Isogeny Volcanoes Research Articles

Same value analysis on Edwards curves

Recently, several research groups in cryptography have presented new elliptic curve models based on Edwards curves. These new curves were selected for their good performance and security perspectives. Cryptosystems based on elliptic curves in embedded devices can be vulnerable to side-channel attacks (SCA), such as simple power analysis (SPA) or differential power analysis. In this paper, we analyze the existence of special points—whose use in SCA is known as same value analysis (SVA)—in the case of Edwards elliptic curves. These special points can be identified through a power analysis of the scalar multiplication. We show that all Edwards curves recently proposed for standardization contain some of these points and are therefore unsafe against SVA. As a countermeasure, we use the isogeny volcano approach to find SVA-secure isogenous curves to those proposed for standardization.

Extensions of CM elliptic curves and orbit counting on the projective line

There are several formulas for the number of orbits of the projective line under the action of subgroups of mathrm{GL}_2. We give an interpretation of two such formulas in terms of the geometry of elliptic curves, and prove a more general formula for a large class of congruence subgroups of Bianchi groups. Our formula involves the number of walks on a certain graph called an isogeny volcano. Underlying our results is a complete description of the group of extensions of a pair of CM elliptic curves, as well as the group of extensions of a pair of lattices in a quadratic field.

Class polynomials for nonholomorphic modular functions

We give algorithms for computing the singular moduli of suitable nonholomorphic modular functions F(z). By combining the theory of isogeny volcanoes with a beautiful observation of Masser concerning the nonholomorphic Eisenstein series E2⁎(z), we obtain CRT-based algorithms that compute the class polynomials HD(F;x), whose roots are the discriminant D singular moduli for F(z). By applying these results to a specific weak Maass form Fp(z), we obtain a CRT-based algorithm for computing partition class polynomials, a sequence of polynomials whose traces give the partition numbers p(n). Under the GRH, the expected running time of this algorithm is O(n5/2+o(1)). Key to these results is a fast CRT-based algorithm for computing the classical modular polynomial Φm(X,Y) that we obtain by extending the isogeny volcano approach previously developed for prime values of m.

Pairing the volcano

Isogeny volcanoes are graphs whose vertices are elliptic curves and whose edges are $\ell$-isogenies. Algorithms allowing to travel on these graphs were developed by Kohel in his thesis (1996) and later on, by Fouquet and Morain (2001). However, up to now, no method was known, to predict, before taking a step on the volcano, the direction of this step. Hence, in Kohel's and Fouquet-Morain algorithms, many steps are taken before choosing the right direction. In particular, ascending or horizontal isogenies are usually found using a trial-and-error approach. In this paper, we propose an alternative method that efficiently finds all points $P$ of order $\ell$ such that the subgroup generated by $P$ is the kernel of an horizontal or an ascending isogeny. In many cases, our method is faster than previous methods. This is an extended version of a paper published in the proceedings of ANTS 2010. In addition, we treat the case of 2-isogeny volcanoes and we derive from the group structure of the curve and the pairing a new invariant of the endomorphism class of an elliptic curve. Our benchmarks show that the resulting algorithm for endomorphism ring computation is faster than Kohel's method for computing the $\ell$-adic valuation of the conductor of the endomorphism ring for small $\ell$.

Explicit CM theory for level 2-structures on abelian surfaces

For a complex abelian surface A with endomorphism ring isomorphic to the maximal order in a quartic CM field K, the Igusa invariants j1(A),j2(A),j3(A) generate an unramified abelian extension of the reflex field of K. In this paper we give an explicit geometric description of the Galois action of the class group of this reflex field on j1(A),j2(A),j3(A). Our description can be expressed by maps between various Siegel modular varieties, and we can explicitly compute the action for ideals of small norm. We use the Galois action to modify the CRT method for computing Igusa class polynomials, and our run time analysis shows that this yields a significant improvement. Furthermore, we find cycles in isogeny graphs for abelian surfaces, thereby implying that the ‘isogeny volcano’ algorithm to compute endomorphism rings of ordinary elliptic curves over finite fields does not have a straightforward generalization to computing endomorphism rings of abelian surfaces over finite fields.

Computing isogeny volcanoes of composite degree

Isogeny volcanoes are an interesting structure that have had several recent applications. An isogeny volcano is a connected component of a larger graph called a cordillera. In this paper, we further explore properties of how to compute volcanoes given that we have already computed one of a different degree. This allows us to compute volcanoes of composite degree more efficiently than a direct construction using modular polynomials.

Modular polynomials via isogeny volcanoes

We present a new algorithm to compute the classical modular polynomial Phi_n in the rings Z[X,Y] and (Z/mZ)[X,Y], for a prime n and any positive integer m. Our approach uses the graph of n-isogenies to efficiently compute Phi_n mod p for many primes p of a suitable form, and then applies the Chinese Remainder Theorem (CRT). Under the Generalized Riemann Hypothesis (GRH), we achieve an expected running time of O(n^3 (log n)^3 log log n), and compute Phi_n mod m using O(n^2 (log n)^2 + n^2 log m) space. We have used the new algorithm to compute Phi_n with n over 5000, and Phi_n mod m with n over 20000. We also consider several modular functions g for which Phi_n^g is smaller than Phi_n, allowing us to handle n over 60000.