Prime Numbers

7.6 Elliptic curve primality proving (ECPP) 373
5. [Operate on point]
Compute the multiple U =[m/q]P (however if any illegal inversions occur,
return “n is composite”);
if(U == O) goto [Choose point ...];
Compute V =[q]U (however check the above rule on illegal inversions);
if(V = O) return “n is composite”;
return “If q is prime, then n is prime”;
Note that if n is composite, then there is no guarantee that Algorithm 2.3.13
in Step [Choose discriminant] will successfully find u, v, eveniftheyexist.In
this event, we continue with the next D, until we are eventually successful, or
we lose patience and give up.
Let us work through an explicit example. Recall the Mersenne prime
p =2 89 − 1 analyzed after Algorithm 7.5.9. We found a discriminant D = −3
for complex multiplication curves, for which D there turn out to be six possible
curve orders. The recursive primality proving works, in this case, by taking
p +1+u as the order; in fact, this choice happens to work at every level like
so:
p =2 89 − 1,
D = −3 : u = 34753815440788, v = 20559283311750,
#E = p +1+u =2 2 · 3 2 · 5 2 · 7 · 848173 · p2,
p2 = 115836285129447871,
D = −3 : u = 557417116, v = 225559526,
#E = p2 +1+u =2 2 · 3 · 7 · 37 · 65707 · p3,
and we establish that p3 = 567220573 is prime by trial division. What we have
outlined is the essential “backbone” of a primality certificate for p =2 89 − 1.
The full certificate requires, of course, the actual curve parameters (from Step
[Obtain curve parameters]) and relevant starting points (from Step [Choose
point ...]) in Algorithm 7.6.3.
Compared to the Goldwasser–Kilian approach, the complexity of the
Atkin–Morain method is a cloudy issue—although heuristic estimates are
polynomial, e.g. O(ln 4+ɛ N) operations to prove N prime (see Section 7.6.3).
The added difficulty comes from the fact that the potential curve orders
that one tries to factor have an unknown distribution. However, in practice,
the method is excellent, and like the Goldwasser–Kilian method a complete
and succinct certificate of primality is provided. Morain’s implementation of
variants of Algorithm 7.6.3 has achieved primality proofs for “random” primes
of well over two thousand decimal digits, as we mentioned in Section 1.1.2.
But even more enhancement has been possible, as we discuss next.
7.6.3 Fast primality-proving via ellpitic curves (fastECPP)
A new development in primality proving has enabled primality proofs of some
spectacularly large numbers. For example, in July 2004, the primality of the