We study pseudorandomness of quartic Dirichlet characters from both analytic and cryptographic perspectives. From an analytic perspective, following Mauduit–Sárközy, we define a Boolean sequence from the quartic character modulo a Gaussian prime and show, using classical character-sum bounds, that it has strong pseudorandomness measures for small order. Cryptographically, resolving an open question of Damgård, we prove that quartic characters yield secure pseudorandom generators and weak pseudorandom functions (wPRFs), by showing that distinguishing the quartic wPRF implies solving the underlying quadratic residuosity problem. Under the Quadratic Residuosity Assumption, this establishes the security of quartic-character-based constructions such as Quartapus and PorcRoast _4 , which offers efficiency advantages over classical Legendre-character-based schemes.
Charles, Goren and Lauter proved that the supersingular ℓ -isogeny graph is a Ramanujan graph, which is an optimal expander. Jordan and Zaytman argued that this is no longer true in dimension two, but Florit and Smith showed that those graphs exhibit good expansion properties nonetheless. Castryck, Decru and Smith however have pointed out that the higher-dimensional analogue setting should only consider a subset of all edges, namely the paths corresponding to (ℓ ^k,ℓ ^k) -isogenies, so-called good extensions, instead of all (ℓ ^a,ℓ ^b,ℓ ^c,ℓ ^d) -isogenies in general, which contain bad extensions too. Such bad extensions lead to many small cycles in the graph, which are a cryptographic problem due to collisions and a graph-theoretic nuisance as these superfluous edges counteract part of the expansion properties. Restricting to good extensions makes the resulting graph directed, as outgoing edges now depend on the incoming edge. We study abelian surfaces with (ℓ ,ℓ ) -level structure and (ℓ )^g -isogeny digraphs restricted to good extensions for concrete small dimensions and degrees ℓ . These graphs exhibit excellent expander properties: by our heuristic evidence, they converge to weakly Ramanujan graphs for all primes ℓ in dimension 1, and for ℓ = 2 in dimension 2. Our main conjecture implies that this would still be the case for ℓ =3 in dimension 2, but not for any larger ℓ in dimension 2, or any ℓ in dimension 3 and up. Furthermore, we generalize the work of Florit and Smith from ℓ = 2 to general primes ℓ , by classifying all abelian surfaces with nontrivial automorphism groups and their actions on their maximal isotropic (ℓ ,ℓ ) -subgroups.
We present a new algorithm to distinguish alternant and Goppa codes from general linear codes. Our approach is based on higher-order vanishing of polynomials and can be applied to a wide set of code parameters. It also applies to Goppa code parameters used in the Classic McEliece key encapsulation mechanism. While these parameters are out of reach in practice, we analyse the behaviour of our distinguisher and estimate its complexity for them, indicating that it is more efficient than previous distinguishing approaches. This is supported by concrete experiments that distinguish codes with larger parameters in practice.
The Number Field Sieve and its variants are the best-known algorithms to solve the discrete logarithm problem in finite fields. When the extension degree is composite, the Tower variant, TNFS, is the most efficient. Looking at finite fields with composite extension degrees such as 6 and 12 is motivated by pairing-based cryptography, which does not yet have a good quantum-resistant equivalent. The two most costly steps in TNFS are the relation collection and linear algebra steps. Although the use of order-k Galois automorphisms allows one to accelerate the relation collection step by a factor of k, their use to accelerate the linear algebra step remains an open problem. In previous work, this problem is solved for k=2 , leveraging a quadratic acceleration factor equal to 4. In this article, we provide a solution for k=6 and k=12 . We propose a new construction that allows the use of a Galois automorphism of order 6 (resp. 12) in 𝔽_p^6 (resp. 𝔽_p^12 ), thus accelerating the linear algebra step by a factor of approximately 36 (resp. 144). Moreover, we provide a SageMath implementation of TNFS and our construction, and validate our findings on small examples.
