## Counting Points on Hyperelliptic Curves over Finite Fields (0)

Citations: | 58 - 7 self |

### BibTeX

@INPROCEEDINGS{Gaudry_countingpoints,

author = {Pierrick Gaudry and Robert Harley},

title = {Counting Points on Hyperelliptic Curves over Finite Fields},

booktitle = {},

year = {},

pages = {313--332},

publisher = {Springer-Verlag}

}

### Years of Citing Articles

### OpenURL

### Abstract

. We describe some algorithms for computing the cardinality of hyperelliptic curves and their Jacobians over finite fields. They include several methods for obtaining the result modulo small primes and prime powers, in particular an algorithm `a la Schoof for genus 2 using Cantor 's division polynomials. These are combined with a birthday paradox algorithm to calculate the cardinality. Our methods are practical and we give actual results computed using our current implementation. The Jacobian groups we handle are larger than those previously reported in the literature. Introduction In recent years there has been a surge of interest in algorithmic aspects of curves. When presented with any curve, a natural task is to compute the number of points on it with coordinates in some finite field. When the finite field is large this is generally difficult to do. Ren'e Schoof gave a polynomial time algorithm for counting points on elliptic curves i.e., those of genus 1, in his ground-...

### Citations

536 |
A Classical Introduction to Modern Number Theory, Second Edition
- Ireland, Rosen
- 1990
(Show Context)
Citation Context ...l.inria.fr/~harley/hyper/ 2 Frobenius Endomorphism In this section we collect some useful results and quote them without proof. A starting point for the reader interested in pursuing this material is =-=[IR82]-=- and the references therein. We first describe properties of the q--power Frobenius endomorphism OE(x) = x q . Note that it has no effect on elements of F q but it becomes non-trivial in 6 Pierrick Ga... |

302 | An improved algorithm for computing logarithms over GF(p) and its cryptographic significance
- Pohlig, Hellman
(Show Context)
Citation Context ...ng cryptosystems [Kob89]. To build such a cryptosystem, it is first desirable to check that the group order has a large prime factor since otherwise the logarithm could be computed in small subgroups =-=[PH78]-=-. We restrict ourselves to odd characteristic for simplicity. We will work with models of odd degree where arithmetic is analogous to that of imaginary quadratic fields. For the even degree alternativ... |

230 |
Monte Carlo methods for index computation (mod p
- Pollard
- 1978
(Show Context)
Citation Context ...ultiples of n in the search interval (since the group order is one such) and we can find one of them using a birthday paradox algorithm, in particular a distributed version of Pollard's lambda method =-=[Pol78]-=- with distinguished points. For a similar Pollard rho method see [vOW99]. Since the width of the search interval is w, we expect to determine the multiple after O( p w) operations in the Jacobian. By ... |

189 |
A remark concerning m-divisibility and the discrete logarithm in the divisor class group of curves
- Frey, Rück
- 1994
(Show Context)
Citation Context ...ithms 2 Pierrick Gaudry and Robert Harley in the Jacobian groups of these curves. In low genus, no sub-exponential algorithms are currently known, except for some very thin sets of examples ([Ruc99], =-=[FR94]-=-) and hence the Jacobian group of a random curve is likely to be suitable for constructing cryptosystems [Kob89]. To build such a cryptosystem, it is first desirable to check that the group order has ... |

170 |
Elliptic curves over finite fields and the computation of square roots mod p
- Schoof
- 1985
(Show Context)
Citation Context ... the finite field is large this is generally difficult to do. Ren'e Schoof gave a polynomial time algorithm for counting points on elliptic curves i.e., those of genus 1, in his ground-breaking paper =-=[Sch85]-=-. Subsequent improvements by Elkies and Atkin ([Sch95], [Mor95], [Elk98]) lowered the exponent to the point where efficient implementations became possible. After further improvements ([Cou96], [Ler97... |

155 |
Computing in Jacobian of a Hyperelliptic Curve,” in
- Cantor
- 1987
(Show Context)
Citation Context ...ds. By using Mumford's notation we can work entirely in the field of definition of the divisors. 1.2 Group Law in Mumford's Notation Cantor gave two forms of the group law using Mumford's notation in =-=[Can87]-=-. One was a direct analogue of Gauss's reduction of binary quadratic forms of 3 In a more classical treatment the reduction would be described as choosing a representative for an equivalence class of ... |

146 | Parallel Collision Search with Cryptanalytic Applications
- Oorschot, Wiener
- 1999
(Show Context)
Citation Context ... and we can find one of them using a birthday paradox algorithm, in particular a distributed version of Pollard's lambda method [Pol78] with distinguished points. For a similar Pollard rho method see =-=[vOW99]-=-. Since the width of the search interval is w, we expect to determine the multiple after O( p w) operations in the Jacobian. By using distinguished points and distributing the computation on M machine... |

145 |
Hyperelliptic cryptosystems
- Koblitz
- 1989
(Show Context)
Citation Context ...ial algorithms are currently known, except for some very thin sets of examples ([Ruc99], [FR94]) and hence the Jacobian group of a random curve is likely to be suitable for constructing cryptosystems =-=[Kob89]-=-. To build such a cryptosystem, it is first desirable to check that the group order has a large prime factor since otherwise the logarithm could be computed in small subgroups [PH78]. We restrict ours... |

136 |
Endomorphisms of abelian varieties over finite fields
- Tate
- 1966
(Show Context)
Citation Context ...e a prime power co-prime with the characteristic. Then the subgroup of l--torsion points has the structure J[l] = (Z=lZ) 2g . Moreover, the Frobenius acts linearly on this subgroup and Tate's theorem =-=[Tat66]-=- states that the characteristic polynomial of the induced endomorphism is precisely the characteristic polynomial of the Frobenius endomorphism on J with its coefficients reduced modulo l. Hence by co... |

126 |
Handbook of Magma functions
- Bosma, Cannon
- 1996
(Show Context)
Citation Context ...ented all these algorithms and tested their performance for real computation. Some of them were written in the C programming language, and others were implemented in the Magma computer algebra system =-=[BC97]-=-. 7.1 Prime Field In the case where the curve is defined over a prime field F p , where p is a large prime, we use all the methods described in previous sections except for CartierManin. We give some ... |

82 | Counting points on elliptic curves over finite fields
- Schoof
- 1995
(Show Context)
Citation Context ... to do. Ren'e Schoof gave a polynomial time algorithm for counting points on elliptic curves i.e., those of genus 1, in his ground-breaking paper [Sch85]. Subsequent improvements by Elkies and Atkin (=-=[Sch95]-=-, [Mor95], [Elk98]) lowered the exponent to the point where efficient implementations became possible. After further improvements ([Cou96], [Ler97]) several implementations of the Schoof-ElkiesAtkin a... |

58 |
Elliptic and modular curves over finite fields and related computational issues
- Elkies
- 1997
(Show Context)
Citation Context ...of gave a polynomial time algorithm for counting points on elliptic curves i.e., those of genus 1, in his ground-breaking paper [Sch85]. Subsequent improvements by Elkies and Atkin ([Sch95], [Mor95], =-=[Elk98]-=-) lowered the exponent to the point where efficient implementations became possible. After further improvements ([Cou96], [Ler97]) several implementations of the Schoof-ElkiesAtkin algorithm were actu... |

50 |
Frobenius maps of abelian varieties and finding roots of unity in finite fields
- Pila
- 1990
(Show Context)
Citation Context ...lly written and very large finite fields can now be handled in practice ([Mor95], [Ver99]). For higher genus, significant theoretical progress was made by Pila who gave a polynomial time algorithm in =-=[Pil90]-=- (see also [HI98]). However to date these methods have not been developed as extensively as the elliptic case. As a first step towards closing this gap it is fruitful to concentrate on low genus hyper... |

45 |
Primality Testing And Abelian Varieties Over Finite Fields (Springer-Verlag
- Adleman, Huang
- 1992
(Show Context)
Citation Context ... two possible applications of the ability to count points on low genus hyperelliptic curves. An early theoretical application was the proof that primality testing is in probabilistic polynomial time, =-=[AH92]-=-. A practical application results from the apparent difficulty of computing discrete logarithms 2 Pierrick Gaudry and Robert Harley in the Jacobian groups of these curves. In low genus, no sub-exponen... |

36 |
Calcul du nombre de points sur une courbe elliptique dans un corps fini: aspects algorithmiques, Journal de Théorie des Nombres de Bordeaux 7
- Morain
- 1995
(Show Context)
Citation Context ...en'e Schoof gave a polynomial time algorithm for counting points on elliptic curves i.e., those of genus 1, in his ground-breaking paper [Sch85]. Subsequent improvements by Elkies and Atkin ([Sch95], =-=[Mor95]-=-, [Elk98]) lowered the exponent to the point where efficient implementations became possible. After further improvements ([Cou96], [Ler97]) several implementations of the Schoof-ElkiesAtkin algorithm ... |

28 |
On the analogue of the division polynomials for hyperelliptic curves
- Cantor
- 1994
(Show Context)
Citation Context ...or computing the cardinality of J=F q in genus 2. This algorithm follows theoretical work of Pila [Pil90] and Kampkotter [Kam91]. We make extensive use of the division polynomials described by Cantor =-=[Can94]-=-. 5.1 Hyperelliptic Analogue of Schoof's Algorithm The hyperelliptic analogue of Schoof's algorithm consists of computingsmodulo some small primes l by working in J[l]. Once this has been done, modulo... |

26 |
On the discrete logarithms in the divisor of class group of curves
- Ruck
- 1999
(Show Context)
Citation Context ...ete logarithms 2 Pierrick Gaudry and Robert Harley in the Jacobian groups of these curves. In low genus, no sub-exponential algorithms are currently known, except for some very thin sets of examples (=-=[Ruc99]-=-, [FR94]) and hence the Jacobian group of a random curve is likely to be suitable for constructing cryptosystems [Kob89]. To build such a cryptosystem, it is first desirable to check that the group or... |

25 | Introductory lectures on Siegel modular forms, volume 20 of Cambridge studies in advanced mathematics - Klingen - 1990 |

20 | Computing parametric geometric resolutions
- Schost
(Show Context)
Citation Context ...ugging its coefficients into the generic basis to get the specialized one. We are indebted to Eric Schost who kindly performed the construction of this generic Grobner basis for the curves we studied =-=[Sch]-=-. For his construction, he made use of the Kronecker package [Lec99] written by Gr'egoire Lecerf. This package behaves very well on these types of problem (lifting from specialized systems to generic ... |

18 |
Une nouvelle opération sur les formes différentielles
- Cartier
- 1957
(Show Context)
Citation Context ...od for calculating the order of the Jacobian modulo the characteristic p of the base field, by using the so-called Cartier-Manin operator and its concrete representation as the Hasse-Witt matrix (see =-=[Car57]-=-). In the case of hyperelliptic curves, this g \Theta g matrix can be computed by a method given in [Yui78] which generalizes the computation of the Hasse invariant for elliptic curves. Yui's result i... |

18 |
Algorithmique des courbes elliptiques dans les corps finis
- Lercier
- 1997
(Show Context)
Citation Context ...Sch85]. Subsequent improvements by Elkies and Atkin ([Sch95], [Mor95], [Elk98]) lowered the exponent to the point where efficient implementations became possible. After further improvements ([Cou96], =-=[Ler97]-=-) several implementations of the Schoof-ElkiesAtkin algorithm were actually written and very large finite fields can now be handled in practice ([Mor95], [Ver99]). For higher genus, significant theore... |

14 |
The Hasse-Witt matrix of an algebraic curve
- Manin
- 1965
(Show Context)
Citation Context ...1 be the equation of a genus g hyperelliptic curve. Denote by c i the coefficient of x i in the polynomial f(x) (p\Gamma1)=2 . Then the Hasse-Witt matrix is given by A = (c ip\Gammaj ) 1i;jg : (7) In =-=[Man65]-=-, Manin relates it to the characteristic polynomial of the Frobenius modulo p. For a matrix A = (a ij ), let A (p) denote the elementwise p--th power i.e., (a p ij ). Then Manin proved the following r... |

13 |
Computing l-isogenies using the p-torsion
- Couveignes
- 1996
(Show Context)
Citation Context ...g paper [Sch85]. Subsequent improvements by Elkies and Atkin ([Sch95], [Mor95], [Elk98]) lowered the exponent to the point where efficient implementations became possible. After further improvements (=-=[Cou96]-=-, [Ler97]) several implementations of the Schoof-ElkiesAtkin algorithm were actually written and very large finite fields can now be handled in practice ([Mor95], [Ver99]). For higher genus, significa... |

13 |
Counting points on curves over finite fields
- Huang, Ierardi
- 1998
(Show Context)
Citation Context ...ry large finite fields can now be handled in practice ([Mor95], [Ver99]). For higher genus, significant theoretical progress was made by Pila who gave a polynomial time algorithm in [Pil90] (see also =-=[HI98]-=-). However to date these methods have not been developed as extensively as the elliptic case. As a first step towards closing this gap it is fruitful to concentrate on low genus hyperelliptic curves, ... |

9 |
lectures on theta II, volume 43
- Tata
- 1984
(Show Context)
Citation Context ...not possible on the curve itself directly. This group law is denoted by + and will be described in the next section. A convenient representation of reduced (and semi-reduced) divisors, due to Mumford =-=[Mum84]-=-, uses a pair of polynomials hu(x); v(x)i. Here u(x) = Q i (x \Gamma x i ) and v(x) interpolates the points P i respecting multiplicities. More precisely v = 0 or deg v ! deg u, and u divides f \Gamma... |

5 | Siegelsche Modulfunktionen, volume 254 of Grundlehren der Mathematischen Wissenschaften - Freitag - 1983 |

5 |
Explizite Gleichungen für Jacobische Varietäten hyperelliptischer Kurven
- Kampkotter
- 1991
(Show Context)
Citation Context ...a Schoof In this section we describe a polynomial time algorithm `a la Schoof for computing the cardinality of J=F q in genus 2. This algorithm follows theoretical work of Pila [Pil90] and Kampkotter =-=[Kam91]-=-. We make extensive use of the division polynomials described by Cantor [Can94]. 5.1 Hyperelliptic Analogue of Schoof's Algorithm The hyperelliptic analogue of Schoof's algorithm consists of computing... |

5 |
On the Jacobian varietes of hyperelliptic curves over fields of characteristic p > 2
- Yui
- 1978
(Show Context)
Citation Context ...-called Cartier-Manin operator and its concrete representation as the Hasse-Witt matrix (see [Car57]). In the case of hyperelliptic curves, this g \Theta g matrix can be computed by a method given in =-=[Yui78]-=- which generalizes the computation of the Hasse invariant for elliptic curves. Yui's result is as follows: Theorem 1. Let y 2 = f(x) with deg f = 2g +1 be the equation of a genus g hyperelliptic curve... |

4 | Catching kangaroos in function fields
- Stein, Teske
- 1999
(Show Context)
Citation Context ...ll work with models of odd degree where arithmetic is analogous to that of imaginary quadratic fields. For the even degree alternative, which is similar to real quadratic fields, see the recent paper =-=[ST99]-=- which describes a birthday paradox algorithm optimized using an analogue of Shanks' infrastructure. Our contribution contains several complementary approaches to the problem of finding the size of Ja... |

1 | On modular equations in genus 2 - Harley |

1 |
EC(GF(21999)). E-mail message to the NMBRTHRY list
- Vercauteren
- 1999
(Show Context)
Citation Context .... After further improvements ([Cou96], [Ler97]) several implementations of the Schoof-ElkiesAtkin algorithm were actually written and very large finite fields can now be handled in practice ([Mor95], =-=[Ver99]-=-). For higher genus, significant theoretical progress was made by Pila who gave a polynomial time algorithm in [Pil90] (see also [HI98]). However to date these methods have not been developed as exten... |