Search

Bruinier and Yang conjectured a formula for intersection numbers on an arithmetic Hilbert modular surface, and as a consequence obtained a conjectural formula for CM(K).G_1 under strong assumptions on the ramification in K. Yang later proved this conjecture under slightly stronger assumptions on the ramification. In recent work, Lauter and Viray proved a different formula for CM(K).G_1 for primitive quartic CM fields with a mild assumption, using a method of proof independent from that of Yang. In this paper we show that these two formulas agree, for a class of primitive quartic CM fields which is slightly larger than the intersection of the fields considered by Yang and Lauter and Viray. Furthermore, the proof that these formulas agree does not rely on the results of Yang or Lauter and Viray. As a consequence of our proof, we conclude that the Bruinier-Yang formula holds for a slightly largely class of quartic CM fields K than what was proved by Yang, since it agrees with the Lauter-Viray formula, which is proved in those cases. The factorization of these intersection numbers has applications to cryptography: precise formulas for them allow one to compute the denominators of Igusa class polynomials, which has important applications to the construction of genus 2 curves for use in cryptography., Comment: 17 pages

In this paper we prove an explicit formula for the arithmetic intersection number (CM(K).G1)_{\ell} on the Siegel moduli space of abelian surfaces, generalizing the work of Bruinier-Yang and Yang. These intersection numbers allow one to compute the denominators of Igusa class polynomials, which has important applications to the construction of genus 2 curves for use in cryptography. Bruinier and Yang conjectured a formula for intersection numbers on an arithmetic Hilbert modular surface, and as a consequence obtained a conjectural formula for the intersection number (CM(K).G1)_{\ell} under strong assumptions on the ramification of the primitive quartic CM field K. Yang later proved this conjecture assuming that O_K is freely generated by one element over the ring of integers of the real quadratic subfield. In this paper, we prove a formula for (CM(K).G1)_{\ell} for more general primitive quartic CM fields, and we use a different method of proof than Yang. We prove a tight bound on this intersection number which holds for all primitive quartic CM fields. As a consequence, we obtain a formula for a multiple of the denominators of the Igusa class polynomials for an arbitrary primitive quartic CM field. Our proof entails studying the Embedding Problem posed by Goren and Lauter and counting solutions using our previous article that generalized work of Gross-Zagier and Dorman to arbitrary discriminants., Comment: 30 pages. Minor edits

Let d1 and d2 be discriminants of distinct quadratic imaginary orders O_d1 and O_d2 and let J(d1,d2) denote the product of differences of CM j-invariants with discriminants d1 and d2. In 1985, Gross and Zagier gave an elegant formula for the factorization of the integer J(d1,d2) in the case that d1 and d2 are relatively prime and discriminants of maximal orders. To compute this formula, they first reduce the problem to counting the number of simultaneous embeddings of O_d1 and O_d2 into endomorphism rings of supersingular curves, and then solve this counting problem. Interestingly, this counting problem also appears when computing class polynomials for invariants of genus 2 curves. However, in this application, one must consider orders O_d1 and O_d2 that are non-maximal. Motivated by the application to genus 2 curves, we generalize the methods of Gross and Zagier and give a computable formula for v_p(J(d1,d2)) for any distinct pair of discriminants d1,d2 and any prime p>2. In the case that d1 is squarefree and d2 is the discriminant of any quadratic imaginary order, our formula can be stated in a simple closed form. We also give a conjectural closed formula when the conductors of d1 and d2 are relatively prime., Comment: 33 pages. Changed the abstract and made small changes to the introduction. Reorganized section 3.2, 4, and proof of Proposition 8.1. Some remarks added to section 7

We provide new upper bounds on N_q(g), the maximum number of rational points on a smooth absolutely irreducible genus-g curve over F_q, for many values of q and g. Among other results, we find that N_4(7) = 21 and N_8(5) = 29, and we show that a genus-12 curve over F_2 having 15 rational points must have characteristic polynomial of Frobenius equal to one of three explicitly given possibilities. We also provide sharp upper bounds for the lengths of the shortest vectors in Hermitian lattices of small rank and determinant over the maximal orders of small imaginary quadratic fields of class number 1. Some of our intermediate results can be interpreted in terms of Mordell-Weil lattices of constant elliptic curves over one-dimensional function fields over finite fields. Using the Birch and Swinnerton-Dyer conjecture for such elliptic curves, we deduce lower bounds on the orders of certain Shafarevich-Tate groups., Comment: LaTeX, 35 pages

We prove a higher dimensional generalization of Gross and Zagier's theorem on the factorization of differences of singular moduli. Their result is proved by giving a counting formula for the number of isomorphisms between elliptic curves with complex multiplication by two different imaginary quadratic fields $K$ and $K^\prime$, when the curves are reduced modulo a supersingular prime and its powers. Equivalently, the Gross-Zagier formula counts optimal embeddings of the ring of integers of an imaginary quadratic field into particular maximal orders in $B_{p, \infty}$, the definite quaternion algebra over $\QQ$ ramified only at $p$ and infinity. Our work gives an analogous counting formula for the number of simultaneous embeddings of the rings of integers of primitive CM fields into superspecial orders in definite quaternion algebras over totally real fields of strict class number 1. Our results can also be viewed as a counting formula for the number of isomorphisms modulo $\frak{p} | p$ between abelian varieties with CM by different fields. Our counting formula can also be used to determine which superspecial primes appear in the factorizations of differences of values of Siegel modular functions at CM points associated to two different CM fields, and to give a bound on those supersingular primes which can appear. In the special case of Jacobians of genus 2 curves, this provides information about the factorizations of numerators of Igusa invariants, and so is also relevant to the problem of constructing genus 2 curves for use in cryptography., Comment: 32 pages

We give a classification of all principally polarized abelian surfaces that admit an $(l,l)$-isogeny to themselves, and show how to compute all the abelian surfaces that occur. We make the classification explicit in the simplest case $l=2$. As part of our classification, we also show how to find all principally polarized abelian surfaces with multiplication by a given imaginary quadratic order., Comment: 25 pages

Bruinier and Yang conjectured a formula for an intersection number on the arithmetic Hilbert modular surface, CM(K).T_m, where CM(K) is the zero-cycle of points corresponding to abelian surfaces with CM by a primitive quartic CM field K, and T_m is the Hirzebruch-Zagier divisors parameterizing products of elliptic curves with an m-isogeny between them. In this paper, we examine fields not covered by Yang's proof of the conjecture. We give numerical evidence to support the conjecture and point to some interesting anomalies. We compare the conjecture to both the denominators of Igusa class polynomials and the number of solutions to the embedding problem stated by Goren and Lauter., Comment: 27 pages, 1 table, 1 appendix with Magma code. To appear in Fields Communications Volume WIN - Women In Numbers, Proceedings of the WIN Workshop, Banff International Research Station, Banff, Canada

The moduli space of principally polarized abelian surfaces is parametrized by three Igusa functions. In this article we investigate a new way to evaluate these functions by using Siegel Eisenstein series. We explain how to compute the Fourier coefficients of certain Siegel modular forms using classical modular forms of half-integral weight. One of the results in this paper is an explicit algorithm to evaluate the Igusa functions to a prescribed precision.

Genus 2 curves are useful in cryptography for both discrete-log based and pairing-based systems, but a method is required to compute genus 2 curves such that the Jacobian has a given number of points. Currently, all known methods involve constructing genus 2 curves with complex multiplication via computing their three Igusa class polynomials. These polynomials have rational coefficients and require extensive computation and precision to compute. Both the computation and the complexity analysis of these algorithms can be improved by a more precise understanding of the denominators of the coefficients of the polynomials. The main goal of this paper is to give a bound on the denominators of Igusa class polynomials of genus 2 curves with CM by a primitive quartic CM field. We give an overview of Igusa's results on the moduli space of genus two curves and the method to construct genus 2 curves via their Igusa invariants. We also give a complete characterization of the reduction type of a CM abelian surface, for biquadratic, cyclic, and non-Galois quartic CM fields, and for any type of prime decomposition of the prime, including ramified primes. The methods of the proof of the main result involve studying the embedding problem of the quartic CM field into certain matrix algebras over quaternions and invoking techniques from crystalline deformation theory.

We present a new algorithm to compute the classical modular polynomial Phi_n in the rings Z[X,Y] and (Z/mZ)[X,Y], for a prime n and any positive integer m. Our approach uses the graph of n-isogenies to efficiently compute Phi_n mod p for many primes p of a suitable form, and then applies the Chinese Remainder Theorem (CRT). Under the Generalized Riemann Hypothesis (GRH), we achieve an expected running time of O(n^3 (log n)^3 log log n), and compute Phi_n mod m using O(n^2 (log n)^2 + n^2 log m) space. We have used the new algorithm to compute Phi_n with n over 5000, and Phi_n mod m with n over 20000. We also consider several modular functions g for which Phi_n^g is smaller than Phi_n, allowing us to handle n over 60000., Comment: corrected a typo in equation (14), 31 pages

For a complex abelian variety $A$ with endomorphism ring isomorphic to the maximal order in a quartic CM-field $K$, the Igusa invariants $j_1(A), j_2(A),j_3(A)$ generate an abelian extension of the reflex field of $K$. In this paper we give an explicit description of the Galois action of the class group of this reflex field on $j_1(A),j_2(A),j_3(A)$. We give a geometric description which can be expressed by maps between various Siegel modular varieties. We can explicitly compute this action for ideals of small norm, and this allows us to improve the CRT method for computing Igusa class polynomials. Furthermore, we find cycles in isogeny graphs for abelian surfaces, thereby implying that the `isogeny volcano' algorithm to compute endomorphism rings of ordinary elliptic curves over finite fields does not have a straightforward generalization to computing endomorphism rings of abelian surfaces over finite fields.

Modular polynomials are an important tool in many algorithms involving elliptic curves. In this article we investigate their generalization to the genus 2 case following pioneering work by Gaudry and Dupont. We prove various properties of these genus 2 modular polynomials and give an improved way to explicitly compute them.

We define three hard problems in the theory of elliptic divisibility sequences (EDS Association, EDS Residue and EDS Discrete Log), each of which is solvable in sub-exponential time if and only if the elliptic curve discrete logarithm problem is solvable in sub-exponential time. We also relate the problem of EDS Association to the Tate pairing and the MOV, Frey-R\"{u}ck and Shipsey EDS attacks on the elliptic curve discrete logarithm problem in the cases where these apply., Comment: 18 pages; revised version includes some small mathematical corrections, reformatted

We present and analyze two algorithms for computing the Hilbert class polynomial $H_D$ . The first is a p-adic lifting algorithm for inert primes p in the order of discriminant D < 0. The second is an improved Chinese remainder algorithm which uses the class group action on CM-curves over finite fields. Our run time analysis gives tighter bounds for the complexity of all known algorithms for computing $H_D$, and we show that all methods have comparable run times.

Kolyvagin used Heegner points to associate a system of cohomology classes to an elliptic curve over $\Q$ and conjectured that the system contains a non-trivial class. His conjecture has profound implications on the structure of Selmer groups. We provide new computational and theoretical evidence for Kolyvagin's conjecture. More precisely, we explicitly compute Heegner points over ring class fields and use these points to verify the conjecture for specific elliptic curves of rank two. We explain how Kolyvagin's conjecture implies that if the analytic rank of an elliptic curve is at least two then the $\Z_p$-corank of the corresponding Selmer group is at least two as well. We also use explicitly computed Heegner points to produce non-trivial classes in the Shafarevich-Tate group., Comment: 20 pages

We present algorithms which, given a genus 2 curve $C$ defined over a finite field and a quartic CM field $K$, determine whether the endomorphism ring of the Jacobian $J$ of $C$ is the full ring of integers in $K$. In particular, we present probabilistic algorithms for computing the field of definition of, and the action of Frobenius on, the subgroups $J[\ell^d]$ for prime powers $\ell^d$. We use these algorithms to create the first implementation of Eisentr\"ager and Lauter's algorithm for computing Igusa class polynomials via the Chinese Remainder Theorem \cite{el}, and we demonstrate the algorithm for a few small examples. We observe that in practice the running time of the CRT algorithm is dominated not by the endomorphism ring computation but rather by the need to compute $p^3$ curves for many small primes $p$., Comment: Revised version, with minor corrections and incorporating reader comments. Proposition 3.7 and Lemma 6.5 are new. To appear in Proceedings of SAGA 2007, Tahiti

For a quartic primitive CM field $K$, we say that a rational prime $p$ is {\it evil} if at least one of the abelian varieties with CM by $K$ reduces modulo a prime ideal $\gerp| p$ to a product of supersingular elliptic curves with the product polarization. We call such primes {\it evil primes for $K$}. In \cite{GL}, we showed that for fixed $K$, such primes are bounded by a quantity related to the discriminant of the field $K$. In this paper, we show that evil primes are ubiquitous in the sense that, for any rational prime $p$, there are an infinite number of fields $K$ for which $p$ is evil for $K$. The proof consists of two parts: (1) showing the surjectivity of the abelian varieties with CM by $K$, for $K$ satisfying some conditions, onto the the superspecial points modulo $\gerp$ of the Hilbert modular variety associated to the intermediate real quadratic field of $K$, and (2) showing the surjectivity of the superspecial points modulo $\gerp$ of the Hilbert modular variety associated to a large enough real quadratic field onto the superspecial points modulo $\gerp$ with principal polarization on the Siegel moduli space., Comment: 11 pages

We present a new probabilistic algorithm to compute modular polynomials modulo a prime. Modular polynomials parameterize pairs of isogenous elliptic curves and are useful in many aspects of computational number theory and cryptography. Our algorithm has the distinguishing feature that it does not involve the computation of Fourier coefficients of modular forms. We avoid computing the exponentially large integral coefficients by working directly modulo a prime and computing isogenies between elliptic curves via Velu's formulas., Comment: 8 pages, appendix added with correction to Elkies' running time, final version to appear in London Math Society Journal of Computation and Mathematics

We present a new method for constructing genus 2 curves over a finite field with a given number of points on its Jacobian. This method has important applications in cryptography, where groups of prime order are used as the basis for discrete-log based cryptosystems. Our algorithm provides an alternative to the traditional CM method for constructing genus 2 curves. For a quartic CM field K with primitive CM type, we compute the Igusa class polynomials modulo p for certain small primes p and then use the Chinese remainder theorem (CRT) and a bound on the denominators to construct the class polynomials. We also provide an algorithm for determining endomorphism rings of ordinary Jacobians of genus 2 curves over finite fields, generalizing the work of Kohel for elliptic curves., Comment: 16 pages. to appear in Proceedings of AGCT-10

One can define class invariants for a quartic primitive CM field K as special values of certain Siegel (or Hilbert) modular functions at CM points corresponding to K. We provide explicit bounds on the primes appearing in the denominators of these algebraic numbers. This allows us, in particular, to construct S-units in certain abelian extensions of K, where S is effectively determined by K. It also yields class polynomials for primitive quartic CM fields whose coefficients are S-integers., Comment: 14 pages

A curve over a field k is pointless if it has no k-rational points. We show that there exist pointless genus-3 hyperelliptic curves over a finite field F_q if and only if q < 26, that there exist pointless smooth plane quartics over F_q if and only if either q < 24 or q = 29 or q = 32, and that there exist pointless genus-4 curves over F_q if and only if q < 50., Comment: LaTeX, 15 pages

We present algorithms for computing the squared Weil and Tate pairings on elliptic curves and the squared Tate pairing for hyperelliptic curves. The squared pairings introduced in this paper have the advantage that our algorithms for evaluating them are deterministic and do not depend on a random choice of points. Our pairings save about 20-30% over the usual pairings., Comment: 15 pages, new version revised for publication in ANTS-6, references added

The purpose of this note is to suggest an analogue for genus 2 curves of part of Gross and Zagier's work on elliptic curves. Experimentally, for genus 2 curves with CM by a quartic CM field K, it appears that primes dividing the denominators of the discriminants of the Igusa class polynomials all have the property 1) that they are bounded by d, the absolute value of the discriminant of K, and 2) that they divide d-x^2, for some integer x whose square is less than d. A slightly stronger condition is given in Section 3. Such primes are primes of bad reduction for the genus 2 curve and primes of supersingular reduction for the Jacobian of the genus 2 curve., Comment: 3 pages

We present an algorithm which speeds scalar multiplication on a general elliptic curve by an estimated 3.8 % to 8.5 % over the best known general methods when using affine coordinates. This is achieved by eliminating a field multiplication when we compute 2P+Q from given points P, Q on the curve. We give applications to simultaneous multiple scalar multiplication and to the Elliptic Curve Method of factorization. We show how this improvement together with another idea can speed the computation of the Weil and Tate pairings by up to 7.8 %., Comment: 12 pages, added some consequences for computing the Weil Pairing, to appear in Proceedings of RSA-CT 2003

We give new arguments that improve the known upper bounds on the maximal number N_q(g) of rational points of a curve of genus g over a finite field F_q for a number of pairs (q,g). Given a pair (q,g) and an integer N, we determine the possible zeta functions of genus-g curves over F_q with N points, and then deduce properties of the curves from their zeta functions. In many cases we can show that a genus-g curve over F_q with N points must have a low-degree map to another curve over F_q, and often this is enough to give us a contradiction. In particular, we able to provide eight previously unknown values of N_q(g), namely: N_4(5) = 17, N_4(10) = 27, N_8(9) = 45, N_{16}(4) = 45, N_{128}(4) = 215, N_3(6) = 14, N_9(10) = 54, and N_{27}(4) = 64. Our arguments also allow us to give a non-computer-intensive proof of the recent result of Savitt that there are no genus-4 curves over F_8 having exactly 27 rational points. Furthermore, we show that there is an infinite sequence of q's such that for every g with 0 < g < log_2 q, the difference between the Weil-Serre bound on N_q(g) and the actual value of N_q(g) is at least g/2., Comment: LaTex, 40 pages. There was a mistake in Section 7 that invalidated the proofs of two of our results. We correct the error in Section 7, and add an appendix with new proofs of the two results

This paper proves that the maximum number of rational points on a smooth, absolutely irreducible genus 4 curve over the field of 8 elements is 25. The body of the paper shows that 27 points is not possible using techniques from algebraic geometry. The appendix shows that 26 points is not possible by examining the zeta functions., Comment: 16 pages, 5 page appendix; replaced July 7, 2002. Paper by David Savitt with an Appendix by Kristin Lauter. Includes a collection of examples by David Savitt that will not be included in the print version of the paper

Elliptic curves with a known number of points over a given prime field with n elements are often needed for use in cryptography. In the context of primality proving, Atkin and Morain suggested the use of the theory of complex multiplication to construct such curves. One of the steps in this method is the calculation of a root modulo n of the Hilbert class polynomial H(X) for a fundamental discriminant D. The usual way is to compute H(X) over the integers and then to find the root modulo n. We present a modified version of the Chinese remainder theorem (CRT) to compute H(X) modulo n directly from the knowledge of H(X) modulo enough small primes. Our complexity analysis suggests that asymptotically our algorithm is an improvement over previously known methods., Comment: 14 pages, complexity analysis redone, several sections rewritten

Currently, the best upper bounds on the number of rational points on an absolutely irreducible, smooth, projective algebraic curve of genus g defined over a finite field F_q come either from Serre's refinement of the Weil bound if the genus is small compared to q, or from Oesterle's optimization of the explicit formulae method if the genus is large. This paper presents three methods for improving these bounds. The arguments used are the indecomposability of the theta divisor of a curve, Galois descent, and Honda-Tate theory. Examples of improvements on the bounds include lowering them for a wide range of small genus when q=2^3, 2^5, 2^{13}, 3^3, 3^5, 5^3, 5^7, and when q=2^{2s}, s>1. For large genera, isolated improvements are obtained for q=3,8,9., Comment: 16 pages including the appendix. Main paper by Kristin Lauter, appendix by Jean-Pierre Serre

We show that for all finite fields F_q, there exists a curve C over F_q of genus 3 such that the number of rational points on C is within 3 of the Serre-Weil upper or lower bound. For some q, we also obtain improvements on the upper bound for the number of rational points on a genus 3 curve over F_q., Comment: 28 pages including the appendix. Main paper by Kristin Lauter, appendix by Jean-Pierre Serre