Results 1  10
of
22
Construction of secure random curves of genus 2 over prime fields
 Advances in Cryptology – EUROCRYPT 2004, volume 3027 of Lecture Notes in Comput. Sci
, 2004
"... Abstract. For counting points of Jacobians of genus 2 curves defined over large prime fields, the best known method is a variant of Schoof’s algorithm. We present several improvements on the algorithms described by Gaudry and Harley in 2000. In particular we rebuild the symmetry that had been broken ..."
Abstract

Cited by 37 (12 self)
 Add to MetaCart
Abstract. For counting points of Jacobians of genus 2 curves defined over large prime fields, the best known method is a variant of Schoof’s algorithm. We present several improvements on the algorithms described by Gaudry and Harley in 2000. In particular we rebuild the symmetry that had been broken by the use of Cantor’s division polynomials and design a faster division by 2 and a division by 3. Combined with the algorithm by Matsuo, Chao and Tsujii, our implementation can count the points on a Jacobian of size 164 bits within about one week on a PC. 1
Fast algorithms for polynomial solutions of linear differential equations
 In Proceedings of ISSAC’05
, 2005
"... Si l’on se bornait à demander les intégrales entières, le problème n’offrirait aucune difficulté. 1 Joseph Liouville, 1833. We investigate polynomial solutions of homogeneous linear differential equations with coefficients that are polynomials with integer coefficients. The problems we consider are ..."
Abstract

Cited by 12 (4 self)
 Add to MetaCart
Si l’on se bornait à demander les intégrales entières, le problème n’offrirait aucune difficulté. 1 Joseph Liouville, 1833. We investigate polynomial solutions of homogeneous linear differential equations with coefficients that are polynomials with integer coefficients. The problems we consider are the existence of nonzero polynomial solutions, the determination of the dimension of the vector space of polynomial solutions, the computation of a basis of this space. Previous algorithms have a bit complexity that is at least quadratic in an integer N (that can be computed from the equation), even for merely detecting the existence of nonzero polynomial solutions. We give a deterministic algorithm that computes a compact representation of a basis of polynomial solutions in O(N log 3 N) bit operations. We also give a probabilistic algorithm that computes the dimension of the space of polynomial solutions in O ( √ N log 2 N) bit operations. In general, the integer N is not bounded polynomially in the bit size of the input differential equation. We isolate a class of equations for which detecting nonzero polynomial solutions can be performed in polynomial complexity. We discuss implementation issues and possible extensions.
Differential equations for algebraic functions
 ISSAC’07: Proceedings of the 2007 international symposium on Symbolic and algebraic computation
, 2007
"... Abstract. It is classical that univariate algebraic functions satisfy linear differential equations with polynomial coefficients. Linear recurrences follow for the coefficients of their power series expansions. We show that the linear differential equation of minimal order has coefficients whose deg ..."
Abstract

Cited by 12 (5 self)
 Add to MetaCart
Abstract. It is classical that univariate algebraic functions satisfy linear differential equations with polynomial coefficients. Linear recurrences follow for the coefficients of their power series expansions. We show that the linear differential equation of minimal order has coefficients whose degree is cubic in the degree of the function. We also show that there exists a linear differential equation of order linear in the degree whose coefficients are only of quadratic degree. Furthermore, we prove the existence of recurrences of order and degree close to optimal. We study the complexity of computing these differential equations and recurrences. We deduce a fast algorithm for the expansion of algebraic series. 1.
Kedlaya’s algorithm in larger characteristic
 Universitd Joseph Fourier (Grenoble
, 2007
"... We show that the linear dependence on p of the running time of Kedlaya’s pointcounting algorithm in characteristic p may be reduced to p1/2. 1 ..."
Abstract

Cited by 11 (2 self)
 Add to MetaCart
We show that the linear dependence on p of the running time of Kedlaya’s pointcounting algorithm in characteristic p may be reduced to p1/2. 1
Faster Algorithms for Approximate Common Divisors: Breaking FullyHomomorphicEncryption Challenges over the Integers
 In Eurocrypto 2012
"... At EUROCRYPT ’10, van Dijk, Gentry, Halevi and Vaikuntanathan presented simple fullyhomomorphic encryption (FHE) schemes based on the hardness of approximate integer common divisors problems, which were introduced in 2001 by HowgraveGraham. There are two versions for these problems: the partial ve ..."
Abstract

Cited by 9 (0 self)
 Add to MetaCart
At EUROCRYPT ’10, van Dijk, Gentry, Halevi and Vaikuntanathan presented simple fullyhomomorphic encryption (FHE) schemes based on the hardness of approximate integer common divisors problems, which were introduced in 2001 by HowgraveGraham. There are two versions for these problems: the partial version (PACD) and the general version (GACD). The seemingly easier problem PACD was recently used by Coron, Mandal, Naccache and Tibouchi at CRYPTO ’11 to build a more efficient variant of the FHE scheme by van Dijk et al.. We present a new PACD algorithm whose running time is essentially the “square root ” of that of exhaustive search, which was the best attack in practice. This allows us to experimentally break the FHE challenges proposed by Coron et al. Our PACD algorithm directly gives rise to a new GACD algorithm, which is exponentially faster than exhaustive search: namely, the running time is essentially the 3/4th root of that of exhaustive search. Interestingly, our main technique can also be applied to other settings, such as noisy factoring, fault attacks on CRTRSA signatures, and attacking lowexponent RSA encryption. 1
Low complexity algorithms for linear recurrences
 ISSAC’06: Proceedings of the 2006 International Symposium on Symbolic and Algebraic Computation
, 2006
"... We consider two kinds of problems: the computation of polynomial and rational solutions of linear recurrences with coefficients that are polynomials with integer coefficients; indefinite and definite summation of sequences that are hypergeometric over the rational numbers. The algorithms for these t ..."
Abstract

Cited by 5 (0 self)
 Add to MetaCart
We consider two kinds of problems: the computation of polynomial and rational solutions of linear recurrences with coefficients that are polynomials with integer coefficients; indefinite and definite summation of sequences that are hypergeometric over the rational numbers. The algorithms for these tasks all involve as an intermediate quantity an integer N (dispersion or root of an indicial polynomial) that is potentially exponential in the bit size of their input. Previous algorithms have a bit complexity that is at least quadratic in N. We revisit them and propose variants that exploit the structure of solutions and avoid expanding polynomials of degree N. We give two algorithms: a probabilistic one that detects the existence or absence of nonzero polynomial and rational solutions in O ( √ N log 2 N) bit operations; a deterministic one that computes a compact representation of the solution in O(N log 3 N) bit operations. Similar speedups are obtained in indefinite and definite hypergeometric summation. We describe the results of an implementation.
and Tsujii’s algorithm
, 2010
"... Abstract. We present an algorithm based on the birthday paradox, which is a lowmemory parallel counterpart to the algorithm of Matsuo, Chao and Tsujii. This algorithm computes the group order of the Jacobian of a genus 2 curve over a finite field for which the characteristic polynomial of the Frobe ..."
Abstract
 Add to MetaCart
Abstract. We present an algorithm based on the birthday paradox, which is a lowmemory parallel counterpart to the algorithm of Matsuo, Chao and Tsujii. This algorithm computes the group order of the Jacobian of a genus 2 curve over a finite field for which the characteristic polynomial of the Frobenius endomorphism is known modulo some integer. The main tool is a 2dimensional pseudorandom walk that allows to heuristically choose random elements in a 2dimensional space. We analyze the expected running time based on heuristics that we validate by computer experiments. Compared with the original algorithm by Matsuo, Chao and Tsujii, we lose a factor of about 3 in running time, but the memory requirement drops from several GB to almost nothing. Our method is general and can be applied in other contexts to transform a babystep giantstep approach into a low memory algorithm. 1