-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy path33_hash_BFT.m
385 lines (326 loc) · 41.8 KB
/
33_hash_BFT.m
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
/*
The following is a hash function based on (3,3)-isogenies between superspecial p.p.a.s.
One can change the security level by changing the variable p at the top of the code.
The starting Jacobians are hardcoded with an accompanying symplectic basis.
Remark that the code is a proof of concept: certain exceptional cases are not implemented.
However, these only occur with chance O(1/p), which is negligble for cryptographic parameters.
*/
clear;
p86 := 10*3^54 - 1; // 89 bit prime
p128 := 20*3^80 - 1; // 131 bit prime
p171 := 38*3^105 - 1; // 172 bit prime
p256 := 10*3^159 - 1; // 255 bit prime
p := p86;
exp3 := Valuation(p+1,3);
K := GF(p);
Kx<x> := PolynomialRing(K);
K<twist> := ext<K | x^2 + 3>; // The twists we work over are all defined up to square root of -3.
Kx<x> := PolynomialRing(K);
INV2 := K ! 1/2; INV3 := K ! 1/3; INV4 := K ! 1/4; INV16 := K ! 1/16; INV216 := K ! 1/216; INV864 := K ! 1/864;
INV103680 := K ! 1/103680; INV213408 := K ! 1/213408; INV13837824 := K ! 1/13837824; INV8115344640 := K ! 1/8115344640; INV327019680 := K ! 1/327019680;
function get_start_Jacobian_and_symplectic_base(p)
case p:
when p86:
f := Kx ! (176954821525955805404857501*twist + 63209351121672858737719799)*x^6 + (18779730370827897563390551*twist + 183148910407161137346714826)*x^5 + (217133436836816567380743586*twist + 134370185560313720944279508)*x^4 + (216317901524863752492356585*twist + 437011310837517330479182486)*x^3 + (159568359574676528827522617*twist + 365532126545748751780704469)*x^2 + (141722157366574653484637915*twist + 260360502665395779826261785)*x + 432160927543879507298333030*twist + 357852148492748436089444651;
C := HyperellipticCurve(f);
J := Jacobian(C);
P1 := J ! [x^2 + (289024759408008002378696305*twist + 252433025479728190792011963)*x + 220435436994113754902987439*twist + 410931206681362161747951473, (554238234377422300759270915*twist + 512242019197861310316108143)*x + 479849582572839748562528420*twist + 50642024683096666259747842];
P2 := J ! [x^2 + (402178487064224807242246261*twist + 368611172158338256261616084)*x + 341354186248018867124173695*twist + 262419368475583380557820653, (423646164718938409346364164*twist + 369167754667129838248967713)*x + 530043121514554965079995389*twist + 581425710010107114465058100];
Q1 := J ! [x^2 + (178536074139878257553863153*twist + 440205233268128437217117640)*x + 377325337532826152557006086*twist + 539303792228934824737238633, (71669983130435589966787897*twist + 68392674916524704329639299)*x + 416735294596942907815779296*twist + 552998170166735129625784767];
Q2 := J ! [x^2 + (374546864225798610655145985*twist + 220950742984365475727300289)*x + 72077130158516351045767737*twist + 87424813110749063434543601, (337812758547310558447249475*twist + 498778719433684355884865225)*x + 203149610417222961935120109*twist + 159723204345596276754721754];
when p128:
f := Kx ! (1553371936413153072743907537770247355840*twist + 2082337710644265386807243814325583099509)*x^6 + (297507054352813646945159546041942422624*twist + 2152493905806207414873849811330295195801)*x^5 + (1575004021715451089672123283798420131272*twist + 693873685380562641426671061694799418061)*x^4 + (2464593207674982589580695219370419406165*twist + 488635973198613181188407474574241908970)*x^3 + (2506348069544373361693935842513198675337*twist + 1389065747312376943875999815111443432343)*x^2 + (1269085104740582058526622761247889959503*twist + 2216921303657040404420212823114606971197)*x + 1160822072619205705134779893309325900028*twist + 118765667139638179259147731752279069473;
C := HyperellipticCurve(f);
J := Jacobian(C);
P1 := J ! [x^2 + (2764653499373027320641011583870164748991*twist + 1591210230433450263934922023028619581904)*x + 1577943139698643136937585397941634444804*twist + 453801353912036043527336113709833929736, (967986290832185334972034005304407008909*twist + 1572156633867205171746009432509033013626)*x + 182928102136811691466878049069020189800*twist + 1007618304149301569984086823138032043187];
P2 := J ! [x^2 + (1563896044945573641907197332984905186711*twist + 615309634900300028762231090923349632519)*x + 1468924704688126517798551775203494864263*twist + 2332333517485259892795780192352524727639, (1432399167343654265463612147923380327781*twist + 648888872541621034641367061701748386261)*x + 196653646156254538356772124364016805939*twist + 1488356948688330853391887215000508174718];
Q1 := J ! [x^2 + (643697117906860804067557287695832272421*twist + 324855874973310655645492539237251873778)*x + 874009044412247157074633316842363310309*twist + 1529568043878433725852871172382026801981, (2551174313693266290559839465873371904224*twist + 922484229541153409564323103262705841864)*x + 354790912279988900088143888567738853820*twist + 2116031478365706410765748568343545560036];
Q2 := J ! [x^2 + (545938022548915977489156937715868573221*twist + 2170930186183655350283733857370416272716)*x + 1583846819465859431472359170864144110666*twist + 1176152816848288119793507114686490463784, (829021274608714861587494146544415369950*twist + 1998074480778719310172617722293052644638)*x + 1625921754338385675799920061464951714596*twist + 1314236608225757200692046681238390489170];
when p171:
f := Kx ! (3666585615203093763131476998723976317730255160982579*twist + 4229237827993085359038320233297317481563073577292268)*x^6 + (1308573472079790135126437503292236669007513888809634*twist + 4441484759564380435588064814273924240659420616396621)*x^5 + (187574094077802379718240290118734711332324784335206*twist + 1604670797972750256466442731219496865564562063431960)*x^4 + (1100238959859936886573620316018718227658382195948645*twist + 457646740204611966052591677362985942657206554183036)*x^3 + (1459866121998810628404624348444570233918014939736999*twist + 3547183899600042520374739747146323942182583954305363)*x^2 + (14211160130635734145759959199731492074086499267348*twist + 2049695471183335049309757426979683849456504261165486)*x + 212616119030108854749515395218036417482067616314204*twist + 2013414563127507432768556279007909173381210547743964;
C := HyperellipticCurve(f);
J := Jacobian(C);
P1 := J ! [x^2 + (633733728315003046061467207471039044732237721813064*twist + 2132663932286622938569137566023681396110709791394449)*x + 2673716738390466807056229423481757569751755508049607*twist + 299557376873380442639626373044780469265206442012621, (3721002882521149766080058893685476006000614095310457*twist + 4104335565605608369285491644756081106969783279318101)*x + 3858660036759753369978422733877963842681634095282040*twist + 1646729984717768911559397759061566151146944499468742];
P2 := J ! [x^2 + (3433553539073380306444294229407073488312449560965989*twist + 1508097341794712655502510004816779703709123032981398)*x + 4632913555230813162026715941129561958962388126946816*twist + 312493897255564238480633041725883828279479450310004, (4552850170151333374113966589097121236154242635070862*twist + 2403285101233709224163150254023755330290347850487205)*x + 3376809854202124819082223144125303789007757419139644*twist + 2320461861408765217535533905914536486487622459420410];
Q1 := J ! [x^2 + (3817784329697248781097824991593866308991515370724560*twist + 3167032809872784390225334492745376186902484277266355)*x + 1585023077573749455625193715536890816768368649082352*twist + 1001441726089446689351048839955899486468543638018446, (2117364128368060619250761415851713557900461964994746*twist + 4073111535793929070424293992426923688358051729486276)*x + 3374684929386185033347215500588573516682471237813257*twist + 2031457243422728284696271918404311383289439828744513];
Q2 := J ! [x^2 + (2592964465889668005254120259975677494251192630505048*twist + 475215492962311465729069184537123886340897747582773)*x + 4174260788266414761546705591213286257124985696172341*twist + 2681801771411338477915994736127271167766007889513828, (1771200396637646989128523486418080252695641580840989*twist + 535925138869911377545738680186741056967026318771487)*x + 37085010406786169862930788483622745899144875623630*twist + 2061009199559547576511601496466645337405392633836382];
when p256:
f := Kx ! (18649656189313205363684599806807075328817666096774797850030104570752982035908*twist + 25339362907865147845102477150108859359341451926183463747250865749052011788205)*x^6 + (49171912402915739506367293771285346106725644396888649736056383136640983880741*twist + 24795311578558836607036047368151288106329624781465885623756037954590028815927)*x^5 + (17563386385284774633770289431792898328062059004578612304371011894411112393669*twist + 5789974758264576776296646732302983642559524748332747104843258804932998278)*x^4 + (38944847420691079714091998895655203793368306051666272784202204494426382004720*twist + 14828200004975810120226056104960099713526072024527127016915273558749182074941)*x^3 + (18608142705126629640742323420633228656291243503532068088090051238614764854536*twist + 1457031930077234457850075780951040345734771692138842545746104281198558154894)*x^2 + (45997674088888318295011543128925462063797204857084708789685706822128071344545*twist + 45692913011432189829097319973029452817465238289232258152189899712519693353376)*x + 51933131252260766221046285299347344981256903813679396421814469952099561094981*twist + 34629668429180570046666144114756336107238111915926393903572509303725631166671;
C := HyperellipticCurve(f);
J := Jacobian(C);
P1 := J ! [x^2 + (30261679486637360701248645096199899878140457534169064587334868570955819013058*twist + 72343629062767878475220747204836900295662822713442844645556208815006034625206)*x + 71616179505912455023287828549187181721833354964528648783718297076770582751742*twist + 42925190302163723744989167581220108121037718376303776227445732713982854242861, (43579173601332224639397133771844643946789037738946881159162630720703746726653*twist + 61368250853800094017516917241802439127189554785059721717741252363507419852908)*x + 26385313922961973777903749378318530288888371468325982542784692065549560395655*twist + 22688403505387534940499694770539374792708606093471440697826143385670063489467];
P2 := J ! [x^2 + (39687912645756323087086250207414640554327520637355506648736889573479847550216*twist + 62785485213773294784992088558484577780058279342295018555740666151017588105185)*x + 3161991029476469495979208333747419829600489057895452181530317199454679422205*twist + 59076777272498908723785651010966779787934133091582013692857617559150358661325, (59375004341318534583228711907240798728161791517177297472208270351586648647650*twist + 9492543481719430563354865456674020374484282002335455116331703528596693749399)*x + 45913801370356053943274622009331281146088341216849255462674432539257989432698*twist + 8483306817904738123300983175389976206457847374236599728956824742083648375007];
Q1 := J ! [x^2 + (33349325861332970623644321577279618140932229793565262312944801268336923794597*twist + 50930630274358193311816211497908000615037153746691661638163897432126980869895)*x + 573102175957833163938007315715524223785813150083370557514918124762406916257*twist + 17804470387382338985842751199203089121246478158550141008749154159771959242353, (49875014590055820813886778698636381073654365986946133199406852080246190449440*twist + 776721372884173385268519831805173085888695685484561762043726546559135968312)*x + 69426326897345978727250739512214661648952364373611358962276394692497093713643*twist + 5249955560294900764287574230791569265132792601761040146469645489572898506735];
Q2 := J ! [x^2 + (66191623683237136143487949861016911285174999114748913355885486421437873218012*twist + 44462023123554403140923796709976425349055047766329872735431311774457520511939)*x + 45426592837689451043198072473846529893604194229231932906854378687010214026420*twist + 13284795896007368848789780960727786148158770551506082721957417341689145423701, (61905372843640176071712639406463793130460727948011008790841792919074926732075*twist + 57826390503228877381920677218878170404291222607901829225617259687609382997912)*x + 18714995898478158154981655785029862746605076316093018639185885101429427577443*twist + 44739594959792044601783145330367552449508825673112343331089156168163012906148];
end case;
return [P1,P2,Q1,Q2];
end function;
function kernel_generators_from_message(message, B)
T1 := B[1] + message[1]*B[3] + message[2]*B[4];
T2 := B[2] + message[2]*B[3] + message[3]*B[4];
return [T1, T2];
end function;
function get_cubic_Gx(D)
Kab<alpha,beta,lambda> := PolynomialRing(K,3);
Kx<x> := PolynomialRing(Kab);
F := HyperellipticPolynomials(Curve(Parent(D)));
pol := F - (D[2] + (alpha*x + beta)*D[1])^2 - lambda*(Kx ! D[1])^3;
relations := [Eltseq(pol)[i] : i in [1..4]];
GB := GroebnerBasis(Ideal(relations));
alpha := -Coefficients(GB[1])[2];
beta := -Coefficients(GB[2])[2];
Gx := D[2] + (alpha*x + beta)*D[1];
return Eltseq(Gx);
end function;
function get_rst_transform(Ti)
Knew<newr,news,newt,b,c,d,e,newtinv> := PolynomialRing(K,8,"grevlex");
Kx<x> := PolynomialRing(Knew);
T1 := Ti[1]; T2 := Ti[2];
Gx1 := Kx ! get_cubic_Gx(T1);
Gx2 := Kx ! get_cubic_Gx(T2);
Hx1 := Kx ! T1[1];
Hx2 := Kx ! T2[1];
I0 := [newt*newtinv - 1]; // Assertion such that t =/= 0
G1 := ((news - news*newt - 1)*x^3 + 3*news*(newr - newt)*x^2 + 3*news*newr*(newr - newt)*x - news*newt^2 + news*newr^3 + newt);
Gx1eval := Kx ! Numerator(Evaluate(Gx1,(x + b)/(c*x + d))*(c*x + d)^3);
I1 := [e*Eltseq(G1)[i] - Eltseq(Gx1eval)[i] : i in [1..4]];
G2 := ((news - news*newt + 1)*x^3 + 3*news*(newr - newt)*x^2 + 3*news*newr*(newr - newt)*x - news*newt^2 + news*newr^3 - newt);
Gx2eval := Kx ! Numerator(Evaluate(Gx2,(x + b)/(c*x + d))*(c*x + d)^3);
I2 := [e*Eltseq(G2)[i] - Eltseq(Gx2eval)[i] : i in [1..4]];
H1 := x^2 + newr*x + newt;
Hx1eval := Kx ! Numerator(Evaluate(Hx1,(x + b)/(c*x + d))*(c*x + d)^2);
I3 := [LeadingCoefficient(Hx1eval)*Eltseq(H1)[i] - Eltseq(Hx1eval)[i] : i in [1..2]];
H2 := x^2 + x + newr;
Hx2eval := Kx ! Numerator(Evaluate(Hx2,(x + b)/(c*x + d))*(c*x + d)^2);
I4 := [LeadingCoefficient(Hx2eval)*Eltseq(H2)[i] - Eltseq(Hx2eval)[i] : i in [1..2]];
I := Ideal(I0 cat I1 cat I2 cat I4); // Yields quickest results on average
GB := GroebnerBasis(I);
r := -Coefficients(GB[1])[2];
s := -Coefficients(GB[2])[2];
t := -Coefficients(GB[3])[2];
a := 1;
b := -Coefficients(GB[4])[2];
c := -Coefficients(GB[5])[2];
d := -Coefficients(GB[6])[2];
e := -Coefficients(GB[7])[2];
return [r,s,t], [a,b,c,d,e];
end function;
function apply_transformation(transform, points, f, rst)
r,s,t := Explode(rst);
Kx<x> := PolynomialRing(Parent(r));
f_rst := ((-s*t + s - 1)*x^3 + (-3*s*t + 3*s*r)*x^2 + (-3*s*t*r + 3*s*r^2)*x - s*t^2 + s*r^3 + t)^2 + 4*s*(x^2 + r*x + t)^3;
C := HyperellipticCurve(f_rst);
J := Jacobian(C);
newK := KummerSurface(J);
a,b,c,d,e := Explode(transform);
f0,f1,f2,f3,f4,f5,f6 := Explode(Coefficients(f));
ac := a*c;
bd := b*d;
abcd := ac*bd;
bcpad := b*c + a*d;
l0 := (-2) * (ac)^2 * (3*(bcpad)^2 - 8*abcd)*f0 + (2) * ac * (bcpad) * ((bcpad)^2 - 2*abcd)*f1 + (-4) * abcd * ((bcpad)^2 - 2*abcd) * f2 + bd * (bcpad)^3 * f3 + (-2) * (bd)^2 * (bcpad)^2* f4 + (4) * (bd)^3 * (bcpad) *f5 + (-8) * (bd)^4 *f6 ;
l2 := (-8) * (ac)^4 *f0 + (4) * (ac)^3 * (bcpad) *f1 + (-2) * (ac)^2 * (bcpad)^2 * f2 + ac * (bcpad)^3*f3 + (-4) * abcd * (b^2*c^2 + a^2*d^2) * f4 + (2) * bd * (bcpad) * (b^2*c^2 + a^2*d^2) * f5 + (-2) * (bd)^2 * (3*b^2*c^2 - 2*abcd + 3*a^2*d^2) * f6;
l1 := (-4) * (ac)^3 * (bcpad)*f0 + (ac)^2 * ((bcpad)^2 + 4*abcd) * f1 + (-4) * abcd*a*c * (bcpad)*f2 + abcd * ((bcpad)^2 + 4*abcd)*f3 + (-4) * ac * (bd)^2 * (bcpad)*f4 + (bd)^2 * ((bcpad)^2 + 4*abcd)* f5 + (-4) * (bd)^3 * (bcpad)*f6;
images := [];
for xx in points do
y1 := xx[3]*c^2 + xx[2]*c*d + xx[1]*d^2;
y2 := 2*xx[3]*a*c + xx[2]*(bcpad) + 2*xx[1]*b*d;
y3 := xx[3]*a^2 + xx[2]*a*b + xx[1]*b^2;
y4 := e*((a*d-b*c)^4*xx[4] + l2*xx[3] + l1*xx[2] + l0*xx[1]);
images := Append(images,newK![y1,y2,y3,y4]);
end for;
return images;
end function;
function get_codomain_Kummer_coefficients(rst)
r,s,t := Explode(rst);
e1 := s;
e2 := t;
e3 := r - 1;
e4 := r - t;
e5 := r*s - s*t - 1;
e6 := r^2 - t;
Delta := (e1*e3*e6)^2 + e5*(e3*e6*(e1*e4 + e5) + e4^2*e5);
if Delta eq 0 then return Delta, 0, 0, 0, 0; end if;
invD := 1/Delta;
j0fac := e1*( e1*( e1*( e6^2*( e6^2*(e4*e5 + e3) - e3*e4^2*(e3 + 1)) + (e2*e3*e4)^2*e4*e5) - e4*e5*(e2*e4^3 + e6^3)) + e2*(e2*Delta + e4^2*e5*(2*e5*e6 + e6)));
j1fac := e1*( e1*( e6^3*( e5*(e1*e4^2 + e2 - 1) + e1*e3^2) + (e2*e3)^2*e3*e4*e5*(2 - e1*e4)) + e2*(Delta - e2*e3^3*e5));
j2fac := e1*(e2*( Delta - (e3*e5)^2*e6*(2*e5 + 1)) + e1*e4^2*Delta );
j0 := 36*Delta*j0fac;
j1 := 12*Delta*j1fac;
j2 := 36*Delta*j2fac;
Kx<x> := PolynomialRing(Parent(r));
Hrst := x^2 + r*x + t;
Grst := (s - s*t - 1)*x^3 + 3*s*(r - t)*x^2 + 3*r*s*(r - t)*x + (r^3*s - s*t^2 + t);
Frsti := Coefficients(Delta*(Grst^2 + 4*s*Hrst^3));
f0D := Frsti[1]; f1D := Frsti[2]; f2D := Frsti[3]; f3D := Frsti[4]; f4D := Frsti[5]; f5D := Frsti[6]; f6D := Frsti[7];
Hrst_tilde := e3*e5*x^2 + (r^3*s - 2*r^2*s + r*s*t + r - s*t^2 + s*t - t)*x - e6*e5;
Grst_tilde := Grst - 2*t;
Frsti_tilde := Coefficients(-3*(Delta*Grst_tilde^2 + 4*s*t*Hrst_tilde^3));
h0 := Frsti_tilde[1]; h1 := Frsti_tilde[2]; h2 := Frsti_tilde[3]; h3 := Frsti_tilde[4]; h4 := Frsti_tilde[5]; h5 := Frsti_tilde[6]; h6 := Frsti_tilde[7];
a0 := 0; a1 := 0; a2 := 0; a3 := Delta;
b0 := 0; b1 := 0; b2 := Delta; b3 := 0;
c0 := 0; c1 := Delta; c2 := 0; c3 := 0;
a4 := f6D - h6;
c9 := f0D - h0;
a5 := (f5D - h5)*INV3;
b4 := -a5;
c8 := (f1D - h1)*INV3;
b9 := -c8;
b5 := 4*e1*( Delta*( 5*e2 - e1*e4^2 - 2*(e2*e3*e5 - e6)) + e2*(e3*e5)^2*e6*(12*e5 + 9) );
a7 := 4*e1*(Delta*(e2 + e1*e4^2) - e2*(e3*e5)^2*e6*(3*e5 + 2));
c4 := b5 + (f4D - h4)*INV3;
a6 := 2*b5 - c4 - 4*a7 + (f4D - h4);
a8 := 12*e1* ( e1*( e6^3*( e5*(e4*e5 + e3) + e1*e3^2) - (e2*e3*e5)^2*e3*e4) + e2*(Delta + e2*e3*(e3*e5)^2));
b7 := -4*e1* ( e2*( e5*( e3*e6*( e1*e3*e6*(-5*e5 - 4) - e4*e5^2) + 3*e4*Delta - 2*e4*(e4*e5)^2) - e2*Delta) + e1*e4^3*Delta);
c5 := a8;
b6 := 4*(a8 - b7) - (f3D - h3);
b8 := 4*e1*( Delta*( e1*( e6*( e6 -2*e4^2) - e2^2*(e3^2 - 5*e4)) + e2*(e6 - 5*e2*e5 + 2*e4)) - e2*e3*(e5*e6)^2*(12*e5 + 9));
c7 := 4*e1* (Delta* ( e2*( e1*e4^2 + e6 + e2) + e1*e4^2*e6) + e2*e3*(e5*e6)^2*(2*e1*e4 + e5));
a9 := b8 + (f2D - h2)*INV3;
c6 := 2*b8 - a9 - 4*c7 + (f2D - h2);
a10 := (a4*b5 + f6D*(a6 - b5) - a5*(2*f5D + h5)*INV3 )*invD;
c19 := (c9*b8 + f0D*(c6 - b8) - c8*(2*f1D + h1)*INV3 )*invD;
a11 := (2*f6D*(b6 + 2*(c5 - b7)) + f5D*(a6 - a7 - c4) + 3*a4*b7 - h5*a7 )*invD;
c18 := (2*f0D*(b6 + 2*(a8 - b7)) + f1D*(c6 - c7 - a9) + 3*c9*b7 - h1*c7 )*invD;
b10 := (b4*c4 + 4*f6D*b7 - 4*h6*a8 + a7*(9*a5 + 4*h5) - 3*a4*(a8 + b7) )*invD*INV2;
b19 := (b9*a9 + 4*f0D*b7 - 4*h0*c5 + c7*(9*c8 + 4*h1) - 3*c9*(c5 + b7) )*invD*INV2;
a13 := (f6D*(10*a9 - 9*c6 - b8)*INV2 - h5*b7 - 3*b5*a7 + f5D*c5 )*invD;
c17 := (f0D*(10*c4 - 9*a6 - b5)*INV2 - h1*b7 - 3*b8*c7 + f1D*a8 )*invD;
b11 := (a4*(2*c7 - c6) + c4*(2*b5 - c4) + f6D*(4*b8 - 3*c6) + h6*(b8 - 2*a9) + 2*f5D*(a8 - b7) + a7*(2*a6 - a7) - 6*a13*Delta )*invD*INV4;
b18 := (c9*(2*a7 - a6) + a9*(2*b8 - a9) + f0D*(4*b5 - 3*a6) + h0*(b5 - 2*c4) + 2*f1D*(c5 - b7) + c7*(2*c6 - c7) - 6*c17*Delta )*invD*INV4;
a12 := (8*(2*f2D*a4 - a13*Delta + 12*h6*c7) + a5*(9*b6 - 7*f3D) - a5*(h3 - 32*a8) + 2*a7*(6*c4 - b5) - 2*a6*(2*c4 - 4*a6 + 11*a7) + 115*b6*(h6 - f6D + a4)*INV16 )*invD*INV16;
c15 := (8*(2*f4D*c9 - c17*Delta + 12*h0*a7) + c8*(9*b6 - 7*f3D) - c8*(h3 - 32*c5) + 2*c7*(6*a9 - b8) - 2*c6*(2*a9 - 4*c6 + 11*c7) + 115*b6*(h0 - f0D + c9)*INV16 )*invD*INV16;
c10 := (c7*(3*f6D + 5*h6 - a4) + c4^2 + 2*a5*a8 - a7*(2*a6 - a7) )*invD*INV4;
a19 := (a7*(3*f0D + 5*h0 - c9) + a9^2 + 2*c8*c5 - c7*(2*c6 - c7) )*invD*INV4;
a16 := (a7*(3*a8 + b7 - 2*f3D - b6) + c8*(3*f6D + h6) + a5*b8 - c7*(3*f5D + h5) + b5*a8 - a6*b7 )*invD*INV4;
c16 := (c7*(3*c5 + b7 - 2*f3D - b6) + a5*(3*f0D + h0) + c8*b5 - a7*(3*f1D + h1) + b8*c5 - c6*b7 )*invD*INV4;
b13 := (2*a7*(2*(f3D + b6) + h3 + a8 - b7) + 2*b5*(b7 + a8) - c4*(b7 + a8) - f5D*(3*a9 - 2*c6) + h5*(2*b8 - a9) - 4*f6D*c8 - 3*a5*c7 )*invD*INV4;
b17 := (2*c7*(2*(f3D + b6) + h3 + c5 - b7) + 2*b8*(b7 + c5) - a9*(b7 + c5) - f1D*(3*c4 - 2*a6) + h1*(2*b5 - c4) - 4*f0D*a5 - 3*c8*a7 )*invD*INV4;
a14 := (c8*(10*f6D - 3*a4) + b13*Delta - h5*(b8 + c6)*INV2 + f5D*(2*b8 - a9) - a7*(7*f3D - 6*a8) + 2*f4D*(a8 - b7) )*invD;
c14 := (a5*(10*f0D - 3*c9) + b17*Delta - h1*(b5 + a6)*INV2 + f1D*(2*b5 - c4) - c7*(7*f3D - 6*c5) + 2*f2D*(c5 - b7) )*invD;
c11 := (3*(c4*b7 + a7*a8)*INV2 - Delta*(2*b13 + 9*a16) + 4*(f5D*c7 - f6D*c8) )*invD;
a18 := (3*(a9*b7 + c7*c5)*INV2 - Delta*(2*b17 + 9*c16) + 4*(f1D*a7 - f0D*a5) )*invD;
b12 := ((b6*(c4 - a7) + a6*(a8 + b7))*INV2 + Delta*(b13 - a14 + 6*a16) - c4*b7 - a7*a8 )*invD;
b15 := ((b6*(a9 - c7) + c6*(c5 + b7))*INV2 + Delta*(b17 - c14 + 6*c16) - a9*b7 - c7*c5 )*invD;
b16 := (c7*(6*f4D + 2*h4 - a6 + a7) + 2*b5*(b8 - a9) + c9*(3*h6 - 7*f6D) + b7*(b7 - 2*b6) - 4*h0*a4 + a5*c8 - c6*a7 )*invD*INV4;
c13 := (c8*(a5 + 3*f5D + h5) - c9*(3*(h6 + a4) + 5*f6D) + b5*(b8 + 2*c7 - c6) + b7*(b7 - 2*b6) + a8^2 )*invD*INV4 - b16;
a17 := (a5*(c8 + 3*f1D + h1) - a4*(3*(h0 + c9) + 5*f0D) + b8*(b5 + 2*a7 - a6) + b7*(b7 - 2*b6) + c5^2 )*invD*INV4 - b16;
a15 := ((a6*(f2D - 5*c7 + b8 - h2) + a8*(a8 - b7 + 2*b6))*INV2 - a7*(5*f2D + 3*(c7 - b8) + h2)*INV3 + 2*c9*(3*f6D + h6) - (c8*(f5D + h5) - h1*a5) )*invD;
c12 := ((c6*(f4D - 5*a7 + b5 - h4) + c5*(c5 - b7 + 2*b6))*INV2 - c7*(5*f4D + 3*(a7 - b5) + h4)*INV3 + 2*a4*(3*f0D + h0) - (a5*(f1D + h1) - h5*c8) )*invD;
b14 := (2*(2*(f4D*c7 - f5D*c8 - f6D*c9) - h0*a4 - a5*c8 - f3D*b7 - c4*a9) - 3*h1*a5 + b8*(b5 + c4) + a8*(f3D + h3) )*invD + 4*(c13 - b16) + c12;
d0 := Delta^3;
d1 := Delta*j2;
d2 := Delta*j1;
d3 := Delta*j0;
d9 := Delta*( 2*(f0D*b5 - h4*c9) + c8*(f3D - 4*a8) + Delta*(4*c17 + c15) - j2fac*(108*c9 + 72*h0) + 4*f2D*c7);
d4 := Delta*( 2*(f6D*b8 - h2*a4) + a5*(f3D - 4*c5) + Delta*(4*a13 + a12) - j0fac*(108*a4 + 72*h6) + 4*f4D*a7);
d8 := Delta*( Delta*(4*c16 + c14) + b5*(h1 - f1D)*INV3 + 2*(f3D*c7 - 2*h0*a5 - f5D*c9));
d5 := Delta*( Delta*(4*a16 + a14) + b8*(h5 - f5D)*INV3 + 2*(f3D*a7 - 2*h6*c8 - f1D*a4));
d6 := Delta*( a8*(18144*c7 + 1344*(h2 - f2D) - 2016*b8 + 1386*h3 + 3198*f3D - 1770*b6) + j0fac*(51840*h3 - 77760*b6 - 194400*b7 + 303264*c4 - 17712*b5 - 478656*f4D) + c6*(3888*b6 - 2592*h3 + 9720*b7 + 12528*f4D + 4644*b5 - 10584*c4) + b7*(6006*b6 - 678*h3 - 4890*f3D) + f1D*(1728*a6 - 8640*a7 - 1024*h5) + h1*(1296*a6 - 25920*j2fac - 22464*a5) + b6*(192*b6 + 384*f3D) + f2D*(4608*f4D - 512*h4) - f0D*(24384*h6 + 11904*f6D) + c8*(22768*h5 - 2416*f5D) - a9*(240*b5 + 1536*h4)+ 5664*b16*Delta + 49248*h0*a4 - 45600*h6*c9 - 1536*f3D^2 )*INV216;
d7 := Delta*( a8*(336*(f2D - h2) - 4536*c7 + 504*b8 - 822*f3D - 378*h3 + 474*b6) + j0fac*(19440*b6 - 12960*h3 + 48600*b7 - 71928*c4 + 119664*f4D + 3780*b5) + c6*(2646*c4 - 972*b6 + 648*h3 - 2430*b7 - 1161*b5 - 3132*f4D) + f3D*(384*f3D + 1299*b7 - 96*b6) + h1*(5616*a5 - 324*a6 + 6480*j2fac) + f1D*(256*h5 - 432*a6 + 2160*a7) + f0D*(2904*f6D + 6312*h6) + a9*(384*h4 - 12*b5) + f2D*(128*h4 - 1152*f4D) + b7*(165*h3 - 1461*b6) + c8*(592*f5D - 5680*h5) - 48*b6^2 - 1272*b16*Delta - 12312*h0*a4 + 11184*h6*c9)*INV216;
d10 := (a5*(f3D*(161280*c4 - 30720*f4D - 145920*a6 + 2343345*a7) + a5*(1488420*a9 - 3587400*b8 + 322560*f2D) - f4D*(30720*b6 + 199680*a8 + 284160*b7) + a7*(5539185*b6 + 691191*h3) + f5D*(510720*b8 - 7074540*c7) - 15360*f1D*h6 + 996480*b5*b7 + 10958040*a16*Delta + 866880*c4*a8 + 1586340*h5*c7) + f5D*(f5D*(130560*b8 + 2453760*c7 - 215040*a9) + c4*(158400*b7 - 2588160*a8 - 11520*f3D) - a7*(680388*f3D + 2668740*b6 + 191292*h3) + f4D*(61440*a8 - 46080*b7) - 2780160*a16*Delta - 384000*b5*b7 + 7680*a6*b6 + 161280*f6D*c8) + a7*(h6*(69892224*a9- 131227776*c7- 33135744*c6 - 3661632*f2D) + c4*(4174608*b5 + 3304896*c4 - 2843904*f4D) + b5*(129696*b5 + 2325504*f4D) + f6D*(74365920*c7 - 13811968*f2D - 20964800*h2) - Delta*(2124480*a12 + 2182800*a13) + 34296960*a4*b8) + f6D*(a8*(552960*b6 - 2407680*b7 + 2313600*a8) + a6*(18504000*c7 - 46080*f2D + 568320*b8 + 9398400*a9) + c7*(35443200*h4 - 59031360*b5) + c4*(138240*f2D - 8559360*a9)) + c4*(a6*(15360*f4D + 81600*c4 - 76800*b5) + 2525760*h5*b7 - 184320*a12*Delta- 1411200*h6*b8 - 1558080*a4*c7) + h6*(b7*(1075200*f3D - 122880*b6 - 439680*b7) + 34560*a4*c9 - 15360*h3^2 - 764160*a6*c7) - a4*(a8*(608640*a8 - 2079360*b7) + 702720*a6*b8) + a6*Delta*(84480*a12 + 1265280*a13) )*INV103680 + (j0*a10 + j1*b10 + j2*c10);
d11 := (a7*(f5D*(663936*f2D+ 331980*c7 + 2228928*a9 - 3106272*c6) + f3D*(1445873*a6 - 1920672*c4 - 881400*a7) + a5*(5212692*b8- 3170316*f2D - 2121108*h2) + a8*(2798016*f4D - 1217892*c4 + 74932*b5) + a6*(480831*h3 - 49647*b6) + b7*(3974724*c4- 3129984*f4D) - a7*(241176*b6 + 1537536*h3) - 165984*h1*a4 + 8144136*a16*Delta + 4161756*h5*c7) + b7*(b5*(284544*h4- 480168*b5 + 441064*a6) + f5D*(160056*b7 - 35568*h3 + 326040*a8) + h5*(118560*h3 - 17784*b6 - 569088*b7) + a4*(480168*a9 - 960336*f2D) + a6*(102960*f4D - 400556*c4) + 47424*h2*h6 - 1421732*a5*a8) + a5*(a8*(158080*b6 + 670852*a8 + 98800*h3) + h4*(8208*f2D + 24624*a9 - 24624*c6) + a6*(372576*c7 - 3496*b8) - c8*(160056*f5D + 88920*h5) - 332424*b5*c6 + 213408*h6*c9) + a8*(h6*(397176*a9 - 219336*c6 - 136344*f2D) - Delta*(725192*a13 + 158080*a12) + a4*(201552*b8 + 21736*h2) - 148200*f6D*h2) + a6*(h6*(253344*f1D - 747136*c8) + Delta*(56992*a14 + 3320512*a16) - f5D*(39624*b8 + 499408*c7) + 196352*h1*a4) + f5D*(189696*h0*h6 + h1*(71136*h5 - 82992*f5D) - 2736*h2*h4) - h5*(195624*b5*b8 - 11856*h1*h5 - 2736*h2*h4) + a16*Delta*(1849536*f4D - 5975424*c4) + 640224*f1D*f6D*b5)*INV213408 + (j0*a11 + j1*b11 + j2*c11);
d12 := (a7*(a8*(71688639263904*b6 - 47633590083456*h3 + 8226721831536*a8 + 150071629876272*b7) + f2D*(726002896320*b5 - 179138718720*h4 + 138945245672016*a6 + 3086073952448*a7) + a6*(53546718093024*b8 - 151947714850584*a9 + 325475748300312*c7) + h4*(52749740160*a9 - 29732886144*c6 + 588120892416*c7) + a7*(6586890862080*b8 - 4249353171776*h2 - 118179243959904*c7) + b7*(11182445707680*f3D - 2820326389920*b7) + h5*(20027432146176*c8 - 8088690876864*f1D) - b5*(224586788400*a9 + 111193712928*c6) - 14100621058368*f5D*c8 - 18611697184704*h1*a5) + a6*(a8*(6525676207557*h3 - 22601221319781*f3D - 10603550635821*b6 + 80301151266336*a8) + a6*(13243726386768*c6 - 14700419646732*a9 - 11815674624*f2D + 15956038353324*c7) + h4*(4508524800*a9 + 1596351744*c6 - 2344823770176*c7) + b5*(8408066073336*c6 - 24346033920*f2D - 4030968240*a9) + b7*(55566725760*f3D - 273511527120*b7) + h5*(14260256617152*f1D - 30843403202664*c8) - 12028028084280*a15*Delta + 12154510984824*f5D*c8 + 28183820804568*h1*a5) + a8*(h5*(26468641652544*c7 + 23504123448*f2D + 24429383784*a9 - 5375754349992*c6) + f5D*(108746474616*a9 - 83614417848*f2D - 131580175896*c6) + f4D*(14126711040*b6 + 871146327168*b7) + a8*(32077009590912*h4 - 72100886590512*b5) + c4*(27577143360*h3 - 1117106909568*b7) +31709957760*f3D*h4 - 116319939840*f1D*a4 + 66604982184*h2*a5) + b7*(a5*(458399616012*f2D - 4438398297996*a9 + 2342796395004*c6) + f5D*(26218297404*h2 - 424505659968*f2D) + h5*(322851453444*h2 - 256082141952*b8) + b7*(844880615280*b5 - 500669994240*h4) + 8115344640*h1*a4 + 12336736557600*a16*Delta) + a9*(f6D*(230723116416*c6 - 4057672320*a9 - 86563676160*f2D) - 37729916640*a4*c7) + c7*(26149443840*h5*b6 - 866538466560*h4*c4 + 731141831160*b5^2 + 37504321920*f2D*a4) + f5D*(b5*(53989584480*c8 - 13826142720*f1D) + 10369607040*f4D*c8 + 13525574400*f3D*c6) - c6*(106107356160*f2D*f6D + 24556431744*h6*b8) + h4*(1352557440*a15*Delta - 1352557440*a4*c9) + h1*(5184803520*c4*a5 - 2404546560*h3*h6) + 36519050880*a4*a19*Delta - 601136640*f0D*h5^2)*INV8115344640 + (j0*a12 + j1*b12 + j2*c12);
d13 := (a6*(a8*(152377957017*f3D - 43858328553*h3 - 542547965232*a8 + 70926086673*b6) + a7*(1027033984428*a9 - 939329740800*f2D - 364246057056*b8 - 2221420681944*c7) + a6*(99362564352*a9 - 72671040*f2D - 89555386368*c6 - 110375191650*c7) + b5*(218013120*f2D - 56749284936*c6 + 235471860*a9) + h4*(16654460832*c7 - 290684160*a9 + 266460480*c6) + h5*(208629280080*c8 - 96846091680*f1D) + b7*(2716672608*b7 - 2100591792*f3D) + 49052952*a4*c9 + 81476094024*a15*Delta - 81917937036*f5D*c8 - 190688851080*h1*a5) + a7*(a8*(324608223888*h3 - 485859058776*b6 - 49610165904*a8 - 1024182914976*b7) + h4*(2131683840*f2D - 2241445536*c7- 1731993120*c6 - 654039360*a9) + a7*(35892961856*h2 - 55359277320*b8 - 22401676160*f2D + 792582864408*c7) + b5*(3475392804*a9 - 3804328944*f2D + 2869454808*c6) + b7*(23841196236*b7 - 75249410184*f3D) + c8*(93792832848*f5D - 134772145560*h5)+ 124109677224*h1*a5 + 55935056112*f1D*h5) + a8*(h5*(37133566470*c6 - 117723554*f2D - 1120252614*a9 - 176536537632*c7) + f5D*(2268786338*f2D + 2892135402*c6 - 4942122042*a9) + c4*(196817400*h3 + 5019607476*b7) + a8*(490324404960*b5 - 218074296960*h4) - f4D*(3527778384*b7 + 24223680*b6) - 133230240*f3D*h4 + 245264760*f1D*a4 - 450065382*h2*a5) + b7*(a5*(28009741032*a9 - 3964646088*f2D - 17342227656*c6) + h5*(1181516544*b8 - 1946519640*h2) + b7*(4266587520*h4 - 7199866440*b5) + f5D*(4678872120*f2D - 319673952*h2) + 370622304*h1*a4) + c7*(327019680*h5*b6 + 218013120*h4*c4 + a4*(2411681688*a9 - 1183058136*c6) - 183948570*b5^2) + f6D*c6*(4113978336*a9 - 544763232*c6 - 1177270848*f2D) + f5D*(436026240*f1D*b5 - 13625820*b5*c8 - 690374880*f4D*c8) + Delta*(218013120*h2*a13- 109006560*h4*a15 - 85899528000*b7*a16) + h1*(96894720*h3*h6 - 136258200*c4*a5) + 109006560*h4*a4*c9 + 290684160*f0D*h5^2 - 2943177120*f6D*a9^2) *INV327019680 + (j0*a13 + j1*b13 + j2*c13);
d14 := (a7*(f3D*(1609023*c7 - 680238*a9 + 952359*c6 - 331056*f2D) + b6*(1197666*a9 - 335088*f2D - 3120369*c7 - 360885*c6) + f1D*(1352928*c4 - 1327680*b5 + 144384*f4D) + h3*(333360*f2D - 293499*c7 - 6489*b8) + c8*(1074888*c4 - 2640096*f4D + 30024*b5) + h5*(2385984*c9 - 932928*f0D)+ 357120*a18*Delta - 6584256*h0*a5 - 537168*f5D*c9) + b7*(b7*(378*b6 - 630*f3D - 42*h3) + b8*(87876*h4 - 61092*f4D - 148056*b5) + c7*(397776*c4 - 109248*b5 - 747360*f4D) + a9*(35136*f4D + 31704*c4) + a8*(1680*b6 + 3552*f3D) + c8*(78288*f5D - 228888*a5) + 2592*a4*c9 + 8640*a15*Delta - 27984*f1D*a5) + c7*(f5D*(1445940*c7 - 535440*b8 - 82176*f2D) + a6*(8448*f3D + 40272*b6) + a8*(161568*f4D - 125064*c4) - a5*(12684*a9 + 124128*f2D) - 7776*h6*c8 - 5935032*a16*Delta - 286332*h5*c7) + b8*(a8*(6300*c4 + 101844*b5 - 61920*f4D) + a5*(563760*a9 - 148686*c6 - 4032*f2D) + f5D*(44352*a9 - 195646*b8) - 108*a4*c8 + 151294*h5*b8) + a5*(2196*h0*a6 + c9*(2268*b5 - 864*f4D) - 3456*b6*c8 + 2880*f1D*h3 + a8*(159816*c8 - 72768*f1D) - 321216*a19*Delta) + Delta*(3456*c8*a12 + a16*(1410048*a9 - 902736*c6 + 176256*f2D) + 8064*a6*a18 - 2880*a8*a15) + a6*(f5D*(54356*f0D - 8496*h0) - 45860*f0D*h5) + c9*(3168*h6*a8 - 432*h3*a4)- 2880*f3D*a8^2)*INV864 + (j0*a14 + j1*b14 + j2*c14);
d15 := (c7*(c5*(71688639263904*b6 - 47633590083456*h3 + 8226721831536*c5 + 150071629876272*b7) + f4D*(726002896320*b8 - 179138718720*h2 + 138945245672016*c6 + 3086073952448*c7) + c6*(53546718093024*b5 - 151947714850584*c4 + 325475748300312*a7) + h2*(52749740160*c4 - 29732886144*a6 + 588120892416*a7) + c7*(6586890862080*b5 - 4249353171776*h4 - 118179243959904*a7) + b7*(11182445707680*f3D - 2820326389920*b7) + h1*(20027432146176*a5 - 8088690876864*f5D) - b8*(224586788400*c4 + 111193712928*a6) - 14100621058368*f1D*a5 - 18611697184704*h5*c8) + c6*(c5*(6525676207557*h3 - 22601221319781*f3D - 10603550635821*b6 + 80301151266336*c5) + c6*(13243726386768*a6 - 14700419646732*c4 - 11815674624*f4D + 15956038353324*a7) + h2*(4508524800*c4 + 1596351744*a6 - 2344823770176*a7) + b8*(8408066073336*a6 - 24346033920*f4D - 4030968240*c4) + b7*(55566725760*f3D - 273511527120*b7) + h1*(14260256617152*f5D - 30843403202664*a5) - 12028028084280*c12*Delta + 12154510984824*f1D*a5 + 28183820804568*h5*c8) + c5*(h1*(26468641652544*a7 + 23504123448*f4D + 24429383784*c4 - 5375754349992*a6) + f1D*(108746474616*c4 - 83614417848*f4D - 131580175896*a6) + f2D*(14126711040*b6 + 871146327168*b7) + c5*(32077009590912*h2 - 72100886590512*b8) + a9*(27577143360*h3 - 1117106909568*b7) +31709957760*f3D*h2 - 116319939840*f5D*c9 + 66604982184*h4*c8) + b7*(c8*(458399616012*f4D - 4438398297996*c4 + 2342796395004*a6) + f1D*(26218297404*h4 - 424505659968*f4D) + h1*(322851453444*h4 - 256082141952*b5) + b7*(844880615280*b8 - 500669994240*h2) + 8115344640*h5*c9 + 12336736557600*c16*Delta) + c4*(f0D*(230723116416*a6 - 4057672320*c4 - 86563676160*f4D) - 37729916640*c9*a7) + a7*(26149443840*h1*b6 - 866538466560*h2*a9 + 731141831160*b8^2 + 37504321920*f4D*c9) + f1D*(b8*(53989584480*a5 - 13826142720*f5D) + 10369607040*f2D*a5 + 13525574400*f3D*a6) - a6*(106107356160*f4D*f0D + 24556431744*h0*b5) + h2*(1352557440*c12*Delta - 1352557440*c9*a4) + h5*(5184803520*a9*c8 - 2404546560*h3*h0) + 36519050880*c9*c10*Delta - 601136640*f6D*h1^2)*INV8115344640 + (j0*a15 + j1*b15 + j2*c15);
d16 := (b7*(f4D*(28021592352*c7 - 1186872960*a9 - 90215424*f2D + 2564727256*b8) + b7*(11080992*h3 - 61233120*f3D + 36739872*b6) + c4*(15634944*f2D - 2143884288*a9 - 13429047840*c7) + f1D*(468525408*a5 - 31277376*f5D) + b8*(5647063032*b5 - 3255914584*h4) + c8*(8596985904*a5 - 2837594448*f5D) + a8*(18118464*f3D - 18670080*b6) + 4315057968*b5*c7 + 12224160*a15*Delta) + a7*(f3D*(10870942872*f2D - 49034471628*c7 + 21659664474*a9 - 31509056853*c6) + b6*(11004658584*f2D - 43666946766*a9 + 111387259092*c7 + 13921300635*c6) + f1D*(44079092448*b5 - 5433312768*f4D - 46842869568*c4) + h3*(187974099*b8 + 10704948264*c7 - 11120962200*f2D) + c8*(90357626208*f4D - 1937626536*b5 - 37449463512*c4) + c9*(24032217992*f5D - 86657028776*h5) + 237813785376*h0*a5 + 38797324800*f0D*h5 - 9889831872*a18*Delta) + b8*(f5D*(18592956792*c7- 1205128704*a9 - 12300288*f2D + 6491862111*b8) + a8*(1950122304*f4D + 192529896*c4 - 3659704464*b5) + a5*(59754240*f2D - 17589284478*a9 + 3699429813*c6) + a6*(8948160*b6 + 14092416*f3D) - 5222075775*h5*b8 ) + c7*(a5*(4309388928*f2D - 1812003696*a9) + f5D*(2948345088*f2D - 45120978720*c7) + a8*(4260518496*c4 - 5260253856*f4D) - a6*(346663200*f3D + 1408667520*b6) + 7915475520*h5*c7 + 211025095584*a16*Delta) + Delta*(a16*(35150202888*c6 - 5556385536*f2D - 56712723408*a9) + a19*(11345435712*a5 - 299120640*f5D) + 13837824*c9*a11 - 170775072*a6*a18 + 16320096*a8*a15 + 12300288*h2*a14) + h3*(h3*(3234816*b6 - 1078272*h3) - 741312*a4*c9 - 2426112*b6^2 + h4*(4313088*a9 - 1078272*c6 + 1437696*f2D)) + a6*(9424896*f4D*h1 + h0*(303996576*f5D - 58496256*a5) + f0D*(1627032160*h5 - 1976850304*f5D)) + b6*(h4*(1617408*c6 - 6469632*a9 - 2156544*f2D) + 5189184*a4*c9) + a8*(43041024*f3D*a8 + a5*(3190273008*f1D - 5827652064*c8)) + h1*h6*(18450432*a9 - 22843392*c6) - 8154432*f3D*a4*c9)*INV13837824 + (j0*a16 + j1*b16 + j2*c16);
d17 := (c6*(c5*(152377957017*f3D - 43858328553*h3 - 542547965232*c5 + 70926086673*b6) + c7*(1027033984428*c4 - 939329740800*f4D - 364246057056*b5 - 2221420681944*a7) + c6*(99362564352*c4 - 72671040*f4D - 89555386368*a6 - 110375191650*a7) + b8*(218013120*f4D - 56749284936*a6 + 235471860*c4) + h2*(16654460832*a7 - 290684160*c4 + 266460480*a6) + h1*(208629280080*a5 - 96846091680*f5D) + b7*(2716672608*b7 - 2100591792*f3D) + 49052952*c9*a4 + 81476094024*c12*Delta - 81917937036*f1D*a5 - 190688851080*h5*c8) + c7*(c5*(324608223888*h3 - 485859058776*b6 - 49610165904*c5 - 1024182914976*b7) + h2*(2131683840*f4D - 2241445536*a7- 1731993120*a6 - 654039360*c4) + c7*(35892961856*h4 - 55359277320*b5 - 22401676160*f4D + 792582864408*a7) + b8*(3475392804*c4 - 3804328944*f4D + 2869454808*a6) + b7*(23841196236*b7 - 75249410184*f3D) + a5*(93792832848*f1D - 134772145560*h1)+ 124109677224*h5*c8 + 55935056112*f5D*h1) + c5*(h1*(37133566470*a6 - 117723554*f4D - 1120252614*c4 - 176536537632*a7) + f1D*(2268786338*f4D + 2892135402*a6 - 4942122042*c4) + a9*(196817400*h3 + 5019607476*b7) + c5*(490324404960*b8 - 218074296960*h2) - f2D*(3527778384*b7 + 24223680*b6) - 133230240*f3D*h2 + 245264760*f5D*c9 - 450065382*h4*c8) + b7*(c8*(28009741032*c4 - 3964646088*f4D - 17342227656*a6) + h1*(1181516544*b5 - 1946519640*h4) + b7*(4266587520*h2 - 7199866440*b8) + f1D*(4678872120*f4D - 319673952*h4) + 370622304*h5*c9) + a7*(327019680*h1*b6 + 218013120*h2*a9 + c9*(2411681688*c4 - 1183058136*a6) - 183948570*b8^2) + f0D*a6*(4113978336*c4 - 544763232*a6 - 1177270848*f4D) + f1D*(436026240*f5D*b8 - 13625820*b8*a5 - 690374880*f2D*a5) + Delta*(218013120*h4*c17- 109006560*h2*c12 - 85899528000*b7*c16) + h5*(96894720*h3*h0 - 136258200*a9*c8) + 109006560*h2*c9*a4 + 290684160*f6D*h1^2 - 2943177120*f0D*c4^2)*INV327019680 + (j0*a17 + j1*b17 + j2*c17);
d18 := (c7*(f1D*(663936*f4D+ 331980*a7 + 2228928*c4 - 3106272*a6) + f3D*(1445873*c6 - 1920672*a9 - 881400*c7) + c8*(5212692*b5- 3170316*f4D - 2121108*h4) + c5*(2798016*f2D - 1217892*a9 + 74932*b8) + c6*(480831*h3 - 49647*b6) + b7*(3974724*a9- 3129984*f2D) - c7*(241176*b6 + 1537536*h3) - 165984*h5*c9 + 8144136*c16*Delta + 4161756*h1*a7) + b7*(b8*(284544*h2- 480168*b8 + 441064*c6) + f1D*(160056*b7 - 35568*h3 + 326040*c5) + h1*(118560*h3 - 17784*b6 - 569088*b7) + c9*(480168*c4 - 960336*f4D) + c6*(102960*f2D - 400556*a9) + 47424*h4*h0 - 1421732*c8*c5) + c8*(c5*(158080*b6 + 670852*c5 + 98800*h3) + h2*(8208*f4D + 24624*c4 - 24624*a6) + c6*(372576*a7 - 3496*b5) - a5*(160056*f1D + 88920*h1) - 332424*b8*a6 + 213408*h0*a4) + c5*(h0*(397176*c4 - 219336*a6 - 136344*f4D) - Delta*(725192*c17 + 158080*c15) + c9*(201552*b5 + 21736*h4) - 148200*f0D*h4) + c6*(h0*(253344*f5D - 747136*a5) + Delta*(56992*c14 + 3320512*c16) - f1D*(39624*b5 + 499408*a7) + 196352*h5*c9) + f1D*(189696*h6*h0 + h5*(71136*h1 - 82992*f1D) - 2736*h4*h2) - h1*(195624*b8*b5 - 11856*h5*h1 - 2736*h4*h2) + c16*Delta*(1849536*f2D - 5975424*a9) + 640224*f5D*f0D*b8)*INV213408 + (j0*a18 + j1*b18 + j2*c18);
d19 := (c8*(f3D*(161280*a9 - 30720*f2D - 145920*c6 + 2343345*c7) + c8*(1488420*c4 - 3587400*b5 + 322560*f4D) - f2D*(30720*b6 + 199680*c5 + 284160*b7) + c7*(5539185*b6 + 691191*h3) + f1D*(510720*b5 - 7074540*a7) - 15360*f5D*h0 + 996480*b8*b7 + 10958040*c16*Delta + 866880*a9*c5 + 1586340*h1*a7) + f1D*(f1D*(130560*b5 + 2453760*a7 - 215040*c4) + a9*(158400*b7 - 2588160*c5 - 11520*f3D) - c7*(680388*f3D + 2668740*b6 + 191292*h3) + f2D*(61440*c5 - 46080*b7) - 2780160*c16*Delta - 384000*b8*b7 + 7680*c6*b6 + 161280*f0D*a5) + c7*(h0*(69892224*c4- 131227776*a7- 33135744*a6 - 3661632*f4D) + a9*(4174608*b8 + 3304896*a9 - 2843904*f2D) + b8*(129696*b8 + 2325504*f2D) + f0D*(74365920*a7 - 13811968*f4D - 20964800*h4) - Delta*(2124480*c15 + 2182800*c17) + 34296960*c9*b5) + f0D*(c5*(552960*b6 - 2407680*b7 + 2313600*c5) + c6*(18504000*a7 - 46080*f4D + 568320*b5 + 9398400*c4) + a7*(35443200*h2 - 59031360*b8) + a9*(138240*f4D - 8559360*c4)) + a9*(c6*(15360*f2D + 81600*a9 - 76800*b8) + 2525760*h1*b7 - 184320*c15*Delta- 1411200*h0*b5 - 1558080*c9*a7) + h0*(b7*(1075200*f3D - 122880*b6 - 439680*b7) + 34560*c9*a4 - 15360*h3^2 - 764160*c6*a7) - c9*(c5*(608640*c5 - 2079360*b7) + 702720*c6*b5) + c6*Delta*(84480*c15 + 1265280*c17) )*INV103680 + (j0*a19 + j1*b19 + j2*c19);
ai := [a0,a1,a2,a3,a4,a5,a6,a7,a8,a9,a10,a11,a12,a13,a14,a15,a16,a17,a18,a19];
bi := [b0,b1,b2,b3,b4,b5,b6,b7,b8,b9,b10,b11,b12,b13,b14,b15,b16,b17,b18,b19];
ci := [c0,c1,c2,c3,c4,c5,c6,c7,c8,c9,c10,c11,c12,c13,c14,c15,c16,c17,c18,c19];
di := [d0,d1,d2,d3,d4,d5,d6,d7,d8,d9,d10,d11,d12,d13,d14,d15,d16,d17,d18,d19];
return [ai,bi,ci,di], [j0,j1,j2,Delta^2];
end function;
function get_codomain_curve_polynomial(rst)
r,s,t := Explode(rst);
Kx<x> := PolynomialRing(Parent(r));
e1 := s;
e2 := t;
e3 := r - 1;
e4 := r - t;
e5 := r*s - s*t - 1;
e6 := r^2 - t;
Delta := (e1*e3*e6)^2 + e5*(e3*e6*(e1*e4 + e5) + e4^2*e5);
Gco := Delta*( (s - s*t - 1)*x^3 + 3*s*e4*x^2 + 3*r*s*e4*x + r^3*s - s*t^2 - t );
Hco := e3*e5*x^2 + (r^3*s - 2*r^2*s + r*s*t + r - s*t^2 + s*t - t)*x - e5*e6;
lambdaco := 4*Delta*s*t;
Fco := Gco^2 + lambdaco*Hco^3;
return -3*Fco;
end function;
function BFT_evaluation(kernel, points)
/*
Input: a (3,3)-subgroup kernel of a Jacobian (not in BFT parametrization), and auxiliary points (on the Kummer) to evaluate the isogeny at
Output: a new Jacobian J (not in BFT parametrization), as well as the images of the auxiliary points under the isogeny
*/
J := Parent(kernel[1]);
C := Curve(J);
f := HyperellipticPolynomials(C);
rst, transform := get_rst_transform(kernel);
a,b,c,d,e := Explode(transform);
transform_points := apply_transformation([d,-b,-c,a,1/e^2], points, f, rst);
fnew := get_codomain_curve_polynomial(rst);
Cnew := HyperellipticCurve(fnew);
Jnew := Jacobian(Cnew);
Knew := KummerSurface(Jnew);
ai, bi, ci, di := Explode(get_codomain_Kummer_coefficients(rst));
codomain_points := [];
for pt in transform_points do
k0, k1, k2, k3 := Explode(Eltseq(pt));
ki := [k3^3, k2*k3^2, k1*k3^2, k0*k3^2, k2^2*k3, k1*k2*k3, k0*k2*k3, k1^2*k3, k0*k1*k3, k0^2*k3,
k2^3, k1*k2^2, k0*k2^2, k1^2*k2, k0*k1*k2, k0^2*k2, k1^3, k0*k1^2, k0^2*k1, k0^3];
xi0 := &+[ai[j]*ki[j] : j in [1..#ki]];
xi1 := &+[bi[j]*ki[j] : j in [1..#ki]];
xi2 := &+[ci[j]*ki[j] : j in [1..#ki]];
xi3 := &+[di[j]*ki[j] : j in [1..#ki]];
Append(~codomain_points, Knew ! [xi0,xi1,xi2,xi3]);
end for;
return Jnew, codomain_points;
end function;
function hash_new(message, B);
J := Parent(B[1]);
kernel := kernel_generators_from_message(message, B);
n := exp3;
pos := 1;
indices := [0];
pos := 1;
kernel_aux := [KummerSurface(J) ! P : P in kernel];
indices := [0];
for i := 0 to n-1 do
gap := n-i-1 - indices[pos];
if gap eq 0 then
kernel2 := [Points(J, D)[1] : D in kernel_aux[2*pos-1..2*pos]];
if not indices[pos] eq 0 then
Prune(~indices);
Prune(~kernel_aux);
Prune(~kernel_aux);
pos -:= 1;
end if;
elif gap eq 1 then
kernel2 := [3*Points(J, D)[1] : D in kernel_aux[2*pos-1..2*pos]];
if not indices[pos] eq 0 then
Prune(~indices);
Prune(~kernel_aux);
Prune(~kernel_aux);
pos -:= 1;
end if;
else
new_ind := indices[pos] + Floor(gap/2);
new_aux := kernel_aux[2*pos-1..2*pos];
new_aux := [3^Floor(gap/2)*Points(J, P)[1] : P in new_aux];
Append(~indices, new_ind);
kernel_aux cat:= [KummerSurface(J) ! D : D in new_aux];
pos +:= 1;
new_aux := [3^Ceiling(gap/2)*D : D in new_aux];
kernel2 := new_aux;
end if;
J, kernel_aux := BFT_evaluation(kernel2, [KummerSurface(J) ! P : P in kernel_aux]);
end for;
return G2Invariants(Curve(J));
end function;
B := get_start_Jacobian_and_symplectic_base(p);
message := Intseq(Random([1..3^(3*exp3)]), 3^exp3);
time h := hash_new(message, B);
print h;