## Annegret, Construction of CM Picard curves

Venue: | Math. Comp |

Citations: | 3 - 0 self |

### BibTeX

@ARTICLE{Koike_annegret,construction,

author = {Kenji Koike and Annegret Weng and Dedicated Professor and Rolf Peter Holzapfel},

title = {Annegret, Construction of CM Picard curves},

journal = {Math. Comp},

year = {},

pages = {499--518}

}

### OpenURL

### Abstract

Abstract. In this article we generalize the CM method for elliptic and hyperelliptic curves to Picard curves. We describe the algorithm in detail and discuss the results of our implementation. 1.

### Citations

1663 | Algebraic geometry - Hartshorne - 1977 |

696 |
Elliptic curve cryptosystems
- Koblitz
- 1987
(Show Context)
Citation Context ...gorithm in detail and discuss the results of our implementation. 1. Introduction The applications of elliptic and hyperelliptic curves over finite fields to cryptography have been studied intensively =-=[14, 20, 15]-=-. Recently, other kinds of curves proved to be suitable for cryptosystems. The most important examples are superelliptic, or more general Cab, curves [1, 7]. Since the discrete logarithm problem on a ... |

529 |
Uses of elliptic curves in cryptography
- Miller
- 1986
(Show Context)
Citation Context ...gorithm in detail and discuss the results of our implementation. 1. Introduction The applications of elliptic and hyperelliptic curves over finite fields to cryptography have been studied intensively =-=[14, 20, 15]-=-. Recently, other kinds of curves proved to be suitable for cryptosystems. The most important examples are superelliptic, or more general Cab, curves [1, 7]. Since the discrete logarithm problem on a ... |

494 | Introduction to the arithmetic theory of automorphic functions - Shimura - 1971 |

302 | An improved algorithm for computing logarithms over GF(p) and its cryptographic significance
- Pohlig, Hellman
(Show Context)
Citation Context ...ists an algorithm for an efficient addition law on the degree zero divisor class group, Pic 0 C(κ), of a Picard curve defined over a finite field κ = Fq [7, 29]. Because of the Pohlig-Hellmann attack =-=[27]-=-, the curve C defined over Fq should be chosen such that the order of Pic 0 C(Fq) contains a large prime factor. To tackle this problem, we need an efficient point counting algorithm for the curve C (... |

162 | Elliptic curves and primality proving
- Atkin, Morain
(Show Context)
Citation Context ...ethod for constructing Picard curves over large prime fields suitable for cryptography using complex multiplication. Note that the complex multiplication (CM) method is well-known for elliptic curves =-=[2, 3]-=-. Recently, this method has been extended to hyperelliptic curves of genus g ≤ 3 [34, 36, 37, 38]. We now describe the CM method from an abstract point of view. Given a CM field K with nK =[K : Q] ≤ 6... |

145 |
Hyperelliptic cryptosystems
- Koblitz
- 1989
(Show Context)
Citation Context ...gorithm in detail and discuss the results of our implementation. 1. Introduction The applications of elliptic and hyperelliptic curves over finite fields to cryptography have been studied intensively =-=[14, 20, 15]-=-. Recently, other kinds of curves proved to be suitable for cryptosystems. The most important examples are superelliptic, or more general Cab, curves [1, 7]. Since the discrete logarithm problem on a ... |

111 | On the arithmetic of abelian varieties - Milne - 1972 |

105 | Complex Abelian Varieties - Birkenhake - 1992 |

91 |
Abelian Varieties With Complex Multiplication And Modular Functions
- Shimura
- 1998
(Show Context)
Citation Context ...ltiplication by the maximal order OK in a CM field K. This is needed for the first step of the algorithm given in the introduction. We use the theory of complex multiplication by Shimura and Taniyama =-=[31]-=-. We summarize their results restricted to the case [K : Q] = 6 (for details see [31], but also [34, 36, 38]). Let K be a CM field of degree 6 with real subfield K0. A tuple (K, Φ) = (K, {ϕ1,ϕ2,ϕ3}) c... |

90 |
Point sets in projective space and theta functions, Astérisque, Volume 165
- Dolgachev, Ortland
- 1988
(Show Context)
Citation Context ...s given by 3P1 − 3P5. Hence α(P1) is a 3-torsion point of the Jacobian. Similarly we have α(P1),...,α(P4) ∈ JC[3]. From Theorem 4 we deduce that there must be 15 torsion points of the form ∆+α(D) ∈ JC=-=[6]-=- with D = P1 + P2 and α(D) ∈ JC[3] which lie in the zero locus of θ. Thesearegivenby α(D) ∈{α(2P1),α(P1 + P2),α(P1 + P3),α(P1 + P4),α(P1 + P5),α(2P2), α(P2 + P3),α(P2 + P4),α(P2 + P5),α(2P3),α(P3 + P4... |

81 |
Classes d’isogénie des variétés abéliennes sur un corps fini (d’après Honda
- Tate
- 1971
(Show Context)
Citation Context ...orresponding to w ∈OK, there exist only two more isomorphism classes of curves over Fp with the same j-invariant and Frobenius elements ζk 3 w, k =1, 2 (see Section 4.1). By the theorem of Honda-Tate =-=[13, 35]-=-, every element in SOK,p can be realized as the Frobenius of a principally polarized abelian variety over Fp. IfCis a Picard curve defined over Fp with g2g3 ̸= 0andwthe Frobenius of JC, we can constru... |

51 |
The number of points on an elliptic curve modulo a prime. manuscript
- Atkin
- 1988
(Show Context)
Citation Context ...ethod for constructing Picard curves over large prime fields suitable for cryptography using complex multiplication. Note that the complex multiplication (CM) method is well-known for elliptic curves =-=[2, 3]-=-. Recently, this method has been extended to hyperelliptic curves of genus g ≤ 3 [34, 36, 37, 38]. We now describe the CM method from an abstract point of view. Given a CM field K with nK =[K : Q] ≤ 6... |

39 |
Isogeny classes of abelian varieties over finite fields
- Honda
- 1968
(Show Context)
Citation Context ...orresponding to w ∈OK, there exist only two more isomorphism classes of curves over Fp with the same j-invariant and Frobenius elements ζk 3 w, k =1, 2 (see Section 4.1). By the theorem of Honda-Tate =-=[13, 35]-=-, every element in SOK,p can be realized as the Frobenius of a principally polarized abelian variety over Fp. IfCis a Picard curve defined over Fp with g2g3 ̸= 0andwthe Frobenius of JC, we can constru... |

37 | Arithmetic on super-elliptic curves
- Galbraith, Paulus, et al.
- 1998
(Show Context)
Citation Context ...ography have been studied intensively [14, 20, 15]. Recently, other kinds of curves proved to be suitable for cryptosystems. The most important examples are superelliptic, or more general Cab, curves =-=[1, 7]-=-. Since the discrete logarithm problem on a curve of genus g ≥ 4 turned out to be easier than on a curve of lower genus [8], we are restricted to curves of genus g ≤ 3. A cyclic trigonal curve of genu... |

37 |
Kurven vom Geschlecht 2 und ihre Anwendung in Public-KeyKryptosystemen
- Spallek
- 1994
(Show Context)
Citation Context ...using complex multiplication. Note that the complex multiplication (CM) method is well-known for elliptic curves [2, 3]. Recently, this method has been extended to hyperelliptic curves of genus g ≤ 3 =-=[34, 36, 37, 38]-=-. We now describe the CM method from an abstract point of view. Given a CM field K with nK =[K : Q] ≤ 6, set g = nK/2. In general the CM method can be described as follows: Received by the editor Febr... |

32 | Introduction to Algebraic and Abelian Functions - Lang - 1982 |

29 | Constructing hyperelliptic curves of genus 2 suitable for cryptography. Mathematics of Computation, 72(241):435–458, 2002. A Parameters produced by Algorithm 1 ( Here are some parameters found by Algorithm 1 for the CM field K = Q i √ 2− √ ) 2 and embeddi
- Weng
(Show Context)
Citation Context ...using complex multiplication. Note that the complex multiplication (CM) method is well-known for elliptic curves [2, 3]. Recently, this method has been extended to hyperelliptic curves of genus g ≤ 3 =-=[34, 36, 37, 38]-=-. We now describe the CM method from an abstract point of view. Given a CM field K with nK =[K : Q] ≤ 6, set g = nK/2. In general the CM method can be described as follows: Received by the editor Febr... |

27 |
User’s Guide to PARI-GP, by
- Batut, Belabas, et al.
- 1997
(Show Context)
Citation Context ... (Section 6) we give examples for Picard curves defined over Q and Fp with a Jacobian which has complex multiplication by a given CM field of degree 6. For the computations we used the C-library Pari =-=[5]-=- and Magma [19]. The authors thank the referee for valuable comments for improving the paper. 2. Definitions and basic facts 2.1. CM fields of Picard curves. In this section we construct all CM fields... |

23 | Complex Multiplication - Lang - 1983 |

20 | Examples of genus two CM curves defined over the rationals
- Wamelen
- 1999
(Show Context)
Citation Context ...using complex multiplication. Note that the complex multiplication (CM) method is well-known for elliptic curves [2, 3]. Recently, this method has been extended to hyperelliptic curves of genus g ≤ 3 =-=[34, 36, 37, 38]-=-. We now describe the CM method from an abstract point of view. Given a CM field K with nK =[K : Q] ≤ 6, set g = nK/2. In general the CM method can be described as follows: Received by the editor Febr... |

17 |
Principally polarized abelian varieties of dimension two or three are Jacobian varieties
- Oort, Ueno
- 1973
(Show Context)
Citation Context ...position 3 in [31, Section 14]). Moreover, A is isomorphic to the Jacobian variety of some curve C, sincethe principally polarized abelian varieties of dimension 3 are exactly the Jacobians of curves =-=[24]-=-. By Torelli’s Theorem, the curve C is uniquely determined by the principally polarized abelian variety A and we have Aut(C) is isomorphic to Aut(JC)/G where G is either trivial or {±1} (see, e.g., [2... |

16 |
An algorithm for solving the discrete logarithm problem on hyperelliptic curves
- Gaudry
- 2000
(Show Context)
Citation Context ...he most important examples are superelliptic, or more general Cab, curves [1, 7]. Since the discrete logarithm problem on a curve of genus g ≥ 4 turned out to be easier than on a curve of lower genus =-=[8]-=-, we are restricted to curves of genus g ≤ 3. A cyclic trigonal curve of genus g = 3 is called a Picard curve (see [25, 26, 12]). A Picard curve over a field κ is given by an affine equation of the fo... |

16 |
On the representation of the Picard modular function by θ constants
- Shiga
- 1988
(Show Context)
Citation Context ...ive an explicit formula which expresses the branch points of a Picard curve by theta functions. This formula goes back to Picard [25] and has already been worked out for a special symplectic basis in =-=[30]-=-. But since the period matrices constructed in Section 3 are in general not of a special form, we have to review the arguments in [25, 30] and give a more general formulation using geometric considera... |

15 | The Arithmetic of Certain Cubic Function Fields
- Bauer
(Show Context)
Citation Context ...ed up the computation. (5) For step (4)(b) we really need the arithmetic in the function field (resp. the divisor class group of degree zero) of the curve. Such algorithms can for example be found in =-=[4, 7, 29]-=-. (6) Note that all computations are only done up to some fixed precision. Hence, we do not have a rigorous mathematical proof for the claim that the resulting curve does really have complex multiplic... |

13 |
les fonctions de deux variables indépendentes analogues aux fonctions modulaires
- Picard, Sur
(Show Context)
Citation Context ... on a curve of genus g ≥ 4 turned out to be easier than on a curve of lower genus [8], we are restricted to curves of genus g ≤ 3. A cyclic trigonal curve of genus g = 3 is called a Picard curve (see =-=[25, 26, 12]-=-). A Picard curve over a field κ is given by an affine equation of the form y 3 = f(x), f ∈ κ[x], deg(f(x)) = 4, where f is a polynomial without multiple roots in κ. Ifκ contains the third roots of un... |

10 |
Explizite Bestimmung der Randflächen des Fundamentalbereiches der Modulgruppe zweiten Grades
- Gottschling
- 1959
(Show Context)
Citation Context ... up to a low precision, because we only want to know if they vanish. (4) It would be helpful to first apply Siegel reduction to the period matrix. Unfortunately, unlike in the case of dimension g = 2 =-=[10]-=-, no Siegel reduction algorithm for dimension 3 matrices is known. At least we should try to get a good approximation to a Siegel reduced matrix. This would speed up the computation. (5) For step (4)(... |

9 |
Topics in Complex Function Theory. Vol
- Siegel
(Show Context)
Citation Context ...he arguments in [25, 30] and give a more general formulation using geometric considerations. 4.2.1. Facts on theta functions. We first summarize some facts about theta functions. For more details see =-=[22, 33]-=-. Let δ, ε ∈ Qg . The theta function with characteristic (δ, ε) is the function θ [ δ ε ] (z,Ω) = ∑ n∈Z g exp ( πi(n + δ) t Ω(n + δ)+2πi(n + δ) t (z + ε) ) of (z,Ω) ∈ Cg × Hg, whereHg = {Ω ∈ Glg(C) :Ω... |

8 |
The ball and some Hilbert problems
- Holzapfel
- 1995
(Show Context)
Citation Context ... on a curve of genus g ≥ 4 turned out to be easier than on a curve of lower genus [8], we are restricted to curves of genus g ≤ 3. A cyclic trigonal curve of genus g = 3 is called a Picard curve (see =-=[25, 26, 12]-=-). A Picard curve over a field κ is given by an affine equation of the form y 3 = f(x), f ∈ κ[x], deg(f(x)) = 4, where f is a polynomial without multiple roots in κ. Ifκ contains the third roots of un... |

5 |
On unramified Galois extensions of real quadratic number fields, Osaka
- Yamamura
- 1986
(Show Context)
Citation Context ...s defined over the rationals, the CM field has to be a Galois extension of Q ([32, Proposition 5.17 (5)]). There are precisely five sextic normal CM fields with class number one containing Q(ζ3) (see =-=[39]-=-). For all fields we get a Picard curve defined over Q. For each example we give one model of the curve representing the isomorphism class over C. (1) Let K = K1 0(ζ3) whereK1 0 is given by y3 − 3y − ... |

4 |
Sur les formes quadratiques ternaires indéfinies à indéterminées conjuguées et sur les fonctions hyperfuchsiennes correspondantes
- Picard
(Show Context)
Citation Context ... on a curve of genus g ≥ 4 turned out to be easier than on a curve of lower genus [8], we are restricted to curves of genus g ≤ 3. A cyclic trigonal curve of genus g = 3 is called a Picard curve (see =-=[25, 26, 12]-=-). A Picard curve over a field κ is given by an affine equation of the form y 3 = f(x), f ∈ κ[x], deg(f(x)) = 4, where f is a polynomial without multiple roots in κ. Ifκ contains the third roots of un... |

3 |
Construction of secure Cab curves using modular curves. Algorithmic number theory
- Arita
- 2000
(Show Context)
Citation Context ...ography have been studied intensively [14, 20, 15]. Recently, other kinds of curves proved to be suitable for cryptosystems. The most important examples are superelliptic, or more general Cab, curves =-=[1, 7]-=-. Since the discrete logarithm problem on a curve of genus g ≥ 4 turned out to be easier than on a curve of lower genus [8], we are restricted to curves of genus g ≤ 3. A cyclic trigonal curve of genu... |

3 |
Efficient reduction on the Jacobian variety of Picard curves
- Reinaldo-Barreiro, Estrada-Sarlabous, et al.
- 1998
(Show Context)
Citation Context ...utomorphism of order 3 defined over κ. There exists an algorithm for an efficient addition law on the degree zero divisor class group, Pic 0 C(κ), of a Picard curve defined over a finite field κ = Fq =-=[7, 29]-=-. Because of the Pohlig-Hellmann attack [27], the curve C defined over Fq should be chosen such that the order of Pic 0 C(Fq) contains a large prime factor. To tackle this problem, we need an efficien... |

3 |
A class of hyperelliptic CM-curves of genus three
- Weng
(Show Context)
Citation Context |

2 |
An extension of Kedlaya’s algorithm to superelliptic curves
- Gaudry, Gurel
- 2001
(Show Context)
Citation Context ...factor. To tackle this problem, we need an efficient point counting algorithm for the curve C (or Pic 0 C (Fq)). For fields of small characteristic p this problem has been solved using p-adic methods =-=[9]-=-, but for large prime fields the question is still unanswered. In this paper, we consider an alternative method for constructing Picard curves over large prime fields suitable for cryptography using c... |

1 |
Integral matrices. Pure and applied mathematics
- Newman
- 1972
(Show Context)
Citation Context ...s u1, u2 or u1u2 is in U1, 4 if u1, u2 and u1u2 are not in U1. 7.2. Skew-symmetric matrices and Riemann forms. We show how to compute Frobenius bases for Riemann forms using an algorithm described in =-=[23]-=-. A skew-symmetric matrix of dimension 2n is a 2n × 2n matrix (aij)i,j with aij = −aji. Inparticular,aii =0foralli. Let V be a complex vector space of dimension n and let D be a lattice of full dimens... |

1 | Algorithmic Number Theory - Pohst, Zassenhaus - 1989 |