Computing the height of volcanoes of ℓ-isogenies of elliptic curves over finite fields

Miret, Josep M.; Moreno, Ramiro; Sadornil, Daniel; Tena, Juan Guillermo Lohmann Luca de; Valls, Magda

doi:10.1016/j.amc.2007.05.037

Cited by 7 publications

(14 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In some cases, if the ℓ-torsion is not defined over F q , it may be preferable to replace the curve by its twist, if the ℓ-torsion of the twist is defined over an extension field of smaller degree. We also need the following corollary [18]. Corollary 2.4.…”

Section: 2mentioning

confidence: 99%

“…These algorithms need to walk on the crater, to descend from the crater to the floor or to ascend from the floor to the crater. In many cases, the structure of the ℓ-Sylow subgroup of the elliptic curve, allows one, after taking a step on the volcano, to decide whether this step is ascending, descending or horizontal (see [17,18]). Note that, since a large fraction of isogenies are descending, finding one of them is quite easy.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Pairing the Volcano

Ionica

Joux

2010

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Isogeny volcanoes are graphs whose vertices are elliptic curves and whose edges are ℓ-isogenies. Algorithms allowing to travel on these graphs were developed by Kohel in his thesis (1996) and later on, by Fouquet and Morain (2001). However, up to now, no method was known, to predict, before taking a step on the volcano, the direction of this step. Hence, in Kohel's and Fouquet-Morain algorithms, many steps are taken before choosing the right direction. In particular, ascending or horizontal isogenies are usually found using a trialand-error approach. In this paper, we propose an alternative method that efficiently finds all points P of order ℓ such that the subgroup generated by P is the kernel of an horizontal or an ascending isogeny. In many cases, our method is faster than previous methods. This is an extended version of a paper published in the proceedings of ANTS 2010. In addition, we treat the case of 2-isogeny volcanoes and we derive from the group structure of the curve and the pairing a new invariant of the endomorphism class of an elliptic curve. Our benchmarks show that the resulting algorithm for endomorphism ring computation is faster than Kohel's method for computing the ℓ-adic valuation of the conductor of the endomorphism ring for small ℓ.

show abstract

Section: 2mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Pairing the Volcano

Ionica

Joux

2010

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Proposition 1 [15] Let E/F q be an elliptic curve whose ℓ-Sylow subgroup is isomorphic to Z/ℓ r Z × Z/ℓ s Z, r ≥ s ≥ 0, r + s ≥ 1.…”

Section: Preliminariesmentioning

confidence: 99%

“…When the cardinality is unknown, Fouquet and Morain [6] give an algorithm to determine the height (or depth) of a volcano using exhaustive search over several paths on the volcano to detect the crater and the floor levels. As a consequence, they obtain computational simplifications for the SEA algorithm, since they extend the moduli ℓ in the algorithm to prime powers ℓ s .In [15], Miret et al showed the relationship between the levels of a volcano of ℓ-isogenies and the ℓ-Sylow subgroups of the curves. All curves in a fixed level have the same ℓ-Sylow subgroup.…”

mentioning

confidence: 99%

See 1 more Smart Citation

Isogeny Volcanoes of Elliptic Curves and Sylow Subgroups

Fouquet

Miret

Valera

2015

Progress in Cryptology - LATINCRYPT 2014

View full text Add to dashboard Cite

Given an ordinary elliptic curve over a finite field located in the floor of its volcano of ℓ-isogenies, we present an efficient procedure to take an ascending path from the floor to the level of stability and back to the floor. As an application for regular volcanoes, we give an algorithm to compute all the vertices of their craters. In order to do this, we make use of the structure and generators of the ℓ-Sylow subgroups of the elliptic curves in the volcanoes. of ordinary elliptic curves over F q with group order N = q + 1 − t, |t| ≤ 2 √ q, can be represented as a directed graph, whose vertices are the isomorphism classes and its arcs represent the ℓ-isogenies between curves in two vertices. It is worth remarking that if two vertices are connected by an arc, the corresponding dual ℓ-isogeny is represented as an arc in the other direction.Each connected component of this graph is called volcano of ℓ-isogenies due to its peculiar shape. Indeed, it consists of a cycle that can be reduced to one point, called crater, where from its vertices hang ℓ + 1 − m complete ℓ-ary trees being m the number of horizontal ℓ-isogenies. Then, the vertices can be stratified into levels in such a way that the curves in each level have the same endomorphism ring. The bottom level is called the floor of the volcano.Knowing the cardinality of an elliptic curve, Kohel [9] and recently Bisson and Sutherland [1] describe algorithms to determine its endomorphism ring taking advantage of the relationship between the levels of its volcano and the endomorphism rings at those levels. When the cardinality is unknown, Fouquet and Morain [6] give an algorithm to determine the height (or depth) of a volcano using exhaustive search over several paths on the volcano to detect the crater and the floor levels. As a consequence, they obtain computational simplifications for the SEA algorithm, since they extend the moduli ℓ in the algorithm to prime powers ℓ s .In [15], Miret et al. showed the relationship between the levels of a volcano of ℓ-isogenies and the ℓ-Sylow subgroups of the curves. All curves in a fixed level have the same ℓ-Sylow subgroup. At the floor, the ℓ-Sylow subgroup is cyclic. When ascending by the volcanoside, that is, by the levels which are between the floor and the crater, the ℓ-Sylow subgroup structure is becoming balanced. The first level, if it exists, where the ℓ-Sylow subgroup is balanced, is called stability level. If this level does not exist, the stability level is the crater of the volcano. Recently, Ionica and Joux [7] have developed a method to decide whether the isogeny with kernel a subgroup generated by a point of order ℓ is an ascending, horizontal or descending ℓ-isogeny using a symmetric pairing over the ℓ-Sylow subgroup of a curve [8].Volcanoes of ℓ-isogenies have also been used by Sutherland [20] to compute the Hilbert class polynomials. Another application has been provided by Bröker, Lauter and Sutherland [2] in order to compute modular polynomials. To reach these goals, in both works, it is necessary to ...

show abstract