Lemma 3 Clause Samples

Lemma 3. Let K be a sextic CM field containing an imaginary quadratic field k and Φ be a CM type of K. Let F be totally cubic subfield of K. Put IH = {b ∈ IK | b = b}, where H := Gal(K/F ). Then we have h∗K = 2tK−1[IK : IHPK ]. Proof. Lemma 2.2.2 tells us that if × = WK ×, then h∗ IHPK ]. Combine this with Lemma 3.2.2. = 2tK−1[IK : Proof of Proposition 3.2.1. Identify K with Kr via an isomorphism. By Lemma 3.2.3, we have h∗K = 2tK−1 if and only if IK = IHPK. For any b ∈ IF , we have NΦr (b) = (NF/Q(b)), where NF/Q(b) ∈ Z. Hence IF PK ⊂ I0(Φr). We can see from the exact sequence (2.2.1) p prime of F that the elements of IH/IF are represented by the products of the primes in K that are ramified in K/F . For any such prime P, let pZ = P∩ F and p = p∩ Q. Then the following holds 2 NΦr (P) = NΦr (p0K) = NF/Q(p)0K, (3.2.1) where NF/Q(p) p, p2, p3 depending on the splitting behavior of p in F . The prime P lies over a rational prime p that is ramified in k, see Lang [21, Proposition 4.8-(ii) in II]. Moreover, the prime p is the unique ramified prime in k/Q. Indeed, by genus theory, if the class number of an imaginary quadratic field k is odd then there is one and only one ramified prime in k/Q. By (3.2.1), we have NΦr (P) = qNF/Q(p)0K. (3.2.2) If NF/Q(p) = p, then the right hand side of (3.2.2) is generated by √ p if k /= Q(i) and generated by i + 1 if k ∼= Q(i). Therefore, in both cases we have a generator π in k of NΦr (P) such that ππ ∈ Q. Similarly, in cases NF/Q(p) = p2 that ππ ∈ Q. or p3 , there exists a generator π in k of NΦr (P) such Hence every element of IHPK , which is IK , is in I0(Φr). In particular, we get IK = I0(Φr).

Lemma 3. Let C/Q be a hyperelliptic curve of genus g ≥ 3, with a rational Weierstrass point, geometrically simple Jacobian with r ≤ 1, good reduction at 3, which satisfies condition (†). Let P1, P2 ∈ C(Q) be a pair of conjugate quadratic points, with ▇▇, ▇▇ ∈ ▇▇▇ (▇▇) \ ▇▇▇ (▇▇). If n(ΛC, P1) = 1, there are at most 8 pairs (Q1, Q2) of unexpected conjugate quadratic points in DP1 × DP2 that are not equal to (P1, P2). If n(ΛC, P1) = 0, there are no such pairs.

Lemma 3. The vector AX with A = (GX⊤ − XG⊤) represents the action of DFX on the tangent space TXVp(Rn) Proof. Consider the differential G = ∂F ∂Xi,j ∈ Rn×p as well as some vector Z ∈ TXVp(Rn). Each can be represented in the coordinate form at X as G = XGA +X⊥GB and Z = XZA + Z⊥ZB with the restriction that ZA is skew symmetric. The directional derivative DFX(Z) is thus given by the substitution as DFX(Z) = Tr(G⊤Z) = Tr(GA⊤ZA) + Tr(G⊤BZB)

Lemma 3. For the MAC construction above, the success probability of the ad- versary in forging a tagged message (mj, tj) that pass MAC verification is no more than A . The proof is a direct extension of the proof in [22]. Algebraic manipulation detection code (AMD code) [8] can be used to encode a source into a value stored on Σ(G) so that any tampering by an adversary will be detected, except with a small error probability δ.

Lemma 3. Let C/Q be a hyperelliptic curve of genus g ≥ 3, with a rational Weierstrass point, geometrically simple Jacobian with r ≤ 1, and let p be an odd prime of good reduction for C. Let P1, P2 ∈ C(Q) be either two rational points or a pair of conjugate quadratic points, with well-behaved uniformizers zP1 , zP2 . Let (Q1, Q2) be a pair of unexpected conjugate quadratic points with the same reduction as (P1, P2). Then {(Q1, Q2)} is a zero-dimensional component of (C2)ΛC ∩ (B1 (P1, zP ) × ▇▇ (▇▇, zP )).

Lemma 3. For any adversary B with resources as discussed in Sect. 4.1, ΔB(KDf ,f ; RDφ,π,f) ≤ (L + Ω)N 2c 2ν2(M −L)(N + 1) 2c (M − q − L)q 2b − q + M − q − L q ( ) 2Hmin(DK)+min{c,b−k} + qivN 2Hmin(DK) + 2 . 2Hcoll(DK)

Lemma 3. For any two varieties X, Y over a field k, the following conditions are equivalent:

Lemma 3. If all honest parties in Cb

Lemma 3. The marginal impact of αi on hi is monotone.