Prime Numbers

342 Chapter 7 ELLIPTIC CURVE ARITHMETIC
in hand a precomputed, stored set of difference multiples [∆]Q =[X∆ : Z∆],
where ∆ has run over some relatively small finite set {2, 4, 6,...}; then a prime
s near to but larger than r can be checked as the outlying prime, by noting
that a “successful strike”
[s]Q =[r +∆]Q = O
can be tested by checking whether the cross product
XrZ∆ − X∆Zr
has a nontrivial gcd with n. Thus, armed with enough multiples [∆]Q, and
a few occasional points [r]Q, we can check outlying prime candidates with 3
multiplies (mod n) per candidate. Indeed, beyond the 2 multiplies for the cross
product, we need to accumulate the product (XrZ∆−X∆Zr) in expectation
of a final gcd of such a product with n. But one can reduce the work still
further, by observing that
XrZ∆ − X∆Zr =(Xr − X∆)(Zr + Z∆)+X∆Z∆ − XrZr.
Thus, one can store precomputed values X∆,Z∆,X∆Z∆, and use isolated
values of Xr,Zr,XrZr for well-separated primes r, to bring the cost of
stage two asymptotically down to 2 multiplies (mod n) per outlying prime
candidate, one for the right-hand side of the identity above and one for
accumulation.
As exemplified in [Brent et al. 2000], there are even more tricks for
such reduction of stage-two ECM work. One of these is also pertinent to
enhancement (3) above, and amounts to mixing into various identities the
notion of transform-based multiplication (see Section 9.5.3). These methods
are most relevant when n is sufficiently large, in other words, when n is in
the region where transform-based multiply is superior to “grammar-school”
multiply. In the aforementioned identity for cross products, one can actually
store transforms (for example DFT’s)
ˆXr, ˆ Zr,
in which case the product (Xr − X∆)(Zr + Z∆) now takes only 1/3 of
a (transform-based) multiply. This dramatic reduction is possible because
the single product indicated is to be done in spectral space, and so is
asymptotically free, the inverse transform alone accounting for the 1/3. Similar
considerations apply to the accumulation of products; in this way one can get
down to about 1 multiply per outlying prime candidate. Along the same lines,
the very elliptic arithmetic itself admits of transform enhancement. Under the
Montgomery parameterization in question, the relevant functions for curve
arithmetic degenerate nicely and are given by equations (7.6) and (7.7); and
again, transform-based multiplication can bring the 6 multiplies required for
addh() down to 4 transform-based multiplies, with similar reduction possible
for doubleh() (see remarks following Algorithm 7.4.4).