Prime Numbers

7.5 Counting points on elliptic curves 357
impressive performance. Atkin, for example, used such enhancements to find
in 1992, for the smallest prime having 200 decimal digits, namely
p = 10000000000000000000000000000000000000000000000000\
00000000000000000000000000000000000000000000000000\
00000000000000000000000000000000000000000000000000\
00000000000000000000000000000000000000000000000153,
and the curve over Fp governed by the cubic
a point order
Y 2 = X 3 + 105X + 78153,
#E = 10000000000000000000000000000000000000000000000000\
00000000000000000000000000000000000000000000000000\
06789750288004224118080314365460277641928049641888\
39991591392960032210630561760029050858613689631753.
Amusingly, it is not too hard to agree that this choice of curve is “random”
(eveniftheprimep is not): The (a, b) = (105, 78153) parameters for this curve
were derived from a postal address in France [Schoof 1995]. Subsequently,
Morain was able to provide further computational enhancements, to find an
explicit order for a curve over Fp, withp a 500-decimal-digit prime [Morain
1995].
Most recently, A. Enge, P. Gaudry, and F. Morain were able to count the
points on the curve
y 2 = x 3 + 4589x + 91128
over Fp with p =10 1499 + 2001 being a 1500-digit prime. These researchers
used new techniques—not yet published—for generating the relevant SEA
modular equations efficiently.
In this treatment we have, in regard to the powerful Schoof algorithm and
its extensions, touched merely the tip of the proverbial iceberg. There is a great
deal more to be said; a good modern reference for practical point-counting on
elliptic curves is [Seroussi et al. 1999], and various implementations of the
SEA continuations have been reported [Izu et al. 1998], [Scott 1999].
In his original paper [Schoof 1985] gave an application of the pointcounting
method to obtain square roots of an integer D modulo p in (not
random, but deterministic) polynomial time, assuming that D is fixed. Though
the commonly used random algorithms 2.3.8, 2.3.9 are much more practical,
Schoof’s point-counting approach for square roots establishes, at least for fixed
D, a true deterministic polynomial-time complexity.
Incidentally, an amusing anecdote cannot be resisted here. As mentioned
by [Elkies 1997], Schoof’s magnificent point-counting algorithm was rejected in
its initial paper form as being, in the referee’s opinion, somehow unimportant.