Quintic point group operation

A quintic curve in y² with five real roots.

Ordinary elliptic curves in the form

$y^{2}=r_{3}x^{3}+r_{2}x^{2}+r_{1}x+r_{0}$

are used as resolvent equations to calculate the point group operation numerically over a quintic curve

$y^{2}=q_{5}x^{5}+q_{4}x^{4}+q_{3}x^{3}+q_{2}x^{2}+q_{1}x+q_{0}$

by a limiting process with a point-averaging method, because the general quintic equation is insoluble in any closed form.

There are some indications of quintic curves actually being used for cryptographic applications, a book going for ${\frac {1}{4}}G$ and a website on the subject and some papers . Without further reference, the idea seems preposterous at first glance, given the known insolubility of quintic equations in closed form. And then again, why not? We don’t want our crypto too easy to solve. Yet nevertheless, we have a sneaking suspicion none of the references on the topic are doing the sort of heavy-duty industrial curve-fitting math which civil engineers for instance would use to solve these types of equations.

Gottfried Wilhelm Leibniz, 1 July 1646 [O.S. 21 June] – 14 November 1716.

Fitting elliptic curves over the quintic

When the degree of a solvend equation is odd and at least five, the degree of its resolvent is the least integer no less than half of it, and the resolvent is not squared as it is in the case of equations of high even degree. Therefore the first few leading terms of a resultant equation of odd degree are the negatives of the leading terms of the solvend.

${\begin{array}{rcrrrrrrll}y^{2}&=&&&r_{3}x^{3}&{}+r_{2}x^{2}&{}+r_{1}x&{}+r_{0}&&({\textrm {resolvent}})\\y^{2}&=&q_{5}x^{5}&{}+q_{4}x^{4}&{}+q_{3}x^{3}&{}+q_{2}x^{2}&{}+q_{1}x&{}+q_{0}&&({\textrm {solvend}})\\\hline &&-q_{5}x^{5}&{}-q_{4}x^{4}&{}+(r_{3}-q_{3})x^{3}&{}+(r_{2}-q_{2})x^{2}&{}(r_{1}-q_{1})x+&{}r_{0}-q_{0}&=0&({\textrm {resultant}})\end{array}}$

A resolvent elliptic curve fitted through any one or two or three or four points on a quintic curve will intersect the quintic curve at a fifth point, uniquely determined, up to specified multiplicity and sign of the y-axis.

If P, Q, R, S and T are the five points of intersection of the resolvent elliptic curve with the quintic curve, permitting multiplicity, let

$P\oplus Q\oplus R\oplus S\oplus T=O$,

where O is the additional “point at infinity” considered to lie on the curve and serve as an identity for its additive point group operation. We will call this the “quincunx equation” and use direct sum notation $\oplus$ for the point “sums” and additive inverses computed.

Curve intersections of multiplicity two and three are commonly referred to “in the business” as “tangency” and “osculation” as described in the quartic point group operation. On quintic curves, without any more explicit terminology than that already introduced by Leibnitz, we will make use of intersections of multiplicity four as well, where the first, second and third derivatives with respect to x, as well as the y-coördinate, would be required to match, if the equations were put in the form of derivatives rather than polynomials with multiple roots at those points.

Curve fittings through one point

Choose a point P and solve $4P\oplus T=O$, $3P\oplus 2S=O$, $2P\oplus 3R=O$ and $P\oplus 4Q=O$ by curve-fitting. Now $T=-4P$, $S=-{\frac {3}{2}}P$, $R=-{\frac {2}{3}}P$, and $Q=-{\frac {1}{4}}P$.

$\{P\}\longrightarrow \left\{-4P,-{\frac {3}{2}}P,-{\frac {2}{3}}P,-{\frac {1}{4}}P\right\}$

Curve fittings through two points

Choosing points P and Q it is possible to solve for $2P\oplus 2Q\oplus T=O$ and $P\oplus Q\oplus 3R=O$ by curve-fitting: $T=-2(P\oplus Q)$ and $R=-{\frac {1}{3}}(P\oplus Q)$, if scalar division is permitted. Also $2P\oplus Q\oplus 2S=O$ and $P\oplus 2Q\oplus 2U=O$ so $S=-\left(P\oplus {\frac {1}{2}}Q\right)$ and $U=-\left({\frac {1}{2}}P\oplus Q\right)$, etc.

$\{P,Q\}\longrightarrow \left\{-2(P\oplus Q),-{\frac {1}{3}}(P\oplus Q),-\left(P\oplus {\frac {1}{2}}Q\right),-\left({\frac {1}{2}}P\oplus Q\right),-(3P\oplus Q),-(P\oplus 3Q)\right\}$

Goals and objectives

The goal is to reach the point $-P$ from the point P alone, and to reach the point $P\oplus Q$ from the points P and Q if possible, and if so, by the shortest possible path of computation, i.e., using the least number of resolvent elliptic curve operations.

Point averaging and limit

Point averaging is possible.

${\frac {P\oplus Q}{2}}=-{\frac {1}{4}}{\big (}-2(P\oplus Q){\big )}$.

A closed form expression also exists for

${\frac {9}{8}}(P\oplus Q)=-{\frac {3}{2}}\left(-{\frac {3}{2}}\left({\frac {P\oplus Q}{2}}\right)\right)$

although, apparently not for the point group “sum” $P\oplus Q$ itself. The only remaining option then is to approximate

$P\oplus Q=\lim _{n\rightarrow 1}n(P\oplus Q)$

using only those rational numbers n for which a closed form expression exists for the rational scalar multiple by n of the point group “sum” we are calculating.

Insolubility in closed form radical expressions

It has been known for over 500 years that unlike quartic equations, general quintic equations cannot be solved in closed form radical expressions, and this is indeed what we find here for the point group operation which we have defined by “summing” five points that intersect an elliptic curve to an additive identity “point at infinity.”

This is the difficulty of solving the “quincunx equation” which determines the “group operation” among the rational points on a quintic curve. Numbers which are not congruent to 1 modulo 5 are not “constructible” in the resolvent system of the quintic. Non-constructible scalar multiples of a point under the point group operation are not computable or expressible in any closed form. The scalar multiples $-1$ and 2, which are needed for the “inverse” of one point and for point-doubling or calculating a “sum” of two points, since averaging is permitted without a scalar multiple, are not constructible because

$-1\ncong 1\mod 5$; and

$2\ncong 1\mod 5$.

Finding roots of equations which are soluble

Place the resolvent elliptic curve equation over the equation for the quintic curve and subtract term by term:

${\begin{array}{lrrrr}y^{2}=&ax^{3}&{}+bx^{2}&{}+cx&{}+d\\y^{2}=px^{5}+qx^{4}&{}+rx^{3}&{}+sx^{2}&{}+tx&{}+u\end{array}}$

$-px^{5}-qx^{4}+(a-r)x^{3}+(b-s)x^{2}+(c-t)x+d-u=0$

$-p(x-x_{P})(x-x_{Q})(x-x_{R})(x-x_{S})(x-x_{T})=0$.

The fundamental theorem of algebra assures us that the roots (or radicals) which we seek do exist, and may be found when the equation is in this form. If a quintic equation with rational coefficients has four rational roots, then its fifth root must exist and be rational as well. Any known rational roots may be factored out by long division into the polynomial with rational coefficients, and in any case the degree of the equation reduced accordingly, and solved in closed form.

Numerical methods

Numerical or what we call “floating point” methods are often used in practice to solve equations in the fifth or higher degree. The point averaging method, which is expressible in closed form, certainly allows the solution to be approximated to any desired degree of accuracy.

Exact solutions from floating-point computations

If the point group operation as defined does indeed map pairs of rational points on the curve to rational points on the same curve not exceeding a given denominator or height, then floating point approximations of sufficient precision can potentially be proven adequate to rigorously determine the exact numerators and denominators of those rational points.

If we had anything else to offer in this regard, we would have succeeded in doing exactly what the classical Italian mathematicians already proved impossible centuries ago.

R code for example plot

#! /usr/bin/R -f

H <- function(x){
    sqrt(1/9*(x+3)*(x+1)*(x+1/2)*(x-3/2)*(x-2))
}

xvals <- seq(0,3.1,0.0001)

plot(x=c(rev(xvals),-xvals,-rev(xvals),xvals),
    y=c(H(rev(xvals)),H(-xvals),-H(-rev(xvals)),-H(xvals)),
    type="l", lwd=3, col="purple",
    xlab="x", ylab="y", asp="1",
    main=expression(9*y^2 == (x+3)*(x+1)*(x+1/2)*(x-3/2)*(x-2))
)
abline(0,0)