Prime Numbers

356 Chapter 7 ELLIPTIC CURVE ARITHMETIC
...]is2,whichiswhyweconsider[2](X, Y ).)Itturnsoutthatthelastpoint
here is indeed the elliptic sum of the two points previous, consistent with the
claim that t mod 3 = 1.
There is an important enhancement that we have intentionally left out for
clarity. This is that prime powers work equally well. In other words, l = q a
can be used directly in the algorithm (with the gcd for l = 2 ignored when
l =4, 8, 16,...) to reduce the computation somewhat. All that is required is
that the overall product of all prime-power values l used (but no more than
one for each prime) exceed 4 √ p.
We have been able to assess curve orders, via this basic Schoof scheme,
for primes in the region p ≈ 10 80 ,byusingprimepowersl < 100. It is
sometimes said in the literature that there is little hope of using l much
larger than 30, say, but with the aforementioned enhancements—in particular
the large-polynomial multiply/mod algorithms covered in Chapter 8.8—the
Schoof prime l can be pressed to 100 and perhaps beyond.
By not taking Algorithm 7.5.6 all the way to CRT saturation (that is,
not handling quite enough small primes l to resolve the order), and by then
employing a Shanks–Mestre approach to finish the calculation based on the
new knowledge of the possible orders, one may, in turn, press this rough
bound of 10 80 further. However, it is a testimony to the power of the Schoof
algorithm that, upon analysis of how far a “Shanks–Mestre boost” can take
us, we see that only a few extra decimal digits—say 10 or 20 digits—can be
added to the 80 digits we resolve using the Schoof algorithm alone. For such
reasons, it usually makes more practical sense to enhance an existing Schoof
implementation, rather than to piggyback a Shanks–Mestre atop it.
But can one carry out point counting for significantly larger primes?
Indeed, the transformation of the Schoof algorithm into a “Schoof–Elkies–
Atkin” (SEA) variant (see [Atkin 1986, 1988, 1992] and [Elkies 1991, 1997],
with computational enhancements in [Morain 1995], [Couveignes and Morain
1994], [Couveignes et al. 1996]) has achieved unprecedented point-counting
performance. The essential improvement of Elkies was to observe that for some
of the l (depending on a, b, p; in fact, for about half of possible l values), a
certain polynomial fl dividing Ψl but of degree only (l−1)/2 can be employed,
and furthermore, that the Schoof relation of (7.10) can be simplified. The
Elkies approach is to seek an eigenvalue λ with
(X p ,Y p )=[λ](X, Y ),
where all calculations are done mod (fl,p), whence #E = p +1− t with
t ≡ λ + p/λ (mod l).
Because the degrees of fl are so small, this important discovery effectively pulls
some powers of ln p off the complexity estimate, to yield O(ln 6 p) rather than
the original Schoof complexity O(ln 8 p) [Schoof 1995]. (Note, however, that
such estimates assume direct “grammar-school” multiplication of integers, and
can be reduced yet further in the power of ln.) The SEA ideas certainly give