Prime Numbers

350 Chapter 7 ELLIPTIC CURVE ARITHMETIC
of the two curves possesses a point P with the property that the only integer
m ∈ (p +1− 2 √ p, p +1+2 √ p) having [m]P = O is the actual curve order.
Note that the relation #E +#E ′ =2p+2 is an easy result (see Exercise 7.16)
and that the real content of the theorem lies in the statement concerning a
singleton m in the stated Hasse range of orders. It is a further easy argument
to get that there is a positive constant c (which is independent of p and
the elliptic curve) such that the number of points P satisfying the theorem
exceeds cp/ ln ln p—see Exercise 7.17—so that points satisfying the theorem
are fairly common. The idea now is to use the Shanks method on E, andif
this fails (because the point order has more than one multiple in the Hasse
interval), to use it on E ′ , and if this fails, to use it on E, and so on. According
to the theorem, if we try this long enough, it should eventually work. This
leads to an efficient point-counting algorithm for curves E(Fp) whenp is up
to, roughly speaking, 10 30 . In the algorithm following, we denote by x(P )the
x-coordinate of a point P . In the convenient scenario where all x-coordinates
are given by X/Z ratios, the fact of denominator Z = 0 signifies as usual the
point at infinity:
Algorithm 7.5.3 (Shanks–Mestre assessment of curve order).
Given an elliptic curve E = Ea,b(Fp), this algorithm returns the order #E. For
list S = {s1,s2,...} and entry s ∈ S, we assume an index function ind(S, s) to
return some index i such that si = s. Also, list-returning function shanks() is
defined at the end of the algorithm; this function modifies two global lists A, B
of coordinates.
1. [Check magnitude of p]
if(p ≤ 229) return p +1+
x
3
x +ax+b
p ; // Equation (7.8).
2. [Initialize Shanks search]
Find a quadratic nonresidue g (mod p);
W = ⌈p 1/4√ 2⌉; // Giant-step parameter.
(c, d) =(g 2 a, g 3 b); // Twist parameters.
3. [Mestre loop] // We shall find a P of Theorem 7.5.2.
Choose random x ∈ [0,p− 1];
σ = x 3
+ax+b
p ;
if(σ == 0) goto [Mestre loop];
// Henceforth we have a definite curve signature σ = ±1.
if(σ == 1) E = Ea,b; // Set original curve.
else {
E = Ec,d;
x = gx; // Set twist curve and valid x.
}
Define an initial point P ∈ E to have x(P )=x;
S = shanks(P, E); // Search for Shanks intersection.
if(#S = 1) goto [Mestre loop]; // Exactly one match is sought.