Smart Attack - Elliptic curves over and formal groups
This small exposition aims to give a sketch of how the Smart attack works. One can find the precise details in Silverman AEC Exercise 7.13.
Notation used:
is a characteristic local field with discrete normalized valuation
is the ring of integers of
a uniformizer of
is the maximal ideal of
is the residue field of
is the characteristic of
is the order of
an elliptic curve over
The outline of the Smart attack can be summarized as:
We have an exact sequence due to Hensel’s lemma, and we have an isomorphism and finally an isomorphism of formal groups . In this post we shall attempt to decipher this summary.
For some intuition, one can consider the case that commonly appears in the Smart attack:
Exact sequence
First we shall consider the reduction map mod . For any point , by choosing suitable homogeneous coordinates, when we take mod on each coordinate, we get a new point . In general, we denote reduction mod by adding a on top. For instance given the point , the reduction mod gives the point . This reduction map gives us the curve .
Let be the group of nonsingular points on . Since these points are nonsingular, we can lift them up to points in . This suggests we define the group . This gives us a surjective map . The kernel of this map is evidently every point that gets mapped to the identity of , hence we define as the kernel of reduction. Hence by definition, we have the exact sequence
(One should verify the maps are indeed group morphisms)
Before we go on, we need a brief discussion on formal groups.
Formal groups
Intuitively, a formal group is a group law that is not explicitly defined over any set. The simplest example is the additive formal group, given by . We first define a formal group law over a ring :
Definition: A one parameter commutative formal group law over a ring is a power series satisfying:
associativity
commutativity
As one typically can’t sum infinitely many elements in a ring, the formal group associated with the formal group law can only take on values on the nilpotent elements of . However in the case of rings with a valuation, the notion of convergence is well defined, so in such cases the formal group can take on values in the elements with positive valuation. We denote as the group associated with the formal group law taking values in . Typically would be the nilradical but in the case of rings with valuation, can be any ideal.
Example: The formal group law corresponds to addition and the formal group law corresponds to multiplcation. The power series corresponds to velocity addition in special relativity. We have .
We shall now construct the formal group associated to an elliptic curve . Suppose we are given the Weiestrass equation of :
In this presentation, every point in the elliptic curves is given by two variables, while our formal group law can really only take in one variable. This motivates us to perform the substitution and we obtain
Now by repeatedly substituting the expression into itself and by taking limits, we can obtain . This gives us a one parameter parametrization of points on the curve. Let be the corresponding point on the curve, we define the elliptic curve formal group law as
For notation purposes, we let be the cprresponding point on the curve.
Like most algebric objects, we have a notion of morphisms of formal groups as well:
Definition: A morphism of formal group laws is a power series such that
Example We have the identity for every formal group law. Consider the power series over a -algebra , this is a morphism and it has an inverse, , hence the formal group laws and are isomorphic over -algebras.
We see that we have found an isomorphism between and , which would make the discrete log problem quite easy whenever this exists. So now our goal is to find such an isomorphism for other formal groups. If we can find an isomorphism , the discrete log problem on the corresponding curve should be computatinally easy to solve. This isomorphism is given by the logarithm of formal groups:
Definition: For a formal group , is an isomorphism from to .
For -algebras, such an isomorphism always exists and is given by
where we require , fixing the constant of integration. One can quickly verify that we recover in the case of . In the case of elliptic curves, the differential being integrated is the classic invariant differential of an elliptic curve
As the inverse of may not converge for a formal group associated with , we may not always have the isomorphism , however for charateristic local fields (using the convention at the start), we have
is an isomorphism if .
In summary, each point on a curve can be parametrized by a single parameter , with being the identity. This gives rise to a formal group law which takes this parameter as its input and we have an isomorphism .
Smart attack
Evidently is isomorphic to the group of points on such that has positive valuation. This turns out to be precisely the group that we defined above as all such points must be in the kernel of the reduction map, hence nonsingular. From here we’re almost done. Suppose is a group of order and suppose we have in . Let be the composite map . Lift to points , then since , we have
which gives us some as long as . Hence is a well defined multiplication map of , which gives us a solution to the DLP over .
References
Johannes Anschütz - Lubin-Tate Spaces (Sommersemester 2021) lecture notes
Joseph H. Silverman - The Arithmetic of Elliptic Curves