Prime Numbers

372 Chapter 7 ELLIPTIC CURVE ARITHMETIC
implemented a highly efficient elliptic curve primality proving (ECPP) scheme
[Atkin and Morain 1993b]. The method is now in wide use. There are various
ways to proceed in practice with this ECPP; we give just one here.
The idea once again is to find either “closed-form” curve orders, or at least
be able to specify orders relatively quickly. One could conceivably use closed
forms such as those of Algorithm 7.5.10, but one may well “run out of gas,”
not being able to find an order with the proper structure for Theorem 7.6.1.
The Atkin–Morain approach is to find curves with complex multiplication, as
in Algorithm 7.5.9. In this way, a crucial step (called [Assess curve order], in
Algorithm 7.6.2) is a point of entry into the Atkin–Morain order/curve-finding
Algorithm 7.5.9. A quick perusal will show the great similarity of Algorithm
7.6.3 below and Algorithm 7.6.2. The difference is that here one searches for
appropriate curve orders first, and only then constructs the corresponding
elliptic curve, both using Algorithm 7.5.9, while the Schoof algorithm 7.5.6 is
dispensed with.
Algorithm 7.6.3 (Atkin–Morain primality test). Given a nonsquare integer
n > 2 32 strongly suspected of being prime (in particular gcd(n, 6) = 1 and
presumably n has already passed a probable prime test), this algorithm attempts
to reduce the issue of primality of n to that of a smaller number q. The algorithm
returns either the assertion “n is composite” or the assertion “If q is prime, then
n is prime,” where q is an integer smaller than n. (Note similar structure of
Algorithm 7.6.2.)
1. [Choose discriminant]
Select a fundamental discriminant D by increasing value of h(D) for
which
D
n =1and for which we are successful in finding a solution
u2 + |D|v2 =4n via Algorithm 2.3.13, yielding possible curve orders m:
m ∈{n +1± u, n +1± 2v}, forD = −4,
m ∈{n +1± u, n +1± (u ± 3v)/2}, forD = −3,
m ∈{n +1± u}, forD1 and q is a
probable prime > (n 1/4 +1) 2 (however if this cannot be done according
to some time-limit criterion, goto [Choose discriminant]);
3. [Obtain curve parameters]
Using the parameter-generating option of Algorithm 7.5.9, establish the
parameters a, b for an elliptic curve that would have order m if n is
indeed prime;
4. [Choose point on Ea,b(Zn)]
Choose random x ∈ [0,n− 1] such that Q =(x3 + ax + b) modnhas Q
n = −1;
Apply Algorithm 2.3.8 or 2.3.9 (with a = Q and p = n) to find an integer
y that would satisfy y2 ≡ Q (mod n) if n were prime;
if(y2 mod n = Q) return “n is composite”;
P =(x, y);