Courbes algébriques :de l’inutile à l’indispensable
Sylvain Duquesne
Habilitation à diriger des recherches
Soutenue le 27 novembre 2007 devant le jury composé de
J. C. Bajard
H. CohenJ. M. Couveignes
G. Frey
M. Girault
P. Michel
B. Vallée

Professeur
Professeur émérite
Professeur
Professeur
Expert émérite
Professeur
Directrice de recherche

Université Montpellier 2
Université Bordeaux 1
Université de Toulouse
Universität Essen
France Telecom R&D, Caen
Université Montpellier 2
Université de Caen

après avis de
J. M. Couveignes
G. Frey
M. Girault

Professeur
Professeur
Expert émérite

1

Université de Toulouse
Universität Essen
France Telecom R&D, Caen

Table des matières
1 Animation de la recherche
1.1 Situation . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.2 Enseignements liés à la recherche . . . . . . . . . . . . . . . .
1.3 Participation à la formation doctorale . . . . . . . . . . . . .
1.4 Encadrement de travaux de recherche . . . . . . . . . . . . .

3
3
3
3
4

2 Travaux de recherche
2.1 Étude algorithmique de familles de courbes algébriques . . . .
2.1.1 Les “simplest cubic fields” . . . . . . . . . . . . . . . .
2.1.2 Les “simplest quartic fields” . . . . . . . . . . . . . . .
2.1.3 Pistes de futures recherches . . . . . . . . . . . . . . .
2.2 La Variété de Kummer d’une courbe algébrique . . . . . . . .
2.2.1 Utilisation pour la recherche des points rationnels d’une
courbe hyperelliptique . . . . . . . . . . . . . . . . . .
2.2.2 Cas des courbes de genre 3 . . . . . . . . . . . . . . .
2.2.3 Cas des courbes de genre 2 en caractéristique 2 . . . .
2.2.4 Pistes de futures recherches . . . . . . . . . . . . . . .
2.3 Application à la cryptographie : arithmétique résistante aux
fuites sur les courbes algébriques . . . . . . . . . . . . . . . .
2.3.1 Formules unifiées : forme de Jacobi d’une courbe elliptique . . . . . . . . . . . . . . . . . . . . . . . . . .
2.3.2 Utilisation de la surface de Kummer en genre 2 . . . .
2.3.3 Représentation des nombres par restes modulaires appliquée aux courbes elliptiques . . . . . . . . . . . . .
2.3.4 Pistes de futures recherches . . . . . . . . . . . . . . .

5
6
7
10
11
12
13
15
16
17
18
20
21
23
24

3 Sujets de thèse des doctorants codirigés25
3.1 Nicolas Méloni (2004-2007) . . . . . . . . . . . . . . . . . . . 25
3.2 Nadia El Mrabet (2006-2009) . . . . . . . . . . . . . . . . . . 27
Références

28

Sélection des travaux les plus importants

32

2

1

Animation de la recherche

1.1

Situation

Actuellement maı̂tre de conférences en mathématiques à l’université deMontpellier 2 au sein de l’I3M (Institut de Mathématiques et de Modélisation
de Montpellier), je suis également chercheur associé au LIRMM (Laboratoire d’Informatique, de Robotique et de Microélectronique de Montpellier).
Je participe donc activement à la vie de deux équipes de recherche, d’unepart l’équipe de théorie des nombres, dirigée par Philippe Michel (I3M) etd’autre part l’équipe ARITH d’arithmétique des ordinateurs dirigée par Arnaud Tisserand (LIRMM).
Par ailleurs, je suis responsable de la filière Mathématiques et Informatique du département de Mathématiques de Montpellier. En particulier, entant que responsable du Parcours Mathématiques-Informatique du Master 2
Recherche, je reste en contact permanent avec les étudiants désirant faire dela recherche dans cette voie. J’ai donc pour responsabilité de les conseiller, deles orienter, de leur trouver des stages (aussi bien dans le monde académiqueque dans le monde industriel) et des financements pour poursuivre en doctorat.

1.2

Enseignements liés à la recherche

J’enseigne également dans ce M2 recherche un module de cryptographie
théorique et appliquée depuis 2003 (15 puis 30 heures). J’y aborde tous les
aspects de la cryptographie moderne (fonctions de hachage, cryptographie
par flot, générateurs aléatoires) et ses applications (internet, téléphonie mobile, protection contre la copie, ...) avec bien sur une attention particulièreportée sur les systèmes de chiffrement symétriques (DES, Blowfish, AES) et
asymétriques (RSA, courbes elliptiques et hyperelliptiques). Ce module faitégalement partie du M2 recherche d’informatique de Montpellier.
D’autre part j’ai accepté de dispenser un cours en anglais dans le Master
2 SISA (Security of Integrated Systems Applications) de l’école des Minesde Saint-Etienne sur les chiffrements asymétriques.

1.3

Participation à la formation doctorale

Lors de l’école d’été de Cryptologie organisée en 2002 et destinée à promouvoir la recherche en cryptologie auprès des jeunes doctorants ou futurs
3doctorants, j’ai donné une conférence sur le thème de l’utilisation des courbes
hyperelliptiques en cryptographie et sur les avantages et les inconvénientsque ces courbes apportaient.
Avec l’aide d’Emmanuel Royer et de Thomas Hausberger, j’ai organiséle colloque “Jeunes Chercheurs en théorie des nombres” qui s’est tenu à laGrande Motte en mars 2004, réunissant une soixantaine de jeunes chercheurs (essentiellement des doctorants). L’objectif de ce colloque était depermettre à ces doctorants de se réunir, de présenter leurs travaux lors d’exposés de vingt minutes et de rencontrer des chercheurs confirmés qui ont
chacun donné un cours durant trois heures sur un sujet en développement.
Lors de l’école jeunes chercheurs en algorithmique et calcul formel de2005, j’ai été sollicité pour présenter un cours sur les courbes elliptiques etleur utilisation en cryptographie.

1.4

Encadrement de travaux de recherche

Depuis mon arrivée à Montpellier, j’ai encadré plusieurs étudiants pourleur stage de recherche de première année de Master. Les sujets tournent
autour de la théorie des nombres et de la cryptographie.
J’ai également encadré, chaque année, un étudiant pour son stage dedeuxième année de Master (ou de DEA) :– Nicolas Méloni en 2004 sur l’utilisation des couplages en cryptographie.
– Moana Tetiarahi en 2005 sur le comptage de points sur les courbes
elliptiques en caractéristique 2.
– Nadia El Mrabet en 2006 sur les attaques sur carte à puces et contre
mesures mathématiques.
– Julien Hoarau en 2007 sur la sécurité dans la téléphonie mobile (stage
en entreprise).
Enfin, avec Jean Claude Bajard, professeur au LIRMM, je coencadre actuellement 2 doctorants en cryptographie dont les sujets sont détaillés dansla partie 3.
Nicolas Méloni va soutenir sa thèse le 26 novembre 2007. Il avait obtenu
une allocation de recherche 50% Mathématique et 50% Informatique en 2004
grâce à ses bons résultats dans le DEA de Mathématiques de Montpellier.
Ses recherches se sont concentrées sur les représentations alternatives per4

mettant d’accélérer ou de sécuriser les opérations cryptographiques basées
sur les courbes elliptiques. Ses travaux ont pour l’instant donné lieu à 5
publications dans des conférences internationales à comité de lecture. Pourl’année 2007-2008, il a obtenu un demi poste d’ATER à l’université de Toulon.
Nadia El Mrabet a commencé sa thèse en octobre 2006. Titulaire del’agrégation de mathématiques, elle a obtenue une bourse DPI cofinancée
par la région et le CNRS. Son sujet de thèse porte sur l’utilisation des couplages, récemment apparus en cryptographie. Elle travaille plus précisément
sur les algorithmes permettant de les calculer et sur leur résistance aux fuites.
Ses travaux ont déjà donné lieu à une publication dans une conférence internationale à comité de lecture.

2

Travaux de recherche

Mon domaine de recherche est l’algorithmique en théorie des nombres
et la cryptographie. Je me suis plus particulièrement intéressé à l’algorithmique des courbes elliptiques et des courbes hyperelliptiques de genre 2 ou
3 ainsi qu’à leurs applications en cryptographie.
Mes travaux s’articulent autour de deux idées directrices qui me tiennentà coeur et continueront à me guider dans les années à venir :– Une démarche expérimentale, peu courante en recherche mathématique.
– L’utilisation d’outils théoriques et abstraits pour résoudre des problèmes très concrets rencontrés par les industriels.
Le domaine des courbes elliptiques (et des courbes algébriques en général)fait partie des grands axes de la théorie des nombres. Elles sont par exempleà la base de la démonstration du grand théorème de Fermat. Je parle biensûr ici de mathématiques dites pures ou plus généralement de recherche fondamentale rimant trop souvent aux yeux du grand public avec inutilité voiremême gaspillage de l’argent public. Il faut bien avouer que de savoir (etencore pire : d’avoir une preuve) que l’équation
xn + y n = z n
n’a pas de solutions entières non triviales si n est un entier supérieur à 3 neva pas aider à résoudre le problème du réchauffement climatique. Cela n’a5pas empêché des centaines de chercheurs du monde entier de s’attarder sur
ce problème pendant 350 ans. Aucun de ces chercheurs ni des gouvernements
ou mécènes qui les finançaient ne pensait que ces travaux finiraient un jour
entre les mains de chacun d’entre nous. Et pourtant, les courbes elliptiques(et plus généralement les courbes algébriques) constituent, à n’en pas douter,
l’avenir de la cryptographie moderne. Elles sont déjà utilisées dans certains
produits de grande consommation (Blackberry, protection de HD-DVD et
Blue-ray, serveurs de paiement en ligne) et leur récente recommandation par
la NSA (National Security Agency, l’agence de sécurité américaine) leur promet un avenir radieux partout autour de nous (internet, cartes bancaires,téléphonie mobile, vote électronique, télévision payante, ...).
Pour ma part je me suis intéressé aux deux aspects des courbes algébriques, l’aspect “fondamental” et l’aspect “appliqué”. Ces deux aspects nesont bien sûr pas indépendants et les mêmes outils servent dans les deuxcas. J’expliquerai en particulier dans la partie 2.3 comment la variété deKummer, étudiée du point de vue théorique dans la partie 2.2, peut servirà sécuriser les algorithmes de chiffrement basés sur les courbes elliptiques ethyperelliptiques.

2.1

Étude algorithmique de familles de courbes algébriques

Les courbes algébriques sur lesquelles j’ai travaillé sont données par deséquations de la forme
y 2 = f (x),(1)

où f est un polynôme à coefficients dans Q. Lorsque le degré de f vaut
3 ou 4, on a à faire aux courbes elliptiques et lorsque le degré est plus
grand aux courbes hyperelliptiques. Ces courbes possèdent des propriétés
très similaires du point de vue diophantien. D’une part Siegel a démontréen 1928 qu’une courbe elliptique ne pouvait posséder qu’un nombre fini depoints entiers (c’est à dire de couples d’entiers (x,y) vérifiant l’équation (1)).
D’autre part Faltings a démontré dans [Faltings 83] qu’une courbe hyperelliptique (sous-entendu non elliptique) ne pouvait posséder qu’un nombre
fini de points rationnels.
Ces deux propriétés n’ont toutefois pas que leur énoncé comme ressemblance.
Dans les deux cas, en effet, on ne connaı̂t pas de méthode effective pour trouver ces points ni même pour connaı̂tre leur nombre.

6Ces deux problèmes, très similaires, sont donc centraux dans la recherche
actuelle en théorie des nombres et plus particulièrement pour les chercheurs
intéressés par les équations diophantiennes. Dans cette section, je m’intéresse
au premier problème en cherchant des points entiers sur des familles decourbes elliptiques. J’aborderai le second problème dans la section 2.2.
2.1.1

Les “simplest cubic fields”

Soit m un entier positif tel que∆ = m2 + 3m + 9
soit sans facteur carré.
Le corps cubique Km défini par le polynôme irréductible sur Q,
f (X) = X 3 + mX 2 − (m + 3)X + 1
a été introduit dans [Shanks 74] et est appelé un “simplest cubic field”.
Shanks a introduit cette classe de corps car les calculs sont particulièrement
faciles à effectuer sur de tels corps, ce qui leur a valu leur nom. Ces corps ontété par la suite beaucoup étudiés car leur régulateur est explicite et petit.
Ainsi leur nombre de classes a tendance à être particulièrement grand.
Je me suis pour ma part intéressé aux courbes elliptiques définies sur Q
par les équations :Em : Y 2 = X 3 + mX 2 − (m + 3)X + 1 ,(2)pour un entier m définissant un “simplest cubic field”.
Cette famille de courbes elliptiques a été introduite dans [Washington 87].
L’auteur y établit une relation entre le rang de la courbe elliptique E m sur
Q et le 2-rang du groupe des classes de K m . On peut ainsi espérer que lerang des courbes elliptiques de cette famille ne sera pas trop petit, du moins
qu’il sera suffisamment grand pour que ces courbes contiennent des points
entiers. C’est la raison pour laquelle je me suis intéressé au calcul de cespoints sur les courbes de cette famille qui semblaient bien s’y prêter.
Dans un premier temps, j’ai utilisé une méthode permettant de calculer
les points entiers sur une courbe elliptique lorsque son groupe de MordellWeil est connu. Cette méthode développée dans [Stroeker-Tzanakis 94],
[Gebel-Pethö-Zimmer 94], et [Smart 94] entre autres, est basée sur les formes
linéaires de logarithmes elliptiques.
7

Elle m’a permis de calculer tous les points entiers sur les courbes elliptiques
Em pour les valeurs du paramètre m inférieures à 1000 et définissant un“simplest cubic field”. À partir de ces calculs, j’ai émis plusieurs conjecturesconcernant bien sûr les points entiers de ces courbes mais aussi la structure
du groupe de Mordell-Weil E(Q). J’ai finalement démontré ces conjectures
dont la principale concerne le point [0, 1] qui joue un rôle central dans ce
travail. Les résultats les plus intéressants sont en effet :– d’une part la preuve que le point [0, 1] est un générateur du groupe deMordell-Weil,– d’autre part le calcul explicite de tous les multiples entiers de ce point.
J’ai démontré ces résultats pour un entier m quelconque définissant un “simplest cubic field”. C’est le fait de travailler sur une famille infinie qui fait
la difficulté de ces travaux. Ce type de calcul est en effet classique et bien
connu sur une courbe donnée.
Il devient alors possible de déduire de ces deux résultats que, lorsque la
courbe Em est de rang 1, les points entiers de E m sont exactement les points[0, 1], [0, −1] et leurs doubles si m est pair.
C’était la première fois que ce type de travail était réalisé sur une famillede courbes elliptiques et cela a donné lieu à la publication [Duquesne 01].
Ce premier travail a été pour moi la découverte de l’intérêt d’une démarche
expérimentale (expérimentations, conjectures, preuves) en recherche mathématique et m’a encouragé à poursuivre dans cette voie.
Les preuves sont basées sur l’utilisation de la hauteur canonique sur les
courbes elliptiques Em et leur encadrement. Bien évidemment la méthodeemployée n’est pas généralisable à n’importe quelle famille (cela donnerait
une version explicite du théorème de Siegel). Il est en effet nécessaire depouvoir éliminer, grâce à une autre méthode ou à des astuces, les cas où unetelle borne sur les hauteurs canoniques n’existe pas.
J’ai par la suite précisé les conditions pour qu’elle s’applique lors de monétude des “simplest quartic fields” [Duquesne 07a].
En dehors de la problématique des points entiers, le fait de connaı̂tre explicitement le générateur d’une famille de courbes elliptiques ouvre de nouvelles perspectives. En effet la structure du groupe de Mordell-Weil d’une8courbe elliptique est l’outil de base pour une étude poussée de cette courbe.
Avoir à sa disposition une famille de courbes dont on connaı̂t la structureprécise du groupe de Mordell-Weil permet ainsi de faire plus facilement descalculs et des statistiques sur un grand nombre de courbes. Avec Christophe Delaunay, nous avons ainsi étudié dans [Delaunay-Duquesne 03] lesvaleurs critiques des séries L associées aux courbes elliptiques de rang 1
définies par des “simplest cubic fields”. D’après la conjecture de Birch et
Swinnerton-Dyer, ces valeurs sont reliées à des invariants géométriques dela courbe elliptique tels la hauteur canonique du générateur et le groupe deTate-Shafarevitch. La hauteur canonique du générateur étant connue grâce
au travail précédent, on peut déduire des informations sur le groupe de TateShafarevitch habituellement difficilement accessibles surtout sur une famillede courbes. Ce type de travail sur une famille de courbes elliptiques avait
précédemment été réalisé ([Zagier-Kramarz 87]) dans le cas du rang 0 (oùla structure du groupe de Mordell-Weil est particulièrement simple). Outrele fait d’étudier une autre famille pour valider ou moduler les constatations de [Zagier-Kramarz 87], le passage à une famille de courbes de rang
1 apporte d’autres nouveautés. Par exemple, il n’existe que peu d’exemples
dans la littérature de courbes elliptiques de rang non nul et de groupe deTate-Shafarevitch non trivial. Cela est dû à l’existence d’une infinité depoints rationnels (contre un nombre fini en rang nul), il est donc plus difficile de trouver des points p-adiques ne correspondant pas à des points
rationnels (c’est ce déséquilibre local/global que mesure le groupe de TateShafarevitch). Ainsi déterminer l’ordre du groupe de Tate-Shafarevitch pour
un grand nombre de courbes dans ces conditions revêt un intérêt particulier.
Nous avions, à l’époque, constaté (comme Zagier et Kramarz) une densité
positive de courbes de rang strictement supérieur à 1, ce qui est contraire àl’opinion généralement admise sur le sujet. Des calculs plus avancés, réalisésdans [Watkins 07], sur la famille de courbes étudiée par Zagier et Kramarz
d’une part et la théorie des matrices aléatoires d’autre part nous ont par lasuite laissé penser que cette constatation était erronée et que nous n’avionspas poussé les calculs assez loin pour voir la courbe s’infléchir.
Par contre, concernant les fréquences d’apparition des différents ordresdu groupe de Tate-Shafarevtich, nous avons constaté des densités non nulles,ce qui était cette fois en accord avec les heuristiques de [Delaunay 01].
Finalement nous avons utilisés nos calculs pour produire des exemples
de courbes de rang 3 et 5 possédant des groupes de Tate-Shafarevitch non
9triviaux qui sont extrêmement rares dans la littérature.
2.1.2

Les “simplest quartic fields”

Plus récemment dans [Duquesne 07a], j’ai continué l’étude des familles
de courbes elliptiques en faisant un travail similaire à [Duquesne 01] sur une
famille ne possédant pas les mêmes propriétés. J’ai ainsi étudié la famille,
en apparence très similaire, des courbes elliptiques associés aux “simplest
quartic fields”. Les “simplest quartic fields” ont bien sûr la même origine
que les “simplest cubic fields” et les courbes elliptiques qui leur sont associéssont de la forme
Qt : Y 2 = X 4 − tX 3 − 6X 2 + tX + 1,
ou, en envoyant le point [0, 1] à l’infini, de la forme (de Weierstrass)
Ct : y 2 = x3 − (16 + t2 )x.
Certaines propriétés des courbes elliptiques associées aux “simplest cubic
fields” et aux “simplest quartic fields” sont communes. Ainsi, dans les deux
cas, il existe un point d’ordre infini (le point [0, 1]) et je démontre que cepoint est de plus un générateur du groupe de Mordell-Weil. Cela laisse penser
que la méthode utilisée dans [Duquesne 01] (utilisant les encadrements dehauteurs canoniques) peut être étendue à d’autres familles de courbes elliptiques. En fait, j’explique dans [Duquesne 07a] que si on dispose d’un pointd’ordre infini et que celui ci est effectivement générateur, alors la méthodeutilisée dans [Duquesne 01] permet de le démontrer.
Cette propriété est bien sûr fondamentale pour la suite puisqu’elle concerne
la structure du groupe de Mordell-Weil qui doit être connue si on veut aller
plus loin dans l’étude des propriétés arithmétiques des courbes elliptiques(par exemple si on veut connaı̂tre les points entiers).
Ainsi, comme c’était le cas pour les “simplest cubic fields”, la structure
du groupe de Mordell-Weil est complètement déterminée dans le cas descourbes de rang 1 associées aux “simplest quartic fields”. La situation est
toutefois différente pour les points entiers à cause de la présence d’un pointde torsion, ce qui n’était pas le cas avec les courbes elliptiques associées aux“simplest cubic fields”. Trouver exactement les points entiers sur la famillede courbes Ct de rang 1 devient alors impossible avec la méthode utiliséequand le paramètre t est pair. Toutefois une astuce m’a permis de contourner cette difficulté et de trouver quand même les points entiers sur la familledes courbes Qt de rang 1, ce qui était le problème initial.

10

L’autre particularité de la famille des courbes elliptiques définies pardes “simplest quartic fields” est la possibilité d’en extraire une sous-famillede courbes de rang 2 dont on connaı̂t explicitement 2 points d’ordre infini. J’ai dû alors généraliser la méthode utilisée dans [Duquesne 01] pourdémontrer que ces deux points sont indépendants et engendrent la partie
libre du groupe de Mordell-Weil. Le passage à deux points est loin d’être
aisé. Il utilise la méthode de descente infinie décrite dans [Siksek 95] et lerégulateur. Le régulateur étant une différence de hauteurs canoniques, lesbornes sur celles ci doivent être très précises sous peine de trouver de mauvaises bornes sur le régulateur.
Encore une fois la connaissance de la structure complète du groupe deMordell-Weil (ici en rang 2) permet de s’attaquer à la détermination despoints entiers. J’ai donc généralisé la méthode utilisée en rang 1 et obtenu
exactement tous les points entiers sur la sous famille des courbes Q t de rang
2 considérée. Pour des raisons similaires au cas du rang 1, je n’ai pas pu
conclure sur la famille des Ct .
A ma connaissance, c’est la première fois que l’on a autant d’information
sur la structure du groupe de Mordell-Weil et sur les points entiers pour une
famille infinie de courbes de rang 2. Ce travail m’a également permis demieux cerner les cas où les méthodes employées dans [Duquesne 01] peuventêtre utilisées avec succès.
2.1.3

Pistes de futures recherches

Malgré l’orientation plus cryptographique de mes dernières recherches,j’ai plusieurs idées pour continuer mes travaux dans cette voie. La plus
naturelle est de regarder ce qui se passe pour les “simplest quintic fields”
ou les “simplest sextic fields”. On quitte alors le monde des courbes elliptiques pour celui des courbes hyperelliptiques. Le reste de mes travaux
concernant en grande partie les courbes hyperelliptiques, je connais bien lesoutils nécessaires à l’étude des courbes associées à ces corps et des résultats
intéressants devraient pouvoir être obtenus.
D’autre part, très peu de travaux ont été réalisés dans le domaine dela vérification expérimentale de la conjecture de Birch et Swinnerton-Dyer
pour les courbes hyperelliptiques. Des travaux du type de ceux entrepris
dans [Delaunay-Duquesne 03] mais dans le cadre des courbes hyperelliptiques seraient particulièrement intéressants. Cette piste, ainsi que l’étude
de familles de courbes elliptiques tordues quadratiques, fait partie de l’ANR
11

ALGOL dont je fais partie et qui démarre en 2007.

2.2

La Variété de Kummer d’une courbe algébriqueDans cette partie, je m’intéresse à la variété de Kummer d’une courbe
elliptique ou hyperelliptique. Du point de vue théorique, cet objet est simplement le quotient de la Jacobienne de la courbe par l’involution hyperelliptique. Cela signifie qu’il devient impossible de distinguer un diviseur de son
opposé. Du point de vue pratique, cet objet présente l’avantage d’être plus
simple à manipuler que la Jacobienne elle même. Il faut cependant, dans unpremier temps, donner une description explicite de ce quotient et c’est ce quiva me préoccuper dans cette partie. Je donnerai aussi des applications de ce
nouvel outil à des problèmes classiques sur les courbes algébriques commela recherche de points rationnels.
Le fait qu’on ne puisse pas distinguer un élément de son opposé n’est à
priori pas très restrictif. Par exemple dans le cas des courbes elliptiques, cela
revient à ne conserver quepl’abscisse des points qui contient l’essentiel de l’information puisque y = ± f (x). Malheureusement, cela a des conséquences
regrettables sur la loi de groupe. En effet il devient impossible d’additionnerdeux éléments A et B puisqu’il y a confusion pour le résultat entre A + B
et A − B. La loi de groupe de la Jacobienne, si fondamentale dans les applications, n’est donc plus valable dans la variété de Kummer. Cependantdes traces de cette loi de groupe subsistent sur la variété de Kummer. Ainsi,
un élément de 2-torsion est égal à son opposé, de sorte que l’addition par
un élément de 2-torsion reste valable. De la même manière, il est possible
d’ajouter un élément A avec lui-même puisque A − A est l’élément neutre. Il
est donc facilement reconnaissable et il ne peut pas y avoir de confusion avec
A + A. Dans le cas des courbes de genre 2 (et en caractéristique impaire),
Flynn a donné dans [Flynn 93] une version explicite de la variété de Kummer(qui est une surface dans P3 dans ce cas) et a donné des formules permettant
de calculer rapidement ces traces de la loi de groupe. Il a également donné
des formules pour les expressions de la formeki (A + B)kj (A − B) + kj (A + B)ki (A − B),où ki (A) représente la i-ème coordonnée dans P 3 de A. Ces formules sontbien définies sur la surface de Kummer (remplacer A ou B par son opposé
ne les modifie pas) et permettent de faire explicitement la somme de A etde B sur la surface de Kummer si leur différence est connue.

12Dans [Cassels-Flynn 96] Flynn reprend cette construction et décrit deux
applications importantes de cette description complète des traces de la loi
de groupe de la Jacobienne sur la surface de Kummer. La première est ledéveloppement d’une théorie explicite des hauteurs ([Flynn 95]) sur les Jacobiennes de courbes de genre 2 permettant d’effectuer une descente infinie[Flynn-Smart 97]. Cette descente infinie est la dernière étape du processus
permettant de calculer les générateurs du groupe de Mordell-Weil. La seconde concerne la recherche des points rationnels d’une telle courbe.
2.2.1

Utilisation pour la recherche des points rationnels d’une
courbe hyperelliptique

Le théorème de Faltings permet d’affirmer qu’il n’y a qu’un nombre finide points rationnels sur une courbe de genre 2 sans toutefois donner d’angled’attaque pour les déterminer. Une version plus explicite de ce résultat avaitété donnée précédemment dans [Chabauty 41] mais à la condition que le rang
de la Jacobienne soit strictement inférieur au genre de la courbe.
Dans [Flynn 97], la description de la surface de Kummer permet d’élaborer une méthode explicite pour appliquer le théorème de Chabauty à une
courbe de genre 2 dont le rang de la jacobienne vaut 1 (le cas du rang 0
est résolu depuis longtemps puisqu’il ne s’agit que de calculer la torsion).
Plus précisément, cette méthode permet de borner de façon fine le nombrede points rationnels et dans la plupart des cas, on peut ainsi connaı̂tre effectivement tous les points rationnels. Le principe simplifié de cette méthodeest le suivant :– On considère connue la structure du groupe de Mordell-Weil (c’est àdire sa torsion et un générateur G puisqu’on est en rang 1).
– Pour chaque élément de torsion T , on cherche un point rationnel sousla forme T + nG.
– On utilise la surface de Kummer pour assurer l’annulation d’une série
formelle p-adique en n.
– On utilise le théorème de Strassman pour trouver une borne sur lenombre de valeurs de n annulant cette série formelle.
– En recollant toutes ces bornes, on obtient une borne sur le nombre depoints rationnels.
– Si cette borne correspond aux nombre de points déjà connus, ce qui
est souvent le cas, le problème de trouver tous les points rationnels est
résolu.
Bien sûr, “souvent” ne veut pas dire “tout le temps” et les cas restants sont13sources de nouvelles idées et de nouvelles méthodes de résolution.
La plus prometteuse d’entre elle est la méthode dite de Chabauty elliptique. C’est fondamentalement la même méthode : au lieu de travailler sur
une courbe de genre g dont le rang de la jacobienne est strictement inférieurà g, on travaille avec une courbe elliptique définie sur un corps de nombresde degré d et dont le rang r est strictement inférieur à d. En utilisant la loi
de groupe formelle sur cette courbe elliptique, on se ramène également à unecondition d’annulation de séries formelles.
Il existe plusieurs méthodes pour ramener le problème de la recherchede points rationnels sur une courbe hyperelliptique à celle d’un problèmerésoluble par la méthode de Chabauty elliptique et ces approches ont permis
de résoudre bon nombre de cas où la méthode de Chabauty usuelle ne permettait pas de conclure ([Flynn-Wetherell 99], [Bruin 99],[Flynn-Wetherell 01],
[Flynn 01], [Duquesne 03]).
Ces exemples restent cependant dans la même catégorie que la méthodede Chabauty pour les courbes de genre 2, à savoir que le rang de la courbe
elliptique vaut 1 et qu’une seule série formelle en une seule variable doit s’annuler. Un nouveau problème se pose donc : que faire dans le cas où la courbe
elliptique est de rang strictement supérieur à 1 (et bien sûr toujours strictement inférieur à d). La méthode (tout comme une éventuelle méthode de
Chabauty basée sur la variété de Kummer d’une courbe dont la Jacobienne
a un rang strictement supérieur à 1) conduit alors non pas à l’annulationd’une série formelle en une variable, mais à l’annulation simultanée de d − 1séries formelles en r variables (et on voit bien ici d’ailleurs pourquoi le rang
doit être strictement inférieur au degré).
Dans [Duquesne 02a], j’ai utilisé le théorème de préparation de Weierstrass pour généraliser le théorème de Strassman au cas de plusieurs variables,
j’en ai écrit une version explicite et déduit un algorithme permettant donc
de borner effectivement et finement le nombre de solutions d’un système deséries formelles. Cela m’a permis de traiter le cas des points rationnels d’une
courbe hyperelliptique de genre 4 dont le rang de la jacobienne vaut 4. Biensûr cette courbe ne vérifie pas les conditions du théorème de Chabauty, maisle problème de trouver ses points rationnels se ramène au problème de Chabauty elliptique pour une courbe de rang 2 définie sur un corps de nombresde degré 3 (qui rentre dans le cadre de la méthode de résolution donnée dans[Duquesne 02a])14

2.2.2

Cas des courbes de genre 3

La construction explicite de la variété de Kummer par Flynn a ainsi
eu des applications variées et importantes quant à l’étude des propriétésarithmétiques et géométriques des courbes de genre 2. Il semble donc naturel d’essayer de les généraliser au cas des courbes hyperelliptiques de genre
3 en espérant que les applications pourront également se généraliser.
Dans [Stubbs 00], un doctorant de Flynn a commencé ce travail endécrivant la variété de Kummer d’un courbe hyperelliptique de genre 3
définie sur un corps de caractéristique impaire par une équation de la forme
y 2 = f (x) où f est un polynôme de degré 7.
Il donne ainsi un plongement de la variété de Kummer dans P 7 ainsi que 27
équations polynômiales explicites reliant ses coordonnées dans P 7 . Dans lecas du genre 2, la variété de Kummer était une surface de P 3 , c’est à direqu’une seule telle équation suffisait à la décrire. Les objets manipulés en
genre 3 sont donc bien plus complexes qu’en genre 2 et les calculs sont bienplus lourds à réaliser.
Exactement comme dans le cas des courbes de genre 2, la structure degroupe de la jacobienne est perdue en passant dans la variété de Kummer
mais les calculs s’en retrouvent considérablement simplifiés. Il reste cependant des traces de la loi de groupe qui sont d’ailleurs les mêmes que dans lecas des courbes de genre 2. L’objectif de [Duquesne 02b] était d’étudier ces
traces de la loi de groupe. J’ai, dans un premier temps, calculé la matriced’addition d’un élément de 2-torsion. Pour cela, j’ai suivi la méthode employée par Flynn moyennant quelques modifications techniques permettant
d’accélérer les calculs qui auraient été trop lourds si une simple généralisation
avait été effectuée. De plus, dans le cas du genre 2, une astuce est nécessaireà la fin du calcul pour remplir la dernière ligne de la matrice. Dans le cas
du genre 3, ce sont les 4 dernières des 8 lignes qui doivent être déterminées
et l’astuce utilisée par Flynn en genre 2 n’est plus suffisante.
L’addition d’un élément de 2-torsion n’est pas qu’une simple trace de laloi de groupe sans intérêt. Elle est à la base de la méthode utilisée par Flynn
pour déterminer explicitement les formes biquadratiques B ij telles queki (A + B)kj (A − B) + ki (A − B)kj (A + B) = Bij (A, B).
En effet, le calcul direct de ces expressions aurait été irréalisable (commeon le verra dans la partie suivante) avec les moyens dont Flynn disposait
15

à l’époque et il est certainement toujours irréalisable pour les courbes degenre 3.
La méthode que Flynn emploie en genre 2 et que j’ai généralisée en
genre 3 est très surprenante mais terriblement efficace ; elle consiste à calculer les Bij en faisant l’hypothèse que B est un élément de 2-torsion maissans l’exprimer dans ses coordonnées. Autrement dit on prend un élément
B quelconque et on calcule les coordonnées de A + B et de A − B en utilisant la matrice d’addition d’un élément de 2-torsion précédemment calculée.
Le résultat obtenu n’est alors, à priori, valable que pour les éléments de 2torsion mais un argument d’indépendance des produits 2 à 2 des coordonnéesformelles de A permet de conclure à leur validité pour un élément B quelconque. Cette méthode se généralise bien aux courbes hyperelliptiques degenre 3 sauf que l’argument d’indépendance ne peut être utilisé tel quel àcause des 27 relations définissant la variété de Kummer. Un argument dumême type mais plus fin doit être utilisé.
Comme dans le cas du genre 2, ces résultats m’ont permis d’esquisser une
théorie explicite des hauteurs pour les courbes hyperelliptiques de genre 3
définies par un polynôme de degré 7.
2.2.3

Cas des courbes de genre 2 en caractéristique 2

Dans tous ses travaux, Flynn se place en caractéristique impaire. Les
différences avec la caractéristique 2 sont multiples puisque même l’équationde la courbe de départ n’a pas la même forme. Les outils utilisables sont trèsdifférents et la plupart des applications des travaux de Flynn sont en caractéristique nulle (et même sur Q à vrai dire). Il n’était donc pas nécessairepour lui de se compliquer la tâche avec la caractéristique 2. Comme détaillédans la section 2.3, j’ai pour ma part trouvé des applications de la variété deKummer en cryptographie. Les corps finis de caractéristique 2 sont souvent
utilisés en cryptographie si bien que le besoin d’une théorie analogue à cellede Flynn s’est vite fait ressentir en caractéristique 2.
Je me suis donc attelé à cette tâche dans [Duquesne 07b]. J’ai dû redéfinirle plongement dans P3 de la surface de Kummer ainsi que recalculer sonéquation, puis déterminer la matrice de l’addition d’un élément de 2-torsion.
J’ai fait tout ceci avec des méthodes similaires à celles employées par Flynnen caractéristique impaire à ceci près que l’on tombe souvent sur des difficultés propres à la caractéristique 2. Il a fallu ensuite calculer les formes biquadratiques permettant d’additionner deux éléments de la surface de Kum16

mer si leur différence est connue. Comme je l’ai expliqué dans le paragrapheprécédent, Flynn supposait pour cela que B était un élément de 2-torsion
et utilisait la matrice d’addition d’un élément de 2-torsion bien définie surla surface de Kummer. Malheureusement, ceci ne peut pas être appliqué encaractéristique 2 pour la simple et bonne raison que les expressionski (A + B)kj (A − B) + kj (A + B)ki (A − B),sont toutes nulles si B est un élément de 2-torsion. Cette obstruction à unegénéralisation trop simpliste de la méthode de Flynn illustre d’ailleurs trèsbien le type de problèmes rencontrés en caractéristique 2.
J’ai donc dû m’attaquer directement au cas où A et B sont des éléments
quelconques de la surface de Kummer. Les calculs deviennent alors vite trèsgourmands. En effet les éléments A et B sont définis par 8 variables reliées
par 4 équations et ce travail nécessite des polynômes de degré supérieur à
10 en ces 8 variables, le tout sur un corps défini à l’aide de 10 variables (lescoefficients de la courbe). Dans ces conditions une simple multiplication mal
placée a vite fait de prendre toute une nuit de calcul ou d’utiliser toute lamémoire de la machine. J’ai donc dû utiliser des astuces pour alléger ces
calculs et les rendre possibles. J’ai par exemple dû faire des essais sur deséléments B ayant certaines particularités ou même sur des exemples pourdeviner la forme que devraient avoir les formes biquadratiques (ou mêmela forme des résultats intermédiaires). Cela a permis de diminuer les ressources informatiques nécessaires en rajoutant des contraintes sur le résultat.
Comme dans le cas des familles de courbes elliptiques que j’ai étudiées etbien que dans un registre tout à fait différent, une démarche expérimentale
m’a ainsi permis d’obtenir des résultats significatifs.
2.2.4

Pistes de futures recherches

Du point de vue de la construction de variétés de Kummer et applications arithmétiques, le cas du genre 3 ouvre de nombreuses portes. Il seraitbien sûr intéressant de généraliser la construction de la variété de Kummer
et la description explicite des traces de la loi de groupe aux courbes hyperelliptiques de genre 3 définies par un polynôme de degré 8 ou aux courbes
de genre 3 non hyperelliptiques. Cependant, même dans le cas des courbes
définie par un polynôme de degré 7, il reste beaucoup à faire. Je n’ai par
exemple pas encore calculé les constantes permettant de borner la hauteurd’un élément car il est fort probable que leur taille les rende inexploitables
en pratique (ce n’est déjà pas efficace en genre 2). Mes espoirs reposent sur
une version équivalente de la méthode que Flynn emploie pour améliorer ces
17constantes dans le cas des courbes de genre 2. Cela permettrait d’écrire un
algorithme pour le calcul du sous-groupe de torsion de la jacobienne et pourla descente infinie qui sont deux des étapes majeures de la déterminationde la structure du groupe de Mordell-Weil. Malheureusement la méthode de
Flynn ne peut pas se généraliser telle quelle puisqu’elle utilise le fait que
toutes les courbes de genre 2 sont hyperelliptiques, ce qui n’est plus le cas
en genre 3. Une nouvelle approche est donc nécessaire.
A plus long terme, on peut espérer une méthode de Chabauty analogue àcelle de Flynn pour les courbes de genre 3.

2.3

Application à la cryptographie : arithmétique résistante
aux fuites sur les courbes algébriques

Une grande partie de mes travaux dans le domaine de la cryptographie
tourne autour de la résistance aux fuites et c’est donc cet aspect que jevais détailler dans cette partie. Une première approche de la cryptographie
consisterait à se satisfaire d’une primitive cryptographique mathématiquement robuste (comme RSA ou ECC) et à l’implémenter. Malheureusement,
le monde réel n’est pas aussi idyllique que le monde abstrait des mathématiques. Ainsi, même si le problème mathématique sous-jacent est incassable,
son implémentation peut facilement s’avérer désastreuse et révéler très rapidement des informations capitales sur les secrets à protéger, voire les secrets
eux-mêmes. Les implémentations sur des systèmes embarqués, comme lescartes à puces, sont plus particulièrement sensibles à cette problématique
puisque l’attaquant a accès à l’ensemble du système de chiffrement. Ce typed’attaques, couramment appelées attaques par canaux cachés, est basé surl’observation d’informations fuyant de la carte à puce, comme ses temps
d’exécution ([Kocher 96]), sa consommation ([Kocher-Jaffe-Jun 99]) ou son
rayonnement électromagnétique ([Quisquater-Samyde 01]). Contrairement àce qu’on pourrait penser, ce type d’information est accessible relativement
facilement et pour un coût modeste (par rapport aux enjeux). Il faut enfin
noter que ces attaques ne sont pas exclusivement orientées vers les systèmes
embarqués ; il a par exemple été possible de réaliser une attaque par canauxcachés en analysant le bruit produit par un ordinateur à travers un mur.
Il existe deux types d’attaques par canaux cachés. D’une part, celles dites
simples qui tirent les informations directement d’une seule opération spécifique et d’autre part celles dites différentielles qui utilisent des méthodes
statistiques sur un grand nombre de réalisations d’une opération. D’après[Coron 99], il est toujours possible et relativement peu coûteux de se prémunir
18

contre les attaques différentielles. Je me suis donc plus particulièrementintéressé aux attaques simples.
Supposons par exemple qu’on sache analyser avec un oscilloscope laconsommation d’une carte à puce sur laquelle est implémenté un algorithme
simple de multiplication scalaire sur les courbes elliptiques : le double-andadd. Cette méthode, aussi appelée méthode du paysan russe ou squareand-multiply si on l’applique sur un groupe multiplicatif, est une simple
application du schéma de Hörner et est à la base de toutes les méthodes demultiplication scalaire ou d’exponentiation.
La multiplication scalaire d’un entier k par un point de la courbe P est
l’opération centrale dans le domaine de la cryptographie basée sur les courbes
elliptiques. Dans la plupart des protocoles cryptographiques k est la clésecrète.
L’algorithme de double-and-add fonctionne de la façon suivante : pourchaque bit de la clé k, il effectue un doublement et si le bit vaut 1 il ajoute
le point P . Une addition et un doublement étant obtenus avec des formules
différentes sur une courbe elliptique, les opérations effectuées par la carteà puce sont différentes selon que le bit de la clé vaut 0 ou 1. En pratique,l’image obtenue sur l’oscilloscope ressemble à ceci.

On peut alors lire à l’œil nu l’enchaı̂nement des bits de k et donc la clék elle-même. Ainsi, il est possible de retrouver la clé utilisée sans avoir àcasser un logarithme discret.
Pour parer ces attaques, il est donc nécessaire que les opérations effectuées sur la courbe elliptique ne dépendent plus des bits de la clé. Il
existe plusieurs types de méthodes pour y parvenir.
– La plus simple est d’ajouter des opérations inutiles dans les calculs. On
peut ainsi, dans l’exemple précédent, décider d’effectuer une addition
19

fantôme quand le bit de la clé vaut 0. Cette solution a l’avantage dela simplicité mais elle est coûteuse et surtout sensible aux attaquespar injection de faute (si on force la puce à faire une faute au moment
ou elle effectue une opération fantôme, cela n’a pas d’incidence sur lerésultat final et on peut alors en déduire qu’au moment de l’injection
de la faute, le bit de la clé valait 0).
– Une autre méthode consiste à utiliser des représentations des courbes
elliptiques telles que le doublement d’un point et l’addition de deux
points utilisent les mêmes formules. C’est la méthode des formules
unifiées.
– La dernière possibilité est d’utiliser un algorithme exposé pour lapremière fois dans [Montgomery 87]. Cet algorithme consiste à neconsidérer que l’abscisse d’un point sur une courbe elliptique. Il ala particularité d’utiliser à la fois un doublement et une addition pourchaque bit de la clé ce qui ne laisse donc pas de trace de la clé.
J’ai, pour ma part, apporté des améliorations ou des contributions à cesméthodes et surtout généralisé la troisième au cas des courbes hyperelliptiques de genre 2.
2.3.1

Formules unifiées : forme de Jacobi d’une courbe elliptique

Des formules unifiées pour l’addition et le doublement peuvent être obtenues de différentes façons. Elles sont décrites en détail dans [Cohen-et-al 06].
L’une d’entre elles utilise la forme de Jacobi d’une courbe elliptique ayant
un point de 2-torsion ([Liardet-Smart 01]). D’après [Billet-Joye 03], ces formules nécessitent, pour chaque bit de l’exposant, 16 multiplications sur lecorps de base et 14 sous certaines conditions. Jusqu’à mes améliorations,ces formules étaient les plus efficaces pour une courbe ayant un point de
2-torsion. J’ai en effet réussi dans [Duquesne 07b] à faire descendre cettecomplexité à 14 multiplications et 12 sous certaines conditions, par ailleursmoins contraignantes que celles de [Billet-Joye 03].
Un courbe elliptique sous forme de Jacobi est donnée par une équation
Y 2 = εX 4 − 2δX 2 Z 2 + Z 4 .

(3)Un point est représenté par un triplet (X, Y, Z) satisfaisant cette équation
et il est prouvé dans [Billet-Joye 03] que toute courbe elliptique définie
sur un corps premier et ayant un point de 2-torsion peut se mettre souscette forme. J’ai réussi à améliorer la complexité des formules fournies dans20[Billet-Joye 03] en changeant la représentation des points (je les ai représentépar un quadruplet (X 2 , XZ, Z 2 , Y )) et en adaptant les formules. Il faut toutefois noter qu’une transformation d’une représentation à l’autre doit être
effectuée en début et en fin de calcul de la multiplication scalaire mais soncoût est négligeable.
D’autre part, dans mes formules (comme dans celles de [Billet-Joye 03])
2 multiplications par ε interviennent. Il est donc particulièrement intéressantd’essayer de se ramener au cas où ε est petit. Billet et Joye montrent que l’onpeut souvent se ramener à ce cas à condition que la courbe elliptique possède3 points de 2-torsion. J’ai également amélioré ce résultat en démontrant
que non seulement la présence d’un seul point de 2-torsion était suffisantemais encore qu’on pouvait négliger les multiplications par ε dans de plus
nombreux cas.
2.3.2

Utilisation de la surface de Kummer en genre 2

J’ai déjà mentionné le fait que Montgomery utilisait seulement l’abscissed’un point sur une courbe elliptique pour décrire un algorithme de multiplication scalaire nécessitant, pour chaque bit de la clé, une addition et un
doublement sur la courbe elliptique. Cet algorithme est donc naturellement
protégé contre les attaques par canaux cachés simples et il a beaucoup desuccès chez les développeurs sur carte à puce. Il n’est cependant pas applicable sur toutes les courbes elliptiques (et en particulier sur les courbes fournies dans les standards) sans les généralisations apparues plus récemment
dans [Brier-Joye 02].
Dans le cadre des courbes elliptiques, ne conserver que l’abscisse despoints est assez naturel puisque l’ordonnée ne porte que peu d’information et n’est même pas nécessaire dans tous les protocoles cryptographiques.
L’inconvénient est qu’on ne peut plus distinguer un point de son opposé.
Cela n’est bien sûr pas sans rappeler la variété de Kummer étudiée dans lapartie 2.2. Les traces de la loi de groupe sur la variété de Kummer d’une
courbe elliptique (doublement, formes biquadratiques) permettent aisément
de retrouver, par un autre moyen que celui employé par Montgomery, les formules d’addition et de doublement données dans [Montgomery 87] et dans[Brier-Joye 02].
Il n’y a alors qu’un pas à franchir pour généraliser la méthode de Montgomery aux courbes hyperelliptiques de genre 2 puisque la plupart des outils
21

nécessaires ont été présentés dans la partie 2.2. Ces outils sont en effet d’unepart le doublement qui reste bien défini sur la surface de Kummer et d’autre
part les formes biquadratiques qui permettent d’additionner deux éléments
si leur différence est connue.
J’ai pu transposer l’algorithme de multiplication scalaire donné par Montgomery au cas des courbes hyperelliptiques sans trop de difficulté. Son but
est le calcul de kA où A est un élément de la Jacobienne (ou de la surface deKummer) et k est un scalaire (dans les cas qui nous intéressent, k est censé
rester secret). Étant donné qu’on ne sait additionner deux éléments que sileur différence est connue, le principe de base de cet algorithme est de garder à disposition, à chaque étape, le couple (nA, (n + 1)A) de sorte que leurdifférence est connue (et même constante égale à A). Si le bit de k à cetteétape vaut 0, on calcule (2nA, (2n + 1)A) en effectuant un doublement (celui
de nA) et une addition de deux éléments dont on connaı̂t la différence (nAet (n+1)A) et si le bit vaut 1, on calcule ((2n+1)A, (2n+2)A) en effectuant
un doublement (celui de (n + 1)A) et une addition de deux éléments dont on
connaı̂t la différence (nA et (n + 1)A). Il est alors facile de voir que lorsque
tous les bits de k ont été décrits, le premier élément du couple est kA. Ainsi,
pour chaque bit de la clé, on a bien effectué à la fois un doublement et une
addition et on n’a utilisé que les traces de la loi de groupe sur la variété deKummer.
Cependant les résultats obtenus par une retranscription basique des formules de [Flynn 93] sont décevants en terme d’efficacité. Il m’a donc fallu
chercher à optimiser les formules pour réduire leur complexité globale. Le
résultat, bien que bien meilleur, n’est toutefois toujours pas comparable avec
les complexités obtenues dans [Montgomery 87]. Cela est tout à fait logique
puisque Montgomery utilise des courbes elliptiques d’une forme particulière.
J’ai donc dû, moi aussi, définir une forme particulière de courbes hyperelliptique de genre 2 bien adaptée à mes formules sans trop perdre en généralité
comme l’avait fait Montgomery.
Finalement les formules que j’ai obtenues dans [Duquesne 05] sont compétitives avec les meilleures formules connues pour les courbes hyperelliptiques de genre 2 ([Lange 02]) et apportent en plus une protection contre les
attaques par canaux cachés simples.
Pour finir, je me suis plus récemment intéressé à un autre type de protection contre les attaques par canaux cachés. La représentation RNS des22

nombres procure en effet aux opérations sur le corps de base une protection
contre les attaques par fuite. Il était donc intéressant d’essayer de combiner
cette technique avec les techniques de protection au niveau de la courbeévoquées précédemment.
2.3.3

Représentation des nombres par restes modulaires appliquée
aux courbes elliptiques

Pour finir, je me suis plus récemment intéressé à un autre type de protection contre les attaques par canaux cachés. La représentation RNS desnombres procure en effet aux opérations sur le corps de base une protection
contre les attaques par fuite. Il était donc intéressant d’essayer de combiner
cette technique avec les techniques de protection au niveau de la courbeévoquées précédemment.
Le système de représentation des nombres par restes modulaires (RNS) aété introduit dans [Garner 59] et [Szabo-Tanaka 67] et appliqué à la cryptographie dans [Bajard-Didier-Kornuerup 01]. Il présente de nombreux avantages :– Il est facile à implémenter, notamment en hardware.
– Il est naturellement (et donc efficacement) parallélisable.
– Il procure une protection contre les attaques par canaux cachés sur lecorps de base ([Bajard-Imbert-Liardet-Teglia 04]).
– Une même implémentation peut facilement être utilisée pour plusieurs
corps de base.
C’est un système basé sur le théorème des restes chinois. Le principe
est de représenter un élément de F p par ses restes modulo suffisamment denombres de petite taille. Son intérêt réside dans le fait que les opérations sur
des grands nombres sont découpées en des opérations sur des petits nombresqu’on choisira de la taille d’un mot machine pour une efficacité optimale.
Ainsi une multiplication de deux nombres de n mots s’effectue en seulement
2n multiplications de mots au lieu des n 2 habituelles (pour les tailles denombres intéressantes en cryptographie elliptique et hyperelliptique). Leschoses ne sont malheureusement pas aussi simples. En effet, pour que cettetechnique s’applique, il faudrait que p soit le produit de nombres de la tailled’un mot machine, or p est premier. Pour contourner cet obstacle on utilise
un analogue de la méthode de réduction très utilisée de [Montgomery 85].
Cette méthode utilise une représentation spécifique des éléments de F p pourtransformer une réduction modulo p en une réduction modulo une puissancede 2 (une simple troncature, donc). Pour le RNS, on construit ainsi un M
23supérieur à p, produit de nombres de la taille d’un mot machine, et on utilise la méthode de Montgomery en remplaçant la puissance de 2 par M . On
remplace ainsi la réduction modulo p par une réduction modulo M .
En utilisant la représentation des nombres par restes modulaires, la multiplication devient donc de complexité linéaire alors que la réduction reste
quadratique. Ainsi la réduction devient l’opération la plus coûteuse. Dans
[Bajard-Duquesne-Ercegovac-Meloni 06] nous avons expliqué qu’il était donc
intéressant de regrouper les expressions de la forme AB + CD de façon àn’effectuer qu’une seule réduction au lieu de deux. Nous avons appliqué cela
aux formules de [Brier-Joye 02]. Cependant, il est possible de faire mieux en
optimisant les formules habituellement utilisées pour minimiser non pas lenombre de multiplications mais le nombre de réductions modulaires. Dans
[Bajard-Duquesne-Ercegovac 07], nous avons fait ce travail pour toutes lesformules sur les courbes elliptiques qui sont protégées contre les attaques par
canaux cachés. Les résultats obtenus sont particulièrement intéressants dansle cas des formules de [Brier-Joye 02] utilisant l’algorithme de Montgomery(celui pour la multiplication scalaire sur les courbes elliptiques). En effet,
en faisant une fois de plus appel aux outils de la surface de Kummer (plusprécisément en n’utilisant pas les mêmes formes biquadratiques que cellesqui permettent de retrouver les formules de [Brier-Joye 02]), nous avons obtenu des formules plus adaptées à la représentation RNS, c’est à dire faisantintervenir moins de réductions modulaires au détriment des multiplications.
Dans ce même article, nous avons également diminué la complexité de laréduction en RNS par rapport aux travaux antérieurs en regroupant certaines opérations. Ces deux améliorations mises ensemble nous permettent
d’obtenir des complexités globales compétitives avec les autres systèmes dereprésentation des nombres (et même meilleures pour des hauts niveau desécurité). Étant donnés les avantages apportés par la représentation RNS
décrits au début de ce paragraphe, l’utilisation du RNS en cryptographie
basée sur les courbes elliptiques devient donc intéressante.
2.3.4

Pistes de futures recherches

Dans cette voie, plus que des pistes, j’ai de nombreux projets de recherche en cours dans la continuité des derniers travaux que j’ai effectués. Je
compte ainsi essayer d’appliquer les formules pour la multiplication scalairede Montgomery en genre 2 obtenues dans [Duquesne 05] à la représentation
RNS. La difficulté consistera à réussir à minimiser le nombre de réductions
sur des formules bien plus complexes que dans le cas des courbes ellip24

tiques. Dans un avenir très proche, j’ai également l’intention d’utiliser lesrésultats de [Duquesne 07b] pour développer une méthode de multiplication scalaire de Montgomery pour les courbes de genre 2 définies sur uncorps de caractéristique 2. Afin d’améliorer l’efficacité de cet algorithme, je
compte m’appuyer sur [Byramjee-Duquesne 04] afin de faire de bons choix
de courbes sans trop perdre en généralité.
A plus long terme, un premier projet avec J.C. Bajard consisterait àaméliorer la réduction RNS où les changements de base ont un poids déraisonnable
et un autre projet utiliserait les résultats que j’ai obtenus sur les variétés deKummer en genre 3 ainsi que d’éventuelles améliorations pour produire un
algorithme de multiplication scalaire de Montgomery en genre 3.

3

Sujets de thèse des doctorants codirigés

Je coencadre 2 doctorants sur des sujets de cryptographie à la frontièreentre les mathématiques et l’informatique. Dans les deux cas, Jean Claude
Bajard est l’autre coencadrant.

3.1

Nicolas Méloni (2004-2007)

Le sujet de thèse de Nicolas Méloni porte sur l’arithmétique des courbes
elliptiques pour la cryptographie. Nous lui avons plus précisément demandéde se concentrer sur les différentes représentations possibles autant au niveau
du corps de base qu’au niveau de l’exposant ou de la courbe et d’en déduirede nouveaux algorithmes de multiplication scalaire ou des améliorations aux
algorithmes existants.
Son travail le plus important a commencé par le développement de nouvelles formules d’addition sur les courbes elliptiques de deux points ayant lamême coordonnée Z en coordonnées Jacobiennes. Ces formules ont l’avantage d’être beaucoup plus efficaces que les formules habituellement utilisées.
En contrepartie, il n’est pas trivial de les mettre en oeuvre dans une multiplication scalaire. Il parait en effet hautement improbable que deux points pris
au hasard aient la même coordonnée Z et ces formules ne s’appliquent donc
jamais. Il remarque toutefois, qu’en effectuant l’opération P 3 = P1 + P2 , il
est possible de modifier légèrement ses formules pour qu’en sortie P 1 et P3(ou P2 et P3 ) aient la même coordonnée Z. De la sorte, il peut construire unechaı̂ne d’addition où la coordonnée Z des 2 opérandes est la même à chaqueétape. Le cas idéal pour une telle chaı̂ne d’addition est le cas où le scalaire
25

utilisé est un nombre de Fibonacci. Ce n’est bien sûr pas toujours le cas,loin de là. Nicolas Méloni a donc dû utiliser les représentations de Zeckendorf(sommes de nombres de Fibonacci). L’algorithme obtenu marche très bien
mais comprend malheureusement plus d’étapes (44% en plus) qu’une multiplication scalaire classique ce qui annule le gain d’efficacité obtenu via ses
nouvelles formules. Il a donc dû aller plus loin et utiliser les chaines d’additions euclidiennes. Celles-ci sont une généralisation des chaı̂nes obtenues parla représentation de Zeckendorff et permettent, à chaque étape, de choisir si
on additionne P3 avec P1 ou avec P2 . Il existe plusieurs façons de représenterun entier en utilisant de telles chaı̂nes et le but est bien sûr de trouver cellesqui sont les plus courtes possibles afin de gagner en efficacité. Là encore, latâche n’est pas aisée. En pratique, Nicolas Méloni obtient finalement un algorithme à peu près compétitif avec les meilleurs algorithmes connus. Il faut en
outre noter que, comme seules des additions sont effectuées, cet algorithme
est naturellement résistant aux attaques par canaux cachés. Il a également
proposé une approche consistant à utiliser des chaı̂nes différentielles et à lesadapter à ces nouvelles formules et compte bien continuer dans cette voie
pour améliorer son algorithme. Ce travail a donné lieu à plusieurs exposéset à deux publications
New Point Addition Formulae for ECC Applications WAIFI, Lecture Notes
in Comput. Sci. 4547 (2007).
SPA resistant Elliptic Curve Cryptosystem using Addition Chains avec A.
Byrne, F. Crowe, W. P. Marnane, A. Tisserand et E. M. Popovici, 4th International Conference on Information Technology (2007), pp. 995-1000.
Nicolas Méloni a également effectué plusieurs travaux sur la représentation des nombres par restes modulaires (RNS). J’ai déjà introduit cettetechnique dans la partie 2.3.3, je me contente donc ici de décrire brièvement
les résultats auxquels il a participé. Il a ainsi participé à déterminer desbases de modules particulièrement bien adaptées au RNS en utilisant, pourles modules, des nombres inspirés des nombres premiers de Mersenne ou despseudo-Mersenne. Il a également pris part à l’élaboration d’un algorithmed’inverse modulaire en RNS qui n’était jusque là pas satisfaisant. Enfin il
a travaillé avec moi, entre autres, sur
P l’intérêt que peut apporter le RNS
lorsque des expressions de la forme
Ai Bi doivent être calculées. Ces travaux ont également donné lieu à des exposés et à trois publications.
Residue systems efficiency for modular products summation : Application26

to Elliptic Curves Cryptography, avec J.-C. Bajard, S. Duquesne et M. Ercegovac, proc. SPIE 6313 (2006), 631304.
Study of modular inversion in RNS, avec J.-C. Bajard et T. Plantard, proc.
SPIE 5910 (2005), 59100T.
Efficient RNS Bases for Cryptography avec J.-C. Bajard et T. Plantard,
proc. IMACS’2005 World Congress.

3.2

Nadia El Mrabet (2006-2009)

Le sujet de thèse de Nadia El Mrabet est plus particulièrement orientévers l’utilisation de couplages en cryptographie et des modifications qui pourraient être apportées pour améliorer les algorithmes où ils interviennent. Cesaméliorations peuvent être de l’ordre de l’efficacité mais aussi de l’ordre dela robustesse des calculs.
Le couplage de Weil est un outil connu depuis longtemps par les théoriciens
des nombres s’intéressant aux courbes elliptiques. Leur intérêt du point devue de la cryptographie est qu’ils permettent de ramener le problème difficile
du logarithme discret sur les courbes elliptiques au problème un peu moinsdifficile du logarithme discret sur le groupe multiplicatif d’un corps fini. Ils
ont ainsi été utilisés pour la première fois en cryptographie au début desannées 90 comme moyen d’attaque sur certaines courbes pour lesquelles lelogarithme discret sur le corps fini est résoluble. Ce n’est que plus récemment(2000) qu’on s’est rendu compte qu’ils pouvaient aussi être utilisés pourconstruire de nouveaux protocoles cryptographiques, comme la cryptographie basée sur l’identité, impossibles à réaliser auparavant. Depuis, l’engouement pour ce nouvel outil n’a cessé de croı̂tre.
Les deux principaux couplages sont le couplage de Weil, déjà évoqué, etle couplage de Tate qui ont tous deux connu de nombreuses améliorations.
Le premier (et pour l’instant unique puisqu’elle n’a fait qu’un an de thèse)travail de Nadia El Mrabet a consisté à comparer deux articles récents (l’unde Koblitz et Menezes et l’autre de Granger, Page et Smart) qui annoncent
des résultats contradictoires quant à la supériorité d’un couplage sur l’autre.
Elle a ainsi pu, dans un premier temps, se familiariser avec les améliorations
les plus récentes sur les couplages. Elle a ensuite essayé d’appliquer lesaméliorations de l’un aux méthodes de l’autre pour enfin réaliser une comparaison la plus objective possible entre les deux. Son résultat est que le27

couplage de Weil est plus intéressant que le couplage de Tate pour les hauts
niveaux de sécurité. Elle fournit bien sûr des données chiffrées précises dansson article sur ce sujet.
Pairing in cryptography : an arithmetic point of view, avec J.C. Bajard,proc. SPIE 6697 (2007), 669724.
Elle connaı̂t maintenant donc mieux les subtilités de l’implémentation
des couplages et va pouvoir s’intéresser à des sujets plus pointus et encore
peu explorés comme par exemple la résistance des algorithmes existants
aux attaques par canaux cachés et bien sûr le développement de nouveauxalgorithmes plus résistants.

Références[Bajard-Didier-Kornuerup 01] J.C. Bajard, L.S. Didier, P. Kornerup, Modular multiplication and base extension in residue number systems, 15th
IEEE Symposium on Computer Arithmetic, IEEE Computer Society
Press (2001), pp. 59–65.
[Bajard-Duquesne-Ercegovac 07] J. C. Bajard, S. Duquesne, M. Ercegovac,
Combining leak-resistant arithmetic for elliptic curves defined over F p and
RNS representation, preprint.
[Bajard-Duquesne-Ercegovac-Meloni 06] J. C. Bajard, S. Duquesne, M. Ercegovac, N. Meloni, Residue systems efficiency for modular products summation : application to elliptic curves cryptography, Proc. SPIE 6313
(2006), 631304.
[Bajard-Imbert-Liardet-Teglia 04] J.C. Bajard, L. Imbert, P.Y. Liardet, Y.
Teglia, Leak resistant arithmetic, CHES 2004, Lecture Notes in Comput.
Sci. 3156 (2004), pp. 59–65.
[Billet-Joye 03] O. Billet, M. Joye, The Jacobi Model of an Elliptic Curveand Side-Channel Analysis, Applied Algebra, Algorithms and ErrorCorrecting Codes, Lecture Notes in Comput. Sci. 2643 (2003), pp. 34–42.
[Brier-Joye 02] E. Brier, M. Joye,Weierstrass Elliptic Curves and SideChannel Attacks, Public Key Cryptography, Lecture Notes in Comput.
Sci. 2274 (2002).
[Brier-Joye 03] E. Brier, M. Joye, Fast Point Multiplication on Elliptic Curves Trough Isogenies, Applied Algebra, Algorithms and ErrorCorrecting Codes, Lecture Notes in Comput. Sci., 2643 (2003), pp. 43–50.
28

[Bruin 99] N. Bruin, On Generalised Fermat Equations, PhD Dissertation,
Leiden (1999).
[Byramjee-Duquesne 04] B. Byramjee, S. Duquesne, Classification of genus
2 curves over Fn2 and optimization of their arithmetic, e-smart 2003 et
Cryptology ePrint Archive, no. 107 (2004).
[Cassels-Flynn 96] J. W. S. Cassels, E. V. Flynn, Prolegomena to a middlebrow Arithmetic of Curves of Genus 2, LMS Lecture Note Series, 230,
Cambridge University Press (1996).
[Chabauty 41] C. Chabauty, Sur les points rationnels des variétésalgébriques dont l’irrégularité est supérieure à la dimension,
C. R. A. S. Paris, 212 (1941), pp. 1022–1024.
[Cohen-et-al 06] H. Cohen et al. Handbook of elliptic and hyperelliptic curve
cryptography, Discrete Math. Appl., Chapman & Hall/CRC (2006).
[Coron 99] J. S. Coron, Resistance against differential power analysis for
elliptic curve cryptosystems, CHES’99, Lecture Notes in Comput. Sci.
1717 (1999), pp. 292–302.
[Delaunay 01] C. Delaunay, Heuristics on Tate-Shafarevitch groups of elliptic curves defined over Q, Exp. Math. 10 (2001), no. 2, 191–196.
[Delaunay-Duquesne 03] C. Delaunay, S. Duquesne, Numerical investigations related to the derivatives of the L-series of certain elliptic curves,
Experimental Mathematics 12 :3 (2003), pp. 311-317.
[Duquesne 01] S. Duquesne, Integral points on elliptic curves defined by simplest cubic fields, Experimental Mathematics 10 :1 (2001), pp. 91–102.
[Duquesne 02a] S. Duquesne, Rational Points on Hyperelliptic Curves andan explicit Weierstrass Preparation Theorem, Manuscripta Mathematica,
108 (2002), pp. 191–204.
[Duquesne 02b] S. Duquesne, Hauteurs et descente infinie sur les courbes
hyperelliptiques, Publications Mathématiques de Besançon en théorie desnombres (2002), pp. 35–41.
[Duquesne 03] S. Duquesne, Points rationnels et méthode de Chabauty elliptique, Journ. Théor. Nombres Bordeaux 15 :1 (2003), pp. 99–113.
[Duquesne 05] S. Duquesne, Montgomery scalar multiplication for genus 2
curves, ANTS VI, Lecture Notes in Comput. Sci. 3076 (2004), pp. 153–
168.
[Duquesne 07a] S. Duquesne, Elliptic curves associated with simplest quartic
fields, Journ. Théor. Nombres Bordeaux, 19 :1 (2007), pp. 81–100.
29

[Duquesne 07b] S. Duquesne, Improving the arithmetic of elliptic curves in
the Jacobi model, Information Processing Letters 104 :3 (2007), pp. 101–105.
[Duquesne 07b] S. Duquesne, Traces of the group law on the Kummer surface of a curve of genus 2 in characteristic 2, soumis.
[Faltings 83] G. Faltings, Endlichtkeitssästze für abelsche Varietäten über
Zahlenkörpen, Inv. Math. 73 (1983), pp. 349–366.
[Flynn 93] E. V. Flynn, The group law on the Jacobian of a curve of genus
2, J. reine angew. Math., 439 (1993), pp. 45–69.
[Flynn 95] E. V. Flynn, An explicit theory of heights, Trans. Amer. Math.
Soc., 347 (1995), pp. 3003–3015.
[Flynn 97] E. V. Flynn, A flexible method for applying Chabauty’s Thorem,
Compositio Math., 105 (1997), pp. 79–94.
[Flynn 01] E. V. Flynn, On Q-Derived Polynomials, Proc. Edinburgh Math.
Soc. 44 :1 (2001), pp. 103–110.
[Flynn-Smart 97] E. V. Flynn, N. P. Smart, Canonical height on the Jacobians of curves of genus 2 and the infinite descent, Acta Artih., 79 :4(1997), pp. 333–352.
[Flynn-Wetherell 99] E. V. Flynn, J. L. Wetherell, Finding rational points
on bielliptic genus 2 curves, Manuscripta Math., 100 (1999), pp. 519–533.
[Flynn-Wetherell 01] E. V. Flynn, J. L. Wetherell, Covering Collections anda Challenge Problem of Serre, Acta Arith., 98 :2 (2001), pp. 197–205.
[Garner 59] H.L. Garner, The residue number system, IRE Transactions on
Electronic Computers, EL 8 :6 (1959), pp. 140–147.
[Gebel-Pethö-Zimmer 94] J. Gebel, A. Pethö, H. G. Zimmer, Computing
integral points on elliptic curves, Acta Arith. 68 :2 (1994), pp. 171–192.
[Kocher 96] P. C. Kocher, Timing attacks on implementations of DH, RSA,DSS and other systems, CRYPTO’96, Lecture Notes in Comput. Sci. 1109
(1996), pp. 104–113.
[Kocher-Jaffe-Jun 99] P. C. Kocher, J. Jaffe, B. Jun, Differential power analysis, CRYPTO’99, Lecture Notes in Comput. Sci. 1666 (1999), pp. 388–
397.
[Lange 02] T. Lange, Weighted Coordinates on Genus 2 Hyperelliptic
Curves, Cryptology ePrint Archive, 153 (2002).
[Liardet-Smart 01] P. Y. Liardet, N. Smart, Preventing SPA/DPA in ECC
systems using the Jacobi form, CHES 2001, Lecture Notes in Comput.
Sci. 2162 (2001), pp. 391–401.
30

[Montgomery 85] P.L. Montgomery, Modular multiplication without trial division, Math. Comp. 44 (1985), pp. 519–521.
[Montgomery 87] P. L. Montgomery, Speeding the Pollard and elliptic curve
methods of factorization, Math. Comp. 48 (1987), pp. 243–164.
[Quisquater-Samyde 01] J. J. Quisquater, D. Samyde, ElectroMagnetic Analysis (EMA) : Measures and Countermeasures for Smart Cards, e-smart
2001, Lecture Notes in Comput. Sci. 2140 (2001), pp. 200–210.
[Shanks 74] D. Shanks, The simplest cubic fields, Math. Comp. 28 (1974),
pp. 1137–1152.
[Siksek 95] S. Siksek, Infinite descent on elliptic curves. Rocky Mountain J.
Math. 25 :4 (1995), pp. 1501–1538.
[Smart 94] N. P. Smart, S-integral points on elliptic curves, Math. Proc.
Cambridge Philos. Soc., 116 :3 (1994), pp.391–399.
[Stroeker-Tzanakis 94] R. J. Stroeker, N. Tzanakis, Solving elliptic Diophantine equations by estimating linear forms in elliptic logarithms, Acta
Arith., 67 :2 (1994), pp. 177-196.
[Stubbs 00] A. Stubbs, Hyperelliptic Curves, Thesis, University of Liverpool(2000).
[Szabo-Tanaka 67] N.Z. Szabo, R.I. Tanaka, Residue Arithmetic and its Applications to Computer Technology, McGraw-Hill (1967).
[Washington 87] L. C. Washington, Class Numbers of the Simplest Cubic
Fields, Math. Comp., 48 :177 (1987), pp. 371–384.
[Watkins 07] M. Watkins,Rank distribution in a family of cubic twists, inRanks of Elliptic Curves and Random Matrix Theory, edited by J. B.
Conrey, D. W. Farmer, F. Mezzadri, and N. C. Snaith, London Mathematical Society Lecture Note Series 341 (2007), pp. 237–246.
[Zagier-Kramarz 87] D. Zagier and G. Kramarz, Numerical investigations
related to the L–series of certain elliptic curves, Journal of the IndianMath. Soc. 52 (1987), pp. 51–69.

31

Sélection des travaux les plus importants
1. Integral Points on Elliptic Curves Defined by Simplest Cubic Fields,
Experimental Mathematics 10 :1 (2001), pp. 91-102.
2. Rational Points on Hyperelliptic Curves and an explicit Weierstrass
Preparation Theorem, Manuscripta Mathematica, 108 (2002), pp. 191204.
3. Numerical investigations related to the derivatives of the L-series ofcertain elliptic curves, avec C. Delaunay, Experimental Mathematics
12 :3 (2003), pp. 311-317.
4. Classification of genus 2 curves over F n2 and optimization of theirarithmetic, avec B. Byramjee, e-smart 2003 et Cryptology ePrint Archive, no. 107 (2004).
5. Montgomery scalar multiplication for genus 2 curves, ANTS VI, Lecture Notes in Comput. Sci. 3076 (2004), pp. 153-168.
6. Elliptic curves associated with simplest quartic fields, Journ. Théor.
Nombres Bordeaux, 19 :1 (2007), pp. 81-100.
7. Improving the Arithmetic of Elliptic Curves in the Jacobi Model, Information Processing Letters 104 :3 (2007), pp. 101-105.
8. Combining leak-resistant arithmetic for elliptic curves defined over F p
and RNS representation, avec J. C. Bajard et M. Ercegovac, soumis.
9. Traces of the group law on the Kummer surface of a curve of genus 2
in characteristic 2, soumis.

32

Integral Points on Elliptic Curves
Defined by Simplest Cubic Fields
Sylvain Duquesne

CONTENTS
Introduction
1. Elliptic Curves Defined by Simplest Cubic Fields
2. Linear Forms in Elliptic Logarithms
3. Computation of Integral Points
4. Tables of Results
5. General Results about Integral Points on the Elliptic Curves
y2 = x3 + mx2 (m+3)x + 1
References

Let f(X) be a cubic polynomial defining a simplest cubic field inthe sense of Shanks. We study integral points on elliptic curvesof the form Y2 = f(X). We compute the complete list of integral
points on these curves for the values of the parameter below
1000. We prove that this list is exhaustive by using the methodsof Tzanakis and de Weger, together with bounds on linear forms
in elliptic logarithms due to S. David. Finally, we analyze thislist and we prove in the general case the phenomena that wehave observed. In particular, we find all integral points on the
curve when the rank is equal to 1.

INTRODUCTION

    !#"$"!%
&('*) $+-,/.01,32

456!%789;:<=>?@BADCE">!FGF=HIJI>KGL>=I
@M"> H@N>ODH
P-Q8RTS ) RVU ,/ R +;W Q J,X. SYR ,[Z%\] "!#"^4=I!!LH<_a`^9cb4"><GF=HIBADCd4I^e ^fhg8i4jeklKfnmpoqFrKgso;tulKkvxwzyN"!!{6 Z=2|_}%~9b">=uGF=HIF-"!=78= =!IF=Ie=Fp">=!H%X4KNFH!IVaOHHa FHe">=!K">=4H<FO?   F%#!H%#H@^H%9"! ] #{L ] M%B==I/=HHFM!=
I>KGL>=IB6@=56!%
4C ' + ) RVU , R +W Q J, . SYR ,[Z(0–1)] ">pcI>KGLF>XXOFH=!F;GF=HI9
4GFh ] u Ge!IDHHL">a#He ;">=>=a7a =H ] ZN9?"!=K%=K> ] "!%">!HIM ah><B=!#H !IMGL!HH@ ] !_X">=
K%=K!=9$b">OD=#!H%M% >">De
w N\=Zn~ ' ]  !# "!%ccc=!#%7L">hI>=HH*
=H>J!I ] XGL!IBHH4#HO!HFH=9
 c A K Peters, Ltd.
1058-6458/2001 $0.50 per page
Experimental Mathematics 10:1, page 91

92

Experimental Mathematics, Vol. 10 (2001), No. 1

1. ELLIPTIC CURVES DEFINED BY SIMPLEST CUBIC
FIELDSb"> I!K#O!a7c"! >#aC I>KGL!=I6@ Q _eZ S
 Z  & + Q =HH"!% & )  + ,.0J,X2ET!OD=I56!%78 S 9Y7- <=">K!I!!KXZ  & +  7
 Z Q OD6IM} S >">K!I!FK  & +  !IM7  .
Q ONIB} S ! p} & + 9;yN!K">XI!K#O!u H ] =@N>">X>X Q S "!p ] K!>=K=I$KOD 
>=9?:<=>D@T  Q S ">K!>=K=IKO >=
7F"!I>=Y@!I@  Q SpQ c   S ">K
O
FKL% 7  Q S 9
XGL#%">=O 7-9>x"!>9 pHa J"!VI>=HHB#>E7">OFH=>F<GL=HI^ADC !I$+ ) pH '  + ) "Z !
9-b">$##>{{ + Q  H + S ] HHLI!=><pI!OD=!u%'& # %(=K FK*9 )a"!% FKADC  ^K@NH>FJGF=HIa{ + Q pH + S ^=,9 +!HH@XH - + I>.
>"!' ##7L">ab%nNyN"F%78%N#"M!7
4C Q ` S 9
pHTheorem 1.1
gf95 m i%: fnmZ
flDC qFl.e6 ohl

w x"F>Z=2 |~90/21Nl435 687{;aC Q ` S, #{ + pH + <9 ;=6>?5o=mnm 1>.l 3lTg9
f 5 6 Al @B5o=m

 C  Q ` S & #%4C Q ` S EGpH + EG- + E Z H+>O("F;"!=O$6x"!>I>=I!!K=u"><7HH ]>KHH%#@9ZFElmp rhl5jJ:0fng8m g K%l$g 6Fm lML6l.3fnq!o.1m 1N5m
 + , .0 , 2 gfxf.C=qO5 3lP>=3l#l^m 1Nl.6 m 1>lQ35 6O7R:>m 1Nl
lKk8k gzjem gsoToqJ3SK%lD4C gfT:=vveU50fhfhqNigV6NL/m 1N5m m 1NlW/X5m l?Y
Z 1N5[>.5 3.l K_g8m?o 1\L 3[:%q_jg fct]6!g8m l9Corollary 1.2. Ib">#=O Z%9 Z<=HH !u"!%p">=%#h"B7 F#"B>="!6>XH%4#>{=56!%H=cX"!p=%##"78cO*
FH=>LDGL=HI! ] ">^H>3"!H%T
 ##>{e9 y6#Ha FH"!J#=IExGe!I 56!I>#%
GF=HI! ] "xH%. #!{ ] "F#"xX"!K= !I!!
!LH=O I>$ #69-_=>!K"!4H6!*O O7 ^DCK6 =K=I?4 H%_7 - + OHH ] "= =K<  H +  ] T"6!aHMKN =Ka"!?#!{$74CE  H%9g f`5MjJ:0fhg m g K%lBg 6Fm laLl.3fhq!o?1m 1N5m
 + ,.0J, 2 gf^f.C=qO5 3lP>=3l#l?m 1>bl L 3[:%q_jE4C Q ` S gf$Mm : 3Sc
fhgP: 6>S3l#l9

Proposition 1.3.

;V>@!><"> ] =HeH {N> ] 78K"!%-aC Q ` Safhgji
/ D=O  =I!I>=IaC QVk]lS ] ">=Tm3 J!#ODD7
66I=I!!K9n

Proof. d> ]  O">NI$!#>=HH! H%#"!O78=%h#"!>78 #H uB=HH!>=9cb"FOD">6I ]  >==I@V>wZ=2| 6o p"!%FF p<nq _~p!s
I r %^wZ=2 |~!I ] ?#O FH>! I>=eH =IJ@#H ==%#h">#wzy66{X!IJ
b t=!%{6Z=220} Xu  =H6cH 9!Z=220}  y>OD%uZ=220}%~9b"> H#"!O=56!=">J{6> ] H=I>J7 xF7X">J#I>=HH*
=H>$H!H%=I 7$K>OLHV6W@ vJwOxJy zN{|w u#=O!$Z=22 _~FI$7c$KNFHH ] eF!I^78
H>=%-78#O =HH! H%#"!O=Mw :6I
Z=22 }_~~
9 +>=!#Heeu76 ] !IMO#aI>HMwzyNOD% Z=22 _~9
2. LINEAR FORMS IN ELLIPTIC LOGARITHMS   x=HHFD>=@X=h#=56!%
 + ,WJ R  ,W U  ) R U ,W + R +-,W R ,W] "  %9db"!D>$DOF"F_M`
># 7">X7hO + ) } RJU W + R W U H\1 $">H%KN%=IE9 THH(!9I  + "!? #NI!a7c"!<H%KD!sI x">Ne%=I^=h# 7 !!Ko9 )4X"!% ] X^H ] @6
S  N9h">   !I$O Q   & + J"!=^">$O% 78O U&" x I>KGe>=I @)  7    !)  
) M PQ S [\  PQ S 
 PQ S 
I  PQ S "> ]  ] "\  PQ S )  Q  PQ S W J  W  U S H++"+] e "!4h47 !!KD7 ;9c= Q ONIJ
!H\ S 6@
 QPS) QPS W

Q  S )¢¡¤£S¥X¦ §©¨



+

H

} U W«  ¬ + W Uª
b"F78!FKcHH=I">lkk gzj ¬ m g o<k®:AL¬ 5 3hg m 1i1e=F
4#%GF=Q  ,°¯ S )­Q  S ,Q Q ¯ S

Q ONI S

78?HH  \=¯   Q ` S 9b±4=!K78" ] D%{D"!D7 !JI!OD=H ,

+ ' !\  \F4²³\´ Z%\F´


²

Z"!H

Duquesne: Integral Points on Elliptic Curves Defined by Simplest Cubic Fields

b $KOF! "F78!FK ] !">H>{Ve ] =
=HH!?hHa!I$"> u  w|u">=Z=22._~9<> ] I>KGL> "!4>!HL">="u#I>;XG!
>%F9
7  ) Q  [\  S   Q ` S !I $) m & ] " Q m\  S ) Z%
] I>KGL!
 Q  S )  Q  Q  SS ) H;O0  m  \    !Hb"F;">=" Me<ONI! GF=I!M">>!H">="
 Q  S ) + HO }  Q #  S Hª
4 #FHX !!IB">?I! e#=!K   ] =$">=">=" 'wzyNH#OD[Z=22%0~9 /21N.l 3lDl @gfnm=o : 6>fnMm 5 6Fm8f
Lemma 2.1
 45 6Lv  + fnq!.o 1$m 1N5m 
W  (´  Q  S W   Q  S ´  + H+;=6 :%J
q 3?=o 50fl ;lDo 5 6x.o 1J::0flH Q  + , .0J,X2 S H;
,g>  EN2 H
 + ) Z H }|4,}#
<> ] < ODFH GF=I#7y 9:<6I z=#!HwZ=22 }_~ ] "!h"HH ] !4pH ]  !!I! 78H>=%
78#OD $=HH!H%#"FOD94 eX=HH!>#X=6@"! =5F% + ) } R U;
W +R W U FI3 #6IF FQ
I  + #!#"3"F%
] "d%%#
S  N9  ?\ H?H?H=\  I>=!o !ITO Q =& + $  D9cI>KGL!X"> ">=" ) OD0 Q Z%\  + Q Z%\  + \  U S \  Q  SS \7c"!?=HH!># ] ">  + I>=>=<">%FH!H%#"FOD ">="4  +  "!K!. )   + O Q S& + S 
">?ONI! GF=IB">=« "
 C Q  S ) OD0  #  Q  S \  \    Q  S  + ! !IK! + ) O0   ! \  C Q«   S ?\ H?H?H\  C Q  S !
« ) OD
'&  C Q  S \U #" " %$ ­    Q  S (
«
!I
«
# +
.

§
 ) #NH Z*)

,+

«

¥

0

!/

Q  ,Z S   §¥ Q H

«


US +




1  C Q SH
32 

93


w :6I3Z=22 }_~9 l=m 4 Q  S )65 2    Q  STheorem 2.2
-g8m 1 9 %  5 6Lvfl=m87 ) ODI 0    9(;V>94 Q  S;) : 5 6ev
7< KN Q + S m 1Nl.6
H  4 Q  S  « W  Q H=7 ,/H U SKQ HuH=7 ,   ,3H U S   H
¥
«

«

«

3. COMPUTATION OF INTEGRAL POINTS e=HHFD>#6%=I^ODFH=>FGF=HI9 !OD"!% ]  "! KOF>=IaF"  =\  + ?\ H?H?H=\  78 ">X#I!=HH*=H!9yN!K
">!O 7< ]     Q S HH4E  Q S
">!O 7 ] eE  Q S    Q S !Iw N\=Zn~  '  Q S  ] ^"FHH;#!O"!%  FI!H@  =H> D' j Q S 9  e$d#H4 9EyNFK$ Q ` S D[>78 ] B"!  ) m    ?
, >@>@>6, m    78O
 %9 Y^M=@d KODF>ThHe^m  Q ` S 9 ±a=!K ] T> ] #!O$"F%">V  e=H! D  Q S 9uyN¯U ) #      Q S \  % !#"$"!%m  ) #*B, A6>789 A ) ?Z\
)  \
¯ R
 ) m 78D C ) : Z\)  K\¯   R"!¥ %
 )   ¯  E, >@>@>0F,  ¯  G, A¯   Hb"><e  =\ ¯  ?\ H?H?H=\ ¯   =>B  Q ¥ S N">= !O
H =H>  Q S F">=!KA ) N9)4 ] I H ) OD0    ;9 J>L>  aDGLFI$>!   !!I78 H9^GF#!=IVH>K{ H ] "">  K6#I!F% 7  9;V>  ) Q  [\  S g U
f 5 6Vg 6Fm al L 3[5%k>Jj :Vg 6Fmn
Proposition 3.1.
Z
´ML?  N § \

 .

PO
§

 1N.l 3Q
l L? ) K6  + Q f=l#l lKi*i 5 #69 Z S 5 6LR
v L + g fJm 1>lI
fhi*5%k8klKfnm lKg®Ll?68K"5%k qFl :> m 1NlU
3lMLq6k®5mM: 3?i*5m 3hg®@w Q ¯ , ¯IS S W  Q ¯ S W  Q ¯IS S ~ T" VU SW"  H?> ] >=I^DH!{">  K6#I!!% 7  ] "$
=HH! H%#"!O9 < ] "F= = 7#"> > OF"FaM> 7">X78#O + ) } R U;W  + R 
W  U )  Q8RTS H

94Experimental Mathematics, Vol. 10 (2001), No. 1

O +  U I>=!">M67  Q8RS 9y6 L= )#OD0   9;V> ^) Q  [\  S    Q S 5 6Lv   ,&6Z #  Proposition 3.2.
 +L=;m 1>.l 6
  Q  S  + ´ L .

-g m 1 L  ) 4,   +  &6Z#<>">?=HH! H%#"!O ! Y@BFI!KC¯
H=4 Q S 7aHH C ] "!
 Q  S W    Q ¯  S W >@>@> W    Q ¯  S ) b ] "    ´  H , Z%9/"!=   )  Q  S p">=!Kj Q ¯  S <, >@>@>E,    Q ¯  S ,db <XBH>=%7#O 
=HH!MH%#"!O9M:6I z?=FHHH ] !O
XH ]  !FI78  Q S
9 pOF%#!a"! !FI




B
"


>
"

!

!


u




!

F


I


F





>=I^6@  !4.69 Z]
!IM.69 #6 ] aI!=I!!Ka@DH%>! c !FI H  7
H9 J> ] { =I!!K^"! !FIQ
9 +!D"!
'


K

F





>
I


X



>
"


8
7



H

H



>

^

F



F


H
=

O


>

!
 ] %
]]=  =H 6!O  # K?\ H?H?H_\  ; ] x ^=H
K!I LS<!I L !I^H>=%a7#O+

4 Q S )





2 



] ">#X">  %# !FI>=IB@  H  , Z%9
 ] !HI$H{?DI>=I!FKX7O ">>=56!H @ 4 Q  S  ´ML   N O §T !!I7 H9//"> ] #I! ]  ] !HI3H{$
"> ] "!%4">H>=%<7hO !>4e=KOD 6DODHH74K6 =<%  !FI>=I9b"F!#FH=O ] !I!=I 6@ p%{D!I :<=JwZ=2  2_~4">  ) #69Jb4">DK>#H] =@NX^=>#H t">= O">NI9?D">">> OD!=I$$=K=4@=%#9b"!ML^I>= Q I!!^xI>^ S %!!B
OD%B">^H>=%78#O 6@3%!!#=>OD%3H%K
!IGL!I =I!!K=IDFc78"FH%K9;b4"> GF#=K 7u"F > ] F# = %!!#=>OD%
">OHH=c=Kp">4H%K9py6c=HH;! ] ">="> H>=%a7hO OHH 9uFI><">H%K0 =>h%=I@">KH!OD!
7 ">OD%h 
 
 Z

999
#"F U  Q % S H
7 )
Z
 !
 

   >@>@>      #">6">K!  %!!NO%=H@$=56!H 
Q  H  S  9Bb"F ">DI!#OD! 797 ] HHeD7u"!
#I!^7 Q  H  S  FI ] "> T"!%B">TGF#F#
=H=OD=  =I!FK=IxH%K ] HHc 7 #I!
 H 9%$&$('
+ ' +%L/. ) 5 2
2
 ;:



lm ) Q K \?H?H?_H \ S rhl45\3l#v%q!ohlvJrA5 c
Proposition 3.3. Ifng f~>.: 
3 mN
1 lk 5msm gsohl
m 1Nl*50fhf.:=o=g 5m lv 35%i4c Z o.1i gsvm) O 
B' ZT´)
rD05 fhgf
´
!
 R +

) 
5 e
6 v
+ , 5 6Lv  ) R 9 ;V> ++Q   \?H?H?H \  S ) Vm N1 l.6*)
C  -, 5 32
L ) 0. 1,

H 4´ 3  H Q  LS S W H  & L + W , W . 65 L H)+
7c">  !!I$78 H K>7c"> 7#O
Remark.
7  ­ H=H   9?7">OD">NIJ7 H Q  9 97">K!IFe^QL ) 4> %GF=I S  ] X!K=X"!KF !I^ =%"> Hh"!O$9±a=!K"!cO"!6IHH ] !  =IF!Kp">  !!I  7  ­ H%H   9Mb4">> ]  !!I=>#HH@xOHH
=>!" =6!O#%aHH>"> FH=7;#H
9 ±4 ] =u7"!  !!I=OD?H% ]  =%"!H#"!O9

4. TABLES OF RESULTS

b %FH=XZh6. "> ] #=!Hu!>=IM6@"!pO">NI9+>XHH ´ ZB!h"$"!%< U ,d.01, 2<5F%.
78 ]  78!!I$"!#>{^#{uaC Q ` S 9a "!? #FH
">F#7c">hI>=HH*=Hc! ] XKOL>=I
!#>
 vJwJxOy zN{ |w u=OD!xZ=22 _~9V OD=cIF>F">=I3 ">B%FH=6@/!!I>hH>=I%H>^7
">;F%#OD vNwOxOy zJ{<F>K!HFI>;% >"!
#!{  ] ^"!= KODF>=I ">B#>{ !>V">8 p##"
!IVy ] !>#J :<@4K%=K>9b4">a%LH=%XF%#%=IB6@#!{L9-b %FH= # !I^.
H-"!  K6#I!!% 7L=#"D#H> -  Q S 9
NO!%E#"> ] "!%">J%#VH ] =@NB#Hd x  Q S ] "xB   K6#I!!% ] ">= 6I!I^FI$> ] ">=B=9
[">=">#>{Z%">Dew N\=Zn~ =OD$ 
F 78"!J#I>=HH*=Hu> !Ix">#DI>6=
> K>@"!#He "!xw N\=Zn~FIM
I>!FH ] ">=-NI!I9cy6 b %FH Z =cFH@?">H
7 "> %H>=-7e"> F%#ODc ] ">=">4#>{?4Z%9
Ju=>#HH@Fw N\=Zn~>=ODaH ] =@N 4=>#%=9
Q b"FH?=OD%{T %HIxFH@T7p">DF%#O?
I>KGe>=4OFH=>FGF=HIL ]  "!= !OD=I Duquesne: Integral Points on Elliptic Curves Defined by Simplest Cubic Fields

95                     !"#$#$#%&%'%!(!"%%!% ( % ! !%!  %!%%
)!%%%%%$%$$$*"+!%!%!",(%%"+% %%%! !%'!% ( % %!%
 ( !!'%*!&+(++(+  &(((++ (++&&+ +"(+ &&&+(&%## #$# ( !! !(!+%"" (! ! !!!"'!!( %%%!% )  %%# %!( %!%!%%, !(!!  !%!% ! ( "!%!%%!
&%"% && ((&( && ((&(+&&& &(&()((""%& ( &( ( &((++( (+ && ) +"*&   ,  -   
&%!"#$#$*'!% %!(!% % %+ %!%!  %%!- !'!!%%!!%

G3J)K
G
G
C\[^]I_
6 G /I6
0L4-6C'@25
4-`a2A/10L6b<1c
G M @ONA4-0LPQ/1RAPS8T71U V%B @BQC*B54WU/XRAG Y718Z G/16$@7
2dC*4PeMgfihAjdk5lXmdnp
o
&
q

U
4
r
7
A
R
Q
/

<
1
s
1
s
X
t
v
u

c
r
7
U
c
Q
R

C
5
B
)
4
5
2
A
R
d
P
4
*
U
0
A
R
4
w
P

@
1
/
*
6
4
6

c
g
M
D
f
*
C
5
B
)
4
A
2
*
6
)
4
X
7

8

C
5
B
?
4
x

U

@
g
B
d
y
g
z
V
5
R
5
R
4

U

C
71Rd{}|'f14U
K
[
_
K G
G
@7rRE~4-@C*G 25U41(&/1@K BGU*7EVU*4 U*4GL6 4-RaC6"/)U/1R514<-J
>r>ri

:

9
<

1
>
>
A

W

<


}


R
X
/
L
0

0
*
C
5
B

4

6
W
4
@
1
/
*
6
4
+
6
*
C
A
B
4
7
a
R
b
C
o
5
>



<
u
6
)
/
1


4
RA4U/EC*7rU-c
67CB54 RaC41U/X0 7 RaC6%/1U*4$
4-RiMgf"BA471U4

TABLEJ)1.K ./1032546!7189;:=<>1>1>?J 6*2A@BDCBA/EC'F

CHG

4478H 74 ) }6!784!!K9 Sb4"> =ODFI>-7L"F-F% cI>=ID !_6!
">=J!Id">=!#H=#!H78D">V>= C
I>KGe>=I @ OFH= >LDGL=HI!9 F%!H% ] !#X"!%w N\=Zn~ H ] =@N=>h% Q b">=O }69*|
 =H ] S !I?"!% ">u%u!4">-#H  
aC "!%?% DO!HFH=7Xw N\=Zn~ %L%X7#O
# w N\=Zn~ ] "!=^ NI!I Q b">#=O }69  S 9

5. GENERAL RESULTS ABOUT INTEGRALW POINTS ON
THE ELLIPTIC CURVES y2 = x3 + mx2 (m+3)x + 1
y6hHLL%eh;"! K!I>#=I"!a!#FH=O 7 HB
>DF%#Oh t =I:F"!>=56!%!=9;$F%#S
!H%78b"6>B=5F%!w ""  Z=22NZ  <) {NH#"!I yNO%JZ=22 _ ~9  "!MF% = ] T! OD
=> =FHDdF%#Oh t =Id=HH!V>==9<HH"> >=a$>a78OH@B"F="!?#H 
w N\=Zn~-"> ] = !I$"F4=#=H $"!78HH ] >>9±a=!K4c"!!HI ep LHuXKN=!I!cO">NI ">;F%#OD# t=I>="!=N>GF6=I>#
9

5A. Arithmetic Study of Integral Points+ # ] B"> ] "!% ] ">=x">DF%hO  =">#M >J#H;  ">B>J KODFKL%

7"> >#4Ca9;V>  gfMl.K%l?65 6LvTg >w  \[~Xg f\5 63gV6Fm laL 3[5%kLemma 5.1.
jJ%: g F6 mnm 1>l.6  [  Q ONI  S 9y6 ) #de>?"!% ] "!=F + )R U ,#d  + W
, Z Hb">=7  =M">=\ + ;NI!I9-b">
!H@/6I!I3#5!%#$ONI!!H $Z%  Q #dB, . S   Q ONI  S 9;yN!K #dp,.;FHONI!!H
 6 ] aO  [ Q ONb
I  S 9Y7  p6IFI6#ODH% %!OD=
H=I!DDK#IFK9n;V>g 'f :=vv 5 6Lv?w  [\ ~g(
f 5 6Mg 6Fm Ml L35%kJj :%g 6Fmn
Lemma 5.2.
m 1N.l 6B}v :lnU
f 6_:mpv%Vg K_g vl   W Z  9
yNODH%D">X!N! !#79n
Proof.
)  + W  5 6ev
l=m  r#l 5 6^g 6Fm al L.l 369 Z l=m  R
Theorem 5.3. I)  U W .  , Z%s
9 /21N?l 3lBAl @g fKm8f  fhq!?o 1Tm 1N5~m ,g\
f 5.f C=8q 5 3lBg >05 6e
v : 6!Lk Jg >.l K.l 3:=vvDj 3hg8iDl^v%g Kgsv%Vg 6NL  W Z  g fXDo : 6BL3hqF?l 6Fm-Mm :Z*i :=v%qN®k :XT} 5 6Lvg >aVg 6T5vv%g m g : 6}Tv :_lnf 6_:muv%g Kgsvl   W Z  9)4"!%
^K!#OJ  !I   W Z%
Proof.
">=!K4 !9-b"6! ">K>; !h""!%~[, D56!% 7c!I$!H@$7 a5F%?OD6I!FH0
   "! %
7p!I!H@7u7 HH- !#ODI!6( m
7 ! 5F% OD6IF!H m ,L Q ] ">!!H( l Q  S I!= >=">( m8 I! 0H!%7"> >O t  S 9a#> ±a=!=H zpH=OODNJ7 m ) : #6 ] <{6! ] "!% ^5F%ONI!!H m  7X@T  7;!IT!H@7 D5F% ONI!!HF m9
Proof.
Q d# ,T. S 



,
%rA%rA%XA(1A(¡-1(-1A&-XA1%-r1gXr¡1aXg¢-1A1,Xg-¢-1a-¡1d1a1,E5E¡X£--,Xar,-¢- E£
(EXA&-¢XA&-XA(-rA(¡-1%XArr1a¡1a¡1a¢1A¢X5-£-X¢-1d-,-£1¢,-1A&--1A&-XA%¢¡X(¡rA(X%-aXdEg¡X5ra¡-¡1a,,Ed¢-1g1
¢1A&£¡1A%XA(¢1a11EEdrgE5-£-1a¢¡-¡1g-¢Xg,,,£-,-¡1A(¡rA&1A(¡1A%¡X1r1g£XgX-,£Eg-¢¢1d-XXd-¡X£X
¡X¤(¡XXA&-£XA(,rA&-¢X&X%rA(¢15%a1aEd£rg-¡¡Xd,¡Xd¡-¡1A¡-1g,,Xg¢-¡X1£

TABLE 2. ¥/XU/

J

G
G
K G
4C4U"9¦/XRAPS§A{¨@7a7rUP A
R /XC*4#7X8 RaC41U/X0 7 RaC6%V%B54-RiCB54OU/XR5Y

G6

c5/16%Pd4C*4UJ)G

RA4-PMaf)hAjgk5l1mdn

96

Experimental Mathematics, Vol. 10 (2001), No. 1


%E(¢X5rA%r1gXr¡1g-¡Xg-1
XgX£15£--£ %E1r1a1a,Xa
-=&1r%¡1X(¢11%-X,ErrEEr,¡ %EgXgXaXA£E
-¡=&1%¡1a-¢=&-X1r1Ag-£H,X%¡1a %EgXg¡X5-¡X5£¡-¢=(¡X(-¡1A&E%-aXdE1EXa¡X¢¡-H&1g¡,£ &£E(¢Xr1a¡1A
£X &E1r1ArA¢
=(-1¢1A(¡X%-aXdEr¡,XAr£¡¡, &1gXgX5,E¢, (-11r1a1g--¡1 ,XgXgXa-¡-=(-11r1a,Xa,-X
=(¢¡Xg£ (¡XgX¡Xa¢=&£Eg=&1gXa-,¢X¡,£ ,XgXgX1E£-¡-
E &£Eg,¡=,Xg,¢=%-¡1A%¡XgX-g-¡,-£X
1a¡¡Xd-£££ (-1(¡-1A%EgXaXg¡
¡=%¡1A(¡XgXg¡£-¡¡¡=&1g¡¢=%¡-1A%-rdXa£-££-¡=(Xg£-¢=%-1A%-1(X5%a1aE,¡1-Xa1,1 (¢¡XgXg--,£ %£-£XA(¢1a15Xg-¢1 &-XgXg¡Xr¢,X¢-X=(Xg--=(XgXg¡X5,¡£ %£-XAra1r¡¡X-¢-¢-¢
1g£E,-£
-

-¡

E (¡-1g,=(Xg-¡=&-¡rA%-r%X-%-aXdEaE
1rA£E-¡££ %EgXd¡1a,£-£-1A¡-1¢-¡££ (-1gXgX5¢--
1A£rg-X¡¡-,£ %¢1a1g-£--¢, &1a, %Xa1a1g-r,£ &£EgXg¡Xa-,£E

G
G
K G
4 C*4U%9 /XRAPQ
R /EC4O7X8 G RrC4rU/10 7 RaC6!V%B54-RC*B54\_ U/1R5Y
G §5{}@7g71UP G A/1032A4-6%718 9wc52A6 R5CB54Wx U @BgydzdV R5RA4U*C*71R5{¨|'f14-U+@71RE~4@C*2AU*4r

¥/X U/TABLE 3.
G
25RAPd4-U*0 RA4-P

J

-

X(1E%¡¢X%rA%a1aEd¡¡1¡¡Xd,--¢
1r,Eg¡£Xd£-£r&-1a15-g-¢,,-H&ra

-¢
15rd,-¡,=%EgXgXr-¢1£X&ra15ra-E¢££=%Xa1rXa,£--
-¢H(,£-¡X%¡1a1a£Eg-£-¢1(-ra1rr¡1g-1-¢,=(¡1a15¢Xd-¢,--¡H%¢,Eg¡H%¡Xg,£=(,E&-Xa15Xa1¡X
,-H&ra
--,H,1a-E,£=&,XgXd--,
,-H,1a¡1%Xa1rXg--¡
,£-

,£

,£=&£Xa1a¡¡-¡,£-¢H,X&--¡X&-XA%a1aEa,X,¡Xd-£-¡-,¢1,¡,E&-Xa15Xg¡-,E¢- E-¡X%¡1a¢¢1rXg¡-H(1a15ra¡,¡
E
15Xd¡
E

E£=%Xa1r¡£----H%XgXg¡-¡,¡,=&--1gH11r1AE£Ed£E¢1,
1r¡¡Xd£E,¡E=&-Xg
E=,1a1a£E-X
,

-£
1a-X5£-£-,--¢H(1a1a£-,-£X&-¡-1(-¡1a1r1£-¢-£=11r1A-Xg-¢,¡-£H%,EgXg¡Xr,¡¡-¡X¡H&--1g
¡X£ &-X&-Xa1r1A-g¢¡X¢H(¢¡1a1r¡Xg¢-¡1
¡1r¢,£¢,£X¡-¡H(¡1¡Xg¡-,£=&ra151£¡¡r&-,E1r1AE£E--,¡ (-1g
G¡-¢
X,¡,£¡,H&1a1A-¡¢X
¡,-=%Xa1A£--¡¡¡-H&¡-1d
¡,£E(-¡-1d15E£-X---¢¡-H(¡--1(¡XA(,rA%r1gXa¡1r£¡,E¡¢-¡¡¡¢-H%-1d£-X&--Xd1rX-,
£- (¡-X(¡-1r£--¢XX--¡££X

£X=&ra
£X¢H(¡-X(¢1rXd£rA-¢-¡£-=(--1d£ &Xd£-£=&£-Xa1A-¡1¡£,=&¡-1d1rX¢11
£H&,Xd££H(,Xd15,¢,£-£X
£-

£-¢X
X-¡-1£-¢-H%-¡Xd1r££X-£-¡X£-¢-¡H(-¡Xd
-X%-Eg-H&£1%¡Xr1grA¡X¡-¡-¡HXd-¢H(¡-XrrXdE¢1A¡,£1=%EEd1r¡X¡¡-¡¡,- %-1,Xr
=&£¢,Ed15£E£--¡-¢H(,X1A,-1a1A%aXg£-¡X
¢-¡X£¡-,
-,=&£-Xa1A-£-¢-1
-H&Xd,¡ &ra,£-=&-Xa1AX¡,¡1¢1-¡,£H%¡Xd
-H&,Xd¢-¢
Xd,--,¢¢1 (£-¡Xd
¢,

¢

¢
¢-1&£,ErrXdE¢1gE,¢- (¡-¡X%¢1A&1gXr,Xg-£--¡¢,¡¢,H&¡-1d¢,¢H&£1a1A1d-,¢¡X %Xa1g£Ed¢1g-X-¡¢,£H&£¢,Ed¢,£-£
XdX1Xd-¢X
¢=(,Xd¢-H(-1a1g,-¡-¡¢-¢H%¡Xd1aE-£¢¢X%-¡Xd1r¡Xd,¡X¢¢=&-Xa1AXd,-¡6


[/16'Pd4C4UJ)G

R54PMgf)hAjdk5l1mgni71Uc58T71U

Duquesne: Integral Points on Elliptic Curves Defined by Simplest Cubic Fieldsb4"!= H m  DNI!Ix!hOI!N 7'!9b4">==">]mJI!NI>=  F
Z
)
) Z%\

m



m

a56!% ONI!!HFm  mJI!NI>=  W Z%F">=!KQ  + W # SKQ  W Z S W Z
W Z
)
)
H

m





m

m



78HH ] "F% M 5F%J7 !IE!H@ 7(m  ZQ OD6IB} S 9<FOc> ] "!% <=a"!% NI!I9b"!=!
"  ¢# Q ONIB} S  ;H ] @6u 56! %4OD6IF!H#69] =0
[">= \ } Q ONI  S   ] "!=  + W    Q ONIB} S
=">   =">=!K  Z Q OD6IB} S  ?
56!%pONI!!H4}>9 J   NI! I%">=!K   . Q ON IB} S   + W  # Q OD6IB} S ] "!#" 3K#I!K9
[">=W    Q ONI  S   NI!I !I #NHu!#<@DFI!!K"!%; 78pHH   u?56!%<ONJI
!H #  7<!I !H@ 7  Z Q ONI   S 9db"6! ] ">= [ Q ONIB} S ">= Z Q ONI  S F
D5F%
OD6I!FH0
 #  9;b">?    Z Q OD6IB} S 4 > #FH
6@$"@6 ">=9 + FHH@ 7  #. Q ONIB} S e"!=  + W   # Q OD6IB} S  ] "!#"KhI!K
9 nlm  ) w  [\ ~r#Q
l 5 6 Vg 6Lm Ml L 3[5%kJj :%g 6Fm
Corollary 5.4. I: 6 m 1NlJoJ
q 3=KlaCa9 /21N.l 6 ag >   Z ;
l 1N5 Kl   #Q OD6IB} S : 3   . Q OD6I  S =  1g8klg >  ² Z ;4
l 1J5 K%l
 [ Q ONIB} S : 3   | Q ONI  S 9<!ODpGF#-"F%   Z%9-Y7cw  \[~LuD#H  U ,3  + W Q (,E. S  , Z#5!%#9<b"!
=O }69 . OLH="!%p@6IFI!#ODaI!NI!>  W ZaK>#>=Z OD6IF!H}>9cY7   = ] I>=IF!K"!%  W Z K>#>=aTZ ONI!!H}>9aY7  a6IFI] p{6> ] "!%}XI>=>-I!NI>   W Z  6@?=OOD'}69 #!I

Proof.



W Z )
#

1

l 
l
£ +

2

b"!X!67 #ODH% ] "!=;V> Corollary 5.5.
: ^6  C  Q ` SQ gh9l9

mb

 ²

Q OD6I
#

 S H

Z%9
n

gf l.Kl.6 m 1Nl?3l gf 6_:gV6Lm lML 3[5%k!jJ:%g 6Fm

-g m 1 5 jJ:%fhg m gVKl  coD:: 3v%g 6_5m l S 9b">u  wZ%[\ ~>> ">p>9 Y7   Z%
"># K#I!KJe ] =$"> !N! KHe
H%@^!I=ODO }69 Z%9nb"!= KHH%#=^  !OOD%# t=IB47HH ]  'Proof.

97/2>
1 l.3 llA
@ g fKm8fi Q 6:m~6elonlnf#f?5 3^vl to68c
Proposition 5.6.
gV6BL9M
5 fhg8iajLk lnfnmaoqFrKgsoptulkv S fnq!o.1Jm 1N5mm 1NlajO:%gV6Lmaw  \[~g f*: J
6 aC Q % S g >5 L
6 v9: !
6 kL$g > m 1Nl>?:%kk®: -g 6BLVoD: 6Lvg8m gP: 6>f
5 3 l f.
5 m gftul#v '



Q



Z Q ONI a   S >?: 3Xl.K%l?3-:=vv<j_3hg8iDl DvgVK_g v c£
gV6NL  ³  ­ W Z Q ONI m E  S >.: 3Jl.K%l?3-Q:=vv$j_3ngiDl m
2.
£v%g K gsv%gV6NL  W Z  g f =: vv x
3.
g >  ² Zb5 L6 v  [  Q ONI  S m 1>l.6
4.
Q ONI #     S H
 Z§ £b"!F JHH ] !aI>Ms7 DM
 @N=O1.

%^=%##"/78hHpe9 u7#^!N>V">!>!!K=I =#!H ] ^H{ 78OBF%#OD# t=I
H>!47=56!% Q _eZ S 9

5B. Parametrized Solutions of y2 = x3 + mx2

W(m+3)x + 1

"F=K ] 4K!I!">=56!% Q _eZ S ;
>;#>7 K; U 9 u B) ,DZ%9-yN!K Q N\=Z%\ SuH ] =@Np"><#>7 K ] <B~  W Z ) Q W ZS 9b"!>{ND ">TH>=%#Y@EE 7 ">V=56!% ] !h%!HF%#OD# t=%$7>a>7 ¬ K '^) ,/Z%\
 )
, W \
+ ,/Z
 ) ¬ +W # ¬ W W Z,
H/#I! xGL!I¬ F%#O¬ h t=I3¬ #H4H>!7
>=56!% ] 
+ ,/Z
 )
\
¬

!I ] $I>=>$6@  Q  S ">$F%hO# t=I H>
"!!>=I9]+!4K>OFH '
B)
+ 
, #6\

 Q Z S )   ) ¬ W UW # W + W Z%\
  ) # ¬ W Z ¬ ¬b">H>M!>=IBp">¬ < ( #w N\=Zn~ ] "!=D 
6I!I9cb"!p=O%{"!4H=I>@B =$ODI>9b">$=56!%!78  Q W Z S TE#Hae
>", # W Z%9  "!x3"! 
] =  ) # + 

)
W
w
%
Z
\

# ,Zn~   ) w N\=Zn~!I + ) w #6\ # ,Zn~¬¬%!I> =!I>=D[4C Q ` Q SSVQ "!^ eT"> ] !> "!' ) ¬ Nb% ">="L#>wzyN"F6I!DZ=22%¬ 0~ S 9_' #      ,      W ¬    + ,      ,  + !I
 W  <% #H F9 )a"!%<"!H>
+98

Experimental Mathematics, Vol. 10 (2001), No. 1

 ">X  =$6@  Q W Z S 9py6Ge!HH@M$"!]  !%H=2#H> -">>aC49
b"> 6!OD#H I!%>=4"! L">=>O=!9yNOH%^K!I>#%F ] "  ) W } Q %78
FH! 6@ W  , # S 3#H 7 )+} + W . ,J.?FI ] <GL!IDB"!p>X.?FI> =!I>=#H ¬ 9 ¬¬^¬3"> MTGL!I OM !#" "!%aC "!"!" #>{?7!1#%7@? "?7F">p ] <F6F=56!"!L^"> ] #I!7 ) # + 
, #  W Z ) } + W . + ,xN. H+
y6 .2 ) # >,ZX¬ !I .¬ + ) Z + ¬ W .6 ] ¬ X"! H
. + + W Z .  + ¬ ) W NZ ] "J">?K¬ !IF! .  NI!I . + 
W . Q OD6IZ S  . !I . + !cO FHFH=-7.6.
9 a=@%!OD=">;GF=HI?` Q ­ Z S "> ] "F%">u=>#H
H>J. + , .  ­ Z ) Q W Z S ¥  Q .c, ­ Z S + ¥  Q ZZ, # ­ Z S H] "e  %X9Y7  ) N ] FD ) ZZ ] "!#"c">
OHH=c%H>47 78h>{.69-Y7 ) W Z% ] ! ) ZK}. ] "F#"X">#ODHH=X%H>78X#>{}697 )Z% ] !x ) ZK}2  .FI4C X7;h>{J%H=| Q ">p  w N\=Zn~ew W Z%\=Z|%._~ w #6\=Z|%._~ w W }>D\ }0}|~
w W ZZ  0}>\  }2 }  ._~ %B=/6@>F%#OD# t=%
!IB">?I!I!!H=!#%#w W  }>\h| |%._~

!Ixw 2%N\=Z2 NZn~%78!!IT6@^@6=OD%=%h#"9 <HH-">= 
%!I> =!I>= S 9)4"!%p"!pp>u">ODHH=#>{|<>!-78OH@!K4aC-7e#>{|<H
78 ) Z # }  .6 ] "!#"OD=@ ] =HH X"> ODHH=9> ] !# =!HK!K#F>"! w N\=Zn~9+> "! L>  ] O!Ge!Ix%!!#=>OD%!7
">M">="?7$  4Ca9 +>?"F ] M>=I
F%FH%?V{6! ] ">@6OD!D ="!6 7">
#NI!a#6%=Ix^">>4C JhOD<7">
F%#OD 95C. Approximating the periods



1 and



U



2



$+ ,V ,.   , +  U , $+e,V ,3Z H
U
+

+



C ¡ 

 C H
 W   SKQ  W  SKQ  W  S
Q
&

«
+ U
§
7 9 w  + \  U ~>">=B , Z, Z&_ ´  W  ´  ,#,+ ).&_eZ
 ,#c,.&_

&

!I

´



)



+!HH@ ]

§

W

C





¡


´

&  , #c,.&_] "

Z

­ 



Z

´



&  ,/Z,/Z&_+ ´& Q  W  « + SKQ  U W  S&  ,3Z,/Z&_
)


¡

)

Z « W¬ + ­"F=

H

¬


+ ´
´
H
C


,
c
#

,

.
_
&

&
&  ,/Z,/Z&_
y6* + C 2& ­ !Ib + & C E.NH Z=.B& ­ 7 ³}%N9 > ] K!I>a"> 7 9uFH"!hH4 ] 4L% '   )   $,   
¥




"
]
) ¡
  ¢



b">>X C I>KGL!=I6@ Q _ Z S  OF"F4">>N+ ) } P-Q  S] "P-Q  S )R UW   ´  + ´  U   "!=H6X7 P[Q ">IF
K#O!?H ] @6  S 9b"!D #NI! oFI
 %X=J6@
+




) ¡ §
o ¢
!I  + ) W ¡H& « P-Q  S& « P-Q  S#"78 ] %hIJFI>@7">78!FK§  P =4"!
>=56!H= '
#0
#
#0
Z
W
W Z W
W Z W
´  ´ W
7 
 ³#6\
.

.



Z
´  ´
,
\
+
.
.



Z
,3Z ´  U ´
,/Z,
H
.
.

 % ] "$%!!NO%$78(  + =$6@





FI

  )¢¡
¥



§



H

P-Q  S& « P-Q  S & «+>*  c">B6  !I  %7 %78O "!M=FIJ
U+a7"> I!OD$7;#%9X "6!<"!=
78 9 w  \0~ ' &%.4´
99&%.c,/Z ´ + W  ´  ,3Z,.&_\ U W  ´  , #c,.&_H

99

Duquesne: Integral Points on Elliptic Curves Defined by Simplest Cubic Fields

y6
Z



 
 

& Q  ,3Z,.&_ SKQ  ,#c,.&_ S
Z

´



¡


¡




­ 
«

W





W
«

\

\


& Q 9&%. SKQ 9&%.c,3Z S  # ­ W    \
& Q  ,3Z,.&_ SKQ  ,#c,.&_ S# ­ W    ´\
& Q 9&%. SKQ 9&%.c,3Z S# & #09&%.c,/Z,3Z&_  \& Q  ,3Z,.&_ SKQ  ,#c,.&_ S# & #09&%.c,3Z,#&_H  ´& Q 9&%. SKQ 9&%.c,3Z S­ I>=I!!K4">4>=56!H=  ´ }OH 2& ­  !I  
Z H  N. & ­ 7 ³}%N9)a ] K!I>4">  7   9]±aX!H@  >7V¥
GL=H@[78%7O "!xI>OD[7h%9+>9 w N\  ~
+
#0
Z
.
,/Z,
´  W  ´  ,/Z,
\
.





] "&  ,/Z,.&_


!I

)



¡


§

´W 



¥

´



& #09&%.c,/Z,/Z&_& Q  W  « + SKQ  W  U S) H

"!=L74³}%N
JH # 
 H 22Hp
J}NH # Z H #.Hu,´W  ´
,
\
­ 
­ 
­ 
­ 
¥
}NH # Z H #.Hp
Z H 2NZ J H 22Hp,´W(´
,
H
­ 
­ 
­ 
­ 
B78K ]  =H@^!_ "!%
Remark.
Hu ,V}cH(
 #c
, QZS
o )
\
­ 
F> ] I>>>=I"!9+ FHH@ ]U , ­ +­  W­ U+­­  , ­ } 9&%.
U+ ´ } Q 9&%.c,/Z,3Z&_ S H´­  W­ 
Z,/Z&_
Z W Z&_U+ ^"F ] #
Z
}
  
H
\
Q
.

Z
/
,
Z&_ S¥&  ,/Z,. &_Z} Q  ,.c,.&_ S
  ´
H
\
. Q Z W Z &_ S¥
 &%.c,/Z,/Z &_
& #09
}
H
Hu. Q Z,/Z &_ S
  
,
\
¥
&  ,/Z,. &_&  ,/Z,. &_
}H
H Q  ,.c,. &_ S. Q Z W Z &_ S
  ´
,
H
¥
 &%.c,/Z,/Z &_ &%.c,/Z,/Z &_
& #09
& #09

5D. Approximating the Canonical Height+ h ]  GL!I  >! J !FI 78V"!/!!H">="-7L#HN   aC49 u@?=ODODF#69 Z% Q  S W +  Q  S ´ Z H }|-,  H Q  + ,X.0J,X2 S , + H;HyN!K  4#H   Q  S ) H;O0  Z%\    !9pyN Q  S ´ U+ + H , + HuO0  Z%\    ! 7³ }%JHb DGL!I$MH ] eF!IB7<"> >!H ">="<(5–1)
7c#%!H D ]  ] #?a"!!O7-HNH
K#L>!9  )  & + \  & U   4C Q ` S ] " Q \ S )Q -\ S ) Z%9X?GL#aKODF> ">>J a##"!OD=I>=
K#L>9 ;« !">« H#"!O I>=Khe=IXM« wzyNeH«#OD
/Z=2    u"!= Z=22.6y6=K|9 }69 #_~9 "!
 + ) U ,T + + W Q J,X. S  ,/Z%9 y6   ,/Z
Q ONI # S !I !> =9 OH%4%!OD=
"> ]  "!% «>4DO FHFH« X7.69py6«& )  + ,X« .0J,X2 7 ) . + , #0 + W Q J,X. S  Q ">MFO#% 7
. +& 
, #0 & + W Q J,X. SS $ ) « #   Q ">?!« « OD#% o7 # «  & U S   ) . ,} U + W Q  /,Z  S +  ,$Z #  W & )Q "> FO#% 7e. & ) ,?} « U & W Q  J,Z  S 0«««+ &  ,/Z # & + W « & S  !I««) I Q 7?\ $ S 9««

!_"!%a"> !H@B!hOXN>@^H6H KJ#F> #69$
 m/exNI!Ix!hOI!NI!> 9
;=F} 7 + ) Q 2 ,. +  S $ + ,V} &



Q +W

+ ,



S\

!I NI>=} &  Q « + W + ,  S 9 « J/">«^"!«"!!IQ  =!\m I!6I!= S !I &m[I>6=B>BI!6I!
m +

«

«

«

«

100

Experimental Mathematics, Vol. 10 (2001), No. 1

56!%78UmIF6I>= Q + W + ,  S 9)aKNe.
!««$ + ) } Q , +_Q J,Z SSKQ + W + ,  S W }  Q . , +  S \m I!NI>=M. « ,
+ 9 J« « ">T=« !H« 7 7
!#I $(  + & + F mJIF6I>= & !I$"!=!K(mJI!NI>=
Q . , +  W .  & « S 9 u=!«

Q #0J,X. S & \#| $ + « ) } Q . , « +  W . & SKQ . , +  S , }Q « #0J,X. S « & <
m + I!NI>= m I!« NI>= #0« J,X.69 a!I!K} & ) Q #0J,X. S + , #| ] KFH!I> "!%m ) . 
F><">=.M« I!NI>= !I & X! 5F%7#9?
"! "F !_=9
I # "! !H@M!#OXI!NI!> 9> ] KOF!?">HNH-KhF>  + ) % ) #69VB"!=p  + Q $ S ) ZM!I   W Q #0J, # S
Q ONI  S F ] X! '7=  + ) H 9
7
  Z Q ONIM} S   + «) H W  H(
 #69

 #69
7
  . Q ONIM} S   + ) H « W H(U^HH=  + dH W  H( #6« 9U
VK!I>B> ] "> a#h"!O=I>=EKhF>
 ª 7">$   9 « :a=!J6@  ">$=HHFJH%#"!O 7  9 y6  ) # &oK ) 4    )KN Q # C  + &  S !I¬ª )   QQ #  ,Z S SKQ W Z S        + H
¥ ¨

2

b"!=B">4h#"!OD=I>=$K¬ #F>J ª )  H Z  & + & W  H   U+
Q & + S U ,V Q & + S + W Q J,X. S & + ,/Z,  H

)

«

«



«

 H

b">?I!K#O!?Z  & + 7-">>?a=%"!
Z    9 J^">X"><"!!Iª   ´      ¥   ¨ + ´ Z WZ  H
2bTGL!I3xH ] eF!I 7  ª  ] >=I  !!  !!IJ7 9 a!B%F!=>OD%F^">eh6I!=]  I>=I!!K
W N. H Z=0
. #
2 H }|
N
+ ´
# C
´ W
o
}NH #  ,/Z H #.H4
H
7 
 ³}%NL ´dK6 - W HN2 uH } | ´ Z W HO} uH   /
7  ³}%N9

 %#! ] %FHOD!O t4=h"^F%u7  ª 78
³}% '
H Z  & +   H; ,  H#6\
U+))
2 H }|N
2 H }|N
H  Z &  HKN

\Hu. #Hu
U+U+Z
HuW  H     W  H
W  HZW } H 
O
 H
  H;O} H   W  H;Hu<p7 W  H  )  H Q   & # S N p=% "FB))
=56!HZ H 2NZ,TJ H 22H4
W  H Q # S ,  H­ )) ) H ­ Z  W ) H Q # S , ) H Q Z H 2NZ,TJ H 22H4 S
 W a  Hu W ) H Q # S , ) H - J H 22c, HZ ;H 2N Z/,  H;Hu\)J
H
 #

H;O} H  W,EJ H # } #NH

H Q # S}+!HH@ ] D!">78HH ] !VH ]   !!IT78 ª '2 H }|N,  H Q  & U Sa H ,. #Hp, H Q J H 22c,/Z H 2NZ &0H « S W  HpH; ,TJ H # } #NH))<I!I!>J">!J 4h#"!OD=I>=K#F> ] D8
 Q  S  a  H , . #N2 HH}p|  ,  H Q  & U S,  H Q J H 22c,3Z H 2NZ &0H4 « S) W  HpHu ,TH W  H( #,TJ H # } #NHU)±a=!K ]  !JH ] a !FI78«  Q  S ' Q  S  a  H , . #N2 HH}p|  ,  H Q  S,  H Q J H 22c,/Z H 2NZ &0H4 S W  HpH«  ,J Hz #NH

)

)

(5–2)

5E. About the Special Point [0, 1]/2N
1 ljJ
: gVF
6 m w N\=Zn~ gfU5%k ]5d_f45 L6l.6el?35mM: 39
Theorem 5.7.
Y7; ´ %} N ] "!=KODF>=IT">J#I>=HH*
Proof.

3=H4> !I3HH "!$#H4  Q Jb%FH=/F%=2 }TFI/2  S FI"!B#/74"!M"!.
=O ^#%GF=I9 7 }%N ] !V"!V% 

Duquesne: Integral Points on Elliptic Curves Defined by Simplest Cubic Fields%!F=>OD%!=9u     Q ] "e# B
K6#I!!% S  !h"x"!%Bw N\=Zn~ )   9^yN!K"!
FO7- ] D 4  Q ` S 4HH  Q ` S    .
H>4D  Q ` S 9c?!ODaGL#p"!%  4#H
!I!<=56!H w N\=Zn~9b">  K6#I!!%7p!h"T4 =%<"! ­ #0 ,.>F6@ Q }O # S

 Q S  Q  S 
 Q S  H ­ #0[,a HuE,
aU  Hu

W

)



HpJH 22 W H;H

) H;HuE,BJH Z%\) Hu,BHJuHz #6\

J$">X">a"F!I  Q w N\=Zn~ S ´ U+ + H;6@ Q }eZ S L
Q w N\=Zn~ S + )   Q  S ´  U+ + ´NHJ#     Q ` S !I$">=FK  !>4KN9<> ] !OD "!%  ) w & + \  & U ~Lc!.
#H 9"F=X=B"!% u6IFI!IM>pO FHFH
7c.6F  ³}69?"! @ Q }J « # S «« Q  S 
 Q S «M H , HH

) HpJH 22

W





) HuH; ,  H}6\+

<4^"!X!N! ]  F

 + ´ Z|U+ + ´³# #NHb"!a #  !IM}  %B  Q ` S 9 u@DMK6FH
KODF>%X<=@$^"> ] "F% + I!NI>=4"!
I>=!OD!%u7">  K6#I!F%<7 .  9o±4=FKw N\=Zn~«a=>#%=9nTheorem 5.8.
5 3 l4jJ%: fhg m gVKl?i/21Nlb: 6Fk3JgV6Fm laL 3[5%kjO:%gV6Lm8fb: 6aC
qNkm gzjeklKf :
> mN
1 ljO%: gVL
6 mpw N\=Zn~'5 3 l 'w N\=Zn~g >  gf l.Kl.6 9
w N\=Zn~ 5 6Lv4#w N\=Zn~g >  1gso.1

gfU:=vve9

Y74 ´ }%Nu">^/7a">M">=O  %GF=I Q y6=KB} S 9c7³}% ] Fa"!<F.
N!p%!!NO%!9<GF#!<">H=ODO9
?!H@MKFI>4 ?O FHFH=9

Proof.

/2N
1 l0: vvJi qNkm gzjeklKf:
> mN
1 ljJ%: g 6Fm<w N\=Zn~ 5 3lLemma 5.9.
e6 l?%K l?3 gV6Lm lML 3[5%kYclD@onlYjem(:>o=:%qJ3#f=l~>.: 3?w N\=Zn~ g8m8f=lKk >9101  ) Q #  ,Z S w N\=Zn~   #H< 9yN!KVw N\=Zn~  ' Q ` S   ' Q ` S 9$"!="!     ´  ,3Z !I>6@ Q } Z S !I Q }J# S 

Proof.

  Q  S ´ U+ + Hu , + H Q  ,/Z S \  Q  S ´ +   Hu\  Q w N\=Zn~ S  M Hu , ) H Q JH 22c,/Z H 2NZ&0H S,2 H }|N
W. #Hp) H;Hu ,TJHz#6\

 Q w N\=Zn~ S  +   HuH
 Q w N\=Zn~ S K6 #OD=HH@B=56!H
Remark.
 H ,  + , Q Z S \) Z%9b"! "!!HI>
] ">  +  % _ ] "e IF  !H !#9«+ FHH@L7 ³ }%N ] "!
Q #  ,/Z S +F´ }}NHb KODFH "> !67 ] "! H6{ %c"!u 
.w N\=Zn~!TI } w N\=Zn~9?"F=0 U ,V}% + ,/Z #%% ,/Z } # Q . w N\=Zn~ S ) W\  ,T} U , # #0 + ,.   , NZ  Q . w N\=Zn~ S  ² Z ] ">= ³6<. w N\=Zn~>> hH 9b">pOu=!! ] " ³#2<OFH= "!%]} w N\=Zn~>4#H 9n/21NlJj :%g 6Fm }w N\=Zn~ g
f 6e.l K.l 3Xg 6Fm Ml L35k 9
Lemma 5.10.
;"!=;">-7HH ] >aK6!#=X78  Q }w N\=Zn~ S 'Proof.
C ) C    C + )  C j  ) C UU +  C  )  ) C j U  ) C  +  UYU
CC   C ¥,  +§¥¥¥¥ ¥  +  ¥
¥
§
§
¥
¥
,
¥
+
Y7- <=">!OD#%aNI!I ] ">=<">I>.
>OD!%?X=$"!% }-w N\=Zn~u !hH"!9
Y7
  Z Q OD6IB} S  ]    ) A} , Z!IB#FHK  Q }w N\=Zn~ S  ">BO=!>J">= OFH=?"!%
}w N\=Zn~4>#H 9
Y7a  . Q OD6IB} S  ] $ ) A} ,.6uKNF!I
!I^=HODF%KODOD7 K#a7 #6 ] #>
m Q S Q }w N\=Zn~ S ) Q S+ H
b">=0
 m Q  S FI  Q  S %K!#OD78HH %H>=<'7  
?7 K ]  "!= Q  S m Q  S S,  Q  S  Q  S ) Z ] " Q  S )Z  + 0, d W Z  FI  Q  S ) W Z # d W  }5   W ZK} d  W
Z } 0A}  W  } d U , }2   + ,V2% d ,+ }>Z H>Y 78HH ]  "!%
}w N\=Zn~4>4#H4HO=I9n102

Experimental Mathematics, Vol. 10 (2001), No. 1

Lemma 5.11.
  )Proof.

:  Q % S )# :  Q% S9

GLJJo l#4M40a4C/X0v1<-srsm,uU5Pl#4M40vcnb-¥4CBp7Ao c/XRAPbPl0q
4-U-c
J)K
G
G
K G
GLK G


q&7
2dC R5 RaC*4-1U/X0
7 RaC6\71R 4-030 C @@25U 4-6 cr=h?6!
k:sXW
[
_
=ICER&S<-sr
s m c<  <y<s JJo !2A6*4
7r030L4U$<-srt  u |\( !2A6*4
7r030L4U
c tLEL^C H:KC'??(u05B
c l#U/1Pg{
G
K Gj
2A/XC*4W 
4 vgC6 %R e/ECB x
 w[w:wcAz U R514-U-c
4-V y7rU*Yc <s1t  w J& + \ & U ~  ] " Q F\ S ) Q \ S ) Z%9<>">IF>FH%$ 78#O!H ]  ! 
«
«
«

«
W    , Q  + ,#0 ,2 S ) W # Q  ,. S  +
  )
H
+
} + +
«
«
«

yN!K`JFI%KF#O « + I!NI>= ">MI>=>Oe
!%7  +  9n««=!#Hp7  >#Hp">=O w B~ 
Remark.
4!a#H78a@^9pb"!47HH ] 478O
!IF%#Ix7 K% >">U m8 I!DGLH#%/7 =eH
H! ! <` l w ±aF=OHHZ=2 |~9p> ] KOLH">u!67>7>">u">=O$9 "!=-  ,/Z + ,#6\
 Q # w N\=Zn~ S )<-s  tuz{z/XRAAc{t*LEL^C H:KC'?|?(u05B6}c~C'/AH:&S0D:RCED5JG
7:D[0LTPBACB
cl#U25RAPd0L4BAU*4-RPd4-U/ECB S66*4RA6@BA/E8 C4R
wc
K G
G
z U R514-U-c5x+4-U*0 Rc <-s  t5
j!G
J
j G
j
J
o Yg0L/r6*@B?/XRPIz/XU*C!<-s1srt
u l
Yg0 /16@B)/1RAPa¥rz/XU*C-c
K G
G
G
JG
G
J
 v5@4 C 71RA/102AR C6p
R /=8 /
0Lf 7X8 `a2A/1UC @ Rg2
M4U
kW
[
_


;
NA4-0LPA6 
c #%'&(*,/0GIH
<-s1srt c  sEy  
J)K
G
J)G G
o ¥4Cp
B 7W
o <-srs5<u W,¥4Cp
B 7Ao c q&7
0L4C4(6*710L2dC 71RA6 x
C*7%
8 / [ 0 4671_ 8GGW`a2A/1UC @%"Bg254%4`r2/EC 71R6 (c #0R&Sp,/GhH]<;s  <s1sA< c; y  srt5
GLJK
G

o zgBA/1R5Yd6<s  m,u |b(zgB/XR5Yd6-c "B54S6
0346C?@25M @iNA40 P56 c
7s [
_

#0R&Sp/GhH<-s  m c<1<  y<1<

G
G
G
G


o zgB 7dP5/b<s1sr>uO$XzgB 7dP5/Ac
ROC*B5
4 eD7rUPd4-0303!{  4 010 /ECC @4-6 c
:XW [_,/0GG45D:!(#%'&(rDCEu0S3:J;(Lb<-srs1> c <r<y mr>A
G 
J
G 
J
J)K
G
G
o z 0 4U /1R <-s1trt
u U5X
 bz 0 4U /XR c q&7
2dC RASBA4 1BaC6
GLK G

W
[
_

7rR40L0 C @b@25U 4-6 
c #'&(8,/0GIHxxw <t<s1trt c
sEy

t5
G 
J
G 
J
Gb
o z 0 4U /1R<-s1sr>uU5 bwz 0 4U /XR c"B54 P
4-U*4-RA@4G
G
GG
M4G3CK V+4G 4-RQC*BA 4  4 0B54 rBrC$/XRAPC*B54)

@
1
/
5
R
1
7
R

@
1
/
0
A
B
4
1

BaC'7rRW[_
4-030 C @ @2AU 4-6 S
c #0R&S,/0GIH][ <-s<-srs1> c  y  m 
J
j
J
K G
GLK G
A G
oz
/XU*CWs m,u¥Az/XU*C-c{ RaC*4-1U/X0 7 RaC6%71RS40L0 kX
C W@
 <-sr @25U 4-6 
c #0R&S./`?npG4OC'16MN5c&CEL/PB63/n?nw[w
[
_
<-s1;
s m c s5<y srs5
J
jJoz/XU*CQ<-srs1tu(¥+z/XU*C-c x&S50L M/CE'&NG C'?25B6/0L^(KC'/0D/-*~C'/AH:&SDKCED[55.d60KC'/0DB]c z 71RPd71
R eQ/EC*Bdzd7g@1d6C2APd4RaC
J
G
G3
G
J
G
C
4 vgC6 Xwc)q+/
M5U Pd1
4  R
4U6 Cf ¥(U*46*6-cq+/
M5U P5141c<s1s1tA
G
jo zaC*U7g4Yr4Ue/1
 -g/1G RA/XY 6 GL<-K sr
s G m,u G OK 
 U5$za
G RAP=*G C*U7g4Yr4UeG/1RAP /XRA/1Y 6-c zg7r0 R5D40L0 C @I| 7 BA/1RrC RA4I4-`a2A/XC 71RA6$Mgf
*
G3J
G
G
J
G
GLK G
G J 
46C
/EC RA 0 R54-/1U?8T71U 6 R 40L0 C @0L71a/XU CB
6 
c =h?6!
k[xW [_=ICER&S<-sr
s m c< ; y<;
s 5
G
G
J
o w/r6B R51C*7rRS<s1t  4
u z(aq' p/16*B R5XC71R c q&0L/r6*6Rg2
M4-U6718
GLJK
G
X
s
W
[
_

CB54+6
0346C@25M @(NA40 P56 
c #%'&($p/GhH;
< ; <s1t  c
 <y ;
t mA
G
G
G
K G

oZq/X 4|b%
 q/1 4Ucz /XU14
RrC4[ rU/10 _ 7 Rr C6 7rR
G3K UHG <-srt u 
sxW4-030 C @ @2AU 4-6 S
c #0R&S,/0GIHS<  <-srt  
c m
y m A
S
JG
[
_


'P5Pd4RPd2
R xw
<-srt1t co z/1R5/#"> ]#w N\=Zn~L#HF7e!IFH@?7e(c6I!I9  ) # l w N\=Zn~ ] "[ NI!I[!Ism  N9 7 ) Z%c">=/=">$m )  Q !I  ) w N\=Zn~<.
#H S ; m ) Z Q !I  ) # w N\=Zn~a#H 7a!I
!H@7 <NI!I S  ~ mR#M!IJ">=  >X.
#H@$=ODO }69 ZB!
I }69 ZZ%9<7-  Z%ew N\=Zn~c
>X#H@V=OOD0}69 26  X!#H6@
=OOD4}69 ZZ%9
nN1 l.d6 m>
1 l3[5 6O7gfMZ%m 1Nlnf=l$m 1NlD: 3lKi
Corollary 5.12. 
L g %K l q6fU%5 k8kgV6Lm lML 3[5%k!jJ:%g 6Fm8f : 6m 1Nlo=qN3SK%l9



f


K

K
o x+/1Y14-U/XRAPb|'/ G 4R 71U*C(<-s1s,uWEx"/XYr4U/1RAPb,|#/ 4-R 71U*C-c+  + /XRAP\tX§ +  + c!
"B54+4-`a2A/XC 71RA6 §[ 8_ 7:9p[_"$#%'&(*),+.-/02143566<;s rs c< s,y<  u<W?q&71B54-R c>=@?A/0(AB65CEDF?A/0GIH:(J0KC'/0D0L
K G
GU R5r4Uc5x&4-U*0 R c <-srs JJKJo q&U*4
7rRA/?<s1s1tEV
u U5g!Aq&U4
71RA/Ac hAjgk5l1mdnc1/
U*7r1U/
8T71U
GLK G


] 
J
K
{}Pd4-6@4-RaC)7rR4-030 C @@25U 467 4U
c(0L/r6C/E~7rU2 {K WZYEYXJ
GJY
V%V%VO /ECBA6- R571CC R5rBA/
 /1@1 25Y
KP5/EC4p<-s1srY t5zgY 44S[
K BaYXCK C
4-U6*71R/X0 ~4-@ 8 C
U71a6
gG

aG
o |'/
Pp<-s1s u z|#/P X
c #\CED/02RC'/J D]B41;5*-/0G45B L^CED5`_ CE25B
1;5aLb/2MN0CER&G45Bc56LEL^C H:KC'd65BI
c eg4 f !zg7d@Xh e/XC*B 8
 iAU/1RA@4
'[ j
_ k7
8
J
G

 z
cAzd7g@1
/ECB  i5U/XR@41c5¥/1U 6-c<s1s 






GL

4P£U1250Lfis5c <s1srs]¤d/1@-@4

K

C*4-P

G

RSU4

gG

64PI8T7rU

J


K

G
U 0


c









 G
GL
G
G
zgfg0 / RQ|'2A`a2546R54rc!R
4-U6 C]4W
f x+71UPd4-/12(vcz/1M7rU/XC*7 U4 ¡ c
[J
_Pd2A`a2546RA4P¢/ECB  25{vM71UPd4-/12(v  8TU
%4@4



REFERENCES

0L MN5PO2C'?D(GQO.5R&S5A/0TEcz







o q&71B54-R<s1s





>r>1>





<\q&7r25U6 Pd4\0L/Qz

GG
M*4f U/EC r
7 R c




mr>



 /1034-RA@4rc[iAU/1RA@4manuscripta math. 108, 191–204 (2002)c Springer-Verlag 2002
S. Duquesne

Rational points on hyperelliptic curves
and an explicit Weierstrass preparation theorem
Received: 2 January 2001
Abstract. By using the so-called elliptic curve Chabauty method, N. Bruin [1], V. Flynn
and J. Wetherell [6] have extended Chabauty’s method to some cases where the rank of theJacobian may not be less than the genus. The main tool in these methods is a theorem ofStrassman on p-adic zeros of power series in one variable, and is applicable only if certain
Jacobians are of rank less than or equal to 1. In the present paper, we give an explicit generalization of Strassman’s theorem to several variables, enabling us to treat cases where
the rank is greater than 1. We apply this to find all the rational points on a hyperelliptic
curve of rank and genus equal to 4.

1. Introduction
One of the most important problems about curves of genus greater or equal to 2
is the computation of their rational points. It is now well-known that by using amethod of Chabauty ([3], [4], [5]), if the rank of the Jacobian of a hyperelliptic
curve is strictly less than the genus, we can bound the number of rational points on
the curve. In many cases it is thus possible to compute all the rational points on the
curve.
When the rank of the Jacobian is greater than or equal to the genus of the curve,a few methods are known for computing rational points (see [1], [7], [13]).
One of these methods (the elliptic curve Chabauty method, explained in [1] and[6]) consists in reducing the problem to finding rational points with a Q -rational
x-coordinate on an elliptic curve over some number field. In all the examples givenin the paper of Flynn and Wetherell, the elliptic curves which occur are of rank at
most equal to 1, hence one only needs to bound the number of p-adic zeros of apower series in one variable, which is done using Strassman’s theorem.
When the rank of the elliptic curve is larger than 1, it is possible to obtainsystems of power series in several variables. Bruin treated some examples in thiscase in [1]. In the general case, Strassman’s theorem does not apply and we need ageneralization of this theorem to power series in several variables.
Flynn and Wetherell suggest to use instead the Weierstrass preparation theorem.
The goal of the present paper is to make this suggestion explicit.
S. Duquesne: Laboratoire A2X, Université Bordeaux I, 351 Cours de la Libération, 33405
Talence Cedex, France. e-mail: duquesne@math.u-bordeaux.fr
Mathematics Subject Classification (2000): 11G30, 11Y50

192

S. Duquesne

As an illustration, we give the following example.
Theorem 1. Let C denote the hyperelliptic curve defined by
y 2 = x 9 − 6x 8 + 31x 7 − 81x 6 + 177x 5 − 176x 4 − 9x 3 + 107x 2 + 19x + 1 .
Then C(Q) = {∞, (1, ±8), (0, ±1)}.
Remark 1. The curve C is a hyperelliptic curve of genus 4. Using a magma programof M. Stoll [11] included in magma 2.7 and above, we compute that the rank of
its Jacobian is equal to 4. Since the rank is greater than or equal to the genus, wecannot apply Chabauty’s theorem. Hence, we will try to apply the elliptic curve
Chabauty method developed in [1] and [6]. In other words, we will look for an
elliptic curve defined over some number field such that every rational point on C
gives rise to a point on the elliptic curve with a Q -rational x-coordinate.
Let K denote the number field Q(β), where β is a root of x 3 + 2x + 1. The
curve C has been chosen so that we can factorize its defining polynomial f over K.
More precisely, we havef (x) = f1 (x)f2 (x) ,where
f1 (x) = x 3 − 2x 2 + (−4β 2 − β + 1)x + 1 .
f2 (x) = x 6 − 4x 5 + (4β 2 + β + 22)x 4 + (−8β 2 − 2β − 34)x 3+(37β 2 − 15β + 83)x 2 + (4β 2 + β + 18)x + 1 .
Let (x, y) be any rational point in C(Q). Since K has class number 1, there exist
y1 , y2 , α ∈ K such that
αy12 = f1 (x) ,αy22 = f2 (x) .
Note that there is no solution with y = 0, and that solutions with y = ∞ correspond to x = ∞. On the other hand, the resultant of f1 (x) and f2 (x) is equalto (−4 + 3β − 2β 2 )3 (−16 + β + 4β 2 )3 so that, if y = 0, ∞, without loss ofgenerality we can choose α belonging to a system of representatives of {2, (−4 +3β − 2β 2 ), (−16 + β + 4β 2 )}-units in K modulo squares. Moreover, these units
are generated by −1, β, 1 + β, 1 + β + β 2 , −4 + 3β − 2β 2 , and −16 + β + 4β 2 . It
follows that up to squares there are 64 {2, (−4+3β −2β 2 ), (−16+β +4β 2 )}-units
in K and we can compute them explicitly.
We have now to search for which of these {2, (−4+3β−2β 2 ), (−16+β+4β 2 )}units α there exists an x in Q such that αf1 (x) and αf2 (x) are simultaneously
squares. We can first look for those α which satisfy this property everywhere locally. Modulo 32, we find that this only happens for α = 1.
We have thus proved that α = 1 is the only value to consider. Thus, if (x, y) ∈C(Q), there exist y1 , y2 ∈ K such thaty12 = f1 (x) ,y22 = f2 (x) .

Rational points on curves and Weierstrass preparation theorem

193

In particular, if (x, y) is a rational point on the curve C, then (x, y1 ) is a K-rational
point on the elliptic curve
E : y 2 = f1 (x) = x 3 − 2x 2 + (−4β 2 − β + 1)x + 1 ,with a Q -rational x-coordinate.
We are thus interested in the x ∈ Q which are the x-coordinates of points on
the curve E over K. For this purpose, we want to apply the elliptic curve Chabauty
method explained in [1] and [6].
When the rank of the elliptic curve is one, this method reduces to bounding
the number of p-adic zeros of a power series in one variable, which is done byusing Strassman’s theorem. In our case, the rank of E over K is equal to 2. Thus, if
we follow the elliptic curve Chabauty method, we will need to bound the numberof p-adic solutions of systems of power series in two variables. In [6], Flynn andWetherell suggest to use the Weierstrass preparation theorem in several variables,
since Strassman’s theorem is equivalent to the Weierstrass preparation theorem in
one variable. We now follow this suggestion.
2. The Weierstrass preparation theorem in two variables
In this section we rewrite for the case n = 2 the Weierstrass preparation theorem
in n variables of Sugatani [12].
As in [12], we denote by Zp n1 , n2 the set of power series in two variables n1
and n2 with coefficients in Zp which can be written in the form
f =

∞


j

f(i,j ) ni1 n2 ,(i,j )=(0,0)

where the coefficients f(i,j ) are in Zp and f(i,j ) p → 0 as i + j → ∞.

We define a norm on Zp n1 , n2 by ||f || = max |f(i,j ) |p .
Moreover, we define Zp n2 and Zp n2 n1 in the same way and we identify Zp n2 n1 with Zp n1 , n2 so that each element f of Zp n1 , n2 has ani
expression ∞i=0 fi n1 , where fi ∈ Zp n2 and ||fi || → 0 as i → ∞.
Let us first characterize units in Zp n2 and Zp n1 , n2 .
– f =

∞


j

fj n2 ∈ Zp n2 is a unit of Zp n2 if and only if |f0 |p = 1 and

j =0|fj |p < 1 for each j = 0.
∞jf(i,j ) ni1 n2 ∈ Zp n1 , n2 is a unit of Zp n1 , n2 if and only if– f =(i,j )=(0,0)|f(0,0) |p = 1 and |f(i,j ) |p < 1 for each (i, j ) = (0, 0).
Finally, we say that f = fi ni1 ∈ Zp n2 n1 is general in n1 of order s if fs isa unit element of Zp n2 and if ||fi || < 1 for all i > s.
We can now state the following theorem which is a special case of Theorem 3.1
of Sugatani [12]:194

S. Duquesne

Theorem 2 (Sugatani). Let f ∈ Zp n1 , n2 be general in n1 of order s ≥ 0. Then
there exist unique h, g0 , . . . , gs−1 and gs satisfying the following conditions:– h is a unit element of Zp n1 , n2 and h0 (n2 ) = 1.
– g0 , . . . , gs−1 are in Zp n2 and gs is a unit element of Zp n2 .
+ · · · + g1 (n2 )n1 + g0 (n2 )).
– f (n1 , n2 ) = h(n1 , n2 )(gs (n2 )ns1 + gs−1 (n2 )ns−1
1
Remark 2. We can recognize the Weierstrass preparation theorem which says thesame thing for power series in one variable (see for example [2] p. 108). In order tobound the number of zeros of systems of two power series in two variables, we need
to apply explicitly the Weierstrass preparation theorem to one of the power series,and so we need to know how to compute the functions gi and hi of the theorem.
3. An explicit Weierstrass preparation theorem
In this section, we give a method for computing the functions occurring in theprevious theorem (2).
We have∞jf (n1 , n2 ) =f(i,j ) ni1 n2 ∈ Zp n1 , n2 ,(i,j )=0

where f(i,j ) converges to 0 in Zp as i + j → ∞. In order to apply the Weierstrass preparation theorem, we consider f as a power series in n1 with coefficientsin Zp n2 denoted by fi (n2 ). Moreover f is general in n1 of order s, hence thecoefficient fs (n2 ) of ns1 is invertible in Zp n2 and ||fi (n2 )|| < 1 for all i ≥ s + 1.
Let us denote by g(n1 , n2 ) the polynomial g0 (n2 ) + g1 (n2 )n1 + · · · + gs (n2 )ns1
iand h(n1 , n2 ) = 1 + ∞1 hi (n2 )n1 the functions of Theorem 2. Our goal is tocompute these functions. The equation f (n1 , n2 ) = g(n1 , n2 )h(n1 , n2 ) gives
hn g0 + hn−1 g1 + · · · + hn−s gs = fn

for all n ≥ 0 ,(1)with the notation h0 (n2 ) = 1 and hn (n2 ) = 0 if n < 0.
Since h is a unit in Zp n1 , n2 , we have ||hi (n2 )|| < 1 for all i ≥ 1. Hence, sincefs (n2 ) is invertible, Equation (1) for n = s implies that gs (n2 ) is also invertible inZp n2 .
Proposition 1. The functions hi can be written in terms of g0 , g1 , . . . , gs by thefollowing formula:
hn =

∞

(−1)k
k=0





gsk+1 i +i +···+i01s−1 =ks−1
 ikfind(n,k,s,i)g ,i0 , i1 , . . . , is−1where
– i = (i0 , i1 , . . . , is−1 ) ,– ind(n, k, s, i) = n + s +

s−1

j =0

(s − j )ij ,

=0

(2)

Rational points on curves and Weierstrass preparation theorem


– and

k
i0 , i1 , . . . , is−1


=

195

k!
is a multinomial coefficient.
i0 !i1 ! · · · is−1 !

Proof. Thanks to Theorem 2, we must simply show that these functions satisfy
Equation (1). For this purpose, denote by hn,kthe k-th summand occurring inEquation (2). Thus, we must show that hn = ∞k=0 hn,k satisfy Equation (1) or,
equivalently, that∞(hn,k g0 + hn−1,k g1 + · · · + hn−s,k gs ) = fn .

k=0

Let us consider the first term of this sum (k = 0) :hn,0 g0 + hn−1,0 g1 + · · · + hn−s+1,0 gs−1 + hn−s,0 gs ,the last term, hn−s,0 , is equal to fn and it is easy to prove that the other terms arecanceled by the last term for k = 1 (hn−s,1 gs ). In the same way, for any givenk ≥ 0 it is easy to prove that the term hn,k g0 + hn−1,k g1 + · · · + hn−s+1,k gs−1
is canceled by the term hn−s,k+1 gs , proving the proposition. In order to obtain an explicit Weierstrass preparation theorem, thanks to this
proposition, we only need to compute the functions g0 , . . . , gs . Since h0 = 1 and
hn = 0 for all n ≤ 0, Equation (1) allows us to write
g0 = f0 and gi = fi −i

hj gi−j 1 ≤ i ≤ s .

(3)

j =1

At this stage, it is possible to obtain formulas for gi by recursive substitution using Formula (2), but the computation is very costly. We give here a method which
computes the gi ’s and the hi ’s for any given precision in Qp if the fi ’s are given
with this precision.
Assume that we have computed the functions gi and hi modulo pk . We canthen compute the inverse of gs modulo p k . Since by definition, p divides fi for
all i ≥ s + 1, Equations (2) for n = 0, . . . , s allow us to compute the functions
h0 , . . . , hs modulo p k+1 (we can even compute the following hi ’s, but we do notneed them to compute the gi ’s). In fact, in the formula of Proposition 1, the index
of the functions fi is greater than s + 1.
Hence, using Formula (3) for i = 0, . . . , s we can compute the functions
g0 , . . . , gs modulo p k+1 . In fact, the hi ’s are now known modulo p k+1 and divisible by p. In this way, we can compute the gi ’s and even the hi ’s with the same
precision as the fi ’s.
Our main problem is to solve systems of two formal equations in two variables.
For this purpose, we consider one of the two equations as an element of Zp n1 , n2
(Flynn and Wetherell show in [6] that these equations are in Zp n1 , n2 ). We apply
the Weierstrass preparation theorem to this equation which reduces to a formula ofthe form
g0 + g1 n1 + · · · + gs ns1 = 0 .

196

S. Duquesne

In fact, in Theorem 2 the function h cannot be identically 0 because h(0,0) = 1,
hence the solution of our first equation must be a zero of a polynomial of degree s.
In this way, we can hope to eliminate the variable n1 of the equations of our system. In order to apply this method to the curve of the introduction, let us computethe power series associated to it following the “elliptic curve Chabauty” method
described in [6]. For this, we first need to compute the Mordell-Weil group E(K).
4. Computing E(K)We first compute the rank of the curve with the program of D. Simon [10]. The curve
E(K) has rank 2. It is torsion-free and generators for E(K)/2E(K) are G1 = (0, 1)
and G2 = (1, 1 − β 2 ).
We have now to find a basis for the full Mordell-Weill group E(K). For this we
perform an infinite descent as described by Siksek in [8].
Proposition 2. G1 and G2 are generators for the full Mordell-Weill group.
Proof. The first step is to bound the difference between the naive height and thecanonical height on E. The method developed by Siksek allows us to prove that forany point P in E(K), we haveh(P ) − ĥ(P ) ≤ 0.217 .
The second step is to prove that there are no point in E(K) with canonical heightless than 0.5. If P is such a point, its naive height must be less than 0.717 thanks to
the first step. We have now to test which elements of K with logarithmic height lessthan 0.717 are corresponding to points in E(K) with canonical height less than 0.5.
Such elements are represented by polynomials with integral coefficients of degree
less than 3 and with Mahler mesure less than 8.6. There are only finitely many suchpolynomials and we can compute all of them. By this way, we prove that 0 and 1
are the only elements of K which are the x-coordinate of any point in E(K) withnaive height less than 0.717. The canonical height of these points (G1 and G2 ) arerespectively 0.8054... and 0.9715.... Hence we proved that there are no point inE(K) with canonical height less than 0.5.
For the last step we use the following standard fact:
If E(K) contains no point of infinite order with canonical height less than λ andG1 , G2 generate a sublattice of E(K) of full rank 2, then the index of the span of
G1 , G2 in E(K) satisfiesn ≤ R(G1 , G2 )1/2

γ2
,
λ

√
where γ2 = 2/ 3 and R(G1 , G2 ) ≤ 0.718 is the determinant of the height pairing
matrix.
We proved in the second step that we can choose λ = 1/2, so that n ≤ 1.96.
This means that n must be equal to 1 and then that G1 and G2 are generators forE(K). 

Rational points on curves and Weierstrass preparation theorem

197

5. Elliptic curve Chabauty for C
In this section, we follow the method explain in [6].
We then choose a prime p satisfying the six conditions given in [6]: the prime
3 satisfies these conditions. The order of G1 is 11 and the order of G2 is 33, where
hereafter, denotes the reduction modulo 3. If we define G3 = G1 −3G2 , (G2 , G3 )is still a basis for E(K) and the order of G3 is 1, so we define:– m1 = 1 and m2 = 33 ,– Q1 = G3 and Q2 = 33G2 ,– S = {∞, ±iG2 , 1 ≤ i ≤ 16} ,so that every P ∈ E(K) can be written as P = S + n1 Q1 + n2 Q2 for someS ∈ S, n1 , n2 ∈ Z.
We first want to reduce the size of the set S.
Since by construction Q1 and Q2 are in the kernel of reduction modulo 3,
P = S. Hence if P has a Q -rational x-coordinate then S must have an F3 -rational
x-coordinate. Computing the elements of S mod 3, we find that this is true for
S = ∞, ±G2 , ±3G2 , ±14G2 , and so these are the only S ∈ S that we need toconsider.
Moreover, since n1 and n2 are in Z, it is of course not necessary to consider−G2 , −3G2 and −14G2 .
In fact, −G2 +n1 Q1 +n2 Q2 = −(G2 −n1 Q1 −n2 Q2 ). Since we are interested
in the x-coordinate of such a point, we have only to consider the points in E(K)which can be written as S + n1 Q1 + n2 Q2 for some S ∈ S  , n1 , n2 ∈ Z if S denotes the set {∞, G2 , 3G2 , 14G2 }.
For each point Qi = (xi , yi ), define the z-coordinate of Qi as zi = −xi /yi ,and let g3 = 1, g2 = −2, g1 = 1 − β − 4β 2 and g0 = 1 be the coefficients of ourelliptic curve.
We will now compute the z-coordinate of an arbitrary P ∈ E(K) in terms of
n1 and n2 . For this, we use the formal group law on elliptic curves and the formal
logarithm and exponential (see [9] for details).
Note that, in our cases, it will be sufficient to work mod 35 .
Thanks to the fact that k! times the coefficient of t k in log(t) or exp(t) belongs
to Z[g0 , g1 , g2 , g3 ] and the standard estimate |k!|p ≥ p−(k−1)/(p−1) , the terms in
O(t 9 ) can be ignored in the formulas.
Let θ∞ (n1 , n2 ) denote the inverse of the x-coordinate of n1 Q1 + n2 Q2 andθS (n1 , n2 ) denote the x-coordinate of S + n1 Q1 + n2 Q2 if S = ∞. We can split
θS into its components:
(0)

(1)

(2)

θS (n1 , n2 ) = θS (n1 , n2 ) + θS (n1 , n2 )β + θS (n1 , n2 )β 2 .
(1)

(2)

If the x-coordinate of P is Q -rational, then θS (n1 , n2 ) and θS (n1 , n2 ) must be
equal to 0, giving our system of two power series in two variables. In other words,(1)(2)
we have to determine which (n1 , n2 ) satisfies θS (n1 , n2 ) = θS (n1 , n2 ) = 0 in
order to obtain a bound for points on E(K) with a Q -rational x-coordinate.

198

S. Duquesne

We first compute the z-coordinate of Qi and its formal logarithm modulo 35 :z1 ≡ 240 + 84β + 57β 2z2 ≡ 60 + 99β + 195β 2log(z1 ) ≡ 42 + 48β + 39β 2log(z2 ) ≡ 15 + 117β + 15β 2(mod 35 ) ,(mod 35 ) ,(mod 35 ) ,(mod 35 ) .

We now substitute n1 log(z1 ) + n2 log(z2 ) in the expression of the formal exponential and we obtain:
z-coord of n1 Q1 + n2 Q2 ≡ ((162n22 + 18)n31 + (162n32 + 216n2 )n21+(81n42 + 81n22 + 39)n1 + (63n32 + 132n2 ))β 2+(81n51 + (162n22 + 198)n31 + (81n32 + 189n2 )n21+(162n42 +216n22 +48)n1 +(162n52 +63n32 +117n2))β+162n51 + 162n2 n41 + 36n31 + (81n32 + 162n2 )n21+(162n22 + 42)n1 + (45n32 + 15n2 )(mod 35 ) .

Hence, we have θ∞ (n1 , n2 ) as a power series in two variables and:
θ∞ (n1 , n2 ) ≡ (27n41 + 81n32 n31 + (81n22 + 207)n21 + (27n32 + 117n2 )n1+(189n42 + 198n22 )) + [54n41 + (162n32 + 162n2 )n31 + 126n21+(189n32 + 144n2 )n1 + (189n42 + 126n22 )]β + [189n41+(81n32 + 54n2 )n31 + (162n22 + 108)n21 + (162n32 + 225n2 )n1+(189n42 + 54n22 )]β 2(mod 35 ) .

(1)and so θ∞(n1 , n2 ) ≡ 54n41 + (162n32 + 162n2 )n31 + 126n21 + (189n32 + 144n2 )n1+(189n42 + 126n22 )(mod 35 ) .

(2)θ∞(n1 , n2 ) ≡ 189n41 + (81n32 + 54n2 )n31 + (162n22 + 108)n21+(162n32 + 225n2 )n1 + (189n42 + 54n22 )(mod 35 ) .

In the same way, we show that:(1)θG2 (n1 , n2 ) ≡ 162n41 + (81n22 + 162n2 + 9)n31+(81n32 + 162n22 + 108n2 + 234)n21+(162n42 + 189n32 + 198n2 + 123)n1+(189n42 + 18n32 + 162n22 + 237n2 )(mod 35 ) .

(2)

θG2 (n1 , n2 ) ≡ 162n51 + (162n2 + 54)n41 + (162n32 + 108n2 + 36)n31+(81n32 + 153)n21 + (27n32 + 162n22 + 216n2 + 150)n1+(45n32 + 33n2 )(mod 35 ) .

Rational points on curves and Weierstrass preparation theorem

199

(1)

θ3G2 (n1 , n2 ) ≡ 162n51 + 135n41 + (162n32 + 81n22 + 81n2 + 207)n31+(162n32 + 162n22 + 216n2 + 225)n21+(81n42 + 54n32 + 27n22 + 153n2 + 105)n1+(81n62 +81n52 +54n42 +99n32 +18n22 +27n2 +138)(mod 35 ) .

(2)

θ3G2 (n1 , n2 ) ≡ 81n61 +(81n22 +162n2 +9)n31 +(81n32 +162n22 +108n2 + 234)n21+(162n42 + 27n32 + 81n22 + 225n2 + 69)n1+(162n62 + 27n42 + 126n32 + 216n22 + 12n2 + 93)(mod 35 ) .

(1)

θ14G2 (n1 , n2 ) ≡ (162n2 + 108)n41 + (81n32 + 81n2 + 135)n31+(162n22 +54n2 +189)n21 +(81n42 +162n32 +54n22 +108n2 +60)n1+(162n52 + 81n42 + 45n32 + 36n22 + 171n2 + 189)

(mod 35 ) .

(2)

θ14G2 (n1 , n2 ) ≡ 162n51 + (81n2 + 108)n41 + (81n32 + 81n22 + 135n2 + 126)n31+(162n32 + 81n22 + 81n2 + 99)n21+(189n32 + 54n22 + 18n2 + 162)n1+(162n52 +54n42 +108n32 +135n22 +207n2 +150)(mod 35 ) .

In all these cases, we have to solve a system of two power series in two variables.
We already know solutions to these systems, for example (0, 0) for the first one.
Thanks to the Weierstrass preparation theorem, we will now try to bound the number of solutions and hope that the bound will correspond to the number of known
solutions.
6. Application of the Weierstrass preparation theorem in two variables tothe curve C
We have shown that the only rational points on the curve C which are apt tohave a Q − rational x-coordinate can be written ±S + n1 Q1 + n2 Q2 with
S = ∞, G2 , 3G2 or 14G2 . Moreover, for each of these S, n1 and n2 satisfy asystem of two equations. Let us first consider the case S = G2 .
6.1. The linear Weierstrass preparation theorem (s = 1) and θG2
We have(1)θG2 (n1 , n2 ) ≡ 162n41 + (81n22 + 162n2 + 9)n31+(81n32 + 162n22 + 108n2 + 234)n21+(162n42 + 189n32 + 198n2 + 123)n1+(189n42 + 18n32 + 162n22 + 237n2 )(mod 35 ) .

200

S. Duquesne(2)θG2 (n1 , n2 ) ≡ 162n51 + (162n2 + 54)n41 + (162n32 + 108n2 + 36)n31+(81n32 + 153)n21 + (27n32 + 162n22 + 216n2 + 150)n1+(45n32 + 33n2 )(mod 35 ) .
(1)

We want to apply the Weierstrass preparation theorem to θG2 (n1 , n2 ). In our casep = 3, let us consider
1 (1)f (n1 , n2 ) = θG2 (n1 , n2 ) ≡ 54n41 + (27n22 + 54n2 + 3)n31
3+(27n32 + 54n22 + 36n2 + 78)n21+(54n42 + 63n32 + 66n2 + 41)n1+(63n42 + 6n32 + 54n22 + 79n2 )(mod 34 ) .

Since by construction f(i,j ) converges to 0 as i +j → ∞ (see [6]), f ∈ Z3 n1 , n2 .
Moreover f1 (n2 ) is a unit element of Z3 n2 (because f1 (n2 ) ≡ 2 (mod 3)) and3 divides fi (n2 ) for all i ≥ 2. It follows that f is general in n1 of order 1.
Applying the method described in Section 3, we have
h1 =

∞

(−1)k

g k+1
k=0 1

fk+2 g0k ,(4)

g 0 = f0 ,g1 = f1 − g0 h1 ,

(5)
(6)

We know f0 and f1 modulo 34 , hence we know g0 modulo 34 , and we want tocompute g1 modulo 34 .
We know that h1 ≡ 0 (mod 3), hence g0 ≡ f0 ≡ n2 (mod 3) and g1 ≡ f1 ≡ 2(mod 3).
Let us follow the method described in Section 3 in order to compute g1 modulo
9. The inverse of g1 modulo 3 is equal to 2. Since the fi ’s are known modulo 9, aredivisible by 3, and known to be 0 (mod 9) for all i greater than 4, we can computeh1 modulo 9 using Equation (4):h1 (n2 ) ≡ −3n2 + 3(mod 9).

Hence, we can compute g1 modulo 9 using Formula (6):g1 (n2 ) ≡ 3n22 + 5(mod 9).

All the functions are now known modulo 9 and we can reapply this method. Finally
we compute g0 and g1 modulo 34 and obtaing0 (n2 ) ≡ 63n42 + 6n32 + 54n22 + 79n2

(mod 34 ) ,g1 (n2 ) ≡ 27n52 + 9n32 + 30n22 + 54n2 + 41

(7)

(mod 3 ) .
4Hence we have, using Theorem 2(1)

θG2 (n1 , n2 )3

= (g0 (n2 ) + g1 (n2 )n1 )(1 +with ||hi (n2 )|| < 1 for all i > 0.

∞

i=1

hi (n2 )ni1 ) ,(8)

Rational points on curves and Weierstrass preparation theorem

201

(1)

It follows that the condition θG2 (n1 , n2 ) = 0 implies that g0 (n2 ) + g1 (n2 )n1
must be 0, and so for any given n2 there is at most one solution in n1 to ourequation, and moreover the above theorem gives us an explicit solution φ(n2 ) =−g0 (n2 )/g1 (n2 ) in Z3 n2 , so thatn1 = φ(n2 ) ≡ 54n52 + 45n42 + 72n32 + 27n22 + 4n2(2)(mod 34 ) .

(2)

We can now compute θG2 (φ(n2 ), n2 ). Since θG2 ∈ Z3 n1 , n2 , we obtain a power
series ψ ∈ Z3 n2 and we haveψ(n2 ) ≡ 54n42 + 27n32 + 72n22 + 66n2

(mod 34 ) .

We can now apply Strassman’s theorem (i.e., the Weierstrass preparation theorem
in one variable) to this power series and we obtain at most one solution for n2 . We
know that n2 = 0 is a solution, so this is the only one.
Finally, we have shown that (0, 0) is the unique solution to
(1)

(2)

θG2 (n1 , n2 ) = θG2 (n1 , n2 ) = 0 ,as required.
Of course it was not really necessary to work modulo 35 , but we did this inorder to explain the computations. We note that this method can always be applied
when s = 1.
Let us now consider the case S = ∞.
6.2. The quadratic weierstrass preparation theorem (s = 2) and θ∞
We have(1)(n1 , n2 ) ≡ 54n41 + (162n32 + 162n2 )n31 + 126n21 + (189n32 + 144n2 )n1
θ∞+(189n42 + 126n22 )(mod 35 ) .

(2)θ∞(n1 , n2 ) ≡ 189n41 + (81n32 + 54n2 )n31 + (162n22 + 108)n21+(162n32 + 225n2 )n1 + (189n42 + 54n22 )(mod 35 ) .

(1)

We want to apply the Weierstrass preparation theorem to θ∞ (n1 , n2 ). In our casep is equal to 3, and let us consider the function f of Zp n1 , n2 given by
1 (1)θ (n1 , n2 ) ,9 ∞≡ 6n41 + (18n32 + 18n2 )n31 + 14n21 +f (n1 , n2 ) =(21n32 + 16n2 )n1 + (21n42 + 14n22 )(mod 33 ) .

f2 (n2 ) is a unit of Z3 n2 (because is it equal to 2 modulo 3) and 3 divides fi (n2 )for all i ≥ 3. Hence f is general in n1 of order 2.

202

S. Duquesne

Using our method, we can compute g0 , g1 and g2 modulo 33 . We obtain:
g0 (n2 ) ≡ 21n42 + 14n22(mod 33 ) ,g1 (n2 ) ≡ 18n52 + 6n32 + 16n2
g2 (n2 ) ≡ 14

(mod 33 ) ,(mod 33 ) .

Hence we have
∞

(1)


θ∞ (n1 , n2 )hi (n2 )ni1 ) ,= (g0 (n2 ) + g1 (n2 )n1 + g2 (n2 )n21 )(1 +9i=0with ||hi (n2 )|| < 1 for all i > 0.
(1)
Thus, the condition θ∞ (n1 , n2 ) = 0 implies that g0 (n2 )+g1 (n2 )n1 +g2 (n2 )n21
= 0. Hence, for any given n2 there are at most two solutions in n1 to our equation.
Moreover, g2 (n2 ) is invertible in Z3 n2 , hence there exist power series φ0 and φ1
in Z3 n2 such thatn21 = φ0 (n2 ) + φ1 (n2 )n1 .
Let us substitute recursively n21 by φ0 (n2 ) + φ1 (n2 )n1 in the equation(2)

θ∞ (n1 ,n2 )= 0. We deduce that there exist power series ψ0 and ψ1 in Z3
9n2 suchthatψ0 (n2 ) + ψ1 (n2 )n1 = 0 .

(9)In our case, we have
ψ0 (n2 ) ≡ 9n62 + 24n42 + 21n22(mod 33 ) ,ψ1 (n2 ) ≡ 18n52 + 24n32 + 19n2

(mod 33 ) .

Thanks to the fact that 19 is invertible modulo 33 , we deduce from (9) that there
0
exists a power series + = − ψψ1 in Z3 n2 such that n1 = +(n2 ). In our case, wehave+(n2 ) ≡ 21n32 + 6n2 (mod 33 ) .
We can now compute f (+(n2 ), n2 ) ∈ Z3 n2 and we can apply Strassman’s
theorem to this power series. In our case, we havef (+(n2 )) ≡ 15n42 + 20n22(mod 33 ) .

2 ))allows us to conclude that n2 = 0 is
Applying Strassman’s theorem to f (+(n2n2the only solution to f (+(n2 ), n2 ) = 0 and finally that n1 = n2 = 0 is the only
solution to our problem.
Finally, we have shown that (0, 0) is the only solution to(1)(2)(n1 , n2 ) = θ∞(n1 , n2 ) = 0 ,θ∞as required.

Rational points on curves and Weierstrass preparation theorem

203

7. Conclusion(1)

As for θG2 , we can show that n1 = 1, n2 = 0 is the unique solution to θ3G2 (n1 , n2 )
(2)

(1)

(2)

= θ3G2 (n1 , n2 ) = 0. In order to prove that θ14G2 (n1 , n2 ) = θ14G2 (n1 , n2 ) = 0 has(2)

no solution, we only need to apply Strassman’s theorem to θ14 (n1 , n2 ) with respect
to one of the variables (the term having largest 3-adic norm is the constant term).
This shows that the only K-rational points on the curve E with Q -rational x-coordinates are ∞, ±G2 and ±(3G2 + Q1 ) = ±G1 . It follows that the only possible
x-coordinates for a Q -rational point on C are {∞, 0, 1}, thus proving Theorem 1.
There is a more general method to apply the Weierstrass preparation theorem:
we can compute the functions gi for each of the power series. By this way weobtain 2 polynomials P1 and P2 in n1 with coefficients in Zp < n2 >. Our goal
is to bound the number of solutions (n1 , n2 ) of P1 = P2 = 0. It is then natural tocompute the resultant of P1 and P2 which is a power series in Zp < n2 >. Then
applying Strassman’s theorem allows to bound the number of solutions.
I write a Maple program which compute the function gi and hi as explained in
section 3 and apply this method in order to bound the number of p-adics solutionsof systems of two power series in two variables. This program is available by ftp:
ftp://megrez.math.u-bordeaux.fr/pub/duquesne
or on my home page on the web:
http://www.math.u-bordeaux.fr/˜duquesne/programs.
To conclude, we see that the use of the Weierstrass preparation theorem in two
variables allows us to extend the elliptic curve Chabauty method to elliptic curvesof rank 2 over number fields. In the same way, by writing explicitly the Weierstrass
preparation theorem in n variables it is easy to extend the method to elliptic curvesof rank n over number fields of degree strictly larger than n.
References[1] Bruin, N.: Chabauty methods and covering techniques applied to generalized Fermat
equation, PhD Dissertation, Leiden University, (1999)[2] Cassels, J.W.S.: Local fields, London Math. Soc. Student Texts 3, Cambridge
University Press, (1986)[3] Chabauty, C.: Sur les points rationnels des variétés algébriques dont l’irrégularité estsupérieure à la dimension, C.R.A.S. Paris 212, 1022–1024 (1941)[4] Coleman, R.F.: Effective Chabauty, Duke Math. J. 52, 765–780 (1985)[5] Flynn, E.V.: A flexible method for applying Chabauty’s theorem, Compositio
Mathematica 105, 79–94 (1997)[6] Flynn, E.V., Wetherell, J.L.: Finding rational points on bielliptic genus 2 curves,
Manuscripta Math. 100, 519–533 (1999)[7] Flynn, E.V.: On Q-derived polynomials, Manuscript (2000), to appear in Proc.
Edinburgh Math. Soc.
[8] Siksek, S.: Infinite descent on elliptic curves, Rocky Mountain Journal of Mathematics 25(4), 1501–1538 (1995)[9] Silverman, J.: The arithmetic of elliptic curves, Springer, (1986)[10] Simon, D.: Computing the rank of elliptic curves over number fields, Manuscript(2000), to appear in LMS J. Comput. Math.

204

S. Duquesne[11] Stoll, M.: Implementing 2-descent for Jacobians of hyperelliptic curves, Acta Arith.
98(3), 245–277 (2001)[12] Sugatani, T.: Rings of convergent power series and Weierstrass preparation theorem,
Nagoya Math. J. 81, 73–78 (1981)[13] Wetherell, J.L.: Bounding the number of rational points on certain curves of highrank, PhD Dissertation, University of California at Berkeley, (1997)

Numerical investigations related to the derivativesof the L–series of certain elliptic curves
C. Delaunay, S. Duquesne
September 23, 2003
Abstract
In [Zagier and Kramarz 1987], the authors computed the critical valueof the L-series of the family of elliptic curves x3 +y 3 = m and they pointed
out some numerical phenomena concerning the frequency of curves witha positive rank and the frequency of occurrences of the Tate-Shafarevitchgroups X in the rank 0 case (assuming the Birch and Swinnerton-Dyer
conjecture). In this paper, we give a similar study for the family of elliptic
curves associated to simplest cubic fields. These curves have a nonzero
rank and we discuss about the density of curves of rank 3 that occurs.
We also remark a possible positive density of nontrivial Tate–Shafarevitchgroups in the rank 1 case. Finally, we give examples of curves of rank 3
and 5 for which the group X is nontrivial.

1

Introduction and Motivations

Let E be an elliptic curve defined over Q. From the work of [Wiles 1995],[Taylor and Wiles 1995] and [Breuil et al. 2001], E is known to be modular.
This implies that its L-function L(E, s) can be analytically continued to thewhole complex plane. Furthermore, if N is the conductor of E, then the following functional equation holds:
Λ(E, 2 − s) = εΛ(E, s) ,(1)

where ε = ±1 is the sign of the functional equation and:√ !sN
Λ(E, s) =Γ(s)L(E, s) .
2π
In this paper, we are interested in computing the analytic order of the Tate–
Shafarevich group X of certain elliptic curves E defined over Q using the Birch
and Swinnerton-Dyer (BSD) conjecture:
Conjecture 1 (Birch and Swinnerton-Dyer) Let r denote the rank of theMordell-Weil group E(Q). We have:lim

L(E, s)s→1 (s − 1)r

=

cΩR
|X|
|E(Q)tors |2
1

,

(2)

1 INTRODUCTION AND MOTIVATIONS

2

where c denotes the product of the Tamagawa numbers, Ω the real period and R
the regulator of E.
In [Zagier and Kramarz 1987], Kramarz and Zagier carried out some numerical computations related to the family of elliptic curves given by equations
x3 + y 3 = m (the so-called Sylvester cubics). They computed the critical valueof the L-functions of the curves having an even functional equation (i.e. ε = 1)
for m ≤ 70000 and they pointed out some numerical phenomena concerning thefrequency of curves with a positive rank and the frequencies of occurrences of|X| in the rank 0 case (with formula (2)). More precisely, concerning the rank,
their numerical data suggest a possible positive density of curves with positive
rank. In [Watkins], Watkins extended the computations to m = 107 , the results being that the density of positive rank is finally decreasing and probably
tends to zero like x5/6 log(x)C (with some constant C ≈ 3/5). The behaviour
x5/6 was already mentioned in [Zagier and Kramarz 1987], and stronger models
using random matrix theory as in [Conrey et al. 2000] should give x5/6 log(x)Cfor some constant C.
Watkins computations confirm the remark on Kramarz and Zagier that the frequency of occurrences of |X| = 1, |X| = 4, etc. among rank 0 curves isdecreasing. Heuristics in [Delaunay 2001] predict that these frequencies shouldbe 0 (but note that these heuristics predict a general behaviour for all elliptic
curves and that we are only concerned here with very specific families). Furthermore, the numerical results of Watkins about the question of how often a given
prime p divides |X| seem to be not too much discordant with the predictions in[Delaunay 2001] (at least for p 6= 3).
In this paper, we make a similar experimental study but in the case of a familyof elliptic curves with positive rank. It is quite natural and interesting to wonder
if the same phenomena will occur or not and, in fact, as far as we know there
is no such study in the literature. In the case of positive rank, heuristics in[Delaunay 2001] predict that there is a positive density of curves with nontrivial
Tate–Shafarevich group but, in practice, they are quite sparsely observed. For
example, the tables of Cremona ([Cremona data]) found only 196 such curves
among all elliptic curves of conductor less than 20000, furthermore all these 196
curves have rank one and most of them have X = 4. Indeed, there are infinitely
many rational points on such curves, so that it is more difficult to find p-adic
points not corresponding to rational points. In fact, nontrivial Tate–Shafarevichgroups appear for large conductors.
The problem of computing |X| using formula (2) when the rank is positive ismuch more complicated because on the one hand we have to determine the regulator R (in the rank-zero case, the regulator is simply R = 1) and on the other
hand we have to deal with quite large conductors to be able to detect nontrivial X.
Here, we are concerned with the family of elliptic curves associated to the simplest cubic fields (see below) which were introduced by Shanks in [Shanks 1974]
and were studied by Washington ([Washington 1987]) and more recently in2 ELLIPTIC CURVES ASSOCIATED TO SIMPLEST CUBIC FIELDS

3[Duquesne 2001]. This family has properties interesting for our purpose. Eachof these curves has an odd rank and an explicit generator so that the regulator iseasily computable when the rank is one. The conductor grows fast so that we canhope finding nontrivial Tate-Shafarevich groups. We compute, using the GP-Pari
software ([PARI]), values of L0 (E, 1) for many of these curves and deduce fromthem and from formula (2) analytic orders of Tate–Shafarevich groups for the
rank-one case. The method we used are well known since we have to evaluate a
rapidly converging series (see formula (6)), and are explained in [Cohen 1993] andin [Cremona 1997]. Furthermore, several GP-programs are available, for example
a program by Cremona and Womack ([Cremona and Womack], which computes
the derivatives of L-functions of elliptic curves) or by Dokchitser ([Dokchitser],this program deals with general L-function having a classical functional equation).
According to our numerical data, we first observe an experimental positivelike density of curves with high ranks. In regard to the above Zagier-Kramarz
extension by Watkins, we must be careful; indeed, the fact that the growth of
the regulator can be well estimate allows to use the same argument-principle
as in the case of the Sylvester cubics and it suggests the density of curves withranks ≥ 3 may tend to 0. We also discuss about the density of occurrences of|X| when the rank is one (with the same reticence as above). Finally, we findexample of nontrivial Tate–Shafarevich groups for some curves of rank 3 and 5
by computing L(3) (E, 1) and L(5) (E, 1).

2

Elliptic curves associated to simplest cubic fields

In the sequel, m will always denotes a positive integer such that the number∆ = m2 + 3m + 9 is squarefree. Let E be the elliptic curve:
E : Y 2 = X 3 + mX 2 − (m + 3)X + 1 .

(3)

The field defined by the polynomial of the right hand side of (3) is said to be asimplest cubic field. These fields were introduced by Shanks in [Shanks 1974].
In [Washington 1987], Washington studied these fields and deduced some properties of the related elliptic curves (3) including the following result:
Theorem 2 (Washington) The rank of the elliptic curve E is odd, assumingthat the Tate–Shafarevitch group is finite.
In [Duquesne 2001], the second author studies the structure of the Mordell–Weilgroup of these curves, and in particular proves:
Theorem 3 The Mordell–Weil group E(Q) is torsion-free and the point (0, 1)
can always be taken as an element of a system of generators for E(Q). In
particular, if the rank of E is one, the point (0, 1) generates E(Q).

2 ELLIPTIC CURVES ASSOCIATED TO SIMPLEST CUBIC FIELDS

4

Let us now write down the classical invariants attached to these curves. The
discriminant of E is 16∆2 , its j-invariant is 256∆. Note that 16∆2 is the discriminant of (3) and is the minimal discriminant of E whereas equation (3) does
not give the minimal Weierstrass model. In fact, the minimal model is given bya slightly more complicated equation:
Y 2 = X 3 +εX 2 − 3(k 2 + k + 1) + (2k + 1)ε X +(2k+1)(k 2 +k+1)+k(k+1)ε ,where m = 3k + ε with ε = ±1 (if ε = 0, m does not define a simplest cubic
field). Moreover, Tate’s algorithm also allows us to compute the conductor andthe Tamagawa numbers :Ncm ≡ 0 (mod 2)
16∆2
1

m ≡ 1 (mod 4)
8∆2
2m ≡ 3 (mod 4)
4∆2
3The table above gives N is about m4 and grows sufficiently quickly as mentioned
in the introduction.
In our case, the BSD conjecture predicts that:
L0 (E, 1) = c Ω bh ((0, 1)) S ,(4)

where bh is the canonical height on E and is computed using GP-Pari, Ω is thereal period of E (which is easily computable using the AGM method) and:
0
if rank(E) > 1,
S=
|X| if rank(E) = 1.
From the work of [Duquesne 2001], one can see that bh ((0, 1)) behaves like log(m)and that Ω ' m−1/2 log(m). Since, under GRH, L0 (E, 1) = O(mε ), using formula (4), we obtain :S = O(m1/2+ε ) .
Furthermore, the value of L0 (E, 1) is computed by:
X an Z ∞dt0
L (E, 1) = 2
e−t
,
n 2πn
t
√
n≥1

where L(E, s) =Pn≥1 an n

−s

(5)

(6)

N

.

Thus, we compute S using (4). From the well-known work of Gross and Zagier([Gross and Zagier 1986]) S is known to be a rational number. All the values
that we find in our numerical calculations are near to perfect squares of integers as required by the BSD conjecture. This gives a check of our numericalcomputations.

5

3 NUMERICAL RESULTS

3

Numerical results

We computed S for all integers√ m less than 14000 defining simplest cubic fields.
For this, we need about O N coefficients in the right hand side of formula(6) to obtain a reasonable accuracy for L0 (E, 1). Since the conductor grows as
m4 , we were led to consider sums with about m2 terms (and so sums with about
2 × 108 terms for the largest values of m we considered). For this, the strategy
that we use to get a sufficiently good approximation for L0 (E, 1) is the following(the same sort of strategy is used in [Zagier and Kramarz 1987]) :• We compute and store the√values of the coefficients an for n less than somebound B of the order of N (B = 1.67 × 107 for large values of m).
• We compute the partial sum in (6) using these first coefficients.
• Beyond B, we compute on the fly the coefficients an (if n = n1 n2 with
n1 , n2 ≤ B, we can deduce an from an1 and an2 ) and add their contributions to the sum. At each step, we add 106 new terms in the partialsum.
• We repeat the last step until two successive sums Σ1 and Σ2 satisfy:|Σ1 − Σ2 | < 0.02 and |Σ2 − s2 | < 0.02 for some s ∈ Z.
Note that for each prime p dividing the conductor we have p2 |N . Thus fromAtkin–Lehner theory ([Atkin and Lehner 1970]), (n, N ) 6= 1 ⇒ an = 0, and inparticular an = 0 if n is even. This remark is helpful for computations.
For large values of the parameter (say m ≥ 8000), the computation of L 0 (E, 1)
requires a lot of time and memory. We needed several months of CPU on a
Pentium III @ 1GHz to deal with the values of m less than 14000.
In order to give the numerical data that we obtained, we set:N (x) = ] m ≤ x | m2 + 3m + 9 is squarefree ,Ns (x) = ] m ≤ x | m2 + 3m + 9 is squarefree and Sm = s .
The results are summarized in the following table:xN (x)N0 (x)
N1 (x)
N4 (x)N9 (x)
N16 (x)N25 (x)N36 (x)N49 (x)N64 (x)N81 (x)

2000
1246
363
728
101
45
5
3
1

4000
2492
700
1384
235
141
19
11
2

6000
3739
1031
2025
389
227
42
17
7
1

8000
4986
1347
2677
522
326
67
32
13
1
1

10000
6234
1681
3267
703
427
91
46
13
3
1
2

12000
7477
2026
3828
868
540
116
72
15
7
2
3

14000
8722
2328
4402
1035
674
150
97
21
9
3
3

3 NUMERICAL RESULTS

3.1

6

Density of high rank curves

The discussion we give here is founded on the experimental data and several interpretations are possible so we must be careful all the more that the behaviourof the curves for m ≤ 14000 may not mirror the general one when m tends
to ∞ (as it is the case for the Zagier-Kramarz computations). A first approachconcerning the frequency of occurrences of curves with L0 (E, 1) = 0 (and so of
curves with rank ≥ 3) suggests that there is a positive density of such curves.
Indeed, as it can be seen on figure (1), the ratio N0 (x)/N (x) is fairly nearly
constant (the constant being ≈ 0.27).

N0 (x) = 2328
2311

N (x)8661= 8722

15
64

Figure 1: The points (N (x), N0 (x)) (and joined)
Such an observation should provide, as asked in [Zagier and Kramarz 1987] an
example of a family of curves with an expected positive density of curves withhigh rank. Note that in the case of the simplest cubic fields, and contrary to
the Fermat cubics, the curves are not isomorphic over any number field (their jinvariant is not constant). We should compare this 27% of extra-rank curves weobtained with the large table of Stein and Watkins in [Stein and Watkins 2002]
extending the Brumer-McGuiness one ([Brumer and McGuinness 1990]) and forwhich 92.5% of their curves with odd functional equation have rank one (their
database contains million of curves, and their conductors do not exceed 1010 ). In7

3 NUMERICAL RESULTS

fact, one of the current opinion about the rank of elliptic curves is that asymptotically, the rank is the lowest one compatible with the sign of the functional
equation ([Brumer and McGuinness 1990]). So, it would be very surprising if apositive density really occurs for our family.
Thanks to the estimate of formula (5), we can adapt the argument of Zagierand√ Kramarz : assuming S is, in fact, a random perfect square between 0 and
m for each value of m, then the number of curves with m ≤ x that have rank
greater than 1 should be about x3/4 . Moreover a naive extension of the conjecture [Conrey et al. 2000] to our case should provide the more precise estimatex3/4 log(x)C for some constant C. However, it does not seem obvious how toextend the work of [Conrey et al. 2000] to the derivatives of L-functions even if,
as in our case, the regulator can be well estimated. The interpretation above iscorroborated by taking the best linear fit to a log-log graph of figure (1). We
obtain by this way that the number of curves with m < x that have rank greaterthan 1 appear to grow like x0.967 , which is enough close to x3/4 log(x)0.91 whenx ≤ 14000.

3.2

Frequency of occurrences of S

We also compute the frequency of occurrences of each analytic order of Tate–
Shafarevich groups among curves of (analytic) rank 1. The figure 2 illustrates
the results that we obtain.
11

S=1

S=4
S=9
S ≥ 1600
11399
m = 14000

m=1

Figure 2: Frequencies of occurrence of S

4 NONTRIVIAL TATE–SHAFAREVICH GROUPS OF CURVES WITH RANK 3 AND 58

Although we cannot produce sufficient data, we seem to have a positive density for each order. This is in accordance with the heuristics in [Delaunay 2001].
However the densities could differ from the predicted ones since we only consider
a specific family of elliptic curves. For instance, 68.8% (resp. 18.9%, 10.9%) of
rank 1 curves with m ≤ 14000 have trivial X (resp. have 2 dividing S, have
3 dividing S) whereas [Delaunay 2001] would predict 54.9% (resp. 31.1%, resp.
12.3%).
Furthermore, the same heuristic argument as for S = 0 could be also used here
and predicts that NS (x)/(N (x) − N0 (x)) should tend to zero like x3/4 and so
clashes with the heuristics and seems to be discordant with our numerical data.
Arithmetic effects on m could also modify the frequencies we considered. In
view of the invariants of E, it is natural to fit m into three cases : m even,m ≡ 1 mod 4 and m ≡ 3 mod 4 (in fact, other cases were considered as ∆prime for example, but gave the nearly the same results as in the general case).
We sum up the results for all curves with m ≤ 14000 in the following table :m ≡ 0 mod 2
m ≡ 1 mod 4
m ≡ 3 mod 4]{S = 0}
964
649
715

]{S = 1}
2040
1133
1229

]{S = 4}
628
256
151

]{S = 9}
490
110
74

]{S ≥ 16}
239
32
12

It follows from the data that the densities are, as in the general case, nearly
constant for m ≤ 14000 but depend on the class of m.
For m ≡ 0 mod 2 (resp. m ≡ 1 mod 4, m ≡ 3 mod 4), there are about 22.1%(resp. 29.7%, 32.7%) of elliptic curves with S = 0. This difference could be
explained by the fact that formula (4) and the invariant c force S to be smallerwhen m is odd, and so S is more often equal to 0 or 1 in this case. We also remarkthat all parametrization of [Duquesne 2001] in order to have elliptic curves withlarge rank give odd values of m.

4

Nontrivial Tate–Shafarevich groups of curves
with rank 3 and 5

Among the 27% of our curves of rank 3 or more, we find some curves of analytic rank 3 with nontrivial Tate–Shafarevich group. For this, we use conjecture (2) and we compute L000 (E, 1) by the method of Buhler, Gross and Zagier([Buhler, Gross and Zagier 1985]).
The first example of rank greater than 1 for which the program mwrank of Cremona ([Cremona]) is not able to determine the rank completely is obtained with
m = 157. As mwrank uses a 2-descent, this suggests a non trivial 2-part in theTate–Shafarevich group. In order to compute the regulator, we check that the

9

REFERENCES

points
P1 = [−12, 151], P2 = [0, 1] and P3 = [3, 31]
form a basis for E(Q) using Siksek’s method ([Siksek 1995]). Finally, we get|X| = 4, thus providing a nontrivial Tate–Shafarevich group for an elliptic
curve of rank 3 (assuming BSD). Other such examples are given for examples
by m = 617, 830, 856, 943, 961.
We can also obtain similar results for rank 5. In this case, the first value forwhich the mwrank program does not seem to determine the rank completely is
m = 3461. Thus, this suggests a nontrivial 2-part. Indeed, we can check thatthe points:
−12 35725,[0, 1], [−4, 263], [−40, 2369], [−124, 7193] and169 2197
give a basis for E(Q) and so that |X| = 4 (under BSD).

Aknowledgements. We are very grateful to the anonymous referees for theircomments and suggestions which improved this paper. We are very pleased to
thank them here.

References[Atkin and Lehner 1970] A. O. L. Atkin and J. Lehner, Hecke operators on
Γ0 (N ), Math. Ann. 185 (1970), 134–160.
[PARI] C. Batut, K. Belabas, D. Bernardi, H. Cohen and M. Olivier, pari-gp,
available at http://www.math.u-psud.fr/˜belabas/pari/[Buhler, Gross and Zagier 1985] J. Buhler, B. Gross and D. Zagier, On the
Conjecture of Birch and Swinnerton-Dyer for an Elliptic Curve of Rank 3,
Math. Comp. 44 (1985), no. 170, 473–481.
[Breuil et al. 2001] C. Breuil, B. Conrad, F. Diamond and R. Taylor,
On the modularity of elliptic curves over Q : wild 3-adic exercises,
J. Amer. Math. Soc. 14 (2001), no. 4, 843–939 (electronic).
[Brumer and McGuinness 1990] A. Brumer and O. McGuinness, The behaviourof the Mordell-Weil group of elliptic curves, Bull. Amer. Soc. 23 (1990), no.
2, 375–382.
[Cohen 1993] H. Cohen, A course in computational algebraic number theory,
Graduate Texts in Math. 138, Springer-Verlag, New-York, 4-th corrected
printing (2000).

REFERENCES

10[Conrey et al. 2000] J. Conrey, J. Keating, M. Rubinstein and N. Snaith, On thefrequency of vanishing of quadratic twists of modular L-functions, Number
theory for the millennium, I (Urbana, IL, 2000), 301–315, A. K. Peters,
Natick, MA, 2002.
[Cremona 1997] J. Cremona, Algorithms for modular elliptic curves, Cambridge
University Press, (1997) second edition.
[Cremona] J. Cremona, mwrank, program available at
http://www.maths.nott.ac.uk/personal/jec/.
[Cremona data] J. Cremona, Elliptic curve data for conductors up to 20000
available at http://www.maths.nott.ac.uk/personal/jec/[Cremona and Womack] J. Cremona and T. Womack, program available at
http://www.maths.nott.ac.uk/personal/pmxtow/BG.gp[Delaunay 2001] C. Delaunay, Heuristics on Tate-Shafarevitch groups of elliptic
curves defined over Q, Exp. Math. 10 (2001), no. 2, 191–196.
[Dokchitser] T. Dokchitser program available at
http://maths.dur.ac.uk/˜dma0td/computel/[Duquesne 2001] S. Duquesne, Integral points on elliptic curves defined by simplest cubic fields, Exp. Math. 10 (2001), no. 1, 91–102.
[Gross and Zagier 1986] B. Gross and D. Zagier, Heegner points and derivativesof L-series, Invent. Math. 84, (1986), 225–320.
[Shanks 1974] D. Shanks, The simplest cubic fields, Math. Comp. 28 (1974),
1137–1152.
[Siksek 1995] S. Siksek, Infinite descent on elliptic curves, Rocky Mountain
Journal of Math. 25 (1995), no. 4, 1501–1538.
[Stein and Watkins 2002] W. Stein and M. Watkins, A database of elliptic
curves – first report, ANTS-V, LNCS 2369, Springer-Verlag, 267–275.
[Taylor and Wiles 1995] R. Taylor and A. Wiles, Ring-theoretic properties ofcertain Hecke algebras, Ann. of Math. (2)141 (1995), no. 3, 553–572.
[Washington 1987] L. C. Washington, Class numbers of the simplest cubic fields,
Math. Comp. 48:177 (1987), 371–384.
[Watkins] M. Watkins, Rank distribution of cubic twists, preprint, available atwww.math.psu.edu/watkins/zk.dvi[Wiles 1995] A. Wiles, Modular elliptic curves and Fermat’s last theorem,
Ann. of Math. (2) 141 (1995), no.3, 443–551.

REFERENCES

11[Zagier and Kramarz 1987] D. Zagier and G. Kramarz, Numerical investigations
related to the L–series of certain elliptic curves, Journal of the Indian Math.
Soc.52 (1987), 51–69.

Christophe Delaunay, École Polytechnique Fédérale de Lausanne, Faculté dessciences de Base, CSAG, 1015 Lausanne, Switzerland.
e-mail : christophe.delaunay@epfl.ch
Sylvain Duquesne, Département des Sciences Mathématiques, Université Montpellier II - Case Courrier 051, Place Eugène Bataillon, 34095 Montpellier cedex
5, France.
e-mail : duquesne@math.univ-montp2.fr

Classification of genus 2 curves over F2n
and optimization of their arithmetic
Bertrand Byramjee1 and Sylvain Duquesne2
1

Oberthur Card Systems,
25, rue Auguste Blanche, 92800 Puteaux, France,b.byramjee@oberthurcs.com
2
Université de Montpellier II, Laboratoire I3M, UMR CNRS 5149
CC 051, place Eugene Bataillon, 34095 Montpellier Cedex 5, France,
duquesne@math.univ-montp2.fr

Abstract
To obtain efficient cryptosystems based on hyperelliptic curves, westudied genus 2 isomorphism classes of hyperelliptic curves in characteristic 2. We found general and optimal form for these curves, just as
the short Weierstrass form for elliptic curves. We studied the security
and the arithmetic on their jacobian. We also rewrote and optimized
the formulas of Lange in characteristic 2, and we introduced a new
system of coordinate. Therefore, we deduced the best form of hyperelliptic curves of genus 2 in characteristic 2 to use in cryptography.
Key words. hyperelliptic curve cryptography, genus 2, characteristic
2, explicit formulas, security, isomorphism classes, standardization of
curves.

1

Introduction

There is no sub-exponential time algorithm to solve the discrete problem
based on abelian generic group. Elliptic curves provide the simplest example
with no better algorithm than for generic group. In 1985, Elliptic curves
cryptosystems were introduced independently by Miller [13] and Koblitz[6]. In 1989, Koblitz [7] suggested using the jacobian of hyperelliptic curves
as a source of finite abelian groups. The main advantage is to use smaller
ground field for the same level of security. For example, a hyperelliptic curve1

of genus 2 over F280 can be used in order to have the same level of security
as an elliptic curve defined over F2160 .
This paper deals with hyperelliptic curves of genus 2 in characteristic
2. It is organized as follows. In section 2, we recall the basic notions ofhyperelliptic curves. We refer the reader to [8] for further details and insection 3 we proceed as in [2] and [16] to classify hyperelliptic curves. In thecase of elliptic curves (g = 1), one can prove that every non supersingularcurve can be transformed into a curve of the type:y 2 + xy = x3 + a2 x2 + a6 .
At this point, there is no analogous in higher genus. Such a representation is very important to define a standard for hyperelliptic curves. Somework has already been done in this field, at least in genus 2 in [2]. Nevertheless we can improve it. We suggest two types of curves suitable forcryptography which are general and optimal in a sense that we will precise
later.
In section 4, we analyze the security of the different classes of curves
defined in the previous section. In section 5, we rewrite and optimize characteristic 2 formulas of Lange, but we count multiplications of all the coefficients. Moreover we suggest a new system of coordinates which allows
faster scalar multiplications on jacobians. All these formulas are given inappendix. Thanks to the results of the last two sections, we suggest a form
for equations for hyperelliptic curves of genus 2 in characteristic 2 for future
standards in cryptography.

2

Background on Hyperelliptic curves

Let F2n be an algebraic closure of the field F 2n . A hyperelliptic curve C ofgenus g ≥ 1 on F2n is given by the general equation :C : y 2 + h(x)y = f (x)(G)

where h ∈ F2n [X], is a polynomial of degree at most g, f ∈ F 2n [X] is a
monic polynomial of degree 2g + 1 and there is no singular points (x, y) ∈F2n × F2n . These are the solutions satisfying simultaneously equation (G)and the partial derivative equations h(x) = 0 and h 0 (x)y + f 0 (x) = 0.
Now, we concentrate in the genus 2 case. Let us define some objects onthese curves.
A divisor D is a formal sum of points on the hyperelliptic curve C. The
2

jacobian J is the group of degree 0 divisors modulo principal divisors. In
practice, we use the Mumford representation : each divisor is represented
by a pair of polynomials [u, v] such that u is a monic polynomial of degree 2,
deg v < deg u and u|f − hv − v 2 (these types of divisors are called reduced).
Cantor described a general algorithm (working in every genera) to add
divisors on J, see [1] for more definitions on hyperelliptic curves and details
on this algorithm. Nevertheless, his algorithm is too slow, mainly because
using gcd algorithms, and uses up too much memory for restricted environments like smart cards.
To improve it in the genus 2 case, Lange following Harley [5], suggests
several explicit formulas in affine, projective and weighted projective, in [9],[10] & [11]. Nevertheless she doesn’t count multiplications by the coefficientsof h, as with the Koblitz curves. Therefore her formulas are not general.
That’s why we suggest here to rewrite her formulas in the general case andin the different types we define in section 2. In so doing, we optimize theseformulas. The best optimizations we obtained, are in the doubling casewhich is the most important in scalar multiplication.

3

Classification of genus 2 hyperelliptic curves over F2n

For the genus 2 case, we use the following equationy 2 + (h2 x2 + h1 x + h0 )y = x5 + f4 x4 + f3 x3 + f2 x2 + f1 x + f0 .
We divide the hyperelliptic curves into three types depending on the leading
coefficient of h, following the notation of [2]:• type I: h2 6= 0.
• type II: h2 = 0, h1 6= 0.
• type III: h2 = h1 = 0, h0 6= 0.
Moreover, Choie and Yun prove in [2] that type I has asymptoticallybetween 2q 3 and 4q 3 isomorphism classes (q = 2n ), type II about 2q 2 andtype III between 2q and 32q. Nevertheless, from these 3 types, only 2 areinteresting for a cryptosystem based on the Discrete Logarithm problem, as
Galbraith proves in [4] the following result.
Proposition 1. A characteristic 2 hyperelliptic curve is of type III if andonly if it is supersingular.
3

Let us first give results concerning the resolution of some simple equationin F2n .
Proposition 2. Let a, b ∈ F2n ,k

1. The equation x2 = b has always a solution in F2n for k ≥ 1.
2. The equation x3 = b has always a solution in F2n if n is odd.
3. For a 6= 0, x2 + ax + b = 0 has a solution in F2n iff Tr(a−2 b) = 0.
4. If Tr(a−2 b) = 1, the equation x2 + ax + b = ta2 has a solution in F2nwhere t is an element of trace 1.
Remark:• Here the Trace function is defined by Tr(x) =

Pn−1

i=0 x

2i .

• In 4, if n is odd, t can be chosen equal to 1 and if n is even, t is a
power of π in polynomial basis representation (i.e. F 2n ' F2 [π]). In
all cases, multiplication by t is free.
Sketch of the proof:
1. x2 = b has always the solution x = b2

n−1

. This proves the first point.

2n −1

2. x3 = b has a solution in F2n iff b d = 1 where d = gcd(2n − 1, 3). If
n is odd, d = 1 so x3 = b has a solution.
3. This is an application of the additive form of Hilbert’s ”Satz 90”.
4. Please note that Tr(a−2 (b + ta2 )) = 0. 
We will now write equation for type I and type II in a minimal form, inthe sense that if the coefficients of the equation describe the base field, theexpected number of curves is obtained (say 2q 3 for type I and 2q 2 for typeII). In the following, t denotes an element of trace 1 (t = 1 if n is odd) as
explained in the previous proposition and ε an element of F 2 .
Theorem 1. A characteristic 2 hyperelliptic curve of type I can always betransformed into one of the following equations:type Ia : y 2 + (x2 + h1 x + th21 )y = x5 + tεx4 + f1 x + f0 ,type Ib : y 2 + x(x + h1 )y = x5 + tεx4 + f1 x + f0 .

4Remark:• It is possible to define only one type, but we chose to separate the casewhere the polynomial h is irreducible (type Ia) and the case where it
can be factorized (type Ib) because they are mathematically different.
For example, the order of the jacobian of a type Ia curve will always
be divisible by two, (since there exists a divisor of order 2) whereas it
is divisible by 4 (since there exists two divisors of order 2) in type Ib
case.
This kind of observation is of course very important in cryptography
and must be taken into account if one wants to construct good curves
for future standards.
• In both cases, we obtain in this way at most 2q 3 isomorphism classesof curves of type I, which was the expected number as proved in [2].
Sketch of the proof: specializing Lockhart’s formula (see [12] for details),
x = h22 x + λ
y = h52 y + h42 αx2 + h22 βx + γ
with• λ a root of h2 X 2 + h1 X + h0 , if Tr(h0 h2 h−21 ) = 0 and we obtain acurve of type Ib.
−2• λ a root of h2 X 2 + h1 X + h0 + th21 h−1
2 , if Tr(h0 h2 h1 ) = 1 and we
obtain a curve of type Ia.

• α a root of X 2 + h2 X + f4 + λ + εth22 with ε =Tr((f4 + λ)h22 ).
• β = (f3 + h1 α)h−12 .
• γ = (β 2 + h1 β + α(h2 λ2 + h1 λ + h0 ) + f3 λ + f2 )h−1
2 . 
Theorem 2. If n is odd, a hyperelliptic curve of type II defined over F 2n
can be transformed into the following equation :y 2 + xy = x5 + f3 x3 + εx2 + f0 .
Sketch of the proof: with Lockhart’s formula:x = µ2 x + λ
y = µ5 y + µ4 αx2 + µ2 βx + γ
with5• µ such as µ3 = h1 ,• λ = h0 h−1
1 ,√• α = λ + f4 ,• β is a root of X 2 + h1 X + f2 + εh21 with ε =Tr(f2 h−2
1 ),• γ = (h0 + h1 λ)β + λ2 f3 + λ4 + f1 h−1
1 . 
Theorem 2’. If n is even, a hyperelliptic curve of type II defined over F 2n
can be transformed into the following equation :y 2 + h1 xy = x5 + ε0 x3 + tεh21 x2 + f0 .
Remark:• To prove theorem 2’, one just have to choose µ so that µ 4 = f3 + h1 α.
• In theorem 2, we could have erased f 3 instead of h0 , choosing λ before
α and so would have had the following form:
y 2 + (x + h0 )y = x5 + εx2 + f0 .
This form can be useful if someone wants to implement a general formof a hyperelliptic curve as there is no f 3 term in type I or type II.
Nevertheless we didn’t choose this form as we lose performance bykeeping h0 in the explicit formulas.
• To avoid the Weil-descent attack, n must be chosen prime, whichmeans that only the theorem 2 is of interest for cryptographic purposes.
• If n is odd (resp. even), we obtain in this way at the most 2q 2 (resp.
4q 2 ) isomorphism classes of curves of type II, which was the expected
number as proved in [2].
If one wants to use pairings, we provide the following result for the lasttype of hyperelliptic curves.
Theorem 3. A characteristic 2 hyperelliptic curve of type III can be transformed into the following equation :y 2 + y = x5 + f3 x3 + f1 x + tε.
6Sketch of the proof: with Lockhart’s formula:x = µ2 xy = µ5 y + µ4 αx2 + µ2 βx + γ
with• µ such as µ5 = h0 ,√• α = f4 ,√• β = f2 + f4 ,• γ is a root of X 2 + h0 X + f0 + εh20 with ε =Tr(f0 h−20 ). 
Remark:This is not the optimal form as there are between 2q and 32q curves of type
III. Nevertheless, we believe that the correct choice is to take f 1 = 0, but
we can’t prove it in a general way.

4

Analysis of the security of different types of curves

In the previous section, we have classified the curves of genus 2 define overF2n . In order to use these curves in cryptography, it is very interesting
to check the security of each type of curve and to compare them. For
example, in proposition 1, we have already seen that all curves of type III
are supersingular, which means that they are weak for cryptographic use.
To compare the behavior of different curves, we computed the cardinalityof at least 10 000 curves of each type and each value of ε. We use theimplementation of Kedlaya’s algorithm to compute the cardinality of thejacobian of a curve of genus 2 [15]. We thank F. Vercauteren for allowing
us to use his implementation and for answering kindly all our questions.
We have chosen F289 as ground field so that all the curves are resistantto Weil descent attacks, see Rück in [14] for details.
We call good curves those suitable for cryptography, i.e. where there is adivisor of prime order greater than 2 160 and nice curves those with minimal
cofactor. In characteristic 2, as in the case of elliptic curves, the cardinality
cannot be prime, but we want the cofactor to be minimal (we denote it by
f ). For example a nice curve with cofactor 2 means that the cardinality of
the jacobian is two times a prime.

7

For each type of curve, we computed the rate of good curves and therate of nice curves. Moreover, proposition 1 states that curves of type III
are the only supersingular curves. However, this didn’t prove that curvesof type I or II are resistant to Frey-Rück attack [3] (using transfer via theTate-Lichtenbaum pairing) but it seems to be true in practice. In fact all
the curves we tested are resistant.
Type Ia, ε = 0
ε=1Type Ib, ε = 0
ε=1Type II, ε = 0
ε=1

good curves
10.4 %
10 %
8.9 %
9.6 %
9.6 %
10.9 %

nice curves
0.56 %
0.53 %
0.33 %
0.6 %0.6 %1.23 %

minimal f
2
2
4
4
4
2

curves tested
10 00011 44610 00011 44520 91716 724

We note with these computations, that there are some differences between different types of curves. We already stated that the order of thejacobian is always divisible by 2 for type Ia and by 4 for type Ib, therefore
one could hope to find more good curves of type Ia than Ib. This is in fact
the case. We can conclude that if one wants to use curves of type I, it isbetter to choose type Ia because there are more good curves and moreover
the minimal cofactor is 2 instead of 4. Nevertheless, we will see in the next
section that formulas for doubling and adding in the jacobian are slightly
faster in the case of type Ib.
Concerning curves of type II, even if it was not obvious at first sight, wehave the following properties on the cardinality of the jacobian:
Proposition 3. Let C be a type II hyperelliptic curve of genus 2 definedover F2n by the equationy 2 + xy = x5 + f3 x3 + εx2 + f0
The minimal cofactor is 4 if ε = 0 and 2 if ε = 1.
Sketch of the √proof:
The divisor 0, f0 + ∞ is the one divisor of order 2 and it exists a√ onlydivisor D such that 2D = 0, f0 + ∞ (i.e. a divisor of order 4) if andonly if ε = 0. This proves that the cardinality of the jacobian is congruent
to zero modulo 4 if ε = 0 and to 2 if ε = 1. In this last case, we find many of both good curves and nice curves.
From these results, it appears that, among hyperelliptic curves of genus 2 in8characteristic 2, the curves of type II with ε = 1 are the best from a security
point of view.

5

Application to jacobian scalar multiplication

We use this classification of hyperelliptic curve of genus 2, to rewrite andeven optimize formulas of Lange for mixed addition and doubling on theirjacobian. Lange uses three types of coordinates, affine [9], projective [10]and weighted projective [11]. In these papers Lange chose the coefficients ofh in F2 . In the last sections, we proved that we can’t always assume that.
That is why contrary to Lange we count multiplications by h 0 and h1 .
These formulas can be found in the appendix for curves of type II whichis the most efficient. In fact the mixed addition formulas are just thoseof Lange rewritten in characteristic 2. We did not rewrite formulas forclassical addition as they are also the same as Lange one’s. Nevertheless,for doubling, our formulas are slightly different and optimized for each typeof curve. Formulas for general cases and curves of type I can be found on
the web page of the author.
Besides, we also introduced a new system of coordinates called Modified
Projective Coordinates. Based on Projective representation, we add twocoordinates Z0 , Z1 . So the septuple [U1 , U0 , V1 , V0 , Z0 , Z1 , Z] stand for [x2 +U1 /Z + U0 /Z, x2 + V1 /Z + V0 /Z] and Z0 = h0 Z, Z1 = h1 Z. The formulas for
addition are the same as for projective one’s but we gain some multiplications
in doubling. The complexities we obtained are listed in the following table.

AffineAddition
Doubling
Projective
Mixed Addition
Doubling
Modified Projective
Mixed Addition
Doubling
Weighted Projective
Mixed Addition
Doubling

General casetype I

type II

25M + I
27M + I

24M + I
18M + I

45M
45M

25M + I
26M + I(Ia) (Ib)
45M 44M
44M 41M

45M
43M

45M
42M

44M
40M

42M
31M

42M
46M

42M
45M

41M
42M

40M
27M

9

42M
31M

We see we gain at least one multiplication in each system of coordinates for doubling, and of course more for each type of curve. The best
performance was produced using type II.
We also noticed the weighted projective coordinates are only interesting
for additions in the general case and type I. Thus, the use of projective andmodified projective coordinates is more interesting if we use scalar multiplication methods such as sliding window (since it uses much more doubling
than adding). Nevertheless, weighted projective coordinates are still competitive in type II or if one has to use doubling and adding at each step,for instance to resist against power analysis in restricted environments likesmart cards. It can also be used with algorithms like BGMW, where doublings are pre-computed.
For example in type I, what we gain in addition by using weighted projective
coordinates instead of modified projective, we lose in doubling.
Besides, one has to keep in mind that weighted projective coordinatesuses up more memory, which has to be taken into account by anyone whowants to implement in restricted environments.

6

Conclusion

We studied genus 2 isomorphism classes of curves in characteristic 2. They
are classified in three types. Type III curves are supersingular. We focused
our effort on type I and type II and found optimal forms for these curves,just as the short Weierstrass form. For these types of curves we studied the
security and the arithmetic on their jacobian.
In addition, we rewrote and optimized formulas of Lange in characteristic
2, and we introduced a new system of coordinate.
We noticed that both from the arithmetic and the security point of view,
curves of the form
y 2 + xy = x5 + f3 x3 + x2 + f0
are the best for cryptographic use.
Hence we recommend this type for future standards.

10Appendix: formulas for hyperelliptic curves overF2n of type II: y 2 + xy = x5 + f3 x3 + εx2 + f0
Affine case
Input
OutputStep
1

Affine Doubling with type II:
y 2 + xy = x5 + f3 x3 + εx2 + f0 with ε ∈ F2
D = [u1 , u0 , v1 , v0 ]2D = [u01 , u00 , v10 , v00 ]Operations
resultant r:
r = u02compute almost inverse:
1 = inv1 , u1 = inv0

3

compute k:
k1 = u21 + f3
k0 = u1 k1 + v12 + v1 + ε

4compute s = kinv mod u: Karatsuba is useless now
s 1 = k 0 + u 1 k1
s0 = k 1 u0
for s1 6= 0
precomputation
t0 = (u0 s1 )−1 , t1 = u0 t0 , t2 = s21 t0 , t3 = u0 t1 , s0 = s0 t1

5

Cost

2S, 1M

6

compute ll2 = u 1 + s 0 , l1 = u 1 s0 + u 0 , l0 = u 0 s07compute u0
u00 = s20 + t3
u01 = t23

8

compute v 0
t0 = u01 (l2 + u01 ) + u00 + l1
v10 = t2 t0 + v1 + 1
t0 = u00 (l2 + u01 ) + l0
v00 = t2 t0 + v0

1M

1I, 1S, 5M

2M

2S

4M

total

1I, 5S, 13M

11

Projective case

Input
OutputStep
1

Projective Doubling with type II:
y 2 + xy = x5 + f3 x3 + εx2 + f0 with ε ∈ F2
D = [U1 , U0 , V1 , V0 , Z]
2D = [U10 , U00 , V10 , V00 , Z 0 ]Operations
precomputation and resultant r:
t0 = Z 2 , t1 = U12
r = U0 Z

Cost
2S, 1M

2

compute almost inverse: uselessinv0 = U1 Z, inv1 = Z

3compute k:
k1 = f 3 t 0 + t 1 ,k0 = U1 k1 + Z(εt0 + V1 (Z + V1 ))4M

4compute s = kinv mod u: Karatsuba is useless now
t2 = k 0 U1
s1 = k 0 Z
s0 = k 1 r + t 2
for s1 6= 0
precomputation and compute l
t0 = t0 r, r = t0 s1 , t1 = s1 k0 , t3 = U0 k0
l2 = s1 t2 , l0 = s0 t3 , l1 = (t2 + t3 )(s0 + s1 ) + l2 + l0

3M

6compute U 0
U00 = s20 + r
U10 = t20

2S

7

precomputation:
l2 = l2 + s0 s1 + U10 , s1 = s21 , t2 = rt1
t0 = U00 l2 + l0 s1 , t1 = U10 l2 + s1 (U00 + l1 )8adjust:Z 0 = s1 r, U10 = U10 r, U00 = U00 r

3M

9compute V 0
V00 = t0 + t2 V0
V10 = t1 + t2 V1 + Z 0

2M

5

total

7M

1S, 6M

5S, 26M

Modified projective coordinates, are obviously useless in this case.

12

Weighted projective case

Input
OutputStep
1

Weighted projective Mixed Addition with type II:
y 2 + xy = x5 + f3 x3 + εx2 + f0 with ε ∈ F2
D1 = [u11 , u10 , v11 , v10 ],D2 = [U21 , U20 , V21 , V20 , Z20 , Z21 , z20 , z21 , z22 , z23 ]D1 + D2 = [U10 , U00 , V10 , V00 , Z00 , Z10 , z00 , z10 , z20 , z30 ]Operations
Cost
precomputation and resultant r:
1S, 7M
t1 = u11 z20 + U21 , t2 = u10 z20 + U20 , t0 = u11 t1 + t2
r = u10 t21 + t2 t0 , t3 = rz22 , Z10 = t3 Z20

2compute almost inverse: nothing to do
t1 = inv1 , t0 = inv0

3

compute almost s:
t4 = V10 z23 + V20 , t5 = V11 z23 + V21 ,s0 = (t2 t0 ) + u10 (t3 t1 )s1 = (t0 + t1 )(t4 + t5 ) + (t2 t0 ) + (t3 t1 )(1 + u11 )for s1 6= 0
precomputation:
Z00 = s1 Z20 , t0 = rs1 , t3 = t23 , t4 = s0 Z20 , s0 = s0 s1 , s1 = s21 ,22
z00 = Z00 , z10 = Z10 , z20 = Z00 Z10 , z30 = z00 z20

45compute ll2 = s1 u21 , l0 = s0 u20 , l1 = (s0 + s1 )(u21 + u20 ) + l0 + l2

6compute U 0
t5 = t 1 s1
U00 = t24 + u11 t5 + s1 t2 + z20 + t1 t3
U10 = t5 + z10

7compute V 0
t1 = l2 + Z00 t4 + U10 , t2 = t1 U00 , t3 = t1 U10
V10 = t3 + z00 (l1 + t0 V21 + U00 + z20 )V00 = t2 + z00 (l1 + t0 V20 )

total

7M

4S, 6M

3M

1S, 3M

8M

6S, 34M

13

InputOutputStep
1

Weighted projective Doubling with type II:
y 2 + xy = x5 + f3 x3 + εx2 + f0 with ε ∈ F2
D = [U1 , U0 , V1 , V0 , Z0 , Z1 , z0 , z1 , z2 , z3 ]2D = [U10 , U00 , V10 , V00 , Z00 , Z10 , z00 , z10 , z20 , z30 ]Operations
resultant r:
r = z0 U0 , t0 = rz2 , Z10 = t0 z2

2compute almost inverse: uselessz0 = inv1 , z0 U1 = inv0

3

compute k:√√t0 = ( f3 z0 + U1 )2 with precomputation of f3
k1 = t 0 z 1
k0 = U1 k1 + V1 (V1 + z3 ) + εz32

4compute s = kinv mod u: Karatsuba is useless now
s1 = k 0
s0 = s 1 U1 + k 1 r
for s1 6= 0
precomputation
Z00 = s1 , t0 = t1 Z00 , r = s20 , s0 = s0 Z00
22z00 = Z00 , z10 = Z10 , z20 = Z00 Z10 , z30 = z00 z20

5

6compute ll2 = U1 z00 , l0 = U0 s0 , l1 = (s0 + z00 )(U1 + U0 ) + l0 + l2
l2 = l 2 + s 0

7compute U 0
U00 = r + z20
U10 = z10

8

compute V 0
t1 = (l2 + U10 )U00
V00 = t1 + z00 (l0 + t0 V0 )t1 = (l2 + U10 )U10
V10 = t1 + z00 (l1 + t0 V1 + U00 ) + z30

total

Cost
3M

2S, 4M

2M

3S, 4M

3M

6M

5S, 22M

Remark: for the general case we choose the following form:
y 2 + (h2 x2 + h1 x + h0 )y = x5 + f4 x4 + f3 x3 + f2 x2 + f1 x + f0 with h2 , f4 , f3 , f2 ∈ F2
as for type I, there is no f2 or f3 and f4 ∈ F2 , and for type II f2 ∈ F2 , there is no f4 andfollowing the remark of theorem 2 we can also erase f3 .

The formulas are mostly the same of T. Lange [9], [10], [11], but can be found in the web
page of the author.

14

References[1] D.G. Cantor. Computing on the Jacobian of a hyperelliptic curve Math.
Comp., vol. 48, pp. 95-101, 1987.
[2] Y. Choie and D. Yun. Isomorphism classes of hyperelliptic curves ofgenus 2 over Fq , in ACISP 2002. LNCS, vol. 2384, pp. 190-202, 2002.
[3] G. Frey and H. Rück. A remark concerning m-divisibility and the dicrete
logarithm in the divisor class group of curves, Math. Comp., vol. 62,
pp. 865-874, 1994.
[4] S. Galbraith. Supersingular curves in cryptography, in Advances in
Cryptology Asiacrypt 2001, LNCS, vol. 2248, pp. 495-513, 2001.
[5] R. Harley. Fast arithmetic on genus 2 curves. available
http://cristal.inria.fr/ harley/hyper, 2000.

at[6] N. Koblitz. Elliptic Curves cryptosystem Math. Comp., vol. 48, pp.
203-209, 1987.
[7] N. Koblitz. Hyperelliptic cryptosystem J. Crypto, vol. 1, pp. 139-150,
1989.
[8] N. Koblitz. Algebraic aspects of cryptosystem Springer, 1998.
[9] T. Lange. Efficient Arithmetic on Genus 2 Hyperelliptic Curves over
Finite Fields via Explicit Formulae. Cryptology ePrint Archive, Report
2002/121, 2002. http://eprint.iacr.org/[10] T. Lange. Inversion-Free Arithmetic on Genus 2 Hyperelliptic Curves.
Cryptology ePrint Archive, Report 2002/147, 2002.
[11] T. Lange. Weighted Coordinates on Genus 2 Hyperelliptic Curves.
Cryptology ePrint Archive, Report 2002/153, 2002.
[12] P. Lockhart. On the discriminant of a hyperelliptic curve, Trans. Ame.
Math. Soc. 342, pp. 729-752, 1994.
[13] V. Miller. Uses of Elliptic Curves in cryptography, in Advances in Cryptology CRYPTO’85, LNCS, vol. 218, pp. 417-426, 1986.
[14] H.G. Rück. On the discrete logarithms in the divisor of class group of
curves, Math. Comp., vol. 68, pp. 805-806, 1999.

15

[15] F. Vercauteren. Computing Zeta Functions of Hyperelliptic Curves
over Finite Fields of Characteristic 2, in Advances in Cryptology
CRYPTO’02, LNCS, vol. 2248, pp. 369-384, 2002.
[16] F. Zhang, S. Liu and K. Kim. Compact representation of domain parameters of hyperelliptic curve cryptosystems, in ACISP 2002. LNCS,
vol. 2384, pp. 203-213, 2002.

16

Montgomery Scalar Multiplication
for Genus 2 Curves
Sylvain Duquesne
Université Montpellier II, Laboratoire I3S, UMR CNRS 5149
Place Eugène Bataillon CC 051, 34005 Montpellier Cedex, France
duquesne@math.univ-montp2.fr

Abstract. Using powerful tools on genus 2 curves like the Kummer
variety, we generalize the Montgomery method for scalar multiplication
to the jacobian of these curves. Previously this method was only known
for elliptic curves. We obtain an algorithm that is competitive comparedto the usual methods of scalar multiplication and that has additional
properties such as resistance to timings attacks. This algorithm has very
important applications in cryptography using hyperelliptic curves andmore particularly for people interested in cryptography on smart cards.

1

Introduction

In this paper we are dealing with the scalar multiplication on the jacobian of
curves defined over a field of large characteristic. One of the motivations is that
this operation is the main part in cryptography based on the jacobian of curves
which is becoming more and more popular. For elliptic curves, Montgomery [24]developed a method for certain curves (which are said to be in the Montgomeryform) which allows faster scalar multiplication than the usual methods of exponentiation for groups. This method has the extra advantage that it is resistant toside-channel attacks which is very interesting for people who want to use elliptic
curves in cryptography on smart cards. The aim of this paper is the generalization of this method to genus 2 curves. In the following, K will denote a fieldof characteristic k ≥ 7. For cryptographic application, the base field we have inmind is IFp where p is prime.

2

The Montgomery Method for Scalar Multiplication on
Elliptic Curves

Let E be an elliptic curve defined over K by the equationy 2 = x3 + a 4 x + a 6 .
Every elliptic curve defined over K is isomorphic to a curve given by such an
equation which is called the short Weierstrass form. The set E(K) of the points
P = (x, y) verifying this equation with x and y in K, forms (together with thepoint at infinity) a group which will be denoted additively. The problem we areinterested in is the following :Scalar multiplication
Given a point P ∈ E(K) and an integer n, compute nP as fast as possible.
Of course there are a lot of very old methods to do this, such as the classicaldouble and add algorithm and its variants (like the sliding window method). To
improve these algorithms one can choose other systems of coordinates (i.e. othermeans to represent points on the curve) [4]. For example, the best-known coordinates are projective ones. They are obtained by introducing a new coordinate,usually called Z, which is the lcm of the denominators of x and y. Of course, x
and y are replaced by X and Y such that x = X/Z and y = Y /Z. This choiceof coordinates allows to avoid inversions, which are very costly operations. In
the following, we will work with projective coordinates for reasons of efficiency.
Nevertheless, the same work can be done with other systems of coordinates. The
algorithm we will present here is slightly different from the usual exponentiation algorithms in the sense that the purpose is not to minimize the number ofoperations but rather the cost of each operation.
2.1

The Algorithm

The original idea of Montgomery [24] was to avoid the computation of the ycoordinate, so that one can hope that basic operations (doubling and adding)are easier to compute. Since for any x-coordinate, there are two corresponding
points on the curve (x, y) and (x, −y), this restriction is equivalent to identifying
a point on the curve and its opposite. When trying to add two points ±P and±Q, one cannot decide if the result obtained is ±(P + Q) as required or ±(P −Q). Nevertheless, some operations remain possible like doubling since it is notdifficult to decide if the result is ±2P or the point at infinity. Unfortunately,
doubling is not sufficient for a complete scalar multiplication: one really needs
to perform some additions. In fact additions are possible if the difference P − Q
is known. The principle of the computation of nP is to use pairs of consecutive
powers of P , so that the difference between the two components of the pair isalways known and equals to P . The algorithm for scalar multiplication is asfollows:
Algorithm 1. Montgomery scalar multiplication algorithm on elliptic curves
Input : P ∈ E (K) and n ∈ ZZ.
Output : x and z-coordinate of nP .
Step 1. Initialize Q = (Q1 , Q2 ) = (O, P ) where O is the point at infinity.
Step 2. If the bit of n is 0, Q = (2Q1 , Q1 + Q2 ).
Step 3. If the bit of n is 1, Q = (Q1 + Q2 , 2Q2 ).
Step 4. After doing that for each bit of n, return Q1 .
In fact, at each step, Q = (kP, (k + 1)P ) for some k and we compute either(2kP, (2k + 1)P ) or ((2k + 1)P, (2k + 2)P ) in the following step, so that wealways have Q2 − Q1 = P .
Let us note that contrary to double and add or sliding window methods, bothan addition and a doubling are done for each bit of the exponent. It is the priceto be paid to avoid the computation of the y-coordinate but we hope that thegain obtained thanks to this restriction will be sufficient to compensate for thelarge number of operations. That is the reason why the Montgomery form for
elliptic curves has been introduced. The interested reader will find more details
for this section in [24] or [26].
2.2

The Montgomery Form

An elliptic curve E is transformable into the Montgomery form if it is isomorphic
to a curve given by an equation of the type
Em : By 2 = x3 + Ax2 + x .
It is easy to prove ([26]) that E is transformable in the Montgomery form if andonly if– the polynomial x3 + a4 x + a6 has at least one root α in K,– the number 3α2 + a4 is a square in K.
Thus all elliptic curves are not transformable into the Montgomery form. Nevertheless, since the two coefficients can be chosen arbitrarily in K, the numberof curves in such a form is of the same order as for general elliptic curves (forexample O(p2 ) if K = IFp ).
Please note that the first condition means that there is at least one 2-torsion
point on the curve E, so that the cardinality of the curve is even.
2.3

Formulas for Doubling and Adding

Let us now describe the arithmetic of curves in the Montgomery form.
Proposition 1. Let K be a field of characteristic k 6= 2, 3 and let Em be an
elliptic curve defined over K in the Montgomery form. Let P = (Xp , Yp , Zp ) andQ = (Xq , Yq , Zq ) ∈ Em (K) be given in projective coordinates. Assume that thedifference P − Q = (x, y) is known in affine coordinates. Then we obtain the X
and Z-coordinates for P + Q and 2P by the following formulas :Xp+q = ((Xp − Zp )(Xq + Zq ) + (Xp + Zp )(Xq − Zq ))2 ,Zp+q = x ((Xp − Zp )(Xq + Zq ) − (Xp + Zp )(Xq − Zq ))4Xp Zp = (Xp + Zp )2 − (Xp − Zp )2 ,X2p = (Xp + Zp )2 (Xp − Zp )2 ,


A+2
2
Z2p = 4Xp Zp (Xp − Zp ) +4Xp Zp .
42,

In this way, both an addition and a doubling take 3 multiplications and 2 squares
each so that the cost of this algorithm is about 10|n|2 multiplications where |n|2
denotes the number of bits of n.
In the best case with usual scalar multiplication, one needs 4 multiplications
and 4 squaring just for doubling and more for adding. Thus, for curves in theMontgomery form, this method is interesting. In practice, the gain obtained isabout 10 percent (compared in [6] for 192 bits with a sliding window method ofsize 4 after a Koyama-Tsuruoka recoding [18] and using mixed jacobian modified
coordinates [4]).
2.4General Case

We are now interested in a Montgomery method for scalar multiplication for
elliptic curves which cannot be transformed into the Montgomery form. In fact
the method for scalar multiplication is the same, we just need to have formulasfor doubling and adding. These formulas can be found in [1], [10] or [13]. Let us
recall them.
Proposition 2. Let K be a field of characteristic k 6= 2, 3 and let E be an
elliptic curve defined over K as described in Sect. 2. Let P = (Xp , Yp , Zp ) andQ = (Xq , Yq , Zq ) ∈ E(K) be given in projective coordinates. Assume that thedifference P − Q = (x, y) is known in affine coordinates. Then we obtain the X
and Z-coordinates for P + Q and 2P by the following formulas :Xp+q = −4a6 Zp Zq (Xp Zq + Xq Zp ) + (Xp Xq − a4 Zp Zq )2 ,Zp+q = x(Xp Zq − Xq Zp ) ,2
X2p = Xp2 − a4 Zp2 − 8a6 Xp Zp3 ,
Z2p = 4Zp Xp3 + a4 Xp Zp2 + a6 Zp3 .
Addition can be evaluated in 10 multiplications and doubling in 9. Thus, in thisway, the scalar multiplication can be performed in about 19|n|2 multiplicationsin the base field. This method can even be optimized in most cases to 17|n|2 multiplications [7]. Of course, in this case, the algorithm is not interesting any morecompared with the usual methods. However, it can be useful in some situations
as we will see in the next section.
2.5

Use and Interest in Cryptography

In this section, we are dealing with elliptic curve cryptography. Elliptic curve
cryptosystems were simultaneously introduced by Koblitz [14] and Miller [23].
They are becoming more and more popular because the key length can bechosen smaller than with RSA cryptosystems for the same level of security.
This small key size is especially attractive for small cryptographic devices likesmart cards. In all schemes (such as encryption/decryption or signature generation/verification) the dominant operation is the scalar multiplication of somepoint on the elliptic curve. Hence, the efficiency of this scalar multiplicationis central in elliptic curve cryptography, and more generally in cryptography
based on the discrete logarithm problem. In the case where the curve is in theMontgomery form, we saw in the previous sections that the Montgomery scalarmultiplication method allows to compute the multiple of any given point on the
curve faster than with the usual scalar multiplication algorithms. Unfortunately,
we also saw that some elliptic curves cannot be transformed into the Montgomery form. This is for example the case for most of the standards. The reason
is really simple: any curve which can be transformed in the Montgomery form
has a 2-torsion point so that its cardinality is divisible by 2 and this is not ideal
for cryptographic use since we prefer to use curves with prime order.
In the general case, the Montgomery method can also be applied but is much
more time-consuming. Indeed, we need to perform both an addition and a doubling for each bit of the exponent. This is not the case for example in the classicaldouble and add algorithm where we only have to perform an addition every two
bits on average (and even fewer with the sliding window method). Nevertheless,this particularity allows to resist to side-channel attacks on smart cards which
is not the case with other algorithms.
This kind of attacks uses observations like timings [16], power consumption [17]or electromagnetic radiation [28]. They are based on the fact that addition anddoubling are two different operations. In this situation, it is easy to decide, foreach bit of the exponent, if the algorithm (double and add for example) is performing either a doubling (if the bit is 0) or a doubling and an addition (if the
bit is 1). Hence, it is easy to recover the whole exponent (which was the secretkey). Of course, various countermeasures have been proposed to secure the elliptic curve scalar multiplication against side-channel attacks [5]. For example,
if one wants to protect a double and add algorithm, one can perform extra, useless, additions when the bit of the exponent is 0. In this way, for each bit of
the exponent we perform both an addition and a doubling so that bits of the
exponent are indistinguishable, but this is of course time consuming.
With the Montgomery scalar multiplication method, we always have to perform
both an addition and a doubling for each bit of the exponent, so that this method
is resistant against side-channel attacks. Therefore it is always interesting evenwith 19 multiplications at each step for general curves.
Of course elliptic curves in the Montgomery form are very attractive for peopleinterested in elliptic curve cryptosystems on smart cards since, on the one hand,the scalar multiplication method is the most efficient one known to date and, on
the other hand, it is resistant to side-channel attacks. That is one of the reasons
why we want to generalize this method to hyperelliptic curves of genus 2.
Finally, for some cryptosystems, the x-coordinate of nP is sufficient but others,
like the elliptic curve signature scheme ECDSA, require the y-coordinates. To
recover it, we use the following result from [27] in the case of a curve in theMontgomery form.

Proposition 3. Suppose that R = P + Q with P = (x1 , y1 ), Q = (x0 , y 0 ) andR = (x+ , y + ). Then, if y1 6= 0, one hasy+ =(x0 x1 + 1)(x0 + x1 + 2A) − 2A − (x0 − x1 )2 x+.
2By1

For general curves, it is also possible to recover the y-coordinate ([1]).
In order to generalize this method to genus 2 curves, let us first recall somelowbrow background on these curves.

3

Background on Genus 2 Curves

First, let us note that every genus 2 curve is hyperelliptic, so that, in the following we will not state that the curves we are interested in are hyperelliptic.
Moreover, we will concentrate on imaginary hyperelliptic curves. Since the characteristic of the field K has been chosen different from 2 and 5, the hyperelliptic
curves we are interested in are given by an equation of the form
C : y 2 = f (x) = x5 + f3 x3 + f2 x2 + f1 x + f0 with f0 , f1 , f2 , f3 ∈ K .

(1)

Contrary to elliptic curves, the set of points on genus 2 curves does not forma group. Thus, one can define the jacobian of C, denoted J (C) which is thequotient of the group of divisors of degree 0 by the principal divisors. In the caseof elliptic curves, this jacobian is isomorphic to the curve itself. More details on
the definition of the jacobian can be found in [15]. Our purpose in this paper is
to give an algorithm for scalar multiplication in this jacobian. There are mainly
two means to represent elements in the jacobian. The first one is a consequenceof the Riemann-Roch theorem and says that a divisor class can be represented
by a couple of points (P1 = (x1 , y1 ) and P2 = (x2 , y2 )) on the curve which areconjugated over some quadratic extension of the base field K. The second one
makes explicit the correspondence of ideal classes and divisor classes and wasintroduced by Mumford [25]:
Theorem 1. Let the function field be given via the irreducible polynomial y 2 =f (x) where f ∈ K[x] and deg(f )=5. Each non trivial ideal class over K can be
represented via a unique ideal generated by u(x) and y −v(x), u, v ∈ K[x] , where
u is monic, deg(v) <deg(u) ≤ 2 and u|(v 2 − f ).
The correspondence between these representations is that u(x) = (x−x1 )(x−x2 )and v(xi ) = yi with appropriate multiplicities. This Mumford representation wasused by Cantor to develop his algorithm to compute the group law on jacobiansof curves [2]. Several researchers such as Harley [12], or more recently Lange [19],[20], [21] made explicit the steps of Cantor’s Algorithm and list the operations
one really needs to perform. They obtained explicit formulas for the group law
on the jacobian.
The basic objects are now defined and we can give an analog for genus 2 curvesof the Montgomery form for elliptic curves.

4

A Montgomery-like Form for Genus 2 Curves

4.1

Definition

In the following, we will say that a curve C is transformable into Montgomery-likeform if it is isomorphic to a curve given by an equation of the typeBy 2 = x5 + f4 x4 + f3 x3 + f2 x2 + x .

(2)

It is easy to prove that a curve C as defined in Sect. 3 is transformable into
Montgomery-like form if and only if– the polynomial f (x) has at least one root α in K.
– the number f 0 (α) is a fourth power in K.
Thus, as in the case of elliptic curves, not all the curves are transformable into
the Montgomery-like form. Nevertheless, since the four coefficients can be chosen
arbitrarily in K, the number of such curves is about the same as for general genus
2 curves (O(p4 ) if K = IFp ).
Please note that the first condition means that there is at least one 2-torsion
element in the jacobian variety of the curve C, so that the cardinality of thejacobian is even.
4.2

The Kummer Surface

With elliptic curves, the main idea of the Montgomery method was to avoid thecomputation of the y-coordinate. At first sight an analog for genus 2 curves would
be to avoid the computation of the polynomial v in the Mumford representationand keep only u. But this is not satisfying since it has no mathematical sense.
In fact, with elliptic curves, working only with the x-coordinate means that we
identify a point and its opposite. The analog for genus 2 curves is called theKummer surface, where a divisor and its opposite are identified. The Kummer
surface is a quartic surface in IP3 . We give here the definition of the Kummer
surface and its properties without demonstrations for curves in Montgomery-like
form. They were obtained using the same method as that in the book of Cassels
and Flynn on genus 2 curves ([3] or [8]). The Kummer surface is the image ofthe mapκ : J(K) −→ IP3 (K)
F0 (x1 , x2 ) − 2By1 y2{(x1 , y1 ), (x2 , y2 )} 7−→ 1, x1 + x2 , x1 x2 ,,(x1 − x2 )2with
F0 (x1 , x2 ) = (x1 + x2 ) + 2f2 x1 x2 + f3 (x1 + x2 )x1 x2 + 2f4 x21 x22 + (x1 + x2 )x21 x22 .
In the following, for any divisor A ∈ J (C)), we will denote
κ(A) = (k1 (A), k2 (A), k3 (A), k4 (A)) .

More precisely, the Kummer surface is the projective locus given by an equation
K of degree four in the first three variables and of degree two in the last one.
The exact equation can be found online [9]. In passing from the jacobian to theKummer surface, we have lost the group structure (as was already the case withelliptic curves) but traces of it remain. For example, it is possible to double on
the Kummer surface.
Nevertheless, for general divisors A and B, we cannot determine the values of
the ki (A + B) from the values of the ki (A) and ki (B) since the latter do not
distinguish between ±A and ±B, and so not between A ± B. However the valuesof the ki (A + B)kj (A − B) + ki (A − B)kj (A + B) are well determined. We have
Theorem 2. There are explicit polynomials ϕij biquadratic in the ki (A), ki (B)such that projectivelyki (A + B)kj (A − B) + ki (A − B)kj (A + B) = ϕij (A, B) .

(3)

Using these biquadratic forms, we can easily compute the ki (A+B) if the ki (A−B) are known. We can also compute the ki (2A) by puting A = B.
4.3

Formulas for Adding

Proposition 4. Let K be a field of characteristic k 6= 2, 3 and let C be a curveof genus 2 defined over K in the Montgomery form as defined in Sect. 4. Let K
denote the Kummer surface of C. Let A and B be two divisors on the jacobian ofC, κ(A) = (k1 (A), k2 (A), k3 (A), k4 (A)) and κ(B) = (k1 (B), k2 (B), k3 (B), k4 (B))
their images in the Kummer surface. Assume that the difference A − B is known
and that the last coordinate of its image in the Kummer surface is one (remember
we are in IP3 (K)). Then we obtain the Kummer coordinates for A + B by thefollowing formulas :k1 (A + B) = ϕ11 (A, B) ,k2 (A + B) = 2 (ϕ12 (A, B) − k1 (A + B)k2 (A − B)) ,k3 (A + B) = k1 (A − B)ϕ33 (A, B) ,k4 (A + B) = 2(ϕ14 (A, B) − k1 (A + B)k4 (A − B)) ,where the ϕij are the biquadratic forms described in Sect. 4.2.
The expressions of the ϕij (A+B) are available by anonymous ftp [9] but require alarge number of operations in the base field to be computed. The main difficulty
is to find expressions which require the least possible multiplications in K. We
now give more precisely these expressions for the ϕij we are interested in. For
clarity we will denote κ(A) = (k1 , k2 , k3 , k4 ) and κ(B) = (l1 , l2 , l3 , l4 ).
ϕ11 (A, B) = ((k4 l1 − k1 l4 ) + (k2 l3 − k3 l2 ))2 ,ϕ12 (A, B) = ((k2 l3 + k3 l2 ) + (k1 l4 + k4 l1 ))(f3 (k1 l3 + k3 l1 ) + (k2 l4 + k4 l2 )) +2(k1 l3 + k3 l1 )(f2 (k1 l3 + k3 l1 ) + (k1 l2 + k2 l1 ) − (k3 l4 + k4 l3 )) +

2f4 (k1 l4 + k4 l1 )(k2 l3 + k3 l2 ) ,ϕ33 (A, B) = ((k3 l4 − k4 l3 ) + (k1 l2 − k2 l1 ))2 ,ϕ14 (A, B) = (k1 l1 − k3 l3 )(f3 ((k1 l4 + k4 l1 ) − (k2 l3 + k3 l2 )) +2((k1 l2 + k2 l1 ) − (k3 l4 + k4 l3 )) +f2 (k4 l4 + k2 l2 ) + 2f4 (k1 l1 − k3 l3 )) +(k2 l2 − k4 l4 )((k2 l3 + k3 l2 ) − (k1 l4 + k4 l1 ) − f2 (k1 l1 + k3 l3 )) .

4.4

Formulas for Doubling

Proposition 5. Let K be a field of characteristic k 6= 2, 3 and let C be a curveof genus 2 defined over K in the Montgomery form as defined in Sect. 4. Let K
denote the Kummer surface of C. Let also A be a divisor on the jacobian of Cand κ(A) = (k1 , k2 , k3 , k4 ) its image in the Kummer surface. Then we obtain theKummer coordinates for 2A (κ(2A) = δ1 , δ2 , δ3 , δ4 ) by the following formulas :δ1 = 2ϕ14 (A, A) ,
δ2 = 2ϕ24 (A, A) + 2f3 K(A) ,δ3 = 2ϕ34 (A, A) ,
δ4 = ϕ44 (A, A) + 2K(A) ,where the ϕij are the biquadratic forms described in Sect. 4.2 and K is theequation of the Kummer surface also described in Sect. 4.2 and such that K(A) =0.
This is just a consequence of Theorem 2. Let us note that in δ2 and δ4 we
added a multiple of the equation of the Kummer surface in order to simplify theexpressions as much as possible. We give now more precisely these expressions
for the δi .
δ1 = 8(k12 − k32 )(f4 (k12 − k32 ) + 2(k1 k2 − k3 k4 )) +8(k1 k4 − k2 k3 )(k42 − k22 + f2 (k1 k4 − k2 k3 ) + f3 (k12 − k32 )) ,
δ2 = 8(k12 + k32 − f3 k1 k3 − 3k2 k4 )(k22 + k42 − f3 (k12 + k32 ) + 4k1 k3 ) +16(k2 k4 + f3 k1 kl3 )(f4 (k1 k2 + k3 k4 ) + 2(k22 + k42 ) + f2 (k1 k4 + k2 k3 )) +32k1 k3 (4k2 k4 + f2 (k1 k2 + k3 k4 ) + (f22 + f42 )k1 k3 + 8f4 (k1 k4 + k2 k3 )) ,
δ3 = 8(k12 − k32 )(f2 (k12 − k32 ) + 2(k1 k4 − k2 k3 ) + f3 (k1 k2 − k3 k4 )) +8(k3 k4 − k1 k2 )(k42 − k22 + f4 (k3 k4 − k1 k2 )) ,
δ4 = (k22 + k42 )((k22 + k42 ) − 2f3 (k12 + k32 ) − 8k1 k3 ) +(k12 + k32 )(f3 k1 k3 + f4 (k1 k4 + k2 k3 ) + 2k2 k4 + f2 (k1 k2 + k3 k4 ) +(f32 − 4f2 f4 )(k12 + k32 )) − 8f2 f4 (k1 k3 )2 .

5The Montgomery Scalar Multiplication on Genus 2Curves in Montgomery-like Form

5.1

Algorithm

We give here an analog for genus 2 curves of the Montgomery method for scalarmultiplication on elliptic curves described in Sect. 2.1. In the case of elliptic
curves, Montgomery’s method [24] avoids the computation of the y-coordinate.
We saw that an equivalent method in genus 2 was to work on the Kummer
surface. Of course we have the same restriction in the case of genus 2 curves,
namely that it is not possible to add two divisors except if their difference is
known. If D is some divisor, recalling that our goal is the computation of nD
for some integer n, the principle is, as it was already the case for elliptic curves,to use pairs of consecutive powers of D, so that the difference between the twocomponents of the pair is always known and equal to D. The algorithm for scalarmultiplication is as follows:
Algorithm 2. Montgomery scalar multiplication algorithm for genus 2 curves
Input : D ∈ J (K) and n ∈ ZZ.
Output : κ(nD), the image in the Kummer surface of nD.
Step 1. Initialize (A, B) = ((0, 0, 0, 1), κ(D)) where (0, 0, 0, 1) is the image
in the Kummer surface of the neutral element on J (C).
Step 2. If the bit of n is 0, (A, B) = (2A, A + B).
Step 3. If the bit of n is 1, (A, B) = (A + B, 2B).
Step 4. After doing that for each bit of n, return A.
Note that, at each step, we always have B − A = κ(D) so that the addition of
A and B is possible.
5.2

Number of Operations

At each step of the algorithm, we perform both an addition and a doubling,hence we just have to count the number of operations required for each of them.
In the following, M will denote a multiplication in K and S a squaring.
Table 1. Addition of A and B in K(C) if A − B is known
expressions
operations
precomputations{ki lj }i,j=1..416M
ϕ11 (A, B)
S
ϕ12 (A, B)
6M
ϕ33 (A, B)
S
ϕ14 (A, B)
6M
κ(A + B)
3M
total
31M + 2S

Remark 1. The 31 multiplications include 7 multiplications by coefficients of thecurve.
Table 2. Doubling of A in K(C)expressions
operations
precomputations{ki kj }i,j=1..4
6M + 4S
δ1 (A, B)
5M
δ2 (A, B)
11M
δ3 (A, B)
5M
δ4 (A, B)
5M
total
31M + 5S
Remark 2. The 31 multiplications include 16 multiplications by coefficients ofthe curve. Moreover the multiplications f3 k1 k3 , f3 (k12 + k32 ), f4 (k1 k4 + k2 k3 ) andf2 (k1 k2 + k3 k4 ) are not counted in δ4 since they were already computed in δ2 .
Finally, we of course assumed that f2 f4 , f32 −4f2 f4 and f22 +f42 were precomputed.
Hence, on a curve in the Montgomery form as in (2), the scalar multiplication using the Montgomery method requires 69|n|2 base field multiplications (assumingthat a squaring is a multiplication), where |n|2 is the number of bits of n.
5.3

Comparison with Usual Algorithms for Scalar Multiplication

To date, the best algorithms for scalar multiplication on genus 2 curves definedover a field of odd characteristic are obtained by using mixed weighted projective
coordinates [21]. In this case, Lange needs 41 multiplications both for a mixed
addition and for a doubling. Hence our formulas requires fewer base field operations. But, in the Montgomery algorithm, we must perform both an addition
and a doubling for each bit of the exponent whereas one can use efficient algorithms (like the sliding window method) with Lange’s formulas. Nevertheless,this algorithm is still interesting for many reasons.
– As was the case for elliptic curves and as explained in Sect. 2.5, the Montgomery algorithm is resistant to side-channel attacks, contrary to other algorithms for scalar multiplications. For this reason it will be of interest to
people who need to implement hyperelliptic curves protocols on smart cards
or systems sensitive to side-channel attacks. For example, if one wants tomake safe algorithms using mixed weighted projective coordinates, one needs
to perform an extra addition when the bit of the exponent is one. In thiscase, for each bit of the exponent, 82 base field operations are required andwith only 69, our algorithm allows a gain of 16 percent, which is significant.
– This algorithm is very easy to implement, there are no precomputations(as in the sliding window method) and an element on the Kummer surface
requires only 4 base field elements whereas weighted projective coordinates
require 8 of them so that it is also interesting in terms of memory usage.

This last remark will be an advantage for constrained environments likesmart cards.
– It is very dependent of the coefficients of the curve. Indeed there are 23
multiplications by these coefficients but only 2 in Lange’s formulas. Hence a
good choice of the coefficients of the curve certainly allows better timings.
This is the subject of the following section.
5.4

Some Special Cases

In order to decrease the number of base field operations for our algorithm, certain
choices of coefficients of the curve are better to use. For example there are 6
multiplications by f3 in the formulas given in Sects. 4.3 and 4.4 so that, if one
chooses f3 = 0 or 1, the total amount of multiplications necessary for each bit of
the exponent is 63 instead of 69. In the following table, we summarize the gain
obtained in each operation. Let us note that there is no gain for the calculationof ϕ11 , ϕ33 and precomputations.
Table 3. Gain obtained if . . .

ϕ12
ϕ14
δ1
δ2
δ3
δ4
total

f2 = 0 f2 small f3 = 0 or small f4 = 0 f4 small
1
1
1
2
1
2
2
1
1
1
1
1
1
1
1
2
2
2
2
2
1
1
1
1
1
2
1
0
2
1
9
8
6
9
7

Remark 3. If two of these conditions on the coefficients are satisfied the gain
obtained is just the sum of the gains.
Of course this kind of restriction implies that fewer curves are taken into account.
For example, if K = IFp and f3 = 0, one can only choose three coefficients in IF p
(namely f2 , f4 and B) so that the number of such curves is O(p3 ). Thus we lose
in generality. However, in cryptography, one only needs to find a curve such thatthe order of its jacobian is divisible by a huge prime number. For this, one needs
enough choices of curves in order to be able to find a curve with this property
and O(p3 ) choices are of course widely sufficient.
Let us now examine more precisely a particular case and compare our algorithm
to usual ones. Let C be a genus 2 curve defined over K by an equation of theform
By 2 = x5 + f3 x3 + εx2 + x with ε = 0 or ± 1 and B and f3 ∈ K .

(4)

There are O(p2 ) curves in this form (which is sufficient to find one of thesewith nice properties for use in cryptography). Here, our algorithm of scalarmultiplication requires 52 multiplications for each bit of the exponent whereas
with mixed weighted projective coordinates,

– a sliding window method with window size equal to 4 requires in average 48
multiplications,– a classical double and add requires 61 multiplications on average,– a side-channel attack resistant double and add requires 81 multiplications.
Thus, our algorithm is 15 percent faster than a double and add, not so far fromthe sliding window method (around 7 percent) and much more efficient if one
wants the operation to be resistant to side-channel attacks. Indeed, in this case,
we obtain a gain of 36 percent. Of course one can even be faster than the sliding
window method by choosing a small coefficient f3 but the number of such curves
becomes small.
Remark 4. Another means to accelerate this algorithm would be to choose f 2 ,f3 and f4 one word long. For example, on a 32 bits processor, if we are working
on some finite field of cryptographic size for genus 2 curves, a multiplicationof a coefficient of the curve and an element of the base field is about threetimes faster than the usual multiplication in the base field. Hence, as there are
23 multiplications by coefficients of the curve, our algorithm will require theequivalent of 53 multiplications, which is not so bad.
5.5

ExamplesIn this section, the base field is the prime field IF280 +13 (so that cryptosystems
based on genus 2 curves defined over this field have the same security level thanthose based on elliptic curves defined over some 160 bits prime field). Let C1 , C2
and C3 be the genus 2 curves respectively defined by the equations
44294637780422381596577 y 2 = x5 + 27193747657561668783534 x4+ 29755922098575219239037 x3+ 76047862040141126737826 x2 + x ,10377931047456722522292 y 2 = x5 + 77304198867988157865677 x3 + x2 + x ,69418837068442493864220 y 2 = x5 + x3 + x .
We compared our algorithm on these curves with a sliding window of size 4, aclassical double and add and a double and always add (used to resist against
side-channel attacks). For these three algorithms, we of course always used theweighted projective coordinates as in [21] which are the more efficient ones.
In the following table, we provide the timings obtained using GMP 4.1.2 on a
Pentium IV 3.06 GHz. We carried out 1000 scalar multiplications in each casewith various divisors and 160 bits exponents.
Table 4. Timings
C1
C2
C3
Sliding window
13.4 ms 13.3 ms 12.9 ms
Double and add
16 ms
16 ms 15.5 ms
Double and always add 21.5 ms 21.5 ms 21 ms
Montgomery method 18.3 ms 13.6 ms 11.9 ms

6Conclusion and Prospects

Thanks to the theory of the Kummer surface of a hyperelliptic curve of genus
2, we have generalized to genus 2 curves the method of Montgomery for scalarmultiplication on elliptic curves. As Montgomery does for elliptic curves, we restrict to curves transformable into Montgomery-like form. However, there are no
theoretical obstructions to generalize this method to all genus 2 curves. Indeed
Propositions 4.3 and 4.4 remain valid but the total amount of multiplications tocompute the biquadratic forms is really huge so that this method is not competitive with the classical ones. This is not so surprising since it was already thecase for elliptic curves.
In fact, for people interested in cryptography, this restriction is not very important since the number of choices of curves remains largely the same. The only
significant restriction is that the order of the jacobian of such curves is even andthen cannot be prime. But working with a jacobian whose order is twice a prime
is not less efficient than working with a prime order.
For elliptic curves, the standards are not transformable into the Montgomery
form because of this restriction and it’s really a shame because the Montgomery
method for scalar multiplication is the most interesting one (the fastest, easy to
implement, resistant to side-channel attacks). Up to now, there are no standards
for genus 2 curves. If such standards exist one day, it would be useful to takethe method that we developed into account.
Moreover, we have seen that, with some restrictions, we obtain very interesting
timings for the scalar multiplication on the jacobian of genus 2 curves. It would
be nice to verify (even if there is no reason for this) that these restrictions are
not awkward for finding jacobians suitable for cryptography (i.e. with a large
prime dividing the order). Unfortunately, algorithms for finding the order of thejacobian over IFp are still under development ([11], [22]).
Finally, it would be very interesting to study the case of the characteristic 2,
since it is in that case that this method is the most efficient for elliptic curves.
For this, all the necessary mathematical objects, such as the Kummer surface,remain to be defined.

References
1. Brier, E., Joye, M.: Weierstrass Elliptic Curves and Side-Channel Attacks, Public Key Cryptography, Lecture Notes in Computer Science, 2274 (2002)
2. Cantor, D. G.: Computing on the Jacobian of a hyperelliptic curve. Math.
Comp., 48 (1987) 95–101
3. Cassel, J. W. S., Flynn, E. V.: Prolegomena to a middlebrow arithmetic of curvesof genus 2, London Mathematical Society Lecture Note Series, 230 (1996)
4. Cohen, H., Miyaji, A., Ono, T.: Efficient elliptic curve exponentiation using
mixed coordinates, Asiacrypt’98, Lecture Notes in Computer Science, 1514
(1998) 51–65
5. Coron, J. S.: Resistance against differential power analysis for elliptic curve
cryptosystems, CHES’99, Lecture Notes in Computer Science, 1717 (1999) 292–
302

6. Doche, C., Duquesne, S.: Manual for the elliptic curve library, Arehcc report(2003)
7. Duquesne, S.: Improvement of the Montgomery method for general elliptic
curves defined over IFp , preprint (2003)
8. Flynn, E. V.: The group law on the Jacobian of a curve of genus 2, J. reine
angew. Math., 439 (1993), 45–69
9. Flynn, E. V.: ftp site, ftp://ftp.liv.ac.uk/pub/genus2/kummer
10. Fischer, W., Giraud, C., Knudsen, E. W., Seifert, J. P.: Parallel scalar multiplication on general elliptic curves over IFp hedged against Non-Differential
Side-Channel Attacks, preprint
11. Gaudry, P., Schost, E.: Construction of secure random curves of genus 2 overprime fields, Eurocrypt’04, Lecture Notes in Computer Science (2004)
12. Harley, R.: Fast arithmetic on genus 2 curves, available at
http://cristal.inria.fr/∼harley/hyper (2000)
13. Izu, T., Takagi, T.: A fast Elliptic Curve Multiplication Resistant against Side
Channel Attacks, preprint
14. Koblitz, N.: Elliptic curve cryptosystems, Math. Comp., 48 (1987) 203–209
15. Koblitz, N.: Algebraic aspects of cryptography, Algorithms and Computation in
Mathematics, 3 (1998)
16. Kocher, P. C.: Timing attacks on implementations of DH, RSA, DSS and othersystems, CRYPTO’96, Lecture Notes in Computer Science, 1109 (1996), 104–
113
17. Kocher, P. C., Jaffe, J., Jun, B.: Differential power analysis, CRYPTO’99, Lecture Notes in Computer Science, 1666 (1999) 388-397
18. Koyama, K., Tsuruoka, Y.: Speeding up elliptic cryptosystems by using a signed
binary window method, Crypto’92, Lecture Notes in Computer Science, 740(1993) 345–357
19. Lange, T.: Efficient Arithmetic on Genus 2 Hyperelliptic Curves over Finite
Fields via Explicit Formulae, Cryptology ePrint Archive, 121 (2002)
20. Lange, T.: Inversion-Free Arithmetic on Genus 2 Hyperelliptic Curves, Cryptology ePrint Archive, 147 (2002)
21. Lange, T.: Weighted Coordinates on Genus 2 Hyperelliptic Curves, Cryptology
ePrint Archive, 153 (2002)
22. Matsuo, K. Chao, J. Tsujii, S.: An improved baby step giant step algorithm forpoint counting of hyperelliptic curves over finite fields, ANTS-V, Lecture Notes
in Computer Science, 2369 (2002) 461–474
23. Miller, V. S.: Use of elliptic curves in cryptography, Crypto’85, Lecture Notes
in Computer Science, 218 (1986) 417–426
24. Montgomery, P. L.: Speeding the Pollard and elliptic curve methods of factorization, Math. Comp., 48 (1987) 243–164
25. Mumford, D.: Tata lectures on Theta II, Birkhuser (1984)
26. Okeya, K., Kurumatani, H., Sakurai, K.: Elliptic curves with the Montgomeryform and their cryptographic applications, Public Key Cryptography, Lecture
Notes in Computer Science, 1751 (2000) 238–257
27. Okeya, O., Sakurai, K.: Efficient Elliptic Curve Cryptosystems from a Scalar
Multiplication Algorithm with Recovery of the y-Coordinate on a MontgomeryForm Elliptic Curve, Cryptographic Hardware and Embedded Systems, Lecture
Notes in Computer Science, 2162 (2001) 126–141
28. Quisquater, J. J., Samyde, D.: ElectroMagnetic Analysis (EMA): Measures andCountermeasures for Smart Cards, e-smart 2001, Lecture Notes in Computer
Science, 2140, (2001), 200–210

Journal de Théorie des Nombresde Bordeaux 19 (2007), 81–100

Elliptic curves associated with simplest
quartic fields
par Sylvain DUQUESNE

Résumé. Nous étudions la famille infinie des courbes elliptiques
associées aux “simplest quartic fields”. Si le rang de telles courbes
vaut 1, nous déterminons la structure complète du groupe deMordell-Weil et nous trouvons tous les points entiers sur le modèleoriginal de la courbe. Notons toutefois que nous ne sommes pas
capables de les trouver sur le modèle de Weierstrass quand leparamètre est pair. Nous obtenons également des résultats similaires pour une sous-famille infinie de courbes de rang 2. A notre
connaissance, c’est la première fois que l’on a autant d’information
sur la structure du groupe de Mordell-Weil et sur les points entiers
pour une famille infinie de courbes de rang 2. Le principal outils
que nous avons utilisé pour cette étude est la hauteur canonique.
Abstract. We are studying the infinite family of elliptic curves
associated with simplest cubic fields. If the rank of such curves
is 1, we determine the whole structure of the Mordell-Weil groupand find all integral points on the original model of the curve.
Note however, that we are not able to find them on the Weierstrass model if the parameter is even. We have also obtained
similar results for an infinite subfamily of curves of rank 2. To
our knowledge, this is the first time that so much information has
been obtained both on the structure of the Mordell-Weil groupand on integral points for an infinite family of curves of rank 2.
The canonical height is the main tool we used for that study.

1. Introduction
In [4], we studied elliptic curves associated with simplest cubic fields.
In the case of curves of rank 1, we determined both the structure of theMordell-Weil group and all integral points. Several questions remainedunanswered at the end of this study. Is it possible to do the same workwith other families of rank 1 curves? Is it possible to generalize to familiesof curves of higher ranks? Xavier Roblot and Franck Leprevost suggested
Manuscrit reçu le 28 décembre 2005.

82

Sylvain Duquesne

that I should work on elliptic curves associated with simplest quartic fields.
This family has several interesting properties.
• There is an explicit point on every curve of the family, which is anecessary condition for the kind of study we are interested in.
• Contrary to simplest cubic fields, the curves are not torsion-free.
Hence we can check if the method used in [4] is also valid when
there are torsion points.
• It is possible to extract a subfamily of curves of rank at least 2 withtwo explicit points.
In this paper, we will first see that the method used for simplest cubic
fields to determine the structure of the Mordell-Weil group can also be used
for simplest quartic fields. It can also be generalized to higher ranks andprobably to other families. However, we will see that this is not the casefor integral points, even though a technical trick enabled us to conclude in
our case.
Finally recent papers ([2], [3]), not known when this paper was written,
would be helpful in simplifying some of the calculations. They provide better bounds than those used in this paper and then will probably eliminate
some cases which are done by hand in the following.
2. Simplest quartic fields
The term “simplest” has been used to describe certain number fields
defined by a one-parameter family of polynomials. The regulator of these
simplest fields is small in an asymptotic sense, so their class number tends
to be large. This is why they have generated so much interest. In degree 4, simplest quartic fields are defined by adjoining to Q a root of thepolynomials
X 4 − tX 3 − 6X 2 + tX + 1,
where 16+t2 is not divisible by an odd square (which ensures the irreducibility of the polynomial). These fields were studied, among other things, byGras, who proved that this family is infinite [5]. Later, Lazarus studied
their class number [8, 9]. More recently, they were studied by Louboutin[10], Kim [7] and Olajos [11].
3. Elliptic curves associated with simplest quartic fields
In the following, we are interested in the infinite family of elliptic curves
Qt given by the equation
Y 2 = X 4 − tX 3 − 6X 2 + tX + 1,
where 16 + t2 is not divisible by an odd square. The discriminant is ∆t =26 (16 + t2 )3 .

Elliptic curves associated with simplest quartic fields

83

Let us first put the curve into the Weierstrass form
Ct : y 2 = x3 − (16 + t2 )x
by sending the point [0, 1] to infinity using the transformation ϕ
2Y − 2X 2 + tX + 2,
X2 
Y + X 2 + 1 2Y − 2X 2 + tX + 2.
y=X3
Such curves are special cases of curves defined by equations of the form
y 2 = x3 + Dx which often appear in the literature. For instance they
are studied in the book of Silverman [14] where several general results areproved, one of which is given below
x=

Proposition 3.1. Let D be a fourth-power-free integer. Let ED be theelliptic curve defined over Q by the equationy 2 = x3 + Dx.
If D 6= 4 and −D is not a perfect square, thenED (Q)tors ' Z/2Z.
This result can be applied to our family.
Corollary 3.2. Let t be an integer defining a simplest quartic field. The
only torsion points on Ct (Q) are the point at infinity and the 2-torsion point[0, 0]. The torsion points on Qt (Q) can be obtained using the inverse mapof ϕ.
As usual with elliptic curves, we are interested in the following two Diophantine problems.
(1) Determination of the structure of the Mordell-Weil group Qt (Q) (orequivalently Ct (Q)). This means that we want to compute the torsion
subgroup (already done thanks to Proposition 3.1), the rank and aset of generators for the free part.
(2) Determination of all integral points on both Qt and Ct , since a famous
theorem of Siegel states that there are only finitely many such points.
Concerning the second problem, it is important to note that the integral
points are dependent on the model. In the case of elliptic curves associated with simplest quartic fields, both models (Qt and Ct ) given above areinteresting. Nevertheless they are linked thanks to the following property.
Proposition 3.3. Let t be an integer defining a simplest quartic field and[X, Y ] be an integral point on the quartic model. Then ϕ([X, Y ]) + [0, 0] is
an integral point on the cubic model.

84

Sylvain Duquesne

Proof. It is easy to formally compute ϕ([X, Y ]) + [0, 0] using the group law
on Ct (Q) :ϕ([X, Y ]) + [0, 0] = [2Y + 2X 2 − tX − 2, −(Y + X 2 + 1)(2Y + 2X 2 − tX − 2)]which proves the proposition.

This means that it is sufficient to find all integral points on Ct in order
to find those of Qt . On the other hand, the structure of the Mordell-Weilgroup does not depend on the model, so we will work on Ct in the following.
4. Experimental approach
Using the magma algebra system, we performed a large number of computations both of the structure of the Mordell-Weil group and of the integral
points. Here we do not present the results we obtained, but we give themost important observations we deduced from these computations.
(1) The rank is never 0.
(2) The rank parity only depends on the congruence class of t modulo
16.
(3) The point [−4, 2t] can always be in a system of generators of Ct (Q).
(4) In theof rank
 3 1, theionly integral points on Ct are [0, 0], [−4, ±2t]
h casett2
and 4 + 4, ± 8 + 2t if t is even.
(5) In the case of rank 1, [0, ±1] are the only integral points on Qt .
(6) In higher ranks, there are very few integral points on Qt apart froma point with a x-coordinate equal to −3.
The first observation is trivial to prove. Indeed, [−4, 2t] is always a point
on Ct (Q). Moreover, we already proved that [0, 0] and the point at infinity
are the only torsion points. So [−4, 2t] has an infinite order and Ct (Q) has
a rank of at least one.
5. The sign of the functional equation
We will now prove the second observation assuming the conjecture of
Birch and Swinnerton-Dyer.
Theorem 5.1. Let t be an integer defining a simplest quartic field. Assuming the Birch and Swinnerton-Dyer conjecture, the Mordell-Weil rankof Ct (Q) is even if and only ift ≡ 0, ±1, ±7 mod 16.
Proof. We use the sign of the functional equation which is 1 if and only if
the rank is even assuming the conjecture of Birch and Swinnerton-Dyer.
This sign can be computed as a product of local signs :Y
ε = ε∞
εp .
p primeElliptic curves associated with simplest quartic fields

85

The value of the sign at the Archimedean place is always ε∞ = −1. Concerning finite places, the local sign depends on the type of curve reduction.
It can be computed using the tables given by Rizzo in [12]. The places 2
and 3 must be treated separately. The first remark is that 16 + t2 is neverdivisible by 3, so 3 is always a prime of good reduction and ε3 = 1. Now let
p be a prime number greater than or equal to 5. Hereafter in this paper,vp (x) will denote the p-adic valuation of x.
If p - ∆t , then εp = 1.
If p|∆t , we have that vp (∆t ) = 3 since 16 +t2 is not divisible by an odd
square. In this case, Rizzo’s tables give εp = −2
p , so(p−1
if p ≡ 1 mod 4(−1) 4εp =p+1
if p ≡ −1 mod 4 .
−(−1) 4

We want now to compute the product of all these local signs.
tLet δt = 16 + t2 and δt0 = 2v2δ(δ. Since t defines a simplest quartict)field, there are k different prime numbers p1 , . . . , pk which are congruent
to 1 modulo 4 and r different prime numbers pk+1 , . . . , pk+r which arecongruent to -1 modulo 4, such thatδt0 = p1 . . . pk pk+1 . . . pk+r .
Moreover, it is easy to prove that δt0 equals 1 modulo 4, so r must be even.
Let qi = pi4−1 if i ≤ k and qi = pi4+1 if i ≥ k + 1. We have
δt0 = (1 + 4q1 ) . . . (1 + 4qk )(−1 + 4qk+1 ) . . . (−1 + 4qk+r )≡ 1 + 4q1 + · · · + 4qk+r mod 8.
On the other hand,Yεp = (−1)q1 . . . (−1)qk (−1)r (−1)qk+1 . . . (−1)qk+r
p6=2= (−1)q1 +···+qk+r .
SoY

δt0 −1εp = (−1) 4 .

p6=2

It is easy to deduce thatYεp = 1 ⇐⇒ t odd or t ≡ 0 mod 16 or t ≡ ±4 mod 32.
p6=2

We will now compute the local sign ε2 . For this, we again use the tablesof Rizzo. For each value of t modulo 32, the 2-adic valuations of both ∆t
and the usual invariant c4 = 3.24 (16 + t2 ) give the value of ε2 . We have
ε2 = 1 ⇐⇒ t ≡ ±3 mod 8 or t ≡ ±4 mod 32.

Sylvain Duquesne

86

We just have to multiply ε∞ ,theorem.

Q

p6=2 εp and ε2 to achieve the proof of theRemark. We chose to use the tables of Rizzo instead of those of Halberstadt [6] because the minimality of the model is not required. In fact, themodel is minimal if t is not divisible by 4. When t is divisible by 4, theminimal model is y 2 = x3 − (1 + t2 )x.
We now want to prove the observations 3, 4 and 5. For this, we use amethod similar to that we used for elliptic curves associated with simplest
cubic fields in [4]. The central part of this method is a good estimate of
the canonical height. Let us briefly review this canonical height.
6. Canonical height on elliptic curves
Even though it is possible to work on number fields, we will restrict ourstudy to Q since this is the case we are interested in. Let E be an elliptic
curve defined over Q and P = [x, y] be a point on E(Q). If x = n/d with
gcd(n, d) = 1 the naı̈ve height of point P is defined ash(P ) = max(log |n|, log |d|).
This height function is the main tool for the proof of the Mordell-Weiltheorem which states that E(Q) is finitely generated. The naı̈ve height has
some nice properties but we need a more regular function. This function isthe canonical height and is defined as follows
h(2n P )h(kP )=lim.
ĥ(P ) = lim
n→∞
k→∞
k2
4n
Remark. The canonical height is sometimes defined as half of this value,
so one must be very careful which definition is used for results from different
origins.
The canonical height has a lot of interesting properties. We will justmention here those that we will use later in this work.
(1) We haveĥ(P ) = 0 ⇐⇒ P ∈ E(Q)tors .
(2) Function ĥ is a quadratic form on E(Q).
(3) Letĥ(P + Q) − ĥ(P ) − ĥ(Q),2denote the scalar product associated with ĥ. If P1 , . . . , Pn are n points
in the free part of E(Q), let us define the elliptic regulator of points
Pi by
R(P1 , . . . , Pn ) = det(hPi , Pj i)1≤i,j≤n .
hP, Qi =Elliptic curves associated with simplest quartic fields

87

Then, points P1 , . . . , Pn are linearly independent if and only if theirelliptic regulator is not equal to zero.
The naı̈ve height is much easier to compute than the canonical height,
so it is interesting to have explicit bounds for the difference between bothof them. Such bounds are given by Silverman in [16].
Theorem 6.1 (Silverman). Let E be an elliptic curve defined over Q. Let∆ be the discriminant of E and j its j-invariant. Then for any P in E(Q)
we have−h(j) h(∆)h(j) h(∆)−− 1.946 ≤ ĥ(P ) − h(P ) ≤++ 2.14.
4
6
6
6

However, better bounds on the canonical heights are required for our
purpose. For instance, if the naı̈ve height of P is small, the lower boundgiven by Silverman does not give any information since ĥ(P ) is always nonnegative. We will now briefly recall two ways to compute the canonicalheight. Both will be used hereafter in this work to improve Silverman’sbounds for the curves we are interested in.
7. Computation of the canonical height
The two ways of computation we will present here consist of expressing
the canonical height as a sum of local functions. The finite part of theheight equals 0 for all primes of good reduction. For primes of bad reduction, it can be computed using a technical but simple algorithm given in [1].
The main part of the computation is focused on the Archimedean contribution which we will denote ĥ∞ . This can be done by two ways. The first
one uses q-expansions and consists of evaluation of the following formulay(P )21
1∆
1log− log θ,ĥ∞ (P ) =
+ log
16
q
4
λ
2
where, if ω1 and ω2 denote the periods of the curve, and z(P ) is the elliptic
logarithm of the point P
λ=

2π
,
ω1
ω

2ıπ ω1

q=e
θ=

∞
X

2

,

(−1)n qn(n+1)
2sin((2n + 1)λ<e(z(P ))).

n=0

If the curve is explicitly given, this method is very efficient since theseries θ converges rapidly. However, we are dealing with a family of elliptic
curves and, in this context, computation of the terms of the series θ seems

Sylvain Duquesne

88

difficult. We can still give an upper bound for this series. It is indeed trivial
that
1
|θ| ≤
.
1 − |q|This will provide a lower bound for the canonical height which is more
useful than that given by Theorem 6.1. Such a lower bound combined with
Silverman’s upper bound was successfully used for simplest cubic fields in[4]. Concerning simplest quartic fields, these bounds can also be used when
the rank of Ct (Q) is 1. However, they are not sharp enough when the rank is
2. The second way of computing the Archimedean contribution will provide
these better bounds. This other way is slower but more appropriate for
specific cases we are studying. It was developed by Tate and was improvedby Silverman in [15]. It consists of computing the simple series∞ĥ∞ (P ) = log |x(P )| +1 X cn44nn=0where ci are easily computable and bounded. The main advantage is thatthe computation of the ci of a specific point can be done even for our family
whereas computation of the terms of the series θ seems difficult for a family.
Moreover, Silverman gives bounds for the error term if only N terms areused in the series. Let H = max(4, 2|a|, 4|b|, a2 ), thenN −1ĥ∞ (P ) = log |x(P )| +1 X cn+ R(N ),
4
4n
n=0

with
(1)

1
log
3.4N



∆2
260 H 8
≤ R(N ) ≤


1
11
log
2
H
.
3.4N

Thus, Tate’s method will provide better bounds for the canonical heightof specific points, such as [−4, 2t]. However, we first need bounds which
are valid for any point in Ct (Q), so we use Silverman’s theorem and qexpansions.
8. Approximation of the canonical height of any point on Ct (Q)As explained above, an upper bound of the canonical height is given by
Silverman’s theorem:ĥ(P ) − h(P ) ≤h(j) h(∆)++ 2.14.
6
6

Applying this bound to our family gives the following proposition.

Elliptic curves associated with simplest quartic fields

89

Proposition 8.1. Let t be an integer defining a simplest quartic field. Let
P be a point in Ct (Q), then1ĥ(P ) ≤ h(P ) + log(16 + t2 ) + 4.08.
2
We will now use the decomposition of the canonical height as a sum of
local functions to obtain a lower bound.
The first step involves
 thecomputation of the finite part of the canonicalheight of a point P = da2 , db3 . For this, we follow the algorithm given in [1].
If p is an odd prime
 number, it is easy to prove that the local contribution
at p is 2 log pvp (d) − 12 log(p) if p divides a, b and 16 + t2 and 0 otherwise.
The contribution at 2 is more difficult to find since there are several cases
depending on the 2-adic valuation of t and a. We summarize the result in
the following table.
condition

contribution at 2d even2 log 2v2 (d)t odd and a odd− 12 log(2)t even and a odd or a even and t odd

0v2 (a) = 1 and v2 (t) = 1− 32 log(2)v2 (a) = 1 and v2 (t) ≥ 2 or v2 (t) = 1 and v2 (a) ≥ 2− log(2)v2 (a) = 2 and v2 (t) = 2 or v2 (a) ≥ 3 and v2 (t) ≥ 3−2 log(2)v2 (a) = 2 and v2 (t) ≥ 3 or v2 (t) = 2 and v2 (a) ≥ 3− 52 log(2)Finally, the local contribution at non-Archimedean places to the canonicalheight of any point P is given by


Q
1
pi
(2)
ĥf (P ) = 2 log(d) − log+ ĥ2 (P ),pi 6=2,pi |a,b,16+t2
2
where ĥ2 (P ) is equal to zero if d is even and to the contribution at 2, givenin the previous table, if d is odd. The second step is the computation of theArchimedean contribution. As explained above, we will use q-expansions
since we want a lower bound that is valid for any point on the curve. We
first need approximations for the periods ω1 and ω2 .
Lemma 8.2. Let t be an integer defining a simplest quartic field and Ct be
the associated elliptic curve. Let ω1 and ω2 be the periods of Ct such that
ω1 and ıω2 are positive, thenππ
ω1 = ıω2 and √1 ≤ ω1 ≤
1
2(16 + t2 ) 4(16 + t2 ) 4

Sylvain Duquesne

90

Proof. Let δ =√16 + t2 . The Ct equation is
y 2 = x3 − 16 + t2 x = x(x − δ)(x + δ).

Thus, with the convention we chose for the periods, ω1 and ω2 are given by
the integrals
Z 0
1
p
ω1 =
,
x (x − δ) (x + δ)
−δ
Z δ
1
p
.
ω2 =
x (x − δ) (x + δ)0
A trivial change of variable shows that ω1 = ıω2 . Concerning ω1 , within
the integration range, we have −2δ ≤ x − δ ≤ −δ, so that
Z 0
Z 0
1
1
1
1
p
p
≤
ω
≤
.
√
1
1
1
2(16 + t2 ) 4 −δ x(x + δ)
(16 + t2 ) 4 −δ x(x + δ)
The result follows thanks to an easy change of variables.
So, thanks to this lemma, we can give a lower bound for the Archimedean
contribution to the canonical height of any point P = da2 , db3 in the freepart of Ct (Q).
 
1
b
1
2
.
ĥ∞ ([P ]) ≥ 0.38 + log(16 + t ) + log
82
d3
Thus, combining this lower bound with the non-Archimedean contributions,
we have



1
1
1
5
ĥ(P ) ≥ 0.38− log(2)+ log(16+t2 )+ log(d)+ log 

2
8
2
2

b
Q
pi


.


pi 6=2,pi |a,b,16+t2

The last two terms are always positive, so this provides an explicit lower
bound. However, these terms can be used to reduce the constant 0.38 −52
2 log(2). Let g be the gcd of a, b and 16 + t divided by its higher powerof 2. Let A = ag and B = gb . With these notations, the sum of the last
two terms of the lower bound equals 12 log(Bd), so a lower bound for Bd
will improve the lower bound for ĥ(P ). Based on the fact that da2 , db3 is apoint on the curve, we prove that g must satisfy the equation
A3 g 2 − B 2 g − A(16 + t2 )d4 = 0.
Since g is an integer, the discriminant of this degree 2 polynomial must be
the square of an integer, say C, such that
B 4 + 64A4 d4 = C − 2A2 td2 C + 2A2 td2 .

Elliptic curves associated with simplest quartic fields

91

It is easy to deduce that, if such a C exists, thenB 4 + 64A4 d4 − 1.
4A2 d2
Let us assume that the local contribution at 2 is negative, i. e. d is odd andt and a are together even or odd. In this case, we have 4|B and A ≤ B 2 . If
B = 4 and d = 1, the above condition becomes t ≤ 4160. For all t ≤ 4160
and A ≤ 16, we can check if the discriminant of the degree 2 polynomial isa square. This never occurs if t > 256. Thus, if t > 256, it is not possible
to have B = 4 and d = 1, so either B ≥ 4 and d ≥ 3 or B ≥ 8 and d = 1.
In any case, Bd ≥ 8. We can now give a lower bound for the canonicalheight.
t≤Proposition 8.3. Let t be an integer greater than 256 defining a simplest
quartic field. Let P be any point in the free part of Ct (Q). We have1ĥ(P ) ≥ 0.38 + log(16 + t2 )if t is odd,
81
in any case.
ĥ(P ) ≥ 0.38 + log(16 + t2 ) − log(2)8Proof. If t is odd and ĥ2 (P ) = 0 then Bd ≥ 1 is sufficient to give therequired lower bound for ĥ(P ). If t is odd and ĥ2 (P ) < 0, this contributionis − 21 log(2) and we proved that Bd ≥ 8. This provides a better lower
bound than required. Finally, if t is even and ĥ2 (P ) < 0, this contribution
is greater than or equal to − 25 log(2) and we proved that Bd ≥ 8. Again,
this is sufficient to conclude.

9. Estimates of the canonical height of a specific point: [−4, 2t]
The previous bounds are valid for any non-torsion point on Ct (Q), sothey provide bounds for the points G1 = [−4, 2t]. However, we need a more
precise approximation for ĥ(G1 ). So we will use Tate’s series to computeĥ(G1 ) in terms of t. For our purpose, it is sufficient to compute the first
four terms of the series:
1
c1
c2
c3 
c0 +
+
+
+ R(4).
ĥ∞ (G1 ) = log(4) +
4
4
16 64
We are using the algorithm given in [15] to formally compute c0 , c1 , c2 andc3 . In fact, the only significant contribution comes from c0 . Thus we only
give approximations for the others.

c0 = 2 log 16 + t2 − 8 log(2) and 0 ≤ c1 , c2 , c3 ≤ log(4).
Let us now estimate the error term R(4). In the case of elliptic curves
defined by simplest quartic fields, the constant H involved in the approxi2mation of the rest (1) equals 16 + t2 soSylvain Duquesne

92

1
log
3.44

212 16 + t2

6 !


 
1
11
2 2
16
+
t
,
log
2
3.44
260 (16 + t2 )16
48 log(2) + 10 log 16 + t2
11 log(2) + 2 log 16 + t2−
≤ R(4) ≤.
768
768
Concerning non-Archimedean contributions, the only non-zero one comesfrom 2. The previous table can be used to estimate the contribution at 2ĥ2 (G1 ) = 0
if t is odd,
5
− 2 log(2) ≤ ĥ2 (G1 ) ≤ − log(2) otherwise.
≤ R(4) ≤Finally, combining these estimates we obtain an estimate for the canonical height of the point [−4, 2t]1871ĥ([−4, 2t]) ≥ 384
log 16 + t2 − 16log(2)
if t is odd,187
log 16 + t2 − 41
in any case,ĥ([−4, 2t]) ≥ 384
16 log(2)193
log 16 + t2 + 137
in any case.
ĥ([−4, 2t]) ≤ 384
768 log(2)We now have sufficiently good estimates to prove some of our observations when the rank is 1.
10. Solving Diophantine problems in rank 1
In this section, we will prove most of our observations concerning thestructure of Ct (Q) and the integral points both on Ct and Qt .
Theorem 10.1. Let t be an integer defining a simplest quartic field, andCt be the associated elliptic curve. Then the point [−4, 2t] can always be ina system of generators. In particular, if the rank of Ct is one,Ct (Q) = h[0, 0], [−4, 2t]i.
Proof. Assume that G1 = [−4, 2t] cannot be in a system of generators. Thismeans that there exist P ∈ Ct (Q), ε ∈ {0, 1} and n ∈ Z such that
G1 = nP + ε[0, 0].
So the canonical height of G1 equals the canonical height of nP andn2 =ĥ(G1 )ĥ(P ).

The estimates obtained above can now be used to bound n2 . If t ≥ 257
193
2 + 137 log(2)2384 log 16 + t
768
n ≤ 1
.
2 ) + 0.38 − log(2)
log
(16
+
t
8

Elliptic curves associated with simplest quartic fields

93

Since this function decreases with t, it is easy to prove thatn2 ≤ 5.31 if t ≥ 257.
The remaining cases, namely n = 2 or t ≤ 256, can be computed byhand.

Let us now concentrate on integral points. When the rank is one, thestructure of the Mordell-Weil group is known, so we are using it to findintegral points on Ct . If P is an integral point then there exist ε ∈ {0, 1}
and n ∈ Z such thatP = nG1 + ε[0, 0].
The strategy is the same as above, namely we are using the bounds on
canonical heights to deduce an upper bound on n. But, in this case, weneed an upper bound for the canonical height of any integral point. Using
Silverman’s bounds, this means that we need an upper bound for the naı̈veheight of any integral point. This is of course not possible unless we have an
explicit version of Siegel’s theorem. In the case of simplest cubic fields, we
proved by an other means that there are no integral points in the connectedcomponent of the point at inifinity of the curve. This cannot be done forsimplest quartic fields for any t. However, it can be done if t is odd. For
this, we will use the following lemma.
Lemma 10.2. Let E be an elliptic curve defined over Q and P be a pointon E(Q) which is not integral. Then none of the multiples of P are integral.
Proof. We just give the idea of the proof. Let p be a prime number dividing
the denominator of the coordinates of P . The reduction of P modulo p is
the point at infinity on the reduced curve. So all multiples of P are also
the point at infinity on the reduced curve. Thus their denominators arealso divisible by p.

Theorem 10.3. Let t be an odd number defining a simplest quartic field.
Assume that the elliptic curve Ct has rank 1, then the only integral points
on Ct are [0, 0] and [−4, ±2t].
Proof. Let P be an integral point on Ct . Then, there exist ε ∈ {0, 1} andn ∈ Z such thatP = nG1 + ε[0, 0].
Three cases can occur• n is even and ε = 0. In this case, P is a multiple of 2[−4, 2t] which
is never an integral point if t 6= 4, 8. Lemma 10.2 then ensures that
P is not an integral point.
• n is odd and ε = 1. Again P is a multiple of [−4, 2t] + [0, 0] which is
not an integral point and we use Lemma 10.2.

Sylvain Duquesne

94• n is odd and ε = 0 or n is even and ε = 1. In this case, P is notin the connected component of the point at infinity of Ct (R) so its
x-coordinate is boundedp− 16 + t2 ≤ x(P ) ≤ 0.
The method using canonical heights can then be applied. Thanks to
Proposition 8.1, the canonical height of such a point is bounded asfollows
1ĥ(P ) ≤ h(P ) + log(16 + t2 ) + 4.08 ≤ log(16 + t2 ) + 4.08.
2
Using the lower bound for the canonical height of [−4, 2t] obtained
in section 9, we deduce thatlog(16 + t2 ) + 4.08.
1
2384 log (16 + t ) − 16 log(2)n2 ≤ 187

Again, the function is decreasing andn2 ≤ 3.9 if t ≥ 10.
So only n = 0, 1 or −1 can provide integral points.

Remark. The second case cannot be treated if t is even because [−4, 2t] +[0, 0] is an integral point.
We deduce the following corollary from this theorem and Proposition 3.3
Corollary 10.4. Let t be an odd number defining a simplest quartic fieldsuch that Qt has rank 1, then the only integral points on Qt are [0, ±1].
In fact, we can prove this also when t is even thanks to the following
lemma.
Lemma 10.5. Let t be an odd number defining a simplest quartic field. Let
P = [X, Y ] be an integral point on Qt such that Y ≤ 0. Then ϕ(P ) + [0, 0]
is an integral point on Ct whose x-coordinate is bounded by t2 .
Proof. √The x-coordinate of ϕ(P ) + [0, 0] equals 2Y + 2X 2 − tX − 2 andY = − X 4 − tX 3 − 6X 2 + tX + 1. Thus, it is sufficient to prove that
2

2X 2 − tX − 2 − t2 − 4 X 4 − tX 3 − 6X 2 + tX + 1 ≤ 0.
This polynomial is a degree 2 polynomial
and it is easy to prove that it is
negative outside of − n3 − 1, n + 1 . Within this range, 2X 2 − tX − 2 − t2
is always negative which achieves the proof.

We can now prove the following theorem
Theorem 10.6. Let t be an integer defining a simplest quartic field suchthat Qt has rank 1, then the only integral points on Qt are [0, ±1].

Elliptic curves associated with simplest quartic fields

95

Proof. Thanks to Lemma 10.5, it is sufficient to find all integral points on
Ct whose naı̈ve height is less than or equal to t2 . Let P be such an integral
point. Proposition 8.1 provides an upper bound for its canonical height.
13ĥ(P ) ≤ h(P ) + log(16 + t2 ) + 4.08 ≤ log(16 + t2 ) + 4.08.
2
2
If P = n[−4, 2t] + ε[0, 0], then3log(16 + t2 ) + 4.08
n2 ≤ 187 2.
412384 log (16 + t ) − 16 log(2)As in the previous cases, the function is decreasing and we deduce thatn2 ≤ 8.92 if t ≥ 33.
The remaining cases, namely n = 2 or t ≤ 32, can easily be done byhand.

We are now interested in the last observation in section 4 which will
provide a subfamily with a rank of at least 2.
11. A subfamily with a rank at least 2
During our numerical experiments, we noticed that −3 is sometimes the
x-coordinate of an integral point on Qt . It is in fact not difficult to provethat[−3, . . . ] ∈ Qt (Z) ⇐⇒ t = 6k 2 + 2k − 1 with k ∈ Z.
In this case, there are new integral points on Ct (Q). One of them is ofcourse given by ϕ([−3, 2 + 12k]) + [0, 0]. These new points are the following
and their opposites.

G2 = −2k 2 + 2k − 1, 4(k + 1) 2k 2 − 2k + 1 ,
G2 + [0, 0] = 18k 2 + 30k + 17, 4(k + 1) 18k 2 + 30k + 17 ,
G1 + G2 = 9 2k 2 − 2k + 1 , 12(3k − 2) 2k 2 − 2k + 1 .
Since t is odd and G2 is an integral point, Theorem 10.3 ensures that therank is at least 2. The aim of the rest of this paper is to generalize theresults obtained in rank 1 to the case of rank 2 using this subfamily. Let
us first consider the structure of the Mordell-Weil group.
12. Case of rank 2: generators
The infinite descent generalizes to higher ranks the method we used toprove that G1 can always be in a system of generators. Let us first recall
the principle of this method.
Suppose that P1 . . . Pr generate a subgroup of the free part of the MordellWeil group of full rank and denote by n the index of this subgroup. If n = 1,
this provides a basis. Let R be the regulator of the curve (i. e. the elliptic

96

Sylvain Duquesne

regulator of a basis B of the free part of the Mordell-Weil group), then wehave
n2 R = R(P1 . . . Pr ).
Since the regulator is roughly of the same order of magnitude as the productof the canonical heights of the basis B, it can be bounded using Proposition
8.3. So that n can be bounded. In [13], Siksek specifies this idea by thefollowing theorem (written here only in the case of rank 2 and base field
Q).
Theorem 12.1 (Siksek). Let E be an elliptic curve defined over Q of rank
2. Suppose that E(Q) contains no point of infinite order with a canonicalheight less than some positive real number λ. Suppose that P1 and P2
generate a subgroup of the free part of the Mordell-Weil group of full rank
and denote by n the index of this subgroup. Then we have
1

2 R(G1 , G2 ) 2
n≤ √
.
λ
3
As explained above, the infinite descent is based on canonical heights.
Thus, we need to approximate the canonical heights of the points involvedin our problem.
Proposition 12.2. Let k be an integer such that t = 6k 2 + 2k − 1 defines
a simplest quartic field and such that |k| ≥ 27, then we have
0.96 log(t) ≤ĥ(G1 )
≤ 1.02 log(t)0.47 log(t) ≤ĥ(G2 )
≤ 0.56 log(t)0.47 log(t) ≤ ĥ(G1 + G2 ) ≤ 0.54 log(t).
Proof. The first estimate is a direct consequence of the estimates given in
section 9. Estimates for the canonical height of G2 and G1 +G2 are obtainedin the same way, namely using the first four terms of the Tate series for
the Archimedean contribution. Non-Archimedean contributions are given
by formula (2), knowing that t is odd and that the gcd of a, b and 16 + t2
is exactly 2k 2 − 2k + 1 both for G2 and G1 + G2 .

We can now prove the following theorem
Theorem 12.3. Let k be an integer such that t = 6k 2 + 2k − 1 defines
a simplest quartic field. Then the points G1 = [−4, 2t] and G2 =−2k 2 + 2k − 1, 4(k + 1) 2k 2 − 2k + 1 can always be in a system of generators. In particular, if the rank of Ct is exactly 2, we haveCt (Q) = hG1 , G2 , [0, 0]i.
Proof. In order to apply Siksek’s theorem, we need an estimate ofR(G1 , G2 ) = ĥ(G1 )ĥ(G2 ) − hG1 , G2 i2Elliptic curves associated with simplest quartic fields

97




with hG1 , G2 i = 21 ĥ(G1 + G2 ) − ĥ(G1 ) − h(G2 ) . Proposition 12.2 provides these estimates−0.56 log(t) ≤ hG1 , G2 i ≤ −0.44 log(t)R(G1 , G2 ) ≤ 0.39 (log(t))2Siksek’s theorem then ensures that if G1 and G2 generate a subgroup ofindex n of the free part of the Mordell-Weil group, then1

2 R(G1 , G2 ) 2
n≤ √
,
λ
3
with ĥ(P ) ≥ λ for any point P in the free part of the Mordell-Weil group.
The estimates obtained in Propositions 12.2 and 8.3 imply that, for any ksuch that |k| ≥ 27,√√
2
0.39 log(t)2 0.39 log(t)n≤ √≤√≤ 2.9.
3 0.38 + 18 log(16 + t2 )3 14 log(t)The case n = 2 must be treated by hand. For this, it is sufficient toprove that there are no point Q ∈ Ct (Q) and integers ε1 and ε2 in {0, 1}
such thatε1 G1 + ε2 G2 = 2Q.
This is not difficult because G1 , G2 and G1 + G2 are integral points, so Q
must be an integral point because of Lemma 10.2. Looking at the numerator
and denominator of the double of any integral point modulo 8 shows thatsuch a double is not an integral point. Finally, the cases with k ≤ 26 canbe treated by hand (i. e. using magma).
The structure of the Mordell-Weil rank is now completely determined
and can be used to find integral points.
13. Case of rank 2: integral points
The situation is the same as in rank one, namely we do not have any
bound for the naı̈ve height for integral points on Ct (Q), so it is not possible,
with our method, to determine all integral points on Ct . However, we canuse the same trick to determine all integral points on Qt .
Theorem 13.1. Let k be an integer such that t = 6k 2 + 2k − 1 defines a
simplest quartic field. Suppose that Qt has rank 2, then the only integral
points on Qt are [0, ±1] and [−3, ±(2 + 12k)].
Proof. Thanks to Lemma 10.5, it is sufficient to find all integral points
on Ct whose naı̈ve height is less than or equal to t2 . Let P be such an

Sylvain Duquesne

98

integral point. We have an upper bound for its canonical height provided
by Proposition 8.1.
3ĥ(P ) ≤ log(16 + t2 ) + 4.08.
2
Theorem 12.3 implies that there are integers n1 and n2 and ε ∈ {0, 1} suchthat
P = n1 G1 + n2 G2 + ε[0, 0].
Using the properties of the canonical height, we deduce thatĥ(P ) = n21 ĥ(G1 ) + n22 ĥ(G2 ) + 2n1 n2 hG1 , G2 i.
We know, thanks to Proposition 12.2, that hG1 , G2 i is negative and thatĥ(G1 ) ≥ ĥ(G2 ). Hence it is easy to conclude if n1 n2 is non-positive. Indeed,
we haveĥ(P ) ≥ (n21 + n22 )ĥ(G2 ).
So, if |k| ≥ 27, we have3

log(16 + t2 ) + 4.08
0.47 log(t)≤ 7.5

n21 + n22 ≤ 2This proves that both |n1 | and |n2 | are less than or equal to 2, but not at
the same time.If n1 n2 is positive, it is more subtle. In this case we especiallyneed precise approximations of Proposition 12.2. If |k| ≥ 27, we haveĥ(P ) ≥ 0.96 log(t)n21 + 0.47 log(t)n22 − 1.11 log(t)n1 n2≥ 0.47(2.04n21 + n22 + 2.38n1 n2 ) log(t)≥ 0.47 0.62n21 + (1.19n1 − n2 )2 log(t) .
Using the upper bound on ĥ(P ) given by Silverman, we deduce3log(16 + t2 ) + 4.08
0.62n21 + (1.19n21 − n2 )2 ≤ 20.47 log(t)≤ 7.5

We assume, without loss of generality, that n1 and n2 are both positive. It
is easy to deduce that n1 must be less than or equal to 3 and thatn1 = 1 =⇒ n2 ≤ 3
n1 = 2 =⇒ n2 ≤ 4
n1 = 3 =⇒ n2 = 3 or 4.
The remaining cases must be done by hand; for |k| < 27 we used magma.
For small values of n1 and n2 , we are again using canonical heights. Let

Elliptic curves associated with simplest quartic fields

99

us treat, for instance, the case n1 = 2 and n2 = −1. The bounds given in
Proposition 12.2 ensure thatĥ(G1 − 2G2 ) ≥ 4.34 log(t).
If G1 − 2G2 is an integral point, its naı̈ve height equals the logarithm of its
x-coordinate, so, using Proposition 8.1, we have1ĥ(G1 − 2G2 ) ≤ log(x(P )) + log(16 + t2 ) + 4.08
2
with
2

24k 5 + 60k 4 + 24k 3 − 48k 2 − 54k − 13x(P ) = −4.
20k 4 + 56k 3 + 88k 2 + 76k + 29
These two bounds are incompatible so G1 − 2G2 is never an integral point.
In some cases, Silverman’s bounds are not precise enough and thus we usedbounds obtained by Tate’s series.Finally, this proves that the only integral
points having their x-coordinate less than or equal to t2 on Ct are [0, 0],
G1 , G2 , G1 + G2 , G2 + [0, 0] and G1 + 2G2 if k ≡ −1 mod 5 and theiropposites. Using the reciprocal map of ϕ, it is easy to find all integral
points on Qt .

14. Conclusion
As in the case of simplest cubic fields, we succeeded in proving that the
point [−4, 2t] can always be in a system of generators of Ct (Q). We also
succeeded in generalizing this to the rank 2 case. This is not surprisingsince it is based on the infinite descent method. Moreover, it is almost surethat it will also work with other families or with higher ranks assuming, ofcourse, that explicit generators exist and are known.
On the contrary, we encountered difficulties in solving the problem ofintegral points on Ct , even in rank 1. This is due to the fact that we do
not know any bound on the naı̈ve height of integral points. This difficulty
can be overcome in some specific situations, as in the case of simplest cubic
fields or of simplest quartic fields when the parameter is odd. In fact, we
noticed that the method used for simplest cubic fields in rank 1 will be
successful for any family of torsion-free curves of rank 1.
However, we were able to give exactly all integral points on the originalmodel of the curve both in the case of rank 1 and in the case of a subfamilyof curves of rank 2.
References[1] H. Cohen, A Course in Computational Algebraic Number Theory. Graduate Texts in
Math. 138, Springer-Verlag, 1993.
[2] J. Cremona, M. Prickett, S. Siksek, Height difference bounds for elliptic curves overnumber fields. Journal of Number Theory 116 (2006), 42–68.

100

Sylvain Duquesne[3] J. Cremona, S. Siksek, Computing a Lower Bound for the Canonical Height on Elliptic
Curves over Q. Algorithmic Number Theory, 7th International Symposium, ANTS-VII,
LNCS 4076 (2006), 275–286.
[4] S. Duquesne, Integral points on elliptic curves defined by simplest cubic fields. Exp. Math.
10:1 (2001), 91–102.
[5] M. N. Gras, Table numérique du nombre de classes et des unités des extensions cycliquesréelles de degré 4 de Q. Publ. Math. Fac. Sci. Besancon, fasc 2 (1977/1978).
[6] E. Halberstadt, Signes locaux des courbes elliptiques en 2 et 3. C. R. Acad. Sci. Paris Sér.
I Math. 326:9 (1998), 1047–1052.
[7] H. K. Kim, Evaluation of zeta functions at s = −1 of the simplest quartic fields. Proceedingsof the 2003 Nagoya Conference ”Yokoi-Chowla Conjecture and Related Problems”, Saga
Univ., Saga, 2004, 63–73.
[8] A. J. Lazarus, Class numbers of simplest quartic fields. Number theory (Banff, AB, 1988),
de Gruyter, Berlin, 1990, 313–323.
[9] A. J. Lazarus, On the class number and unit index of simplest quartic fields. Nagoya Math.
J. 121 (1991), 1–13.
[10] S. Louboutin, The simplest quartic fields with ideal class groups of exponents less than orequal to 2. J. Math. Soc. Japan 56:3 (2004), 717–727.
[11] P. Olajos, Power integral bases in the family of simplest quartic fields. Experiment. Math.
14:2 (2005), 129–132.
[12] O. Rizzo, Average root numbers for a nonconstant family of elliptic curves. Compositio
Math. 136:1 (2003), 1–23.
[13] S. Siksek, Infinite descent on elliptic curves. Rocky Mountain J. Math. 25:4 (1995), 1501–
1538.
[14] J. H. Silverman, The arithmetic of elliptic curves. Graduate Texts in Mathematics 106,
Springer-Verlag, 1986.
[15] J. H. Silverman, Computing heights on elliptic curves. Math. Comp. 51 (1988), 339–358.
[16] J. H. Silverman, The difference between the Weil height and the canonical height on elliptic
curves. Math. Comp. 55 (1990), 723–743.
Sylvain Duquesne
Université Montpellier II
Laboratoire I3M (UMR 5149) et LIRMM (UMR 5506)
CC 051, Place Eugène Bataillon
34005 Montpellier Cedex, France
E-mail : duquesne@math.univ-montp2.fr

This article was published in an Elsevier journal. The attached copy
is furnished to the author for non-commercial research andeducation use, including for instruction at the author’s institution,
sharing with colleagues and providing to institution administration.
Other uses, including reproduction and distribution, or selling or
licensing copies, or posting to personal, institutional or third party
websites are prohibited.
In most cases authors are permitted to post their version of thearticle (e.g. in Word or Tex form) to their personal website or
institutional repository. Authors requiring further information
regarding Elsevier’s archiving and manuscript policies areencouraged to visit:
http://www.elsevier.com/copyrightAuthor's personal copy

Information Processing Letters 104 (2007) 101–105
www.elsevier.com/locate/ipl

Improving the arithmetic of elliptic curves in the Jacobi model
Sylvain Duquesne
I3M (UMR CNRS 5149) and LIRMM (UMR CNRS 5506), Université Montpellier II, CC 051, Place Eugène Bataillon,
34095 Montpellier Cedex 5, France
Received 25 April 2007; accepted 17 May 2007
Available online 5 June 2007
Communicated by D. Pointcheval

Abstract
The use of elliptic curve cryptosystems on embedded systems has been becoming widespread for some years. Therefore theresistance of such cryptosystems to side-channel attacks is becoming crucial. Several techniques have recently been developed.
One of these consists in finding a representation of the elliptic curve such that formulae for doubling and addition are the same.
Until now, one of the best results has been obtained by using the Jacobi model. In this Letter, we improve the arithmetic of elliptic
curves in the Jacobi model and we relax some conditions required to work efficiently on this model. We thus obtained the fastest
unified addition formulae for elliptic curve cryptography (assuming that the curve has a 2-torsion point).
© 2007 Elsevier B.V. All rights reserved.
Keywords: Cryptography; Elliptic curves; Side-channel attacks; Unified addition formulae

1. Introduction
Because of their short key length and their longterm strength, elliptic curve cryptosystems have become
very popular. They have recently been recommended by
NSA. This small key size is especially attractive for devices with limited capacities, like smart cards. However,such devices are sensitive to side-channel attacks. In thefollowing, we focus on simple attacks since it is always
possible to introduce countermeasures against differential attacks [6]. Such simple attacks are based on the
difference of complexity between doubling and addition
operations on an elliptic curve. They can be achieved byanalysing information like timing [8], power consumption [9], electromagnetic radiation [11] or any otherside-channel information.
E-mail address: duquesne@math.univ-montp2.fr.
0020-0190/$ – see front matter © 2007 Elsevier B.V. All rights reserved.
doi:10.1016/j.ipl.2007.05.012

Several methods have been developed to obtain anarithmetic which is resistant to side-channel attacks, andmost of them can be found in [5]. Some of these methods consist in rewriting the addition formulae so that it
can be used for doubling a point. In this way, the doubling of a point and the addition of two distinct points
become indistinguishable and simple side-channel attacks are staved off. The most efficient unified formulae
have been obtained with the Hessian model (12 field
multiplications) for curves having a 3-torsion point [7].
Until now, the most efficient unified addition formulaefor elliptic curves with a 2-torsion point have been obtained by using the Jacobi form [2]. Based on curve
representation, the authors present formulae requiring
14 field multiplications if some additional conditions
are satisfied, and 16 unconditionally.
In this Letter, we will improve these formulae. The
result of this enhancement is that the unified addition

Author's personal copy102

S. Duquesne / Information Processing Letters 104 (2007) 101–105

requires only 12 field multiplications under conditions
and 14 unconditionally. Moreover, we relax the conditions evoked above. Thus, we obtain the most efficientunified addition for an elliptic curve containing a 2-torsion point (which means that the order of the curve iseven).
The paper is organized as follows. In Section 2 wereview the Jacobi form of an elliptic curve and the unconditional unified addition formulae obtained in [2]. In
Section 3, we give our improved unconditional formulae and discuss the differences with the previous ones.
Then, in Section 4, we explain how these formulae canagain be improved under some conditions and how weare relaxing the conditions given in [2]. Finally, we conclude in Section 5.
2. Elliptic curves in Jacobi form
In this Letter, the base field is a finite prime field Fp
where p is a large prime number. In fact, it is easy togeneralize the results to any finite field of characteristic
greater than or equal to 5, but this is of no interest for
cryptography in real life.
Let E be an elliptic curve defined over such a field.
It is well known that E can be represented by the set ofpoints (x, y) in F2p satisfying an equation of the form
E : y 2 = x 3 + a4 x + a6 ,together with a point at infinity (denoted O in the following) [12]. Constants a4 and a6 are elements of Fp
such that 4a43 + 27a62 = 0. Following [4], Liardet andSmart explain in [10] how the embedding of an elliptic
curve as the intersection of two quadrics in P3 can beused to produce unified addition formulae. In [2], Billet
and Joye generalize and improve this idea by considering the (extended) Jacobi quartics given by equations of
the form
Y 2 = εX 4 − 2δX 2 Z 2 + Z 4 .

(1)

With this equation, a point is represented by a triplet(X, Y, Z) satisfying Eq. (1). Let us note that two triplets(X1 , Y1 , Z1 ) and (X2 , Y2 , Z2 ) represent the same point
if and only if there is an element k in F∗p such that X1 =kX2 , Y1 = k 2 Y2 and Z1 = kZ2 .
It is proved in [2] that any elliptic curve defined overFp having a 2-torsion point is birationally equivalent tosuch a quartic.
Let (θ, 0) be such a 2-torsion point (i.e., θ is a rootof the polynomial x 3 + a4 x + a6 ), then constants ε andδ are defined by3θ 2 + 4a4
ε=−
,
16

3
δ = θ,
4and the birational transformations are given by⎧⎪⎨ (θ, 0) → (0, −1, 1),
ψ : O → (0, 1, 1),⎪⎩ (x, y) → 2(x − θ ), (2x + θ )(x − θ )2 − y 2 , y ,
and⎧(0, 1, 0) → O,⎪⎨
ψ −1 : (0, −1, 0) → (θ, 0),
⎪

2)
2
2
⎩
(X, Y, Z) → 2(YX+Z− θ2 , Z 4(Y +ZX3)−3θ .
2
Of course, this means that all the curves cannot be transformed into an extended Jacobi quartic. In particular, thecardinality of a curve transformable into such a form iseven. However, this is more general than the intersection of two quadrics [10] or the Montgomery form [5]whose cardinality is a multiple of 4. Let us now give theformulae for the addition(X1 , Y1 , Z1 ) + (X2 , Y2 , Z2 ) = (X3 , Y3 , Z3 ).
We have⎧X = X Z Y + Y X Z ,
3
1 1 2
1 2 2
⎪
⎪
⎨ Y = Z 2 Z 2 + εX 2 X 2 ht (Y Y − 2δX X Z Z )
3
1 2
1 2
1 2
1 2 1 22
2
2
2⎪+ 2εX1 X2 Z1 Z2 X1 Z2 + Z1 X2 ,⎪⎩Z3 = Z12 Z22 − εX12 X22 .
(2)
The main interest of these formulae is that they remain
valid if (X1 , Y1 , Z1 ) = (X2 , Y2 , Z2 ). They are also valid
if one of the points is the neutral element. According
to [2], these formulae require 13 multiplications and3 multiplications by constants, which has provided thebest unified formulae until now for curves of even order.
They also require 14 modular reductions and 8 temporary variables. Note that we give both the number ofmultiplications (which is standard) and the number ofmodular reductions because the latter is the most important operation in RNS representation, which can beused for performing a safe arithmetic on elliptic curves,
as explained in [1]. This complexity can be reduced byeliminating 2 multiplications by constants if ε is small,which is possible under some conditions. Before explaining these conditions and relaxing them in comparison with [2], let us explain how to reduce the numberof multiplications and modular reductions.
3. Improved addition formulae
Let ϕ be the map
ϕ : F3p → F4p ,(X, Y, Z) → X 2 , XZ, Z 2 , Y

Author's personal copy

S. Duquesne / Information Processing Letters 104 (2007) 101–105

Let (X, Y, Z) be a point on the extended Jacobi quartic.
To reduce the number of field multiplications, we willuse ϕ(X, Y, Z) instead of (X, Y, Z). Of course this increases the memory required compared to [2]. This is adrawback for small devices, but we will see that in practice only 9 temporary variables are necessary instead of
8 in [2], so the memory extra cost is not very high (wedo not count the registers for storing ε and δ in the memory requirements).
We thus use the formulae (2) and give, in Table 1, theoperations necessary to add two points (X1 , Y1 , Z1 ) and(X2 , Y2 , Z2 ) represented by ϕ(X1 , Y1 , Z1 ) = (U1 , V1 ,W1 , Y1 ) and ϕ(X2 , Y2 , Z2 ) = (U2 , V2 , W2 , Y2 ). If thesum of these points is (X3 , Y3 , Z3 ), the operations described can either return (X3 , Y3 , Z3 ) or return ϕ(X3 ,Y3 , Z3 ) = (U3 , V3 , W3 , Y3 ).
Assuming that the input and output are represented
using ϕ, executing operations of Table 1 requires only
11 multiplications and 3 multiplications by constants.
They also require 12 modular reductions and 9 temporary variables. Compared to [2], this is a gain of 14%
and even 17% if ε is assumed to be small (as discussed
in the next section). Thus, this provides the best unified
addition for an elliptic curve with a 2-torsion point. Let
us now describe in detail how this new system of coordinates can be used to perform a scalar multiplication
which is resistant to side-channel attacks.
Let E be an elliptic curve defined over Fp containing a 2-torsion point and let P be a point in E(Fp ) and n
an integer. The computation of nP is crucial in elliptic
curve cryptography since this operation is used in almost all cryptosystems and is the most time-consuming
operation. We can proceed as follows:(1) Compute constants θ , ε and δ to obtain the equationof the (extended) Jacobi quartic (of the form (1)).
(2) Send the point P to the (extended) Jacobi quartic
model using the rational transformation ψ .
(3) Compute the new coordinates (U, V , W, Y ) of
ψ(P ) using the map ϕ.
(4) Use the full Table 1 and your favorite exponentiation algorithm to compute n(U, V , W, Y ).
(5) Remember to use only the first part of Table 1 forthe last operation of the exponentiation, so that theresult of the exponentiation is a point on the (extended) Jacobi quartic with standard coordinates(X, Y, Z).
(6) Send this point back to the original elliptic curve via
the reverse rational transformation ψ −1 .
Of course, steps (1), (2) and (6) are not necessary if thecurve is originally given in (extended) Jacobi quartic

103

Table 1
Unified addition on a Jacobi quartic using ϕOperation

Value of the variableT1 ← U1

X12

T2 ← U2
T3 ← V1

X22
X1 Z1

T4 ← V2

X2 Z2

T5 ← W1

Z12

T6 ← W2
T7 ← Y1

Z22
Y1

T8 ← Y2

Y2

T9 ← T7 T8
T7 ← T7 + T3

Y1 Y2
X1 Z1 + Y1

T8 ← T8 + T4
T3 ← T3 T4
T7 ← T7 T8
T7 ← T7 − T9
T7 ← T7 − T3

X2 Z2 + Y2
X1 X2 Z1 Z2(X1 Z1 + Y1 )(X2 Z2 + Y2 )X1 Z1 Y2 + X2 Z2 Y1 + X1 Z1 X2 Z2
X3T4 ← T1 T2

X12 X22

T8 ← T5 T6

Z12 Z22

T1 ← T1 + T5

X12 + Z12

T2 ← T2 + T6

X22 + Z22

T5 ← T1 T2(X12 + Z12 )(X22 + Z22 )T5 ← T5 − T4

X12 Z22 + X22 Z12 + Z12 Z22

T5 ← T5 − T8

X12 Z22 + X22 Z12

T4 ← εT4
T1 ← T8 − T4

εX12 X22
Z3

T2 ← T8 + T4
T6 ← 2δT3

Z12 Z22 + εX12 X22
2δX1 X2 Z1 Z2

T6 ← T9 − T6

Y1 Y2 − 2δX1 X2 Z1 Z2

T6 ← T6 T2(Z12 Z22 + εX12 X22 )(Y1 Y2 − 2δX1 X2 Z1 Z2 )T3 ← 2εT3T3 ← T5 T3
T8 ← T6 + T3

2εX1 X2 Z1 Z2
2εX1 X2 Z1 Z2 (X12 Z22 + X22 Z12 )Y3

T2 ← T72

T4 ← T1 T7

U3 (= X32 )V3 (= X3 Z3 )T6 ← T12

W3 (= Z32 )form. Moreover, note that, since addition and doubling
are indistinguishable, any of the many exponentiation
algorithms (double-and-add, w-NAF, addition chains,
fixed base point methods) can be used without jeopardizing the security against simple side-channel attacks.
4. The case of small coefficients
In formulae (2), there are two multiplications by ε, so
it is very interesting to assume that ε is small. In [2], theauthors explained that this is possible for most elliptic
curves with three points of order 2. More precisely they

Author's personal copy

104

S. Duquesne / Information Processing Letters 104 (2007) 101–105

prove that ε can always be rescaled to 1 if p ≡ 3 mod 4
and with a probability 7/8 if p ≡ 1 mod 4. In this part,
we explain how to relax the condition on the numberof 2-torsion points. Indeed, it is not necessary to makeadditional assumptions to obtain this result and it is evenpossible to conclude in more cases.
Thus, we only assume in the following that the elliptic curve E has one 2-torsion point (which is a necessary
condition to transform the curve into a Jacobi quartic). Let (θ, 0) be this 2-torsion point on E, and recall
that3θ 2 + 4a4.
16
Let α ∈ F∗p . We will consider the change of variables
YX
y= 3
x = 2,
αα
which makes the elliptic curve E isomorphic to the elliptic curveε=−E : Y 2 = X 3 + a4 X + a6 ,with a4 = a4 α 4 and a6 = bα 6 . This curve has, of course,
a 2-torsion point (θ , 0) with θ = θ α 2 , so if one wants
to transforms E into a Jacobi quartic, the new value of
ε is
ε = εα 4 .
We therefore have to find an α such that εα 4 is asmall number. For this, let μ denote the smallest integer (greater than or equal to −1) which is not a squaremodulo p. Using the multiplicativity of the Legendre
symbol, one can prove that four cases can occur (withthe same probability):(i) ε is a fourth power in Fp and we can choose α suchthat ε = 1.
√(ii) ε is not a square in Fp and ε/μ is a square. In
this case, ε/μ is a fourth power and we can choose
α such that ε = μ.
√(iii) ε is a square in Fp but not ε. In this case, ε/μ2
is a fourth power and we can choose α such thatε = μ2 .
√(iv) Neither ε nor ε/μ are squares in Fp . In this case,ε/μ3 is a fourth power and we can choose α suchthat ε = μ3 .
The simplest case to treat is p ≡ 3 mod 4. Indeed, we
can choose μ = −1 so that we can always rescale εto 1 or −1. Note that this is the most current case incryptographic applications (pseudo-Mersenne primes orgeneralized Mersenne primes). If p ≡ 1 mod 4, we haveto check that μ is sufficiently small. It is easy to prove(again using the properties of the Legendre symbol) thatthe proportion of prime fields such that the n first prime
numbers are squares is only 1/2n . Thus, in most cases
it is possible to rescale ε to a small number.
Anyway, if μ is too large to assume that the multiplication by ε can be neglected (for instance, if we are incases (iii) or (iv)), there is another way to rescale ε to asmall value. This method is explained in [3]. The principle is to find an isogeny of small degree between theelliptic curve E and a new elliptic curve, say E , having
the same cardinality. One can then hope that the method
explained above (i.e. via isomorphisms) will give a better result on E than on E (for instance, if we are incases (i) or (ii)).
Basically, this is the same idea as the previous isomorphism between E and E (an isomorphism is an
isogeny of degree 1), but the composition of the isogeny
and its dual is not the identity on E, so the scalar multiplication must be modified to give a good result. This
operation is of negligible cost compared to full scalarmultiplication, as explained in detail in [3].
5. Conclusion
In this Letter, we provide better unified addition formulae for elliptic curves having a 2-torsion point by introducing a new system of coordinates on the (extended)
Jacobi quartic model. Moreover, we prove that, in mostcases, it is not necessary to assume that the elliptic curve
has three 2-torsion points to further improve the performance. In particular, we prove that, if p ≡ 3 mod 4, ε
can be rescaled to 1 or −1 without any additional assumption on the curve.
Finally, we obtain unified addition formulae (on elliptic curves with a 2-torsion point) requiring only 12
multiplications on the base field in most cases, which
represents a gain of 17% compared to the best known
formulae until now [2]. This formulae will allow more
efficient scalar multiplication, which is resistant to sidechannel attacks, on elliptic curves whose order is even.
References[1] J.C. Bajard, S. Duquesne, M. Ercegovac, N. Meloni, Residue
systems efficiency for modular products summation: application
to elliptic curves cryptography, Proc. SPIE 6313 (2006) 631304.
[2] O. Billet, M. Joye, The Jacobi model of an elliptic curve and sidechannel analysis, in: Applied Algebra, Algorithms and ErrorCorrecting Codes, Lecture Notes in Comput. Sci., vol. 2643,
Springer, Berlin, 2003, pp. 34–42.
[3] E. Brier, M. Joye, Fast point multiplication on elliptic curves
trough isogenies, in: Applied Algebra, Algorithms and Error-

Author's personal copy

S. Duquesne / Information Processing Letters 104 (2007) 101–105

Correcting Codes, in: Lecture Notes in Comput. Sci., vol. 2643,
Springer, Berlin, 2003, pp. 43–50.
[4] D.V. Chudnovsky, G.V. Chudnovsky, Sequences of numbers generated by addition in formal groups and new primality and factorization tests, Adv. in Appl. Math. 7 (1986) 385–434.
[5] H. Cohen, G. Frey, Handbook of Elliptic and Hyperelliptic Curve
Cryptography, Discrete Math. Appl., Chapman & Hall/CRC,
2006.
[6] J.S. Coron, Resistance against differential power analysis for elliptic curve cryptosystems, in: CHES’99, in: Lecture Notes in
Comput. Sci., vol. 1717, Springer, Berlin, 1999, pp. 292–302.
[7] M. Joye, J.J. Quisquater, Hessian elliptic curves and side-channel
attacks, in: CHES 2001, in: Lecture Notes in Comput. Sci.,
vol. 2162, Springer, Berlin, 2001, pp. 402–410.

105[8] P.C. Kocher, Timing attacks on implementations of DH, RSA,DSS and other systems, in: CRYPTO’96, in: Lecture Notes in
Comput. Sci., vol. 1109, Springer, Berlin, 1996, pp. 104–113.
[9] P.C. Kocher, J. Jaffe, B. Jun, in: Differential power analysis,
CRYPTO’99, in: Lecture Notes in Comput. Sci., vol. 1666,
Springer, Berlin, 1999, pp. 388–397.
[10] P.Y. Liardet, N. Smart, in: Preventing SPA/DPA in ECC Systems
Using the Jacobi Form, CHES 2001, in: Lecture Notes in Comput. Sci., vol. 2162, Springer, Berlin, 2001, pp. 391–401.
[11] J.J. Quisquater, D. Samyde, in: ElectroMagnetic Analysis(EMA): Measures and Countermeasures for Smart Cards,
e-smart 2001, in: Lecture Notes in Comput. Sci., vol. 2140,
Springer, Berlin, 2001, pp. 200–210.
[12] J.H. Silverman, The Arithmetic of Elliptic Curves, Graduate
Texts in Mathematics, vol. 106, Springer, Berlin, 1986.

Combining leak–resistant arithmetic for elliptic
curves defined over Fp and RNS representationa

JC Bajarda , S. Duquesneb , M Ercegovacc
ARITH-LIRMM, CNRS Université Montpellier2, France;b
I3M, CNRS Université Montpellier2, France;c
UCLA, Computer Science Dep., Los Angeles, US
September 24, 2007

Contents
1 Introduction

22 Background properties of the different representations and algorithms
3
2.1 Modular multiplication . . . . . . . . . . . . . . . . . . . . . . . .
3
2.2 Leak-resistant arithmetic in elliptic curve cryptography . . . . .
4
3

Residue Number Systems
3.1 Presentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.2 RNS Montgomery reduction . . . . . . . . . . . . . . . . . . . . .
3.3 Discussion about the advantages . . . . . . . . . . . . . . . . . .

8
8
9
14

4 Leak-resistant arithmetic on elliptic curves optimized for the
RNS representation
14
4.1 Unified addition formulae . . . . . . . . . . . . . . . . . . . . . . 15
4.2 Montgomery formulae . . . . . . . . . . . . . . . . . . . . . . . . 16
4.3 Rescaling the constant to a small value . . . . . . . . . . . . . . . 18
5 Comparisons of performance19

6 Conclusion

22
Abstract

In this paper we combine the RNS representation and the leak-resistantarithmetic on elliptic curves. These two techniques are relevant for implementation of elliptic curve cryptography on embedded devices since they
have leak-resistance properties. We improve the reduction step of the
RNS modular product and we optimize formulae for the basic operations

1

arising in leak-resistant arithmetic on elliptic curves (unified addition,
Montgomery ladder) in order to minimize the number of modular reduction. Finally, we obtain a competitive and secure implementation. We also
explain the advantages of the RNS representation, especially in hardwareand for embedded devices, and show that, contrary to other approaches,ours takes optimal advantage of a dedicated parallel architecture.

Keywords: Elliptic curves, Montgomery, Leak-resistance, RNS, Modular
multiplication.

1

Introduction

Elliptic curve cryptosystems, because of their small key length, has become popular to such a point that they have recently been recommended by the NSA.
Their small key size is especially attractive for small cryptographic devices likesmart cards. However, such devices are sensitive to side channel attacks. These
attacks consist in analyzing side channel informations like timings [22], power
consumptions [23] or electromagnetic radiations [30] of a device. They havebecome such a threat that protecting ECC against them has become itself awhole research area giving rise to various countermeasures [14].
The weakness comes from the difference of complexity between the addition
and the doubling on elliptic curves. There are two ways to resolve this. The
first one is to use representations of the curve for which the two operations are
obtained with the same formulae as in [24], [20] or [8]. The second one is to usean algorithm for the scalar multiplication due to Montgomery [26] for a familyof curves defined over Fp and generalized in [16], [8] and [19]. This algorithm has
many advantages for constrained environments: it is leak-resistant, very simple to implement, careful in memory and does not required precomputations.
On the other hand the RNS representation of numbers in Fp has interestingleak-resistance properties for the arithmetic on the base field, it is easily parallelizable in hardware [4] and it is scalable.
The aim of this paper is to combine these two techniques, especially in thecase of curves in Weierstrass form, to obtain an implementation of ECC whichis leak-resistant, both at the level of the curve and at the level of the field, andwhich can be easily and efficiently parallelized in hardware.
In the following, K denotes a field of characteristic 6= 2, 3 (which is a prime field
Fp in practice) and |n|2 denotes the bit-length of n.

2

2

Background properties of the different representations and algorithms

2.1

Modular multiplication

Elliptic curve arithmetic over Fp mainly involves modular multiplications modulo p. Such a modular multiplication can be decomposed into one classic multiplication followed by a modular reduction. Because of the small size of thenumbers used with ECC (192 to 512 bits, i.e., 6 to 16 32-bit words), the multiplication is performed by the so called schoolbook method. Let us consider
A
Pn
and B two n-word integers given in radix representation (i.e., X = i=0 xi β iwith 0 ≤ ai < β), then A × B can be computed by a succession of word multiplications and additions (which will be considered in the following as basic word
operations). We can summarize it by the equation
A × B = b0 A + β(b1 A + β(b2 A · · · + βbn A) . . . ).
We get a complexity of n2 word operations.
The reduction of an integer k modulo another integer p consists in finding
the remainder of the euclidean division of k by p. This operation is costly. It
can be substantially speeded up by using the Montgomery reduction (we willrecall now this method as it is in RNS) or by using special modulo.
Montgomery general reduction algorithm:
In [25] Montgomery proposed to substitute the reduction modulo p by a division
by a power of the radix β (a simple shift). The result is not exactly k mod p
but kβ −n mod p. Using Montgomery representation allows overcoming of thisproblem.
Algorithm 1: Montgomeryp (R)Data: R = A × B < β 2n and β n−1 ≤ p < β nand a precomputed value (−p−1 mod β n );Result: (q, r) such that r = Rβ −n (mod p) < 2p;q ← −R × p−1 mod β n ;r ← (R + qp)/β n ;The complexity of this reduction is n2 + n word operations [7]. As all thecomputations can be done in Montgomery representation, we ignore the cost of
the conversion from Montgomery to classic representation.
Reduction using special modulo:
When using ECC, one can choose the underlying field without restriction. In
this case, the cost of a modular reduction can be reduced to some additions.
Compared to the cost of a general reduction, it can be considered as almost
free. As an example, if the field Fp is such that p is a Mersenne number (ie3p = 2k − 1), then the reduction of a 2n-word integer R modulo p requires only
2n word additions. Just write R = R1 2k + R0 , then R (mod p) = R1 + R2 , if
R1 + R2 ≥ p then R (mod p) = R1 + R2 − p. Prime Mersenne numbers are rare.
This is why the generalized Mersenne number class has been introduced [33, 11](integer of the form P (2k ) where P (X) = X n − C(X) and C is a polynomialwith coefficients equal to −1, 0 or 1 and deg(C) ≤ n2 ) . Modular reduction isstill a question of additions, so it is almost free. However, one can not findgeneralized Mersenne numbers for all the number length. Moreover, the maindrawback is that a dedicated architecture to a particular p cannot be used forother values. Consequently, it is not realistic in either a context of software or
hardware implementation.

2.2

Leak-resistant arithmetic in elliptic curve cryptography

In all elliptic curves based schemes (such as encryption/decryption or signature
generation/verification) the dominant operation is the scalar multiplication ofpoints on the curve. Hence, the efficiency of this operation is central in elliptic
curve cryptography. This is usually done by using standards scalar multiplication methods such as double and add or sliding window methods combined withrecoding of the exponent.
However, these methods are not leak-resistant because of the difference ofcomplexity between the addition and the doubling operations. There exists
some methods to protect these algorithms, for example, if one wants to protect
a double and add algorithm against side-channel attacks, one can perform extra(useless) additions [14]. By this way, for each bit of the exponent we perform
both an addition and a doubling so that bits of the exponent are indistinguishable. Unfortunately this protection is not only expensive but vulnerable to fault
attacks too.
Currently there are essentially two means to perform leak-resistant arithmetic on elliptic curves. The first one is the use of unified addition formulae.
This means that we use a representation of the curve for which the addition
and the doubling can be performed using the same formulae. In the following,
we will present unified formulae for three representations of the curve, namely,
the Hessian form, the Jacobi form (leading to the most efficient formulae but
not applicable to all elliptic curves) and the short Weierstrass form (which is
the general case). The second one is to use the Montgomery ladder where bothan addition and a doubling are necessary to perform at each step of the scalarmultiplication algorithm. Again, in this case, the arithmetic is more efficient on
restrictive models of the curve and we will present both the restrictive and thegeneral model.
Unified addition formulae
The use of the Hessian form for a leak-resistant arithmetic has been introduce
in [20]. An elliptic curve over Fp is said to be in Hessian form if it is given by4

an equation of the form
X 3 + Y 3 + Z 3 = 3dXY Z
where d ∈ Fp and is not a third root of unity. Such curves have a point of 3torsion (which means that there cardinality is divisible by 3) so that all elliptic
curve cannot be given in this form. In [20], Joye and Quisquater described
the formulae for the addtion of two points (X1 , Y1 , Z1 ) and (X2 , Y2 , Z2 ) for theelliptic curve in such a representation.
 X3 = Y12 X2 Z2 − Y22 X1 Z1 ,Y3 = X12 Y2 Z2 − X22 Y1 Z1 ,

Z3 = Z12 X2 Y2 − Z22 X1 Y1 .
These formulae require 12 field multiplications and can be used for the addition
and the doubling since we have2(X, Y, Z) = (Z, X, Y ) + (Y, Z, X).
At the same time, the use of the Jacobi model was introduced by Liardet andSmart in [24]. It is improved in [6] and, more recently, in [15]. It is easy to provethat any elliptic curve containing a 2-torsion point is birationally equivalent to
the Jacobi quartic given by an equation of the form
Y 2 = εX 4 − 2δX 2 Z 2 + Z 4 ,where ε and δ are constants in Fp . In this case, the formulae for the addition of
two points (X1 , Y1 , Z1 ) and (X2 , Y2 , Z2 ) are also valid if the two points are thesame.
X3 = X1 Z1 Y2 + Y1 X2 Z2 ,
Y3 = Z12 Z22 + εX12 X22 (Y1 Y2 − 2δX1X2 Z1 Z2 )+2εX1 X2 Z1 Z2 X12 Z22 + Z12 X22 ,
Z3 = Z12 Z22 − εX12 X22 .
In most cases, ε can be rescaled to a small value so that it is not too restrictive
to neglect multiplication by ε. Thus these formuale are also requiring 12 multiplication as explained in [15]. However this method cannot be applied to any
elliptic curve since the cardinality of a Jacobi quartic is even.
In [8] Brier and Joye are giving unified formulae for a curve given in short
Weierstrass form (which is not restrictive over Fp where p is a large prime
number)Y 2 Z = X 3 + aXZ 2 + bZ 3 .
Again, the formulae given for the addition of two points (X1 , Y1 , Z1 ) and (X2 , Y2 , Z2 )are also valid if the two points are the same.
 X3 = 2λd λ2n − (X1 Z2 + X2 Z1 )(Y1 Z2 + Y2 Z1 )λd ,2
Y = λn 3(X1 Z2 + X2 Z1 )(Y1 Z2 + Y2 Z1 )λd − 2λ2n − ((Y1 Z2 + Y2 Z1 )λd ) , 3
3Z3 = 2λd ,5where= (X1 Z2 + X2 Z1 )2 − X1 X2 Z1 Z2 + aZ12 Z22 ,= (Y1 Z2 + Y2 Z1 )Z1 Z2 .

λnλdThese formulae are valid for all elliptic curve but are less efficient since they
are requiring 18 field multiplications. Note that, by using an isomorphism or an
isogeny, it is possible, in most cases, to rescale a to a small value. We will explain
this in details in Section 4.3 within the context of Montgomery arithmetic.
The Montgomery scalar multiplication
Montgomery proposed in [26] to work only with the x-coordinate. Of course,
the group law is lost but traces remain. So doubling is still possible and the
addition of two points P and Q is possible if P − Q is known. Montgomery gives
the formulae for those operations when the curve is in Montgomery form, thatis defined by an equation of the typeBy 2 = x3 + Ax2 + x.
Proposition 1 Let E be an elliptic curve defined over Fp in Montgomery form.
Let also P = (Xp , Yp , Zp ) and Q = (Xq , Yq , Zq ) ∈ E(K) given in projective
coordinates. Assume that P − Q = (x, y) is known in affine coordinates. Thenthe X and Z-coordinates for P + Q and 2P are given by
2((Xp − Zp )(Xq + Zq ) + (Xp + Zp )(Xq − Zq )) ,

Xp+q

=

Zp+q

= x ((Xp − Zp )(Xq + Zq ) − (Xp + Zp )(Xq − Zq )) ,
= (Xp + Zp )2 − (Xp − Zp )2 ,4Xp Zp2

X2p=(Xp + Zp )2 (Xp − Zp )2 ,

Z2p

=


4Xp Zp (Xp − Zp )2 + A+2
4 4Xp Zp .

By this way, both an addition and a doubling takes only 3 multiplications and2 squares which is much faster than usual operations ([13]). The fact that thedifference P − Q must be known to compute P + Q implies that a new algorithm
must be used to compute the scalar multiplication of a point G by an integer k.
The solution is to use pairs of consecutive multiples of P, so that the difference
between the two components of the pair is always known and equal to G. The
algorithm for scalar multiplication is as follows:
Algorithm 2: Montgomery Scalar()
Data: G ∈ E (Fp ) and k ∈ Z
Result: x and z-coordinate of kG
1 Initialize Q = (P, Q) = (O, G) where O is the point at infinity;
2 If the bit of k is 0, Q = (2P, P + Q);
3 If the bit of k is 1, Q = (P + Q, 2Q);
4 After doing that for each bit of k, return P ;6Both an addition and a doubling are done for each bit of the exponent. So
the cost of this algorithm is about 10|k|2 multiplications for a curve in Montgomery form which is better than other available algorithms.
Moreover, the operations we have to perform do not depend on the bits of the
exponent so that this method has interesting leak-resistance properties.
Finally, the x-coordinate of kG is usually sufficient but some cryptosystems, like
ECDSA, require the y-coordinates. It can easily be recovered, as explain in [27].
Unfortunately, in odd characteristic, all the elliptic curves cannot be transformed into Montgomery form. This is, for example, the case for most of thestandards. The reason is that any curve which can be transformed into Montgomery form has a 2-torsion point so that its cardinality is not prime (it isdivisible by 2).
In general, namely when the curve is defined by an equation of the form
y 2 = x3 + ax + b,

(1)

this method can also be applied but is more time consuming ([8],[16] and [19]).
Proposition 2 Let E be an elliptic curve defined over Fp by (1). Let also
P = (Xp , Yp , Zp ) and Q = (Xq , Yq , Zq ) ∈ E(Fp ) given in projective coordinates.
Assume that P − Q = (x, y) is known in affine coordinates. Then we obtain the
X and Z-coordinates for P + Q and 2P by the following formulae :Xp+q= −4bZp Zq (Xp Zq + Xq Zp ) + (Xp Xq − aZp Zq )2 ,

Zp+q
X2p

= x(Xp Zq − Xq Zp )2 ,2
= Xp2 − aZp2 − 8bXp Zp3 ,

Z2p

=


4Zp Xp3 + aXp Zp2 + bZp3 .

Addition can be performed in 10 multiplications and doubling in 9. Hence,the scalar multiplication can be performed in about 19|n|2 multiplications on
Fp which is not interesting in terms of performance but it is interesting in termsof leak-resistance. Note that the y-coordinate can also be recovered in this case([8]).
Proposition 3 Suppose that Q = P + G with G = (x, y), P = (xp , yp ) andQ = (xq , yq ). Then, if y 6= 0, one has
yp = −

2b + (a + xxp )(x + xp ) − xq (x − xp )22yWith the Montgomery scalar multiplication method, we always have to perform both an addition and a doubling for each bit of the exponent, so that thismethod is resistant against side-channel attacks and that is the reason why thismethod is always interesting even with 19 multiplications int each step.
In this paper, we will use the Residue Number Systems (RNS) for the arithmetic on the base field. The consequence is that the cost of the multiplication
7

becomes negligible compared to the cost of the modular reduction. Thus, it isnecessary to rewrite the formulae given above in order to minimize the numberof modular reductions. Let us now briefly review this system of representation.

3

Residue Number Systems

3.1

Presentation

The Residue Number Systems (RNS) are based on the well-known Chinese Remainder Theorem (CRT). It was introduced in computer science in [18] and [34].
A good presentation can be found in [21].
These systems are based on the fact that a number x can be represented by
its residues (x1 , x2 , . . . , xn ) modulo a set of coprime numbers (m1Q
, m2 , . . . , mn ),ncalled RNS basis. We generally assume that 0 ≤ x < M = i=1 mi . The
elements xi are called RNS-digits, or simply digits if there is no ambiguity.
The biggest interest of a such system, is to distribute integer operations on theresidues values. Large integer operations are made on the residues, in otherwords on small numbers independently. We consider in this part a RNS base
(m1 , ..., mn ) with elements such that, mi = β − ci where ci is small (with few
non null digits). This property ensure that
Qnthe reduction part on each mi canbe neglected [5]. We assume that M = i=1 mi is such that p < M . In thissystem two numbers a, and b can be represented by their remainders modulo
the mi , i = 1, . . . , n.
a = (a1 , . . . , an ) and b = (b1 , . . . , bn )A multiplication is reduced to n digit modular digit-products. A modular digitproduct is equivalent to a classical digit product following by few additions(which are due to the number of ones in the binary representation of ci , see [5]).
Thus this modular digit-operation can be done in one clock cycle on an hardware composed of n arithmetic cells. This operation is done in n independent
products on words.
r = (a1 × b1

(mod m1 ), . . . , an × bn

(mod mn ))(2)

It is clear that if a product is followed by an addition, the cost is just increasedof one addition on each modulo, and so, can be done in the same cycle.
r = (a1 × b1 + d1

(mod m1 ), . . . , an × bn + dn

(mod mn ))(3)

We now focus our attention on the multiplication modulo p using the algorithm presented in [1]. This algorithm for two numbers a and b given in RNS,
evaluates in fact r = abM −1 mod p. To obtain the right result we need to use
it again with r and M 2 mod p as operands. To prevent this fact, we convert
the values in a Montgomery representation where a0 = a × M mod p which isstable for Montgomery product and addition. Thus, this conversion is done one
8time at the beginning by calling Montgomery product with a and M 2 mod p
as operands, and one time at the end of the complete cryptographic computing
with 1, as second operand. Hence, this transformation will be neglected in thefollowing. Moreover, as the RNS is not redundant, this representation is well
suited for cryptography without any conversion.

3.2

RNS Montgomery reduction

This algorithm is a direct transposition of the classical Montgomery method.
The main difference is due to the representation system. When Montgomery isapplied in a classical radix β representation, the value β n occurs for reduction,
division and Montgomery factor. In RNS this value is replaced by M . Thus anauxiliary RNS Bases is need to handle the inverse of M . Hence some operation
as the initial product will be done on the two bases, which will cost 2n wordsproducts (2n + 1 if we consider the extra modulo m2n+1 , but as its value is of
the order of n, the cost due to this modulo can be neglected).
Algorithm 3 presents the RNS Montgomery reduction (c can be consideredas the result of an RNS product on the two bases), where all the operations
considered are in RNS. We clarify on which basis (and auxiliary modulo) they
are done.
Algorithm 3: MontgR RNS(c, p)
Data:0• Two RNS
1 , . . . , mn ), and B = (mn+1 , . . . , m2n ), such that
Qn bases B =0 (mQn
M = i=1 mi < M = i=1 mn+i and gcd(M, M 0 ) = 1 ;• a redundant modulus m2n+1 , gcd(m2n+1 , mi ) = 1 ∀i = 1...2n ;• a positive integer p represented in RNS in both bases such that
0 < (n + 2)2 p < M and gcd(p, M ) = 1 (p is prime);• a positive integers c represented in RNS in both bases, with c < M p.
Result:• A positive integer r ≡ cM −1 (mod p) represented in RNS in both bases,
with r < (n + 2)p.
begin
q ← (c) × (−p−1 ) in B;
2[q in B] −→ [q̂ in B 0 and m2n+1 ] First base extension;3r ← (c + q̂ × p) × M −1 in B 0 and m2n+1 ;4[r in B and m2n+1 ] ←− [r in B 0 ] Second base extension;
end
1

Instructions 1 and 3 of the Algorithm 3 deal with RNS operations as presented in the previous section, which are made independently one each element9

of the basis, so they are very efficient. These two instructions are linear (orconstant number of words-operations on a n cells architecture) Instructions 2
and 4 represent RNS bases extensions which are quadratic (or linear on an ncell architecture) are costly. To reduce this cost, we can use two different full
RNS extensions as shown in [1]. The extension to base B 0 of q (instruction 2),
obtained in its RNS form (q1 , . . . , qn ) in the base B, is done by evaluating first:
σi = qi Mi−1 m m ,
i

i

(4)

and then,
q̂j =

n
X

Mi m σ i
j

i=1

,
mj

∀j = n + 1 . . . 2n and m2n+1(5)

we have q̂ = q + αM with α < n.
Then we compute in the base B 0 the valuer = (ab + q̂p)M −1 = (ab + qp)M −1 + αp < M 0 .

(6)

After instruction 3, we get r such that r ≡ abM −1 (mod p). The conditions
α < n, q < M and ab < M p gives q̂ < (n + 1)M and thus r < (n + 2)p < M 0 .
In order to use this algorithm within a cryptographic protocol, we must
be able to compute x2 mod p, where x is the output of a former evaluation
verifying x < (n + 2)p. The condition ab < M p then implies (n + 2)2 p2 < M pwhich rewrites:(n + 2)2 p < M.
(7)
The second extension of r from B 0 to B is a classical Shenoy-Kumaresan
scheme [31] using the extra modulus m2n+1 for the computing of the factor α(this is depicted in Algorithm 4), which gives a result smaller than (n + 2)p.
This transformation has no consequence on the conditions.
Reduction of the number of operations:
To reduce the number of operations some pre-computing is helpful. For that,
we develop the previous algorithm 3, giving in Algorithm 4 the details of thebases extensions. Then we introduce a new combination of the operations in
Algorithm 5, which is faster than the previous versions.

10

Algorithm 4: MontgR2 RNS(c, p)
Data:0• Two RNS
1 , . . . , mn ), and B = (mn+1 , . . . , m2n ), such that
Qn bases B =0 (mQn
M = i=1 mi < M = i=1 mn+i and gcd(M, M 0 ) = 1 ;• a redundant modulus m2n+1 , gcd(m2n+1 , mi ) = 1 ∀i = 1...2n ;• a positive integer p represented in RNS in both bases such that
0 < (n + 2)2 p < M and gcd(p, M ) = 1 (p is prime);• a positive integers c represented in RNS in both bases, with c < M p.
Result:• A positive integer r ≡ cM −1 (mod p) represented in RNS in both bases,
with r < (n + 2)p.
begin
−1

1

qi ← ci × − p m

i

in B;
mi

[q in B] −→ [q̂ in B 0 and m2n+1 ]σi ← qi Mi−1 m
in B;
i m
i
Pn
q̂j ←
,
i=1 Mi m σi234First base extension (lines 2 and 3) ;in B 0 and m2n+1 ;jrj ← (cj + q̂j × pj ) ×

mj
−1
M m
j m

in B 0 and m2n+1 ;j[r in B and m2n+1 ] ←− [r in B 0 ]µj ← rj ×

5Second base extension (lines 5 to 8) ;

−1
Mj0 m
, in B 0 ;
j m
j

ξi ←
6

2n
X

µj × Mj0 mi

j=n+1

mi

α ← (ξ2n+1 − r2n+1 ) × M 0

7

rj ← (ξi − α × M 0

8

−1

;
m2n+1 m2n+1

in B;

)
mi

, in B and m2n+1 ;miend
We remark that most of the operations are done with constant values. To
minimize their number, we try to regroup these multiplications by a constantvalue. Instruction 1 can be merged with the first step (instruction 2) of the firstextension given equation (4), then we obtain the following transformation :−1 1 − . qi ← ci × − p m
in B
i m
i
(8)
 2 − . σi ← qi M −1
in B
i
m
i

11

mi

becomes the instruction 1 of Algorithm 5
1 − . σi ← |ci × τi |mi , with τi =

−1

−1

i

i

− p m Mi m

, in B(9)mi

Then we merge the next three instructions (lines 3, 4 and 5 of Algorithm 4), for obtaining new expressions where new constants occur.
Pn
,in B 0 and m2n+1
i=1 Mi mj σi 3 − . q̂j ←
mj


−1
4 − . rj ← (cj + q̂j × pj ) × M m
in B 0 and m2n+1
(10)
j m

j


−1

 5 − . µj ← rj × Mj0 m
in B 0j

mj

These three instructions can be rewritten as follow:
P−1 r2n+1 ← c2n+1 + ni=1 σi × Mi m
× p2n+1 ) × M m
2n+1
2n+1 m
2n+1
Pn
−1
−1
0

 µj ← (cj + i=1 σi × Mi m × pj ) × M m × Mj mjjj

in B 0mj(11)Thus we obtain the instructions 3 and 4 of Algorithm 5:
3 − . γj ← cj +nXρi σ ii=1, with ρi = Mi m p m
j

mj
−1

4 − . µj ← γj × νj

mjwith νj = M

mjjin B 0(12)

in B 0

(13)

mj

−1

× Mj0 mj

mj

We remark that we can apply this rewriting to the complete evaluation of α
from the last instructions.

P2n
0

6 − . ξi ←in B and m2n+1

j=n+1 µj × Mj mi

mi


−1
7 − . α ← (ξ2n+1 − r2n+1 ) × M 0(14)

m2n+1 m2n+1 8 − . rj ← (ξi − α × M 0 )
in B
mi

mi

Then we obtain for the evaluation modulo m2n+1 , the instructions 6, 2 and
7 of Algorithm 5:

−1
P2n
0
0
0


6 − . ξ2n+1←

j=n+1 µj × Mj m2n+1 × M
m2n+1 m2n+1


−1
Pn
−1
0
× M0
2 − . r2n+1 ← c2n+1 + i=1 σi × Mi m
× p2n+1 ) × M m
2n+1
2n+1

m2n+1 m

2n+1



0
0
 7 − . α ← ξ2n+1 − r2n+1
m2n+1

(15)
Hence the algorithm becomes:
12

Algorithm 5: MontgR RNSbis(c, p)
Data:• Two RNS bases B = (m1 , . . . , mn ), and B 0 = (mn+1 , . . . , m2n ), such thatQn
Q2n
M = i=1 mi < M 0 = j=1+n mj and gcd(M, M 0 ) = 1 ;with Mi = M/mi and Mj0 = M 0 /mj• a redundant modulus m2n+1 , coprime to all the mi for i = 1...2n• a positive integer p represented in RNS in both bases such that
0 < (n + 2)2 p < M and gcd(p, M ) = 1 (p is prime);−1− p−1 m × Mi m m , ∀i = 1...n;• τi =ii• ρi,j = Mi m × p mj−1• νj = M

mj

mj

j

−1

i

, ∀i = 1...n and ∀j = n + 1...2n + 1 ,, in B 0 .

× Mj0 mj

mj

Input: A positive integer c represented in RNS in in B in B 0 and m2n+1 ,with c < M p
Result: A positive integer r ≡ abM −1 (mod p) represented in RNS inboth bases, with r < (n + 2)p.
σ←c×τi m , in B ;
1
i
i
i
n
X
−1
−1
0
r2n+1
← (c2n+1 +σi × ρi,2n+1 ) × ( M m
M0
)
;
2n+1

2

γj ← cj +34nXρi,j × σi

i=1µj ← γj × νj
ξi ←

5

2n
X

m2n+1

, in B 0 ;mj, in B 0 , ;mjµj × Mj0 mi

j=n+1
2n
X

0
ξ2n+1
←
6

m2n+1

i=1

, in B ;miµj × ( Mj0 m

2n+1

M0

0
0
α ← ξ2n+1− r2n+1

8

rj ← ξi − α × M 0

)
m2n+1

j=n+1

7

−1

;
m2n+1

;
m2n+1

in B;
mi mi

We summarize now the cost of this algorithm. The evaluations in bases B
and B 0 (lines 1, 3, 4, 5 and 8), represent 2n2 + 3n products. The evaluations on
the extra modulus m2n+1 (instructions 6, 2 and 7) use 2n + 1 multiplications.
Thus, the total cost of these reduction is 2n2 + 5n + 1 words-operations (on an + 1 arithmetic cells, that represents, due to the dependencies, 2n + 3 productcycles). Now, we remind that m2n+1 is small, it can be chosen as the smaller
13

power of two greater than n. So, this part of the calculus can be neglected.
Hence, we can consider that the total cost of the reduction represents 2n2 + 3nwords-products

3.3

Discussion about the advantages

Even if the number of operations needed is somewhat higher than in a classicalrepresentation (2n2 + n words products for the classical Montgomery), RNS has
some important advantages. It is easy to implement, particularly in hardware,and it provides a reduced cost for multiplication and addition and a competitive
modular reduction. Furthermore, RNS allows, due to the independence of themodular operations, to perform computations in a random way and to parallelize
the architecture.
Moreover, it is shown that RNS can be used as a leak-resistant arithmetic[12, 4], by selecting randomly B and B 0 in a set of 2n coprime numbers. It isshown that we got (2nn ) ways to do the same calculus. Hence, DPA attacks arevery difficult to operate. Against SPA it can be possible to exchange the bases
during the evaluation.
The parallelization of the architecture, with n basic operators (the extra
modulus mr can be included inside [3]), gives a time complexity of 2 modular
digit-operation for the multiplication (or multiplication-addition) and 2n + 3 forthe modular reduction. According to this point we see that if we accumulate
some operations (i.e., sum of products) before reduction we obtain an efficient
implementation ([2]). We develop this approach in the next section with ECC.
Last advantage of the RNS is the natural scalability of the architecture.
With a given structure of n modular digit operators, it is possible to handle
many values of p whose verify (7): (n + 2)2 × p < M . If we refer to Algorithm
5, we remark that the only values depending of p are: τi and ρi,j . Thus byreinitializing these pre-computed values the system can be adapted for a newvalue of p. If p is relatively smaller than M , we can adjust the RNS basis by
reducing it of some mi . In this case we will use partial RNS bases (m1 , ..., mñ )and (mn+1 , ..., mn+ñ ) with ñ < n. In this case, with a control part which takes
into account of ñ, we can assume that the performances of the system dependsof the size of p.
Hence, the architecture proposed in this paper offer different level of adaptability, scalability and security proper to the RNS.

4

Leak-resistant arithmetic on elliptic curves optimized for the RNS representation

The aim of this section is to rewrite or modify the formulae given in section 2.2
in order to minimize the number of modular reduction since this is the mostexpensive operation in RNS representation. Thus we have to group together
several multiplications and perform only one reduction.

14

4.1

Unified addition formulaeThis can be very well illustrated by the formulae for Hessian elliptic curves.
We give here the steps that must be done to compute the sum of two points(X1 , Y1 , Z1 ) and (X2 , Y2 , Z2 ). The costs are given by the number of modular
reductions.
stepcomputation ofintermediate products
computation of X3
computation of Y3
computation of Z3

operations
A = X2 Y1 , B = Y1 Z2 , C = X1 Y2
D = Y2 Z1 , E = X1 Z2 , F = X2 Z1
AB − CDEC − F A
EB − F D

cost
3
3
1
1
1

Thus the total cost in RNS representation is 9 modular reductions which has tobe compared to the 12 base field multiplication in standard representation.
Concerning the Jacobi quartic the cost in term of modular reductions (andthe formulae) is given in [15] and is equal to 10 whereas 12 multiplications arenecessary.
Finally, we give the details of the steps for computing the sum of two points
using unified addition formulae for a curve given in short Weierstrass form
step
computation of λncomputation of λdintermediary
computations
computation of X3
computation of Y3
computation of Z3

operations
A = X2 Z1 , B = X1 Z2 ,C = Z1 Z2 , D = aC
λn = (A + B)2 − AB + CD
E = Y1 Z2 + Y2 Z1
λd = ECF = Eλd , G = λ2nH = F (A + B)
2λd (G − H)
λn (3H − 2G) − F 2
2λ3d

cost
2
2
1
1
1
2
1
1
1
2

In this case, the total cost in RNS is 14 modular reduction whereas 18 multiplication must be performed.
Thus, for all known unified formulae, the computation of the addition requires less reductions than multiplications. This means that, even if the cost of
the RNS modular multiplication is higher than the cost of the standard modular multiplication (as shown in Section 3.2), using the RNS representation of
numbers can become interesting in term of performance. In addition, it has
all the advantages described in Section 3.3. We give in Section 5 a detailledcomparison.

15

4.2

Montgomery formulae

The situation is even more exciting in this case. In fact it is not exciting at
all for curves which can be transformed into Montgomery form since both 10
multiplications and modular reduction are required. Moreover, because of thedegree of the formulae, it is easy to see that it is not possible to have a better
result. The case of Montgomery formulae in the general Weierstrass form ismuch more interesting. Indeed one can do better than re-using the formulae
described in Section 2.2. Following the strategy used for the unified addition
formulae leads to 16 modular reductions and 19 multiplications. Slightly rewriting the formulae given in Section 2.2 already allows to perform only 15 modular
reductions. These formulae are given in [2]. It is in fact possible to reduce again
this complexity by resuming from the beginning the Montomery ladder with amore theoretical point of view.
The Montgomery ladder is based on the fact that the y-coordinate brings
only minor information. Indeed, it only allows to distinguish a point and its opposite (or equivalently a point and its image under the hyperelliptic involution).
Thus the Montgomery ladder is only dealing with the x-coordinate. From atheoretical point of view, this means that we are working on the quotient of thecurve by the hyperelliptic involution : the Kummer surface. Of course, taking
such a quotient implies that it is not possible to add two different points (since
P + Q and P − Q are not equal in the Kummer surface. However the doublingis still possible (it is easy to discern P + P and P − P ) and if P − Q is known it
will be possible to discern P + Q and P − Q. More precisely, it is proved in [17]that there exists biquadratic forms Mx , Mz and Mxz such that for any points
P = (Xp , Zp ) and Q = (Xq , Zq ) on the Kummer surface
2Xp+q Xp−q
Xp+q Zp−q + Xp−q Zp+q
2Zp+q Zp−q

= Mx
= Mxz
= Mz

with
(Xp Xq − aZp Zq )2 − 4bZp Zq (Zp Xq + Xp Zq ),

Mx

=

Mxz

= Xp Xq (Zp Xq + Xp Zq ) + Zp Zq (a(Zp Xq + Xp Zq ) + 2bZp Zq )Mz=

(Zp Xq − Xp Zq )2

If P − Q is known, one can easily deduce from these biquadratic forms theformulae to compute Xp+q and Zp+q . In fact, only two of the biquadratic forms
are necessary. For instance, the formulae obtained (by an other way) by Brierand Joye in [8] and given in Proposition 2 can be easily deduced from Mx and
Mz . Here, in order to minimize the number of modular reductions, we will
use Mxz and Mz . In the context of the Montgomery ladder (Algorithm 2),
the difference between the two points we want to add is always the base point
G = (x, y) which is given in affine coordinate so that Zp−q = 1 and Xp+q = x.

16Thus we obtain2(Mxz − xZp+q )

Xp+q

=

Zp+q

= Mz

Let us note that the theory of Kummer surfaces also provides formulae for the
doubling but there are always leading to the same formulae than in Proposition
2. Therefore, we have the following theorem.
Theorem 1 Let p be a prime number and E be an elliptic curve defined overFp by (1). Let also P = (Xp , Yp , Zp ) and Q = (Xq , Yq , Zq ) ∈ E(Fp ) given inprojective coordinates. Assume that P − Q = (x, y) is known in affine coordinates. Then we obtain the X and Z-coordinates for P + Q and 2P in terms of
the X and Z-coordinates for P and Q by the following formulae :
Xp+q

=

Zp+q

=

X2p
Z2p

2 (Xp Xq (Zp Xq + Xp Zq ) + Zp Zq (a(Zp Xq + Xp Zq ) + 2bZp Zq ) − xZp+q ) ,(Xp Zq + Xq Zp )2 − 4Xp Xq Zp Zq ,2
= Xp2 − aZp2 − 8bXp Zp3 ,= 4Xp Zp Xp2 + aZp2 + 4bZp4 .

Finally, we give the details of the steps for computing the sum of two points
and the doubling of a point
step
preliminary
computations
computation of Zp+q
computation of Xp+q
preliminary
computations
computation of X2p
computation of Z2p

operations
A = Zp Xq + Xp Zq
B = 2Xp Xq , C = 2Zp Zq
A2 − BC
D = aA + bC
BA + CD + 2xZp+q
A = 2Xp Zp
B = Xp2 , C = Zp2
D = −4bA, E = aA
BD + (C − E)2
2B(C + E) − AD

cost
1
2
1
1
1
1
2
2
1
1

In this case, the total cost in RNS representation is 13 modular reduction (and20 almost for free multiplications) whereas 19 base field multiplications must be
performed in a standard representation.
It is interesting to notice that, contrary to the case of the standard representation, the extra cost for curves in short Weierstrass form compared to (morespecific) curves in Montgomery form is not too large (33% in RNS representation compared to 90% in standard representation).
Lastly, if a (or b) is a small number, the cost becomes 12 modular reductions
whereas 17 base field multiplications must be performed in a standard representation. Let us now show that we can almost always assume that either a orb is small.

17

4.3

Rescaling the constant to a small value

This section is not specific to the RNS representation and can be applied inother contexts. It takes source in the fact that there are 2 multiplications by ain the general formulae for the Montgomery ladder. Thus if a can be rescaled
to a small value, the gain will be attractive.
The standard way to perform such a rescaling is the use of an isomorphism
E 0 (Fp )x y 
,u2 u3

ψ : E(Fp ) −→(x, y)

7→

where u ∈ F∗p and E 0 is the elliptic curve given by the equationy 2 = x3 +ab
x + 6.
u4uThus if we want to rescale a to a small value, say k, we have to find an elementu such that u4 = ka . In other words, rescaling a to the smallest possible value
is equivalent to find the smallest k such that ka is a fourth power in Fp . For
instance a can be rescaled to 1 if it is a fourth power. The probability for
an element of Fp to be a fourth power is 14 . In fact, one can obtain a better
result in the context of the Montgomery ladder. Indeed y is not used in thisrepresentation so that only u2 will be used and it is in fact sufficient that ka isa square in Fp . This allows to relax the constraints. Of course it is not possible
to use an isomorphism over Fp anymore. We can use an isomorphism definedover Fp but it is easier to use a change of variables.
Theorem 2 Let E be an elliptic curve defined over Fp by (1) and k be a small
integer such that ka is a square in Fp . Let also P = (Xp , Yp , Zp ) and Q =(Xq , Yq , Zq ) ∈ E(Fp ) given in projective coordinates.
Assume that P −Q = (x, y)p
is known in affine coordinates. Put Z 0 = ka Z. Then we obtain the X and Z 0 coordinates for P + Q and 2P in terms of the X and Z 0 -coordinates for P and
Q by the following formulae :
Xp+q

b
0 0
0
0
0 0 2
= −4 a √a Zp Zq (Xp Zq + Xq Zp ) + (Xp Xq − kZp Zq ) ,

0
Zp+q

=

k

k

√xa (Xp Zq0 − Xq Zp0 ),
k

X2p

=

0
Z2p

=

2
b
03
Xp2 − kZp02 − 8 a √a Xp Zp ,
k
k


b
03
4Zp0 Xp3 + kXp Zp02 + a √
Z
.
a
p
k

k

b
and √xa must be precomputed. In this case, addition can be
Of course, a√aperformed in 9 multiplications and doubling in 8. The same idea can be applied
to formulae optimized for the RNS representation given in Section 4.2.
However, is it always possible to find such a small k ?
The first remark is that a is a square with probability 12 (which is better than18

the probabilty of 41 that a is a fourth power). In this case, we can choose k = 1.
Otherwise, if a is not a square, the simplest case to treat is the case p ≡ 3 mod 4.
Indeed, in this case, −1 is not a square in Fp so that −a is a square (thanks
to the multiplicativity of the Legendre symbol) and we can choose k = −1. If
p ≡ 1 mod 4, we have to check that k is sufficiently small. It is easy to prove(using again the properties of the Legendre symbol) that the proportion of prime
fields such that the n first prime numbers are squares is only 21n . Thus, in mostcases, it is possible to rescale a to a small number.
Anyway, if k is too large to assume that the multiplication by k can be neglected, there is another way to rescale a to a small value. This method is
explained in [9]. The principle is to find an isogeny of small degree between theelliptic curve E and an new elliptic curve, say E 00 having the same cardinality.
One can then hope that the method explained above will give a better result on
E 00 than on E.
Basically, it is the same idea that the previous isomorphism between E and E 0(an isomorphism is an isogeny of degree 1) but the composition of the isogeny
and its dual is not the identity on E so that the scalar multiplication must be
modified to give the right result. This operation has a negligible cost comparedto the full scalar multiplication and is explained in detail in [9].
Finally, the method explained for rescaling a to a small value can also be applied
to b if there exists a small k such that 4b
k is a cube in Fp which leads to thesame gain (2 multiplications).
As a conclusion, the probability that neither a nor b can be rescaled (by using Z 0 or isogenies) to a small value is very low in the Montgomery laddercontext.

5Comparisons of performance

In this section, we will compare the complexity of our approach to those using
Montgomery modular multiplication or Mersenne numbers.
First we summarize the complexities in Table 1: obtained for the base field
Operation
Multiplication
Reduction

RNS
2n2n2 + 3nMontgomery
n2
2
n +n

Mersennen20Table 1: Number of word operations in RNS, Montgomery and Mersenne approach for two n-word integers
operations. Table 2 shows the number of operations required for each bit of the
exponent and for the different representations of the curve we chose to deal with19

in this paper.
Curve representation
Hessian form
Jacobi form
unified Weierstrass form
Montgomery ladderMontgomery ladder (a small)

RNS representation
9 red. and 12 mul.
10 red. and 12 mul.
14 red. and 18 mul.
13 red. and 20 mul.
12 red. and 18 mul.

Standard representation
12 mul. and 9 red.
12 mul. and 10 red.
18 mul. and 14 red.
19 mul. and 16 red.
17 mul. and 14 red.

Table 2: Optimal number of operations in RNS and standard representation fora basic step of the scalar multiplication
It is then easy to deduce the global complexity in each case. For instance,
one step of Montgomery exponentiation algorithm using the formulae given in
Section 2.2 (for Montgomery and Mersenne approach) or section 4.2 (for our approach) when a is small requires 17n2 + 14(n2 + n) operations with Montgomery
modular multiplication, 17n2 with Mersenne numbers and 18(2n)+12(2n2 +3n)
in RNS. We summarize inTable 3 the word complexity for each representation of the curve we considered in this paper (i.e., those having leak-resistanceproperties). We also give these complexities for usual ECC sizes for a 32-bit
architecture. All these complexities are given for one basic step of the scalarmultiplication.
As expected, Mersenne numbers based arithmetic is unbeatable in term of
performance. Nevertheless, we have seen that RNS arithmetic has other advantages such as leak-resistance properties and scalable architecture. On theother hand, it is interesting to remark that the complexities we obtain in RNS
are assymptotically always better than in Montgommery representation despite
the fact that Montgomery arithmetic on the base field has a better complexity.
This is due to the fact that we optimised formulae on elliptic curves in order tominimize the number of reduction. Unfortunately, such a better complexity is
not sufficient when n is small as it is the case for 192 or 256 bits elliptic curves.
Our method becomes competitive for larger sizes such as 512 bits elliptic curves(or equivalently 256 bits elliptic curves on a 16 bits architecture) when unified
formulae are used. Concerning the Montgomery ladder, the results are better
since our method is competitive for 256 bits elliptic curves. This is because
we discovered new formulae which are well adapted to the RNS representationof numbers. Anyway, RNS arithmetic shows all its advantages when a parallelarchitecture is used.
Indeed, if we assume that we dispose of an architecture equivalent to nword-operators on a single word-bus, we get in table 4 the complexities of thedifferent approaches in number of word operations. Note that we only givethese complexities in the case of the Montgomery ladder with a small in order
to simplify the paper. The complexities for the other curves representations can
20

Curve representation
Hessian form

Jacobi form

unified Weierstrass form

Montgomery ladderMontg. ladder (a small)size in bit
32n
192
256
512
32n
192
256
512
32n
192
256
512
32n
192
256
512
32n
192
256
512

RNS
18n2 + 51n
954
1560
5424
20n2 + 54n
1044
1712
5984
28n2 + 78n
1476
2416
8416
26n2 + 79n
1410
2296
7920
24n2 + 72n
1296
2112
7296

Montgomery
21n2 + 9n
810
1416
5520
22n2 + 10n
852
1488
5792
32n2 + 14n
1236
2160
8416
35n2 + 16n
1356
2368
9216
31n2 + 14n
1200
2096
8160

Mersenne
12n2
432
768
3072
12n2
432
768
3072
18n2
648
1152
4608
19n2
684
1216
4864
17n2
612
1088
4352

Table 3: Cost of one iteration of scalar multiplication
be easily deduced from Table 3.
Operation
Multiplication
Reduction
One iteration of algorithm 2RNS22n + 324n + 72

Montgomery
n . . . 2n
2n . . . 3n
44n . . . 75n

Mersenne
n . . . 2n
017n . . . 34n

Table 4: Number of cycles with parallel implementations on a n word-operatorsstructure (18M+12R for RNS and Montgomery and 17M+14R for Mersenne).
The estimation of the cost for the multiplication and for Montgomery parallel
product are based on systolic implementations [28] or on parallel implementations [10, 32] where the given architecture are respectively in O(n2 /log(n)2 ) andO(n2 ) for the area and O(log(n)) for the time. As we did not find an explicit
complexity for multiplication using a O(n) area architecture, we give two values
for the complexity. The first one is minimal but certainly not realistic. The
second one, which is not necessarily optimal, takes into account that• each product of a number by a digit will produce two numbers (the highand the low part),21

• a carry-save adder will need an extra register for storing the carry and a
final adder for absorbing those carries,• 32-bit words look-up tables are not reasonable.
Then, to get an idea with ECC key size, we compare three different implementations in table 5 for the number of operations required for one step of theMontgomery scalar multiplication on an elliptic curve in Weierstrass form witha small.
|p|2
192
256
512

word
6
8
16

RNS
216
264
456

Montgomery
264 . . . 450
352. . . 600
704. . . 1200

Mersenne102. . . 204
136. . . 272
272. . . 544

Table 5: Comparison of parallel implementations
In this configuration, the RNS becomes very interesting compared to Montgomery arithmetic in terms of efficiency for a leak-resistant implementation of
elliptic curve cryptosystems even if we use the non-realistic lower bound for thecomparison.
Implementations based on generalized Mersenne primes are still slighlty better in term of efficiency but one has to keep in mind that an architecture using
such prime numbers has some disadvantages compared to RNS. In particular,
it is not highly scalable.

6

Conclusion

We combined two leak-resistance techniques to obtain an efficient and secure
implementation of elliptic curves cryptosystems on embedded devices.
Since the expensive operation in RNS is the reduction, we had to rewrite formulae for elliptic curve leak-resistant arithmetic in order to minimize the numberof reductions even if the number of multiplications is increasing. In the caseof the Montgomery ladder on elliptic curves in Weierstrass form, we obtained
new formulae which are better adapted to RNS representation of numbers andwe explain why multiplications by one of the coefficients of the curve can beneglected in most cases.
We also give a deep analysis of the complexity of the Montgomery reduction.
Doing this, we realize that some improvements could be done leading to a final
complexity of 2n2 + 3n for a n-word number.
Combining this improvement of the RNS reduction and the revisited formulaefor elliptic curves leads to a competitive leak-resistant arithmetic for high security levels in particular in the case of the Montgomery ladder on elliptic curves
in Weierstrass form.

22

Our approach is particularly interesting from the hardware point of view
since the RNS representation of numbers has many advantages (leak-resistance,easy to implement and to parallelize, scalability). It is also very attractive inthe case of a dedicated parallel architecture.

References[1] Bajard, J.C., Didier, L.S., Kornerup, P.: Modular multiplication and baseextension in residue number systems. 15th IEEE Symposium on Computer
Arithmetic, IEEE Computer Society Press (2001) 59–65[2] Bajard, J.C., Duquesne, S., Ercegovac M. and Meloni N.: Residue systems
efficiency for modular products summation: Application to Elliptic Curves
Cryptography, in Advanced Signal Processing Algorithms, Architectures,and Implementations XVI, part of the SPIE Optics & Photonics 2006 Symposium. August 2006 San Diego, USA.
[3] Bajard, J.C., Imbert, L.: A full RNS implementation of RSA. IEEE Transactions on Computers 53:6 (2004) 769–774[4] Bajard, J.C., Imbert, L., Liardet, P.Y., Teglia, Y.: Leak resistant arithmetic.
CHES 2004, LNCS 3156 59–65[5] Bajard, J.C., Meloni, N., Plantard, T.: Efficient RNS bases for Cryptography IMACS’05, Applied Mathematics and Simulation, (2005) ???–???
[6] Billet, O., Joye, M.: The Jacobi Model of an Elliptic Curve and Side-Channel
Analysis. Applied Algebra, Algorithms and Error-Correcting Codes, LNCS
2643 (2003) 34–42.
[7] Bosselaers, A., Govaerts, R., Vandewalle. J.: Comparison of the three modular reduction functions LNCS 773 (1994) 175–186[8] Brier, E., Joye, M.: Weierstrass Elliptic Curves and Side-Channel Attacks.
Public Key Cryptography, LNCS 2274 (2002) 335–345[9] E. Brier, M. Joye, Fast Point Multiplication on Elliptic Curves Trough Isogenies, Applied Algebra, Algorithms and Error-Correcting Codes, Lecture
Notes in Comput. Sci., vol.2643, Springer, Berlin, 2003, pp. 43–50.
[10] Bunimov, V., Schimmler, M.: Efficient Parallel Multiplication Algorithm
for Large Integers Euro-Par 2003, International Conference on Parallel andDistributed Computing (2003) 923–928[11] Chung, J., Hasan, A.: More generalized mersenne numbers. SAC 2003,
LNCS 3006 (2003) 335–347

23

[12] Ciet, M., Neve, M., Peeters, E., Quisquater, J.J.: Parallel FPGA implementation of RSA with residue number systems– can side-channel threats
be avoided? 46th IEEE International Midwest Symposium on Circuits andSystems (2003)[13] Cohen, H., Frey, G.: Handbook of elliptic and hyperelliptic curve cryptography. Discrete Math. Appl., Chapman & Hall/CRC (2006)[14] Coron, J.S.: Resistance against differential power analysis for elliptic curve
cryptosystems. CHES’99, LNCS 1717 (1999) 292–302[15] Duquesne, S.: Improving the Arithmetic of Elliptic Curve in Jacobi Model.
Information Processing Letters 104:3 (2007) 101–105.
[16] Fischer, W., Giraud, C., Knudsen, E.W., Seifert, J. P.: Parallel scalar multiplication on general elliptic curves over Fp hedged against Non-Differential
Side-Channel Attacks. Preprint[17] Flynn, E.V.: An explicit theory of heights. Trans. Amer. Math. Soc. 347:8(1995) 3003–3015.
[18] Garner, H.L.: The residue number system. IRE Transactions on Electronic
Computers, EL 8:6 (1959) 140–147[19] Izu, T., Takagi, T.: A Fast Parallel Elliptic Curve Multiplication Resistantagainst Side Channel Attacks. Public Key Cryptography, LNCS 2274 (2002)
280–296[20] Joye, M., Quisquater, J.J.: Hessian Elliptic Curves and Side-Channel Attacks. CHES 2001, LNCS 2162 402–410.
[21] Knuth, D.: Seminumerical Algorithms. The Art of Computer Programming, vol. 2. Addison-Wesley (1981)[22] Kocher, P.C.: Timing attacks on implementations of DH, RSA, DSS andother systems. CRYPTO’96, LNCS 1109 (1996) 104–113[23] Kocher, P.C., Jaffe, J., Jun, B.: Differential power analysis. CRYPTO’99,
LNCS 1666 (1999) 388–397[24] Liardet, P. Y., Smart, N.: Preventing SPA/DPA in ECC systems using theJacobi form. CHESS 2001, LNCS 2162 391–401.
[25] Montgomery, P.L.: Modular multiplication without trial division. Math.
Comp. 44:170 (1985) 519–521[26] Montgomery, P.L.: Speeding the Pollard and elliptic curve methods offactorization. Math. Comp. 48:177 (1987) 243–164

24

[27] Okeya, O., Sakurai, K.: Efficient Elliptic Curve Cryptosystems from a
Scalar Multiplication Algorithm with Recovery of the y-Coordinate on a
Montgomery-Form Elliptic Curve. Cryptographic Hardware and Embedded
Systems, LNCS 2162 (2001) 126–141[28] G. Orlando and C. Paar. A scalable GF(p) elliptic curve processor architecture for programmable hardware. In Proceedings of Workshop on Cryptograpic Hardware and Embedded Systems (CHES 2001)[29] Posch, K.C., Posch, R.: Modulo reduction in residue number systems. IEEE
Transaction on Parallel and Distributed Systems 6:5 (1995) 449–454[30] Quisquater, J.J., Samyde, D.: ElectroMagnetic Analysis (EMA): Measures
and Countermeasures for Smart Cards. e-smart 2001, LNCS 2140 (2001)
200–210[31] Shenoy, A.P., Kumaresan, R.: Fast base extension using a redundant modulus in RNS. IEEE Transactions on Computer 38:2 (1989) 292–296[32] Sanu, M.O., Swartzlander, E.E., Chase, C.M.: Parallel Montgomery Multipliers. 15th IEEE International Conference on Application-Specific Systems,
Architectures and Processors (ASAP’04) (2004) 63–72[33] Solinas, J.: Generalized Mersenne numbers. Research Report CORR-99-39,
Center for Applied Cryptographic Research, University of Waterloo (1999)[34] Szabo, N.S., Tanaka, R.I.: Residue Arithmetic and its Applications toComputer Technology. McGraw-Hill (1967)25

Traces of the group law on the Kummer
surface of a curve of genus 2 incharacteristic 2
Sylvain Duquesne
Universités Montpellier II,
Laboratoires I3M, UMR CNRS 5149 et LIRMM, UMR CNRS 5506
CC 051, Place Eugène Bataillon, 34005 Montpellier Cedex, France.
duquesne@math.univ-montp2.fr

Abstract
In the beginning of the 90’s, Flynn gave an explicit descriptionof the Jacobian of a genus 2 hyperelliptic curve allowing to perform
efficient arithmetic on these objects. In this paper, we give a generalization of the work done by Flynn when the ground field has characteristic 2. More precisely we give an explicit description of both theJacobian and the Kummer surface. We also give (and explain how wefound them) explicit formulas for the structure of the group law on the
Jacobian that is preserved on the Kummer surface.

Contents
Introduction

2

1 The Kummer surface in genus 2 and odd characteristic
1.1 Description of the Jacobian . . . . . . . . . . . . . . . . . . .
1.2 Description of the Kummer surface . . . . . . . . . . . . . . .
1.3 Traces of the group law . . . . . . . . . . . . . . . . . . . . .
1.4 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3
3
4
4
5

2 Description of the Jacobian as a P15 embedding in characteristic 2
61

3 Description of the Kummer surface as a P 3 embedding incharacteristic 2
94 Traces of the group law in characteristic 2
11
4.1 Addition of an element of order 2 . . . . . . . . . . . . . . . . 11
4.2 Biquadratic forms . . . . . . . . . . . . . . . . . . . . . . . . 12
4.3 Multiplication-by-2 map . . . . . . . . . . . . . . . . . . . . . 17
Appendix A

18

Appendix B

20

References

25

Introduction
During the 90’s, Victor Flynn provides many tools for the explicit arithmetic on Jacobians of genus 2 hyperelliptic curves which are gathered in[Cas-Fly 96]. He first gave in [Fly 90] an explicit description of such Jacobians as a P15 embedding and therefore brings to the community a new tool
to perform computations on such curves. However, this explicit description
was heavy to manipulate in practice. Flynn solved this problem in [Fly 93]
by introducing the Kummer surface as an embedding in P 3 . This description is, of course, simpler but the group structure is lost in passing fromthe Jacobian to the Kummer surface. Fortunately, traces of this group law
remain and Flynn computed them. He deduced several applications of thiswork as in [Fly 95], [Fly-Sma 97] or [Fly 97]. All this applications were on
fields of characteristic 0 (and even on Q or number fields) so that he neverneeds to consider the case of characteristic 2. In [Sma-Sik 99] and [Duq 05],
applications of this Kummer surface to cryptography are given. As the characteristic 2 is often used in cryptography, it is interesting to generalize thework of Flynn to characteristic 2. Of course other applications could be find,but this one was our first motivation.
All the formulas obtained in this paper are available in Maple or Magma
format on my web site http://www.math.univ-montp2.fr/~duquesne.

2

1

The Kummer surface in genus 2 and odd characteristic

In this section, we suppose that the characteristic of the ground field k is
not 2 and consider curves C of genus 2 in the form
C : y 2 = f (x),where
f (x) = f6 x6 + f5 x5 + f4 x4 + f3 x3 + f2 x2 + f1 x + f0 ∈ k[x]has no multiple factors. Every curve of genus 2 defined over k is birationallyequivalent over k to such a curve.

1.1

Description of the Jacobian

The Jacobian, denoted by J in the following, is an algebraic variety whose
points correspond to the elements of Pic 2 , the group of the divisor classes ofdegree 2 divisors modulo principal divisors. This means that an element of
the Jacobian can be identified with a pair of points on the curve. Such anelement is defined over k if the two points are in k or if they are conjugate
over a quadratic extension of k.
In [Fly 90] and [Cas-Fly 96], Flynn explains how to realize an embedding of the Jacobian in P15 (k). He uses a theorem of Lefschetz ([Lan 82],
p. 105) setting up that a basis of L (2(Θ + + Θ− ))1 gives such a projective
embedding of the Jacobian. L (2(Θ+ + Θ− )) is equivalent to the space ofsymmetric functions on C × C which have at most a double pole at infinity, apole of any order at the neutral element O, and are regular elsewhere. Suchfunctions form a vector space of dimension 16 thanks to the Riemman-Rochtheorem. Therefore, Flynn describes the Jacobian by exhibiting 16 independent functions in L (2(Θ+ + Θ− )) that we will not reproduce here.
Afterward, Flynn studies the behaviour of these 16 basis element in theneighbourhood of O. He deduces from this study a basis for the quadratic
relations between the 16 functions. There are 72 such relations (available
on the ftp site of Flynn) and they form a set of defining equations for theJacobian.
1

Θ+ and Θ− are the images of the curve C in the Jacobian via the embedding P 7→
P − ∞+ and P 7→ P − ∞− , where ∞+ and ∞− are the two branches of the singularity of
C at infinity.

3

1.2

Description of the Kummer surface

Among the 16 functions defining the Jacobian in P 15 , 10 are even, in thesense that the negation on the Jacobian leaves them unchanged.
Of these 10 even functions, there are 4 functions which give a basis for thevector space L ((Θ+ + Θ− )). These functions are providing a basis in P 3
for the Kummer surface. More precisely, if an element of the Jacobian isrepresented by the two points on the curve (x 1 , y1 ) and (x2 , y2 ), these 4functions are
k1 = 1k2 = x 1 + x 2
k3 = x 1 x2
k4 =1
[2f6 (x1 x2 )3 + f5 (x1 + x2 )(x1 x2 )2 + 2f4 (x1 x2 )2 +(x1 − x2 )2f3 (x1 + x2 )x1 x2 + 2f2 x1 x2 + f1 (x1 + x2 ) + 2f0 − 2y1 y2 ]We let κ the projection from the Jacobian to P 3 defined by the choice of
these 4 functions among the 16 defining the Jacobian. The image of thisprojection is the Kummer surface K. The map κ identifies ±. Elements oforder 2 are injected into K and all other elements κ(A) have precisely ±A
as pre-images. Moreover, Flynn proves that these 4 functions are satisfying
an explicit homogeneous quartic equation of total degree 4 and of degree
at most 2 in k4 . This quartic is defined over Z[f0 , . . . , f6 ] and is given in[Fly 93] and on the ftp site of Flynn.
It is of course preferable to work with the simpler Kummer surface inP3 rather than with the Jacobian in P15 . It is however not always possible
because the group law on the Jacobian is not preserved in the Kummer surfaces. Fortunately, traces of this group law remain on the Kummer surface.

1.3

Traces of the group law

The obstruction for the group law to be preserved on the Kummer surface
is that one cannot distinguish an element B and its opposite −B. Hence, if
we want to add an element A and B, there are 4 possibilities for the result
namely A + B, −A − B, A − B or −A + B. There is no ambiguity between
A + B and −A − B (and between A − B and −A + B) because they map to
the same element in the Kummer surface. On the contrary, there is an ambiguity between A+B and A−B which are not equal in the Kummer surface.

4

The simplest case to treat is the addition of an element B of order 2.
Indeed, in this case, A + B = A − B so that this operation is well definedon the Kummer surface. It is in fact a linear map on P 3 and is given by a
4 × 4 matrix. Flynn computes this matrix in [Fly 93] by formally adding an
arbitrary element and an element of order 2.
A second useful piece of structure on the Kummer surface is the additionof two elements if their difference is known. Indeed, there is no ambiguity
between A + B and A − B if A − B is already known. More precisely, Flynn
proves that there exist biquadratic forms ϕ ij defined over Z[f0 , . . . , f6 ] suchthat projectively
ϕij (κ(A), κ(B)) = ki (A + B)kj (A − B) + ki (A − B)kj (A + B).
Moreover, he gives these biquadratic forms explicitly in [Fly 93]. The way
Flynn computes them is very clever. Instead of performing a direct algebraic manipulation with 2 generic elements of the Jacobian, he first assumes
that B is an element of order 2 but keep its coordinates in the generic form.
Thus, he can use the matrix of the addition of an element of order 2 tocompute the biquadratic forms ϕij . Of course, these forms are only valid, apriori, if B is an element of order 2, but Flynn proves that the formulas heobtains are in fact valid for any element B.
Finally, Flynn deduces formulas for the multiplication-by-2 map fromthese biquadratic forms. This map is of course well defined on the Kummer
surface as there is no ambiguity between A + A and A − A = O.
Using an easy induction argument, it follows that the multiplication-by-n
map can also be defined on the Kummer surface and is explicit.

1.4

Applications

Flynn provides several applications of these traces of the group law. In[Fly 95], he determines explicit height constants for Jacobians of hyperelliptic curves. These constants are necessary to perform the last step of thecomputation of the generators of the Jacobian (which is finitely generated
if the base field is a number field). This step is called the infinite descentand is detailed in [Fly-Sma 97].
Last but not least, he deduces in [Fly 97] an explicit and efficient algorithm
to compute the rational points on the curve when the rank of the Jacobian
is 1 (i.e. when the condition of application of the Chabauty’s theorem is5satisfied).
More recently, I used the Kummer surface and the traces of the groupfor cryptographic purposes. The multiplication-by-n map is the central toolin cryptography based on algebraic curves. Flynn already noticed that thismap was well defined on the Kummer surface but gave an inefficient algorithm for its computation. I give in [Duq 05] a new algorithm which is on
the one hand more efficient and on the other hand well adapted for cryptographic applications in the real life.
All the applications given by Flynn are on a ground field of characteristic
0 (and even on Q or on a number field). Thus Flynn did not need tocomplicate its computations by considering the case of the characteristic
2. However, in cryptography, fields of characteristic 2 are often used, sothat a generalization of the work done by Flynn to the characteristic 2 isinteresting. Of course, this does not exclude other applications in the future.

2

Description of the Jacobian as a P15 embedding
in characteristic 2

The situation in characteristic 2 is very different of the odd characteristic.
In fact a genus 2 hyperelliptic curve in characteristic 2 is not defined by anequation of the form
C : y 2 = f (x),but by an equation of the form
C2 : y 2 + h(x)y = f (x),where
h(x) = h2 x2 + h1 x + h0 and
f (x) = f6 x6 + f5 x5 + f4 x4 + f3 x3 + f2 x2 + f1 x + f0
are polynomials in k[x] satisfying some conditions ensuring the regularity of
the curve. That is one of the reason why Flynn preferred to exclude this case.
An element of the Jacobian can still be represented by two points on
the curve and we will always use this representation in the following. The
opposite of an element is given by−{(x1 , y1 ), (x2 , y2 )} = {(x1 , y1 + h(x1 )), (x2 , y2 + h(x2 ))}6

The methodology used by Flynn in [Fly 90] and [Cas-Fly 96] to realize anembedding of the Jacobian in P15 (k) is valid for any ground field k. Thus,a projective embedding of the Jacobian is given by the vector space of symmetric functions on C × C which have at most a double pole at infinity (ielarge at worst like x21 x22 at infinity), a pole of any order at the neutral element O, and are regular elsewhere. The dimension of this vector space is 16(by the Riemann-Roch theorem) and we exhibit 16 independent functions.
These 16 functions form a basis so that they entirely describe the Jacobian
as a P15 embedding.
As in odd characteristic, it is easy to find functions which are regular at
O and those which have a simple pole. The situation is more complicatedfor functions having a pole of higher order. Indeed, the derivation cannot
be used in characteristic 2 to find such order.
All the functions we will construct have (x 1 + x2 )n as a denominator.
Thus, remembering that the neutral element is represented by a pair ofpoints on the curve of the form {(x1 , y1 ), (x1 , y1 + h(x1 ))}, it is sufficient(and easy) to prove that their numerator does not vanish on such pairsof points to prove that they have a pole of order n at O. However, wehave to prove that they have no other pole. Because the denominators
are a power of (x1 + x2 ), we just have to prove that {(x1 , y1 ), (x1 , y1 )}is not a pole. Then, we have to prove that the numerators have a zeroof order n at {(x1 , y1 ), (x1 , y1 )}. For this, we introduce the ideal M ofk[x1 , y1 , x2 , y2 ]/(P1 , P2 ) (where Pi = yi2 + h(xi )yi + f (xi )) generated by(x1 + x2 ) and (y1 + y2 ). By this way, a polynomial has a zero of ordern at {(x1 , y1 ), (x1 , y1 )} if and only if it lies in M n . The ideal M is in fact
principal, generated by (x1 + x2 ). Moreover, (y1 + y2 ) can be written as amultiple of (x1 + x2 ) in any M n (by induction) thanks to a relation deduced
from the defining equation of the curve and given here :h(x2 )(y1 + y2 ) = (y1 + y2 )2 + f6 (x1 + x2 )6 + f5 (x1 + x2 )5 + f4 (x1 +x2 )4 + (f3 + f5 x1 x2 )(x1 + x2 )3 + (f2 + f6 x21 x22 + h2 y1 )(x1 + x2 )2 +(f1 + f3 x1 x2 + f5 x21 x22 + h1 y1 )(x1 + x2 )(*)

Using these tools, we can find all the symmetric functions on C 2 × C2
which are large at worst like x21 x22 at infinity, have a pole of any order at theneutral element O, and are regular elsewhere. We use for this a computer
algebra package such as Maple or Magma and we obtain the following theorem
Theorem 1. The vector space of symmetric functions on C 2 ×C2 which have7

at most a double pole at infinity, a pole of any order at the neutral element
O, and are regular elsewhere is generated by the following 16 independentfunctions :Double zero at O
s2 = (x1 + x2 )2
Simple zero at Os = x 1 + x2
Regular non-zero at O
u = 1
p = x 1 x2
p2 = x21 x22
Simple pole at O
α0 =
α1 =
α2 =
α3 =

y1 + y 2
x1 + x 2
x2 y1 + x 1 y2
x1 + x 2
x22 y1 + x21 y2
x1 + x 2
3
x2 y1 + x31 y2
x1 + x 2

Double pole at O
β0 =
β1 =


(x1 + x2 ) f5 x21 x22 + f3 x1 x2 + f1 + h(x2 )y1 + h(x1 )y2(x1 + x2 )2(x1 +x2 )(f6 x31 x32 +f4 x21 x22 +f2 x1 x2 +f0 +y1 y2 )+x1 h(x1 )y2 +x2 h(x2 )y1(x1 +x2 )2

β2 = x 1 x2 β0
Triple pole at O
γ1 = α0 β0 + f6 (x1 + x2 ) h2 x21 x22 + h1 x1 x2 (x1 + x2 ) + h0 (x1 + x2 )2 +f5 x1 x2 α18γ2 = α0 β1 + x21 + x22 + x1 x2 (f5 α2 + f6 α3 ) + (f4 + f5 (x1 + x2 ))α1 x1 x2 +
f6 x1 x2 h2 x21 x22 + h1 (x1 + x2 )x1 x2 + h0 (x1 + x2 )2
Quadruple pole at O
δ = β02
The most complicated cases are γ0 and γ1 . We notice that even if a termof degree 3 in x1 appears in the expressions given above, these functions are
not larger than x21 x22 at infinity because some simplifications hold when we
expand formulas. However, we prefer to give them in this form because it ismuch more simple than the expanded form.
These functions are difficult to find because we have to describe all thepossibilities for symmetric functions on C 2 × C2 which have (x1 + x2 )3 as adenominator and are large at worst like x 21 x22 at infinity. Then we have to
use that they have a pole of order 3 at O, and are regular elsewhere to get
sufficiently many constraints on the functions. It is however much more easy
to verify that the functions we provide are satisfying the required conditions.
Indeed, one just have to check that their numerator is in M 3 .
Of course, it is also easy to check that the 14 other functions given aresatisfying the required conditions. Afterwards, we verify by algebraic computation that these 16 functions are independent to complete the proof of
the theorem.
Finally, these 16 functions are defining an embedding of the Jacobian in
P15 (k). Moreover, using the same method than Flynn (the local behaviourof these functions in the neighbourhood of O), it is possible to determine abasis for the quadratic relations between these 16 functions and the Jacobian
is given by these quadratic relations.

3

Description of the Kummer surface as a P3 embedding in characteristic 2

By analogy with the terminology used by Flynn, we call “even” a function
which is invariant under the map
k[x1 , y1 , x2 , y2 ]/(P1 , P2 ) −→k[x1 , y1 , x2 , y2 ]/(P1 , P2 )(x1 , y1 , x2 , y2 )7−→ (x1 , y1 + h(x1 ), x2 , y2 + h(x2 ))9

Among the 16 functions describing the Jacobian and given in Theorem 1, 9
are even and only 4 of them are large at worst like x 1 x2 at infinity, (namelyu, s, p and β0 ) and then provide a basis in P3 for the Kummer surface. For
convenience, we introduce a new labelling so that
k1 = 1k2 = x 1 + x 2
k3 = x 1 x2
(x1 + x2 ) f5 x21 x22 + f3 x1 x2 + f1 + h(x2 )y1 + h(x1 )y2
k4 =(x1 + x2 )2The Kummer surface K2 (k) is then the image of the projection from theJacobian to P3 (k) defined by the choice of these 4 functions among the 16
defining the Jacobian.
Proposition 1. Let the map
κ2 :J2 (k)−→K2 (k){(x1 , y1 ), (x2 , y2 )} 7−→ [k1 , k2 , k3 , k4 ]• This map identifies an element and its opposite.
• The elements of order 2 are injected into K 2 and all other elementsκ2 (A) in K2 have precisely A and −A as pre-images.
• The functions k1 , k2 , k3 and k4 satisfy an explicit homogeneous quartic
K of total degree 4 and of degree at most 2 in k 4 . The Kummer surface
is defined by K(k1 , k2 , k3 , k4 ) = 0.
The first assumption is trivial, because the 4 functions k 1 , k2 , k3 and k4
have been chosen among even functions.
Concerning the second assumption, it is trivial that k 2 and k3 are completely determining x1 and x2 . Thus, there are only 4 possibilities for the
pre-images namely• A = {(x1 , y1 ), (x2 , y2 )} itself,• {(x1 , y1 + h(x1 )), (x2 , y2 )},• {(x1 , y1 ), (x2 , y2 + h(x2 ))} and• −A = {(x1 , y1 + h(x1 )), (x2 , y2 + h(x2 ))}.
10

If {(x1 , y1 +h(x1 )), (x2 , y2 )} is a pre-image, it must have the same k 4 than A.
This implies that either h(x1 ) or h(x2 ) equals 0. The situation is of course
the same if {(x1 , y1 ), (x2 , y2 + h(x2 ))} is a pre-image. Hence, if h(x1 ) andh(x2 ) are both non-zero, the only possibilities for pre-images are A and −A.
If either h(x1 ) or h(x2 ) equals 0, then only 2 of the 4 possibilities for the
pre-images are different and this yields again to A and −A as pre-images. Finally, the elements of order 2 are exactly those such that h(x 1 ) = h(x2 ) = 0
and there is, in this case, only one pre-image.
The third assumption is proved using a formal computation of k 42 . We
obtain an equation of the form
K2 k42 + K1 k4 + K0 = 0.
where K0 , K1 and K2 are symmetric expressions in x1 and x2
K2 = (x1 + x2 )2
K1 = h(x1 )h(x2 )
h(x1 )h(x2 )(x1 +x2 )(f5 x21 x22 +f3 x1 x2 +f1 )+h(x2 )f (x1 )+h(x1 )f (x2 )+K0 =(x1 +x2 )22
2(f5 x1 x2 + f3 x1 x2 + f1 )2
Despite the appearance, the term K0 is a symmetric polynomial. Thus, we
can write K0 , K1 and K2 as polynomials in terms of k1 , k2 and k3 .
K2
K1
K0

4

=
=
=

k22
h20 k13 + h21 k3 k12 + h0 h1 k2 k12 + h22 k32 k1 + h2 h1 k2 k3 k1 + h0 h2 k22 k1
f12 + h21 f0 + h20 f2 + h1 h0 f1 k14 +(h20 f3 +h2 h0 f1 )k2 k13 +(h2 h1 f1 +h1 h0 f3 )k3 k13 +(h22 f0 +h20 f4 )k22 k12 +(h2 h0 f3 +h20 f5 +h22 f1 )k2 k3 k12 +(f32 +h22 f2 +h21 f4 +h0 h1 f5 +h1 h2 f3 +h20 f6 )k32 k12 +h20 f5 k23 k1 +(h21 f5 +h2 h0 f5 )k32 k2 k1 + h2 h1 f5 k33 k1 + h20 f6 k24 + h21 f6 k32 k22 + (f52 + h22 f6 )k34

Traces of the group law in characteristic 2

We will now consider the structure of the Jacobian which is preserved by
the map κ2 into the Kummer surface.

4.1

Addition of an element of order 2

Let B be an element of order 2 on the Jacobian represented by the coupleof points {(x1 , y1 ), (x2 , y2 )}. Such an element is invariant under the map
which send an element to its opposite so that both x 1 and x2 are roots of11

h. We have already seen that the addition of B with an arbitrary element
A was defined on the Kummer surface because A + B = A − B. As thisoperation is linear, it can be represented by a 4 × 4 matrix. To compute thismatrix, we use the same method than Flynn, namely we performe a direct
algebraic manipulation using the geometric description of the group law on
the Jacobian. We do not give details of this computation here because wewill give them in the next section in a more general case. Anyway, it is easy
to obtain the 3 first lines of the matrix. To obtain the fourth, we use thefact that the addition by an element of order 2 is an involution so that thesquare of the matrix must be the identity of P 3 . Finally, we have thatki (A + B) =4
X

wij kj (A)(i = 1, 2, 3, 4)

j=1

where the wij are given in Appendix A. Let us note that they are given interm of the coefficients of the curve and in term of x 1 , x2 , y1 and y2 . It is
possible, as Flynn, to give them only in terms of the coefficients of the curve
but this involves square roots of these coefficients. The expressions obtained
are more complicated so that we do not give them.

4.2

Biquadratic forms

In odd characteristic, Flynn deduced the biquadratic forms ϕ ij such thatprojectively
ϕij (κ(A), κ(B)) = ki (A + B)kj (A − B) + ki (A − B)kj (A + B)
from the matrix of the addition of an element of order 2. This cannot beapplied in characteristic 2. Indeed, if B is an element of order 2, these expressions are all zero. This is a good illustration of the difficulties we encounterfor the generalization of Flynn’s works to characteristic 2. Therefore, wehave to find the biquadratic forms by using a direct algebraic manipulation
which is much more demanding in term of computing resources. We noticeat this step, that these expressions are also zero if i = j, so that, in thiscase, we will be interested by ki (A + B)ki (A − B) only.
Let us first describe generically the group law on the Jacobian. Let A
and B be two generic elements defined over k of the Jacobian represented by
the couples of points {(x1 , y1 ), (x2 , y2 )} and {(x3 , y3 ), (x4 , y4 )}. Then, there
is a unique polynomial m(x) defined over k of degree 3 such that y = m(x)12passes through the four points (x1 , y1 ), (x2 , y2 ), (x3 , y3 ) and (x4 , y4 ). The
complete intersection of this cubic with C 2 is given bym(x)2 + m(x)h(x) = f (x)y = m(x)This intersection provide two new points (x 5 , y5 ) and (x6 , y6 ) representing a
new element C on J2 (k) such thatA + B + C = O.
Thus, the opposite of C is the sum of A and B.
To compute the biquadratic forms, we will first formally compute thecoordinates of A + B in the Kummer, and then express the k i (A + B)kj (A −B) + ki (A − B)kj (A + B) in terms of the coordinates of A and B in theKummer.
The first step is to compute the cubic m and does not pose any particular
problem. The second step is the computation of m(x) 2 + m(x)h(x) + f (x)which must vanish. This leads to the vanishing of a polynomial of degree 6
having (x + x1 )(x + x2 )(x + x3 )(x + x4 ) as a factor because (x1 , y1 ), (x2 , y2 ),(x3 , y3 ) and (x4 , y4 ) are satisfying m(x)2 + m(x)h(x) + f (x) = 0. After
performing this exact division, it remains a polynomial of degree 2 whose
coefficients are giving x5 + x6 and x5 x6 . Putting their common denominatorin k1 (A + B), the corresponding numerators are then giving k 2 (A + B) andk3 (A + B). So it is not so difficult to obtain projectively the 3 first coordinates in the Kummer surface of the sum of A and B. These are given as
polynomials symmetric in the (xi , yi )i=1..4 of degree 5 in xi and 1 in yi .
It is much more difficult to obtain a simple expression for the fourthcoordinate. For convenience, we will use in the following [k i (A + B)]i=1..4
to denote the projective coordinates of A + B in the Kummer surface and[1, s, p, β0 ] to specify the affine case so that we have
s =
p =
β0 =

k2 (A+B)
k1 (A+B)
k3 (A+B)
k1 (A+B)
k4 (A+B)
k1 (A+B)= x5 + x6= x 5 x6=

(x5 +x6 )(f5 x25 x26 +f3 x5 x6 +f1 )+h(x6 )y5 +h(x5 )y6(x5 +x6 )2The numerator of β0 can be obtained as a symmetric expression of degree 3
in x5 and x6 using the relations
y5 = m(x5 ) and y6 = m(x6 ).
13

Then we can write this numerator as a function in k 1 (A + B), k2 (A + B) andk3 (A + B). This function is not a polynomial because x 5 + x6 (resp. x5 x6 )must be replaced by k2 (A + B)/k1 (A + B) (resp. k3 (A + B)/k1 (A + B))
so that k1 (A + B)3 appears as a denominator. On the other hand, the denominator of β0 is (x5 + x6 )2 so that, the denominator of β0 (written as afunction of k1 (A + B), k2 (A + B) and k3 (A + B)) is k2 (A + B)2 k1 (A + B).
Thus, we have to multiply the original k 1 (A + B), k2 (A + B) and k3 (A + B)
by k2 (A + B)2 if we want a result without denominators. This leads to verylarge expressions of degree 15 in the x i . This is not reasonable (rememberthat there are 18 variables, namely the x i , the yi and the coefficients of thecurve and that we want to compute ki (A + B)kj (A − B)).
As y5 = m(x5 ), y6 = m(x6 ) and β0 is regular at {(x5 , y5 ), (x5 , y5 )}, β0
must in fact be a polynomial. This will eliminate the term (x 5 + x6 )2 inthe denominator so that we can hope a simpler result. Indeed, using therelation (*), we have
β0 = f6 (x5 + x6 )4 + f5 (x5 + x6 )3 + f4 (x5 + x6 )2 + (f3 + f5 x6 x5 )(x5 + x6 ) +h2 (m(x5 ) + m(x6 )) + (f2 + f6 x25 x26 ) + (m3 ((x5 + x6 )2 + x5 x6 ) + m2 (x5 + x6 ) +m1 )2 + h1 (m3 ((x5 + x6 )2 + x5 x6 ) + m2 (x5 + x6 ) + m1 )where m(x) = m3 x3 + m2 x2 + m1 x + m0 is the cubic polynomial introducedin the beginning of this section. This is the most natural way to eliminate
denominators in k4 (A + B). Unfortunately, this is worst than the previous
situation because this symmetric polynomial has degree 4 so that the denominator of β0 (written as a function of k1 (A + B), k2 (A + B) and k3 (A + B))
is k1 (A + B)4 and we have to multiply the original k 1 (A + B), k2 (A + B)
and k3 (A + B) by k1 (A + B)3 if we want a result without denominators.
We choose an intermediate solution which consists in only simplifying
β0 by x5 + x6 . This is simpler than the previous case since we do not need
the relation (*). We have that0withβ0 = x5B+x6

B0 = f5 x25 x26 + f3 x5 x6 + f1 + m3 (h2 x25 x26 + h1 x5 x6 (x5 + x6 ) + h0 (x25 + x5 x6 +x26 )) + m2 (h1 x5 x6 + h0 (x5 + x6 )) + m1 (h2 x5 x6 + h0 ) + m0 (h2 (x5 + x6 ) + h1 )In this case, the symmetric polynomials in x 5 and x6 appear only in degree 2 in B0 so that the denominator of β0 (written as a function of k1 (A +14B), k2 (A + B) and k3 (A + B)) is k1 (A + B)k2 (A + B) and we have only tomultiply the original k1 (A + B), k2 (A + B) and k3 (A + B) by k2 (A + B) if
we want a result without denominators. This is better than the two previous cases but still not satisfying. Indeed, for the reasons explained above,the expression obtained by this way for B 0 must be divisible by k2 (A + B).
However this property of divisibility holds only inF2hf [x1 , x2 , x3 , x4 , y1 , y2 , y3 , y4 ]/(P1 , P2 , P3 , P4 )where F2hf = F2 [h0 , h1 , h2 , f0 , f1 , f2 , f3 , f4 , f5 , f6 ] and Pi = yi2 + h(xi )yi +f (xi ). A direct computation of the quotient of B 0 by k2 (A + B) in thisring is not possible even with modern computer algebra package as Magma.
Thus, We choose to compute it by myself using a specific way. The idea is to
discover and use specific properties of the quotient to reduce the complexityof the computation.
In order to be able to exploit such specific properties, we have to proceedby identification. The general strategy of the identification method is asfollows :• the polynomials B0 and k2 (A + B) have degree 10 and 5 in each xi(and of course 1 in each yi ) so that we construct a formal polynomial
Q of degree 5 in each xi (and of course 1 in each yi ),• we then formally compute Qk2 (A + B) and identify the coefficientswith those of B0 ,• this provides a (sparse) linear system of equations whose variables are
the coefficients of Q,• finally, the coefficients of the quotient are recovered by linear algebra.
Of course there exist much better algorithms for computing a quotient but
they cannot conclude with B0 and k2 (A + B) as input and we cannot speed
them up if we have specific properties for the quotient. On the contrary, if weproceed by identification, it is easy to take such new properties into account.
Let us now find those specific properties. First, we can exploit the factthat our polynomials are symmetrical in the couples (x i , yi ) so that• the term in degree 0 in the yi is a symmetric polynomial in the xi ,• the term in y1 is a symmetric polynomial in x2 , x3 and x4 ,15

• the term in yi can be deduced from the term in y1 by exchanging xi
and x1 ,• the term in y1 y2 is a symmetric polynomial in x3 and x4 ,• the term in yi yj can be deduced from the term in y1 y2 by exchanging
xi and x1 on the one hand and xj and x2 on the other hand,• the same properties holds for products of 3 and 4 y i but we do notneed them.
These properties allow to reduce the number of variables but more than
600 variables are necessary to formally describe Q and is it always too complicated to perform linear algebra in this case (remember that the matrix
obtained has its coefficients in F2 [h0 , h1 , h2 , f0 , f1 , f2 , f3 , f4 , f5 , f6 ]). Fortunately, we can do better using an experimental approach. Our idea, in order
to find specific properties of the quotient, is to compute this quotient in various simpler cases. For example, evaluating most of the 18 variables yields
to a simpler ring where the computation of the quotient can be performed.
Putting together the results obtained, we deduce properties which hold in all
examples and then assume that they hold in the general case. The properties
we obtain by this way areQ• the term in degree 0 in the yi is divisible by i6=j (xi + xj ),• the term in y1 is divisible by (x2 + x3 )(x2 + x4 )(x3 + x4 ) and its degreein x1 is bounded by 2 (instead of 5),• the term in y1 y2 equals h(x3 )h(x4 )(x1 + x2 )2 (x3 + x4 )2 ,• there are no terms of total degree greater than or equal to 3 in the y i .
These properties are in fact very constraining for the quotient so that, finally, only 75 variables are required to formally describe Q. The linear
algebra step can now be performed in some seconds on Magma. Of course,
this computation is done under assumptions, but it is very easy to verify
that the result obtained multiplied by k 2 (A + B) equals B0 .
Finally, we put this quotient in k4 (A + B) so that [k1 (A + B), k2 (A +B), k3 (A + B), k4 (A + B)] are the coordinates in the Kummer of A + B.
These are given as polynomials symmetric in the (x i , yi )i=1..4 of degree only
5 in xi and 1 in yi .

16

Of course, the addition is not defined on the Kummer surface so that wecannot write ki (A + B) in terms of the ki (A) and the ki (B) but we can do it
for the expressions of the form ki (A + B)kj (A − B) + εij ki (A − B)kj (A + B)
(where εij = 1 if i 6= j and 0 if i = j). This is not difficult to do so that we
do not give the details. However, at first glance, the formulas obtained are
not biquadratic in the ki (A) and the ki (B). They are, in fact, all divisible
by k2 (A)2 k2 (B)2 when i 6= j and the quotients are biquadratic which isencouraging. This is not the case if i = j but we succeed in bypassing thisproblem using a trick. Indeed, for each i, it is possible to found an appropriate linear combination of K(A) and K(B) (K is the defining equationof the Kummer surface so that such a linear combination is in fact equal
to zero) such that adding this linear combination to the formula for i = j
ensure that the modified formula is also divisible by k 2 (A)2 k2 (B)2 .
We notice that this approach is close of the approach used by Flynn in
odd characteristic since he also used a particular case to deduce the generalcase.
The above discussion and the computations we have done with Maple
and Magma may be summarized by the following theorem
Theorem 2. Let A, B in J2 (k) and κ2 (A), κ2 (B) their image in K2 (k).
Then, for i, j ∈ {1, . . . , 4}, there exist explicit biquadratic forms ϕ ij definedover F2 [h0 , h1 , h2 , f0 , f1 , f2 , f3 , f4 , f5 , f6 ] such that the 4×4 symmetric matrix(ϕij (κ2 (A), κ2 (B))) is projectively equal to(ki (A + B)kj (A − B) + εij ki (A − B)kj (A + B))
where εij = 1 if i 6= j and 0 if i = j. These biquadratic forms are explicitly
given in Appendix B.

4.3

Multiplication-by-2 map

The last trace of the group law we are interested in is the multiplication-by2 map and more generally, the multiplication-by-n map. We have alreadyseen that the multiplication-by-2 map was well defined on the Kummer
surface. Of course, we can compute formulas by using a direct algebraic
manipulation, but they can in fact be deduced from the biquadratic forms.
Indeed, as the coordinates of O in the Kummer are [0, 0, 0, 1], we have that,projectively
ϕi4 (κ2 (A), κ2 (A)) = ki (2A)
17

The explicit formulas are given in Appendix B.
As in the case of odd characteristic, using an easy induction argument,
we prove that the multiplication-by-n map can be defined on the Kummer
surface and is explicit. This argument gives an algorithm that computes themultiplication-by-n map with a complexity in O(n) whereas algorithms inO(log(n)) exist as explained in [Duq 05].

Conclusion
Despite many technical problems due to the passing from the odd characteristic to the characteristic 2, we succeed in giving a generalization of thework done by Victor Flynn in the beginning of the 90’s. Indeed, we givean explicit description of Jacobians of genus 2 hyperelliptic curves in characteristic 2 as a P15 embedding. We also describe the Kummer surface asa P3 embedding (more suitable for computations) and provide the traces of
the group law on the Kummer surface (addition of an element of order 2,
biquadratic forms enabling the addition of 2 elements if their difference is
known, multiplication-by-2 map). In this way, we bring new tools to peopleinterested in the explicit arithmetic of curves of genus 2 in characteritic 2. In
particular, the formulas we provide can be used to perform a multiplicationby-n map for cryptographic applications. However a detailed study of theseformulas is necessary to obtain a competitive algorithm in this domain, but
we are sure that it can be done.

Appendix A
Let B be an element of order 2 on the Jacobian represented by the coupleof points {(x1 , y1 ), (x2 , y2 )}. The addition by B in the Kummer surface is

18

given by the matrix W whose coefficients are
w11
w12
w13
w14
w21
w22
w23
w24
w31
w32
w33
w34
w41
w42
w43
w44

=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=

f1 h22 + f3 h0 h2 + f5 h20
f 5 h1 h0
f5 h21h 1 h2h2 (y1 x22 + x21 y2 ) + h0 h1 f3
h2 (y1 x2 + x1 y2 ) + f1 h22 + f3 h0 h2 + f5 h20
h2 (y1 + y2 ) + h2 h1 f3
h21
h2 (y1 x32 + x31 y2 ) + h21 f1
h2 (y1 x22 + x21 y2 ) + h2 h1 f1
h2 (y1 x2 + x1 y2 ) + f1 h22 + f3 h0 h2 + f5 h20
h 1 h0h2 f1 (y1 + y2 ) + h2 f3 (y1 x22 + x21 y2 ) + h1 f3 f1 h2
h2 f5 (y1 x32 + x31 y2 ) + h21 f5 f1
h2 f5 (y1 x22 + x21 y2 ) + f5 h0 h1 f3
f1 h22 + f3 h0 h2 + f5 h20

19

Appendix B
We give here the formulas for the biquadratic forms and for the multiplicationby-2 map on the Kummer surface. For clarity we change the notations anduse• [k1 , k2 , k3 , k4 ] instead of [k1 (A), k2 (A), k3 (A), k4 (A)],• [l1 , l2 , l3 , l4 ] instead of [k1 (B), k2 (B), k3 (B), k4 (B)],• ϕij instead of ϕij (κ2 (A), κ2 (B)),• [δ1 , δ2 , δ3 , δ4 ] instead of [k1 (2A), k2 (2A), k3 (2A), k4 (2A)].
All these formulas are available on my web site at
http://www.math.univ-montp2.fr/~duquesne.

ϕ11 = f6 h20 k12 l22 + f6 h21 k12 l32 + k12 l42 + f6 h20 k22 l12 + (f52 + f6 h22 )k22 l32 + f6 h21 k32 l12 +(f52 + f6 h22 )k32 l22 + k42 l12
ϕ12 = f5 h20 k12 l22 + h0 h2 k12 l2 l4 + f5 h21 k12 l32 + h1 h2 k12 l3 l4 + h0 h2 k1 k2 l1 l4 +f5 h0 h2 k1 k2 l2 l3 + f5 h1 h2 k1 k2 l32 + h22 k1 k2 l3 l4 + h1 h2 k1 k3 l1 l4 + f5 h0 h2 k1 k3 l22 +f5 h1 h2 k1 k3 l2 l3 + h22 k1 k3 l2 l4 + h0 h2 k1 k4 l1 l2 + h1 h2 k1 k4 l1 l3 + f5 h20 k22 l12 +f5 h0 h2 k22 l1 l3 + f5 h0 h2 k2 k3 l1 l2 + f5 h1 h2 k2 k3 l1 l3 + h0 h2 k2 k4 l12 + h22 k2 k4 l1 l3 +f5 h21 k32 l12 + f5 h1 h2 k32 l1 l2 + h1 h2 k3 k4 l12 + h22 k3 k4 l1 l2
ϕ13 = (f1 h0 h2 + f3 h20 )k12 l1 l2 + (f1 h1 h2 + f3 h0 h1 )k12 l1 l3 + h20 k12 l1 l4 +f5 h20 k12 l2 l3 + f5 h0 h1 k12 l32 + h0 h2 k12 l3 l4 + (f1 h0 h2 + f3 h20 )k1 k2 l12 + (f1 h22 +f3 h0 h2 )k1 k2 l1 l3 +h0 h1 k1 k2 l1 l4 +f5 h20 k1 k2 l22 +f5 h0 h1 k1 k2 l2 l3 +h0 h2 k1 k2 l2 l4 +(f1 h1 h2 + f3 h0 h1 )k1 k3 l12 + (f1 h22 + f3 h0 h2 )k1 k3 l1 l2 + (h0 h2 + h21 )k1 k3 l1 l4 +f5 h0 h1 k1 k3 l22 + (f5 h0 h2 + f5 h21 )k1 k3 l2 l3 + h1 h2 k1 k3 l2 l4 + f5 h1 h2 k1 k3 l32 +h22 k1 k3 l3 l4 + h20 k1 k4 l12 + h0 h1 k1 k4 l1 l2 + (h0 h2 + h21 )k1 k4 l1 l3 + f5 h20 k22 l1 l2 +f5 h0 h1 k22 l1 l3 + f5 h20 k2 k3 l12 + f5 h0 h1 k2 k3 l1 l2 + (f5 h0 h2 + f5 h21 )k2 k3 l1 l3 +h0 h2 k2 k4 l1 l2 + h1 h2 k2 k4 l1 l3 + f5 h0 h1 k32 l12 + f5 h1 h2 k32 l1 l3 + h0 h2 k3 k4 l12 +h22 k3 k4 l1 l3
ϕ14 = (f12 h22 + f32 h20 + f6 h40 )k12 l12 + f6 h30 h1 k12 l1 l2 + f6 h20 h21 k12 l1 l3 +(f1 h1 h2 + f3 h0 h1 )k12 l1 l4 + f6 h30 h2 k12 l22 + f6 h20 h1 h2 k12 l2 l3 + f5 h20 k12 l2 l4 +
(f52 h20 + f6 h20 h22 )k12 l32 + f6 h30 h1 k1 k2 l12 + f6 h20 h21 k1 k2 l1 l2 + (f1 f5 h1 h2 +f3 f5 h0 h1 + f6 h0 h31 )k1 k2 l1 l3 + f5 h20 k1 k2 l1 l4 + f6 h20 h1 h2 k1 k2 l22 + (f52 h20 +f6 h0 h21 h2 )k1 k2 l2 l3 + f5 h0 h1 k1 k2 l2 l4 + f6 h0 h1 h22 k1 k2 l32 + f5 h0 h2 k1 k2 l3 l4 +20

f6 h20 h21 k1 k3 l12 + (f1 f5 h1 h2 + f3 f5 h0 h1 + f6 h0 h31 )k1 k3 l1 l2 + f6 h41 k1 k3 l1 l3 +
(f52 h20 + f6 h0 h21 h2 )k1 k3 l22 + f6 h31 h2 k1 k3 l2 l3 + (f5 h0 h2 + f5 h21 )k1 k3 l2 l4 +f6 h21 h22 k1 k3 l32 + f5 h1 h2 k1 k3 l3 l4 + (f1 h1 h2 + f3 h0 h1 )k1 k4 l12 + f5 h20 k1 k4 l1 l2 +h21 k1 k4 l1 l4 + f6 h30 h2 k22 l12 + f6 h20 h1 h2 k22 l1 l2 + (f52 h20 + f6 h0 h21 h2 )k22 l1 l3 +
(f52 h20 + f6 h20 h22 )k22 l22 + (f52 h0 h1 + f6 h0 h1 h22 )k22 l2 l3 + (f52 h0 h2 + f6 h0 h32 )k22 l32 +f6 h20 h1 h2 k2 k3 l12 + (f52 h20 + f6 h0 h21 h2 )k2 k3 l1 l2 + f6 h31 h2 k2 k3 l1 l3 + (f52 h0 h1 +f6 h0 h1 h22 )k2 k3 l22 + (f52 h21 + f6 h21 h22 )k2 k3 l2 l3 + (f52 h1 h2 + f6 h1 h32 )k2 k3 l32 +f5 h20 k2 k4 l12 +f5 h0 h1 k2 k4 l1 l2 +(f5 h0 h2 +f5 h21 )k2 k4 l1 l3 +(f52 h20 +f6 h20 h22 )k32 l12 +f6 h0 h1 h22 k32 l1 l2 + f6 h21 h22 k32 l1 l3 + (f52 h0 h2 + f6 h0 h32 )k32 l22 + (f52 h1 h2 +f6 h1 h32 )k32 l2 l3 + (f52 h22 + f6 h42 )k32 l32 + f5 h0 h2 k3 k4 l1 l2 + f5 h1 h2 k3 k4 l1 l3
ϕ22 = (f1 h0 h2 + f3 h20 )k12 l1 l2 + (f1 h1 h2 + f3 h0 h1 )k12 l1 l3 + h20 k12 l1 l4 + (f0 h22 +f4 h20 )k12 l22 + (f1 h22 + f3 h0 h2 + f5 h20 )k12 l2 l3 + h0 h1 k12 l2 l4 + (f2 h22 + f32 +f3 h1 h2 + f4 h21 + f5 h0 h1 + f6 h20 )k12 l32 + h21 k12 l3 l4 + (f1 h0 h2 + f3 h20 )k1 k2 l12 +f5 h20 k1 k2 l22 +(f5 h0 h2 +f5 h21 )k1 k2 l32 +h1 h2 k1 k2 l3 l4 +(f1 h1 h2 +f3 h0 h1 )k1 k3 l12 +h1 h2 k1 k3 l2 l4 + f5 h1 h2 k1 k3 l32 + h20 k1 k4 l12 + h0 h2 k1 k4 l22 + h1 h2 k1 k4 l2 l3 +h22 k1 k4 l32 + (f0 h22 + f4 h20 )k22 l12 + f5 h20 k22 l1 l2 + h0 h2 k22 l1 l4 + f6 h21 k22 l32 + k22 l42 +(f1 h22 + f3 h0 h2 + f5 h20 )k2 k3 l12 + h1 h2 k2 k3 l1 l4 + h0 h1 k2 k4 l12 + h1 h2 k2 k4 l1 l3 +(f2 h22 + f32 + f3 h1 h2 + f4 h21 + f5 h0 h1 + f6 h20 )k32 l12 + (f5 h0 h2 + f5 h21 )k32 l1 l2 +f5 h1 h2 k32 l1 l3 + h22 k32 l1 l4 + f6 h21 k32 l22 + h21 k3 k4 l12 + h1 h2 k3 k4 l1 l2 + k42 l22
ϕ23 = (f1 h0 h2 + f3 h20 )k12 l22 + (f1 h1 h2 + f3 h0 h1 )k12 l2 l3 + h20 k12 l2 l4 + (f1 h22 +f3 h0 h2 +f5 h20 )k12 l32 +(f1 h1 h2 +f3 h0 h1 )k1 k2 l1 l3 +h20 k1 k2 l1 l4 +f5 h20 k1 k2 l2 l3 +h0 h1 k1 k2 l2 l4 + h0 h2 k1 k2 l3 l4 + (f1 h1 h2 + f3 h0 h1 )k1 k3 l1 l2 + f5 h20 k1 k3 l22 +(h0 h2 + h21 )k1 k3 l2 l4 + h1 h2 k1 k3 l3 l4 + h20 k1 k4 l1 l2 + h0 h1 k1 k4 l22 + h21 k1 k4 l2 l3 +h1 h2 k1 k4 l32 + (f1 h0 h2 + f3 h20 )k22 l12 + f5 h20 k22 l1 l3 + h0 h1 k22 l1 l4 + (f1 h1 h2 +f3 h0 h1 )k2 k3 l12 +f5 h20 k2 k3 l1 l2 +h21 k2 k3 l1 l4 +h20 k2 k4 l12 +h0 h1 k2 k4 l1 l2 +(h0 h2 +h21 )k2 k4 l1 l3 + (f1 h22 + f3 h0 h2 + f5 h20 )k32 l12 + h1 h2 k32 l1 l4 + h0 h2 k3 k4 l1 l2 +h1 h2 k3 k4 l1 l3
ϕ24 = (f0 h31 h2 + f12 h1 h2 + f1 h20 h22 + f1 h0 h21 h2 + f2 h20 h1 h2 + f3 h30 h2 +f5 h40 )k12 l12 +(f0 h0 h32 +f0 h21 h22 +f1 h0 h1 h22 +f2 h20 h22 +f32 h20 +f4 h30 h2 +f5 h30 h1 +f6 h40 )k12 l1 l2 +(f0 h1 h32 +f1 h0 h32 +f3 h20 h22 +f4 h20 h1 h2 +f5 h30 h2 +f5 h20 h21 )k12 l1 l3 +f6 h30 h1 k12 l22 +f6 h20 h21 k12 l2 l3 +(f1 h1 h2 +f3 h0 h1 )k12 l2 l4 +(f1 f5 h1 h2 +f3 f5 h0 h1 +f6 h20 h1 h2 )k12 l32 + (f0 h0 h32 + f0 h21 h22 + f1 h0 h1 h22 + f2 h20 h22 + f32 h20 + f4 h30 h2 +f5 h30 h1 + f6 h40 )k1 k2 l12 + (f0 h1 h32 + f1 h0 h32 + f3 h20 h22 + f4 h20 h1 h2 + f5 h30 h2 +f5 h20 h21 )k1 k2 l1 l2 +(f0 h42 +f2 h0 h32 +f32 h0 h2 +f3 h0 h1 h22 +f4 h20 h22 +f4 h0 h21 h2 +f5 h0 h31 +f6 h30 h2 +f6 h20 h21 )k1 k2 l1 l3 +(f1 h1 h2 +f3 h0 h1 )k1 k2 l1 l4 +(f1 f5 h0 h2 +f3 f5 h20 + f6 h20 h21 )k1 k2 l22 + (f1 f5 h1 h2 + f3 f5 h0 h1 + f6 h0 h31 )k1 k2 l2 l3 + (f1 h22 +f3 h0 h2 )k1 k2 l2 l4 + f6 h0 h21 h2 k1 k2 l32 + (f0 h1 h32 + f1 h0 h32 + f3 h20 h22 + f4 h20 h1 h2 +21

f5 h30 h2 + f5 h20 h21 )k1 k3 l12 + (f0 h42 + f2 h0 h32 + f32 h0 h2 + f3 h0 h1 h22 + f4 h20 h22 +f4 h0 h21 h2 + f5 h0 h31 + f6 h30 h2 + f6 h20 h21 )k1 k3 l1 l2 + (f1 h42 + f2 h1 h32 +f32 h1 h2 + f3 h0 h32 + f3 h21 h22 + f4 h31 h2 + f5 h20 h22 + f5 h0 h21 h2 + f5 h41 +f6 h20 h1 h2 )k1 k3 l1 l3 + f6 h0 h31 k1 k3 l22 + f6 h41 k1 k3 l2 l3 + f6 h31 h2 k1 k3 l32 + (f1 h1 h2 +f3 h0 h1 )k1 k4 l1 l2 + f5 h20 k1 k4 l22 + (h0 h2 + h21 )k1 k4 l2 l4 + h1 h2 k1 k4 l3 l4 +f6 h30 h1 k22 l12 +(f1 f5 h0 h2 +f3 f5 h20 +f6 h20 h21 )k22 l1 l2 +f6 h0 h31 k22 l1 l3 +f5 h20 k22 l1 l4 +f6 h20 h1 h2 k22 l22 + (f52 h20 + f6 h0 h21 h2 )k22 l2 l3 + f5 h0 h1 k22 l2 l4 + f6 h0 h1 h22 k22 l32 +f5 h0 h2 k22 l3 l4 + f6 h20 h21 k2 k3 l12 + (f1 f5 h1 h2 + f3 f5 h0 h1 + f6 h0 h31 )k2 k3 l1 l2 +f6 h41 k2 k3 l1 l3 + (f52 h20 + f6 h0 h21 h2 )k2 k3 l22 + f6 h31 h2 k2 k3 l2 l3 + (f5 h0 h2 +f5 h21 )k2 k3 l2 l4 + f6 h21 h22 k2 k3 l32 + f5 h1 h2 k2 k3 l3 l4 + (f1 h1 h2 + f3 h0 h1 )k2 k4 l12 +(f1 h22 + f3 h0 h2 )k2 k4 l1 l2 + (h0 h2 + h21 )k2 k4 l1 l4 + f5 h0 h1 k2 k4 l22 + (f5 h0 h2 +f5 h21 )k2 k4 l2 l3 + h1 h2 k2 k4 l2 l4 + f5 h1 h2 k2 k4 l32 + h22 k2 k4 l3 l4 + (f1 f5 h1 h2 +f3 f5 h0 h1 + f6 h20 h1 h2 )k32 l12 + f6 h0 h21 h2 k32 l1 l2 + f6 h31 h2 k32 l1 l3 + f6 h0 h1 h22 k32 l22 +f6 h21 h22 k32 l2 l3 + f5 h1 h2 k32 l2 l4 + (f52 h1 h2 + f6 h1 h32 )k32 l32 + h1 h2 k3 k4 l1 l4 +f5 h0 h2 k3 k4 l22 + f5 h1 h2 k3 k4 l2 l3 + h22 k3 k4 l2 l4
ϕ33 = (f0 h21 + f12 + f1 h0 h1 + f2 h20 )k12 l22 + (f1 h0 h2 + f3 h20 )k12 l2 l3 + (f0 h22 +f4 h20 )k12 l32 + h20 k12 l3 l4 + (f1 h0 h2 + f3 h20 )k1 k2 l1 l3 + h20 k1 k2 l2 l4 + f5 h20 k1 k2 l32 +(f1 h0 h2 + f3 h20 )k1 k3 l1 l2 + h20 k1 k3 l1 l4 + f5 h20 k1 k3 l2 l3 + h0 h1 k1 k3 l2 l4 +h0 h2 k1 k3 l3 l4 + h20 k1 k4 l1 l3 + h20 k1 k4 l22 + h0 h1 k1 k4 l2 l3 + h0 h2 k1 k4 l32 + (f0 h21 +f12 + f1 h0 h1 + f2 h20 )k22 l12 + h20 k22 l1 l4 + f6 h20 k22 l32 + (f1 h0 h2 + f3 h20 )k2 k3 l12 +f5 h20 k2 k3 l1 l3 +h0 h1 k2 k3 l1 l4 +h20 k2 k4 l1 l2 +h0 h1 k2 k4 l1 l3 +(f0 h22 +f4 h20 )k32 l12 +f5 h20 k32 l1 l2 + h0 h2 k32 l1 l4 + f6 h20 k32 l22 + k32 l42 + h20 k3 k4 l12 + h0 h2 k3 k4 l1 l3 + k42 l32
ϕ34 = (f0 h20 h22 +f0 h0 h21 h2 +f0 h41 +f12 h0 h2 +f12 h21 +f1 h0 h31 +f2 h30 h2 +f2 h20 h21 +f3 h30 h1 + f4 h40 )k12 l12 + (f0 h31 h2 + f12 h1 h2 + f1 h20 h22 + f1 h0 h21 h2 + f2 h20 h1 h2 +f3 h30 h2 +f5 h40 )k12 l1 l2 +(f0 h0 h32 +f0 h21 h22 +f1 h0 h1 h22 +f2 h20 h22 +f32 h20 +f4 h30 h2 +f5 h30 h1 + f6 h40 )k12 l1 l3 + f6 h40 k12 l22 + f6 h30 h1 k12 l2 l3 + (f1 h0 h2 + f3 h20 )k12 l2 l4 +(f1 f5 h0 h2 + f3 f5 h20 + f6 h30 h2 )k12 l32 + (f0 h31 h2 + f12 h1 h2 + f1 h20 h22 + f1 h0 h21 h2 +f2 h20 h1 h2 + f3 h30 h2 + f5 h40 )k1 k2 l12 + (f0 h0 h32 + f0 h21 h22 + f12 h22 + f1 h0 h1 h22 +f2 h20 h22 + f4 h30 h2 + f5 h30 h1 + f6 h40 )k1 k2 l1 l2 + (f0 h1 h32 + f1 h0 h32 + f3 h20 h22 +f4 h20 h1 h2 + f5 h30 h2 + f5 h20 h21 )k1 k2 l1 l3 + f6 h30 h1 k1 k2 l22 + f6 h20 h21 k1 k2 l2 l3 +f6 h20 h1 h2 k1 k2 l32 + (f0 h0 h32 + f0 h21 h22 + f1 h0 h1 h22 + f2 h20 h22 + f32 h20 + f4 h30 h2 +f5 h30 h1 + f6 h40 )k1 k3 l12 + (f0 h1 h32 + f1 h0 h32 + f3 h20 h22 + f4 h20 h1 h2 + f5 h30 h2 +f5 h20 h21 )k1 k3 l1 l2 +(f0 h42 +f2 h0 h32 +f32 h0 h2 +f3 h0 h1 h22 +f4 h20 h22 +f4 h0 h21 h2 +f5 h0 h31 +f6 h30 h2 +f6 h20 h21 )k1 k3 l1 l3 +(f1 h1 h2 +f3 h0 h1 )k1 k3 l1 l4 +(f1 f5 h0 h2 +f3 f5 h20 + f6 h20 h21 )k1 k3 l22 + (f1 f5 h1 h2 + f3 f5 h0 h1 + f6 h0 h31 )k1 k3 l2 l3 + (f1 h22 +f3 h0 h2 )k1 k3 l2 l4 +f6 h0 h21 h2 k1 k3 l32 +(f1 h1 h2 +f3 h0 h1 )k1 k4 l1 l3 +h20 k1 k4 l1 l4 +f5 h20 k1 k4 l2 l3 + h0 h1 k1 k4 l2 l4 + h0 h2 k1 k4 l3 l4 + f6 h40 k22 l12 + f6 h30 h1 k22 l1 l2 +(f1 f5 h0 h2 + f3 f5 h20 + f6 h20 h21 )k22 l1 l3 + f6 h30 h2 k22 l22 + f6 h20 h1 h2 k22 l2 l3 +22

f5 h20 k22 l2 l4 + (f52 h20 + f6 h20 h22 )k22 l32 + f6 h30 h1 k2 k3 l12 + f6 h20 h21 k2 k3 l1 l2 +(f1 f5 h1 h2 + f3 f5 h0 h1 + f6 h0 h31 )k2 k3 l1 l3 + f5 h20 k2 k3 l1 l4 + f6 h20 h1 h2 k2 k3 l22 +(f52 h20 + f6 h0 h21 h2 )k2 k3 l2 l3 + f5 h0 h1 k2 k3 l2 l4 + f6 h0 h1 h22 k2 k3 l32 +f5 h0 h2 k2 k3 l3 l4 + (f1 h0 h2 + f3 h20 )k2 k4 l12 + (f1 h22 + f3 h0 h2 )k2 k4 l1 l3 +h0 h1 k2 k4 l1 l4 + f5 h20 k2 k4 l22 + f5 h0 h1 k2 k4 l2 l3 + h0 h2 k2 k4 l2 l4 + (f1 f5 h0 h2 +f3 f5 h20 + f6 h30 h2 )k32 l12 + f6 h20 h1 h2 k32 l1 l2 + f6 h0 h21 h2 k32 l1 l3 + (f52 h20 +f6 h20 h22 )k32 l22 +f6 h0 h1 h22 k32 l2 l3 +(f52 h0 h2 +f52 h21 +f6 h0 h32 )k32 l32 +f5 h1 h2 k32 l3 l4 +h0 h2 k3 k4 l1 l4 + f5 h0 h2 k3 k4 l2 l3 + f5 h1 h2 k3 k4 l32 + h22 k3 k4 l3 l4
ϕ44 = (f02 h42 + f0 f1 h1 h32 + f0 f2 h21 h22 + f0 f32 h21 + f0 f3 h0 h1 h22 + f0 f3 h31 h2 +f0 f4 h41 + f0 f5 h0 h31 + f0 f6 h20 h21 + f12 f2 h22 + f12 f32 + f12 f3 h1 h2 + f12 f4 h21 +f12 f5 h0 h1 + f12 f6 h20 + f12 h0 h32 + f1 f2 h0 h1 h22 + f1 f32 h0 h1 + f1 f3 h0 h21 h2 +f1 f4 h20 h1 h2 + f1 f4 h0 h31 + f1 f5 h30 h2 + f1 f5 h20 h21 + f1 f6 h30 h1 + f22 h20 h22 +f2 f32 h20 + f2 f3 h20 h1 h2 + f2 f4 h20 h21 + f2 f5 h30 h1 + f2 f6 h40 + f32 h30 h2 + f3 f4 h30 h1 +f3 f5 h40 + f42 h40 )k12 l12 + (f0 f5 h20 h22 + f0 f5 h0 h21 h2 + f0 f5 h41 + f12 f5 h0 h2 +f12 f5 h21 + f1 f5 h0 h31 + f1 f6 h30 h2 + f2 f5 h30 h2 + f2 f5 h20 h21 + f3 f5 h30 h1 +f3 f6 h40 + f4 f5 h40 )k12 l1 l2 + (f0 f5 h31 h2 + f12 f5 h1 h2 + f1 f5 h20 h22 + f1 f5 h0 h21 h2 +f1 f6 h20 h1 h2 + f2 f5 h20 h1 h2 + f3 f5 h30 h2 + f3 f6 h30 h1 + f52 h40 )k12 l1 l3 + (f12 h22 +f32 h20 )k12 l1 l4 + (f0 f6 h20 h22 + f0 f6 h41 + f12 f6 h21 + f1 f6 h20 h1 h2 + f1 f6 h0 h31 +f2 f6 h20 h21 + f3 f6 h30 h1 + f4 f6 h40 )k12 l22 + (f1 f6 h20 h22 + f3 f6 h30 h2 + f5 f6 h40 )k12 l2 l3 +(f0 f6 h21 h22 + f1 f6 h0 h1 h22 + f2 f6 h20 h22 + f32 f6 h20 + f62 h40 )k12 l32 + (f0 f5 h20 h22 +f0 f5 h0 h21 h2 + f0 f5 h41 + f12 f5 h0 h2 + f12 f5 h21 + f1 f5 h0 h31 + f1 f6 h30 h2 +f2 f5 h30 h2 + f2 f5 h20 h21 + f3 f5 h30 h1 + f3 f6 h40 + f4 f5 h40 )k1 k2 l12 + (f0 f5 h31 h2 +f12 f5 h1 h2 + f1 f5 h20 h22 + f1 f5 h0 h21 h2 + f1 f6 h20 h1 h2 + f2 f5 h20 h1 h2 + f3 f5 h30 h2 +f3 f6 h30 h1 +f52 h40 )k1 k2 l1 l2 +(f0 f5 h0 h32 +f0 f5 h21 h22 +f1 f5 h0 h1 h22 +f1 f6 h0 h21 h2 +f2 f5 h20 h22 + f32 f5 h20 + f3 f6 h20 h21 + f4 f5 h30 h2 + f52 h30 h1 + f5 f6 h40 )k1 k2 l1 l3 +(f1 f6 h20 h22 + f3 f6 h30 h2 + f5 f6 h40 )k1 k2 l22 + (f1 f6 h0 h1 h22 + f3 f6 h20 h1 h2 +f5 f6 h30 h1 )k1 k2 l2 l3 + (f1 f5 h0 h2 + f3 f5 h20 )k1 k2 l2 l4 + (f1 f52 h0 h2 + f1 f6 h0 h32 +f3 f52 h20 + f3 f6 h20 h22 + f5 f6 h30 h2 )k1 k2 l32 + (f0 f5 h31 h2 + f12 f5 h1 h2 + f1 f5 h20 h22 +f1 f5 h0 h21 h2 +f1 f6 h20 h1 h2 +f2 f5 h20 h1 h2 +f3 f5 h30 h2 +f3 f6 h30 h1 +f52 h40 )k1 k3 l12 +(f0 f5 h0 h32 + f0 f5 h21 h22 + f1 f5 h0 h1 h22 + f1 f6 h0 h21 h2 + f2 f5 h20 h22 + f32 f5 h20 +f3 f6 h20 h21 + f4 f5 h30 h2 + f52 h30 h1 + f5 f6 h40 )k1 k3 l1 l2 + (f0 f5 h1 h32 + f1 f5 h0 h32 +f1 f6 h31 h2 + f3 f5 h20 h22 + f3 f6 h0 h31 + f4 f5 h20 h1 h2 + f52 h30 h2 + f52 h20 h21 )k1 k3 l1 l3 +(f1 f6 h0 h1 h22 + f3 f6 h20 h1 h2 + f5 f6 h30 h1 )k1 k3 l22 + (f1 f6 h21 h22 + f3 f6 h0 h21 h2 +f5 f6 h20 h21 )k1 k3 l2 l3 +(f1 f5 h1 h2 +f3 f5 h0 h1 )k1 k3 l2 l4 +(f1 f52 h1 h2 +f1 f6 h1 h32 +f3 f52 h0 h1 +f3 f6 h0 h1 h22 +f5 f6 h20 h1 h2 )k1 k3 l32 +(f12 h22 +f32 h20 )k1 k4 l12 +(f1 h1 h2 +f3 h0 h1 )k1 k4 l1 l4 +f5 h20 k1 k4 l2 l4 +f52 h20 k1 k4 l32 +(f0 f6 h20 h22 +f0 f6 h41 +f12 f6 h21 +f1 f6 h20 h1 h2 + f1 f6 h0 h31 + f2 f6 h20 h21 + f3 f6 h30 h1 + f4 f6 h40 )k22 l12 + (f1 f6 h20 h22 +f3 f6 h30 h2 + f5 f6 h40 )k22 l1 l2 + (f1 f6 h0 h1 h22 + f3 f6 h20 h1 h2 + f5 f6 h30 h1 )k22 l1 l3 +(f0 f52 h21 + f0 f6 h21 h22 + f12 f52 + f12 f6 h22 + f1 f52 h0 h1 + f1 f6 h0 h1 h22 + f2 f52 h20 +23

f2 f6 h20 h22 + f62 h40 )k22 l22 + (f1 f52 h0 h2 + f1 f6 h0 h32 + f3 f52 h20 + f3 f6 h20 h22 +f5 f6 h30 h2 )k22 l2 l3 + (f0 f52 h22 + f0 f6 h42 + f4 f52 h20 + f4 f6 h20 h22 + f5 f6 h20 h1 h2 +f62 h20 h21 )k22 l32 + f52 h20 k22 l3 l4 + (f1 f6 h20 h22 + f3 f6 h30 h2 + f5 f6 h40 )k2 k3 l12 +(f1 f6 h0 h1 h22 + f3 f6 h20 h1 h2 + f5 f6 h30 h1 )k2 k3 l1 l2 + (f1 f6 h21 h22 + f3 f6 h0 h21 h2 +f5 f6 h20 h21 )k2 k3 l1 l3 + (f1 f52 h0 h2 + f1 f6 h0 h32 + f3 f52 h20 + f3 f6 h20 h22 +f5 f6 h30 h2 )k2 k3 l22 + (f1 f52 h1 h2 + f1 f6 h1 h32 + f3 f52 h0 h1 + f3 f6 h0 h1 h22 +f5 f6 h20 h1 h2 )k2 k3 l2 l3 + f52 h20 k2 k3 l2 l4 + (f1 f52 h22 + f1 f6 h42 + f3 f52 h0 h2 +f3 f6 h0 h32 + f53 h20 + f5 f6 h20 h22 )k2 k3 l32 + (f1 f5 h0 h2 + f3 f5 h20 )k2 k4 l1 l2 +(f1 f5 h1 h2 +f3 f5 h0 h1 )k2 k4 l1 l3 +f5 h20 k2 k4 l1 l4 +f52 h20 k2 k4 l2 l3 +f52 h0 h1 k2 k4 l32 +f5 h0 h2 k2 k4 l3 l4 + (f0 f6 h21 h22 + f1 f6 h0 h1 h22 + f2 f6 h20 h22 + f32 f6 h20 + f62 h40 )k32 l12 +(f1 f52 h0 h2 + f1 f6 h0 h32 + f3 f52 h20 + f3 f6 h20 h22 + f5 f6 h30 h2 )k32 l1 l2 + (f1 f52 h1 h2 +f1 f6 h1 h32 + f3 f52 h0 h1 + f3 f6 h0 h1 h22 + f5 f6 h20 h1 h2 )k32 l1 l3 + f52 h20 k32 l1 l4 +(f0 f52 h22 +f0 f6 h42 +f4 f52 h20 +f4 f6 h20 h22 +f5 f6 h20 h1 h2 +f62 h20 h21 )k32 l22 +(f1 f52 h22 +f1 f6 h42 + f3 f52 h0 h2 + f3 f6 h0 h32 + f53 h20 + f5 f6 h20 h22 )k32 l2 l3 + f52 h0 h1 k32 l2 l4 +(f2 f52 h22 +f2 f6 h42 +f32 f52 +f32 f6 h22 +f3 f52 h1 h2 +f3 f6 h1 h32 +f4 f52 h21 +f4 f6 h21 h22 +f53 h0 h1 +f52 f6 h20 +f5 f6 h0 h1 h22 +f5 f6 h31 h2 +f62 h20 h22 +f62 h41 )k32 l32 +f52 h21 k32 l3 l4 +f52 h20 k3 k4 l22 + f5 h0 h2 k3 k4 l2 l4 + f52 h21 k3 k4 l32 + f5 h1 h2 k3 k4 l3 l4 + k42 l42
Let us give now the formulas for the multiplication-by-2 map.
δ1 = (f12 h22 + f32 h20 + f6 h40 )k14 + f6 h20 h21 k12 k22 + f6 h41 k12 k32 + h21 k12 k42 + (f52 h20 +f6 h20 h22 )k24 + (f52 h21 + f6 h21 h22 )k22 k32 + (f52 h22 + f6 h42 )k34
δ2 = (f0 h31 h2 +f12 h1 h2 +f1 h20 h22 +f1 h0 h21 h2 +f2 h20 h1 h2 +f3 h30 h2 +f5 h40 )k14 +(f0 h1 h32 + f1 h0 h32 + f3 h20 h22 + f4 h20 h1 h2 + f5 h30 h2 + f5 h20 h21 )k12 k22 + (f1 h42 +f2 h1 h32 + f32 h1 h2 + f3 h0 h32 + f3 h21 h22 + f4 h31 h2 + f5 h20 h22 + f5 h0 h21 h2 + f5 h41 +f6 h20 h1 h2 )k12 k32 +f6 h20 h1 h2 k24 +f6 h31 h2 k22 k32 +h1 h2 k22 k42 +(f52 h1 h2 +f6 h1 h32 )k34
δ3 = (f0 h20 h22 + f0 h0 h21 h2 + f0 h41 + f12 h0 h2 + f12 h21 + f1 h0 h31 + f2 h30 h2 +f2 h20 h21 + f3 h30 h1 + f4 h40 )k14 + (f0 h0 h32 + f0 h21 h22 + f12 h22 + f1 h0 h1 h22 + f2 h20 h22 +f4 h30 h2 +f5 h30 h1 +f6 h40 )k12 k22 +(f0 h42 +f2 h0 h32 +f32 h0 h2 +f3 h0 h1 h22 +f4 h20 h22 +f4 h0 h21 h2 + f5 h0 h31 + f6 h30 h2 + f6 h20 h21 )k12 k32 + h20 k12 k42 + f6 h30 h2 k24 + (f52 h20 +f6 h0 h21 h2 )k22 k32 + h0 h2 k22 k42 + (f52 h0 h2 + f52 h21 + f6 h0 h32 )k34 + h22 k32 k42
δ4 = (f02 h42 +f0 f1 h1 h32 +f0 f2 h21 h22 +f0 f32 h21 +f0 f3 h0 h1 h22 +f0 f3 h31 h2 +f0 f4 h41 +f0 f5 h0 h31 + f0 f6 h20 h21 + f12 f2 h22 + f12 f32 + f12 f3 h1 h2 + f12 f4 h21 + f12 f5 h0 h1 +f12 f6 h20 + f12 h0 h32 + f1 f2 h0 h1 h22 + f1 f32 h0 h1 + f1 f3 h0 h21 h2 + f1 f4 h20 h1 h2 +f1 f4 h0 h31 +f1 f5 h30 h2 +f1 f5 h20 h21 +f1 f6 h30 h1 +f22 h20 h22 +f2 f32 h20 +f2 f3 h20 h1 h2 +f2 f4 h20 h21 + f2 f5 h30 h1 + f2 f6 h40 + f32 h30 h2 + f3 f4 h30 h1 + f3 f5 h40 + f42 h40 )k14 +(f0 f5 h31 h2 +f12 f5 h1 h2 +f1 f5 h20 h22 +f1 f5 h0 h21 h2 +f1 f6 h20 h1 h2 +f2 f5 h20 h1 h2 +f3 f5 h30 h2 + f3 f6 h30 h1 + f52 h40 )k12 k22 + (f0 f5 h1 h32 + f1 f5 h0 h32 + f1 f6 h31 h2 +24

f3 f5 h20 h22 + f3 f6 h0 h31 + f4 f5 h20 h1 h2 + f52 h30 h2 + f52 h20 h21 )k12 k32 + (f1 h1 h2 +f3 h0 h1 )k12 k42 +(f0 f52 h21 +f0 f6 h21 h22 +f12 f52 +f12 f6 h22 +f1 f52 h0 h1 +f1 f6 h0 h1 h22 +f2 f52 h20 + f2 f6 h20 h22 + f62 h40 )k24 + (f1 f52 h1 h2 + f1 f6 h1 h32 + f3 f52 h0 h1 +f3 f6 h0 h1 h22 + f5 f6 h20 h1 h2 )k22 k32 + (f2 f52 h22 + f2 f6 h42 + f32 f52 + f32 f6 h22 +f3 f52 h1 h2 + f3 f6 h1 h32 + f4 f52 h21 + f4 f6 h21 h22 + f53 h0 h1 + f52 f6 h20 + f5 f6 h0 h1 h22 +f5 f6 h31 h2 + f62 h20 h22 + f62 h41 )k34 + f5 h1 h2 k32 k42 + k44

References[Cas-Fly 96] J. W. S. Cassels, E. V. Flynn, Prolegomena to a middlebrow
Arithmetic of Curves of Genus 2, LMS Lecture Note Series, 230, Cambridge University Press (1996).
[Duq 05] S. Duquesne, Montgomery scalar multiplication for genus 2 curves,
ANTS VI, Lecture Notes in Comput. Sci. 3076 (2004), pp. 153–168.
[Fly 90] E. V. Flynn, The Jacobian and formal group of a curve of genus 2over an arbitrary groud field, Math. Proc. Camb. Phil. Soc., 107 (1990),
pp. 425–441.
[Fly 93] E. V. Flynn, The group law on the Jacobian of a curve of genus 2,
J. reine angew. Math., 439 (1993), pp. 45–69.
[Fly 95] E. V. Flynn, An explicit theory of heights, Trans. Amer. Math. Soc.,
347 (1995), pp. 3003–3015.
[Fly 97] E. V. Flynn, A flexible method for applying Chabauty’s Thorem,
Compositio Math., 105 (1997), pp. 79–94.
[Fly-Sma 97] E. V. Flynn, N. P. Smart, Canonical height on the Jacobiansof curves of genus 2 and the infinite descent, Acta Artih., 79:4 (1997),
pp. 333–352.
[Lan 82] S. Lang, Introduction to Algebraic and Abelian Functions, 2nd edition, Graduate Texts in Math., 89 (1982).
[Sma-Sik 99] N. Smart, S. Siksek, A fast Diffie-Hellman protocol in genus
2, Journal of Cryptology, 12 (1999), pp. 67–73.

25