Prime Numbers

354 Chapter 7 ELLIPTIC CURVE ARITHMETIC
of same. We now describe the latter representation, as it is well suited for
calculations involving division polynomials, especially in regard to the pointmultiplication
property in Theorem 7.5.5. We shall consider a point to be
P =(U/V,F/G), where U, V, F, G are all polynomials, presumably bivariate
in X, Y . There is an alternative strategy, which is to use projective coordinates
as mentioned in Exercise 7.29. In either strategy a simplification occurs, that
in the Schoof algorithm we always obtain any point in a particular form; for
example in the P =(U/V,F/G) parameterization option used in the algorithm
display below, one always has the form
P =(N(X)/D(X),YM(X)/C(X)),
because of the division polynomial algebra. One should think of these four
polynomials, then, as reduced mod Ψn and mod p, in the sense of item (2)
above. Another enhancement we have found efficient in practice is to invoke
large polynomial multiply via our Algorithm 9.6.1 (or see alternatives as in
Exercise 9.70), which is particularly advantageous because deg(Ψn) is so large,
making ordinary polynomial arithmetic painful. Yet more efficiency obtains
when we use our Algorithm 9.6.4 to achieve polynomial mod for these largedegree
polynomials.
Algorithm 7.5.6 (Explicit Schoof algorithm for curve order). Let p > 3
be a prime. For curve Ea,b(Fp) this algorithm returns the value of t (mod l),
where l is a prime (much smaller than p) and the curve order is #E = p +1− t.
Exact curve order is thus obtained by effecting this algorithm for enough primes
l such that l > 4 √ p, and then using the Chinese remainder theorem to
recover the exact value of t. We assume that for a contemplated ceiling L ≥ l
on the possible l values used, we have precomputed the division polynomials
Ψ−1,...,ΨL+1 mod p, which can be made monic (via cancellation of the high
coefficient modulo p) with a view to such as Algorithm 9.6.4.
1. [Check l =2]
if(l == 2) {
g(X) =gcd(X p − X, X 3 + aX + b); // Polynomial gcd in Fp[X].
if(g(X) ==1) return 0; // T ≡ 0(mod2), so order #E is even.
return 1; // #E is odd.
}
2. [Analyze relation (7.10)]
p = p mod l;
u(X) =Xp mod (Ψl,p);
v(X) =(X3 + aX + b) (p−1)/2 mod (Ψl,p);
// That is, v(X) =Y p−1 mod (Ψl,p).
P0 =(u(X),Yv(X)); // P0 =(Xp ,Yp ).
P1 =(u(X) p mod (Ψl,p),Yv(X) p+1 mod (Ψl,p));
// P1 =(Xp2,Yp2 ).
Cast P2 =[p](X, Y ) in rational form (N(X)/D(X),YM(X)/C(X)), for
example by using Theorem 7.5.5;