In this paper, we study transcendence theory for Thakur multizeta values in positive characteristic. We prove an analogue of the strong form of Goncharov’s conjecture. The same result is also established for Carlitz multiple polylogarithms at algebraic points.

The Chevalley involution of a connected, reductive algebraic group over an algebraically closed field takes every semisimple element to a conjugate of its inverse, and this involution is unique up to conjugacy. In the case of the reals we prove the existence of a real Chevalley involution, which is defined over $\mathbb{R}$, takes every semisimple element of $G(\mathbb{R})$ to a $G(\mathbb{R})$-conjugate of its inverse, and is unique up to conjugacy by $G(\mathbb{R})$. We derive some consequences, including an analysis of groups for which every irreducible representation is self-dual, and a calculation of the Frobenius Schur indicator for such groups.

Let $A_{3}(n)$ denote the number of bipartitions of $n$ with 3-cores. Recently, Lin [‘Some results on bipartitions with 3-core’, J. Number Theory139 (2014), 44–52] established some congruences modulo 4, 5, 7 and 8 for $A_{3}(n)$. In this paper, we prove several infinite families of congruences modulo 3 and 9 for $A_{3}(n)$ by employing two identities due to Ramanujan.

We study the values of the zeta-function of the root system of type G2 at positive integer points. In our previous work we considered the case when all integers are even, but in the present paper we prove several theorems which include the situation when some of the integers are odd. The underlying reason why we may treat such cases, including odd integers, is also discussed.

In 1940 Paul Erdős made a conjecture about the distribution of reduced residues. Here we study the distribution of $k$-tuples of reduced residues.

We obtain density estimates for subsets of the $n$-dimensional integer lattice lacking four-term matrix progressions. As a consequence, we show that a subset of the grid $\{1,2,\dots ,N\}^{2}$ lacking four corners in a square has size at most $\mathit{CN}^{2}(\log \log N)^{-c}$. Our proofs involve the density increment method of Roth [J. London Math. Soc.28 (1953), 104–109] and Gowers [Geom. Funct. Anal.11(3) (2001), 465–588], together with the $U^{3}$-inverse theorem of Green and Tao [Proc. Edinb. Math. Soc. (2) 51(1) (2008), 73–153].

We give a short and elementary proof of an inverse Bernstein-type inequality found by S. Khrushchev for the derivative of a polynomial having all its zeros on the unit circle. The inequality is used to show that equally-spaced points solve a min–max–min problem for the logarithmic potential of such polynomials. Using techniques recently developed for polarization (Chebyshev-type) problems, we show that this optimality also holds for a large class of potentials, including the Riesz potentials $1/r^{s}$ with $s>0.$

Cet article est une contribution à la fois au calcul du nombre de fibrés de Hitchin sur une courbe projective et à l’explicitation de la partie nilpotente de la formule des traces d’Arthur-Selberg pour une fonction test très simple. Le lien entre les deux questions a été établi dans [Chaudouard, Sur le comptage des fibrés de Hitchin. À paraître aux actes de la conférence en l’honneur de Gérard Laumon]. On décompose cette partie nilpotente en une somme d’intégrales adéliques indexées par les orbites nilpotentes. Pour les orbites de type «régulières par blocs», on explicite complètement ces intégrales en termes de la fonction zêta de la courbe.

We continue the research programme of comparing the complex exponential with Zilberś exponential. For the latter, we prove, using diophantine geometry, various properties about zero sets of exponential functions, proved for $\mathbb{C}$ using analytic function theory, for example, the Identity Theorem.

Until recently, the ‘plus part’ of the class numbers of cyclotomic fields had only been determined for fields of root discriminant small enough to be treated by Odlyzko’s discriminant bounds.

However, by finding lower bounds for sums over prime ideals of the Hilbert class field, we can now establish upper bounds for class numbers of fields of larger discriminant. This new analytic upper bound, together with algebraic arguments concerning the divisibility properties of class numbers, allows us to unconditionally determine the class numbers of many cyclotomic fields that had previously been untreatable by any known method.

In this paper, we study in particular the cyclotomic fields of composite conductor.

Let $\def \xmlpi #1{}\def \mathsfbi #1{\boldsymbol {\mathsf {#1}}}\let \le =\leqslant \let \leq =\leqslant \let \ge =\geqslant \let \geq =\geqslant \def \Pr {\mathit {Pr}}\def \Fr {\mathit {Fr}}\def \Rey {\mathit {Re}}\mathcal{O}$ be a maximal order in the quaternion algebra $B_p$ over $\mathbb{Q}$ ramified at $p$ and $\infty $. The paper is about the computational problem: construct a supersingular elliptic curve $E$ over $\mathbb{F}_p$ such that ${\rm End}(E) \cong \mathcal{O}$. We present an algorithm that solves this problem by taking gcds of the reductions modulo $p$ of Hilbert class polynomials.

New theoretical results are required to determine the complexity of our algorithm. Our main result is that, under certain conditions on a rank three sublattice $\mathcal{O}^T$ of $\mathcal{O}$, the order $\mathcal{O}$ is effectively characterized by the three successive minima and two other short vectors of $\mathcal{O}^T\! .$ The desired conditions turn out to hold whenever the $j$-invariant $j(E)$, of the elliptic curve with ${\rm End}(E) \cong \mathcal{O}$, lies in $\mathbb{F}_p$. We can then prove that our algorithm terminates with running time $O(p^{1+\varepsilon })$ under the aforementioned conditions.

As a further application we present an algorithm to simultaneously match all maximal order types with their associated $j$-invariants. Our algorithm has running time $O(p^{2.5 + \varepsilon })$ operations and is more efficient than Cerviño’s algorithm for the same problem.

This paper presents an algorithm to construct cryptographically strong genus $\def \xmlpi #1{}\def \mathsfbi #1{\boldsymbol {\mathsf {#1}}}\let \le =\leqslant \let \leq =\leqslant \let \ge =\geqslant \let \geq =\geqslant \def \Pr {\mathit {Pr}}\def \Fr {\mathit {Fr}}\def \Rey {\mathit {Re}}2$ curves and their Kummer surfaces via Rosenhain invariants and related Kummer parameters. The most common version of the complex multiplication (CM) algorithm for constructing cryptographic curves in genus 2 relies on the well-studied Igusa invariants and Mestre’s algorithm for reconstructing the curve. On the other hand, the Rosenhain invariants typically have much smaller height, so computing them requires less precision, and in addition, the Rosenhain model for the curve can be written down directly given the Rosenhain invariants. Similarly, the parameters for a Kummer surface can be expressed directly in terms of rational functions of theta constants. CM-values of these functions are algebraic numbers, and when computed to high enough precision, LLL can recognize their minimal polynomials. Motivated by fast cryptography on Kummer surfaces, we investigate a variant of the CM method for computing cryptographically strong Rosenhain models of curves (as well as their associated Kummer surfaces) and use it to generate several example curves at different security levels that are suitable for use in cryptography.

Deciding whether an ideal of a number field is principal and finding a generator is a fundamental problem with many applications in computational number theory. For indefinite quaternion algebras, the decision problem reduces to that in the underlying number field. Finding a generator is hard, and we present a heuristically subexponential algorithm.

We present a higher-dimensional generalization of the Gama–Nguyen algorithm (STOC ’08) for approximating the shortest vector problem in a lattice. This generalization approximates the densest sublattice by using a subroutine solving the exact problem in low dimension, such as the Dadush–Micciancio algorithm (SODA ’13). Our approximation factor corresponds to a natural inequality on Rankin’s constant derived from Rankin’s inequality.

In the recent breakthrough paper by Barbulescu, Gaudry, Joux and Thomé, a quasi-polynomial time algorithm is proposed for the discrete logarithm problem over finite fields of small characteristic. The time complexity analysis of the algorithm is based on several heuristics presented in their paper. We show that some of the heuristics are problematic in their original forms, in particular when the field is not a Kummer extension. We propose a fix to the algorithm in non-Kummer cases, without altering the heuristic quasi-polynomial time complexity. Further study is required in order to fully understand the effectiveness of the new approach.

Let $\def \xmlpi #1{}\def \mathsfbi #1{\boldsymbol {\mathsf {#1}}}\let \le =\leqslant \let \leq =\leqslant \let \ge =\geqslant \let \geq =\geqslant \def \Pr {\mathit {Pr}}\def \Fr {\mathit {Fr}}\def \Rey {\mathit {Re}}G$ be a cyclic group written multiplicatively (and represented in some concrete way). Let $n$ be a positive integer (much smaller than the order of $G$). Let $g,h\in G$. The bounded height discrete logarithm problem is the task of finding positive integers $a$ and $b$ (if they exist) such that $a\leq n$, $b\leq n$ and $g^a=h^b$. (Provided that $b$ is coprime to the order of $g$, we have $h=g^{a/b}$ where $a/b$ is a rational number of height at most $n$. This motivates the terminology.)

The paper provides a reduction to the two-dimensional discrete logarithm problem, so the bounded height discrete logarithm problem can be solved using a low-memory heuristic algorithm for the two-dimensional discrete logarithm problem due to Gaudry and Schost. The paper also provides a low-memory heuristic algorithm to solve the bounded height discrete logarithm problem in a generic group directly, without using a reduction to the two-dimensional discrete logarithm problem. This new algorithm is inspired by (but differs from) the Gaudry–Schost algorithm. Both algorithms use $O(n)$ group operations, but the new algorithm is faster and simpler than the Gaudry–Schost algorithm when used to solve the bounded height discrete logarithm problem. Like the Gaudry–Schost algorithm, the new algorithm can easily be carried out in a distributed fashion.

The bounded height discrete logarithm problem is relevant to a class of attacks on the privacy of a key establishment protocol recently published by EMVCo for comment. This protocol is intended to protect the communications between a chip-based payment card and a terminal using elliptic curve cryptography. The paper comments on the implications of these attacks for the design of any final version of the EMV protocol.

The problem of solving polynomial equations over finite fields has many applications in cryptography and coding theory. In this paper, we consider polynomial equations over a ‘large’ finite field with a ‘small’ characteristic. We introduce a new algorithm for solving this type of equations, called the successive resultants algorithm (SRA). SRA is radically different from previous algorithms for this problem, yet it is conceptually simple. A straightforward implementation using Magma was able to beat the built-in Roots function for some parameters. These preliminary results encourage a more detailed study of SRA and its applications. Moreover, we point out that an extension of SRA to the multivariate case would have an important impact on the practical security of the elliptic curve discrete logarithm problem in the small characteristic case.

Supplementary materials are available with this article.

Let $\def \xmlpi #1{}\def \mathsfbi #1{\boldsymbol {\mathsf {#1}}}\let \le =\leqslant \let \leq =\leqslant \let \ge =\geqslant \let \geq =\geqslant \def \Pr {\mathit {Pr}}\def \Fr {\mathit {Fr}}\def \Rey {\mathit {Re}}A^{0}(\Gamma _{2})$ denote the ring of scalar-valued Siegel modular forms of degree two, level $1$ and even weights. In this paper, we prove the determinant of a basis of the module of vector-valued Siegel modular forms $\bigoplus _{k \equiv \epsilon \ {\rm mod}\ {2}}A_{\det ^{k}\otimes \mathrm{Sym}(j)}(\Gamma _{2})$ over $A^{0}(\Gamma _{2})$ is equal to a power of the cusp form of degree two and weight $35$ up to a constant. Here $j = 4, 6$ and $\epsilon = 0, 1$. The main result in this paper was conjectured by Ibukiyama (Comment. Math. Univ. St. Pauli 61 (2012) 51–75).

There is an algorithm of Schoof for finding divisors of class numbers of real cyclotomic fields of prime conductor. In this paper we introduce an improvement of the elliptic analogue of this algorithm by using a subgroup of elliptic units given by Weierstrass forms. These elliptic units which can be expressed in terms of $\def \xmlpi #1{}\def \mathsfbi #1{\boldsymbol {\mathsf {#1}}}\let \le =\leqslant \let \leq =\leqslant \let \ge =\geqslant \let \geq =\geqslant \def \Pr {\mathit {Pr}}\def \Fr {\mathit {Fr}}\def \Rey {\mathit {Re}}x$-coordinates of points on elliptic curves enable us to use the fast arithmetic of elliptic curves over finite fields.

We propose a fast method of calculating the $\def \xmlpi #1{}\def \mathsfbi #1{\boldsymbol {\mathsf {#1}}}\let \le =\leqslant \let \leq =\leqslant \let \ge =\geqslant \let \geq =\geqslant \def \Pr {\mathit {Pr}}\def \Fr {\mathit {Fr}}\def \Rey {\mathit {Re}}p$-part of the class numbers in certain non-cyclotomic $\mathbb{Z}_p$-extensions of an imaginary quadratic field using elliptic units constructed by Siegel functions. We carried out practical calculations for $p=3$ and determined $\lambda $-invariants of such $\mathbb{Z}_3$-extensions which were not known in our previous paper.