Super-Isolated Elliptic Curves and Abelian Surfaces in Cryptography

TL;DR

This paper introduces the concept of super-isolated abelian varieties, especially elliptic curves and surfaces, analyzing their rarity and potential cryptographic significance due to their unique isogeny class properties.

Contribution

It defines super-isolated varieties, heuristically estimates their abundance among elliptic curves, and proves their extreme scarcity among surfaces of cryptographic size.

Findings

Number of super-isolated elliptic curves with prime order is roughly proportional to ()

Only 2 super-isolated surfaces of cryptographic size exist

Super-isolated varieties are rare and potentially resistant to isogeny-based attacks

Abstract

We call a simple abelian variety over $\mathbb{F}_p$ super-isolated if its ($\mathbb{F}_p$-rational) isogeny class contains no other varieties. The motivation for considering these varieties comes from concerns about isogeny based attacks on the discrete log problem. We heuristically estimate that the number of super-isolated elliptic curves over $\mathbb{F}_p$ with prime order and $p \leq N$, is roughly $\tilde{\Theta}(\sqrt{N})$. In contrast, we prove that there are only 2 super-isolated surfaces of cryptographic size and near-prime order.

Tables

Table 1. Table 1: gcd a ∈ ℤ ⁡ p ​ ( a ) ​ N ​ ( a ) subscript 𝑎 ℤ 𝑝 𝑎 𝑁 𝑎 \gcd_{a\in\mathbb{Z}}p(a)N(a) for values of d 𝑑 d .

$-d$	$p\left(x\right)$	$N\left(x\right)$	${\gcd }_{a\in \mathbb{Z}}p\left(a\right)N\left(a\right)$
3	$x^2+x+1$	$x^2-x+1$	1
4	$x^2+1$	$x^2-2x+2$	2
8	$x^2+2$	$x^2-2x+3$	6
7	$x^2+x+2$	$x^2-x+2$	4
11	$x^2+x+3$	$x^2-x+3$	3
19	$x^2+x+5$	$x^2-x+5$	1
43	$x^2+x+11$	$x^2-x+11$	1
67	$x^2+x+17$	$x^2-x+17$	1
163	$x^2+x+41$	$x^2-x+41$	1

Table 2. Table 2: An approximation to the Bateman-Horn constant C 𝐶 C .

$-d$	$C$
$-3$	$\approx 2.9$
$-19$	$\approx 3.0$
$-43$	$\approx 10.6$
$-67$	$\approx 17.5$
$-163$	$\approx 44.8$

Equations

$$H(\Delta )=\sum _{{\mathcal{O}}^{\prime }\supseteq \mathcal{O}}h({\mathcal{O}}^{\prime })$$

$$\#I(t)=H(t^2-4p).$$

$$t^2-4p\in \left\{-3,-4,-7,-8,-11,-19,-43,-67,-163\right\}.$$

$$p=\{\begin{array}{ll}{x}^2+\frac{d}{4}& \text{if −d≡0mod4}\\ x^2+x+\frac{d+1}{4}& \text{if −d≡1mod4}\end{array},N=\{\begin{array}{ll}(x-1{)}^2+\frac{d}{4}& \text{if −d≡0mod4}\\ x^2-x+\frac{d+1}{4}& \text{if −d≡1mod4}\end{array}$$

$${\left(\frac{2.9}{4}\frac{1}{2^{128}}{\int }_2^{2^{128}}\frac{1}{{\log }^{2}t}dt\right)}^{-1}\approx 10610.$$

$$19.7\cdot {\int }_2^M\frac{1}{{\log }^{2}t}dt.$$

$$19.7{\int }_2^{\sqrt{M}}\frac{1}{{\log }^{2}t}dt.$$

$$f_1(a_1,a_2,a_3,a_4)=\pm 1\text{ and }{f}_2(a_1,a_2,a_3,a_4)=\pm 1,$$

$$f_1$$

$$f_2$$

$$P$$

$$P_0$$

$$f_2(x_3,x_4)=\pm 1$$

$$f_1(x_2,x_3,x_4)=\pm 1.$$

$$P_0(x_1,x_2,x_3,x_4)=0.$$

$$\pi =a_1{\alpha }_1+a_2{\alpha }_2+a_3{\alpha }_3+a_4{\alpha }_4.$$

$${\varphi }_1(\gamma +\overline{\gamma })+{\varphi }_2(\gamma +\overline{\gamma })\in \mathbb{Z}$$

$${\varphi }_1(\gamma +\overline{\gamma })-{\varphi }_2(\gamma +\overline{\gamma })\in \sqrt{{\Delta }_F}\mathbb{Z}.$$

$${\varphi }_1(\gamma +\overline{\gamma })+{\varphi }_2(\gamma +\overline{\gamma })$$

$${\varphi }_1(\gamma +\overline{\gamma })-{\varphi }_2(\gamma +\overline{\gamma })$$

$${\varphi }_1(\gamma -\overline{\gamma }){\varphi }_2(\gamma -\overline{\gamma })\in \frac{\sqrt{{\Delta }_K}}{{\Delta }_F}\cdot \mathbb{Z}.$$

$${\delta }_{K/F}(\gamma ){\mathcal{O}}_K={\mathfrak{f}}_{{\mathcal{O}}_F[\gamma ]}{\mathcal{D}}_{K/F}$$

$${\left({\varphi }_1(\gamma -\overline{\gamma }){\varphi }_2(\gamma -\overline{\gamma })\right)}^2$$

$$=N_{K/\mathbb{Q}}\left({\delta }_{K/F}(\gamma )\right)$$

$$=N_{F/\mathbb{Q}}(I{)}^2\cdot N_{K/\mathbb{Q}}({\mathcal{D}}_{K/F})$$

$${\Delta }_K={\Delta }_F^2{N}_{K/\mathbb{Q}}\left({\mathcal{D}}_{K/F}\right).$$

$${\varphi }_1({\delta }_i){\varphi }_2({\delta }_j)+{\varphi }_1({\delta }_j){\varphi }_2({\delta }_i)={\varphi }_1({\delta }_i+{\delta }_j){\varphi }_2({\delta }_i+{\delta }_j)-{\varphi }_1({\delta }_i){\varphi }_2({\delta }_i)-{\varphi }_1({\delta }_j){\varphi }_2({\delta }_j).$$

$$\mathrm{disc}{f}_2$$

$$=\frac{{\Delta }_F^2}{{\Delta }_K}{\left({\varphi }_1({\delta }_3){\varphi }_2({\delta }_4)-{\varphi }_2({\delta }_3){\varphi }_1({\delta }_4)\right)}^2.$$

$${\Delta }_K$$

$$={\left({\varphi }_1({\alpha }_2)-{\varphi }_2({\alpha }_2)\right)}^2{\left({\varphi }_1({\delta }_3){\varphi }_2({\delta }_4)-{\varphi }_2({\delta }_3){\varphi }_1({\delta }_4)\right)}^2$$

$$={\Delta }_F{\left({\varphi }_1({\delta }_3){\varphi }_2({\delta }_4)-{\varphi }_2({\delta }_3){\varphi }_1({\delta }_4)\right)}^2.$$

$$\sigma =ax+\frac{b+\sqrt{{\Delta }_F}}{2}y,$$

$${\mathrm{Norm}}_{F/\mathbb{Q}}(\sigma )=\left(ax+\frac{b+\sqrt{{\Delta }_F}}{2}y\right)\left(ax+\frac{b-\sqrt{{\Delta }_F}}{2}y\right)=a\left(a{x}^2+bxy+c{y}^2\right)=a{f}_2(x,y).$$

$${\left(\pi +\overline{\pi }\right)}^2$$

Full text

1 Introduction

The security of elliptic curve cryptography depends on the difficulty of the elliptic curve discrete log problem (ECDLP). Given an elliptic curve $E$ over $\mathbb{F}_{p}$, a cyclic subgroup of $E(\mathbb{F}_{p})$ generated by the point $P$, and a point $Q\in\left\langle P\right\rangle$, the ECDLP asks to find an integer $k$ such that $Q=kP$. The fastest known generic algorithm to solve the ECDLP on an elliptic curve is Pollard’s rho algorithm, which has an expected runtime of $\tilde{O}(\sqrt{p})$ [17, Ch. 3.6.3].

It is possible to transfer the ECDLP between curves via isogenies. If $\varphi:E\to E^{\prime}$ is an isogeny111Unless otherwise noted, by isogeny we mean $\mathbb{F}_{p}$-rational isogeny. that restricts to an isomorphism $\left\langle P\right\rangle\to\left\langle\varphi(P)\right\rangle$, then $Q=kP$ if and only if $\varphi(Q)=k\varphi(P)$. This reduction is useful for solving the ECDLP if the time it takes to compute $\varphi(Q)$ and $\varphi(P)$, as well as to solve the ECDLP on $E^{\prime}$, is less than the time it takes to solve the ECDLP on $E$.

Concern about isogeny based attacks is partially motivated by the Gaudry-Hess-Smart (GHS) attack [9]. Over certain extension fields222The attack described in [15] only applies to fields of the form $\mathbb{F}_{2}^{3\ell}$ with $53\leq\ell\leq 200$., Menezes and Teske in [15, Sec. 7] used the generalized GHS attack to show that there is a non-negligible proportion of “weak” curves, for which the ECDLP can be solved in significantly less time than it takes Pollard’s rho. Under some reasonable assumptions, given a random elliptic curve $E$ over such a field, one can find a chain of efficiently computable isogenies from $E$ to a weak curve.

In [11, Sec. 11, Ex. 5], Koblitz, Koblitz, and Menezes observed that it is possible to use the complex multiplication (CM) method to construct elliptic curves $E/\mathbb{F}_{p}$ whose isogeny class is large ($\approx\sqrt{p}$), but contains no curves (besides $E$ itself) whose conductor gap with $E$ is small. The conductor gap between two curves measures the computational complexity in computing an isogeny between them. The curve $E$ is called isolated because there are no other curves $E^{\prime}$ for which constructing an isogeny between $E$ and $E^{\prime}$ is computationally feasible.

So far we have only mentioned elliptic curves, but the same ideas carry over to abelian surfaces. In [27], Wang gave a construction for isolated abelian surfaces that is analogous to the one for curves given in [11]. Note that while these methods construct isolated varieties, they almost always have large isogeny classes.

In this paper, we focus on the special case of super-isolated abelian varieties. We call an abelian variety over a finite field super-isolated if its isogeny class contains a single isomorphism class. For increased security and efficiency, we focus on varieties of prime or near-prime order defined over a prime field.

Our main contributions are as follows. First, we outline practical algorithms that search for super-isolated elliptic curves and abelian surfaces. Second, we prove that only two super-isolated surfaces of cryptographic size and near-prime order exist, see Examples 35 and 36. Finally, we give some heuristics on the number of super-isolated varieties. Our results suggest that, unlike the case of surfaces, there are enough super-isolated elliptic curves of cryptographic size and prime order to use in cryptosystems that require ephemeral curves, such as [18].

The outline of the paper is as follows. Section 2 focuses on elliptic curves. Some background and notation is given in Section 2.1. In Section 2.2, we outline an algorithm to construct super-isolated elliptic curves of prime order over $\mathbb{F}_{p}$ with $p$ of a given size. We heuristically estimate the number of such curves in Section 2.3. Section 3 focuses on surfaces. In Section 3.1, we show that finding super-isolated surfaces reduces to finding super-isolated Weil numbers, which are defined in that section. In Section 3.2, we outline an algorithm to search for super-isolated Weil numbers. We also prove the correctness and efficiency of the algorithm in the same section. Two examples of super-isolated surfaces of near-prime order and cryptographic size are given in Section 3.3. In Section 3.4, we prove these are the only such examples.

Acknowledgments

I would like to thank my advisor Neal Koblitz for all of his inspiration and guidance while working on this paper. I would also like to acknowledge the support from my graduate student peers, for which I am especially grateful.

2 Elliptic curves

2.1 Background and notation

Let $p$ be a prime333Many results in this paper can be extended to varieties over arbitrary finite fields $\mathbb{F}_{q}$, but we focus on the prime case because it is often more efficient in practice.. For any $t\in\mathbb{Z}$, let $I(t)$ denote the set of isomorphism classes of elliptic curves $E/\mathbb{F}_{p}$ such that $\#E(\mathbb{F}_{p})=p-t+1$. A theorem of Tate says that the sets $I(t)$ are isogeny classes of elliptic curves over $\mathbb{F}_{p}$, see [22, Ch. 5]. The Hasse bound implies that $I(t)$ is empty when $t^{2}>4p$. An elliptic curve is ordinary if $t\not\equiv 0\mod{p}$.

Definition 1**.**

An elliptic curve $E/\mathbb{F}_{p}$ is super-isolated if there is only one isomorphism class in its isogeny class, i.e. $\#I(p+1-\#E(\mathbb{F}_{p}))=1$.

Definition 2**.**

Let $\mathcal{O}$ be an order in a quadratic imaginary field, and let $\Delta$ be the discriminant of $\mathcal{O}$. The Kronecker class number $H(\Delta)$ of $\Delta$ is defined to be

[TABLE]

where $h(\mathcal{O}^{\prime})$ denotes the class number of the order $\mathcal{O}^{\prime}$, and the sum is over all orders $\mathcal{O}^{\prime}$ of $\mathcal{O}\otimes\mathbb{Q}$ such that $\mathcal{O}^{\prime}\supseteq\mathcal{O}$.

Theorem 3** ([21, Thm. 4.6] ).**

If $t^{2}<4p$ and $t\not\equiv 0\mod{p}$, then

[TABLE]

Remark 4*.*

The Kronecker class number is defined differently in [21, Defn. 2.1], but the equivalence with the Definition 2 is proved in [21, Prop. 2.4].

Remark 5*.*

If $t=p+1-\#E(\mathbb{F}_{p})\equiv 0\mod{p}$, then $E$ is called supersingular. The reason that we focus on ordinary curves is because the ECDLP on supersingular curves is vulnerable to the Menezes-Okamoto-Vanstone attack [16]. There do exist super-isolated supersingular curves. For example, $y^{2}+y=x^{3}+x$ is the only curve over $\mathbb{F}_{2}$ with $5$ points. See [21, Thm. 4.6, Pg. 194] for a detailed formula for $\#I(t)$ when $t\equiv 0\mod{p}$. If $p\geq 5$ then any supersingular curve over $\mathbb{F}_{p}$ will have an even number of points. Hence we may ignore the supersingular case because we are interested in curves with prime order.

2.2 Super-isolated elliptic curves of prime order

In this section, we outline a simple method to search for super-isolated elliptic curves which have prime order. The reason for considering curves of prime order is that it increases the security and efficiency of the elliptic curve cryptosystem.

First we will use the results in Section 2.1 to give a simple characterization of super-isolated elliptic curves over prime fields.

Corollary 6**.**

Let $E/\mathbb{F}_{p}$ be an ordinary elliptic curve with trace $t=p+1-\#E(\mathbb{F}_{p})$. Then $E$ is super-isolated if and only if

[TABLE]

Proof.

By Theorem 3, $\#I(t)=1$ if and only if $t^{2}-4p$ is the discriminant of the maximal order of a quadratic imaginary field with class number $1$. It is a well known theorem of Heegner and Stark that the numbers in the statement are precisely the discriminants of such fields [24]. ∎

Remark 7*.*

Super-isolated elliptic curves are rare in the sense that if we choose a prime $p$ at random, it is unlikely there exists such a curve over $\mathbb{F}_{p}$. Let $\pi_{SI}(x)$ denote the number of primes $p<x$ such that there exists a super-isolated elliptic curve over $\mathbb{F}_{p}$. Any such $p$ must be of the form $t^{2}+d/4$, where $-d$ is one of the numbers from Corollary 6 and $t$ is an integer. This shows that $\pi_{SI}(x)=O(\sqrt{x})$.

Remark 8*.*

Even when super-isolated curves exist over $\mathbb{F}_{p}$, such curves are rare in the set of all curves over $\mathbb{F}_{p}$. There are $2p+O(1)$ distinct isomorphism classes of elliptic curves over $\mathbb{F}_{p}$, but at most $18$ are super-isolated. The number $18$ is a rough overestimate that comes from the $9$ values in Corollary 6, and then multiplying by 2 to account for quadratic twists. It is not hard to show that other twists will not be super-isolated.

Remark 9*.*

Another way to view the condition in Corollary 6 is as follows. Let $K=\mathbb{Q}(\sqrt{-d})$ be an imaginary quadratic field with class number $1$ and discriminant $-d$. Then we are searching for algebraic integers $\pi\in\mathcal{O}_{K}$ of the form $\pi=(t+\sqrt{-d})/2$ such that $\pi\overline{\pi}=(t^{2}+d)/4=p$ is prime and $\mathbb{Z}[\pi]=\mathcal{O}_{K}$.

Suppose that $p$, $t$, and $d=t^{2}-4p$ satisfy the condition in Corollary 6. The fact that $p=(t^{2}+d)/4\in\mathbb{Z}$ implies that $t\equiv d\mod{2}$. So we may replace $t$ with $2x$ or $2x+1$ depending on $d\mod{2}$. Then $p$ and $N=p+1-t$ can be written as the following integral polynomials:

[TABLE]

We are interested in values of $x$ such that $p$ and $N$ are simultaneously prime. Two necessary conditions for $p$ and $N$ to be simultaneously prime infinitely often are:

1. (i)

$p$ and $N$ are irreducible over $\mathbb{Z}[x]$. 2. (ii)

$\gcd_{a\in\mathbb{Z}}p(a)N(a)=1$.

It is clear that condition (i) is satisfied for all values of $d$. From Table 1 below, condition (ii) holds for $d\in\{3,19,43,67,163\}$ (this can be checked using only a few consecutive values of $a$ [3, Ex. 3.i, Pg. 19]).

We now give a simple description of our search method.

Choose $d\in\{3,19,43,67,163\}$ and let $p,N$ be as in Table 2. 2. 2.

Choose random integers $x$ in a predetermined range until $p(x)$ and $N(x)$ are both prime. 3. 3.

Use the CM method to recover a curve $E/\mathbb{F}_{p}$ with $N$ points, see [6, Ch. 18.1].

Example 10**.**

Let $d=3$ and $x=321438704914423479101766132343967029098$. Then $p=p(x)$ and $N=N(x)$ are both $256$-bit primes. The curve $E/\mathbb{F}_{p}$ given by $y^{2}=x^{3}+244944$ satisfies $\#E(\mathbb{F}_{p})=N$. This value of $x$ was found by a Sage [26] program that randomly sampled integers from the interval $[0,2^{128}]$.

Example 11**.**

Let $d=3$ and $x=2^{127}+13906$. Then $p(x)$ and $N(x)$ are $255$-bit primes. Moreover, their binary representations have a Hamming weight of $24$ and $27$ respectively. The CM method gives the curve $y^{2}=x^{3}+279936$. Even though our search method does not have full control over the prime $p$, it is still possible to find primes with certain desirable properties, such as a low Hamming weight.

2.3 Estimating the number of super-isolated curves of prime order

In various applications, it is important to have some degree of randomness in the parameter selection. For example, a cryptosystem may require a distinct curve for each user, or use ephemeral keys such as in [18]. In this section, we estimate the number of super-isolated elliptic curves of prime order, as a way to measure the randomness in the selection of such a curve. We also give some numerical evidence supporting our estimates.

The Bateman-Horn conjecture [1] implies that if $p(x)$ and $N(x)$ are irreducible and satisfy $\gcd_{a\in\mathbb{Z}}p(a)N(a)=1$, then the number of $x$, with $0\leq x\leq M$, such that $p(x)$ and $N(x)$ are simultaneously prime is asymptotic to $\frac{C}{4}\int_{2}^{M}1/\log^{2}(t)dt$ for a computable constant $C$. It is clear that $p(x)$ and $N(x)$ are irreducible, and we saw in Table 1 the values of $d$ such that the second property holds. For each such $d$, Table 2 gives an approximation of the constant $C$.

Example 12**.**

We ran $10000$ iterations of the search in Example 10. The average number of $x$’s sampled until $p(x)$ and $N(x)$ were both prime, was $10312$. The heuristics above imply that the expected number of $x$’s that need to be sampled is

[TABLE]

The percent difference between the observed and expected is $-0.028$.

Combining the heuristics above, we expect that the number of $x$ with $0\leq x\leq M$ such that $p(x)$ and $N(x)$ are prime for some $d\in\{3,19,43,67,163\}$ is approximately

[TABLE]

Since $p(x)$ has degree $2$, we can estimate the number of curves over $\mathbb{F}_{p}$ with $p\leq M$ by choosing $x$ in the range $0\leq x\leq\sqrt{M}$. Combined with above, we have the following estimate for the number of curves.

Heuristic 13**.**

The number of super-isolated elliptic curves of prime order over $\mathbb{F}_{p}$ with $p\leq M$ is approximately

[TABLE]

3 Abelian surfaces

3.1 Super-isolated Weil numbers

We define super-isolated for an abelian variety as we did for an elliptic curve: an abelian variety whose isogeny class contains only one isomorphism class. Recall that finding a super-isolated elliptic curve over $\mathbb{F}_{p}$ is equivalent to finding an algebraic integer $\pi$ in an imaginary quadratic field $K$ of class number $1$ such that $\pi\overline{\pi}=p$ and $\mathbb{Z}[\pi]=\mathcal{O}_{K}$ (see Remark 9). The general situation is similar, only we replace $K$ with a CM field (defined below), and $\mathbb{Z}[\pi]$ with $\mathbb{Z}[\pi,\overline{\pi}]$.

Definition 14**.**

A number field $K$ is a complex multiplication field, or CM field, if $K$ is a quadratic imaginary extension of a totally real field $F$. CM fields have a unique non-trivial automorphism fixing $F$, which we denote by $\alpha\mapsto\overline{\alpha}$ and refer to as complex conjugation.

Definition 15**.**

For any $n\in\mathbb{Z}$, a Weil $n$-number is an algebraic integer that has absolute value $\sqrt{n}$ under every embedding to $\mathbb{C}$. A Weil number is a Weil $n$-number for some $n$. If $K$ is a CM field, then $\alpha\in\mathcal{O}_{K}$ is a Weil number if and only if $\alpha\overline{\alpha}\in\mathbb{Z}$. It can be shown that if $\pi$ is a Weil $p$-number for a prime $p$, then either $\mathbb{Q}(\pi)$ is a CM field or $\pi=\pm\sqrt{p}$.

Let $A/\mathbb{F}_{p}$ be a simple444In this paper we use simple to mean simple over the base field. Other sources sometimes use the term to mean simple over the algebraic closure. abelian variety, and let $f$ be the characteristic polynomial of the Frobenius endomorphism of $A$. It is well known that $\#A(\mathbb{F}_{p})=f(1)$ and $f=h^{e}$ where $h$ is irreducible and $e$ is some integer. Moreover, any root $\pi$ of $f$ is a Weil $p$-number and $2\dim A=e[\mathbb{Q}(\pi):\mathbb{Q}]$ [28, Thm 8]. For cryptographic reasons, we are interested in varieties with prime or near-prime order, so we will mainly focus on the case where $e=1$.

Theorem 16**.**

Let $A$ be a simple abelian variety over $\mathbb{F}_{p}$, $\pi$ be a root of the characteristic polynomial of the Frobenius endomorphism, and $K=\mathbb{Q}(\pi)$. Assume that $\pi\neq\pm\sqrt{p}$. Then $A$ is super-isolated if and only if $\mathbb{Z}[\pi,\overline{\pi}]=\mathcal{O}_{K}$ and $K$ has class number $1$.

Proof.

By [29, Thm. 3.5], the endomorphism ring of any variety isogenous to $A$ is an order555The statement of [29, Thm. 3.5] refers to an order in $\operatorname{End}_{\mathbb{F}_{p}}A\otimes\mathbb{Q}$, but this is the same as $K$ since the base field is prime, see [29, Ch. 2]. in $\mathcal{O}_{K}$ containing $\mathbb{Z}[\pi,\overline{\pi}]$. Because the base field is $\mathbb{F}_{p}$ and $\pi\neq\pm\sqrt{p}$, the converse holds as well [29, Thm. 6.1]. That is, every order of $\mathcal{O}_{K}$ containing $\mathbb{Z}[\pi,\overline{\pi}]$ is the endomorphism ring of some variety isogenous to $A$. We call the set of varieties isogenous to $A$ with endomorphism ring $R$ the endomorphism class of $R$. So there is exactly one endomorphism class if and only if $\mathbb{Z}[\pi,\overline{\pi}]=\mathcal{O}_{K}$. The proof of [29, Thm. 6.1] shows that the number of isomorphism classes in the endomorphism class of $\mathcal{O}_{K}$ is equal to the class number of $K$. Therefore, the entire isogeny class of $A$ contains a single isomorphism class if and only if $\mathbb{Z}[\pi,\overline{\pi}]=\mathcal{O}_{K}$ and $K$ has class number $1$. ∎

Definition 17**.**

A super-isolated Weil number is a Weil number $\pi$ such that $K=\mathbb{Q}(\pi)$ has class number $1$ and $\mathcal{O}_{K}=\mathbb{Z}[\pi,\overline{\pi}]$.

In this section we are mainly interested in surfaces. The reason for not considering higher dimensional abelian varieties is that the discrete log problem on jacobians666 Cryptosystems usually use jacobians of hyperelliptic curves rather than arbitrary varieties because they provide efficient representations necessary for practical use [12]. of curves of genus $\geq 3$ can be solved faster than on comparably sized jacobians of curves of genus $\leq 2$ [7, 8, 23]. This means that we would need to use a larger key size in order to achieve comparable security. Hence varieties of dimension $\geq 3$ are less efficient in practice. Both genus $2$ and $1$ are still considered for cryptographic use and have comparable efficiency [2].

Remark 18*.*

Another reason for focusing on curves and surfaces is that we do not expect many super-isolated varieties of dimension at least $3$. In [25], Stark remarked that it is reasonable to believe that there are only finitely many CM fields of class number $1$. This would imply that there is a finite list of fields which admit Weil numbers that could correspond to super-isolated varieties of near-prime order.

The following corollary specializes Theorem 16 to surfaces with $e=1$.

Corollary 19**.**

Let $A$ be an abelian surface over $\mathbb{F}_{p}$. Assume that the characteristic polynomial $f$ of the Frobenius endomorphism of $A$ is irreducible. Then $A$ is super-isolated if and only if the roots of $f$ are super-isolated Weil $p$-numbers.

Proof.

This follows from Theorem 16 after noting that, because $f$ is irreducible, $A$ is simple and $\pm\sqrt{p}$ can not be roots of $f$. ∎

Therefore, in order to find super-isolated surfaces of near-prime order (note that near-prime order implies the hypothesis in Corollary 19), it is sufficient to find all super-isolated Weil numbers $\pi$, such that $\pi\overline{\pi}$ is prime and $\mathbb{Q}(\pi)$ has degree $4$. There are 91 quartic CM fields of class number $1$, and they can be found in the literature [30, 13]. By [14, Cor. 2.10], if $\pi$ is a Weil $p$-number whose minimal polynomial $f$ has degree $4$, then there is a simple abelian surface over $\mathbb{F}_{p}$ such that $f$ is the characteristic polynomial of the Frobenius endomorphism of $A$. This is a special case of a theorem of Honda, which shows that every Weil $p$-number is a root of the characteristic polynomial of the Frobenius endomorphism of some simple abelian variety over $\mathbb{F}_{p}$ [10]. One can recover a representative of the isogeny class of $A$ from $\pi$ using the two dimensional analogue of the CM method [6, Ch. 18].

3.2 Search algorithm

In this section we describe an efficient algorithm for enumerating all super-isolated Weil numbers in a given field up to a certain bound. For the rest of the paper, unless otherwise stated, we will only consider super-isolated Weil numbers $\pi$ such that $\mathbb{Q}(\pi)$ has degree $4$ over $\mathbb{Q}$ and $\pi\overline{\pi}$ is prime.

Remark 20*.*

Our methods are motivated by those Wang used in [27] to parameterize isolated abelian surfaces, which are analogues of the isolated elliptic curves described in Section 1.

Remark 21*.*

A naive algorithm to find super-isolated Weil $p$-numbers is as follows. Fix a quartic CM field $K$ with class number $1$. For each prime $p$ less than a certain bound, find all possible solutions $\pi$ in $\mathcal{O}_{K}$ to the relative norm equation $\pi\overline{\pi}=p$. This can be done using standard algorithms, see [5, Ch. 7.5.4]. For each solution, check if $\mathbb{Z}[\pi,\overline{\pi}]=\mathcal{O}_{K}$ by computing discriminants. This method is not practical because primes $p$ which admit super-isolated Weil $p$-numbers are rare.

First, we will give an informal description of our algorithm. Let $K$ be a quartic CM field with class number $1$, and let $\{\alpha_{1},\alpha_{2},\alpha_{3},\alpha_{4}\}$ be a basis for $\mathcal{O}_{K}$. Then any $\pi\in\mathcal{O}_{K}$ can be written as $\sum a_{i}\alpha_{i}$ for some $a_{i}\in\mathbb{Z}$. We will show that $\pi$ is a super-isolated Weil number if and only if the $a_{i}$ satisfy the following properties:

1. (i)

The condition that $\pi\overline{\pi}\in\mathbb{Z}$ is equivalent to $P_{0}(a_{1},a_{2},a_{3},a_{4})=0$, where $P_{0}$ is the polynomial in Equation 5 below. 2. (ii)

If (i) holds, then the condition that $\mathbb{Z}[\pi,\overline{\pi}]=\mathcal{O}_{K}$ is equivalent to the equations

[TABLE]

where $f_{1}$ and $f_{2}$ are the polynomials in Equations (2,3). 3. (iii)

The condition that $\pi\overline{\pi}$ is prime is equivalent to $P(a_{1},a_{2},a_{3},a_{4})$ being prime, where $P$ is the polynomial in Equation 4 below.

These equivalences are shown in the proof of Theorem 30 below. Moreover, we will also show that if $\{\alpha_{1},\alpha_{2},\alpha_{3},\alpha_{4}\}$ are chosen in a certain way, then finding solutions to the equations $P_{0}=0$, $f_{1}=\pm 1$, $f_{2}=\pm 1$ essentially reduces to an instance of Pell’s equation. Our algorithm starts by choosing such a basis, and proceeds to enumerate tuples $(a_{1},a_{2},a_{3},a_{4})$ satisfying the conditions above.

3.2.1 The algorithm

The algorithm outlined below enumerates super-isolated Weil numbers in a certain field.

Choose a quartic CM field $K$ of class number $1$, and let $F$ be the real quadratic subfield. Let $\Delta_{K},\Delta_{F}$ denote the respective discriminants. 2. 2.

Choose a basis $\{\alpha_{1},\alpha_{2},\alpha_{3},\alpha_{4}\}$ of $\mathcal{O}_{K}$ such that $\alpha_{1}=1$ and $\{\alpha_{1},\alpha_{2}\}$ form a basis for $\mathcal{O}_{F}$. 3. 3.

Choose non-conjugate embeddings $\phi_{1},\phi_{2}:K\hookrightarrow\mathbb{C}$. 4. 4.

Compute the coefficients of the following polynomials:

[TABLE]

By Lemma 25 below, $f_{1}\in\mathbb{Z}[x_{2},x_{3},x_{4}]$, $f_{2}\in\mathbb{Z}[x_{3},x_{4}]$, and $P,P_{0}\in\frac{1}{2}\mathbb{Z}[x_{1},x_{2},x_{3},x_{4}]$. 5. 5.

Enumerate solutions $x_{3}=a_{3}$, $x_{4}=a_{4}$ to the equation

[TABLE]

up to a given bound. We do this as follows.

1. 5.1

By Lemma 26 below, we may write $f_{2}=ax_{3}^{2}+bx_{3}x_{4}+cx_{4}^{2}$ for $a,b,c\in\mathbb{Z}$ with $b^{2}-4ac=\Delta_{F}$. A straight-forward calculation shows that the $\mathbb{Z}$-module $I=a\mathbb{Z}+\frac{b+\sqrt{\Delta_{F}}}{2}\mathbb{Z}$ is an ideal of $\mathcal{O}_{F}$. Here we are abusing notation by writing $\sqrt{\Delta_{F}}$ as an element of $F$. Since $K$ is a quartic CM field with class number $1$, $F$ has class number $1$. So we can choose a principal generator $\gamma$ for $I$. Let $\epsilon$ be a fundamental unit for $F$. One can find both $\gamma$ and $\epsilon$ using standard algorithms, see [4, Ch. 4-5]. 2. 5.2

For each $i\in\mathbb{Z}$, with $|i|$ less than a predetermined bound, compute $\sigma=\pm\epsilon^{i}\gamma$ for each choice of sign. 3. 5.3

For each $\sigma$, find a pair $a_{3},a_{4}\in\mathbb{Q}$ such that $a_{3}a+a_{4}\frac{b+\sqrt{\Delta_{F}}}{2}=\sigma$. 6. 6.

For each pair $(a_{3},a_{4})$, find all $a_{2}$ such that $x_{2}=a_{2}$, $x_{3}=a_{3}$, $x_{4}=a_{4}$ is a solution to

[TABLE]

We can find $a_{2}$ as follows. By the choice of basis, the coefficient of $x_{2}$ in $f_{1}$ is non-zero. Thus, there are two possibilities for $a_{2}\in\mathbb{Q}$, and they are each given by linear polynomials in $a_{3}$, $a_{4}$. 7. 7.

For each tuple $(a_{2},a_{3},a_{4})$, find all $a_{1}$ such that $x_{1}=a_{1}$, $x_{2}=a_{2}$, $x_{3}=a_{3}$, $x_{4}=a_{4}$ is a solution to

[TABLE]

This can be done as follows. A straightforward computation, using the fact that $\alpha_{1}=1$, shows that $2P_{0}=g+f_{1}x_{1}$ for some polynomial $g\in\mathbb{Z}[x_{2},x_{3},x_{4}]$. Since $f_{1}(a_{2},a_{3},a_{4})=\pm 1$, we have $a_{1}=\mp g(a_{2},a_{3},a_{4})$. 8. 8.

For each tuple $(a_{1},a_{2},a_{3},a_{4})$, if every $a_{i}$ is integral and $P(a_{1},a_{2},a_{3},a_{4})$ is prime, then output

[TABLE]

3.2.2 Correctness

In this section, we will prove the correctness of the algorithm of Section 3.2.1. By correctness, we mean that if the algorithm outputs $\pi$, then $\pi$ is a super-isolated Weil number. Conversely, if $\pi$ is a super-isolated Weil number in $K$, then, given a large enough bound, the algorithm will eventually output $\pi$.

Remark 22*.*

This section is solely focused on the correctness of the algorithm. For a discussion of the efficiency, see Section 3.2.3.

Our proof of correctness involves several computations, which have been broken down into several lemmas. The main idea is to find explicit polynomials representing the index of $\mathbb{Z}[\pi,\pi]$ in $\mathcal{O}_{K}$ and the value of $\pi\overline{\pi}$, both with respect to the basis $\{\alpha_{1},\alpha_{2},\alpha_{3},\alpha_{4}\}$.

First, we will prove Lemmas 25 and 26, which were used in the description of the polynomials $f_{1},f_{2},P,P_{0}$ in the algorithm in Section 3.2.1. To prove these lemmas, we start with some facts from algebraic number theory.

Lemma 23**.**

Let $K$ be a quartic CM field, $F$ be the quadratic real subfield of $K$, and $\phi_{1},\phi_{2}$ be non-conjugate embeddings $K\hookrightarrow\mathbb{C}$. If $\gamma\in\mathcal{O}_{K}$, then

[TABLE]

and

[TABLE]

Proof.

Note that $\gamma+\overline{\gamma}\in\mathcal{O}_{F}$, so $\phi_{1}(\gamma+\overline{\gamma})$ can be written as $a+b\sqrt{\Delta_{F}}$ for some $a,b\in\frac{1}{2}\mathbb{Z}$. Because $\phi_{1}(\sqrt{\Delta_{F}})=-\phi_{2}(\sqrt{\Delta_{F}})$, the claim follows from noticing that

[TABLE]

∎

Lemma 24**.**

Let $K$ be a quartic CM field with maximal totally real subfield $F$. If $\gamma\in\mathcal{O}_{K}$ and $\phi_{1},\phi_{2}$ are any non-conjugate pair of embeddings $K\hookrightarrow\mathbb{C}$, then

[TABLE]

Proof.

Let $\delta_{K/F}(\alpha)$ denote the relative different for any $\alpha\in\mathcal{O}_{K}$. Because $K/F$ is a quadratic imaginary extension, we have that $\delta_{K/F}(\alpha)=\alpha-\overline{\alpha}$.

We may assume $K=F(\gamma)$ otherwise the claim is trivial as $\phi_{1}(\gamma-\overline{\gamma})\phi_{2}(\gamma-\overline{\gamma})=0$. From the proof of [20, Thm. III.2.5, Pg. 198],

[TABLE]

where $\mathfrak{f}_{\mathcal{O}_{F}[\gamma]}=\{\alpha\in K\colon\alpha\mathcal{O}_{K}\subseteq\mathcal{O}_{F}[\gamma]\}$ is the conductor of the order $\mathcal{O}_{F}[\gamma]$ in $\mathcal{O}_{K}$ and $\mathcal{D}_{K/F}$ is the relative different of the extension $K/F$.

Note that $\gamma+\overline{\gamma}\in\mathcal{O}_{F}$ implies that $\overline{\gamma}\in\mathcal{O}_{F}[\gamma]$, hence $\mathcal{O}_{F}[\gamma]$ is invariant under conjugation. It follows that $\mathfrak{f}_{\mathcal{O}_{F}[\gamma]}$ is invariant under conjugation, so we may write $\mathfrak{f}_{\mathcal{O}_{F}[\gamma]}=I\cdot\mathcal{O}_{K}$ for some ideal $I\subseteq\mathcal{O}_{F}$. Then

[TABLE]

The different and discriminant are related by the formula [20, Cor. III.2.10, Pg. 197]

[TABLE]

The claim follows from combining Equation 3.2.2 and Equation 10 and taking square roots. ∎

Lemma 25**.**

Let $f_{1},f_{2},P,P_{0}$ be the polynomials from Equations (2)-(5). Then

1. (i)

$f_{1}\in\mathbb{Z}[x_{2},x_{3},x_{4}]$** 2. (ii)

$f_{2}\in\mathbb{Z}[x_{3},x_{4}]$** 3. (iii)

$P\in\frac{1}{2}\mathbb{Z}[x_{1},x_{2},x_{3},x_{4}]$** 4. (iv)

$P_{0}\in\frac{1}{2}\mathbb{Z}[x_{1},x_{2},x_{3},x_{4}]$.

Proof.

It is straightforward from the definition of $f_{1},f_{2}$ and the choice of basis $\{\alpha_{1},\alpha_{2},\alpha_{3},\alpha_{4}\}$ that $f_{1}\in\mathbb{C}[x_{2},x_{3},x_{4}]$ and $f_{2}\in\mathbb{C}[x_{3},x_{4}]$. So it remains to check the domain of the coefficients.

The claims for $f_{1}$, $P$, and $P_{0}$ all follow directly from Lemma 23. For $f_{2}$, note that the coefficient of $x_{i}x_{j}$ is $\phi_{1}(\delta_{i})\phi_{2}(\delta_{j})+\phi_{1}(\delta_{j})\phi_{2}(\delta_{i})$, where $\delta_{i}=\alpha_{i}-\overline{\alpha}_{i}$. The claim for $f_{2}$ follows from Lemma 24 and the fact that

[TABLE]

∎

Lemma 26**.**

$f_{2}$* is a integral bilinear quadratic form in $x_{3},x_{4}$ with discriminant $\Delta_{F}$.*

Proof.

It is clear from the definition that $f_{2}$ is a homogeneous polynomial of degree $2$, and by Lemma 25, $f_{2}\in\mathbb{Z}[x_{3},x_{4}]$. So it remains to calculate the discriminant.

Let $\delta_{i}=\alpha_{i}-\overline{\alpha}_{i}$. By definition,

[TABLE]

Now we compute

[TABLE]

∎

Next we prove the correctness of step 5 using our previous lemmas.

Lemma 27**.**

If $(a_{3},a_{4})$ is outputted in step 5 of the algorithm in Section 3.2.1, then $f_{2}(a_{3},a_{4})=\pm 1$. Moreover, if $x_{3}=a_{3}$, $x_{4}=a_{4}$ is an integral solution to $f_{2}(x_{3},x_{4})=\pm 1$, then, given a large enough bound, step 5 will eventually output the pair $(a_{3},a_{4})$.

Proof.

Following the notation from the algorithm, let $f_{2}(x_{3},x_{4})=ax_{3}^{2}+bx_{3}x_{4}+cx_{4}^{2}$. Recall from Lemma 26 that $a,b,c\in\mathbb{Z}$ and $b^{2}-4ac=\Delta_{F}$. Note that $\{a,(b+\sqrt{\Delta_{F}})/2\}$ is a $\mathbb{Q}$-basis for $F$. Here we are abusing notation by writing $\sqrt{\Delta_{F}}$ as an element of $F$. So we can write any $\sigma\in F$ as

[TABLE]

for some $x,y\in\mathbb{Q}$. Then the norm of $\sigma$ is

[TABLE]

Therefore $f_{2}(x,y)=\pm 1$ if and only if the corresponding $\sigma$ has norm $\pm a$. Moreover, $x,y\in\mathbb{Z}$ if and only if $\sigma$ lies in the ideal $I=a\mathbb{Z}+(b+\sqrt{\Delta_{F}})/2\mathbb{Z}$ (one can show this is an ideal using the fact that $b^{2}-4ac=\Delta_{F}$). Because $\operatorname{Norm}_{F/\mathbb{Q}}(I)=|a|$, it follows that $x_{3}=x,x_{4}=y$ is an integral solution to $f_{2}(x_{3},x_{4})=\pm 1$ if and only if $\sigma\mathcal{O}_{F}=I$. Therefore, we have a bijection between integral solutions to $f_{2}(x_{3},x_{4})=\pm 1$ and generators of $I$.

The claim follows as steps (55.1)-(55.3) enumerate all generators $\sigma$ for the ideal $I$, and compute the associated integral solution to $f_{2}=\pm 1$. ∎

Now we will find an explicit $\mathbb{Z}$-basis for the order $\mathbb{Z}[\pi,\overline{\pi}]$. This will allow us to write down a formula for $\operatorname{disc}\mathbb{Z}[\pi,\overline{\pi}]$ in terms of the coefficients of $\pi$ with respect to the basis $\{\alpha_{1},\alpha_{2},\alpha_{3},\alpha_{4}\}$ for $\mathcal{O}_{K}$. We will use this formula to determine when $\mathbb{Z}[\pi,\overline{\pi}]=\mathcal{O}_{K}$.

Lemma 28**.**

Let $K$ be a quartic CM field and let $\pi\in\mathcal{O}_{K}$ be an Weil $p$-number. Then $B=\left\langle 1,\pi,\overline{\pi},\pi^{2}\right\rangle$ generates $\mathbb{Z}[\pi,\overline{\pi}]$ as a $\mathbb{Z}$-module.

Proof.

We will show that any power of $\pi$ or $\overline{\pi}$ is contained in $\operatorname{Span}(B)$. The claim will follow because $\pi\overline{\pi}\in\mathbb{Z}$, so any product $\pi^{i}\overline{\pi}^{j}$ can be rewritten as sums of powers of $\pi$ or $\overline{\pi}$. Because $K$ is a quartic extension, we only have to show $\pi^{3},\overline{\pi}^{2},\overline{\pi}^{3}\in\operatorname{Span}(B)$.

First we will show that $\overline{\pi}^{2}\in\operatorname{Span}(B)$. Let $F$ be the real quadratic subfield of $K$. Note that $\pi+\overline{\pi}\in\mathcal{O}_{F}$, so it has a characteristic polynomial in $F$ of the form $x^{2}+ax+b$ for some $a,b\in\mathbb{Z}$. It follows that

[TABLE]

Now recall that the characteristic polynomial of $\pi$ in $K$ is of the form $x^{4}-cx^{3}+dx^{2}-cpx+p^{2}$ for some $c,d\in\mathbb{Z}$. Using the fact that $\overline{\pi}=p/\pi$, this shows that

[TABLE]

It follows from Equations (3.2.2)-(13) that $\overline{\pi}^{2},\pi^{3},\overline{\pi}^{3}\in\operatorname{Span}(B)$. ∎

Lemma 29**.**

Let $K$ be a quartic CM field and let $\phi_{1},\phi_{2}$ be non-conjugate embeddings $K\hookrightarrow\mathbb{C}$. If $\gamma\in\mathcal{O}_{K}$, then

[TABLE]

Proof.

Let $\beta_{1}=1,\beta_{2}=\gamma,\beta_{3}=\overline{\gamma},\beta_{4}=\gamma^{2}$. Then $\operatorname{disc}(1,\gamma,\overline{\gamma},\gamma^{2})=\det\operatorname{tr}\beta_{i}\beta_{j}$. Let $\gamma_{i}=\phi_{i}(\gamma)$. Because $K$ is a CM field, complex conjugation commutes with embeddings into $\mathbb{C}$, so $\phi_{i}(\overline{\gamma})=\overline{\gamma}_{i}$. Using this, we can compute $\operatorname{tr}\beta_{i}\beta_{j}$ in terms of $\gamma_{1},\gamma_{2}$. For example:

[TABLE]

A straightforward computation shows that $\det\operatorname{tr}\beta_{i}\beta_{j}$, when viewed as a polynomial in the ring $\mathbb{Z}[\gamma_{1},\gamma_{2},\overline{\gamma}_{1},\overline{\gamma}_{2}]$, factors into the desired form. ∎

We are now ready to prove the correctness of the algorithm.

Theorem 30**.**

If the algorithm of Section 3.2.1 outputs $\pi$, then $\pi$ is a super-isolated Weil number. Moreover, for any fixed super-isolated Weil number $\pi$, if the algorithm is given $K=\mathbb{Q}(\pi)$ and a large enough bound, then it will eventually output $\pi$.

Proof.

We will use the same notation as in Section 3.2.1. Let $a_{1},a_{2},a_{3},a_{4}\in\mathbb{Z}$ and let $\pi=\sum a_{i}\alpha_{i}$. A straightforward computation, using Lemma 23, shows that

[TABLE]

It follows that $\pi$ is a Weil $p$-number for a prime $p$ if and only if the following hold:

1. (i)

$P_{0}(a_{1},a_{2},a_{3},a_{4})=0$ 2. (ii)

$P(a_{1},a_{2},a_{3},a_{4})$ is prime.

Next we will show that if (i) holds, then $\mathbb{Z}[\pi,\overline{\pi}]=\mathcal{O}_{K}$ if and only if the following hold:

1. (iii)

$f_{1}(a_{1},a_{2},a_{3},a_{4})=\pm 1$ 2. (iv)

$f_{2}(a_{1},a_{2},a_{3},a_{4})=\pm 1$.

By Lemma 28, $B=\{1,\pi,\overline{\pi},\pi^{2}\}$ spans $\mathbb{Z}[\pi,\overline{\pi}]$ as a $\mathbb{Z}$-module. Therefore $\mathbb{Z}[\pi,\overline{\pi}]$ is an order in $K$ if and only if $\operatorname{disc}B\neq 0$, in which case $B$ is basis for $\mathbb{Z}[\pi,\overline{\pi}]$. Hence $\mathbb{Z}[\pi,\overline{\pi}]=\mathcal{O}_{K}$ if and only if $\operatorname{disc}B=\Delta_{K}$. By Lemma 29 and the definition of $f_{1},f_{2}$,

[TABLE]

By Lemma 25, $f_{1}$ and $f_{2}$ are integer polynomials, so $\mathbb{Z}[\pi,\overline{\pi}]=\mathcal{O}_{K}$ if and only if $|f_{1}(a_{1},a_{2},a_{3},a_{4})|=|f_{2}(a_{1},a_{2},a_{3},a_{4})|=1$.

We have shown that $\pi$ is a super-isolated Weil number if and only if properties (i)-(iv) hold. Because the algorithm enumerates integral tuples $(a_{1},a_{2},a_{3},a_{4})$ satisfying these properties, this shows that every algebraic integer the algorithm outputs is a super-isolated Weil number.

For the second claim, suppose that $\pi=\sum a_{i}\alpha_{i}$ is a super-isolated Weil number. Then by property (iv), $x_{3}=a_{3}$, $x_{4}=a_{4}$ is an integral solution to Equation 6. By Lemma 27, for a large enough bound, the algorithm will eventually enumerate $a_{3},a_{4}$ in step 5. Recall that $a_{1},a_{2}$ are essentially determined from $a_{3},a_{4}$ (see steps 6 and 7). That is, for any given solution $a_{3},a_{4}$ to Equation 6, there are two pairs $(a_{1},a_{2})$ such that $(a_{1},a_{2},a_{3},a_{4})$ satisfies Equations (6)-(8). Both pairs are found by the algorithm, so the algorithm will eventually output $\pi$. ∎

3.2.3 Efficiency

Recall that the algorithm in Section 3.2.1 enumerates solutions $x_{1}=a_{1}$, $x_{2}=a_{2}$, $x_{3}=a_{3}$, $x_{4}=a_{4}$ to Equations (6)-(8). For each integer $i$, chosen in step 55.2, the algorithm found several (possibly non-integral) solutions, see steps (5)-(7). In this section, we will show that the algorithm can find all solutions $(a_{1},a_{2},a_{3},a_{4})$ with $P(a_{1},a_{2},a_{3},a_{4})\leq N$, by checking at most $O(\log N)$ values of $i$.

To prove the claim, we first show that the value of $|a_{4}|$ grows exponentially with $|i|$, i.e. $\log|a_{4}|=\Omega(|i|)$. Then we will show that the function $P(x_{1},x_{2},x_{3},x_{4})$, when restricted to solutions to Equations (6)-(8), is essentially bounded below by $|x_{4}|$.

Remark 31*.*

The reason we choose $a_{4}$ instead of $a_{3}$ is that some of the equations turn out to be simpler. The same argument could be made with $a_{3}$ instead.

Lemma 32**.**

There are computable positive constants $C_{1},C_{2}$, with $C_{2}>1$, such that if the integer $i$ is chosen as in step 55.2, and the pair $(a_{3},a_{4})$, with $a_{4}\neq 0$, is computed as in step 55.3, then

[TABLE]

The constants $C_{1},C_{2}$ depend only on the basis chosen in step 2 and the generator chosen in step 55.1.

Proof.

We will keep the notation from the algorithm in Section 3.2.1. Recall how the pair $(a_{3},a_{4})$ is constructed from $i$ in step 5. First we found an algebraic integer $\sigma\in\mathcal{O}_{F}$ of the form $\sigma=\pm\epsilon^{i}\gamma$ where $\gamma$ generates the ideal $I=a\mathbb{Z}+(b+\sqrt{\Delta_{F}})/2\mathbb{Z}$, and $\epsilon$ is a fundamental unit of $F$. The pair $a_{3},a_{4}$ are the coefficients of $\sigma$ with respect to the $\mathbb{Z}$-basis $\{a,(b+\sqrt{\Delta_{F}})/2\}$ for $I$.

Using the quadratic formula and the fact that $a_{3},a_{4}\in\mathbb{Z}$, one can show that $f_{2}(a_{3},a_{4})=\pm 1$ implies that $|a_{3}|\leq C_{0}|a_{4}|$ for some constant $C_{0}$ that depends only on $f_{2}$ (hence $C_{0}$ depends on the basis chosen in step 2). So

[TABLE]

The last step follows from the fact that $\phi_{1}(\epsilon)\phi_{2}(\epsilon)=\pm 1$. ∎

Next we want to show that, for all integral solutions $x_{1}=a_{1}$, $x_{2}=a_{2}$, $x_{3}=a_{3}$, $x_{4}=a_{4}$ to Equations (6)-(8), the value of $P(a_{1},a_{2},a_{3},a_{4})$ is essentially bounded below by $|a_{4}|$. Recall that Equations 6 and 7 involve a choice of sign. To simplify our argument, we will first restrict to a specific set of signs.

Let $A$ be the set of rational tuples $(a_{1},a_{2},a_{3},a_{4})\in\mathbb{Q}^{4}$ such that $x_{1}=a_{1},x_{2}=a_{2},x_{3}=a_{3},x_{4}=a_{4}$ is a solution to the following equations:

[TABLE]

Equation 16 comes from solving $f_{2}(x_{3},x_{4})=1$ for $x_{3}$ (recall that $f_{2}=ax_{3}^{2}+bx_{3}x_{4}+cx_{4}^{2}$ for integers $a,b,c$). Therefore, every tuple in $A$ is a solution to Equations (6)-(8) with the positive signs. Note that every integral solution to Equations (6)-(8) lies in a set defined in a way similar to $A$, only with a possibly different choice of signs.777There are a total of $8$ choices of signs we could use to define $A$. These come from the three choices of signs: one in Equation 6, one in Equation 7, and one from the quadratic formula when solving Equation 6 for $x_{3}$. Every solution to Equations (6)-(8) lies in one of these $8$ sets. Our arguments in the lemmas below will not depend on the choice of sign, so they will apply to any such set.

Lemma 33**.**

There exists an explicit function $P_{4}(x_{4})$ such that for every $(a_{1},a_{2},a_{3},a_{4})\in A$,

[TABLE]

where $P$ is the polynomial from Equation 4.

Proof.

To prove the claim, we first find functions $g_{1}(x_{4}),g_{2}(x_{4}),g_{3}(x_{4})$ such that for all tuples $(a_{1},a_{2},a_{3},a_{4})\in A$, $a_{i}=g_{i}(a_{4})$ for $i=1,2,3$. Then we will substitute the $g_{i}$’s into the polynomial $P$ in order to construct $P_{4}(x_{4})$.

By definition, if

[TABLE]

then $a_{3}=g_{3}(a_{4})$ for all $(a_{1},a_{2},a_{3},a_{4})\in A$.

Next we will find $g_{2}$. Recall that $f_{1}(x_{2},x_{3},x_{4})$ is a linear polynomial with a non-zero coefficient of $x_{2}$ (see step 6 in the algorithm in Section 3.2.1). So we can use Equation 14 to write $x_{2}$ as a linear function of $x_{3}$ and $x_{4}$. By substituting $g_{3}$ for $x_{3}$, we obtain a function $g_{2}$ which satisfies $a_{2}=g_{2}(a_{4})$ for all $(a_{1},a_{2},a_{3},a_{3})\in A$.

Now we will find $g_{1}$. Recall that $P_{0}(x_{1},x_{2},x_{3},x_{4})=f_{1}x_{1}+g$ for some $g\in\mathbb{Z}[x_{2},x_{3},x_{4}]$ (see step 7). By Equations 14 and 15, $a_{1}=-g(a_{2},a_{3},a_{4})$ for all $(a_{1},a_{2},a_{3},a_{4})\in A$. By replacing $x_{2},x_{3}$ in $-g$ with $g_{2},g_{3}$ respectively, we obtain a function $g_{1}(x_{4})$ such that $a_{1}=g_{1}(a_{4})$ for all $(a_{1},a_{2},a_{3},a_{4})\in A$.

Let

[TABLE]

Note that $P_{4}$ has the desired property because for all $(a_{1},a_{2},a_{3},a_{4})\in A$, we have that $g_{i}(a_{4})=a_{i}$ for $i=1,2,3$. ∎

Theorem 34**.**

The algorithm in Section 3.2.1 can find all super-isolated Weil $p$-numbers with $p\leq N$ in $O(\log N)$ steps. That is, for each quartic CM field $K$ of class number $1$, there is at least one set of choices that can be made in steps 2 and 3 such that the algorithm only needs to check $O(\log N)$ values of $|i|$ in step 55.2. Here the implicit constant depends on the choices made.

Sketch of proof.

By Theorem 30, the algorithm will eventually output any specific super-isolated Weil number given a large enough bound. Therefore, it is sufficient to show that the value of $P(a_{1},a_{2},a_{3},a_{4})$ in step 8 grows exponentially in $|i|$. From Lemma 32, we know that $\log|a_{4}|=\Omega(|i|)$, so it is sufficient to show that $P(a_{1},a_{2},a_{3},a_{4})=\Omega(|a_{4}|)$.

Recall that there are only $91$ such fields. For each one, we computed the function $P_{4}$ from Lemma 33 after choosing some random values in steps 2 and 3. We found that $|P_{4}(x_{4})|=\Omega(x_{4}^{4})$. We repeated the calculations for every alternative definition of the set $A$ from Lemma 33, and found the same result (this property seems to always hold in practice). Some details for the case of $K=\mathbb{Q}(\zeta_{5})$ are given in Appendix A. We also used these calculations in the proof of Theorem 37 below.

Let $(a_{1},a_{2},a_{3},a_{4})$ be any integral solution to Equations (6)-(8). Then $P(a_{1},a_{2},a_{3},a_{4})=P_{4}(a_{4})$ for some $P_{4}$ (recall the definition of $P_{4}$ depended on the set $A$, so there are $8$ possibilities for $P_{4}$). Since $|P_{4}(x_{4})|=\Omega(x_{4}^{4})$, it follows that $P(a_{1},a_{2},a_{3},a_{4})=\Omega(a_{4}^{4})$. ∎

3.3 Examples

We found the following super-isolated Weil numbers by using the algorithm in Section 3.2.1. Both generate non-normal quartic CM fields.

Example 35**.**

[TABLE]

Here $p=\pi\overline{\pi}=75785615717819865717549739169971883$ is a 116 bit prime, and $N=\operatorname{Norm}_{K/\mathbb{Q}}(\pi-1)$ factors as $31$ times a $227$ bit prime. The associated surface is the jacobian of the following hyperelliptic curve over $\mathbb{F}_{p}$:

[TABLE]

Example 36**.**

[TABLE]

Here $p=\pi\overline{\pi}=5500665463278776959453617590160336793$ is a 123 bit prime, and $N=\operatorname{Norm}_{K/\mathbb{Q}}(\pi-1)$ factors as $521$ times a $236$ bit prime. The associated surface is the jacobian of the following hyperelliptic curve over $\mathbb{F}_{p}$:

[TABLE]

3.4 Main result

Our main result is that Examples 35 and 36 are the only examples of super-isolated surfaces with near-prime order and cryptographic size.

Theorem 37**.**

Examples 35 and 36 are the only super-isolated abelian surfaces $A/\mathbb{F}_{p}$ with the property that

[TABLE]

Sketch of proof.

We will show that if $A$ is an abelian surface satisfying property (17), then the roots of the characteristic polynomial of the Frobenius endomorphism of $A$ are super-isolated Weil $p$-numbers with $p\leq 2^{261}$. The claim then follows by running the algorithm in Section 3.2.1 long enough to find all super-isolated Weil $p$-numbers with $p\leq 2^{261}$.

Let $A$ be an abelian surface over $\mathbb{F}_{p}$ satisfying property (17). Recall from Section 3.1 that $\#A(\mathbb{F}_{p})=f(1)$, where $f$ is the characteristic polynomial of the Frobenius endomorphism of $A$. Using the well-known Hasse bound, it is not hard to show that property (17) implies that $A$ is simple, because a product of elliptic curves does not have near-prime order. Hence $f=h^{e}$ for some irreducible polynomial $h$, see Section 3.1. But as $f(1)$ is near-prime, we must have $e=1$, i.e. $f$ is irreducible. So by Corollary 19, every root $\pi$ of $f$ is a super-isolated Weil $p$-number in the quartic CM field $K=\mathbb{Q}(\pi)$ of class number $1$.

Next we will show that property 17 implies that $p\leq 2^{261}$. This is similar to using the Hasse bound above. Since the roots of $f$ are Weil $p$-numbers, it follows that $f(x)=x^{4}+ax^{3}+bx^{2}+pax+p^{2}$ with $|a|\leq 4\sqrt{p}$ and $|b|\leq 6p$. So

[TABLE]

A straightforward calculation shows that this inequality, when combined with the bound $r\geq 2^{512}$, implies that $p\leq 2^{261}$.

The next part of the proof is computational. We used Sage to compute the implicit constants in Section 3.2.3 that are used to bound the number of steps the algorithm must take in order to enumerate all super-isolated Weil $p$-numbers with $p\leq 2^{261}$ (see Theorem 34). Some details for the case of $K=\mathbb{Q}(\zeta_{5})$ are given in Appendix A. Our results show that there are $282$ conjugacy classes of such Weil numbers. Only those given in Examples 35 and 36 satisfy the properties in the claim. The source code is available at https://sites.math.washington.edu/~tscholl2/super-isolated. ∎

Remark 38*.*

The bound $c\leq 1000$ used above is arbitrary. The smaller $c$ is the more efficient the cryptosystem will be. The three smallest values of $c$ were $31$, $521$, and $73399$.

Remark 39*.*

Note that the surfaces in Examples 35 and 36 provide $113$ and $116$ bits of security respectively (i.e. half the bitlength of the largest prime dividing the order). Recent standards suggest using between $128$ and $256$ bits of security [19]. While $113$ bits should be fine in many cases, our result shows that we can increase the security without increasing the size of $p$ or $c$, which would reduce the efficiency.

Remark 40*.*

After running the algorithm to search all super-isolated Weil $p$-numbers $\pi$ with $100\leq p\leq 2^{10000}$, there was only one conjugacy class such that $\operatorname{Norm}(\pi-1)$ was prime. In that case, $p\approx 2^{740}$. This prime is too large to be useful in most practical applications.

Appendix A Details for $\mathbb{Q}(\zeta_{5})$

In this section, we provide a detailed example of the algorithm in Section 3.2.1, for the field $\mathbb{Q}(\zeta_{5})$. We also show how long the algorithm must run in order to enumerate all super-isolated Weil $p$-numbers with $p\leq 2^{261}$. We will use the notation from Section 3.2.1 and the methods from Section 3.2.3.

Let $K=\mathbb{Q}(\zeta_{5})$. Recall that step 2 of the algorithm chooses a basis $\{\alpha_{1},\alpha_{2},\alpha_{3},\alpha_{4}\}$ for $\mathcal{O}_{K}$ such that $\{\alpha_{1},\alpha_{2}\}$ form a basis for $\mathcal{O}_{F}$ where $F$ is the maximal real subfield of $K$. In this case, $F=\mathbb{Q}(\sqrt{5})$. We choose

[TABLE]

Let $\phi_{1},\phi_{2}$ be the embeddings $K\hookrightarrow\mathbb{C}$ defined by

[TABLE]

For reference, $\phi_{1}(\alpha_{2})=\frac{5+\sqrt{5}}{2}$ and $\phi_{2}(\alpha_{2})=\frac{5-\sqrt{5}}{2}$.

Next we compute the polynomials defined in Equations (2)-(5):

[TABLE]

The next step is to enumerate all solutions to the equation $f_{2}(x_{3},x_{4})=\pm 1$. We do this following the method laid out in step 5.

Write $f_{2}=ax_{3}^{2}+bx_{3}x_{4}+cx_{4}^{2}$, and then choose a generator $\gamma$ for the ideal $I=a\mathbb{Z}+((b+\sqrt{\Delta_{F}})/2)\mathbb{Z}$. Because in this case $I=\mathcal{O}_{F}$, we will choose $\gamma=1$. A fundamental unit for $\mathcal{O}_{F}$ is

[TABLE]

Now for each choice of sign and value of $i$ we compute $\sigma=\pm\epsilon^{i}\gamma$ and write

[TABLE]

as in step 55.3.

The remaining steps of the algorithm are straightforward, so we will skip ahead to compute the bound on $i$ in order to find all super-isolated Weil $p$-numbers with $p\leq 2^{261}$. We first compute the constants from Section 3.2.3.

Notice that $f_{2}(a_{3},a_{4})=\pm 1$ implies that

[TABLE]

Therefore we can bound $|a_{3}|$ from above by

[TABLE]

Next we want to bound $|a_{4}|$ from below by an exponential function in $i$. Following the proof of Lemma 32,

[TABLE]

Since $\gamma=1$ and $\max(|\phi_{1}(\epsilon)|,|\phi_{2}(\epsilon)|)=\frac{1+\sqrt{5}}{2}\geq 3/2$, we have

[TABLE]

Next we want to bound $P(a_{1},a_{2},a_{3},a_{4})$ from below in terms of $|a_{4}|$. We follow the same steps as in the proof of Lemma 33. For simplicity, we will assume that $(a_{1},a_{2},a_{3},a_{4})$ is a solution to Equations (14)-(16). In our case, these equations are

[TABLE]

Note that integral solutions to these equations exist, for example, $x_{1}=115,x_{2}=-45,x_{3}=17,x_{4}=-3$. This solution comes from setting $i=7$.

By solving each of these constraints in terms of $x_{4}$, we have

[TABLE]

Substituting these into the polynomial $P(x_{1},x_{2},x_{3},x_{4})$ as in the proof of Lemma 33, we have

[TABLE]

In particular,

[TABLE]

for all $x_{4}>0$.

We saw above that for each integer $i$, any associated pair $(a_{3},a_{4})$ (as computed in step 5 of the algorithm in Section 3.2.1) satisfies

[TABLE]

If the tuple happens to satisfy Equations (14)-(16), then

[TABLE]

So in order to capture all super-isolated Weil $p$-numbers with $p\leq 2^{261}$ which satisfy the constraints above, we have to check all $i$ with $|i|\leq 118$. The bound for other choices of signs in Equations (14)-(16) can be computed similarly.