How to prove a secret isogeny Luca De Feo Universit Paris Saclay - PowerPoint PPT Presentation

How to prove a secret isogeny Luca De Feo Université Paris Saclay – UVSQ, France June 4, 2019, CTCrypt, Svetlogorsk based on joint work with J. Burdges, S. Galbraith, S. Masson, C. Petit, A. Sanso Slides online at https://defeo.lu/docet/

Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 2 / 30 https://defeo.lu/docet

✱ ✣ ✵ ✦ ✦ ✦ ✦ What’s scalar multiplication? ❬ n ❪ ✿ P ✼✦ P ✰ P ✰ ✁ ✁ ✁ ✰ P ⑤ ④③ ⑥ n times A map E ✦ E , a group morphism, with finite kernel (the torsion group E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 ), surjective (in the algebraic closure), given by rational maps of degree n 2 . Luca De Feo (UVSQ) How to prove a secret isogeny 3 / 30 https://defeo.lu/docet

✱ ✣ ✵ ✦ ✦ ✦ ✦ What’s/////// scalar////////////////// multiplication an isogeny? ❬ n ❪ ✿ P ✼✦ P ✰ P ✰ ✁ ✁ ✁ ✰ P ⑤ ④③ ⑥ n times A map E ✦ E , a group morphism, with finite kernel (the torsion group E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 ), surjective (in the algebraic closure), given by rational maps of degree n 2 . Luca De Feo (UVSQ) How to prove a secret isogeny 3 / 30 https://defeo.lu/docet

✱ ✣ ✵ ✦ ✦ ✦ ✦ What’s/////// scalar////////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣ ✭ P ✮ A map E ✦ E , a group morphism, with finite kernel (the torsion group E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 ), surjective (in the algebraic closure), given by rational maps of degree n 2 . Luca De Feo (UVSQ) How to prove a secret isogeny 3 / 30 https://defeo.lu/docet

✱ ✣ ✵ ✦ ✦ ✦ ✦ What’s/////// scalar////////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣ ✭ P ✮ // E ✵ , A map E ✦ E a group morphism, with finite kernel (the torsion group E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 ), surjective (in the algebraic closure), given by rational maps of degree n 2 . Luca De Feo (UVSQ) How to prove a secret isogeny 3 / 30 https://defeo.lu/docet

✱ ✣ ✵ ✦ ✦ ✦ ✦ What’s/////// scalar////////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣ ✭ P ✮ // E ✵ , A map E ✦ E a group morphism, with finite kernel E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 any finite subgroup H ✚ E ), (//// the///////// torsion//////// group ///////////////////// surjective (in the algebraic closure), given by rational maps of degree n 2 . Luca De Feo (UVSQ) How to prove a secret isogeny 3 / 30 https://defeo.lu/docet

✱ ✣ ✵ ✦ ✦ ✦ ✦ What’s/////// scalar////////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣ ✭ P ✮ // E ✵ , A map E ✦ E a group morphism, with finite kernel E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 any finite subgroup H ✚ E ), (//// the///////// torsion//////// group ///////////////////// surjective (in the algebraic closure), n 2 ★ H . given by rational maps of degree/// Luca De Feo (UVSQ) How to prove a secret isogeny 3 / 30 https://defeo.lu/docet

What’s/////// scalar////////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣ ✭ P ✮ // E ✵ , A map E ✦ E a group morphism, with finite kernel E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 any finite subgroup H ✚ E ), (//// the///////// torsion//////// group ///////////////////// surjective (in the algebraic closure), n 2 ★ H . given by rational maps of degree/// (Separable) isogenies ✱ finite subgroups: ✦ E ✵ ✦ 0 ✣ 0 ✦ H ✦ E Luca De Feo (UVSQ) How to prove a secret isogeny 3 / 30 https://defeo.lu/docet

✼✦ ❋ ✄ Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x ✥ ✦ x 2 ✰ 1 y x 2 � 1 ✣ ✭ x ❀ y ✮ ❂ ❀ x 2 x Luca De Feo (UVSQ) How to prove a secret isogeny 4 / 30 https://defeo.lu/docet

Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x Kernel generator in red. ✥ ✦ x 2 ✰ 1 y x 2 � 1 This is a degree 2 map. ✣ ✭ x ❀ y ✮ ❂ ❀ x 2 x Analogous to x ✼✦ x 2 in ❋ ✄ q . Luca De Feo (UVSQ) How to prove a secret isogeny 4 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ Up to isomorphism R Q P P ✰ Q y 2 ❂ x 3 ✰ ax ✰ b 4 a 3 � ✦ j ✑ 1728 4 a 3 ✰ 27 b 2 Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism R Q P P ✰ Q Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ❂ ✰ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✣ ❂ ✰ ❂ ✰ ✰ � ✦ ✑ ❂ ✰ Up to isomorphism Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✰ ❂ ✰ ✰ � ✦ ✑ ✰ ✣ ❂ Up to isomorphism j ❂ 1728 Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

✰ ❂ ✰ ✰ � ✦ ✑ ✰ Up to isomorphism ✣ j ❂ 1728 j ❂ 287496 Luca De Feo (UVSQ) How to prove a secret isogeny 5 / 30 https://defeo.lu/docet

Isogeny graphs ✣ We look at the graph of elliptic curves with E E ✵ isogenies up to isomorphism. We say two isogenies ✣❀ ✣ ✵ are isomorphic if: ❡ ✣ ✵ E ✵ Example: Finite field, ordinary case, graph of isogenies of degree 3 . Luca De Feo (UVSQ) How to prove a secret isogeny 6 / 30 https://defeo.lu/docet

The graph of isogenies of prime degree ❵ ✻ ❂ p All graphs are undirected (dual isogeny theorem). Nodes can have degree 0 ❀ 1 ❀ 2 or ❵ ✰ 1 . Ordinary ■ For ✘ 50 ✪ of the primes ❵ , graphs are just isolated case points; (isogeny ■ For other ✘ 50 ✪ , graphs are 2 -regular; volcanoes) ■ other cases only happen for finitely many ❵ ’s. If ❵ ❂ 2 nodes have degree 1 , 2 or 3 ; Supersingular For ✘ 50 ✪ of ❵ , graphs are isolated points; case ( ❋ p ) For other ✘ 50 ✪ , graphs are 2 -regular; The graph is ❵ ✰ 1 -regular. Supersingular There is a unique (finite) connected component made case ( ❋ p 2 ) of all supersingular curves with the same number of points. Luca De Feo (UVSQ) How to prove a secret isogeny 7 / 30 https://defeo.lu/docet