A new twofold Cornacchia-type algorithm and its applications

Abstract

<p style='text-indent:20px;'>We focus on exploring more potential of Longa and Sica's algorithm (ASIACRYPT 2012), which is an elaborate iterated Cornacchia algorithm that can compute short bases for 4-GLV decompositions. The algorithm consists of two sub-algorithms, the first one in the ring of integers <inline-formula><tex-math id="M1">\begin{document}$ \mathbb{Z} $\end{document}</tex-math></inline-formula> and the second one in the Gaussian integer ring <inline-formula><tex-math id="M2">\begin{document}$ \mathbb{Z}[i] $\end{document}</tex-math></inline-formula>. We observe that <inline-formula><tex-math id="M3">\begin{document}$ \mathbb{Z}[i] $\end{document}</tex-math></inline-formula> in the second sub-algorithm can be replaced by another Euclidean domain <inline-formula><tex-math id="M4">\begin{document}$ \mathbb{Z}[\omega] $\end{document}</tex-math></inline-formula> <inline-formula><tex-math id="M5">\begin{document}$ (\omega = \frac{-1+\sqrt{-3}}{2}) $\end{document}</tex-math></inline-formula>. As a consequence, we design a new twofold Cornacchia-type algorithm with a theoretic upper bound of output <inline-formula><tex-math id="M6">\begin{document}$ C\cdot n^{1/4} $\end{document}</tex-math></inline-formula>, where <inline-formula><tex-math id="M7">\begin{document}$ C = \frac{3+\sqrt{3}}{2}\sqrt{1+|r|+|s|} $\end{document}</tex-math></inline-formula> with small values <inline-formula><tex-math id="M8">\begin{document}$ r, s $\end{document}</tex-math></inline-formula> given by the curves.</p><p style='text-indent:20px;'>The new twofold algorithm can be used to compute <inline-formula><tex-math id="M9">\begin{document}$ 4 $\end{document}</tex-math></inline-formula>-GLV decompositions on two classes of curves. First it gives a new and unified method to compute all <inline-formula><tex-math id="M10">\begin{document}$ 4 $\end{document}</tex-math></inline-formula>-GLV decompositions on <inline-formula><tex-math id="M11">\begin{document}$ j $\end{document}</tex-math></inline-formula>-invariant <inline-formula><tex-math id="M12">\begin{document}$ 0 $\end{document}</tex-math></inline-formula> elliptic curves over <inline-formula><tex-math id="M13">\begin{document}$ \mathbb{F}_{p^2} $\end{document}</tex-math></inline-formula>. Second it can be used to compute the <inline-formula><tex-math id="M14">\begin{document}$ 4 $\end{document}</tex-math></inline-formula>-GLV decomposition on the Jacobian of the hyperelliptic curve defined as <inline-formula><tex-math id="M15">\begin{document}$ \mathcal{C}/\mathbb{F}_{p}:y^{2} = x^{6}+ax^{3}+b $\end{document}</tex-math></inline-formula>, which has an endomorphism <inline-formula><tex-math id="M16">\begin{document}$ \phi $\end{document}</tex-math></inline-formula> with the characteristic equation <inline-formula><tex-math id="M17">\begin{document}$ \phi^2+\phi+1 = 0 $\end{document}</tex-math></inline-formula> (hence <inline-formula><tex-math id="M18">\begin{document}$ \mathbb{Z}[\phi] = \mathbb{Z}[\omega] $\end{document}</tex-math></inline-formula>). As far as we know, none of the previous algorithms can be used to compute the <inline-formula><tex-math id="M19">\begin{document}$ 4 $\end{document}</tex-math></inline-formula>-GLV decomposition on the latter class of curves.</p>