Part I Introduction Curves in Cryptography

The goal of cryptography is to enable two entities to secretely and efficiently exchange data, and to make any non-authorized third party -the attacker -unable to read it. To encrypt/decrypt the data, a secret key is used, which must be shared by the sender and the receiver. For this reason, those schemes are called symmetric. With the ever growing number of entities willing to securely communicate, the key distribution for symmetric ciphers became a major concern. The advent of public-key cryptography and asymmetric schemes answered this problem, and secured communication protocols now rely on an asymmetric brick to exchange a key for a symmetric cipher. The security of asymmetric schemes is based on "hard" mathematical problems.

In modern Cryptography, "hard" means that the computation would take a tremendous amount of times (for example, billions of years) with state-of-the-art machines. For nowaday standards, reasonable hardness starts at 2 128 binary operations, but 2 80 operations are still accepted for less crucial applications. Complexity classes for algorithms are also used to assess the difficulty of a computational problem. The running time of an algorithm solving a cryptographic problem can usually be expressed as a function of the size t of the inputs. With this notion of difficulty, a problem is considered hard when the best known algorithm to solve it belongs runs in a time exponential in t. Improvements are made when a subexponential algorithm that solves the problem is found, and the problem is considered unfit for cryptgraphic purpose -we sometime say it is "broken" -if a (quasi-)polynomial time algorithm can be designed (and implemented).

Asymmetric Cryptography and Discrete Logarithms

Public-key schemes are called asymmetric because the two parties involved do not share the same piece of information for an exchange. Indeed, in an asymmetric protocol, the sender uses the public key of the receiver to encrypt his message and send it to the receiver, who can then decrypt it using the private key associated to the public key. The sender thus only has access to the public key, while the receiver knows both. It should also be hard for an attacker to decrypt the message, while the owner of the associated private key can do it quickly. In other words, such an encryption scheme can be seen as a one-way function with a trapdoor, the trapdoor being the private key. The terminology highlights that it is easy to compute the output of such functions from the input, while it should be hard to recover the input from a given output without the additional information given by the trapdoor.

Officially, Public-key cryptography was born at the end of the 70's, when Diffie and Hellman [START_REF] Diffie | New directions in cryptography[END_REF] designed a key exchange protocol answering the problem of key-distribution in symmetric cryptography. Diffie-Hellman's solution used the exponentiation in a finite field as a one-way function, the trapdoor being the exponent. The underlying mathematical problem is known as the Computational Diffie-Hellman Problem (CDHP):

Given elements g, g a , g b in an abelian group G, compute h = g ab . This problem is really close to the well-known Discrete Logarithm Problem (DLP), which can be stated as follows:

Let g, h be elements of an abelian group G. Find, if it exists, an integer x such that g x = h.

In fact, there are several instances where these problems are equivalent. However it is not known if this equivalence holds in the general case. Another protocol based on the problem of factoring large integers (IF) was proposed by Rivest, Shamir and Adleman [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF], and it is better known by the initials RSA of its authors. Asymmetric cryptography grew rapidly, with new protocols answering several security-related problems. For example, the Digital Algorithm Signature (DSA), based on the DLP, gives a way to guarantee the authentication of the sender. However, even the best things must come to an end. Both DLP and RSA-based cryptosystems are broken by fast quantum algorithms. Hence, the advent of the quantum computer should, in time, seal their doom. A big part of the community's efforts is now dedicated to the development of new mathematical foundations for cryptographic protocols (Lattices, Correcting codes, ...), gathered into the kingdom of Post-Quantum Cryptography. Nevertheless it is too soon to bury the Discrete Logarithm Problem and Integer Factorization, as a practical quantum computer is still nowhere to be seen, and is not expected in the next 20 years. Moreover, the majority of the current cryptosystems have bricks that rely on DLP or IF. It is fundamental to continue their study to ensure that the transition to the post-quantum world is smooth, and that our current notion of security does not crumble down suddenly.

Both IF and DLP can be used for key exchange and signature, but which one should we use in practice? The answer depends on the situation, but the question can mainly be reduced to a problem of the size of the key.

Key size and Elliptic Curves

The theoretical security of an assymetric cryptographic protocol is measured by the minimal known number of binary operations to recover the key. An immediate way to recover the key is by trying all the possibilities until the key is found -the brute force attack. If a given key can be represented using t bits, then at worst 2 t operations are needed to find the key. This gives an upper bound on any algorithm for attacking a cryptosystem, and in this way, it can be seen that the hardness of an assymetric scheme depends on the key size. While keys in symmetric cryptography are rarely larger than 256 bits, the same cannot be said for asymmetric cryptography. It is recommended by the National Institute of Standards and Technology (NIST) that any RSA key should at least be of 2048 bits to achieve a minimal security1 , and it is considered that a Finite Field Diffie-Hellman key exchange has the same security as a RSA.

In contexts where the key size is critical, such as embedded systems, how can one design a strong asymmetric scheme with rather small keys? This problem was adressed when Miller [START_REF] Miller | Use of elliptic curves in cryptography[END_REF] and Koblitz [START_REF] Koblitz | Elliptic curve cryptosystems[END_REF] proposed to use the group of rational points of an elliptic curve defined over a finite field as a basis for a DLP based cryptosystem. This marked the birth of Curve Based Cryptography, which has various developments and problematics. For DLP based cryptosystems, it is accepted that a 160 bits key using elliptic curve achieves the weakest accepted security, and that less than 256 bits are enough to achieve a 2048 bits RSA key security. In particular, elliptic curve-based cryptosystems should always be preferred when key size matters.

As we have seen already, the Discrete Logarithm Problem can be stated over any abelian group; the reader may wonder at first how to link elliptic curves and abelian groups. In fact, any algebraic curve can be related to an abelian group, and we now dive into more details on this topic.

Discrete Logarithms over Algebraic Curves

The development of algebraic geometry showed that it is a natural association by introducing the Jacobian variety of a curve. Far more than just an abelian group, they enjoy the structure of Abelian varieties, that is to say projective varieties endowed with a group law that can be expressed using rational functions of the coordinates. Rational functions are close to polynomial functions, so that computational methods and therefore cryptosystems can be designed on Abelian Varieties. The dimension and the structure of the Jacobian variety depends on its underlying curve.

The family of Algebraic Curves is a vast and fascinating yet wild jungle. A classification of curves can be done by considering their genus, which also determine the dimension of the Jacobian variety. A genus 0 curve is more or less a projective line, with a trivial Jacobian variety. Thus, we are not interested in them in this work. Non-trivial Jacobian varieties start to appear with genus 1 curves, which are exactly the elliptic curves. Genus 2 curves are Hyperelliptic curves, and can be thought as their bigger sisters. When the genus is at least 3, a distinction appears between hyperelliptic curves and other curves.

Theoretically, all algebraic curves could be used to design a DLP-based cryptosystem. However, from a practical and computational point of view, only elliptic curves and hyperelliptic curves of genus 2, which means Abelian Varieties of dimension 1 and 2, are considered. This is due to two reasons: first, their arithmetics are the most efficient speed-wise and size-wise, which is obviously crucial for practical implementations. Second, the work of the cryptanalysts during the 20 last years [ADH99, Eng02, EG02, Die06, Gau00, EGT11] showed relative weaknesses for the other types. In term of raw security, it also happens that no efficient attack is known for most elliptic curves and hyperelliptic curves of genus 2, making them a priori stronger. While the reader now has an idea of which curves are strong, he might want to learn more about the attacks they are strong against and proceed to the next paragraph.

Computations of Discrete Logarithms

Not counting brute force, there are mainly three approaches to compute a discrete logarithm in a finite abelian group:

• generic algorithms only rely on the group law, and make no use of additional structures, e.g a ring structure or a geometrical structure;

• Index-Calculus algorithms: while countless variants exists, the main outline of the algorithm is always the same:

1. select some elements in the target group; they form the factor base.

2. Find enough linear combinations (relations) between the discrete logarithms of those elements. This phase is called the harvesting, and make intensive usage of additional structures (field structure, geometric or number theoretic properties, ...).

3. Solve the linear system given by the relations and deduce the wanted discrete logarithm from the solution.

• transfer attacks, as the name suggests, transfer an instance of the DLP from a group to another -the additional structures may even be different -where an efficient method among the previous two may exist.

There is no hope to achieve an efficient attack using generic algorithms, as showed by Nechaev [START_REF] Nechaev | Complexity of a determinate algorithm for the discrete logarithm[END_REF], then Shoup [START_REF] Shoup | Lower bounds for discrete logarithms and related problems[END_REF]: such methods are at best exponential in the size of the biggest prime factor of the target group's order. The family of Index-Calculus algorithms is particularly rich2 , and lead to the first subexponential [START_REF] Adleman | A subexponential algorithm for discrete logarithms over hyperelliptic curves of large genus over GF(q)[END_REF][START_REF] Enge | An L(1/3) discrete logarithm algorithm for low degree curves[END_REF] and quasipolynomial [START_REF] Barbulescu | A heuristic quasi-polynomial algorithm for discrete logarithm in finite fields of small characteristic[END_REF] algorithms for certain classes of curves and finite fields, respectively. Transfer attacks target very specific curves: supersingular elliptic curves [START_REF] Menezes | Reducing elliptic curve logarithms to logarithms in a finite field[END_REF][START_REF] Frey | A remark concerning m-divisibility and the discrete logarithm in the divisor class group of curves[END_REF] and anomalous curves [START_REF] Smart | The discrete logarithm problem on elliptic curves of trace one[END_REF][START_REF] Semaev | Evaluation of discrete logarithms in a group of p-torsion points of an elliptic curve in characteristic p[END_REF], curves defined over extension fields [START_REF] Gaudry | Constructive and destructive facets of Weil descent on elliptic curves[END_REF][START_REF] Diem | The GHS attack in odd characteristic[END_REF]. It turns out that in this thesis, we are particularly interested in the latter curves.

Decomposition attacks and Algebraic Cryptanalysis

For curves defined over extension fields, a variant of Index-Calculus called Decomposition attack leads to promising asymptotic complexities [START_REF] Gaudry | Index calculus for abelian varieties of small dimension and the elliptic curve discrete logarithm problem[END_REF]Nag10]. There, one relation translates to a geometric property, which is modelled by a polynomial system using the concept of Weil Descent. In particular, these attacks belong to the realm of Algebraic Cryptanalysis.

Their main concern is therefore the difficulty to solve polynomial systems, and a practical Decomposition attack first needs an efficient way of solving the systems arising from the harvesting. While solving polynomial systems over finite fields is known to be hard in general [START_REF] Garey | Computers and Intractability; A Guide to the Theory of NP-Completeness[END_REF], system arising from practical applications such as algebraic cryptanalysis are not random. This non-randomness sometimes hides algebraic properties, which may be used to simplify the solving process. It remains to clarify what we mean by "solving a system" in our applications.

Polynomial System Solving (PoSSo)

Polynomial systems appear in several practical applications, and "solving" can have a different meaning depending on the context. In algebraic cryptanalysis, solving means finding a way to represent all the solutions of the system in (an algebraic closure of) the base field. When the number of solutions is finite, we also want to list them all. The usual strategy rely on Gröbner bases methods. Informally, the idea is to transform the defining equations of the system into other equations admitting the same space of solutions, but with a shape that enables the solving. Introduced in Buchberger's thesis [START_REF] Buchberger | Ein Algorithmus zum Auffinden der Basiselemente des Restklassenrings nach einem nulldimensionalen Polynomideal[END_REF], efficient algorithms to compute Gröbner bases using linear algebra have been designed since [Laz83, [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF][START_REF] Faugère | A new efficient algorithm for computing Gröbner bases without reduction to zero (F5)[END_REF], and are contained in several computer algebra language (Magma [START_REF] Bosma | The Magma algebra system I: the user language[END_REF], Maple, Sage, Singular, ...). While other methods exist, using Gröbner bases allows for a better understanding of the complexity of the resolution and therefore the efficiency of an algebraic cryptanalysis. Besides, the additional properties of the system can be read from a Gröbner basis, and exploited to speed up the computation: symmetries of the equations (physics-related [START_REF] Svartz | Solving zero-dimensional structured polynomial systems[END_REF], cryptographyrelated [Spa12, Huo13, UDP15]), multi or weighted homogeneity [START_REF] Spaenlehauer | Solving multi-homogeneous and determinantal systems: algorithms, complexity, applications[END_REF][START_REF] Faugère | On the complexity of computing Gröbner bases for weighted homogeneous systems[END_REF]...

Motivations and objectives of this thesis

This thesis focuses on the algebraic cryptanalysis of the Discrete Logarithm Problem in the Jacobian variety of algebraic curves of genus greater than 1. A first reason is that genus 2 curves have been suggested as potential standards [START_REF] Byramjee | Classification of genus 2 curves over F 2 n and optimization of their arithmetic[END_REF], and that recent works on their arithmetic have reached practical competitivity with elliptic curves (genus 1 curves) [START_REF] Bos | Fast cryptography in genus 2[END_REF][START_REF] Chung | Fast, uniform, and compact scalar multiplication for elliptic curves and genus 2 Jacobians with applications to signature schemes[END_REF][START_REF] Lubicz | Arithmetic on abelian and Kummer varieties[END_REF][START_REF] Renes | µKummer: efficient hyperelliptic signatures and key exchange on microcontrollers[END_REF]. Moreover, because of transfer attacks, a Discrete Logarithm Problem over an elliptic curve may be transferred over a curve of higher genus, where more efficient attacks may be known. Our main topic is the harvesting phase of the Index-Calculus algorithm, where efficiency can only be achieved by a deep understanding of the algebraic modelling, depending on the variant.

Motivations

Standardization of Elliptic Curves Several families of curves have been excluded from practical DLP-based applications after the work of the community of both cryptanalists and mathematicians (supersingular [START_REF] Frey | A remark concerning m-divisibility and the discrete logarithm in the divisor class group of curves[END_REF], anomalous [START_REF] Smart | The discrete logarithm problem on elliptic curves of trace one[END_REF][START_REF] Semaev | Evaluation of discrete logarithms in a group of p-torsion points of an elliptic curve in characteristic p[END_REF], non-hyperelliptic C ab curves of small genus [START_REF] Diem | An index calculus algorithm for plane curves of small degree[END_REF], ...). Nowadays, Elliptic Curves Cryptosystems are already widely developed. However, it is always possible that weaknesses of certain parameters may have been overlooked. For example, transfer attacks have been successfully combined with Decomposition attacks in [START_REF] Joux | Cover and decomposition index calculus on elliptic curves made practical -application to a previously unreachable curve over F q 6[END_REF] to threaten elliptic curves previously unreachable. The idea was to first transfer a DLP instance to an hyperelliptic curve of small genus (2 or 3) defined over a "small" extension field3 . Then a Decomposition attack was run over the hyperelliptic curve to compute the target Discrete Logarithm. While the overall computation remained experimental, the total running time vastly improved over the estimations using methods dedicated to elliptic curves. This is a reason why the standardization of elliptic curves cannot be done without a good understanding on the hardness of the DLP for higher genus curves.

Index-Calculus for higher genus curves The first subexponential Index-Calculus algorithm for curves was first heuristic [START_REF] Adleman | A subexponential algorithm for discrete logarithms over hyperelliptic curves of large genus over GF(q)[END_REF], and it took additional works [START_REF] Enge | Computing discrete logarithms in high-genus hyperelliptic Jacobians in provably subexponential time[END_REF][START_REF] Enge | A general framework for subexponential discrete logarithm algorithms[END_REF] to propose a rigorous analysis together with a (theoretical) algorithm. Several other variants are also theoretically well-understood (Gaudry's [Gau00], Diem's [START_REF] Diem | An index calculus algorithm for plane curves of small degree[END_REF], Decomposition attacks [START_REF] Gaudry | Index calculus for abelian varieties of small dimension and the elliptic curve discrete logarithm problem[END_REF][START_REF] Diem | On the discrete logarithm problem in elliptic curves[END_REF]Nag10]). For all those algorithms, the question of their practical efficiency and thus their implementation can be asked. A first example of an answer is the optimized graph implementation of [START_REF] Laine | Time-memory trade-offs for index calculus in genus 3[END_REF], but designed only for genus 3 non-hyperelliptic curves. Is it possible to design efficient implementations for other algebraic curves ? Other examples are given by the Decomposition attacks over elliptic curves of [FGHR14, FHJ + 14, GG14], where symmetries of the equations were exploited to sharpen the complexity bounds on the polynomial systems' solving. As stated before, no such improvements were known for Decomposition attacks over hyperelliptic curves, while they share many properties with elliptic curves. This lack of knowledge is particularly concerning for genus 2 curves, which have been suggested as potential alternatives to elliptic curves -and even became competitive [Gau07, GL09, LR16, BCHL16, CCS15, RSSB16] -until post-Quantum cryptography becomes mandatory. Improvements on both asymptotical and practical algorithmic of algebraic curves may reveal rule out new families of curves. They may even enable a complete computation of a discrete logarithm.

Computations of Discrete Logarithms

The best way to highlight weaknesses of curves is to estimate the running time to compute Discrete Logarithms in its Jacobian Variety, or even to sucessfully compute one. From the academic point of view, running a complete Index-Calculus on parameters achieving realistic security is also a proof-of-concept for improvements on the algorithmic aspect and weaknesses of a given family of curves. This can only be done if efficient methods are designed. While Decomposition attacks looked promising over elliptic curves, they reached a stalemate with [FHJ + 14]. On the other hand, over higher genus curves, no practical Decomposition attacks were known at the beginning of this thesis for extension degree greater than 2. Nagao's approach [Nag10] remained mostly theoretical, the only conceivable cases being when g = 2, 3 and n = 2, 3: these were the only situations where estimations could be done in [START_REF] Joux | Cover and decomposition index calculus on elliptic curves made practical -application to a previously unreachable curve over F q 6[END_REF], and the running time to find a single relations still prevented any practicality. However there were no real in-depth analysis of Nagao's approach.

It is natural to ask whether an efficient harvesting could be designed for particular curves or if the attack would stay theoretical. In the first case, computation of Discrete Logarithms or at least estimations on the necessary time are mandatory.

Objectives and Tools

First, this thesis aims at giving a clear framework on the various harvesting phases for Index-Calculus over Algebaic Curves of genus g ≥ 2 by defining new concepts or generalizing existing notions, enabling a systematic study and a rigorous analysis of the complexity of the harvesting. Another goal is to propose new theoretic and algorithmic methods for the resolution of polynomial systems with particular algebraic properties over finite fields. As polynomial systems are involved in Decomposition attacks, the analysis of the new approaches is done in order to improve the complexity bounds on the harvesting phase. This way, a better insight on the strength of certain curves is obtained, which in turn refines which curves can be made practical or not.

On the theoretical side of the necessary tools, basic algebraic geometry, and particularly the theory of algebraic curve and their Jacobian Varieties, is needed to rigorously describe the various modellings of the harvesting phase. Special properties of the sytems are modelled using Invariant theory, Group theory and Field theory. From the computational point of view, powerful computer algebra and efficient Gröbner basis libraries are needed to perform experiments and give proof-of-concept for the new notions we develop. We mainly used Magma 2.19 [START_REF] Bosma | The Magma algebra system I: the user language[END_REF], which contains an efficient implementation of F4 algorithm [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF], to run our experiments. On some occasions, the FGb package [START_REF] Faugère | FGb: A Library for Computing Gröbner Bases[END_REF] in the Maple computer algebra system is used.

Contributions Harvesting by Sieving

We design a Sieving approach to the harvesting phase in the classic Index-Calculus. Overall, such approaches are time-memory tradeoffs: cheap computations are stored instead of repeating expensive ones. We show how the reformulation of Sarkar-Singh's sieving approach to hyperelliptic harvesting [START_REF] Sarkar | A new method for decomposition in the Jacobian of small genus hyperelliptic curves[END_REF] can be generalized to all algebraic curves. Our approach can also be adapted to any variants of Index-Calculus (Large Primes [GTTD07], Singularity based [START_REF] Diem | Computing discrete logarithms with special linear systems[END_REF]). Our simpler reformulation also allows for an implementation that does not rely on sorting lists and can even prevent factorization of polynomials. Experiments and timings confirm that our approach perform better than both classical works by factors ranging from 3 to 7 (Tables 4.1 and 4.2). Those results can be found in Chapter 4 and lead to a publication at LatinCrypt 2015 [START_REF] Vitse | Improved sieving on algebraic curves[END_REF], co-authored with Vanessa Vitse.

Generalization of Semaev's Summation Polynomials

Before this thesis, Decomposition attacks were separated into two distinct worlds: the world of elliptic curves, whith Gaudry and Diem's usage of Summation Polynomial; and the world of other curves, where only Nagao's algorithm was known, using a more geometrical approach involving bases of Riemann-Roch spaces. Both ideas modelled the harvesting into solving polynomial systems with finite number of solutions. In Chapter 5 we present a new approach to the hyperelliptic decomposition attacks, by generalizing the notion of Summation Polynomials to Summation Ideals (Definition 5.4). In order to do this, we introduce new objects. For H a genus g imaginary hyperelliptic curve, let (P) stands for the canonical embedding of H into Jac(H ), and let m ≥ 2g + 1. Let the m-summation map be Σ m : H m -→ Jac(H ), defined by Σ m (P 1 , . . . , P m ) = ∑ m i=1 (P i ). We then define the m-Summation Variety of H as the set V m = Σ -1 m (O) = {(P 1 , . . . , P m ) : ∑ m i=1 (P i ) = O}, where O denotes the neutral element of Jac(H ), and obtain the following result.

Theorem 0.1. There exist an embedding of V m into the affine space A 2m-g given by polynomial equations.

The embedding is exhibited with a polynomial ideal I m ⊂ F[a 1 , . . . , a m-g , X 1 , . . . , X m ] (Theorem 5.3). The m th Summation Ideal is then defined as the elimination ideal I m ∩ F[X 1 , . . . , X m ], equivalently as the ideal describing the projection of V m over the m last coordinates, and we define Summation polynomials as any set of generators for the m th Summation Ideal (Definition 5.4). The geometric study of the projection shows that the codimension equals the genus of the curve. In other words, as soon as g ≥ 2, it can only be generated by sets of polynomials (of cardinality at least g) instead of one single polynomial as in Semaev's approach [START_REF] Semaev | Summation polynomials and the discrete logarithm problem on elliptic curves[END_REF]. Indeed, assuming the base field F is algebraically closed, we obtain the next results, which show that our new notion generalizes Semaev's: Proposition 0.2. For any m ≥ 2g + 1, a set S m of m th summation polynomials associated to H exists, and it verifies: S m (x) = 0 ⇔ ∃ y 1 , . . . , y n ∈ F such that P i = (x i , y i ) ∈ H , 1 i m, and

(P 1 ) + • • • + (P m ) = O.
The m th Summation Ideal is globally invariant under the action of the m th symmetric group S m , and a set of symmetric generators exists and can be algorithmically computed.

In particular, the elliptic (g = 1) Summation Polynomial is recovered this way, together with its known properties (symmetry, irreducibility). Although we focus on hyperelliptic curves, everything extends to any algebraic curve. We formulate a conjecture (Conjecture 5.8) for the degree of the Summation variety: Conjecture 0.3. Let S m be the symmetric group on m elements, and J m be the ideal generated by a symmetric set of Summation Polynomials. Then we have:

deg V m /S m = 2 m-g , deg J m = 2 m-g-1 .
This conjecture is verified on several examples of pairs (m, g) (see Tables 5.1 and 5.2). and is strenghtened both by intuition and the fact that it is known to be true when g = 1 [START_REF] Diem | On the discrete logarithm problem in elliptic curves[END_REF].

A Summation-flavoured algorithm for Decomposition attacks

The new Summation notion allows us to design a new algorithm to harvest relations in Decomposition attacks, mixing Gaudry's [START_REF] Gaudry | Index calculus for abelian varieties of small dimension and the elliptic curve discrete logarithm problem[END_REF] and Nagao's [Nag10]. There are two ways of finding decompositions using Summation Ideals that we sum up briefly:

1.

• Compute a symbolic Summation Set, with parameters for x-coordinates of points described by an element of Jac(H ).

• For an input R ∈ Jac(H ), evaluate it at the coordinates given by R.

• Build and solve the system describing a decomposition of R. It may not have a solution.

2.

• For an input R ∈ Jac(H ), compute a Summation Set already evaluated at the coordinates given by R.

• Build and solve the system describing a decomposition of R. It may not have a solution.

Then the efficiency of this algorithm, and of any harvesting phase in Decomposition attacks in general, can be measured by the number of solutions of the systems to solve. Both methods seem really close, and in genus 1, they are equivalent and give the same number of solutions -the first is usually preferred. However, we show using our previous conjecture that when the genus of the curve is greater than 2, the degree obtained with the first approach is greater in Nagao's approach by a factor 2 n(g-1) . This is confirmed by our experiments, and highlights the fundamental impact of the genus on the construction of the Jacobian Variety. The analysis is done by favoring a even more geometrical approach, and defining Specialized Summation Polynomials and Specialized Summation Variety associated to a fixed R ∈ Jac(H ):

V m,R = {(P 1 , . . . , P m ) :

m ∑ i=1 (P i ) = R}.
We also conjecture that deg V m,R = 2 m-2g . Overall, we obtain an algorithm that must solve systems with d Nag = 2 n(n-1)g solutions if the target curve has genus g and is defined over some F q n , which is the same as the degree obtained with a Nagao's modelling.

Degree reductions of the systems from Decomposition attacks, in even characteristic

As stated in the previous paragraph, the efficiency of the harvesting phase in Decomposition attacks can be estimated by the number D of solutions of the systems to solve. The reason behind this is that, in our situation, the bottleneck of the solving strategy for one system depends polynomially on D, see Section 1.3.3 for more details. In Decomposition attacks, D itself is exponential in the (square of the) extension degree, and exponential in the genus. Hence, for any hope of practical efficiency, this number must be reduced as much as possible. This can be done by exploiting the structure of the equations highlighted by the modelling. Such reduction were achieved in Decomposition attacks for elliptic curve in [FGHR14, FHJ + 14].

For Hyperelliptic Curves in even characteristic, we observe specific algebraic structures linked to the degree of equations generating the systems, and exploit them to reduce the number of solutions. Either in Nagao's modelling or Summation modelling, the systems are generated with the following procedure. Over a hyperelliptic curve H , a function with a known number of zeroes on the H can be expressed using a symbolic basis a 1 , . . . , a d of a certain linear space (see Riemann-Roch spaces, Definition 2.11). In particular, the intersection between H and such a function can be symbolically described by the coefficients of a polynomial in (F[a 1 , . . . , a d ]) [x], that we define as the Decomposition Polynomial (Definition 6.2). In even characteristic, we analyze the properties of its coefficients and show that one is always a univariate polynomial, and that some other are always squares. We analyze the number of squares among the coefficients, and link it to the equation of the curve. More precisely, if the target hyperelliptic curve admits an equation as y 2 + h 1 (x)y = h 0 (x) over some field of characteristic 2, then the number of squares is entirely determined by the length (Definition 6.6) of h 1 .

Exploiting those properties is done differently whether we consider Nagaos's modelling or Summation modelling. In the former, square coefficients over F 2 kn lead to n -1 square equations over F 2 k in the system. Replacing those equations by their square root divides generally the number of solutions by 2 for each replacement. In Summation modelling, the squared coefficients of the Decomposition Polynomial are related to natural weights on the variables involved in the Summation Ideals. For genus g hyperelliptic curves defined over F 2 kn , we show that a degree reduction of a factor up to 2 (n-1)(g+1) can be obtained from the number of solutions d Nag = 2 n(n-1)g . The exact factor is entirely determined by the length of h 1 , and the (tight) lower bound we obtain is d opt = 2 (n-1)((n-1)g+1) .

A complete classification for genus 2 curves is given, as there exist normal forms for them (described from [START_REF] Byramjee | Classification of genus 2 curves over F 2 n and optimization of their arithmetic[END_REF][START_REF] Cohen | Handbook of elliptic and hyperelliptic curve cryptography[END_REF] in Section 6.1.3), depending on deg h 1 . The following tables show the degree we obtained after reduction for Nagao's modelling in genus 2 in the best cases, and the impact of this reduction on the running time for finding relations. In the first table, L h stands for the length of the polynomial h 1 (see Definition 6.6). Similar tables are given for Summation modelling in the next paragraph. Here, the timings highlighted by exclamation marks seem far too long for the type of systems considered. They were obtained with Magma 2.19's FGLM algorithm. We comment on this, along with more details in Sections 6.1 and 6.3.2.

Action of the Frobenius automorphism over ideals of relations in positive characteristic

To obtain a precise analysis of the degree reduction in even characteristic for Summation modelling, we put ourselves in a general context of polynomial parametrizations in positive characteristic p > 0 with action of the Frobenius automorphism. More precisely, we fix a field F with Char(F) = p > 0 and we consider ideals as I = X 1 -P 1 (a) p , . . . , X k -P k (a) p , X k+1 -P k+1 (a), . . . , X m -P m (a) , with P i polynomials in F[a 1 , . . . , a l ]. Then, the ideal of relations between the P i is the elimination ideal I e = I ∩ F[X 1 , . . . , X m ] (Proposition 1.71). Now let J = X 1 -P 1 (a), . . . , X m -P m (a) , J e = J ∩ F[X 1 , . . . , X m ], and for any polynomial f = ∑ c α m α , define f σ = ∑ c p α m α . Keeping previous notations, we show the following: Proposition 0.4. Let J e = g 1 , . . . , g r and define

I = g σ i (X 1 , . . . , X k , X p k+1 , . . . , X p m ) : 1 ≤ i ≤ r .
Then I e is the radical of I This implies that it is equivalent to find points in V(I e ) or V(J e ). However, using the ideal J e is more efficient in practice, because the weighted degree of J e is reduced by roughly the product of the weights: Proposition 0.5. With the same notations as in the previous Proposition, we have

deg w J e = deg I p m-k .
The degree reduction process for Summation modelling in even characteristic follows from an instantiation to p = 2 and the parametrization of the Specialized Summation Variety of those results. The degree of the systems describing relations in a Decomposition attack is then deduced from a careful analysis of the Weil Descent. Upon this analysis, a complete classification for genus 2 curves is also given. The best cases are presented below. The next table shows the impact of the degree reduction. The column "Summation Set" gives the time to compute a specialized summation set. It also shows how considering the weight structure improved the computation of the ideal of relations.

Harvesting on curves with realistic parameters and practical impact

Before this thesis, the only known approach to Decomposition attacks for hyperelliptic curves defined over F q n was Nagao's, which was unpractical as soon as n > 2. For example, more than 1 million seconds were needed to find a single decomposition for a genus 2 curve defined over F 2 45 with a Magma implementation, solving hundreds of systems with 4096 solutions. Our comparisons with Summation modelling reveal that Nagao's approach performs overall better. In even characteristic, our degree reduction strategy for Nagao's modelling decreases the time to find a relation for a genus 2 curve defined over F 2 45 by a factor of 75000. The Summation modelling reveals to be slower in general. Nevertheless, an immediate consequence of those improvements is that we increased the realm of practical experiments to binary genus 2 curves defined over fields as F 2 3k .

A second consequence is that a practical harvesting phase on a curve with realistic parameters can now be considered. To show this, we find a genus 2 curve defined over F 2 93 , whose Jacobian variety have almost prime order and satisfies a generic security bound of 2 92 operations, and run the harvesting with a dedicated implementation. The implementation mixes code-generation techniques and efficient Gröbner bases libraries (such as the FGb package [START_REF] Faugère | FGb: A Library for Computing Gröbner Bases[END_REF]). With this code, around 2 seconds are needed to find a relation (see Section 6.3.3 for more details). Using 8000 cores, the harvesting can build the matrix of relations in a bit more than 7 days. This highlights additional weaknesses of binary genus 2 curves against Decomposition attacks, and in particular the base field should never be an extension whose degree can be divided by 3.

Perspectives Theoretical framework for Summation ideals over Abelian Varieties

Following the work of Gaudry [START_REF] Gaudry | Index calculus for abelian varieties of small dimension and the elliptic curve discrete logarithm problem[END_REF] and Diem [START_REF] Diem | On the discrete logarithm problem in elliptic curves[END_REF], a framework for Summation Ideals for Elliptic Curve was proposed. The basic idea is that Summation Polynomials are associated to a choice of a projection π : E -→ P 1 , or equivalently, to a choice of a model for E. Several Summation Polynomials can then be deduced from the classical one using the action of Aut(P 1 ) = PGL 2 . This is the point of view that lead the authors of [FHJ + 14] to fully exploit the group of symmetry acting over the Summation Polynomial in an Index-Calculus context. Elliptic Curves corresponds exactly to Abelian Varieties of dimension 1, and the projective line P 1 is in fact the Kummer Variety of the Elliptic Curve. For a more general Abelian Variety, Summation Ideals can be defined using different projections over different models for the associated Kummer Variety.

It is natural to expect a generalization of Summation Ideals and Polynomials to any Abelian Variety using projections. This can shed new lights on the arithmetic of Abelian Varieties. Besides, Abelian Variety of dimension 2 corresponds exactly to Jacobian Varieties of Hyperelliptic Curves of genus 2. In this situation, the Kummer variety is a Kummer Surface, a quartic surface which is well-known in the litterature, even from a computational point of view [Fly93, Gau07, GL09, Duq10, BCHL16, RSSB16]. Hence explicit computations and experiments can be hoped on genus 2 curves.

Automorphisms of Summation Varieties

As we stated in the previous paragraph, the geometrical framework for Summation Polynomials of an Elliptic Curve E have lead Faugère & al. [FHJ + 14] to exploit a large group of automorphisms . More precisely, by considering the addition of 2-torsion points in E, they identified a group G of automorphisms acting over the Summation Polynomials. Using a set of fundamental invariants expressing the action, they reduced the degree of systems arising from a Decomposition attack by a factor #G. Moreover, the clear link with Aut(P 1 ) enabled them to build factor bases that remained invariant by the addition of 2-torsion points to its elements, further improving on the efficiency of the Decomposition Attacks. Unfortunately for us, the object introduced by our generalization are not invariant under the action of rational 2-torsion points in a Hyperelliptic Jacobian Variety.

Exploiting more symmetries when g ≥ 2 can be done by understanding the group of automorphsim acting over our new Summation Ideals.. With a general framework for Abelian Varieties, other groups of symmetry can be used on other sets of Summation Polynomials. For example in genus 2, the addition of a 2-torsion point in the Jacobian Variety expresses as a linear (projective) map over the Kummer Surface. Hence it can be represented by matrices in Aut(P 3 ) = PGL 4 [START_REF] Flynn | The group law on the Jacobian of a curve of genus 2[END_REF]. Explicit formulae are likely to be handled for this size of matrices, leading to experimental computations. Ultimately, it could lead to a new Decomposition attack on genus 2 hyperelliptic curves.

Complete Transfer and Decomposition attack over a meaningful binary Elliptic Curve

A first threat to an Elliptic Curve defined over F q 6 , q odd with log q = 23, was presented by Joux and Vitse in [START_REF] Joux | Cover and decomposition index calculus on elliptic curves made practical -application to a previously unreachable curve over F q 6[END_REF]. Their method used first a transfer of a DLP instance to the Jacobian Variety J of an Hyperelliptic Curve of small genus (g = 2, 3) defined over F q 6/g , then a Decomposition attack in J. The complexity of their attack mainly revolves around the efficiency of the harvesting, since the linear algebra is a somewhat rigid phase. While they mostly target the odd characteristic, their analysis also covers the even characteristic. However no example of computations were given so far. Our work on the reduction of the degree for Decomposition attack in even characteristic showed that a really efficient harvesting could be design on certain binary Hyperelliptic curves. Our results in Chapter 6 suggest that a genus 2 curve defined over some F 2 3k , or a genus 3 Hyperelliptic Curve defined over some F 2 2k could be targeted.

It would be interesting to work toward a complete Transfer and Decomposition attack on an Elliptic Curve defined over F 2 6k , with k ≈ 32. A first step is to find convenient hyperelliptic covers of genus 2, 3, with base field being F 2 3k or F 2 2k . Then a dedicated implementation of a Decomposition attack exploiting our degree reduction process and powerful Gröbner bases libraires must be done. Lastly, the running time for a complete Discrete Logarithm computation have to be estimated. It could be enough for a practical computation of a Discrete Logarithm.

Open Problem

Algorithmic of Gröbner Bases for ideals with positive dimension

The computational aspect of Gröbner bases for 0-dimensional ideal is already well understood. Recent works sharpen the complexity bounds under various additional hypothesis ([Spa12], [START_REF] Svartz | Solving zero-dimensional structured polynomial systems[END_REF], [START_REF] Faugère | On the complexity of computing Gröbner bases for weighted homogeneous systems[END_REF]), and major improvements on the computational efficiency are already observed. The most efficient computational strategy is to rely on the change-ordering algorithm FGLM, which can be really efficient in practice. However, the situation for positive dimensional ideal is far less understood. FGLM's algorithm is not efficient when the dimension of the ideal is positive. Another approach using the Gröbner Walk algorithm exists (implemented e.g. in Magma), but its complexity is not clear, and, in practice, it is generally much slower than a direct computation with F4 algorithm for an elimination order. Nevertheless, a direct computation for such orders is also much slower than a computation for a (weighted) total degree order. This thesis highlighted that it can be interesting to consider such ideals: examples are given by the Summation Varieties we introduced in Chapter 5.

Understanding the behaviour of elimination orders with respect to F4 and F5 algorithms can be a first step toward more efficiency in Gröbner Basis computations for positive dimensional ideals. This can lead to clearly understood computational strategies, or even to the design of new algorithms dedicated to elimination orders. Also, sharp complexity bounds can be derived from such new insights about positive dimension.

Organisation of the thesis

The manuscript is divided in two parts. The first part contains both the necessary material to understand the results of this thesis and presents the Discrete Logarithm Problem and its application in Cryptography, strongly centered around Algebraic Curves. The first chapter deals with algebraic varieties from a computational point of view, and follows mostly [START_REF] Cox | Ideals, Varieties, and Algorithms: An Introduction to Computational Algebraic Geometry and Commutative Algebra[END_REF]. A special emphasis is done on solving systems with a finite number of solutions. The second chapter introduces algebraic curves, inspired from [START_REF] Fulton | Algebraic curves: an introduction to algebraic geometry[END_REF][START_REF] Silverman | The Arithmetic of Elliptic Curves[END_REF]. The basics of the theory are followed by a focus on hyperelliptic and elliptic curves, a main concern for the results of this thesis. Chapter 3 deals with the Discrete Logarithm Problem. Section 3.1.2 states the problem together with its applications in Cryptography, and can be read indepndently from the rest of the manuscript. It is followed by a State-of-the-Art on the Discrete Logarithm Problem over Algebraic Curves. A strong focus on Index-Calculus is done, as it is the main topic of this thesis.

The second part gathers the contributions of this work in three separated chapters. The sieving approach to the harvesting in general Index-Calculus is first presented in Chapter 4. The text is really close to that of the article Improved Sieving on Algebraic Curves [START_REF] Vitse | Improved sieving on algebraic curves[END_REF], co-authored with Vanessa Vitse and published at LatinCrypt 2015. Summation Ideals are the topic of Chapter 5. We start by defining this new notion, then getting practical with Index-Calculus in mind. A new algorithm for harvesting in Decomposition attacks is proposed in Section 5.4.4. The last Chapter of this manuscript mainly deals about the degree reduction of the systems in even characteristic. It also contains the results about the Frobenius action over ideals of relations in positive characteristic. It concludes with a precise description of the realistic simulation of the harvesting for a binary genus 2 curve defined over F 2 93 , whose Jacobian Variety achieves a 2 92 operations generic security bound.

Part II

Preliminaries

Chapter 1

Polynomial Ideals and Algebraic Varieties

In this thesis, we are generally interested in algebraic varieties defined over finite fields, or in other words, the geometrical locus of a system of polynomial equations with coefficients in some F q . The set of all polynomial combinations between the defining equations of a system is called an ideal, and by the Ideal-Variety correspondence 1.9, any geometric property of the variety translates to an algebraic equivalent in the language of ideals and polynomials. Section 1.1 introduces this dictionnary for affine and projective varieties.

There is a clear separation in our interests for this work depending on the dimension of the target variety. Hence, this notion is rigorously defined in Section 1.2 before going any further. We choose an Hilbert Series-based approach, with a special emphasis on weighted structures, since several estimates in our contribution (see Section 6.2.1) rely on these important objects. Along the way, this also enables us to define the (weighted) degree of a polynomial, but also of an ideal and of a variety (Definition 1.28). Informally, those quantities generalize the degree of a univariate polynomial to count the expected number of solutions (in an algebraic closure) of a polynomial system. They are also needed in all the complexity estimates for Decomposition attacks, the main focus of this thesis.

Positive-dimensional and zero-dimensional varieties are targeted differently by our contributions. When the dimension is positive, we want to compute particular projections (Chapter 5). When the dimension is 0, that is to say, the variety has only a finite number of points with coordinates in the algebraic closure, we want to find them all. Equivalently, we want to efficiently solve the system of defining equations -see for example Section 3.4.2 and Chapter 6. Once an adequate monomial order is fixed, which means that we choose a way to sort multivariate monomials, both goals can be achieved by the computation of a Gröbner basis for this order (Definition 1.41). In other words, theses objects give us a computational tool to manipulate algebraic varieties, and are thus treated in Section 1.3. The algorithmic of Gröbner bases is a fundamental brick of our work: our experiments can only be done by Gröbner bases computations, and most of our results involve improvements of such computations -Chapter 5 and 6. Therefore the entire Section 1.3.2 is devoted to this subject. We briefly remind the reader how Gröbner bases can be computed by linear algebra. The efficient algorithms F4 [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF] and [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases without reduction to zero (F5)[END_REF] are then informally presented. Their complexity is well-understood for regular sequences (Definition 1.48). However, their output is not suited for solving zero-dimensional systems, i.e. with a finite number of solutions, that appear in most of our contributions. The standard strategy for solving such systems relies on changing the monomial order. This is done using FGLM's algorithm [START_REF] Faugère | Efficient computation of zero-dimensional Gröbner bases by change of ordering[END_REF][START_REF] Faugère | Fast Algorithm for Change of Ordering of Zerodimensional Gröbner Bases with Sparse Multiplication Matrices[END_REF], introduced thereafter. Before our work, this step dominated the running time in all experiments.

Since its complexity mainly depends on the number of solutions of the system (Proposition 1.58), reducing this number as much as possible is what we strive for (see Chapter 6).

After the needed theory on zero-dimensional varieties has been developed, Section 1.4 focuses on positive-dimensional varieties. In Chapter 5, we use the projection of a particular variety of positive dimension to design a new modelling for the harvesting phase in Decomposition attacks. This modelling is a core part of most of our results. Understanding the relations between a variety and its projections is the topic of Elimination theory, briefly developed in Section 1.4. The name stems from "by-hand" methods to solve linear and polynomial systems where combinations of the equations are used to eliminate some variables, until it is possible to solve it. From a computational point of view, describing a projection can be done by computing a Gröbner basis for an elimination ideal of the variety (Definition 1.59). The resultant of two polynomials (Definition 1.64) is also an important object of elimination theory. It is involved in the computation of Summation Polynomials in Section 3.4.2, and we also use it in our new modelling for Decomposition attacks (Section 5.1 and 5.4, Section 6.1.1). This work makes a special emphasis on two special classes of varieties, detailed in Section 1.5.1, the last of this Chapter. First, Polynomial parametrizations are involved in our new definition of Summation Ideals in Chapter 5. They are closely related to Ideals of relations, which we use to generalize Semaev's Summation Polynomials [START_REF] Semaev | Summation polynomials and the discrete logarithm problem on elliptic curves[END_REF]. Second, we focus on Weil Restrictions of varieties defined over extensions of finite fields. Given a variety V defined over F q n , the Weil Restriction associates a variety W n (V ) defined over F q , where F q nrational points in V are in one-to-one correspondence with F q -rational points of W n (V ). Such varieties are used to model the harvesting phase in Decomposition attacks as the solving of zero-dimensional polynomial systems. Understanding their degrees allows us to give precise estimates on the complexity of our new harvesting phases starting Chapter 5.

The Ideal-Variety Correspondence

We start by a reminder on ideals and affine algebraic varieties, and link them together using results from Hilbert -Basis Theorem, Weak and Strong Nullstellensatz. The one-to-one correspondence between radical ideals and affine algebraic varieties is also described. We also choose to consider non-irreducible varieties as varieties on their own; they correspond to prime ideals.

Affine Varieties and Radical Ideals

Most of the results in this Section are directly taken from [START_REF] Cox | Ideals, Varieties, and Algorithms: An Introduction to Computational Algebraic Geometry and Commutative Algebra[END_REF]. Let K be a field and denote by K its algebraic closure. For any field K, let K[X 1 , . . . , X n ] be its ring of polynomials in n variables.

Definition 1.1. A set I in K[X 1 , . . . , X n ] is called a polynomial ideal if it is an additive subgroup closed under multiplication.
If f 1 , . . . , f r are polynomials in K[X 1 , . . . , X n ] we can define the ideal generated by f 1 , . . . , f r as the set of all polynomial combinations between them, namely:

f 1 , . . . , f r = r ∑ i=1 h i f i , h i ∈ K[X 1 , . . . , X n ] .
The well-known Hilbert's Basis theorem says that all polynomial ideals can be described this way.

Theorem 1.2 (Hilbert's Basis Theorem). All polynomial ideals are finitely generated.

We can associate to any ideal a set of points in an affine space called an affine algebraic variety. Let A n (K), or A n when the context is clear, be the n-dimensional affine space over K. Definition 1.3. Let f 1 , . . . , f r be polynomials in K[X 1 , . . . , X n ]. An affine algebraic variety is the set of common zeroes of f 1 , . . . , f r in A n (K) and it is denoted by V = V( f 1 , . . . , f r ). Let L | K be any field extension. If f 1 , . . . , f r ∈ L[X 1 , . . . , X n ], then we say that V is defined over L. If V is defined over L, its set of L-rational points is denoted by

V L ( f 1 , . . . , f r ) = {P = (x 1 , . . . , x n ) ∈ A n (L) : f 1 (P) = f 1 (x 1 , . . . , x n ) = . . . = f r (P) = 0}. Any P = (x 1 , . . . , x n ) in V L ( f 1 , . . . , f r ) is called a L-rational point.
What we define as algebraic varieties are sometime called algebraic sets in the litterature, while the name "variety" is reserved for irreducible algebraic sets -see Definition 1.11. In our work we deal with varieties defined over (extension of) finite fields F q , and we are usually looking for F q -rational points. When the context is clear we often omit the field in the subscript.

Proposition 1.4. Let I be an ideal of K[X 1 , . . . , X n ]. The set V(I) = {P ∈ A n (K) : f (P) = 0 ∀ f ∈ I}
is an affine algebraic variety, called the affine algebraic variety associated to I.

When I = f 1 , . . . , f r , or when S is a given generating set for I, we also use the notations

V(I) = V(S) = V( f 1 , . . . , f r
). An affine algebraic variety can be empty, but when the field is algebraically closed, this implies a strong property on its defining ideal. This is known as Hilbert's Weak Nullstellensatz.

Theorem 1.5 (Weak Nullstellensatz). Let K be an algebraically closed field, and

I ⊂ K[X 1 , . . . , X n ] be an ideal. Then V (I) = / 0 if and only if I = K[X 1 , . . . , X n ].
Example: Let K = F q and P be an irreducible polynomial in F q [X] with deg P = d > 1, and define the ideal

I = P in F q [X]. Then V K (I) = / 0 while I = K[X]
. Now let L the field of decomposition of P. Then P has roots x 1 , . . . , x d in L, and V L (I) = {x 1 , . . . , x d } = V(I).

Starting from an affine algebraic variety V in A n , we can do the opposite and associate a polynomial ideal to V as

I(V ) = { f ∈ K[X 1 , . . . , X n ] : f (P) = 0 ∀ P ∈ V }.
This set is indeed an ideal: let f , g ∈ I(V ) and h ∈ K[X 1 , . . . , X n ], then for any P ∈ V , we have

( f + g)(P) = f (P) + g(P) = 0 and ( f • h)(P) = f (P)h(P) = 0. Similarly, when V is defined over K, we define I L (V ) = { f ∈ L[X 1 , . . . , X n ] : f (P) = 0 ∀ P ∈ V } for any extension L | K.
Overall we defined a correspondence between affine algebraic varieties and polynomial ideals. This correspondence is however not one-to-one on the V side. For example, let

I = X and J = X 2 in K[X]. It is clear that V(I) = V(J) = {0}. Conversely, it is also clear that I({0}) = I. It turns out that I is the radical of J. Definition 1.6. Let I ⊂ K[X 1 , . . . , X n ] be an ideal. The ideal I is radical if f m ∈ I for some integer m implies f ∈ I. The radical of I is the set √ I = { f ∈ K[X 1 , . . . , X n ] : ∃ m ∈ N s.t. f m ∈ I}.
Proposition 1.7. The radical √ I of an ideal I is a radical ideal containing I. An ideal I is radical if and only if √ I = I. The radical of I is the smallest radical ideal containing I.

The notion of radical ideal leads to a one-to-one correspondence between radical polynomials ideals and affine algebraic varieties. This is in fact a reformulation of Hilbert's Strong Nullstellensatz.

Theorem 1.8 (Strong Nullstellensatz). Let K be an algebraically closed field, and

f , f 1 , . . . , f r ∈ K[X 1 , . . . , X n ]. If f ∈ I(V( f 1 , . . . , f r ))
, then there exists an integer m such that f m ∈ f 1 , . . . , f r .

Corollary 1.9 (Ideal-Variety correspondence). Let K be an algebraically closed field and I be an ideal in K[X 1 , . . . , X n ]. Then we have:

I(V(I)) = √ I. If I 1 ⊂ I 2 are ideals, then V(I 2 ) ⊂ V(I 1 ). Similarly, if V 1 ⊂ V 2 are varieties, then I(V 2 ) ⊂ I(V 1 ).
Let V be an affine algebraic variety in A n . Then we have:

V(I(V )) = V.
In other words, I and V are inclusion-reversing bijections, inverses of each other, between the set of radical ideals in K[X 1 , . . . , X n ] and the set of affine algebraic varieties in A n .

Proof. Let f ∈ √ I. Then f m ∈ I for some m so that f m vanishes on V(I), and f also vanishes on V(I). The other inclusion comes from the Strong Nullstellensatz. Let I 1 = f 1 , . . . , f r and I 2 = g 1 , . . . , g s . For P ∈ V(I 2 ) = V (g 1 , . . . , g s ), we have g i (P) = 0 for all 1 ≤ i ≤ s. Now for all 1 ≤ i ≤ r, there are h i ∈ K[X 1 , . . . , X n ] such that f i = ∑ h j g j , and thus f i (P) = 0, which means

P ∈ V(I 1 ) = V ( f 1 , . . . , f r ). If V 1 ⊂ V 2 , then any polynomial that vanishes on V 2 vanishes in particular on V 1 , so I(V 2 ) ⊂ I(V 1 ). Let now V = V( f 1 , .
. . , f r ) be an affine algebraic variety. By definition, V ⊂ V(I(V )). For the other inclusion, notice that f 1 , . . . , f r are in I(V ). Since V reverses the inclusion, this gives V(I(V )) ⊂ V( f 1 , . . . , f r ) = V . Notice that the first statement of the proposition also means that for any affine algebraic variety V , I(V ) is a radical ideal. To conclude, we observe that if I is radical, then √ I = I and we have I(V(I)) = I.

Remark 1.10. For any ideal I, we also have

V(I) = V( √ I).
We give some more insights about irreducible varieties and their link to polynomial ideals.

Definition 1.11 (Irreducible Variety, Prime Ideal). An algebraic affine variety V is said to be irreducible if, whenever there are two affine varieties

V 1 and V 2 such that V = V 1 ∪V 2 , then either V 1 = V or V 2 = V . An ideal I in K[X 1 , . . . , X n ] is said to be prime if, whenever f , g ∈ K[X 1 , . . . , X n ] are such that f • g ∈ I, then either f ∈ I or g ∈ I.
Prime ideals are radical: indeed, let I be a prime ideal and f be a polynomial such that f m ∈ I. Then by definition, either f m-1 of f is in I, and the statement follows by induction.

Proposition 1.12. An affine algebraic variety is irreducible if and only if I(V ) is a prime ideal.

Projective Varieties and Homogeneous Ideals

This Section follows [START_REF] Silverman | The Arithmetic of Elliptic Curves[END_REF][START_REF] Fulton | Algebraic curves: an introduction to algebraic geometry[END_REF]. In most of our applications, it is enough to consider affine algebraic varieties. However, to define properly several notions in Section 1.2 and Chapter 2, it is necessary to consider projective varieties. In some sense -see Proposition 1.17 -they can be thought as "completions" of affine varieties. Definition 1.13 (Projective n-space). Let K be a field. The projective n space is defined as P n (K) = K n+1 / ∼, where ∼ denotes the equivalence relation (x 0 , . . . , x n ) ∼ (x 0 , . . . , x n ) if and only if there exists λ ∈ K * such that x i = λ x i for all i. A representant of the equivalence class is denoted [x 0 : . . . : x n ] and called homogeneous coordinates.

If the context is clear, we usually omit K when describing a projective space. Projective varieties are defined in term of homogeneous ideals and polynomials.

Definition 1.14. Let d ≥ 1. A polynomial f in K[X 0 , . . . , X n ] is homogeneous of degree d if f (λ X 0 , . . . , λ X n ) = λ d f (X 0 , . . . , X n ) for all λ ∈ K * . An ideal I in K[X 0 , . . . , X n ]
is homogeneous is there exists a generating set of homogeneous polynomials. Let I be a homogeneous ideal in K[X 0 , . . . , X n ]. A projective variety is defined as the set of common zeroes in P n (K) of the homogeneous polynomials in I, and denoted V(I). Let L | K be any field extension. If the ideal I is in L[X 1 , . . . , X n ], then we say that V(I) is defined over L, and its set of L-rational points is

V L (I) = {P ∈ P n (L) : f (P) = 0 ∀ P ∈ I}.
Similarly, let V be a projective variety. The ideal associated to V is the ideal

I(V ) = f ∈ K[X 0 , . . . , X n ] : f is homogeneous and f (P) = 0 ∀ P ∈ V ,
adding the subscript L if the polynomials are considered with coefficients in L and if V is defined over K. A projective variety V is irreducible if its associated ideal is prime.

The projective n-space contains many copies of A n . Some of them are particularly interesting: consider the projective hyperplane H i defined by the ideal X i in K[X 0 , . . . , X n ] for some i, and its complement U i = {[x 0 : . . . : x n ] ∈ P n : x i = 0}. There is a natural map

ϕ i : A n -→ P n (y 1 , . . . , y n ) -→ [y 0 : . . . : y i-1 : 1 : y i+1 : . . . : y n ],
whose image is U i , and whose inverse on U i can be defined by

ϕ -1 i : U i -→ A n [x 0 : . . . : x n ] -→ ( x 0 x i , . . . , x i-1 x i , x i+1 x i , . . . , x n x i ).
In a similar way, we can link polynomials in n variables and homogeneous polynomials in n + 1 variables.

Definition 1.15 ((De)Homogenization of a polynomial). Fix 0 ≤ i ≤ n. Let f ∈ K[X 0 , . . . , X n ] be a homogeneous polynomial. The dehomogenization of f wrt. X i is the polynomial

f * (Y 1 , . . . ,Y n ) = f (Y 1 , . . . ,Y i-1 , 1,Y i+1 , . . . ,Y n ).
Let g be any polynomial in K[Y 1 , . . . ,Y n ]. The homogenization of g wrt. X i is the polynomial

g * (X 0 , . . . , X n ) = X deg g i g X 0 X i , . . . , X i-1 X i , X i+1 X i , . . . , X n X i . If I is any non-homogeneous ideal in K[X 1 , . . . , X n ], the homogenization of I is the homogeneous ideal I * = f * : f ∈ I in K[X 0 , . . . , X n ].
From these observations we can also link affine varieties and projective varieties.

Definition 1.16. Fix 0 ≤ i ≤ n. Let V be a projective variety in P n . The i th affine patch of V is the set

V i = ϕ -1 i (V ∩ U i ).
Let V be an affine variety in A n , and I = I(V ). The i th projective closure of V is the set of common zeroes in P n of the polynomials in the ideal I * = f * : f ∈ I , and it is denoted V i .

Proposition 1.17. Fix 0 ≤ i ≤ n. If V is an affine variety, its i th projective closure V i is a projective variety, and

ϕ i (V ) = V i ∩U i . If V is a non-empty irreducible projective variety, the i th patch V i of V is an affine algebraic variety and either ϕ i (V i ) i = V , either V i = / 0.
Let V be an affine variety in A n , and V i its i th

i (V ) is V i .
Therefore, in some sense, projective varieties are completion of affine varieties. The points in V i ∩U i are called points at infinity for V .

Example: Let K be an algebraically closed field, and consider the projective variety V in P 2 defined by the homogeneous polynomial

C(X,Y, Z) = Y 2 Z -X 3 -aXZ 2 -bZ 3 , for some a, b ∈ K.
The 3 rd affine patch is the affine variety V in A 2 defined by the equation c(x, y) = C(x, y, 1) = y 2x 3axb. We verify that V 3 = V , and that it has a single point at infinity O = [0 :

1 : 0],
that is to say V ∩ {Z = 0} = {O}.

Dimension and Degrees

This Section is dedicated to the definition of the dimension and degree of a variety. Our approach involves Hilbert Series, hence the (weighted) degree of a polynomial is first recalled. Then, we give useful and well-known properties to compute Hilbert Series. The coordinate ring of a variety is defined next, and its Krull dimension is linked to the Hilbert Series. This allows us to give several equivalent definitions for the dimension of a variety, that are used in both this Chapter and the following one. Thanks to the Hilbert Series, the (weighted) degree of a variety can also be defined. It measures the number of solutions of the systems that we consider, and hence it is key to estimate the efficiency and improvements of our new approaches in Chapters 5 and 6.

The Hilbert Series of an Ideal

We first recall the definitions of monomials and (weighted) degree of a multivariate polynomial. Those classic notions are needed for the definition of both the Hilbert Series and Gröbner bases.

Definition 1.18. A monomial in K[X 1 , . . . , X n ] is a polynomial of the form X α 1 1 X α 2 2 . . . X α n n , with α 1 , . . . , α n nonnegative integers. If we let α = (α 1 , . . . , α n ) we also write X α 1 1 . . . X α n n = X α .

Any polynomial f ∈ K[X 1 , . . . , X n ] can be written as a linear combination of monomials f = ∑ α∈N n c α X α , with c α ∈ K and finitely many c α = 0. When c α = 0, the polynomial c α X α is called a term of f , and X α a monomial of f . The set of all monomials of f is called the support of f , and is denoted by Supp( f ). The sets in Definition 1.19 are linear spaces of finite dimension. Indeed, K[X] d is generated by the monomials of degree d. Hence it makes sense to consider the dimension of the quotient spaces K[X] d /I d . When I is radical, such spaces give a grading of the coordinate ring (Definition 1.24) of the projective variety V(I), that is to say:

Let |α| = ∑ n i=1 α i . The total degree of f is deg f = max{|α| : X α ∈ Supp( f )}.
K[X]/I = d≥0 K[X] d /I d .
(1.1)

All this information can be encoded using the Hilbert Series.

Definition 1.20 (Hilbert Series of a homogeneous ideal). Let I be a homogeneous ideal in K[X]. The Hilbert Series of I is the power series HS I (T ) generating the number of monomials of degree d in the quotient algebra:

HS I (T ) = ∑ d≥0 (dim K K[X] d /I d )T d .
When I is non-homogeneous, the Hilbert Series of I is the Hilbert Series of its homogenization I * .

The next Propositions are used to compute the Hilbert Series.

Proposition 1.21 ([Spa12], Prop. 1.40, p.34 ). The Hilbert Series of 0 is:

HS 0 (T ) = 1 (1 -T ) n .
Proposition 1.22 ([Spa12], Prop. 1.41, p.35). Let I be a homogeneous ideal in K[X] and f be a homogeneous polynomial of degree d. If f does not divide zero in K[X]/I, then we have:

HS I+ f (T ) =(1 -T d )HS I (T ).
The Hilbert Series can always be represented as a rational function, from which some properties of the associated variety can be read.

Proposition 1.23 (Hilbert-Serre). Let I be a homogeneous ideal in K[X]. There is a polynomial P(T ) ∈ Z[T ] and a minimal integer 0 ≤ D ≤ n such that:

HS I (T ) = P(T ) (1 -T ) D . with P(1) = 0 if D > 0.
The form of the Hilbert Series given by Proposition 1.23 is sometimes called the irreducible form.

Dimension of varieties

In this Section, we fix a field K and denote its algebraic closure by K. The coordinate ring of a variety and its fraction field (Definition 1.24) are important objects for the study of Algebraic Curves in Chapter 2. Definition 1.24. Let V be an irreducible affine variety and I = I(V ) its associated ideal in K[X 1 , . . . , X n ]. The coordinate ring of V is the quotient ring K[X 1 , . . . , X n ]/I, and it is denoted by K[V ]. The function field of V is the fraction field of K[V ], and is denoted by K(V ). If V is a projective (irreducible) variety, let V 0 be any non-empty affine patch for V . The coordinate ring, resp. the function field of V is defined as

K[V 0 ], resp. K(V 0 ).
If V is defined over K, then every notion can be defined with K instead of K. It can be shown that two (non-empty) affine patches lead to canonically isomorphic function fields, so that Definition 1.24 is consistent.

The irreducible form of an Hilbert Series can be linked to the coordinate ring of V(I). Recall that the Krull dimension of a ring A is the length of the maximal increasing chain of distinct prime ideals. In this manuscript, we sometimes write "dimension of an ideal I" and use the notation dim I when we mean the Krull dimension of the quotient K[X]/I. Proposition 1.25 ([Kem11], Thm. 11.13, p.58). Let I be a homogeneous ideal in K[X] with Hilbert Series in irreducible form HS I (T ) = P(T )

(1-T ) D . Then D equals the Krull dimension of I.

If I is not homogeneous, then D = dim(I) + 1.
If I is a homogeneous ideal such that K[X]/I has Krull dimension 0, its Hilbert Series is a polynomial. We are now ready to give definitions of the dimension of an algebraic variety. The equivalence of every statement is well-known, see for example [CLO97, Chap. 9, §5].

Definition 1.26. Let V = V(I) be an affine irreducible variety defined over K. The dimension of V is either:

• the length of the maximal increasing chain of irreducible distinct subvarieties of V .

• the Krull dimension of K[V ].
• the transcendence degree of K(V ) over K.

• the degree of the denominator of the irreducible form of HS I minus one. If V is not irreducible, dimV is defined as the maximum of the dimension of its irreducible components. If V is projective, then dimV is the dimension of any non-empty affine patch of V . By convention dim / 0 = -1.

In particular, if V(I) is projective, then HS I (T ) =

P(T ) (1-T ) dim V(I)+1 .
Zero-dimensional varieties are important both for this thesis (see Decomposition attacks in Chapter 3) and practical applications. The following proposition gives useful characterizations for our applications.

Proposition 1.27 ([CLO97], Chap. 5, §5). Let V = V(I) be an affine variety defined over a field K, with algebraic closure K. Then the following statements are equivalent:

1. dimV = 0 2. dim K K[X]/I is finite (as a K-linear space). 3. #V K (I) is finite.
In this case, we have #V K (I) = dim K K[X]/ √ I and we define the degree of V as:

degV = #V K (I).
Throughout this work, when we are interested in polynomial system solving, we sometimes refer to ideals (and varieties) of dimension 0 as zero-dimensional systems.

Degrees of varieties

Evaluating the numerator of the Hilbert Series at 1 counts the number of points in V(I) cut by D "generic" hyperplanes. To see why, consider an irreducible projective variety V of dimension D, with associated ideal I in K[X]. From Proposition 1.23, there is a polynomial P(T ) such that HS I (T ) = P(T )

(1-T ) D+1 . Assume that V is not contained in the hyperplane given by a linear form f . From Proposition 1.22 we infer HS I+ f (T ) = P(T )

(1-T ) D , so that the numerator remains unchanged. If we now assume that we can find D such hyperplanes H i = V( f i ), the homogeneous ideal I + f 1 , . . . , f D has dimension 1, and generates the 0-dimensional projective variety V ∩ H 1 ∩ • • • ∩ H D . The numerator of the Hilbert Series is still P(T ), thus

P(1) = #(V ∩ H 1 ∩ • • • ∩ H D )
. This prompts the next definition.

Definition 1.28 (Degree of a variety). Let I be an ideal with Hilbert Series in irreducible form P(T )

(1-T ) D . The degree of I is defined as deg I = P(1). If V is a variety, the degree of V is defined as degV = deg I(V ).

Since the polynomial P has integer coefficients, the degree is always an integer. It can be shown it is never negative.

Example: Let f 1 , f 2 be homogeneous polynomials of degree d 1 , d 2 ≥ 1 in K[x, y, z], and consider the ideal I = f 1 , f 2 . From Proposition 1.21 we have HS K[x,y,z] (T ) = 1

(1-T ) 3 . Using Proposition 1.22, we find the polynomial

P 1 (T ) = ∑ d 1 -1 i=0 T i such that: HS f 1 = 1 -T d 1 (1 -T ) 3 = P 1 (T ) (1 -T ) 2 .
The variety V( f 1 ) is a projective hypersurface and has (projective) dimension 1 -notice that its associated homogeneous ideal has Krull dimension 2, which is coherent with Definition 1.26. Such varieties are called algebraic curves and are the topic of Chapter 2. The curve V( f 1 ) has degree P 1 (1) = d 1 as a variety, which can be expected since it is generated by a single polynomial of degree d 1 . We now add the polynomial f 2 to f 1 . Geometrically we look at the intersection of two curves. Thus, it should have dimension 0 in general (or in other words, be a finite set of points), but it can happen that f 2 is a factor of f 1 . In geometric words, f 2 could be a branch of the curve f 1 , and algebraically, f 2 could be a divisor of zero in K[x, y]/ f 1 , which is precisely when Proposition 1.22 fails. Let's assume it is not the case, so that we find a polynomial P 2 = P 1 (T )(∑ d 2 -1 i=0 T i ) with

HS I = (1 -T d 2 )P 1 (T ) (1 -T ) 2 = P 2 (T ) 1 -T .
Thus V(I) has (projective) dimension 0, as the geometric intuition suggested. We observe that deg

I = P 2 (1) = d 1 d 2 ,
wich is confirmed by Bezout's theorem: two projective curves of degree respectively d 1 and d 2 intersect at exactly d 1 d 2 points (counted with multiplicities), eventually at infinity. With a slight abuse of names and notations, the Hilbert Series for the underlying affine variety is the polynomial P 2 (T ).

We now list the properties of the degree that we shall need in this thesis. First, the degree of a 0-dimensional ideal can be interpreted as the dimension of the quotient algebra.

Proposition 1.29. Let I be a 0-dimensional homogeneous ideal. Then dim K K[X]/I is finite and dim K K[X]/I = deg I.

Proof. We already observed that HS I (T ) = P(T ) is a polynomial when dim I = 0. Then by definition, deg

I = P(1) = ∑ deg P d=0 dim K K[X] d /I d = dim K K[X]/I.
The Hilbert Series is multiplicative with respect to tensor products, that is to say, if K[X]/I K[X 1 ]/I 1 ⊗ K[X 2 ]/I 2 , then HS I (t) = HS I 1 (t) × HS I 2 (t). An useful example for our applications is the case of cartesian products of varieties. Let V 1 ,V 2 be two algebraic varieties. Then we can show that K

[V 1 ×V 2 ] K[V 1 ] ⊗ K[V 2 ]
-informally, any coordinate function on the cartesian product comes from a pair of coordinate functions from V 1 and V 2 . The next result is then a consequence of the definition of degree and the multiplicative behaviour of the Hilbert Series wrt. tensor products.

Proposition 1.30. Let V 1 ,V 2 be two algebraic varieties. Then deg(V 1 ×V 2 ) = degV 1 × degV 2 .
Lastly, in Chapter 6 we will need that the degree is decreasing, in the sense of the next Proposition.

Proposition 1.31. Let J ⊂ I be two ideals in K[X], such that dim I = dim J. Then deg I ≤ deg J.

Proof. Up to homogenization, we can take I and J homogeneous. First assume that I and J are both 0-dimensional, with respective Hilbert Series being the polynomials HS I (T ) and HS J (T ). Then we have deg

I = HS I (1) = dim K[X]/I ≤ dim K[X]/J = HS J (1) = deg J. Assume now that dim I = dim J = D > 0.
The observation before Definition 1.28 shows that the numerator of the Hilbert Series is unchanged by adding a linear form f to I, provided f does not divide zero in K[X]/I and in this situation, the dimension of the ideal is decreased by 1 -see also [CLO97, Chap.9 §5]. Let's assume for the moment that we can find f 1 , . . . , f D such linear forms. In particular, they are not divisors of zero in J. Let I 0 = I + f 1 , . . . , f D and J 0 = J + f 1 , . . . , f D . Then dim I 0 = dim J 0 = 0, J 0 ⊂ I 0 and HS I 0 (T ) resp. HS J 0 (T ) is the numerator of HS I (T ) resp. HS J (T ). The result follows.

Now we show that we can find such f 1 , . . . , f D . Let P 1 , . . . , P k be a minimal decomposition of I [CLO97, Chap. 4, §5, p. 208-209] in prime ideals. In particular, P i ⊂ P j for all i = j. Let also V be the linear space of all linear forms. If V ⊂ P i for some i, then the maximal ideal X 1 , . . . , X n is contained in P i , so that I = P i . But this means that dim I = 0, which contradicts our hypothesis. We can proceed inductively to find f 1 , . . . , f D linear forms that do not divide 0 in I + f 1 , I + f 1 , f 2 ,...

Weighted structures

There are situations where natural weights appear on the variables. Exploiting weights has several benefits: first, the theoretical complexity of computing a Gröbner basis for a weighted homogeneous system can be sharpened. Second, running time for practical computations are faster, predicted by complexity estimates -see Section 1.3.2 for more details on the complexity of computing a Gröbner basis. Lastly, the output is usually more "homogeneous". Such weight systems are explicitly exploited in Chapter 6, and we also use adequate systems of weights as computational strategies throughout our experiments in Sections 5.3 and 5.4.2. See also [START_REF] Faugère | On the complexity of computing Gröbner bases for weighted homogeneous systems[END_REF] for other practical applications.

In all this paragraph, we denote by w = (w 1 , . . . , w n ) a system of weights over K[X], unless stated otherwise. We only consider integer weights in this work.

Definition 1.32. For a monomial X α , the weighted degree of X α is denoted by |α| w and is equal to

|α| w = w 1 α 1 + • • • + w n α n . The weighted total degree of f is deg w f = max{|α| w : X α ∈ Supp( f )}.
A polynomial f is said to be weighted homogeneous of weighted degree d when all its monomials have the same weighted degree d. An ideal is weighted homogeneous when it admits a weighted homogeneous generating set.

Remark 1.33. If w 1 = • • • = w n = 1, then the weigthed degree is the total degree of monomials and polynomials as in Definition 1.18.

When it is clear from the context that weights are involved, we may write "homogeneous" instead of "weighted homogeneous". As in the beginning of the Section, the set of all homogeneous polynomials of weighted degree d is denoted by K[X]

I (T ) = ∑ d≥0 (dim K K[X] (w) d /I (w) d )T d .
In other words, the weighted Hilbert Series is the generating power series of the number of monomials of weighted degree. The weighted structure acts on the shape of the Hilbert Series for the whole algebra, but results similar to those of the previous paragraphs can be obtained.

Proposition 1.35 ([Spa12], Prop. 1.40, 41, 42, p.34-36 ). The weighted Hilbert Series of 0 is:

HS (w) 0 (T ) = 1 n ∏ i=1 (1 -T w i ) .
Let I be a weighted homogeneous ideal in K[X] and f be a weighted homogeneous polynomial of degree d. If f does not divide zero in K[X]/I, then we have:

HS (w) I+ f (T ) =(1 -T d )HS I (T ).
Moreover, there is a polynomial P(T ) ∈ Z[T ] such that:

HS I (T ) = P(T ) n ∏ i=1 (1 -T w i )
.

Next we define the weigthed degree of an ideal and a variety. The weighted degree of a variety is

deg w V = deg w I(V ).
The weighted degree can be a rational, see the example at the end of this Section. The next proposition illustrates the impact of the weights on the Hilbert Series for ideals, and allows to relate the weighted degree and the standard degree. It is fundamental in our contributions of Chapter 6.

Proposition 1.37 (Computation of the weighted degree, [START_REF] Verron | Régularisation du calul de bases de Gröbner pour des systèmes avec poids et déterminantiels, et application en imagerie médicale[END_REF], Prop. 3.10). Consider the injective homomorphism of graded algebras

ϕ : (K[Y 1 , . . . ,Y n ], w) -→ (K[X 1 , . . . , X n ], (1, . . . , 1)) Y i -→ X w i i . Let I be an ideal in K[Y 1 , . . . ,Y n ]. Then we have deg w I = deg ϕ(I)
∏ n i=1 w i .

Example: Consider the weighted algebra K[x, y] where deg x = 1 and deg y = 2, and the algebra K[X,Y ] with standard weights. Let also ϕ(x) = X, ϕ(y) = Y 2 . The variety V(x) corresponds to the line of the x-axis, and has degree deg w V(x) = deg X /2 = 1/2. Analogously, observe that the line V(y) has weighted degree 1. The intersection is the origin, and is associated to the radical ideal x, y . We calculate HS X,Y 2 (T ) = 1 + T so that the image ideal has degree 2, and we get deg w V(x, y) = 1.

Gröbner Bases and their algorithmic

When we work with an algebraic variety, it is usually described by polynomial equations fitting the geometric intuition. However, those equations are rarely suited to any of our goals (computing projections, solving zero-dimensional systems). If we replace them by suitable polynomial combinations, the ideal (or variety) remains unchanged, but the new equations allow us to perform the task we want. Several choices can be made for such combinations; to decide how to combine the polynomials, a monomial order must be chosen, that is to say, a way of sorting the monomials of the algebra. Then, the main algebraic properties of an ideal, and hence the geometric properties of the associated variety, can be read on the leading ("greatest") monomials of the ideal. Gröbner Bases of an ideal are generating sets of polynomials which contain all the necessary leading monomials for a given order. Section 1.3.1 gives the definitions and properties that we need for our contributions.

Measuring the efficiency of the harvesting in Decomposition attacks can be done by estimating the degree of the 0-dimensional systems arising from the algebraic modelling. Classically, 0-dimensional systems over finite fields are solved in three steps: first a Gröbner basis for a degree order is computed. Second, a change of monomial ordering is done to obtain a basis for an elimination order. Lastly, the system is solved. Before our work, the second step was the bottleneck of the solving process in Decomposition attacks. In Chapter 6 we improve this step in even characteristic. In Sections 1.3.2 and 1.3.3, we detail all the steps in the strategy, together with algorithms and complexity estimates.

Computing degree order Gröbner bases is our first focus. In his thesis [START_REF] Buchberger | Ein Algorithmus zum Auffinden der Basiselemente des Restklassenrings nach einem nulldimensionalen Polynomideal[END_REF][START_REF] Buchberger | Logic, mathematics and computer science: Interactions in honor of bruno buchberger (60th birthday) bruno buchberger's phd thesis 1965: An algorithm for finding the basis elements of the residue class ring of a zero dimensional polynomial ideal[END_REF] Buchberger gave an algorithm to compute a Gröbner Basis for an ideal from a set of generators. While a proof of termination is given, a complexity analysis of the algorithm was complicated. The work of Lazard [Laz83] highlighted the link between the computation of Gröbner Bases and linear algebra by performing Gaussian Elimination on Macaulay matrices. This framework leads to the efficient algorithms F4 and F5 [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF][START_REF] Faugère | A new efficient algorithm for computing Gröbner bases without reduction to zero (F5)[END_REF] to compute Gröbner Bases for total degree orders, informally presented in Section 1.3.2. We also give complexity estimates (Theorem 1.53 [START_REF] Bardet | On the complexity of the F5 Gröbner basis algorithm[END_REF]) depending on the degree of regularity (Definition 1.46). Those estimates are used to analyze the harvesting in Decomposition attacks in Section 3.4.2. Total degree orders are not suited for resolution of 0-dimensional systems. Bases in lexicographical orders are on the contrary fit for solving: we explain why starting Section 1.3.3. However, a direct computation is usually intractable with current algorithms for any meaningful experiments and practical applications. We recall the best known strategy for the resolution of zero-dimensional systems, relying on a change of monomial ordering from a degree order to a lexicographical order using FGLM's algorithm [START_REF] Faugère | Efficient computation of zero-dimensional Gröbner bases by change of ordering[END_REF] -more recently, its sparse variant [START_REF] Faugère | Fast Algorithm for Change of Ordering of Zerodimensional Gröbner Bases with Sparse Multiplication Matrices[END_REF]. Whenever we need to solve a zero-dimensional system in this thesis, we always use this strategy. FGLM's complexity depends on the degree of the system (also the number of solutions, Proposition 1.27) and is stated in Proposition 1.58. It is the main indicator of the efficiency of the harvesting in Decomposition attacks, as it usually dominates the solving process of the systems in this situation.

Monomial orders and Gröbner Bases

Definition 1.38 (Monomial Ordering). A monomial ordering > m on N n is a relation satisfying the following properties:

1. > m is a total ordering on N n . 2. If α > m β , then for all γ ∈ N n , α + γ > m β + γ.
3. > m is well-ordering on N n , which means that every non-empty subset of N n has a smallest element.

Given a monomial ordering > m , we say that X α > m X β if and only if α > m β .

Thanks to the second condition, a monomial order is compatible with the multiplication of monomials: X α X β > m X α X γ if and only if X β > m X γ . Using a monomial ordering we can define leading monomial, term and coefficient of a polynomial. Definition 1.39. Let f = ∑ c α X α in K[X 1 , . . . , X n ], and fix a monomial order > m .

• The leading monomial LM( f ) of f is the greatest monomial with respect to > m in Supp( f ).

• The leading coefficient LC( f ) is the coefficient of LM( f ).

• The leading term LT( f ) is the polynomial LC( f ) • LM( f ).

We now introduce classical monomial orders.

Definition 1.40. Let α, β ∈ N n .

• Lexicographical Order: We say that α > lex β if there is 1 ≤ i 0 ≤ n such that α i 0 > β i 0 and α i = β i for all 1 ≤ i < i 0 . Equivalently, the leftmost non-zero entry in the vector αβ is positive.

• Degree Reverse Lex Order (DRL): We say that α

> DRL β if |α| > |β | or |α| = |β |
and the rightmost non-zero entry in αβ is negative.

• Elimination Order: Let 1 ≤ k ≤ n, and fix two monomials orders > 1 and > 2 . We say that α

> k-elim β if (α 1 , . . . , α k ) > 1 (β 1 , . . . , β k ) or (α 1 , . . . , α k ) = 1 (β 1 , . . . , β k ) and (α k+1 , . . . , α n ) > 2 (β k+1 , . . . , β n ).
• Weighted Degree Reverse Lex Order (w-DRL) Fix a weight vector w ∈ N n , and let α, β ∈ N n . The Weighted Degree Reverse Lex Order (w-DRL) is defined as α > w-DRL β if |α| w > |β | w or |α| w = |β | w and the rightmost non-zero entry in αβ is negative.

Examples: Let f = 4xy 2 z + 4z 2 -5x 3 + 7x 2 z 2 in K[x, y, z].
• In lex order, rewriting f with monomials in decreasing order gives f = -5x 3 + 7x 2 z 2 + 4xy 2 z + 4z 2 . In this case, LT( f ) = -5x 3 , LC( f ) = -5, LM( f ) = x 3 , and deg f = 3.

• In DRL order, we have

f = 4xy 2 z + 7x 2 z 2 -5x 3 + 4z 2 with LT( f ) = 4xy 2 z, LC( f ) = 4, LM( f ) = xy 2 z and deg f = 4. • Consider f in K[z, x, y] for the 1-Elimination order. Then f = 7z 2 x 2 + 4z 2 + 4zxy 2 -5x 3 with LT( f ) = 7x 2 z 2 , LC( f ) = 7 and LM( f ) = x 2 z 2 and deg f = 4. • Let w = (2, 1, 2). In w-DRL order we have f = 7x 2 z 2 -5x 3 + 4xy 2 z + 4z 2 with LT( f ) = 7x 2 z 2 , LC( f ) = 7 and LM( f ) = x 2 z 2 and deg w f = 8.
Elimination orders are also called Block orders, a terminology that stems from the fact that monomials are first compared for > 1 on a first block of variables, then with > 2 on the rest of the variables. The term "Elimination" comes from the observation that any monomial involving at least one variable from the first set is always greater than a monomial involving only variables from the second set. Thus for an elimination order, the smaller elements in a given set of polynomial may not involve variables of the first block, that have been "eliminated". It is possible to consider more than two blocks of variables. In particular, the lexicographical order is an elimination order with as many blocks as there are variables. When a monomial order is chosen over K[X 1 , . . . , X n ] and no more details are given, then the variables are ordered as X 1 > X 2 > . . . > X n .

Gröbner Bases Gröbner bases are generating sets of polynomials with convenient properties, which depend on the monomial order: bases in total degree orders are interesting for computation purpose, while eliminations orders are better to solve the underlying system of equations. They are also our main computational tools. For any set S in K[X 1 , . . . , X n ] and a monomial order, let LT(S) = {LT( f ) : f ∈ S}.

Definition 1.41 (Gröbner Bases). Let I be an ideal in K[X 1 , . . . , X n ] and fix a monomial order.

• The initial ideal of I is LT(I) .

• A set {g 1 , . . . , g r } ⊂ I is a Gröbner Basis for I if its set of leading terms generates the initial ideal of I: LT(g 1 ), . . . , LT(g r ) = LT(I) .

• A Gröbner Basis G for I is said to be reduced if:

-LC(p) = 1 for all p ∈ G;

-For all p ∈ G, no monomial of p lies in LT (G -{p}) , i.e. Supp(p)∩ LT (G -{p}) = / 0.

Gröbner Bases have several properties, and we list the ones that we need below. The proofs can be found in [CLO97, Chap. 2]. A constructive proof of existence was given first in Buchberger's thesis [START_REF] Buchberger | Ein Algorithmus zum Auffinden der Basiselemente des Restklassenrings nach einem nulldimensionalen Polynomideal[END_REF].

Proposition 1.42. Let I be an ideal of K[X 1 , . . . , X n ] and fix a monomial order. A Gröbner Basis G = {g 1 , . . . , g r } of I exists, it generates I. Moreover, the ideal I admits a unique reduced Gröbner Basis.

Gröbner bases give computational answers to several problems in the theory of algebras. Among them is the Ideal membership problem.

Definition-Proposition 1.43 (Normal Form, [START_REF] Cox | Ideals, Varieties, and Algorithms: An Introduction to Computational Algebraic Geometry and Commutative Algebra[END_REF], p. 82). Let I be an ideal in K[X 1 , . . . , X n ], and G = {g 1 , . . . , g r } be a Gröbner basis for a fixed monomial order. For any polynomial f in K[X 1 , . . . , X n ], there exists a unique r in K[X 1 , . . . , X n ] such that • No term of r is in LT (I) .

• There are c 1 , . . . , c r such that f = ∑ c i g i + r and LM(c i g i ) ≤ LM( f ).

Moreover, r = 0 if and only if f ∈ I. The polynomial r is called the Normal Form of f wrt. G.

The normal form gives a way of representing elements in the quotient algebra K[X 1 , . . . , X n ]/I. Hence Gröbner bases allow practical computations in the coordinate rings of algebraic varieties (see Definition 1.24). It is also used by FGLM's algorithm described in Section 1.3.3.

Computing Gröbner Bases with linear algebra

The case of linear systems The link between linear algebra and Gröbner bases is better understood if we first go back to linear systems. Indeed, they are particular cases of polynomial systems where all equations have degree 1. Consider the following linear system:

a 1,1 X 1 + • • • + a 1,n X n = 0, . . . a m,1 X 1 + • • • + a m,n X n = 0.
To solve it, we write A = (a i, j ) as a m × n matrix and X = (X 1 , . . . , X n ) to get A • X = 0. Gaussian Elimination is then performed on A to get a triangular form, which means we get an equivalent system with shape

b 1,1 X 1 + • • • +b 1,d X d + • • • + b 1,n X n = 0, . . . b m,d X d + • • • + b m,n X n = 0.
In this triangular shape the system can be solved starting from the bottom equation and going up until all equations have been used.

Macaulay Matrices This idea can be generalized to a polynomial system with equations of distinct degrees greater than 1. Writing f i = ∑ α c α X α and m d-d i ,k = X β , then the Macaulay matrix contains c α in the column m d, j = X α+β and in the line m d-d i ,k f i :

Mac d,> m ( f 1 , . . . , f s ) = m d,1 > m • • • m d, j • • • > m m d,r d              • • • • • • . . . . . . . . . c α . . . . . . . . . • • • • • •              m d-d 1 ,1 f 1 m d-d 1 ,2 f 1 . . . m d-d i ,k f i . . . m d-d s ,r d-ds f s Example: Let f 1 = x 2 y + 2x 2 + 2y + 4 and f 2 = xy -x 2 -4y 2 + 4x in K[x, y].
The degree 3 Macaulay Matrix for the DRL order and

f 1 , f 2 is Mac 3,> DRL ( f 1 , f 2 ) = x 3 x 2 y xy 2 y 3 x 2 xy y 2 x y 1   0 1 0 0 2 0 0 0 2 4 -1 1 -4 0 4 0 0 0 0 0 0 -1 1 -4 0 4 0 0 0 0   f 1 x f 2 y f 2
Any linear combination of the rows gives the same linear combination of the associated polynomials. Therefore if we perform Gaussian Elimination without swapping the columns on the degree d Macaulay matrix for f 1 , . . . , f s , the rows give a new set of generators with nice properties for the set of all polynomial of degree at most d in the ideal I = f 1 , . . . , f s . The key result is that for a degree d high enough, a Gröbner Basis for I is obtained this way.

Theorem 1.45 (Lazard,[Laz83]). Let f 1 , . . . , f s be polynomials in K[X 1 , . . . , X n ]. There exists a degree D such that the rows of the row echelon form of Mac D,> m ( f 1 , . . . , f s ) form a Gröbner Basis of I = f 1 , . . . , f s .

The theorem does not give an expression for the integer D. To have a clear stopping criterion, any algorithm relying on linear algebra to compute Gröbner bases must use additional properties. This is achieved by F4 [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF] and F5 [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases without reduction to zero (F5)[END_REF] algorithms, which use linear algebra on Macaulay matrices to compute Gröbner bases for total degree orders, and rely on additional criteria to terminate and speed-up the computations.

Efficient algorithms: F4 and F5 We first briefly present F4's principle. The overall idea is to combine the classical Buchberger algorithm relying on the notion of critical pairs and Gaussian elimination over Macaulay matrices. In Buchberger's algorithm, iteration is done over critical pairs: one pair is selected and reduced (by multivariate division) at each iteration. The F4 algorithm selects all the critical pairs satisfying a selection criterion, and reduce them all at the same time by computing row-echelon form of their Macaulay matrix. Some computations are stored at each degree, and used to build the next Macaulay matrices. This reduces their size by eliminating useless rows, which should speed-up the Gaussian Elimination. Iteration is done on the degree of the matrices as in Lazard's approach [Laz83], but termination of the algorithm is reached when there are no more critical pairs, as in Buchberger's algorithm. An efficient implementation of F4 exists in Magma [START_REF] Bosma | The Magma algebra system I: the user language[END_REF]: it is the primary tool we used in our experiments. Another efficient library for prime finite fields and rational numbers is given by the FGb [Fau10] Maple package.

A problem in the F4 approach is that, during the computation of the row echelon form, there is a large amount of linear combinations of the rows that reduce to zero. This means no information is deduced from these combinations, and that time is spent for useless computations. A criterion to detect such reductions to zero is given in [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases without reduction to zero (F5)[END_REF], leading to F5 algorithm. For regular sequences of homogeneous polynomials (Definition 1.48), it is proved that all useless computations are avoided. The complexity can be bounded by the cost of computing the row echelon form for the biggest Macaulay matrix [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF]. We now investigate the situation for zero-dimensional ideals and varieties, which are our main interests.

Degree of regularity

The degree bound for zero-dimensional homogeneous ideals is called the degree of regularity, and it can be estimated for regular sequences. In our applications, we mainly need to estimate the complexity of solving affine zero-dimensional systems. The notions can be extended and the complexity is also understood [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF]. As in all this thesis, we only consider integer weights.

Definition 1.46 (Degree of regularity). Let I be a 0-dimensional homogeneous ideal in K[X 1 , . . . , X n ], equipped with weights w = (w 1 , . . . , w n ). The degree of regularity of I is the smallest integer d (w) reg (I) ≥ 0 such that the linear combinations of homogeneous polynomials of (weighted) degree d in I generate all the monomials of (weighted) degree d in n variables:

d (w) reg (I) = min d∈N d : dim K Span( f : f ∈ I, deg w f = d ) = n + d -1 d = min d∈N { d : dim K I d = dim K K[X 1 , . . . , X n ] d } .
When the weights are (1, . . . , 1), we also use the notation d reg (I).

Let G be the reduced Gröbner Basis for a total degree order for some zero-dimensional homogeneous ideal I. It can then be shown that the degree of regularity is a bound on the total degree of the elements in G. Recall that the Hilbert Series for a homogeneous zerodimensional ideal is a polynomial (Proposition 1.25). This gives a convenient way to read the degree of regularity of an ideal from its Hilbert Series.

Proposition 1.47. Let I be a 0-dimensional homogeneous ideal in K[X 1 , . . . , X n ] equipped with weights (w 1 , . . . , w n ). The (weighted) degree of regularity of I is:

d (w) reg (I) = deg(HS I (T )) + max 1≤i≤n {w i }.
Regular sequences Such sequences of polynomials behave particularly well in computations of Gröbner bases, and the degree of regularity of the ideal they define is well-understood (Proposition 1.50).

Definition 1.48. A sequence ( f 1 , . . . , f r ) of non-zero homogeneous polynomials in K[X] is called regular if for all 1 ≤ i ≤ r -1, f i+1 does not divide zero in K[X]/ f 1 , . . . , f i .
As a direct consequence of Proposition 1.22, they can be characterized by the Hilbert Series of the ideal they generate.

Proposition 1.49. Let F = ( f 1 , . . . , f r ) be a sequence of non-zero homogeneous polynomials in K[X] with weights w = (w 1 , . . . , w n ). The following statements are equivalent:

• F is regular.

• HS F (T ) = r ∏ i=1 (1 -T deg f i ) n ∏ i=1 (1 -T w i ) . • dim F = n -r, dim V( F ) = n -r -1.
We are now in a position to give a bound on the degree of regularity. It is used in the complexity analyses of Section 3.4.2.

Proposition 1.50 (Bézout bound, Macaulay bound, [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF][START_REF] Spaenlehauer | Solving multi-homogeneous and determinantal systems: algorithms, complexity, applications[END_REF]). Let ( f 1 , . . . , f n ) be a regular sequence in K[X 1 , . . . , X n ], with weights w = (w 1 , . . . , w n ). Let d i = deg f i and let I = f 1 , . . . , f n . Then we have:

• Bézout bound: deg I = n ∏ i=1 d i n ∏ i=1 w i . • Macaulay Bound: d reg (I) = max 1≤i≤n {w i } + ∑ n i=1 (deg w f i -w i ).
Example: For the standard weights, the Bézout bound is the classical product of the degree of the hypersurfaces given by the f i 's, and the Macaulay bound is

1 + ∑ n i=1 (deg f i -1).
Affine Ideals All the previous notions can be extended following [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF] to non-homogeneous ideals -which we also call affine ideals. Starting this paragraph, we denote by f the homogeneous component of highest degree of any polynomial f , and similarly, if I = f 1 , . . . , f s , we write Ĩ = f1 , . . . , fs .

Definition 1.51 (Affine regular sequence). A sequence of non-zero non-homogeneous polynomials ( f 1 , . . . , f s ) in K[X 1 , . . . , X n ] is called regular, or affine regular, if ( f1 , . . . , fs ) is a regular sequence.

If an ideal I in K[X 1 , . . . , X n ] is generated by an affine regular sequence of n polynomials, then from Proposition 1.49 Ĩ is homogeneous and has dimension 0. Thus it makes sense to talk about its degree of regularity, and the next definition is coherent.

Definition 1.52 (Affine degree of regularity). Let ( f 1 , . . . , f n ) be an affine regular sequence in K[X 1 , . . . , X n ] equipped with weights w = (w 1 , . . . , w n ) and let I = f 1 , . . . , f n . Then the affine degree of regularity is defined as

d (w) a,reg (I) = d (w) reg ( Ĩ).
The affine degree of regularity also bounds the size of the biggest Macaulay matrix in Gröbner bases computations when the input system is not homogeneous -see [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF]. The fundamental difference with homogeneous system is that degree falls can happen during the computation. In other words, polynomials of degree smaller than the current iteration can be obtained by combinations of the lines in the Macaulay matrix. The complexity statement for affine systems does not account for such reductions.

As row-echelon forms are involved in the computation of Gröbner Basis by linear algebra, the complexity also depends on the so-called matrix multiplication exponent, traditionally denoted by ω. It is defined as the smallest exponent such that the product of two N × N matrices can be achieved in O(N ω ). Classical (and practical) values for this exponent are:

• ω = 3 (Schoolbook multiplication) • ω ≤ 2.807 (Strassen's algorithm [Str69])
For completeness we mention that ω ≤ 2.376 is reached by the (unpractical) Coppersmith-Winograd's algorithm [START_REF] Coppersmith | Matrix multiplication via arithmetic progressions[END_REF]. The recent work of Le Gall [START_REF] Gall | Powers of tensors and fast matrix multiplication[END_REF] reduced the exponent to ω ≤ 2.3728639.

We now state the complexity for computing a Gröbner basis of a (weighted) homogeneous ideal for a total (weighted) degree order using F5 algorithm. A bound in the affine case is obtained by replacing n by n + 1, d reg by d a,reg and with w n+1 = 1. It is used in the complexity analyses of Section 3.4.2.

Theorem 1.53 ([BFS14], [START_REF] Faugère | On the complexity of computing Gröbner bases for weighted homogeneous systems[END_REF]). Let I = f 1 , . . . , f n be a homogeneous ideal in K[X 1 , . . . , X n ] of dimension 0 in K[X 1 , . . . , X n ] equipped with weights w = (w 1 , . . . , w n ). Let ω be the exponent for the multiplication of matrices. The complexity in number of field operations to compute a Gröbner Basis of I for the (weighted) DRL order with the F5 algorithm is asymptotically bounded when n goes to infinity by

O   nd (w) reg (I) 1 ∏ n i=1 w i d (w) reg (I) + ∑ n i=1 w i -1 d (w) reg ω   .
When K[X 1 , . . . , X n ] is equipped with the standard weights w 1 = . . . = w n = 1, the complexity is:

O nd reg (I) d reg (I) + n -1 d reg ω .

Solving Zero Dimensional Systems

In practice, computing a Gröbner Basis for a degree order (such as DRL order) is easier than for an elimination order. However, Gröbner bases for degree order are not suited for the resolution of the system, while elimination orders, and particularly the lexicographical order, are. This can be seen on the next propositions, which describe the shape of a lexicographical basis as some triangular system.

Proposition 1.54. Let I ⊂ K[X 1 , . . . , X n ] be a zero-dimensional ideal, and G = {g 1 , . . . , g r } a Gröbner basis of I for the lexicographical order > lex . Assume the g i 's are ordered decreasingly for > lex , i.e LM(g 1 )

> lex • • • > lex LM(g r ). Then g r ∈ K[X n ],
and there exists a strictly increasing sequence

1 = i 1 < i 2 < • • • < i m = r of integers such that, for all 1 ≤ j ≤ m -1 and all i j ≤ k ≤ i j+1 -1, g k ∈ K[X j , . . . , X n ] and g k / ∈ K[X j+1 , . . . , X n ].
More precisely, the Gröbner basis G has the following shape:

G =                                  g 1 (X 1 , . . . , X n ),
. . .

g i 2 -1 (X 1 , . . . , X n ), g i 2 (X 2 , . . . , X n ), . . . g i 3 (X 3 , . . . , X n ), . . . g r-1 (X n-1 , X n ), g r (X n )                                 
Solving a system in this form is staightforward using the roots of the univariate polynomial g r . An even more convenient shape of lexicographical basis exists.

Definition 1.55 (Shape position). A 0-dimensional ideal I ⊂ K[X 1 , . . . , X n
] is said to be in Shape position if the reduced Gröbner basis G for the lexicographical order has the following shape:

G =              X 1 -g 1 (X n ), X 2 -g 2 (X n ), . . . X n-1 -g n-1 (X n ), g n (X n )             
It has been proved in [START_REF] Becker | The shape of the shape lemma[END_REF] that if I is radical and K is large enough, then after a random linear change of variables, the probability that a lexicographical Gröbner basis is in Shape position is overwhelming. From this shape, the degree of the ideal can be read as deg I = deg g n and solving the system is immediate once the roots of g n have been found. FGLM's algorithm F4 and F5 algorithms were designed to exploit the structure of the (weigthed) DRL order. In particular, computing directly a lexicographical Gröbner basis is usually harder in practice than computing a degree order basis. For 0-dimensional ideals, an efficient approach was proposed in [START_REF] Faugère | Efficient computation of zero-dimensional Gröbner bases by change of ordering[END_REF] with the FGLM change-ordering algorithm. It takes in input a Gröbner basis G 1 for a monomial order > 1 , a monomial order > 2 , and outputs a Gröbner basis G 2 for > 2 . We informally describe the ideal of the algorithm below.

Define the staircase of a set of polynomial as the set of the leading monomials of its elements. By Theorem 1.27, the K-algebra K[X 1 , . . . , X n ]/I has finite dimension deg I, a basis being given by (the classes of) the monomials of K[X 1 , . . . , X n ] "under the staircase" defined by G 1 . In other words, the set of all the monomials in K[X 1 , . . . , X n ] that are smaller wrt. > 1 to all elements in G 1 's staircase forms a K-basis of K[X 1 , . . . , X n ]/I. Informally, the algorithm performs a basis transformation to determine the staircase of G 2 . This is done by determining the multiplicative structure of K[X 1 , . . . , X n ]/I as a K-algebra, that is to say computing for each i the matrix of the multiplication by X i in K[X 1 , . . . , X n ]/I. Definition 1.56 (Multiplication Matrices). Let I be a zero-dimensional ideal in K[X 1 , . . . , X n ] and fix a monomial order > m . Let G be the unique reduced Gröbner basis of I wrt. > m , and let

D = deg I = dim K[X 1 , . . . , X n ]/I. The i th multiplication matrix for > m is the D × D matrix T n,> m of the linear map [X i ] : K[X 1 , . . . , X n ]/I -→ K[X 1 , . . . , X n ]/I f -→ X i f
in the basis given by the staircase of G, where f denotes the normal form of

f ∈ K[X 1 , . . . , X n ] wrt. G (see Definition 1.43).
The transformation from one basis to another is then obtained by finding linear dependencies between the (classes of the) monomials of K[X 1 , . . . , X n ], sorted wrt. > 2 . The complexity of the algorithm is well-understood (see Proposition 1.58), and mainly depends on the dimension of K[X]/I. When dim I = 0 and I is homogeneous, we have by Proposition 1.29 that deg I = dim K K[X]/I, so the complexity can be expressed using the degree of the ideal. A "weighted" version of this statement can also be obtained.

Proposition 1.57. Let I be an ideal such that dim I = 0, and fix a weight system w = (w 1 , . . . , w n ). Then

deg w I = dim K K[X]/I.
Proof. On the one hand, we know that deg

I = dim K K[X]/I. From [CLO97, Chap. 3, Theorem 4],
this dimension is also the cardinal of the set of "monomials under the staircase" of I, that is to say, the cardinal of the set M = {X α : X α ∈ LT(I) }. On the other hand, using Proposition 1.37 and its notations, we have

deg w I = deg ϕ(I) ∏ n i=1 w i = dim K K[X]/ϕ(I) ∏ n i=1 w i
, and the numerator is also the number of monomials under the staircase of ϕ(I). Hence the wanted equality is obtained if we can prove that M = {X α :

X α ∈ LT(ϕ(I)) } has ∏ n i=1 w i × #M elements.
The cardinality of the staircase does not depend on any choice of a (reduced) Gröbner basis for any order, so we can consider the staircase given by G, a Gröbner basis for I for the w-DRL order, and

M = {X α : X α < w-DRL LT(g) ∀ g ∈ G}. As ϕ(G) is a Gröbner basis for ϕ(I) for the DRL order [Ver16, p. 94], then M = {X α : X α < DRL LT(ϕ(g)) ∀ g ∈ G}, where LT(ϕ(g)) = LT(g) w = X α 1 w 1 1 . . . X α n w n n
, and the result follows.

Informally, the above proof essentially says that going through the homomorphism ϕ dilates the volume of the staircase by ∏ n i=1 w i . We can now state the complexity of FGLM's algorithm.

Proposition 1.58 ([FGLM93], [FGHR], [START_REF] Verron | Régularisation du calul de bases de Gröbner pour des systèmes avec poids et déterminantiels, et application en imagerie médicale[END_REF]). Let I be a zero-dimensional ideal in K[X 1 , . . . , X n ], and G 1 be a Gröbner basis for a monomial order > 1 . If ω is the matrix multiplication exponent, then a Gröbner basis G 2 for a monomial order > 2 can be computed from G 1 in a number of field operations bounded by

O(n deg I ω ).
If K[X 1 , . . . , X n ] is equipped with a weight system w = (w 1 , . . . , w n ), then the number of field operations can be bounded by

O(n deg w I 3 ) = O n deg ϕ(I) ∏ n i=1 w i 3 ,
where ϕ is the homomorphism defined in Proposition 1.37.

For solving 0-dimensional system S , > 1 is usually a (weighted) DRL order and > 2 is a lexicographical order. It is conjectured that the ω exponent can also be considered for weighted structures. Indeed, the way this exponent is obtained in [FGHR] does not seem to depend on the presence of weights or not.

From [START_REF] Becker | The shape of the shape lemma[END_REF] we can assume that the ideal generated by S is in Shape Position with basis

G 2 = {X 1 -g 1 (X n ), . . . , X n-1 -g n-1 (X n ), g n (X n )}.
In this context, a very efficient changeordering algorithm has been proposed in [START_REF] Faugère | Fast Algorithm for Change of Ordering of Zerodimensional Gröbner Bases with Sparse Multiplication Matrices[END_REF] taking advantage of the sparsity of the multiplication matrices and Wiedemann's sparse linear algebra algorithm [START_REF] Wiedemann | Solving sparse linear equations over finite fields[END_REF]. It does not improve on the asymptotic complexity given in Proposition 1.58, but is far more efficient in practice than the original approach. We give a brief and informal description.

The polynomial g n is in fact the minimal polynomial of the matrix T n,> 1 of multiplication by X n in K[X 1 , . . . , X n ]/S . Using adequate dot products of vectors, this amounts to computing the minimal polynomial for a linear recurring sequence. If T n is sparse, this can be done efficiently as the first step of Wiedemann's algorithm. Then recovering g 1 , . . . , g n-1 can be done by solving several linear systems of deg S equations, that can be built almost for free using previous computations. Hence, a basis in Shape Position for I can be computed with knowledge of T n only. Under additional assumptions, authors of [START_REF] Faugère | Fast Algorithm for Change of Ordering of Zerodimensional Gröbner Bases with Sparse Multiplication Matrices[END_REF] showed that T n can be directly read from G 1 . For the systems arising in Decomposition attacks, these hypotheses are always satisfied. This allows us to use the Sparse-FGLM algorithm in our realistic simulations for harvesting in Section 6.3.3.

Once a lexicographical basis has been computed, the last step to finish the solving of the system is to find roots of univariate polynomial of degree deg I -up to a random change of variables, but in our application Shape Position is obtained directly. A well-known rootfinding algorithm for polynomials over F q is given in [START_REF] Zur Gathen | Modern Computer Algebra[END_REF]Chap. 14.5,p. 392]. It is also used in the harvesting phase of several Index-Calculus variants, see Sections 3.3.3 and 3.3.4. For a polynomial of degree d, it runs in O(M(d) log d log(dq)), where M(d) is the time for multiplying polynomials of degree d over F q . Naive multiplication leads to Õ(d 2 log q), and fast multiplication algorithms to O(d log 2 d log(dq) log log d).

Example: Consider the polynomials

f 1 = y 2 -x 3 -x+1 and f 2 = x 2 +4y 2 -xy+2 in F 31 [x, y].
Solving this system over any extension L | F 31 amounts to finding the intersection points with coordinates in L of the 2 algebraic curves defined by the f i . For the DRL order with x > y, the Gröbner Basis is

G DRL =    y 4 + 21y 3 + 30xy + 7y 2 + 30x + 20y + 19, xy 2 + 22y 3 + 21y 2 + 21x + 11y + 21, x 2 + 30xy + 4y 2 + 2    ,
The staircase of G DRL is

S = {1, x, y, y 2 , y 3 , xy}, so that dim F 31 [x, y]/ f 1 , f 2 = deg f 1 , f 2 = 6. Hence V( f 1 , f 2
) is 0-dimensional and has at most 6 points with coordinates in F 31 . We compute a lexicographical basis to obtain a set in Shape position

G lex = x + h 1 (y) = x + 24y 5 + 15y 4 + 6y 3 + 10y 2 + 23y + 17, h 2 (y) = y 6 + 21y 5 + 19y 4 + 8y 3 + 12y 2 + 18y + 17 .
Solving is then reduced to finding the roots of h 2 (y) in L, then evaluating h 1 at each root to find the corresponding value of x. In this example, h 2 has two roots 19, 25 in F 31 , so that the set of F 31 -rational points of

V( f 1 , f 2 ) is V F 31 ( f 1 , f 2 ) = {(-h 1 (19), 19), (-h 1 (25), 25)} = {(29, 19), (4, 25)}. Original System -→ DRL Basis F4, F5 -→ Change order FGLM -→ Solve system n variables s equations ∆ = dreg (I ) O(s∆ n+∆-1 ∆ ω ) D = deg I O(nD ω ) Figure 1
.1: Strategy of resolution for a system of dimension 0

In our applications, the running time is usually dominated by the Change-order step, even using its Sparse variant. Therefore a main concern for us is to reduce as much as possible the degree deg I of the ideal. This can be done using the algebraic properties of the system: symmetries [Col97, FGHR14, FHJ + 14, Ste13, Stu08, FS12, FS13], weighted homogeneous structures [START_REF] Faugère | On the complexity of computing Gröbner bases for weighted homogeneous systems[END_REF], multi-homogeneous structure [START_REF] Faugère | Gröbner bases of bihomogeneous ideals generated by polynomials of bidegree (1, 1): Algorithms and complexity[END_REF][START_REF] Spaenlehauer | Solving multi-homogeneous and determinantal systems: algorithms, complexity, applications[END_REF], sparsity [START_REF] Faugère | Sparse Gröbner Bases: the Unmixed Case[END_REF], determinantal structure [Spa12, BFJ + 16]... For our contributions, we consider systems whose set of solutions (equivalently, ideals whose associated variety) is stable under the action of a group of symmetry, and also systems whose defining equations are given by a (power of) the Frobenius automorphism in positive characteristic.

Elimination Theory

This Section mostly follows [CLO97, Chap. 3]. Among our contributions, the introduction of Summation Ideals involves the computation of a projection of the Summation Variety (in Section 5.1). Elimination ideals describe all the projections of a variety, and can be described by computing Gröbner Bases for elimination order. Another key object of Elimination theory, namely the Resultant of two polynomial wrt. one variable, is then briefly introduced with the properties that we will need. It is also used to compute Semaev's Summation Polynomials (Proposition 3.13), and appear in several occasions in our work for the modelling of systems arising in Decomposition attacks (Sections 5.1 and 6.1.1).

Definition 1.59 (Elimination Ideals). Let I be an ideal in K[X 1 , . . . , X n ], and let 1 ≤ k ≤ n be an integer. The k th elimination ideal of I is the ideal

I k in K[X k , . . . , X n ] defined as I k = I ∩ K[X k , . . . , X n ].
Describing such ideals can be done by means of Gröbner basis and elimination order.

Proposition 1.60. Let I be an ideal in K[X 1 , . . . , X n ], and for 0 ≤ k ≤ n, let I k be the k th elimination ideal of I. Let also G be a Gröbner basis of I for an elimination order > k-elim (see Definition 1.40). Then the set

G k = G ∩ K[X k , . . . , X n ] is a Gröbner basis for I k . Proof. By definition G k ⊂ I k , hence LT(G k ) ⊂ LT(I k ) . Let f be in I k . In particular, f is in I so LT( f ) is divisible by LT(g), for some g ∈ G. Since f ∈ K[X k , . . . , X n ], then LT(g) ∈ K[X k , . . . , X n ] too. Because of the monomial order, this means that g ∈ K[X k , . . . X n ], hence g ∈ G k and LT(I k ) ⊂ LT(G k ) . From Definition 1.41, G k is a Gröbner basis of I k .
Next we relate elimination ideals with projections of an affine algebraic variety onto a set of variables.

Lemma 1.61. Let I be an ideal in K[X 1 , . . . , X n ], and for a fixed 0 ≤ k ≤ n, let I k be the k th elimination ideal. Consider the variety V = V(I) in A n and the projection π k :

A n -→ A n-k defined as π k (a 1 , . . . , a n ) = (a k , . . . , a n ). Then we have π k (V ) ⊂ V(I k ). Proof. Let f ∈ I k and (a 1 , . . . , a n ) ∈ V . Then f (a 1 , . . . , a n ) = 0. Since f ∈ K[X k , . . . , X n ], this rewrites as f (π k (a 1 , . . . , a n )) = 0. Lemma 1.61 also states that π k (V ) = {(a k , . . . , a n ) ∈ V(I k ) : ∃ a 1 , . . . , a k-1 ∈ K s.t. (a 1 , . . . , a n ) ∈ V }.
It can happen that the projection π k (V ) is not an affine algebraic variety. For example, consider the variety in A 3 defined by

V : xy = 1, xz = 1
which admits the Gröbner basis G = {xz -1, y -z} for the 1st elimination order. Then I 1 = yz , and (0, 0) ∈ V(I 1 ), but there is no point in V that projects onto (0, 0). More precisely, π 1 (V ) = {(a, a) ∈ A 2 : a = 0}, which is not an affine algebraic variety. The next theorem gives a more explicit description of the link between π k (V ) and V(I k ).

Theorem 1.62 (Closure Theorem). Let I be an ideal in K[X 1 , . . . , X n ] and for a fixed 0 ≤ k ≤ n, let I k be the k th elimination ideal. Then V(I k ) is the (set-theoretically) smallest affine algebraic variety containing π k (V ).

Proof. See e.g. [CLO97, Thm. 3, p. 125].

Examples:

• In the previous example, the diagonal in the plane (yOz), with equation yz = 0, is the smallest algebraic variety containing π k (V ), and it contains stricly π 1 (V ).

• Let K be the algebraic closure of F 1031 and consider the ideal in

F 1031 [a 1 , a 2 , x, y, z] gener- ated by I = a 2 1 -x + 499, 2a 1 a 2 + y + 582, a 2 2 -z , with associated variety V = V(I).
The second elimination ideal I 2 admits the Gröbner basis G = {x(1027z + 965) + y 2 + 133y + +556}, and Theorem 1.62 ensures that π 2 (V ) ⊂ V(I 2 ).

Theorem 1.62 can be precised by a description of the "missing" points betwen π k (V ) and V(I k ) -see [CLO97, Thm. 3, p. 125] -but we do not need this description in this thesis. A natural question is now the following: given a point in V(I k ), when does it lift up to a point in V ? This problem is solved by the next theorem when the elimination is done for one variable. We first state the theorem, then explain how it can be used to lift up solutions when more than one variable have been eliminated. The proof involves resultants of polynomials and their properties; we postpone it to the end of this Section.

Theorem 1.63 (Extension Theorem). Let I = f 1 , . . . , f s be en ideal in K[X 1 , . . . , X n ] and I 1 be the first elimination ideal of I. For 1 ≤ i ≤ s, write f i in the form

f i = g i (X 2 , . . . , X n )X N i 1 + terms with lower degree in X 1 ,
where

g i = 0. Let c * = (c 2 , . . . , c n ) be in V(I 1 ). If c * is not in V(g 1 , .
. . , g s ), then there exists

c 1 ∈ K such that (c 1 , c * ) ∈ V(I).
When a k th elimination ideal is considered, with k > 1, then we can consider the increasing chain of ideals

I k ⊂ I k-1 ⊂ • • • ⊂ I 1 ⊂ I 0 = I,
and apply the theorem to I k and I k-1 as ideals in K[X k-1 , X k , . . . , X n ], then to I k-1 and I k-2 as ideals in K[X k-2 , X k-1 , . . . , X n ] and so on until an element of V(I k ) has been lifted to V(I), or until an element fails to lift up. Observe in Theorem 1.63 that, if one of the g i 's is a constant, then all element of V(I 1 ) lifts to V(I). This comes from the fact that, in this case, g 1 , . . . , g s = K[X 2 , . . . , X n ], whose associated variety is empty by Weak Nullstellensatz (Theorem 1.5). We now introduce an important polynomial in elimination theory, the Resultant.

Definition 1.64 (Sylvester Matrix, Resultant). Let f = ∑ m i=0 a m-i x i and g = ∑ n i=0 b m-i x i , with a 0 = 0 = b 0 , be univariate polynomials with coefficient in some ring. The Sylvester Matrix S( f , g) of f and g is the m × n matrix defined by

S( f , g) =                       a 0 0 • • • 0 b 0 0 • • • 0 a 1 a 0 . . . . . . b 1 b 0 . . . . . . a 2 a 1 . . . 0 b 2 b 1 . . . 0 . . . . . . a 0 . . . . . . b 0 . . . a 1 . . . b 1 a m-1 b n-1 a m a m-1 . . . b n b n-1 . . . 0 a m 0 b n . . . . . . . . . a m-1 . . . . . . . . . b n-1 0 • • • 0 a m 0 • • • 0 b n                      
.

The resultant Res x ( f , g) of f and g with respect to x is the determinant of S( f , g).

We now list useful properties of the Resultant.

Proposition 1.65. Let f = ∑ m i=0 a m-i X i 1 and g = ∑ n i=0 b m-i X i 1 be polynomials in (K[X 2 , . . . , X n ])[X 1 ] = K[X 1 , . . . , X n ], with a 0 = 0 = b 0 and m ≥ n. Let also I = f , g . 1. The Resultant Res X 1 ( f , g) is in the second elimination ideal I 2 .

The polynomials f and g have a common factor in

K[X 1 , . . . , X n ] if and only if Res X 1 ( f , g) = 0. 3. Let c * = (c 2 , . . . , c n ) in K n-1 such that deg X 1 f (X 1 , c * ) = m and deg X 1 g(X 1 , c * ) = n. Then Res X 1 ( f , g)(c * ) = a 0 (c * ) m-n Res X 1 ( f (X 1 , c * ), g(X 1 , c * )). Proof. See [CLO97, Chap. 3, §5, §6].
We can now present the proof of Theorem 1.63.

Proof. Let c * = (c 2 , . . . , c n ) be in V(I 1 ) and not in V (g 1 , . . . , g s ), and consider the ring homomorphism

λ : K[X 1 , . . . , X n ] -→ K[X 1 ] f -→ f (X 1 , c * ). The image of I by λ is an ideal λ (I) of K[X 1 ], which is a principal ideal domain. Therefore, there exists h ∈ K[X 1 ] such that λ (I) = h . Assume first that h is a not a non-zero constant.
Since K is algebraically closed, the Fundamental Theorem of Algebra says that there exists

c 1 ∈ K such that h(c 1 ) = 0. Thus for any f ∈ I, f (c 1 , c * ) = 0 so that (c 1 , c * ) ∈ V(I).
It remains to show that h cannot be in K * , which we do by contradiction. Assume h = u ∈ K * and fix any f ∈ I, with deg X 1 f = m. Observe that f (X 1 , c * ) = u, and that by hypothesis, there exists a

g i such that g i (c * ) = 0. Now consider the polynomial h = Res X 1 ( f i , f ). Proposition 1.65 states that h(c * ) = g i (c * ) m Res X 1 (u, f (X 1 , c * )).
From the Definition of the Sylvester Matrix, we see that

S(u, f (X 1 , c * )) is a diagonal m × m matrix with u on its diagonal, hence Res X 1 (u, f (X 1 , c * )) = u m = 0. This means that h(c * ) = g i (c * ) m u m = 0.
But Proposition 1.65 also states that h ∈ I 1 , so that h(c * ) = 0, a contradiction.

Varieties of interest

The Summation variety introduced in Chapter 5 is a core element of our contribution. While it can be abstractly described in a straightforward manner, we give an explicit polynomial embedding using a polynomial parametrization. This embedding allows us to compute Summation Polynomials for Hyperelliptic Curves as a particular elimination ideal called the ideal of relations (Definition 1.70). This terminology stems from Invariant theory (see e.g.

[Stu08])
where the problem of determining all the non-trivial polynomial relations between invariants is important. For these reasons, Section 1.5.1 focuses on such varieties and highlights their link with ideals of relations.

Decomposition attacks target curves defined over extension fields F q n . There, the sets of valid decompositions can be described by polynomial equations generating an ideal of positive dimension. To find points in the associated variety, constraints must be added to the system, so that it is made 0-dimensional. The Weil Restriction of a variety over F q gives a natural and practical way to put such constraints and to model decompositions as 0-dimensional systems, with the additional benefit that instead of solving over F q n , we solve systems defined over F q . In Section 1.5.2 we recall the construction of the Weil Restriction for a variety defined over F q n using the action of Galois automorphism. The process gives a variety W n (V ) defined over

F q , such that dim F q W n (V ) = n • dim F q n V and deg W n (V ) = (degV ) n .
Those expressions are used in our estimates throughout Chapters 5 and 6.

Polynomial Parametrizations and Ideals of Relations

Notations: For integers m, l, we use the notations X = (X 1 , . . . , X m ) and a = (a 1 , . . . , a l ) throughout this section.

Definition 1.66 (Polynomial Parametrization). Let m, l be integers, and P 1 , . . . , P m be polynomials in K[a]. A polynomial parametrization is an ideal I in K[a, X] of the form

I = X 1 -P 1 (a), . . . , X m -P m (a) .
Let V be a variety defined by a polynomial parametrization I. The problem of determining Cartesian equations for V is called the implicitization problem. Starting from the parametrization, it can be solved by computing a Gröbner basis for an adequate elimination order, as we now describe. Let I = X 1 -P 1 (a), . . . , X m -P m (a) be a polynomial parametrization and V = V(I). If we let F : A l -→ A m be a function defined as F(a) = (P 1 (a), . . . , P m (a)), it is straightforward to see that V can be seen as the graph of the function F. Define i :

A l -→ A m+l and π m : A m+l -→ A m by i(a) = (a, P 1 (a), . . . , P m (a)) π m (a, x) = x,
then the following diagram is commutative:

A m+l π m " " A l i < < F / / A m
From this we obtain F(A l ) = π m (V ), and also that dim V(I) = l. In the previous section we saw that the projection of an affine variety is not necessarily an affine variety. The discussion shows that solving the implicitization problem for V amounts to applying the Closure Theorem 1.62 to V .

Theorem 1.67 (Implicitization). Let V be an algebraic variety with polynomial parametrization I = X 1 -P 1 (a), . . . , X m -P m (a) . Define F : A l -→ A m as F(a) = (P 1 (a), . . . , P m (a)). Let I l be the l th elimination ideal of I ⊂ K[a, X]. Then V(I l ) is the smallest algebraic variety containing F(A l ).

Remark 1.68. This theorem can also be proved when the field is not algebraically closed, see [CLO97, Thm. 1, p. 130].

This result prompts the next definition.

Definition 1.69. We say that an algebraic affine variety V admits a polynomial parametrization if there is a polynomial parametrization

I ⊂ K[a, X] such that V = V(I l ). If we write I = X 1 -P 1 (a), . . . , X m -P m (a)
, we also say that V is parametrized by the P i 's.

Examples: Over a field K with Char(K) = 2, 3:

• The parabola y = x 2 -2x + 2 admits a polynomial parametrization x = 1 + t, y = 1 + t 2 .
To see this, we observe that Res t (x -1t, y -1t 2 ) = yx 2 + 2x -2, and that the set

G = {t -x + 1, x 2 -2x -y + 2} is a
Gröbner basis for the first elimination order with x > y for x -1t, y -1t 2 . Hence G 1 = {x 2 -2x + 2 -y} is the (reduced) Gröbner basis for I 1 and we have V = V(I 1 ).

• The surface defined by x 2y 2 z 2 + z 3 = 0 admits a polynomial parametrization

f 1 = x -t(u 2 -t 2 ), f 2 = y -u, f 3 = z -u 2 + t 2 . Indeed, if we let I = f 1 , f 2 , f 3 , computations shows that g 1 = Res u ( f 2 , f 3 ) = t 2 -z + y 2 and g 2 = Res u ( f 1 , f 3 ) = tz -x are in I 1 . Then we find that x 2 -y 2 z 2 + z 3 = Res t (tg 2 -zg 1 , g 2 ) belongs to I 2 . A computation shows that I 2 = x 2 -y 2 z 2 + z 3 .
• Let V(y 2x 2 , zx 3 ) be the twisted cubic, with polynomial parametrization x = t, y = t 2 , z = t 3 , and consider its tangent surface S , that is to say, the ruled surface generated by all the tangents of the twisted cubic. It is not easy to derive a Cartesian equation starting from the equations defining the twisted cubic. However, elementary calculus leads to the following polynomial parametrization for S as x = tu, y = t 2 -2tu, z = t 3 -3t 2 u. Computing a Gröbner basis for the 2 nd elimination order gives a Cartesian equation of S as

f = x 3 z -3 4 x 2 y 2 -3 2 xyz + y 3 + 1 4 z = 0.
Given polynomials P 1 , . . . , P m in K[a], an interesting question is to find non-trivial algebraic relations between the P i 's. For example, if the P i 's generate a polynomial algebra invariant under a matrix group action, knowing a Gröbner basis of the ideal of relations is used to obtain a unique writing of a polynomial expressed in the invariants of the group action. This is also known as symmetrization.

Definition 1.70 (Ideal of Relations). Let P 1 , . . . , P m be polynomials in K[a]. The ideal of relations between the P i 's is defined as the set

I R = {g ∈ K[X] : g(P 1 (a), . . . , P m (a)) = 0 in K[a]}. For f , g ∈ I R , it is clear that f + g is also in I R . If g is in K[X], then it is also clear that f • g ∈ I R
, so I R is an ideal. The next proposition highlights the link between ideals of relations and polynomial parametrizations.

Proposition 1.71. For P 1 , . . . , P m polynomials in K[a], let I = X 1 -P 1 (a), . . . , X m -P m (a) be a polynomial parametrization, and I R be the ideal of relations between the P i 's.

1. f ∈ I ⇔ f (a, P 1 (a), . . . , P m (a)) = 0 in K[a]. 2. I R = I ∩ K[X]. In other words, I R is the l th elimination ideal of I in K[a, X].
Proof. If f ∈ I, then by definition there are polynomials q i 's such that f = ∑ m i=1 q i (X i -P i (a)), and thus f (a, P 1 (a), . . . , P m (a)) = 0. This also shows that I ∩ K[X] ⊂ I R . Observe that for any integer k ≥ 0, the identity (X +Y ) k = X k +YC k (X,Y ) holds for the polynomial C α (X,Y ) defined by

C 1 = 1, and C k = k-1 ∑ i=1 k i X i Y k-i-1 for k ≥ 2. Hence, if m = a α X β = a α 1 1 . . . a α l l X β 1 1 . . . X β m m is a monomial in K[X], there are polynomials C β 1 , . . . ,C β m in K[a, X] such that: m(a, X) = m(a, P 1 (a) -(P 1 (a) -X 1 ), . . . , P m (a) -(P m (a) -X m )) = a α m ∏ i=1 (P i (a) -(P i (a) -X i )) β i = a α m ∏ i=1 (P i (a) β i + (P i (a) -X i )C β i (a, X i )).
For the next step, we assume temporarily that m = 2 to simplify the description. We have

m(a, X) = a α P 1 (a) β 1 + (P i (a) -X i )C β 1 (a, X i ) P 2 (a) β 2 + (P 2 (a) -X 2 )C β 2 (a, X 2 ) = m(a, P 1 (a), P 2 (a)) + a α C β 1 (a, X 1 )P 2 (a) β 2 + (P 2 (a) -X 2 )C β 2 (a, X 2 ) (P 1 (a) -X 1 )+ a α P 1 (a) β 1 C β 2 (a, X 2 )(P 2 (a) -X 2 ) = m(a, P 1 (a), P 2 (a)) + C1 • (P 1 (a) -X 1 ) + C2 • (P 2 (a) -X 2 ),
for some polynomials C1 , C2 in K[a, X]. Now we come back to the general case, and an induction on m shows that there are polynomials C1 , . . . Cm in K[a, X] such that m(a, X) = m(a, P 1 (a), . . . , P m (a)) + C1

• (P 1 (a) -X 1 ) + • • • + Cm • (P m (a) -X m ). Since any f in K[a, X] can be written f = ∑ α c α m α , we can then find polynomials B 1 , . . . , B m in K[a, X] such that f (a, X) = f (a, P 1 (a), . . . , P m (a)) + B 1 • (P 1 (a) -X 1 ) + • • • + B m • (P m (a) -X m ).
(1.2)

In particular, if f (a, P 1 (a), . . . , P m (a)) = 0, then f ∈ I and the first statement is proved. Now take

f ∈ I R , equation 1.2 rewrites as f (X) = B 1 • (P 1 (a) -X 1 ) + • • • + B m • (P m (a) -X m ) ∈ K[X]
and the second statement is proved.

Thanks to Proposition 1.71 we now associate polynomial parametrizations with ideal of relations as their elimination ideal. We can precise the structure of the affine algebraic variety admitting a polynomial parametrization.

Corollary 1.72. Let P 1 , . . . , P m be polynomials in K[a]. A polynomial parametrization I in K[a, X] by the P i 's and its ideal of relations I R are prime ideals, and the associated varieties are irreducible.

Proof. Assume f , g are in K[X], and that f •g ∈ I R ; then f (P 1 (a), . . . , P m (a))•g(P 1 (a), . . . , P m (a)) = 0 in K[a] by definition, so one of the factor must be 0, equivalently f or g is in I R . A similar argument in conjonction with the first statement of Proposition 1.71 shows that a polynomial parametrization is also a prime ideal. Irreducibility comes from Proposition 1.12.

Weil Restrictions

Let K = F q n from some n > 1 and q a power of a prime, and G = Gal(F q n |F q ) be the Galois Group of F q n over F q , that is to say, the group of field automorphisms of F q n that fix any element of F q .

Definition 1.73. Let τ ∈ G and V = V( f 1 , . . . , f s ) with f i ∈ F q n [X 1 , . . . , X r ] be an algebraic variety defined over F q n .

• For any P = (x 1 , . . . , x r ) ∈ V , we define P τ = (τ(x 1 ), . . . , τ(x r )).

• We define V τ = {P τ : P ∈ V }.

• For any polynomial f with coefficients over F q n , we define f τ as the polynomial obtained by action of τ over its coefficients:

if f = ∑ α c α m α , then f τ = ∑ α τ(c α )m α . Proposition 1.74. For any τ ∈ G, if V = V( f 1 , . . . , f s ) is defined over F q n , then we have V τ = V( f τ 1 , . . . , f τ s ).
Proof. Let P = (x 1 , . . . , x r ) ∈ V , so that by definition

f i (x 1 , . . . x r ) = 0 for all 1 ≤ i ≤ s. Let f i = ∑ c α,i m α,i . Since τ is a field automorphism, we have f i (P) = ∑ c α,i m α,i (x 1 , . . . , x r ) = 0 if and only if τ( f i (P)) = ∑ τ(c α,i )m α,i (τ(x 1 ), . . . , τ(x r )) = 0 or equivalently, f τ i (P) = 0.
The Weil Restriction of V over F q is a variety defined over F q , whose F q -rational points are in one-to-one correspondence with the F q n -points of V . There are two possible and equivalent constructions. The Weil Restriction is defined over F q as it is invariant under the "twisted" action of Gal(F q |F q ) defined by τ • (P σ , . . . , P σ n-1 , P) = ((P τ -1 •σ ) τ , . . . , (P τ -1 ) τ ), ∀τ ∈ Gal(F q |F q ), where τ = τ| F q n . It also satisfies functorial and universal properties that we do not detail here -see for example [START_REF] Cohen | Handbook of elliptic and hyperelliptic curve cryptography[END_REF]Chap.7] or [START_REF] Vitse | Attaques algébriques du problème du logarithme discret sur courbes elliptiques[END_REF]Chap. 6]. From Definition 1.75, it can also be noted that dim F q W n (V ) = n • dim F q n V . Because the action of an automorphism in the Galois group does not change the monomial support of a polynomial, we see from the definition of the degree of a variety V that degV = degV τ for any τ ∈ G. By Proposition 1.30, we then obtain that deg

Definition 1.75. The Weil Restriction of V over F q is W n (V ) = ∏ τ∈G V τ . If
W n (V ) = (degV ) n .
For the sake of completeness we give a description of Weil Restrictions in the language of ideals. Let V = V( f 1 , . . . , f r ) and I = f 1 , . . . , f r . Let also σ be any generator of G. Define

I σ i = f σ i 1 , . . . , f σ i r in F q n [X 1 , .
. . , X s ] for any 1 ≤ i ≤ n. We now see f σ i j as polynomials in F q n [X i,1 , . . . , X i,s ], and we form the ideal

I = f σ i 1 , . . . , f σ i r : 1 ≤ i ≤ n ⊂ F q n [X 1,1 , . . . , X 1,r , . . . , X n,1 , . . . , X n,s ].
Since for any f and any i, f and f σ i have the same monomials, we have deg

I = deg I σ i for all i, hence deg I = ∏ n-1 i=0 deg I σ i = (deg I) n .
Using Proposition 1.74, we can also show that W n (V ) = V(I). In other words we described the ideal theoretic translation of the Weil Restriction of V . Notice that this can be used for ideals independantly from the fact that they are radical or not.

A practical Definition for the Weil Restriction The Weil Restriction is involved in the modelling of the harvesting phase in a Decomposition attack as 0-dimensional systems. However, the above description using Galois theory is not practical. For computational purpose, we now describe a variety isomorphic to W n (V ) -see [CF05, Chap.7, p. 129]. Let θ 1 , . . . , θ n be a F q -basis of F q n . Using this basis, we let

X i = ∑ n i=1 X i j θ i . Any polynomial f = ∑ c α m α in F q n [X 1 , . . . , X r ] can then be rewritten as f ( n ∑ i=1 X 1i θ i , . . . , n ∑ i=1 X ri θ i ) = n ∑ i=1 f i (X 11 , . . . , X 1n , . . . , X r1 , . . . , X rn )θ i ,
for some f i ∈ F q [X 11 , . . . , X rn ], and f = 0 if and only if all f i = 0. Now, if V = V( f 1 , . . . , f r ), then we can write f i = ∑ n j=1 f i j θ i and define a variety W = V( f 11 , . . . , f rn ). By definition W is defined over F q , and verifies the universal properties of the Weil Restriction, so that W is isomorphic to W n (V ). Moreover, the F q -rational points of W are in one-to-one correspondence with the F q n -rational points of V . Building the variety W from the input equations for V is easily done with a computer algebra system such as Magma. To obtain a 0-dimensional subvariety of W , additional constraints must be added; this is explained in Section 3.4.3.

Example: Let K = F 31 and L | K be a quadratic extension with an element t such that t 2 = 2t + 28 and {1,t} is a K-basis of L. Let P(X) = X 2 + (24t + 29)X + 10t + 24 in L[X]. The variety V(P) has dimension 0 and we find the roots of P as V L (P) = V(P) = {11t + 28, 27t + 5}. Now, we evaluate

P(x 0 + x 1 t) = (x 2 0 + 29x 0 + 28x 2 1 + 21x 1 + 24) + (2x 0 x 1 + 24x 0 + 2x 2 1 + 15x 1 + 10)t = P 0 (x 0 , x 1 ) + P 1 (x 0 , x 1 )t,
and set W = V(P 0 , P 1 ). A Gröbner Basis computation for DRL order with x 0 > x 1 gives

G DRL =    x 3 1 + 5x 2 1 + 14x 0 + 20x 1 + 25, x 2 0 + 28x 2 1 + 29x 0 + 21x 1 + 24, x 0 x 1 + x 2 1 + 12x 0 + 23x 1 + 5    .
The staircase of G DRL is {1, x 0 , x 1 , x 2 1 }, so that W has at most (deg P) 2 = 4 points with coordinates in an algebraic closure of K. In lexicographical order with x 0 > x 1 , we find in Shape Position

G lex = x 0 + 20x 3 1 + 7x 2 1 + 28x 1 + 4, x 4 1 + 17x 3 1 + 4x 2 1 + 5x 1 + 13 .
The univariate polynomial has exactly two roots in K, which are 11 and 27. Evaluating the first polynomial at those values, we recover the values 28 and 5 for x 0 , which lead to the roots of P over L. In other words, V L (P) V K (P 0 , P 1 ).

Positive dimension to Zero-dimension with Weil Restrictions

We fix an extension F q n . Consider an affine variety V define over F q n , and assume that we are given an embedding V -→ A m (F q n ). Let g = codimV so that dimV = mg, and so that there is an integer r ≥ g and polynomials f 1 , . . . ,

f r ∈ F q n [X 1 , . . . , X m ] such that V( f 1 , . . . , f r ) = V .
No general algorithmic method exists to find a F q n -point in V as it has positive dimension. By adding constraints to the system, we can make the dimension fall to 0. We can then use the strategy from Section 1.3.3, and we may find F q n -rational points. The problem now is to determine what can be "good" linear constraints on the elements of V . Since we are working in F q n , an example of natural constraint is that the points must have their coordinates in a subfield, say F q . This amounts to adding the equations X q i -X i to the system ( f 1 , . . . , f r ). However, we do not want the degree of the system to rise too much, as the efficiency of the solving process depends crucially on the degree of the equations. At best, we want to add linear constraints, or geometrically, to cut V by enough hyperplanes. This is where we can use the linear structure of F q n over F q . Let θ 1 , . . . , θ n be a F q -basis of F q n and build the "practical" Weil Restriction W = W n (V ). Properties of the restriction says that dimW = n(mg), codimW = ng, and that W = V( f 11 , . . . , f 1n , . . . , f r1 , . . . , f rn ) with the f i j polynomials in F q [X 11 , . . . , X 1n , . . . , X m1 , . . . , X mn ] defined in the previous paragraph using the writing X i = ∑ n i=1 X i j θ i . Recall that the Frobenius automorphism σ (x) = x q generating Gal(F q n | F q ) is a F q -linear map. From this we infer that X q i -X i = 0 if and only if (X i1 , . . . , X in ) ∈ ker(σ -Id). Since 1 is a simple root of the minimal polynomial T n -1 of σ , this kernel has dimension 1 and thus must be defined by n -1 independent linear equations. In practice, we identify F q n with some F q [t]/ P , where P is an irreducible polynomial over F q with deg P = n. This gives a power basis 1,t, . . . ,t n-1 , so that the n -1 equations are X i,2 = . . . = X i,n = 0, see also Section 3.4.2.

Overall, we add m(n -1) linear equations to the system of the f i j 's, giving at least gn + m(n -1) equations. This means the intersection of W with the restrictions of all V(X q i -X i ) has dimension 0 when

gn + m(n -1) ≥ mn ⇔ g ≥ m n . (1.3)
This happens in all the applications we are interested in (Section 3.4.2, Chapter 5 and Chapter 6). For the sake of completeness, we mention that smoother constraints can be added by asking that the X i 's belong to F q -linear subspaces of F q n of higher dimension d. Equations (1.3) then becomes g ≥ md n .

Chapter 2

Algebraic Curves

All this thesis is centered around an object which is built over Algebraic Curves. Their general theory is a rich and active research field with striking consequences, a famous one being the proof of the Fermat-Wiles theorem, and somewhat unexpected practical applications, such as Curve Based Cryptography. Indeed, any curve can be associated with an algebraic group, namely its Jacobian Variety. Hence the Discrete Logarithm Problem can be considered on such objects, when the base field is finite. We often abuse the terminology and use "Discrete Logarithm on Curves" when we mean on the Jacobian Variety of said curve.

This Chapter describes the necessary material to understand what is the Jacobian Variety of a Curve, and gives the most meaningful examples for this thesis. Starting with the general basics of the theory, Section 2.1 introduces divisors and functions over a curve. They are used to define the Picard Group of the curve, and the Jacobian Variety is then defined as a particular subgroup (Definition 2.9). The genus of the curve is an important parameter that helps the classification of algebraic curves. We define it by means of the Riemann-Roch theorem (Theorem 2.12), following mostly [START_REF] Silverman | The Arithmetic of Elliptic Curves[END_REF]. Moreover, when a curve has genus g, then its Jacobian Variety can also be described as an abelian variety of dimension g (see Section 2.1.3). This means that the group law can be expressed using rational functions on the coordinates once a projective embedding has been chosen. A short discussion about the geometric interpretation of the Jacobian arithmetic concludes this Section.

We then focus on Hyperelliptic Curves, targeted by our contributions of Chapters 5 and 6. In the litterature, Hyperelliptic Curves are sometimes defined as curves which admit a double cover of the projective line. All the theory can be developed from this, but it involves more material than actually needed for our applications. For this reason, we choose to directly define Hyperelliptic Curves by their well-known Weierstrass model (Definition 2.17). What makes Hyperelliptic Jacobian Varieties interesting for practical applications is that the arithmetic can be described by polynomial arithmetic using the Mumford Representation and Cantor's algorithm -see Section 2.2.2. . While hyperelliptic arithmetic stays too costly in general for practical implementations, recent works using theta functions arithmetic [Gau07, GL09, LR16, RSSB16, BCHL16] showed a potential competitivity of genus 2 curves with Elliptic Curves, topic of Section 2.3. Following the introduction of Elliptic Curve Cryptosystems, several elliptic curve standards have been proposed [START_REF] Lochter | ECC Brainpool standard curves and curves generation[END_REF][START_REF]Recommended elliptic curves for federal government use[END_REF][START_REF]Sec 2: Recommended elliptic curve domain prameters[END_REF]. They are now widely used in practical implementations (SSL/TLS, ...) and embedded systems. Hence Elliptic Curves are the main reason for this work. They are sometimes defined as hyperelliptic curves of genus 1; we choose to define them as genus 1 curve with a rational point. Apart from there genus (it is always 1), they stand out of the realm of algebraic curves as being the only class of curves that identify to its Jacobian Variety (Proposition 2.22). The arithmetic expresses geometrically by the well-known chord-tangent method, and is detailed in Section 2.3.2. Brief comments are given considering practical and secured implementation using special models of curves ((twisted) Edwards, (twisted) Hessian, Montgomery,...).

Curves and their Jacobian Varieties

General notions about the theory of algebraic curves are detailed here. First, we recall results about functions over a curve. This is needed in Section 2.1.2 to introduce the Picard group of a curve. We develop briefly the notion of divisor over a curve, which gives an algebraic formalism to express local properties of functions. The Picard Group is then introduced as a quotient of the group of all divisors, and the Jacobian Variety is defined as the degree 0 Picard Group, see Definition 2.9. We recall the classic Weil-Hasse bounds for the cardinality of a curve and its Jacobian Variety when the base field is finite. Those bounds are used in nearly all complexity estimates for Index-Calculus over Jacobian Varieties. Next, the genus is introduced thanks to Riemann-Roch's theorem (Theorem 2.12), and used to give a way to describe elements in the Jacobian Variety. This representation is used extensively in Chapter 4 to describe our new Sieving approach to harvesting. Lastly, the geometric structure of Jacobian Varieties is described, highlighting that they belong to the family of Abelian Varieties. All the presentation mostly follows [START_REF] Silverman | The Arithmetic of Elliptic Curves[END_REF] and [START_REF] Fulton | Algebraic curves: an introduction to algebraic geometry[END_REF].

Functions over a curve

Definition 2.1. An algebraic (projective) curve is an irreducible (projective) algebraic variety of dimension 1.

Let C be an algebraic curve. It is possible that C contains singular points, which means that the tangent space at this point has dimension greater than expected. Equivalently, the Jacobian Matrix vanishes at this point. However, it is well-known -see for example [Ful08, Chap. 7.5] -that any projective curve admits a non-singular model. More precisely, we say that two curves are birational when their function field (Definition 1.24) are isomorphic. The correct statement is then that every projective curve is birational to a non-singular projective curve. Hence wlog. we now only consider non-singular curves. We also call them smooth curves.

Proposition 2.2 ([Sil13], Chap. 2.1, p.18). Let C be a smooth algebraic curve. Up to a linear change of variable, K(C ) is a finite and separable extension of K(x).

From the definition of the function field (Definition 1.24), any f ∈ K(C ) can be written as a rational fraction g/h with h / ∈ I(C ) = I. Usually, many choices of g, h can be made as K[C ] may not be an UFD, and two rational fractions g h , g h define the same function if ghg h ∈ I. By P ∈ C we mean that the point has coordinates in K. If C is defined over K, we write P ∈ C (K) for points with coordinates in K.

Definition 2.3. Let C be a projective curve and fix a point P ∈ C . We say that f is defined (or regular) at P if there exists g, h ∈ K[C ] such that f = g h and h(P) = 0. The ring of regular functions at P is denoted by K[C ] P . The maximal ideal at P is the set

M P = { f ∈ K[C ] : f (P) = 0}.
If C is defined over K, any K can be replaced by K. It is straightforward to check that the ring of regular functions at a point is indeed a ring and that M P is a maximal ideal of K[C ]. Thanks to Definition 2.3, a function defined at P can be evaluated by f (P) = g(P) h(P) for suitable g, h. This does not depend on the choice of representant for f : if f = g h ∼ g h , then we have gh = g h + I. From the definition of I, we get g(P)h (P) = g (P)h(P) for any P ∈ C .

A more interesting result is that K[C ] P is a discrete valuation ring, which means that K[C ] P local, with maximal ideal M P , and that M P is principal. The order of a regular function at a point can now be defined. It is an algebraic formulation of the concept of multiplicity. For any polynomial ideal I and nonnegative integer d, we define

I d = f d : f ∈ I .
Definition 2.4. Let C be an algebraic curve and P ∈ C . The order a regular function f at P is ord • f has a zero at P is f (P) = 0.

P : K[C ] P -→ N ∪ {∞} f -→ Sup {d ∈ N : f ∈ M d P }. It is extended to any function f = g h in K(C ) by ord P ( g h ) = ord P (g) -ord P (h). Any t ∈ K[C ] P such that ord P (t) =
• f has a pole at P if 1/ f has a zero at P.

A function f is regular at P if and only if ord P ( f ) ≥ 0, and has a zero at P when ord P ( f ) > 0.

Similarly, f has a pole at P when ord P ( f ) < 0. The next result is key in the definition of the Jacobian Variety.

Proposition 2.6. Let C be an algebraic curve, and f ∈ K(C ) with f = 0. Then f has the same finite number of zeros and poles.

Divisors and the Jacobian variety

We now associate abelian groups with algebraic curves. Let K be a field with algebraic closure K, and consider an algebraic curve C . If a divisor is defined over K, this does not necessarily mean that the points in its support are K-rational.

Definition 2.8. Let f ∈ K(C ). The principal divisor associated to f is defined by

div f = ∑ P∈C ord P ( f ) • P.
The subgroup of principal divisors is denoted Prin C .

Since ord P ( f g) = ord P ( f ) + ord P (g) for any f , g ∈ K[C ] P , we see that div f + div g = div( f g), so that Prin C is indeed a subgroup of div C . If C is defined over K, then any f ∈ K(C ) gives a principal divisor defined over K. Thanks to Proposition 2.6, principal divisors have degree 0, so they indeed form a subgroup of Div 0 C . Definition 2.9 (Jacobian Variety as degree 0 Picard Group). Two divisors D 1 and D 2 are said to be linearly equivalent when D 1 -D 2 = div f for some function f ∈ K(C ). The Jacobian Variety of C is the group of linear equivalence classes among degree 0 divisors, or in other words, the quotient group Jac

(C ) = Div 0 C /Prin C . If C is defined over K, then Jac K (C ) is the subgroup of Jac(C ) which is invariant under the action of Gal( K | K).
The set of all classes, or equivalently, the quotient group Div C /Prin C is known as the Picard Group of the curve. When C is defined over K, it is possible to show that two divisors D 1 , D 2 in Div 0 K C are linearly equivalent if and only if they are linearly equivalent over K, that is to say

D 1 = D 2 + div f for some f ∈ K(C ). As a consequence, we obtain Jac K (C ) = Div 0 K C /Prin K C when C is defined over K.
Riemann-Roch's theorem and the genus of a curve When working with a quotient group, a representation for the classes is needed. Convenient representants for elements in Jac(C ) can be obtained using the genus of the curve and Riemann-Roch's theorem, which we now introduce.

Definition 2.10. A divisor D = ∑ P∈C n P P on C is effective when n P ≥ 0 for all P, and it is

denoted by D ≥ 0. For any D 1 , D 2 ∈ Div C , we write D 1 ≥ D 2 when D 1 -D 2 is effective.
Definition 2.11. Let C be an algebraic curve, and D ∈ Div 0 C . The Riemann-Roch space associated to D is the finite dimensional K-linear space

L (D) = { f ∈ K(C ) * : div f ≥ -D} ∪ {0}.
We also let l

(D) = dim K L (D).
It is not immediate that Riemann-Roch space have finite dimension; a proof is given in [START_REF] Fulton | Algebraic curves: an introduction to algebraic geometry[END_REF]. For l(D) to be greater than 0, it is necessary that deg D ≥ 0. For any D ∈ div C and any point P ∈ C , we have l(D) ≤ l(D + P) ≤ l(D) + 1, see [Ful08, Prop.3, p.99]. In other words, adding a point to a divisor increases the dimension of the Riemann-Roch space by at most 1.

Theorem 2.12 (Riemann-Roch, [START_REF] Fulton | Algebraic curves: an introduction to algebraic geometry[END_REF]). Let C be an algebraic curve. There exists a unique integer g ≥ 0, and a divisor E such that for every D ∈ Div C ,

l(D) -l(E -D) = deg D -g + 1.
The integer g is called the genus of C .

Usually there are many E that fit into the statement of the theorem -they are called canonical divisors and related to differential forms, see [Sil13, Chap.2] or [START_REF] Fulton | Algebraic curves: an introduction to algebraic geometry[END_REF]Chap.8]. The weaker form, known as Riemann's theorem, gives a lower bound for l(D). Some immediate consequences of Theorem 2.12 are:

• l(E) = g by setting D = 0; • deg E = 2g -2 by setting D = E; • if deg D > 2g -2, then l(E -D) = 0 and hence l(D) = deg D -g + 1.
The next corollary gives a representation of elements of the Jacobian thanks to the genus. It is also used to work rigorously with divisors, for example in our Sieving approach in Chapter 4.

Corollary 2.13 (Representation for elements in the Jacobian variety). Let C be an algebraic curve of genus g defined over a field K, with at least one K-rational point O. For any D ∈ Div 0 C , there exists an integer 0 ≤ k ≤ g and P 1 , . . . , P k ∈ C such that D is equivalent to

P 1 + • • • + P k -kO.
Proof. Let D ∈ Div 0 C and consider the divisor D 1 = D -gO. From Riemann-Roch's theorem we have l(D 1 ) ≥ deg D 1g + 1 = 1 so there exists a non-constant f ∈ L (D 1 ). This function f is such that div f -D + gO is effective of degree g. Therefore, there exists P 1 , . . . , P g ∈ C such that div f -D + gO = P 1 + • • • + P g . Now some cancellation can happen if some P i 's are O.

In other words, any degree 0 divisor can be represented in Jac(C ) by a divisor of the form P 1 + • • • + P k -kO, where k ≤ g and O is a distinguished point of C . We say that this representation is minimal when k is the smallest possible integer. It is possible [START_REF] Galbraith | Arithmetic on superelliptic curves[END_REF] to refine Corollary 2.13 by showing that a minimal representation is unique. For completeness we give the demonstration.

Proposition 2.14 (Reduced divisors). For any divisor D of degree 0 on a curve, there exists a unique and minimal representant Proof. The existence comes from Corollary 2.13. Let D be a degree 0 divisor with

P 1 + • • • + P k -kO of the class of D in Jac(C ).
D ∼ P 1 + • • • + P k -kP ∞ = D 0 , k being minimal. If k = 0, then D is a principal divisor, so assume that k ≥ 1. If l(D 0 + (k -1)O) > 0, there exists a function f and an effective divisor E such that div f + D 0 + (k -1)O = E. In other words, D 0 ∼ E -(k -1)O, which contradicts the minimality of k. Hence l(D 0 + (k -1)O) = 0,
and since adding a point to a divisor increases the dimension by at most 1, l(D 0 + kO) ≤ 1. As D 0 + kO is effective, its associated space contains the constant, so we find

L (P 1 + • • • + P k ) = K. Let now E -kO ∼ P 1 + • • • + P k -kO. By definition there is a function f such that div f +P 1 +• • •+P k = E, so that f ∈ L (P 1 +• • •+P k ). Thus f is constant, which implies that E = P 1 + • • • + P k .

Jacobian Varieties as Abelian Varieties

The Jacobian variety enjoys a group structure, but is also an algebraic variety. More precisely, there exists an algebraic variety whose points identify one-to-one to the elements of Jac(C ), that we now briefly describe. Denote by C (g) = C g /S g its symmetric product, that is to say, the cartesian product of g copies of the curve where the order of the points in a g-tuple is not considered. Assume that C has at least one point O and define a map

C (g) -→ Jac(C ) (P 1 , . . . , P g ) -→ P 1 + • • • + P g -gO
Corollary 2.13 shows this map is at least surjective. Observe that if C is defined over K, then its symmetric product is defined over K. However, there are elements in Jac K (C ) which cannot be described by K-rational points of C , see Section 2.2.2 for an example. The fundamental result is that this map is compatible with the group law on Jac(C ), and that it can be described by rational maps (informally, once coordinates have been chosen for the variety, rational fractions in those coordinates). Such algebraic varieties are called Abelian varieties and are important objects in algebraic geometry. We give a more precise definition. Definition 2.15. An Abelian Variety is a projective algebraic group. In other words, it is a projective algebraic variety, endowed with a group law that can be expressed by regular rational functions of the coordinates.

Geometrically, the group law can be described as follow. Let D 1 , D 2 in Jac(C ). For simplicity, we assume that D 1 , D 2 have weight g, which means

D 1 = P 1 + • • • + P g -gP ∞ , D 2 = Q 1 + • • • + Q g -gP ∞ ,
and all P i and Q i are distinct. We look for a reduced divisor D equivalent to the degree 0 divisor D 3 = D 1 + D 2 . For simplicity, we assume that D 3 has weight g. In other words, we look for a function f ∈ K(C ) such that div f = D 3 -D, so that we need f ∈ L (gP ∞ -D 1 -D 2 ). From Riemann-Roch's theorem, this space has dimension at least 1 and l(3gP ∞ ) = 2g + 1. Adding a point to a given divisor increases the dimension of the associated space by at most 1, and from this we deduce that l(gP ∞ -D 1 -D 2 ) = 1. Therefore, f in unique up to a constant. Computing the group law amounts to computing this function and find its remaining zeroes.

The main problem is that it is difficult to determine this function starting from reduced divisors, that is to say, from input points. When the curve is hyperelliptic, a more practical representation allowing for algorithmic computation of this group law is introduced in Section 2.2.2 with Mumford Representation. When the curve is elliptic, explicit formula can be obtained straightforwardly by a geometric description of the addition, see Section 2.3.

Cardinal bounds over finite fields When the field of definition is finite, it is obvious that a curve and its Jacobian variety has a finite number of rational points. It is less obvious that there is a general formula to estimate this number. A first result in this direction was obtained by Hasse for elliptic curves. Weil later proposed a generalized conjecture for any projective variety, and proved the results for all curves of a given genus and Abelian Varieties. In this thesis we only need statements for curves and their Jacobian variety.

Theorem 2.16 (Hasse, Weil). Let C be an algebraic curve of genus g, defined over F q . We have the following bounds:

• |#C (F q ) -q + 1| ≤ 2g √ q. • ( √ q -1) 2g ≤ # Jac F q (C ) ≤ ( √ q + 1) 2g .
When the genus g is fixed, an interpretation of Theorem 2.16 is that #C = O(q) and # Jac(C ) = O(q g ). It is often used implicitly in the complexity analyses of Chapter 3.

Hyperelliptic Curves

Equations for hyperelliptic curves

Traditionally, hyperelliptic curves are defined as degree 2 coverings of the projective line. This presentation can be reformulated in terms of function fields by saying that H is hyperelliptic when K(H ) is a separable degree 2 extension of K(x) = K(P 1 ). The natural automorphism of K(H ) of order 2 and which fixes K(x) induces the hyperelliptic involution on H . For more details, see for example [START_REF] Cohen | Handbook of elliptic and hyperelliptic curve cryptography[END_REF]Chap. 4]. While this approach is elegant and general, it does not suit straightforwardly a computational point of view -some work and additional material are needed to derive equations. For this reason, we choose to directly define hyperelliptic curves by an affine equation.

Definition 2.17. Let K be a field and g ≥ 1 an integer. An imaginary hyperelliptic curve H of genus g is an algebraic curve that admits an affine equation in the form of

H : y 2 + h 1 (x)y = h 0 (x), with h 0 , h 1 ∈ K[x], deg h 1 (x) ≤ g and deg h 0 (x) = 2g + 1, such that the equations 2y -h 1 (x) = 0 and yh 1 (x) -h 0 (x) = 0 have no common solutions.
Other models exist, called real, but they are less used in practice and therefore we do not elaborate further on them. The last condition implies that H has no singular points. Such a model is called an imaginary model for the hyperelliptic curve, and admits a single point at infinity P ∞ = [0 : 1 : 0]. As a distinguished point P ∞ always exists, there is a canonical way of embedding H into its Jacobian variety, using the map H -→ Jac(H ), P -→ P -P ∞ . In the next Section we will show that this is in fact a bijection if g = 1.

Definition 2.18. Let H be an hyperelliptic curve defined by an equation as

y 2 + h 1 (x)y = h 0 (x). The application ι : H -→ H (x, y) -→ (x, -y -h 1 (x))
is called the hyperelliptic involution. For any P ∈ H , ι(P) is called the opposite of P.

It is straightforward to verify that this application is correctly defined and satisfies ι 2 = id. Moreover this involution is compatible with the addition in the Jacobian: for P ∈ H , we have div(xx P ) = P + ι(P) -2P ∞ , and then ι(P) -P ∞ ∼ -(P -P ∞ ) -this is also why we call ι(P) the opposite of P. The points such that ι(P) = P are called Weierstrass points (or sometimes ramification points), and have order 2 in Jac(H ).

We now consider the particular case of genus 2 curves, which are a particular focus of our work.

Proposition 2.19. Let H be a smooth genus 2 projective curve. Then there is a double cover ϕ : H -→ P 1 .

Proof. Let W be a canonical divisor on H . We can assume wlog. that W is effective. Indeed, by Riemann-Roch's theorem, l(W ) = 2, so there are two linearly independent functions g 1 = g 2 that generates L (W ). Thus if (λ 1 , λ 2 ) = (0, 0) and f = λ 1 g 1 + λ 2 g 2 , then W = div f + W is effective and linearly equivalent to W , and we can take g 1 = 1. Since degW = 2, then W = P 1 + P 2 for some P 1 , P 2 ∈ H , which means g 2 has two poles P 1 , P 2 . Then the map ϕ : H -→ P 1 given by ϕ(P) = [g 2 (P) : 1] and ϕ(P i ) = [1 : 0] is a well-defined non-constant (hence surjective) morphism of curves, which has degree two.

If we admit the alternate definition of hyperelliptic curves (curves that are double covers of the projective line), then this shows that all genus 2 curves are hyperelliptic.

Short Weierstrass equations in odd characteristic Let K be a field not of characteristic 2, and H be an hyperelliptic curve of genus g. Using the transformation (x, y) → (x, yh 1 (x)/2), we can get an isomorphic hyperelliptic curve H w with equation in the form of H w : y 2 = h(x),

with h ∈ K[x], deg h = 2g + 1.
This equation is called a short Weierstrass model. In this model, singularities happen only if f has roots with multiplicity ≥ 2. The hyperelliptic involution is given by ι(x, y) = (x, -y). Further in this work, when we consider hyperelliptic curves over fields of characteristic = 2, we always assume that they are given by a short Weierstrass equations. When Char(K) = 2, a classification for genus 2 curves is known -see Section 6.1.3, which is inspired from [BD04, CJ03].

Arithmetic of hyperelliptic curves: the Mumford Representation

The Mumford representation is an elegant and compact polynomial representation for elements in the Jacobian.

Theorem 2.20 (Mumford Representation). Let H : y 2 + h 1 (x)y = h 0 (x) be an hyperelliptic curve of genus g defined over K. Any D ∈ Jac K (H ) can be uniquely represented by a couple of polynomials

(u, v) ∈ K[x] × K[x] such that
• u is monic.

• deg v < deg u ≤ g • u | v 2 + h 1 (x)v -h 0 (x). Let D = P 1 + • • • + P k -kP ∞ ∈ Jac(H ), k ≤ g,
(x) = x 2 +311x+835, v E (x) = 277x+ 889.
Although u E has no roots over F 1031 , we find that u E = (x -145t -215)(x -886t -505) in a degree 2 extension L F 1031 [t]/ t 2 -2t + 14 . We indeed verify that the L-rational points Q 1 = (145t + 215, 987t + 646) and Q 2 = (886t + 505, 44t + 558) belong to H , so that

E = Q 1 + Q 2 -2P ∞ .
This is an example of divisor defined over K by non K-rational points. Using its Mumford representation, checking if a divisor is defined over K is immediate.

Mumford representation also allows a nice description of the group law using Cantor's algorithm (Algorithm 1, [START_REF] Cantor | Computing in the Jacobian of an hyperelliptic curve[END_REF]), and therefore practical implementations of Jacobian varieties for hyperelliptic curves. The idea of the algorithm is to first compute a polynomial representation for the degree 0 divisor D 1 + D 2 , then to use the divisibility condition in the representation to reduce it until it has correct size.

Algorithm 1 Addition in the Jacobian Variety of Hyperelliptic Curves

Input: D 1 = (u 1 , v 1 ), D 2 = (u 2 , v 2 ) in Jac(H ), and H : y 2 + h 1 (x)y = h 0 (x). Output: The Mumford representation (u, v) of the unique reduced divisor

D = D 1 + D 2 . d 1 , a 1 , b 1 ← xgcd(u 1 , u 2 ); /* d 1 = a 1 u 1 + b 1 u 2 */ d, a, b ← xgcd(d 1 , v 1 + v 2 + h 1 ); /* d = ad 1 + b(v 1 + v 2 + h 1 ) */ s 1 ← aa 1 , s 2 ← ab 1 , s 3 ← b; u ← u 1 u 2 d 2 ; v ← s 1 u 1 v 2 + s 2 u 2 v 1 + s 3 (v 1 v 2 + h 0 ) d mod u; while deg u > g do u ← h 0 -vh 1 -v 2 u , v = (-h 1 -v) mod u ; u ← u , v ← v ; end while return u LC(u) , v
We give a brief description of what is done in the loop, where for simplicity we assume that gdc(u 1 , u 2 ) = 1, so that d = d 1 = 1. Before the loop, v is the solution modulo u of the chinese remainders system v ≡ v i mod u

i . If deg u ≤ g, then (u, v) is the Mumford Represen- tation of D 1 + D 2 . If deg u = m > g, then the divisor D 3 = D 1 + D 2 is not reduced and can be written D 3 = P 1 + • • • + P m -mP ∞ . As div(y -v) = D 3 + Q 1 + . . . + Q l -lP ∞ for some 0 < l < m, we have D 3 ∼ D 4 := ι(Q 1 ) + • • • + ι(Q l ) -lP ∞ ,
which has smaller weight. Thus we want to find polynomials describing D 4 . On the one hand, the roots of u in K are roots of

v 2 + h 1 v -h 0 , hence there is u ∈ K[x] such that uu = v 2 + h 1 v -h 0 . On the other hand, we check that v 2 + h 1 v -h 0 = (y -v)(y + h 1 + v).
This means that div(u) + div(u ) = div(yv) + div(y + h 1 + v), so that u and -h 1v mod u are what we need. Figure 2.1 gives a geometric intuition for a genus 2 curve with equation y 2 = f (x) defined over the reals.

H P 1 R 2 Q 1 R 1 P 2 Q 2 ι(R 2 ) ι(R 1 )
+ P 2 + Q 1 + Q 2 + R 1 + R 2 -6P ∞ , so we define (P 1 + P 2 -2P ∞ ) + (Q 1 + Q 2 -2P ∞ ) = (ι(R 1 ) + ι(R 2 ) -2P ∞ ) Example: Consider the divisors D = P 1 + P 2 -2P ∞ = (u D , v D ) and E = Q 1 + Q 2 -2P ∞ = (u E , v E ) of
v = (1019x + 573)u D v E + (12x + 559)u E v D mod u = 43x 3 + 441x 2 + 176x + 332. We verify that y -v is the equation of the cubic passing through P 1 , P 2 , Q 1 , Q 2 .
Such a function has a pole of order 6 at infinity, hence the divisor div f -

D -E = R 1 + R 2 -2P ∞
has weight 2 and is therefore reduced. The polynomial h 0vh 1v 2 is in fact the resultant of yv and the curve's equation with respect to y, and thus describe the abscissae of all the intersection points. In particular, x(R 1 ) and x(R 2 ) are the roots of

h 0 -vh 1 -v 2 u = 213x 2 + 231x + 662, that we make monic to find u F (x) = x 2 + 974x + 158. From the previous paragraph, if we take v = v mod u F , then v (x(R i )) = y(ι(R i )
), so we have to account for the action of the hyperelliptic involution, and set v F = -v mod u F = 548x + 902. To verify our result, we compute the roots of u F and evaluate v F at their values, to find that R 1 = (418t + 126, 182t + 873) and R 2 = (613t + 962, 849t + 206) are L-rational points of H . Those points are also zeroes of yv. All the polynomials considered by the algorithm have degree less than g, so every operation can be done in O(g 2 ). Improvements for special cases, characteristic and curves have been proposed, see for example [START_REF] Blake | Advances in Elliptic Curve Cryptography[END_REF] and [CF05, Chap. 14]. Geometric approaches have been also designed [START_REF] Costello | Group law computations on Jacobians of hyperelliptic curves[END_REF][START_REF] Hisil | Jacobian coordinates on genus 2 curves[END_REF], and recent works on genus 2 curves using theta functions arithmetic and Kummer surfaces [Gau07, GL09, CCS15, BCHL16] have lead to very efficient arithmetics.

Complexity analysis and improvements

Elliptic Curves

Weierstrass models for elliptic curves

Definition 2.21 (Elliptic Curves). An elliptic curve defined over K is a projective curve of genus 1 defined over K with at least one K-rational point O.

The fundamental property of elliptic curves is that they identify to their Jacobian variety, and that the group law transfers from the Jacobian to the curve.

Proposition 2.22. Let E be an elliptic curve defined over K with distinguished K-rational point O. The application ϕ O : E -→ Jac(E) defined by ϕ O (P) = P -O is a bijection, and E is an abelian group with neutral element O.

Proof. Surjectivity comes from Corollary 2.13. Let P, P in E such that P -O ∼ P -O. By definition there exists a function f such that div f = P-P , or in other words, there is a function in L (P ). From Riemann-Roch theorem, this space has dimension 1, and since it contains the constants, it is in fact the space of constant functions. But if f is constant, then div f = 0 or equivalently, P = P and ϕ O is one-to-one. Using again Corollary 2.13 it is straightforward to verify that the application σ :

E × E -→ E defined by σ (P, Q) = ϕ -1 O (ϕ O (P) + ϕ O (Q)) transfers the group structure of Jac(E) on E.
Definition 2.21 is enough to find an affine equation for any elliptic curve. Let K be a field and E an elliptic curve defined over K. From Riemann-Roch's Theorem 2.12, and any integer n ≥ 1, we have l(nO) = n. From this we deduce that L (O) = K, that there is a nonconstant function x such that {1, x} is a K-basis of L (2O), and a nonconstant function y = x such that {1, x, y} is a K-basis of L (3O). This implies that {1, x, y, x 2 } is a K-basis of L (4O) and that {1, x, y, x 2 , xy} is a K-basis of L (5O). Now the space L (6O) has dimension 6 and contains the seven functions 1, x, x 2 , x 3 , xy, y, y 2 . This means there is a linear relation among them, whose coefficients in x 3 and y 2 cannot vanish. Up to scalar multiplication on x and y, the relation has the form of

y 2 + a 1 xy + a 3 y = x 3 + a 2 x 2 + a 4 x + a 6 , a i ∈ K. (2.1)
This defines an affine plane curve E , with projective closure E ⊂ P 2 given by

E : Y 2 Z + a 1 XY Z + a 3 XZ 2 = X 3 + a 2 X 2 Z + a 4 XZ 2 + a 6 Z 3 .
It has a single point at infinity [0 : 1 : 0], which is in fact O. It is then possible to show that E is isomorphic to E. As we mainly consider affine models, we may assume any elliptic curve admits an equation as (2.1). Smoothness of the curve is achieved if the partial derivatives 2y + a 1 x + a 3 and a 1 y -(3a 2 x 2 + a 4 ) do not vanish simultaneously at a point (x 1 , y 1 ) ∈ E.

Remark 2.23. From Equation 2.1 and its affine version and Definition 2.21, it seems that we can see elliptic curves as hyperelliptic curves of genus 1. While this point of view is not problematic for any of our contributions, it hides a fundamental structural difference between hyperelliptic and elliptic function fields, see [CF05, Chap.4-4, p.73].

The general equation for an elliptic curve is not the most convenient for computational purpose. Sparser equations are well-known. We omit the case of characteristic 3 as we never consider it in our applications.

Proposition 2.24 (Short Weierstrass equations for Elliptic curve). Let E : y 2 + a 1 xy + a 3 y = x 3 + a 2 x 2 + a 4 x + a 6 be an elliptic curve defined over a field K with Char(K) = 3. There exist linear changes of variables such that E admits an equation in the form of

• y 2 = x 3 + a 4 x + a 6 if Char(K) = 2; • y 2 + xy = x 3 + a 2 x 2 + a 6 if Char(K) = 2 and a 1 = 0 • y 2 + a 3 y = x 3 + a 4 x + a 6 if Char(K) = 2 and a 1 = 0
Elliptic curves with equation like the last one are called supersingular. They are known to be weak for any Discrete logarithm purpose [START_REF] Frey | A remark concerning m-divisibility and the discrete logarithm in the divisor class group of curves[END_REF] but were popular in pairing-based cryptography because their Tate pairing is easy to compute. The elliptic involution is often denoted [-] : E -→ E and defined as [-](x, y) = (x, -y) in odd characteristic or [-](x, y) = (x, y+ x) or (x, y + a 3 ) in even characteristic. For a short Weierstrass equation in odd characteristic, the roots of x 3 + a 4 x 2 + a 6 give three points of order 2, that is to say points fixed by the elliptic involution. Such points are also called 2-torsion points.

Arithmetic of Elliptic Curves

The geometric interpretation of the group law on an elliptic curve is well-known as the chordtangent method. We first briefly recall how it is done. Let E be an elliptic curve with point at infinity O, and let P 1 , P 2 be two points of E. Because E has an equation of degree 3, the line through P 1 , P 2 must cut E in a third point Q. In term of divisor,

P 1 + P 2 + Q -3P ∞ is principal, hence 0. As Q ∼ [-]Q, it
is natural to define an addition on E as P 1 ⊕ P 2 = [-]Q. There are some particular cases -see also Figure 2.2 for a visualization over the reals:

• when P 1 = O, we define P 1 ⊕ P 2 = P 2 ;

• when P 1 = [-]P 2 , we define P 1 ⊕ P 2 = O;

• When P 1 = P 2 , the line is the tangent at P 1 for E, and

P 1 ⊕ P 2 = 2P 1 .
It is known (and proved for example in [Sil13, Chap.3]) that this geometric law is the same as the group law from Jac(E), when it is transferred on E as in Proposition 2.22. For this reason, we often denote P 1 ⊕ P 2 directly as P 1 + P 2 and -P stands either for the image by the elliptic involution or the opposite for the group law. Formulae can be deduced once an equation E : y 2 + a 1 xy + a 3 y = x 3 + a 2 x 2 + a 4 x + a 6 is given. The computations are identical to that of Cantor's algorithm 1 for genus 1 curve if we consider that a point has a Mumford representation as (xx(P), y(P)). We now explicit those formulae, omitting the special cases. Let P 1 (x 1 , y 1 ) and P 2 (x 2 , y 2 ) be points of E, and P 3 = P 1 + P 2 = (x 3 , y 3 ). We also let λ be the slope of the line through P 1 , P 2 or the slope of the tangent of E at P:

P 1 P 2 Q P 1 ⊕ P 2 P Q 2P O P 1 -P 1
Addition: λ = y 2 -y 1 x 2 -x 1 Doubling: λ = 3x 2 1 + 2a 2 x 1 + a 4 -a 1 y 1 2y 1 + a 1 x 1 + a 3
Then the coordinates of the sum are given by

x 3 = λ 2 + a 1 λ -a 2 -x 1 -x 2 y 3 = λ (x 1 -x 3 ) -y 1 -a 1 x 3 -a 3 .
Improvements, special models Several elliptic curves have been selected as standards for cryptographic primitives. Indeed, the litterature on their arithmetic is extremely rich and various approaches have been proposed to give faster, more efficient and secured arithmetic. A close-to-exhaustive (practical) listing can be found on the url http://hyperelliptic. org/EFD/, and we give some explanations on what can be found there.

Fastest arithmetic can be designed using (twisted) Edwards curves, see [Edw07, BBJ + 08, BLF08]. These models have complete addition law (in the sense that there are no particular cases), and require fewer operations than curves in short Weierstrass models. Adding torsion points and computing involution amount to sign changes. These models are in fact really close to some theta models. In particular, this link was used in even characteristic to define binary Edwards curves [START_REF] Fouotsa | Pairing computation and arithmetic of elliptic curves for cryptography[END_REF]. Another interesting family of curves is the class of (twisted) Hessian curves [START_REF] Smart | The Hessian form of an elliptic curve[END_REF][START_REF] Bernstein | Twisted Hessian curves[END_REF], which come close to Edwards curves in term of speed.

For side-channel resistant implementations of the scalar multiplication, that is to say, computations of mP for some fixed P, the Montgomery ladder [Mon87] can be used. While the algorithm does not depend on the model of the curve, an efficient implementation requires some properties on the addition law. Curves with said properties are called Montgomery Curves. Any Montgomery curve can be transformed into a (twisted) Edwards curve and reciprocally.

Chapter 3

The Discrete Logarithm Problem in Jacobian Varieties

This Chapter gives a State-of-the-Art on the Discrete Logarithm Problem. This problem can be stated as such: given an abelian group (G, ×) and g, h ∈ G, find, if it exists, an integer x such that g x = h. Variants of the problem exist, for example if G is known to be cyclic with order N and g is a generator -it is the case in most practical applications. The first Section presents the DLP as the inverse problem of the group exponentiation. It also introduces applications of the DLP in cryptography, with the Diffie-Hellman key exchange, the ElGamal encryption and the Digital Signature Agorithm (DSA). The next Sections all deal with known methods to compute Discrete Logarithms. In Section 3.2, generic attacks are presented. In this context, it is assumed that only the group law can be used, which is precised in Definition 3.4. In the generic case, it is known that a generic algorithm needs a number of arithmetic operations at least proportional to the square root of the group order to solve a DLP instance ([Nec94, Sho97], see Theorem 3.5 for a precise statement). As the size of a group can be carefully chosen, the DLP is generically a hard problem.

To achieve better asymptotic complexities and practical run time for DLP computations, specialized approaches must be used. The term "specialized" implies that the richer structure (algebraic equations, underlying geometry, ...) surrounding the group is exploited to compute Discrete Logarithms. Indeed, in practice, the target group is the group of rational points of an elliptic curve defined over a finite field. This second situation is a particular case of the Discrete Logarithm Problem over the Jacobian Variety of an algebraic curve, the main topic of this thesis and therefore of the remaining Sections. A popular specialized approach to the DLP is given by the family of Index Calculus algorithms. Such algorithms run in mainly two phases: in a first one, an overdetermined linear system linking discrete logarithms of selected elements of the group is built. As a particular focus of this work, we refer to this phase as the harvesting or relations collection. The linear system is then solved in a second phase. Section 3.3 gives more details.

Several variants of the harvesting exist, and for certain families of group, have culminated in subexponential algorithms [START_REF] Adleman | A subexponential algorithm for discrete logarithms over hyperelliptic curves of large genus over GF(q)[END_REF], with proper analysis in [Eng02, EG02, ES02], and [START_REF] Enge | An L(1/3) discrete logarithm algorithm for low degree curves[END_REF], detailed in Section 3.3. However, the parameters targeted by those algorithms are not practical. In fact, practical applications only consider elliptic curves (g = 1), which are already widely used [LM10, [START_REF]Recommended elliptic curves for federal government use[END_REF][START_REF]Sec 2: Recommended elliptic curve domain prameters[END_REF]. Recent works on Jacobian arithmetics [Gau07, GL09, LR16] suggest that genus 2 curves can be competitive with elliptic curves, and could therefore be considered for future standards. Still, other algebraic curves must not be ruled out of the picture: Transfer attacks [Die03, GHS02] can transfer DLP instances on certain Elliptic Curves to equivalent instances on potentially weaker curves, usually with higher genus and defined on different finite fields. Such attacks are briefly covered in Section 3.4.1. The main idea is to use the concept of Weil Restriction of an algebraic variety defined over an extension of a finite field (defined in Section 1.5.2). This approach leads to another variant of the harvesting, called Decomposition Attacks and pioneered by Gaudry and Diem in [START_REF] Diem | On the discrete logarithm problem in elliptic curves[END_REF][START_REF] Gaudry | Index calculus for abelian varieties of small dimension and the elliptic curve discrete logarithm problem[END_REF]. Decomposition attacks are concerned with the major part of our contributions, and are therefore emphasized in this Chapter.

Discrete Logarithm Problem and Cryptography

Exponentiation and Discrete Logarithm

Public-key cryptography is based on one-way functions. A function is said to be one-way when computing its value with given inputs can be done quickly in term of arithmetic operations while, on the contrary, recovering the inputs from the result cannot be done easily. Among public key cryptosystems, the two most famous one-way functions are the Discrete Logarithm [START_REF] Diffie | New directions in cryptography[END_REF] and RSA [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF]. For the latter, computing the product of two (very large) prime numbers can be done very efficiently, whereas obtaining the factorization when the product is given is usually a challenging task. The Discrete Logarithm involves an Abelian group (G, ×). For a given g ∈ G and x ∈ N, the exponentiation g x can be computed very efficiently, thanks to the Square-and-Multiply algorithm and assuming x can itself be computed very efficiently. We give one version in Algorithm 2.

Algorithm 2 Square-and-Multiply

Input: A element g of an abelian group (G, ×), and x ∈ N. Output: The exponentiation g x in G. l ← log 2 (x) and i ← l -1; Get binary expansion of x = (x l-1 . . . x 0 ) 2 ; a ← 1 G . while i ≥ 0 do a ← a 2 ;

if n i = 1 then a ← a × g; end if i ← i -1; end while return a
It is straightforward to see that the loop is entered log 2 (x) times, and that the worst case happens when all bits of x are 1. If G has known order N of bitsize t, we can assume for simplicity that the exponent x has at most size t. If an operation of the group law is computed in M(t) operations, Algorithm 2 needs at most 2tM(t) operations in the group to terminate. This gives a complexity of O(tM(t)), which is linear in term of group multiplications, and at most cubic in bitsize t for practical groups. Several variants exists (see for example [CF05, Chap. 9]) depending on the constraints. Definition 3.1 (Discrete Logarithm). Let (G, ×) be an abelian group, and g ∈ G of order N. Let h ∈ g . The discrete logarithm of h in base g is the unique integer 0 ≤ x ≤ N -1 such that g x = h. It is denoted by x = log g (h).

Thanks to Definition 3.1, the Discrete Logarithm Problem can now be seen as the inverse problem of the Exponentiation. Problem 3.2 (Discrete Logarithm Problem (DLP)). Let (G, ×) be an abelian group, and g, h be in G. The General Discrete Logarithm Problem is to find, if it exists, an integer x such that g x = h. Remark 3.3. In practice, we usually have G = g of order N. The DLP is then to find the unique integer 0 ≤ x ≤ N -1 such that g x = h.

Before turning to applications in cryptography, it remains to understand why the Discrete Logarithm Problem is (generically) considered a difficult problem to solve. Definition 3.4 (Generic Algorithm). An algorithm performing operation over a group is said to be generic when it can only performs the following operations:

• computing the product of two group elements;

• computing the inverse of a group element;

• checking if two group elements are equal.

Considering only generic algorithms over abelian groups, the next theorem assesses the hardness of the DLP in general. The statement implicitly uses Pohlig-Hellman reduction ( [START_REF] Pohlig | An improved algorithm for computing logarithms over GF(p) and its cryptographic significance (corresp.)[END_REF], see also Section 3.2.1).

Theorem 3.5 ( [START_REF] Nechaev | Complexity of a determinate algorithm for the discrete logarithm[END_REF][START_REF] Shoup | Lower bounds for discrete logarithms and related problems[END_REF]). Let G = g be an abelian group of order N, h ∈ G, and let p be the greatest prime divisor of N. Then a generic algorithm needs at least Ω( √ p) group operations to compute the Discrete Logarithm of h in base g.

Hence, over a group with a prime cardinality of 160 bits, a generic algorithm needs at least 2 80 operations to compute a discrete logarithm. If we consider only generic algorithms, and log 2 (p) = 256, then recommended cryptographic security is achieved. This has to be compared with RSA key-size, for which the recommandation is now at least 4096 bits. Theorem 3.5 is already enough to understand the generic difficulty of the DLP, but the given bound is in fact tight, as it is reached by several algorithms -see Section 3.2 -and so the conclusion could be reformulated with a Θ( √ p) instead.

The special case G = (Z/NZ, +) Here the DLP rewrites as xg ≡ h [N], and we assume for simplicity that g is a generator. This also means that GCD(g, N) = 1, equivalently that g is invertible modulo N. Its inverse g -1 can be computed in quadratic time in log 2 (N) using Extended Euclidean Algorithm and satisifies x ≡ hg -1 [N]. Hence solving the Discrete Logarithm Problem in (Z/NZ, +) amounts to computing an inverse modulo N. This is an example of a non-generic algorithm because the ring structure has been used in the computation of the inverse. Recall that if a given group G is known to be cyclic of order N with generator g, then it is isomorphic to (Z/NZ, +). From Z/NZ to G this is simply the exponentiation i → g i . However, describing the inverse map amounts to solve the discrete logarithm in G as we want to define h → log g (h). Hence describing the isomorphism is equivalent to solve the discrete logarithm problem in G.

DLP Based Cryptosystems

Diffie-Hellman's key exchange Presented in 1976 and following Merkle's ideas, the Diffie-Hellman Key Exchange [START_REF] Diffie | New directions in cryptography[END_REF] allows two parties to share a common secret -typically a key for a symmetric cipher. This started asymmetric cryptography and gave a first answer to the problem of key distribution between users. It is used as an essential component in cryptographic protocols such as SSL or TLS. Traditionally, the two parties are named Alice and Bob, and an ennemy Eve is spying them. Alice and Bob first agree publicly on a cyclic group G = g or order N, hence the tuple (G, g, N) is known. The exchange is then described by the scheme below.

Alice (G, g, N) Bob a = Rand(N) b = Rand(N) A = g a B = g b A / / B o o K = B a K = A b
Table 3.1: Diffie-Hellman Key Exchange

In Table 3.1 the function Rand(N) stands for a cryptographic Pseudo-Random Number Generator (PRNG) returning an positive integer smaller than N. The Computational Diffie-Hellman Problem (CDHP) is the following: given (G, g, N) and g a , g b , compute K = g ab . It is straightforward to see that if Eve has an efficient algorithm to solve the DLP, then she can solve as efficiently the CDHP. The converse is not known, but in special cases both problems are equivalent [START_REF] Den | Diffie-Hellman is as strong as discrete log for certain primes[END_REF][START_REF] Ueli | Towards the equivalence of breaking the Diffie-Hellman protocol and computing discrete algorithms[END_REF]. In practice, groups of rational points of standardized elliptic curves are used and the protocol is then called Elliptic Curve Diffie-Hellman (ECDH).

El-Gamal Encryption El-Gamal encryption is a scheme that allows a user to send encrypted data to the owner of a public key. To decrypt the data it is necessary to know the secret key associated with the public key. Alice chooses again a cyclic group G = g of order N, a random integer x ≤ N and compute h = g x . Then she publishes her public key pk = (G, g, N, h) and keeps her secret key sk = x. Assuming that Bob has a way of mapping data to elements of G, he can now send data encrypted using the public function Enc pk . Alice can read such data using her decryption function Dec sk . Both functions are described in Algorithms 3 and 4.

Algorithm 3 El-Gamal Encryption Enc pk

Input: A message m ∈ G. Output: A ciphertext c = (c 1 , c 2 ). t ← Rand(N); /* t: ephemeral key */ c 1 ← g t ; s ← h t ; c 2 ← m × s; return (c 1 , c 2 ) Algorithm 4 El-Gamal Decryption Dec sk Input: A tuple (c 1 , c 2 ) in G × G. Output: A message m ∈ G. s ← c x 1 ; i ← s -1 ; m ← c 2 × i; return m For any m ∈ G, we have Dec sk (Enc pk (m)) = m, since c 2 × i = (m × (g x ) t ) × (g -t ) x = m. If
Eve can efficiently solve the DLP, then she can decrypt all data sent to Alice, as she can recover the secret key x. Notice that s = h t = (c 1 ) x = g xt is a shared value between Alice and Bob during decryption of (c 1 , c 2 ) and that Eve knows h = g x and c 1 = g t . Hence, if Eve can efficiently solve the CDHP, she can decrypt the message contained in c 2 . Using only El-Gamal encryption, Alice has no way to make sure that Bob is indeed the sender of data. Achieving this is known as Signature and can be done with a Discrete Logarithm based protocol that we now describe.

Digital Signature Algorithm (DSA) The Digital Signature Algorithm allows to certify the sender of a message. It is currently widely used (for example in SSL/TLS protocols), in particular in its Elliptic Curve variant (ECDSA). Alice and Bob first agree publicly on a cyclic group G = g , of prime order p, and a cryptographic hash function H -definitions can be found for example in [CF05, Chap. 1, p. 12] or [Jou09, Chap 1. p. 21-22]. For the sake of simplicity we assume that the ouput of H is an integer modulo p. If Bob wants to send a message m to Alice and certify that the message is his, he chooses a random integer x and compute h = g x . He then publishes his public key pk = h and keeps the secret key sk = x. Overall, a third party Eve knows (G, g, p,H, h). Before sending his message, he generates a signature using Algorithm 5.

Algorithm 5 DSA Signature Generation

Input: A message m and the public key (G, g, p,H, h). Output: A signature (r, s) ∈ Z/pZ × Z/pZ. r ← 0, s ← 0; repeat z ←H(m); t ← Rand(p); r ←H(g t ); s ← t -1 (z + rx) mod p; until r = 0 and s = 0 return (r, s) Now Bob sends his message m together with the signature (r, s). Alice can verify that Bob is inded the sender by using the next Algorithm. For the sake of simplicity Algorithm 6 does not check if its inputs are valid elements.

Algorithm 6 DSA Signature Verification

Input: A message m, a public key (G, g, p,H, h) and a couple (r, s) ∈ Z/pZ × Z/pZ. Output: ACCEPT or REFUSE.

z ←H(m); w ← s -1 mod p; u 1 ← zw mod p; u 2 ← rw mod p; T ←H(g u 1 × h u 2 ); if T = r then return ACCEPT else return REFUSE end if
As H is a cryptographic hash function, to check the validity of Algorithm 6 it is enough to check that g u 1 × h u 2 = g t . This is the case, as we have s -1 = t(z + rx) -1 so that

g u 1 × h u 2 =g s -1 z × g s -1 rx =g s -1 (z+rx) =g t .

Generic Algorithms to compute Discrete Logarithms

Since the target group is finite, the most naive way to compute a discrete logarithm is to enumerate the power of the given generator until the challenge is found. For a group G of order N, in the worst case this needs N operations in the group, which gives a complexity exponential in the bitsize of N. This approach can therefore only be used when the target group is really small. This can happen when N admits small prime factors, using Pohlig-Hellman reduction described in the next Section. Starting from Section 3.2.2 we assume that G is cyclic of prime order p. We then present two Square root algorithms, respectively Baby-Step-Giant-Step and Pollard's ρ-Method. The terminology describes their asymptotic time complexity in O( √ p). In particular, those two algorithms tell that Shoups's generic lower bound of Theorem 3.5 is tight.

Pohlig-Hellman reduction

Pohlig-Hellman reduction [START_REF] Pohlig | An improved algorithm for computing logarithms over GF(p) and its cryptographic significance (corresp.)[END_REF] allows to reduce the asymptotic complexity of the DLP in an abelian group G of order N to the asymptotic complexity of DLP instances in a subgroup of order p, where p is the biggest prime factor of N. This is done in two steps. First, let w.l.o.g1 G = g be a cyclic group of order N = p α 1 1 . . . p α n n , with p 1 < . . . < p n , where the p i are all prime numbers. It is known that there is a group isomorphism G ∏ n i=1 G i , with

G i = g N/p α i i Z/p α i i Z.
Thus for all i, we can let g i = g N/p α i i be a generator of G i . Let now h ∈ G, so that there exists x ≤ N -1 such that h = g x . Let h i = h N/p α i i . Since h i has order a power of p i , then h i must belong to G i . Moreover we have h i = g xN/p α i i = g x i , and since G i has order p α i i , this gives h i = g x i i with x ≡ x i [p α i i ]. If all the x i are known, that is to say, if the discrete logarithms of all h i 's in base g i are known, then x can be recovered by solving the Chinese Remainder System

       x ≡ x 1 [p α 1 1 ], . . . x ≡ x n [p α n n ].
Asymptotically, the dominant part of this reduction is the computation of log g n (h n ), and overall we have reduced the DLP instance in G to a DLP instance in a cyclic group of order a power of a prime.

A second reduction can be obtained. We now assume that G = g has order p α , and that we are given h = g x for some x ≤ p α -1. The idea is to write the expansion of x in base p, that is to say, to consider x = x 0 + x 1 p + • • • + x α-1 p α-1 , with 0 ≤ x i < p. Next we observe that h p α-1 = g x 0 p α-1 belongs to the subgroup g p α-1 of order p. Hence we can find x 0 by solving a DLP instance in a cyclic subgroup of order p. The previous observation leads to h p α-2 = g x 0 p α-2 +x 1 p α-1 , therefore we have h p α-2 g -x 0 p α-2 = (g p α-1 ) x 1 , so that x 1 can be found once x 0 is known by solving a DLP instance in the same subgroup of order p. We can continue inductively until all x i 's have been found. Overall, α DLP instances in a group of order p have to be solved; asymptotically, to find x thus amounts to solving a DLP instance in a subgroup of order p. The next theorem sums up this section.

Theorem 3.6 (Pohlig-Hellman, [START_REF] Pohlig | An improved algorithm for computing logarithms over GF(p) and its cryptographic significance (corresp.)[END_REF]). Let G be a cyclic group of order N = p α 1 1 . . . p α k k , with p 1 < . . . < p k primes numbers. Let c(p) be the of operations to solve a DLP instance in a cyclic group of order p. Then the number of operations to solve DLP instance on G can be bounded by O(α k c(p k )).

Practical impact Because of Theorem 3.6, the biggest prime factor of a practical DLP group must be long enough bitwise. The next Sections shows that the generic bound given by Theorem 3.5 is tight, with c(p) = √ p.

Baby-Step-Giant-Step

The Baby-Step-Giant-Step (BSGS) method is a "smart brute force" attack proposed by Shanks, and more precisely a time-memory tradeoff that uses collisions between two lists to compute a discrete logarithm in the target group. From the previous Section, we can now assume that we are given G = g of prime order p and a challenge h = g x , even if the method works for any finite abelian groups. The key idea is to take a integer y < p and to write the Euclidean division of x by y. Indeed, there exists two integers q, r such that x = qy + r, and we also know that 0 ≤ r < y. Since G has order p, we know that x ≤ p -1, so this implies that 0 ≤ q ≤ p y . Turning now to elements of G, we have that h = g x = g qy+r ⇔ hg -r = (g y ) q .

(3.1)

To find the quotient q and rest r, we can enumerate all possibilities in two lists:

• the list of baby-steps: l = {h, hg -1 , . . . , hg -(y-1) } = {hg -i : 0 ≤ i ≤ y -1}.

• the list of giant-steps: L = {1, g y , . . . , g p/y y } = {(g y ) i : 0 ≤ i ≤ p y }.

Equation 3.1 guarantees that l ∩ L has one element, which can then be used to find the discrete logarithm. To balance the construction of both lists, we notice that g -1 and g y can be precomputed once y is fixed, and that they should have the same number of elements so that building one is not way longer than building the other. This is achieved when y = √ p .

Building l and L then costs 2 √ p multiplications in the group, and costs 2S √ p in memory size, where S is the bitsize of a group element. Finding the collision can be done naively by sorting both lists (in O( √ p log √ p)) and a naive complexity is then given by the cost of the sorting.

It is clear that a more efficient approach can be used. First, it is enough to build only one list. Elements of the other can be computed (but not stored) until the collision is found. This saves S √ p in memory. The sorting can be avoided by using hash tables indexed with the elements of the list: testing if an element is already in the built list is then done in constant time. This leads to an overall complexity of O( √ p), which is the generic bound (Theorem 3.5), and the steps are summed up in Algorithm 7. Several variants exist, see for example [CF05, Chap. 19]

Pollard's ρ-Method

We now describe a probabilistic algorithm that achieves an asymptotic complexity of O( √ p)

for computing discrete logarithms in a cyclic group of prime order p. It is based on the forced periodicity of a random walk among a finite set -here, because it lies in the target groupand the square root complexity is achieved with the birthday paradox. The name originates from the classic representation of a periodic sequence. Assume for a moment that we are given the target group G = g together a function F which maps "uniformly at random" G to itself and a challenge h = g x . A random-walk can be defined by u i+1 = F(u i ). Since the group is finite, there exist an integer i 0 and t > 0 such that u i = u i+t for all i ≥ i 0 , that is to say, the random-walk is periodic after a certain time. This can be used to deduce the discrete logarithm of h by storing each steps of the random walk until a collision is achieved, as we now describe.

Pollard suggested the following function to emulate a random walk, and experimentally its behaviour is indeed close enough to a random behaviour. First partition G into three subsets G 1 , G 2 , G 3 . A close to uniform way to partition the group can be obtained by considering fixed bits in the machine representation of elements of G. Starting from u 0 = g a 0 h b 0 for randomly

u i+1 = F(u i ) =      g × u i if u i ∈ G 1 u 2 i if u i ∈ G 2 h × u i if u i ∈ G 3 so that (a i+1 , b i+1 ) =      (a i + 1, b i ) if u i ∈ G 1 (2a i , 2b i ) if u i ∈ G 2 (a i , b i + 1) if u i ∈ G 3 .
For simple experiments the behaviour of F is random enough. When efficiency is important, for example in record computations, it is better to partition the group in a larger number r of sets. The larger r is, the closer to a random behaviour F is. We do not discuss parallelization and more efficient variants of cycle detection. Details can be found in [START_REF] Cohen | Handbook of elliptic and hyperelliptic curve cryptography[END_REF]Chap. 19] and [Jou09, Chap. 7.3].

Deducing log g (h) from this random-ish walk is straightfroward. As mentioned previously, since the group is finite there exist i < j such that u i = u j , or equivalently, such that g a i h b i = g a j h b j which rewrites as g a i -a j = g x(b j -b i ) so that

x = log g (h) = a i -a j b j -b i mod p.
If b j = b i , we start the random walk again with other a 0 , b 0 . From this description, the algorithm still requires O( √ p) in memory. This can be adressed in several ways using cycledetections algorithms that requires constant memory space. A simple method is given by Floyd's algorithm, which can be summed up as follow: we look for a collision between "the regular walk" (u i ) i∈N and "the speedy walk" (u 2i ) i∈N . Therefore, instead of storing every steps of the walk, we only keep track of the current step until u 2i = u i . With good assumptions on the randomness of ϕ, this approach detects a cycle in O( √ p) evaluation of ϕ, with O(1) needed memory.

Index-Calculus in Jacobian Varieties

This Section is dedicated to a popular family of specialized algorithms, which use the additional structures surrounding the target group. The outline of the algorithm is simple: an overdetermined linear system between the discrete logarithms of selected elements of the group is built in a first phase called harvesting. It is solved in a second phase with sparse linear algebra algorithms, and the target discrete logarithm is computed from the solution. The harvesting is extremely context dependant and it is the main focus of this thesis. Section 3.3.1 dives into more details of Index Calculus and presents several variants, including the socalled Large Primes variants which aim at balancing the asymptotic complexity of the phases of the algorithm. The next Sections focus on Jacobian Varieties. Section 3.3.2 presents the subexponential variants achieved first by [START_REF] Adleman | A subexponential algorithm for discrete logarithms over hyperelliptic curves of large genus over GF(q)[END_REF] for hyperelliptic curves "of large genus", and of [START_REF] Enge | An L(1/3) discrete logarithm algorithm for low degree curves[END_REF] for "low degree" curves. The harvesting is done by looking for smooth divisors in the Jacobian Variety. This approach was presented for "small genus" hyperelliptic curves by Gaudry [Gau00], see Section 3.3.3. While the algorithm is exponential in the field's size, it is still asymptotically faster than generic algorithms as soon as g ≥ 4, and as soon as g ≥ 3 if large primes variants are used, see Table 3.2. The next Section deals with non-hyperelliptic curves and presents Diem's geometric approach [START_REF] Diem | An index calculus algorithm for plane curves of small degree[END_REF]. Surprisingly, Diem's work revealed that such curves are weaker than hyperelliptic curves of the same genus. A complexity analysis is given and comparisons with other curves are shown in Table 3.3, which concludes this Section.

General algorithms

We assume for simplicity the target group is additive (G, +), cyclic of prime order generated by g and that we are given a challenge h = x • g. A first step is to select the Factor Base, which is a subset B of G. The terminology of a factor base can be found e.g. in the Number Field Sieve [START_REF] Lenstra | The Development of the Number Field Sieve[END_REF] in the context of integer factorization. The algorithm then mainly follows the following phases:

1. Harvesting consists in building a (large and sparse) determined linear system linking the discrete logarithms of elements of B. Finding the linear equations, also called relations, is where additional structures surrounding the group are used. It is the central focus of this work.

2. Linear Algebra is the solving of the linear system. The wanted discrete logarithm is deduced from the solution, depending on the variant, see below for their description.

Let B = {B 1 , . . . , B m }, assume that G = P has order N and that Q = x • P. Let also k ≥ N + 1 be an integer.

Variant 1:

Harvesting: We need k relations in the form of

a i • P + b i • Q = m ∑ j=1 c i j B j .
For all i, a i , b i and the c i j 's are integers modulo N. Such relations give equations a i + b i x = ∑ m i=1 c i j log P (B j ) between the discrete logarithms of the elements in the factor base and P, Q. When enough relations have been collected, this gives the matrices A = (a i b i ) 1≤i≤k and M = (c i j ) 1≤i≤k 1≤ j≤m . Linear Algebra: A system vM = 0 is solved. If k ≥ N + 1 it usually yields a solution v = (v 1 , . . . , v k ) in the left kernel of M. It must be checked that vA = (0 0) mod N.

DL computation: For all 1 ≤ i ≤ k we have a i v i + b i v i x = v i ∑ m j=1 c i j log P (B j ). Now we sum on i all these equations and use the fact that v is in the left kernel of M:

k ∑ i=1 a i v i + x k ∑ i=1 b i v i = k ∑ i=1 v i m ∑ j=1 c i j log P (B j ) = m ∑ j=1 log P (B j ) k ∑ i=1 v i c i j =0 mod N.

From this we recover

x = -∑ k i=1 a i v i ∑ k i=1 b i v i -1 mod N. If ∑ k i=1 b i v i
is not invertible, other relations are found and another v is computed. This variant only computes x = log g (h). If other discrete logarithms in this group have to be computed, then the whole algorithm has to be started again.

Variant 2:

Harvesting: Relations are sought in the form of m ∑ i=1 c i j B j = 0, with all c i j integer modulo N. Such relations rewrite as ∑ m i=1 c i j log P (B j ) = 0. We let M = (c i j ) 1≤i≤k 1≤ j≤m . Linear Algebra: A right kernel system M v = 0 mod N is solved, and yields a solution v = (v 1 , . . . , v k ) that describes the discrete logarithms of the B i 's up to a constant λ .

Descent Phase: For integers a, b modulo N, another two relations of the form

a 1 P + b 1 Q = m ∑ i=1 d i B i , a 2 P + b 2 Q = m ∑ i=1 e i B i
are needed. These relations give

a 1 + xb 1 = λ ∑ m i=1 d i v i and a 2 + xb 2 = λ ∑ m i=1 e i v i .
DL computation: Upon invertibility, the previous item leads to

x = a 1 m ∑ i=1 e i v i -a 2 m ∑ i=1 d i v i b 2 m ∑ i=1 d i v i -b 1 m ∑ i=1 e i v i -1 mod N.
Else, another descent phase is done. A simpler form for x is obtained if the descent relations are sought with b 1 = a 2 = 0.

Since the discrete logarithms of all elements of B is obtained once the linear algebra is done, another DL computation in the same group needs only a new descent phase.

Comments on Linear Algebra: The matrix of relations is usually very sparse, and in our applications it is easy to bound the number of non-zero entries of a row in the matrix.

In practical computations, a filtering step [START_REF] Bouvier | The filtering step of discrete logarithm and integer factorization algorithms[END_REF][START_REF]CADO-NFS, an implementation of the number field sieve algorithm[END_REF] is first performed to reduce the size of the matrix before a vector in the kernel is computed. For sparse matrices, computing kernels is usually done with Lanczos' or (Block-)Wiedemann's [START_REF] Wiedemann | Solving sparse linear equations over finite fields[END_REF] Large Primes Variants: In general not all elements of G can be written as a simple combination of elements of the factor base B, so any time we want to find a relation, there is only a probability of success. The larger the factor base is, the higher the probability to find a relation is. However, the larger the factor base is, the harder the linear algebra is since the matrix' size depends on the cardinal of B. Usually the linear algebra dominates both asymptotically and practically the run time for the computation. Hence improvements could come from balancing both phases, that is to say to reduce the size of the factor base without decreasing too much the probability of successfully finding a relation. Thériaut [START_REF] Thériault | Index calculus attack for hyperelliptic curves of small genus[END_REF] investigated an idea from Harley and gave an analysis of a balanced Index-Calculus algorithm with a "one large prime" harvesting. Then a common effort of Diem, Gaudry, Thériault and Thomé [GTTD07] gave a complete Index-Calculus using a "two large prime" harvesting. Here we only describe how the harvesting can be done. Complexity analysis are context dependant, and thus are postponed to Sections 3.3.3 and 3.3.4.

The factor base B is built, and then a subset B of small primes is chosen -size is discussed in Sections 3.3.3 and 3.3.4. The elements of B \ B are called large primes. The word "prime" stems again from integer factorization and number field sieve. Then we search for three types of relations:

• full relations, which are sums ∑ c i j B i involving small primes only;

• one large prime relations, which are sums ∑ c i j B i + B, where B is a large prime;

• two large primes relations: sums as ∑ c i j B i + B 1 + B 2 , and B 1 , B 2 are large primes.

The idea is that if enough relations like this are collected, then more than #B full relations can be obtained. The linear algebra is therefore done on a matrix with #B columns. Building full relations from large prime relations can be modelled by cycle-detection in a graph. The graph is built with the following steps:

1. It is initialized with a "root" * . Edges represent large primes relations: one large prime relation have vertices * and the large prime, two large primes relations have the two large primes as vertices. Edges are labelled with the information of the relation.

2. If a full relation is found, it is directly added to the matrix.

3. If a large prime relation is found, we check if adding the corresponding edge to the graph creates a cycle.

• If no cycle is created, the relation is added to the graph.

• If a cycle is created, then there is a linear combination of the relations involved in the cycle that gives either a one large prime relation or a full relation. In the first case, the relation is added to the graph. In the second, the relation is added to the matrix.

Heuristically, #B + #B relations of the three types are needed in average to obtain enough full relations and to start the linear algebra.

It is not clear if such variants are indeed faster in practical discrete logarithm computations. In particular, an efficient elimination of large prime relations (i.e. management of the graph) must be implemented. To our knowledge, only one efficient implementation has been proposed and analyzed for non-hyperelliptic curves of genus 3 ([DT08, LL15]). In [START_REF] Laine | Time-memory trade-offs for index calculus in genus 3[END_REF], the subset B is built progressively while finding relations, in order to simplify the elimination of the large primes and improve linear algebra. A drawback of their method is the huge amount of needed memory.

Subexponential Approaches

Adleman-DeMarrais-Huang: smooth divisors Let H be an hyperelliptic curve of genus g and defined over F q . For simplicity we assume that we are in the odd characteristic case, but everything can be easily adapted to the characteristic two case. The original algorithm of Adleman, DeMarrais and Huang uses the concept of smooth divisors to find relations between elements of the factor base. Their presentation and analysis show that the algorithm achieves a heuristic subexponential time when g is small compared to log q. Further work of Enge, Gaudry and Stein [Eng02, EG02, ES02] rigorously obtained subexponentiality.

We give a short and informal description on Gaudry's formulation for this algorithm. The smoothness of a divisor is then defined using the Mumford representation. Definition 3.7. Let H be a genus g hyperelliptic curve defined over a field F. Let D ∈ Jac(H ) be the unique reduced divisor in the class [D], and let (u, v) be its Mumford representation. Let B ≥ 1 be an integer. We say that D is B-smooth if all the irreducible factors of u have degree at most B.

Assume that Jac(H ) = D and that we look for the discrete logarithm of E ∈ Jac(H ). A smooth bound B is fixed, and the factor base is selected as

B = {D(u, v) ∈ Jac(H ) : deg u ≤ B}.
To find one relation, first the Mumford representation (u, v) of some R = aD + bE is computed, then the factorization of u is obtained with standard algorithms. This factorization leads to a relation when all the irreducible factors have degree at most B.

While the method is relatively simple, the subexponentiality when g is small compared to log q was only heuristic in [START_REF] Adleman | A subexponential algorithm for discrete logarithms over hyperelliptic curves of large genus over GF(q)[END_REF].

Definition 3.8. Let 0 ≤ α ≤ 1 and N, c > 0. The subexponential function is defined as

L N (α, c) = exp(c(log N) α (log log N) 1-α ).
Usually, the constant c is omitted for the sake of clarity. Assume an algorithm runs in O(L N (α)). When α = 1, the algorithm has exponential complexity in the size of N, subexponential for any 0 < α < 1 and polynomial if α = 0. This function was defined to estimate time complexities of several functions in the Integer Factorization context, and in Index-Calculus algorithms for finite fields as well. It is also used to estimate the number of B-smooth elements in Jac(H ). Theorem 3.9 (Enge-Stein, [START_REF] Enge | Smooth ideals in hyperelliptic function fields[END_REF]). Let H be a hyperelliptic curve of genus g, defined over F q . Let B = log q L q g (1/2, ρ) for some constant ρ > 0, and N(B) the number of B-smooth elements in Jac(H ). When g grows to infinity, we have

N(B) ≥ q g L q g (1/2, 1/2ρ + o(1))
.

Hence an average of O(L q g (1/2)) tries are needed to find a relation. When the "genus is large", or in more precise terms, when g is large compared to log q, or when q is fixed and g goes to infinity, the analysis in [START_REF] Enge | A general framework for subexponential discrete logarithm algorithms[END_REF] shows that the optimal choice is ρ = 1/ √ 2, hence B = log q L q g (1/2, 1/ √ 2) . This gives the next theorem.

Theorem 3.10 (Enge-Gaudry, [START_REF] Enge | A general framework for subexponential discrete logarithm algorithms[END_REF]). Let H be a hyperelliptic curve of genus g defined over F q , and assume that log q = o(g). Then computing discrete logarithms in Jac(H ) when g grows to infinity can be done with an Index-Calculus algorithm in

O L q g 1 2 , √ 2 .
Sketch of Proof. Fix B = log q L q g (1/2, 1/ √ 2) . Since #B = O(q B ), this means that around L q g (1/2, 1/ √ 2) relations have to be found to start linear algebra. As B-smooth elements in Jac(H ) are found with probability L q g (1/2, -1/2 √ 2), the harvesting runs in

L q g (1/2, 1/ √ 2) × L q g (1/2, √ 2/2) = L q g (1/2, √ 2). Linear algebra runs in O(q 2B ) = O(L q g ( 1 2 , √ 2
)).

Enge-Gaudry-Thomé: low degree curves

A similar approach on a C ab curves can be proposed. A C ab curve is defined by an equation

C : Y a + X b + f (X,Y ) = 0,
with gcd(a, b) = 1 and for all monomial X i Y j in Supp( f ), then ai + b j < ab. If we let w(X) = a and w(Y ) = b, it is the same as asking that deg w (X i Y j ) < ab. The genus is given by g = (a-1)(b-1)

2

. They behave relatively similarly as hyperelliptic curves: the non-singular model of a C ab curve has a single point at infinity and the elements of their Jacobian variety enjoy a nice description by polynomial ideals leading to a potentially efficient arithmetic. For this reason, they have been studied in [START_REF] Arita | An addition algorithm in Jacobian of C ab curves[END_REF][START_REF] Basiri | Bases de Groebner et LLL[END_REF], before Diem's work (see Section 3.3.4) revealed that they were in fact weaker than hyperelliptic curves of same genus.

To achieve a complexity of L(1/3, ρ) for some constant ρ, the basic idea is to choose parameters a, b as well as the type of relations. The main part of Enge, Gaudry and Thomé's work [START_REF] Enge | An L(1/3) discrete logarithm algorithm for low degree curves[END_REF] is to analyze the constant ρ, and to give a heuristic proof that there are enough smooth divisors to start linear algebra. Here, we only present how the parameters can be chosen so that the complexity is L q g (1/3) and refer to their article for additional details. First let C be a C ab curve defined over F q , with deg Y C = a ≈ g α and deg X C = b ≈ g 1-α , for some 1/3 ≤ α ≤ 2/3. The smooth bound is set as B = log q L q g (1/3) , and q and the factor base is the set of all elements in Jac(H ) that are B-smooth, so that #B = O(L q g (1/3)).

Relations are searched by intersections between C and polynomial functions ϕ(X,Y ) ∈ F q (C ) with deg X ϕ ≈ g 2/3-α and deg X ϕ ≈ g α-1/3 . This intersection can be described by

N(ϕ) = Res Y (ϕ,Y a + X b + f (X,Y )).
The notation comes from the fact that this is also the norm of ϕ relatively to the field extension F q (C ) | F q (X). If N(ϕ) has irreducible factors with degree at most B over F q , then it describes a relation. Because of the choice of the parameters, the degree of N(ϕ) is

deg N(ϕ) = deg Res Y (ϕ,Y a + X b + f (X,Y )) =a deg X ϕ + b deg Y ϕ ≈g α g 2/3-α + g 1-α g α-1/3 ≈2g 2/3 = O(g 2/3
).

Assuming enough "genericity" in the behaviour of N(ϕ) as a polynomial of degree g 2/3 , the probability that it is B-smooth is L q g (1/3) -1 -see the formulation of Theorem 3.9 in [START_REF] Enge | Smooth ideals in hyperelliptic function fields[END_REF]. The harvesting then takes roughly L q g (1/3) × L q g (1/3) = L q g (1/3, ρ) operations, for some constant ρ > 0 and the linear algebra runs in L q g (1/3) × L q g (1/3) = L q g (1/3, 2ρ).

Gaudry's approach for Hyperelliptic Curves of small genus

When the genus is "small" compared to the characteristic, or equivalently, when the genus is fixed and q grows to infinity, the optimal smooth bound becomes B = 1. If we write D = (P 1 ) + • • • + (P deg u )deg u(P ∞ ), we see that D is smooth when the polynomial u splits over F q , that is to say that, for each i, the point P i is F q -rational. The class of (P i ) -(P ∞ ) then defines an element of Jac F q (H ). Gaudry's algorithm [Gau00] stems from this observation, and its harvesting phase can be summarized as follows.

• The factor base B is the set {(P) -(P ∞ ) : P ∈ H (F q )}, or rather a set of representatives of its quotient by the hyperelliptic involution, accounting for the trivial relations (ıP) -

(P ∞ ) ∼ -((P) -(P ∞ )). It contains O(q) elements.
• At each step, we compute (using a semi-random walk, see e.g. Section 3.2.3) the Mumford representation (u, v) of a reduced divisor D ∼ aD 0 + bD 1 , where D 0 and D 1 are the entries of the DLP challenge.

• If u splits over F q as ∏ i (xx i ) then a relation is found since we have aD 0 + bD 1 ∼ ∑ i ((P i ) -(P ∞ )) where

P i = (x i , v(x i )).
We see that each step of the harvesting phase requires a few operations in Jac H followed by the factorization of u, which is generically a degree g polynomial. The probability that u actually splits over F q is about 1/g!, so we need about g! trials before finding a relation.

A precise analysis of the complexity is given by the author in [Gau00]. For the sake of completeness, we give the main steps and focus on time-complexity. The genus is fixed and the field size q grows to infinity. Enumerating the factor base B is done in O(q), and in practice it is way faster than the next phases. We do not consider the problems of storing all the elements and of memory accesses.

Cost for one try: The Mumford Representation (u, v) of a divisor aD + bE is computed.

Following the pseudo-random walk of Section 3.2.3, this can be reduced to the cost of one addition or one doubling. We assume for simplicity that both share the same cost c(g). Testing if u is split over F q can be done in the first step of the root-finding algorithm: u is split over F q if and only if GCD(X q -X, u) = u. The computation is done by fast exponentiation (see e.g. Algorithm 2) of X to the power q in the quotient ring F q [X]/ u in O(g 2 log q) field operations. The total cost for a try is then O(c(g)+g 2 log q). Swan's criterion can also be used as a first splitting test: when a polynomial is split, then its discriminant is a square in the coefficients' field. Experimentally Gaudry [Gau00] observed nice speed-ups, but it does not help the analysis.

Cost for one relation: If u splits, then its roots can be computed in Õ(g 2 log q) by finishing the root-finding algorithm -the next step is the so-called Cantor-Zassenhaus' "Equal Degree Factorization" algorithm, see [START_REF] Cantor | A new algorithm for factoring polynomials over finite fields[END_REF][START_REF] Zur Gathen | Modern Computer Algebra[END_REF]. The roots gives the abscissae for the P i 's, and the corresponding y-coordinates are computed by evaluation of a degree g -1 polynomial in g -1 multiplications. The probability that u splits is 1/g!, so in average g! tries are needed. Hence finding one relation costs roughly O(g!(c(g) + g 2 log q) + g(g log q + 1)).

Cost for the harvesting: At least #B = O(q) relations are needed to build a determined matrix, so the harvesting is done in roughly O(q(g!(c(g) + g 2 log q) + g(g log q + 1))). As g is fixed and q goes to infinity, the time complexity of the harvesting is Õ(q).

Cost of the linear algebra: Computing the kernel of the matrix is done for example with Wiedemann's algorithm [START_REF] Wiedemann | Solving sparse linear equations over finite fields[END_REF] in Õ(#B 2 ) = Õ(q 2 ) operations.

Asymptotically, the linear algebra phase dominates the complexity, but with a two large primes variant [GTTD07], the complexity can be balanced. Let 0 ≤ α < 1 and select B ⊂ B of size #B ≈ q α . We now accept relations involving elements of B and at most 2 elements of B (see Section 3.3.1). The probability that such a relation happens is heuristically

#B g-2 (g -2)! • #B 2 2# Jac(H ) ≈ q α(g-2) 2(g -2)!q g-2 = q (α-1)(g-2)
2(g -2)! .

In general around q + q α = O(q) relations are needed to have enough full relations, so the cost of this phase is Õ(q (1-α)(g-2) q). Linear algebra is done in Õ(q 2α ), and as the goal is to balance the complexity, we want 1 -(α -1)(g -2) = 2α. This is achieved if α = 1 -1 g , and leads to an overall complexity of Õ(q 2-2/g ).

g = 2 g = 3 g = 4 Generic Õ(q) Õ(q 3/2 ) Õ(q 2 ) Gaudry Õ(q 2 ) Õ(q 2 ) Õ(q 2 ) Gaudry+2LP
Õ(q) Õ(q 4/3 ) Õ(q 3/2 ) Table 3.2: Asymptotic complexities for small genus hyperelliptic curves

Recall that # Jac(H ) ≈ q g , so that generic algorithms run in Õ(q g/2 ). From Table 3.2, Gaudry's approach is better than generic algorithms as soon as g > 4, and with a two large prime variant, as soon as g ≥ 3.

Diem's approach for Small Degree Plane Curves

Gaudry's algorithm can be adapted to non-hyperelliptic curves. Most divisors can still be represented by Mumford coordinates, but computations in the Jacobian variety are not as tractable and checking for 1-smoothness is less obvious. However, all these operations are in Õ(1) when g is fixed, so that the asymptotic complexity is still in Õ(q 2-2/g ), albeit with a larger hidden constant than in the hyperelliptic case.

In [START_REF] Diem | An index calculus algorithm for plane curves of small degree[END_REF], Diem designed a different harvesting technique for plane curves whose degree d is really close to the genus. Harvesting is done by considering relations coming from principal divisors corresponding to equations of lines. For any couple of rational points P 1 and P 2 on the (affine) curve C , we consider the affine function f = ax + by + c ∈ F q (C ) such that the equation of the line L passing through P 1 and P 2 is f = 0. Since the curve has degree d, the intersection of L and C contains up to d rational points. Two of them are already known, and to determine the other d -2 points amounts to finding the roots of a degree d -2 univariate polynomial. If there are exactly d -2 other rational intersection points P 3 , . . . , P d then we obtain a relation of the form

div( f ) = (P 1 ) + • • • + (P d ) -D ∞ ∼ 0,
where D ∞ is the divisor corresponding to the intersection of C with the line at infinity. This happens with probability 1/(d -2)!, which is better than the 1/g! probability for hyperelliptic curves as soon as d ≤ g + 1.

We can summarize Diem's harvesting technique as follows. The curve C is defined by an affine plane equation F(x, y) = 0. We no longer consider only (classes of) degree 0 divisors, so technically we are working in the full divisor class group and not only its degree 0 part, but in practice it makes no difference.

• The factor base is B = {(P) : P ∈ C (F q )} ∪ {D ∞ }.

• We choose two points P 1 = (x 1 , y 1 ) and P 2 = (x 2 , y 2 ) in B such that x 1 = x 2 (for simplicity) and compute λ = (y 2y 1 )/(x 2x 1 ) and µ = y 1λ x 1 .

• We test if the degree d -2 polynomial F(x,λ x+µ) (x-x 1 )(x-x 2 ) splits over F q . If it is the case, we compute its roots x 3 , . . . , x d and the associated y-coordinates y 3 = λ x 3 + µ, . . . , and we store the relation (P 1 ) + (P 2 )

+ (P 3 ) + • • • + (P d ) -D ∞ ∼ 0
where P i = (x i , y i ), provided these points are non-singular.

• We go back to the second step until enough relations are found.

Note that a descent phase is needed to express the entries of the DLP challenge in terms of elements of the factor base.

The cost to find one relation now depends on the degree d of the curve, hence this approach should be efficient for curves of small degree, in particular for curve with degree d ≤ g + 1.

The main result of [START_REF] Diem | An index calculus algorithm for plane curves of small degree[END_REF] states that, if a curve of genus g ≥ 3 is general enough (which rules out hyperelliptic curves), a plane model of expected degree d ≤ g + 1 can be found for the curve in polynomial time using a probabilistic algorithm. This means that Diem's algorithm applies to almost all non-hyperelliptic curves, with the (then unexpected) consequence that the DLP is easier on non-hyperelliptic curves than on hyperelliptic ones.

The whole routine is particularly well-suited for two large prime variation (for another version differing mainly on the construction of the factor base and the large prime graph, see also [START_REF] Laine | Time-memory trade-offs for index calculus in genus 3[END_REF]). Instead of selecting two points in B, we pick them in the small factor base B and keep only relations involving at most two large primes. The main advantage (as compared to the hyperelliptic case) is that we ensure in this way that each potential relation contains already two small primes; this greatly increases the probability of finding relations with only two large primes. In particular if d = 4, every relation found by the above method automatically satisfies the two large prime condition.

We now follow the analysis2 of Section 3.3.3, and use a two large prime approach. The degree d is fixed and q goes to infinity. First, a symbolic polynomial f λ ,µ,x 1 ,x 2 = F(x,λ x+µ) (x-x 1 )(x-x 2 ) of degree d -2 can be precomputed. Enumerating the factor base B is done in O(q), and in practice it is way faster than the next phases. Again we do not consider storing and memory accesses problems. Let 0 ≤ α < 1 and select the small prime set B ⊂ B of size ≈ q α . Cost for one try: Computing λ and µ is done in 1 multiplication and 1 inversion. Testing if f λ ,µ,x 1 ,x 2 splits over F q can be done in at worst (d -2) 2 log q field operations as in Section 3.3.3. Swan's criterion can also be used as a first splitting test. The total cost for a try is then essentially (d -2) 2 log q.

Cost for one relation: If f λ ,µ,x 1 ,x 2 splits, its roots are found in Õ((d -2) 2 log q). The roots gives abscissae for the P i 's, and the corresponding y-coordinates are computed with the line's equation in 1 multiplication. The probability that the rational intersection is complete is heuristically

#B d-4 (d -4)!#B d-2 • #B 2 2 ≈ q (α-1)(d-4) 2(d -4)!
Usually O(q) large primes relations are enough to start linear algebra on B , so the cost of this phase is Õ(q (1-α)(d-4) q).

Linear algebra: It is done in Õ(q 2α ) operations. To balance the complexity, we want 1 -(α -1)(d -4) = 2α, achieved by α = 1 -1 d-2 . The final complexity is then Õ(q 2-2/d-2 ).

Since C admits a plane model of degree g + 1, the asymptotic run time is Õ(q 2-2/(g-1) ), which improves over the Õ(q 2-2/g ) complexity of the hyperelliptic case. Note however that the size of the small factor base is such that in order to find enough relations, almost all lines going through pairs of points of B have to be considered. This is troublesome because each line, and thus each relation, can be obtained several times, namely n(n -1)/2 times if it contains n small factor base points. This is not really an issue if d = 4, but for higher d some extra care has to be taken in order to prevent duplicate relations.

g = 3 g = 4 g = 5 Generic
Õ(q 3/2 ) Õ(q 2 ) Õ(q 5/2 ) Gaudry+2LP Õ(q 4/3 ) Õ(q 3/2 ) Õ(q 8/5 ) Diem+2LP Õ(q) Õ(q 4/3 ) Õ(q 3/2 ) Table 3.3: Asymptotic complexities for small genus non-hyperelliptic curves Table 3.3 shows that Index-Calculus on a non-hyperelliptic curve of genus g is as hard as Index-Calculus on a hyperelliptic curve of genus g -1, and that it also outperforms generic algorithms as soon as g ≥ 3. A notable fact is that, for approximately 18.5% of genus 3 hyperelliptic curves [START_REF] Smith | Isogenies and the Discrete Logarithm Problem in Jacobians of Genus 3 Hyperelliptic Curves[END_REF], a DLP instance can be mapped to an equivalent instance on a non-hyperelliptic curve of same genus, where Diem's algorithm is particularly efficient.

Attacks based on Weil Restrictions

Transfer attacks

Using the Weil Restriction of an Abelian Variety Let A be an Abelian Variety (Definition 2.15) defined over F q n , for some n ≥ 2, and let W = W n (A ) be its Weil Restriction (as defined in Section 1.5.2). The natural identification between A (F q n ) and the F q -rational points of W allows to transfer the group law from A to W . Being an Abelian Variety, the group law on A can be expressed by rational functions with coefficients in F q n . Hence the group law on W can be expressed by rational functions, with coefficients in F q . This means that W naturally inherits an Abelian Variety structure.

Transfer attacks rely on this property to map a DLP instance on A to a "convenient" (to be discussed) subvariety of W . Assume that we are given a curve C defined over F q in W , or in other words, a regular map ψ : C -→ W . Further assume there is at least one F q -rational point P ∈ C . Up to translation, we can assume ψ(P) is the neutral element in W . Recall that Jac F q (C ) identifies to the g th symmetric product C g /S g (Section 2.1.3). Abusing notations, we let ψ : Jac(C ) -→ W be defined by ψ(P 1 , . . . , P g ) = ∑ g i=1 ψ(P i ) using the law of W . This map sends the neutral element in the Jacobian Variety to the neutral of W : a result on Abelian Varieties (see for example [Mil86b]) then ensures that ψ is also a group homomorphism. An instance of DLP in A can then be pulled back to Jac F q (C ). As practical applications mainly deal with Elliptic Curves, we now focus on this setting.

Coverings of Elliptic Curves and the GHS technique

We now assume that A has dimension 1, or equivalently that it is an Elliptic Curve E (defined over F q n ). Finding C | F q amounts to finding a covering π : C -→ E, where π is a F q n -morphism of curves. A group homomorphism τ : Jac F q n (E) = E -→ Jac F q (C ) can then be obtained (called conorm-norm map in [START_REF] Gaudry | Constructive and destructive facets of Weil descent on elliptic curves[END_REF]), and a DLP on E can be transferred to a DLP in Jac F q (C ), provided that the kernel of τ is not too big. Several difficulties now have to be considered. For the point of view of our work, the main concern is the construction of the curve C . For this transfer to be interesting in term of practical attacks, we want that the genus of C is not too high. However, there are no known general method to obtain a curve of prescribed genus in a variety. Since dim W n (E) = n, a curve can be obtained with n -1 "generic" hyperplane sections, and the remaining difficulty is to estimate its genus g(C ). A first rough estimation can be done, with the assumption that the kernel of the conorm-norm map is trivial: as #E(F q n ) ≈ q n , we must have q n ≤ q g(C ) , so that n ≤ g(C ).

A general analysis can be done using function field theory, thanks to the work of Gaudry, Hess and Smart in even characteristic [START_REF] Gaudry | Constructive and destructive facets of Weil descent on elliptic curves[END_REF], and Diem's in odd characteristic [START_REF] Diem | The GHS attack in odd characteristic[END_REF]. We give a brief and informal description. The function field of E is a quadratic extension of F q (x). If σ is any element in Gal(F q n | F q ), so are the function fields of E σ i . The idea is now to build a common extension F for all those function fields and to study their embeddings in F. As all F q n (E σ ) are quadratic, it is necessary that [F : F q n (x)] = 2 m , for some integer m. Its value highly depends on the choice of a model for E, equivalently on the choice of an extension F q n (x) -→ F q n (E). The curve C is then a curve such that F q n (C ) = F, and its genus depends exponentially in m.

Transfer attacks on "small" field extensions Because of this last observation, few values of n can lead to interesting transfers. For example, for an Elliptic Curve E defined over F q 6 , q odd, hyperelliptic coverings of genus 2 and 3 can be obtained defined respectively over F q 3 and F q 2 [START_REF] Joux | Cover and decomposition index calculus on elliptic curves made practical -application to a previously unreachable curve over F q 6[END_REF]. For Hyperelliptic Jacobian Varieties, the attacks previously presented may perform better than a direct attack on E. If a suitable covering of E can be found, an efficient attack on E can then be designed by first tranferring the DLP to the Jacobian Variety of the cover, then solving this new DLP instance, provided an efficient algorithm exists for this class of Jacobian Variety. The original DLP is then mapped back to E. When the degree of the extension considered is small and the target curve has small genus, Decomposition attacks can be such efficient attacks. They are the main concern of this thesis, and therefore deserve the next section.

Decomposition attacks

In this Section we focus on Jacobian Varieties Jac(H ) of hyperelliptic curves defined over field extensions. Here we consider elliptic curves as hyperelliptic curves of genus 1. Relations harvesting in this setting can be done by solving multiple instances of the following problem. Definition 3.11 (Point m-Decomposition Problem (PDP m )). Given an element R and a subset B of Jac(H ), find, if they exist, D 1 , . . . , D m with D i ∈ B such that:

R = D 1 + • • • + D m .
When the curve is an elliptic curve E, i.e. g = 1, an algebraic modelling of PDP m instance, involving Summation Polynomials [START_REF] Semaev | Summation polynomials and the discrete logarithm problem on elliptic curves[END_REF], was introduced by Diem [Die11] and Gaudry [START_REF] Gaudry | Index calculus for abelian varieties of small dimension and the elliptic curve discrete logarithm problem[END_REF]. Usually, the factor base is selected as B = {P ∈ E(F q n ) : x(P) ∈ F q }. Their similar approaches rely on the linear structure of F q n over F q to describe a decomposition by a 0-dimensional system -see also Section 1.5.2. Such systems are solved with Gröbner Bases strategy, see Section 1.3.3. Description of Summation Polynomials and their impact for PDP m solving is analyzed in Section 3.4.3, and the situation is illustrated by a toy example. More general details on the usage of Elliptic Summation Polynomials are given in the survey of [START_REF] Galbraith | Recent progress on the elliptic curve discrete logarithm problem[END_REF].

When g ≥ 2, Nagao proposed in [Nag10] to solve instances of this problem by using a geometric description of decompositions involving bases of Riemann-Roch spaces, together with a Weil Descent strategy. When H has genus g and is defined over F q n , he also selected the factor base as B = {(P) : P ∈ H , x(P) ∈ F q }. Systems arising from this method are also generally 0-dimensional and solved with Gröbner basis methods. We introduce this approach in Section 3.4.4.

Semaev's summation polynomials and Weil Descent

Semaev introduced in [Sem04] a multivariate polynomial that describes vanishing sums of points of an elliptic curve. We omit details for characteristic 3 fields, as we never explicitely consider this situation in our contributions. Anyway, the following presentation can be extended to this characteristic.

Definition-Proposition 3.12 (Summation Polynomials for Elliptic Curve). Let E be an elliptic curve defined over a field F with algebraic closure F, and O its point at infinity. For m ≥ 3, the m-th summation polynomial associated to E is a polynomial S m ∈ F[X 1 , . . . , X m ] defined by the Summation Property:

S m (x 1 , . . . , x n ) = 0 ⇔ ∃ y 1 , . . . , y m ∈ F such that P i (x i , y i ) ∈ E(F), 1 i m,
and

P 1 + • • • + P m = O.
If Char(F) = 2, 3, and E is given by a Weierstrass equation y 2 = x 3 + ax + b, we have:

S 3 (X 1 , X 2 , X 3 ) = (X 1 -X 2 ) 2 X 2 3 -2((X 1 + X 2 )(X 1 X 2 + a) + 2b)X 3 + (X 1 X 2 -a) 2 -4b(X 1 + X 2 ),
and if Char(F) = 2 with E : y 2 + xy = x 3 + ax 2 + b we have:

S 3 (X 1 , X 2 , X 3 ) = (X 1 X 2 + X 1 X 3 + X 2 X 3 ) 2 + X 1 X 2 X 3 + b.
For n ≥ 3, S m is symmetric in X 1 , . . . , X m , is irreducible, and has degree 2 m-2 in each variable.

Since the addition in an elliptic curve is commutative, the order in which the points are considered does not matter. This gives an informal intuition as to why S m is a symmetric polynomial. The idea behind Summation Polynomials is to project the elliptic curve's group law on the x-line. The formula for S 3 can be derived by hand [START_REF] Semaev | Summation polynomials and the discrete logarithm problem on elliptic curves[END_REF]. For larger sum size, Semaev also gave a recursive way to compute the polynomials: Proposition 3.13 (Recursive expression of summation polynomials). Let E be an elliptic curve, m ≥ 4 be an integer and Res T (P, Q) be the resultant of two polynomials with respect to T . For all 2 k m -2, the m th Summation Polynomial associated with E can be computed as:

S m (X 1 , . . . , X m ) = Res T (S k+1 (X 1 , . . . , X k , T ), S m-k+1 (X k+1 , . . . , X m , T )).
Sketch of proof. Checking that S 3 vanishes exactly on sum of size 3 can be done by tedious but direct computations, see [START_REF] Semaev | Summation polynomials and the discrete logarithm problem on elliptic curves[END_REF]. A geometric proof can be derived from our new modelling of Summation Polynomials (Propositions 5.3 and 5.6). The recursive formula comes from the rewriting of a sum of size m as two smaller sums and induction. Fix m ≥ 4 and 2 ≤ k ≤ m -2.

For P i ∈ E let x i = x(P i ). Then we have:

P 1 + • • • + P m = O ⇔ ∃ Q ∈ E : P 1 + • • • + P k = Q P k+1 + • • • + P m = -Q ⇔ ∃ Q ∈ E : S k+1 (x 1 , . . . , x k , x(Q)) = 0 S m-k+1 (x k+1 , . . . , x m , x(Q)) = 0
The last statement is true if and only if S k+1 (x 1 , . . . , x k , T ) and S m-k+1 (x k+1 , . . . , x m , T ) have a common root. This is equivalent to asking that their resultant with respect to T vanishes.

Using only Proposition 3.13, computations revealed to be already hard for n > 5. More efficient ways to compute summation polynomials are given in [START_REF] Joux | Elliptic curve discrete logarithm problem over small degree extension fields -application to the static Diffie-Hellman problem E(F q 5 )[END_REF] for n < 7, relying on the symmetry of the polynomial. With additional symmetries, it culminated in [FHJ + 14] where authors computed up to the 8-th summation polynomial, with a dedicated method for this computational challenge. The method takes advantage of the fact that the representation of a summation polynomial using a set of fundamental invariants is usually much sparser.

Summation Polynomials and PDP n instances Diem and Gaudry showed independently [START_REF] Diem | On the discrete logarithm problem in elliptic curves[END_REF][START_REF] Gaudry | Index calculus for abelian varieties of small dimension and the elliptic curve discrete logarithm problem[END_REF] how to use the summation polynomials in an Index-Calculus context. Let E be an elliptic curve defined over F q n , and select the factor base as B = {P ∈ E(F q n ) : x(P) ∈ F q }. Assume we are given R ∈ E(F q n ). In practice, such R is typically obtained by a linear combination R = aP + bQ of the generator P and the challenge Q. We look for decompositions of R as a sum of exactly n points:

R = P 1 + • • • + P n , P i ∈ B.
Let x i = x(P i ) be the abscissae of P i . This PDP n instance translates algebraically with Definition 3.12 as

n ∑ i=1 P i = R ⇔ S n+1 (x 1 , . . . , x n , x(R)) = 0, (3.2)
with x i ∈ F q . Let 1,t, . . . ,t n-1 be a F q -basis of F q n to write x(R) = ∑ n-1 i=0 r i t i where r i ∈ F q , and X i = ∑ n-1 i=0 X i j t j . Collecting S n+1 (X 1 , . . . , X n , x(R)) with respect to t, we obtain an expression

S n+1 (X 1 , . . . , X n , x(R)) = n-1 ∑ i=0
s i (X 1,0 , . . . , X 1,n-1 , . . . , X n,0 , . . . , X n,n-1 )t i , where s i ∈ F q [X 1,0 , . . . , X n,n-1 ] for all i. Asking that x i ∈ F q amounts to asking that X i j = 0 for all i and all j > 0. Hence Equation (3.2) can be rewritten as a multivariate polynomial system S = {s i (X 1 , . . . , X n ) = 0, 1 ≤ i ≤ n} defined over F q . A solution of this system corresponds to a solution of the PDP n instance, provided the corresponding y i are in F q and not in some F q 2 . It never happened in our experiments, and if it happens, then it can be shown that this gives a shorter decomposition of a 2-torsion point (see [START_REF] Vitse | Attaques algébriques du problème du logarithme discret sur courbes elliptiques[END_REF]Chap. 7,p. 130]). Heuristically3 the probability for such a relation to happen is:

# B n S n #E n ≈ q n n! 1 q n = 1 n! ,
where S n denotes the symmetric group of order n. In general, the ideal generated by S has dimension 0 and has degree n! 2 n(n-1) , which makes computations untractable when n > 4. This degree can be reduced by considering actions of symmetries.

Recall that S n is symmetric and can thus be expressed with the elementary symmetric functions in X 1 , . . . , X n before solving the system. This reduces the number of solutions by a factor n!. Moreover, if the curve has rational torsion points of small order, a larger group of symmetry can be considered. The basic idea is the following: let T ∈ E(F) [k]. If we fix a size n for sums of points, then adding a multiple of k times T to this sum does not change the result. For example if k = 2:

R = P 1 + • • • + P n = (P 1 + T ) + (P 2 + T ) + P 3 + • • • + P n = (P 1 + T ) + P 2 + (P 3 + T ) + • • • + P n = . . . = (P 1 + T ) + (P 2 + T ) + (P 3 + T ) + (P 4 + T ) + P 5 + • • • + P n = . . .
Therefore S n must be invariant under the action of the two-torsion group and the permutation of variables. The underlying group is known as a Coxeter group, and has order n! × 2 n-1 . The first results in this direction were given for binary (twisted) Edwards and Hessian curves in [FGHR14], where authors gained an additional factor of 2 n-1 . These results were generalized in [FHJ + 14] to any characteristic and any elliptic curve. Taking into account a possible 4-torsion point, the number of solutions can be further reduced by a factor 2 2(n-1) . A similar approach to the Weil descent for binary Edwards curves over prime extensions was used in [START_REF] Galbraith | Summation polynomial algorithms for elliptic curves in characteristic two[END_REF].

We now assume that S n+1 (X 1 , . . . , X n , x(R)) is expressed with the elementary symmetric functions in X 1 , . . . , X n as a polynomial Sn+1 , or in other words, that we take in account the action of S n over S n+1 (X 1 , . . . , X n , x(R)). It can be shown [START_REF] Diem | On the discrete logarithm problem in elliptic curves[END_REF] that deg Sn+1 = 2 n-1 in general. Since we are considering a subvariety of dimension 0 in the Weil Restriction of V( Sn+1 ), the description in Section 1.5.2 shows that, in general, a PDP n system has deg S = (deg Sn+1 ) n = 2 n(n-1) solutions. We denote by c(n) the cost of solving such a sytem. Following Section 1.3.3, the solving strategy starts by computing a DRL order basis for S , whose complexity depends on the degree of regularity δ (n) = d a,reg (S ) of the ideal generated by S . To simplify the analysis, we assume that (s 0 , . . . , s n-1 ) is an affine regular sequence -looking at Proposition 1.49, this assumption seems reasonable as S is usually 0-dimensional. Then, an upper bound on δ (n) is given by the Macaulay bound ∆ = ∑ n i=1 (deg s i -1) + 1 (see also Proposition 1.50). Since deg s i ≤ 2 n-1 for each i, then ∆ ∼ n2 n-1 . The following estimates hold:

n + δ (n) δ (n) ≤ (∆ + 1) . . . (∆ + n) n! ∼ n n 2 n(n-1) n!
With Stirling's formula, we obtain:

n + δ (n) δ (n) ∼ 2 n(n-1) e n √ 2πn.
With Theorem 1.53, computing a Gröbner basis for the DRL order costs O (2 n(n-1) e n √ 2πn) ω . Proposition 1.58 shows that computing a lexicographical basis can be done in O(n2 ωn(n-1) ). Lastly, the lexicographical basis is in Shape Position with very high probability, so that solutions are found once the roots of a univariate polynomial of degree deg S = 2 n(n-1) are found. It can be done in O(2 2n(n-1) log q) (see e.g. [START_REF] Zur Gathen | Modern Computer Algebra[END_REF]). Overall we find c(n) = Õ 2 ωn(n-1) (e ωn √ 2πn ω + n) + 2 2n(n-1) .

Remark 3.14. While asymptotically the DRL computation dominates the complexity, the change-ordering dominates the total run time in almost all experiments.

The factor base has around q elements, so the harvesting runs in O(n!c(n)q) and linear algebra in O(q 2 ). A two large prime variant can be used [START_REF] Gaudry | Index calculus for abelian varieties of small dimension and the elliptic curve discrete logarithm problem[END_REF], and an analysis similar to that of Sections 3.3.3 and 3.3.4 shows that the set of small primes should have size O(q 1-1/n ), leading to a linear algebra in O(q 2-2/n ). As generic algorithms run in O(q n/2 ) over an elliptic curve defined over F q n , this method performs asymptotically better as soon as n > 2. However, the cost of finding one relation is in average n!c(n), which is exponential in n.

Example: Let F = F 1031 2 = F 1031 [t]/ t 2 -2t + 14 and E : y 2 = x 3 + (98t + 202)x + (769t + 711). We want to solve PDP 2 instances, so we need the 3rd Summation Polynomial, which is given directly in Definition 3.12. Let R(211t + 341, 539t + 528) ∈ E. We try to write it as

R = P 1 + P 2 , P i ∈ B = {P ∈ E : x(P) ∈ F 1031 }.
Evaluating S 3 at x(R) = 211t + 341, we find the bivariate polynomial

S 3 (X 1 , X 2 , x(R)) = X 2 1 X 2 2 + (609t + 349)X 2 1 X 2 + (969t + 239)X 2 1 + (609t + 349)X 1 X 2 2 + (959t + 149)X 1 X 2 + (293t + 201)X 1 + (969t + 239)X 2
2 + (293t + 201)X 2 + 590t + 837. Collecting wrt. t, we obtain the following system of 2 equations in 2 variables over F 1031 :

609X 2 1 X 2 + 969X 2 1 + 609X 1 X 2 2 + 959X 1 X 2 + 293X 1 + 969X 2 2 + 293X 2 + 590, X 2 1 X 2 2 + 349X 2 1 X 2 + 239X 2 1 + 349X 1 X 2 2 + 149X 1 X 2 + 201X 1 + 239X 2 2 + 201X 2 + 837 A Gröbner basis computation for a lex order with X 1 > X 2 gives X 1 + T 2 (X 2 ) = X 1 + 304X 7 2 + 607X 6 2 + 300X 5 2 + 459X 4 2 + 865X 3 2 + 956X 2 2 + 119X 2 + 280, T 1 (X 2 ) = X 8 2 + 506X 7 2 + 572X 6 2 + 797X 5 2 + 706X 4 2 + 1015X 3 2 + 781X 2 2 + 782X 2 + 117 so we check that the degree is n! × 2 n(n-1) = 2! × 2 2•1 = 8.
The polynomial T 1 has roots 130 and 585 in F 1031 , which leads to 585 and 130 as values for X 2 . Indeed, the points P 1 (130, 154t +161) and P 2 (585, 910t + 635) of E are in B and such that R = P 1 + P 2 .

It is clear that (130, 585) and (585, 130) are in fact the same solutions. The action of the symmetric group can indeed be taken into account. As Summation Polynomials are symmetric, so is S 3 (X 1 , X 2 , x(R)). If e 1 , e 2 are variables for the elementary symmetric functions in X 1 , X 2 , the symmetrized expression is S 3 (e 1 , e 2 ) = (969t + 239)e 2 1 + (609t + 349)e 1 e 2 + (293t + 201)e 1 + e 2 2 + (52t + 702)e 2 + 590t + 837. This polynomial is sparser than S 3 (X 1 , X 2 , x(R)) and has lower total degree, so we expect the ideal resulting of the Weil Descent to have reduced degree as well. Collecting wrt. t, a new system is obtained:

969e 2 1 + 609e 1 e 2 + 293e 1 + 52e 2 + 590, 239e 2
1 + 349e 1 e 2 + 201e 1 + e 2 2 + 702e 2 + 837 For lex order e 1 > e 2 , it admits the Gröbner basis:

e 1 + 468e 3 2 + 44e 2 2 + 735e 2 + 734, e 4
2 + 767e 3 2 + 462e 2 2 + 206e 2 + 117 The degree of the ideal is 2 n(n-1) = 4 as the action of the symmetric group is now encoded. Solutions over F 1031 are (715, 787) and (1002, 437), and an additional step is to factor over F 1031 the two univariate polynomials

F 1 (x) =x 2 -715x + 787, F 2 (x) =x 2 -1002x + 437.
The polynomial F 1 has familiar roots 130 and 585, for which we recover the same decomposition of R, while F 2 has none over F 1031 .

Nagao's approach using Riemann-Roch coordinates

Let H be an imaginary hyperelliptic curve of genus g, defined over a field F q n , n ≥ 2, by a Weierstrass equation y 2 + h 1 (x)y = h 0 (x), deg h 1 g, deg h 0 = 2g + 1 and a single point at infinity P ∞ . Recall that elements of the Jacobian Variety Jac(H ) are called reduced divisors. The zero class in the Jacobian variety is given by principal divisors, i.e. describing the zeroes and poles of a rational function on H . We denote by (P) the usual embedding P → P -P ∞ of a hyperelliptic curve into its Jacobian variety.

In an Index Calculus context, the factor basis is B = {(P) : x(P) ∈ F q } and we solve PDP ng instances: given R ∈ Jac(H ), try to decompose it as R = (P 1 ) + • • • + (P ng ), where P i ∈ B for all 1 i ng.

(3.3) This is equivalent to:

∃ f ∈ L (ngP ∞ -R) : div f + R = (P 1 ) + • • • + (P ng ). (3.4)
From Riemann-Roch theorem 2.12, l(ngP ∞ -R) = (n -1)g + 1, and, if we let

d 1 = (n - 1)g/2 , d 2 = ((n -1)g -1)/2 and d = (n -1)g = d 1 + d 2 + 1, a natural basis of this space is {u, ux, . . . , ux d 1 , y -v, (y -v)x, . . . , (y -v)x d 2 }.
Then any function f ∈ L (ngP ∞ -R) can be written

f (x, y) = u(x) d 1 ∑ i=0 a 2i+1 x i + (y -v(x)) d 2 ∑ i=0 a 2i+2 x i .
and we can set the coefficient of the a d+1 to 1. Since this describes whether ux d 1 or (yv)x d 2 has the pole of highest order at infinity, we also say that we normalize f at infinity. The goal is to determine the coefficients a 1 , . . . , a d , such that expression (3.3) is verified. To achieve this we symbolically compute

Res y ( f , H ) u(x) = F(x) = x ng + ng-1 ∑ i=0 N ng-i (a 1 , . . . , a d )x i , (3.5)
where N i ∈ F q n [a 1 , . . . , a d ] and deg N i = 2. Let (x i , y i ) be the coordinates of P i , so that the roots of this polynomial are exactly the x i . As P i ∈ B for each i, a necessary condition is that F has coefficients in F q , or equivalently, to find values a * 1 , . . . , a * d ∈ F q n such that all N i (a * 1 , . . . , a * d ) are in F q .

We can now use a Weil Descent. Let 1,t, . . . ,t n-1 be a F q -basis of F q n , and write a i = ∑ n-1 j=0 a i, j t j with a i, j ∈ F q . We let a = (a 0,0 , . . . , a 0,n-1 , . . . , a d-1,0 , . . . , a d-1,n-1 ) to simplify the notations, and get

N i (a 0 , . . . , a d-1 ) = n-1 ∑ i=0 N i, j (a)t j , (3.6) with N i, j ∈ F q [a].
Values for which all N i belong to F q are exactly solutions of the multivariate polynomial system N = {N i, j (a) = 0, 1 i ng, 1 j n -1} (3.7) Such systems have n(n -1)g quadratic equations in n(n -1)g variables, and are generally of dimension 0. They are solved by the usual Gröbner basis strategy.

If this system has a solution a * over F q , we have to check in addition that the specialized polynomial

F * (x) = x ng + ∑ ng-1 i=0 N i (a * )x i is split over F q .
When it is the case, its roots are the abscissae of the P i 's, giving a decomposition of R. Heuristically, the probability of finding such decompositions is given by

# B ng S ng # Jac(H ) n ≈ q ng (ng)! 1 q ng = 1 (ng)! .
Notice that the whole modelling adapts to the elliptic case, i.e. when g = 1. However the summation method presented in Section 3.4.3 needs less variables and gives better results in practice and is thus always preferred. We also see that the degree of the ideal grows very fast with the genus and the extension degree, so the probability of finding a PDP ng solution drops exponentially fast as well. In practice, computations in this setting generally take too long as soon as g > 4 or n > 2 to even find relations in experiments.

Toy example for n = 2, g = 2 in even characteristic. Let the fields be

F 4 = F 2 [s]/ s 2 + s + 1 and F 16 = F 4 [t]/ t 2 + t + s . Select the curve as H : y 2 + xy = x 5 + x 3 + (s + 1) + st. Fix R(u, v) ∈ Jac(H ) with u(x) = x 2 + ((s + 1) + st)x + st and v(x) = ((s + 1)t + 1)x and search for f ∈ L (4P ∞ -R). A generic function in this space looks like f (x, y) = (a 1 + x)u(x) + a 2 (y -v(x)), with a i = a i,0 + a i,1 t, a i ∈ F 4 for i = 0, 1, so the R-Decomposition polynomial is F(x) = x 4 + (a 2 2 + st + s + 1)x 3 + (a 2 1 + (st + s + 1)a 2 2 + a 2 + st)x 2 + ((st + s + 1)a 2 1 + a 1 a 2 + (t + s)a 2 2 )x + sta 2 1 + ta 2 2 .
The Weil Descent leads to the following system:

N :            a 2 2,1 + s, a 2 1,1 + sa 2 2,0 + sa 2 2,1 + a 2,1 + s, sa 2 1,0 + a 1,0 a 2,1 + sa 2 1,1 + a 1,1 a 2,0 + a 1,1 a 2,1 + a 2 2,0 + a 2 2,1 , sa 2 1,0 + a 2 1,1 + a 2 2,0 + (s + 1)a 2 2,1
A Gröbner basis wrt a lexicographical ordering e.g.

a 1,0 > a 1,1 > a 2,0 > a 2,1 is then            a 1,0 + (s + 1)a 1,1 a 2,0 a 2,1 + a 1,1 + (s + 1)a 2 2,0 a 2,1 + s + 1, a 2 1,1 + sa 2 2,0 + a 2,1 + 1, a 4 2,0 + sa 2 2,0 a 2,1 + sa 2 2,0 + a 2,1 + s, a 2
2,1 + s so that the ideal has degree 16. In this small example, we already see interesting properties. Indeed the first equation in the system is univariate, and the last one is a square because of the characteristic. In Chapter 6, Section 6.1, we will see that such properties are keys to reduce the degree of the ideals.

Part III

Contributions

Chapter 4

A Sieving approach to the Harvesting

The results of this Chapter have been published at LatinCrypt 2015: V. Vitse, A. Wallet, Improved Sieving on Algebraic Curves [START_REF] Vitse | Improved sieving on algebraic curves[END_REF].

We focus on improving the known harvesting methods, dedicated to Jacobian varieties of algebraic curves defined over finite fields. We emphasize that all the other aspects of the index calculus method (such as the choice of the factor base, the processing of large prime relations and the linear algebra phase) are not modified. Sarkar and Singh proposed in [START_REF] Sarkar | A new method for decomposition in the Jacobian of small genus hyperelliptic curves[END_REF] a sieving technique for harvesting relations in the hyperelliptic case, instead of the standard approach of Gaudry [Gau00] based on smooth reduced divisors. A very similar sieve had actually been used before by Joux and Vitse in [START_REF] Joux | Cover and decomposition index calculus on elliptic curves made practical -application to a previously unreachable curve over F q 6[END_REF], but in the different context of curves defined over extension fields and Weil restrictions. A sieving approach is usually a time-memory trade-off: instead of running numerous (expensive) computations, the results of (cheap) computations are stored for later use. This is precisely the goal of Sarkar and Singh's approach, where relations are sought by incrementing a table of counter depending on the result of some multiplications in the field, instead of testing the splitness of polynomials of fixed degree over the base field. It turns out that Sarkar and Singh's sieve has a simpler interpretation, which allows to generalize it to the Index Calculus introduced by Diem [Die06] for non-hyperelliptic curves, or more exactly small degree planar curves. In our experiments, the new non-hyperelliptic sieve improves Diem's original method, as well as its development by Diem and Kochinke [START_REF] Diem | Computing discrete logarithms with special linear systems[END_REF], by a factor ranging from 3 to 7 approximately. Our reformulation does not rely on any list sorting and is more memory-efficient than [START_REF] Sarkar | A new method for decomposition in the Jacobian of small genus hyperelliptic curves[END_REF] in hyperelliptic context. Additionaly, our approach prevents duplicated relations in a nonhyperelliptic setting by exhausting the whole "pencil" of lines passing through a base point before switching to a new one.

The presentation follows these steps. We begin by the case of hyperelliptic curves with a presentation and analysis of the sieving variant of Sarkar and Singh. We then introduce its simpler reformulation. The next section deals with algebraic curves of genus g admitting a plane model of degree d ≤ g + 1. We start by the classical ideas of using principal divisors associated to equations of lines to generate relations [START_REF] Diem | An index calculus algorithm for plane curves of small degree[END_REF]. We then give the adaptation of our sieve to small degree curves, and compare it to Diem's method. We also briefly present the singularity-based technique of Diem and Kochinke and show that our sieve adapts again to this setting. Experiments and timings are reported in the last section.

Sieving for Hyperelliptic Curves

Sarkar and Singh's Sieve

A recent result of Sarkar and Singh [START_REF] Sarkar | A new method for decomposition in the Jacobian of small genus hyperelliptic curves[END_REF] proposes a sieving approach to the relation search for hyperelliptic curves. In this method, with the same factor base B as in Sect. 3.3.3, we start from a weight g reduced divisor written as D = [u, v] = ∑ g i=1 (P i )g(P ∞ ), usually related to the challenge. We then consider all the weight g + 1 semi-reduced divisors D = [u , v ] that are linearly equivalent to -D; a relation is obtained each time u is split (the factor base B is the same as in the previous version). The set of all the decompositions of -D as

-D ∼ g+1 ∑ i=1 (Q i ) -(g + 1)(P ∞ ),
i.e. the set of all weight g + 1 semi-reduced divisors linearly equivalent to -D, is in oneto-one correspondence with the set of divisors of functions in the Riemann-Roch space L (-D+(g+1

)(P ∞ )) = L (-∑ g i=1 (P i )+(2g+1)(P ∞ ))
. This space is equal to Span(u(x), y-v(x)) (since functions in this space have poles at P ∞ only, of order at most 2g + 1, and vanish at the support of D), and thus the decompositions of -D can be parametrized by an element λ ∈ F q .

We begin with the non-large-prime, non-sieving version of the algorithm. The relation search consists of two main loops, the outer one being simply a semi-random walk iterating through reduced divisors D = [u, v] ∼ aD 0 + bD 1 . The inner loop iterates over the value of the parameter λ ∈ F q . For each λ , we consider the function f λ = yv(x) + λ u(x) and the corresponding semi-reduced divisor

D λ = -D + div( f λ ). The Mumford representation [u λ , v λ ] of D λ is given by the formulae u λ = c (λ u-v) 2 -h u = c(λ 2 u -2λ v + v 2 -h u ) v λ = v -λ u mod u λ ,
where c ∈ F q is the constant that makes u λ monic. We obtain a relation each time D λ is 1-smooth, i.e. when u λ is split over F q ; this happens heuristically with probability 1/(g + 1)!.

The main advantage of this relation search is that it admits a sieving version, in the spirit of [START_REF] Joux | Cover and decomposition index calculus on elliptic curves made practical -application to a previously unreachable curve over F q 6[END_REF]. The idea is to replace the inner loop in λ by an inner loop in x ∈ F q .

For each value of x, we compute the expression

S(x, λ ) = λ 2 u(x) -2λ v(x) + v(x) 2 -h(x) u(x) ,
which becomes a quadratic polynomial in λ , and find the corresponding roots (for simplicity we can skip the values of x for which u(x) = 0). There are two distinct roots λ 0 and λ 1 if and only if h(x) is a square in F q , and those roots are given by:

λ 0 = v(x) + h(x) 1/2 u(x) , λ 1 = v(x) -h(x) 1/2 u(x) .
As explained by the authors, this step is very fast if a table containing a square root of h(x) (if it exists) for each x ∈ F q has been precomputed. We then store the corresponding couples (λ 0 , x) and (λ 1 , x). At the end of the inner loop, we look for the values of λ that have appeared g + 1 times: this means that the corresponding polynomial u λ has g + 1 distinct roots, so that D λ yields a relation, i.e. a decomposition of -D. In practice, we can either store each value of x in an array L of lists indexed by λ ; each time a value of λ is obtained as a root of the quadratic expression, we append x to L[λ ]. When #L[λ ] = g + 1, we directly have the x-coordinates of the points in the support of div( f λ ) -D, and a last step is then to compute back the y-coordinates using f λ . Alternatively, we can simply maintain a counter array Ctr indexed by λ and increment Ctr[λ ] each time λ is obtained as a root. When this counter reaches g + 1, we factorize the corresponding split polynomial u λ . This variant has the merit of saving memory at the expense of some duplicate computations, but is more interesting when g increases since the proportion of λ 's yielding a relation becomes small.

The main speed-up is provided by the fact that at each iteration of the inner loop, we replace the splitting test and the eventual factorization of either the degree g polynomial u (in Gaudry's version) or the degree g + 1 polynomial S(λ , x) evaluated in λ , by the resolution of the degree 2 equation S(λ , x) = 0, evaluated in x. This comes at the expense of a slightly lower decomposition probability, namely 1/(g+1)! instead of 1/g!, and higher memory requirement. As already noticed in [START_REF] Joux | Cover and decomposition index calculus on elliptic curves made practical -application to a previously unreachable curve over F q 6[END_REF], a second advantage of this sieve is its compatibility with the double large prime variation. Indeed, once the "small prime" factor base B s is constructed, it is sufficient to sieve among the values of x ∈ F q corresponding to abscissae of its elements (the full sieving as described above can still be used in the construction steps of B s if necessary). Since the cardinality of B s is in Θ(q α ) with α = 1 -1/g, this shortened sieving only costs Õ(q α ) instead of Õ(q). We then look for the values of λ that have been obtained at least g -1 times. The corresponding polynomials u λ have at least g -1 roots corresponding to small primes, and it just remains to test if it is indeed split, which happens with heuristic probability 1/2 (in the case where λ has been obtained exactly g -1 times). Note that we cannot simply scan the array L or Ctr, as it would cost Õ(q) (even with a very small hidden constant) and defeat our purpose. So additional care must be taken in the implementation in order to recover the interesting values of λ in only Õ(q α ), for instance using associative arrays, see [START_REF] Sarkar | A new method for decomposition in the Jacobian of small genus hyperelliptic curves[END_REF] for details. Although it is not specified in the original paper, one can show that the asymptotic complexity of this variant is still in Õ(q 2-2/g ) for fixed g, as in the work of Gaudry, Thomé, Thériault and Diem [GTTD07], but it is more efficient in practice, and the authors report a significant speed-up.

Sarkar and Singh's Sieve Revisited

As mentioned above, precomputing a table containing an eventual square root of h(x) for each x ∈ F q can significantly speed up the sieving phase (for a Õ(q) overhead). But this table is actually nothing more than a list of the rational points of H . Indeed, if y is a square root of h(x) then (x, y) and (x, -y) are exactly the two points in H (F q ) with abscissa x, and this precomputation is actually performed when the factor base B = {(P) -(P ∞ ) : P ∈ H (F q )} is enumerated.

This means that we can modify Sarkar and Singh's sieve as follows. Recall that we are looking for functions f λ = yv(x)λ u(x) such that -D + div( f λ ) is 1-smooth. Instead of sieving over the value of x ∈ F q , or in a small subset corresponding to small primes, we directly sieve over P = (x P , y P ) ∈ B or B s , and the corresponding value of λ is simply recovered as y P -v(x P ) u(x P ) . We give a pseudo-code of this sieve in Alg. 8.

The pseudo-code corresponds to the non-large-prime version. Details like the management of the list or associative array L and the update of M are omitted. As mentioned above, a simple counter array Ctr can be used instead of L, requiring the factorization of S(x, λ ) for the update of M. If the double large prime variation is used, then the first inner loop iterates only over the elements of the small factor base B s , and in the second we test if #L[λ ] ≥ g -1 and subsequently if the remaining factor of S(x, λ ) splits.

An easy improvement, not included in the pseudo-code for the sake of clarity, is to use the action of the hyperelliptic involution to divide by two the size of the factor base. We can then compute simultaneously the values of λ corresponding to P = (x P , y P ) and ıP = (x P , -y P ). This saves one evaluation of u and of v at x P , and one inversion of u(x P ), although it is also possible to precompute all inverses. It is clear that this is basically a rewriting of Sarkar and singular point P 1 of multiplicity m ≥ 2 (in most cases m = 2). The factor base is given by the rational points of the desingularization C of C , i.e. B = {(P) : P ∈ C (F q )}. In the original version, for each other point P 2 in B or in the small factor base B s , the intersection of C with the line passing through P 1 and P 2 is computed as before. This amounts to finding the roots of the polynomial

F(x, λ x + µ) (x -x 1 ) m (x -x 2 ) ,
which has degree dm -1. If it splits, which happens with probability about 1/(dm -1)!, we compute the intersection points P 3 , . . . , P d-m-1 and obtain a relation that we can write as

D ∼ (P 2 ) + (P 3 ) + • • • + (P d-m-1 ),
where D involves the singularity and the points at infinity. In the double large prime variation we keep this relation only if it involves no more than two large primes. To get rid of the divisor D on the left-hand side we would like to subtract one such relation from all the other ones. But in order to do this (using large primes) we need one relation involving only small primes ; if it does not exist a solution is then to add some points to B s . Since there are less points on the right-hand side than in Diem's first algorithm, the probability of finding a relation increases, and one can show that the overall complexity becomes Õ(q 2-2/(g-2) ). Note that here again, some care must be taken to avoid duplicate relations, and in particular not all points P 2 but only a fraction of the factor base should be considered.

Now it is clear that our sieve can be naturally adapted to this new setting. Indeed, we can keep the inner loops of Alg. 9 ; the point (x 1 , y 1 ) is now the singular point P 1 , and we look for the values of λ that have been obtained dm times, or dm -2 times in the double large prime variation. Once again, this replaces the factorization of a degree dm -1 polynomial by a single division, and avoids checking for duplicate relations.

Experiments

We have experimented the harvesting techniques presented in this article for several curves of different genera, defined over different finite fields. All computations have been done using the computer algebra system Magma [START_REF] Bosma | The Magma algebra system I: the user language[END_REF] on an AMD Opteron ™ 6176 SE@2.3GHz processor. We only implemented the non-large-prime version of the algorithms, the main reason being that we wanted the tests to be as simple as possible1 . The curves have been generated with the command RandomCurveByGenus, which always returned a degree g curve (instead of g + 1) for g ≥ 6; for this reason the results in genus 6 are very close to those in genus 5 and we did not report them. For the non-sieving versions, we used associative arrays and sets to automate the check for duplicate relations, but this is more and more costly as the number of relations grows.

We give in Table 4.1 the comparison between Diem's method and our sieve; the values are the timings in seconds (on an Intel © Core i5@2.00Ghz processor) to obtain p ≈ #F relations, averaged over several curves.

In Table 4.2 we give timings comparing the new sieve with Diem and Kochinke's method. We did not implement the change of plane models; instead, we simply chose random curves possessing rational singular points, and used one of them as the base point for the relation search. In the sieving version all the relations involving lines passing through the singularity were computed, whereas in the non-sieving case we only iterated through half of the basis, as suggested in [START_REF] Diem | Computing discrete logarithms with special linear systems[END_REF]. For this reason the values correspond to the timings in seconds needed to obtain 1000 relations, again averaged over several curves.

Conclusion

We have shown in this work that a reformulation of Sarkar and Singh's sieve [START_REF] Sarkar | A new method for decomposition in the Jacobian of small genus hyperelliptic curves[END_REF], namely sieving over points instead of x-coordinates, gives a simpler presentation of the harvesting phase of the index calculus algorithm on hyperelliptic curves. More importantly, it can be naturally adapted to Diem and Kochinke's index calculus for non-hyperelliptic curves [START_REF] Diem | An index calculus algorithm for plane curves of small degree[END_REF][START_REF] Diem | Computing discrete logarithms with special linear systems[END_REF]. Our experiments show that the new sieve clearly outperforms the relation search of the other methods in all circumstances and should always be preferred.

Chapter 5

Summation Ideals

The results of this Chapter are part of an article which has been submitted at Design, Codes and Cryptography journal.

This section focuses on an alternate modelling of PDP m instances in all genera, derived from Gaudry and Diem's propositions for elliptic curves defined over extension fields. Recall that their approach is practical only if the extension degree is "small", which means that the degree of the extension admits a small factor k (≤ 5). The overall idea is to describe the algebraic dependance of points' abscissae, when the points form a vanishing sum like

P 1 + • • • + P m = O.
Once the size m of the sum is fixed, the set of such points forms an algebraic variety, whose projection over the x coordinates is an hypersurface generated by the Summation Polynomial; this is why computing the Summation Polynomial is sometime referred as "projecting the group law on the x-line". If we denote by S m the Summation Polynomial for sums of size m, then we have m ∑ i=1 P i = O ⇔ S m (x(P 1 ), . . . , x(P m )) = 0, which can be taken as a defining property. As showed by Diem [START_REF] Diem | On the discrete logarithm problem in elliptic curves[END_REF] and Gaudry [START_REF] Gaudry | Index calculus for abelian varieties of small dimension and the elliptic curve discrete logarithm problem[END_REF], Summation Polynomials can be used to solve PDP n instances in Decomposition attacks over F q n . In this setting an additional condition is that the points belong to the factor base, i.e. that x(P i ) ∈ F q (up to a linear change of variables). The Weil Descent on S n 's coefficients then leads to 0-dimensional systems. As those systems involve less variables than their Nagao counterparts, it is hoped that they are easier to solve. This proved to be experimentaly true for elliptic curves.

In Section 5.1 we propose a general definition of Summation Polynomials for higher genus curves by focusing on the geometric description of vanishing sums. With Index-Calculus in mind, we focus on hyperelliptic curves, but the whole modelling can be adapted to any type of curves. Assume H is given by an imaginary model, and let (P) stands for the canonical embedding H -→ Jac(H ) using the point at infinity. We introduce the m-Summation Variety

V m = {(P 1 , . . . , P m ) : m ∑ i=1 (P i ) = O},
and we give a polynomial parametrization of V m using Riemann-Roch spaces. This allows us to compute the associated ideal for its projection over the abscissae: we define this ideal as the m-th Summation Ideal and any set of generators as Summation Sets of Polynomials. The projection of V m is no longer an hypersurface when g ≥ 2, since its codimension is at least g in general. It is noteworthy that we recover the classical elliptic Summation Polynomial of Section 3.4.3 when g = 1, as already noted in [START_REF] Joux | Elliptic curve discrete logarithm problem over small degree extension fields -application to the static Diffie-Hellman problem E(F q 5 )[END_REF]. We give examples of such sets for the smallest parameters g = 1, 2 and m = 3, 5 in positive characteristic, completed by computation timings and informations for several couples of (g, m).

Section 5.4 deals with practical usage of Summation Sets for Index Calculus purpose. When modelling PDP m instances there are two approaches that can be used. On the one hand we can first compute a Summation set, then specialize it to the coordinates given by the input R ∈ Jac(H ): we call this approach Project-then-specialize. On the other hand it is possible at each new input to compute a Summation Set already evaluated using a modification of V m 's parametrization: we refer to this approach as Specialize-then-project. Classically in the elliptic setting, the first one is used but it makes no difference to use the other. This is specific to the case g = 1: indeed, using the Project-then-specialize approach when g ≥ 2 leads to ideals with degree 2 (ng-1)n = 2 n(g-1) • d Nag after Weil Descent, where d Nag = 2 n(n-1)g is the degree obtained with a classical Nagao approach. We show that the Specialize-then-project method leads to ideals with degree d Nag . To this effect we chose a more geometry-flavoured description, to highlight the importance of the projection of V m over the abscissae. Next the Specialized Summation Variety is introduced as

V m,R = {(P 1 , . . . , P m ) : m ∑ i=1 (P i ) = R},
for a fixed R ∈ Jac(H ) of weight g. We also give a parametrization of this variety, and introduce Specialized Summation Sets as generators of its projection over the abscissae. Finally we analyze the PDP ng solving process using Project-then-Specialize and Specialize-then-project methods to conclude that the second gives ideals of degree 2 n(n-1)g and is thus better as soon as g ≥ 2. The analysis shows that, when g = 1, it makes no difference to use Summation Polynomials or Specialized Summation Polynomials: the latter is only the evaluation of the former at x(R). The Chapter concludes with some more general answers: a recursive method to compute Elliptic Summation Polynomials is known (Proposition 3.13). In higher genus, we explain why such a method cannot be expected, which may be summed up by the fact that the cover x : H -→ P 1 over degree 2 induces a morphism Jac(H ) -→ (P 1 ) g of degree 2 g . For more or less the same reason, unfortunately, the natural group of symmetries acting on the Jacobian Variety does not preserve the Summation Variety that we defined. Therefore it seems unlikely that such symmetries can be exploited to reduce the degree of the target variety, as in the work of [FGHR14, FHJ + 14, GG14].

A geometric description of PDP m instances

Following [START_REF] Diem | On the discrete logarithm problem in elliptic curves[END_REF] and [START_REF] Joux | Elliptic curve discrete logarithm problem over small degree extension fields -application to the static Diffie-Hellman problem E(F q 5 )[END_REF], we want to generalize Semev's summation polynomials to any hyperelliptic curve. The elliptic case is covered up when g = 1. To simplify the presentation we assume for the moment that the base field F is algebraically closed, but the whole presentation extends easily to arbitrary fields. For any hyperelliptic curve H , recall that (P) stands for the classical embedding P -P ∞ of H into Jac(H ). We now describe the variety of all sums like (P 1 ) +

• • • + (P m ) = O, P i (x i , y i ) ∈ H . (5.1)
To find a relation as (5.1), we need an f ∈ L (mP ∞ ) such that div f = ∑ m i=1 (P i ). Remark 5.1. If m < 2g + 1 then no basis of L (mP ∞ ) can contain a function involving y, since it has a pole of order 2g + 1 at P ∞ . But if f involves only monomials in x and vanishes at P, then it also vanishes at -P and thus (P) + (-P) is in the support of div f . Any such divisor reduces to O in the Jacobian, and therefore we need at least m ≥ 2g + 1. We will always assume that this is the case in this section.

Definition 5.2. Let m ≥ 2g + 1. Let H : y 2 + h 1 (x)y = h 0 (x) be an hyperelliptic curve of genus g in imaginary model defined over a field F, and set O to be the neutral element of Jac(H ). The set V m = { (P 1 , . . . , P m ) : ∑ m i=1 (P i ) = O } is called the m-Summation Variety of H . We now find generators for the (ideal associated to) V m ; this shows that V m is an algebraic variety. Using Definition 5.7, this set can also be seen as the kernel of a morphism of Abelian variety, which gives an alternate proof, less computationally-flavoured. The space L (mP ∞ ) has dimension mg + 1 and a natural basis is the set {1, x, . . . , x d 1 , y, yx, . . . , yx d 2 }, with d 1 = m/2 and d 2 = (m -2g -1)/2 . Let d = mg and a = (a 0 , . . . , a d ) the coordinates in this basis, so that a generic function in L (mP ∞ ) can be written as an element in (F[a])[x, y] as:

f (x, y) = p(x) + q(x)y, (5.2)

with p(x) = ∑ d 1 i=0 a i x i , q(x) = ∑ d 2 i=0 a i+d 1 +1 x i .
We normalize f at infinity -see Section 3.4.4, the reader may assume that a d = 1. In those coordinates, the generic norm of f is then the monic polynomial in (F[a])[x] given by

N( f ) = p(x) 2 + p(x)q(x)h 1 (x) -q(x) 2 h 0 (x) (5.3) = (-1) m (x m + m-1 ∑ i=0 N m-i (a)x i ), (5.4)
with

deg N i = 2 for 1 ≤ i ≤ m. Assume now that f describes a sum (P 1 ) + • • • + (P m ) = O and let x i = x(P i ), x = (x 1 , . . . , x m
). The generic norm N( f ) vanishes exactly at all the x i 's so we have

N( f ) = (-1) m n ∏ i=1 (x -x i ) (5.5) = (-1) m (x m + m-1 ∑ i=0 (-1) n-i e n-i (x)x i ), (5.6)
where e i stands for the i-th elementary symmetric polynomial in m variables X = (X 1 , . . . , X m ). Equating coefficients of (5.4) and (5.6) we obtain a polynomial system

       N 1 (a) = e 1 (X), . . . N m (a) = (-1) m+1 e m (X), (5.7)
of m equations in 2mg variables. We claim that the projection of V m onto the x-line can be parametrized by the ideal generated by those polynomials.

Proposition 5.3. Let H be a hyperelliptic curve in imaginary model of genus g with canonical embedding P → (P) in its Jacobian Jac(H ). For any m ≥ 2g + 1, define I m as the ideal in F[a, X] generated by system (5.7). The projection of the m-Summation Variety on the x-line admits a parametrization by I m .

Proof. Let π x denote the projection on the x line. The description above tells us that π x (V m ) is contained in the variety parametrized by I m (in the sense of Definition 1.69). For the reverse inclusion, assume that (a * 1 , . . . , a * m-g , x * 1 , . . . , x * m ) ∈ V (I m ). We want to show that there exist y 1 , . . . , y m ∈ F such that P i (x * i , y i ) ∈ H and ∑ m i=1 (P i ) = O. We start by specializing the generic function f from (5.2) with a * 1 , . . . , a * m-g . This gives an element f * ∈ L (mP ∞ ). Next, provided q(x * i ) = 0, we can set

y i = - p(x * i )
q(x i ) for 1 ≤ i ≤ m and we can easily check that P i ∈ H and that f * (x * i , y i ) = 0. Now assume q(x * i ) = 0 for at least one i. By (5.4) we have p(x * i ) = 0 and then f * (x * i , y) = 0 for all y ∈ F, and

f * (x, y) = (x -x * i ) f (x, y) with f ∈ L ((m -2)P ∞ ). Since F is algebraically closed 1 , the polynomial y 2 + h 1 (x * i )y + h 0 (x * i )
have roots y i and -y ih 1 (x * i ) and thus f * vanishes at P i (x * i , y i ) and

-P i (x * i , -y i -h 1 (x * i )).
"Projecting on the x-line" means we want a condition involving only the abscissae of points in (5.1), or equivalently, we want to eliminate the variables coming from the coordinates of f . Geometrically, this means we want to find polynomial equations defining the projection of V m onto the m last variables. Assume for simplicity that we are in a generic situation. Being described by m equations in a 2mg dimensional space, V m has dimension mg, so that the projection on a m-dimensional subspace will have codimension g. This means that a minimal generating family of the associated ideal should have at least g elements. For g ≥ 2, this means there is no hope to obtain a unique summation polynomial. Instead, we will have a set of summation polynomials, which we can now define: Definition 5.4 (Summation polynomials for hyperelliptic curves). Let H be a hyperelliptic curve of genus g given by a Weierstrass equation y 2 + h 1 (x) = h 0 (x), and m ≥ 2g + 1. The m-th summation ideal associated to H is defined as the elimination ideal I m ∩ F[X] where I m is the ideal in F[a, X] generated by equations (5.7). Any set S m ⊂ F[X] generating I m ∩ F[X] is called a set of m-th summation polynomials, or a m-th summation set, for H . Remark 5.5. Geometrically, S m is a m-th summation set if it verifies

V (S m ) = V (I m ∩ F[X]).
Describing the projection of V m can be done by computing a Gröbner basis of the elimination ideal I m ∩ F[X]. For any set S of polynomials, we denote by S(x) the set of all elements in S evaluated at x. The next proposition generalizes the definition of Semaev's summation polynomials:

Proposition 5.6. For any m ≥ 2g + 1, a set S m of m-th summation polynomials associated to H exists, and it verifies:

S m (x) = 0 ⇔ ∃ y 1 , . . . , y n ∈ F such that P i (x i , y i ) ∈ H , 1 i m,
and

(P 1 ) + • • • + (P m ) = O.
Proof. The existence of summation sets is clear from the Hilbert Basis theorem and the existence of a Gröbner basis for any ideal in

F[X]. Now if x is in V (I m ∩ F[X]
), according to the Extension Theorem 1.63 we know that there exists a = (a * 1 , . . . , a * m-g ) such that (a, x) ∈ V m . The conclusion is basically Proposition 5.3. When g = 1, the ideal is principal and we recover the fact that, in the elliptic case, the m-th summation polynomial described in Section 3.4.3 is unique (up to a constant). Using variables e 1 , . . . , e m for expressions e i (X 1 , . . . , X m ) before eliminating a in system (5.7) allows us to compute directly a m-th Summation Set expressed with the elementary symmetric functions. Therefore from now on, we always consider V m as the m-th Summation Variety quotiented by the action of the symmetric group.

In fact, using variables for the symmetric expressions in system (5.7) gives a polynomial parametrization of V m . From Corollary 1.72, V m is irreducible and the defining equations generate a radical ideal. This gives a proof that the (symmetrized) elliptic Summation Polynomial is irreducible. While the modelling focuses on the hyperelliptic case, it can be adapted straigthforwardly to non-hyperelliptic curves as well by studying bases of L (mO), where O is a distinguished point of the curve. We ran some experiments for superelliptic curves (y g = f (x)) and C a,b curves of small genus but we did not investigate further as such curves are not considered in practice.

Examples of Summation Sets

We first show that the third summation for an elliptic curve expressed in the elementary symmetric functions can indeed be computed with our modelling. We then present some sets of summation polynomials for genus 2 curves and discuss the expected codimension of the projected variety.

Elliptic Summation Polynomial revisited

In this Section we assume the characteristic of F to be odd and not equal to three, but the whole process can be adapted easily to every characteristic as well. In this setting it is well-known that every elliptic curve admits a Weierstrass equation of the form

E : y 2 = x 3 + Ax + B.
We want to describe the simplest non trivial sum P 1 + P 2 + P 3 = O, P i (x i , y i ) ∈ E(F) so that we need a basis of L (3O). A convenient one is given by the set {1, x, y}, so that we are in fact looking at the intersection between lines and the curve (this is also the geometric way to see the addition for elliptic curves, the so-called chord-tangent method ). Such a line admits an equation f (x, y) = y -(a 1 x + a 0 ), so using (5.4) we get:

N( f ) = (a 1 x + a 0 ) 2 -(x 3 + Ax + B) = -x 3 + a 2 1 x 2 + (2a 0 a 1 -A)x + a 2 0 -B
and the norm should also have roots exactly in the x i :

N( f ) = - 3 ∏ i=1 (x -x i ) = -x 3 + e 1 x 2 -e 2
x + e 3 (5.8) with e i being the i-th elementary symmetric polynomial in the x i . We are led to the following polynomial system:

     a 2 1 = e 1 , 2a 0 a 1 -A = -e 2 , a 2
0 -B = e 3 .

(5.9)

Let I be the ideal generated by (5.9) in F[a 0 , a 1 , e 1 , e 2 , e 3 ]. We compute a Gröbner Basis of I ∩ F[e 1 , e 2 , e 3 ] and find {e 2 2 -4e 3 e 1 -2Ae 2 -4Be 1 + A 2 } which is indeed the representation of S 3 associated to E, using elementary symmetric functions. With this modelling, it is very fast to compute summation polynomials up to n = 5. For greater n the recursive method using partial symmetrization [START_REF] Joux | Elliptic curve discrete logarithm problem over small degree extension fields -application to the static Diffie-Hellman problem E(F q 5 )[END_REF] at each step prove to be much faster.

First Summation Sets in genus 2

Odd characteristic We assume for simplicity that F has characteristic = 5. Then an imaginary hyperelliptic curve admits a Weierstrass equation H : y 2 = x 5 + h 3 x 3 + h 2 x 2 + h 1 x + h 0 , with h i ∈ F q . Using Section 5.1 the smallest interesting decomposition is obtained for m = 2g + 1 = 5:

(P 1 ) + • • • + (P 5 ) = O.
A convenient F q -basis for L (5P ∞ ) is given by {1, x, x 2 , y}, and describes the family of parabolas in F 2 . Keeping notations consistent with previous Sections, a generic function in this space is f (x, y) = y -(a 2 x 2 + a 1 x + a 0 ), with generic norm

N( f ) = (a 1 x 2 + a 1 x + a 0 ) 2 -(x 5 + h 3 x 3 + h 2 x 2 + h 1 x + h 0 ) = -x 5 + a 2 2 x 4 + (2a 2 a 1 -h 3 )x 3 + (a 2 1 + 2a 2 a 0 -h 2 )x 2 + (2a 0 a 1 -h 1 )x + a 2 0 -h 0 ,
and can be also expressed as

N( f ) = - 5 ∏ i=1 (x -x i ) = -x 5 + e 1 x 4 -e 2 x 3 + e 3 x 2 -e 4 x + e 5 .
Equating coefficients gives the following system:

               a 2 0 -h 0 = e 5 , 2a 0 a 1 -h 1 = -e 4 , a 2 1 + 2a 2 a 0 -h 2 = e 3 , 2a 2 a 1 -h 3 = -e 2 , a 2 2 = e 1 .
To eliminate a 0 , a 1 , a 2 we compute a Gröbner basis for the elimination ideal. If we choose a lexicographical order with a 0 > a 1 > a 2 > e 5 > ... > e 1 , we find after elimination:

S 5,1 = (8e 2 -8h 3 )e 2 5 + ((4h 2 -4e 3 )e 4 -16h 0 e 2 + 16h 0 h 3 -4h 1 h 2 + 4h 1 e 3 )e 5 + e 3 4 -3h 1 e 2 4 + (4h 0 e 3 -4h 0 h 2 + 3h 2 1 )e 4 -8h 2 0 h 3 + 4h 0 h 1 h 2h 3 1 -4h 0 h 1 e 3 + 8h 2 0 e 2 , S 5,2 = 16e 2 5 e 1 + ((-2h 3 + 2e 2 )e 4 + 2h 1 h 3 -4h 2 2 + 8h 2 e 3 -32h 0 e 1 -4e 2 3 -2h 1 e 2 )e 5 + (e 3h 2 )e 2 4 + (-2h 0 e 2 -2h 1 e 3 + 2h 0 h 3 + 2h 1 h 2 )e 4 + 4h 0 e 2 3 + (-8h 0 h 2 + h 2 1 )e 3 + 2h 0 h 1 e 2 + 16h 2 0 e 1 -2h 0 h 1 h 3 + 4h 0 h 2 2h 2 1 h 2 , S 5,3 = (8e 4 e 1 + (-4e 2 + 4h 3 )e 3 -4h 2 h 3 -8h 1 e 1 + 4h 2 e 2 )e 5 + (-h 3 + e 2 )e 2 4 + (-8h 0 e 1 -2h 1 e 2 + 2h 1 h 3 )e 4 + (-4h 0 h 3 + 4h 0 e 2 )e 3 + (-4h 0 h 2 + h 2 1 )e 2 + 8h 0 h 1 e 1 + 4h 0 h 2 h 3h 2 1 h 3 , S 5,4 = (-2h 3 e 2 + h 2 3 + e 2 2 )e 5 + 2h 1 e 4 e 1h 0 e 2 2 + 2h 0 h 3 e 2e 2 4 e 1h 0 h 2 3h 2 1 e 1 , S 5,5 = (-8h 3 e 1 + 8e 2 e 1 )e 5 + (-4e 3 e 1 + e 2 2 -2h 3 e 2 + 4h 2 e 1 + h 2 3 )e 4 + 4h 1 e 3 e 1h 1 e 2 2 + (-8h 0 e 1 + 2h 1 h 3 )e 2 + (8h 0 h 3 -4h 1 h 2 )e 1h 1 h 2 3 , S 5,6 = 16e 5 e 2 1 + (2e 2 e 1 -2h 3 e 1 )e 4 -4e 2 3 e 1 + (h 2 3 + e 2 2 -2h 3 e 2 + 8h 2 e 1 )e 3h 2 e 2 2 + (2h 2 h 3 -2h 1 e 1 )e 2h 2 h 2 3 + (2h 1 h 3 -4h 2 2 )e 1 -16h 0 e 2 1 , S 5,7 = 8e 4 e 2 1 + (-4e 2 e 1 + 4h 3 e 1 )e 3 + e 3 2 -3h 3 e 2 2 + (4h 2 e 1 + 3h 2 3 )e 2 -4h 2 h 3 e 1 -8h 1 e 2 1h 3 3 .

(5.10) For n = 6 the polynomials are already too large to be displayed on paper. For instance, once specialized to a curve, the smallest polynomial in a DRL basis for the case n = 6 has 172

Timings and Experiments

Timings in odd characteristic Table 5.1 shows the details of the computations for the first sets of summation polynomials, expressed in the symmetric elementary functions e 1 , . . . , e m , for hyperelliptic curves with g = 2, 3, 4. The base field is F 65521 and all the curves are given by a general Weierstrass equation with randomized coefficients. The computation of the elimination ideal was carried with the Magma system [START_REF] Bosma | The Magma algebra system I: the user language[END_REF], on a Intel ® Xeon ® @2.93GHz processor. We only computed Gröbner bases with respect to weighted degree orderings; in the simplest cases, it is also possible to compute lexicographical bases. The time is expressed in seconds, and averaged over several curves. If all variables could not be eliminated we let the number we could achieve in parenthesis in the eliminated column, together with the time needed to do so. Next columns give the average number (rounded) of monomials and average total degree of elements in the summation set. The degree accounts for weight i on the variable e i . When a Summation Set S m can be computed, we also compute degV (S m ) using the Hilbert Series, see last column. We interrupted the computations if any of our strategies could not compute the basis in less than 8 hours or if the needed memory exceeded 120 Go. Timings in even characteristic In Table 5.2 we report computation times for the first summation sets for binary hyperelliptic curves of genus 2, 3, 4. This is done with Magma on the same processor. The base field was fixed as F 2 15 and curves' coefficients were randomly chosen, considering the most general case. In genus 2, it has to be stated that the use of canonical forms speeds up the computation and leads to sparser sets, because less non-zero coefficients in the curve's equation means less monomials in the support of the parametrization of V m . The column headings in the table are the same as in the previous paragraph, and we used the same criterion to interrupt a lengthy computation.

As for Semaev's summation polynomials, computations are easier to finish in even characteristic, and the summations sets' elements are much sparser and fewer. It is known [START_REF] Diem | On the discrete logarithm problem in elliptic curves[END_REF] that when g = 1 then degV (S m ) = 2 m-2 if S m is the m-th Summation Polynomial. This fact added to the last column of Tables 5.1 and 5.2 leads to the conjecture that degV (S m ) = 2 m-g-1 . We give more details on this in the next section.

Specialization of Summation Sets for Index-Calculus

In this section the discussion suits both elliptic and hyperelliptic curves so that we let H stand for both elliptic or hyperelliptic curves, specifying the genus as needed. We start by highlighting the projection of V m to V (S m ) and analyze its property to give a general conjecture for deg V m and degV (S m ). Next we study two possible ways of describing PDP m instances (Definition 3.11) using Summation Sets before the Weil Descent. Classically when g = 1, a summation polynomial is computed -or given as raw input -once and for all, then evaluated at every new R that we try to decompose. Alternatively it is possible to compute the summation polynomial already evaluated at x(R). We refer to those approaches as projectthen-specialize resp. specialize-then-project. This also prompts the definition of the Specialized m-Summation Variety associated to R ∈ Jac(H )

V m,R = {(P 1 , . . . , P m-g ) :

m-g ∑ i=1 (P i ) = R}.
A parametrization of this variety is given, as well as generators for its projection over the abscissae, that we call Specialized Summation Polynomials. A conjecture on the degree of V m,R is also given depending on m, g. Then we analyze both approaches to observe that the degree of the ideal resulting from the Weil Descent after project-then-specialize is 2 n(g-1) times greater than its specialize-then-project counterpart, which is found to be equal to d Nag = 2 n(n-1)g . In particular this shows that project-then-specialized or specialized-then-project methods are equivalent when g = 1. A toy-example is presented in Section 5.4.4 to illustrate the theoretical discussion. As a conclusion to this section, we also give a negative answer to the question of a recursive computation for summation sets in the spirit of Proposition 3.13.

Summation Sets and Projections

For an imaginary hyperelliptic curve H and P(x, y) ∈ H , we denote by -P the image of P by the canonical (hyper)elliptic involution [-]. When g = 1, this also gives the opposite of P for the group law. It is well-known that hyperelliptic curves are degree 2 covers of the projective line, which means that there exists a projection π : H -→ P 1 of degree 2. Additionally it can be chosen invariant wrt. the canonical involution i.e. π • [-] = π. For example consider the projection π(P) = [x(P) : 1], π(P ∞ ) = [1 : 0] on the abscissae in a Weierstrass model. As -P(x, -y + h 1 (x)), notice indeed that π • [-] = π. For all m ∈ N * we also denote by π : H m -→ (P 1 ) m the induced cover of degree 2 m .

Definition 5.7. Let H be a (hyper)elliptic curve of genus g ≥ 1 with P → (P) its canonical embedding into Jac(H ). For all m ∈ N * , the m-points sum is the map defined by

Σ m : H m -→ Jac(H ) m
-→ Jac(H ) (P 1 , . . . , P m ) -→ ((P 1 ), . . . , (P m )) -→ ∑ m i=1 (P i )

When m ≥ 2g+1, the m-Summation Variety is V m = {(P 1 , . . . , P m ) : ∑ m i=1 (P i ) = O} = Σ -1 m ({O}). With notations of Section 5.1, Proposition 5.6 tells us that π(V m ) = V (I m ∩ F[X]) = V (S m ) for any m-summation set S m . In particular, summation ideals depend on the choice2 of the double cover π. Overall we have a commutative diagram

V m π / / H m V (S m ) / / (P 1 ) m
If (x 1 , . . . , x m ) ∈ V (S m ), from Proposition 5.6 there exist P i (x i , y i ) ∈ H such that ∑ m i=1 (P i ) = O. Since x(-P i ) = x(P i ), we also have ∑ m i=1 (-P i ) = O. This means that π : V m -→ V (S m ) has degree at least 2, and it can be shown there are only two functions in F(H ) that vanishes exactly at the x(P i )'s, so deg π = 2. If [-] : H m -→ H m is induced by the canonical involution on H , then V m /[-] V (S m ) as the projection π factors through this quotient in a degree 1 map. Using Table 5.1 and 5.2 as well as Diem's proof [START_REF] Diem | On the discrete logarithm problem in elliptic curves[END_REF] for g = 1, we can formulate a conjecture on the degree of V m .

Conjecture 5.8. Let H be an (hyper)elliptic curve of genus g, and m ≥ 2g + 1. The degree of the m-Summation variety V m resp. its projection π(

V m ) = V (S m ) are deg V m = 2 m-g , degV (S m ) = 2 m-g-1 .
This conjecture is strengthened by the following intuition: if we fix dim V m = mg points in a vanishing sum (P 1 ) + . . . + (P m ) = O of points of a genus g curve, then generally the last g points are totally determined. In other word we have mg degree of freedom for a vanishing sum of size m. Two choices can be done for each "free" point, as any point has an opposite, so there should be 2 m-g possible sums (provided the field is algebraically closed). As V m /[-] V (S m ) from the quotient of a degree 2 projection, then it is expected that degV (S m ) = deg V m /2.

Specialized Summations Sets

Let X = (X 1 , . . . , X m ) and X = (X 1 . . . , X m-g ). To solve PDP m instances, we can on the one hand compute a m-th Summation set S m ⊂ F[X] -associated to a well-chosen cover but we assume here it is given by the Weierstrass abscissae -then for a given input R = (R 1 ) + • • • + (R g ) ∈ Jac(H ) we compute the specialization S m (X, x(R 1 ), . . . , x(R g )). This process can be decomposed into two steps: first a projection is done to compute V (S m ). Then, this projection is cut by the hyperplanes X m-g+1x(R 1 ), . . . , X mx(R g ). As π -1 (π(R)) = {±R 1 , . . . , ±R g }, the preimage of this intersection wrt. π is V m,R := {(P 1 , . . . , P m-g ) :

m-g ∑ i=1 (P i ) = ±(R 1 ) ± • • • ± (R g )}.
This variety contains obviously more elements than those actually needed. Since R is given in practice, we can on the other hand compute (generators for the projection of) another variety.

As in the end of Section 5.1, using variables for symmetric functions in the parametrization of V m,R leads to consider the action of the symmetric group. We again keep the same notations for the Specialized variety quotiented by the symmetric action. Since it is given by a polynomial parametrization, it is irreducible and the defining equations generate a radical ideal by Corollary 1.72. Recall from Remark 5.10 that V = {(P 1 , . . . , P m-g ) : ∑ m-g i=1 (P i ) = ±R}. The projection π : V -→ V (S m,R ) has degree 2, and factors through the quotient V /[-] V m,R as a map of degree 1. In particular, V m,R is birational to V (S m,R ).

Timings for Specialized Summation Sets: Below are tables summing up computations experiments for several Specialized Summation Sets with 2 ≤ g ≤ 4 in both even and odd characteristics. Protocol and column headings are identical to the previous tables. The degree of V (S m,R ) can also be obtained as the degree of V m,R since both varieties are birational. This is done when a Specialized Summation Set cannot be computed in reasonable time. This prompts the following conjecture on the degree of V m,R . As previously, the degree is expressed taking into account the action of the mg-th symmetric group. hence W n (S m ) is generated by {S i, j (E) : 1 ≤ i ≤ ng, 0 ≤ i ≤ n -1}. To find a decomposition of R, it is necessary that values for E i belong to F q -equivalently, that E i, j = 0 for 1 ≤ i ≤ ng, 1 ≤ j ≤ n -1. Geometrically, this means we try to find points in the variety

V = W n (S m ) ∩V ({E i, j : 1 ≤ i ≤ ng, 1 ≤ j ≤ n -1}).
Since dim W n (S m ) = n(n -1)g, the above intersection has dimension 0 in general. Assuming Conjectures 5.8 and 5.13 are true, we have in general deg(V (S m ) ∩ H) = degV (S m ) = 2 m-g-1 from Expression (5.13) and thus

deg V = (degV (S m )) n = 2 n•(m-g-1) = 2 n(ng-1) .
Recall that the degree obtained with a (unrefined) Nagao approach is d Nag = 2 n(n-1)g , so that deg V = 2 n(g-1) • d Nag .

Specialize-then-Project: Now let S m,R ⊂ F q n [E 1 , . . . , E ng ] be a Specialized Summation Set for H . In this situation we have dimV (S m,R ) = m -2g = (n -1)g, and therefore dim W n (S m,R ) = n(n -1)g. Collecting wrt. t any S ∈ S m,R as in expression (5.14), a generating set for

W n (S m,R ) is {S i, j (E) : 1 ≤ i ≤ ng, 0 ≤ i ≤ n -1}. Intersecting V R = W n (S m,R ) ∩V ({E i, j : 1 ≤ i ≤ ng, 1 ≤ j ≤ n -1}),
with the n(n-1)g hyperplanes E i, j = 0, 1 ≤ i ≤ ng, 1 ≤ j ≤ n-1 generally reduces the dimension to dim V R = 0. Assuming Conjecture 5.13 is true, we find that

deg V R = (degV (S m,R )) n = 2 n•(m-2g) = 2 n(n-1)g = d Nag .
The whole description confirms that when g = 1, i.e. for elliptic curves, it makes no difference in terms of expected degree to chose one approach or another. Overall as soon as g ≥ 2, only Specialized Summation Sets should be used to expect lower degree for the ideals resulting from the Weil Descent. In Chapter 6, Section 6.3, we give timing comparisons between the Specialize-then-Project approach and Nagao's modelling.

A toy-example and a new algorithm.

We now illustrate the two approaches with small parameters n = g = 2, and solve a PDP 4 instance over k = F 1031 and K = k[t]/(t 2 + 728t + 1005). We consider the genus 2 curve H : y 2 = x 5 + (876t + 276)x 3 + (459t + 27)x 2 + (141t + 664)x + 383t + 69.

In this setting the factor base is B = {(P) : P ∈ H , x(P) ∈ k}. Fix R(u = x 2 + (338t + 756)x + 166t + 804, v = (179t + 133)x + 990t + 598). The goal is to find if possible P 1 , . . . ,

P 4 ∈ B such that R = (P 1 ) + • • • + (P 4 ).
This means we consider general cubics, and we can express them as element of

L (6P ∞ ) resp. L (4P ∞ -R) as f (x, y) = x 3 + a 2 x 2 + a 1 x + a 0 + a 3 y = (a 0 + x)u(x) + a 1 (y -v(x)).
We let a = (a 0 , . . . , a 3 ) and a = (a 0 , a 1 ) so that the generic norm resp. the R-Decomposition polynomial can be written as

N( f ) = x 6 + 5 ∑ i=0 N 6-i (a)x i ,
(5.15)

F(x) = N( f ) u(x) = x 4 + 3 ∑ i=0 N 4-i (a)x i (5.16)
We start by the Project-then-Specialized approach. A (symmetrized) 6-th Summation Set S 6 ⊂ K[e 1 , . . . , e 6 ] for H is computed, using parametrization (5.7) and expression (5.15). In DRL order we find 14 polynomials of average length 326 monomials; hence we cannot display them on paper. The next step is to evaluate this system at the coordinates given by u.

With new variables E = (E 1 , . . . , E 4 ) representing the symmetric functions in 4 variables and u(x) = x 2u 1 x + u 2 , the desymmetrization relations are obtained by equating coefficients in

(x 2 -u 1 x + u 2 ) • (x 4 + 3 ∑ i=0 E 4-i x i ) = x 6 + 5 ∑ i=1 S 6-i (E)x i .
Then desymmetrizing S 6 is done by computing S 6 = S 6 (S 1 , . . . , S 6 ). We now apply the Weil Descent to get a multivariate system of 28 equations in 4 variables in k[E]. A Gröbner basis in lex order with e.g. E 1 < . . . < E 4 is found in Shape Position as

           T 1 (E 1 ) E 2 + T 2 (E 1 ), E 3 + T 3 (E 1 ), E 4 + T 4 (E 1 ).
with deg T 1 = 64 and deg T i = 63, 2 ≤ i ≤ 4. The degree is 2 n(g-1) = 4 times larger than the expected d Nag = 2 n(n-1)g = 16. Solving this system is now a matter of factoring T 1 over k: we find the two solutions (923, 399, 659, 612) and (656, 323, 124, 790). To decide if the given PDP 4 instance itself has a solution, we factor the two polynomials

F 1 (x) = x 4 -923x 3 + 399x 2 -659x + 612, F 2 (x) = x 4 -656x 3 + 323x 3 -124x + 790
over k; in this case we find that F 1 has only one root over k, but that F 2 = (x -170)(x -594)(x -956)(x -998). This leads us to find the relation R = (170, 257t + 744) + (594, 969t + 711) + (956, 654t + 140) + (998, 55t + 32).

We now use specialized summations sets for this R. The modelling described at the end of Section 5.1 along with expression (5.16) gives the following parametrization for V 6,R :

           E 4 = (166t + 804)a 2 0 + (82t + 866)a 0 a 1 + (555t + 455)a 2 1 , -E 3 = (338t + 756)a 2 0 + (673t + 765)a 0 a 1 + (534t + 133)a 2 1 + (332t + 577)a 0 + (82t + 866)a 1 , E 2 = a 2 0 + (338t + 756)a 2 1 + (676t + 481)a 0 + (673t + 765)a 1 + 166t + 804, -E 1 = -a 2 1 + 2a 0 + 338t + 756.
A (symmetrized) Specialized Summation Set S 6,R ⊂ K[E] is computed in DRL order by elimination of a. It contains 7 polynomials of average length 28, so that a Weil Descent gives a system of 14 equations in 4 variables over k. The reduced Gröbner basis of this system for lex order E 1 < . . . < E 4 is:

               T 1 (E 1 ) = E 16 1 + 475E 15 1 + 617E 14 1 + 317E 13 1 + 299E 12 1 + 646E 11 1 + 492E 10 1 + 275E 9 1 + 680E 8 1 + 256E 7 1 + 906E 6 1 + 15E 5 1 + 831E 4 1 + 954E 3 1 + 357E 2 1 + 623E 1 + 268, E 2 + T 2 (E 1 ), E 3 + T 3 (E 1 ), E 4 + T 4 (E 1 ),
again in Shape Position with deg T 1 = 16 = d Nag and deg T i = 15, 2 ≤ i ≤ 4. We observe that T 1 divides T 1 , find (656, 323, 124, 790) as only solution this time and recover the previous decomposition.

Obstruction for a recursive computation of summations sets

The recursive approach for computing summation polynomials for a genus 1 curve E is found by decomposing a sum into two smaller sums:

P 1 + • • • + P m = O ⇔ ∀ k ∈ {2, . . . , m -3}, ∃ Q ∈ E(F) : P 1 + • • • + P k = Q P k+1 + • • • + P m = -Q
Using X as an indeterminate for the abscissae of the intermediate summand Q and x i = x(P i ), we deduce that S k+1 (x 1 , . . . , x k , X) and S m-k+1 (x k+1 , . . . , x m , X) have a common root. Hence their resultant with respect to X must vanish. If we see S k and S m-k+1 in F[X 1 , . . . , X m , X], then geometrically this corresponds to the projection of V (S k (X 1 , . . . , X k , X))∩V (S m-k+1 (X k+1 , . . . , X m , X)) on the m first coordinates. In general, both varieties are hypersurfaces in a n + 1-dimensional space. Thus their intersection has dimension n -1. The projection on a n-dimensional subspace is then of codimension 1 and its defining ideal is indeed generated by the resultant with respect to X of both summation polynomials. This leads to Proposition 3.13.

However this observation cannot be generalized in higher genus to obtain a recursive method of computation. For the sake of simplicity we restrict ourselves to a genus 2 curve H . Let be S m a set of m-th summation polynomials associated to H . Generally, a sum of points reduces to an element of weight 2 in Jac(H ). Therefore if we split a sum of length m into two smaller decompositions, not one but two points have to be fixed in the intermediate summand Q = (Q 1 ) + (Q 2 ). More explicitely assume that we have

S k+2 (x 1 , . . . , x k , x(Q 1 ), x(Q 2 )) = 0 S m-(k+2) (x k+1 , . . . , x m , x(Q 1 ), x(Q 2 )) = 0
for some x 1 , . . . , x m ∈ F. To any pair of distinct points Q 1 , Q 2 ∈ H correspond 2 g = 4 divisors: Q = (Q 1 ) + (Q 2 ) and -Q, as well as Q = (Q 1 ) + (-Q 2 ) and -Q. By Proposition 5.6 there exist P 1 , . . . , P m ∈ H with x(P i ) = x i such that

(P 1 ) + • • • + (P k ) = Q or Q (P k+1 ) + • • • + (P m ) = -Q or -Q.
and so the decomposition into two small sums leads to the following "weaker" possibilities:

     (P 1 ) + • • • + (P m ) = O or ∃ i ∈ {1, 2} : (P 1 ) + . . . + (P m ) = 2(Q i ).
This means that the projection of V (S k ) ∩V (S n-(k+2) ) describes more than the vanishing sums of n points. As for the end of Section 5.4.2 with π : H m -→ (P 1 ) m induced by the projection over the abscissae, the obstruction comes from #π -1 (π(Q))/#{±Q} = 2 g-1 . Consequently, there is little hope to achieve the same kind of equivalence as in the elliptic case using this approach. Still, there are several ways to model the situation as an elimination problem. Because of the above observation and the end of Section 5.1, the computation asks for the elimination of at least g variables between two sets of polynomials, which seems harder to do than a resultant between two polynomials. Computations indeed proved to be intractable in odd characteristic, even for the simplest case. In even characteristic, a first set of polynomials for sums of size m could be computed this way, with an already longer computational time than with the direct method. However this set of polynomials indeed vanished on sums of length m equals to O as well as on sums of length m equals to the double of a point.

Chapter 6 Degree Reduction in even characteristic

The results of this Chapter are part of an article which has been submitted at Design, Codes and Cryptography journal.

Let H be a hyperelliptic curve of genus g with equation y 2 + h 1 (x)y = h 0 (x) and R ∈ Jac(H ). Decompositions of R can be found by using either Nagao's approach (3.4.4) or a Summation modelling (5.4.2) to obtain a polynomial system describing the decomposition. In this Chapter, we exploit the link between the degree of the equations in both approaches and the even characteristic to reduce the number of solutions of those systems before solving them. This is a crucial step to make the computations tractable. In practice, the solving process is therefore much faster. The Chapter is divided into three parts, and we always work in even characteristic unless stated otherwise.

In Section 6.1 we focus on Nagao's modelling. The systems arising in this approach are generated by the (polynomial) coefficients of the Decomposition Polynomial (Definition 6.2). The shape of those coefficients is particular in even characteristic. Indeed, we show that one of them is always a univariate polynomial, and that some others are squares. Additional squares can be found when the leading coefficient of h 1 belongs to a subfield. All those properties are used in Section 6.1.2 to reduce the number of solutions of the system describing a decomposition when H is defined over F 2 dn . We analyze the reduction factor and give (tight) bounds on the final degree. Using the classification from [START_REF] Byramjee | Classification of genus 2 curves over F 2 n and optimization of their arithmetic[END_REF][START_REF] Choie | Isomorphism classes of hyperelliptic curves of genus 2 over F 2 n[END_REF] for genus 2 binary hyperelliptic curves, Table 6.1 sums up the degree reduction expected for 2 ≤ n ≤ 4. Section 6.2 deals with degree reductions for Summation modelling. Coefficients of the Decomposition Polynomial are involved in the parametrization of the Summation Variety. In even characteristic, their properties give the parametrization a special shape. This is a particular case of the action of the Frobenius automorphism over the ideal of relations of polynomial equations, which expresses by natural weights on some variables. We use this more general context in Section 6.2.1 to obtain general estimates for the degree of the ideal of relations. Next we instantiate the situation to a PDP ng instance over H and analyze the reduction factor. The situation is however not as clear as in Nagao's modelling as some degrees are harder to estimate. We give a complete analysis in genus 2 and observe that the reduction factor is maximal and equal for Type I b curve with h 1 (x) = x 2 and Type II curve.

The last part of the Chapter presents comparisons between modellings. The case of odd characteristic is briefly presented. Next, in even characteristic, we compare running time using a Magma 2.19 implementation of our reduction for Type I b curve with h 1 (x) = x 2 and Type II curve defined over F 2 dn , with d = 15 and n = 3. The times we obtain with our Magma code prompt a simulation of Index-Calculus for realistic parameters. Using a dedicated implementation mixing code generating techniques and efficient Gröbner Basis libraries, we estimate in Section 6.3.3 the running time for a complete harvesting phase over a Type II curve defined over F 2 93 , whose Jacobian variety achieves a generic security bound of 2 92 operations. A bit more than a week is needed to start linear algebra, which emphasizes that such curves are weaker than expected.

Reducing degree of ideals in Nagao's approach

Nagao's modelling (Section 3.4.4) can be used to solve the PDP ng instance related to R. Such instances are described by a system generated by the (polynomial) coefficients of the Decomposition Polynomial (Definition 6.2). One of them is always a univariate polynomal, that is used to determine values for up to n -1 variables of the system, achieving a reduction factor of 2 n-1 . The shape of those coefficients is particular and can be used to reduce the degree of the systems to solve. Some others are squares: the number of squares among the coefficients is linked to the length L h (Definition 6.6) of the polynomial h 1 in the curve's equation. Indeed, we show that exactly g + 1 -L h coefficients are squares. Only g -L h squares become relevant for the degree reduction, as one counts the fact that the Decomposition Polynomial is monic. Any squared coefficient can be replaced by its square root: since the square root is now a linear polynomial, the degree is in general divided by 2 with each replacement. The estimated degree reduction thus depends on L h : after the Weil Descent is done on the Decomposition Polynomial's coefficients, (n -1)(g -L h ) square equations are replaced by linear ones (Proposition 6.9). Adding the n -1 variables that we can determine using the univariate coefficient N 1 , we obtain a general reduced degree of

d Red = d Nag 2 (n-1)(g-L h +1) = 2 (n-1)((n-1)g+L h -1) .
Lower and upper bounds are respectively reached for curves with L h = 0 or L h = g, and give a lower bound of d opt = 2 (n-1)((n-1)g-1) for the degree reduction process. As the expected degree in a classical Nagao modelling is d Nag = 2 n(n-1)g , the degree reduction factor is at most

d Nag d opt = 2 (n-1)(g+1) .
This is true for binary elliptic curve as well, setting g = 1. Each step of the reduction process is illustrated on a toy example. The Section concludes with an exhaustive analysis of genus 2 binary curves. Such curves are classified into three types -see Section 6.1.3 for details -and have been proposed as new standards for cryptographic primitives [START_REF] Byramjee | Classification of genus 2 curves over F 2 n and optimization of their arithmetic[END_REF]. We sum up all the expected degrees for the ideals in Table 6.1. We notice that, while Type II curves were particularly suggested in [START_REF] Byramjee | Classification of genus 2 curves over F 2 n and optimization of their arithmetic[END_REF] because of their lower cost arithmetic, they are as weak as Supersingular curves 1 (type III) against Decomposition attacks, if the base field can be written as an extension of degree less than 4. This suggests additional care in the selection of parameters for new cryptographic standards.

Properties of Decomposition polynomials' coefficients

Let H : y 2 + h 1 (x)y = h 0 (x) be an hyperelliptic curve of genus g defined over a field F. The general goal is to find decompositions (P 1 ), . . . , (P m ) of a fixed R = (u, v) ∈ Jac(H ) of weight g. As described in the Section 3.4.4, it is equivalent to find

f ∈ L (mP ∞ -R) such that div f = ∑ m i=1 (P i ) -R.
The modelling uses the coefficients of a particular polynomial (3.5) related to R. We generally define this polynomial in Definition 6.2 as the Decomposition Polynomial. Then we give expressions for it using coordinates (a 0 , . . . , a d ) for a basis of L (mP ∞ -R). These expressions are used to understand the shape of its coefficients N i ∈ F[a 0 , . . . , a d ] in even characteristic, and therefore to understand the system describing a decomposition of R.

Fix R ∈ Jac(H ) of weight g. Riemann-Roch spaces as L (mP ∞ -R) for m ∈ N are of particular interest in our situation. If (u, v) is the Mumford representation of R with deg u = g then a natural basis of L (mP ∞ -R) is given by {u, xu, . . . , x d 1 u, yv, x(yv), . . . , x d 2 (yv)}, (6.1)

with d 1 = (mg)/2 and d 2 = (mg -1)/2 , so that its dimension is d + 1, with d = mg. Thus any f ∈ L (mP ∞ -R) can be written as

f (x, y) = u(x) d 1 ∑ i=0 a i x i + (y -v(x)) d 2 ∑ i=0 a i+d 1 +1 x i (6.2)
and we can take a d 1 = 1 or a d = 1 by normalizing f at infinity.

Definition 6.1. Let d = dim L (mP ∞ -R) -1, for R = (u, v) ∈ Jac(H ) of weight g. • The polynomial f (x, y) in (F[a 0 , . . . , a d ])[x, y] in expression (6.2) is called a generic func- tion in L (mP ∞ -R).
• The generic norm of a generic function is the polynomial

N( f ) = Res y ( f (x, y), y 2 + h 1 (x)y -h 0 (x)) in (F[a 0 , . . . , a d ])[x].
We consider now a sum like R = (P 1 ) + • • • + (P m ) and assume that div f = ∑ m i=1 (P i ) -R. The abscissae of the m + g points not at infinity are roots of N( f ). In particular u divides N( f ) and we obtain this way a polynomial in (F[a 0 , . . . , a d ])[x]:

N( f ) u(x) = F(x) = x m + m-1 ∑ i=0 N m-i (a 0 , . . . , a d-1 )x i , (6.3)
with N i ∈ F[a 0 , . . . , a d ] and deg N i = 2 for all i. Notice that F vanishes exactly at the abscissae of the P i 's, prompting the next definition. This polynomial has already been seen in Section 5.4 when we defined Specialized Summation Ideals.

Convenient expressions for Decomposition polynomials Using the natural basis

(6.1) of L (mP ∞ -R) with d 1 = (m -g)/2 , d 2 = (m -g -1)/2 and d = m -g, set p(x) = ∑ d 1 i=0 a i x i and q(x) = ∑ d 2 i=0 a i+d 1 +1 x i in order to write (6.2) as f (x, y) = u(x)p(x) + (y -v(x))q(x).
We normalize f at infinity if needed so that its norm is a monic polynomial in (F[a 0 , . . . , a d ])[x] and of degree m + g given by:

N( f ) = (vq -up) 2 + q(vq -up)h 1 -q 2 h 0 = (up) 2 -2upvq -upqh 1 + q 2 (v 2 + vh 1 -h 0 ) = u(up 2 -pq(2v + h 1 ) + q 2 w),
where u, h 1 , w ∈ F[x] and -w is a monic polynomial of degree g + 1 given by the third property of the Mumford Representation. Hence the R-Decomposition polynomial has the following general expression in (F[a 0 , . . . , a d ])[x]:

F(x) = up 2 -pq(2v + h 1 ) + q 2 w = x m + m-1 ∑ i=0 N m-i (a 0 , . . . , a d )x i , (6.4)
with a d 1 or a d = 1 depending on the parity of m. We now assume that F has even characteristic, unless stated otherwise.

Therefore

Tr F 2 kn |F 2 k (H -2 g (u 1 + z)) needs to be a root α of the 2-polynomial Tr F 2 k |F 2 , which is split [MM07] over F 2 k . Next, properties of the trace give α + Tr F 2 kn |F 2 k (H -2 g u 1 ) = Tr F 2 kn |F 2 k (H -2 g z) = z Tr F 2 kn |F 2 k (H -2 g ).
With the hypothesis it is possible to write

z = α + Tr F 2 kn |F 2 k (H -2 g u 1 ) Tr F 2 kn |F 2 k (H -2 g ) ∈ F 2 k . Since Tr F 2 kn |F 2 k is a 2 k -polynomial over F 2 k of degree 2 k(n-1)
, the probability that H -2 g ∈ F 2 kn is one of its root is 1/2 k which is negligible in practice and is decided once and for all when the curve is chosen.

Corollary 6.5. If H g = 0 or Tr F 2 kn |F 2 k (H -2 g ) = 0, the
F(x) = x 4 + (a 2 2 + st + s + 1)x 3 + (a 2 1 + (st + s + 1)a 2 2 + a 2 + st)x 2 + ((st + s + 1)a 2 1 + a 1 a 2 + (t + s)a 2 2 )x + sta 2 1 + ta 2 2 .
Proposition 6.3 is confirmed, and linearization over F 4 gives

N 1 (a 2 ) = a 2 2 + st + (s + 1) = a 2 2,0 + (t + s)a 2 2,1 + ((s + 1) + st) = a 2 2,0 + sa 2 2,1 + (s + 1) + (a 2 2,1 + s)t. It is straightforward to check that N 1 (a 2 ) ∈ F 4 iff a 2,1 = s + 1.
Square Coefficients Keeping previous notations, we have in characteristic 2

F(x) = p(x) 2 u(x) + p(x)q(x)h 1 (x) + q(x) 2 w(x) = x m + m-1 ∑ i=0 N m-i (a 0 , . . . , a m-g )x i , with p(x) = ∑ d 1 i=0 a i x i and q(x) = ∑ d 2 i=0 a i+d 1 +1 x i ∈ (F[a 0 , . . . , a d ])[x].
In particular, if we let

M = {a i a j : 0 ≤ i = j ≤ d} ∪ {a 0 , . . . , a d },
any monomial of M appearing in a N i ∈ F[a 0 , . . . , a d ] in expression (6.3) has to come from a coefficient in x of the polynomial pqh 1 . If no such monomials appears in N i , then it is a square since the characteristic of the field is even. The number of such square coefficients depends only on h 1 . Definition 6.6 (Length of a polynomial). Let P be a univariate polynomial. Let d P and i p be respectively the degree of the leading and trailing term of P. The length of P is defined as L P = d Pi P .

Proposition 6.7. Let F be a field of even characteristic and H : y 2 + h 1 (x)y = h 0 (x) a hyperelliptic curve of genus g defined over F with h

1 (x) = ∑ d h i=i h H i x i , d h = deg h 1 .
For a fixed R = (u, v) ∈ Jac(H ) of weight g, let F = up 2 + pqh 1 + q 2 w be its related Decomposition polynomial, with p = ∑ d 1 i=0 a 2i+1 x i and q = ∑ d 2 i=0 a 2i+2 x i . Let L h be the length of h 1 . There are g + 1 -L h squares among the coefficients of F in x.

Proof. Let pq = ∑ d-1 i=0 M i x i with M i ∈ F[a 0 , . . . , a d ], deg M i = 2 and deg a j M i = 1 for 0 ≤ j ≤ d, and h 1 = ∑ d h i=0 H i x i . Then the Cauchy product gives pqh 1 = d-1+d h ∑ i=i h i ∑ j=0 M j H i-j x i = d-1+d h ∑ i=i h c i x i , ( 6
M = {a i a j : 0 ≤ i = j ≤ d} ∪ {a 0 , . . . , a d } and M = {a 2 i : 0 ≤ i ≤ d}. so that Supp c i ⊂ M for all i h ≤ i ≤ d -1 + d h , deg d i = deg e i = 2. Recall that 2d 1 = m -g, 2d 2 = m -g -1 and that deg w = g + 1. We let up 2 = u d 1 ∑ i=0 a 2 2i+1 x 2i = m ∑ i=0 d i x i , q 2 w = w d 2 ∑ i=0 a 2 2i+2 x 2i = m ∑ i=0 e i x i ,
with Supp d i ⊂ M and Supp e i ⊂ M for all i. We can write the Decomposition Polynomial as

F(x) = i h -1 ∑ i=0 (d i + e i )x i + d-1+d h ∑ i=i h (c i + d i + e i )x i + m-1 ∑ i=d+d h (d i + e i )x i + x m . (6.6)
Then Supp(d i + e i ) ⊂ M and M ∩ Supp(c i + d i + e i ) = / 0 whenever c i is not zero. From the definition of c i we see that this can only happen if H i = 0 for all i, which is excluded by the fact that H is a binary hyperlliptic curve. Now the number of squares among the coefficients of F amounts is read on Expression 6.6 as m -

(d + d h ) + 1 + i h = g + 1 -L h .
Since F is monic in general, the number of relevant squares among the coefficient of F is g -L h .

Toy example -continued: We continue from the R-Decomposition polynomial

F(x) = x 4 + (a 2 2 + st + s + 1)x 3 + (a 2 1 + (st + s + 1)a 2 2 + a 2 + st)x 2 + ((st + s + 1)a 2 1 + a 1 a 2 + (t + s)a 2 2 )x + sta 2 1 + ta 2 2 . Since d h = 1, i h = 1,
Proposition 6.7 tells there are g-L h +1 = 3 squares among F's coefficients, one being 1 since F is monic, the two other being

N 1 (a 2 ) = a 2 2 + st + s + 1, N 4 (a 1 , a 2 ) = sta 2 1 + ta 2 2 .
The Weil Descent leads to the following system:

N :            a 2 2,1 + s, a 2 1,1 + sa 2 2,0 + sa 2 2,1 + a 2,1 + s, sa 2 1,0 + a 1,0 a 2,1 + sa 2 1,1 + a 1,1 a 2,0 + a 1,1 a 2,1 + a 2 2,0 + a 2 2,1 , sa 2 1,0 + a 2 1,1 + a 2 2,0 + (s + 1)a 2 2,1
and since we solved S 1 to find a 2,1 = s + 1, we can build the system S 2 = {N i,1 (a, s + 1) : 1 ≤ i ≤ 4} with a = (a 1,0 , a 1,1 , a 2,0 ). As N 1,1 (a, s + 1) = 0, we have

S 2 :      a 2 1,1 + sa 2 2,0 + s, sa 2 1,0 + (s + 1)a 1,0 + sa 2 1,1 + a 1,1 a 2,0 + (s + 1)a 1,1 + a 2 2,0 + s, sa 2
1,0 + a 2 1,1 + a 2 2,0 + 1 and we notice that the first expression has become a square once evaluated at a 2,1 = s + 1. This is a general fact that happens if LC(h 1 ) is in a subfield of F 2 kn .

Additional squares depending on LC(h 1 ) Note that N 1 is a square if and only if deg h 1 = d h < g. Assume this is the case, and first that m is even; then the leading term in x of pqh 1 is LT x (pqh 1 ) = H d h a d , and it appears in the coefficient N 1+g-d h as the only one involving a monomial from M . If m is odd, the same observation can be done with

a d 1 instead of a d . If H d h ∈ F 2 k we write H d h a d = H d h a d,0 + ∑ i=1 a d,i t i , and observe that in N 1+g-d h (a 0 , . . . , a d ) = ∑ n-1 i=0 N 1+g-d h , j (
a)t j the monomial a d,0 appears only in the coefficient of degree 0 in t. If a solution a * = (a * d,1 , . . . , a * d,n-1 ) of S 1 is found, as the Weil Descent here deals only with the n -1 last coefficients, we find n -1 new square equations with each N 1+g-d h , j , for 1 ≤ j ≤ n -1. Remark 6.8. All results hold for binary elliptic curves.

Toy example -continued:

The 1 + g -d h = 2nd coefficient of F is N 2 (a 1 , a 2 ) = a 2 1 + (st + s + 1)a 2 2 + a 2 + st,
and we notice that indeed the only term with support in M = {a 1 , a 2 , a 1 a 2 } is H 1 a 2 = a 2 . The linearization over F 2 k and evaluation at s gives

N 2 (a 1,0 , a 1,1 , a 2,0 ) = a 2 1,0 + (t + s)a 2 1,1 + (st + (s + 1))a 2 2,0 + a 2,0 + t + 1 = N 2,0 (a 1,0 , a 1,1 , a 2,0 ) + N 2,1 (a 1,0 , a 1,1 , a 2,0 )t, with N 2,1 (a 1,0 , a 1,1 , a 2,0 ) = a 2 1,1 + sa 2 2,0 + s, indeed a square in F 2 k [a 1,0 , a 1,1 , a 2,0 ].

Reducing the degree of PDP ng systems

We now assume that the field is F 2 kn = F 2 k [t]/ P(t) with P an irreducible polynomial of degree n over F 2 k . If H : y 2 + h 1 (x)y = h 0 (x) is a hyperelliptic curve of genus g defined over F 2 kn , we fix LC(h 1 ) to 1, as it is generally the case in practice, but we do not fix its degree d h ≤ g. Recall that the goal is to solve as efficiently as possible PDP ng instances, i.e. we fix R = (u, v) ∈ Jac(H ) and try to decompose it as

R = (P 1 ) + • • • + (P ng ), (P i ) ∈ B = {(P) : P ∈ H , x(P) ∈ F 2 k }.
Now we show how to reduce the degree of the underlying ideal, using the previous properties of the R-Decomposition polynomial

F(x) = up 2 -pqh 1 + q 2 w = x ng + ng-1 ∑ i=0 N ng-i (a 0 , . . . , a d )x i .
where d = (n -1)g. Again, we assume that ng is even for the sake of simplicity. Following Proposition 6.3 we obtain a first system over

F 2 k S 1 = {N 1,i (a d,1 , . . . , a d,n-1 ) = 0 : 1 ≤ i ≤ n -1},
and we let a * = (a * d,1 , . . . , a * d,n-1 ) be a solution of S 1 , see Proposition 6.4. In our experiments S 1 always had one solution over F 2 k . Let a = (a 0,0 , . . . , a 0,n-1 , . . . , a d-1,n-1 , a d,0 ) and evaluate the remaining equations to form the system

S 2 = {N i, j (a, a * ) : 2 ≤ i ≤ ng, 1 ≤ j ≤ n -1}.
with (ng -1)(n -1) variables and equations. This quadratic system is generally of dimension 0 and therefore generates an ideal of degre 2 (ng-1)(n-1) . It is straightforward to verify that solutions of N can be described by solutions of S 1 and S 2 .

When we start the Weil Descent over F 2 kn , we can again use the characteristic: indeed, if N i is a square, then it can be written

N i = N 2 i with deg N i = 1. We write N i (a 0 . . . , a d ) = n-1 ∑ i=0 N i, j (a)t j = N i (a 0 . . . , a d ) 2 = n-1 ∑ i=0 N i, j (a)t j 2 = n-1 ∑ i=0 N i, j (a) 2 t j
with deg N i, j = deg N i, j = 1, and the polynomials N i, j are linear combinations of the linear polynomials N i, j . As we have

N i, j (a) = 0 ⇔ N i, j (a) = 0 ⇔ N i, j (a, a * ) = 0,
we can build a new system from S 2 by replacing any N i, j (a, a * ) ∈ S 2 that is a square by its square root, namely the linear equation N i, j (a, a * ). We call this new system unsquared and denote it by √ S 2 from now on. Proposition 6.9. Let H : y 2 + h 1 (x)y = h 0 (x) be an hyperelliptic curve of genus g defined over F 2 kn . Let L h be the length of h 1 , and assume h 1 is monic. Let R ∈ Jac(H ) of weight g, and let S be the Nagao system describing the PDP ng instance related to R. The unsquared system √ S 2 contains (n -1)(g -L h ) linear equations.

Proof. Recall that L h = d hi h , where d h resp. i h is the degree of the leading resp. trailing term of h 1 . There are two possible cases:

• If d h = g, Proposition 6.7 tells us that all squares in S 2 come from the i th h coefficients of lower degree in F, so that √ S 2 contains (n -1)i h linear equations.

• If d h < g, N 1 counts as a square in Proposition 6.7 but we do not use it to build √ S 2 since it was used for S 1 , so that g -L h -1 square coefficients are used. Using the description before Remark 6.8, the Weil Descent gives us n -1 additional square equations in S 2 . Overall, this leads to (n -1)(g -L h ) linear equations in √ S 2 .

In any case, there are (n -1)(g -L h ) linear equations in √ S 2 .

It never occured in our experiments that a linear equation was a combination of the others. As systems like S 2 are generally of dimension 0 the following heuristic is therefore reasonable: Heuristic 6.10. The linear equations created during the "unsquaring" process are independent. In other words, the ideal generated by √ S 2 has dimension 0.

Under this heuristic, the degree of S 2 is divided by 2 in general with every linear equation replacing a quadratic one as any linear equation is used to eliminate a variable. A new system S 3 is built that way, containing the remaining quadratic equations. If L h is the length of h 1 , there are (n-1)((n-1)g+L h -1) variables and as much quadratic equations left in S 3 . Hence it is generally of dimension 0 and has degree:

deg S 3 = 2 (n-1)((n-1)g+L h -1) .
It is interesting that the length of h 1 has this impact on the PDP ng instance solving. As 1 ≤ i h ≤ d h ≤ g, we see that the best case happens when L h = 0 and LC(h 1 ) ∈ F 2 k , e.g. when h 1 has only one term with coefficient in the subfield of interest, in which case we find the sharp bound d opt = 2 (n-1)((n-1)g-1) ≤ deg S 3 .

Toy example concluded : From S 2 , we build the unsquared system

S 2 :      a 1,1 + (s + 1)a 2,0 + (s + 1), sa 2 1,0 + (s + 1)a 1,0 + sa 2 1,1 + a 1,1 a 2,0 + (s + 1)a 1,1 + a 2 2,0 + s, (s + 1)a 1,0 + a 1,1 + a 2,0 + 1 We have (n -1)((n -1)g + d h -i h -1) = 1,
and the generated ideal has indeed degree 2. For those small parameters √ S 2 can be solved by hand but nevertheless we compute a Gröbner basis wrt lexicographical order a 1,0 > a 1,1 > a 2,0 in Shape Position to find

     a 1,0 + (s + 1)a 2,0 + s + 1, a 1,1 + (s + 1)a 2,0 + s + 1, a 2
2,0 + sa 2,0 + 1 6.1.3 Analysis of the degree reduction for genus 2 binary curves Genus 2 curves have been proposed as an alternative for curve based cryptosystems [START_REF] Byramjee | Classification of genus 2 curves over F 2 n and optimization of their arithmetic[END_REF].

The article also proposes a complete classification of binary genus 2 curves inspired from [START_REF] Choie | Isomorphism classes of hyperelliptic curves of genus 2 over F 2 n[END_REF] that we succintly present first. We then apply the degree reduction process and sum up the expected degree reduction for n = 2, 3, 4.

Classification of genus 2 binary curves Let H : y 2 + h 1 (x)y = h 0 (x) be a genus 2 curve defined over a field F 2 n , so that deg h 1 = d h ≤ 2 and deg h 0 = 5. We write h 1 (x) = H 2 x 2 +H 1 x+H 0 and h 0 (x) = x 5 + ∑ 4 i=0 f i x i . There are three types of binary genus 2 curves, decided by h 1 .

1. Type I curves: A curve is a type I curve if and only if d h = 2. It then falls into one of two subtypes whether h 1 has roots in the ground field or not. Let t ∈ F 2 kn be an element of (absolute) trace 1 and ε ∈ F 2 . See [START_REF] Byramjee | Classification of genus 2 curves over F 2 n and optimization of their arithmetic[END_REF][START_REF] Choie | Isomorphism classes of hyperelliptic curves of genus 2 over F 2 n[END_REF] for details on their definition. We emphasize that if n is odd then we can set t = 1.

• If h 1 is irreducible over F 2 n , then H is type I a and is isomorphic to the curve

H I a : y 2 + (x 2 + H 1 x + tH 2 1 )y = x 5 + tεx 4 + f 1 x + f 0 .
• Else h 1 has its roots in F 2 n , H is type I b and isomorphic to the curve defined by

H I b : y 2 + x(x + H 1 )y = x 5 + tεx 4 + f 1 x + f 0 .
2. Type II curves: If d h = 1, there are two subtypes depending on the parity of the extension degree n.

• If n is odd then H is isomorphic to

H II : y 2 + xy = x 5 + f 3 x 3 + εx 2 + f 0 .
• If n is even then H is isomorphic to

H II : y 2 + H 1 xy = x 5 + ε x 3 + tεH 2 1 x 2 + f 0 , with ε ∈ F 2 .
3. Type III curves: Lastly if d h = 0 then H is isormorphic to the curve defined by

H III : y 2 + y = x 5 + f 3 x 3 + f 1 x + tε.
There are subtypes for type III as well but as such curves are known to be supersingular, therefore they are considered weak because of the Frey-Rück attack [START_REF] Frey | A remark concerning m-divisibility and the discrete logarithm in the divisor class group of curves[END_REF], so we do not go into further details. There are also other forms for h 0 for each type, coming at the expense of more coefficients in h 1 . More non-zero coefficients implies a more expensive Jacobian arithmetic in term of elementary operations, so this is usually avoided as much as possible in practice. Hence we focus on the above forms for genus 2 binary curves, and we call them canonical forms in the rest of the presentation.

As the length of h 1 plays a crucial role in the degree reduction estimations, we focus briefly on curves with h 1 (x) = x 2 . Such curves are isomorphic to type II curves using the change of variables x = 1/x and y = y 3 + √ f 0 .

Comparisons of degree reductions depending on canonical forms Table 6.1 shows the minimal degrees obtained after the degree reduction process applied to each canonical form of curves defined over a field F 2 kn with 2 ≤ n ≤ 4. The d Nag column shows the degree expected by a Nagao modelling without refinement while d red resp. d opt stands for resp. reduced degree and optimal degree as in previous section. Column Univariate gives the number of variables that can be determined by using equation N 1 , and columns Square and LC(h 1 ) show the number of linear equations to be expected after building the system S 2 . If n is even, then Tr F 2 kn |F 2 k (1) = 0. Proposition 6.4 cannot be applied and the system S 1 may not have a solution. This is indicated by a "≤" sign in the corresponding cell. Nonetheless we only indicate the minimal degree for each type of curve.

I b 2 1 2 ≤ 1 1 - 4 16 3 2 2 - 256 4096 4 ≤ 3 3 - 2 18 2 24 I b with h 1 (x) = x 2 2 0 2 ≤ 1 2 - 2 = d opt 16 3 2 4 - 64 = d opt 4096 4 ≤ 3 6 - 2 15 = d opt 2 24 II 1 0 2 1 1 ≤ 1 2 = d opt 16 3 2 2 ≤ 2 64 = d opt 4096 4 3 3 ≤ 3 2 15 = d opt 2 24 III 0 0 2 1 1 1 2 = d opt 16 3 2 2 2 64 = d opt 4096 4 3 3 3 2 15 = d opt 2 24
For type I a the reduction comes only by using the univariate equations to find values for some variables. The type I b has a particular subcase when h 1 (x) = x 2 , i.e. when H 1 = 0 where d opt can be reached. The polynomial h 1 for type II depends on the extension degree and LC(h 1 )'s base field. As we mentioned already, if H 1 ∈ F 2 k then additional squares can be found in the system. For type III, h 1 is always monic so we can exploit all steps of reduction. This reinforces the weakness of those curves. Finally notice that if kn is odd and as LC(h 1 ) = 1 in practice, then the degree reduction for type II curves reaches d opt = 2 (n-1)((n-1)g-1) . This reveals a weakness for this type while they were suggested as potential new standards for implementation in [START_REF] Byramjee | Classification of genus 2 curves over F 2 n and optimization of their arithmetic[END_REF], and we use this to design a practical Discrete Logarithm computation for realistic parameters, see Section 6.3.3. Curves of type I b with h 1 (x) = x 2 could also be interesting for practical purpose, as their equation is as sparse as type II's. However the reduced degree also reach d opt for those curves, suggesting a greater weakness than other type I b curves.

Ideal degree reduction in the Summation approach

This Section starts with an example: for certain types of curves, some variables in Summation Sets appear with even exponents only. We refer to them as squared variables, and such variables can thus be replaced by their "square root". This divides the degree of the ideal by 2 with each replacement. This was already observed in [FHJ + 14] for binary elliptic curves to reduce the degree of the PDP n systems by a factor 2 n-1 . The number of such variables depends again on the length of the polynomial h 1 defining the curve, and as h 1 can have higher degree when g ≥ 2, the situation becomes more complex for hyperelliptic curves. In particular, reduction of the degree can be achieved even when no squared variables are found among a Summation Set. The complete analysis requires that we consider the more general context of the action of the Frobenius automorphism over a variety given by a polynomial parametrization in positive characteristic. More precisely, in a field F with Char(F) = p, let a = (a 1 , . . . , a l ) and X = (X 1 , . . . , X m ) for l < m, and let I ⊂ F[a, X] be an ideal describing a polynomial parametrization as I = X 1 -P 1 (a) p , . . . , X k -P k (a) p , X k+1 -P k+1 (a), . . . , X m -P m (a) , for some polynomials P i . Implicitizing this variety means eliminating the variables a, equivalently computing I e = I ∩ F[X] the ideal of relations between the P i 's. If we let J be J = X 1 -P 1 (a), . . . , X k -P k (a), . . . , X m -P m (a) , and J e = J ∩ F[X], then we show that it is equivalent to find points in V (I e ) or to find points in V (J e ). Hence we can work with J instead of I.

A first advantage is that the degree of the equations defining J is lower, so we expect elimination to be faster in practice. We then estimate in general the degree reduction when working with V (J e ) instead of V (I e ). As natural weights appear for J e , working with J e means dividing the degree of I e by the product of the weights, up to a certain constant C 1 that we call the degree ratio (Definition 6.15), and which seems to depend on the length L h of the polynomial h 1 . We then observe that the parametrization of V m,R in even characteristic is a special case of polynomial parametrizations with Frobenius action: we indeed know from Section 6.1 that some N i 's defining the parametrization are squares. The lesser degree of the variety generated by the "square root" equations translates to the Weil Restriction, with an exact formula depending on the degree ratio C 1 , and that mainly says that the degree is divided by the product of the weights -here, a power of 2. In our experiments, the degree ratio C 1 is always a power of 2, and in genus 2, C 1 = 1 for 3 types of curves over 5 possiblewe count type I b with h 1 (x) = x 2 as a type on its own. All types of genus 2 curves are treated, and depending on the curve's type, the degree of the ideal to solve a PDP 2n instance can be reduced by a factor up to 2 2(n-1) . Higher genus hyperelliptic curves are discussed: following our experiments, we conjecture that C 1 = 2 L h ≤ 2 g . With d Nag = 2 n(n-1)g , this gives a first degree reduction to an ideal I of degree

deg I = 2 nL h • d Nag 2 (n-1)g+L h = 2 (n-1)((n-1)g+L h ) .
Finally it is possible to achieve further reduction with another use of the univariate coefficient in Section 6.1: the variable a d can be used instead of the variable e 1 . Compared to Nagao's degree reduction in Section 6.1, a difference appears: for an extension of degree n, when the polynomial h 1 is not of degree g, it is not possible to achieve an additional 2 n-1 factor, but only a smaller power of 2. If h 1 has degree g, then in general a factor of 2 n-1 can be obtained.

For curves with deg h 1 = g and L h = 0, a second reduction to an ideal I 2 of degree deg I 2 = deg I 2 n-1 = 2 (n-1)((n-1)g-1) = d opt can be achieved just as in Nagao's modelling. Table 6.3 sums all the reduction achieved with Summation modelling for genus 2 binary curves.

Polynomial Parametrizations in Positive Characteristic

Squared variables in genus 2 Let F = F 32 with primitive element t, and H 1 : y 2 + (x 2 )y = x 5 + x 4 + t 15 x + t 7 and H 2 : y 2 + xy = x 5 + t 3 x 3 + x 2 + t 15 two genus 2 curves of type respectively I b and II. We fix R 1 (x 2 +t 29 x +t 13 ,t 21 x +t 7 ) ∈ Jac(H 1 ) and R 2 (x 2 +t 28 x +t 19 ,t 11 x +t 4 ) ∈ Jac(H 2 ) and compute 5 and 6-Specialized Summation Sets with symmetric variables for each to find: Focusing first on H 1 , we observe that e 1 appears only with even exponent 0 or 2 in S 5,1 and S 6,1 , and that e 2 appear only with exponent 0 or 2 as well in S 6,1 . Now for H 2 , we check that e 2 appears only with even exponent in S 5,2 , S 6,2 and that the same can be said for e 3 in S 6,2 . In Proposition 6.7 and the toy-example of Section 6.1 we also observe that in both cases, the squared variables e i are exactly the variables equal to a non-squared coefficient in the parametrization of V m,R . This implies a natural system of weights on the non-squared variables. To obtain a general description, we temporarily switch to the setting of the Frobenius action over ideal of relations in positive characteristic.

S 5,1 = e 2 2 +
Action of the Frobenius automorphism and degree of parametrization Let F be a field of characteristic p ≥ 2, and σ (x) = x p the Frobenius Automorphism. If f = ∑ c α m α ∈ F[X 1 , . . . , X m ], we denote by f σ = ∑ c p α m α the polynomial obtained by Frobenius action over its coefficients. We observe that f σ (X p 1 , . . . , X p m ) = f (X 1 , . . . , X m ) p . For an ideal I = g 1 , . . . , g r , define I σ = g σ 1 , . . . , g σ r and I p = f p : f ∈ I . Assume m ≥ 2, let 1 ≤ l ≤ k ≤ m be integers and let a = (a 1 , . . . , a l ), X = (X 1 , . . . , X m ). For polynomials P 1 , . . . , P m ∈ F[a], we consider the ideals

I = X i -P i (a) p : 1 ≤ i ≤ k ; X i -P i (a), k + 1 ≤ i ≤ m , J = X i -P i (a) : 1 ≤ i ≤ m .
We also consider their ideals of relations, that is to say their l-th elimination ideals

I e = I ∩ F[X], J e = J ∩ F[X].
Such ideals are prime and therefore radical (Corollary 1.72). It is straightforward to check that (z 1 , . . . , z m , a 1 , . . . , a l ) ∈ V (I) if and only if ( p √ z 1 , . . . , p √ z k , z k+1 , . . . , z m , a 1 , . . . , a l ) ∈ V (J). This suggests a natural weight p on X k+1 , . . . , X m . We turn to eliminations ideals and derive a similar property. Lemma 6.11. Let I e = I ∩ F[X] and J e = J ∩ F[X] be the ideals of relations associated to I, J.

1. g ∈ J e ⇔ g σ (X 1 , . . . , X k , X p k+1 , . . . , X p m ) ∈ I e .

2. g ∈ I e ⇔ g(X p 1 , . . . , X p k , X k+1 , . . . , X m ) ∈ J e . Proof. From the definition of I e and J e we get g ∈ J e ⇔ g(P 1 , . . . , P m ) = 0 and g ∈ I e ⇔ g(P p 1 , . . . , P p k , P k+1 , . . . , P m ) = 0. Then we observe that 1. g ∈ J e ⇔ g(P 1 , . . . , P m ) p = 0 ⇔ g σ (P p 1 , . . . , P p m ) = 0 ⇔ g σ (X 1 , . . . , X k , X p k+1 , . . . , X p m ) ∈ I e .

2. g ∈ I e ⇔ g(X p 1 , . . . , X p k , X k+1 , . . . , X m ) ∈ J e .

In the next Proposition, we introduce an important ideal I . Indeed, it is used to show that finding points in V (I e ) or V (J e ) are equivalent tasks, and it is also involved in the estimation of deg J e .

Proposition 6.12. Let I e = f 1 , . . . , f s and J e = g 1 , . . . , g r , I = g σ i (X 1 , . . . , X k , X p k+1 , . . . , X p m ), 1 ≤ i ≤ r and J = f i (X p 1 , . . . , X p k , X k+1 , . . . , X m ) , 1 ≤ i ≤ s . Then I p e ⊂ I ⊂ I e and J p e ⊂ J ⊂ J e . Proof. From Lemma 6.11 we know that I ⊂ I e . Let f ∈ I e . Lemma 6.11 also gives that f (X p 1 , . . . , X p k , X k+1 , . . . , X m ) ∈ J e . Hence there exists q

i ∈ F[X] such that f (X p 1 , . . . , X p k , X k+1 , . . . , X m ) = r ∑ i=1 q i (X 1 , . . . , X m )g i (X 1 , . . . , X m ).
Evaluating at X 1 , . . . , X k , X p k+1 , . . . X p m and taking p-th power give

f (X p 1 , . . . , X p m ) p = r ∑ i=1 q i (X 1 , . . . , X k , X p k+1 , . . . , X p m ) p g i (X 1 , . . . , X k , X p k+1 , . . . , X p m ) p = r ∑ i=1 q σ i (X p 1 , . . . , X p k , X p 2 k+1 , . . . , X p 2 m )g σ i (X p 1 , . . . , X p k , X p 2 k+1 , . . . , X p 2 m ) which means that f (X 1 , . . . , X m ) p = r ∑ i=1 q σ i (X 1 , . . . , X k , X p k+1 , . . . , X p m ) p g σ i (X 1 , . . . , X k , X p k+1 , . . . , X p m )
so that f p ∈ I . The other inclusions follow similar arguments.

Corollary 6.13. With the previous notations, I e is the radical of I and J e is the radical of J .

Proof. Proposition 6.12 implies that I e ⊂ √ I . As √ I is the smallest radical ideal containing I , and since I e is radical, then in fact I e = √ I . The other statement is proved the same way.

Keeping the same notations for ideals, we let g 1 , . . . , g r be generators for J e and we define the ideal I = g σ i (X 1 , . . . , X k , X p k+1 , . . . , X p m ) : 1 ≤ i ≤ r . Assuming the base field is algebraically closed, we know from Corollary 6.13 that √ I = I e , so that I(V(I )) = I e and V(I e ) = V(I ). This gives (z 1 , . . . , z m ) ∈ V(I e ) ⇔ (z 1 , . . . , z m ) ∈ V(I ) ⇔ g σ i ( p √ z 1 p , . . . , p √ z k p , z p k+1 , . . . , z p m ) = 0, ∀ 1 ≤ i ≤ r ⇔ g i ( p √ z 1 , . . . , p √ z k , z k+1 , . . . , z m ) p = 0, ∀ 1 ≤ i ≤ r ⇔ ( p √ z 1 , . . . , p √ z k , z k+1 , . . . , z m ) ∈ V(g 1 , . . . , g r ) = V(J e ).

This implies that it is equivalent to work with V(I e ) or V(J e ). Since the two associated ideals are radical, in practice we can use either I e or J e for computations. we can assume that the generators g 1 , . . . , g r of J e form a Gröbner Basis for some total degree order. Since LM(g i ) = LM(g σ i ) for all i, then {g σ i : 1 ≤ i ≤ r} is a Gröbner Basis for J σ e , hence deg w J e = deg w J σ e . The first equality follows and the other is obtained by adapting the whole argument.

Application to Specialized Summation Varieties in even characteristic

Consider a hyperelliptic curve H : y 2 + h 1 (x)y = h 0 (x) of genus g, defined over a field F of characteristic 2. Let R ∈ Jac(H ) of weight g and F be the Decomposition Polynomial associated with the PDP m instance related to R:

F(x) = x m + m-1 ∑ i=0 N i (a)x i .
If d h (resp. i h ) is the degree of the leading (resp. trailing) coefficient of h 1 and L h = d hi h , Proposition 6.7 tells us that F has k = g -L h squared coefficients -not counting the fact that it is monic. Assume that L h < g, and for simplicity, renumber the coefficients of F and the e i such that the squares are N In the major part of our genus 2 experiments, C 1 = 1 or 2, see for example the next analysis and Section 5.3. In fact, for thousands of experiments in genus 2 to 4, C 1 only depends on the curve's type, i.e. on h 1 , and is a power of 2. Further in the presentation we propose a conjecture to the value of this exponent. Proposition 6.12 tells that C 1 ≤ deg I 2 e deg I e .

Proposition 6.16. Let H : y 2 + h 1 (x)y = h 0 (x) be a binary hyperelliptic curve of genus g defined over a field F of characteristic 2, and R ∈ Jac(H ) of weight g. Let L h be the length of h Experimentally C 1 is a power of 2 with exponent lesser than mg + L h , so the degree of V (J e ) is indeed divided by a certain factor. We now turn to PDP ng instances, i.e. m = ng. In the previous Section we showed that finding points in V(J e ) and V(I e ) are equivalent tasks, and this extends straightforwardly to the Weil Restrictions. Hence solving a PDP m instance can be done by finding points in W n (J e ), since every such point corresponds to a point in W n (I e ), which in turn describes a decomposition of R. This has two benefits. First it should be faster to eliminate the variables a for J e than for I e because some quadratic equations have been replaced by linear ones. Another crucial advantage is that using W n (J e ) leads to ideal of smaller degree for solving a PDP ng instance. Heuristic 6.17. Assume that the base field is F 2 dn and that we have an element t ∈ F 2 kn such that {1,t, . . . ,t n-1 } is a F 2 d -basis of F 2 dn , and write e i = ∑ n-1 i=0 e i j t i . The Weil Descent in the Summation approach, that is to say, cutting the Weil Restriction of I e or J e by the hyperplanes e i j = 0 for 1 ≤ i ≤ ng and 1 ≤ j ≤ n -1 gives a 0-dimensional ideal.

This heuristic was always verified in our experiments. From now on, the results are stated assuming the heuristic is true. Proposition 6.18. Let H : y 2 + h 1 (x)y = h 0 (x) be a genus g hyperelliptic curve defined over F 2 dn . Let L h be the length of h 1 . A PDP ng instance in Jac(H ) can be solved by computing a lexicographical Gröbner Basis for an ideal I of degree:

deg w I = C n 1 • deg W n (I e )
2 (n-1)g+L h .

Proof. With m = ng we get from Proposition 6.16:

deg w W n (J e ) = C n 1 • deg W n (I e )
2 n((n-1)g+L h ) .

Let 1,t, . . . ,t n-1 be a F 2 d -basis of F 2 dn . The Weil Restriction W n (J e ) is built by considering the change of variables e i = ∑ n-1 j=0 e i, j t j , for which the graduation extends. Thus let w = (w 1,1 , w 1,2 , . . . , w ng,n-1 ) with w 1,1 = w 1,2 = . . . = w k,n-1 = 1 and w k+1,1 = w k+1,2 = . . . = w ng,n-1 = 2, define the w-graded algebra (F 2 d [e 1,1 , . . . , e ng,n-1 ], (w 1,1 , . . . , w ng,n )), and consider I(W n (J e )) as an ideal in this algebra. Solving the related PDP ng instance is done geometrically by considering the intersection of graded hyperplanes

H = 1≤i≤ng 1≤ j≤n-1
V(e i, j ), with deg w V(e i, j ) = 2 for g -L h + 1 ≤ i ≤ ng, 1 ≤ j ≤ n -1 and thus deg w H = 2 ((n-1)g+L h )(n-1) .

Let now I = I(W n (J e ) ∩ H). Under Heuristic 6.17, it is 0-dimensional, so that the intersection has degree deg w I = deg w W n (J e ) • deg w H. The claim follows:

deg w I = C n 1 • deg W n (I e )
2 n((n-1)g+L h ) • 2 ((n-1)g+L h )(n-1) = C n 1 • deg W n (I e ) 2 (n-1)g+L h .

Remark 6.19. If Conjecture 5.13 is true, then degV (I e ) = 2 m-g and deg W n (I e ) = 2 n(n-1)g . This happened in all our experiments. In this case we have from Proposition 6.16 that deg w V(J e ) = C 1 • 2 -L h , and Proposition 6.18 then tells that deg w I = C n 1 • 2 (n-1) 2 g-L h .

Analysis for genus 2 curves

We checked over thousands of genus 2 curves (of all types) that C 1 was a power of 2 depending on the polynomial h 1 in the curve's equation. More precisely, Roughly, the more squares there are among the coefficient of the Decomposition Polynomial, the closer deg I is to deg I e and C 1 is to 1. Recall that no squares appear among the Decomposition Polynomial's coefficients if the type is I a , hence no reduction can be obtained this way. If we consider the other types of curves, and instantiate the formula of Proposition 6.18 for PDP 2n where m = 2(n -1) and the non-reduced degree is d Nag = 2 2n(n-1) , we obtain the following degrees:

C 1 =      1,
Type C 1 L h deg I Reduction factor I b , h 1 (x) = x 2 2 1 2 (2n-1)(n-1) 2 n-1 I b , h 1 (x) = x 2 1 0 2 2(n-1) 2 2 2(n-1) II or III 1 0 2 2(n-1) 2 2 2(n-1) Table 6.2: List of degree reductions using Frobenius action on genus 2 curves Higher genus To our knowledge, there is no known classification on higher genus binary hyperelliptic curves based on the shape of the h 1 polynomial. However, the degree of the squarefree part of h 1 equals the 2-rank of the Jacobian Variety of the curve, so that this gives a classification criteria in our situation where the shape of h 1 determines the shape of the equations. The following additional experiments in genus 3 (over thousands of curves) further confirmed our observation for the behaviour of C 1 :

• For curves with h 1 (x) ∈ {1, x, x 2 , x 3 }, we always observe C 1 = 1.

• For curves with h 1 a monic degree 2 polynomial with two distinct roots, we observe C 1 = 2; up to a linear change of variables, such polynomial have a shape x(x + α) for some α in the ground field, and verifies L h = 1. If h 1 is monic of degree 2 and irreducible, we observe C 1 = 4, and L h = 2.

• When h 1 is monic of degree 3 and split or has exactly one root in the base field, C 1 = 4; up to a linear change of variables, such polynomials have respectively a shape x(x + α)(x + β ) or (x 2 + αx + β )x for some α, β in the ground field, thus L h = 2. When h 1 is monic and irreducible of degree 3, then C 1 = 8 with L h = 3. Recall that there are no square among the coefficients of the R-Decomposition Polynomial if h 1 is irreducible.

A similar behaviour was identified for some cases in genus 4. Hence we propose the next Conjecture to sum up this Section: Conjecture 6.20. Let H : y 2 + h 1 (x)y = h 0 (x) be an hyperelliptic curve of genus g defined over F 2 dn . Assume h 1 is not irreducible of degree g, with length L h . Then the degree ratio C 1 defined in Proposition 6.16 is a power of 2 that only depends on the polynomial h 1 . More precisely, we have:

C 1 = 2 L h .
Using a Summation modelling, a PDP ng instance on H can then be solved by computing a lexicographical Gröbner Basis of an ideal I of degree deg w I = 2 (n-1)((n-1)g+L h ) .

Remark 6.21. If this Conjecture is true, then we find the following bounds for the first reduction step: 2 (n-1) 2 g ≤ deg w I ≤ 2 (n-1)(ng-1) .

Example instance related to R. Using the reduction process we just described, since L h = 0 we expect C 1 = 1 and I = I e , and also a degree 2 (n-1) 2 g = 2 2 = 4 system to solve at the end. The parametrization of V 4,R is The degree of this ideal is 4, which is confirmed by the Hilbert Series

I =         
HS I e (T ) = (1 -T 2 ) 2 (1 -T ) 4 = 1 + 2T + T 2 (1 -T ) 2 .
Notice now that N 4 (a 1 , a 2 ) = (t 20 ω + t 7 )a 2 1 + (t 5 ω + t 2 )a 2 2 = ((t 8 ω + t 21 )a 1 + t 16 ωa 2 ) 2 , N 3 (a 1 , a 2 ) = (t 23 ω + t 17 )a 2 1 + (t 9 ω + t 9 )a 2 2 = ((t 25 w + t 23 )a 1 + (t 18 w + t 2 )a 2 ) 2 .

Therefore, we define the ideal J by the equations then it is equivalent to find points in V(I e ), V(I a ), V(J e ) or V(J a ). In practice, working with V(I a ) or V(J a ) means we can omit the equation e 1 = N 1 (a) in V m,R 's definition, which has the benefit that it is usually faster to compute elimination ideal for smaller orders and with less variables. Additionally, this idea also leads to an additional reduction in the degree of a PDP ng system to solve. When building the Weil Restriction W n (J a ) or W n (I a ), we set a d = ∑ n-1 i=0 a d,i t i for some F 2 k -basis 1,t, . . . ,t n-1 of F 2 kn . Following Section 6.1 we can find with very high probability values a * d,1 , . . . , a * d,n-1 by solving a system of degree 2 n-1 . Geometrically, we then intersect the Weil Restriction with the hyperplanes V(e i, j ) for k + 1 ≤ i ≤ m and 1 ≤ j ≤ n -1, and with V (a d, j + a * d, j ) instead of V (e 1, j ) for 1 ≤ j ≤ n -1. The situation now splits in two cases whether H g = 0 or not.

J =         
When H g = 0: Here N 1 (a) is not a square so there is a natural weight 2 on e 1 , hence there should be a weight 2 on the e 1, j for 1 ≤ j ≤ n -1. However those variables have been replaced by the a d,i with weight 1. Consequently, the intersection H of all the needed hyperplanes has degree deg w H = 2 (n-1)(m-g+L h -1) .

It is straightforward to adapt the proofs of Proposition 6.14 and Proposition 6.16 to show that, in the general case of the parametrization of V m,R : 2 n((n-1)g+L h ) • 2 (n-1)((n-1)g+L h -1) = C n 1 deg W n (I e ) 2 (n-1)g+L h +(n-1) = deg w I 2 n-1 , thus an additional factor of 2 n-1 has been obtained.

deg w V(J a ) = C 1 • deg I a 2 m-
Remark 6.22. If both Conjecture 5.13 and 6.20 are true, then C n 1 = 2 nL h , leading to deg w I = 2 (n-1)((n-1)g+L h ) , and finally deg w I 2 = 2 (n-1)((n-1)g+L h -1) .

When H g = 0: N 1 (a) is a square a 2 d + λ 2 for some λ ∈ F 2 kn . Let z ∈ F 2 kn . For any g ∈ F[e] we denote by g z the polynomial g(e 1 + z, e 2 , . . . , e ng ) and for any g ∈ F[a d , e 2 , . . . , e ng ] we denote by g z the polynomial g(a d + z, e 2 , . . . , e ng ). 1. Because of the relation e 1 = a d + λ in J, we have g ∈ J a ⇒ g(e 1 + λ , e 2 , . . . , e m ) = g λ ∈ J e . Lemma 6.11 states that (g λ ) σ (e 1 , . . . , e k , e 2 k+1 , . . . , e 2 m ) ∈ I e , and the result is obtained using the relation e 1 = a 2 d + λ 2 in I.

2. If g ∈ I a , then g 2 = g σ (a 2 d , e 2 2 , . . . , e 2 m ) ∈ I a , and thus g σ (e 1 +λ 2 , e 2 2 , . . . , e 2 m ) = (g σ ) λ 2 (e 1 , e 2 2 , . . . , e 2 m ) ∈ I e . Using Lemma 6.11 we obtain that (g σ ) λ 2 (e 2 1 , e 4 2 , . . . , e 4 k , e 2 k+1 , . . . , e 2 m ) ∈ J e . This leads to ((g σ ) λ 2 ) σ -1 (e 1 , e 2 2 , . . . , e 2 k , e k+1 , . . . , e m ) ∈ J e and the result follows using the relation e 1 = a d + λ in J.

For g 1 . . . , g r a Gröbner Basis of J a , let I = (((g σ i ) λ 2 ) σ -1 )(a 2 d , e 2 , . . . , e k , e 2 k+1 , . . . , e 2 m ) : 1 ≤ i ≤ r . Lemma 6.23 says that I is a subideal of I a . More precisely, let w 1 = 2 = w k+1 = . . . = w m and w 2 = w 3 = . . . = w k = 1, and consider the injective homomorphism of graded algebra ϕ : (F 2 kn [Y 1 , . . . ,Y m ], (w 1 , . . . , w m )) -→ (F 2 kn [X 1 , . . . , X m ], (1, . . . , 1))

Y i -→ X w i i to see that I = ϕ(J a ). With a similar proof as Proposition 6.14 it can then be shown that there is constant C 2 such that

deg w J a = deg J 2 m-g+L h +1 = C 2 deg I a 2 m-g+L h +1 = C 2 deg I e 2 m-g+L h +1
and thus deg W n (J a ) = C n 2 • 2 n(-L h -1) . If we write a d = ∑ n-1 i=0 a d, j t j , the hyperplanes V (a d, j + a * d, j ) have degree 2 because the weight on a d transfers to the variables a d, j . Hence the variety H has degree deg w H = 2 (n-1)(m-g+L h +1) . Turning to PDP ng context, the ideal I 2 associated to the 0-dimensional intersection W n (J a ) ∩ H has degree Analysis in genus 2 If H g = 0, we are dealing with Type I a and I b curves. The previous paragraph shows that a reduction of the degree by 2 n-1 can be added to the reduction of Proposition 6.18. If H g = 0, then the curve is Type II or III. In this setting, L h = 0 and we observed that C 2 = C 1 = 1. In a PDP 2n context, m = ng. Let d Sum be the degree of the final system to solve a given PDP 2n instance using a Summation modelling. We have

d Sum =           
2 (n-1)(2n-1) if H is Type I a , 2 (n-1)(2n-2) if H is Type I b with h 1 (x) = x 2 , 2 (n-1)(2n-3) if H is Type I b with h 1 (x) = x 2 , 2 2(n-1) 2 -1 if H is Type II or Type III.

Next we list the degree reduction using a Summation modelling for n = 2, 3, 4 depending on the curve's type, just as in Section 6.1.3. In order to compare all the reductions we achieved, we also list the degrees d Nag of the classical Nagao approach and the refined d Ref from Table 6.1 that we obtained in Section 6.1. From this we obtain that deg w J a = 1, as confirmed by the Hilbert Series HS J a (T ) = 1 (1 -T )(1 -T 2 ) .

First, we write a 2 = a 2,0 + a 2,1 ω and find a value for a 2,1 using the equation N 1 (a 2 ) = e 1 . This leads to t 4 a 2 2,1 + a 2,1 + t 23 = (a 2,1 + t 9 )(a 2,1 + t 10 ) = 0. Let a * 2,1 = t 10 . We build the ideal I 2 by Weil Restriction, i.e. evaluating elements of GB J a at (a 2,0 + a * 2,1 ω, e 2 , e 3 , e 4 ) and collecting wrt. w, to obtain:

I 2 =           
t 25 e 3 a 2,0 + t 29 e 3 + t 23 e 2 + t 14 a 2 2,0 + t 3 , e 2 3 + t 23 e 3 a 2,0 + t 5 e 3 + t 17 e 2 + t 20 a 2 2,0 + t 24 , t 28 e 3 + t 26 a 2,0 + t 30 , e 4 + t 3 e 3 + t 24 a 2,0 + t 6 and a lexicographical basis with e 4 > e 3 > e 2 > a 2 is: GB from which we build back the solutions found in the previous example.

Comparisons of Modellings

From Table 6.3 we observe that Nagao and Summation modelling are equivalent for Type I a and I b , and that the refined Nagao approach is slightly better for Type II and III. Moreover, it is very easy to build the system with reduced degree in Nagao's modelling: basically only square roots of some of the defining equations have to be computed. A last advantage is that Nagao's refinement holds for any hyperelliptic curve of any genus, with precise bounds on the degree reduction process. For Summation Modelling, only the genus 2 case is totally described -even if the result seems to extend to higher genus hyperelliptic curves. Furthermore, it is harder to build the system using a Summation modelling, as a Gröbner basis for a well-chosen elimination order has to be computed. The order on the variables themselves may also have a practical impact on the running time. Overall, Nagao's approach seems more stable and the easiness of the reduction process makes it more interesting at first sight. Nevertheless, in this last Section we compare the practical running time for all modellings. We conclude with an Index-Calculus simulation on a realistic genus 2 curve of Type II and Type I b with h 1 (x) = x 2 , satisfying a generic security bound of approximately 2 92 and 2 93 operations respectively.

Nagao vs Summation in Odd characteristic

A first natural question is to compare the methods in odd characteristic, even if there are no known improvements at the moment. Experiments were done on F q n with log q = 16, n = 2, 3, and imaginary genus 2 curves given by general Weierstrass equations y 2 = h(x). This means we look for decompositions of a given R of size 2n. For each approach we listed the time needed to build the system, to compute a Degree Order basis, then to obtain a lexicographical basis with FGLM. For Summation modelling, building the system means computing a Specialized Summation Set for a given R of weight 2, that is to say, eliminating variables from a parametrization of the corresponding V m,R . We used Magma 2.19 [START_REF] Bosma | The Magma algebra system I: the user language[END_REF] for those experiments, so that a DRL Gröbner basis and an elimination basis are computed with F4, on the same computer as the previous experiments of this article. For n = 2, both approaches are extremely fast and of comparable speed. Therefore timings of this row are averaged over thousands of tests, for several curves. For n = 3, we stress that a well planned computing strategy had to be designed to obtain Summation systems in reasonable time. Indeed, eliminating without care the variables to compute S 6,R takes more than 116000 sec. We avoided this very long computation by eliminating only 3 variables in two steps, computing a basis for weighted degree order -this is higlighted by a star in the table. The system is then solved with the standard strategy. Even if we do not count this time for Summation modelling and assume a symbolic Specialized Summation set is given as raw input, we see that Nagao's modelling is faster by a ratio of nearly 7. This may be explained by the degree of the defining equations obtained in Summation modelling. Nagao's approach always gives as much quadratic equations as variables, whereas Summation's approach needs less variables but gives equations of larger degree. The above table shows that, in odd characteristic, Nagao's modelling is the most efficient.

Nagao vs Summation for binary genus 2 curves

Here we focus on fields F 2 nd with d = 15, n = 3, and curves of type I b with h 1 (x) = x2 as well as curves of type II with h 1 (x) = x. This choice is made because these are curves where d opt = 64 can be reached for both modelling, as observed in Tables 6.1 and 6.3. For n = 2, the systems have degree 2 after the degree reduction. In particular a symbolic lexicographical Gröbner Basis could be precomputed, then solved for each new R. Therefore we did not consider this very simple case. To show the impact of the degree reduction we also give timings for "Old" approaches, that is to say, Nagao or Summation modelling without any degree reduction. Headings "Method" refer to Nagao or Summation approach. For each of those rows, the upper subrow gives the timing for "Old" approach and the lower subrow gives timing for the new Reduced approach. "Style Ratio" is obtained by comparing Old and Reduced approaches, and "Method Ratio" by comparing Reduced Nagao and Reduced Summation. In the first column, d old stands for the degree of the system obtained with the old approach, while d red stands for the new reduced degree. The timings highlighted by exclamations marks are abnormaly long. Since, once computed, the lexicographical bases are not in Shape position, this suggests a problem in Magma 2.19 implementation 2 of FGLM, as it should be faster to compute a lexicographical basis not in Shape position than a basis in Shape position. To obtain a fairer comparison, we estimated the running time of FGLM on random systems over F 2 15 with n(n -1)g = 12 quadratic equations in n(n -1)g = 12 variables. The running time of FGLM for such systems (usually in Shape Position) is around 1500sec. If we consider this time as a reference for the Old Nagao approach, the speed-up ratio obtained by the Reduced approach is around 75000. Computational strategies were used to compute Specialized Summation Sets. The elimination Basis was computed for a weighted order, in two steps: of the 4 variables to be eliminated, three are eliminated in a first step, then the last is eliminated. This strategy leads to important speed-ups in our experiments for the elimination. Table 6.5 shows that Refined Nagao's modelling is also practically faster than the Refined Summation Modelling. For the next and final Section of this article, we therefore used a Refined Nagao's approach to solve PDP instances.

Running time of DLP solving for a realistic binary genus 2 curves

Let ω such that ω 31 + ω 3 + 1 = 0 and F 2 31 F 2 [ω], and let t be such that t 3 + αt + β = 0 with α = 7BCEB1AC and β = 50F6CCC4 in hexadecimal form, that is to say, the hexadecimal representation of α and β when ω is evaluated at 2, and put F 2 93 = F 2 31•3 F 2 31 [t]. We solve PDP 6 instances using our refined Nagao modelling.

Using 8000 cores, the harvesting phase can be completed in a bit more than 7 days. The filtering is then performed and can reduce the size from 2 31 to 250 millions rows (around 2 28 ) with 87 non-zero elements per row in average. The size of the matrices were obtained from a personal communication with Jean-Charles Faugère. It is noteworthy to state that the filtering algorithms considered are normally dedicated to factoring integers and discrete logarithm over finite fields; better reduction might be expected with a filtering step designed for a hyperelliptic curve DLP. A sparse linear algebra algorithm, usually a block Wiedemann, is expected to run in 2 56 operations. As a comparison, in the record factorizations of a RSA-768 modulus [KAF + 10] the matrix used was near 193 millions rows with 144 non-zero elements in average. In the factorization of a 1061 bits number [START_REF] Childers | Factorization of a 1061-bit number by the special number field sieve[END_REF], the matrix had around 282 millions rows, and the filtering-merge phase reduced it to 93 millions, averaging 125 non-zero elements by row. We also mention that the final algebra step in RSA has to be performed over F 2 .

Conclusion:

This practical simulation confirms that characteristic 2 curves are weaker than their odd characteristic counterparts in general. This strenghtens that curves based cryptographic standards should now focus on odd characteristic. In particular, we highlighted that, on a binary genus 2 curves defined over extensions whose degree admits a factor of 2 or 3, an efficient harvesting phase can be designed. Indeed, we showed that, using 8000 cores, around 1 week is needed to build an overdetermined matrix for a curve satisfying a generic bound of 2 92 . The degree reduction is linked to the length of the polynomial h 1 defining the curve. The shorter h 1 is, the more efficient the arithmetic can be, but the more vulnerable the curve is to decomposition attacks. Therefore extensions whose degree admit a small factor should in general be avoided for curves with short h 1 .

  A polynomial f is said to be homogeneous of degree d when all its monomials have the same degree d. This definition of homogeneous polynomials is equivalent to Definition 1.14 when d = 0. By convention, we let deg 0 = -1. Definition 1.19. Let d ∈ N. The set of all homogeneous polynomials of degree d in K[X] is denoted by K[X] d . For a homogeneous ideal I ⊂ K[X], we denote by I d the set I ∩ K[X] d .

d

  and for any ideal I in K[X], we write I (w)d = I ∩ K[X] (w) d .Definition 1.34 (Hilbert Series for weighted ideals). Let I be a weighted homogeneous ideal in K[X]. The weighted Hilbert Series of I is the power series: HS (w)

Definition 1. 36 (

 36 Weighted degree of a variety). Let I be an ideal in K[X] equipped with weights w = (w 1 , . . . , w n ), and d = dim I. Let Q(T ) = (1 -T ) d HS (w) I (T ). The weigthed degree of I is deg w I = Q(1).

  a generating set S for I = I(V ) is given, we also use the notation W n (S) or W n (I).

  1 is called a uniformizing parameter at P. Any uniformizing parameter generates M P , and therefore two of them differ only from a unit in K[C ]. Definition 2.5. Let C be an algebraic curve defined over K. Let P ∈ C , and f ∈ K[C ] P .

  Definition 2.7. The group of divisors on C is the free abelian group Div C generated by the points of C . Hence, a divisor D ∈ Div C is a formal Z-linear combination of points of C , that is to say: D = ∑ P∈C n P P, n P ∈ Z, with finitely many n P = 0. The support of D is the set Supp(D) = {P ∈ C : n p = 0}. If C is defined over K then a divisor is defined over K if its support is invariant under the action of the Galois group Gal( K | K). The group of divisors defined over K is denoted when it matters by Div K C . The degree of D is the integer deg D = ∑ P∈C n P . The subgroup of degree 0 divisors is denoted by Div 0 C .

  It is called a reduced divisor along O, and the integer k is called the weight of D.

Figure 2 . 1 :

 21 Figure 2.1: Geometric visualization of the addition. The blue cubic f gives a principal divisor div f = P 1+ P 2 + Q 1 + Q 2 + R 1 + R 2 -6P ∞ , so we define (P 1 + P 2 -2P ∞ ) + (Q 1 + Q 2 -2P ∞ ) = (ι(R 1 ) + ι(R 2 ) -2P ∞ )

  the previous example. We want to compute the Mumford representation (u F , v F ) of the sum F = D + E. Let u = u D u E . The extended euclidean algorithm gives (1019x + 573)u D + (12x + 559)u E = 1, and we obtain

  We use the notations of Algorithm 1. With overwhelming probability, deg u 1 = deg u 2 = g. The degree of u is maximal when gcd(u 1 , u 2 ) = 1, in which case deg u = 2g. By construction, deg v = 2g -1 at worst, so that deg u = 4g -2 -2g = 2g -2 at worst in the first round of the loop. This means at most g/2 rounds are done.

Figure 2 . 2 :

 22 Figure 2.2: Group law for y 2 = x 3 + Ax + B over the reals.

Definition 6. 2 .

 2 For R ∈ Jac(H ) of weight g, let f be a generic function in L (mP ∞ -R). The polynomial F(x) = N( f ) u(x) ∈ (F[a 0 , . . . , a d ])[x] is called the R-Decomposition polynomial, or the Decomposition Polynomial if the context is clear.

  .5) with the convention that M d = . . . = M d-1+d h = H d h +1 = . . . = H d-1+d h = 0, and c i ∈ F[a 0 , . . . , a d ]. Denote by

Proposition 6. 14 .

 14 Let w 1 = . . . = w k = 1 and w k+1 = . . . = w m = p, and let also w 1 = . . . = w m-k = p, w m-k+1 = . . . = w m = 1. Consider the systems of weight w = (w 1 , . . . , w m ) and w = (w 1 , . . . , w m ). Keeping previous notations, we have: deg w J e = deg I p m-k and deg w I e = deg J p k . Proof. Let first A = (F[X 1 , . . . , X m ], (1, . . . , 1)) be the polynomial algebra with standard graduation. Let w = (w 1 , . . . , w m ) with w 1 = . . . = w k = 1 and w k+1 = . . . = w m = p, and consider the w-graded algebra A w = (F[Y 1 , . . . ,Y m ], (w 1 , . . . , w m )). We see the ideal J e in this algebra. Using the injective homomorphism of graded algebras ϕ : A w -→ A Y i -→ X w i i we have ϕ(J σ e ) = I , hence by Proposition 1.37, deg w J σ e = deg I p m-k .Wlog.

  1 (a) = Ñ1 (a) 2 , . . . , N k (a) = Ñk (a) 2 , and then the ideals corresponding to the previous paragraph areI = e i + N i (a) : 1 ≤ i ≤ m , I e = I ∩ F[e], J = e i + Ñi (a) : 1 ≤ i ≤ k, e i + N i (a), k + 1 ≤ i ≤ m , J e = J ∩ F[e].Estimating this reduction depends on the shape of the polynomial h 1 as deg I is linked to deg I e depending on the length L h of h 1 . Definition 6.15. The degree ratio between I and I e is noted C 1 = deg I deg I e .

  1 . Define I and J as the ideals associated to the parametrization of V m,R , and I e = I ∩ F 2 dn [e], J e = J ∩ F 2 dn [e]. Then:deg w V(J e ) = C 1 • deg V(I e ) 2 m-g+L h .Proof. Since I e and J e are radical, we have deg w V(J e ) = deg w J e and deg V(I e ) = deg I e . Thus it is enough to prove that the formulae are valid for the ideals. Recall that the number of squares among the coefficients of the Decomposition Polynomial associated to R is k = g -L h . Renumber the equations defining V m,R such that the squares are the k first equations. For w = (w 1 , . . . , w m ) with w 1 = . . . = w k = 1 and w k+1 = . . . = w m = 2, we consider J e in the graded algebra (F 2 dn [e], (w 1 , . . . , w m )). Proposition 6.14 states that deg J e = deg I 2 m-g+L h = C 1 • deg I e 2 m-g+L h .

  g+L h . Now consider a PDP ng context and define I 2 as the ideal associated to W n (J a ) ∩ H, generally of dimension 0. Since deg I e = deg I a , then deg W n (J a ) = deg W n (J e ) and Proposition 6.18 gives:deg w I 2 = deg w W n (J a ) • deg w H = C n 1 • deg W n (I e )

  Lemma 6.23. Let I a = I ∩ F[a, e 2 , . . . , e m ] and J a = J ∩ F[a d , e 2 , . . . , e m ].1. g ∈ J a ⇒ ((g λ ) σ ) λ 2 (a 2 d ,e 2 , . . . , e k , e 2 k+1 , . . . , e 2 m ) ∈ I a . 2. g ∈ I a ⇒ (((g σ ) λ 2 ) σ -1 ) λ (a d , e 2 2 , . . . , e 2 k , e k+1 , . . . , e m ) ∈ J a . Proof. Let I e = I ∩ F[e] and J e = J ∩ F[e].

  deg w I 2 = C n 2 • deg W n (I e ) 2 n((n-1)g+L h +1) • 2 (n-1)((n-1)g+L h +1) = C n 2 • deg W n (I e ) 2 (n-1)g+L h -1Remark 6.24. Assuming C 2 = C 1 , which happened in all our experiments, then only a factor 2 is obtained. If moreover Conjecture 5.13 and 6.20 are true, then deg w I 2 = 2 (n-1) 2 g+L h -1 .

Table 1 :

 1 Degree reduction for Nagao's modelling in genus 2 for fields F 2 kn

	Curve Type	deg h 1 L h n New degree Old degree
				2	2 = d opt	16
	I b with h 1 (x) = x 2	2	0	3	64 = d opt	4096
				4	2 15 = d opt	2 24
				2	2 = d opt	16
	II	1	0	3	64 = d opt	4096
				4	2 15 = d opt	2 24

Table 2 :

 2 Impact of the degree reduction on Nagao's modelling (base field: F 2 45 )

	Curve	Modelling	DRL	FGLM	Total
		Old New	166.76s. 34152s. !! 34318s. !! 1.7 • 10 6 0.02s. 0.000s. 0.02s.
		Old New	185.56s. 33917s. !! 34102s !! 0.02s. 0.009s. 0.029s.	1.1 • 10 6

Ratio

Type

I b , h 1 (x) = x 2 , d old = 4096, d red = 64 Type II, h 1 (x) = x, d old = 4096, d red = 64

Table 3 :

 3 Degree reduction for Summation modelling in genus 2 for fields F 2 kn

	Curve Type	deg h 1 n New degree Old degree
			2	2 = d opt	16
	I b with h 1 (x) = x 2	2	3	64 = d opt	4096
			4	2 15 = d opt	2 24
			2	2 = d opt	16
	II	1	3	128	4096
			4	2 17	2 24

Table 4 :

 4 Impact of the degree reduction on Summation modelling (base field: F 2 45 )

	Curve	Modelling Summation Set DRL FGLM Total
		Old New	1.04s. 0.27s.	0.9s. 0.06s. 0.01s. 0.34s. 8.7s 10.64s.	31
		Old New	0.84s 0.27s.	0.65s. 0.14s. 0.01s. 0.42s. 7.7s 9.19s	23

Ratio

Type

I b , h 1 (x) = x 2 , d old = 4096, d red = 64 Type II, h 1 (x) = x, d old = 4096, d red = 64

More details are found in Section 6.2.1.

  projective closure in P n . Recall that the Zariski topology on P n is the topology where the open sets are the complements of the projective varieties (sets of common zeroes between homogeneous polynomials). Hence by definition, U i is Zariski open, so V ∩U i is Zariski open for the topology of V induced by P n . It is well-known that Zariski open sets are either empty or dense. Hence, either V ∩U i is empty, in which case V is empty too, or Proposition 1.17 says that the Zariski closure of ϕ

  Let f 1 , . . . , f s be homogeneous polynomials with deg f i = d i , and I = f 1 , . . . , f s . Let M d,n be the set of all monomials of degree at mostd in K[X 1 , . . . , X n ].All polynomials in I of degree at most d are linear combinations of m f i , for all m ∈ M d-d i ,n . This can be rewritten as a matrix-vector product, where the columns of the matrix are indexed by the monomials in M d,n , and the vector is the vector of all m f i . This matrix is called the Macaulay matrix of degree d.Definition 1.44 (Macaulay Matrix). Let f 1 , . . . , f s be polynomials in K[X 1 , . . . , X n ], with deg f i = d i , and fix a monomial ordering > m . For a fixed integer d, let M d,n be the set of all monomial of degrees at most d in K[X 1 , . . . , X n ], sorted by decreasing order with respect to > m . Let its cardinal be r d = n+d n , and let alsoR d = r d-d 1 + • • • + r d-d s . The degree d Macaulay Matrix for > m and the f i 's is denoted Mac d,> m ( f 1 , . . . , f s ) and lies in M R d ,r d (K).Its rows are indexed by the polynomials m d-d i ,k f i , for all k ≤ r d-d i and for all i ≤ s. Its columns are indexed by the monomials in M d,n . The entry corresponding to the row m d-d i ,k f i and column m d, j is the coefficient of m d, j in m d-d i ,k f i .

  and let (x i , y i ) be the coordinates for P i . We can define u(x) = x i ), and v by v(x i ) = y i for all i. When all P i appear just one time in D, v can be defined by Lagrange interpolation. The third condition in Theorem 2.20 ensures the points described by u and v belong to H . If D has weight g, the Mumford representation states that L ((g + 1)P ∞ -D) is spanned by u D and yv D .Example: Let H : y 2 = x 5 + 617x 3 + 533x 2 + 150x + 457 over F 1031 , and of genus 2. Let P 1 = (916, 306) and P 2 = (397, 44) in H , and define D = P 1 + P 2 -2P ∞ . The Mumford representation of D is u D (x) = (x -916)(x -397) = x 2 + 749x + 740, and since the line y -(664x + 372) passes through P 1 , P 2 , we can take v D (x) = 664x + 372. If (x i , y i ) are the coordinates for P i , then v D (x i ) = y i , so the roots of u D are roots of v 2 D +h 1 (x)v D -h 0 (x), and the last condition is verified. Consider now the reduced divisor E with representation u E

k ∏ i=1 (x

  Algorithm 7 Computing Discrete Logarithms with Baby-Step-Giant-Step in O( √ p)Input: A cyclic group G = g of prime order p and h ∈ G.Output: The discrete logarithm x = log g (h).

	√ p ; P ← g y ; y ← B ← g -1 ; Initialize L as a Hash Table;
	t ← 1; L[t] ← 0; for i = 1 to y do
	t ← t × P; L[t] ← i; end for
	t ← h; j ← 0; while t / ∈ L do t ← t × B; j ← j + 1; end while
	return L[t]y + j
	selected a

0 , b 0 , we define directly F as

Table 5 .

 5 1: Computations of summation sets in odd characteristic

  system S 1 has a solution over F 2 k . Proof. From Proposition 6.4 we can almost always find a value a * d ∈ F 2 kn such that N 1 (a * d ) ∈ F 2 k . The corollary comes since N 1 (a * d ) ∈ F 2 k if and only if there exists (a

* d,1 , . . . , a * d,n-1 ) ∈ V(S 1 ).

Toy Example -a new start: We use the same parameters and notations as in the example of Section 3.4.4. Recall that the R-Decomposition polynomial is

Table 6

 6

		.1: Degree reduction in genus 2 for small extension fields
	Type	deg h 1 L h n Univariate Square LC(h 1 )	d red	d Nag
	I a	2	2	2 3	≤ 1 2	--	--	8 1024	16 4096
				4	≤ 3	-	-	2 21	2 24

  t 29 e 2 + t 27 e 2 1 + t 18 , e 3 + t 15 e 2 + t 17 S 5,2 = e 2 2 + t 25 e 2 1 + e 1 + t 3 , e 3 + t 19 e 1 + t 13 + t 17 e 4 + t 30 e 2 3 + te 3 + t 3 e 2 1 + t 30 , e 4 e 3 + t 20 e 4 + t 25 e 2 3 + t 4 e 3 + t 15 e 2 2 + t 6 e 2 1 + t 22 + t 7 e 1 + 1, t 12 e 4 e 1 + t 9 e 4 + e 2 3 + t 25 e 2 2 + t 10 e 2 1 + t 25 e 1 + t 11

	S 6,1 =	               t 8 e 4 e 2 2 + t 30 e 4 e 2 1 + t 11 e 4 + e 3 3 + t 5 e 2 3 + t 2 e 3 e 2 2 + t 22 e 3 e 2 1 + t 4 e 3 + t e 2 2 + t 7 e 2 e 2 4 S 6,2 = 1 + t 18 ,	       e 2 4 + t 7 e 2 2 + t 26 e 2 1

  if H is Type I b with h 1 (x) = x 2 , Type II, or Type III 2, if H is Type I b with h 1 (x) = x 2 4, if H is Type I a .

  in genus 2:Let k = F 32 = F 2 [t]/ t 5 + t 2 + 1 and K = F 32 2 = F 32 [ω]/ ω 2 + t 4 ω + t .Consider the type I b curve given by H : y 2 + x 2 y = x 5 + (t 21 ω + t 19 )x + t 8 ω + t 5 . Fix R = (x 2 + (t 23 ω + t 17 )x + t 20 ω + t 7 , (t 4 ω + t 14 )x + t 21 ω + t 25 ) ∈ Jac(H ), and try to solve a PDP 4

    (t 2 0 ω + t 7 )a 2 1 + (t 5 ω + t 2 )a 2 2 + e 4 , (t 23 ω + t 17 )a 2 1 + (t 9 ω + t 9 )a 2 2 + e 3 , a 2 1 + a 1 a 2 + (t 23 ω + t 17 )a 2 2 + t 20 ω + t 7 + e 2 , a 2 2 + a 2 + t 23 ω + t 17 + e 1 We compute a Gröbner basis for the ideal I e = I ∩ K[e 1 , . . . , e 4 ] and find GB I e = {e 3 3 + (t 17 ω + t 15 )e 4 e 2 2 + (t 14 ω + 1)e 3 e 2 2 + (t 30 ω + t 15 )e 4 e 2 1 + t 19 ωe 3 e 2 1 + (t 27 ω + t 3 )e 2 3 + (t 23 ω + t 26 )e 2 2 + (ω + t 7 )e 2 1 + (t 21 ω + t 23 )e 4 + (tω + t 14 )e 3 + t 30 ω + t 11 , e 2 4 + ωe 2 3 + (t 23 ω + t 21 )e 2 1 + (t 25 ω + t 19 )e 4 + (t 22 ω + t 9 )e 3 + t 15 ω + t 9 , e 4 e 3 + (t 29 ω + t 25 )e 2 3 + (t 21 ω + t 19 )e 2 2 + (t 3 ω + t 19 )e 2 1 + (t 2 ω + t 16 )e 4 + (t 28 ω + t 4 )e 3 + t 3 ω + t 26 }.

    (t 8 ω + t 21 )a 1 + t 16 ωa 2 + e 4 , (t 25 w + t 23 )a 1 + (t 18 w + t 2 )a 2 + e 3 , a 2 1 + a 1 a 2 + (t 23 ω + t 17 )a 2 2 + t 20 ω + t 7 + e 2 , a 2 2 + a 2 + t 23 ω + t 17 + e 1 This particular equation means that it is equivalent to find values for e 1 or to find values for a d . Since e 1 appears nowhere else in the defining equations for V m,R , we can eliminate it instead of a d to obtain "tweaked" Specialized Summation Sets. Keeping notations of the previous Section, if we define I a = I ∩ F 2 kn [a d , e 2 , . . . , e ng ], J a = J ∩ F 2 kn [a d , e 2 , . . . , e ng ],

Table 6 .

 6 3: Degree reduction in genus 2 for small extension fields using a Summation Modelling Example in genus 2, continued: We use the same notations and curve as the previous example. Recall that the ideal J is defined by(t 8 ω + t 21 )a 1 +t 16 ωa 2 + e 4 , (t 25 w + t 23 )a 1 + (t 18 w + t 2 )a 2 + e 3 , a 2 1 + a 1 a 2 + (t 23 ω + t 17 )a 2 2 + t 20 ω + t 7 + e 2 , a 2 2 + a 2 + t 23 ω + t 17 + e 1 . This time we compute a Gröbner Basis for the ideal J a = J ∩ K[a 2 , e 2 , e 3 , e 4 ] with weights w = (1, 2, 1, 1) in w-DRL order, and find GB J a = {e 2 3 + (t 25 w + t 23 )e 3 a 2 + (t 14 w + t 20 )a 2 2 + (t 23 w + t 17 )e 2 + t 18 w + t, e 4 + (t 28 w + t 3 )e 3 + (t 26 w + t 24 )a 2 }.

	Type		deg h 1 H g C 1 n	d Sum	d Nag	d Ref
						2	8	16	8
	I a		2	1	4	3	1024	4096	1024
						4	2 21	2 24	2 21
						2	4	16	4
	I b		2	1	2	3	256	4096	256
						4	2 18	2 24	2 18
						2	2 = d opt	16	2 = d opt
	I b with h 1 (x) = x 2	2	1	1	3 64 = d opt 4096 64 = d opt
						4 2 15 = d opt	2 24	2 15 = d opt
						2	2 = d opt	16	2 = d opt
	II		1	0	1	3	128	4096 64 = d opt
						4	2 17	2 24	2 15 = d opt
						2	2 = d opt	16	2 = d opt
	III		0	0	1	3	128	4096 64 = d opt
						4	2 17	2 24	2 15 = d opt
		     
	J =	    

  lex,I 2 = {e 4 + t 13 a 2 + t 23 , e 3 + t 29 a 2 + t 2 , e 2 + t 17 a 2 + t 18 , a 2 2,0 + t 10 a 2 + t 22 }, an ideal of (weighted) degree 2 as expected. We find solutions {(t 16 ,t 11 ,t 25 ,t 19 ), (t 6 ,t 20 ,t 7 ,t 29 )} for (a 2,0 , e 2 , e 3 , e 4 ), recover two values for e 1 : e * 1 = (t 16 ) 2 + t 16 + (t 4 ω + t)a * 2,1 2 + ωa * 2,1 + t 23 ω + t 17 = t 30 , e * * 1 = (t 6 ) 2 + t 6 + (t 4 ω + t)a * 2,1 2 + ωa * 2,1 + t 23 ω + t 17 = t 23 ,

Table 6 .

 6 4: Comparisons of Nagao and Summation modelling in odd characteristic

						Method
	n Degree		Nagao			Summation	Ratio
			System	DRL	FGLM	Total	System	DRL	FGLM Total
	2	16	-	0.001s. 0.001s. 0.002s. 0.005s. 0.004s. 0.001	0.010	5
	3 4096	-	159s.	1254s. 1413s.	137.6s* 2280s. 7358s. 9775s.	6.9

Table 6 .

 6 5: Comparisons of Nagao and Summation modelling in even characteristic

	Curve	Method	System	DRL	FGLM	Total	Style Ratio Method Ratio
	Type I b , h 1 (x) = x 2 , d old = 4096, d red = 64	Nagao Summation	--1.04s. 0.27s.	166.76s. 34152s. !! 34318s. !! 0.02s. 0.000s. 0.02s. 0.9s. 8.7s. 10.64s. 0.06s. 0.01s. 0.34s.	1.7 • 10 6 31	17
	Type II, h 1 (x) = x, d old = 4096, d red = 64	Nagao Summation	--0.84s. 0.27s.	185.56s. 33917s. !! 34102s !! 0.02s. 0.009s. 0.029s. 0.65s. 7.7s. 9.19s. 0.14s. 0.01s. 0.42s.	1.1 • 10 6 23	14

The NIST claims [BBB + 12] that 15360 bits RSA key achieve the same security as a

symmetric AES key.

Saying that there is a dedicated Index-Calculus algorithm for each curve or each finite field might not be an overstatement!

By small, we mean here that the extension degree admits a small factor (between 2 and 6).

We assume a practical DLP context, where the challenge lies in the the group generated by the input g.

A more precise analysis is given in[START_REF] Diem | An index calculus algorithm for plane curves of small degree[END_REF].

It can be rigourously proven[START_REF] Diem | On the discrete logarithm problem in elliptic curves[END_REF] using intersection theory that this estimation holds.

More fundamentally, large prime variations are interesting for the asymptotic complexity analysis, but are not always well-suited in practice ; other methods such as the Gaussian structured elimination[START_REF] Lamacchia | Computation of discrete logarithms in prime fields[END_REF] can be more efficient.

In the general case, we look for y i in the algebraic closure of F anyway.

When g = 1, the authors of [FHJ + 14] use that different covers can be obtained by action of Aut(P 1 ) = PGL 2 to find a cover having a good behaviour wrt. the group of symmetry of the m-Summation variety and to compute Summation Polynomials associated to this cover.

Those curves are known to be weak to the Frey-Rück attack[START_REF] Frey | A remark concerning m-divisibility and the discrete logarithm in the divisor class group of curves[END_REF], and thus are not considered safe as basis for Discrete Logarithms Problems.

We did not try a more recent version.

Singh's original sieve, so that the performances of both should be similar. However, we will now see that it is easier to adapt to the non-hyperelliptic case.

Algorithm 8 Sieving in the hyperelliptic case Input: the set of rational points B of H . Output: the relation matrix M.

n rel = 0. repeat Choose a random reduced divisor D = [u, v] ∼ aD 0 + bD 1 . Initialize an array of lists L. for P = (x P , y P ) ∈ B do Compute u(x P ) and v(x P ). if u(x P ) = 0 then Compute λ = (y Pv(x P ))/u(x P ).

Append

Increment n rel . end if end for until n rel > #B return the matrix M.

Sieving for Small Degree Curves

The Sieving Technique

We can easily adapt our sieving formulation to Diem's setting. The factor base remains the same set of points. Basically, in a first loop we iterate over points P 1 = (x 1 , y 1 ) ∈ C 0 (F q ). The equation of a non-vertical line passing through P 1 is given by (yy 1 )λ (xx 1 ) = 0. The task is now to find the values of λ such that the line has d rational points of intersection with C without checking for smoothness. For this we then loop over P 2 = (x 2 , y 2 ) ∈ C 0 (F q ) and compute the corresponding λ = (y 2y 1 )/(x 2x 1 ). But instead of looking for the intersection of the line with C , we just append P 2 to the list L[λ ], where L is an array of lists; alternatively, we can simply increment a counter Ctr [λ ]. If this counter reaches d -1, or if L[λ ] contains d -1 elements, we know that the line contains enough points and yields a relation. This is made precise in the pseudo-code of Alg. 9.

Note that in the inner loop we do not iterate over the elements of B that have already been considered in the outer loop. Indeed, after an iteration of the outer loop all the lines passing through the given point P 1 = B[i] have been surveyed, so there is no reason to scan this point again. In this way no line can be considered twice, and we avoid completely having to check for duplicate relations.

In Diem's version, each step requires the computation and factorization of F(x,λ x+µ) (x-x 1 )(x-x 2 ) . The probability of finding a relation is 1/(d -2)!, so that after q steps about q/(d -2)! relations are harvested. By comparison, in our sieving each step requires a single division (or multiplication if the inverses are tabulated). The inner loop ends after about #B ≈ q steps, and yields q/(d -1)! relations approximately: all the lines through P 1 = (x 1 , y 1 ) have been explored, and contain d -1 other points with probability 1/(d -1)!. Thus we need d -1 times as many steps to obtain the same number of relations, but each step is much simpler, Algorithm 9 Sieving for small degree curves Input: the list of rational non-singular affine points B = C 0 (F q ). Output: the relation matrix M. n rel = 0.

Initialize an array of lists L.

return the matrix M. end if end for end for and the experiments of the next section confirm the important speed-up.

This sieve can be adapted straightforwardly to the double large prime variation: we just have to restrict both loops to the small factor base B s (once it is constructed, if the version of [LL15] is followed), then we recover the values of λ such that #L[λ ] ≥ d -3. When #L[λ ] = d -3, we still have to check if the remaining two points on the line are rational, which amounts to factorising a degree 2 polynomial. If d = 4, in Diem's version there are at most two remaining points on any line anyway; our new sieve is thus basically equivalent and does not provide a significant speed-up when using double large primes. However as soon as d ≥ 5 it outperforms Diem's version, but the asymptotic complexity remains in Õ(q 2-2/(d-2) ).

Sieving with Singularities

An article of Diem and Kochinke [START_REF] Diem | Computing discrete logarithms with special linear systems[END_REF] tries to improve on the asymptotic complexity of the above method. The basic idea is to consider singular small degree plane models, and use a singular point as one of the points defining the lines cutting out the curve. Indeed, a singular point appears with a multiplicity greater than one in any line passing through it, so that there are fewer remaining points of intersection with C , and the degree of the polynomial to test for smoothness is less than when two regular points are used. Unfortunately in general there are not enough singular points on a given planar curve to obtain sufficiently many relations. Thus an important part of Diem and Kochinke's work is to find a way to compute new singular plane models of degree d ≤ g + 1 for a given genus g curve, but this is outside of the scope of the present article; furthermore, the computation of the maps between the different models is not asymptotically relevant. Using Brill-Noether theory and considerations on special linear systems, they show that this method works for "general enough" non-hyperelliptic curves, of genus g ≥ 5.

So we assume that we are given a degree d curve C , of equation F(x, y) = 0, with a rational monomials in 6 variables, and there are 14 polynomials in the basis. For the lexicographical order, the smallest polynomial has 382 monomials and there are 27 polynomials in the basis.

We also see that S 5,7 in the list of generators (5.10) depends only on the e 1 , . . . , e 4 . This has the following interpretation. First assume that e 1 , e 2 and e 3 are given, with e 1 = 0 and denote by e * i the value of the corresponding i-th symmetric function. Solving the linear equation S 5,7 (e * 1 , . . . , e * 3 , e 4 ) = 0 we find the value e * 4 . Next, as the leading coefficient e 2 1 of S 5,6 (e * 1 , . . . , e * 4 , e 5 ) is non zero, then this polynomial is linear in e 5 ; it is then straightforward to find its root and thus an element of V (S 5 ). If e * 1 = 0, from the expression of the function we see that this means the function represents a line. It could indeed happen that its intersection with the curve has 5 points. There are approximately q 2 lines (up to a constant factor) in the space L (5P ∞ ), hence the probability of considering one is 1/q, which will be very low for practical fields. From a geometrical point of view it means that the variety generated by S 5,6 and S 5,7 should have the same dimension as the whole variety. Indeed, the codimension of the variety is g = 2 in this case (see Section 5.1). In practice, it means the major part of the sums of length 5 will make S 5,1 , . . . , S 5,5 vanish as well.

Even characteristic The general case gives equations such as H :

We first compute a Gröbner basis on an elimination ideal I ∩ F 2 d [e] and a second Gröbner basis for a lexicographical ordering such that e 5 > . . . > e 1 : Estimations on the codimension of the projection at the end of Section 5.1 are further confirmed, as S 5,2 depends only on 4 variables e 1 , e 2 , e 3 , e 4 , and that the projected variety is generated by two polynomials. Moreover, we notice that the representation of the polynomials is much sparser than its odd characteristic counterpart, as it was already the case in genus 1.

Finally, if E : y 2 + xy = x 3 + Ax 2 + B is an ordinary elliptic curve defined over F 2 d , the first summation polynomial expressed in the e i is given by

This equation is very close to the canonical equation of a type II genus 2 curve over F 2 d with d odd which is y 2 + xy = x 5 + f 3 x 3 + εx 2 + f 0 , ε ∈ F 2 , see 6.1.3. As a comparison, a set of 5-th summation polynomials for a type II curve is:

S 5,1 (e 1 , e 2 , e 3 , e 4 , e 5 ) = e 2 4 + e 5 + f 0 , S 5,2 (e 1 , e 2 , e 3 , e 4 , e 5 ) = e 2 2 + e 1 + f 2 3 , and we see that their expressions are also very similar to the genus 1 case.

Definition 5.9. Let H be an (hyper)elliptic curve of genus g defined over F, and fix R ∈ Jac(H ) of weight g. The R-Specialized m-Summation Variety, or the Specialized m-Summation Variety if the context is clear, is the algebraic variety defined by

Remark 5.10. Whenever a decomposition R = (P 1 ) + . . . + (P m-g ) is found, then it also determines the "opposite" -R = (-P 1 ) + • • • + (-P m-g ). This does not give an element of V m,R , rather an element of V = {(P 1 , . . . , P m-g ) :

) m is induced by the canonical hyperelliptic involution on H , then we check that V /[-] V m,R . For Index-Calculus this does not matter as we use the action of [-] to reduce the size of the factor base anyway.

Let R in Jac(H ) with Mumford Representation (u, v). We look for points such that R = (P 1 )+• • •+(P m-g ), and we can generate a parametrization of V m,R following the steps presented in Section 5.1 up to equation (5.4). The difference is that we consider L ((m-g)P ∞ -R) and its natural basis {u, xu, . . . , x d 1 u, yv, x(yv), . . . , x d 2 (yv)}. Recall that this space has dimension m -2g + 1 and let a = (a 1 , . . . , a m-2g ). Since the generic norm N( f ) for this sum should vanish at any root of u, we obtain a polynomial F(x) in (F[a])[x] as:

(5.11)

We call this polynomial the Decomposition Polynomial associated with R, and it will be important in Section 6.2. If f describes a PDP m instance, then F vanishes at the abscissae of the P i 's and we can write with x = (x(P 1 ), . . . , x(P m )):

(-1) m-g-i e m-g-i (x)x i .

(5.12)

is the ideal generated by equations {e i (X) + (-1) m-g-i+1 N i (a) : 1 ≤ i ≤ m} we obtain a parametrization of V m,R by I m,R by equating (5.11) and (5.12) -the proof is similar to that of Proposition 5.3 -and we can then extend Definition 5.4.

Definition 5.11 (Specialized Summation Polynomials). Let H be an (hyper)elliptic curve of genus g defined over F, and fix R ∈ Jac(H ) of weight g. The m-th summation ideal specialized to R is defined as the elimination ideal

is called a set of m-th summation polynomials specialized to R or a Specializeed Summation Set.

Such summation sets can be computed by a Gröbner basis computation for an elimination order. An analysis similar as that of Section 5.1 can be done: V m,R is generated by mg equations in a 2m -3g -dimensional ambient space, therefore in general dim V m,R = m -2g.

The projection onto a subspace of dimension mg has generally codimension g, hence we expect V m,R to be generated by at least g polynomials. The next proposition has a proof similar to that of Proposition 5.6.

Proposition 5.12. Let H be an (hyper)elliptic curve of genus g defined over F, and fix R ∈ Jac(H ) of weight g. For any m ≥ 2g + 1, a set S m,R of m-th summation polynomials specialized to R and associated to H exists, and it satisfies:

Conjecture 5.13. Let H be an (hyper)elliptic curve of genus g, R ∈ Jac(H ) of weight g and m ≥ 2g + 1. The degree of the m-Specialized Summation Variety V m,R and its projection

When g = 1, let S m resp. S m,R be the m-th summation polynomial resp. the specialized m-th polynomial. In this case it is checked that

This also means that S m,R (X 1 , . . . , X m-1 ) = S m (X 1 , . . . , X m-1 , x(R)), and the specialized variety is indeed generated by the evaluation of S m at x(R).

If g ≥ 2 a specialize-then-project approach means finding points in V (S m,R ), while projectthen-specialize accounts for finding points in V (S m ) ∩ H, which contains more solutions than needed. More precisely, observe that π -1 (π(R)) = {±R 1 , . . . , ±R g } contains 2 g elements but that we are only interested in the two {±(R 1 + • • • + R g )}: this means that we have 2 g-1 times too much solutions in V (S m ) ∩ H. In other words, we have generally

(5.13)

Specialize-then-Project better than Project-then-Specialize

Focusing on Index-Calculus purpose, we want to solve PDP ng instances, i.e. find decomposition of a given R ∈ Jac(H ) of weight g as R = (P 1 ) + • • • + (P ng ), P i ∈ B with B = {(P) : P ∈ H , x(P) ∈ F q }, so we let m = (n + 1)g.

Project-then-Specialize: Let S m ⊂ F q n [e 1 , . . . , e m ] be a m-th Summation Set for H , and (u, v) be the Mumford Representation of R. We now describe how to specialize it at R, omitting explicit formulae for the sake of simplicity; we refer the reader to Section 5.4.4 for an example with small parameters. If u = x g + ∑ g-1 i=0 u g-i x i with u i ∈ F q n , we desymmetrize S m using mg = ng new variables E 1 , . . . , E ng for symmetric functions in ng variables and the u i 's. Algebraically it amounts to let S m be in F q n [E 1 , . . . , E ng , e 1 , . . . , e m ] and add the m linear desymmetrization relations to the generators of S m . Geometrically we now have dim S m = 2ng, so that the intersection with the m hyperplanes H = H 1 ∩ . . . ∩ H m given by the desymmetrization relations has in general dimension dim(V (S m ) ∩ H) = (n -1)g

A generating set S m for V (S m ) ∩ H is then obtained by evaluation of all S ∈ S m at the desymmetrization relations.

Using notations from the end of Section 5.4.1, the next step is to build (a generating set of) the Weil Restriction W n (S m ). Let F q n = F q [t]/ P(t) and write E i = ∑ n-1 i=0 E i, j t j for 1 ≤ i ≤ ng. Let E = (E 1,0 , . . . , E 1,n-1 , . . . , E ng,0 , . . . , E ng,n-1 ). We can collect any S ∈ S m in t, writing

(5.14)

Coefficient N 1 is univariate The next proposition generalizes that of [START_REF] Joux | Elliptic curve discrete logarithm problem over small degree extension fields -application to the static Diffie-Hellman problem E(F q 5 )[END_REF] to every genus.

Proposition 6.3. Let F be a field of even characteristic and H : y 2 + h 1 (x)y = h 0 (x) a hyperelliptic curve of genus g defined over

, and with R-Decomposition polynomial F written as in expression (6.4). The coefficient N 1 (a 0 , . . . , a d ) is always an univariate polynomial. More precisely, we have:

Proof. Since arguments are similar for the even and odd cases, we restrict ourselves to the even case. In particular p is monic as a polynomial in x, and so is up 2 in expression (6.4). We also have

Because of the characteristic, p 2 does not have a term of degree m -1 in x, so the lead-

Assume now that m is even, so that a d 1 = 1. If H g ∈ F 2 k , which is generally the case as h 1 is monic in practice, then Proposition 6.3 gives:

A similar expression is obtained for the odd case. All in all we remark that the last n -1 coefficients in t of N 1 (a d ) form a system with n -1 equations of degree 2

Such a system is generally of dimension 0 with 2 n-1 solutions. As n ≤ 4 in practice, solving it is quasi-instantaneous and lead to values for the variables a d,i . What is more interesting is that S 1 has a solution in almost every situation.

Proposition 6.4. Let F = F 2 kn and use the same notations as Proposition 6.3. If

In other words we look for possible roots of N 1 (a d ) + z for some z ∈ F 2 k . We use the change of variable a ← H g a d on the polynomial N 1 (a d ) + z to obtain N 1 (a) = a 2 + a + H -2 g (u 1 + z) It is well-known [LN97, prop 3.79 p.127] that polynomials such as N 1 (a) are split iff Tr F 2 kn |F 2 (H 2 g (u 1 + z)) = 0. In particular we can choose z = Tr F 2 kn |F 2 k (u 1 ) if h 1 is monic. If it is not monic, the "chain rule" for traces gives

We compute a Gröbner Basis for J e = J ∩ K[e 1 , e 2 , e 3 , e 4 ] for weights w = (2, 2, 1, 1) in w-DRL order and obtain:

GB J e = {e We now finish the solving of the PDP 4 instance, collecting all elements in GB J e wrt. ω. We obtain 6 equations The second has only one roots over k, but F 1 (x) = (x + t 7 )(x + t 17 )(x + t 20 )(x + t 25 ), and we recover a decomposition in 4 points for R. In the next section we achieve further reduction. This example will be used again to illustrate that a degree 2 ideal can even be considered.

Additional reduction using the univariate coefficient

We let H be a hyperelliptic curve defined over F 2 kn . A fixed R(u, v) ∈ Jac(H ) of weight g is given, and we write u = x g + u 1 x g-1 + . . . . The associated Decomposition Polynomial is F(x) = x m + ∑ m-1 i=0 N i (a)x i . For simplicity we assume that m is even, the arguments being similar in the odd case. With d = mg, we have N 1 (a) = N 1 (a d ) = a 2 d + H g a d + u 1 from Section 6.1. Therefore the first equation in the parametrization of V m,R is

Type II curve: Let H :

. Hence if we let a 4 = a 4,0 + a 4,1 t + a 4,2 t 2 and √ u 1 = u 1,0 + u 1,1 t + u 1,2 t 2 then we have N 1 (a 4 ) ∈ F 2 31 ⇔ a 4,i = u 1,i , 1 ≤ i ≤ n.

Hence those values are directly obtained once an input R is given. It is even possible to precompute a symbolic unsquared system S 2 with a 4,1 , a 4,2 , u 1 and u 0 as parameters. After this, the harvesting of relations is started. Each new R ∈ Jac(H ) to decompose is computed using a pseudo-random walk as proposed by Gaudry [Gau00]. If it is not of weight 2, then it is discarded and a new one is computed. The symbolic unsquared system √ S 2 is then evaluated at coordinates of R and corresponding values for a 4,1 , a 4,2 , following Section 6.1. The resulting system has resp. 4 (resp. 6) linear (resp. quadratic) equations in 10 variables, and is solved following the standard strategy for 0-dimensional systems:

• a DRL Gröbner Basis for √ S 2 is computed in 3.87 • 10 -4 sec, using code generating techniques and F5 [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases without reduction to zero (F5)[END_REF] algorithm. We can check that √ S 2 has 64 solutions.

• With Sparse-FGLM algorithm [START_REF] Faugère | Fast Algorithm for Change of Ordering of Zerodimensional Gröbner Bases with Sparse Multiplication Matrices[END_REF], we obtain indeed a univariate polynomial of degree 64 in 5.93 • 10 -4 sec.

• The last step of the solving process is to find its roots using NTL [START_REF] Shoup | NTL: A library for doing number theory[END_REF]. This is done in 2.22 • 10 -3 sec.

Overall, solving one PDP 6 instance over H takes 3.2 • 10 -3 sec., and finding the roots of the degree 64 univariate polynomial surprisingly becomes the bottleneck of the computation. Memory-wise the whole process is really efficient as approximately 1.1 Mo is needed. The probability to get a decomposition for each R is 1/6!, so we need in average 720 × 3.2 • 10 -3 sec.= 2.3 sec. to find a relation. The factor base has approximately 2 31 elements and is invariant by the canonical involution on H , we would normally need around 2 31 /2 = 2 30 relations to start linear algebra. However, computing at least twice this minimal number of relations enables us to use efficient filtering techniques [START_REF] Bouvier | The filtering step of discrete logarithm and integer factorization algorithms[END_REF][START_REF]CADO-NFS, an implementation of the number field sieve algorithm[END_REF] to reduce the size of the matrix. Computing more relations can lead to even more efficient filtering.