Automorphism Groups of Hyperelliptic Function Fields
Total Page:16
File Type:pdf, Size:1020Kb
Norbert G¨ob Automorphism Groups of Hyperelliptic Function Fields Vom Fachbereich Mathematik der Technischen Universit¨atKaiserslautern zur Verleihung des akademischen Grades Doktor der Naturwissenschaften (Doctor rerum naturalium, Dr. rer. nat.) genehmigte Dissertation Gutachter: Privatdozent Dr. Andreas Guthmann Prof. Dr. Wolfram Decker Datum der Disputation: 28. Januar 2004 D 386 For my son Hendrik Contents Notation 3 Introduction 5 Chapter I. Hyperelliptic Function Fields 9 1. Elementary Notations 9 2. Algebraic Function Fields 9 3. The Riemann-Roch Theorem 12 4. Subfields of Algebraic Function Fields 15 5. Automorphisms of Algebraic Function Fields 19 6. Hyperelliptic Function Fields 21 7. Weierstraß Points 25 8. Cantor’s Representation of Divisor Classes 29 Chapter II. Cryptographic Aspects 33 1. Hyperelliptic Crypto Systems 33 2. Attacks on HECC 36 3. Known Algorithms for Computing the Order of Jacobians 37 3.1. Zeta Functions 37 3.2. CM-Method 38 3.3. Weil Descent 39 3.4. AGM Method (Gaudry-Harley) 40 4. A Theorem by Madan and its Practical Consequences 41 Chapter III. Defining Equations 49 1. A Simple Criterion 49 2. A Theorem by Lockhart 51 3. Basis Transformations 52 3.1. Relations Between the Variable Symbols 53 3.2. Relation Between the Square Roots 54 3.3. Putting Both Relations Together 57 4. Isomorphisms 60 Chapter IV. Isomorphisms and Normal Forms 63 1. Checking for Defining Equations 63 1.1. Solving Over the Given Constant Field 64 1.2. Constructing Necessary Constant Field Extensions 75 1.3. Checking for Solutions Over the Algebraic Closure 76 2. Explicit Determination of Isomorphisms 77 3. Normal Forms 79 Chapter V. Computing the Automorphism Group 85 1. Elementary Facts on Automorphism Groups 86 2. Automorphism Groups and Associated Normal Forms 88 3. Subgroup Checking 94 1 2 CONTENTS 3.1. Checking for Cyclic Subgroups Whose Order is Prime to char(k) 94 3.2. Checking for Elementary Abelian char(k)-Groups 95 3.3. Checking for Semidirect Product Groups 96 4. Computing the Automorphism Group 97 5. Stoll’s Algorithm 98 Chapter VI. Computational Aspects 101 1. A Secure Jacobian 101 2. The Number of Non-Trivial Automorphism Groups 102 3. Fixed Fields and Their Class Numbers 103 3.1. Fixed Fields of Cn, where (n, char(k)) = 1 and ν = 0 104 3.2. Fixed Fields of Cn, where (n, char(k)) = 1 and ν = 1 106 m 3.3. Fixed Fields of Cp 109 4. Efficiency Considerations and Comparison to Stoll’s Algorithm 111 Conclusion 115 Appendix A. Function Fields with Nontrivial Automorphism Groups 117 1. All Imaginary Quadratic Hyperelliptic Fields of Genus 2 over F3 117 2. All Imaginary Quadratic Hyperelliptic Fields of Genus 3 over F3 118 3. All Imaginary Quadratic Hyperelliptic Fields of Genus 2 over F5 121 4. Random Hyperelliptic Fields of Genus 3 130 5. Random Hyperelliptic Fields of Genus 4 131 Appendix B. Jacobian Orders of Subfields 133 1. Fixed Fields of Cn, where (n, char(k)) = 1 and ν = 0 133 2. Fixed Fields of Cn, where (n, char(k)) = 1 and ν = 1 137 Bibliography 141 Index 145 Lebenslauf des Autors 147 Author’s Curriculum Vitae 149 Notation In this work, the following notations are used—some of them without further defi- nition. (k, +) additive group of the field k AF , AF (A) adele spaces of F k algebraic closure of k 1 An alternating group of order 2 n! Aut(F/k) field automorphisms of F fixing k Aut(G) automorphisms of G |M| cardinality of the set M char(k) characteristic of the field k C complex numbers F k composite field of the fields F and k 0 ConF 0/F conorm of the function field extension F /F Cn cyclic group of order n d(P 0/P ) different exponent of the place P 0 lying over P Diff(F 0/F ) different of the function field extension F 0/F Dn dihedral group of order 2n dimk(V ) dimension of a vector space over k div(a, b) divisor defined by the polynomials a and b (Cantor representation) a | b a is a divisor of b a - b a is no divisor of b CF divisor class group of F DF divisor group of F m Cp elementary abelian p-group of order mp a ≡ b mod n n is a divisor of a − b A ∼ B the divisors A and B are equivalent F G fixed field of G ≤ Aut(F/k) k˜ full constant field of a function field F/k G ≤ G0 G is a subgroup of G0 0 0 G E G G is a normal subgroup of G Gal(F 0/F ) Galois group of the field extension F 0/F (a, b) greatest common divisor of a and b g, gF genus of the function field F Fq Galois field, i.e. the finite field of cardinality q GLn(k) general linear group over k GLn(q) general linear group over Fq Φ hyperelliptic involution idF identity map on F F =∼ F 0 F and F 0 are isomorphic JF Jacobian of the function field F D a Jacobi symbol; determines, whether D is a square modulo a Ker(ϕ) kernel of ϕ 3 4 NOTATION [k0 : k] degree of the field extension k0 ⊇ k lct(f) the leading coefficient of the polynomial f with respect to the vari- able t bxc floor(x), largest integer < x P 0 | P the place P 0 lies over the place P (l · c) linear combination, cf. definition V.2 N nonnegative integers N+ positive integers O(f) O-estimation of f as is known from complexity theory ord(g) order of a group or group element g PGLn(k) projective general linear group over k PGLn(q) projective general linear group over Fq PF places of the function field F pm k n pm divides n, while pm+1 does not F (x)∞ pole divisor of x ∈ F (x)F principal divisor of x ∈ F PF principal divisors of F Pn(k) n-dimensional projective space over k PSLn(k) projective special linear group over k PSLn(q) projective special linear group over Fq e(P 0/P ) ramification index of the place P 0 lying over P f(P 0/P ) relative degree of the place P 0 lying over P L(D) Riemann-Roch space of the divisor D G o H semidirect product group σ|F restriction of the function σ to F SLn(k) special linear group over k SLn(q) special linear group over Fq hg0, . , gn−1i span of g0, . , gn−1 supp(D) support of the divisor D Sn symmetric group of order n! UF (G) subgroup of Aut(F/k) if F is of type F[G, k], cf. definition V.1 F[G, k] type of a function field, cf. definition V.1 R∗ unit group of the ring R vP valuation corresponding to the place P OP valuation ring corresponding to the place P ΩF , ΩF (A) Weil differentials of F Z integers F (x)0 zero divisor of x ∈ F Introduction Today, electronic data exchange is part of our everyday lives. Hence, it is essential to protect valuable information against unauthorized access. To be able to do so, cryptographic algorithms need to be researched continuously. The most widely used public-key crypto system1 today is RSA ([RSA78]). Due to the development of the number field sieve2, RSA can only assure a sufficient level of security if very large keys are used. Elliptic curves3 are an alternative to RSA, because they guarantee a high level of security even for small keys4. Therefore, they are widely used on smart cards and in similar environments where storage space is limited or expensive. In 1989, Neal Koblitz suggested to use Jacobians of hyperelliptic curves for crypto- graphic purposes ([Kob89]). These are a natural generalization of (groups of points of) elliptic curves. Hence, they provide more flexibility at a level of security which is at least as high as for elliptic curves, if the same key lengths are used. While both elliptic and (Jacobians of) hyperelliptic curves are considered to be secure in general, there are specific, insecure curves in both cases. To apply (hyper-)elliptic curves in practice, methods are needed which identify insecure curves, allowing users to generate secure ones using a trial-and-error strategy. While this problem is solved for elliptic curves5, there is no efficient possibility known to find out whether a general6 hyperelliptic curve has a secure Jacobian. 7 In order to obtain secure Jacobians J it is necessary to prevent attacks like Pohlig- Hellman’s ([PH78]), Frey-R¨uck’s ([FR94]) or Duursma-Gaudry-Morain’s attacks ([DGM99]). The latter is only feasible, if the Jacobian has an automorphism of large order. Because each automorphism of the corresponding hyperelliptic function field8 defines an automorphism of the Jacobian, at least the field’s automorphism group ought to be small for secure Jacobians. To forestall the Pohlig-Hellman attack, one needs to assert that the group order is almost prime, i.e. it ought to contain a large prime factor p0. To prevent the Frey-R¨uck attack, p0 needs to possess additional properties. Therefore, one needs to know both the automorphism group of the function field and the order of the Jacobian. Unfortunately, there is no efficient algorithm known 1Public-key cryptography has been invented by Diffie and Hellman, cf. [DH76]. 2cf. [LL93] 3cf. e.g. [Sil86] 4Today, a key length of 256 bit provides security for elliptic curve crypto systems, while equally secure RSA keys need to be 2048 bits long.