Prime Numbers

7.6 Elliptic curve primality proving (ECPP) 371
where now all the factors fall under our 2 32 threshold. For randomly chosen
starting point
P =[X : Z] = [245203089935 : 1]
we obtain, with q = 805019,
U =[m/q]P = [260419245130 : 1] = O,
V =[q]P = O.
It follows that the original p =1020 + 39 is prime. The relevant numbers are
then collected as a primality certificate for this prime. It should be noted that
for larger examples one should not expect to be lucky enough to get a good
factorization of m on every attempt, though conjecturally the event should
not be so very rare.
The study of the computational complexity of Algorithm 7.6.2 is
interesting. Success hinges on the likelihood of finding a curve order that
factors as in Step [Attempt to factor]. Note that one is happy even if one finds
an order m =2q where q is a prime. Thus, it can be shown via Theorem 7.3.2
that if
π x +1+2 √ x − π x +1− 2 √ x √
x
>A
ln c x
for positive constants A, c, then the expected bit complexity of the algorithm
is O ln 9+c n ; see [Goldwasser and Kilian 1986]. It is conjectured that the
inequality holds with A = c = 1 and all sufficiently large values of x.
In addition, using results in analytic number theory that say that such
inequalities are usually true, it is possible to show that the Goldwasser–Kilian
test (Algorithm 7.6.2) usually works, and does so in polynomial time. To
remove this lacuna, one might note that sufficient information is known about
primes in an interval of length x3/4 near x. Using this, [Adleman and Huang
1992] were able to achieve a guaranteed expected polynomial time bound. In
their scheme, a certificate chain is likewise generated, yet, remarkably, the
initial primes in the chain actually increase in size, eventually to decay to
acceptable levels. The decay is done via the Goldwasser–Kilian test as above,
and the increase is designed so as to “gain randomness.” The initial candidate
n might be one for which the Goldwasser–Kilian test does not work (this
would be evidenced by never having luck in factoring curve orders or just
taking too long to factor), so the initial steps of “reducing” the primality of n
to that of larger numbers is a way of replacing the given number n with a new
number that is random enough so that the Goldwasser–Kilian test is expected
to work for it. This “going up” is done via Jacobian varieties of hyperelliptic
curves of genus 2.
7.6.2 Atkin–Morain primality test
The Goldwasser–Kilian Algorithm 7.6.2 is, in practice for large n under
scrutiny, noticeably sluggish due to the point-counting step to assess #E.
Atkin found an elegant solution to this impasse, and together with Morain