Prime Numbers

7.5 Counting points on elliptic curves 349
Now to Shanks’s application of the list intersection notion to the problem
of curve order. Imagine we can find a relation for a point P ∈ E, say
[p +1+u]P = ±[v]P,
or, what amounts to the same thing because −(x, y) =(x, −y) always,we
find a match between the x-coordinates of [p +1+u]P and vP. Such a match
implies that
[p +1+u ∓ v]P = O.
This would be a tantalizing match, because the multiplier here on the left
must now be a multiple of the order of the point P , and might be the curve
order itself. Define an integer W = p 1/4√ 2 . We can represent integers k
with |k| < 2 √ p as k = β + γW, whereβ ranges over [0,W − 1] and γ ranges
over [0,W]. (We use the letters β,γ to remind us of Shanks’s baby-steps and
giant-steps, respectively.) Thus, we can form a list of x-coordinates of the
points
{[p +1+β]P : β ∈ [0,...,W − 1]},
calling that list A (with #A = W ), and form a separate list of x-coordinates
of the points
{[γW]P : γ ∈ [0,...,W]},
calling this list B (with #B = W + 1). When we find a match, we can test
directly to see which multiple [p +1+β ∓ γW]P (or both) is the point at
infinity. We see that the generation of baby-step and giant-step points requires
O p 1/4 elliptic operations, and the intersection algorithm has O p 1/4 ln p
steps, for a total complexity of O p 1/4+ɛ .
Unfortunately, finding a vanishing point multiple is not the complete task;
it can happen that more than one vanishing multiple is found (and this is why
we have phrased Algorithm 7.5.1 to return all elements of an intersection).
However, whenever the point chosen has order greater than 4 √ p, the algorithm
will find the unique multiple of the order in the target interval, and this will
be the actual curve order. It occasionally may occur that the group has low
exponent (that is, all points have low order), and the Shanks method will never
find the true group order using just one point. There are two ways around
this impasse. One is to iterate the Shanks method with subsequent choices
of points, building up larger subgroups that are not necessarily cyclic. If the
subgroup order has a unique multiple in the Hasse interval, this multiple is
the curve order. The second idea is much simpler to implement and is based
on the following result of J. Mestre; see [Cohen 2000], [Schoof 1995]:
Theorem 7.5.2 (Mestre). For an elliptic curve E(Fp) and its twist E ′ (Fp)
by a quadratic nonresidue mod p, we have
#E +#E ′ =2p +2.
When p>457, there exists a point of order greater than 4 √ p on at least
one of the two elliptic curves E,E ′ .Furthermore,ifp>229, at least one