Prime Numbers

352 Chapter 7 ELLIPTIC CURVE ARITHMETIC
to the coordinates of a point (x, y) ∈ E(Fp), takes this point to another
point in E(Fp). And since the rules for addition of points involve rational
expressions of the Fp-coefficients of the defining equation, this mapping is
seen to be a group automorphism of E(Fp). This is the celebrated Frobenius
endomorphism Φ. Thus, for (x, y) ∈ E(Fp), we have Φ(x, y) =(x p ,y p ); also,
Φ(O) =O. One might well wonder what use it is to consider the algebraic
closure of Fp when it is really the points defined over Fp itself that we are
interested in. The connection comes from a beautiful theorem: If the order of
the elliptic curve group E(Fp) isp +1− t, then
Φ 2 (P ) − [t]Φ(P )+[p]P = O
for every point P ∈ E(Fp). That is, the Frobenius endomorphism satisfies
a quadratic equation, and the trace (the sum of the roots of the polynomial
x 2 − tx + p) ist, the number that will give us the order of E(Fp).
A second idea comes into play. For any positive integer n, consider those
points P of E(Fp) forwhich[n]P = O. This set is denoted by E[n], and it
consists of those points of order dividing n in the group, namely, the n-torsion
points. Two easy facts about E[n] are crucial: It is a subgroup of E(Fp), and
Φ maps E[n] to itself. Thus, we have
Φ 2 (P ) − [t mod n]Φ(P )+[p mod n]P = O, for all P ∈ E[n]. (7.9)
The brilliant idea of Schoof, see [Schoof 1985], [Schoof 1995], was to use this
equation to compute the residue t mod n by trial and error procedure until the
correct value that satisfies (7.9) is found. To do this, the division polynomials
are used. These polynomials both simulate elliptic multiplication and pick out
n-torsion points.
Definition 7.5.4. To an elliptic curve Ea,b(Fp) we associate the division
polynomials Ψn(X, Y ) ∈ Fp[X, Y ]/(Y 2 − X 3 − aX − b) defined as follows:
Ψ−1 = −1, Ψ0 =0, Ψ1 =1, Ψ2 =2Y,
Ψ3 =3X 4 +6aX 2 +12bX − a 2 ,
Ψ4 =4Y X 6 +5aX 4 +20bX 3 − 5a 2 X 2 − 4abX − 8b 2 − a 3 ,
while all further cases are given by
Ψ2n =Ψn Ψn+2Ψ 2 n−1 − Ψn−2Ψ 2 n+1
Ψ2n+1 =Ψn+2Ψ 3 n − Ψ 3 n+1Ψn−1.
/(2Y ),
Note that in division polynomial construction, any occurrence of powers of
Y greater than the first power are to be reduced according to the relation
Y 2 = X 3 +aX +b. Some computationally important properties of the division
polynomials are collected here:
Theorem 7.5.5 (Properties of division polynomials). The division polynomial
Ψn(X, Y ) is, for n odd, a polynomial in X alone, while for n even it is