Prime Numbers
Prime Numbers Prime Numbers
7.5 Counting points on elliptic curves 367 does not tell us which of the curve parameter pairs (a, b) goeswithwhich order (from Step [Option: Curve orders] of Algorithm 7.5.9). As mentioned above, this is not a serious problem: One finds a point P on one curve where a candidate order does not kill it, so we know that the candidate belongs to another curve. For the example in the last paragraph with p =(2 31 +1)/3, the orders shown were matched to the curves in just this way. D E #E −3 y 2 = x 3 +0x + 715827882 715861972 y 2 = x 3 +0x + 715827878 715880649 y 2 = x 3 +0x + 715827858 715846561 y 2 = x 3 +0x + 715827758 715793796 y 2 = x 3 +0x + 715827258 715775119 y 2 = x 3 +0x + 715824758 715809207 −7 y 2 = x 3 + 331585657x + 632369458 715788584 y 2 = x 3 + 415534712x + 305115120 715867184 −8 y 2 = x 3 + 362880883x + 649193252 715784194 y 2 = x 3 + 482087479x + 260605721 715871574 −11 y 2 = x 3 + 710498587x + 673622741 715774393 y 2 = x 3 + 582595483x + 450980314 715881375 −67 y 2 = x 3 + 265592125x + 480243852 715785809 y 2 = x 3 + 197352178x + 616767211 715869959 −51 y 2 = x 3 + 602207293x + 487817116 715826683 y 2 = x 3 + 22796782x + 131769445 715829085 −91 y 2 = x 3 + 407640471x + 205746226 715824963 y 2 = x 3 + 169421413x + 664302345 715830805 −187 y 2 = x 3 + 389987874x + 525671592 715817117 y 2 = x 3 + 443934371x + 568611647 715838651 −403 y 2 = x 3 + 644736647x + 438316263 715881357 y 2 = x 3 + 370202749x + 386613767 715774411 −427 y 2 = x 3 + 370428023x + 532016446 715860684 y 2 = x 3 + 670765979x + 645890514 715795084 But one can, in principle, go a little further and specify theoretically which orders go with which curves, at least for discriminants D having h(D) =1. There are explicit curves and orders in the literature [Rishi et al. 1984], [Padma
368 Chapter 7 ELLIPTIC CURVE ARITHMETIC and Ventkataraman 1996]. Many such results go back to the work of Stark, who connected the precise curve order p +1− u, when4p = u 2 + |D|v 2 and u is allowed to be positive or negative, with the Jacobi symbol u |D| . Interesting refinements of this work are found in the modern treatment in [Morain 1998]. 7.6 Elliptic curve primality proving (ECPP) We have seen in Section 4.1 that a partial factorization of n − 1 can lead to a primality proof for n. One might wonder whether elliptic-curve groups—given their variable group orders under the Hasse theorem 7.3.1—can be brought to bear for primality proofs. Indeed they can, as evidenced by a certain theorem, which is a kind of elliptic curve analogy to the Pocklington Theorem 4.1.3. Before we exhibit the theorem, we recall Definition 7.4.1 of a pseudocurve E(Zn). Recalling, too, the caveat about elliptic multiplication on a pseudocurve mentioned following the definition, we proceed with the following central result. Theorem 7.6.1 (Goldwasser–Kilian ECPP theorem). Let n > 1 be an integer coprime to 6, letE(Zn) be a pseudocurve, and let s, m be positive integers with s|m. Assume that there exists a point P ∈ E such that we can carry out the curve operations for [m]P to find [m]P = O, and for every prime q dividing s we can carry out the curve operations to obtain [m/q]P = O. Then for every prime p dividing n we have #E(Fp) ≡ 0(mods). Moreover, if s> n 1/4 +1 2 , then n is prime. Proof. Let p be a prime factor of n. The calculations on the pseudocurve, when reduced modulo p, imply that s divides the order of P on E(Fp). This proves the first assertion. In addition, if s > n 1/4 +1 2 , we may infer that #E(Fp) > n 1/4 +1 2 . But the Hasse Theorem 7.3.1 implies that #E(Fp) < p 1/2 +1 2 . We deduce that p 1/2 >n 1/4 ,sothatp>n 1/2 .Asn has all of its prime factors greater than its square root, n must be prime. ✷ 7.6.1 Goldwasser–Kilian primality test On the basis of Theorem 7.6.1, Goldwasser and Kilian demonstrated a primality testing algorithm with expected polynomial-time complexity for conjecturally all, and provably “most,” prime numbersn. That is, a number n could be tested in an expected number of operations O ln k n for an absolute
- Page 326 and 327: 316 Chapter 6 SUBEXPONENTIAL FACTOR
- Page 328 and 329: Chapter 7 ELLIPTIC CURVE ARITHMETIC
- Page 330 and 331: 7.1 Elliptic curve fundamentals 321
- Page 332 and 333: 7.2 Elliptic arithmetic 323 the poi
- Page 334 and 335: 7.2 Elliptic arithmetic 325 with EC
- Page 336 and 337: 7.2 Elliptic arithmetic 327 Algorit
- Page 338 and 339: 7.2 Elliptic arithmetic 329 Before
- Page 340 and 341: 7.2 Elliptic arithmetic 331 the “
- Page 342 and 343: 7.3 The theorems of Hasse, Deuring,
- Page 344 and 345: 7.4 Elliptic curve method 335 a ran
- Page 346 and 347: 7.4 Elliptic curve method 337 B1 =
- Page 348 and 349: 7.4 Elliptic curve method 339 facto
- Page 350 and 351: 7.4 Elliptic curve method 341 propa
- Page 352 and 353: 7.4 Elliptic curve method 343 As fo
- Page 354 and 355: 7.4 Elliptic curve method 345 if(1
- Page 356 and 357: 7.5 Counting points on elliptic cur
- Page 358 and 359: 7.5 Counting points on elliptic cur
- Page 360 and 361: 7.5 Counting points on elliptic cur
- Page 362 and 363: 7.5 Counting points on elliptic cur
- Page 364 and 365: 7.5 Counting points on elliptic cur
- Page 366 and 367: 7.5 Counting points on elliptic cur
- Page 368 and 369: 7.5 Counting points on elliptic cur
- Page 370 and 371: 7.5 Counting points on elliptic cur
- Page 372 and 373: 7.5 Counting points on elliptic cur
- Page 374 and 375: 7.5 Counting points on elliptic cur
- Page 378 and 379: 7.6 Elliptic curve primality provin
- Page 380 and 381: 7.6 Elliptic curve primality provin
- Page 382 and 383: 7.6 Elliptic curve primality provin
- Page 384 and 385: 7.7 Exercises 375 7.4. As in Exerci
- Page 386 and 387: 7.7 Exercises 377 (some Bj equals A
- Page 388 and 389: 7.7 Exercises 379 This reduction ig
- Page 390 and 391: 7.8 Research problems 381 multiply-
- Page 392 and 393: 7.8 Research problems 383 highly ef
- Page 394 and 395: 7.8 Research problems 385 is prime.
- Page 396 and 397: Chapter 8 THE UBIQUITY OF PRIME NUM
- Page 398 and 399: 8.1 Cryptography 389 is, if an orac
- Page 400 and 401: 8.1 Cryptography 391 Algorithm 8.1.
- Page 402 and 403: 8.1 Cryptography 393 just to genera
- Page 404 and 405: 8.1 Cryptography 395 where in the l
- Page 406 and 407: 8.2 Random-number generation 397 ar
- Page 408 and 409: 8.2 Random-number generation 399 Al
- Page 410 and 411: 8.2 Random-number generation 401 }
- Page 412 and 413: 8.2 Random-number generation 403 is
- Page 414 and 415: 8.3 Quasi-Monte Carlo (qMC) methods
- Page 416 and 417: 8.3 Quasi-Monte Carlo (qMC) methods
- Page 418 and 419: 8.3 Quasi-Monte Carlo (qMC) methods
- Page 420 and 421: 8.3 Quasi-Monte Carlo (qMC) methods
- Page 422 and 423: 8.3 Quasi-Monte Carlo (qMC) methods
- Page 424 and 425: 8.4 Diophantine analysis 415 [Tezuk
368 Chapter 7 ELLIPTIC CURVE ARITHMETIC<br />
and Ventkataraman 1996]. Many such results go back to the work of Stark,<br />
who connected the precise curve order p +1− u, when4p = u 2 + |D|v 2 and u<br />
is allowed to be positive or negative, with the Jacobi symbol <br />
u<br />
|D| . Interesting<br />
refinements of this work are found in the modern treatment in [Morain 1998].<br />
7.6 Elliptic curve primality proving (ECPP)<br />
We have seen in Section 4.1 that a partial factorization of n − 1 can lead to a<br />
primality proof for n. One might wonder whether elliptic-curve groups—given<br />
their variable group orders under the Hasse theorem 7.3.1—can be brought to<br />
bear for primality proofs. Indeed they can, as evidenced by a certain theorem,<br />
which is a kind of elliptic curve analogy to the Pocklington Theorem 4.1.3.<br />
Before we exhibit the theorem, we recall Definition 7.4.1 of a pseudocurve<br />
E(Zn). Recalling, too, the caveat about elliptic multiplication on a pseudocurve<br />
mentioned following the definition, we proceed with the following<br />
central result.<br />
Theorem 7.6.1 (Goldwasser–Kilian ECPP theorem). Let n > 1 be an<br />
integer coprime to 6, letE(Zn) be a pseudocurve, and let s, m be positive<br />
integers with s|m. Assume that there exists a point P ∈ E such that we can<br />
carry out the curve operations for [m]P to find<br />
[m]P = O,<br />
and for every prime q dividing s we can carry out the curve operations to<br />
obtain<br />
[m/q]P = O.<br />
Then for every prime p dividing n we have<br />
#E(Fp) ≡ 0(mods).<br />
Moreover, if s> n 1/4 +1 2 , then n is prime.<br />
Proof. Let p be a prime factor of n. The calculations on the pseudocurve,<br />
when reduced modulo p, imply that s divides the order of P on E(Fp).<br />
This proves the first assertion. In addition, if s > n 1/4 +1 2 , we may<br />
infer that #E(Fp) > n 1/4 +1 2 . But the Hasse Theorem 7.3.1 implies that<br />
#E(Fp) < p 1/2 +1 2 . We deduce that p 1/2 >n 1/4 ,sothatp>n 1/2 .Asn<br />
has all of its prime factors greater than its square root, n must be prime. ✷<br />
7.6.1 Goldwasser–Kilian primality test<br />
On the basis of Theorem 7.6.1, Goldwasser and Kilian demonstrated a<br />
primality testing algorithm with expected polynomial-time complexity for<br />
conjecturally all, and provably “most,” prime numbersn. That is, a number n<br />
could be tested in an expected number of operations O ln k <br />
n for an absolute
Change language