Prime Numbers
Prime Numbers Prime Numbers
7.6 Elliptic curve primality proving (ECPP) 373 5. [Operate on point] Compute the multiple U =[m/q]P (however if any illegal inversions occur, return “n is composite”); if(U == O) goto [Choose point ...]; Compute V =[q]U (however check the above rule on illegal inversions); if(V = O) return “n is composite”; return “If q is prime, then n is prime”; Note that if n is composite, then there is no guarantee that Algorithm 2.3.13 in Step [Choose discriminant] will successfully find u, v, eveniftheyexist.In this event, we continue with the next D, until we are eventually successful, or we lose patience and give up. Let us work through an explicit example. Recall the Mersenne prime p =2 89 − 1 analyzed after Algorithm 7.5.9. We found a discriminant D = −3 for complex multiplication curves, for which D there turn out to be six possible curve orders. The recursive primality proving works, in this case, by taking p +1+u as the order; in fact, this choice happens to work at every level like so: p =2 89 − 1, D = −3 : u = 34753815440788, v = 20559283311750, #E = p +1+u =2 2 · 3 2 · 5 2 · 7 · 848173 · p2, p2 = 115836285129447871, D = −3 : u = 557417116, v = 225559526, #E = p2 +1+u =2 2 · 3 · 7 · 37 · 65707 · p3, and we establish that p3 = 567220573 is prime by trial division. What we have outlined is the essential “backbone” of a primality certificate for p =2 89 − 1. The full certificate requires, of course, the actual curve parameters (from Step [Obtain curve parameters]) and relevant starting points (from Step [Choose point ...]) in Algorithm 7.6.3. Compared to the Goldwasser–Kilian approach, the complexity of the Atkin–Morain method is a cloudy issue—although heuristic estimates are polynomial, e.g. O(ln 4+ɛ N) operations to prove N prime (see Section 7.6.3). The added difficulty comes from the fact that the potential curve orders that one tries to factor have an unknown distribution. However, in practice, the method is excellent, and like the Goldwasser–Kilian method a complete and succinct certificate of primality is provided. Morain’s implementation of variants of Algorithm 7.6.3 has achieved primality proofs for “random” primes of well over two thousand decimal digits, as we mentioned in Section 1.1.2. But even more enhancement has been possible, as we discuss next. 7.6.3 Fast primality-proving via ellpitic curves (fastECPP) A new development in primality proving has enabled primality proofs of some spectacularly large numbers. For example, in July 2004, the primality of the
374 Chapter 7 ELLIPTIC CURVE ARITHMETIC Leyland number (with general form x y + y x ) N = 4405 2638 + 2638 4405 was established, a number of 15071 decimal digits. This “fastECPP” method is based on an asymptotic improvement, due to J. Shallit, that yields a bitcomplexity heuristic of O(ln 4+ɛ N)toproveN prime. The basic idea is to build a base of small squareroots, and build discriminants from this basis. Let L =lnN where N isthepossibleprime under scrutiny. Now Algorithm 7.6.3 requires, we expect, O(L 2 ) discriminants D tried before finding a good D. Instead, one may build discriminants of the form −D =(−p)(q), where p, q are primes each taken from a pool of size only O(L). In this way, Step [Choose discriminant] can be enhanced, and the overall operation complexity of Algorithm 7.6.3—which complexity started out as O(ln 5+ɛ N) thus has the 5 turning into a 4. The details and various primality-proof records are found in [Franke et al. 2004] and (especially for the fastECPP theory) [Morain 2004]. 7.7 Exercises 7.1. Find a bilinear transformation of the form that renders the curve (x, y) ↦→ (αx + βy,γx + δy) y 2 + axy + by = x 3 + cx 2 + dx + e (7.11) into Weierstrass form (7.4). Indicate, then, where the fact of field characteristic not equal to 2 or 3 is required for the transformation to be legal. 7.2. Show that curve with governing cubic has affine representation Y 2 = X 3 + CX 2 + AX + B y 2 = x 3 +(A − C 2 /3)x +(B − AC/3+2C 3 /27). This shows that a Montgomery curve (B = 0) always has an affine equivalent. But the converse is false. Describe exactly under what conditions on parameters a, b in y 2 = x 3 + ax + b such an affine curve does possess a Montgomery equivalent with B = 0. Describe applications of this result, for example in cryptography or pointcounting. 7.3. Show that the curve given by relation (7.4) is nonsingular over a field F with characteristic = 2, 3 if and only if 4a 3 +27b 2 =0.
- Page 332 and 333: 7.2 Elliptic arithmetic 323 the poi
- Page 334 and 335: 7.2 Elliptic arithmetic 325 with EC
- Page 336 and 337: 7.2 Elliptic arithmetic 327 Algorit
- Page 338 and 339: 7.2 Elliptic arithmetic 329 Before
- Page 340 and 341: 7.2 Elliptic arithmetic 331 the “
- Page 342 and 343: 7.3 The theorems of Hasse, Deuring,
- Page 344 and 345: 7.4 Elliptic curve method 335 a ran
- Page 346 and 347: 7.4 Elliptic curve method 337 B1 =
- Page 348 and 349: 7.4 Elliptic curve method 339 facto
- Page 350 and 351: 7.4 Elliptic curve method 341 propa
- Page 352 and 353: 7.4 Elliptic curve method 343 As fo
- Page 354 and 355: 7.4 Elliptic curve method 345 if(1
- Page 356 and 357: 7.5 Counting points on elliptic cur
- Page 358 and 359: 7.5 Counting points on elliptic cur
- Page 360 and 361: 7.5 Counting points on elliptic cur
- Page 362 and 363: 7.5 Counting points on elliptic cur
- Page 364 and 365: 7.5 Counting points on elliptic cur
- Page 366 and 367: 7.5 Counting points on elliptic cur
- Page 368 and 369: 7.5 Counting points on elliptic cur
- Page 370 and 371: 7.5 Counting points on elliptic cur
- Page 372 and 373: 7.5 Counting points on elliptic cur
- Page 374 and 375: 7.5 Counting points on elliptic cur
- Page 376 and 377: 7.5 Counting points on elliptic cur
- Page 378 and 379: 7.6 Elliptic curve primality provin
- Page 380 and 381: 7.6 Elliptic curve primality provin
- Page 384 and 385: 7.7 Exercises 375 7.4. As in Exerci
- Page 386 and 387: 7.7 Exercises 377 (some Bj equals A
- Page 388 and 389: 7.7 Exercises 379 This reduction ig
- Page 390 and 391: 7.8 Research problems 381 multiply-
- Page 392 and 393: 7.8 Research problems 383 highly ef
- Page 394 and 395: 7.8 Research problems 385 is prime.
- Page 396 and 397: Chapter 8 THE UBIQUITY OF PRIME NUM
- Page 398 and 399: 8.1 Cryptography 389 is, if an orac
- Page 400 and 401: 8.1 Cryptography 391 Algorithm 8.1.
- Page 402 and 403: 8.1 Cryptography 393 just to genera
- Page 404 and 405: 8.1 Cryptography 395 where in the l
- Page 406 and 407: 8.2 Random-number generation 397 ar
- Page 408 and 409: 8.2 Random-number generation 399 Al
- Page 410 and 411: 8.2 Random-number generation 401 }
- Page 412 and 413: 8.2 Random-number generation 403 is
- Page 414 and 415: 8.3 Quasi-Monte Carlo (qMC) methods
- Page 416 and 417: 8.3 Quasi-Monte Carlo (qMC) methods
- Page 418 and 419: 8.3 Quasi-Monte Carlo (qMC) methods
- Page 420 and 421: 8.3 Quasi-Monte Carlo (qMC) methods
- Page 422 and 423: 8.3 Quasi-Monte Carlo (qMC) methods
- Page 424 and 425: 8.4 Diophantine analysis 415 [Tezuk
- Page 426 and 427: 8.4 Diophantine analysis 417 9262 3
- Page 428 and 429: 8.5 Quantum computation 419 We spea
- Page 430 and 431: 8.5 Quantum computation 421 three H
374 Chapter 7 ELLIPTIC CURVE ARITHMETIC<br />
Leyland number (with general form x y + y x )<br />
N = 4405 2638 + 2638 4405<br />
was established, a number of 15071 decimal digits. This “fastECPP” method<br />
is based on an asymptotic improvement, due to J. Shallit, that yields a bitcomplexity<br />
heuristic of O(ln 4+ɛ N)toproveN prime.<br />
The basic idea is to build a base of small squareroots, and build<br />
discriminants from this basis. Let L =lnN where N isthepossibleprime<br />
under scrutiny. Now Algorithm 7.6.3 requires, we expect, O(L 2 ) discriminants<br />
D tried before finding a good D. Instead, one may build discriminants of the<br />
form −D =(−p)(q), where p, q are primes each taken from a pool of size<br />
only O(L). In this way, Step [Choose discriminant] can be enhanced, and the<br />
overall operation complexity of Algorithm 7.6.3—which complexity started<br />
out as O(ln 5+ɛ N) thus has the 5 turning into a 4.<br />
The details and various primality-proof records are found in [Franke et al.<br />
2004] and (especially for the fastECPP theory) [Morain 2004].<br />
7.7 Exercises<br />
7.1. Find a bilinear transformation of the form<br />
that renders the curve<br />
(x, y) ↦→ (αx + βy,γx + δy)<br />
y 2 + axy + by = x 3 + cx 2 + dx + e (7.11)<br />
into Weierstrass form (7.4). Indicate, then, where the fact of field characteristic<br />
not equal to 2 or 3 is required for the transformation to be legal.<br />
7.2. Show that curve with governing cubic<br />
has affine representation<br />
Y 2 = X 3 + CX 2 + AX + B<br />
y 2 = x 3 +(A − C 2 /3)x +(B − AC/3+2C 3 /27).<br />
This shows that a Montgomery curve (B = 0) always has an affine<br />
equivalent. But the converse is false. Describe exactly under what conditions<br />
on parameters a, b in<br />
y 2 = x 3 + ax + b<br />
such an affine curve does possess a Montgomery equivalent with B = 0.<br />
Describe applications of this result, for example in cryptography or pointcounting.<br />
7.3. Show that the curve given by relation (7.4) is nonsingular over a field<br />
F with characteristic = 2, 3 if and only if 4a 3 +27b 2 =0.
Change language