Prime Numbers

340 Chapter 7 ELLIPTIC CURVE ARITHMETIC
current point by every prime in (B1,q]. Instead, one can use the point
⎡
Q = ⎣
p ai
⎤
⎦
i P,
pi≤B1
which is the point actually “surviving” the stage-one ECM Algorithm 7.4.2,
and check the points
[q0]Q, [q0 +∆0]Q, [q0 +∆0 +∆1]Q, [q0 +∆0 +∆1 +∆2]Q,...,
where q0 is the least prime exceeding B1, and∆i are the differences between
subsequent primes after q0. The idea is that one can store some points
Ri =[∆i]Q,
once and for all, then quickly process the primes beyond B1 by successive
elliptic additions of appropriate Ri. The primary gain to be realized here
is that to multiply a point by a prime such as q requires O(ln q) elliptic
operations, while addition of a precomputed Ri is, of course, one operation.
Beyond this “stage-two” optimization and variants thereupon, one may
invoke other enhancements such as
(1) Special parameterization to easily obtain random curves.
(2) Choice of curves with order known to be divisible by 12 or 16 [Montgomery
1992a], [Brent et al. 2000].
(3) Enhancements of large-integer arithmetic and of the elliptic algebra itself,
saybyFFT.
(4) Fast algorithms applied to stage two, such as “FFT extension” which is
actually a polynomial-evaluation scheme applied to sets of precomputed
x-coordinates.
Rather than work through such enhancements with incremental algorithm
exhibitions, we instead adopt a specific strategy: We shall discuss the above
enhancements briefly, then exhibit a single, practical algorithm containing
many of said enhancements.
On enhancement (1) above, a striking feature our eventual algorithm will
enjoy is that one need not involve y-coordinates at all. In fact, the algorithm
will use the Montgomery parameterization
gy 2 = x 3 + Cx 2 + x,
with elliptic multiplication carried out via Algorithm 7.2.7. Thus a point
will have the general homogeneous form P = [X, any,Z] = [X : Z] (see
Section 7.2 for a discussion of the notation), and we need only track the
residues X, Z (mod n). As we mentioned subsequent to Algorithm 7.2.7, the
appearance of the point-at-infinity O during calculation on a curve over Fp,
where p|n, is signified by the vanishing of denominator Z, and such vanishing