Prime Numbers

7.2 Elliptic arithmetic 323
the point at infinity, is a number that gives rise to fascinating and profound
issues. Indeed, the question of order will arise in such domains as primality
proving, factorization, and cryptography.
We define elliptic multiplication by integers in a natural manner: For point
P ∈ E and positive integer n, we denote the n-th multiple of the point by
[n]P = P + P + ···+ P,
where exactly n copies of P appear on the right. We define [0]P as the group
identity O, the point at infinity. Further, we define [−n]P to be −[n]P .From
elementary group theory we know that when F is finite,
[#E(F )]P = O,
a fact of paramount importance in practical applications of elliptic curves.
This issue of curve order is addressed in more detail in Section 7.5. As regards
any group, we may consider the order of an element. In an elliptic-curve group,
the order of a point P is the least positive integer n with [n]P = 0, while if
no such integer n exists, we say that P has infinite order. If E(F ) is finite,
then every point in E(F ) has finite order dividing #E(F ).
The fundamental relevance of elliptic curves for factorization will be the
fact that, if one has a composite n to be factored, one can try to work
on an elliptic curve over Zn, even though Zn is not a field and treating it
as such might be considered “illegal.” When an illegal curve operation is
encountered, it is exploited to find a factor of n. This idea of what we might
call “pseudocurves” is the starting point of H. Lenstra’s elliptic curve method
(ECM) for factorization, whose details are discussed in Section 7.4. Before we
get to this wonderful algorithm we first discuss “legal” elliptic curve arithmetic
over a field.
7.2 Elliptic arithmetic
Armed with some elliptic curve fundamentals, we now proceed to develop
practical algorithms for elliptic arithmetic. For simplicity we shall adopt a
finite field Fp for prime p>3, although generally speaking the algorithm
structures remain the same for other fields. We begin with a simple method
for finding explicit points (x, y) on a given curve, the idea being that we
require the relevant cubic form in x to be a square modulo p:
Algorithm 7.2.1 (Finding a point on a given elliptic curve). For a prime
p>3 we assume an elliptic curve E(Fp) determined by cubic y 2 = x 3 + ax + b.
This algorithm returns a point (x, y) on E.
1. [Loop]
Choose random x ∈ [0,p− 1];
t =(x(x2 + a)+b) modp; //Affinecubicforminx.
if(
t
p == −1) goto [Loop]; // Via Algorithm 2.3.5.
return (x, ± √ t mod p); // Square root via Algorithm 2.3.8 or 2.3.9.