Prelude to the current state of mathematics and AI.

In order to address Isogeny Based Cryptography, we will need to have a crash course on mathematical structures. This will also hopefully bleed into other aspects of your cryptographic research.

There are generally three motivations for pools studying mathematics are:

1. Those who primarily care about results, which are the theorems.
2. Those who care about the proofs of such results.
3. And those who do math for the love of the game.

I am of the second type. I personally care about the proofs of such results, and being able to understand these notions and concepts we use freely should be inherently studied from the ground up. People who are of this second family generally only label theorems as a bookmark that summarizes the proof itself, but provides less value than the proof that found its existence. This is to say I find that the reasoning behind a theorem is more illuminating than its statement alone.

Mathematicians against the current state of mathematics because of AI but are fine with utilizing AI to advance mathematics, in a parallel manner, are generally of this second family as well. This is generally what the endorsers of A Severe Misalignment of AI in Mathematics are for. Of course, there are those completely against the use of AI in any regard.

Introduction

In this reading group, we will emphasize the reasoning behind definitions and theorems. Our goal is to understand not only which results hold, but why they hold and how they help us study isogenies.

Also please check out Note 33 for Zichen's comment on cosets and subgroups.

We begin our study of Isogeny Based Cryptosystems by providing an idea of what an Isogeny is informally, and then formally building up it's toolbelt.

Question 1What is an isogeny?#

An isogeny is a nonconstant morphism between elliptic curves that preserves their group structure and identities.

Our goal is to eventually understand each of these terms, and also be able to state how it all relates back to our cryptosystem.

Groups

Definition 2Binary Operation#

Given a set $G$, we define a binary operation as:

$$\mu : G\times G\longrightarrow G,\qquad (a,b)\longmapsto ab$$

This operation is closed, meaning every operation maintains being within the set same $G$.

Definition 3Semigroup#

A set $(G,\mu)$ with a binary operation $\mu$ and is associative.

Definition 4Monoid#

A semigroup $(G,\mu)$ that contains an identity.

Definition 5Group#

A group is a monoid $(G,\mu)$ that also has inverses for every element. Both identity and element inverses are unique. If $b$ is the inverse of $a$, then we write $a^{-1} = b$.

Example 6Additive Integers are a group#

The group $(\mathbb{Z},+)$ has identity zero, inverse of $n$ is $-n$. But notice that $(\mathbb{Z},\cdot)$ is only a monoid since most integers do not have inverses closed within the integers.

For the sake of simplicity, we will always denote $G$ as a group unless explicitly said.

Definition 7Abelian (commutative)#

If $ab = ba$ for every $a,b\in G$, then the group is abelian.

This is not a requirement to be abelian. However, from now on, the groups in the lecture are abelian and written additively.

Definition 8Subgroup#

A subgroup of $G$ is a subset $H\subseteq G$ that contains $0_G$ and is closed under addition and additive inverses. We write $H\leq G$.

The associativity of the operation on $H$ is inherited from $G$.

Definition 9Integer multiples#

For a positive integer $r$, define

$$[r]P=\underbrace{P+\cdots+P}_{r\text{ terms}}.$$

Also define $[0]P=0_G$ and $[-r]P=-([r]P)$.

Associativity lets us write repeated sums without specifying parentheses. The familiar rules

$$[r+t]P=[r]P+[t]P,\qquad [r]([t]P)=[rt]P$$

follow by grouping repeated sums, with inverses handling negative integers.

Definition 10Cyclic subgroup and order#

The cyclic subgroup generated by $P$ is

$$\langle P\rangle=\{[r]P:r\in\mathbb Z\}.$$

The order of $P$ is the least positive integer $r$ for which $[r]P=0_G$, if such an integer exists. Otherwise, $P$ has infinite order.

A group $G$ is cyclic if $G=\langle P\rangle$ for some $P\in G$.

Example 11Element order and group size#

In $G=\mathbb Z/12\mathbb Z$, take $P=8$. Then

$$[0]P=0,\qquad [1]P=8,\qquad [2]P=4,\qquad [3]P=0.$$

Thus

$$\langle 8\rangle=\{0,4,8\},$$

and $8$ has order $3$. The group $G$ has $12$ elements. The order of this element and the size of its ambient group are different quantities.

Group Homomorphism

Definition 12Group homomorphism#

Let $G$ and $H$ be additive groups. A function $f:G\to H$ is a homomorphism if

$$f(P+Q)=f(P)+f(Q)$$

for every $P,Q\in G$.

Definition 13Surjective homomorphism#

A surjective homomorphism is one that maps all elements from the domain to the codomain. Denoted in a mapping as $G \twoheadrightarrow H$.

Every $h\in H$ equals $f(g)$ for atleast one $g\in G$.

Definition 14Injective homomorphism#

An injective homomorphism is one that maps any valid element from the domain only once to the codomain. Denoted in a mapping as $G \hookrightarrow H$.

$f(P) = f(Q)$ implies $P = Q$.

Definition 15Isomorphism#

A bijective homomorphism is an isomorphism. If an isomorphism exists, we write $G\cong H$. Denoted in a mapping as $G \overset{\sim}{\longrightarrow} H$.

Definition 16Automorphism#

An isomorphism:

$$f : G \overset{\sim}{\longrightarrow} G$$

is known as an automorphism.

Example 17Reduction of residue classes#

Consider

$$f:\mathbb Z/12\mathbb Z\longrightarrow\mathbb Z/4\mathbb Z, \qquad f([a]_{12})=[a]_4.$$

This is well-defined meaning if $a-b=12k$, then $a-b=4(3k)$, so equal classes modulo $12$ give equal classes modulo $4$.

It is a homomorphism because

$$\begin{aligned} f([a]_{12}+[b]_{12}) &=f([a+b]_{12})\\ &=[a+b]_4\\ &=[a]_4+[b]_4\\ &=f([a]_{12})+f([b]_{12}). \end{aligned}$$

Definition 18Kernel and image#

For a homomorphism $f:G\to H$, define

$$\ker f=\{P\in G:f(P)=0_H\}$$

and

$$\operatorname{im}f=\{f(P):P\in G\}.$$

Proposition 19The kernel is a subgroup#

For a group homomorphism $f:G\to H$, we have $\ker f\leq G$.

Proof#

We have $f(0_G)=0_H$, so $0_G\in\ker f$.

If $P,Q\in\ker f$, then

$$f(P+Q)=f(P)+f(Q)=0_H+0_H=0_H.$$

Thus $P+Q\in\ker f$. Also,

$$f(-P)=-f(P)=-0_H=0_H,$$

so $-P\in\ker f$.

□

Exercise 1#

Prove that a homomorphism $f:G\to H$ is injective if and only if $\ker f=\{0_G\}$.

Proof#

Recall that injectivity means that $f(P)=f(Q)$ implies $P=Q$. We prove the two implications separately.

Suppose first that $f$ is injective. If $P\in\ker f$, then $f(P)=0_H$. We also know that $f(0_G)=0_H$. Therefore

$$f(P)=f(0_G).$$

Injectivity gives $P=0_G$. Thus every kernel element equals $0_G$. Conversely, $0_G$ always belongs to the kernel, so

$$\ker f=\{0_G\}.$$

Now suppose $\ker f=\{0_G\}$. To prove injectivity, take any $P,Q\in G$ with $f(P)=f(Q)$.

$$\begin{aligned} f(P-Q) &= f(P) - f(Q)\\ &= 0_H. \end{aligned}$$

Therefore:

$$P-Q\in\ker f.$$

The only element in the kernel is $0_G$, so $P-Q=0_G$. Add $Q$ to both sides:

$$(P-Q)+Q=0_G+Q.$$

Associativity and the inverse property simplify this to $P=Q$. Hence $f$ is injective.

□

Cosets and Quotients

Throughout this section, $G$ is an abelian group written additively, and $K\leq G$ is a subgroup. The abelian assumption will let us form a quotient by any subgroup without introducing normal subgroups. This should reduce confusion from the lecture.

Cosets

Definition 20Coset#

For $P\in G$, the coset of $K$ containing $P$ is

$$P+K=\{P+T:T\in K\}.$$

Example 21Cosets in a cyclic group#

Let $G=\mathbb Z/12\mathbb Z$ and $K=\{0,4,8\}$. The distinct cosets are

$$\begin{aligned} K&=\{0,4,8\},\\ 1+K&=\{1,5,9\},\\ 2+K&=\{2,6,10\},\\ 3+K&=\{3,7,11\}. \end{aligned}$$

For example, $5+K=1+K$. Different representatives can describe the same coset, just as different integers can describe the same residue class.

Proposition 22Cosets have the same size as the subgroup#

The map

$$K\longrightarrow P+K,\qquad T\longmapsto P+T$$

is a bijection.

Proof#

It is surjective by the definition of $P+K$. It is injective because $P+T=P+U$ implies $T=U$ by cancellation.

□

We didn't discuss this in the lecture, but this is an important theorem brought up by Zichen.

Theorem 23Lagrange's theorem for finite abelian groups#

If $G$ is finite and $K\leq G$, then

$$|G|=[G:K]|K|,$$

where $[G:K]$ denotes the number of distinct cosets of $K$. In particular, $|K|$ divides $|G|$.

Proof#

The distinct cosets partition $G$, and every coset contains exactly $|K|$ elements. Counting the elements in this partition gives the formula.

□

Quotient Groups

Definition 24Quotient group#

The quotient $G/K$ is the set of cosets

$$G/K=\{P+K:P\in G\},$$

with addition defined by

$$(P+K)+(Q+K)=(P+Q)+K.$$

Construction 25The quotient map#

Define

$$\pi:G\longrightarrow G/K,\qquad \pi(P)=P+K.$$

Then

$$\pi(P+Q)=(P+Q)+K=(P+K)+(Q+K)=\pi(P)+\pi(Q),$$

so $\pi$ is a homomorphism. It is surjective because every coset has a representative.

The identity in $G/K$ is $K$, so

$$P\in\ker\pi\quad\Longleftrightarrow\quad P+K=K \quad\Longleftrightarrow\quad P\in K.$$

Therefore $\ker\pi=K$.