❂ ❢ f ✍ ✣ ❥ f ✷ k ✭ E ✵ ✮ ❣ ✿ Degree, separability The degree of ✣ is ❞❡❣ ✣ ❂ ❬ k ✭ E ✮ ✿ ✣ ✄ k ✭ E ✵ ✮❪ . It is always finite. 1 ✣ is said to be separable, inseparable, or purely inseparable if the 2 extension of function fields is. If ✣ is separable, then ❞❡❣ ✣ ❂ ★ ❦❡r ✣ . 3 If ✣ is purely inseparable, then ❦❡r ✣ ❂ ❢❖❣ and ❞❡❣ ✣ is a power of p . 4 Any isogeny can be decomposed as a product of a separable and a 5 purely inseparable isogeny. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 19 / 82
Isogenies: back to algebra Let ✣ ✿ E ✦ E ✵ be an isogeny defined over a field k of characteristic p . k ✭ E ✮ is the field of all rational functions from E to k ; ✣ ✄ k ✭ E ✵ ✮ is the subfield of k ✭ E ✮ defined as ✣ ✄ k ✭ E ✵ ✮ ❂ ❢ f ✍ ✣ ❥ f ✷ k ✭ E ✵ ✮ ❣ ✿ Degree, separability The degree of ✣ is ❞❡❣ ✣ ❂ ❬ k ✭ E ✮ ✿ ✣ ✄ k ✭ E ✵ ✮❪ . It is always finite. 1 ✣ is said to be separable, inseparable, or purely inseparable if the 2 extension of function fields is. If ✣ is separable, then ❞❡❣ ✣ ❂ ★ ❦❡r ✣ . 3 If ✣ is purely inseparable, then ❦❡r ✣ ❂ ❢❖❣ and ❞❡❣ ✣ is a power of p . 4 Any isogeny can be decomposed as a product of a separable and a 5 purely inseparable isogeny. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 19 / 82
Isogenies: separable vs inseparable Purely inseparable isogenies Examples: The Frobenius endomorphism is purely inseparable of degree q . All purely inseparable maps in characteristic p are of the form ✭ X ✿ Y ✿ Z ✮ ✼✦ ✭ X p e ✿ Y p e ✿ Z p e ✮ . Separable isogenies Let E be an elliptic curve, and let G be a finite subgroup of E . There are a unique elliptic curve E ✵ and a unique separable isogeny ✣ , such that ❦❡r ✣ ❂ G and ✣ ✿ E ✦ E ✵ . The curve E ✵ is called the quotient of E by G and is denoted by E ❂ G . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 20 / 82
The dual isogeny Let ✣ ✿ E ✦ E ✵ be an isogeny of degree m . There is a unique isogeny ✣ ✿ E ✵ ✦ E such that ❫ ❫ ✣ ✍ ❫ ✣ ✍ ✣ ❂ ❬ m ❪ E ❀ ✣ ❂ ❬ m ❪ E ✵ ✿ ❫ ✣ is called the dual isogeny of ✣ ; it has the following properties: ❫ ✣ is defined over k if and only if ✣ is; 1 ✥ for any isogeny ✥ ✿ E ✵ ✦ E ✵✵ ; ❬ ✥ ✍ ✣ ❂ ❫ ✣ ✍ ❫ 2 ✥ ✰ ✣ ❂ ❫ ❭ ✥ ✰ ❫ ✣ for any isogeny ✥ ✿ E ✦ E ✵ ; 3 ❞❡❣ ✣ ❂ ❞❡❣ ❫ ✣ ; 4 ❫ ❫ ✣ ❂ ✣ . 5 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 21 / 82
Algebras, orders A quadratic imaginary number field is an extension of ◗ of the form ♣ Q ❬ � D ❪ for some non-square D ❃ 0 . A quaternion algebra is an algebra of the form ◗ ✰ ☛ ◗ ✰ ☞ ◗ ✰ ☛☞ ◗ , where the generators satisfy the relations ☛ 2 ❀ ☞ 2 ✷ ◗ ❀ ☛ 2 ❁ 0 ❀ ☞ 2 ❁ 0 ❀ ☞☛ ❂ � ☛☞✿ Orders Let K be a finitely generated ◗ -algebra. An order ❖ ✚ K is a subring of K that is a finitely generated ❩ -module of maximal dimension. An order that is not contained in any other order of K is called a maximal order. Examples: ❩ is the only order contained in ◗ , ❩ ❬ i ❪ is the only maximal order of ◗ ✭ i ✮ , ♣ ♣ ❩ ❬ 5 ❪ is a non-maximal order of ◗ ✭ 5 ✮ , The ring of integers of a number field is its only maximal order, In general, maximal orders in quaternion algebras are not unique. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 22 / 82
The endomorphism ring The endomorphism ring ❊♥❞✭ E ✮ of an elliptic curve E is the ring of all isogenies E ✦ E (plus the null map) with addition and composition. Theorem (Deuring) Let E be an elliptic curve defined over a field k of characteristic p . ❊♥❞✭ E ✮ is isomorphic to one of the following: ❩ , only if p ❂ 0 E is ordinary. An order ❖ in a quadratic imaginary field: E is ordinary with complex multiplication by ❖ . Only if p ❃ 0 , a maximal order in a quaternion algebra a : E is supersingular. a (ramified at p and ✶ ) Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 23 / 82
The finite field case Theorem (Hasse) Let E be defined over a finite field. Its Frobenius endomorphism ✙ satisfies a quadratic equation ✙ 2 � t ✙ ✰ q ❂ 0 in ❊♥❞✭ E ✮ for some ❥ t ❥ ✔ 2 ♣ q , called the trace of ✙ . The trace t is coprime to q if and only if E is ordinary. Suppose E is ordinary, then D ✙ ❂ t 2 � 4 q ❁ 0 is the discriminant of ❩ ❬ ✙ ❪ . K ❂ ◗ ✭ ✙ ✮ ❂ ◗ ✭ ♣ D ✙ ✮ is the endomorphism algebra of E . Denote by ❖ K its ring of integers, then ❩ ✻ ❂ ❩ ❬ ✙ ❪ ✚ ❊♥❞✭ E ✮ ✚ ❖ K ✿ In the supersingular case, ✙ may or may not be in ❩ , depending on q . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 24 / 82
Endomorphism rings of ordinary curves Classifying quadratic orders Let K be a quadratic number field, and let ❖ K be its ring of integers. Any order ❖ ✚ K can be written as ❖ ❂ ❩ ✰ f ❖ K for an integer f , called the conductor of ❖ , denoted by ❬ ❖ k ✿ ❖ ❪ . If d K is the discriminant of K , the discriminant of ❖ is f 2 d K . If ❖ ❀ ❖ ✵ are two orders with discriminants d ❀ d ✵ , then ❖ ✚ ❖ ✵ iff d ✵ ❥ d . ❖ K ❩ ✰ 2 ❖ K ❩ ✰ 3 ❖ K ❩ ✰ 5 ❖ K ❩ ✰ 6 ❖ K ❩ ✰ 10 ❖ K ❩ ✰ 15 ❖ K ❩ ❬ ✙ ❪ ✬ ❩ ✰ 30 ❖ K Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 25 / 82
Ideal lattices Fractional ideals Let ❖ be an order of a number field K . A (fractional) ❖ -ideal a is a finitely generated non-zero ❖ -submodule of K . When K is imaginary quadratic: Fractional ideals are complex lattices, Any lattice ✄ ✚ K is a fractional ideal, The order of a lattice ✄ is ❖ ✄ ❂ ❢ ☛ ✷ K ❥ ☛ ✄ ✚ ✄ ❣ Complex multiplication Let ✄ ✚ K , the elliptic curve associated to ❈ ❂ ✄ has complex multiplication by ❖ ✄ . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 26 / 82
The class group ♣ Let ❊♥❞✭ E ✮ ❂ ❖ ✚ ◗ ✭ � D ✮ . Define ■ ✭ ❖ ✮ , the group of invertible fractional ideals, P ✭ ❖ ✮ , the group of principal ideals, The class group The class group of ❖ is ❈❧✭ ❖ ✮ ❂ ■ ✭ ❖ ✮ ❂ P ✭ O ✮ ✿ It is a finite abelian group. Its order h ✭ ❖ ✮ is called the class number of ❖ . ♣ It arises as the Galois group of an abelian extension of ◗ ✭ � D ✮ . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 27 / 82
Complex multiplication Fundamental theorem of CM Let ❖ be an order of a number field K , and let a 1 ❀ ✿ ✿ ✿ ❀ a h ✭ ❖ ✮ be representatives of ❈❧✭ ❖ ✮ . Then: K ✭ j ✭ a i ✮✮ is an Abelian extension of K ; The j ✭ a i ✮ are all conjugate over K ; The Galois group of K ✭ j ✭ a i ✮✮ is isomorphic to ❈❧✭ ❖ ✮ ; ❬ ◗ ✭ j ✭ a i ✮✮ ✿ ◗ ❪ ❂ ❬ K ✭ j ✭ a i ✮✮ ✿ K ❪ ❂ h ✭ ❖ ✮ ; The j ✭ a i ✮ are integral, their minimal polynomial is called the Hilbert class polynomial of ❖ . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 28 / 82
Lifing Deuring’s lifing theorem Let E 0 be an elliptic curve in characteristic p , with an endomorphism ✦ o which is not trivial. Then there exists an elliptic curve E defined over a number field L , an endomorphism ✦ of E , and a non-singular reduction of E at a place p of L lying above p , such that E 0 is isomorphic to E ✭ p ✮ , and ✦ 0 corresponds to ✦ ✭ p ✮ under the isomorphism. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 29 / 82
Executive summary Elliptic curves are algebraic groups; Isogenies are the natural notion of morphism for EC: both group and projective variety morphism; We can understand most things about isogenies by looking only at endomorphisms; Isogenies of curves over ❈ are especially simple to describe; It is easy to construct curves over ❈ with prescribed complex multiplication; Most of what happens in positive characteristic can be understood by: ■ looking at the Frobenius endomorphism, and/or ■ looking at reductions of curves in characteristic 0 . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 30 / 82
Plan Elliptic curves, isogenies, complex multiplication 1 Isogeny graphs 2 Key exchange 3 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 31 / 82
Isogeny graphs Serre-Tate theorem reloaded Two elliptic curves E ❀ E ✵ defined over a finite field are isogenous iff their endomorphism algebras ❊♥❞✭ E ✮ ✡ ◗ and ❊♥❞✭ E ✵ ✮ ✡ ◗ are isomorphic. Isogeny graphs Vertices are curves up to isomorphism, Edges are isogenies up to isomorphism. Isogeny volcanoes Curves are ordinary, Isogenies all have degree a prime ❵ . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 32 / 82
What do isogeny graphs look like? Torsion subgroups ( ❵ prime) In an algebraically closed field: E ❬ ❵ ❪ ❂ ❤ P ❀ Q ✐ ✬ ✭ ❩ ❂❵ ❩ ✮ 2 ✰ There are exactly ❵ ✰ 1 cyclic subgroups H ✚ E of order ❵ : ❤ P ✰ Q ✐ ❀ ❤ P ✰ 2 Q ✐ ❀ ✿ ✿ ✿ ❀ ❤ P ✐ ❀ ❤ Q ✐ ✰ There are exactly ❵ ✰ 1 distinct (non-CM) 2 -isogeny graph over ❈ isogenies of degree ❵ . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 33 / 82
✥ ✦ ✙ ✿ ♠♦❞ ❵ ✙ ❥ ❬ ❵ ❪ ●▲✭ ❩ ❂❵ ❩ ✮ What happens over a finite field ❋ p ? Rational isogenies ( ❵ ✻ ❂ p ) In the algebraic closure ✖ ❋ p E ❬ ❵ ❪ ❂ ❤ P ❀ Q ✐ ✬ ✭ ❩ ❂❵ ❩ ✮ 2 However, an isogeny is defined over ❋ p only if its kernel is Galois invariant. The Frobenius action on E ❬ ❵ ❪ Enter the Frobenius map ✙ ✭ P ✮ ❂ aP ✰ bQ ✙ ✿ E � ✦ E ✦ ✭ x p ❀ y p ✮ ✭ x ❀ y ✮ ✼� ✙ ✭ Q ✮ ❂ cP ✰ dQ E is seen here as a curve over ✖ ❋ p . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 34 / 82
✙ ✭ ✮ ❂ ✥ ✦ ✙ ✿ ♠♦❞ ❵ ✙ ✭ ✮ ❂ ✙ ❥ ❬ ❵ ❪ ●▲✭ ❩ ❂❵ ❩ ✮ What happens over a finite field ❋ p ? Rational isogenies ( ❵ ✻ ❂ p ) In the algebraic closure ✖ ❋ p E ❬ ❵ ❪ ❂ ❤ P ❀ Q ✐ ✬ ✭ ❩ ❂❵ ❩ ✮ 2 However, an isogeny is defined over ❋ p only if its kernel is Galois invariant. The Frobenius action on E ❬ ❵ ❪ Enter the Frobenius map aP ✰ bQ ✙ ✿ E � ✦ E ✦ ✭ x p ❀ y p ✮ ✭ x ❀ y ✮ ✼� cP ✰ dQ E is seen here as a curve over ✖ ❋ p . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 34 / 82
✙ ✭ ✮ ❂ ✙ ✿ ♠♦❞ ❵ ✙ ✭ ✮ ❂ ✙ ❥ ❬ ❵ ❪ ●▲✭ ❩ ❂❵ ❩ ✮ What happens over a finite field ❋ p ? Rational isogenies ( ❵ ✻ ❂ p ) In the algebraic closure ✖ ❋ p E ❬ ❵ ❪ ❂ ❤ P ❀ Q ✐ ✬ ✭ ❩ ❂❵ ❩ ✮ 2 However, an isogeny is defined over ❋ p only if its kernel is Galois invariant. The Frobenius action on E ❬ ❵ ❪ Enter the Frobenius map aP ✰ bQ ✥ ✦ ✙ ✿ E � ✦ E ✦ ✭ x p ❀ y p ✮ ✭ x ❀ y ✮ ✼� cP ✰ dQ E is seen here as a curve over ✖ ❋ p . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 34 / 82
✙ ✭ ✮ ❂ ✰ ✙ ✿ ♠♦❞ ❵ ✙ ✭ ✮ ❂ ✰ ✙ ❥ ❬ ❵ ❪ ●▲✭ ❩ ❂❵ ❩ ✮ What happens over a finite field ❋ p ? Rational isogenies ( ❵ ✻ ❂ p ) In the algebraic closure ✖ ❋ p E ❬ ❵ ❪ ❂ ❤ P ❀ Q ✐ ✬ ✭ ❩ ❂❵ ❩ ✮ 2 However, an isogeny is defined over ❋ p only if its kernel is Galois invariant. The Frobenius action on E ❬ ❵ ❪ Enter the Frobenius map ✥ a b ✦ ✙ ✿ E � ✦ E ✦ ✭ x p ❀ y p ✮ ✭ x ❀ y ✮ ✼� c d E is seen here as a curve over ✖ ❋ p . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 34 / 82
✙ ✭ ✮ ❂ ✰ ✙ ✭ ✮ ❂ ✰ ✙ ❥ ❬ ❵ ❪ ●▲✭ ❩ ❂❵ ❩ ✮ What happens over a finite field ❋ p ? Rational isogenies ( ❵ ✻ ❂ p ) In the algebraic closure ✖ ❋ p E ❬ ❵ ❪ ❂ ❤ P ❀ Q ✐ ✬ ✭ ❩ ❂❵ ❩ ✮ 2 However, an isogeny is defined over ❋ p only if its kernel is Galois invariant. The Frobenius action on E ❬ ❵ ❪ Enter the Frobenius map ✥ a b ✦ ✙ ✿ E � ✦ E ✙ ✿ ♠♦❞ ❵ ✦ ✭ x p ❀ y p ✮ ✭ x ❀ y ✮ ✼� c d E is seen here as a curve over ✖ ❋ p . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 34 / 82
✙ ✭ ✮ ❂ ✰ ✙ ✭ ✮ ❂ ✰ What happens over a finite field ❋ p ? Rational isogenies ( ❵ ✻ ❂ p ) In the algebraic closure ✖ ❋ p E ❬ ❵ ❪ ❂ ❤ P ❀ Q ✐ ✬ ✭ ❩ ❂❵ ❩ ✮ 2 However, an isogeny is defined over ❋ p only if its kernel is Galois invariant. The Frobenius action on E ❬ ❵ ❪ Enter the Frobenius map ✥ a b ✦ ✙ ✿ E � ✦ E ✙ ✿ ♠♦❞ ❵ ✦ ✭ x p ❀ y p ✮ ✭ x ❀ y ✮ ✼� c d We identify ✙ ❥ E ❬ ❵ ❪ to a conjugacy E is seen here as a curve over ✖ ❋ p . class in ●▲✭ ❩ ❂❵ ❩ ✮ . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 34 / 82
� ✕ ✙ ❥ ❬ ❵ ❪ ✘ ✁ ✦ ❵ ✰ ✕ ✏ ✑ ✕ ✙ ❥ ❬ ❵ ❪ ✘ ✕ ✻ ❂ ✖ ✦ ✖ � ✕ ✄ ✁ ✙ ❥ ❬ ❵ ❪ ✘ ✦ ✕ ❩ ❂❵ ❩ ✙ ❥ ❬ ❵ ❪ ✦ What happens over a finite field ❋ p ? Galois invariant subgroups of E ❬ ❵ ❪ = eigenspaces of ✙ ✷ ●▲✭ ❩ ❂❵ ❩ ✮ = rational isogenies of degree ❵ Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 35 / 82
What happens over a finite field ❋ p ? Galois invariant subgroups of E ❬ ❵ ❪ = eigenspaces of ✙ ✷ ●▲✭ ❩ ❂❵ ❩ ✮ = rational isogenies of degree ❵ How many Galois invariant subgroups? � ✕ 0 ✁ ✦ ❵ ✰ 1 isogenies ✙ ❥ E ❬ ❵ ❪ ✘ 0 ✕ ✏ ✑ ✕ 0 with ✕ ✻ ❂ ✖ ✦ two isogenies ✙ ❥ E ❬ ❵ ❪ ✘ 0 ✖ � ✕ ✄ ✁ ✙ ❥ E ❬ ❵ ❪ ✘ ✦ one isogeny 0 ✕ ✙ ❥ E ❬ ❵ ❪ is not diagonalizable over ❩ ❂❵ ❩ ✦ no isogeny Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 35 / 82
Volcanology (Kohel 1996) Let E ❀ E ✵ be curves with respective if ❖ ❂ ❖ ✵ , ✣ is horizontal; endomorphism rings ❖ ❀ ❖ ✵ ✚ K . if ❬ ❖ ✵ ✿ ❖ ❪ ❂ ❵ , ✣ is ascending; Let ✣ ✿ E ✦ E ✵ be an isogeny of if ❬ ❖ ✿ ❖ ✵ ❪ ❂ ❵ , ✣ is descending. prime degree ❵ , then: ❊♥❞✭ E ✮ ❖ K ❩ ❬ ✙ ❪ Ordinary isogeny volcano of degree ❵ ❂ 3 . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 36 / 82
✿ ❩ ❬ ✙ ❪❪✮ ❂ ❵ ✭❬ ❖ Volcanology (Kohel 1996) Let E be ordinary, ❊♥❞✭ E ✮ ✚ K . � D K � D K ✁ ✁ ❂ � 1 ❂ 0 ❖ K : maximal order of K , ❵ ❵ D K : discriminant of K . � D K ✁ ❂ ✰ 1 ❵ Horizontal Ascending Descending ✏ ✑ D K ❵ ✲ ❬ ❖ K ✿ ❖ ❪❪ ❵ ✲ ❬ ❖ ✿ ❩ ❬ ✙ ❪❪ 1 ✰ ❵ ✏ ✑ ✏ ✑ D K D K ❵ ✲ ❬ ❖ K ✿ ❖ ❪❪ ❵ ❥ ❬ ❖ ✿ ❩ ❬ ✙ ❪❪ 1 ✰ ❵ � ❵ ❵ ❵ ❥ ❬ ❖ ✿ ❩ ❬ ✙ ❪❪ ❵ ❥ ❬ ❖ K ✿ ❖ ❪❪ ❵ 1 ❵ ❥ ❬ ❖ K ✿ ❖ ❪❪ ❵ ✲ ❬ ❖ ✿ ❩ ❬ ✙ ❪❪ 1 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 37 / 82
Volcanology (Kohel 1996) Let E be ordinary, ❊♥❞✭ E ✮ ✚ K . � D K � D K ✁ ✁ ❂ � 1 ❂ 0 ❖ K : maximal order of K , ❵ ❵ D K : discriminant of K . Height ❂ v ❵ ✭❬ ❖ K ✿ ❩ ❬ ✙ ❪❪✮ . � D K ✁ ❂ ✰ 1 ❵ Horizontal Ascending Descending ✏ ✑ D K ❵ ✲ ❬ ❖ K ✿ ❖ ❪❪ ❵ ✲ ❬ ❖ ✿ ❩ ❬ ✙ ❪❪ 1 ✰ ❵ ✏ ✑ ✏ ✑ D K D K ❵ ✲ ❬ ❖ K ✿ ❖ ❪❪ ❵ ❥ ❬ ❖ ✿ ❩ ❬ ✙ ❪❪ 1 ✰ ❵ � ❵ ❵ ❵ ❥ ❬ ❖ ✿ ❩ ❬ ✙ ❪❪ ❵ ❥ ❬ ❖ K ✿ ❖ ❪❪ ❵ 1 ❵ ❥ ❬ ❖ K ✿ ❖ ❪❪ ❵ ✲ ❬ ❖ ✿ ❩ ❬ ✙ ❪❪ 1 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 37 / 82
Volcanology (Kohel 1996) Let E be ordinary, ❊♥❞✭ E ✮ ✚ K . � D K � D K ✁ ✁ ❂ � 1 ❂ 0 ❖ K : maximal order of K , ❵ ❵ D K : discriminant of K . Height ❂ v ❵ ✭❬ ❖ K ✿ ❩ ❬ ✙ ❪❪✮ . � D K How large is the crater? ✁ ❂ ✰ 1 ❵ Horizontal Ascending Descending ✏ ✑ D K ❵ ✲ ❬ ❖ K ✿ ❖ ❪❪ ❵ ✲ ❬ ❖ ✿ ❩ ❬ ✙ ❪❪ 1 ✰ ❵ ✏ ✑ ✏ ✑ D K D K ❵ ✲ ❬ ❖ K ✿ ❖ ❪❪ ❵ ❥ ❬ ❖ ✿ ❩ ❬ ✙ ❪❪ 1 ✰ ❵ � ❵ ❵ ❵ ❥ ❬ ❖ ✿ ❩ ❬ ✙ ❪❪ ❵ ❥ ❬ ❖ K ✿ ❖ ❪❪ ❵ 1 ❵ ❥ ❬ ❖ K ✿ ❖ ❪❪ ❵ ✲ ❬ ❖ ✿ ❩ ❬ ✙ ❪❪ 1 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 37 / 82
How large is the crater of a volcano? ♣ Let ❊♥❞✭ E ✮ ❂ ❖ ✚ ◗ ✭ � D ✮ . Define ■ ✭ ❖ ✮ , the group of invertible fractional ideals, P ✭ ❖ ✮ , the group of principal ideals, The class group The class group of ❖ is ❈❧✭ ❖ ✮ ❂ ■ ✭ ❖ ✮ ❂ P ✭ O ✮ ✿ It is a finite abelian group. Its order h ✭ ❖ ✮ is called the class number of ❖ . ♣ It arises as the Galois group of an abelian extension of ◗ ✭ � D ✮ . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 38 / 82
Complex multiplication The a -torsion Let a ✚ ❖ be an (integral invertible) ideal of ❖ ; Let E ❬ a ❪ be the subgroup of E annihilated by a : E ❬ a ❪ ❂ ❢ P ✷ E ❥ ☛ ✭ P ✮ ❂ 0 for all ☛ ✷ a ❣ ❀ Let ✣ ✿ E ✦ E a , where E a ❂ E ❂ E ❬ a ❪ . Then ❊♥❞✭ E a ✮ ❂ ❖ (i.e., ✣ is horizontal). Theorem (Complex multiplication) The action on the set of elliptic curves with complex multiplication by ❖ defined by a ✄ j ✭ E ✮ ❂ j ✭ E a ✮ factors through ❈❧✭ ❖ ✮ , is faithful and transitive. Corollary ✏ ✑ D Let ❊♥❞✭ E ✮ have discriminant D . Assume that ❂ 1 , then E is on a ❵ crater of size N of an ❵ -volcano, and N ❥ h ✭❊♥❞✭ E ✮✮ Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 39 / 82
❈❧✭ ❖ ✮ Complex multiplication graphs Vertices are elliptic curves with complex E 3 multiplication by ❖ K E 4 E 2 (i.e., ❊♥❞✭ E ✮ ✬ ❖ K ✚ ♣ ◗ ✭ � D ✮ ). E 5 E 1 E 6 E 12 E 7 E 11 E 8 E 10 E 9 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 40 / 82
❈❧✭ ❖ ✮ Complex multiplication graphs Vertices are elliptic curves with complex E 3 multiplication by ❖ K E 4 E 2 (i.e., ❊♥❞✭ E ✮ ✬ ❖ K ✚ ♣ ◗ ✭ � D ✮ ). Edges are horizontal E 5 E 1 isogenies of bounded prime degree. degree 2 E 6 E 12 E 7 E 11 E 8 E 10 E 9 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 40 / 82
❈❧✭ ❖ ✮ Complex multiplication graphs Vertices are elliptic curves with complex E 3 multiplication by ❖ K E 4 E 2 (i.e., ❊♥❞✭ E ✮ ✬ ❖ K ✚ ♣ ◗ ✭ � D ✮ ). Edges are horizontal E 5 E 1 isogenies of bounded prime degree. degree 2 E 6 E 12 degree 3 E 7 E 11 E 8 E 10 E 9 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 40 / 82
❈❧✭ ❖ ✮ Complex multiplication graphs Vertices are elliptic curves with complex E 3 multiplication by ❖ K E 4 E 2 (i.e., ❊♥❞✭ E ✮ ✬ ❖ K ✚ ♣ ◗ ✭ � D ✮ ). Edges are horizontal E 5 E 1 isogenies of bounded prime degree. degree 2 E 6 E 12 degree 3 E 7 E 11 degree 5 E 8 E 10 E 9 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 40 / 82
Complex multiplication graphs Vertices are elliptic curves with complex E 3 multiplication by ❖ K E 4 E 2 (i.e., ❊♥❞✭ E ✮ ✬ ❖ K ✚ ♣ ◗ ✭ � D ✮ ). Edges are horizontal E 5 E 1 isogenies of bounded prime degree. degree 2 E 6 E 12 degree 3 E 7 E 11 degree 5 Isomorphic to a Cayley E 8 E 10 graph of ❈❧✭ ❖ K ✮ . E 9 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 40 / 82
Supersingular endomorphisms Recall, a curve E over a field ❋ q of characteristic p is supersingular iff ✙ 2 � t ✙ ✰ q ❂ 0 with t ❂ 0 ♠♦❞ p . Case: t ❂ 0 ✮ D ✙ ❂ � 4 q Only possibility for E ❂ ❋ p , E ❂ ❋ p has CM by an order of ◗ ✭ ♣� p ✮ , similar to the ordinary case. t ❂ ✝ 2 ♣ q Case: ✮ D ✙ ❂ 0 General case for E ❂ ❋ q , when q is an even power. ✙ ❂ ✝♣ q , hence no complex multiplication. We will ignore marginal cases: t ❂ ✝♣ q ❀ ✝♣ 2 q ❀ ✝♣ 3 q . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 41 / 82
Supersingular complex multiplication Let E ❂ ❋ p be a supersingular curve, then ✙ 2 ❂ � p , and ✏ ♣� p ✑ 0 ✙ ❂ ♠♦❞ ❵ �♣� p 0 ✏ ✑ � p for any ❵ s.t. ❂ 1 . ❵ Theorem (Delfs and Galbraith 2016) Let ❊♥❞ ❋ p ✭ E ✮ denote the ring of ❋ p -rational endomorphisms of E . Then ❩ ❬ ✙ ❪ ✚ ❊♥❞ ❋ p ✭ E ✮ ✚ ◗ ✭ ♣� p ✮ ✿ Orders of ◗ ✭ ♣� p ✮ If p ❂ 1 ♠♦❞ 4 , then ❩ ❬ ✙ ❪ is the maximal order. If p ❂ � 1 ♠♦❞ 4 , then ❩ ❬ ✙ ✰ 1 2 ❪ is the maximal order, and ❬ ❩ ❬ ✙ ✰ 1 2 ❪ ✿ ❩ ❬ ✙ ❪❪ ❂ 2 . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 42 / 82
Supersingular CM graphs 2 -volcanoes, p ❂ � 1 ♠♦❞ 4 ❩ ❬ ✙ ✰ 1 2 ❪ ❩ ❬ ✙ ❪ 2 -graphs, p ❂ 1 ♠♦❞ 4 ❩ ❬ ✙ ❪ ✏ ✑ � p All other ❵ -graphs are cycles of horizontal isogenies iff ❂ 1 . ❵ Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 43 / 82
The full endomorphism ring Theorem (Deuring) Let E be a supersingular elliptic curve, then E is isomorphic to a curve defined over ❋ p 2 ; Every isogeny of E is defined over ❋ p 2 ; Every endomorphism of E is defined over ❋ p 2 ; ❊♥❞✭ E ✮ is isomorphic to a maximal order in a quaternion algebra ramified at p and ✶ . In particular: If E is defined over ❋ p , then ❊♥❞ ❋ p ✭ E ✮ is strictly contained in ❊♥❞✭ E ✮ . Some endomorphisms do not commute! Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 44 / 82
An example The curve of j -invariant 1728 E ✿ y 2 ❂ x 3 ✰ x is supersingular over ❋ p iff p ❂ � 1 ♠♦❞ 4 . Endomorphisms ❊♥❞✭ E ✮ ❂ ❩ ❤ ✓❀ ✙ ✐ , with: ✙ the Frobenius endomorphism, s.t. ✙ 2 ❂ � p ; ✓ the map ✓ ✭ x ❀ y ✮ ❂ ✭ � x ❀ iy ✮ ❀ where i ✷ ❋ p 2 is a 4-th root of unity. Clearly, ✓ 2 ❂ � 1 . And ✓✙ ❂ � ✙✓ . Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 45 / 82
❈❧✭ � ✮ ❂ ❈❧✭ � ✮ ❈❧✭ � ✮ ❈❧✭ � ✮ ❈❧✭ � ✮ Class group action party j ❂ 1728 Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Jul 29–Aug 2, 2019 — Würzburg 46 / 82
Recommend
More recommend
