) * {(\mathbb{Z}/r\mathbb{Z})^{*}} . Therefore, t has approximately the same size as r , which in turn implies that the generic ρ-value is ρ ≈ 2 {\rho\approx 2} in both methods. Such choices of parameters do not lead to efficient pairing computations, when considering the most well-known variants of the Tate pairing, namely the Ate and twisted-Ate asymmetric pairings. This problem can be avoided by representing the elliptic curve parameters ( q , t , r ) {(q,t,r)} as polynomial families ( q ( x ) , t ( x ) , r ( x ) ) {(q(x),t(x),r(x))} in ℚ [ x ] {\mathbb

strategy 313 statistical frequency attack 32 stream cipher 20 – software generation 24 stream ciphers 22 strong pseudoprime 119 subalgebra membership problem 327 subgroup 184 – conjugate 186 substitution cipher 20 substitution-permutation network 21 subword 317 successful attack 40 summit set 269 SVP 354 syllable length 209 symmetric group 189 symmetric key cryptography 4, 19, 126 symmetry group 188 system of generators 318 syzygy module 329 – computation 333 Tate pairing 171 term 297, 329 term ordering 297 – component elimination 331 –degree reverse lexicographic 298

projective, 1 Néron, see height, see theorem of Néron, Tate Néron–Tate pairing, 124 Nagell, see theorem of Nagell, Lutz, and Cassels, see theorem of Nagell, Lutz non-split multiplicative reduction, see reduction nonsingular, 4 O, 93 one-way function, 82 ordinary, 65 Index 367 parametrization, 41 period, 33, 52, 54 period parallelogram, 33 plane algebraic curve, 2 affine, 2 projective, 2 Pohlig-Hellmann reduction of DLP, 83 point at infinity, 2, 3 Pollard, 84 primality test, Goldwasser, Kilian, 27 projective n-space, see n-space public key, see cryptosystem purely

.37), respectively, are related by OhD.P / D 3 Oh.P /. A very important property of the canonical height is that, by means of it, a positive- definite quadratic form is defined as follows: First, one defines the so-called Néron– Tate (or Weil) pairing by hP ,Qi D Oh.P CQ/ Oh.P / Oh.Q/. The following important properties for the canonical height and the Néron–Tate pair- ing hold (see [45, Theorem 9.3]): The Néron–Tate pairing is bilinear. For any P 2 E with PE 2 E.Q/ and anym 2 Z, Oh.mP / D m2 Oh.P /; in particular, Oh.P / D Oh.P /. Oh.P / 0 and Oh.P / D 0 if and only if PE

materials for unification. Though the latter, unified vision, is possible, it is by no means universal: We should be so much in favor of tragedy and irony as not to think it good policy to require them in all our poems, for fear we might bring them into bad fame . . . . Tragedy suggests Irony, and Irony leads easily to Ambiguity, (page 101) 12 This idea is set forth at length in Tate's pair of essays, "The Symbolic Imagina- tion" and "The Angelic Imagination". See Chapter Two, B, above. 84 THE SECOND GENERATION Empson's theory is so heterogeneous as to avoid the

application to the arithmetic theta correspondence, which is modeled on [6], we need Howe’s abstract formulation. The additional facts we need, some of which are special to this particular dual pair, can be found in [10]. 2This follows from invariance under HB(Af ) of the hermitian form on MW(MB) de- termined by the Néron-Tate pairing. CENTRAL DERIVATIVES OF L-FUNCTIONS 355 where δp(σp, ψ−p ) is the local dichotomy sign defined in (8.2.8). Note that the occurrence here of the additive ψ−p , where ψ − p (x) = ψp(−x), is ex- plained in Corollary 8.2.6. Since B is indefinite

(K)→ R 〈P,Q〉 = ĥ(P +Q)− ĥ(P )− ĥ(Q) is symmetric and bilinear. This pairing is called Néron–Tate pairing. (Sometimes a factor 12 is placed in front of the right-hand side. This has the advantage that then ĥ(P ) = 〈P, P 〉.) Proof. a) As we have seen in Theorem 5.13, one has 2h(P )+ 2h(Q)− c1 ≤ h(P +Q)+ h(P −Q) ≤ 2h(P )+ 2h(Q)+ c2 for all P,Q ∈ E(K) with constants c1 and c2. Replacing P and Q by 2nP and 2nQ, and dividing the equation by 22n, one gets the equation 2 h(2nP ) 22n + 2h(2 nQ) 22n − c1 22n ≤ h(2 n(P +Q)) 22n + h(2 n(P −Q)) 22n ≤ 2h(2 nP ) 22n + 2h(2 nQ) 22

cohomology groups. In §1.4 we state without proof the results we need concerning the Tate pair- ing on local cohomology groups, and we study how our special subgroups behave with respect to this pairing. In §1.5 and §1.6 we define Selmer groups and give the basic examples of ideal class groups and Selmer groups of elliptic curves and abelian varieties. Then in §1.7, using Poitou-Tate global duality and the local orthogonality results from §1.4, we derive our main tool (Theorem 1.7.3) for bounding the size of Selmer groups. 1.1. p-adic Representations Definition 1

commutative diagram in which all the maps are isomorphisms where AE is the formal group logarithm, and the bottom right isomorphism is defined in [T3] Theorem 4.2. Using these identifications we will also view AE as a homomorphism from E(Qn,p) to Qn,p· Since V !::! V*, the local Tate pairing gives the second isomorphism in Hom(E(Qn,p), Qp) !::! Hom(H}(Qn,p, V), Qp) !::! H!(Qn,p, V). Thus there is a dual exponential map (see [Kal] §11.1.2) expE; : H!(Qn,p, V) ~ Cotan(E;Qn,p) = Qn,pWE. Write exp~E : Hi (Qn,p, V) ~ Qn,p for the composition wE; o expE;. Since Hi

+ 1−|E(ℤp)|. Then the following hold: (1) E([n]) ≅ (ℤn1 , +) × (ℤn2 , +) for some n1, n2 ∈ ℕ if n ∈ ℕ and p does not divide n E([pr]) ≅ {O} if p|t, that is, E(ℤp) is super singular and E([pr]) ≅ (ℤpr , +) if p does not divide t. (2) The map ℤ → End(E(ℤp)) given by k → [k] is an injective ring homomorphism. We call this the Tate pairing. (3) ϕ 2 − [t]ϕ + [p] = [0] in End(E(ℤp). Proof. Here End(E(ℤp)) is the ring of endomorphisms of (E(ℤp)) via k + l → [k + l] where [k + l](P) = [k](P) + [l](P) forP ∈ (E(ℤp)) and kl → k∘lwhere [k∘l](P) = [k]([l](P)) for P ∈ (E