On Bilinear Structures on Divisor Class Groups

It is well known that duality theorems are of utmost importance for the arithmetic of local and global ﬁelds and that Brauer groups appear in this context unavoidably. The key word here is class ﬁeld theory. In this paper we want to make evident that these topics play an important role in public key cryptopgraphy, too. Here the key words are Discrete Logarithm systems with bilinear structures. Almost all public key crypto systems used today based on discrete logarithms use the ideal class groups of rings of holomorphic functions of aﬃne curves over ﬁnite ﬁelds F q to generate the underlying groups. We explain in full generality how these groups can be mapped to Brauer groups of local ﬁelds via the Lichtenbaum-Tate pairing, and we give an explicit description. Next we discuss under which conditions this pairing can be computed eﬃciently. If so, the discrete logarithm is transferred to the discrete logarithm in local Brauer groups and hence to computing invariants of cyclic algebras. We shall explain how this leads us in a natural way to the computation of discrete logarithms in ﬁnite ﬁelds. To end we give an outlook to a globalisation using the Hasse-Brauer-Noether sequence and the duality theorem ot Tate-Poitou which allows to apply index-calculus methods resulting in subexponential algorithms for the computation of discrete logarithms in ﬁnite ﬁelds as well as for the computation of the Euler totient function (so we have an immediate application to the RSA-problem), and, as application to number theory, a computational method to “describe” cyclic extensions of number ﬁelds with restricted ramiﬁcation. This report is based on a lecture given at the conference Algèbre, Théorie des


DL-systems
Let be a prime number and A a group of order such that i): the elements in A are presented in a compact way, for instance by O(log( )) bits, ii): it is easy to implement the group composition • such that it is very fast, for instance has complexity O(log( )), but iii): to compute, for randomly chosen elements g 1 , g 2 ∈ A, a number k ∈ Z such that g k 2 = g 1 (the discrete logarithm problem (DLproblem)) is hard.
In the ideal case this complexity were exp(O(log( ))).This is obtained in black box groups, and, as we hope, in certain groups related to elliptic curves and abelian varieties.
In many cases one gets a weaker result: The complexity is subexponential, and this forces to take the parameters larger to get security.
Typical examples are systems related to the multiplicative group of quotients of rings of integers ("classical" DL).
A group (A, •) satisfying conditions i),ii) and iii) is called a DL-system.

Bilinear Structures
Let (A, •) be a DL-system.
Definition 1.1.Assume that there are Z-modules B and C and a bilinear map Q : A × B → C with i): the group composition laws in A, B and C as well as the map Q can be computed rapidly (e.g. in polynomial time).
ii): Q(., .) is non-degenerate in the first variable.Hence, for random b ∈ B we have Then we call (A, Q) a DL-system with bilinear structure.
Remark 1.2.One is used to describe bilinear maps on free modules by matrices whose entries consist of the values of pairs of elements in fixed bases.This is not enough for our purposes.
For instance assume that A = B is a cyclic group with n elements with generator P 0 and take C = Z/n.
Choose m ∈ Z prime to n.Let be the pairing determined by Q m (P 0 , P 0 ) := m + nZ.
Without further information the computation of Q m (P, Q) is equivalent with the Discrete Logarithm in A. So, though from the algebraic point of view pairings are "everywhere" it is much harder to find DL-systems with bilinear structure.One source is delivered by duality theorems in Arithmetic Geometry.

Some applications of bilinear structures
There are destructive aspects which may weaken DL-systems if they carry a bilinear structure.
Here is one.
: The DL-system (A, •) is at most as secure as the discrete logarithm in (C, •) [6].
For more information the interested reader is advised to visit Paulo Barretos Pairing Based Crypto Lounge.

Discrete Logarithms in class groups
Let O be an integral domain with quotient field F .The group of invertible ideals of O is denoted by I(O).Principal ideals are invertible ideals of the form f • O =: (f ) with f ∈ F * .They form a subgroup Princ(O) of I(O).
The quotient group I(O)/Princ(O) is denoted by Pic(O).

Ideal classes of function rings
In the following we take for O the ring of holomorphic functions of an affine curve C O defined over a field K.
We allow singularities of a restricted type interesting for cryptological applications: We assume that there is only one singular point and that the conductor ideal m of this point is square free.
Let O denote the ring of holomorphic functions on the desingularisation Let C be the projective irreducible regular curve with affine part C.
We extend scalars and interpret C O as well as C and C as curves defined over the separable closure K s of K with corresponding ring of holomorphic functions. 1e denote by T ∞ the set C(K s ) \ C(K s ) and we assume that there is an K-rational point P ∞ in T ∞ .
By S we denote the set of points in C which correspond to the singular point on C O .
The absolute Galois group G K := Aut K (K s ) of K acts on the points of C O , C and C as well as on T ∞ and S and on functions, ideals and ideal classes in a natural way.
By the theory of Generalized Jacobians and using the Approximation Theorem we relate the ideal class groups of the rings of functions to the points of the Jacobian variety J C of C by the following exact sequences of Galois modules.Theorem 2.1.We have the exact sequences of Galois modules For more details see [19] and [21].

The Lichtenbaum pairing
The sequences in Theorem 2.1 are exact G K -module sequences and so we can apply Galois cohomology. 2

The regular "complete" case
Assume first that C O is regular and The map δ 1 can be given explicitly. Take and choose ).We have some choices.
As result we can assume that the function f (σ 1 , σ 2 ) has neither zeros nor poles in finitely many given points P ∈ C. Definition 3.1.The Lichtenbaum pairing( [14]) is, as Galois module, isomorphic to J C (K s ) with J C the Jacobian variety of C, we get the pairing Let L by a cyclic extension of K of degree n and let τ be a generator of G(L/K).We denote by Pic(O L ) the ideal class group of the ring of holomorphic functions on C × L, the curve obtained from C by base extension from K to L. Let In other words: we can identify 1-cocycles from G(L/K) to Pic(O L ) with elements c ∈ Pic(O L ) whose trace is equal to 0. Now choose an ideal D ∈ c and D(τ j ) : P prime to the set of zeroes and poles of f D and of degree 0, ie.z P = 0.
Then T L (a, z) ∈ H 2 (G(L/K), L * ) is presented by the cocycle η(τ i , τ j ) = 1 for i + j < n and η(τ i , τ j ) = This is a cocycle defining a cyclic algebra with center K and splitting field L, see Example 5.8.

The Lichtenbaum-Tate pairing
Take n ∈ N prime to char(K).By using the Kummer sequence the Lichtenbaum pairing induces the "Lichtenbaum pairing modulo n" The Tate pairing [22].Let A be an abelian variety with dual abelian variety A [17]. Then , and the pairing is made explicit by the Weil pairing w n .
The cup product composed with w n induces a pairing Using the Kummer sequence for A 0 → A(K)/nA(K) and the corresponding one for A one maps A(K) and A(K) to the group Fact: δ 0 (A(K)) is orthogonal with respect to w 1 n to δ 0 ( A(K)).Hence w 1 n induces the Tate pairing

Theorem 3.3. (Lichtenbaum)[14]
For Jacobian varieties the pairing T L,n is up to a sign equal to the Tate pairing T n .
The pairing T L,n is called the Lichtenbaum-Tate pairing.
G. Frey

The regular affine case
A first application of Theorem 3.3 is the definition of the Lichtenbaum-Tate pairing pairing when T ∞ contains more than one element.
We want to define a pairing for Pic(O) with H 1 (G K , Pic(O)) which generalizes the pairing T L,n defined for the complete case.
Using the sequence But the map from F to Princ(O) has as kernel the group of functions U T∞ which have no poles and zeroes outside of T ∞ .Hence the evaluation of elements of the image of δ 1 at points on C \ T ∞ is not well defined.
On the other side H 0 (G K , Pic(O)) is, in general, not equal to Pic(O) = ϕ(Pic(O P∞ )), and we can use the exact sequence For simplicity we assume that C T∞ is finite.(This is the interesting case for cryptography and the general case can be treated, too.) We apply an isogeny ψ to J C with C T∞ = kernel(ψ).By doing this we leave the world of Jacobian varieties.We achieve that Pic(O) is as G Kmodule isomorphic to the K s -rational points of an abelian variety.Using Theorem 3.3 we switch to the Tate pairing.In addition we have to use the functoriality of the Weil pairing with respect to isogenies.Finally we get Proposition 3.4.For natural numbers prime to char (K) the Tate-Lichtenbaum pairing induces a pairing T L,n with

The singular case
To make things not too complicated we assume that T ∞ = {P ∞ }.We recall the exact sequence Here T S is a torus determined by the conductor P ∈S m P and Pic(O P∞ ) = J C (K s ).
From this sequence we get the exact sequence and since H 1 (G K , T S (K s )) = 0 by Hilbert's theorem 90 we have the exact sequence as well as We can restrict the boundary map and we get a pairing as above but we cannot expect to get any information about T S (K).

Conclusion
Let O be the ring of holomorphic functions of an affine curve C O defined over K.
Theorem 3.5.For all n prime to char(K) we have defined the Tate-Lichtenbaum pairing Hence one can suspect that DL-systems based on divisor class groups of rings of holomorphic functions on curves over finite fields are endowed with a bilinear structure.(Note that in this case Pic(O) is finite and so iii): T L,n can be computed rapidly (for instance, in polynomial time).
One sees immediately that i) is not satisfied (over any field K) if C O has singularities, or (for any curve C) if K is a finite field which is the interesting case for cryptography since in this case H 2 (G K , (F q ) s ) = 0.
In the next section we shall describe how to overcome these difficulties.

p-adic lifting
We begin with O being the ring of holomorphic functions of an affine curve over a finite field F q .
We want to replace finite fields by local fields K with residue field F q , maximal ideal m p and normalized valuation w p , and geometric objects defined over F q by objects lifted in such a way that no information and no efficiency is lost.

Lifting of Galois groups
Let φ q be the Frobenius automorphism which acts by exponentiation by q and which generates topologically G Fq .
The maximal unramified extension of K is denoted by K nr .
There is a canonical lift of φ q to K nr also called the Frobenius automorphism and denoted by φ q , and this automorphism generates topologically the Galois group of K nr /K.(For computational aspects of this lifting see [1].) Algebraic extensions of K nr are totally ramified.Let n be a natural number prime to p, π a uniformizing element of K, i.e. w p (π) = 1.
L n := K nr (π 1/n ) is the unique ramified extension of K nr cyclic of degree n.
Choose a primitive n-th root of unity ζ n and denote by τ n the generator of G(L n /K nr ) which maps π 1/n to ζ n • π 1/n .Special case: Assume that n | (q −1).Then K(π 1/n ) is Galois over K, τ n and φ q commute and the maximal tamely ramified extension of K whose Galois group has exponent dividing n is the subfield of L n fixed by φ q n .

Lifting of curves
Let O be the ring of holomorphic functions of an affine curve C O defined over F q , with one singular point and corresponding desingularized curve C. Let S ⊂ C(F q s ) be the set of points associated with the singular point on C O defining the conductor m O = P ∈S m P of the singularity.We embed C into the projective nonsingular curve C. The set T ∞ is defined as C(F q s ) \ C(F q s ).
We denote by g 0 the genus of C. We state the following (rather elementary) facts from the reduction theory of curves respectively abelian varieties.

Theorem 4.1.
(1) There is a projective absolutely irreducible nonsingular curve C l over K and a Galois invariant set • The Jacobian of C l extends to its Néron model J C l over the spectrum Spec(O K ), the ring of integers of K, whose connected component J 0 := J 0 C l is a semi-abelian variety which has as special fiber the generalized Jacobian of We assume from now on that n is prime to q and to the number of connected components of the special fiber of J C l .
(2) Denote by O l the ring of holomorphic functions on C l \ T ∞ l .
• Pic(O l )/[n] Pic(O l ) and Pic(O)/[n] Pic(O) are canonically isomorphic.• There is a torus T l S defined over K of dimension | S | −1 with reduction T S such that the elements of order n in T l S are mapped to the elements of order n in T S and we have the exact sequence of finite abelian groups → 0 where U K are the units with respect to the valuation of K.
(4) The set T ∞ l can be chosen such that the subgroup C T∞ l , the subgroup of divisor classes generated by divisors of degree 0 with support in T ∞ l , is isomorphic to C T∞ .So we get the exact sequence Moreover there is an isogeny ψ of J C l defined over K with kernel isomorphic to Theorem 4.1 enables us to study all crypto systems based on ideal classes of curves over finite fields by using cohomology theory of local fields.
In most instances the situation will be rather simple.The curve C will be either non-singular (good reduction) or will have genus equal to zero (the toric case).
The set of missing points will often consist (e.g. in the case of C abcurves) of one point and so the group C T∞ is the trivial group.
The lift of curves in the toric case leads to the interesting theory of Mumford curves.Remark 4.2.It is important that all interesting objects can be lifted over K.This is so since n is prime to q and we are in the étale world.
The next important observation is that the finite modules defined over F q can be lifted to unramified Galois modules over K which play a special role in the cohomology theory of local fields [15].
Connected components and ramification.In Theorem 4.1 we have assumed that n is prime to the number of connected components of the special fiber of the Jacobian of the lifted curve.This is a very mild condition.On the one hand we have many choices for the construction of C l and we can do it such that this number is very small.On the other side the assumption is not really necessary; it only simplifies the formulation of Theorem 4.1 (which is long enough as it is).In certain cases it may be even desired to have an appropriate number of components which deliver torsion points on J C l which are not coming from points on Pic(O).
If, after the lifting, we extend K by a ramified extension L and if there was a singularity on C 0 then the group of connected components of the semi-abelian group scheme over O L will be multiples of the ramification index, and so there is a ramified part of the torsion group of J C l if there are singular points on C O .This makes the cohomology theory of Galois modules attached to torsion points much richer.
The Tate elliptic curve.Instead of proving the statements of Theorem 4.1 we give a simple but important example.
Example 4.3.We begin with the affine curve defined over F q and corresponding to We have T ∞ = {P ∞ } where P ∞ corresponds to the point (0, 1, 0) on the projective curve There is one singular point (0, 0) on C.This point corresponds to two points (we have two different tangents at this point) on the desingularization.It follows that Pic(O) is isomorphic to F * q .Let K be a local field with residue field F q and uniformizing element π, k ∈ N. Then is the affine part of an elliptic curve with reduction equal to C. It is a Tate curve with period Q with w p (Q) = k.The number of connected components in the special fiber is equal to k.The group of rational points E(K) is isomorphic to K * / < Q >, and we get the exact sequence and all the assertions of the Theorem 4.1 can be checked immediately.

Local duality
We state the local version of the fundamental duality theorem for (finite) Galois modules (cf.[22] and [15]) 3 .Let K be a local field and A a finite G K -module of order n prime to the characteristic of the residue field of K. Let A be the Cartier dual Hom(A, µ n ) of A (where µ n is the Galois module consisting of the n-th roots of unity in K s ).

G. Frey
We apply this to A = Z/n.Its dual is µ n .We get for i = 0 a nondegenerate pairing . The Kummer sequence for K * s and Hilbert's theorem 90 imply that We shall make this isomorphism "inv" explicit (which does not mean "computable"!).
The interesting consequence of the duality theorem in our context is For every natural number n the Lichtenbaum-Tate pairing

H 1 (G K , Pic(O))[n]
We recall that Pic(O) is G K -isomorphic to A(K s ) where A is an abelian variety defined over K and isogenous to J C .Moreover A extends to a group scheme over the rings of integer of K, its Néron model whose connected component of the unity is a semi-abelian variety.We continue to assume that n is prime to the characteristic of the residue field of K and to the number of connected components of the special fiber of A 4 .
Hence via restriction of cocycles we can embed H 1 (G K , Pic(O)) into H 1 (G Knr , Pic(O)), and the image is contained in the subgroup of elements which are φ q -invariant (φ q acts by conjugation on G Knr ).
It is known that elements in H 1 (G K , P ic(O))[n] are split by extensions of exponent n, and so H 1 (G K , P ic(O))[n] can be considered as subgroup of H 1 (G(L n /K nr ), Pic(O Knr )) with L n := K nr (π 1/n ).
We state this as a lemma.

Lemma 5.4. Let O be the ring of holomorphic functions of a regular affine curve, and let A be an abelian variety with
Assume that n ∈ N is prime to the characteristic of the residue field of K and to the number of connected components of the Néron model of A.
Then H 1 (G K , P ic(O))[n] can, via restriction, be identified with the subgroup of Hence the Frobenius automorphism φ q acting by conjugation on τ sends τ to τ q .( q is the value of the cyclotomic character applied to φ q .)Using this one can determine H 1 (G K , P ic(O))[n] in all concrete cases.Here are two examples.
First assume that J C and hence A has good reduction.This is true if the affine curve C O is the lift of a regular curve over F q .In this case and hence Proposition 5.5.Let K be a local field with residue field F q .We assume that O is the ring of holomorphic functions of a regular affine curve which is the lift of a regular curve over F q .
Let n be prime to q.Let Pic(O)[n] (q) be the subgroup in Pic(O)[n] consisting of elements c with φ q (c) = q • c. Then ), and so, non-canonically since depending on the choice of τ , to Pic(O)[n] (q) .Corollary 5.6.The assumptions are as in the Proposition 5.5.
ii): Let L be any extension field of K totally ramified of degree n. Then

G. Frey
For general curves C O it is more complicated to describe the result.One reason is that the torus part of the special fiber of J C need not be split.A complete treatment is possible in principle but not in the frame of this survey.So we restrict ourselves to take as rings O the holomorphic functions on Tate elliptic curves given by affine equations Since only one point is missing we get that We assume that n is prime to m.Then E Q (K) contains elements of order n iff ζ n ∈ K, and hence by duality and in this case it is cyclic of order n.
So we assume that ζ n ∈ K.
We take a special cyclic extension of degree n, namely be any point of order n which is not K-rational, and let ζ be the cocycle from is cyclic of order n and generated by the class of ζ.

H
For the moment let K be any field of characteristic prime to n.
The second cohomology group of K * s plays a very important role in the arithmetic of K and is called the Brauer group Br(K) of K.
Its elements can be identified with classes of central simple algebras with center K.The group composition is the tensor product, and the trivial class consists of all algebras which are isomorphic to full matrix algebras over K (for details see [18]).
Because of Hilbert's theorem 90 one sees that for L/K Galois the inflation map from H 2 (G(L/K), L * ) to Br(K) is injective.
For any L/K the restriction map from Br(K) to Br(L) corresponds to base field extension applied to algebras, and its kernel consists of the classes of algebras which become, after tensoring with L, isomorphic to full matrix algebras.In this case L is called a splitting field of K.
Example 5.8.Cyclic algebras Assume that L/K is cyclic extension of degree n.
H 2 (G(L/K), L * ) consists of classes of cyclic algebras with 2-cocycles given in the following way: let σ be a generator of G(L/K) and take a in defines a 2-cocycle.The cocycles f σ,a and f σ,a are in the same cohomology class if and only if a • a −1 ∈ N L/K (L * ).We denote the corresponding class of cyclic algebras by (L, σ, a Recall that a cyclic algebra occurred in Example 3.2 as result of the Lichtenbaum-Tate pairing.

Brauer groups of local fields
Let K be a local field with residue field F q , and let n be prime to q.
Because of the local duality theorem we know already that Br(K)[n] ∼ = Z/n.

The unramified case: the invariant
Let L u be the unique unramified extension of K of degree n.It is cyclic.
G(L u /K) has as canonical generator a lift of the Frobenius automorphism φ q of F q .
Elements c ∈ H 2 (G(L u /K), L * u ) are represented by cyclic algebras.We use Example 5.8 and represent c by a triple ii): The map inv K : is defined as follows: with inf Lu/Ks (c 0 ) = c and represent c 0 by the triple (L u , φ q , a • N Lu/K (L * u )).Then inv K (c) := w p (a) mod n is well defined, determines c uniquely, and defines an isomorphism Remark 5.11.Though the invariant is defined in a seemingly very explicit way for cyclic algebras split by unramified extensions it may be difficult to compute it even in this case.To see this assume that τ is another generator of G(L u /K) and the cyclic algebra representing c is given by the triple We know that there exists k ∈ Z with So we have to determine k, and this is a discrete logarithm problem.For example, assume that Hence k has to satisfy which is a discrete logarithm problem in F * q .

The tamely ramified case
Let L n a totally ramified Galois extension L n of degree n of K.It follows that L n /K is cyclic and that K contains the n-th roots of unity.Let τ be a fixed generator of G(L n /K).
. Proposition 5.12.Assume that a 1 , a 2 ∈ F q are given.Then Corollary 5.13.The computation of discrete logarithms in the multiplicative group of finite fields is equivalent with the computation of invariants of cyclic algebras split by ramified extensions.

The Frobenius case
The most important case for applications is that c ∈ Br(K) is represented as algebra split by an extension L of K which is totally ramified of degree n but which becomes Galois only after adjoining the n-th roots of unity.This is exactly the situations which occurs when one applies the Lichtenbaum-Tate pairing.
At the moment a description useful for algorithmic purposes is only available if one restricts c to K(ζ n ) and then uses the results obtained for cyclic ramified extensions over K(ζ n ) instead of K. Hence one has to pass to a field which will be, in general, much larger than K! It is a challenge to do better.

The pairing
Having information about the groups involved in the Lichtenbaum-Tate pairing we give this pairing now in an explicit way, first over local fields, and then, in order to apply it to cryptography, over finite fields.

Explicit description of the Lichtenbaum-Tate pairing
The pairing over local fields.We continue to assume that K is a local field with residue field F q .Though the general case is interesting we restrict ourselves to the case that the curve C has good reduction (hence is the lift of a nonsingular curve C 0 over F q ) and that only one point "at infinity" is missing on C O .So we have a non-degenerate pairing Let k be the smallest number with k is called the "embedding degree".
Define K(ζ n ) := K n .It is a local field with residue field F q k .
We choose a uniformizing element π ∈ K and define L := K n (π 1/n ) and take τ as generator of G(L/K n ).
As seen in Subsection 5.1 we can identify ) with the group of homomorphisms ϕ ∈ Hom(G K , J C (K n )[n]) with ϕ(τ ) = P and φ q (P ) = q • P .
Hence we are in the situation described already in Example 3.2 and have only to repeat the construction made there.
Take c ∈ H 1 (G K , J C (K s )) and corresponding ϕ with ϕ(τ ) = P .Let nP = (f P ) and assume that a representative As seen in Subsection 5.2.3 we can interpret T L,n as pairing with values in F * q k /(F * q k ) n .Hence we get a pairing ) n which is non-degenerate on the right side and has radical nJ C (K) on the left side.
The pairing over finite fields.We can look at the result above modulo m p and get an explicit description of the Tate-Lichtenbaum pairing in the case of good reduction which only uses objects attached to the curve modulo m p .Theorem 5.14.Assume that C is a projective irreducible non-singular curve define over F q .Then we get a pairing ) n which is non-degenerate on the right side and has radical nJ C (F q ) on the left side.

Evaluation
To get a bilinear structure on class groups of rings attached to holomorphic functions on curves over finite fields there is a last step to be done.One has to show that the computation of the pairing is fast.
To compute T n one has to evaluate a divisor D on C defined over F q by a function f P contained in the function field F • F q k .A naive approach is, because of the high degrees needed in practice, not possible.
The way out was found by V. Miller [16] for elliptic curves (applied to the Weil pairing).The general method uses as background the theory of Mumford's Theta groups which describe extensions of (finite subgroups of) abelian varieties by linear groups.It was developed in [10], for elliptic curves we refer to [9].
The basic step for the computation is: for given positive divisors A 1 , A 2 of degree g find a positive divisor A 3 of degree g and a function h on C such that One has to repeat such an step O(log(n)) times and one has to compute in F q k .For more details and shortcuts we refer to [1] (and many publications in recent time).

Bilinear structures on divisor classes
Let O be the ring of holomorphic functions of an affine curve over a finite field F q .
Let n be a number prime to q, and let k be the smallest number such that n | q k − 1.
Theorem 6.1.The Lichtenbaum-Tate pairing induces a bilinear structure on Pic(O) of complexity O(k • log(q)) with value group Br(K).Corollary 6.2.The discrete logarithm in Pic(O) is reduced to the discrete logarithm with costs O(k • log(q)) in Br(K) and hence to the computation of invariants in Br(K), or alternatively, to the computation of discrete logarithms in To apply these results (and to have a bilinear structure in the strong sense) it is necessary that k is not too big.
In particular, for the constructive applications it is necessary to have an embedding degree ∼ 12 • g.It is a very nice problem in computational number theory to find such k.For elliptic curves see for example [2] and [3].
But for g > 1 nearly nothing is known if J C is not supersingular.
A successful approach to this problem could be interesting since one can speed up the computation of T n by a factor g in interesting protocols, see [8].

An Index-Calculus approach for the computation of invariants
In the previous chapters the role of Brauer groups of local fields was explained.In particular, the importance of invariants of elements in Br(K) for discrete logarithms was emphasized.By passing from local fields to global fields we can again use the basic duality theorem of Tate, but now in a global version.For a precise formulation see [15].
So let K be a global field, i.e.K is either a finite algebraic extension of Q or a function field of one variable over a finite field F q .
Let p be a non-archimedean place of K with normalized valuation w p .Let K p be the completion of K with respect to p. Its Galois group G p can be identified with a subgroup of G K , namely the decomposition group of an extension p of p to K s .
The restriction map to G p is denoted by ρ p .For c ∈ Br(K) define inv p (c) := inv Kp (ρ p (c)).
A consequence of the global duality theorem is the sequence of Hasse-Brauer-Noether. Theorem 7.1.Let K be a global field and n ∈ N odd and prime to char(K).
The sequence We shall use an obvious consequence: Corollary 7.2.Let m be an ideal (m = O K allowed) in O K , the ring of integers of K. We assume that there is a cyclic extension L of odd degree n of K which is unramified outside of the set T m of prime ideals dividing m.
Let τ be a generator of G(L/K).For p / ∈ T m let φ p be a Frobenius automorphism at p in G(L/K).By f p we denote a number for which τ fp = φ p holds.Then for all elements a ∈ K * we have  More details can be found in [7].

Index-Calculus in global Brauer groups
We search for algorithms to determine the numbers f p which characterize the Frobenius automorphisms at places p of K related to cyclic extensions with conductor dividing an ideal m.
A possible method to do this (with subexponential complexity) is an index-calculus algorithm of the type one is used to see in factorization algorithms.

Example: K = Q
Take K = Q.The congruence in Corollary 7.2 can be seen as solution of a system of linear equations relating the variables f p for p prime to m and inv p (A) for p | m.
We want to use numbers a with w q (a) = 0 only for q < B. Let d be the smallest number ≥ √ m.

G. Frey
For small δ take a

Construction of elements in the Brauer group
Motivated by index-calculus and for theoretical reasons, too, we are looking for more methods to construct elements in the Brauer group of number fields.The theoretical background for the success (or failure) is another consequence of the global duality theorem, namely the duality theorem of Tate-Poitou [15].As methods to construct such elements of a very well controlled arithmetical nature one can try to use i) pairings with Dirichlet Characters ( [11]), or ii) pairings with Principal Homogenous Spaces of abelian varieties instead of using the multiplicative group , or iii) Cassel's pairing using Tate-Shafarevich groups and ending in the second cohomology group of the idele class group which is the right global object corresponding to local Brauer group.

Theorem 5 . 1 .
(Duality Theorem of Tate) For 0 ≤ i ≤ 2 the cohomology groups H i (G K , A) are finite and the evaluation pairing induces nondegenerate pairings

Theorem 5 . 3 .
(Tate-Lichtenbaum) Let K be a local field, C O an affine regular curve over K with ring of holomorphic functions O.
where w p is the normalized valuation in p and A is the cyclic algebra (L, τ, a) over K.

7. 1 .
ApplicationsIf we can compute (enough of) the numbers f p we can compute i): the order of ray class groups of K with conductor m, in particular Euler's totient function ϕ(m)ii): the discrete logarithm in F * q and iii): get a very subtle description of cyclic extensions of K.