Introduction
Commutative cryptographic group actions generalize exponentiation in finite cyclic groups and inherit some of its versatility in cryptographic design, such as non-interactive key exchange protocols à la Diffie–Hellman and threshold signatures, see [1 ] for an overview. At the same time, the concept is general enough to allow for (conjecturally) quantum-resistant instantiations, unlike exponentiation which falls prey to Shor’s algorithm. This generality is, however, relative: the only known fruitful source of post-quantum commutative group actions comes from the theory of complex multiplication (CM). Moreover, nearly all known instantiations work in dimension g = 1 g = 1 g = 1 [29 ] and Rostovtsev–Stolbunov [87 ] , using ordinary elliptic curves over finite fields, but the focus has now shifted to supersingular elliptic curves for the sake of flexibility and efficiency. This is implemented, e.g., in [17 , 35 , 5 ] .
CM theory in arbitrary dimension g ≥ 1 g \ge1 g ≥ 1 [89 ] . Unlike the elliptic curve case, the acting group is not simply the ideal-class group of an imaginary quadratic order, but a slightly more complicated class group attached to a CM order of rank 2 g 2g 2 g
Given the growing role of higher-dimensional abelian varieties in isogeny-based cryptography, and given the central place of CM theory in the theory of PPAVs, it is a natural goal to study how Shimura class group actions can be put to cryptographic use. Our purpose is to initiate this study for superspecial PPAVs, which are the appropriate generalizations to higher dimension of supersingular elliptic curves. Sanon’s PhD thesis [88 ] already gave a high-level description of a key exchange protocol from Shimura class groups acting on absolutely simple, ordinary abelian surfaces over a finite field F q \mathbb{F}_q F q [83 ] mentions the possibility of extending the module-action framework to modules over CM orders, which would generalize our discussion (which corresponds to rank-1 modules). This being said, the Shimura class group action has been on cryptographers’ radars for a long time, in tangential studies such as [68 , 6 , 7 , 63 , 10 , 51 ] .
When compared to elliptic curves, the cases g > 1 g > 1 g > 1 F p \mathbb{F}_p F p [17 ] , which is not possible in large-discriminant frameworks such as [16 , 46 ] , and (ii) there potentially exist more prime ideals of a given small norm ℓ \ell ℓ g = 1 g = 1 g = 1 [34 , 45 , 66 ] .
Contributions and paper organization. Our contributions are organized as follows. First, after reviewing CM orientations and Shimura class groups in Section 2, with further background to be found in the appendices, we introduce some recurring examples of superspecial CM orientations in Section 3. Next, in Section 4 we discuss how to set up and evaluate Shimura class group actions within the g-REGA model from [1 ] . This includes finding the generating set g \mathbf{g} g g g g g = 1 g = 1 g = 1 C 2 × C 2 C_2 \times C_2 C 2 × C 2 [49 ] . We show how to evaluate the Shimura class group action on the IKO-side, and how to produce superspecial PPASs that are oriented by a prescribed CM order; this has applications to the 2-dimensional version of the “one endomorphism” problem (often called OneEnd in the literature [79 ] ), on which we elaborate in Appendix I. Next, in Section 6, we delve into the orbits of the Shimura class group action, which is a rich and much more intricate discussion than in the case g = 1 g = 1 g = 1
Appendices. To keep the main body contained, a considerable amount of material was deferred to the appendices. Besides additional background in Appendices A, J and proofs in Appendices D, E, H, they contain several results worth highlighting. Most notably, building on Section 4, we present a key exchange protocol built from superspecial CM-oriented PPASs, all defined over F p \mathbb{F}_p F p p p p F p \mathbb{F}_p F p [42 ] , which describes modulo which unramified primes p p p C 2 × C 2 C_2 \times C_2 C 2 × C 2
Acknowledgements. The authors would like to thank Eyal Goren, the reviewers of a prior version of this paper, and the authors of [28 , 50 ] for helpful input and feedback. For the statement and proof of Lemma 5.14 we strongly benefited from interactions with Claude Opus 5.5 (Anthropic PBC). All authors are supported by the European Union under the Horizon Europe programme with grant agreement No. 101309092 (PQC-SCAN), as well as by the CELSA alliance through the MaCRo project. Castryck and Lorenzon are also supported by the European Research Council (ERC) under the Horizon 2020 programme, grant agreement No. 101020788 (ISOCRYPT), by the Research Council KU Leuven grant C14/24/099, as well as by Cybersecurity Research Flanders with reference number VR20192203. Kutas is partly supported by EPSRC through grant number EP/V011324/1, and together with Dina, he is also supported by the Hungarian Ministry of Innovation and Technology NRDI Office within the framework of the Quantum Information National Laboratory Program. Kutas is also supported by NRDI grant “EXCELLENCE-151343”. Lorenzon is funded by Research Foundation – Flanders (FWO) under a PhD Fellowship fundamental research (project number 1139225N).
Background
We review the notions of principally polarized abelian varieties (PPAVs) equipped with a CM orientation and the Shimura class group action. More elementary background can be found in Appendix § 8 , to which we have deferred all proofs.
CM orientations
Henceforth K K K 2 g 2g 2 g g g g K 0 ⊃ Q K_0 \supset\mathbb{Q} K 0 ⊃ Q K K K x ↦ x ˉ x \mapsto\bar{x} x ↦ x ˉ K 0 K_0 K 0 K 0 + K_0^+ K 0 + K 0 K_0 K 0 Q \mathbb{Q} Q
Definition 2.1. A K K K g g g ( A , λ ) (A,\lambda) ( A , λ ) ι : K ↪ End 0 ( A ) \iota: K \hookrightarrow\operatorname{End}^{0}(A) ι : K ↪ End 0 ( A ) ι ( α ˉ ) = ι ( α ) † \iota(\bar{\alpha})=\iota(\alpha)^{\dagger} ι ( α ˉ ) = ι ( α ) † α ∈ K \alpha\in K α ∈ K † \dagger † ι \iota ι R R R R ⊂ K R \subset K R ⊂ K ι − 1 End ( A ) = R \iota^{-1}\operatorname{End}(A)=R ι − 1 End ( A ) = R
Since End ( A ) \operatorname{End}(A) End ( A ) R R R R ˉ = R \bar{R}=R R ˉ = R 1 R R R R ∩ K 0 = Z K 0 R \cap K_0=\mathbb{Z}_{K_0} R ∩ K 0 = Z K 0 g = 1 g=1 g = 1
Consider two K K K ( A 1 , λ 1 , ι 1 ) , ( A 2 , λ 2 , ι 2 ) (A_1,\lambda_1,\iota_1),(A_2,\lambda_2,\iota_2) ( A 1 , λ 1 , ι 1 ) , ( A 2 , λ 2 , ι 2 ) μ ∈ K 0 + ∩ ι 1 − 1 End ( A 1 ) \mu\in K_0^+ \cap\iota_1^{-1}\operatorname{End}(A_1) μ ∈ K 0 + ∩ ι 1 − 1 End ( A 1 ) μ ∈ K \mu\in K μ ∈ K ι 1 ( μ ) \iota_1(\mu) ι 1 ( μ ) A 1 A_1 A 1 μ = N ∈ Z > 0 \mu=N \in\mathbb{Z}_{>0} μ = N ∈ Z > 0 ι 1 ( μ ) \iota_1(\mu) ι 1 ( μ ) φ : ( A 1 , λ 1 ) → ( A 2 , λ 2 ) \varphi:(A_1,\lambda_1)\to(A_2,\lambda_2) φ : ( A 1 , λ 1 ) → ( A 2 , λ 2 ) α ∈ ι 1 − 1 End ( A 1 ) ∩ ι 2 − 1 End ( A 2 ) \alpha\in\iota_1^{-1}\operatorname{End}(A_1)\cap\iota_2^{-1}\operatorname{End}(A_2) α ∈ ι 1 − 1 End ( A 1 ) ∩ ι 2 − 1 End ( A 2 ) φ ∘ ι 1 ( α ) = ι 2 ( α ) ∘ φ \varphi\circ\iota_1(\alpha)=\iota_2(\alpha)\circ\varphi φ ∘ ι 1 ( α ) = ι 2 ( α ) ∘ φ φ : ( A 1 , λ 1 , ι 1 ) → ( A 2 , λ 2 , ι 2 ) \varphi:(A_1,\lambda_1,\iota_1)\to(A_2,\lambda_2,\iota_2) φ : ( A 1 , λ 1 , ι 1 ) → ( A 2 , λ 2 , ι 2 ) R ⊂ K R\subset K R ⊂ K
Definition 2.2. Let K K K 2 g 2g 2 g M k ( K ) \mathcal{M}_k(K) M k ( K ) K K K ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι ) k k k R ⊂ K R\subset K R ⊂ K M k ( R ) \mathcal{M}_k(R) M k ( R ) R R R
Remark 2.3. If g = 1 g=1 g = 1 M k ( K ) \mathcal{M}_k(K) M k ( K ) ( E , ι ) (E,\iota) ( E , ι ) M k ( R ) \mathcal{M}_k(R) M k ( R ) g = 1 g=1 g = 1 p > 0 p>0 p > 0 p ∤ [ Z K : R ] p\nmid[\mathbb{Z}_K:R] p ∤ [ Z K : R ] § 6 .
The Shimura class group
To any CM order R R R K K K C ( R ) \mathcal{C}(R) C ( R ) [65 ] even just talks about “a Picard group”, denoting it as Pic ∗ R \operatorname{Pic}_{*} R Pic ∗ R ( a , μ ) (\mathfrak{a},\mu) ( a , μ ) a \mathfrak{a} a R R R a a ‾ = μ R \mathfrak{a}\overline{\mathfrak{a}}=\mu R a a = μ R μ ∈ K 0 + \mu\in K_0^+ μ ∈ K 0 + μ \mu μ K 0 K_0 K 0 I R I_R I R ( μ R , μ μ ‾ ) (\mu R,\mu\overline{\mu}) ( μ R , μ μ ) μ ∈ K × \mu\in K^\times μ ∈ K × P R P_R P R R R R
C ( R ) : = I R / P R . (1) \mathcal{C}(R):=I_R/P_R. \tag*{(1)} C ( R ) := I R / P R . (1) We denote by ∼ \sim ∼ P R P_R P R ( a , μ ) ∈ I R (\mathfrak{a},\mu)\in I_R ( a , μ ) ∈ I R g = 1 g=1 g = 1 μ ∈ K 0 + = Q > 0 \mu\in K_0^+=\mathbb{Q}_{>0} μ ∈ K 0 + = Q > 0 a a ‾ = μ R \mathfrak{a}\overline{\mathfrak{a}}=\mu R a a = μ R μ \mu μ a \mathfrak{a} a C ( R ) ≅ Cl ( R ) \mathcal{C}(R)\cong\operatorname{Cl}(R) C ( R ) ≅ Cl ( R )
Lemma 2.4. For a given invertible fractional ideal a ⊂ R \mathfrak{a}\subset R a ⊂ R 2 g − 1 2^{g-1} 2 g − 1 [ ( a , μ ) ] ∈ C ( R ) [(\mathfrak{a},\mu)]\in\mathcal{C}(R) [( a , μ )] ∈ C ( R )
Example 2.5. If K 0 = Q ( 2 ) K_0=\mathbb{Q}(\sqrt{2}) K 0 = Q ( 2 ) ε 1 = 1 + 2 \varepsilon_1=1+\sqrt{2} ε 1 = 1 + 2 K 0 = Q ( 3 ) K_0=\mathbb{Q}(\sqrt{3}) K 0 = Q ( 3 ) ε 1 = 2 + 3 \varepsilon_1=2+\sqrt{3} ε 1 = 2 + 3 K = K 0 ( α ) K=K_0(\alpha) K = K 0 ( α ) α = − ε 1 \alpha=\sqrt{-\varepsilon_1} α = − ε 1 ε 1 = α α ‾ \varepsilon_1=\alpha\overline{\alpha} ε 1 = α α
As explained in the proof of Theorem 2.7 below, if a ⊂ R \mathfrak{a}\subset R a ⊂ R ( a , μ ) (\mathfrak{a},\mu) ( a , μ ) R R R ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι ) ι ( μ ) \iota(\mu) ι ( μ ) N N N N N N μ = N ∈ Z > 0 \mu=N\in\mathbb{Z}_{>0} μ = N ∈ Z > 0 Corollary 5.6 we will explain how the KLPT2 algorithm from [13 ] can be used, in principle, to by-pass this restriction in the case of an oriented superspecial PPAS with “known” endomorphism ring. The Shimura classes of the form [ ( a , N ) ] [(\mathfrak{a},N)] [( a , N )] a ⊂ R \mathfrak{a}\subset R a ⊂ R N ∈ Z > 0 N\in\mathbb{Z}_{>0} N ∈ Z > 0 C ( R ) Z ⊂ C ( R ) \mathcal{C}(R)_{\mathbb{Z}}\subset\mathcal{C}(R) C ( R ) Z ⊂ C ( R ) [7 Lem. 6] .
Lemma 2.6. We have C ( R ) 2 ⊂ C ( R ) Z \mathcal{C}(R)^2\subset\mathcal{C}(R)_{\mathbb{Z}} C ( R ) 2 ⊂ C ( R ) Z [ C ( R ) : C ( R ) Z ] ∣ # C ( R ) [ 2 ] [\mathcal{C}(R):\mathcal{C}(R)_{\mathbb{Z}}]\mid\#\mathcal{C}(R)[2] [ C ( R ) : C ( R ) Z ] ∣ # C ( R ) [ 2 ]
The Shimura class group fits into the following exact sequence:
1 ⟶ ( R 0 × ) + N K / K 0 ( R × ) → u ↦ [ ( R , u ) ] C ( R ) → [ ( a , μ ) ] ↦ [ a ] Cl ( R ) → N K / K 0 Cl + ( R 0 ) , (2) 1\longrightarrow\frac{(R_0^\times)^+}{N_{K/K_0}(R^\times)}
\xrightarrow{u\mapsto[(R,u)]}
\mathcal{C}(R)
\xrightarrow{[(\mathfrak{a},\mu)]\mapsto[\mathfrak{a}]}
\operatorname{Cl}(R)
\xrightarrow{N_{K/K_0}}
\operatorname{Cl}^+(R_0), \tag*{(2)} 1 ⟶ N K / K 0 ( R × ) ( R 0 × ) + u ↦ [( R , u )] C ( R ) [( a , μ )] ↦ [ a ] Cl ( R ) N K / K 0 Cl + ( R 0 ) , (2) where R 0 = R ∩ K 0 R_0=R\cap K_0 R 0 = R ∩ K 0 ( R 0 × ) + (R_0^\times)^+ ( R 0 × ) + Cl + ( R 0 ) \operatorname{Cl}^+(R_0) Cl + ( R 0 ) # C ( R ) [ 2 ] ≤ # Cl ( R ) [ 2 ] ⋅ U \#\mathcal{C}(R)[2] \leq\#\operatorname{Cl}(R)[2]\cdot U # C ( R ) [ 2 ] ≤ # Cl ( R ) [ 2 ] ⋅ U U = [ R + × : N K / K 0 ( R × ) ] ≤ 2 g − 1 U = [R^{\times}_{+} : N_{K/K_{0}}(R^{\times})] \leq2^{g-1} U = [ R + × : N K / K 0 ( R × )] ≤ 2 g − 1 R = Z K R = \mathbb{Z}_{K} R = Z K R 0 R_{0} R 0 K K K [9 Proof of Thm. 3.1] (that theorem also states that if g = 2 g=2 g = 2 Gal ( K , Q ) ≅ C 2 × C 2 \operatorname{Gal}(K,\mathbb{Q}) \cong C_{2} \times C_{2} Gal ( K , Q ) ≅ C 2 × C 2 h ( R ) = # C ( R ) h(R) = \#\mathcal{C}(R) h ( R ) = # C ( R ) h ( R ) U / h + ( R 0 ) h(R)U/h^{+}(R_{0}) h ( R ) U / h + ( R 0 ) [40 §4] (implemented in PARI/GP).
We are now ready to state our main theorem of interest:
Theorem 2.7. Assume that the set M k ( R ) \mathcal{M}_{k}(R) M k ( R )
C ( R ) × M k ( R ) → M k ( R ) : ( [ ( a , μ ) ] , ( A , λ , ι ) ) ↦ [ ( a , μ ) ] ⋆ ( A , λ , ι ) . \mathcal{C}(R) \times\mathcal{M}_{k}(R) \to\mathcal{M}_{k}(R) : \left( [(\mathfrak{a},\mu)],(A,\lambda,\iota) \right) \mapsto[(\mathfrak{a},\mu)] \star(A,\lambda,\iota). C ( R ) × M k ( R ) → M k ( R ) : ( [( a , μ )] , ( A , λ , ι ) ) ↦ [( a , μ )] ⋆ ( A , λ , ι ) . It can be assumed w.l.o.g. that a ⊂ R \mathfrak{a} \subset R a ⊂ R p p p ι ( μ ) \iota(\mu) ι ( μ ) ⋂ x ∈ a ker ι ( x ) \bigcap_{x\in\mathfrak{a}} \ker\iota(x) ⋂ x ∈ a ker ι ( x )
At this point we make no claims on the orbits of the action. This is discussed in Section 6.
First examples of superspecial CM orientations
The focus of our paper lies on the case of superspecial abelian varieties (and surfaces in particular). The easiest way to generate a g g g K K K 2 g 2g 2 g A = E g A=E^{g} A = E g E E E λ \lambda λ E E E ϑ : O → End ( E ) \vartheta:\mathcal{O}\to\operatorname{End}(E) ϑ : O → End ( E ) O \mathcal{O} O B p , ∞ B_{p,\infty} B p , ∞ Q \mathbb{Q} Q p p p ϑ : M g ( O ) → End ( A ) \vartheta:M_{g}(\mathcal{O})\to\operatorname{End}(A) ϑ : M g ( O ) → End ( A ) K K K ( A , λ ) (A,\lambda) ( A , λ ) ι : K ↪ M g ( B p , ∞ ) \iota:K\hookrightarrow M_{g}(B_{p,\infty}) ι : K ↪ M g ( B p , ∞ ) ι ( α ‾ ) = ι ( α ) ∗ \iota(\overline{\alpha})=\iota(\alpha)^{*} ι ( α ) = ι ( α ) ∗ α ∈ K \alpha\in K α ∈ K ∗ * ∗ ϑ \vartheta ϑ A A A R ⊂ K R\subset K R ⊂ K R R R K K K R R R M g ( O ) M_{g}(\mathcal{O}) M g ( O ) ι ( α ) ∉ M g ( O ) \iota(\alpha)\notin M_{g}(\mathcal{O}) ι ( α ) ∈ / M g ( O ) α ∈ K ∖ R \alpha\in K\setminus R α ∈ K ∖ R
Example 3.1. Let p ≡ 3 ( m o d 4 ) p\equiv3\pmod4 p ≡ 3 ( mod 4 ) E : y 2 = x 3 − x E:y^{2}=x^{3}-x E : y 2 = x 3 − x F p 2 \mathbb{F}_{p^{2}} F p 2 i ∈ F p 2 ∖ F p i\in\mathbb{F}_{p^{2}}\setminus\mathbb{F}_{p} i ∈ F p 2 ∖ F p − 1 -1 − 1 A = E 2 A=E^{2} A = E 2 λ \lambda λ ϑ : i ↦ ( ( x , y ) ↦ ( − x , i y ) ) , j ↦ π p \vartheta:i\mapsto((x,y)\mapsto(-x,iy)),\ j\mapsto\pi_{p} ϑ : i ↦ (( x , y ) ↦ ( − x , i y )) , j ↦ π p O = Z ⟨ 1 , i , ( 1 + j ) / 2 , ( i + k ) / 2 ⟩ ⊂ B p , ∞ \mathcal{O}=\mathbb{Z}\langle1,i,(1+j)/2,(i+k)/2\rangle\subset B_{p,\infty} O = Z ⟨ 1 , i , ( 1 + j ) /2 , ( i + k ) /2 ⟩ ⊂ B p , ∞ End ( E ) \operatorname{End}(E) End ( E ) m = p + 4 m=p+4 m = p + 4 d = ( p + 1 ) / 4 d=(p+1)/4 d = ( p + 1 ) /4
ι : 1 + − m 2 ↦ ( 1 + j 2 i i 1 + j 2 ) , d ↦ ( 0 1 + j 2 1 − j 2 0 ) \iota:\frac{1+\sqrt{-m}}{2}\mapsto
\begin{pmatrix}
\frac{1+j}{2} & i\\
i & \frac{1+j}{2}
\end{pmatrix},
\quad
\sqrt{d}\mapsto
\begin{pmatrix}
0 & \frac{1+j}{2}\\
\frac{1-j}{2} & 0
\end{pmatrix} ι : 2 1 + − m ↦ ( 2 1 + j i i 2 1 + j ) , d ↦ ( 0 2 1 − j 2 1 + j 0 ) is a primitive R R R ( A , λ ) (A,\lambda) ( A , λ ) R = Z [ ( 1 + − m ) / 2 , d ] R=\mathbb{Z}[(1+\sqrt{-m})/2,\sqrt{d}] R = Z [( 1 + − m ) /2 , d ] M 2 ( O ) M_2(\mathcal{O}) M 2 ( O ) End ( A ) \operatorname{End}(A) End ( A ) ϑ \vartheta ϑ M M M D D D
M M M D D D
M 2 − M + ( m + 1 ) / 4 Id 2 = 0 M^2-M+(m+1)/4\operatorname{Id}_2=0 M 2 − M + ( m + 1 ) /4 Id 2 = 0 D 2 − d Id 2 = 0 D^2-d\operatorname{Id}_2=0 D 2 − d Id 2 = 0
M ∗ = 1 − M M^*=1-M M ∗ = 1 − M D ∗ = D D^*=D D ∗ = D
which is easily done. To verify primitivity, note that if d ≢ 1 ( m o d 4 ) d\not\equiv1\pmod{4} d ≡ 1 ( mod 4 ) R = Z K R=\mathbb{Z}_K R = Z K [62 p. 68] ), in which case primitivity is automatic. To cover the case d ≡ 1 ( m o d 4 ) d\equiv1\pmod{4} d ≡ 1 ( mod 4 ) ι ( ( 1 + d ) / 2 ) ∉ M 2 ( O ) \iota((1+\sqrt{d})/2)\notin M_2(\mathcal{O}) ι (( 1 + d ) /2 ) ∈ / M 2 ( O )
As a toy example, letting p = 103 p=103 p = 103 m = 107 m=107 m = 107 d = 26 d=26 d = 26 26 + 5 \sqrt{26}+5 26 + 5 Q ( 26 ) \mathbb{Q}(\sqrt{26}) Q ( 26 ) 107 R 0 107R_0 107 R 0 K K K 2
1 ⟶ C ( R ) → [ ( a , μ ) ] ↦ [ a ] Cl ( R ) → N K / K 0 Cl + ( R 0 ) ⟶ 1 1\longrightarrow\mathcal{C}(R)\xrightarrow{[(\mathfrak{a},\mu)]\mapsto[\mathfrak{a}]} \operatorname{Cl}(R)\xrightarrow{N_{K/K_0}} \operatorname{Cl}^{+}(R_0)\longrightarrow1 1 ⟶ C ( R ) [( a , μ )] ↦ [ a ] Cl ( R ) N K / K 0 Cl + ( R 0 ) ⟶ 1 is exact. With the use of Magma or SageMath one then verifies that C ( R ) \mathcal{C}(R) C ( R ) 42 42 42
t = ( ( 3 , − 107 − 1 ) , 3 ) , s = ( ( 7 , − 107 26 − 2 ) , 7 ) \mathfrak{t}=((3,\sqrt{-107}-1),3),\qquad\mathfrak{s}=((7,\sqrt{-107}\sqrt{26}-2),7) t = (( 3 , − 107 − 1 ) , 3 ) , s = (( 7 , − 107 26 − 2 ) , 7 ) (and cyclically generated by the class of their product s t \mathfrak{s}\mathfrak{t} st ( 3 , 3 ) (3,3) ( 3 , 3 ) [11 ] one calculates that [ t ] ⋆ ( A , λ , ι ) = ( Jac ( H ) , λ 1 , ι 1 ) [\mathfrak{t}]\star(A,\lambda,\iota)=(\operatorname{Jac}(H),\lambda_1,\iota_1) [ t ] ⋆ ( A , λ , ι ) = ( Jac ( H ) , λ 1 , ι 1 ) H : y 2 = 102 x 6 + 25 x 5 + 57 x 4 + 4 x 3 + 41 x 2 + 46 x + 14 H:y^2=102x^6+25x^5+57x^4+4x^3+41x^2+46x+14 H : y 2 = 102 x 6 + 25 x 5 + 57 x 4 + 4 x 3 + 41 x 2 + 46 x + 14 λ 1 \lambda_1 λ 1 Jac ( H ) \operatorname{Jac}(H) Jac ( H ) ι 1 \iota_1 ι 1 § 4.3 for more details on how to evaluate the Shimura class group action in practice.
Example 3.2. Now assume that moreover d = a 2 + b 2 d=a^2+b^2 d = a 2 + b 2 a , b ∈ Z a,b\in\mathbb{Z} a , b ∈ Z 26 = 5 2 + 1 2 26=5^2+1^2 26 = 5 2 + 1 2 d d d b b b
ι ′ : 1 + − m 2 ⟼ ( i + 1 + j 2 0 0 i + 1 + j 2 ) , d ⟼ ( a b b − a ) \iota'\colon\frac{1+\sqrt{-m}}{2}\longmapsto
\begin{pmatrix}
i+\frac{1+j}{2} & 0\\
0 & i+\frac{1+j}{2}
\end{pmatrix},
\qquad
\sqrt{d}\longmapsto
\begin{pmatrix}
a & b\\
b & -a
\end{pmatrix} ι ′ : 2 1 + − m ⟼ ( i + 2 1 + j 0 0 i + 2 1 + j ) , d ⟼ ( a b b − a ) is another R R R ( A , λ ) (A,\lambda) ( A , λ ) b b b ι ′ ( ( 1 + d ) / 2 ) ∉ M 2 ( O ) \iota'((1+\sqrt{d})/2)\notin M_2(\mathcal{O}) ι ′ (( 1 + d ) /2 ) ∈ / M 2 ( O ) ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι ) ( A , λ , ι ′ ) (A,\lambda,\iota') ( A , λ , ι ′ ) C ( R ) \mathcal{C}(R) C ( R )
Example 3.3. Away from products, let p ≠ 2 , 5 p\ne2,5 p = 2 , 5 C : y 2 = x 5 − 1 C:y^2=x^5-1 C : y 2 = x 5 − 1 A = Jac ( C ) A=\operatorname{Jac}(C) A = Jac ( C ) p ≡ 4 ( m o d 5 ) p\equiv4\pmod{5} p ≡ 4 ( mod 5 ) R = Z [ ζ 5 ] R=\mathbb{Z}[\zeta_5] R = Z [ ζ 5 ] ι : R ↪ End ( A ) \iota:R\hookrightarrow\operatorname{End}(A) ι : R ↪ End ( A ) ζ 5 \zeta_5 ζ 5 A A A C → C : ( x , y ) ↦ ( ξ 5 x , y ) C\to C:(x,y)\mapsto(\xi_5x,y) C → C : ( x , y ) ↦ ( ξ 5 x , y ) ζ 5 , ξ 5 \zeta_5,\xi_5 ζ 5 , ξ 5 C \mathbb{C} C k k k
Example 3.4 (R2-D2). We fix a supersingular elliptic curve E / F p 2 E/\mathbb{F}_{p^2} E / F p 2 π p 2 = − p \pi_{p^2}=-p π p 2 = − p ( A , λ ) (A,\lambda) ( A , λ )
A = W F p 2 / F p ( E ) ≅ F p E × E ( p ) A = W_{\mathbb{F}_{p^2}/\mathbb{F}_p}(E) \cong_{\mathbb{F}_p} E \times E^{(p)} A = W F p 2 / F p ( E ) ≅ F p E × E ( p ) equipped with the product polarization. We choose E E E τ : E → E ( p ) \tau:E\to E^{(p)} τ : E → E ( p ) τ ^ ∘ π p = π p ∘ τ \hat{\tau}\circ\pi_p=\pi_p\circ\tau τ ^ ∘ π p = π p ∘ τ d d d p p p [22 ] and a method for finding large examples can be found in [16 §5] . Then, an orientation is given by
ι : Q ( d , − p ) → End 0 ( A ) : d ↦ ( 0 τ ^ τ 0 ) , − p ↦ Π p = ( 0 π p π p 0 ) . \iota:\mathbb{Q}(\sqrt{d},\sqrt{-p})\to\operatorname{End}^{0}(A):\sqrt{d}\mapsto\begin{pmatrix}0&\hat{\tau}\\\tau&0\end{pmatrix},\quad\sqrt{-p}\mapsto\Pi_p=\begin{pmatrix}0&\pi_p\\\pi_p&0\end{pmatrix}. ι : Q ( d , − p ) → End 0 ( A ) : d ↦ ( 0 τ τ ^ 0 ) , − p ↦ Π p = ( 0 π p π p 0 ) . where we note that Π p \Pi_p Π p p p p A A A d d d − p -p − p R R R R = Z [ d , − p ] R=\mathbb{Z}[\sqrt{d},\sqrt{-p}] R = Z [ d , − p ] ( 1 + d ) / 2 , ( 1 + − p ) / 2 (1+\sqrt{d})/2,(1+\sqrt{-p})/2 ( 1 + d ) /2 , ( 1 + − p ) /2 ( 1 + − d p ) / 2 (1+\sqrt{-dp})/2 ( 1 + − d p ) /2 − d p ≢ 1 ( m o d 4 ) -dp\not\equiv1\pmod{4} − d p ≡ 1 ( mod 4 ) [16 ] ) because then ( 1 + − d p ) / 2 (1+\sqrt{-dp})/2 ( 1 + − d p ) /2 ( 1 + π p ∘ τ ) / 2 ∉ End ( E ) (1+\pi_p\circ\tau)/2\notin\operatorname{End}(E) ( 1 + π p ∘ τ ) /2 ∈ / End ( E )
In the above examples, the primitivity of the orientation was easily established. In general, however, finding the primitive order R = ι − 1 End ( A ) R=\iota^{-1}\operatorname{End}(A) R = ι − 1 End ( A ) ι \iota ι R ′ ⊊ R R'\subsetneq R R ′ ⊊ R A A A F q \mathbb{F}_q F q Z [ π q , π ^ q ] \mathbb{Z}[\pi_q,\hat{\pi}_q] Z [ π q , π ^ q ] [6 ] .
Remark 3.5. R2-D2 is part of a larger family of orientations called R2, discussed in Appendix § 10 . The suffix D2 refers to the Galois group D 2 ≅ C 2 × C 2 D_2\cong C_2\times C_2 D 2 ≅ C 2 × C 2 K = Frac ( R ) K=\operatorname{Frac}(R) K = Frac ( R ) Q \mathbb{Q} Q
Remark 3.6. In § 5 we will develop the theory of CM orientations on the algebraic side of the IKO correspondence. Within that framework, we will discuss an easy technique for producing superspecial PPASs together with a prescribed CM orientation, see § 5.3 . In Appendix § 10 we will put Example 3.4 inside the larger family of explicit F p \mathbb{F}_p F p
Evaluating the Shimura class group action
In this section we describe the main auxiliary tools needed for cryptographic applications of the Shimura ideal class group action on oriented superspecial PPAVs in the g-REGA model (e.g., non-interactive key exchange).
On the generating set g \mathfrak{g} g
As mentioned in § 2.2 , we will act with C ( R ) Z \mathcal{C}(R)_{\mathbb{Z}} C ( R ) Z § 5.2 for how to act with elements of C ( R ) ∖ C ( R ) Z \mathcal{C}(R) \setminus\mathcal{C}(R)_{\mathbb{Z}} C ( R ) ∖ C ( R ) Z g = 2 g = 2 g = 2
Similar to class group actions like CSIDH [17 ] and SCALLOP [35 ] , we choose the elements of our generating set g \mathfrak{g} g ( a , ℓ ) (\mathfrak{a}, \ell) ( a , ℓ ) ℓ ∤ disc R \ell\nmid\operatorname{disc} R ℓ ∤ disc R 3 C ( R ) Z \mathcal{C}(R)_{\mathbb{Z}} C ( R ) Z [ ( a , ℓ ) ] [(\mathfrak{a}, \ell)] [( a , ℓ )] ( a ‾ , ℓ ) (\overline{\mathfrak{a}}, \ell) ( a , ℓ ) § 11 we prove that, in dimension g = 2 g = 2 g = 2 a \mathfrak{a} a
Lemma 4.1. For a given CM order R R R 4 4 4 ℓ ∤ disc R \ell\nmid\operatorname{disc} R ℓ ∤ disc R a ⊂ R \mathfrak{a} \subset R a ⊂ R ( a , ℓ ) ∈ I R (\mathfrak{a}, \ell) \in I_R ( a , ℓ ) ∈ I R ℓ R \ell R ℓ R
ℓ R = p 1 p ‾ 1 p 2 p ‾ 2 or ℓ R = p p ‾ (3) \ell R = \mathfrak{p}_1\overline{\mathfrak{p}}_1\mathfrak{p}_2\overline{\mathfrak{p}}_2
\qquad\text{or}\qquad
\ell R = \mathfrak{p}\overline{\mathfrak{p}} \tag*{(3)} ℓ R = p 1 p 1 p 2 p 2 or ℓ R = p p (3) for degree-1 prime ideals p 1 , p 2 \mathfrak{p}_1,\mathfrak{p}_2 p 1 , p 2 p \mathfrak{p} p a \mathfrak{a} a p 1 p 2 \mathfrak{p}_1\mathfrak{p}_2 p 1 p 2 p 1 p ‾ 2 \mathfrak{p}_1\overline{\mathfrak{p}}_2 p 1 p 2 p ‾ 1 p 2 \overline{\mathfrak{p}}_1\mathfrak{p}_2 p 1 p 2 p ‾ 1 p ‾ 2 \overline{\mathfrak{p}}_1\overline{\mathfrak{p}}_2 p 1 p 2 p \mathfrak{p} p p ‾ \overline{\mathfrak{p}} p
One sees that if ℓ \ell ℓ l , l − 1 , l ′ , l ′ − 1 ∈ C ( R ) Z \mathfrak{l},\mathfrak{l}^{-1},\mathfrak{l}',\mathfrak{l}'^{-1} \in\mathcal{C}(R)_{\mathbb{Z}} l , l − 1 , l ′ , l ′ − 1 ∈ C ( R ) Z ℓ \ell ℓ l , l − 1 ∈ C ( R ) Z \mathfrak{l},\mathfrak{l}^{-1} \in\mathcal{C}(R)_{\mathbb{Z}} l , l − 1 ∈ C ( R ) Z ℓ 1 , … , ℓ r \ell_1,\ldots,\ell_r ℓ 1 , … , ℓ r g = { l 1 , l 1 ′ , … , l r , l r ′ } \mathfrak{g} = \{\mathfrak{l}_1,\mathfrak{l}'_1,\ldots,\mathfrak{l}_r,\mathfrak{l}'_r\} g = { l 1 , l 1 ′ , … , l r , l r ′ }
l 1 e 1 l 1 ′ e 1 ′ ⋯ l r e r l r ′ e r ′ , ∣ e i ∣ , ∣ e i ′ ∣ ≤ B (4) \mathfrak{l}_1^{e_1}\mathfrak{l}_1'^{e_1'}\cdots\mathfrak{l}_r^{e_r}\mathfrak{l}_r'^{e_r'}, \qquad|e_i|,|e_i'| \le B \tag*{(4)} l 1 e 1 l 1 ′ e 1 ′ ⋯ l r e r l r ′ e r ′ , ∣ e i ∣ , ∣ e i ′ ∣ ≤ B (4) for some bound B ∈ Z ≥ 0 B \in\mathbb{Z}_{\ge0} B ∈ Z ≥ 0 ( 2 B + 1 ) 2 r (2B+1)^{2r} ( 2 B + 1 ) 2 r C ( R ) Z \mathcal{C}(R)_{\mathbb{Z}} C ( R ) Z g g g 2 g − 1 2^{g-1} 2 g − 1
( 2 B + 1 ) r 2 g − 1 (2B+1)^{r2^{g-1}} ( 2 B + 1 ) r 2 g − 1 many expressions. This growing “key space” for fixed r r r B B B
Remark 4.2. The asymptotic proportions of primes factoring as in (3) depend on Gal ( L , Q ) \operatorname{Gal}(L,\mathbb{Q}) Gal ( L , Q ) L L L K K K 1 4 \frac{1}{4} 4 1 1 2 \frac{1}{2} 2 1 C 2 × C 2 C_2 \times C_2 C 2 × C 2 1 4 \frac{1}{4} 4 1 0 0 0 C 4 C_4 C 4 1 8 \frac{1}{8} 8 1 1 4 \frac{1}{4} 4 1 D 4 D_4 D 4 § 13 , we can bias this in our favor and choose parameters such that as many small primes ℓ \ell ℓ
In order to find the factorization of ℓ R \ell R ℓ R Z [ γ ] ⊂ R \mathbb{Z}[\gamma] \subset R Z [ γ ] ⊂ R R R R Q \mathbb{Q} Q 1 , γ , … , γ 2 g − 1 1,\gamma,\ldots,\gamma^{2g-1} 1 , γ , … , γ 2 g − 1 0 0 0 ℓ \ell ℓ ℓ ∤ [ R : Z [ γ ] ] \ell\nmid[R:\mathbb{Z}[\gamma]] ℓ ∤ [ R : Z [ γ ]] f ( x ) ∈ Z [ x ] f(x) \in\mathbb{Z}[x] f ( x ) ∈ Z [ x ] γ \gamma γ ℓ R \ell R ℓ R f ( x ) f(x) f ( x ) ℓ \ell ℓ g = 2 g=2 g = 2 4 r : = γ 1 γ ‾ 1 + γ 2 γ ‾ 2 ∈ Z r:=\gamma_1\overline{\gamma}_1+\gamma_2\overline{\gamma}_2\in\mathbb{Z} r := γ 1 γ 1 + γ 2 γ 2 ∈ Z γ 1 = γ , γ ‾ 1 , γ 2 , γ ‾ 2 ∈ C \gamma_1=\gamma,\overline{\gamma}_1,\gamma_2,\overline{\gamma}_2\in\mathbb{C} γ 1 = γ , γ 1 , γ 2 , γ 2 ∈ C f ( x ) f(x) f ( x )
If f ( x ) ≡ f 1 ( x ) f 2 ( x ) ( m o d ℓ ) f(x)\equiv f_1(x)f_2(x)\pmod{\ell} f ( x ) ≡ f 1 ( x ) f 2 ( x ) ( mod ℓ ) f i ( x ) f_i(x) f i ( x ) f 1 ( 0 ) + f 2 ( 0 ) ≡ r ( m o d ℓ ) f_1(0)+f_2(0)\equiv r\pmod{\ell} f 1 ( 0 ) + f 2 ( 0 ) ≡ r ( mod ℓ ) ℓ R = p p ‾ \ell R=\mathfrak{p}\overline{\mathfrak{p}} ℓ R = p p p = ( ℓ , f 1 ( γ ) ) \mathfrak{p}=(\ell,f_1(\gamma)) p = ( ℓ , f 1 ( γ ))
If f ( x ) f(x) f ( x ) ℓ \ell ℓ a 1 , b 1 , a 2 , b 2 a_1,b_1,a_2,b_2 a 1 , b 1 , a 2 , b 2 f ( x ) f(x) f ( x ) ℓ \ell ℓ r ≡ a 1 b 1 + a 2 b 2 ( m o d ℓ ) r\equiv a_1b_1+a_2b_2\pmod{\ell} r ≡ a 1 b 1 + a 2 b 2 ( mod ℓ ) ℓ R = p 1 p ‾ 1 p 2 p ‾ 2 \ell R=\mathfrak{p}_1\overline{\mathfrak{p}}_1\mathfrak{p}_2\overline{\mathfrak{p}}_2 ℓ R = p 1 p 1 p 2 p 2 p i = ( ℓ , γ − a i ) \mathfrak{p}_i=(\ell,\gamma-a_i) p i = ( ℓ , γ − a i ) i = 1 , 2 i=1,2 i = 1 , 2
The C 2 × C 2 \mathsf{C}_2\times\mathsf{C}_2 C 2 × C 2 There is an alternative way of describing an “easy” generating set g \mathfrak{g} g K K K Gal ( K , Q ) ≅ C 2 × C 2 \operatorname{Gal}(K,\mathbb{Q})\cong\mathsf{C}_2\times\mathsf{C}_2 Gal ( K , Q ) ≅ C 2 × C 2 g \mathfrak{g} g C ( R ) Z \mathcal{C}(R)_{\mathbb{Z}} C ( R ) Z K K K K 0 K_0 K 0 K 1 , K 2 K_1,K_2 K 1 , K 2 R i = R ∩ K i R_i=R\cap K_i R i = R ∩ K i i = 1 , 2 i=1,2 i = 1 , 2
κ R : Cl ( R 1 ) × Cl ( R 2 ) ⟶ C ( R ) : ( [ a 1 ] , [ a 2 ] ) ⟼ [ ( ( a 1 R ) ( a 2 R ) , N K 1 / Q ( a 1 ) N K 2 / Q ( a 2 ) ) ] . \kappa_R:\operatorname{Cl}(R_1)\times\operatorname{Cl}(R_2)\longrightarrow\mathcal{C}(R):([a_1],[a_2])\longmapsto[((a_1R)(a_2R),N_{K_1/\mathbb{Q}}(a_1)N_{K_2/\mathbb{Q}}(a_2))]. κ R : Cl ( R 1 ) × Cl ( R 2 ) ⟶ C ( R ) : ([ a 1 ] , [ a 2 ]) ⟼ [(( a 1 R ) ( a 2 R ) , N K 1 / Q ( a 1 ) N K 2 / Q ( a 2 ))] . seen as taking values in C ( R ) Z \mathcal{C}(R)_{\mathbb{Z}} C ( R ) Z R = Z K R=\mathbb{Z}_K R = Z K g \mathfrak{g} g
[ m 1 ] , [ m 2 ] , … , [ m s ] ∈ Cl ( R 1 ) , [ l 1 ] , [ l 2 ] , … , [ l t ] ∈ Cl ( R 2 ) , [\mathfrak{m}_1],[\mathfrak{m}_2],\ldots,[\mathfrak{m}_s]\in\operatorname{Cl}(R_1),\qquad[\mathfrak{l}_1],[\mathfrak{l}_2],\ldots,[\mathfrak{l}_t]\in\operatorname{Cl}(R_2), [ m 1 ] , [ m 2 ] , … , [ m s ] ∈ Cl ( R 1 ) , [ l 1 ] , [ l 2 ] , … , [ l t ] ∈ Cl ( R 2 ) , e.g., as chosen in CSIDH or SCALLOP, by letting it be the collection of images of ( [ m i ] , 1 ) ([\mathfrak{m}_i],1) ([ m i ] , 1 ) i = 1 , … , s i=1,\ldots,s i = 1 , … , s ( 1 , [ l i ] ) (1,[\mathfrak{l}_i]) ( 1 , [ l i ]) i = 1 , … , t i=1,\ldots,t i = 1 , … , t
Lemma 4.3. Assume that K K K C 2 × C 2 \mathsf{C}_2\times\mathsf{C}_2 C 2 × C 2 K 0 K_0 K 0 K 1 , K 2 K_1,K_2 K 1 , K 2 Z K × \mathbb{Z}_K^\times Z K × ± 1 \pm1 ± 1
∣ ker κ Z K ∣ ≤ 1 2 q ( K ) ∏ ℓ p r i m e e ( ℓ ) , \left|\ker\kappa_{\mathbb{Z}_K}\right|\leq\frac{1}{2q(K)}\prod_{\ell\ \mathrm{prime}}e(\ell), ∣ ker κ Z K ∣ ≤ 2 q ( K ) 1 ℓ prime ∏ e ( ℓ ) , ∣ coker κ Z K ∣ ≤ 1 4 q ( K ) ∣ coker N K / K 0 ∣ ∏ ℓ p r i m e e ( ℓ ) , \left|\operatorname{coker}\kappa_{\mathbb{Z}_K}\right|\leq\frac{1}{4q(K)}\left|\operatorname{coker}N_{K/K_0}\right|\prod_{\ell\ \mathrm{prime}}e(\ell), ∣ coker κ Z K ∣ ≤ 4 q ( K ) 1 coker N K / K 0 ℓ prime ∏ e ( ℓ ) , where q ( K ) = [ Z K × : Z K 0 × ] ∈ { 1 , 2 } q(K)=[\mathbb{Z}_K^\times:\mathbb{Z}_{K_0}^\times]\in\{1,2\} q ( K ) = [ Z K × : Z K 0 × ] ∈ { 1 , 2 } e ( ℓ ) e(\ell) e ( ℓ ) ℓ \ell ℓ K K K N K / K 0 : Cl ( Z K ) → Cl + ( Z K 0 ) N_{K/K_0}:\operatorname{Cl}(\mathbb{Z}_K)\to\operatorname{Cl}^{+}(\mathbb{Z}_{K_0}) N K / K 0 : Cl ( Z K ) → Cl + ( Z K 0 )
Proof. The proof follows from results by Lemmermeyer [64 ] and the exact sequence (2) . We refer to Appendix § 12 for all the details. □ \square □
As mentioned in § 2.2 , a sufficient condition for ∣ coker N K / K 0 ∣ = 1 \lvert\operatorname{coker} N_{K/K_0}\rvert= 1 ∣ coker N K / K 0 ∣ = 1 K / K 0 K/K_0 K / K 0 K 0 K_0 K 0 C 2 × C 2 C_2 \times C_2 C 2 × C 2 [92 Thm. 2] . We note that when R R R ker κ R \ker\kappa_R ker κ R Corollary E.1 in Appendix § 12 ). We expect that a similar bound on the cokernel also holds for κ R \kappa_R κ R
Kani’s lemma with CM
In § 4.3 we will use the machinery of higher-dimensional isogeny representations for the purpose of representing orientations. Let us quickly revisit the case of a polarized isogeny φ : A 1 → A 2 \varphi: A_1 \to A_2 φ : A 1 → A 2 g g g d ∈ Z > 0 d \in\mathbb{Z}_{>0} d ∈ Z > 0 φ \varphi φ [53 ] to encode φ \varphi φ Φ \Phi Φ N N N Φ \Phi Φ φ \varphi φ α \alpha α Z \mathbb{Z} Z n : = N − d n := N-d n := N − d u = 1 , 2 , 4 u = 1, 2, 4 u = 1 , 2 , 4 [84 Prop. 5.15] ); by Lagrange’s theorem, u = 4 u = 4 u = 4
For the purpose of representing orientations, we wish to generalize this to the setting where A 1 A_1 A 1 A 2 A_2 A 2 R R R R R R K K K 2 g 2g 2 g R R R Z \mathbb{Z} Z n n n R R R d d d φ \varphi φ d ∈ Z > 0 d \in\mathbb{Z}_{>0} d ∈ Z > 0 d d d R 0 + = R 0 ∩ K 0 + R_0^+ = R_0 \cap K_0^+ R 0 + = R 0 ∩ K 0 + R 0 R_0 R 0
Theorem 4.4. Let ( A 1 , λ 1 , ι 1 ) (A_1,\lambda_1,\iota_1) ( A 1 , λ 1 , ι 1 ) ( A 2 , λ 2 , ι 2 ) (A_2,\lambda_2,\iota_2) ( A 2 , λ 2 , ι 2 ) R R R g g g φ : ( A 1 , λ 1 , ι 1 ) → ( A 2 , λ 2 , ι 2 ) \varphi: (A_1,\lambda_1,\iota_1) \to(A_2,\lambda_2,\iota_2) φ : ( A 1 , λ 1 , ι 1 ) → ( A 2 , λ 2 , ι 2 ) R R R d d d d ∈ R 0 + d \in R_0^+ d ∈ R 0 + n ∈ R n \in R n ∈ R N : = d + n ∈ Z N := d+n \in\mathbb{Z} N := d + n ∈ Z α = ( α j , k ) 1 ≤ j , k ≤ u ∈ M u ( R ) \alpha= (\alpha_{j,k})_{1 \le j,k \le u} \in M_u(R) α = ( α j , k ) 1 ≤ j , k ≤ u ∈ M u ( R ) α ∗ α = n I d u \alpha^* \alpha= n I_{du} α ∗ α = n I d u α ∗ \alpha^* α ∗ α \alpha α α A i = ι A i ( α ) : = ( ι i ( α j , k ) ) 1 ≤ j , k ≤ u ∈ End ( A i u ) \alpha_{A_i} = \iota_{A_i}(\alpha) := (\iota_i(\alpha_{j,k}))_{1 \le j,k \le u} \in\operatorname{End}(A_i^u) α A i = ι A i ( α ) := ( ι i ( α j , k ) ) 1 ≤ j , k ≤ u ∈ End ( A i u )
Φ = ( φ I d u α A 2 † − α A 1 φ † I d u ) : ( A 1 u × A 2 u , λ 1 × u × λ 2 × u ) → ( A 2 u × A 1 u , λ 2 × u × λ 1 × u ) \Phi= \begin{pmatrix} \varphi I_{d_u} & \alpha_{A_2}^{\dagger} \\ -\alpha_{A_1} & \varphi^{\dagger} I_{d_u} \end{pmatrix} : (A_1^u \times A_2^u,\lambda_1^{\times u} \times\lambda_2^{\times u}) \to(A_2^u \times A_1^u,\lambda_2^{\times u} \times\lambda_1^{\times u}) Φ = ( φ I d u − α A 1 α A 2 † φ † I d u ) : ( A 1 u × A 2 u , λ 1 × u × λ 2 × u ) → ( A 2 u × A 1 u , λ 2 × u × λ 1 × u ) is an N N N 2 u g 2ug 2 ug Φ † Φ = [ N ] \Phi^\dagger\Phi= [N] Φ † Φ = [ N ] deg Φ = N 2 u g \deg\Phi= N^{2ug} deg Φ = N 2 ug
(i) φ = ϱ ∘ Φ ∘ ȷ \varphi= \varrho\circ\Phi\circ\jmath φ = ϱ ∘ Φ ∘ ȷ : A 1 → A 1 u × A 2 u \jmath: A_1 \to A_1^u \times A_2^u : A 1 → A 1 u × A 2 u ϱ : A 2 u × A 1 u → A 2 \varrho: A_2^u \times A_1^u \to A_2 ϱ : A 2 u × A 1 u → A 2
(ii) if the ideals d R 0 dR_0 d R 0 n R 0 nR_0 n R 0 R 0 R_0 R 0 N N N
ker Φ = { ( − α A 1 † ( P ) , φ I d u ( P ) ) ∣ P ∈ A 1 u [ N ] } = { ( ι 1 ( d ) I d u ( P ) , α A 2 φ I d u ( P ) ) ∣ P ∈ A 1 u [ N ] } . \ker\Phi= \{(-\alpha_{A_1}^{\dagger}(P),\varphi I_{d_u}(P)) \mid P \in A_1^u[N]\}
= \{(\iota_1(d)I_{d_u}(P),\alpha_{A_2}\varphi I_{d_u}(P)) \mid P \in A_1^u[N]\}. ker Φ = {( − α A 1 † ( P ) , φ I d u ( P )) ∣ P ∈ A 1 u [ N ]} = {( ι 1 ( d ) I d u ( P ) , α A 2 φ I d u ( P )) ∣ P ∈ A 1 u [ N ]} . Remark 4.5. Point (ii) of Theorem 4.4 describes ker Φ \ker\Phi ker Φ φ \varphi φ A 1 [ N ] A_1[N] A 1 [ N ] 2 g 2g 2 g A 1 [ N ] A_1[N] A 1 [ N ] Φ \Phi Φ N N N φ \varphi φ A 1 [ N ] A_1[\sqrt{N}] A 1 [ N ] Φ \Phi Φ [86 §6.4] , which we detail further in Remark D.1.
To apply Theorem 4.4 one has to produce, for a prescribed n ∈ R 0 + n \in R_0^+ n ∈ R 0 + α ∈ M u ( R ) \alpha\in M_u(R) α ∈ M u ( R ) α ∗ α = n I d u \alpha^*\alpha= nI_{du} α ∗ α = n I d u u u u Φ \Phi Φ 2 u g 2ug 2 ug
As mentioned, if n ∈ Z > 0 n \in\mathbb{Z}_{>0} n ∈ Z > 0 α ∈ M u ( Z ) \alpha\in M_u(\mathbb{Z}) α ∈ M u ( Z ) u = 1 , 2 , 4 u = 1, 2, 4 u = 1 , 2 , 4 n n n 1 , 2 , 4 1, 2, 4 1 , 2 , 4 n ∈ R 0 + n \in R_0^+ n ∈ R 0 + R 0 R_0 R 0 [85 Lem. 4.2] , Robert gives solutions for α ∈ M 2 k ( R 0 ) \alpha\in M_{2^k}(R_0) α ∈ M 2 k ( R 0 ) n n n m m m k ≥ ⌈ log 2 m ⌉ k \ge\lceil\log_2 m \rceil k ≥ ⌈ log 2 m ⌉ m ≤ 8 m \le8 m ≤ 8 n = ∑ i = 0 m − 1 ϑ i 2 n = \sum_{i=0}^{m-1} \vartheta_i^2 n = ∑ i = 0 m − 1 ϑ i 2 ϑ i ∈ R 0 \vartheta_i \in R_0 ϑ i ∈ R 0 m = 1 , 2 , 4 m = 1, 2, 4 m = 1 , 2 , 4
α = ( ϑ 0 ) , α = ( ϑ 0 ϑ 1 − ϑ 1 ϑ 0 ) , α = ( ϑ 0 ϑ 1 ϑ 2 − ϑ 3 − ϑ 1 ϑ 0 ϑ 3 ϑ 2 − ϑ 2 − ϑ 3 ϑ 0 − ϑ 1 ϑ 3 − ϑ 2 ϑ 1 ϑ 0 ) . (5) \alpha= (\vartheta_0), \qquad\alpha=
\begin{pmatrix}
\vartheta_0 & \vartheta_1 \\
-\vartheta_1 & \vartheta_0
\end{pmatrix}, \qquad\alpha=
\begin{pmatrix}
\vartheta_0 & \vartheta_1 & \vartheta_2 & -\vartheta_3 \\
-\vartheta_1 & \vartheta_0 & \vartheta_3 & \vartheta_2 \\
-\vartheta_2 & -\vartheta_3 & \vartheta_0 & -\vartheta_1 \\
\vartheta_3 & -\vartheta_2 & \vartheta_1 & \vartheta_0
\end{pmatrix}. \tag*{(5)} α = ( ϑ 0 ) , α = ( ϑ 0 − ϑ 1 ϑ 1 ϑ 0 ) , α = ϑ 0 − ϑ 1 − ϑ 2 ϑ 3 ϑ 1 ϑ 0 − ϑ 3 − ϑ 2 ϑ 2 ϑ 3 ϑ 0 ϑ 1 − ϑ 3 ϑ 2 − ϑ 1 ϑ 0 . (5) There is no guarantee that n ∈ R 0 + n \in R_0^+ n ∈ R 0 + R 0 R_0 R 0 [90 Thm. 1] states that all totally positive integral elements of a totally real number field K 0 K_0 K 0 K 0 = Q K_0 = \mathbb{Q} K 0 = Q K 0 = Q ( 5 ) K_0 = \mathbb{Q}(\sqrt{5}) K 0 = Q ( 5 ) n n n n n n [81 Sz. 2] .
In the following, we give solutions for α ∈ M u ( R ) \alpha\in M_u(R) α ∈ M u ( R ) n n n k + 1 k + 1 k + 1 R R R u = 2 k u = 2^k u = 2 k n n n t t t R R R m = 2 d m = 2^d m = 2 d R 0 R_0 R 0 u = 2 k + t u = 2^{k+t} u = 2 k + t k ≥ d k \ge d k ≥ d § 4.3 , but they are of independent interest, and do specialize to meet our needs.
Proposition 4.6. Let X , Y ∈ M m ( R ) X,Y \in M_m(R) X , Y ∈ M m ( R )
α = ( X Y ∗ − Y X ∗ ) ∈ M 2 m ( R ) . \alpha=
\begin{pmatrix}
X & Y^* \\
-Y & X^*
\end{pmatrix}
\in M_{2m}(R). α = ( X − Y Y ∗ X ∗ ) ∈ M 2 m ( R ) . (a) If X ∗ X = X X ∗ = x I d m X^*X = XX^* = xI_{d_m} X ∗ X = X X ∗ = x I d m Y ∗ Y = Y Y ∗ = y I d m Y^*Y = YY^* = yI_{d_m} Y ∗ Y = Y Y ∗ = y I d m x , y ∈ R 0 x,y \in R_0 x , y ∈ R 0 X Y = Y X XY = YX X Y = Y X
α ∗ α = α α ∗ = ( x + y ) I 2 m . \alpha^*\alpha= \alpha\alpha^* = (x+y)I_{2m}. α ∗ α = α α ∗ = ( x + y ) I 2 m . (b) Conversely, for arbitrary X , Y ∈ M m ( R ) X,Y \in M_m(R) X , Y ∈ M m ( R ) n ∈ R 0 n \in R_0 n ∈ R 0 α ∗ α = n I 2 m \alpha^*\alpha= nI_{2m} α ∗ α = n I 2 m
X Y = Y X , X ∗ X + Y ∗ Y = X X ∗ + Y Y ∗ = n I m . XY = YX,\qquad X^*X + Y^*Y = XX^* + YY^* = nI_m. X Y = Y X , X ∗ X + Y ∗ Y = X X ∗ + Y Y ∗ = n I m . (c) Let k ∈ Z ≥ 0 k \in\mathbb{Z}_{\geq0} k ∈ Z ≥ 0 ϑ 0 , … , ϑ k ∈ R \vartheta_0,\ldots,\vartheta_k \in R ϑ 0 , … , ϑ k ∈ R α 0 : = ( ϑ 0 ) ∈ M 1 ( R ) \alpha_0 := (\vartheta_0) \in M_1(R) α 0 := ( ϑ 0 ) ∈ M 1 ( R ) 1 ≤ i ≤ k 1 \leq i \leq k 1 ≤ i ≤ k
α i : = ( α i − 1 ϑ ‾ i Id 2 i − 1 − ϑ i Id 2 i − 1 α i − 1 ∗ ) ∈ M 2 i ( R ) . \alpha_i := \begin{pmatrix} \alpha_{i-1} & \overline{\vartheta}_i \operatorname{Id}_{2^{i-1}} \\ -\vartheta_i \operatorname{Id}_{2^{i-1}} & \alpha_{i-1}^{*} \end{pmatrix} \in M_{2^i}(R). α i := ( α i − 1 − ϑ i Id 2 i − 1 ϑ i Id 2 i − 1 α i − 1 ∗ ) ∈ M 2 i ( R ) . Then α k ∗ α k = n Id 2 k \alpha_k^{*}\alpha_k = n\operatorname{Id}_{2^k} α k ∗ α k = n Id 2 k n = ∑ i = 0 k N K / K 0 ( ϑ i ) n = \sum_{i=0}^{k}N_{K/K_0}(\vartheta_i) n = ∑ i = 0 k N K / K 0 ( ϑ i ) n n n k + 1 k+1 k + 1 R R R α ∈ M 2 k ( R ) \alpha\in M_{2^k}(R) α ∈ M 2 k ( R ) α ∗ α = n Id 2 k \alpha^{*}\alpha= n\operatorname{Id}_{2^k} α ∗ α = n Id 2 k
(d) Let d , t ∈ Z ≥ 0 d,t \in\mathbb{Z}_{\geq0} d , t ∈ Z ≥ 0 m = 2 d m=2^d m = 2 d ϑ 0 , … , ϑ m − 1 ∈ R 0 \vartheta_0,\ldots,\vartheta_{m-1} \in R_0 ϑ 0 , … , ϑ m − 1 ∈ R 0 α 0 ∈ M 2 k ( R 0 ) \alpha_0 \in M_{2^k}(R_0) α 0 ∈ M 2 k ( R 0 ) α 0 ∗ α 0 = α 0 α 0 ∗ = n 1 Id 2 k \alpha_0^{*}\alpha_0=\alpha_0\alpha_0^{*}=n_1\operatorname{Id}_{2^k} α 0 ∗ α 0 = α 0 α 0 ∗ = n 1 Id 2 k n 1 = ∑ i = 0 m − 1 ϑ i 2 n_1=\sum_{i=0}^{m-1}\vartheta_i^2 n 1 = ∑ i = 0 m − 1 ϑ i 2 k ≥ d k\geq d k ≥ d ϑ 1 ′ , … , ϑ t ′ ∈ R \vartheta'_1,\ldots,\vartheta'_t \in R ϑ 1 ′ , … , ϑ t ′ ∈ R n 2 = ∑ i = 1 t N K / K 0 ( ϑ i ′ ) n_2=\sum_{i=1}^{t}N_{K/K_0}(\vartheta'_i) n 2 = ∑ i = 1 t N K / K 0 ( ϑ i ′ ) 1 ≤ i ≤ t 1\leq i\leq t 1 ≤ i ≤ t
α i : = ( α i − 1 ϑ ‾ i ′ Id 2 k + i − 1 − ϑ i ′ Id 2 k + i − 1 α i − 1 ∗ ) ∈ M 2 k + i ( R ) . \alpha_i := \begin{pmatrix} \alpha_{i-1} & \overline{\vartheta}'_i\operatorname{Id}_{2^{k+i-1}} \\ -\vartheta'_i\operatorname{Id}_{2^{k+i-1}} & \alpha_{i-1}^{*} \end{pmatrix} \in M_{2^{k+i}}(R). α i := ( α i − 1 − ϑ i ′ Id 2 k + i − 1 ϑ i ′ Id 2 k + i − 1 α i − 1 ∗ ) ∈ M 2 k + i ( R ) . Then α t ∗ α t = ( n 1 + n 2 ) Id 2 k + t \alpha_t^{*}\alpha_t=(n_1+n_2)\operatorname{Id}_{2^{k+t}} α t ∗ α t = ( n 1 + n 2 ) Id 2 k + t n n n t t t R R R m = 2 d m=2^d m = 2 d R 0 R_0 R 0 α ∈ M 2 k + t ( R ) \alpha\in M_{2^{k+t}}(R) α ∈ M 2 k + t ( R ) α ∗ α = n Id 2 k + t \alpha^{*}\alpha=n\operatorname{Id}_{2^{k+t}} α ∗ α = n Id 2 k + t
Proposition 4.6(d) reduces to [85 Lem. 4.2] when n 2 = 0 n_2=0 n 2 = 0 α ∈ M 2 k ( R 0 ) \alpha\in M_{2^k}(R_0) α ∈ M 2 k ( R 0 ) n 1 n_1 n 1 Z \mathbb{Z} Z α ∈ M 2 k ( Z ) \alpha\in M_{2^k}(\mathbb{Z}) α ∈ M 2 k ( Z ) k = d = 0 , 1 , 2 k=d=0,1,2 k = d = 0 , 1 , 2
Representing the orientation
Usage. Let ( A , λ ) (A,\lambda) ( A , λ ) g g g ι : R → End ( A ) \iota:R\to\operatorname{End}(A) ι : R → End ( A ) R R R 2 g 2g 2 g ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι ) ( ( ℓ , f 1 ( γ ) ) , ℓ ) ((\ell,f_1(\gamma)),\ell) (( ℓ , f 1 ( γ )) , ℓ ) γ ∈ R \gamma\in R γ ∈ R K / Q K/\mathbb{Q} K / Q g g g f 1 ( x ) ∈ Z [ x ] f_1(x)\in\mathbb{Z}[x] f 1 ( x ) ∈ Z [ x ] § 4.1 . Following the proof of Theorem 2.7 , this amounts to computing the subgroup
H : = A [ ℓ ] ∩ A [ f 1 ( ι ( γ ) ) ] ≅ ( Z ℓ Z ) g . H := A[\ell]\cap A[f_1(\iota(\gamma))]\cong\left(\frac{\mathbb{Z}}{\ell\mathbb{Z}}\right)^g. H := A [ ℓ ] ∩ A [ f 1 ( ι ( γ ))] ≅ ( ℓ Z Z ) g . which is maximal isotropic with respect to the ℓ \ell ℓ H H H f 1 ( ι ( γ ) ) f_1(\iota(\gamma)) f 1 ( ι ( γ )) A [ ℓ ] A[\ell] A [ ℓ ]
Remark 4.7. This can be sped up by using that H H H f 2 ( ι ( γ ) ) f_2(\iota(\gamma)) f 2 ( ι ( γ )) A [ ℓ ] A[\ell] A [ ℓ ] f 2 ( x ) f_2(x) f 2 ( x ) f 1 ( x ) f_1(x) f 1 ( x ) f ( x ) f(x) f ( x ) γ \gamma γ [16 §3.2] .
The result of the action is then the codomain of an ℓ \ell ℓ H H H ι ( γ ) \iota(\gamma) ι ( γ ) ℓ \ell ℓ
Remark 4.8. As a side remark, observe that we can act with ( ( ℓ , f 1 ( γ ) ) , ℓ ) ((\ell, f_1(\gamma)), \ell) (( ℓ , f 1 ( γ )) , ℓ ) R R R γ ∈ R \gamma\in R γ ∈ R [23 , 58 ] on the vectorization problem on C ( R ) \mathcal{C}(R) C ( R ) R R R γ \gamma γ § 3 , extracting the primitive order R R R Z [ γ ] \mathbb{Z}[\gamma] Z [ γ ] [88 pp. 107–108] , albeit in the context of ordinary PPAVs oriented by Frobenius. But it does not provide the hoped-for security: determining the stabilizer S S S Z [ γ ] \mathbb{Z}[\gamma] Z [ γ ] [54 ] . One then has a free action by C ( Z [ γ ] ) / S \mathcal{C}(\mathbb{Z}[\gamma])/S C ( Z [ γ ]) / S
Higher-dimensional representation. Let us first assume that we can efficiently evaluate endomorphisms coming from R 0 R_0 R 0 ι ( γ ) \iota(\gamma) ι ( γ ) [21 ] , would be as follows: write d = γ ˉ γ ∈ R 0 + d = \bar{\gamma}\gamma\in R_0^+ d = γ ˉ γ ∈ R 0 + N N N 2 2 2 N − d N-d N − d s s s R 0 R_0 R 0 5
α ∈ M u ( R 0 ) , u = 2 ⌈ log 2 s ⌉ \alpha\in M_u(R_0), \qquad u = 2^{\lceil\log_2 s\rceil} α ∈ M u ( R 0 ) , u = 2 ⌈ l o g 2 s ⌉ from Proposition 4.6(d), we can embed ι ( γ ) \iota(\gamma) ι ( γ ) N N N 2 u g 2ug 2 ug Theorem 4.4 . This is an endomorphism of A 2 u A^{2u} A 2 u ι ( γ ) \iota(\gamma) ι ( γ ) P , ι ( γ ) ( P ) P,\iota(\gamma)(P) P , ι ( γ ) ( P ) P P P A [ N ] A[N] A [ N ] N N N A [ N ] A[\sqrt{N}] A [ N ] φ : A → A / H \varphi:A\to A/H φ : A → A / H N N N φ ( P ) , φ ( ι ( γ ) ( P ) ) \varphi(P),\varphi(\iota(\gamma)(P)) φ ( P ) , φ ( ι ( γ ) ( P )) ( φ ∗ ι ) ( γ ) (\varphi_*\iota)(\gamma) ( φ ∗ ι ) ( γ ) 6
Halving the ambient dimension. In the common scenario where γ = − d \gamma=\sqrt{-d} γ = − d N − d N-d N − d R 0 R_0 R 0 u g ug ug g = 1 g=1 g = 1 α \alpha α ϑ 2 = 0 \vartheta_2=0 ϑ 2 = 0 N − d = ϑ 0 2 + ϑ 1 2 + ϑ 2 2 N-d=\vartheta_0^2+\vartheta_1^2+\vartheta_2^2 N − d = ϑ 0 2 + ϑ 1 2 + ϑ 2 2
ξ : = − d + α \xi:=\sqrt{-d}+\alpha ξ := − d + α u = 1 u=1 u = 1 N − d N-d N − d R 0 R_0 R 0
ξ : = − d ⋅ diag ( 1 , − 1 ) + α \xi:=\sqrt{-d}\cdot\operatorname{diag}(1,-1)+\alpha ξ := − d ⋅ diag ( 1 , − 1 ) + α u = 2 u=2 u = 2
− ξ : = − d ⋅ diag ( 1 , − 1 , 1 , − 1 ) + α if u = 4 (sum of 3 squares and ϑ 2 = 0 ). -\xi:= \sqrt{-d}\cdot\operatorname{diag}(1,-1,1,-1)+\alpha\text{ if } u=4 \text{ (sum of 3 squares and } \vartheta_2=0\text{).} − ξ := − d ⋅ diag ( 1 , − 1 , 1 , − 1 ) + α if u = 4 (sum of 3 squares and ϑ 2 = 0 ). One then checks that ι A ( ξ ) \iota_A(\xi) ι A ( ξ ) A u A^u A u N N N A u A^u A u ι ( γ ) \iota(\gamma) ι ( γ ) A A A ι A ( α ) \iota_A(\alpha) ι A ( α ) φ ( P ) , φ ( ι ( − d ) ( P ) ) \varphi(P),\varphi(\iota(\sqrt{-d})(P)) φ ( P ) , φ ( ι ( − d ) ( P )) ι ( ξ ) \iota(\xi) ι ( ξ ) A [ N ] A[\sqrt{N}] A [ N ] ker ( ι ( ξ ) ) ∩ A u [ N ] \ker(\iota(\xi))\cap A^u[\sqrt{N}] ker ( ι ( ξ )) ∩ A u [ N ] ker ( ι ( ξ ∗ ) ) ∩ A u [ N ] \ker(\iota(\xi^*))\cap A^u[\sqrt{N}] ker ( ι ( ξ ∗ )) ∩ A u [ N ] u = 1 u=1 u = 1 g = 1 g=1 g = 1 [35 , 2 ] .
Representing R 0 R_0 R 0 We now return to the problem of representing endomorphisms coming from R 0 R_0 R 0 g = 2 g=2 g = 2 K 0 = Q ( c ) K_0=\mathbb{Q}(\sqrt{c}) K 0 = Q ( c ) c ∈ Z > 0 c\in\mathbb{Z}_{>0} c ∈ Z > 0 ι ( c ) \iota(\sqrt{c}) ι ( c ) c c c α ∈ M u ( Z ) \alpha\in M_u(\mathbb{Z}) α ∈ M u ( Z ) c = p c=p c = p γ ∈ R \gamma\in R γ ∈ R K / Q K/\mathbb{Q} K / Q γ ˉ γ ∈ Z \bar{\gamma}\gamma\in\mathbb{Z} γ ˉ γ ∈ Z Z \mathbb{Z} Z γ \gamma γ R R R 7 R = Z K R=\mathbb{Z}_K R = Z K ( β / β ˉ ) N K / Q ( β ) (\beta/\bar{\beta})N_{K/\mathbb{Q}}(\beta) ( β / β ˉ ) N K / Q ( β ) β / β ˉ \beta/\bar{\beta} β / β ˉ K / Q K/\mathbb{Q} K / Q N K / Q ( β ) N_{K/\mathbb{Q}}(\beta) N K / Q ( β ) γ ˉ γ = N K / Q ( β ) 2 \bar{\gamma}\gamma=N_{K/\mathbb{Q}}(\beta)^2 γ ˉ γ = N K / Q ( β ) 2 γ \gamma γ ι ( γ ) \iota(\gamma) ι ( γ ) [ R : Z [ γ ] ] [R:\mathbb{Z}[\gamma]] [ R : Z [ γ ]] ℓ \ell ℓ
Instantiating key exchange over F p \mathbb{F}_p F p
In Appendix F we describe concrete key exchange protocols built from Shimura class group actions on superspecial PPASs. These are built from the R2 family of orientations: R2-D2 was described in Example 3.4, while R2-C4 and R2-D4 will be discussed in Appendix C. A common feature of these orientations is that all PPASs and isogenies involved when computing the action are defined over F p \mathbb{F}_p F p p p p Π p \Pi_p Π p ι \iota ι [17 ] , where working with the Frobenius orientation on supersingular elliptic curves comes with three distinguishing features: ( i ) (i) ( i ) E E E F p \mathbb{F}_p F p ℓ \ell ℓ
In higher dimension, these features remain partially present:
One can no longer avoid the need for representing the orientation altogether, but at least the Frobenius part of the orientation still comes for free. E.g., in the R2-D4 and R2-C4 orientations described in Appendix C, where K 0 = Q ( p ) K_0 = \mathbb{Q}(\sqrt{p}) K 0 = Q ( p ) ι ( p ) = Π p \iota(\sqrt{p}) = \Pi_p ι ( p ) = Π p ι ( c ) \iota(\sqrt{c}) ι ( c ) c ∈ Z > 0 c \in\mathbb{Z}_{>0} c ∈ Z > 0 F p \mathbb{F}_p F p
In all R2 orientations we have Q ( ± p ) ⊂ K \mathbb{Q}(\sqrt{\pm p}) \subset K Q ( ± p ) ⊂ K ± p \pm p ± p ℓ i \ell_i ℓ i ℓ 1 , … , ℓ r \ell_1,\ldots,\ell_r ℓ 1 , … , ℓ r ℓ i \ell_i ℓ i 1 4 \frac{1}{4} 4 1 1 2 \frac{1}{2} 2 1 C 2 × C 2 C_2 \times C_2 C 2 × C 2 C 4 C_4 C 4 1 8 \frac{1}{8} 8 1 1 4 \frac{1}{4} 4 1 D 4 D_4 D 4
Remark 4.9. There may be reasons to stay away from Frobenius orientations, e.g., for more control over # C ( R ) \#C(\mathbb{R}) # C ( R ) [35 , 21 , 2 ] (a general technique for constructing such orientations in dimension g = 2 g = 2 g = 2 C 2 × C 2 C_2 \times C_2 C 2 × C 2 [50 ] observed that the vectorization problem for R2-D2, which we recall is an orientation by a CM order of the form Z [ d , − p ] \mathbb{Z}[\sqrt{d},\sqrt{-p}] Z [ d , − p ] Cl ( Z [ − p ] ) \operatorname{Cl}(\mathbb{Z}[\sqrt{-p}]) Cl ( Z [ − p ]) Cl ( Z [ − d p ] ) \operatorname{Cl}(\mathbb{Z}[\sqrt{-dp}]) Cl ( Z [ − d p ]) [18 , 96 ] and, as far as we are aware, does not obviously generalize to arbitrary C 2 × C 2 C_2 \times C_2 C 2 × C 2 p p p K K K
CM orientations under the IKO correspondence
The IKO framework, introduced in [49 ] , gives a convenient Deuring-like dictionary between the geometry of superspecial PPASs over F ‾ p \overline{\mathbb{F}}_p F p M 2 ( B p , ∞ ) M_2(B_{p,\infty}) M 2 ( B p , ∞ ) g g g
The IKO correspondence: a slight extension
Fix a supersingular elliptic curve E E E p > 0 p > 0 p > 0 ϑ : O → End ( E ) \vartheta: \mathcal{O} \to\operatorname{End}(E) ϑ : O → End ( E ) O ⊂ B p , ∞ \mathcal{O} \subset B_{p,\infty} O ⊂ B p , ∞ § 3 . By Deligne’s theorem [41 ] any superspecial PPAS is isomorphic to ( A , λ ) (A,\lambda) ( A , λ ) λ : A → A ∨ \lambda: A \to A^\vee λ : A → A ∨ A = E 2 A = E^2 A = E 2 λ 0 \lambda_0 λ 0 λ 0 − 1 ∘ λ \lambda_0^{-1} \circ\lambda λ 0 − 1 ∘ λ ϑ \vartheta ϑ
g = ( s r r ‾ t ) , s , t ∈ Z > 0 , r ∈ O , s t − r r ‾ = 1 ; g = \begin{pmatrix} s & r \\ \overline{r} & t \end{pmatrix}, \qquad s,t \in\mathbb{Z}_{>0},\ r \in\mathcal{O},\ st-r\overline{r}=1; g = ( s r r t ) , s , t ∈ Z > 0 , r ∈ O , s t − r r = 1 ; see also Example A.5 . We call g g g g g g ( A , λ ) (A,\lambda) ( A , λ ) λ , λ ′ \lambda,\lambda' λ , λ ′ ( A , λ ) ≅ ( A , λ ′ ) (A,\lambda) \cong(A,\lambda') ( A , λ ) ≅ ( A , λ ′ ) g g g g ′ ∼ g g' \sim g g ′ ∼ g g ′ = u ∗ g u g'=u^*gu g ′ = u ∗ g u u ∈ GL 2 ( O ) u \in\operatorname{GL}_2(\mathcal{O}) u ∈ GL 2 ( O )
Since we are just considering A A A End ( A ) ≅ M 2 ( O ) \operatorname{End}(A) \cong M_2(\mathcal{O}) End ( A ) ≅ M 2 ( O ) λ \lambda λ λ 0 \lambda_0 λ 0 b ↦ b ∗ b \mapsto b^* b ↦ b ∗ g g g b ↦ b † = g − 1 b ∗ g b \mapsto b^\dagger= g^{-1}b^*g b ↦ b † = g − 1 b ∗ g g g g M 2 ( O ) M_2(\mathcal{O}) M 2 ( O )
Isogenies are incorporated in the IKO correspondence as follows. Let λ 1 , λ 2 \lambda_1,\lambda_2 λ 1 , λ 2 A A A g g g g 1 , g 2 g_1,g_2 g 1 , g 2 μ ∈ M 2 ( O ) \mu\in M_2(\mathcal{O}) μ ∈ M 2 ( O ) g 1 g_1 g 1 Q \mathbb{Q} Q γ ∈ M 2 ( O ) \gamma\in M_2(\mathcal{O}) γ ∈ M 2 ( O ) ϑ \vartheta ϑ ϑ ( μ ) \vartheta(\mu) ϑ ( μ ) ( A , λ 1 ) → ( A , λ 2 ) (A,\lambda_1) \to(A,\lambda_2) ( A , λ 1 ) → ( A , λ 2 )
λ 1 ∘ ϑ ( μ ) = ϑ ( γ ) ^ ∘ λ 2 ∘ ϑ ( γ ) ⟺ λ 0 − 1 ∘ λ 1 ∘ ϑ ( μ ) = λ 0 − 1 ∘ ϑ ( γ ) ^ ∘ λ 0 ∘ λ 0 − 1 ∘ λ 2 ∘ ϑ ( γ ) \lambda_1 \circ\vartheta(\mu) = \widehat{\vartheta(\gamma)} \circ\lambda_2 \circ\vartheta(\gamma) \Longleftrightarrow\lambda_0^{-1} \circ\lambda_1 \circ\vartheta(\mu) = \lambda_0^{-1} \circ\widehat{\vartheta(\gamma)} \circ\lambda_0 \circ\lambda_0^{-1} \circ\lambda_2 \circ\vartheta(\gamma) λ 1 ∘ ϑ ( μ ) = ϑ ( γ ) ∘ λ 2 ∘ ϑ ( γ ) ⟺ λ 0 − 1 ∘ λ 1 ∘ ϑ ( μ ) = λ 0 − 1 ∘ ϑ ( γ ) ∘ λ 0 ∘ λ 0 − 1 ∘ λ 2 ∘ ϑ ( γ ) ⟺ g 1 μ = γ ∗ g 2 γ . \Longleftrightarrow g_1\mu= \gamma^*g_2\gamma. ⟺ g 1 μ = γ ∗ g 2 γ . This (slightly) extends the corresponding calculation from [13 §2.3] , which was restricted to μ = N Id 2 \mu=N\operatorname{Id}_2 μ = N Id 2 N N N
Remark 5.1. For γ = Id 2 \gamma=\operatorname{Id}_2 γ = Id 2 g 1 Id 2 = Id 2 ∗ g 1 Id 2 g_1\operatorname{Id}_2=\operatorname{Id}_2^*g_1\operatorname{Id}_2 g 1 Id 2 = Id 2 ∗ g 1 Id 2 ( A , λ 1 ) (A,\lambda_1) ( A , λ 1 ) ( A , λ 1 ) (A,\lambda_1) ( A , λ 1 ) ( A , λ 0 ) (A,\lambda_0) ( A , λ 0 ) ( A , λ 1 ) (A,\lambda_1) ( A , λ 1 ) ϑ ( g 1 ) \vartheta(g_1) ϑ ( g 1 ) g 1 g_1 g 1 μ \mu μ
So this means that if λ 1 \lambda_1 λ 1 A A A g g g g 1 g_1 g 1 H ⊂ A H \subset A H ⊂ A
e ϑ ( μ ) ( P , λ 1 ( Q ) ) = 1 , ∀ P , Q ∈ H , e_{\vartheta(\mu)}(P,\lambda_1(Q))=1,\qquad\forall P,Q\in H, e ϑ ( μ ) ( P , λ 1 ( Q )) = 1 , ∀ P , Q ∈ H , then a g g g A ≅ A / H A \cong A/H A ≅ A / H
g 2 : = γ − ∗ g 1 μ γ − 1 , g_2 := \gamma^{-*}g_1\mu\gamma^{-1}, g 2 := γ −∗ g 1 μ γ − 1 , with γ ∈ M 2 ( O ) \gamma\in M_2(\mathcal{O}) γ ∈ M 2 ( O ) ker ϑ ( γ ) = H \ker\vartheta(\gamma) = H ker ϑ ( γ ) = H g 2 g_2 g 2 g g g M 2 ( O ) M_2(\mathcal{O}) M 2 ( O )
Remark 5.2. Most of these properties are easily confirmed:
Using μ † = g 1 − 1 μ ∗ g 1 \mu^\dagger= g_1^{-1}\mu^*g_1 μ † = g 1 − 1 μ ∗ g 1 g 2 ∗ = g 2 g_2^* = g_2 g 2 ∗ = g 2
By definition of a ϑ ( μ ) \vartheta(\mu) ϑ ( μ ) ϑ ( μ ) \vartheta(\mu) ϑ ( μ ) ϑ ( γ ) \vartheta(\gamma) ϑ ( γ ) [14 Lem. 2.10] we see that g 2 g_2 g 2
It concerns a positive-definite matrix: for this it suffices to see that γ ∗ g 2 γ = g 1 μ \gamma^*g_2\gamma= g_1\mu γ ∗ g 2 γ = g 1 μ μ \mu μ B p , ∞ ⊗ Q C ≅ M 2 ( C ) B_{p,\infty} \otimes_{\mathbb{Q}} \mathbb{C} \cong M_2(\mathbb{C}) B p , ∞ ⊗ Q C ≅ M 2 ( C ) g 1 μ = h ( h ∗ μ h ) h − 1 g_1\mu= h(h^*\mu h)h^{-1} g 1 μ = h ( h ∗ μ h ) h − 1 h h ∗ = g 1 hh^* = g_1 h h ∗ = g 1 h h h
Verifying that g 2 ∈ M 2 ( O ) g_2 \in M_2(\mathcal{O}) g 2 ∈ M 2 ( O ) H H H
Lemma 5.3 (Cholesky decomposition in M 2 ( B p , ∞ ) M_2(B_{p,\infty}) M 2 ( B p , ∞ ) Let g ∈ M 2 ( B p , ∞ ) g \in M_2(B_{p,\infty}) g ∈ M 2 ( B p , ∞ ) g = g ∗ g = g^* g = g ∗ h ∈ M 2 ( B p , ∞ ) h \in M_2(B_{p,\infty}) h ∈ M 2 ( B p , ∞ ) h h ∗ = g hh^* = g h h ∗ = g
Orientations of g g g
Let K K K R ⊂ K R \subset K R ⊂ K K K K ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι ) A = E 2 A = E^2 A = E 2 g g g g g g λ \lambda λ ι : R ↪ End ( A ) ≅ M 2 ( O ) \iota: R \hookrightarrow\operatorname{End}(A) \cong M_2(\mathcal{O}) ι : R ↪ End ( A ) ≅ M 2 ( O ) R 0 = Z [ a ] R_0 = \mathbb{Z}[a] R 0 = Z [ a ] a a a R = R 0 [ b 1 , b 2 ] R = R_0[b_1,b_2] R = R 0 [ b 1 , b 2 ] b i ∈ R b_i \in R b i ∈ R 8 a , b 1 , b 2 a,b_1,b_2 a , b 1 , b 2 M 2 ( O ) M_2(\mathcal{O}) M 2 ( O ) g − 1 a ∗ g = a g^{-1}a^*g = a g − 1 a ∗ g = a g − 1 b i ∗ g ∈ R g^{-1}b_i^*g \in R g − 1 b i ∗ g ∈ R i = 1 , 2 i = 1,2 i = 1 , 2 g , a , b 1 , b 2 ∈ M 2 ( O ) g,a,b_1,b_2 \in M_2(\mathcal{O}) g , a , b 1 , b 2 ∈ M 2 ( O ) ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι )
Theorem 5.4. Assuming the generalized Riemann hypothesis (GRH), there is a polynomial-time algorithm which upon input of
algebraic data g , a , b 1 , b 2 g,a,b_1,b_2 g , a , b 1 , b 2 ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι )
– an integral Shimura ideal ( a , μ ) (\mathfrak{a}, \mu) ( a , μ ) Z [ a , b 1 , b 2 ] \mathbb{Z}[\mathfrak{a}, b_1, b_2] Z [ a , b 1 , b 2 ] p ∤ N ( a ) p \nmid N(\mathfrak{a}) p ∤ N ( a ) ι ( μ ) \iota(\mu) ι ( μ )
Proof. The endomorphisms that vanish on the kernel of a \mathfrak{a} a M 2 ( O ) M_2(\mathcal{O}) M 2 ( O ) a \mathfrak{a} a γ \gamma γ [14 ] or [78 §4] ; the former algorithm is more efficient but the latter method is heuristic-free (modulo a dependency on GRH). As explained in the previous section, the g g g
g ′ = γ − ∗ g μ γ − 1 . g' = \gamma^{-*} g_\mu\gamma^{-1}. g ′ = γ −∗ g μ γ − 1 . From the requirement that γ \gamma γ
a ′ = γ a γ − 1 , b i ′ = γ b i γ − 1 . a' = \gamma a \gamma^{-1}, \qquad b_i' = \gamma b_i \gamma^{-1}. a ′ = γ a γ − 1 , b i ′ = γ b i γ − 1 . All this data is straightforward to compute. □ \square □
Remark 5.5. It is instructive to try and define the Shimura class group action (on superspecial PPASs) via g ↦ γ − ∗ g γ − 1 g \mapsto\gamma^{-*}g\gamma^{-1} g ↦ γ −∗ g γ − 1 a ↦ γ a γ − 1 a \mapsto\gamma a\gamma^{-1} a ↦ γ a γ − 1 b i ↦ γ b i γ − 1 b_i \mapsto\gamma b_i\gamma^{-1} b i ↦ γ b i γ − 1 g ′ g' g ′ a ′ a' a ′ b i ′ ∈ M 2 ( O ) b_i' \in M_2(\mathcal{O}) b i ′ ∈ M 2 ( O ) a ′ a' a ′ g ′ g' g ′ Z [ a ′ , b 1 ′ , b 2 ′ ] \mathbb{Z}[a', b_1', b_2'] Z [ a ′ , b 1 ′ , b 2 ′ ] § 15 .§ 1 .
All explicit formulae for isogeny evaluation (that we are aware of) restrict to N N N N ∈ Z > 0 N \in\mathbb{Z}_{>0} N ∈ Z > 0 Theorem 5.4 : if a g g g ( A , λ ) (A,\lambda) ( A , λ ) C ( R ) Z \mathcal{C}(R)_{\mathbb{Z}} C ( R ) Z ( A , λ ) (A,\lambda) ( A , λ ) g g g ( A , λ ) (A,\lambda) ( A , λ ) A A A [73 Def. 2.14] ; see [73 §3] for details.
Corollary 5.6. Let R R R p p p [ ( a , μ ) ] ⋆ ( A , λ , ι ) [(\mathfrak{a}, \mu)] \star(A,\lambda,\iota) [( a , μ )] ⋆ ( A , λ , ι ) [ ( a , μ ) ] ∈ C ( R ) [(\mathfrak{a}, \mu)] \in\mathcal{C}(R) [( a , μ )] ∈ C ( R ) ( A , λ , ι ) ∈ M F p ( R ) (A,\lambda,\iota) \in\mathcal{M}_{\mathbb{F}_p}(R) ( A , λ , ι ) ∈ M F p ( R ) g g g ( A , λ ) (A,\lambda) ( A , λ )
Proof. We assume that the orientation ι \iota ι § 4.3 , but the argument should carry over to any other valid way of representing ι \iota ι g g g ( A , λ ) (A,\lambda) ( A , λ ) φ : ( A , λ ) → ( E 2 , λ 0 ∘ g ) \varphi: (A,\lambda) \to(E^2,\lambda_0 \circ g) φ : ( A , λ ) → ( E 2 , λ 0 ∘ g ) [73 Thm. 5.3] . This is then also an oriented isomorphism between ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι ) ( E 2 , λ 0 ∘ g , φ ∗ ι ) (E^2,\lambda_0 \circ g,\varphi_*\iota) ( E 2 , λ 0 ∘ g , φ ∗ ι ) a , a , b 1 , b 2 a,a,b_1,b_2 a , a , b 1 , b 2 a ′ , a 1 ′ , b 1 ′ , b 2 ′ a',a_1',b_1',b_2' a ′ , a 1 ′ , b 1 ′ , b 2 ′ [ ( a , μ ) ] ⋆ ( A , λ , ι ) [(\mathfrak{a},\mu)] \star(A,\lambda,\iota) [( a , μ )] ⋆ ( A , λ , ι ) [13 Thm. 5.1] we can realize this codomain as a Jacobian (or a product of elliptic curves with the product polarization), where an explicit isomorphism φ ′ \varphi' φ ′ [73 Thm. 5.3] . The algebraic data a ′ a' a ′ b 1 ′ b'_1 b 1 ′ b 2 ′ b'_2 b 2 ′ φ ′ \varphi' φ ′
Remark 5.7. Corollary 5.6 is heuristic due to several calls to the powersmooth KLPT2 ^2 2 [13 ] , which relies on some heuristics. Note that the improved KLPT2 ^2 2 [78 ] can likely be made heuristic-free (perhaps under GRH; this would work with very similar ideas as in the case of 1-dimensional KLPT [97 ] ).
Constructing g g g
An important application of the algebraic viewpoint is the construction of superspecial PPASs with a prescribed orientation. Indeed, on the geometry side there is no systematic way to find orientations other than ad-hoc constructions, as in § 3 or Appendix § 10 , or CM reductions, which only provide orientations by orders with a relatively small discriminant.
As an entry point, we consider the next lemma:
Lemma 5.8. Let g g g g g g a ∈ M 2 ( O ) ∖ Q Id 2 a \in M_2(\mathcal{O}) \setminus\mathbb{Q}\operatorname{Id}_2 a ∈ M 2 ( O ) ∖ Q Id 2 Cent ( a ) ⊂ M 2 ( B p , ∞ ) \operatorname{Cent}(a) \subset M_2(B_{p,\infty}) Cent ( a ) ⊂ M 2 ( B p , ∞ ) C = Q ( a ) ⊗ B p , ∞ C = \mathbb{Q}(a) \otimes B_{p,\infty} C = Q ( a ) ⊗ B p , ∞ Q ( a ) \mathbb{Q}(a) Q ( a ) C C C
This shows that one can obtain orientations as follows. Take a symmetric element a ∈ M 2 ( O ) a \in M_2(\mathcal{O}) a ∈ M 2 ( O ) M 2 ( O ) ∩ Cent ( a ) M_2(\mathcal{O}) \cap\operatorname{Cent}(a) M 2 ( O ) ∩ Cent ( a ) M 2 ( O ) M_2(\mathcal{O}) M 2 ( O ) Cent ( a ) \operatorname{Cent}(a) Cent ( a ) M 2 ( O ) ∩ Cent ( a ) M_2(\mathcal{O}) \cap\operatorname{Cent}(a) M 2 ( O ) ∩ Cent ( a ) M 2 ( O ) ∩ Cent ( a ) M_2(\mathcal{O}) \cap\operatorname{Cent}(a) M 2 ( O ) ∩ Cent ( a ) [75 ] where it was shown that they are either maximal orders or Eichler orders of level p p p Q ( a ) ⊗ B p , ∞ \mathbb{Q}(a) \otimes B_{p,\infty} Q ( a ) ⊗ B p , ∞ p p p Q ( a ) \mathbb{Q}(a) Q ( a ) [75 Thm. 2.5.27] .
Our goal is an algorithm for creating superspecial PPASs that are primitively oriented by a prescribed CM order R R R R = Z K R = \mathbb{Z}_K R = Z K R = Z K R = \mathbb{Z}_K R = Z K K K K ( A , λ , ι ) (A, \lambda, \iota) ( A , λ , ι ) Z K ⊂ ι − 1 End ( A ) \mathbb{Z}_K \subset\iota^{-1}\operatorname{End}(A) Z K ⊂ ι − 1 End ( A )
Our approach is to generalize the 1-dimensional blueprint, where one takes an element in B p , ∞ B_{p,\infty} B p , ∞ M 2 ( B p , ∞ ) M_2(B_{p,\infty}) M 2 ( B p , ∞ ) M 2 ( B p , ∞ ) M_2(B_{p,\infty}) M 2 ( B p , ∞ ) g g g
Lemma 5.9. Let Λ \Lambda Λ M 2 ( B p , ∞ ) M_{2}(B_{p,\infty}) M 2 ( B p , ∞ ) Λ \Lambda Λ M 2 ( O ) M_{2}(\mathcal{O}) M 2 ( O ) g g g
Proof. First, we find γ \gamma γ M 2 ( O ) = γ − 1 Λ γ M_{2}(\mathcal{O})=\gamma^{-1}\Lambda\gamma M 2 ( O ) = γ − 1 Λ γ γ \gamma γ [78 ] or [14 ] as it is equivalent to a principal ideal problem. One can assume that the reduced norm of γ \gamma γ p p p M 2 ( O ) M_{2}(\mathcal{O}) M 2 ( O ) ( γ − 1 Λ γ ) ∗ = γ − 1 Λ γ (\gamma^{-1}\Lambda\gamma)^{*}=\gamma^{-1}\Lambda\gamma ( γ − 1 Λ γ ) ∗ = γ − 1 Λ γ γ γ ∗ Λ = Λ γ γ ∗ \gamma\gamma^{*}\Lambda=\Lambda\gamma\gamma^{*} γ γ ∗ Λ = Λ γ γ ∗ γ γ ∗ \gamma\gamma^{*} γ γ ∗ Λ \Lambda Λ ( γ γ ∗ ) = ( N ) (\gamma\gamma^{*})=(N) ( γ γ ∗ ) = ( N ) N N N γ γ ∗ / N \gamma\gamma^{*}/N γ γ ∗ / N 1 1 1 γ ∗ γ / N \gamma^{*}\gamma/N γ ∗ γ / N g g g g g g ( Λ , ∗ ) (\Lambda,*) ( Λ , ∗ ) ( M 2 ( O ) , † g ) (M_{2}(\mathcal{O}),\dagger_{g}) ( M 2 ( O ) , † g ) † g \dagger_{g} † g g g g
The second lemma is a very generic fact from the algorithmic theory of quaternion algebras (and might already be in the literature but we could not find a reference). Let C C C K K K 2 2 2 C C C K ( d ) K(\sqrt{d}) K ( d ) C ⊗ K K ( d ) ≅ M 2 ( K ( d ) ) C\otimes_{K}K(\sqrt{d})\cong M_{2}(K(\sqrt{d})) C ⊗ K K ( d ) ≅ M 2 ( K ( d )) C C C K ( d ) K(\sqrt{d}) K ( d ) C ⊗ K K ( d ) C\otimes_{K}K(\sqrt{d}) C ⊗ K K ( d ) M 2 ( K ( d ) ) M_{2}(K(\sqrt{d})) M 2 ( K ( d )) C C C K ( d ) K(\sqrt{d}) K ( d )
Lemma 5.10. Let K K K C C C K K K K K K d ∈ K ∖ K 2 d\in K\setminus K^{2} d ∈ K ∖ K 2 K ( d ) K(\sqrt{d}) K ( d ) C C C
Remark 5.11. Let us emphasize that the quantum part is not necessary in practice, but it makes the lemma heuristic-free. Indeed, our proof of Lemma 5.10 in Appendix H.2 invokes a quantum algorithm from [60 ] but this can be replaced with a heuristic algorithm for solving quadratic forms.
We now proceed to finding Z K Z_{K} Z K
Lemma 5.12. Given a quartic CM field K K K ι : K ↪ M 2 ( B p , ∞ ) \iota:K\hookrightarrow M_{2}(B_{p,\infty}) ι : K ↪ M 2 ( B p , ∞ ) ι ( α ‾ ) = ι ( α ) ∗ \iota(\overline{\alpha})=\iota(\alpha)^{*} ι ( α ) = ι ( α ) ∗ α ∈ K \alpha\in K α ∈ K
Proof. We first find an element a ∈ M 2 ( B p , ∞ ) a \in M_{2}(B_{p,\infty}) a ∈ M 2 ( B p , ∞ ) a a a Q ( a ) ≅ K 0 \mathbb{Q}(a) \cong K_{0} Q ( a ) ≅ K 0
( s r r ˉ t ) \begin{pmatrix} s & r \\ \bar{r} & t \end{pmatrix} ( s r ˉ r t ) where s , t ∈ Q s,t \in\mathbb{Q} s , t ∈ Q r ∈ B p , ∞ r \in B_{p,\infty} r ∈ B p , ∞ a a a M M M N N N s + t = M s+t=M s + t = M s t − n ( r ) = N st-n(r)=N s t − n ( r ) = N s , t , r s,t,r s , t , r [12 ] in polynomial time (this is a variation of an algorithm due to Simon that does not require factoring). Now we find the CM field K K K Cent ( a ) \operatorname{Cent}(a) Cent ( a ) Lemma 5.10 with C = Cent ( a ) C=\operatorname{Cent}(a) C = Cent ( a ) K = Q ( a ) K=\mathbb{Q}(a) K = Q ( a ) □ \square □
Remark 5.13 (continuation of Remark 5.11). Here too the word “quantum” can be omitted at the cost of introducing some heuristics.
Our main technical tool for converting this into an algorithm for finding Z K \mathbb{Z}_{K} Z K
Lemma 5.14. Let K ⊂ M 2 ( B p , ∞ ) K \subset M_{2}(B_{p,\infty}) K ⊂ M 2 ( B p , ∞ ) K K K M 2 ( B p , ∞ ) M_{2}(B_{p,\infty}) M 2 ( B p , ∞ ) Z K \mathbb{Z}_{K} Z K Z K ∩ M 2 ( O ) \mathbb{Z}_{K} \cap M_{2}(\mathcal{O}) Z K ∩ M 2 ( O ) μ ∈ Z K 0 \mu\in\mathbb{Z}_{K_{0}} μ ∈ Z K 0 p p p ξ ∈ M 2 ( B p , ∞ ) \xi\in M_{2}(B_{p,\infty}) ξ ∈ M 2 ( B p , ∞ ) ξ ξ ∗ = μ \xi\xi^{*}=\mu ξ ξ ∗ = μ γ ∈ M 2 ( B p , ∞ ) \gamma\in M_{2}(B_{p,\infty}) γ ∈ M 2 ( B p , ∞ ) M 2 ( O ) γ M_{2}(\mathcal{O})\gamma M 2 ( O ) γ M 2 ( O ) Z K M_{2}(\mathcal{O})\mathbb{Z}_{K} M 2 ( O ) Z K Z K \mathbb{Z}_{K} Z K Λ = ( γ ξ ) − 1 M 2 ( O ) γ ξ \Lambda=(\gamma\xi)^{-1}M_{2}(\mathcal{O})\gamma\xi Λ = ( γ ξ ) − 1 M 2 ( O ) γ ξ Λ ∗ = Λ \Lambda^{*}=\Lambda Λ ∗ = Λ
ι : Z K → Λ : α ↦ ξ − 1 α ξ \iota:\mathbb{Z}_{K}\to\Lambda:\alpha\mapsto\xi^{-1}\alpha\xi ι : Z K → Λ : α ↦ ξ − 1 α ξ is an injective ring homomorphism such that ι ( α ˉ ) = ι ( α ) ∗ \iota(\bar{\alpha})=\iota(\alpha)^{*} ι ( α ˉ ) = ι ( α ) ∗ α ∈ Z K \alpha\in\mathbb{Z}_{K} α ∈ Z K
Corollary 5.15. If we assume that h + ( K 0 ) h^{+}(K_{0}) h + ( K 0 ) 10 K K K Z K \mathbb{Z}_{K} Z K p p p
Proof. Repeatedly run Lemma 5.12 until the conductor ideal c \mathfrak{c} c Z K ∩ M 2 ( O ) \mathbb{Z}_{K} \cap M_{2}(\mathcal{O}) Z K ∩ M 2 ( O ) Z K \mathbb{Z}_{K} Z K μ ∈ Z K 0 \mu\in\mathbb{Z}_{K_{0}} μ ∈ Z K 0 p p p
since c ˉ = c \bar{c}=c c ˉ = c c = c 0 Z K c=c_0\mathbb{Z}_K c = c 0 Z K c 0 ⊂ Z K 0 c_0\subset\mathbb{Z}_{K_0} c 0 ⊂ Z K 0 c c c p e \mathfrak{p}^e p e e e e p \mathfrak{p} p K 0 K_0 K 0 c 0 c_0 c 0 μ \mu μ 1 / h + ( K 0 ) 1/h^+(K_0) 1/ h + ( K 0 ) Z K \mathbb{Z}_K Z K Λ ⊂ M 2 ( B p , ∞ ) \Lambda\subset M_2(B_{p,\infty}) Λ ⊂ M 2 ( B p , ∞ ) Q \mathbb{Q} Q [12 ] . Now invoking Lemma 5.9 we get an orientation for some g g g M 2 ( O ) M_2(\mathcal{O}) M 2 ( O ) K K K □ \square □
Applications
In Appendix I we discuss applications of the previously described algebraic machinery to the “one endomorphism problem”. In dimension 1 it is known that knowing one non-scalar endomorphism provides significant extra information:
Given one non-scalar endomorphism one can compute the entire endomorphism ring in sub-exponential time [45 ] .
Given an endomorphism of small degree (polylogarithmic in p p p [66 ] .
Given an oracle for computing non-scalar endomorphisms, one can compute the endomorphism ring in polynomial time [79 ] .
We investigate the first two problems in dimension 2, where we observe that adjustments have to be made, as there are non-scalar (even polarized) endomorphisms that will likely not provide enough information for computing the full endomorphism ring: an example is
( 1 1 1 − 1 ) \begin{pmatrix} 1 & 1 \\ 1 & -1 \end{pmatrix} ( 1 1 1 − 1 ) on E 2 E^2 E 2 E E E Q \mathbb{Q} Q
Orbits of the Shimura class group action
It is classical that if g = 1 g=1 g = 1 p = 0 p=0 p = 0 ⋆ : Cl ( R ) × M k ( R ) → M k ( R ) \star:\operatorname{Cl}(R)\times\mathcal{M}_k(R)\to\mathcal{M}_k(R) ⋆ : Cl ( R ) × M k ( R ) → M k ( R ) [76 ] , that there are in fact two orbits. One can jump back and forth between these orbits via ( E , ι ) ↦ ( E , ι ∘ σ ) (E,\iota)\mapsto(E,\iota\circ\sigma) ( E , ι ) ↦ ( E , ι ∘ σ ) σ : α ↦ α ˉ \sigma:\alpha\mapsto\bar{\alpha} σ : α ↦ α ˉ R R R p > 0 p>0 p > 0 p ∣ [ Z K : R ] p\mid[\mathbb{Z}_K:R] p ∣ [ Z K : R ] M k ( R ) \mathcal{M}_k(R) M k ( R ) p ∤ [ Z K : R ] p\nmid[\mathbb{Z}_K:R] p ∤ [ Z K : R ] p p p K K K M k ( R ) \mathcal{M}_k(R) M k ( R )
(ii) If p p p K K K M k ( R ) \mathcal{M}_k(R) M k ( R )
(iii) If p p p K K K M k ( R ) \mathcal{M}_k(R) M k ( R ) ( E , ι ) ↦ ( E , ι ∘ σ ) (E,\iota) \mapsto(E,\iota\circ\sigma) ( E , ι ) ↦ ( E , ι ∘ σ ) F p 2 \mathbb{F}_{p^2} F p 2 p p p ( E , ι ) ↦ ( E ( p ) , ι ( p ) ) (E,\iota) \mapsto(E^{(p)},\iota^{(p)}) ( E , ι ) ↦ ( E ( p ) , ι ( p ) )
This can be assembled from [61 §13, Thm. 5 & Thm. 12] and [76 Prop. 3.3] .
In higher dimension this picture is much more subtle.11
An obstruction to transitivity
Our starting point is the ring homomorphism ϱ ( A , λ , ι ) : R → End k ( D ( A ) ) : α ↦ ι ( α ) ∗ \varrho_{(A,\lambda,\iota)}: R \to\operatorname{End}_k(D(A)) : \alpha\mapsto\iota(\alpha)^* ϱ ( A , λ , ι ) : R → End k ( D ( A )) : α ↦ ι ( α ) ∗ ι ( α ) ∗ \iota(\alpha)^* ι ( α ) ∗ ι ( α ) \iota(\alpha) ι ( α ) g g g k k k D ( A ) = H 0 ( A , Ω A 1 ) D(A)=H^0(A,\Omega_A^1) D ( A ) = H 0 ( A , Ω A 1 ) 1 1 1 A A A D ( A ) D(A) D ( A ) R R R
Lemma 6.1. If ( A , λ , ι ) , ( A ′ , λ ′ , ι ′ ) ∈ M k ( R ) (A,\lambda,\iota),(A',\lambda',\iota') \in\mathcal{M}_k(R) ( A , λ , ι ) , ( A ′ , λ ′ , ι ′ ) ∈ M k ( R ) C ( R ) \mathcal{C}(R) C ( R ) D ( A ) ≅ D ( A ′ ) D(A)\cong D(A') D ( A ) ≅ D ( A ′ ) R R R
Proof. Every Shimura ideal class has a representative ( a , μ ) (\mathfrak{a},\mu) ( a , μ ) N ( a ) N(\mathfrak{a}) N ( a ) p p p φ a : A → A ′ \varphi_{\mathfrak{a}}: A \to A' φ a : A → A ′ φ a ∗ : D ( A ′ ) → D ( A ) \varphi_{\mathfrak{a}}^*:D(A') \to D(A) φ a ∗ : D ( A ′ ) → D ( A ) k k k
D ( A ′ ) → ι ′ ( α ) ∗ D ( A ′ ) φ a ∗ ↓ ↓ φ a ∗ D ( A ) → ι ( α ) ∗ D ( A ) \begin{CD}
D(A') @>{\iota'(\alpha)^*}>> D(A') \\
@V{\varphi_{\mathfrak{a}}^*}VV @VV{\varphi_{\mathfrak{a}}^*}V \\
D(A) @>{\iota(\alpha)^*}>> D(A)
\end{CD} D ( A ′ ) φ a ∗ ↓ ⏐ D ( A ) ι ′ ( α ) ∗ ι ( α ) ∗ D ( A ′ ) ↓ ⏐ φ a ∗ D ( A ) commutes for every α ∈ R \alpha\in R α ∈ R φ a \varphi_{\mathfrak{a}} φ a φ a ∗ \varphi_{\mathfrak{a}}^* φ a ∗ R R R □ \square □
Remark 6.2. The lemma generalizes to non-horizontal isogenies: for any two CM orders R , R ′ ⊂ Z K R,R'\subset\mathbb{Z}_K R , R ′ ⊂ Z K p ∤ [ Z K : R ] [ Z K : R ′ ] p\nmid[\mathbb{Z}_K:R][\mathbb{Z}_K:R'] p ∤ [ Z K : R ] [ Z K : R ′ ] ( A , λ , ι ) ∈ M k ( R ) (A,\lambda,\iota)\in\mathcal{M}_k(R) ( A , λ , ι ) ∈ M k ( R ) ( A ′ , λ ′ , ι ′ ) ∈ M k ( R ′ ) (A',\lambda',\iota')\in\mathcal{M}_k(R') ( A ′ , λ ′ , ι ′ ) ∈ M k ( R ′ ) D ( A ) , D ( A ′ ) D(A),D(A') D ( A ) , D ( A ′ ) Z K \mathbb{Z}_K Z K p ∤ [ Z K : R ] p\nmid[\mathbb{Z}_K:R] p ∤ [ Z K : R ] ϱ ( A , λ , ι ) \varrho_{(A,\lambda,\iota)} ϱ ( A , λ , ι ) Z K \mathbb{Z}_K Z K R ′ R' R ′
Example 6.3. We start by shedding a different light on Onuki’s motivating example from [76 p4] . Let R = Z [ i ] R = \mathbb{Z}[i] R = Z [ i ] p ≠ 2 p \ne2 p = 2 i ∈ k i \in k i ∈ k − 1 -1 − 1 E : y 2 = x 3 + x E : y^2 = x^3 + x E : y 2 = x 3 + x k k k R R R
ι : i ↦ ( ( x , y ) ↦ ( − x , i y ) ) , ι ′ : i ↦ ( ( x , y ) ↦ ( − x , − i y ) ) \iota: i \mapsto((x,y) \mapsto(-x,iy)), \qquad\iota' : i \mapsto((x,y) \mapsto(-x,-iy)) ι : i ↦ (( x , y ) ↦ ( − x , i y )) , ι ′ : i ↦ (( x , y ) ↦ ( − x , − i y )) on E E E D ( E ) D(E) D ( E ) d x / y dx/y d x / y ι ( i ) \iota(i) ι ( i ) d ( − x ) / i y = ( − 1 / i ) d x / y = i d x / y d(-x)/iy = (-1/i)dx/y = i dx/y d ( − x ) / i y = ( − 1/ i ) d x / y = i d x / y ι ′ ( i ) \iota'(i) ι ′ ( i ) − i d x / y -i dx/y − i d x / y i i i i i i − i -i − i ( E , ι ) (E,\iota) ( E , ι ) ( E , ι ′ ) (E,\iota') ( E , ι ′ ) R R R [96 Prob. 2] is very easy to solve.
Example 6.4. Let E 1 , E 2 E_1, E_2 E 1 , E 2 k k k A = E 1 × E 2 A = E_1 \times E_2 A = E 1 × E 2 D ( A ) ≅ D ( E 1 ) ⊕ D ( E 2 ) D(A) \cong D(E_1) \oplus D(E_2) D ( A ) ≅ D ( E 1 ) ⊕ D ( E 2 ) ω i \omega_i ω i D ( E i ) D(E_i) D ( E i ) i = 1 , 2 i = 1, 2 i = 1 , 2 ( ω 1 , 0 ) , ( 0 , ω 2 ) (\omega_1,0), (0,\omega_2) ( ω 1 , 0 ) , ( 0 , ω 2 ) D ( A ) D(A) D ( A ) End ( A ) \operatorname{End}(A) End ( A )
( α 11 α 21 α 12 α 22 ) , α i j ∈ Hom ( E i , E j ) . \begin{pmatrix}
\alpha_{11} & \alpha_{21} \\
\alpha_{12} & \alpha_{22}
\end{pmatrix}, \qquad\alpha_{ij} \in\operatorname{Hom}(E_i,E_j). ( α 11 α 12 α 21 α 22 ) , α ij ∈ Hom ( E i , E j ) . With respect to our basis of D ( A ) D(A) D ( A ) ( α j i ) i , j (\alpha_{ji})_{i,j} ( α j i ) i , j ( c i j ) i , j (c_{ij})_{i,j} ( c ij ) i , j c i j ∈ k c_{ij} \in k c ij ∈ k α i j ∗ ω j = c i j ω i \alpha_{ij}^{*}\omega_j = c_{ij}\omega_i α ij ∗ ω j = c ij ω i ι , ι ′ \iota,\iota' ι , ι ′
Using that differentials pull back to zero under inseparable isogenies, i.e., π p ∗ ω i = 0 \pi_p^{*}\omega_i = 0 π p ∗ ω i = 0 i = 1 , 2 i = 1, 2 i = 1 , 2 ϱ ( A , λ , ι ) \varrho_{(A,\lambda,\iota)} ϱ ( A , λ , ι )
1 + − m 2 ↦ ( 1 2 i i 2 1 2 ) , d ↦ ( 0 1 2 1 2 0 ) . \frac{1+\sqrt{-m}}{2} \mapsto\begin{pmatrix} \frac{1}{2} & i \\ \frac{i}{2} & \frac{1}{2} \end{pmatrix}, \qquad\sqrt{d} \mapsto\begin{pmatrix} 0 & \frac{1}{2} \\ \frac{1}{2} & 0 \end{pmatrix}. 2 1 + − m ↦ ( 2 1 2 i i 2 1 ) , d ↦ ( 0 2 1 2 1 0 ) . When rewritten with respect to the basis ( ω 1 , ω 2 ) , ( ω 1 , − ω 2 ) (\omega_1,\omega_2),(\omega_1,-\omega_2) ( ω 1 , ω 2 ) , ( ω 1 , − ω 2 )
1 + − m 2 ↦ ( 1 2 + i 0 0 1 2 − i ) , d ↦ ( 1 2 0 0 − 1 2 ) , \frac{1+\sqrt{-m}}{2} \mapsto\begin{pmatrix} \frac{1}{2}+i & 0 \\ 0 & \frac{1}{2}-i \end{pmatrix}, \qquad\sqrt{d} \mapsto\begin{pmatrix} \frac{1}{2} & 0 \\ 0 & -\frac{1}{2} \end{pmatrix}, 2 1 + − m ↦ ( 2 1 + i 0 0 2 1 − i ) , d ↦ ( 2 1 0 0 − 2 1 ) , showing that ϱ ( A , λ , ι ) \varrho_{(A,\lambda,\iota)} ϱ ( A , λ , ι )
x 1 + x 2 1 + − m 2 + x 3 d + x 4 d 1 + − m 2 ↦ x 1 + ( 1 2 + i ) x 2 + 1 2 x 3 + 1 2 ( i + 1 2 ) x 4 (6) x_1+x_2\frac{1+\sqrt{-m}}{2}+x_3\sqrt{d}+x_4\sqrt{d}\frac{1+\sqrt{-m}}{2}
\mapsto
x_1+\left(\frac{1}{2}+i\right)x_2+\frac{1}{2}x_3+\frac{1}{2}\left(i+\frac{1}{2}\right)x_4 \tag*{(6)} x 1 + x 2 2 1 + − m + x 3 d + x 4 d 2 1 + − m ↦ x 1 + ( 2 1 + i ) x 2 + 2 1 x 3 + 2 1 ( i + 2 1 ) x 4 (6) for all x i ∈ Z x_i \in\mathbb{Z} x i ∈ Z ϱ ( A , λ , ι ′ ) \varrho_{(A,\lambda,\iota')} ϱ ( A , λ , ι ′ )
1 + − m 2 ↦ ( 1 2 + i 0 0 1 2 + i ) , d ↦ ( 1 2 0 0 − 1 2 ) \frac{1+\sqrt{-m}}{2} \mapsto\begin{pmatrix} \frac{1}{2}+i & 0 \\ 0 & \frac{1}{2}+i \end{pmatrix}, \qquad\sqrt{d} \mapsto\begin{pmatrix} \frac{1}{2} & 0 \\ 0 & -\frac{1}{2} \end{pmatrix} 2 1 + − m ↦ ( 2 1 + i 0 0 2 1 + i ) , d ↦ ( 2 1 0 0 − 2 1 ) when expressing the images with respect to ( b ω 1 , ( 1 / 2 − a ) ω 2 ) , ( b ω 1 , ( − 1 / 2 − a ) ω 2 ) (b\omega_1,(1/2-a)\omega_2),(b\omega_1,(-1/2-a)\omega_2) ( b ω 1 , ( 1/2 − a ) ω 2 ) , ( b ω 1 , ( − 1/2 − a ) ω 2 )
x 1 + ( 1 2 + i ) x 2 + 1 2 x 3 + 1 2 ( 1 2 + i ) x 4 (7) x_1+\left(\frac{1}{2}+\mathrm{i}\right)x_2+\frac{1}{2}x_3+\frac{1}{2}\left(\frac{1}{2}+\mathrm{i}\right)x_4 \tag*{(7)} x 1 + ( 2 1 + i ) x 2 + 2 1 x 3 + 2 1 ( 2 1 + i ) x 4 (7) From (6) and (7) we see that ι , ι ′ \iota,\iota' ι , ι ′ R R R D ( A ) D(A) D ( A ) E ( R ) \mathcal{E}(R) E ( R )
We emphasize that there is an important difference between the obstructions from Example 6.3 and Example 6.4 . In the former case, precomposition of ι ′ \iota' ι ′ R R R
Example 6.5. Revisiting the Z [ ζ 5 ] \mathbb{Z}[\zeta_5] Z [ ζ 5 ] D ( A ) ≅ H 0 ( C , Ω C 1 ) = ⟨ d x / y , x d x / y ⟩ D(A)\cong H^0(C,\Omega_C^1)=\langle dx/y, xdx/y\rangle D ( A ) ≅ H 0 ( C , Ω C 1 ) = ⟨ d x / y , x d x / y ⟩
ι ( ζ 5 ) ∗ d x y = d ( ξ 5 x ) y = ξ 5 d x y , ι ( ζ 5 ) ∗ d x y = ( ξ 5 x ) d ( ξ 5 x ) y = ξ 5 2 d x y \iota(\zeta_5)^*\frac{dx}{y}=\frac{d(\xi_5x)}{y}=\xi_5\frac{dx}{y},\qquad\iota(\zeta_5)^*\frac{dx}{y}=(\xi_5x)\frac{d(\xi_5x)}{y}=\xi_5^2\frac{dx}{y} ι ( ζ 5 ) ∗ y d x = y d ( ξ 5 x ) = ξ 5 y d x , ι ( ζ 5 ) ∗ y d x = ( ξ 5 x ) y d ( ξ 5 x ) = ξ 5 2 y d x we see that, here too, ϱ ( A , λ , ι ) \varrho(A,\lambda,\iota) ϱ ( A , λ , ι ) ζ 5 \zeta_5 ζ 5 ξ 5 \xi_5 ξ 5 ξ 5 2 \xi_5^2 ξ 5 2
CM types in characteristic p = 0 p=0 p = 0
In the above examples, the decomposability of ϱ ( A , λ , ι ) \varrho(A,\lambda,\iota) ϱ ( A , λ , ι ) ϱ i : R → k \varrho_i:R\to k ϱ i : R → k i = 1 , … , g i=1,\ldots,g i = 1 , … , g p = 0 p=0 p = 0 ϱ i \varrho_i ϱ i K K K L ⊂ k L\subset k L ⊂ k K K K [93 ] that the resulting size-g g g Hom ( K , L ) \operatorname{Hom}(K,L) Hom ( K , L )
Definition 6.6. Let K K K L ⊂ C L\subset\mathbb{C} L ⊂ C K K K K K K Hom ( K , L ) \operatorname{Hom}(K,L) Hom ( K , L ) φ , φ ‾ : K → L \varphi,\overline{\varphi}:K\to L φ , φ : K → L
E.g., this pattern is clearly visible in Example 6.5.
Famously, it was proven by Shimura and Taniyama that for p = 0 p=0 p = 0 R R R R = Z K R=\mathbb{Z}_K R = Z K 12 [93 Thm. 5.2] :
Theorem 6.7 (Shimura–Taniyama, 1961). Consider a CM field K K K ( A , λ , ι ) , ( A ′ , λ ′ , ι ′ ) ∈ M k ( O K ) (A,\lambda,\iota),(A^{\prime},\lambda^{\prime},\iota^{\prime}) \in\mathcal{M}_{k}(\mathcal{O}_{K}) ( A , λ , ι ) , ( A ′ , λ ′ , ι ′ ) ∈ M k ( O K ) k k k [ ( a , μ ) ] ∈ C ( O K ) [(a,\mu)] \in\mathcal{C}(\mathcal{O}_{K}) [( a , μ )] ∈ C ( O K ) ( A ′ , λ ′ , ι ′ ) = [ ( a , μ ) ] ⋆ ( A , λ , ι ) (A^{\prime},\lambda^{\prime},\iota^{\prime})=[(a,\mu)]\star(A,\lambda,\iota) ( A ′ , λ ′ , ι ′ ) = [( a , μ )] ⋆ ( A , λ , ι )
The number of CM types of K K K 2 g 2^{g} 2 g R R R R = O K R=\mathcal{O}_{K} R = O K 13 K K K τ \tau τ K K K K 0 K_{0} K 0 K K K Φ \Phi Φ Φ ′ = Φ ∘ τ \Phi^{\prime}=\Phi\circ\tau Φ ′ = Φ ∘ τ Φ , Φ ′ \Phi,\Phi^{\prime} Φ , Φ ′ g = 2 g=2 g = 2 [93 Lem. 3.4] :
Lemma 6.8 (Inequivalent CM types for g = 2 g=2 g = 2 K K K L L L G = Gal ( L , Q ) G=\operatorname{Gal}(L,\mathbb{Q}) G = Gal ( L , Q ) Hom ( K , L ) = { id , id ‾ , φ , φ ‾ } \operatorname{Hom}(K,L)=\{\operatorname{id},\overline{\operatorname{id}},\varphi,\overline{\varphi}\} Hom ( K , L ) = { id , id , φ , φ } Φ = { id , φ } \Phi=\{\operatorname{id},\varphi\} Φ = { id , φ } Φ ′ = { id , φ ‾ } \Phi^{\prime}=\{\operatorname{id},\overline{\varphi}\} Φ ′ = { id , φ }
if G ≅ C 2 × C 2 G\cong C_{2}\times C_{2} G ≅ C 2 × C 2 G ≅ D 4 G\cong D_{4} G ≅ D 4 Φ \Phi Φ Φ ′ \Phi^{\prime} Φ ′
if G ≅ C 4 G\cong C_{4} G ≅ C 4 Φ , Φ ′ \Phi,\Phi^{\prime} Φ , Φ ′
So the number of inequivalent CM types in these cases is 2, 2, 1, respectively.
Back to positive characteristic
We now move to our main case of interest k = F ‾ p k=\overline{\mathbb{F}}_{p} k = F p R R R 14
Theorem 6.9. Let k = F ‾ p k=\overline{\mathbb{F}}_{p} k = F p K K K ( A , λ , ι ) , ( A ′ , λ ′ , ι ′ ) ∈ M k ( O K ) (A,\lambda,\iota),(A^{\prime},\lambda^{\prime},\iota^{\prime})\in\mathcal{M}_{k}(\mathcal{O}_{K}) ( A , λ , ι ) , ( A ′ , λ ′ , ι ′ ) ∈ M k ( O K ) ϱ ( A , λ , ι ) ≅ ϱ ( A ′ , λ ′ , ι ′ ) \varrho_{(A,\lambda,\iota)}\cong\varrho_{(A^{\prime},\lambda^{\prime},\iota^{\prime})} ϱ ( A , λ , ι ) ≅ ϱ ( A ′ , λ ′ , ι ′ ) [ ( a , μ ) ] ∈ C ( O K ) [(a,\mu)]\in\mathcal{C}(\mathcal{O}_{K}) [( a , μ )] ∈ C ( O K ) ( A ′ , λ ′ , ι ′ ) = [ ( a , μ ) ] ⋆ ( A , λ , ι ) (A^{\prime},\lambda^{\prime},\iota^{\prime})=[(a,\mu)]\star(A,\lambda,\iota) ( A ′ , λ ′ , ι ′ ) = [( a , μ )] ⋆ ( A , λ , ι )
Proof. It was shown in [43 Lem. 4.4.1] that every ( A , λ , ι ) ∈ M k ( O K ) (A,\lambda,\iota)\in\mathcal{M}_{k}(\mathcal{O}_{K}) ( A , λ , ι ) ∈ M k ( O K ) Φ \Phi Φ α 1 , α 2 , … , α 2 g \alpha_{1},\alpha_{2},\ldots,\alpha_{2g} α 1 , α 2 , … , α 2 g O K \mathcal{O}_{K} O K Φ \Phi Φ
f Φ = ∏ φ ∈ Φ ( x 1 φ ( α 1 ) + x 2 φ ( α 2 ) + ⋯ + x 2 g φ ( α 2 g ) ) ∈ O K ∗ [ x 1 , x 2 , … , x 2 g ] . f_{\Phi}=\prod_{\varphi\in\Phi}\left(x_{1}\varphi(\alpha_{1})+x_{2}\varphi(\alpha_{2})+\cdots+x_{2g}\varphi(\alpha_{2g})\right)\in\mathcal{O}_{K}^{*}[x_{1},x_{2},\ldots,x_{2g}]. f Φ = φ ∈ Φ ∏ ( x 1 φ ( α 1 ) + x 2 φ ( α 2 ) + ⋯ + x 2 g φ ( α 2 g ) ) ∈ O K ∗ [ x 1 , x 2 , … , x 2 g ] . Here K ∗ ⊂ L K^* \subset L K ∗ ⊂ L τ ∈ Gal ( L , Q ) \tau\in\operatorname{Gal}(L,\mathbb{Q}) τ ∈ Gal ( L , Q ) τ ∘ Φ = Φ \tau\circ\Phi= \Phi τ ∘ Φ = Φ K K K Φ \Phi Φ Φ \Phi Φ Φ \Phi Φ p ∗ \mathfrak{p}^* p ∗ K ∗ K^* K ∗ p p p det ( ι ( x 1 α 1 + x 2 α 2 + ⋯ + x 2 g α 2 g ) ∗ ) ≡ f Φ ( m o d p ∗ ) \det\left(\iota(x_1\alpha_1+x_2\alpha_2+\cdots+x_{2g}\alpha_{2g})^*\right)\equiv f_\Phi\pmod{\mathfrak{p}^*} det ( ι ( x 1 α 1 + x 2 α 2 + ⋯ + x 2 g α 2 g ) ∗ ) ≡ f Φ ( mod p ∗ ) ϱ ( A , λ , ι ) ≅ ϱ ( A ′ , λ ′ , ι ′ ) \varrho_{(A,\lambda,\iota)}\cong\varrho_{(A',\lambda',\iota')} ϱ ( A , λ , ι ) ≅ ϱ ( A ′ , λ ′ , ι ′ ) ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι ) ( A ′ , λ ′ , ι ′ ) (A',\lambda',\iota') ( A ′ , λ ′ , ι ′ ) ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι ) ( A ′ , λ ′ , ι ′ ) (A',\lambda',\iota') ( A ′ , λ ′ , ι ′ )
It is not hard to check that if p p p Φ \Phi Φ Φ \Phi Φ R = Z K R=Z_K R = Z K p p p 0 0 0 2 g 2^g 2 g p p p Φ \Phi Φ p p p
Example 6.10 (CSIDH). Assume g = 1 g=1 g = 1 K = Q ( − p ) K=\mathbb{Q}(\sqrt{-p}) K = Q ( − p ) p p p p ≡ 1 ( m o d 4 ) p\equiv1\pmod4 p ≡ 1 ( mod 4 ) Z K = Z [ − p ] Z_K=\mathbb{Z}[\sqrt{-p}] Z K = Z [ − p ] x 1 ± − p x 2 ∈ Z K [ x 1 , x 2 ] x_1\pm\sqrt{-p}x_2\in Z_K[x_1,x_2] x 1 ± − p x 2 ∈ Z K [ x 1 , x 2 ] K ∗ = K K^*=K K ∗ = K p ∗ = ( − p ) \mathfrak{p}^*=(\sqrt{-p}) p ∗ = ( − p ) x 1 x_1 x 1 det ( ι ( x 1 + − p x 2 ) ∗ ) ∈ F p [ x 1 , x 2 ] \det(\iota(x_1+\sqrt{-p}x_2)^*)\in\mathbb{F}_p[x_1,x_2] det ( ι ( x 1 + − p x 2 ) ∗ ) ∈ F p [ x 1 , x 2 ] ι : − p ↦ π p \iota:\sqrt{-p}\mapsto\pi_p ι : − p ↦ π p F p \mathbb{F}_p F p ( i i ) (ii) ( ii )
Example 6.11. Revisiting Example 6.4, one easily checks that both ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι ) ( A , λ , ι ′ ) (A,\lambda,\iota') ( A , λ , ι ′ ) { id , φ } \{\operatorname{id},\varphi\} { id , φ } { id , φ ˉ } \{\operatorname{id},\bar{\varphi}\} { id , φ ˉ }
φ : 1 + − m 2 ↦ 1 − − m 2 , d ↦ − d \varphi:\frac{1+\sqrt{-m}}{2}\mapsto\frac{1-\sqrt{-m}}{2},\quad\sqrt{d}\mapsto-\sqrt{d} φ : 2 1 + − m ↦ 2 1 − − m , d ↦ − d (and these CM types are inequivalent). So here we expect 2 2 = 4 2^2=4 2 2 = 4
Example 6.12 (R2-D2). For the R2-D2 orientations described in Example 3.4, one checks that ϱ ( A , λ , ι ) \varrho_{(A,\lambda,\iota)} ϱ ( A , λ , ι )
d ↦ ( 0 d / c τ c τ 0 ) , − p ↦ 0 \sqrt{d}\mapsto\begin{pmatrix}0&d/c_\tau\\c_\tau&0\end{pmatrix},\qquad\sqrt{-p}\mapsto0 d ↦ ( 0 c τ d / c τ 0 ) , − p ↦ 0 when expressed with respect to the basis ( ω , 0 ) , ( 0 , ω ′ ) (\omega,0),(0,\omega') ( ω , 0 ) , ( 0 , ω ′ ) ω , ω ′ \omega,\omega' ω , ω ′ E , E ( p ) E,E^{(p)} E , E ( p )
det ( ι ( x 1 + x 2 d + x 3 − p + x 4 d − p ) ∗ ) = x 1 2 − d x 2 2 . \det\left(\iota\left(x_1+x_2\sqrt{d}+x_3\sqrt{-p}+x_4\sqrt{d}\sqrt{-p}\right)^*\right)=x_1^2-dx_2^2. det ( ι ( x 1 + x 2 d + x 3 − p + x 4 d − p ) ∗ ) = x 1 2 − d x 2 2 . This satisfies the Kottwitz condition with respect to all CM types of Q ( d , − p ) \mathbb{Q}(\sqrt{d},\sqrt{-p}) Q ( d , − p ) Z [ d , − p ] \mathbb{Z}[\sqrt{d},\sqrt{-p}] Z [ d , − p ] [50 ] .
Security considerations
We conclude with some security aspects of cryptosystems built from Shimura class group actions. Most threats we consider are analogs of existing attack scenarios in the case g = 1 g = 1 g = 1 § 13 .§ 1 :
Endomorphism ring computation. It is to be expected that the vectorization problem for Shimura class group actions on oriented superspecial PPAVs reduces to the problem of computing their endomorphism rings; this would be in complete analogy with the elliptic curve case [18 , 96 ] . We note that the endomorphism ring computation problem has several interpretations (e.g., computing an explicit basis of 4 g 2 4g^{2} 4 g 2 [73 ] for the surface case, while in arbitrary dimension some aspects are treated in [78 ] . Up to our knowledge, the fastest known algorithms run in time
p 1 / 3 + o ( 1 ) if g = 1 , p 4 / 5 + o ( 1 ) if g = 2 , ( log p ) O ( g 2 ) p g − 1 if g > 2 , \begin{aligned}
p^{1/3+o(1)} &\text{ if } g=1,\qquad p^{4/5+o(1)} \text{ if } g=2,\\
(\log p)^{O(g^{2})}p^{g-1} &\text{ if } g>2,
\end{aligned} p 1/3 + o ( 1 ) ( log p ) O ( g 2 ) p g − 1 if g = 1 , p 4/5 + o ( 1 ) if g = 2 , if g > 2 , see [95 ] , [47 ] and [27 Thm. 6.15] , respectively. In practice this attack scenario is largely overruled by Kuperberg’s quantum attack, which we discuss next.
Generic attacks on the abelian hidden shift problem. The vectorization problem for commutative group actions can be modeled as an instance of the “abelian hidden shift problem” [23 ] , for which several quantum sub-exponential time algorithms were devised by Kuperberg [58 , 59 ] . These run in time L # G ( 1 / 2 ) L_{\#G}(1/2) L # G ( 1/2 ) G G G # G = h ( R ) \#G=h(R) # G = h ( R ) [8 , 20 ] , and this becomes even more intricate as the dimension grows. In Appendix F.1 we work with log 2 h ( R ) ≈ 2048 \log_{2}h(R)\approx2048 log 2 h ( R ) ≈ 2048 g g g O ( # K ) O(\sqrt{\#\mathcal{K}}) O ( # K ) K \mathcal{K} K
Using non-maximal orders. In the elliptic curve case, the vectorization problem associated with a non-maximal order R R R R R R [16 §6.3] . In higher dimension this picture is more complicated, but it is certain that in many scenarios (e.g., if the order is Bass), such ascending walks are again possible; see [3 ] and Appendix J for more context. So it seems wise to work with maximal orders, or at least with orders R R R [ Z K : R ] [\mathbb{Z}_{K}:R] [ Z K : R ] 15
What about “imprimitive” CM types? This discussion is specific to higher dimension. We mentioned that key exchange from the R2-D2 orientation discussed in Example 3.4 got broken in [50 ] , in the sense that the vectorization problem for C ( R ) \mathcal{C}(R) C ( R ) Cl ( R 1 ) , Cl ( R 2 ) \operatorname{Cl}(R_1), \operatorname{Cl}(R_2) Cl ( R 1 ) , Cl ( R 2 ) R 1 , R 2 R_1, R_2 R 1 , R 2 R R R C 2 × C 2 C_2 \times C_2 C 2 × C 2 p p p ( A , λ , ι ) (A, \lambda, \iota) ( A , λ , ι ) Φ \Phi Φ K ′ ⊂ K K' \subset K K ′ ⊂ K Φ ′ \Phi' Φ ′ K ′ K' K ′ Φ \Phi Φ K ′ K' K ′ Φ ′ \Phi' Φ ′ A A A [93 Thm. 5.2(3)] . All CM types of C 2 × C 2 C_2 \times C_2 C 2 × C 2 C 4 C_4 C 4 D 4 D_4 D 4
Genus theory attacks. In the elliptic curve case, the decisional Diffie–Hellman assumption for class group actions can often be broken using genus theory [19 , 15 ] . This attack strategy generalizes to higher dimension, as was illustrated in [19 §6] and worked out in full generality in [50 ] . It can be countered by making sure one acts with elements from C ( R ) 2 \mathcal{C}(R)^2 C ( R ) 2 # C ( R ) \#\mathcal{C}(R) # C ( R )
Backdoors and active attacks. One realistic threat is that a malicious authority or another adversary could lure Alice or Bob into acting with their secret key on a dishonestly generated PPAV ( A , λ , ι ) (A, \lambda, \iota) ( A , λ , ι ) R ′ ⊋ R R' \supsetneq R R ′ ⊋ R R R R A A A [28 ] , and that ι \iota ι R R R R R R Z K \mathbb{Z}_K Z K ι \iota ι § 3 . Thus, for this reason as well, it is safer to consider orientations by orders that are near-maximal.
Background on the background
Cryptographic group actions
Let X X X G G G ⋆ : G × X → X \star:G \times X \to X ⋆ : G × X → X G G G X X X x 1 , x 2 ∈ X x_1,x_2 \in X x 1 , x 2 ∈ X g ∈ G g \in G g ∈ G g ⋆ x 1 = x 2 g \star x_1=x_2 g ⋆ x 1 = x 2 G G G [31 , 32 , 77 , 80 ] .
For certain applications such as non-interactive key exchange it is enough to have a so-called restricted effective group action (REGA). More explicitly, the action is called a g-REGA for some generating subset g = { g 1 , … , g n } \mathfrak{g}=\{g_1,\ldots,g_n\} g = { g 1 , … , g n } G G G n n n ∣ G ∣ |G| ∣ G ∣ g i ⋆ x g_i \star x g i ⋆ x g i − 1 ⋆ x g_i^{-1} \star x g i − 1 ⋆ x g i ∈ g , x ∈ X g_i \in\mathfrak{g},x \in X g i ∈ g , x ∈ X [17 , 25 , 22 , 16 , 46 , 5 ] . This will also be the case for the Shimura class group action studied in this paper, where potential generalizations of [32 ] to construct an EGA from this are left as future work. We refer to [1 ] for more details on REGAs and EGAs and their range of applications.
Polarized isogenies
In the next few paragraphs we recall some basic facts and terminology needed for studying the Shimura class group action. All statements below are well-known to specialists and kept concise; we refer the reader to [93 , 72 , 70 ] and the references included below for more details.
Abelian varieties and isogenies. Let k k k p p p p p p k k k 0 ∈ A 0 \in A 0 ∈ A A × A → A : ( P , Q ) ↦ P + Q A \times A \to A : (P,Q) \mapsto P+Q A × A → A : ( P , Q ) ↦ P + Q A → A : P ↦ − P A \to A : P \mapsto-P A → A : P ↦ − P A A A φ : A 1 → A 2 \varphi: A_1 \to A_2 φ : A 1 → A 2 A 1 , A 2 A_1, A_2 A 1 , A 2 φ ( 0 ) = 0 \varphi(0)=0 φ ( 0 ) = 0 dim A 1 = dim A 2 \dim A_1 = \dim A_2 dim A 1 = dim A 2 φ \varphi φ A A A End ( A ) \operatorname{End}(A) End ( A ) Z \mathbb{Z} Z End ( A ) \operatorname{End}(A) End ( A ) End 0 ( A ) = End ( A ) ⊗ Z Q \operatorname{End}^{0}(A) = \operatorname{End}(A) \otimes_{\mathbb{Z}} \mathbb{Q} End 0 ( A ) = End ( A ) ⊗ Z Q p > 0 p > 0 p > 0 A / k A/k A / k g g g E g E^{g} E g E / k E/k E / k g ≥ 2 g \ge2 g ≥ 2 E E E [41 ] any two products of g g g
Principal polarizations. A polarization on an abelian variety A A A
λ : A → A ∨ ≅ Pic 0 ( A ) : P ↦ [ t − P D − D ] \lambda: A \to A^{\vee} \cong\operatorname{Pic}^{0}(A) : P \mapsto[t_{-P}D-D] λ : A → A ∨ ≅ Pic 0 ( A ) : P ↦ [ t − P D − D ] attached to an ample divisor D D D A A A t − P t_{-P} t − P − P -P − P ( A , λ ) (A,\lambda) ( A , λ )
Example A.1 (Jacobians). Consider a smooth projective curve C C C g ≥ 1 g \ge1 g ≥ 1 u : C ↪ Jac ( C ) ≅ Pic 0 ( C ) : P ↦ [ P − P 0 ] u : C \hookrightarrow\operatorname{Jac}(C) \cong\operatorname{Pic}^{0}(C) : P \mapsto[P-P_{0}] u : C ↪ Jac ( C ) ≅ Pic 0 ( C ) : P ↦ [ P − P 0 ] P 0 ∈ C P_{0} \in C P 0 ∈ C Jac ( C ) \operatorname{Jac}(C) Jac ( C ) g − 1 g-1 g − 1 u u u D D D Jac ( C ) \operatorname{Jac}(C) Jac ( C ) λ : Jac ( C ) → Jac ( C ) ∨ \lambda: \operatorname{Jac}(C) \to\operatorname{Jac}(C)^{\vee} λ : Jac ( C ) → Jac ( C ) ∨ Jac ( C ) \operatorname{Jac}(C) Jac ( C )
Example A.2 (products). If ( A 1 , λ 1 ) (A_1,\lambda_1) ( A 1 , λ 1 ) ( A 2 , λ 2 ) (A_2,\lambda_2) ( A 2 , λ 2 ) D 1 , D 2 D_1,D_2 D 1 , D 2
comes with the product polarization λ 1 × λ 2 \lambda_1 \times\lambda_2 λ 1 × λ 2 D 1 × A 2 + A 1 × D 2 D_1 \times A_2 + A_1 \times D_2 D 1 × A 2 + A 1 × D 2
Rosati involution. With every homomorphism φ : A 1 → A 2 \varphi: A_1 \to A_2 φ : A 1 → A 2 φ ^ : A 2 ∨ → A 1 ∨ \hat{\varphi} : A_2^\vee\to A_1^\vee φ ^ : A 2 ∨ → A 1 ∨ A 2 A_2 A 2 φ \varphi φ λ 1 , λ 2 \lambda_1, \lambda_2 λ 1 , λ 2 A 1 , A 2 A_1, A_2 A 1 , A 2
φ † = λ 1 − 1 ∘ φ ^ ∘ λ 2 : A 2 → A 1 . \varphi^\dagger= \lambda_1^{-1} \circ\hat{\varphi} \circ\lambda_2 : A_2 \to A_1. φ † = λ 1 − 1 ∘ φ ^ ∘ λ 2 : A 2 → A 1 . When applied to endomorphisms of a PPAV ( A , λ ) (A,\lambda) ( A , λ ) End ( A ) \operatorname{End}(A) End ( A ) End 0 ( A ) \operatorname{End}^{0}(A) End 0 ( A ) λ \lambda λ α ↦ Tr ( α α † ) \alpha\mapsto\operatorname{Tr}(\alpha\alpha^\dagger) α ↦ Tr ( α α † ) End 0 ( A ) \operatorname{End}^{0}(A) End 0 ( A ) Tr ( x ) \operatorname{Tr}(x) Tr ( x ) x x x Q \mathbb{Q} Q End 0 ( A ) \operatorname{End}^{0}(A) End 0 ( A )
Example A.3. Any homomorphism φ : A 1 × A 2 → B 1 × B 2 \varphi: A_1 \times A_2 \to B_1 \times B_2 φ : A 1 × A 2 → B 1 × B 2
( φ 11 φ 21 φ 12 φ 22 ) \begin{pmatrix}
\varphi_{11} & \varphi_{21} \\
\varphi_{12} & \varphi_{22}
\end{pmatrix} ( φ 11 φ 12 φ 21 φ 22 ) of homomorphisms φ i j : A i → B j \varphi_{ij} : A_i \to B_j φ ij : A i → B j A 1 , A 2 , B 1 , B 2 A_1, A_2, B_1, B_2 A 1 , A 2 , B 1 , B 2
φ † = ( φ 11 † φ 12 † φ 21 † φ 22 † ) . (8) \varphi^\dagger=
\begin{pmatrix}
\varphi_{11}^\dagger& \varphi_{12}^\dagger\\
\varphi_{21}^\dagger& \varphi_{22}^\dagger
\end{pmatrix}. \tag*{(8)} φ † = ( φ 11 † φ 21 † φ 12 † φ 22 † ) . (8) which can be thought of as a “conjugate-transpose”. This naturally generalizes to homomorphisms between products of arbitrarily many abelian varieties.
Polarized isogenies. If φ : A 1 → A 2 \varphi: A_1 \to A_2 φ : A 1 → A 2 λ 2 \lambda_2 λ 2 A 2 A_2 A 2 φ ^ ∘ λ 2 ∘ φ \hat{\varphi} \circ\lambda_2 \circ\varphi φ ^ ∘ λ 2 ∘ φ A 1 A_1 A 1 λ 1 \lambda_1 λ 1 A 1 A_1 A 1 A 1 A_1 A 1 λ 1 ∘ α \lambda_1 \circ\alpha λ 1 ∘ α α \alpha α A 1 A_1 A 1 α = α † \alpha= \alpha^\dagger α = α † α \alpha α φ ^ ∘ λ 2 ∘ φ \hat{\varphi} \circ\lambda_2 \circ\varphi φ ^ ∘ λ 2 ∘ φ α ∈ End ( A 1 ) \alpha\in\operatorname{End}(A_1) α ∈ End ( A 1 )
\begin{CD}
A_1 @<\alpha<< A_1 @>\varphi>> A_2 \\
@V\lambda_1VV @. @VV\lambda_2V \\
A_1^\vee@<\hat{\varphi}<< A_2^\vee
\end{CD}
commutes. We then say that φ : ( A 1 , λ 1 ) → ( A 2 , λ 2 ) \varphi: (A_1,\lambda_1) \to(A_2,\lambda_2) φ : ( A 1 , λ 1 ) → ( A 2 , λ 2 ) α \alpha α α \alpha α α = N ∈ Z > 0 \alpha= N \in\mathbb{Z}_{>0} α = N ∈ Z > 0 N N N N g N^g N g N N N degrd ( φ ) \operatorname{degrd}(\varphi) degrd ( φ ) [70 Prop. 13.8] :
Proposition A.4. Let ( A 1 , λ 1 ) (A_1,\lambda_1) ( A 1 , λ 1 ) H ⊂ A 1 H \subset A_1 H ⊂ A 1 p p p α ∈ End ( A 1 ) \alpha\in\operatorname{End}(A_1) α ∈ End ( A 1 ) φ : A 1 → A 2 \varphi: A_1 \to A_2 φ : A 1 → A 2 H H H λ 2 \lambda_2 λ 2 A 2 A_2 A 2 φ : ( A 1 , λ 1 ) → ( A 2 , λ 2 ) \varphi: (A_1,\lambda_1) \to(A_2,\lambda_2) φ : ( A 1 , λ 1 ) → ( A 2 , λ 2 ) α \alpha α H H H
e α ( P , λ 1 ( Q ) ) = 1 , ∀ P , Q ∈ H , e_\alpha(P,\lambda_1(Q)) = 1,\qquad\forall P,Q \in H, e α ( P , λ 1 ( Q )) = 1 , ∀ P , Q ∈ H , where e α e_\alpha e α α \alpha α A 1 A_1 A 1 λ 2 \lambda_2 λ 2
Example A.5 (IKO matrices). Let E E E k k k p > 0 p > 0 p > 0 ϑ : O → End ( E ) \vartheta: \mathcal{O} \to\operatorname{End}(E) ϑ : O → End ( E ) O ⊂ B p , ∞ \mathcal{O} \subset B_{p,\infty} O ⊂ B p , ∞ p p p ∞ \infty ∞ A = E 2 A = E^2 A = E 2 λ 1 \lambda_1 λ 1 A A A λ 1 ∘ ϑ ( g ) \lambda_1 \circ\vartheta(g) λ 1 ∘ ϑ ( g )
g = ( s r r ˉ t ) , s , t ∈ Z > 0 , r ∈ O , s t − r r ˉ = 1 , g = \begin{pmatrix} s & r \\ \bar{r} & t \end{pmatrix},\qquad s,t \in\mathbb{Z}_{>0},\ r \in\mathcal{O},\ st-r\bar{r}=1, g = ( s r ˉ r t ) , s , t ∈ Z > 0 , r ∈ O , s t − r r ˉ = 1 , and ϑ \vartheta ϑ [49 ] where this is detailed; see § 5 .
Omitted proofs
Proof (of Lemma 2.4). Let ε 1 , … , ε g − 1 \varepsilon_1,\ldots,\varepsilon_{g-1} ε 1 , … , ε g − 1 R 0 R_0 R 0 ( R , ε i 2 ) ∈ P R (R,\varepsilon_i^2) \in P_R ( R , ε i 2 ) ∈ P R i i i a = R \mathfrak{a}=R a = R
[ ( R , ε 1 e 1 ⋯ ε g − 1 e g − 1 ) ] , e i ∈ { 0 , 1 } . (9) [(R,\varepsilon_1^{e_1}\cdots\varepsilon_{g-1}^{e_{g-1}})],\qquad e_i \in\{0,1\}. \tag*{(9)} [( R , ε 1 e 1 ⋯ ε g − 1 e g − 1 )] , e i ∈ { 0 , 1 } . (9) The lemma follows because a a ˉ = μ 1 R = μ 2 R \mathfrak{a}\bar{\mathfrak{a}}=\mu_1R=\mu_2R a a ˉ = μ 1 R = μ 2 R μ 1 − 1 μ 2 ∈ R 0 + \mu_1^{-1}\mu_2 \in R_0^+ μ 1 − 1 μ 2 ∈ R 0 + □ \square □
Remark A.6. Not all expressions of the form (9) are valid Shimura classes: this is the case only if ε 1 e 1 ⋯ ε g − 1 e g − 1 \varepsilon_1^{e_1}\cdots\varepsilon_{g-1}^{e_{g-1}} ε 1 e 1 ⋯ ε g − 1 e g − 1 e 1 = e 2 = … = e g − 1 = 0 e_1=e_2=\ldots=e_{g-1}=0 e 1 = e 2 = … = e g − 1 = 0 [ ( a , μ ) ] [(\mathfrak{a},\mu)] [( a , μ )] a \mathfrak{a} a μ \mu μ a \mathfrak{a} a ε ≠ 1 \varepsilon\ne1 ε = 1 [ ( R , ε ) ] [(R,\varepsilon)] [( R , ε )] ε = α α ˉ \varepsilon=\alpha\bar{\alpha} ε = α α ˉ α ∈ R \alpha\in R α ∈ R ( R , ε ) = ( α R , α α ˉ ) ∈ P R (R,\varepsilon)=(\alpha R,\alpha\bar{\alpha}) \in P_R ( R , ε ) = ( α R , α α ˉ ) ∈ P R
Proof (of Lemma 2.6 ). Consider a Shimura ideal ( a , μ ) (\mathfrak{a},\mu) ( a , μ ) a ⊂ R \mathfrak{a} \subset R a ⊂ R n n n n μ a \frac{n}{\mu}\mathfrak{a} μ n a
[ ( a , μ ) ] 2 = [ ( a 2 , μ 2 ) ] = [ ( n μ a 2 , n n ‾ μ μ ‾ μ 2 ) ] = [ ( n μ a 2 , n 2 ) ] . [(\mathfrak{a},\mu)]^{2}=[(\mathfrak{a}^{2},\mu^{2})]=\left[\left(\frac{n}{\mu}\mathfrak{a}^{2},\frac{n\overline{n}}{\mu\overline{\mu}}\mu^{2}\right)\right]=\left[\left(\frac{n}{\mu}\mathfrak{a}^{2},n^{2}\right)\right]. [( a , μ ) ] 2 = [( a 2 , μ 2 )] = [ ( μ n a 2 , μ μ n n μ 2 ) ] = [ ( μ n a 2 , n 2 ) ] . where we have used that n = n ‾ n=\overline{n} n = n μ = μ ‾ \mu=\overline{\mu} μ = μ
Remark A.7. Based on computational evidence, we expect the dichotomy
[ C ( R ) : C ( R ) Z ] ∈ { 1 , # C ( R ) [ 2 ] } [\mathcal{C}(R):\mathcal{C}(R)_{\mathbb{Z}}]\in\{1,\#\mathcal{C}(R)[2]\} [ C ( R ) : C ( R ) Z ] ∈ { 1 , # C ( R ) [ 2 ]} to hold for any CM order R ⊂ K R\subset K R ⊂ K
Proof (of Theorem 2.7 ). Although it is hard to pinpoint a reference not putting additional assumptions on R R R k k k [89 ] or Deligne modules [65 ] , the arguments are standard. We highlight the constructive aspects of the proof, because these indicate how to work with the action, and are more concise about the remaining details. Let ( A 1 , λ 1 , ι 1 ) ∈ M k ( R ) (A_{1},\lambda_{1},\iota_{1})\in\mathcal{M}_{k}(R) ( A 1 , λ 1 , ι 1 ) ∈ M k ( R ) [ ( a , μ ) ] ∈ C ( R ) [(\mathfrak{a},\mu)]\in\mathcal{C}(R) [( a , μ )] ∈ C ( R )
( A 2 , λ 2 , ι 2 ) = [ ( a , μ ) ] ⋆ ( A 1 , λ 1 , ι 1 ) , (A_{2},\lambda_{2},\iota_{2})=[(\mathfrak{a},\mu)]\star(A_{1},\lambda_{1},\iota_{1}), ( A 2 , λ 2 , ι 2 ) = [( a , μ )] ⋆ ( A 1 , λ 1 , ι 1 ) , a priori as an element of M k ( K ) \mathcal{M}_{k}(K) M k ( K ) M k ( R ) \mathcal{M}_{k}(R) M k ( R ) a \mathfrak{a} a μ \mu μ a \mathfrak{a} a p p p
H = ⋂ x ∈ a ker ι 1 ( x ) H=\bigcap_{x\in\mathfrak{a}}\ker\iota_{1}(x) H = x ∈ a ⋂ ker ι 1 ( x ) of A 1 A_{1} A 1 N K / Q ( a ) N_{K/\mathbb{Q}}(\mathfrak{a}) N K / Q ( a ) φ : A 1 → A 2 : = A 1 / H \varphi:A_{1}\to A_{2}:=A_{1}/H φ : A 1 → A 2 := A 1 / H a \mathfrak{a} a a \mathfrak{a} a A 1 A_{1} A 1 [72 §7] ). Writing μ = ∑ i x i y ‾ i \mu=\sum_{i}x_{i}\overline{y}_{i} μ = ∑ i x i y i x i , y i ∈ a x_{i},y_{i}\in\mathfrak{a} x i , y i ∈ a z i = x i y ‾ i / μ ∈ R z_{i}=x_{i}\overline{y}_{i}/\mu\in R z i = x i y i / μ ∈ R ∑ i z i = 1 \sum_{i}z_{i}=1 ∑ i z i = 1 P , Q ∈ H P,Q\in H P , Q ∈ H
e ι ( μ ) ( P , λ 1 ( Q ) ) = ∏ i e ι ( μ ) ( ι ( z i ) ( P ) , λ 1 ( Q ) ) = ∏ i e ι ( x i ) ι ( y i ) ( P , λ 1 ( Q ) ) e ι ( y i ) ( ι ( x i ) ( P ) , λ 1 ( Q ) ) = ∏ i e ι ( y i ) † ( ι ( x i ) ( P ) , λ 1 ( Q ) ) = ∏ i e ι ( y i ) † ( 0 , λ 1 ( Q ) ) = 1 \begin{aligned}
e_{\iota(\mu)}(P,\lambda_{1}(Q))=\prod_{i}e_{\iota(\mu)}(\iota(z_{i})(P),\lambda_{1}(Q))=\prod_{i}\frac{e_{\iota(x_{i})\iota(y_{i})}(P,\lambda_{1}(Q))}{e_{\iota(y_{i})}(\iota(x_{i})(P),\lambda_{1}(Q))} \\
&=\prod_{i}e_{\iota(y_{i})^{\dagger}}(\iota(x_{i})(P),\lambda_{1}(Q))=\prod_{i}e_{\iota(y_{i})^{\dagger}}(0,\lambda_{1}(Q))=1
\end{aligned} e ι ( μ ) ( P , λ 1 ( Q )) = i ∏ e ι ( μ ) ( ι ( z i ) ( P ) , λ 1 ( Q )) = i ∏ e ι ( y i ) ( ι ( x i ) ( P ) , λ 1 ( Q )) e ι ( x i ) ι ( y i ) ( P , λ 1 ( Q )) = i ∏ e ι ( y i ) † ( ι ( x i ) ( P ) , λ 1 ( Q )) = i ∏ e ι ( y i ) † ( 0 , λ 1 ( Q )) = 1 where we have used some standard properties of the Weil pairing which, e.g., can be found in [82 §3.1] , and the fact that λ 1 ( Q ) \lambda_{1}(Q) λ 1 ( Q ) ι ( y i ) † \iota(y_{i})^{\dagger} ι ( y i ) † Proposition A.4 there is a unique principal polarization λ 2 \lambda_{2} λ 2 A 2 A_{2} A 2 φ \varphi φ ι 1 ( μ ) \iota_{1}(\mu) ι 1 ( μ ) ι 2 : K → End 0 ( A 2 ) \iota_{2}:K\to\operatorname{End}^{0}(A_{2}) ι 2 : K → End 0 ( A 2 )
ι 2 : α ↦ ( φ ∘ ι 1 ( α ) ∘ φ † ) ( φ ∘ φ † ) . (10) \iota_{2}:\alpha\mapsto\frac{(\varphi\circ\iota_{1}(\alpha)\circ\varphi^{\dagger})}{(\varphi\circ\varphi^{\dagger})}. \tag*{(10)} ι 2 : α ↦ ( φ ∘ φ † ) ( φ ∘ ι 1 ( α ) ∘ φ † ) . (10) From the multiplicativity of the unpolarized action [72 Prop. 7.28] it is not hard to deduce that acting in this way with ( a b , μ ν ) (ab,\mu\nu) ( ab , μν ) ( a , μ ) (a,\mu) ( a , μ ) ( b , ν ) (b,\nu) ( b , ν ) ( μ R , μ μ ˉ ) (\mu R,\mu\bar{\mu}) ( μ R , μ μ ˉ ) μ ∈ R \mu\in R μ ∈ R C ( R ) \mathcal{C}(R) C ( R ) M k ( R ) ⊂ M k ( K ) \mathcal{M}_k(R) \subset\mathcal{M}_k(K) M k ( R ) ⊂ M k ( K ) [63 Proof of Lem. 27] for more details on this step. □ \square □
Endomorphism rings of some well-known supersingular elliptic curves
We include explicit descriptions of the endomorphism rings of certain “extremal” supersingular elliptic curves:
y 2 = x 3 + x y^2 = x^3 + x y 2 = x 3 + x p ≡ 3 ( m o d 4 ) p \equiv3 \pmod{4} p ≡ 3 ( mod 4 ) j j j
y 2 = x 3 + 1 y^2 = x^3 + 1 y 2 = x 3 + 1 p ≡ 5 ( m o d 6 ) p \equiv5 \pmod{6} p ≡ 5 ( mod 6 ) j j j [69 Prop. 3.2] but this description is wrongly attributed to y 2 = x 3 − 1 y^2 = x^3 - 1 y 2 = x 3 − 1
y 2 = x 3 + 12 x 2 + 18 x y^2 = x^3 + 12x^2 + 18x y 2 = x 3 + 12 x 2 + 18 x p ≡ 5 ( m o d 8 ) p \equiv5 \pmod{8} p ≡ 5 ( mod 8 ) j j j [56 Lem. 3] it was studied as an abstract maximal order in B p , ∞ B_{p,\infty} B p , ∞
We do not cover other congruence classes of p p p [56 Lem. 4] for the cases p ≡ 1 ( m o d 4 ) p \equiv1 \pmod{4} p ≡ 1 ( mod 4 ) [14 Ftn. 4] . Since [69 , 56 ] are frequently cited references and the typos have been copied into the existing literature, we hope that this appendix helps in cleaning up the landscape.
Lemma B.1. Let p ≡ 3 ( m o d 4 ) p \equiv3 \pmod{4} p ≡ 3 ( mod 4 )
B p , ∞ = ( − 1 , − p Q ) B_{p,\infty} = \left(\frac{-1,-p}{\mathbb{Q}}\right) B p , ∞ = ( Q − 1 , − p ) ramified at p p p ∞ \infty ∞ 1 , i , j , k 1,i,j,k 1 , i , j , k i 2 = − 1 i^2=-1 i 2 = − 1 j 2 = − p j^2=-p j 2 = − p k = i j = − j i k=ij=-ji k = ij = − j i Q \mathbb{Q} Q i ∈ F p 2 i \in\mathbb{F}_{p^2} i ∈ F p 2 − 1 -1 − 1 E : y 2 = x 3 + x E:y^2=x^3+x E : y 2 = x 3 + x F p \mathbb{F}_p F p j j j
ι : ( x , y ) ↦ ( − x , i y ) \iota:(x,y)\mapsto(-x,iy) ι : ( x , y ) ↦ ( − x , i y ) satisfying ι 2 = [ − 1 ] \iota^2=[-1] ι 2 = [ − 1 ]
1 ↦ [ 1 ] , i ↦ ι , j ↦ π p , k ↦ ι π p (11) 1\mapsto[1],\quad i\mapsto\iota,\quad j\mapsto\pi_p,\quad k\mapsto\iota\pi_p \tag*{(11)} 1 ↦ [ 1 ] , i ↦ ι , j ↦ π p , k ↦ ι π p (11) :::`
defines a ring isomorphism
Z ⟨ 1 , i , i + j 2 , 1 + k 2 ⟩ → End ( E ) , \mathbb{Z}\left\langle1,i,\frac{i+j}{2},\frac{1+k}{2}\right\rangle\to\operatorname{End}(E), Z ⟨ 1 , i , 2 i + j , 2 1 + k ⟩ → End ( E ) , where π p \pi_p π p p p p E E E
Proof. As mentioned, this is standard, and easier than the lemmata below, so we will be concise. It is immediate that ι 2 = [ − 1 ] \iota^2=[-1] ι 2 = [ − 1 ] p ≡ 3 m o d 4 p \equiv3 \bmod4 p ≡ 3 mod 4 ι π p = − π p ι \iota\pi_p=-\pi_p\iota ι π p = − π p ι B p , ∞ → End 0 ( E ) B_{p,\infty}\to\operatorname{End}^0(E) B p , ∞ → End 0 ( E ) ( i + j ) / 2 (i+j)/2 ( i + j ) /2 ( 1 + k ) / 2 (1+k)/2 ( 1 + k ) /2 E E E [91 Cor. III.4.11] is equivalent to
E [ 2 ] ⊂ ker ( ι + π p ) , ker ( [ 1 ] + ι π p ) , E[2]\subset\ker(\iota+\pi_p),\ker([1]+\iota\pi_p), E [ 2 ] ⊂ ker ( ι + π p ) , ker ([ 1 ] + ι π p ) , but that is immediate from E [ 2 ] = { 0 , ( 0 , 0 ) , ( i , 0 ) , ( − i , 0 ) } E[2]=\{0,(0,0),(i,0),(-i,0)\} E [ 2 ] = { 0 , ( 0 , 0 ) , ( i , 0 ) , ( − i , 0 )} Z ⟨ 1 , i , ( i + j ) / 2 , ( 1 + k ) / 2 ⟩ \mathbb{Z}\langle1,i,(i+j)/2,(1+k)/2\rangle Z ⟨ 1 , i , ( i + j ) /2 , ( 1 + k ) /2 ⟩ B p , ∞ B_{p,\infty} B p , ∞
Lemma B.2. Let p ≡ 5 m o d 6 p\equiv5\bmod6 p ≡ 5 mod 6
B p , ∞ = ( − 3 , − p Q ) B_{p,\infty}=\left(\frac{-3,-p}{\mathbb{Q}}\right) B p , ∞ = ( Q − 3 , − p ) ramified at p p p ∞ \infty ∞ 1 , i , j , k 1,i,j,k 1 , i , j , k i 2 = − 3 i^2=-3 i 2 = − 3 j 2 = − p j^2=-p j 2 = − p k = i j = − j i k=ij=-ji k = ij = − j i Q \mathbb{Q} Q z ∈ F p 2 z\in\mathbb{F}_{p^2} z ∈ F p 2 E : y 2 = x 3 + 1 E:y^2=x^3+1 E : y 2 = x 3 + 1 F p \mathbb{F}_p F p j j j
ω : ( x , y ) ↦ ( z x , y ) \omega:(x,y)\mapsto(zx,y) ω : ( x , y ) ↦ ( z x , y ) satisfying ω 2 + ω + [ 1 ] = 0 \omega^2+\omega+[1]=0 ω 2 + ω + [ 1 ] = 0 Ω = [ 2 ] ω + [ 1 ] \Omega=[2]\omega+[1] Ω = [ 2 ] ω + [ 1 ] π p \pi_p π p p p p E E E
1 ↦ [ 1 ] , i ↦ Ω , j ↦ π p , k ↦ Ω π p 1\mapsto[1],\quad i\mapsto\Omega,\quad j\mapsto\pi_p,\quad k\mapsto\Omega\pi_p 1 ↦ [ 1 ] , i ↦ Ω , j ↦ π p , k ↦ Ω π p defines an isomorphism
Z ⟨ 1 , − 1 + i 2 , j , 3 + i + 3 j + k 6 ⟩ → End ( E ) (12) \mathbb{Z}\left\langle1,\frac{-1+i}{2},j,\frac{3+i+3j+k}{6}\right\rangle\to\operatorname{End}(E) \tag*{(12)} Z ⟨ 1 , 2 − 1 + i , j , 6 3 + i + 3 j + k ⟩ → End ( E ) (12) of rings.
Proof. It is easy to check that the (horizontal) line connecting two points of the form ( z x 0 , y 0 ) (zx_0,y_0) ( z x 0 , y 0 ) ( z 2 x 0 , y 0 ) (z^2x_0,y_0) ( z 2 x 0 , y 0 ) ( x 0 , y 0 ) (x_0,y_0) ( x 0 , y 0 ) E E E ω 2 + ω + [ 1 ] = 0 \omega^2+\omega+[1]=0 ω 2 + ω + [ 1 ] = 0 ( 0 , 1 ) (0,1) ( 0 , 1 ) ( 0 , − 1 ) (0,-1) ( 0 , − 1 )
An easy calculation shows Ω 2 = [ − 3 ] \Omega^2=[-3] Ω 2 = [ − 3 ] π p 2 = [ − p ] \pi_p^2=[-p] π p 2 = [ − p ] π p ω = ω 2 π p \pi_p\omega=\omega^2\pi_p π p ω = ω 2 π p Ω π p = − π p Ω \Omega\pi_p=-\pi_p\Omega Ω π p = − π p Ω
define an isomorphism between B p , ∞ B_{p,\infty} B p , ∞ End 0 ( E ) \operatorname{End}^{0}(E) End 0 ( E ) ( − 1 + i ) / 2 ↦ ω (-1+i)/2 \mapsto\omega ( − 1 + i ) /2 ↦ ω
[ 3 ] + Ω + [ 3 ] π p + Ω π p = [ 4 ] + [ 2 ] ω + [ 4 ] π p + [ 2 ] ω π p (13) [3]+\Omega+[3]\pi_{p}+\Omega\pi_{p}=[4]+[2]\omega+[4]\pi_{p}+[2]\omega\pi_{p} \tag*{(13)} [ 3 ] + Ω + [ 3 ] π p + Ω π p = [ 4 ] + [ 2 ] ω + [ 4 ] π p + [ 2 ] ω π p (13) annihilates E [ 6 ] E[6] E [ 6 ] End ( E ) \operatorname{End}(E) End ( E )
It obviously annihilates E [ 2 ] E[2] E [ 2 ] E [ 3 ] E[3] E [ 3 ] 3 x ( x 3 + 4 ) 3x(x^{3}+4) 3 x ( x 3 + 4 ) E E E ( 0 , ± 1 ) (0,\pm1) ( 0 , ± 1 )
( t , ± − 3 ) , ( z t , ± − 3 ) , ( z 2 t , ± − 3 ) (t,\pm\sqrt{-3}),\quad(zt,\pm\sqrt{-3}),\quad(z^{2}t,\pm\sqrt{-3}) ( t , ± − 3 ) , ( z t , ± − 3 ) , ( z 2 t , ± − 3 ) with t = ( − 4 ) − ( p − 2 ) / 3 ∈ F p t=(-4)^{-(p-2)/3}\in\mathbb{F}_{p} t = ( − 4 ) − ( p − 2 ) /3 ∈ F p π p \pi_{p} π p
on ( 0 , ± 1 ) (0,\pm1) ( 0 , ± 1 ) ω − [ 1 ] \omega-[1] ω − [ 1 ]
on ( t , ± − 3 ) (t,\pm\sqrt{-3}) ( t , ± − 3 )
on ( z t , ± − 3 ) (zt,\pm\sqrt{-3}) ( z t , ± − 3 ) − ω -\omega − ω [ 3 ] [3] [ 3 ]
similarly, on ( z 2 t , ± − 3 ) (z^{2}t,\pm\sqrt{-3}) ( z 2 t , ± − 3 ) − ω 2 -\omega^{2} − ω 2 [ 3 ] [3] [ 3 ]
This concludes the proof.
Remark B.3. In contrast with what is claimed in [69 Prop. 3.2] the statement fails for E : y 2 = x 3 − 1 E:y^{2}=x^{3}-1 E : y 2 = x 3 − 1 p ≡ 3 ( m o d 4 ) p\equiv3\pmod{4} p ≡ 3 ( mod 4 ) F p \mathbb{F}_{p} F p ( t , ± 3 ) ∈ E [ 3 ] (t,\pm\sqrt{3})\in E[3] ( t , ± 3 ) ∈ E [ 3 ] t = 4 − ( p − 2 ) / 3 ∈ F p t=4^{-(p-2)/3}\in\mathbb{F}_{p} t = 4 − ( p − 2 ) /3 ∈ F p ω − [ 1 ] \omega-[1] ω − [ 1 ]
Lemma B.4. Let p ≡ 5 ( m o d 8 ) p\equiv5\pmod{8} p ≡ 5 ( mod 8 )
B p , ∞ = ( − 2 , − p Q ) B_{p,\infty}=\left(\frac{-2,-p}{\mathbb{Q}}\right) B p , ∞ = ( Q − 2 , − p ) ramified at p p p ∞ \infty ∞ 1 , i , j , k 1,i,j,k 1 , i , j , k i 2 = − 2 i^{2}=-2 i 2 = − 2 j 2 = − p j^{2}=-p j 2 = − p k = i j = − j i k=ij=-ji k = ij = − j i Q \mathbb{Q} Q z ∈ F p 2 z\in\mathbb{F}_{p^{2}} z ∈ F p 2 − 2 -2 − 2 E : y 2 = x 3 + 12 x 2 + 18 x E:y^{2}=x^{3}+12x^{2}+18x E : y 2 = x 3 + 12 x 2 + 18 x F p \mathbb{F}_{p} F p j j j
ϑ : ( x , y ) ↦ ( − y 2 2 x 2 , z 4 y ( 1 − 18 x 2 ) ) \vartheta:(x,y)\mapsto\left(-\frac{y^{2}}{2x^{2}},\frac{z}{4}y\left(1-\frac{18}{x^{2}}\right)\right) ϑ : ( x , y ) ↦ ( − 2 x 2 y 2 , 4 z y ( 1 − x 2 18 ) ) satisfying ϑ 2 = [ − 2 ] \vartheta^{2}=[-2] ϑ 2 = [ − 2 ]
1 ↦ [ 1 ] , i ↦ ϑ , j ↦ π p , k ↦ ϑ π p (14) 1\mapsto[1],\quad i\mapsto\vartheta,\quad j\mapsto\pi_{p},\quad k\mapsto\vartheta\pi_{p} \tag*{(14)} 1 ↦ [ 1 ] , i ↦ ϑ , j ↦ π p , k ↦ ϑ π p (14) defines a ring isomorphism
Z ⟨ 1 , i , 1 + i + j 2 , i + 2 j ± k 4 ⟩ → End ( E ) (15) \mathbb{Z}\left\langle1,i,\frac{1+i+j}{2},\frac{i+2j\pm k}{4}\right\rangle\to\operatorname{End}(E) \tag*{(15)} Z ⟨ 1 , i , 2 1 + i + j , 4 i + 2 j ± k ⟩ → End ( E ) (15) where the sign ± \pm ± + + + p ≡ 5 , 13 ( m o d 48 ) p \equiv5,13 \pmod{48} p ≡ 5 , 13 ( mod 48 ) − - − p ≡ 29 , 37 ( m o d 48 ) p \equiv29,37 \pmod{48} p ≡ 29 , 37 ( mod 48 ) π p \pi_p π p p p p
Proof. In the proof all occurrences of ± \pm ± + + + p ≡ 5 , 13 ( m o d 48 ) p \equiv5,13 \pmod{48} p ≡ 5 , 13 ( mod 48 ) − - − p ≡ 29 , 37 ( m o d 48 ) p \equiv29,37 \pmod{48} p ≡ 29 , 37 ( mod 48 ) ∓ \mp ∓ i ∈ F p i \in\mathbb{F}_p i ∈ F p − 1 -1 − 1
It is easy to check that ϑ \vartheta ϑ
ϑ 2 = [ − 2 ] . \vartheta^2=[-2]. ϑ 2 = [ − 2 ] . It is also easy to see that π p 2 = [ − p ] \pi_p^2=[-p] π p 2 = [ − p ] ϑ π p = − π p ϑ \vartheta\pi_p=-\pi_p\vartheta ϑ π p = − π p ϑ B p , ∞ B_{p,\infty} B p , ∞ End 0 ( E ) \operatorname{End}^{0}(E) End 0 ( E )
E [ 2 ] ⊂ ker ( [ 1 ] + ϑ + π p ) , E [ 4 ] ⊂ ker ( ϑ + [ 2 ] π p ± ϑ π p ) . E[2]\subset\ker([1]+\vartheta+\pi_p), \qquad E[4]\subset\ker(\vartheta+[2]\pi_p\pm\vartheta\pi_p). E [ 2 ] ⊂ ker ([ 1 ] + ϑ + π p ) , E [ 4 ] ⊂ ker ( ϑ + [ 2 ] π p ± ϑ π p ) . because this implies that the left-hand side of (14) indeed lands inside End ( E ) \operatorname{End}(E) End ( E )
We do this in an artisanal way. First, write O = ( 0 , 0 ) O=(0,0) O = ( 0 , 0 ) T 0 = ( − 6 + 3 i z , 0 ) T_0=(-6+3iz,0) T 0 = ( − 6 + 3 i z , 0 ) T 1 = ( − 6 − 3 i z , 0 ) T_1=(-6-3iz,0) T 1 = ( − 6 − 3 i z , 0 ) E E E
ϑ ( O ) = 0 , ϑ ( T 0 ) = ϑ ( T 1 ) = O \vartheta(O)=0,\qquad\vartheta(T_0)=\vartheta(T_1)=O ϑ ( O ) = 0 , ϑ ( T 0 ) = ϑ ( T 1 ) = O and
π p ( O ) = O , π p ( T ℓ ) = T 1 − ℓ for ℓ = 0 , 1 \pi_p(O)=O,\qquad\pi_p(T_\ell)=T_{1-\ell}\quad\text{for }\ell=0,1 π p ( O ) = O , π p ( T ℓ ) = T 1 − ℓ for ℓ = 0 , 1 one indeed checks that [ 1 ] + ϑ + π p [1]+\vartheta+\pi_p [ 1 ] + ϑ + π p E [ 2 ] E[2] E [ 2 ]
The remainder of the proof is a bit more tedious. By explicit calculation, the points of order 4 are seen to be groupable as follows:
the halves of O O O x x x 3 i z 3iz 3 i z − 3 i z -3iz − 3 i z
the halves of T 0 T_0 T 0 x x x
− 6 + 3 i z + 6 1 − i z , − 6 + 3 i z − 6 1 − i z , -6+3iz+6\sqrt{1-iz},\quad-6+3iz-6\sqrt{1-iz}, − 6 + 3 i z + 6 1 − i z , − 6 + 3 i z − 6 1 − i z , − 6 − 3 i z + 6 1 + i z , − 6 − 3 i z − 6 1 + i z . -6-3iz+6\sqrt{1+iz},\quad-6-3iz-6\sqrt{1+iz}. − 6 − 3 i z + 6 1 + i z , − 6 − 3 i z − 6 1 + i z . These x x x F p 2 \mathbb{F}_{p^2} F p 2 1 + i z 1+iz 1 + i z 1 − i z 1-iz 1 − i z F p 2 \mathbb{F}_{p^2} F p 2 π p 2 = [ − p ] \pi_p^2=[-p] π p 2 = [ − p ] P ∈ E [ 4 ] P\in E[4] P ∈ E [ 4 ] π p 2 ( P ) = [ − p ] P = − P \pi_p^2(P)=[-p]P=-P π p 2 ( P ) = [ − p ] P = − P p ≡ 1 ( m o d 4 ) p\equiv1\pmod4 p ≡ 1 ( mod 4 ) y y y F p 2 \mathbb{F}_{p^2} F p 2 F p 4 \mathbb{F}_{p^4} F p 4
It is immediate to see how [ 2 ] π p = π p [ 2 ] [2]\pi_p=\pi_p[2] [ 2 ] π p = π p [ 2 ] O O O T 1 T_1 T 1 T 0 T_0 T 0
ϑ ( 1 ± π p ) = ( 1 ∓ π p ) ϑ \vartheta(1\pm\pi_p)=(1\mp\pi_p)\vartheta ϑ ( 1 ± π p ) = ( 1 ∓ π p ) ϑ also maps the halves of O O O O O O T 0 T_0 T 0 T 1 T_1 T 1 T 1 T_1 T 1 T 0 T_0 T 0 p p p
Let us first concentrate on the halves of O O O O ∈ ker ϑ O \in\ker\vartheta O ∈ ker ϑ ϑ 2 = [ − 2 ] \vartheta^2=[-2] ϑ 2 = [ − 2 ] { T 0 , T 1 } \{T_0,T_1\} { T 0 , T 1 } ϑ \vartheta ϑ ( 1 ± π p ) ϑ (1 \pm\pi_p)\vartheta ( 1 ± π p ) ϑ O O O T 0 + T 1 = O T_0+T_1=O T 0 + T 1 = O
Now consider a half of T ℓ T_\ell T ℓ ℓ ∈ { 0 , 1 } \ell\in\{0,1\} ℓ ∈ { 0 , 1 } ϑ ( T ℓ ) = O \vartheta(T_\ell)=O ϑ ( T ℓ ) = O O O O ϑ \vartheta ϑ ( 1 ∓ π p ) ϑ (1 \mp\pi_p)\vartheta ( 1 ∓ π p ) ϑ T ℓ T_\ell T ℓ O O O x x x 2 2 2 O O O { T 0 , T 1 } \{T_0,T_1\} { T 0 , T 1 } T 1 − ℓ T_{1-\ell} T 1 − ℓ
We concentrate on a half H H H T 0 T_0 T 0
ϑ ( H ) = ( − 3 i z , y 0 ) \vartheta(H)=(-3iz,y_0) ϑ ( H ) = ( − 3 i z , y 0 ) for some y y y y 0 ∈ F p 4 y_0 \in\mathbb{F}_{p^4} y 0 ∈ F p 4
π p ϑ ( H ) = ( 3 i z , y 0 p ) \pi_p\vartheta(H)=(3iz,y_0^p) π p ϑ ( H ) = ( 3 i z , y 0 p ) and the usual addition formula shows that the x x x ( 1 ∓ π p ) ϑ ( H ) (1\mp\pi_p)\vartheta(H) ( 1 ∓ π p ) ϑ ( H )
( ∓ y 0 p − y 0 6 i z ) 2 − 12 = 1 72 ( y 0 p ∓ y 0 ) 2 − 12 = 1 72 ( ( y 0 2 ) p ± 2 y 0 p + 1 + y 0 2 ) − 12. \left(\frac{\mp y_0^p-y_0}{6iz}\right)^2-12=\frac{1}{72}(y_0^p\mp y_0)^2-12=\frac{1}{72}\left((y_0^2)^p\pm2y_0^{p+1}+y_0^2\right)-12. ( 6 i z ∓ y 0 p − y 0 ) 2 − 12 = 72 1 ( y 0 p ∓ y 0 ) 2 − 12 = 72 1 ( ( y 0 2 ) p ± 2 y 0 p + 1 + y 0 2 ) − 12. Since y 0 2 = ( − 3 i z ) 3 + 12 ( − 3 i z ) 2 + 18 ( − 3 i z ) = 108 ( 2 − i z ) y_0^2=(-3iz)^3+12(-3iz)^2+18(-3iz)=108(2-iz) y 0 2 = ( − 3 i z ) 3 + 12 ( − 3 i z ) 2 + 18 ( − 3 i z ) = 108 ( 2 − i z )
− 6 ± 3 ⋅ 108 ( p − 1 ) / 2 ( 2 − i z ) ( p + 1 ) / 2 = − 6 ± 3 ( 3 p ) ( 2 − i z ) ( p + 1 ) / 2 , -6\pm3\cdot108^{(p-1)/2}(2-iz)^{(p+1)/2}=-6\pm3\left(\frac{3}{p}\right)(2-iz)^{(p+1)/2}, − 6 ± 3 ⋅ 10 8 ( p − 1 ) /2 ( 2 − i z ) ( p + 1 ) /2 = − 6 ± 3 ( p 3 ) ( 2 − i z ) ( p + 1 ) /2 , with ( ⋅ p ) \left(\frac{\cdot}{p}\right) ( p ⋅ ) x x x T 1 T_1 T 1
± ( 3 p ) ( 2 − i z ) ( p + 1 ) / 2 = − i z . \pm\left(\frac{3}{p}\right)(2-iz)^{(p+1)/2}=-iz. ± ( p 3 ) ( 2 − i z ) ( p + 1 ) /2 = − i z . Note, as a sanity check, that both sides square to 2 2 2 2 2 2
( 2 + 2 ) ( p + 1 ) / 2 ≡ 2 ( m o d p ) (2+\sqrt{2})^{(p+1)/2}\equiv\sqrt{2}\pmod p ( 2 + 2 ) ( p + 1 ) /2 ≡ 2 ( mod p ) in Z [ 2 ] \mathbb{Z}[\sqrt{2}] Z [ 2 ] p ≡ 3 , 13 ( m o d 16 ) p\equiv3,13\pmod{16} p ≡ 3 , 13 ( mod 16 ) p p p 2 + 2 = ζ − 1 ( 1 + ζ ) 2 2+\sqrt{2}=\zeta^{-1}(1+\zeta)^2 2 + 2 = ζ − 1 ( 1 + ζ ) 2 ζ \zeta ζ p ≡ 5 ( m o d 8 ) p\equiv5\pmod8 p ≡ 5 ( mod 8 ) + + + p ≡ 5 , 13 ( m o d 48 ) p\equiv5,13\pmod{48} p ≡ 5 , 13 ( mod 48 ) − - − p ≡ 29 , 37 ( m o d 48 ) p\equiv29,37\pmod{48} p ≡ 29 , 37 ( mod 48 )
Remark B.5. The two orders in (14) are isomorphic via j ↦ − j j\mapsto-j j ↦ − j p ≡ 29 , 37 ( m o d 48 ) p\equiv29,37\pmod{48} p ≡ 29 , 37 ( mod 48 ) + + + [56 Lem. 3] but, there, the third basis element reads ( 1 + j + k ) / 2 (1+j+k)/2 ( 1 + j + k ) /2 ( 1 + i + j ) / 2 (1+i+j)/2 ( 1 + i + j ) /2 − - − 3 3 3 + + +
R2: three families of F p \mathbb{F}_p F p
In this section we study families of oriented PPASs defined over F p \mathbb{F}_p F p p p p Π p \Pi_p Π p p p p π p \pi_p π p K K K D 2 ≅ C 2 × C 2 D_2 \cong C_2 \times C_2 D 2 ≅ C 2 × C 2 C 4 C_4 C 4 D 4 D_4 D 4 A 4 A_4 A 4 S 4 S_4 S 4 16 Π p \Pi_p Π p
For each of the families, the starting surface is the Weil restriction
A = W F p 2 / F p ( E ) ≅ F ‾ p E × E ( p ) A = W_{\mathbb{F}_{p^2}/\mathbb{F}_p}(E) \cong_{\overline{\mathbb{F}}_p} E \times E^{(p)} A = W F p 2 / F p ( E ) ≅ F p E × E ( p ) of a well-chosen supersingular elliptic curve E / F p 2 E/\mathbb{F}_{p^2} E / F p 2 λ \lambda λ p p p A A A
Π p = ( 0 π p π p 0 ) \Pi_p = \begin{pmatrix} 0 & \pi_p \\ \pi_p & 0 \end{pmatrix} Π p = ( 0 π p π p 0 ) with π p : E → E ( p ) \pi_p : E \to E^{(p)} π p : E → E ( p ) E E E π p 2 = − p \pi_p^2 = -p π p 2 = − p Π p 2 = − p \Pi_p^2 = -p Π p 2 = − p R R R − p \sqrt{-p} − p C 4 C_4 C 4 D 4 D_4 D 4 E / F p 2 E/\mathbb{F}_{p^2} E / F p 2 π p 2 = p \pi_p^2 = p π p 2 = p Π p 2 = p \Pi_p^2 = p Π p 2 = p F p \mathbb{F}_p F p p p p − p \sqrt{-p} − p
Remark C.1. Since Π p \Pi_p Π p ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι ) C ( R ) \mathcal{C}(R) C ( R ) F p \mathbb{F}_p F p π p 2 = ± p \pi_p^2 = \pm p π p 2 = ± p
A ( F p ) ≅ E ( F p 2 ) ≅ ( Z ( p + 1 ) Z ) 2 , A ( F p 2 ) ≅ E ( F p 2 ) × E ( F p 2 ) ≅ ( Z ( p − 1 ) Z ) 4 A(\mathbb{F}_p) \cong E(\mathbb{F}_{p^2}) \cong\left(\frac{\mathbb{Z}}{(p+1)\mathbb{Z}}\right)^2,\qquad A(\mathbb{F}_{p^2}) \cong E(\mathbb{F}_{p^2}) \times E(\mathbb{F}_{p^2}) \cong\left(\frac{\mathbb{Z}}{(p-1)\mathbb{Z}}\right)^4 A ( F p ) ≅ E ( F p 2 ) ≅ ( ( p + 1 ) Z Z ) 2 , A ( F p 2 ) ≅ E ( F p 2 ) × E ( F p 2 ) ≅ ( ( p − 1 ) Z Z ) 4 of abelian groups.
More precisely, we consider the following method for generating Frobenius-oriented PPASs over F p \mathbb{F}_p F p E / F p 2 E/\mathbb{F}_{p^2} E / F p 2 π p 2 = p \pi_p^2=p π p 2 = p ( A , λ ) (A,\lambda) ( A , λ )
K = Q ( a + b p ) K=\mathbb{Q}\left(\sqrt{a+b\sqrt{p}}\right) K = Q ( a + b p ) for a , b ∈ Z a,b\in\mathbb{Z} a , b ∈ Z a + ∣ b ∣ p < 0 a+|b|\sqrt{p}<0 a + ∣ b ∣ p < 0
ι : p ↦ Π p = ( 0 π p π p 0 ) , a + b p ↦ ( α β π p π p β 1 p π p α π p ) \iota:\sqrt{p}\mapsto\Pi_p=\begin{pmatrix}0&\pi_p\\ \pi_p&0\end{pmatrix},\qquad
\sqrt{a+b\sqrt{p}}\mapsto\begin{pmatrix}\alpha&\beta\pi_p\\ \pi_p\beta\frac{1}{p}\pi_p\alpha\pi_p&\end{pmatrix} ι : p ↦ Π p = ( 0 π p π p 0 ) , a + b p ↦ ( α π p β p 1 π p α π p β π p ) for suitable
α ∈ End ( E ) , β ∈ 1 p Hom ( E ( p ) , E ) π p ⊉ End ( E ) \alpha\in\operatorname{End}(E),\qquad\beta\in\frac{1}{p}\operatorname{Hom}(E^{(p)},E)_{\pi_p}\not\supseteq\operatorname{End}(E) α ∈ End ( E ) , β ∈ p 1 Hom ( E ( p ) , E ) π p ⊇ End ( E ) of trace tr ( α ) = tr ( β ) = 0 \operatorname{tr}(\alpha)=\operatorname{tr}(\beta)=0 tr ( α ) = tr ( β ) = 0 Π p \Pi_p Π p
( α β π p π p β 1 p π p α π p ) 2 = ( p β 2 + α 2 0 0 π p β 2 π p + 1 p π p α 2 π p ) + ( 0 ( α β + β α ) π p π p ( α β + β α ) 0 ) = ( − p n ( β ) − n ( α ) ) ι ( 1 ) + tr ( α β ) ι ( p ) \begin{aligned}
\begin{pmatrix}\alpha&\beta\pi_p\\ \pi_p\beta\frac{1}{p}\pi_p\alpha\pi_p\end{pmatrix}^2
=
\begin{pmatrix}p\beta^2+\alpha^2&0\\0&\pi_p\beta^2\pi_p+\frac{1}{p}\pi_p\alpha^2\pi_p\end{pmatrix}
+
\begin{pmatrix}0&(\alpha\beta+\beta\alpha)\pi_p\\ \pi_p(\alpha\beta+\beta\alpha)&0\end{pmatrix} \\
&=(-p\,n(\beta)-n(\alpha))\iota(1)+\operatorname{tr}(\alpha\beta)\iota(\sqrt{p})
\end{aligned} ( α π p β p 1 π p α π p β π p ) 2 = ( p β 2 + α 2 0 0 π p β 2 π p + p 1 π p α 2 π p ) + ( 0 π p ( α β + β α ) ( α β + β α ) π p 0 ) = ( − p n ( β ) − n ( α )) ι ( 1 ) + tr ( α β ) ι ( p ) where we have used that tr ( β ) = tr ( α ) = 0 \operatorname{tr}(\beta)=\operatorname{tr}(\alpha)=0 tr ( β ) = tr ( α ) = 0 a = − p n ( β ) − n ( α ) a=-p\,n(\beta)-n(\alpha) a = − p n ( β ) − n ( α ) b = tr ( α β ) b=\operatorname{tr}(\alpha\beta) b = tr ( α β ) ι : K → End 0 ( A ) \iota:K\to\operatorname{End}^{0}(A) ι : K → End 0 ( A ) K K K
Lemma C.2. Under the above assumptions on a , b a,b a , b K K K
D 2 ≅ C 2 × C 2 D_2\cong C_2\times C_2 D 2 ≅ C 2 × C 2 a 2 − b 2 p a^2-b^2p a 2 − b 2 p
C 4 C_4 C 4 a 2 − b 2 p a^2-b^2p a 2 − b 2 p p ( a 2 − p b 2 ) p(a^2-pb^2) p ( a 2 − p b 2 )
D 4 D_4 D 4 a 2 − p b 2 a^2-pb^2 a 2 − p b 2 p ( a 2 − p b 2 ) p(a^2-pb^2) p ( a 2 − p b 2 )
In particular, if p ≡ 3 ( m o d 4 ) p\equiv3\pmod4 p ≡ 3 ( mod 4 ) K K K C 2 × C 2 C_2\times C_2 C 2 × C 2 D 4 D_4 D 4
Proof. The classification can be found in [26 Lem. 4.7] . As for the last claim, the classification shows that Gal ( K , Q ) ≅ C 4 \operatorname{Gal}(K,\mathbb{Q})\cong C_4 Gal ( K , Q ) ≅ C 4 a 2 − b 2 p = p k 2 a^2-b^2p=pk^2 a 2 − b 2 p = p k 2 k ∈ Z k\in\mathbb{Z} k ∈ Z a = p a ′ a=pa' a = p a ′ a ′ a' a ′ p a ′ 2 = b 2 + k 2 pa'^2=b^2+k^2 p a ′2 = b 2 + k 2 p ≡ 3 ( m o d 4 ) p\equiv3\pmod4 p ≡ 3 ( mod 4 ) a ′ , b , k a',b,k a ′ , b , k 4 4 4 □ \square □
In the concrete orientations below, the curve E E E E 0 : y 2 = f ( x ) E_0:y^2=f(x) E 0 : y 2 = f ( x ) F p \mathbb{F}_p F p
E : v y 2 = f ( x ) , v ∈ F p 2 non-square . E:v y^2=f(x),\qquad v\in\mathbb{F}_{p^2}\ \text{non-square}. E : v y 2 = f ( x ) , v ∈ F p 2 non-square . Note that π p 2 = − p \pi_{p^2}=-p π p 2 = − p E 0 E_0 E 0 p > 3 p>3 p > 3 π p 2 = p \pi_{p^2}=p π p 2 = p E E E
τ : E → E 0 : ( x , y ) ↦ ( x , u y ) , τ ( p ) : E ( p ) → E 0 : ( x , y ) ↦ ( x , u p y ) , \tau:E\to E_0:(x,y)\mapsto(x,uy),\qquad\tau^{(p)}:E^{(p)}\to E_0:(x,y)\mapsto(x,u^p y), τ : E → E 0 : ( x , y ) ↦ ( x , u y ) , τ ( p ) : E ( p ) → E 0 : ( x , y ) ↦ ( x , u p y ) , where u ∈ F p 4 ∖ F p 2 u\in\mathbb{F}_{p^4}\setminus\mathbb{F}_{p^2} u ∈ F p 4 ∖ F p 2 u 2 = v u^2=v u 2 = v
T : W F p 2 / F p ( E ) → E 0 2 T:W_{\mathbb{F}_{p^2}/\mathbb{F}_p}(E)\to E_0^2 T : W F p 2 / F p ( E ) → E 0 2 (for the product polarizations). Using π p τ = τ ( p ) π p \pi_p\tau=\tau^{(p)}\pi_p π p τ = τ ( p ) π p π p τ ( p ) = − τ π p \pi_p\tau^{(p)}=-\tau\pi_p π p τ ( p ) = − τ π p
T ∘ Π p ∘ T − 1 = ( 0 − π p π p 0 ) , T ∘ ( α β π p π p β 1 p π p α π p ) ∘ T − 1 = ( α ~ − β ~ π p π p β ~ − 1 p π p α ~ π p ) , T\circ\Pi_p\circ T^{-1}=
\begin{pmatrix}
0&-\pi_p\\
\pi_p&0
\end{pmatrix},
\qquad
T\circ
\begin{pmatrix}
\alpha&\beta\pi_p\\
\pi_p\beta&\frac{1}{p}\pi_p\alpha\pi_p
\end{pmatrix}
\circ T^{-1}
=
\begin{pmatrix}
\widetilde{\alpha}&-\widetilde{\beta}\pi_p\\
\pi_p\widetilde{\beta}&-\frac{1}{p}\pi_p\widetilde{\alpha}\pi_p
\end{pmatrix}, T ∘ Π p ∘ T − 1 = ( 0 π p − π p 0 ) , T ∘ ( α π p β β π p p 1 π p α π p ) ∘ T − 1 = ( α π p β − β π p − p 1 π p α π p ) , where the (quasi-)endomorphisms α ~ = τ α τ − 1 \widetilde{\alpha}=\tau\alpha\tau^{-1} α = τ α τ − 1 β ~ = τ β τ − 1 \widetilde{\beta}=\tau\beta\tau^{-1} β = τ β τ − 1 α , β \alpha,\beta α , β ι \iota ι ( E 0 2 , λ 0 ) (E_0^2,\lambda_0) ( E 0 2 , λ 0 )
α ~ ∈ End ( E 0 ) , β ~ ∈ End ( E 0 ) 1 π p = 1 π p End ( E 0 ) \widetilde{\alpha}\in\operatorname{End}(E_0),\qquad
\widetilde{\beta}\in\operatorname{End}(E_0)\frac{1}{\pi_p}=\frac{1}{\pi_p}\operatorname{End}(E_0) α ∈ End ( E 0 ) , β ∈ End ( E 0 ) π p 1 = π p 1 End ( E 0 ) with trace 0 0 0
Z [ a + b p ] (16) \mathbb{Z}\left[\sqrt{a+b\sqrt{p}}\right] \tag*{(16)} Z [ a + b p ] (16) with a = − p n ( β ~ ) − n ( α ~ ) a=-p\,n(\widetilde{\beta})-n(\widetilde{\alpha}) a = − p n ( β ) − n ( α ) b = tr ( α ~ β ~ ) b=\operatorname{tr}(\widetilde{\alpha}\widetilde{\beta}) b = tr ( α β ) End ( E 0 ) \operatorname{End}(E_0) End ( E 0 ) F p \mathbb{F}_p F p
Remark C.3. This viewpoint also makes for a clearer link with the machinery from § 5.3 : applying Lemma 5.8 to g = Id 2 g=\operatorname{Id}_2 g = Id 2
P = ( 0 − π p π p 0 ) ∈ M 2 ( End ( E 0 ) ) , P=
\begin{pmatrix}
0&-\pi_p\\
\pi_p&0
\end{pmatrix}
\in M_2(\operatorname{End}(E_0)), P = ( 0 π p − π p 0 ) ∈ M 2 ( End ( E 0 )) , we are looking for quadratic subrings of Q ( P ) ⊗ Q End ( E 0 ) \mathbb{Q}(P)\otimes_{\mathbb{Q}}\operatorname{End}(E_0) Q ( P ) ⊗ Q End ( E 0 )
Example C.4 (R2-D4). In view of Lemma C.2 , let us assume p ≡ 3 ( m o d 4 ) p\equiv3\pmod{4} p ≡ 3 ( mod 4 ) E 0 : y 2 = x 3 + x E_0:y^2=x^3+x E 0 : y 2 = x 3 + x Lemma B.1 : it is isomorphic to the maximal order
O 0 = Z ⟨ 1 , i , i + j 2 , 1 + k 2 ⟩ ⊂ B p , ∞ = ( − 1 , − p Q ) \mathcal{O}_0=\mathbb{Z}\left\langle1,i,\frac{i+j}{2},\frac{1+k}{2}\right\rangle\subset B_{p,\infty}=\left(\frac{-1,-p}{\mathbb{Q}}\right) O 0 = Z ⟨ 1 , i , 2 i + j , 2 1 + k ⟩ ⊂ B p , ∞ = ( Q − 1 , − p ) where an isomorphism O 0 → End ( E 0 ) \mathcal{O}_0\to\operatorname{End}(E_0) O 0 → End ( E 0 ) i i i ( x , y ) ↦ ( − x , i y ) (x,y)\mapsto(-x,iy) ( x , y ) ↦ ( − x , i y ) j j j p p p π p \pi_p π p α ∈ O 0 \alpha\in\mathcal{O}_0 α ∈ O 0 β ∈ O 0 1 j \beta\in\mathcal{O}_0\frac{1}{j} β ∈ O 0 j 1 ~ \widetilde{\ } Z \mathbb{Z} Z O 0 \mathcal{O}_0 O 0 i i i i + j 2 \frac{i+j}{2} 2 i + j k k k
α = a 1 i + a 2 i + j 2 + a 3 k . \alpha= a_1i + a_2\frac{i+j}{2} + a_3k. α = a 1 i + a 2 2 i + j + a 3 k . For β \beta β 1 j O 0 \frac{1}{j}\mathcal{O}_0 j 1 O 0 1 j \frac{1}{j} j 1 i j \frac{i}{j} j i 1 + k 2 j \frac{1+k}{2j} 2 j 1 + k Z \mathbb{Z} Z
β = 1 j ( b 1 + b 2 i + b 3 1 + k 2 ) \beta= \frac{1}{j}\left(b_1 + b_2i + b_3\frac{1+k}{2}\right) β = j 1 ( b 1 + b 2 i + b 3 2 1 + k ) for integers a 1 , a 2 , a 3 , b 1 , b 2 , b 3 a_1,a_2,a_3,b_1,b_2,b_3 a 1 , a 2 , a 3 , b 1 , b 2 , b 3
a = − a 1 2 − a 1 a 2 − p + 1 4 a 2 2 − p a 3 2 − b 1 2 − b 1 b 3 − p + 1 4 b 3 2 − b 2 2 , b = a 2 b 1 + ( a 1 + a 2 ) b 3 − 2 a 3 b 2 . \begin{aligned}
a &= -a_1^2-a_1a_2-\frac{p+1}{4}a_2^2-pa_3^2-b_1^2-b_1b_3-\frac{p+1}{4}b_3^2-b_2^2,\\
b &= a_2b_1+(a_1+a_2)b_3-2a_3b_2.
\end{aligned} a b = − a 1 2 − a 1 a 2 − 4 p + 1 a 2 2 − p a 3 2 − b 1 2 − b 1 b 3 − 4 p + 1 b 3 2 − b 2 2 , = a 2 b 1 + ( a 1 + a 2 ) b 3 − 2 a 3 b 2 . For each choice of a i , b i a_i,b_i a i , b i a 2 − b 2 p a^2-b^2p a 2 − b 2 p D 4 D_4 D 4 Lemma C.2 . The condition a + ∣ b ∣ p < 0 a+|b|\sqrt{p}<0 a + ∣ b ∣ p < 0 M 2 ( B p , ∞ ) M_2(B_{p,\infty}) M 2 ( B p , ∞ )
As for the primitivity, an easy calculation shows
disc Z [ a + b p ] = 256 b 2 p 2 ( a 2 − b 2 p ) . (17) \operatorname{disc}\mathbb{Z}\left[\sqrt{a+b\sqrt{p}}\right]=256b^2p^2(a^2-b^2p). \tag*{(17)} disc Z [ a + b p ] = 256 b 2 p 2 ( a 2 − b 2 p ) . (17) From [48 Thm. 1 and Tbl. B] we see that for p ≡ 3 ( m o d 4 ) p\equiv3\pmod{4} p ≡ 3 ( mod 4 ) disc K \operatorname{disc} K disc K b = ± 1 b=\pm1 b = ± 1 a 2 − p a^2-p a 2 − p ∣ b ∣ = 4 |b|=4 ∣ b ∣ = 4 § 13 .
Example C.5 (R2-C4). We follow the same recipe to realize C 4 C_4 C 4 Lemma C.2 tells us that we must move away from characteristics p ≡ 3 ( m o d 4 ) p\equiv3\pmod{4} p ≡ 3 ( mod 4 ) E 0 : y 2 = x 3 + 12 x 2 + 18 x E_0:y^2=x^3+12x^2+18x E 0 : y 2 = x 3 + 12 x 2 + 18 x F p 2 \mathbb{F}_{p^2} F p 2 p ≡ 5 ( m o d 8 ) p\equiv5\pmod{8} p ≡ 5 ( mod 8 ) Lemma B.4 for an explicit description of its endomorphism ring, which is isomorphic to the maximal order
Z ⟨ 1 , i , 1 + i + j 2 , i + 2 j ± k 4 ⟩ ⊂ B p , ∞ = ( − 2 , − p Q ) , \mathbb{Z}\left\langle1,i,\frac{1+i+j}{2},\frac{i+2j\pm k}{4}\right\rangle\subset B_{p,\infty}=\left(\frac{-2,-p}{\mathbb{Q}}\right), Z ⟨ 1 , i , 2 1 + i + j , 4 i + 2 j ± k ⟩ ⊂ B p , ∞ = ( Q − 2 , − p ) , with the sign depending on whether p ≡ 5 , 13 ( m o d 48 ) p\equiv5,13\pmod{48} p ≡ 5 , 13 ( mod 48 ) p ≡ 29 , 37 ( m o d 48 ) p\equiv29,37\pmod{48} p ≡ 29 , 37 ( mod 48 ) p ≡ 5 , 13 ( m o d 48 ) p\equiv5,13\pmod{48} p ≡ 5 , 13 ( mod 48 ) + + +
α = a 1 i + a 2 ( i + j ) + a 3 i + 2 j + k 4 , \alpha=a_1i+a_2(i+j)+a_3\frac{i+2j+k}{4}, α = a 1 i + a 2 ( i + j ) + a 3 4 i + 2 j + k , β = 1 j ( b 1 + b 2 i + b 3 1 + i + j 2 − b 3 i + 2 j + k 4 ) \beta=\frac{1}{j}\left(b_1+b_2i+b_3\frac{1+i+j}{2}-b_3\frac{i+2j+k}{4}\right) β = j 1 ( b 1 + b 2 i + b 3 2 1 + i + j − b 3 4 i + 2 j + k ) for integers a 1 , a 2 , a 3 , b 1 , b 2 , b 3 a_1,a_2,a_3,b_1,b_2,b_3 a 1 , a 2 , a 3 , b 1 , b 2 , b 3
a = − 2 a 1 2 − ( p + 2 ) a 2 2 − 4 a 1 a 2 − a 1 a 3 − ( p + 1 ) a 2 a 3 − 3 p + 1 8 a 3 2 − b 1 2 − 2 b 2 2 − b 1 b 3 − b 2 b 3 − p + 3 8 b 3 2 , b = − a 1 b 3 + 2 a 2 b 1 + a 3 b 1 − a 3 b 2 . \begin{aligned}
a={}&-2a_1^2-(p+2)a_2^2-4a_1a_2-a_1a_3-(p+1)a_2a_3-\frac{3p+1}{8}a_3^2-b_1^2-2b_2^2-b_1b_3-b_2b_3-\frac{p+3}{8}b_3^2,\\
b={}&-a_1b_3+2a_2b_1+a_3b_1-a_3b_2.
\end{aligned} a = b = − 2 a 1 2 − ( p + 2 ) a 2 2 − 4 a 1 a 2 − a 1 a 3 − ( p + 1 ) a 2 a 3 − 8 3 p + 1 a 3 2 − b 1 2 − 2 b 2 2 − b 1 b 3 − b 2 b 3 − 8 p + 3 b 3 2 , − a 1 b 3 + 2 a 2 b 1 + a 3 b 1 − a 3 b 2 . Again this will generically result in orientations of type D 4 D_4 D 4 C 4 C_4 C 4 p = x 2 + y 2 p=x^2+y^2 p = x 2 + y 2 p ≡ 1 ( m o d 4 ) p\equiv1\pmod4 p ≡ 1 ( mod 4 )
x a − p b ∈ Z [ a 1 , a 2 , a 3 , b 1 , b 2 , b 3 ] . xa-pb\in\mathbb{Z}[a_1,a_2,a_3,b_1,b_2,b_3]. x a − p b ∈ Z [ a 1 , a 2 , a 3 , b 1 , b 2 , b 3 ] . Then 0 = ( x a − p b ) ( x a + p b ) = ( p − y 2 ) a 2 − p 2 b 2 = p ( a 2 − p b 2 ) − a 2 y 2 0=(xa-pb)(xa+pb)=(p-y^2)a^2-p^2b^2=p(a^2-pb^2)-a^2y^2 0 = ( x a − p b ) ( x a + p b ) = ( p − y 2 ) a 2 − p 2 b 2 = p ( a 2 − p b 2 ) − a 2 y 2 p ( a 2 − p b 2 ) p(a^2-pb^2) p ( a 2 − p b 2 )
Controlling primitivity for R2-C4 is harder than for R2-D4. Indeed, by construction the factor a 2 − p b 2 a^2-pb^2 a 2 − p b 2 p p p [48 Thm. 1 and Tbl. C] this makes our order non-maximal, typically. An example family of solutions is where p = 1 + 4 m 2 p=1+4m^2 p = 1 + 4 m 2 m ≡ 5 ( m o d 6 ) m\equiv5\pmod6 m ≡ 5 ( mod 6 ) p ≡ 5 ( m o d 8 ) p\equiv5\pmod8 p ≡ 5 ( mod 8 ) p ≢ 29 , 37 ( m o d 48 ) p\not\equiv29,37\pmod{48} p ≡ 29 , 37 ( mod 48 )
a 1 = − m + 1 , a 2 = − 1 , a 3 = 2 , b 1 = − 1 , b 2 = m , b 3 = 2 ⇒ a = − 2 p , b = − 2 a_1=-m+1,\ a_2=-1,\ a_3=2,\ b_1=-1,\ b_2=m,\ b_3=2\quad\Rightarrow\quad a=-2p,b=-2 a 1 = − m + 1 , a 2 = − 1 , a 3 = 2 , b 1 = − 1 , b 2 = m , b 3 = 2 ⇒ a = − 2 p , b = − 2 yielding a 2 − p b 2 = 16 p m 2 a^2-pb^2=16pm^2 a 2 − p b 2 = 16 p m 2 disc K \operatorname{disc} K disc K m 2 m^2 m 2
Remark C.6. Many of the examples we found satisfy p ∣ a , b p\mid a,b p ∣ a , b p 3 ∣ a 2 − b 2 p p^3\mid a^2-b^2p p 3 ∣ a 2 − b 2 p p ( a 2 − b 2 p ) p(a^2-b^2p) p ( a 2 − b 2 p )
γ = a + b p p \gamma=\frac{\sqrt{a+b\sqrt{p}}}{\sqrt{p}} γ = p a + b p is integral. If we want our orientation to extend to Z [ γ ] ⊂ Z K \mathbb{Z}[\gamma]\subset\mathbb{Z}_K Z [ γ ] ⊂ Z K
ι ( a + b p ) = ( α β π p π p β 1 p π p α π p ) = ( 0 π p π p 0 ) ( β 1 p α π p 1 p π p α 1 p π p β π p ) \iota\left(\sqrt{a+b\sqrt{p}}\right)=
\begin{pmatrix}
\alpha& \beta\pi_p\\
\pi_p\beta& \frac{1}{p}\pi_p\alpha\pi_p
\end{pmatrix}
=
\begin{pmatrix}
0 & \pi_p\\
\pi_p & 0
\end{pmatrix}
\begin{pmatrix}
\beta& \frac{1}{p}\alpha\pi_p\\
\frac{1}{p}\pi_p\alpha& \frac{1}{p}\pi_p\beta\pi_p
\end{pmatrix} ι ( a + b p ) = ( α π p β β π p p 1 π p α π p ) = ( 0 π p π p 0 ) ( β p 1 π p α p 1 α π p p 1 π p β π p ) should factor through Π p \Pi_p Π p End ( A ) \operatorname{End}(A) End ( A ) β \beta β ( 1 / p ) Hom ( E ( p ) , E ) π p (1/p)\operatorname{Hom}(E^{(p)},E)\pi_p ( 1/ p ) Hom ( E ( p ) , E ) π p p = 1 + 4 m 2 p=1+4m^2 p = 1 + 4 m 2
a 1 = − 2 m 2 − m + 1 , a 2 = − 2 m − 1 , a 3 = 4 m + 2 , a_1=-2m^2-m+1,\ a_2=-2m-1,\ a_3=4m+2, a 1 = − 2 m 2 − m + 1 , a 2 = − 2 m − 1 , a 3 = 4 m + 2 , b 1 = 2 m − 1 , b 2 = − 2 m 2 + 3 m , b 3 = − 4 m + 2 b_1=2m-1,\ b_2=-2m^2+3m,\ b_3=-4m+2 b 1 = 2 m − 1 , b 2 = − 2 m 2 + 3 m , b 3 = − 4 m + 2 (leading to a = − 2 p 2 , b = − 2 p a=-2p^2,b=-2p a = − 2 p 2 , b = − 2 p k k k j β j j\beta j j β j b 2 + b 3 / 4 ≡ 2 m + 1 ≢ 0 ( m o d p ) b_2+b_3/4\equiv2m+1\not\equiv0\pmod p b 2 + b 3 /4 ≡ 2 m + 1 ≡ 0 ( mod p ) M k ( R ) \mathcal{M}_k(R) M k ( R ) p ∣ [ Z K : R ] p\mid[\mathbb{Z}_K:R] p ∣ [ Z K : R ] g = 1 g=1 g = 1
Proofs from Section 4 (except for Lemma 4.3)
Proof from Section 4.1
Proof (of Lemma 4.1). If K = Frac ( R ) K = \operatorname{Frac}(R) K = Frac ( R ) C 2 × C 2 C_2 \times C_2 C 2 × C 2 C 4 C_4 C 4 ℓ R \ell R ℓ R 4 / r 4/r 4/ r r ∈ { 1 , 2 , 4 } r \in\{1,2,4\} r ∈ { 1 , 2 , 4 } D 4 D_4 D 4 ℓ R = p 1 p 2 p \ell R = \mathfrak{p}_1\mathfrak{p}_2\mathfrak{p} ℓ R = p 1 p 2 p p 1 , p 2 \mathfrak{p}_1,\mathfrak{p}_2 p 1 , p 2 p \mathfrak{p} p p \mathfrak{p} p ℓ R \ell R ℓ R □ \square □
Proofs from Section 4.2
Proof (of Theorem 4.4). The product polarization on A i u A_i^u A i u
ι A i ( α ) † = ( ι i ( α k , j ) † ) 1 ≤ k , j ≤ u = ( ι i ( α ‾ k , j ) ) 1 ≤ j , k ≤ u = ι A i ( α ∗ ) \iota_{A_i}(\alpha)^\dagger= \left(\iota_i(\alpha_{k,j})^\dagger\right)_{1\leq k,j\leq u} = \left(\iota_i(\overline{\alpha}_{k,j})\right)_{1\leq j,k\leq u} = \iota_{A_i}(\alpha^*) ι A i ( α ) † = ( ι i ( α k , j ) † ) 1 ≤ k , j ≤ u = ( ι i ( α k , j ) ) 1 ≤ j , k ≤ u = ι A i ( α ∗ ) for any α ∈ M u ( R ) \alpha\in M_u(R) α ∈ M u ( R ) ι A i ( α ) † ∘ ι A i ( α ) = ι A i ( n I d ) \iota_{A_i}(\alpha)^\dagger\circ\iota_{A_i}(\alpha) = \iota_{A_i}(nI_d) ι A i ( α ) † ∘ ι A i ( α ) = ι A i ( n I d ) ι A i : M u ( R ) → End ( A i u ) \iota_{A_i}: M_u(R) \to\operatorname{End}(A_i^u) ι A i : M u ( R ) → End ( A i u ) α ∗ α = n I d ∈ M u ( R ) \alpha^*\alpha= nI_d \in M_u(R) α ∗ α = n I d ∈ M u ( R )
Φ = ( φ t I d u − α A 1 † α A 2 φ I d u ) . \Phi= \begin{pmatrix} \varphi^t I_{d_u} & -\alpha_{A_1}^\dagger\\ \alpha_{A_2} & \varphi I_{d_u} \end{pmatrix}. Φ = ( φ t I d u α A 2 − α A 1 † φ I d u ) . Using α ∗ α = α α ∗ = n I d u \alpha^*\alpha= \alpha\alpha^* = nI_{d_u} α ∗ α = α α ∗ = n I d u φ † ∘ φ = ι 1 ( d ) \varphi^\dagger\circ\varphi= \iota_1(d) φ † ∘ φ = ι 1 ( d ) φ ∘ φ † = ι 2 ( d ) \varphi\circ\varphi^\dagger= \iota_2(d) φ ∘ φ † = ι 2 ( d ) Φ † Φ \Phi^\dagger\Phi Φ † Φ
( 1 , 1 ) : φ † φ I d u + α A 1 † α A 1 = ι 1 ( d + n ) I d u = ι 1 ( N ) I d u , ( 1 , 2 ) : φ † α A 2 † − α A 1 † φ † I d u = 0 , ( 2 , 1 ) : α A 2 φ I d u − φ α A 1 I d u = 0 , ( 2 , 2 ) : α A 2 α A 2 † + φ φ † I d u = ι 2 ( n + d ) I d u = ι 2 ( N ) I d u . \begin{aligned}
(1,1)&:\ \varphi^\dagger\varphi I_{d_u}+\alpha_{A_1}^\dagger\alpha_{A_1}=\iota_1(d+n)I_{d_u}=\iota_1(N)I_{d_u},\\
(1,2)&:\ \varphi^\dagger\alpha_{A_2}^\dagger-\alpha_{A_1}^\dagger\varphi^\dagger I_{d_u}=0,\\
(2,1)&:\ \alpha_{A_2}\varphi I_{d_u}-\varphi\alpha_{A_1}I_{d_u}=0,\\
(2,2)&:\ \alpha_{A_2}\alpha_{A_2}^\dagger+\varphi\varphi^\dagger I_{d_u}=\iota_2(n+d)I_{d_u}=\iota_2(N)I_{d_u}.
\end{aligned} ( 1 , 1 ) ( 1 , 2 ) ( 2 , 1 ) ( 2 , 2 ) : φ † φ I d u + α A 1 † α A 1 = ι 1 ( d + n ) I d u = ι 1 ( N ) I d u , : φ † α A 2 † − α A 1 † φ † I d u = 0 , : α A 2 φ I d u − φ α A 1 I d u = 0 , : α A 2 α A 2 † + φ φ † I d u = ι 2 ( n + d ) I d u = ι 2 ( N ) I d u . where in ( 1 , 2 ) (1,2) ( 1 , 2 ) ( 2 , 1 ) (2,1) ( 2 , 1 ) φ \varphi φ φ † ∘ ι 2 ( α ) † = ι 1 ( α ) † ∘ φ † \varphi^\dagger\circ\iota_2(\alpha)^\dagger=\iota_1(\alpha)^\dagger\circ\varphi^\dagger φ † ∘ ι 2 ( α ) † = ι 1 ( α ) † ∘ φ † φ ∘ ι 1 ( α ) = ι 2 ( α ) ∘ φ \varphi\circ\iota_1(\alpha)=\iota_2(\alpha)\circ\varphi φ ∘ ι 1 ( α ) = ι 2 ( α ) ∘ φ ι i ( N ) = [ N ] \iota_i(N)=[N] ι i ( N ) = [ N ] Φ † Φ = [ N ] \Phi^\dagger\Phi=[N] Φ † Φ = [ N ] Φ \Phi Φ N N N 2 u g 2ug 2 ug N 2 u g N^{2ug} N 2 ug
(i) Φ ( P , 0 ) = ( φ I d u ( P ) , − α A 1 ( P ) ) \Phi(P,0)=(\varphi I_{d_u}(P),-\alpha_{A_1}(P)) Φ ( P , 0 ) = ( φ I d u ( P ) , − α A 1 ( P )) P ∈ A 1 u P\in A_1^u P ∈ A 1 u P = ( P 1 , 0 , … , 0 ) P=(P_1,0,\ldots,0) P = ( P 1 , 0 , … , 0 ) φ ( P 1 ) \varphi(P_1) φ ( P 1 )
(ii) For P ∈ A 1 u [ N ] P\in A_1^u[N] P ∈ A 1 u [ N ]
Φ ( − α A 1 † ( P ) , φ I d u ( P ) ) = ( − φ α A 1 † ( P ) + α A 2 φ ( P ) , α A 1 α A 1 † ( P ) + φ † φ ( P ) ) = ( 0 , [ N ] P ) = 0. \Phi(-\alpha_{A_1}^\dagger(P),\varphi I_{d_u}(P))=
(-\varphi\alpha_{A_1}^\dagger(P)+\alpha_{A_2}\varphi(P),\alpha_{A_1}\alpha_{A_1}^\dagger(P)+\varphi^\dagger\varphi(P))=(0,[N]P)=0. Φ ( − α A 1 † ( P ) , φ I d u ( P )) = ( − φ α A 1 † ( P ) + α A 2 φ ( P ) , α A 1 α A 1 † ( P ) + φ † φ ( P )) = ( 0 , [ N ] P ) = 0. The map P ↦ ( − α A 1 † ( P ) , φ I d u ( P ) ) P\mapsto(-\alpha_{A_1}^\dagger(P),\varphi I_{d_u}(P)) P ↦ ( − α A 1 † ( P ) , φ I d u ( P )) A 1 u [ N ] A_1^u[N] A 1 u [ N ] P ∈ A 1 u [ n R 0 ] ∩ A 1 u [ d R 0 ] P\in A_1^u[nR_0]\cap A_1^u[dR_0] P ∈ A 1 u [ n R 0 ] ∩ A 1 u [ d R 0 ] n R 0 nR_0 n R 0 d R 0 dR_0 d R 0 x n + y d = 1 xn+yd=1 x n + y d = 1 x , y ∈ R 0 x,y\in R_0 x , y ∈ R 0 P = 0 P=0 P = 0 N N N # A 1 u [ N ] = N 2 u g = deg Φ \#A_1^u[N]=N^{2ug}=\deg\Phi # A 1 u [ N ] = N 2 ug = deg Φ ker Φ \ker\Phi ker Φ n R 0 + N R 0 = n R 0 + d R 0 = R 0 nR_0+NR_0=nR_0+dR_0=R_0 n R 0 + N R 0 = n R 0 + d R 0 = R 0 n R 0 nR_0 n R 0 N R 0 NR_0 N R 0 α A 1 \alpha_{A_1} α A 1 A 1 u [ N ] A_1^u[N] A 1 u [ N ] A 1 [ N ] A_1[N] A 1 [ N ] P ∈ A 1 u [ N ] P\in A_1^u[N] P ∈ A 1 u [ N ] α A 1 ( P ) = 0 \alpha_{A_1}(P)=0 α A 1 ( P ) = 0 P ∈ A 1 u [ n R 0 ] ∩ A 1 u [ N R 0 ] P \in A_1^u[nR_0] \cap A_1^u[NR_0] P ∈ A 1 u [ n R 0 ] ∩ A 1 u [ N R 0 ] P = 0 P=0 P = 0 n R 0 nR_0 n R 0 N R 0 NR_0 N R 0 P ↦ α A 1 ( P ) P \mapsto\alpha_{A_1}(P) P ↦ α A 1 ( P ) − ι 1 ( n ) I d u = ι 1 ( d ) I d u -\iota_1(n)I\!d_u=\iota_1(d)I\!d_u − ι 1 ( n ) I d u = ι 1 ( d ) I d u A 1 u [ N ] A_1^u[N] A 1 u [ N ] φ ∘ ι 1 ( α ) = ι 2 ( α ) ∘ φ \varphi\circ\iota_1(\alpha)=\iota_2(\alpha)\circ\varphi φ ∘ ι 1 ( α ) = ι 2 ( α ) ∘ φ □ \square □
Remark D.1 (continuation of Remark 4.5). We have that Φ = Ψ 2 ∘ Ψ 1 \Phi=\Psi_2\circ\Psi_1 Φ = Ψ 2 ∘ Ψ 1 Ψ 1 , Ψ 2 \Psi_1,\Psi_2 Ψ 1 , Ψ 2 N \sqrt{N} N ker Ψ 1 = N ker Φ \ker\Psi_1=\sqrt{N}\ker\Phi ker Ψ 1 = N ker Φ
ker Ψ 1 = { ( − α A 1 † ( P ) , φ I d u ( P ) ) ∣ P ∈ A 1 u [ N ] } . \ker\Psi_1=\{(-\alpha_{A_1}^{\dagger}(P),\ \varphi I\!d_u(P))\mid P\in A_1^u[\sqrt{N}]\}. ker Ψ 1 = {( − α A 1 † ( P ) , φ I d u ( P )) ∣ P ∈ A 1 u [ N ]} . The Rosati dual Φ † \Phi^\dagger Φ † α A i \alpha_{A_i} α A i
ker Ψ 2 † = { ( α A 2 † ( Q ) , φ † I d u ( Q ) ) ∣ Q ∈ A 2 u [ N ] } = { ( α A 2 † φ I d u ( P ) , ι 1 ( d ) I d u ( P ) ) ∣ P ∈ A 1 u [ N ] } . \begin{aligned}
\ker\Psi_2^\dagger=\{(\alpha_{A_2}^{\dagger}(Q),\ \varphi^\dagger I\!d_u(Q))\mid Q\in A_2^u[\sqrt{N}]\} \\
&=\{(\alpha_{A_2}^{\dagger}\varphi I\!d_u(P),\ \iota_1(d)I\!d_u(P))\mid P\in A_1^u[\sqrt{N}]\}.
\end{aligned} ker Ψ 2 † = {( α A 2 † ( Q ) , φ † I d u ( Q )) ∣ Q ∈ A 2 u [ N ]} = {( α A 2 † φ I d u ( P ) , ι 1 ( d ) I d u ( P )) ∣ P ∈ A 1 u [ N ]} . One computes Ψ 1 \Psi_1 Ψ 1 Ψ 2 † \Psi_2^\dagger Ψ 2 † [33 App. F] , for instance.
Proof (of Proposition 4.6). Since α ∗ = ( X ∗ − Y ∗ Y ∗ X ∗ ) \alpha^*=\begin{pmatrix}X^*&-Y^*\\Y^*&X^*\end{pmatrix} α ∗ = ( X ∗ Y ∗ − Y ∗ X ∗ )
α ∗ α = ( X ∗ X + Y ∗ Y ( Y X − X Y ) ∗ Y X − X Y X X ∗ + Y Y ∗ ) . \alpha^*\alpha=
\begin{pmatrix}
X^*X+Y^*Y & (YX-XY)^*\\
YX-XY & XX^*+YY^*
\end{pmatrix}. α ∗ α = ( X ∗ X + Y ∗ Y Y X − X Y ( Y X − X Y ) ∗ X X ∗ + Y Y ∗ ) . Under the hypotheses of (a) we have X ∗ X = X X ∗ = x I d m X^*X=XX^*=xI\!d_m X ∗ X = X X ∗ = x I d m Y ∗ Y = Y Y ∗ = y I d m Y^*Y=YY^*=yI\!d_m Y ∗ Y = Y Y ∗ = y I d m ( x + y ) I d m (x+y)I\!d_m ( x + y ) I d m α α ∗ \alpha\alpha^* α α ∗
The hypotheses of (b) are exactly the conditions under which α ∗ α \alpha^*\alpha α ∗ α n I d 2 m nI\!d_{2m} n I d 2 m
For (c), the claim follows by induction on k k k i = 0 i=0 i = 0 ϑ 0 ∗ ϑ 0 = ϑ 0 ϑ 0 ∗ = N K / K 0 ( ϑ 0 ) \vartheta_0^*\vartheta_0=\vartheta_0\vartheta_0^*=N_{K/K_0}(\vartheta_0) ϑ 0 ∗ ϑ 0 = ϑ 0 ϑ 0 ∗ = N K / K 0 ( ϑ 0 ) i ≥ 1 i\geq1 i ≥ 1 ϑ i I d m \vartheta_iI\!d_m ϑ i I d m ( ϑ i I d m ) ∗ ( ϑ i I d m ) = ( ϑ i I d m ) ( ϑ i I d m ) ∗ = N K / K 0 ( ϑ i ) I d m (\vartheta_iI\!d_m)^*(\vartheta_iI\!d_m)=(\vartheta_iI\!d_m)(\vartheta_iI\!d_m)^*=N_{K/K_0}(\vartheta_i)I\!d_m ( ϑ i I d m ) ∗ ( ϑ i I d m ) = ( ϑ i I d m ) ( ϑ i I d m ) ∗ = N K / K 0 ( ϑ i ) I d m X = α i − 1 X=\alpha_{i-1} X = α i − 1 Y = ϑ i I d 2 i − 1 Y=\vartheta_iI\!d_{2^{i-1}} Y = ϑ i I d 2 i − 1 N K / K 0 ( ϑ i ) N_{K/K_0}(\vartheta_i) N K / K 0 ( ϑ i ) n n n
For (d), the claim again follows by induction and similarly as for (c), since the case i = 0 i=0 i = 0 α 0 \alpha_0 α 0 i ≥ 1 i\geq1 i ≥ 1 X = α i − 1 X=\alpha_{i-1} X = α i − 1 x = n 1 + ∑ j = 1 i − 1 N K / K 0 ( ϑ j ) x=n_1+\sum_{j=1}^{i-1}N_{K/K_0}(\vartheta_j) x = n 1 + ∑ j = 1 i − 1 N K / K 0 ( ϑ j ) Y = ϑ i I d 2 k + i − 1 Y=\vartheta_iI\!d_{2^{k+i-1}} Y = ϑ i I d 2 k + i − 1 α 0 \alpha_0 α 0 [85 Lemma 4.2] . □ \square □
Proof of Lemma 4.3
This appendix is devoted to a detailed proof of Lemma 4.3. We also prove an easy corollary. Let us first recall the statement of the Lemma.
Lemma 4.3. Assume that K K K C 2 × C 2 C_2\times C_2 C 2 × C 2 K 0 K_0 K 0 K 1 , K 2 K_1,K_2 K 1 , K 2 Z K X Z_K^X Z K X no roots of unity other than ± 1 \pm1 ± 1
∣ ker κ Z K ∣ ≤ 1 2 q ( K ) ∏ ℓ p r i m e e ( ℓ ) , \lvert\ker\kappa_{\mathbb{Z}_K} \rvert\leq\frac{1}{2q(K)} \prod_{\ell\ \mathrm{prime}} e(\ell), ∣ ker κ Z K ∣ ≤ 2 q ( K ) 1 ℓ prime ∏ e ( ℓ ) , ∣ coker κ Z K ∣ ≤ 1 4 q ( K ) ∣ coker N K / K 0 ∣ ∏ ℓ p r i m e e ( ℓ ) , \lvert\operatorname{coker} \kappa_{\mathbb{Z}_K} \rvert\leq\frac{1}{4q(K)} \lvert\operatorname{coker} N_{K/K_0} \rvert\prod_{\ell\ \mathrm{prime}} e(\ell), ∣ coker κ Z K ∣ ≤ 4 q ( K ) 1 ∣ coker N K / K 0 ∣ ℓ prime ∏ e ( ℓ ) , where q ( K ) = [ Z K × : Z K 0 × ] ∈ { 1 , 2 } q(K) = [\mathbb{Z}_K^\times: \mathbb{Z}_{K_0}^\times] \in\{1,2\} q ( K ) = [ Z K × : Z K 0 × ] ∈ { 1 , 2 } e ( ℓ ) e(\ell) e ( ℓ ) ℓ \ell ℓ K K K N K / K 0 : Cl ( Z K ) → Cl + ( Z K 0 ) N_{K/K_0} : \operatorname{Cl}(\mathbb{Z}_K) \to\operatorname{Cl}^{+}(\mathbb{Z}_{K_0}) N K / K 0 : Cl ( Z K ) → Cl + ( Z K 0 )
Corollary E.1. Assume that K K K C 2 × C 2 C_2 \times C_2 C 2 × C 2 Z K × \mathbb{Z}_K^\times Z K × ± 1 \pm1 ± 1 R R R K K K R i = R ∩ K i R_i = R \cap K_i R i = R ∩ K i i = 1 , 2 i = 1,2 i = 1 , 2
∣ ker κ R ∣ ≤ C 1 C 2 2 q ( K ) ∏ ℓ p r i m e e ( ℓ ) \lvert\ker\kappa_R \rvert\leq\frac{C_1C_2}{2q(K)} \prod_{\ell\ \mathrm{prime}} e(\ell) ∣ ker κ R ∣ ≤ 2 q ( K ) C 1 C 2 ℓ prime ∏ e ( ℓ ) where C i = f i ∏ p p r i m e p ∣ f i ( 1 − ( d K i p ) 1 p ) C_i = f_i \prod_{\substack{p\ \mathrm{prime}\\p\mid f_i}} \left(1 - \left(\frac{d_{K_i}}{p}\right)\frac{1}{p}\right) C i = f i ∏ p prime p ∣ f i ( 1 − ( p d K i ) p 1 ) f i = [ Z K i : R i ] f_i = [\mathbb{Z}_{K_i} : R_i] f i = [ Z K i : R i ] R i R_i R i d K i d_{K_i} d K i K i K_i K i i = 1 , 2 i = 1,2 i = 1 , 2
Proof. If ( [ a 1 ] , [ a 2 ] ) ∈ Cl ( R 1 ) × Cl ( R 2 ) ([a_1],[a_2]) \in\operatorname{Cl}(R_1) \times\operatorname{Cl}(R_2) ([ a 1 ] , [ a 2 ]) ∈ Cl ( R 1 ) × Cl ( R 2 ) κ R \kappa_R κ R
( [ a 1 Z K 1 ] , [ a 2 Z K 2 ] ) ∈ Cl ( Z K 1 ) × Cl ( Z K 2 ) ([a_1\mathbb{Z}_{K_1}], [a_2\mathbb{Z}_{K_2}]) \in\operatorname{Cl}(\mathbb{Z}_{K_1}) \times\operatorname{Cl}(\mathbb{Z}_{K_2}) ([ a 1 Z K 1 ] , [ a 2 Z K 2 ]) ∈ Cl ( Z K 1 ) × Cl ( Z K 2 ) is in the kernel of κ Z K \kappa_{\mathbb{Z}_K} κ Z K ψ : ker κ R → ker κ Z K \psi: \ker\kappa_R \to\ker\kappa_{\mathbb{Z}_K} ψ : ker κ R → ker κ Z K ker κ R \ker\kappa_R ker κ R R 1 R_1 R 1 R 2 R_2 R 2 Z K 1 \mathbb{Z}_{K_1} Z K 1 Z K 2 \mathbb{Z}_{K_2} Z K 2
∣ ker ψ ∣ ≤ h ( R 1 ) h ( Z K 1 ) ⋅ h ( R 2 ) h ( Z K 2 ) \lvert\ker\psi\rvert\leq\frac{h(R_1)}{h(\mathbb{Z}_{K_1})} \cdot\frac{h(R_2)}{h(\mathbb{Z}_{K_2})} ∣ ker ψ ∣ ≤ h ( Z K 1 ) h ( R 1 ) ⋅ h ( Z K 2 ) h ( R 2 ) where h h h
h ( R i ) h ( Z K i ) = f i ∏ p p r i m e p ∣ f i ( 1 − ( d K i p ) 1 p ) \frac{h(R_i)}{h(\mathbb{Z}_{K_i})} = f_i \prod_{\substack{p\ \mathrm{prime}\\p\mid f_i}} \left(1 - \left(\frac{d_{K_i}}{p}\right)\frac{1}{p}\right) h ( Z K i ) h ( R i ) = f i p prime p ∣ f i ∏ ( 1 − ( p d K i ) p 1 ) using [30 Theorem 7.24] , and remembering the assumption that the only roots of unity in Z K \mathbb{Z}_K Z K Z K i \mathbb{Z}_{K_i} Z K i R i R_i R i ± 1 \pm1 ± 1 ∣ ker κ R ∣ ≤ ∣ ker ψ ∣ ∣ ker κ Z K ∣ \lvert\ker\kappa_R \rvert\leq\lvert\ker\psi\rvert\lvert\ker\kappa_{\mathbb{Z}_K} \rvert ∣ ker κ R ∣ ≤ ∣ ker ψ ∣ ∣ ker κ Z K ∣ □ \square □
To prove the lemma we will make use of the following results from [64 ] .
Lemma E.2 ([64 1.3] ). Let K K K C 2 × C 2 C_2 \times C_2 C 2 × C 2 Q \mathbb{Q} Q K 0 , K 1 , K 2 K_0, K_1, K_2 K 0 , K 1 , K 2
j : Cl ( Z K 0 ) × Cl ( Z K 1 ) × Cl ( Z K 2 ) → Cl ( K ) : ( [ a 0 ] , [ a 1 ] , [ a 2 ] ) ↦ [ a 0 Z K a 1 Z K a 2 Z K ] j : \operatorname{Cl}(\mathbb{Z}_{K_0}) \times\operatorname{Cl}(\mathbb{Z}_{K_1}) \times\operatorname{Cl}(\mathbb{Z}_{K_2}) \to\operatorname{Cl}(K) : ([a_0],[a_1],[a_2]) \mapsto[a_0\mathbb{Z}_K a_1\mathbb{Z}_K a_2\mathbb{Z}_K] j : Cl ( Z K 0 ) × Cl ( Z K 1 ) × Cl ( Z K 2 ) → Cl ( K ) : ([ a 0 ] , [ a 1 ] , [ a 2 ]) ↦ [ a 0 Z K a 1 Z K a 2 Z K ] is a group homomorphism. Taking the restriction map j ^ : C ^ → Cl ( Z K ) \hat{j}:\hat{C}\to\operatorname{Cl}(\mathbb{Z}_K) j ^ : C ^ → Cl ( Z K )
C ^ = { ( [ a 0 ] , [ a 1 ] , [ a 2 ] ) ∈ Cl ( Z K 0 ) × Cl ( Z K 1 ) × Cl ( Z K 2 ) ∣ N K 0 / Q ( a 0 ) N K 1 / Q ( a 1 ) N K 2 / Q ( a 2 ) = 1 } \hat{C}=\{([a_0],[a_1],[a_2])\in\operatorname{Cl}(\mathbb{Z}_{K_0})\times\operatorname{Cl}(\mathbb{Z}_{K_1})\times\operatorname{Cl}(\mathbb{Z}_{K_2})\mid N_{K_0/\mathbb{Q}}(a_0)N_{K_1/\mathbb{Q}}(a_1)N_{K_2/\mathbb{Q}}(a_2)=1\} C ^ = {([ a 0 ] , [ a 1 ] , [ a 2 ]) ∈ Cl ( Z K 0 ) × Cl ( Z K 1 ) × Cl ( Z K 2 ) ∣ N K 0 / Q ( a 0 ) N K 1 / Q ( a 1 ) N K 2 / Q ( a 2 ) = 1 } gives a surjection coker j ^ ↠ coker j \operatorname{coker}\hat{j}\twoheadrightarrow\operatorname{coker}j coker j ^ ↠ coker j
∣ coker j ^ ∣ = 2 d − 2 ∏ ℓ p r i m e e ( ℓ ) [ Z × : H ] |\operatorname{coker}\hat{j}|=\frac{2^{d-2}\prod_{\ell\ \mathrm{prime}}e(\ell)}{[\mathbb{Z}^{\times}:H]} ∣ coker j ^ ∣ = [ Z × : H ] 2 d − 2 ∏ ℓ prime e ( ℓ ) where d d d K / Q K/\mathbb{Q} K / Q e ( ℓ ) e(\ell) e ( ℓ ) ℓ \ell ℓ K / Q K/\mathbb{Q} K / Q H ≤ Z × H\leq\mathbb{Z}^{\times} H ≤ Z × N K / Q N_{K/\mathbb{Q}} N K / Q
Lemma E.3 [64 1.5] . Let K K K C 2 × C 2 C_2\times C_2 C 2 × C 2 K 0 , K 1 , K 2 K_0,K_1,K_2 K 0 , K 1 , K 2
h ( Z K ) = 1 2 q ( K ) h ( Z K 0 ) h ( Z K 1 ) h ( Z K 2 ) h(\mathbb{Z}_K)=\frac{1}{2}q(K)h(\mathbb{Z}_{K_0})h(\mathbb{Z}_{K_1})h(\mathbb{Z}_{K_2}) h ( Z K ) = 2 1 q ( K ) h ( Z K 0 ) h ( Z K 1 ) h ( Z K 2 ) where h h h q ( K ) = [ Z K × : Z K 0 × Z K 1 × Z K 2 × ] q(K)=[\mathbb{Z}_K^{\times}:\mathbb{Z}_{K_0}^{\times}\mathbb{Z}_{K_1}^{\times}\mathbb{Z}_{K_2}^{\times}] q ( K ) = [ Z K × : Z K 0 × Z K 1 × Z K 2 × ]
Moreover, we will need the following formulas for the narrow class number h + h^{+} h +
Lemma E.4. Let L L L
h + ( Z L ) = 2 r [ Z L × : ( Z L × ) + ] h ( Z L ) , h^{+}(\mathbb{Z}_L)=\frac{2^{r}}{[\mathbb{Z}_L^{\times}:(\mathbb{Z}_L^{\times})^{+}]}h(\mathbb{Z}_L), h + ( Z L ) = [ Z L × : ( Z L × ) + ] 2 r h ( Z L ) , where r r r σ i : L ↪ C \sigma_i:L\hookrightarrow\mathbb{C} σ i : L ↪ C i ∈ { 1 , … , r } i\in\{1,\ldots,r\} i ∈ { 1 , … , r }
Proof. There is an exact sequence
1 ⟶ Z L × ( Z L × ) + → u ↦ u L × ( L × ) + → u ↦ [ u Z L ] Cl + ( Z L ) → [ a ] ↦ [ a ] Cl ( Z L ) ⟶ 1. 1\longrightarrow\frac{\mathbb{Z}_L^{\times}}{(\mathbb{Z}_L^{\times})^{+}}\xrightarrow{u\mapsto u}\frac{L^{\times}}{(L^{\times})^{+}}\xrightarrow{u\mapsto[u\mathbb{Z}_L]} \operatorname{Cl}^{+}(\mathbb{Z}_L)\xrightarrow{[a]\mapsto[a]}\operatorname{Cl}(\mathbb{Z}_L)\longrightarrow1. 1 ⟶ ( Z L × ) + Z L × u ↦ u ( L × ) + L × u ↦ [ u Z L ] Cl + ( Z L ) [ a ] ↦ [ a ] Cl ( Z L ) ⟶ 1. The formula follows from surjectivity of the sign map sgn : L × → { ± 1 } r \operatorname{sgn}:L^{\times}\to\{\pm1\}^{r} sgn : L × → { ± 1 } r x ∈ L x\in L x ∈ L ( sgn ( σ 1 ( x ) ) , … , sgn ( σ r ( x ) ) ) ∈ { ± 1 } r (\operatorname{sgn}(\sigma_1(x)),\ldots,\operatorname{sgn}(\sigma_r(x)))\in\{\pm1\}^{r} ( sgn ( σ 1 ( x )) , … , sgn ( σ r ( x ))) ∈ { ± 1 } r ( L × ) + (L^{\times})^{+} ( L × ) +
Lemma E.5. Let K K K C 2 × C 2 C_2\times C_2 C 2 × C 2 Z K × \mathbb{Z}_K^{\times} Z K × ± 1 \pm1 ± 1
∣ C ( Z K ) ∣ = 1 2 h ( Z K 1 ) h ( Z K 2 ) ∣ coker N K / K 0 ∣ |\mathcal{C}(\mathbb{Z}_K)|=\frac{1}{2}h(\mathbb{Z}_{K_1})h(\mathbb{Z}_{K_2})|\operatorname{coker}N_{K/K_0}| ∣ C ( Z K ) ∣ = 2 1 h ( Z K 1 ) h ( Z K 2 ) ∣ coker N K / K 0 ∣ where N K / K 0 : Cl ( Z K ) → Cl + ( Z K 0 ) N_{K/K_0}:\operatorname{Cl}(\mathbb{Z}_K)\to\operatorname{Cl}^{+}(\mathbb{Z}_{K_0}) N K / K 0 : Cl ( Z K ) → Cl + ( Z K 0 )
Proof. From the exact sequence in § 2.2 , it follows that
∣ E ( Z K ) ∣ = [ ( Z K 0 × ) + : N K / K 0 ( Z K × ) ] h ( Z K ) ∣ im N K / K 0 ∣ . |\mathcal{E}(\mathbb{Z}_K)| = [(\mathbb{Z}_{K_0}^{\times})^{+} : N_{K/K_0}(\mathbb{Z}_K^{\times})] \frac{h(\mathbb{Z}_K)}{|\operatorname{im} N_{K/K_0}|}. ∣ E ( Z K ) ∣ = [( Z K 0 × ) + : N K / K 0 ( Z K × )] ∣ im N K / K 0 ∣ h ( Z K ) . Using Lemma E.3, and Lemma E.4 applied to K 0 K_0 K 0
1 8 h + ( Z K 0 ) ∣ im N K / K 0 ∣ h ( Z K 1 ) h ( Z K 2 ) q ( K ) [ Z K 0 × : ( Z K 0 × ) + ] [ ( Z K 0 × ) + : N K / K 0 ( Z K × ) ] . \frac{1}{8}\frac{h^{+}(\mathbb{Z}_{K_0})}{|\operatorname{im} N_{K/K_0}|}h(\mathbb{Z}_{K_1})h(\mathbb{Z}_{K_2})q(K)[\mathbb{Z}_{K_0}^{\times} : (\mathbb{Z}_{K_0}^{\times})^{+}][(\mathbb{Z}_{K_0}^{\times})^{+} : N_{K/K_0}(\mathbb{Z}_K^{\times})]. 8 1 ∣ im N K / K 0 ∣ h + ( Z K 0 ) h ( Z K 1 ) h ( Z K 2 ) q ( K ) [ Z K 0 × : ( Z K 0 × ) + ] [( Z K 0 × ) + : N K / K 0 ( Z K × )] . With the assumption that Z K × \mathbb{Z}_K^{\times} Z K × ± 1 \pm1 ± 1 q ( K ) = [ Z K × : Z K 0 × Z K 1 × Z K 2 × ] = [ Z K × : Z K 0 × ] q(K) = [\mathbb{Z}_K^{\times} : \mathbb{Z}_{K_0}^{\times}\mathbb{Z}_{K_1}^{\times}\mathbb{Z}_{K_2}^{\times}] = [\mathbb{Z}_K^{\times} : \mathbb{Z}_{K_0}^{\times}] q ( K ) = [ Z K × : Z K 0 × Z K 1 × Z K 2 × ] = [ Z K × : Z K 0 × ]
∣ E ( Z K ) ∣ = 1 8 ∣ coker N K / K 0 ∣ h ( Z K 1 ) h ( Z K 2 ) [ Z K × : N K / K 0 ( Z K × ) ] . |\mathcal{E}(\mathbb{Z}_K)| = \frac{1}{8}|\operatorname{coker} N_{K/K_0}|h(\mathbb{Z}_{K_1})h(\mathbb{Z}_{K_2})[\mathbb{Z}_K^{\times} : N_{K/K_0}(\mathbb{Z}_K^{\times})]. ∣ E ( Z K ) ∣ = 8 1 ∣ coker N K / K 0 ∣ h ( Z K 1 ) h ( Z K 2 ) [ Z K × : N K / K 0 ( Z K × )] . Again under the assumption that Z K × \mathbb{Z}_K^{\times} Z K × 1 1 1 [ Z K × : N K / K 0 ( Z K × ) ] = 4 [\mathbb{Z}_K^{\times} : N_{K/K_0}(\mathbb{Z}_K^{\times})] = 4 [ Z K × : N K / K 0 ( Z K × )] = 4 □ \square □
We are now ready to prove Lemma 4.3 .
Proof. First observe that if ( [ a 1 ] , [ a 2 ] ) ∈ Cl ( Z K 1 ) × Cl ( Z K 2 ) ([a_1], [a_2]) \in\operatorname{Cl}(\mathbb{Z}_{K_1}) \times\operatorname{Cl}(\mathbb{Z}_{K_2}) ([ a 1 ] , [ a 2 ]) ∈ Cl ( Z K 1 ) × Cl ( Z K 2 ) κ Z K \kappa_{\mathbb{Z}_K} κ Z K ( [ 1 ] , [ a 1 ] , [ a 2 ] ) ∈ Cl ( Z K 0 ) × Cl ( Z K 1 ) × Cl ( Z K 2 ) ([1], [a_1], [a_2]) \in\operatorname{Cl}(\mathbb{Z}_{K_0}) \times\operatorname{Cl}(\mathbb{Z}_{K_1}) \times\operatorname{Cl}(\mathbb{Z}_{K_2}) ([ 1 ] , [ a 1 ] , [ a 2 ]) ∈ Cl ( Z K 0 ) × Cl ( Z K 1 ) × Cl ( Z K 2 ) j j j Lemma E.2 , namely there is an injection ker κ Z K ↪ ker j \ker\kappa_{\mathbb{Z}_K} \hookrightarrow\ker j ker κ Z K ↪ ker j
∣ ker κ Z K ∣ ≤ ∣ ker j ∣ = h ( Z K 0 ) h ( Z K 1 ) h ( Z K 2 ) h ( Z K ) ∣ coker j ∣ . |\ker\kappa_{\mathbb{Z}_K}| \leq|\ker j| = \frac{h(\mathbb{Z}_{K_0})h(\mathbb{Z}_{K_1})h(\mathbb{Z}_{K_2})}{h(\mathbb{Z}_K)}|\operatorname{coker} j|. ∣ ker κ Z K ∣ ≤ ∣ ker j ∣ = h ( Z K ) h ( Z K 0 ) h ( Z K 1 ) h ( Z K 2 ) ∣ coker j ∣. Using Lemma E.3, then
∣ ker j ∣ = 2 q ( K ) ∣ coker j ∣ , |\ker j| = \frac{2}{q(K)}|\operatorname{coker} j|, ∣ ker j ∣ = q ( K ) 2 ∣ coker j ∣ , where one can see that q ( K ) ∈ { 1 , 2 } q(K) \in\{1,2\} q ( K ) ∈ { 1 , 2 } [71 Proposition 5.12] . Hence,
∣ ker j ∣ ≤ 2 q ( K ) ∣ coker j ^ ∣ ≤ 1 2 q ( K ) ∏ ℓ p r i m e e ( ℓ ) |\ker j| \leq\frac{2}{q(K)}|\operatorname{coker} \hat{j}| \leq\frac{1}{2q(K)}\prod_{\ell\ \mathrm{prime}} e(\ell) ∣ ker j ∣ ≤ q ( K ) 2 ∣ coker j ^ ∣ ≤ 2 q ( K ) 1 ℓ prime ∏ e ( ℓ ) using Lemma E.2 for the second inequality, with d = 1 d = 1 d = 1 Q \mathbb{Q} Q K K K [ Z × : H ] = 2 [\mathbb{Z}^{\times} : H] = 2 [ Z × : H ] = 2 − 1 -1 − 1 K K K ∣ ker κ Z K ∣ |\ker\kappa_{\mathbb{Z}_K}| ∣ ker κ Z K ∣
On the other hand,
∣ coker κ Z K ∣ = ∣ E ( Z K ) ∣ h ( Z K 1 ) h ( Z K 2 ) ∣ ker κ Z K ∣ = 1 2 ∣ coker N K / K 0 ∣ ∣ ker κ Z K ∣ |\operatorname{coker} \kappa_{\mathbb{Z}_K}| = \frac{|\mathcal{E}(\mathbb{Z}_K)|}{h(\mathbb{Z}_{K_1})h(\mathbb{Z}_{K_2})}|\ker\kappa_{\mathbb{Z}_K}| = \frac{1}{2}|\operatorname{coker} N_{K/K_0}||\ker\kappa_{\mathbb{Z}_K}| ∣ coker κ Z K ∣ = h ( Z K 1 ) h ( Z K 2 ) ∣ E ( Z K ) ∣ ∣ ker κ Z K ∣ = 2 1 ∣ coker N K / K 0 ∣∣ ker κ Z K ∣ by Lemma E.5, which proves the bound on ∣ coker κ Z K ∣ |\operatorname{coker} \kappa_{\mathbb{Z}_K}| ∣ coker κ Z K ∣ □ \square □
Example E.6. We consider the R2-D2 orientation introduced in Example 3.4 and used in Section F.2 below. Here K = Q ( d , − p ) K = \mathbb{Q}(\sqrt{d},\sqrt{-p}) K = Q ( d , − p ) p > 3 p > 3 p > 3 d d d p p p K 0 = Q ( d ) K_0 = \mathbb{Q}(\sqrt{d}) K 0 = Q ( d ) K 1 = Q ( − p ) K_1 = \mathbb{Q}(\sqrt{-p}) K 1 = Q ( − p ) K 2 = Q ( − d p ) K_2 = \mathbb{Q}(\sqrt{-dp}) K 2 = Q ( − d p ) d = q 1 q 2 d = q_1q_2 d = q 1 q 2 q 1 , q 2 > 3 q_1,q_2 > 3 q 1 , q 2 > 3 p ≡ d ≡ 3 ( m o d 4 ) p \equiv d \equiv3 \pmod{4} p ≡ d ≡ 3 ( mod 4 ) disc Z K = 2 4 p 2 q 1 2 q 2 2 \operatorname{disc}\mathbb{Z}_K = 2^4p^2q_1^2q_2^2 disc Z K = 2 4 p 2 q 1 2 q 2 2 [98 Thm. 3] . There are then exactly four ramified primes in K / Q K/\mathbb{Q} K / Q 2 2 2 p p p q 1 q_1 q 1 q 2 q_2 q 2 e ( 2 ) = e ( p ) = e ( q 1 ) = e ( q 2 ) = 2 e(2) = e(p) = e(q_1) = e(q_2) = 2 e ( 2 ) = e ( p ) = e ( q 1 ) = e ( q 2 ) = 2 Lemma 4.3 it follows that ∣ ker κ Z K ∣ ≤ 8 / q ( K ) |\ker\kappa_{\mathbb{Z}_K}| \leq8/q(K) ∣ ker κ Z K ∣ ≤ 8/ q ( K ) K / K 0 K/K_0 K / K 0 Q ( d ) \mathbb{Q}(\sqrt{d}) Q ( d ) p p p N K / K 0 N_{K/K_0} N K / K 0 Cl + ( Z K 0 ) \operatorname{Cl}^{+}(\mathbb{Z}_{K_0}) Cl + ( Z K 0 ) ∣ coker κ Z K ∣ ≤ 4 / q ( K ) |\operatorname{coker}\kappa_{\mathbb{Z}_K}| \leq4/q(K) ∣ coker κ Z K ∣ ≤ 4/ q ( K )
Key exchange from R2
We now delve into the details of generating concrete parameters for a Diffie–Hellman style key exchange protocol built from Shimura class group actions, along the usual diagram depicted in Figure 1 . We emphasize that the construction below was done for proof-of-concept purposes only: we leave considerable room for optimization, and the security remains to be assessed more thoroughly. For the appealing reasons mentioned in Section 4.4, we concentrate on the R2 orientations from Appendix § 10 (see also Example 3.4 ), where the entire orbit is defined over F p \mathbb{F}_p F p [50 ] .
Figure 1. Diffie–Hellman key exchange based on Shimura class group actions, for a set of “generators” g = { g 1 , … , g r } ⊂ C ( R ) \mathfrak{g} = \{g_1,\ldots,g_r\} \subset\mathcal{C}(R) g = { g 1 , … , g r } ⊂ C ( R ) { − B , … , B } r \{-B,\ldots,B\}^r { − B , … , B } r
Key exchange from R2-D4
Recall that R2-D4 is a (not necessarily primitive) orientation by R = Z [ γ ] R = \mathbb{Z}[\gamma] R = Z [ γ ]
γ = a + b p , a + ∣ b ∣ p < 0. \gamma= \sqrt{a+b\sqrt{p}}, \qquad a + |b|\sqrt{p} < 0. γ = a + b p , a + ∣ b ∣ p < 0. Note that
γ ˉ γ = d : = − a − b p ∈ R 0 + \bar{\gamma}\gamma= d := -a-b\sqrt{p} \in R_0^{+} γ ˉ γ = d := − a − b p ∈ R 0 + so in order to represent ι ( γ ) \iota(\gamma) ι ( γ ) § 4.3 we can stay in dimension 2 as soon as we can write N − d = α 2 N-d=\alpha^2 N − d = α 2 α = s + t p ∈ Z [ p ] \alpha=s+t\sqrt{p}\in\mathbb{Z}[\sqrt{p}] α = s + t p ∈ Z [ p ]
− 2 s t = b , s 2 + p t 2 = N + a , \begin{aligned}
-2st&=b,\\
s^2+pt^2&=N+a,
\end{aligned} − 2 s t s 2 + p t 2 = b , = N + a , showing that we cannot let b = ± 1 b=\pm1 b = ± 1 Z [ γ ] \mathbb{Z}[\gamma] Z [ γ ] b = 4 b=4 b = 4 s = 2 s=2 s = 2 t = 1 t=1 t = 1 a = p + 4 − N a=p+4-N a = p + 4 − N 17
Enforcing complete splitting of small primes. For an efficient evaluation of the Shimura class group action in the g-REGA model, we want that A [ ℓ ] A[\ell] A [ ℓ ] ℓ \ell ℓ g \mathbf{g} g ℓ ∣ p − 1 \ell\mid p-1 ℓ ∣ p − 1 A [ ℓ ] ⊂ A ( F p 2 ) A[\ell]\subset A(\mathbb{F}_{p^2}) A [ ℓ ] ⊂ A ( F p 2 ) ℓ \ell ℓ R R R a ± 4 a\pm4 a ± 4 ℓ \ell ℓ
a = p + 4 − N ≡ 5 − N ( m o d ℓ ) , a=p+4-N\equiv5-N\pmod{\ell}, a = p + 4 − N ≡ 5 − N ( mod ℓ ) , this condition does not explicitly depend on a a a p p p ℓ 1 , ℓ 2 , … , ℓ r \ell_1,\ell_2,\ldots,\ell_r ℓ 1 , ℓ 2 , … , ℓ r 9 − N 9-N 9 − N 1 − N 1-N 1 − N N N N 1 4 \frac{1}{4} 4 1 N N N ℓ i \ell_i ℓ i
p = M c ℓ 1 ℓ 2 ⋯ ℓ r + 1 p=Mc\ell_1\ell_2\cdots\ell_r+1 p = M c ℓ 1 ℓ 2 ⋯ ℓ r + 1 with M M M N N N c c c p p p N = M 2 N=M^2 N = M 2 A [ N ] ⊂ A ( F p 2 ) A[\sqrt{N}]\subset A(\mathbb{F}_{p^2}) A [ N ] ⊂ A ( F p 2 )
Realization as an instance of R2-D4. For an incorporation into the R2-D4 family we need ∣ a ∣ > p / 4 |a|>p/4 ∣ a ∣ > p /4 N = p + 4 − a > 5 p / 4 N=p+4-a>5p/4 N = p + 4 − a > 5 p /4 a 1 , a 2 , a 3 , b 1 , b 2 , b 3 a_1,a_2,a_3,b_1,b_2,b_3 a 1 , a 2 , a 3 , b 1 , b 2 , b 3
a = − a 1 2 − a 1 a 2 − p + 1 4 a 2 2 − p a 3 2 − b 1 2 − b 1 b 3 − p + 1 4 b 3 2 − b 2 2 , a=-a_1^2-a_1a_2-\frac{p+1}{4}a_2^2-pa_3^2-b_1^2-b_1b_3-\frac{p+1}{4}b_3^2-b_2^2, a = − a 1 2 − a 1 a 2 − 4 p + 1 a 2 2 − p a 3 2 − b 1 2 − b 1 b 3 − 4 p + 1 b 3 2 − b 2 2 , 4 = b = a 2 b 1 + ( a 1 + a 2 ) b 3 − 2 a 3 b 2 . 4=b=a_2b_1+(a_1+a_2)b_3-2a_3b_2. 4 = b = a 2 b 1 + ( a 1 + a 2 ) b 3 − 2 a 3 b 2 . These formulae can be rewritten as
− 4 a = A 2 + B 2 + 4 b 2 2 + p ( a 2 2 + 4 a 3 2 + b 3 2 ) , -4a=A^2+B^2+4b_2^2+p(a_2^2+4a_3^2+b_3^2), − 4 a = A 2 + B 2 + 4 b 2 2 + p ( a 2 2 + 4 a 3 2 + b 3 2 ) , 8 = A b 3 + B a 2 − 4 a 3 b 2 . 8=Ab_3+Ba_2-4a_3b_2. 8 = A b 3 + B a 2 − 4 a 3 b 2 . where A = 2 a 1 + a 2 A = 2a_1 + a_2 A = 2 a 1 + a 2 B = 2 b 1 + b 3 B = 2b_1 + b_3 B = 2 b 1 + b 3 ∣ 4 a ∣ > p |4a| > p ∣4 a ∣ > p n = 1 , 2 , 3 , … n = 1, 2, 3, \ldots n = 1 , 2 , 3 , … ( a 2 , 2 a 3 , b 3 ) ∈ Z × 2 Z × Z (a_2, 2a_3, b_3) \in\mathbb{Z} \times2\mathbb{Z} \times\mathbb{Z} ( a 2 , 2 a 3 , b 3 ) ∈ Z × 2 Z × Z n n n ( A , B , 2 b 2 ) (A, B, 2b_2) ( A , B , 2 b 2 ) − 4 a − n p -4a - np − 4 a − n p
H : b 3 X + a 2 Y − 2 a 3 Z = 8. H : b_3X + a_2Y - 2a_3Z = 8. H : b 3 X + a 2 Y − 2 a 3 Z = 8. where moreover we want that A ≡ a 2 m o d 2 A \equiv a_2 \bmod2 A ≡ a 2 mod 2 B ≡ b 3 m o d 2 B \equiv b_3 \bmod2 B ≡ b 3 mod 2 a 1 = ( A − a 2 ) / 2 a_1 = (A - a_2)/2 a 1 = ( A − a 2 ) /2 b 1 = ( B − b 3 ) / 2 b_1 = (B - b_3)/2 b 1 = ( B − b 3 ) /2
This can be turned into an efficient algorithm, but for generating the concrete parameters below we have used a simplified search by restricting to a 3 = 0 a_3 = 0 a 3 = 0 gcd ( a 2 , b 3 ) = 1 \gcd(a_2, b_3) = 1 g cd( a 2 , b 3 ) = 1 n n n ∣ 4 a ∣ |4a| ∣4 a ∣ p p p λ , μ ∈ Z \lambda, \mu\in\mathbb{Z} λ , μ ∈ Z 1 = λ b 3 + μ a 2 1 = \lambda b_3 + \mu a_2 1 = λ b 3 + μ a 2 x , b 2 x, b_2 x , b 2 ( 8 λ + x a 2 , 8 μ − x b 3 , 2 b 2 ) (8\lambda+ xa_2, 8\mu- xb_3, 2b_2) ( 8 λ + x a 2 , 8 μ − x b 3 , 2 b 2 ) H H H − 4 a − n p -4a - np − 4 a − n p
( n x + 8 ( λ a 2 − μ b 3 ) ) 2 + 4 n b 2 2 = − 4 n a − n 2 p − 64. \left(nx + 8(\lambda a_2 - \mu b_3)\right)^2 + 4nb_2^2 = -4na - n^2p - 64. ( n x + 8 ( λ a 2 − μ b 3 ) ) 2 + 4 n b 2 2 = − 4 na − n 2 p − 64. This asks to represent the right-hand side by the positive definite binary quadratic form X 2 + 4 n Y 2 X^2 + 4nY^2 X 2 + 4 n Y 2 1 / 2 h ( Z [ − 4 n ] ) ≈ 1 / n 1/2h(\mathbb{Z}[\sqrt{-4n}]) \approx1/\sqrt{n} 1/2 h ( Z [ − 4 n ]) ≈ 1/ n [30 Thm. 9.12] and in that case a corresponding representation can be found efficiently using Cornacchia’s algorithm. Three remarks are in order:
We model − 4 n a − n 2 p − 64 -4na - n^2p - 64 − 4 na − n 2 p − 64 p p p p p p 3 ∣ a 3 \mid a 3 ∣ a p ≡ 2 m o d 3 p \equiv2 \bmod3 p ≡ 2 mod 3 3 ∤ n 3 \nmid n 3 ∤ n n n n − 4 n a − n 2 p − 64 -4na - n^2p - 64 − 4 na − n 2 p − 64 3 3 3 18 3 ∤ a 3 \nmid a 3 ∤ a p ≡ 1 m o d 3 p \equiv1 \bmod3 p ≡ 1 mod 3
If this integer can indeed be represented as c 2 + 4 n d 2 c^2 + 4nd^2 c 2 + 4 n d 2 c , d ∈ Z c, d \in\mathbb{Z} c , d ∈ Z c = n x + 8 ( λ a 2 − μ b 3 ) c = nx + 8(\lambda a_2 - \mu b_3) c = n x + 8 ( λ a 2 − μ b 3 ) x ∈ Z x \in\mathbb{Z} x ∈ Z ( λ a 2 − μ b 3 ) 2 ≡ − 1 m o d n (\lambda a_2 - \mu b_3)^2 \equiv-1 \bmod n ( λ a 2 − μ b 3 ) 2 ≡ − 1 mod n c 2 ≡ ( 8 ( λ a 2 − μ b 3 ) ) 2 m o d n c^2 \equiv(8(\lambda a_2 - \mu b_3))^2 \bmod n c 2 ≡ ( 8 ( λ a 2 − μ b 3 ) ) 2 mod n n n n c ≡ ± 8 ( λ a 2 − μ b 3 ) m o d n c \equiv\pm8(\lambda a_2 - \mu b_3) \bmod n c ≡ ± 8 ( λ a 2 − μ b 3 ) mod n c c c c c c n x + 8 ( λ a 2 − μ b 3 ) nx + 8(\lambda a_2 - \mu b_3) n x + 8 ( λ a 2 − μ b 3 ) n n n log n \log n log n n n n
Artifact of p ≡ 3 m o d 4 p \equiv3 \bmod4 p ≡ 3 mod 4 N N N N N N M ∣ p − 1 M \mid p-1 M ∣ p − 1 p ≡ 3 m o d 4 p \equiv3 \bmod4 p ≡ 3 mod 4 p ≡ 5 m o d 8 p \equiv5 \bmod8 p ≡ 5 mod 8 D 4 D_4 D 4 p ≡ 1 m o d 4 p \equiv1 \bmod4 p ≡ 1 mod 4 B p , ∞ B_{p,\infty} B p , ∞ M = 3 f M = 3^f M = 3 f N = 3 2 f N = 3^{2f} N = 3 2 f f f f
Group size. Recall from (16) that the discriminant of Z [ γ ] \mathbb{Z}[\gamma] Z [ γ ] 2 16 p 2 ( a 2 − 16 p ) 2^{16}p^2(a^2 - 16p) 2 16 p 2 ( a 2 − 16 p ) Z [ γ ] \mathbb{Z}[\gamma] Z [ γ ] b 2 = 16 b^2 = 16 b 2 = 16 Z [ γ , p ] \mathbb{Z}[\gamma,\sqrt{p}] Z [ γ , p ] Z [ γ , p ] \mathbb{Z}[\gamma,\sqrt{p}] Z [ γ , p ] 2 8 p 2 ( a 2 − 16 p ) 2^8p^2(a^2 - 16p) 2 8 p 2 ( a 2 − 16 p ) a = p + 4 − 3 2 f a = p + 4 - 3^{2f} a = p + 4 − 3 2 f p ≡ 1 m o d 3 f p \equiv1 \bmod3^f p ≡ 1 mod 3 f f f f
a 2 − 16 p ≡ 4 m o d 8 , a 2 − 16 p ≡ 9 m o d 27. a^2 - 16p \equiv4 \bmod8, \qquad a^2 - 16p \equiv9 \bmod27. a 2 − 16 p ≡ 4 mod 8 , a 2 − 16 p ≡ 9 mod 27. and then from [48 Thm. 1 and Tbl. B] it follows that the discriminant of the maximal order is 2 6 p 2 ( a 2 − 16 p ) / 9 2^6p^2(a^2 - 16p)/9 2 6 p 2 ( a 2 − 16 p ) /9 ( a 2 − 16 p ) / 36 (a^2 - 16p)/36 ( a 2 − 16 p ) /36 Z [ γ , p ] \mathbb{Z}[\gamma,\sqrt{p}] Z [ γ , p ] § 7 ). In any case the relevant discriminant is of order p 2 a 2 p^2a^2 p 2 a 2 h + ( Z [ p ] ) h^+(\mathbb{Z}[\sqrt{p}]) h + ( Z [ p ]) Corollary 5.15 ), in view of the Brauer–Siegel theorem it is fair to estimate the size of the Shimura class group as p ∣ a ∣ p|a| p ∣ a ∣
Concrete parameters. We have generated parameters aiming for a Shimura class group size of roughly 2048 bits, which should be compared with CSIDH-4096, aiming for NIST-I security. We choose ∣ a ∣ ≈ N ≈ p |a| \approx N \approx p ∣ a ∣ ≈ N ≈ p p − 1 p - 1 p − 1 ℓ \ell ℓ N N N p p p N = 3 2 f N = 3^{2f} N = 3 2 f f = 333 f = 333 f = 333 ℓ \ell ℓ 9 − N 9 - N 9 − N 1 − N 1 - N 1 − N ℓ i \ell_i ℓ i
23 , 43 , 53 , 61 , 67 , 97 , 101 , 103 , 173 , 197 , 211 , 227 , 233 , 257 , 277 , 283 , 23, 43, 53, 61, 67, 97, 101, 103, 173, 197, 211, 227, 233, 257, 277, 283, 23 , 43 , 53 , 61 , 67 , 97 , 101 , 103 , 173 , 197 , 211 , 227 , 233 , 257 , 277 , 283 , 293 , 307 , 313 , 359 , 373 , 383 , 397 , 419 , 433 , 443 , 457 , 491 , 521 , 563 , 577 , 293, 307, 313, 359, 373, 383, 397, 419, 433, 443, 457, 491, 521, 563, 577, 293 , 307 , 313 , 359 , 373 , 383 , 397 , 419 , 433 , 443 , 457 , 491 , 521 , 563 , 577 , 601 , 613 , 673 , 683 , 691 , 733 , 743 , 769 , 787 , 809 , 811 , 859 , 883 , 887 , 911 , 601, 613, 673, 683, 691, 733, 743, 769, 787, 809, 811, 859, 883, 887, 911, 601 , 613 , 673 , 683 , 691 , 733 , 743 , 769 , 787 , 809 , 811 , 859 , 883 , 887 , 911 , 977 , 983 , 1069 , 1151 , 1163 , 1187 , 1193 , 1237 , 1249 , 1259. 977, 983, 1069, 1151, 1163, 1187, 1193, 1237, 1249, 1259. 977 , 983 , 1069 , 1151 , 1163 , 1187 , 1193 , 1237 , 1249 , 1259. let p = 2 ⋅ 3 f ⋅ 7 ⋅ ℓ 1 ⋯ ℓ 56 + 1 p = 2 \cdot3^f \cdot7 \cdot\ell_1 \cdots\ell_{56} + 1 p = 2 ⋅ 3 f ⋅ 7 ⋅ ℓ 1 ⋯ ℓ 56 + 1 a = p + 4 − N a = p + 4 - N a = p + 4 − N 3 2 3^2 3 2 p p p ∣ a ∣ |a| ∣ a ∣ N N N ( a 2 − 16 p ) / 36 (a^2 - 16p)/36 ( a 2 − 16 p ) /36 2 40 2^{40} 2 40 19 a 2 = 1758 a_2 = 1758 a 2 = 1758 a 3 = 0 a_3 = 0 a 3 = 0 b 3 = 565 b_3 = 565 b 3 = 565 n = a 2 2 + b 3 2 = 3409789 n = a_2^2 + b_3^2 = 3409789 n = a 2 2 + b 3 2 = 3409789 − 4 n a − n 2 p − 64 -4na - n^2p - 64 − 4 na − n 2 p − 64 X 2 + 4 n Y 2 X^2 + 4nY^2 X 2 + 4 n Y 2
a 1 = 72447886291797740848322932962051593473734748284190344 65405345610109441454835644829643664359635439561189660 15384207541540878628641645549368269105214510733042954 \begin{aligned}
a_1 ={}& 72447886291797740848322932962051593473734748284190344\\
&65405345610109441454835644829643664359635439561189660\\
&15384207541540878628641645549368269105214510733042954
\end{aligned} a 1 = 72447886291797740848322932962051593473734748284190344 65405345610109441454835644829643664359635439561189660 15384207541540878628641645549368269105214510733042954 b 1 = − 23283876993666509430775004052081427936666742195999741 02931752144318449614324311336034511014331071303795311 71042137236046983177009402579859540412085437180984222 \begin{aligned}
b_1 ={}& -23283876993666509430775004052081427936666742195999741\\
&02931752144318449614324311336034511014331071303795311\\
&71042137236046983177009402579859540412085437180984222
\end{aligned} b 1 = − 23283876993666509430775004052081427936666742195999741 02931752144318449614324311336034511014331071303795311 71042137236046983177009402579859540412085437180984222 b 2 = 23122390115850551190499797644857286144606472585743281 92024567734772318935855806010161778248613700364778186 274082288575193881983650751959251785841361677700367 \begin{aligned}
b_2 ={}& 23122390115850551190499797644857286144606472585743281\\
&92024567734772318935855806010161778248613700364778186\\
&274082288575193881983650751959251785841361677700367
\end{aligned} b 2 = 23122390115850551190499797644857286144606472585743281 92024567734772318935855806010161778248613700364778186 274082288575193881983650751959251785841361677700367 for the remaining R2-D4 parameters. These integers are roughly of size 3 f 3^f 3 f
Isogeny computations involved. Recall the count from (4) : to reach a key space size having roughly 256 bits, we want
( 2 B + 1 ) 2 ⋅ 56 ≈ 2 256 , (2B + 1)^{2 \cdot56} \approx2^{256}, ( 2 B + 1 ) 2 ⋅ 56 ≈ 2 256 , showing that B = 2 B = 2 B = 2 Figure 1 amounts to at most 2 ⋅ 56 ⋅ 2 = 224 2 \cdot56 \cdot2 = 224 2 ⋅ 56 ⋅ 2 = 224 ( a , ℓ i ) (\mathfrak{a}, \ell_i) ( a , ℓ i ) 3 f 3^f 3 f ℓ i \ell_i ℓ i
Key exchange from R2-D2
We mention once again that the vectorization problem from the R2-D2 orientation, as it was introduced in Example 3.4 , can be reduced to vectorization problems for the ideal-class groups of the underlying imaginary quadratic rings Z [ − p ] \mathbb{Z}[\sqrt{-p}] Z [ − p ] Z [ − d p ] \mathbb{Z}[\sqrt{-dp}] Z [ − d p ] [50 ] . We nevertheless include a quick, high-level discussion. On one hand, we do this for the sake of context for [50 ] . On the other hand, it allows us to highlight an interesting connection between R2-D2 orientations and the “higher-degree” supersingular group actions studied by Chenu–Smith [22 ] , used in Orient Express [16 ] . These concern actions by Cl ( Z [ − d p ] ) \operatorname{Cl}(\mathbb{Z}[\sqrt{-dp}]) Cl ( Z [ − d p ]) Z [ − d p ] \mathbb{Z}[\sqrt{-dp}] Z [ − d p ] ( E , ι ) (E,\iota) ( E , ι )
Generators. Following § 4.1 the generating set g \mathbf{g} g κ R : Cl ( Z [ − d p ] ) × Cl ( Z [ − p ] ) → C ( R ) \kappa_R : \operatorname{Cl}(\mathbb{Z}[\sqrt{-dp}]) \times\operatorname{Cl}(\mathbb{Z}[\sqrt{-p}]) \to\mathcal{C}(R) κ R : Cl ( Z [ − d p ]) × Cl ( Z [ − p ]) → C ( R )
[ m 1 ] , [ m 2 ] , … , [ m s ] ∈ Cl ( Z [ − d p ] ) , [ l 1 ] , [ l 2 ] , … , [ l t ] ∈ Cl ( Z [ − p ] ) [\mathfrak{m}_1], [\mathfrak{m}_2], \ldots, [\mathfrak{m}_s] \in\operatorname{Cl}(\mathbb{Z}[\sqrt{-dp}]), \qquad[\mathfrak{l}_1], [\mathfrak{l}_2], \ldots, [\mathfrak{l}_t] \in\operatorname{Cl}(\mathbb{Z}[\sqrt{-p}]) [ m 1 ] , [ m 2 ] , … , [ m s ] ∈ Cl ( Z [ − d p ]) , [ l 1 ] , [ l 2 ] , … , [ l t ] ∈ Cl ( Z [ − p ]) and let g \mathbf{g} g ( [ m i ] , 1 ) ([\mathfrak{m}_i],1) ([ m i ] , 1 ) i = 1 , … , s i = 1,\ldots,s i = 1 , … , s ( 1 , [ l i ] ) (1,[\mathfrak{l}_i]) ( 1 , [ l i ]) i = 1 , … , t i = 1,\ldots,t i = 1 , … , t [ m i ] [\mathfrak{m}_i] [ m i ] κ R ( [ m i ] , 1 ) \kappa_R([\mathfrak{m}_i],1) κ R ([ m i ] , 1 ) [ l i ] [\mathfrak{l}_i] [ l i ] l i \mathfrak{l}_i l i ℓ 1 ℓ 2 ⋯ ℓ t ∣ p + 1 \ell_1\ell_2\cdots\ell_t \mid p+1 ℓ 1 ℓ 2 ⋯ ℓ t ∣ p + 1 ℓ i \ell_i ℓ i l i = ( ℓ i , − p − 1 ) \mathfrak{l}_i = (\ell_i,\sqrt{-p}-1) l i = ( ℓ i , − p − 1 ) l ‾ i = ( ℓ i , − p + 1 ) \overline{\mathfrak{l}}_i = (\ell_i,\sqrt{-p}+1) l i = ( ℓ i , − p + 1 ) [ l i ] − 1 [\mathfrak{l}_i]^{-1} [ l i ] − 1 m i \mathfrak{m}_i m i m i m_i m i m 1 m 2 ⋯ m s ∣ p + 1 m_1m_2\cdots m_s \mid p+1 m 1 m 2 ⋯ m s ∣ p + 1 i = 1 , 2 , … , s i = 1,2,\ldots,s i = 1 , 2 , … , s a i ∈ Z a_i \in\mathbb{Z} a i ∈ Z d ≡ a i 2 m o d m i d \equiv a_i^2 \bmod m_i d ≡ a i 2 mod m i m i = ( m i , − d p − a i ) \mathfrak{m}_i = (m_i,\sqrt{-dp}-a_i) m i = ( m i , − d p − a i ) [ m i ] − 1 [\mathfrak{m}_i]^{-1} [ m i ] − 1 m ‾ i = ( m i , − d p + a i ) \overline{\mathfrak{m}}_i = (m_i,\sqrt{-dp}+a_i) m i = ( m i , − d p + a i ) { ℓ 1 , … , ℓ t } \{\ell_1,\ldots,\ell_t\} { ℓ 1 , … , ℓ t } { m 1 , … , m s } \{m_1,\ldots,m_s\} { m 1 , … , m s }
Remark F.2. Recall from Lemma 4.3 that κ R \kappa_R κ R
Parameters. The data needed for setting up R2-D2 are in accordance with those needed for the “square-free” case of Orient Express [16 ] . There too, one looks for a supersingular elliptic curve E / F p 2 E/\mathbb{F}_{p^2} E / F p 2 π p 2 = − p \pi_p^2=-p π p 2 = − p d d d
τ : E ⟶ E ( p ) \tau: E \longrightarrow E^{(p)} τ : E ⟶ E ( p ) such that τ ^ ∘ π p = π p ∘ τ \widehat{\tau} \circ\pi_p = \pi_p \circ\tau τ ∘ π p = π p ∘ τ ℓ \ell ℓ p + 1 p+1 p + 1 Z [ − d p ] \mathbb{Z}[\sqrt{-dp}] Z [ − d p ] [16 , 85 ] .
Acting on the starting surface. Interestingly, the higher-degree supersingular group action can be “embedded” in a Shimura class group action. Indeed, given an elliptic curve ( E , ι ) (E,\iota) ( E , ι ) Z [ − d p ] \mathbb{Z}[\sqrt{-dp}] Z [ − d p ] ι ( − d p ) \iota(\sqrt{-dp}) ι ( − d p )
E → τ E ( p ) → π p E E \xrightarrow{\tau} E^{(p)} \xrightarrow{\pi_p} E E τ E ( p ) π p E for a degree-d d d τ \tau τ τ ^ ∘ π p = π p ∘ τ \hat{\tau} \circ\pi_p = \pi_p \circ\tau τ ^ ∘ π p = π p ∘ τ [16 Lem. 1] , so we can build an R R R W ( E , ι ) ∈ M F p ( R ) W(E,\iota) \in\mathcal{M}_{\mathbb{F}_p}(R) W ( E , ι ) ∈ M F p ( R )
κ R ( [ m ] , 1 ) ⋆ W ( E , ι ) = W ( [ m ] ⋆ ( E , ι ) ) , \kappa_R([m],1) \star W(E,\iota) = W([m] \star(E,\iota)), κ R ([ m ] , 1 ) ⋆ W ( E , ι ) = W ([ m ] ⋆ ( E , ι )) , whence the said embedding. This means that during public-key generation, acting with the [ m i ] [m_i] [ m i ] F p 2 \mathbb{F}_{p^2} F p 2 τ \tau τ [ ℓ i ] [\ell_i] [ ℓ i ]
Acting on a public key. But acting with the [ m i ] [m_i] [ m i ] § 4.3 . The parameters in Orient Express are such that 2 2 a − d = α 2 2^{2a}-d=\alpha^2 2 2 a − d = α 2 a , α a,\alpha a , α d d d ι ( d ) \iota(\sqrt{d}) ι ( d ) 2 u g = 2 ⋅ 1 ⋅ 2 = 4 2u_g=2\cdot1\cdot2=4 2 u g = 2 ⋅ 1 ⋅ 2 = 4 Theorem 4.4 . Unfortunately, here the dimension-halving trick from § 4.3 does not seem to work. The asymmetry between both types of actions is summarized in Figure 2 .
Figure 2. An illustration of the R2-D2 key exchange. Blue arrows represent actions computed via 1-dimensional isogenies, with a 2D representation of the orientation; green arrows represent actions computed via 2-dimensional isogenies; orange arrows represent actions computed via 2-dimensional isogenies, with a 4D representation of the orientation. Polarizations and orientations are omitted to lighten the notation.
Compressing interpolation data for R2
In this appendix we discuss the problem of compressing the interpolation data P , ι ( γ ) ( P ) P,\iota(\gamma)(P) P , ι ( γ ) ( P ) P P P A [ N ] A[\sqrt{N}] A [ N ] M = N M=\sqrt{N} M = N M ∣ p ± 1 M\mid p\pm1 M ∣ p ± 1 F p 2 \mathbb{F}_{p^2} F p 2
Since ι ( γ ) \iota(\gamma) ι ( γ ) F p \mathbb{F}_p F p Π p \Pi_p Π p
A [ M ] ( F p ) ≅ ( Z M Z ) 2 A[M](\mathbb{F}_p)\cong\left(\frac{\mathbb{Z}}{M\mathbb{Z}}\right)^2 A [ M ] ( F p ) ≅ ( M Z Z ) 2 into itself, and likewise for the − 1 -1 − 1 A [ M ] A[M] A [ M ] P 1 , P 2 , Q 1 , Q 2 P_1,P_2,Q_1,Q_2 P 1 , P 2 , Q 1 , Q 2 e M ( P i , Q j ) e_M(P_i,Q_j) e M ( P i , Q j ) ζ M \zeta_M ζ M i = j i=j i = j i ≠ j i\ne j i = j ζ M ∈ F p 2 \zeta_M\in\mathbb{F}_{p^2} ζ M ∈ F p 2 M M M e M ( P i , P j ) = e M ( Q i , Q j ) = 1 e_M(P_i,P_j)=e_M(Q_i,Q_j)=1 e M ( P i , P j ) = e M ( Q i , Q j ) = 1 i , j i,j i , j M M M M M M
If M ∣ p + 1 M\mid p+1 M ∣ p + 1 A [ M ] A[M] A [ M ] ⟨ P 1 , P 2 ⟩ \langle P_1,P_2\rangle ⟨ P 1 , P 2 ⟩ ⟨ Q 1 , Q 2 ⟩ \langle Q_1,Q_2\rangle ⟨ Q 1 , Q 2 ⟩ − 1 -1 − 1
If M ∣ p − 1 M\mid p-1 M ∣ p − 1 ⟨ P 1 , Q 1 ⟩ \langle P_1,Q_1\rangle ⟨ P 1 , Q 1 ⟩ ⟨ P 2 , Q 2 ⟩ \langle P_2,Q_2\rangle ⟨ P 2 , Q 2 ⟩ − 1 -1 − 1
The second case where Π 2 = p \Pi^2=p Π 2 = p [28 Lem. 3.17 and Lem. 5.1] . The first case where Π 2 = − p \Pi^2=-p Π 2 = − p [28 Lem. 3.17] . Henceforth, we assume that P 1 , P 2 , Q 1 , Q 2 P_1,P_2,Q_1,Q_2 P 1 , P 2 , Q 1 , Q 2
It now suffices to describe ι ( γ ) ( P i ) \iota(\gamma)(P_i) ι ( γ ) ( P i ) i = 1 , 2 i=1,2 i = 1 , 2 s , t , u , v ∈ Z / M Z s,t,u,v\in\mathbb{Z}/M\mathbb{Z} s , t , u , v ∈ Z / M Z
ι ( γ ) ( P 1 ) = s P 1 + t P 2 , ι ( γ ) ( P 2 ) = u P 1 + v P 2 . \iota(\gamma)(P_1)=sP_1+tP_2,\qquad\iota(\gamma)(P_2)=uP_1+vP_2. ι ( γ ) ( P 1 ) = s P 1 + t P 2 , ι ( γ ) ( P 2 ) = u P 1 + v P 2 . To expand the representation: we know that
ι ( γ ) ( Q 1 ) = x Q 1 + y Q 2 , ι ( γ ) ( Q 2 ) = z Q 1 + w Q 2 \iota(\gamma)(Q_1)=xQ_1+yQ_2,\qquad\iota(\gamma)(Q_2)=zQ_1+wQ_2 ι ( γ ) ( Q 1 ) = x Q 1 + y Q 2 , ι ( γ ) ( Q 2 ) = z Q 1 + w Q 2 for x , y , z , w ∈ Z / M Z x,y,z,w\in\mathbb{Z}/M\mathbb{Z} x , y , z , w ∈ Z / M Z M M M
s x + t y = log ζ M e M ( ι ( γ ) ( P 1 ) , ι ( γ ) ( Q 1 ) ) = log ζ M e M ( P 1 , ι ( d ) ( Q 1 ) ) , sx+ty=\log_{\zeta_M}e_M(\iota(\gamma)(P_1),\iota(\gamma)(Q_1))=\log_{\zeta_M}e_M(P_1,\iota(d)(Q_1)), s x + t y = log ζ M e M ( ι ( γ ) ( P 1 ) , ι ( γ ) ( Q 1 )) = log ζ M e M ( P 1 , ι ( d ) ( Q 1 )) , where we have used that ι ( γ ) † ι ( γ ) = ι ( γ ˉ γ ) = ι ( d ) \iota(\gamma)^\dagger\iota(\gamma)=\iota(\bar{\gamma}\gamma)=\iota(d) ι ( γ ) † ι ( γ ) = ι ( γ ˉ γ ) = ι ( d ) § 4.3 , and similarly obtain u x + v y ux+vy ux + v y x , y x,y x , y z , w z,w z , w
Proofs from Section 5
The Shimura class group action via matrix arithmetic
Let g , a , b 1 , b 2 ∈ M 2 ( O ) g,a,b_1,b_2 \in M_2(\mathcal{O}) g , a , b 1 , b 2 ∈ M 2 ( O ) ( a , μ ) (\mathfrak{a},\mu) ( a , μ ) R = Z [ a , b 1 , b 2 ] R=\mathbb{Z}[a,b_1,b_2] R = Z [ a , b 1 , b 2 ] γ \gamma γ M 2 ( O ) M_2(\mathcal{O}) M 2 ( O ) a \mathfrak{a} a
g ′ : = γ − ∗ g μ γ − 1 , a ′ : = γ a γ − 1 , b i ′ : = γ b i γ − 1 , i = 1 , 2 g' := \gamma^{-*}g\mu\gamma^{-1}, \qquad a' := \gamma a\gamma^{-1}, \qquad b_i' := \gamma b_i\gamma^{-1},\ i=1,2 g ′ := γ −∗ g μ γ − 1 , a ′ := γ a γ − 1 , b i ′ := γ b i γ − 1 , i = 1 , 2 as in the proof of Theorem 5.4. We now give a direct argumentation, essentially using matrix arithmetic only, for why this is a well-defined group action.
Why g ′ g' g ′ g g g In Remark 5.2 we already explained why g ′ g' g ′ g g g g ′ ∈ M 2 ( O ) g' \in M_2(\mathcal{O}) g ′ ∈ M 2 ( O ) g − 1 g ′ ∈ M 2 ( O ) g^{-1}g' \in M_2(\mathcal{O}) g − 1 g ′ ∈ M 2 ( O ) g g g M 2 ( O ) M_2(\mathcal{O}) M 2 ( O ) γ − † μ ∈ M 2 ( O ) γ \gamma^{-\dagger}\mu\in M_2(\mathcal{O})\gamma γ −† μ ∈ M 2 ( O ) γ
The ideal a \mathfrak{a} a r ∈ R r \in R r ∈ R μ \mu μ r † r = r 0 μ r^\dagger r=r_0\mu r † r = r 0 μ r 0 r_0 r 0 a \mathfrak{a} a γ \gamma γ s γ = r s\gamma=r s γ = r s ∈ M 2 ( O ) s \in M_2(\mathcal{O}) s ∈ M 2 ( O ) γ = s − 1 r \gamma=s^{-1}r γ = s − 1 r γ − † μ ∈ M 2 ( O ) \gamma^{-\dagger}\mu\in M_2(\mathcal{O}) γ −† μ ∈ M 2 ( O ) γ − † μ \gamma^{-\dagger}\mu γ −† μ a \mathfrak{a} a γ \gamma γ
γ − † μ = s † r − † μ = s † r μ − 1 r 0 − 1 μ = s † r r 0 − 1 = s † r 0 − 1 r . \gamma^{-\dagger}\mu=s^\dagger r^{-\dagger}\mu=s^\dagger r\mu^{-1}r_0^{-1}\mu=s^\dagger rr_0^{-1}=s^\dagger r_0^{-1}r. γ −† μ = s † r −† μ = s † r μ − 1 r 0 − 1 μ = s † r r 0 − 1 = s † r 0 − 1 r . Here we used the identity r † r = r 0 μ r^\dagger r=r_0\mu r † r = r 0 μ r − † = r μ − 1 r 0 − 1 r^{-\dagger}=r\mu^{-1}r_0^{-1} r −† = r μ − 1 r 0 − 1 r 0 r_0 r 0
Why g ′ , a ′ , b 1 ′ , b 2 ′ g',a',b_1',b_2' g ′ , a ′ , b 1 ′ , b 2 ′ Since conjugation by any invertible element is an automorphism of M 2 ( B p , ∞ ) M_2(B_{p,\infty}) M 2 ( B p , ∞ ) γ a γ − 1 \gamma a\gamma^{-1} γ a γ − 1 γ b 1 γ − 1 \gamma b_1\gamma^{-1} γ b 1 γ − 1 γ b 2 γ − 1 \gamma b_2\gamma^{-1} γ b 2 γ − 1 R = Z [ a , b 1 , b 2 ] R=\mathbb{Z}[a,b_1,b_2] R = Z [ a , b 1 , b 2 ] M 2 ( O ) M_2(\mathcal{O}) M 2 ( O ) a a a b i b_i b i
We need that ( γ − ∗ g μ γ − 1 ) − 1 ( γ a γ − 1 ) ∗ ( γ − ∗ g μ γ − 1 ) = γ a γ − 1 (\gamma^{-*}g\mu\gamma^{-1})^{-1}(\gamma a\gamma^{-1})^*(\gamma^{-*}g\mu\gamma^{-1})=\gamma a\gamma^{-1} ( γ −∗ g μ γ − 1 ) − 1 ( γ a γ − 1 ) ∗ ( γ −∗ g μ γ − 1 ) = γ a γ − 1
( γ μ − 1 g − 1 γ ∗ ) ( γ − ∗ a ∗ γ ∗ ) ( γ − ∗ g μ γ − 1 ) = γ μ − 1 ( g − 1 a ∗ g ) μ γ − 1 . (\gamma\mu^{-1}g^{-1}\gamma^*)(\gamma^{-*}a^*\gamma^*)(\gamma^{-*}g\mu\gamma^{-1})=\gamma\mu^{-1}(g^{-1}a^*g)\mu\gamma^{-1}. ( γ μ − 1 g − 1 γ ∗ ) ( γ −∗ a ∗ γ ∗ ) ( γ −∗ g μ γ − 1 ) = γ μ − 1 ( g − 1 a ∗ g ) μ γ − 1 . Finally, γ μ − 1 ( g − 1 a ∗ g ) μ γ − 1 = γ a γ − 1 \gamma\mu^{-1}(g^{-1}a^*g)\mu\gamma^{-1}=\gamma a\gamma^{-1} γ μ − 1 ( g − 1 a ∗ g ) μ γ − 1 = γ a γ − 1 a a a a a a μ \mu μ
What remains is that γ a γ − 1 \gamma a\gamma^{-1} γ a γ − 1 γ b i γ − 1 \gamma b_i\gamma^{-1} γ b i γ − 1 M 2 ( O ) M_2(\mathcal{O}) M 2 ( O ) a a a γ a γ − 1 ∈ M 2 ( O ) \gamma a\gamma^{-1} \in M_2(\mathcal{O}) γ a γ − 1 ∈ M 2 ( O ) γ a ∈ M 2 ( O ) γ \gamma a \in M_2(\mathcal{O})\gamma γ a ∈ M 2 ( O ) γ γ \gamma γ γ \gamma γ a a a γ a \gamma a γ a a a a γ = s − 1 r \gamma= s^{-1}r γ = s − 1 r γ a = s − 1 r a = s − 1 a r \gamma a = s^{-1}ra = s^{-1}ar γ a = s − 1 r a = s − 1 a r s s s a a a r r r a a a γ a \gamma a γ a a a a b b b a a a r r r
Omitted proofs
Proof (of Lemma 5.3). Writing
g = ( s r r ˉ t ) g = \begin{pmatrix} s & r \\ \bar{r} & t \end{pmatrix} g = ( s r ˉ r t ) with s , t ∈ Q > 0 s,t \in\mathbb{Q}_{>0} s , t ∈ Q > 0 r ∈ B p , ∞ r \in B_{p,\infty} r ∈ B p , ∞
g = γ ( s 0 0 t ′ ) γ ∗ , γ = ( 1 0 s − 1 r 1 ) g = \gamma\begin{pmatrix} s & 0 \\ 0 & t' \end{pmatrix} \gamma^\ast,\qquad\gamma= \begin{pmatrix} 1 & 0 \\ s^{-1}r & 1 \end{pmatrix} g = γ ( s 0 0 t ′ ) γ ∗ , γ = ( 1 s − 1 r 0 1 ) with t ′ = t − s − 1 n ( r ) t' = t - s^{-1}\operatorname{n}(r) t ′ = t − s − 1 n ( r ) t ′ > 0 t' > 0 t ′ > 0 [94 Thm. 14.7.4] we can write s = σ σ ˉ s = \sigma\bar{\sigma} s = σ σ ˉ t ′ = τ τ ˉ t' = \tau\bar{\tau} t ′ = τ τ ˉ σ , τ \sigma,\tau σ , τ
h = γ ( σ 0 0 τ ) h = \gamma\begin{pmatrix} \sigma& 0 \\ 0 & \tau\end{pmatrix} h = γ ( σ 0 0 τ ) is of the requested kind. □ \square □
Proof (of Lemma 5.8). First we compute what the centralizer of a a a
( 0 s 1 0 ) (18) \begin{pmatrix} 0 & s \\ 1 & 0 \tag*{(18)} \end{pmatrix} ( 0 1 s 0 ) (18) where s ∈ Z > 0 s \in\mathbb{Z}_{>0} s ∈ Z > 0 M 2 ( B p , ∞ ) M_2(B_{p,\infty}) M 2 ( B p , ∞ ) (18) will be the set of matrices of the form
( x s y y x ) \begin{pmatrix} x & sy \\ y & x \end{pmatrix} ( x y sy x ) where x , y ∈ B p , ∞ x,y \in B_{p,\infty} x , y ∈ B p , ∞ B p , ∞ B_{p,\infty} B p , ∞ Q ( a ) \mathbb{Q}(a) Q ( a )
Then we observe that if b ∈ M 2 ( B p , ∞ ) b \in M_2(B_{p,\infty}) b ∈ M 2 ( B p , ∞ ) a a a b † b^\dagger b † a b = b a ab = ba ab = ba b † a † = a † b † b^\dagger a^\dagger= a^\dagger b^\dagger b † a † = a † b † b † a = a b † b^\dagger a = ab^\dagger b † a = a b † a † = a a^\dagger= a a † = a C = Q ( a ) ⊗ B p , ∞ C = \mathbb{Q}(a) \otimes B_{p,\infty} C = Q ( a ) ⊗ B p , ∞ c ∈ C c \in C c ∈ C c † c c^\dagger c c † c c † c c^\dagger c c † c C C C C C C Q ( a ) ⊗ B p , ∞ \mathbb{Q}(a) \otimes B_{p,\infty} Q ( a ) ⊗ B p , ∞ C C C c ∈ C c \in C c ∈ C c † c c^\dagger c c † c [94 Rmk. 3.2.5] ) and for quaternion algebras there exists a unique such involution which is quaternion conjugation. □ \square □
Proof (of Lemma 5.10 ). The decision version is folklore (e.g., it follows from [52 §6] ), hence we focus on the embedding problem. First, we compute an explicit isomorphism between C ⊗ K K ( d ) C \otimes_K K(\sqrt{d}) C ⊗ K K ( d ) M 2 ( K ( d ) ) M_2(K(\sqrt{d})) M 2 ( K ( d )) [60 ] . Using this isomorphism we can find an element s ∈ C ⊗ K K ( d ) s \in C \otimes_K K(\sqrt{d}) s ∈ C ⊗ K K ( d ) s 2 = 0 s^2 = 0 s 2 = 0
s = ( s 1 + r 1 d ) + ( s 2 + r 2 d ) i + ( s 3 + r 3 d ) j + ( s 4 + r 4 d ) k s = (s_1 + r_1\sqrt{d}) + (s_2 + r_2\sqrt{d})i + (s_3 + r_3\sqrt{d})j + (s_4 + r_4\sqrt{d})k s = ( s 1 + r 1 d ) + ( s 2 + r 2 d ) i + ( s 3 + r 3 d ) j + ( s 4 + r 4 d ) k then we get that s 1 = r 1 = 0 s_1 = r_1 = 0 s 1 = r 1 = 0
n ( s 2 i + s 3 j + s 4 k ) = − d n ( r 2 i + r 3 j + r 4 k ) n(s_2i + s_3j + s_4k) = -d\,n(r_2i + r_3j + r_4k) n ( s 2 i + s 3 j + s 4 k ) = − d n ( r 2 i + r 3 j + r 4 k ) which implies that the norm of ( s 2 i + s 3 j + s 4 k ) / ( r 2 i + r 3 j + r 4 k ) (s_2i + s_3j + s_4k)/(r_2i + r_3j + r_4k) ( s 2 i + s 3 j + s 4 k ) / ( r 2 i + r 3 j + r 4 k ) − d -d − d
− 2 s 2 r 2 i 2 + s 3 r 3 j 2 + s 4 r 4 k 2 n ( r 2 i + r 3 j + r 4 k ) -2\frac{s_2r_2i^2 + s_3r_3j^2 + s_4r_4k^2}{n(r_2i + r_3j + r_4k)} − 2 n ( r 2 i + r 3 j + r 4 k ) s 2 r 2 i 2 + s 3 r 3 j 2 + s 4 r 4 k 2 which is 0 as the numerator equals the coefficient of d \sqrt{d} d s 2 s^2 s 2 □ \square □
Proof (of Lemma 5.14 ). We first note that ξ , γ \xi,\gamma ξ , γ Lemma 5.3 and the fact that M 2 ( O ) M_2(\mathcal{O}) M 2 ( O )
c = { α ∈ K ∣ α γ ∗ ∈ γ − 1 M 2 ( O ) } . \mathfrak{c} = \{ \alpha\in K \mid\alpha\gamma^* \in\gamma^{-1}M_2(\mathcal{O}) \}. c = { α ∈ K ∣ α γ ∗ ∈ γ − 1 M 2 ( O )} . To see this: it is clear that γ − 1 M 2 ( O ) \gamma^{-1}M_2(\mathcal{O}) γ − 1 M 2 ( O ) x ∈ M 2 ( B p , ∞ ) x \in M_2(B_{p,\infty}) x ∈ M 2 ( B p , ∞ ) Z K x ⊆ M 2 ( O ) \mathbb{Z}_Kx \subseteq M_2(\mathcal{O}) Z K x ⊆ M 2 ( O ) α ∈ K \alpha\in K α ∈ K γ ∗ M 2 ( O ) = ( M 2 ( O ) γ ) ∗ = ( M 2 ( O ) Z K ) ∗ = Z K M 2 ( O ) \gamma^*M_2(\mathcal{O}) = (M_2(\mathcal{O})\gamma)^* = (M_2(\mathcal{O})\mathbb{Z}_K)^* = \mathbb{Z}_KM_2(\mathcal{O}) γ ∗ M 2 ( O ) = ( M 2 ( O ) γ ) ∗ = ( M 2 ( O ) Z K ) ∗ = Z K M 2 ( O ) K K K Z K α γ ∗ M 2 ( O ) = α Z K M 2 ( O ) = α Z K M 2 ( O ) \mathbb{Z}_K\alpha\gamma^*M_2(\mathcal{O}) = \alpha\mathbb{Z}_KM_2(\mathcal{O}) = \alpha\mathbb{Z}_KM_2(\mathcal{O}) Z K α γ ∗ M 2 ( O ) = α Z K M 2 ( O ) = α Z K M 2 ( O )
As a consequence we have κ : = γ μ γ ∗ ∈ M 2 ( O ) \kappa:= \gamma\mu\gamma^* \in M_2(\mathcal{O}) κ := γ μ γ ∗ ∈ M 2 ( O ) κ ∈ GL 2 ( O ) \kappa\in\operatorname{GL}_2(\mathcal{O}) κ ∈ GL 2 ( O ) Λ ′ = γ − 1 M 2 ( O ) γ \Lambda' = \gamma^{-1}M_2(\mathcal{O})\gamma Λ ′ = γ − 1 M 2 ( O ) γ M 2 ( O ) γ = M 2 ( O ) Z K M_2(\mathcal{O})\gamma= M_2(\mathcal{O})\mathbb{Z}_K M 2 ( O ) γ = M 2 ( O ) Z K Z K ∗ = Z K \mathbb{Z}_K^* = \mathbb{Z}_K Z K ∗ = Z K Z K \mathbb{Z}_K Z K Λ \Lambda Λ ξ − 1 Z K ξ \xi^{-1}\mathbb{Z}_K\xi ξ − 1 Z K ξ
Λ ∗ = ξ ∗ γ ∗ M 2 ( O ) γ − ∗ ξ − ∗ = ξ − 1 γ − 1 κ M 2 ( O ) κ − 1 γ ξ = ξ − 1 γ − 1 M 2 ( O ) γ ξ = Λ \Lambda^* = \xi^*\gamma^*M_2(\mathcal{O})\gamma^{-*}\xi^{-*} = \xi^{-1}\gamma^{-1}\kappa M_2(\mathcal{O})\kappa^{-1}\gamma\xi= \xi^{-1}\gamma^{-1}M_2(\mathcal{O})\gamma\xi= \Lambda Λ ∗ = ξ ∗ γ ∗ M 2 ( O ) γ −∗ ξ −∗ = ξ − 1 γ − 1 κ M 2 ( O ) κ − 1 γ ξ = ξ − 1 γ − 1 M 2 ( O ) γ ξ = Λ shows that it is closed under conjugate-transpose. The fact that ι ( α ˉ ) = ι ( α ) ∗ \iota(\bar{\alpha}) = \iota(\alpha)^* ι ( α ˉ ) = ι ( α ) ∗ α ∈ Z K \alpha\in\mathbb{Z}_K α ∈ Z K ( ξ − 1 α ξ ) ∗ = ξ ∗ α ∗ ξ − ∗ = ξ − 1 α ∗ ξ (\xi^{-1}\alpha\xi)^* = \xi^*\alpha^*\xi^{-*} = \xi^{-1}\alpha^*\xi ( ξ − 1 α ξ ) ∗ = ξ ∗ α ∗ ξ −∗ = ξ − 1 α ∗ ξ α ∈ K \alpha\in K α ∈ K ξ ξ ∗ = μ \xi\xi^* = \mu ξ ξ ∗ = μ α \alpha α
Proving that κ ∈ GL 2 ( O ) \kappa\in\operatorname{GL}_2(\mathcal{O}) κ ∈ GL 2 ( O ) n ( γ μ γ ∗ ) = 1 n(\gamma\mu\gamma^*) = 1 n ( γ μ γ ∗ ) = 1 ℓ ∣ n ( μ ) \ell\mid n(\mu) ℓ ∣ n ( μ ) μ ℓ ∈ c \mu_\ell\in\mathfrak{c} μ ℓ ∈ c ℓ ∤ n ( γ μ ℓ γ ∗ ) \ell\nmid n(\gamma\mu_{\ell}\gamma^{*}) ℓ ∤ n ( γ μ ℓ γ ∗ ) ℓ ∤ n ( μ ) \ell\nmid n(\mu) ℓ ∤ n ( μ ) p p p Z K ∩ M 2 ( O ) Z_K \cap M_2(\mathcal{O}) Z K ∩ M 2 ( O ) ℓ \ell ℓ n ( γ ) n(\gamma) n ( γ ) ℓ \ell ℓ ℓ ∤ n ( γ μ γ ∗ ) \ell\nmid n(\gamma\mu\gamma^{*}) ℓ ∤ n ( γ μ γ ∗ )
Instead of finding μ ℓ \mu_{\ell} μ ℓ ν ℓ ∈ K ℓ \nu_{\ell} \in K_{\ell} ν ℓ ∈ K ℓ γ ν ℓ γ ∗ ∈ GL 2 ( O ℓ ) \gamma\nu_{\ell}\gamma^{*} \in\operatorname{GL}_2(\mathcal{O}_{\ell}) γ ν ℓ γ ∗ ∈ GL 2 ( O ℓ ) K ℓ = K ⊗ Z Z ℓ K_{\ell}=K\otimes_{\mathbb{Z}}\mathbb{Z}_{\ell} K ℓ = K ⊗ Z Z ℓ O ℓ = O ⊗ Z Z ℓ \mathcal{O}_{\ell}=\mathcal{O}\otimes_{\mathbb{Z}}\mathbb{Z}_{\ell} O ℓ = O ⊗ Z Z ℓ ν ℓ ′ ∈ K \nu'_{\ell}\in K ν ℓ ′ ∈ K ℓ \ell ℓ ν ℓ \nu_{\ell} ν ℓ l ∣ ℓ Z K \mathfrak{l}\mid\ell Z_K l ∣ ℓ Z K γ ν ℓ ′ γ ∗ ∈ GL 2 ( O ℓ ) \gamma\nu'_{\ell}\gamma^{*}\in\operatorname{GL}_2(\mathcal{O}_{\ell}) γ ν ℓ ′ γ ∗ ∈ GL 2 ( O ℓ ) μ ℓ = n ν ℓ ′ \mu_{\ell}=n\nu'_{\ell} μ ℓ = n ν ℓ ′ n n n m m m m ν ℓ ′ m\nu'_{\ell} m ν ℓ ′ μ \mu μ n n n n ≡ 1 ( m o d ℓ ) n\equiv1\pmod{\ell} n ≡ 1 ( mod ℓ ) n ≡ m n\equiv m n ≡ m m m m ℓ \ell ℓ
Recall that Z K Z_K Z K M 2 ( O ) γ M_2(\mathcal{O})_{\gamma} M 2 ( O ) γ γ − 1 M 2 ( O ) \gamma^{-1}M_2(\mathcal{O}) γ − 1 M 2 ( O ) Z K Z_K Z K γ − 1 M 2 ( O ℓ ) \gamma^{-1}M_2(\mathcal{O}_{\ell}) γ − 1 M 2 ( O ℓ ) Z K , ℓ = Z K ⊗ Z Z ℓ Z_{K,\ell}=Z_K\otimes_{\mathbb{Z}}\mathbb{Z}_{\ell} Z K , ℓ = Z K ⊗ Z Z ℓ
Fix an isomorphism B p , ∞ ⊗ Z Z ℓ ≅ M 2 ( Q ℓ ) B_{p,\infty}\otimes_{\mathbb{Z}}\mathbb{Z}_{\ell}\cong M_2(\mathbb{Q}_{\ell}) B p , ∞ ⊗ Z Z ℓ ≅ M 2 ( Q ℓ ) M 2 ( B p , ∞ ⊗ Z Z ℓ ) ≅ M 4 ( Q ℓ ) M_2(B_{p,\infty}\otimes_{\mathbb{Z}}\mathbb{Z}_{\ell})\cong M_4(\mathbb{Q}_{\ell}) M 2 ( B p , ∞ ⊗ Z Z ℓ ) ≅ M 4 ( Q ℓ ) Z ℓ \mathbb{Z}_{\ell} Z ℓ
L = γ − 1 L 0 , L 0 = Z ℓ 4 (19) L=\gamma^{-1}L_0,\qquad L_0=\mathbb{Z}_{\ell}^{4} \tag*{(19)} L = γ − 1 L 0 , L 0 = Z ℓ 4 (19) by viewing the elements of L 0 L_0 L 0 Z K , ℓ Z_{K,\ell} Z K , ℓ L L L Z K , ℓ Z_{K,\ell} Z K , ℓ
γ − 1 Q ℓ 4 = ⨁ l ∣ ℓ Z K M l over K ℓ ≅ ∏ l ∣ ℓ Z K non-zero prime ideals l ∣ ℓ Z K K l \gamma^{-1}\mathbb{Q}_{\ell}^{4}=\bigoplus_{\mathfrak{l}\mid\ell Z_K} M_{\mathfrak{l}}\qquad\text{over}\qquad K_{\ell}\cong\prod_{\substack{\mathfrak{l}\mid\ell Z_K\\\text{non-zero prime ideals }\mathfrak{l}\mid\ell Z_K}}K_{\mathfrak{l}} γ − 1 Q ℓ 4 = l ∣ ℓ Z K ⨁ M l over K ℓ ≅ l ∣ ℓ Z K non-zero prime ideals l ∣ ℓ Z K ∏ K l where K l K_{\mathfrak{l}} K l K K K l \mathfrak{l} l K ℓ K_{\ell} K ℓ { 0 } × ⋯ × K l × ⋯ × { 0 } \{0\}\times\cdots\times K_{\mathfrak{l}}\times\cdots\times\{0\} { 0 } × ⋯ × K l × ⋯ × { 0 } M l M_{\mathfrak{l}} M l K l K_{\mathfrak{l}} K l K ℓ K_{\ell} K ℓ γ − 1 Q ℓ 4 \gamma^{-1}\mathbb{Q}_{\ell}^{4} γ − 1 Q ℓ 4 Q ℓ \mathbb{Q}_{\ell} Q ℓ dim K l M l = 1 \dim_{K_{\mathfrak{l}}}M_{\mathfrak{l}}=1 dim K l M l = 1 l \mathfrak{l} l γ − 1 Q ℓ 4 \gamma^{-1}\mathbb{Q}_{\ell}^{4} γ − 1 Q ℓ 4 K ℓ K_{\ell} K ℓ
L = γ − 1 Z ℓ 4 = ⨁ l ∣ ℓ Z K L l over Z K , ℓ ≅ ∏ l ∣ ℓ Z K Z K , l , L=\gamma^{-1}\mathbb{Z}_{\ell}^{4}=\bigoplus_{\mathfrak{l}\mid\ell Z_K}L_{\mathfrak{l}}\qquad\text{over}\qquad Z_{K,\ell}\cong\prod_{\mathfrak{l}\mid\ell Z_K}Z_{K,\mathfrak{l}}, L = γ − 1 Z ℓ 4 = l ∣ ℓ Z K ⨁ L l over Z K , ℓ ≅ l ∣ ℓ Z K ∏ Z K , l , and using that the Z K , l Z_{K,\mathfrak{l}} Z K , l L L L Z K , ℓ Z_{K,\ell} Z K , ℓ
L = Z K , ℓ v (20) L=Z_{K,\ell}v \tag*{(20)} L = Z K , ℓ v (20) for some v ∈ Q ℓ 4 v\in\mathbb{Q}_{\ell}^{4} v ∈ Q ℓ 4
We now consider a Q ℓ \mathbb{Q}_{\ell} Q ℓ ⟨ ⋅ , ⋅ ⟩ \langle\cdot,\cdot\rangle ⟨ ⋅ , ⋅ ⟩ Q ℓ 4 \mathbb{Q}_{\ell}^{4} Q ℓ 4 ⟨ μ v , w ⟩ = ⟨ v , μ ∗ w ⟩ \langle\mu v,w\rangle=\langle v,\mu^{*}w\rangle ⟨ μv , w ⟩ = ⟨ v , μ ∗ w ⟩ v , w ∈ Q ℓ 4 v,w\in\mathbb{Q}_{\ell}^{4} v , w ∈ Q ℓ 4 μ ∈ M 2 ( B p , ∞ ) \mu\in M_2(B_{p,\infty}) μ ∈ M 2 ( B p , ∞ ) [55 §1] , let us make this explicit by noting that
a ˉ = H − 1 a T H , H = ( 0 1 − 1 0 ) , \bar{a}=H^{-1}a^{T}H,\qquad H=\begin{pmatrix}0&1\\-1&0\end{pmatrix}, a ˉ = H − 1 a T H , H = ( 0 − 1 1 0 ) , independently of the chosen isomorphism: this merely uses that a ˉ = tr ( a ) − a \bar{a}=\operatorname{tr}(a)-a a ˉ = tr ( a ) − a ⟨ v , w ⟩ = v T diag ( H , H ) w \langle v,w\rangle=v^{T}\operatorname{diag}(H,H)w ⟨ v , w ⟩ = v T diag ( H , H ) w ⟨ γ ∗ v , γ − 1 w ⟩ = ⟨ v , γ γ − 1 w ⟩ = ⟨ v , w ⟩ \langle\gamma^{*}v,\gamma^{-1}w\rangle=\langle v,\gamma\gamma^{-1}w\rangle=\langle v,w\rangle ⟨ γ ∗ v , γ − 1 w ⟩ = ⟨ v , γ γ − 1 w ⟩ = ⟨ v , w ⟩ v , w ∈ Q ℓ 4 v,w\in\mathbb{Q}_{\ell}^{4} v , w ∈ Q ℓ 4 L L L
L ∗ = { v ∈ Q ℓ 4 ∣ ⟨ v , L ⟩ ⊂ Z ℓ } = γ ∗ L 0 . (21) L^{*}=\{v\in\mathbb{Q}_{\ell}^{4}\mid\langle v,L\rangle\subset\mathbb{Z}_{\ell}\}=\gamma^{*}L_{0}. \tag*{(21)} L ∗ = { v ∈ Q ℓ 4 ∣ ⟨ v , L ⟩ ⊂ Z ℓ } = γ ∗ L 0 . (21) But on the other hand, through (20) the form also induces a bilinear map
K ℓ × K ℓ ⟶ Q ℓ : ( r , s ) ↦ ⟨ r v , s v ⟩ = ⟨ v , r s v ⟩ . K_{\ell}\times K_{\ell}\longrightarrow\mathbb{Q}_{\ell}:(r,s)\mapsto\langle rv,sv\rangle=\langle v,r s v\rangle. K ℓ × K ℓ ⟶ Q ℓ : ( r , s ) ↦ ⟨ r v , s v ⟩ = ⟨ v , r s v ⟩ . Note that the right-hand side is a Q ℓ \mathbb{Q}_{\ell} Q ℓ r ˉ s \bar{r}s r ˉ s δ ∈ K ℓ × \delta\in K_{\ell}^{\times} δ ∈ K ℓ ×
⟨ v , r s v ⟩ = Tr K / Q ( δ r s ) , \langle v,r s v\rangle=\operatorname{Tr}_{K/\mathbb{Q}}(\delta r s), ⟨ v , r s v ⟩ = Tr K / Q ( δ r s ) , where we have extended the domain of Tr K / Q \operatorname{Tr}_{K/\mathbb{Q}} Tr K / Q K ℓ K_{\ell} K ℓ Z ℓ \mathbb{Z}_{\ell} Z ℓ K ℓ K_{\ell} K ℓ
L ∗ = δ − 1 D − 1 v (22) L^{*}=\delta^{-1}\mathcal{D}^{-1}v \tag*{(22)} L ∗ = δ − 1 D − 1 v (22) with D \mathcal{D} D Z K , ℓ \mathbb{Z}_{K,\ell} Z K , ℓ K K K Z K , ℓ \mathbb{Z}_{K,\ell} Z K , ℓ Z K , ℓ \mathbb{Z}_{K,\ell} Z K , ℓ L ∗ = Z K , ℓ ν ℓ − 1 v L^{*}=\mathbb{Z}_{K,\ell}\nu_{\ell}^{-1}v L ∗ = Z K , ℓ ν ℓ − 1 v ν ℓ \nu_{\ell} ν ℓ δ D \delta\mathcal{D} δ D (19) , (20) , (21) and (22) we see that γ − 1 L 0 = L = ν ℓ L ∗ = ν ℓ γ ∗ L 0 \gamma^{-1}L_{0}=L=\nu_{\ell}L^{*}=\nu_{\ell}\gamma^{*}L_{0} γ − 1 L 0 = L = ν ℓ L ∗ = ν ℓ γ ∗ L 0 γ ν ℓ γ ∗ ∈ GL 2 ( O ℓ ) \gamma\nu_{\ell}\gamma^{*}\in\operatorname{GL}_{2}(\mathcal{O}_{\ell}) γ ν ℓ γ ∗ ∈ GL 2 ( O ℓ ) □ \square □
On the one endomorphism problem in dimension 2
The machinery from § 5 allows us to prove 2-dimensional analogues of the first two statements in § 5.4 , which we recall here:
Given one non-scalar endomorphism on a supersingular elliptic curve, one can compute the rest of the endomorphism ring in subexponential time [45 ] .
Given an endomorphism of small degree (polylogarithmic in p p p p p p [66 ] .
Our result strongly relies on Corollary 5.15 , which for technical reasons was restricted to cases where R = Z K R=\mathbb{Z}_{K} R = Z K
Theorem I.1. Let ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι ) Z K \mathbb{Z}_{K} Z K K K K h + ( K 0 ) h^{+}(K_{0}) h + ( K 0 ) A A A K K K A A A
Proof. As a first step we compute a Z K \mathbb{Z}_K Z K ( A ′ , λ ′ , ι ′ ) (A',\lambda',\iota') ( A ′ , λ ′ , ι ′ ) g , a , b 1 , b 2 g,a,b_1,b_2 g , a , b 1 , b 2 h + ( K 0 ) h^{+}(K_0) h + ( K 0 ) ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι ) ( A ′ , λ ′ , ι ′ ) (A',\lambda',\iota') ( A ′ , λ ′ , ι ′ ) ι ′ \iota' ι ′ ι ′ ∘ τ \iota'\circ\tau ι ′ ∘ τ τ \tau τ K K K ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι ) ( A ′ , λ ′ , ι ′ ) (A',\lambda',\iota') ( A ′ , λ ′ , ι ′ ) ( A ′ , λ ′ , ι ′ ) (A',\lambda',\iota') ( A ′ , λ ′ , ι ′ ) C 4 C_4 C 4 O ( 1 ) O(1) O ( 1 ) [ ( a , μ ) ] ∈ C ( Z K ) [(a,\mu)] \in\mathcal{C}(\mathbb{Z}_K) [( a , μ )] ∈ C ( Z K ) ( A , λ , ι ) = [ ( a , μ ) ] ⋆ ( A ′ , λ ′ , ι ′ ) (A,\lambda,\iota)=[(a,\mu)]\star(A',\lambda',\iota') ( A , λ , ι ) = [( a , μ )] ⋆ ( A ′ , λ ′ , ι ′ ) g g g A A A [73 ] . If the size of the Shimura class group is polynomial in the input size, then instead of running Kuperberg one can simply compute this group and apply the action of every group element to ( A ′ , λ ′ , ι ′ ) (A',\lambda',\iota') ( A ′ , λ ′ , ι ′ ) ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι ) □ \square □
Remark I.2. The reader might wonder why we have a specific statement for small discriminant CM orientations. The reason is that if one obtains an oriented superspecial PPAS by using CM reduction, then one immediately knows an orientation by a relatively small CM order. The above theorem then shows that in this case one can compute the full endomorphism ring in polynomial time, generalizing a result of Love and Boneh [66 ] to dimension 2.
The Gorenstein and Bass conditions
There are two standard ring-theoretic conditions on a CM order R ⊆ Z K R\subseteq\mathbb{Z}_K R ⊆ Z K [3 ] . Bass implies Gorenstein, but not conversely. This appendix records both notions, two sufficient conditions for Bass, and the index bound on the integer-polarized subgroup C ( R ) Z ⊆ C ( R ) \mathcal{C}(R)_{\mathbb{Z}}\subseteq\mathcal{C}(R) C ( R ) Z ⊆ C ( R )
Definition J.1. An order S S S m ⊂ S \mathfrak{m}\subset S m ⊂ S dim S m ( ( S : m ) / S ) = 1 \dim_{S_{\mathfrak{m}}}((S:\mathfrak{m})/S)=1 dim S m (( S : m ) / S ) = 1 m \mathfrak{m} m S S S a \mathfrak{a} a ( a : a ) = S (\mathfrak{a}:\mathfrak{a})=S ( a : a ) = S
The equivalence between the Cohen–Macaulay type condition and the invertibility of every proper fractional ideal is described in Marsiglia [67 Proposition 3.4] , where the two formulations go back to Bass [4 ] .
If R R R R R R C ( R ) \mathcal{C}(R) C ( R )
If R R R R R R a \mathfrak{a} a ( a : a ) = R (\mathfrak{a}:\mathfrak{a})=R ( a : a ) = R C ( R ) \mathcal{C}(R) C ( R ) [3 ] treats the non-Gorenstein case.
Lemma 2.6 shows that for any CM order R R R C ( R ) \mathcal{C}(R) C ( R ) [ C ( R ) : C ( R ) Z ] [\mathcal{C}(R):\mathcal{C}(R)_{\mathbb{Z}}] [ C ( R ) : C ( R ) Z ] # C ( R ) [ 2 ] \#\mathcal{C}(R)[2] # C ( R ) [ 2 ] § 7 .
Definition J.2. An order R R R L L L R R R R R R R R R
We give an example of a non-Bass CM order.
Example J.4. Let K = Q ( ζ 5 ) K=\mathbb{Q}(\zeta_5) K = Q ( ζ 5 ) K 0 = Q ( 5 ) K_0=\mathbb{Q}(\sqrt{5}) K 0 = Q ( 5 ) 2 Z K 2\mathbb{Z}_K 2 Z K
R = Z + 2 Z K , R ′ = Z K 0 + 2 Z K . R=\mathbb{Z}+2\mathbb{Z}_K,\qquad R'=\mathbb{Z}_{K_0}+2\mathbb{Z}_K. R = Z + 2 Z K , R ′ = Z K 0 + 2 Z K . Complex conjugation sends ζ 5 \zeta_5 ζ 5 ζ 5 − 1 = ζ 5 4 \zeta_5^{-1}=\zeta_5^4 ζ 5 − 1 = ζ 5 4 Z K = Z [ ζ 5 ] \mathbb{Z}_K=\mathbb{Z}[\zeta_5] Z K = Z [ ζ 5 ] K 0 = Q ( 5 ) K_0=\mathbb{Q}(\sqrt{5}) K 0 = Q ( 5 ) R R R R ′ R' R ′ Z K \mathbb{Z}_K Z K Z K / 2 Z K ≅ F 16 \mathbb{Z}_K/2\mathbb{Z}_K\cong\mathbb{F}_{16} Z K /2 Z K ≅ F 16 R / 2 Z K ≅ F 2 R/2\mathbb{Z}_K\cong\mathbb{F}_2 R /2 Z K ≅ F 2 R ′ / 2 Z K ≅ F 4 R'/2\mathbb{Z}_K\cong\mathbb{F}_4 R ′ /2 Z K ≅ F 4
Nakayama’s lemma (see e.g. [38 ] ) gives
μ R ( Z K ) = dim F 2 ( Z K / 2 Z K ) = 4 > 2 , μ R ′ ( Z K ) = dim F 4 ( Z K / 2 Z K ) = 2. \mu_R(\mathbb{Z}_K)=\dim_{\mathbb{F}_2}(\mathbb{Z}_K/2\mathbb{Z}_K)=4>2,\qquad\mu_{R'}(\mathbb{Z}_K)=\dim_{\mathbb{F}_4}(\mathbb{Z}_K/2\mathbb{Z}_K)=2. μ R ( Z K ) = dim F 2 ( Z K /2 Z K ) = 4 > 2 , μ R ′ ( Z K ) = dim F 4 ( Z K /2 Z K ) = 2. By Definition J.2, R R R R ′ R' R ′
2 Z K = R ⋅ 2 + R ⋅ 2 ζ 5 + R ⋅ 2 ζ 5 2 + R ⋅ 2 ζ 5 3 2\mathbb{Z}_K=R\cdot2+R\cdot2\zeta_5+R\cdot2\zeta_5^2+R\cdot2\zeta_5^3 2 Z K = R ⋅ 2 + R ⋅ 2 ζ 5 + R ⋅ 2 ζ 5 2 + R ⋅ 2 ζ 5 3 and explain why all four generators are necessary to represent 2 Z K 2\mathbb{Z}_K 2 Z K
Z K = ⟨ 1 , ζ 5 , ζ 5 2 , ζ 5 3 ⟩ Z , and 2 Z K = ⟨ 2 , 2 ζ 5 , 2 ζ 5 2 , 2 ζ 5 3 ⟩ Z . (23) \mathbb{Z}_K=\langle1,\zeta_5,\zeta_5^2,\zeta_5^3\rangle_{\mathbb{Z}},\quad\text{and}\quad2\mathbb{Z}_K=\langle2,2\zeta_5,2\zeta_5^2,2\zeta_5^3\rangle_{\mathbb{Z}}. \tag*{(23)} Z K = ⟨ 1 , ζ 5 , ζ 5 2 , ζ 5 3 ⟩ Z , and 2 Z K = ⟨ 2 , 2 ζ 5 , 2 ζ 5 2 , 2 ζ 5 3 ⟩ Z . (23) Using R = Z + 2 Z K R = \mathbb{Z} + 2\mathbb{Z}_K R = Z + 2 Z K
R ⋅ 2 + R ⋅ 2 ζ 5 + R ⋅ 2 ζ 5 2 + R ⋅ 2 ζ 5 3 = ∑ i = 0 3 ( Z + 2 Z K ) ⋅ 2 ζ 5 i = 2 ∑ i = 0 3 Z ζ 5 i + 4 ∑ i = 0 3 Z K ζ 5 i = 2 Z K + 4 Z K = 2 Z K . \begin{aligned}
R \cdot2 + R \cdot2\zeta_5 + R \cdot2\zeta_5^2 + R \cdot2\zeta_5^3
&= \sum_{i=0}^{3}(\mathbb{Z} + 2\mathbb{Z}_K)\cdot2\zeta_5^i \\
&= 2\sum_{i=0}^{3}\mathbb{Z}\zeta_5^i + 4\sum_{i=0}^{3}\mathbb{Z}_K\zeta_5^i \\
&= 2\mathbb{Z}_K + 4\mathbb{Z}_K \\
&= 2\mathbb{Z}_K.
\end{aligned} R ⋅ 2 + R ⋅ 2 ζ 5 + R ⋅ 2 ζ 5 2 + R ⋅ 2 ζ 5 3 = i = 0 ∑ 3 ( Z + 2 Z K ) ⋅ 2 ζ 5 i = 2 i = 0 ∑ 3 Z ζ 5 i + 4 i = 0 ∑ 3 Z K ζ 5 i = 2 Z K + 4 Z K = 2 Z K . Here ∑ i = 0 3 Z ζ 5 i = Z K \sum_{i=0}^{3}\mathbb{Z}\zeta_5^i = \mathbb{Z}_K ∑ i = 0 3 Z ζ 5 i = Z K Z K ζ 5 i = Z K \mathbb{Z}_K\zeta_5^i = \mathbb{Z}_K Z K ζ 5 i = Z K ζ 5 i \zeta_5^i ζ 5 i Z K \mathbb{Z}_K Z K m = 2 Z K \mathfrak{m} = 2\mathbb{Z}_K m = 2 Z K R R R
( 2 Z K ) / m ( 2 Z K ) = ( 2 Z K ) / ( 4 Z K ) → ∼ Z K / ( 2 Z K ) ≅ F 16 , (2\mathbb{Z}_K)/\mathfrak{m}(2\mathbb{Z}_K) = (2\mathbb{Z}_K)/(4\mathbb{Z}_K) \xrightarrow{\sim} \mathbb{Z}_K/(2\mathbb{Z}_K) \cong\mathbb{F}_{16}, ( 2 Z K ) / m ( 2 Z K ) = ( 2 Z K ) / ( 4 Z K ) ∼ Z K / ( 2 Z K ) ≅ F 16 , where 2 x ↦ x 2x \mapsto x 2 x ↦ x
Since R / m ≅ F 2 R/\mathfrak{m} \cong\mathbb{F}_2 R / m ≅ F 2 F 16 \mathbb{F}_{16} F 16 F 2 \mathbb{F}_2 F 2 ( 2 Z K ) m (2\mathbb{Z}_K)_{\mathfrak{m}} ( 2 Z K ) m R m R_{\mathfrak{m}} R m μ R m ( ( 2 Z K ) m ) = dim F 2 2 Z K 4 Z K = 4 \mu_{R_{\mathfrak{m}}}((2\mathbb{Z}_K)_{\mathfrak{m}}) = \dim_{\mathbb{F}_2} \frac{2\mathbb{Z}_K}{4\mathbb{Z}_K} = 4 μ R m (( 2 Z K ) m ) = dim F 2 4 Z K 2 Z K = 4 R R R 2 Z K 2\mathbb{Z}_K 2 Z K R R R R ′ R' R ′ Z K 0 ⊂ R ′ \mathbb{Z}_{K_0} \subset R' Z K 0 ⊂ R ′ [ K : K 0 ] = 2 [K : K_0] = 2 [ K : K 0 ] = 2 R ′ R' R ′ μ R ′ ( Z K ) = 2 \mu_{R'}(\mathbb{Z}_K) = 2 μ R ′ ( Z K ) = 2 dim F 4 ( F 16 ) = 2 \dim_{\mathbb{F}_4}(\mathbb{F}_{16}) = 2 dim F 4 ( F 16 ) = 2
The structure of C ( R ) \mathcal{C}(R) C ( R ) K / K 0 K/K_0 K / K 0 [74 Cor. VI.4.5] describes the elements of K × / N K / K 0 ( K × ) K^\times/N_{K/K_0}(K^\times) K × / N K / K 0 ( K × ) K 0 K_0 K 0 K / K 0 K/K_0 K / K 0 R = Z K R = \mathbb{Z}_K R = Z K [93 Lem. I.8.4, Thm. III.2.2] shows that the cokernel of the type norm map into C ( Z K ) \mathcal{C}(\mathbb{Z}_K) C ( Z K ) g = 3 g = 3 g = 3 [36 ] , where the exponent is 2 or 4 depending on the Galois type.
In the integer-polarized version we expect a sharper statement, for which we have computational evidence in the maximal-order case.
Conjecture J.5. Let K K K R ⊆ Z K R \subseteq\mathbb{Z}_K R ⊆ Z K
[ C ( R ) : C ( R ) Z ] ∈ { 1 , # C ( R ) [ 2 ] } . [\mathcal{C}(R) : \mathcal{C}(R)_{\mathbb{Z}}] \in\{1, \#\mathcal{C}(R)[2]\}. [ C ( R ) : C ( R ) Z ] ∈ { 1 , # C ( R ) [ 2 ]} . Superspecial reduction
Reduction. We recall the superspecial reduction results Goren established for CM abelian surfaces in the primitive quartic case [42 ] . Goren did not consider the biquadratic C 2 × C 2 C_2 \times C_2 C 2 × C 2 § 7 for a definition). His argument, however, carries over almost verbatim and gives Proposition K.2 below, which we record as a new result even though its proof is analogous to Goren’s. As in [42 ] , we restrict throughout this appendix to R = Z K R = \mathbb{Z}_K R = Z K p p p K K K
Proposition K.1. Let K K K p p p K K K ( A , λ , ι ) ∈ M k ( Z K ) (A,\lambda,\iota) \in M_k(\mathbb{Z}_K) ( A , λ , ι ) ∈ M k ( Z K ) k = Q k = \mathbb{Q} k = Q L ⊂ k L \subset k L ⊂ k A A A p ‾ ⊂ Z L \overline{\mathfrak{p}} \subset\mathbb{Z}_L p ⊂ Z L p p p A m o d p ‾ A \bmod\overline{\mathfrak{p}} A mod p p p p K K K
Proof. See [42 Thm. 1] . □ \square □
In other words, in the C 4 C_4 C 4 p Z K = p 1 p 2 p\mathbb{Z}_K = \mathfrak{p}_1\mathfrak{p}_2 p Z K = p 1 p 2 2 2 2 p i \mathfrak{p}_i p i K K K
In the cases C 2 × C 2 C_2 \times C_2 C 2 × C 2 D 4 D_4 D 4 p p p K K K Φ \Phi Φ Φ \Phi Φ
Proposition K.2. We inherit the assumptions from Proposition K.1 but now assume that K K K ι \iota ι ( A , λ , ι ) (A,\lambda,\iota) ( A , λ , ι ) Φ = { i d , τ } \Phi= \{\mathrm{id},\tau\} Φ = { id , τ } τ ∈ Gal ( K , Q ) \tau\in\operatorname{Gal}(K,\mathbb{Q}) τ ∈ Gal ( K , Q ) K 1 K_1 K 1 Φ \Phi Φ A m o d p ‾ A \bmod\overline{\mathfrak{p}} A mod p p p p K 1 K_1 K 1
Proof. We can assume that L L L K K K Q \mathbb{Q} Q [39 Prop. 2.4] , as discussed in [42 §2] , says that A m o d p ‾ A \bmod\overline{\mathfrak{p}} A mod p
σ Φ ‾ e x t = Φ e x t \sigma\overline{\Phi}^{\mathrm{ext}} = \Phi^{\mathrm{ext}} σ Φ ext = Φ ext where σ ∈ Gal ( L , Q ) \sigma\in\operatorname{Gal}(L,\mathbb{Q}) σ ∈ Gal ( L , Q ) p ‾ \overline{\mathfrak{p}} p σ ( p ‾ ) = p ‾ \sigma(\overline{\mathfrak{p}}) = \overline{\mathfrak{p}} σ ( p ) = p p p p Z L / p ‾ \mathbb{Z}_L/\overline{\mathfrak{p}} Z L / p F p \mathbb{F}_p F p Φ e x t \Phi^{\mathrm{ext}} Φ ext Gal ( L , Q ) \operatorname{Gal}(L,\mathbb{Q}) Gal ( L , Q ) K K K Φ \Phi Φ Φ ‾ e x t \overline{\Phi}^{\mathrm{ext}} Φ ext σ r e s \sigma^{\mathrm{res}} σ res p ‾ ∩ K \overline{\mathfrak{p}} \cap K p ∩ K p p p σ \sigma σ K K K A m o d p ‾ A \bmod\overline{\mathfrak{p}} A mod p σ r e s ∉ { i d , τ } \sigma^{\mathrm{res}} \notin\{\mathrm{id},\tau\} σ res ∈ / { id , τ } □ \square □
In other words, in the C 2 × C 2 C_2 \times C_2 C 2 × C 2 p Z K = p 1 p 2 p\mathbb{Z}_K = \mathfrak{p}_1\mathfrak{p}_2 p Z K = p 1 p 2 2 2 2 p i \mathfrak{p}_i p i K K K K 0 K_0 K 0 K 1 K_1 K 1
Z [ 1 + p − 4 2 , p + 1 4 ] \mathbb{Z}\left[\frac{1+\sqrt{p-4}}{2},\sqrt{\frac{p+1}{4}}\right] Z [ 2 1 + p − 4 , 4 p + 1 ] in characteristic p ≡ 3 ( m o d 4 ) p \equiv3 \pmod{4} p ≡ 3 ( mod 4 ) Proposition K.2 combined with the lifting statement from [43 Lem. 4.4.1] (which was used in our proof of Theorem 6.9 ), this must mean that p p p K 0 K_{0} K 0 K 1 , K 2 K_{1}, K_{2} K 1 , K 2
Proposition K.3. Let K K K M M M Gal ( M , Q ) = ⟨ x , y ∣ x 2 , y 4 , ( x y ) 2 ⟩ ≅ D 4 \operatorname{Gal}(M,\mathbb{Q})=\langle x,y\mid x^{2},y^{4},(xy)^{2}\rangle\cong D_{4} Gal ( M , Q ) = ⟨ x , y ∣ x 2 , y 4 , ( x y ) 2 ⟩ ≅ D 4 K = M ⟨ x ⟩ K=M^{\langle x\rangle} K = M ⟨ x ⟩ Φ = { id , y } \Phi=\{\operatorname{id},y\} Φ = { id , y } K K K Proposition K.1 , where we can assume M ⊂ L M\subset L M ⊂ L p p p M M M A m o d p ‾ A\bmod\overline{p} A mod p p ‾ ∩ M \overline{p}\cap M p ∩ M y 2 y^{2} y 2 x y xy x y
Proof. This is [42 Thm. 2] in cases (3) and (6). The two cases together are again seen to be equivalent to the product criterion of Ekedahl. □ \square □
This closes the unramified cases for dimension 2 (assuming R = Z K R=\mathcal{Z}_{K} R = Z K p ∣ disc ( K / Q ) p\mid\operatorname{disc}(K/\mathbb{Q}) p ∣ disc ( K / Q ) [42 Thm. 1 and Thm. 2] . In forthcoming work we treat this case by replacing the unramified product criterion with a Lie-type Dieudonné module calculation. The Shimura–Taniyama formula gives the Newton polygon, and the Lie type gives the a a a 1 / 2 1/2 1/2 a = g a=g a = g
