Prime Numbers

364 Chapter 7 ELLIPTIC CURVE ARITHMETIC
where u is the first number being squared in a given representation; yet there
will be more possible orders for the D = −3 case. To illustrate the detailed
algorithm workings, let us consider the case D = −499 above. Then in the
[Option: curve parameters] step we obtain
T−499 = 4671133182399954782798673154437441310949376
− 6063717825494266394722392560011051008x
+ 3005101108071026200706725969920x 2
+ x 3 .
Note that, as must be, the constant term in this polynomial is a cube. Now
this cubic can be reduced right away (mod p) to yield
S = T−499 mod p = 489476008241378181249146744
+ 356560280230433613294194825x
+ 1662705765583389101921015x 2
+ x 3 ,
but we are illustrating the concept that one could in principle prestore the
Hilbert class polynomials T−D ∈ Z[X], reducing quickly to S ∈ Fp[X]
whenever a new p is being analyzed. We are then to use Algorithm 2.3.10
to find a root j of S = T mod p. A root is found as
j = 431302127816045615339451868.
It is this value that ignites the curve parameter construction. We obtain
c = j/(j − 1728) mod p = 544175025087910210133176287,
and thus end up with two governing cubics (the required nonresidue g can be
taken to be −1 for this p):
y 2 = x 3 + 224384983664339781949157472x ± 469380030533130282816790463,
with respective curve orders
#E =2 89 ± 28743118396413.
Incidentally, which curve has which order is usually an easy computation: For
given a, b parameters, find a point P ∈ E and verify that [#E]P = O, for one
possibility for #E and not the other. In fact, if p>475, Theorem 7.5.2 implies
that either there is a point P on E with [#E ′ ]P = O (where E ′ is the twist
of E) orthereisapointQ on E ′ with [#E]Q = O. Thus, randomly choosing
points, first on one of the curves, then on the other, one should expect to soon
be able to detect which order goes with which curve. In any case, many of the
algorithms based on the Atkin–Morain approach can make use of points that
simply have vanishing multiples, and it is not necessary to ascertain the full
curve order.