Smart Attack - Elliptic curves over Qp and formal groups

This small exposition aims to give a sketch of how the Smart attack works. One can find the precise details in Silverman AEC Exercise 7.13.

Notation used:

The outline of the Smart attack can be summarized as:

We have an exact sequence 0E1(K)E0(K)E~ns(K)0 due to Hensel’s lemma, and we have an isomorphism E1(K)E^(m) and finally an isomorphism of formal groups logE^:E^(m)Ga^(m). In this post we shall attempt to decipher this summary.

For some intuition, one can consider the case that commonly appears in the Smart attack:

Exact sequence

First we shall consider the reduction map mod π. For any point PPn(K), by choosing suitable homogeneous coordinates, when we take mod π on each coordinate, we get a new point P~Pn(k). In general, we denote reduction mod π by adding a  ~ on top. For instance given the point [5,6,7]P2(Q3), the reduction mod 3 gives the point [2,0,1]P2(F3). This reduction map gives us the curve E~/k.

Let E~ns(k) be the group of nonsingular points on E~. Since these points are nonsingular, we can lift them up to points in E(K). This suggests we define the group E0(K)={PE(K):P~E~(k)}. This gives us a surjective map E0(K)E~(k). The kernel of this map is evidently every point that gets mapped to the identity O~ of E~(k), hence we define E1(K)={PE(K):P~=O~} as the kernel of reduction. Hence by definition, we have the exact sequence

0E1(K)E0(K)E~(k)0

(One should verify the maps are indeed group morphisms)

Before we go on, we need a brief discussion on formal groups.

Formal groups

Intuitively, a formal group is a group law that is not explicitly defined over any set. The simplest example is the additive formal group, given by G^a(X,Y)=X+Y. We first define a formal group law over a ring R:

Definition: A one parameter commutative formal group law F over a ring R is a power series FR[[X,Y]] satisfying:

As one typically can’t sum infinitely many elements in a ring, the formal group associated with the formal group law can only take on values on the nilpotent elements of R. However in the case of rings with a valuation, the notion of convergence is well defined, so in such cases the formal group can take on values in the elements with positive valuation. We denote F(I) as the group associated with the formal group law taking values in I. Typically I would be the nilradical but in the case of rings with valuation, I can be any ideal.

Example: The formal group law G^a=X+Y corresponds to addition and the formal group law G^m=X+Y+XY=(1+X)(1+Y)1 corresponds to multiplcation. The power series X+Y1+XY corresponds to velocity addition in special relativity. We have G^a(pZp)=(pZp)+Zp+.

We shall now construct the formal group E^ associated to an elliptic curve E. Suppose we are given the Weiestrass equation of E:

y2+a1xy+a3y=x3+a2x2+a4x+a6

In this presentation, every point in the elliptic curves is given by two variables, while our formal group law can really only take in one variable. This motivates us to perform the substitution z=xy,w=1y and we obtain

w=z3+(a1z+a2z2)w+(a3+a4z)w2+a6w3

Now by repeatedly substituting the expression into itself and by taking limits, we can obtain w=f(z)Z[a1,,a6][[z]]. This gives us a one parameter parametrization of points on the curve. Let g(z) be the corresponding point on the curve, we define the elliptic curve formal group law as

E^(X,Y)=g1(g(X)+g(Y))

For notation purposes, we let (x(z),y(z)) be the cprresponding point on the curve.

Like most algebric objects, we have a notion of morphisms of formal groups as well:

Definition: A morphism ϕ:FG of formal group laws is a power series ϕR[[X]] such that

Example We have the identity ϕ(X)=X for every formal group law. Consider the power series over a Q-algebra ϕ(X)=log(1+X)=XX22+X33+, this is a morphism ϕ:G^aG^m and it has an inverse, eX1=X+X22!+X33!+, hence the formal group laws G^a and G^m are isomorphic over Q-algebras.

We see that we have found an isomorphism between G^a and G^m, which would make the discrete log problem quite easy whenever this exists. So now our goal is to find such an isomorphism for other formal groups. If we can find an isomorphism E^G^a, the discrete log problem on the corresponding curve should be computatinally easy to solve. This isomorphism is given by the logarithm of formal groups:

Definition: For a formal group F, logF is an isomorphism from F to G^a.

For Q-algebras, such an isomorphism always exists and is given by

logF(T)=dTXF(0,T)

where we require logF(0)=0, fixing the constant of integration. One can quickly verify that we recover log(1+T) in the case of G^m. In the case of elliptic curves, the differential being integrated is the classic invariant differential of an elliptic curve

dzXE^(0,z)=dx(z)2y(z)+a1x(z)+a3

As the inverse of logF may not converge for a formal group associated with F, we may not always have the isomorphism F(I)G^a, however for charateristic 0 local fields (using the convention at the start), we have

logF:F(mr)G^a(mr)

is an isomorphism if r>v(p)p1.

In summary, each point on a curve can be parametrized by a single parameter z, with z=0 being the identity. This gives rise to a formal group law E^ which takes this parameter as its input and we have an isomorphism E^G^a.

Smart attack

Evidently E^(m) is isomorphic to the group of points on E(K) such that xy has positive valuation. This turns out to be precisely the group E1(K) that we defined above as all such points must be in the kernel of the reduction map, hence nonsingular. From here we’re almost done. Suppose Ens(k) is a group of order q and suppose we have nP~=Q~ in Ens(k). Let log be the composite map E1(K)E^(m)G^a(m). Lift P~,Q~ to points P,QE0(K), then since nPQE1(K), we have

nlog(qP)log(qQ)=qlog(nPQ)=0(modmf+1)

which gives us some nOmf=O(q) as long as log(qP)m2. Hence n is a well defined multiplication map of E~(k), which gives us a solution to the DLP over E~(k).

References