here - Sites personnels de TELECOM ParisTech - Télécom ParisTech

5.4. Elliptic curves in cryptography 153• methods using the Chinese Remainder Theorem to lift reductions at small primes of theHilbert class polynomial back to the integers, and methods using an explicit version of theChinese Remainder Theorem to compute modular reduction of the Hilbert class polynomialat a large prime without computing it over the integers, first presented in the works of Chaoet al. [45] and Agashe et al. [2].These methods were subsequently improved, for example in the works of Belding et al. [12] andSutherland [258, 257].5.3.5 Shimura’s reciprocity law and class invariantsFinally, it should be noted that Shimura described a reciprocity law describing the Galois actionon modular functions of higher level, i.e. modular functions invariant by congruence subgroups ofSL 2 (Z). The exact statement of Shimura’s reciprocity law in the elliptic case can be found inLang’s textbook [160].This reciprocity law can then be used to study other class invariants, i.e. values of modularfunctions generating the ring class field. These class invariants potentially give rise to minimalpolynomials with smaller coefficients than the Hilbert class polynomial. It has been shown thatthe ratio between the heights of the coefficient is at best constant and is bounded as follows.Proposition 5.3.13 ([31, Theorem 4.1]). The reduction factor for a modular function f satisfiesr(f) ≤ 32768/325 ≈ 100.82 ;if Selberg’s eigenvalue conjecture [227] holds, thenr(f) ≤ 96 .This gain could seem useless, but is very important in practice.The study of class invariants goes back to Weber [281]. They are classically constructed usingquotients of the Dedekind η function. Such an approach is described in the works of Gee [114, 115]and Gee and Stevenhagen [116] with a view towards construction of class fields, and of Bröker [27]and Bröker and Stevenhagen [31] with a view towards construction of elliptic curves. More recentdevelopments are due to Schertz [230], Enge and Schertz [87], and Enge and Morain [86]. Thedouble η quotients found in [87] give the best currently known gain of 72, which is close tooptimal.An alternative approach, based on theta functions rather than the Dedekind η functions, canbe found in the work of Leprévost, Pohst and Uzunkol [170] and Uzunkol’s doctoral thesis [269].To conclude, let us mention that, when computing minimal polynomials of a class invariant,the situation is more involved than with the j-invariant and the representatives of the classgroup must be normalized to compute the conjugates of the invariant. This can be done withN-systems [230].5.4 Elliptic curves in cryptography5.4.1 Curves with a given number of pointsIn this subsection we outline the different methods to obtain curves with a given number ofpoints over a finite field. Such constructions are naturally useful to generate curves for integerfactorization [169] or to build public key cryptosystems based on the difficulty of the discretelogarithm problem [69, 153, 202].