Prime Numbers

378 Chapter 7 ELLIPTIC CURVE ARITHMETIC
on either curve there is no unique m in the Hasse interval with [m]P = O.
See [Schoof 1995] for this and other special cases pertaining to the Mestre
theorems.
7.19. Here we investigate the operation complexity of the Schoof Algorithm
7.5.6. Derive the bound O ln 8 p on operation complexity for Schoof’s original
method, assuming grammar-school polynomial multiplication (which in turn
has complexity O(de) field operations for degrees d, e of operands). Explain
why the Schoof–Elkies–Atkin (SEA) method continuation reduces this to
O ln 6 p . (To deduce such reduction, one need only know the degree of an SEA
polynomial, which is O(l) rather than O(l 2 ) for the prime l.) Describe what
then happens to the complexity bound if one also invokes a fast multiplication
method not only for integers but also for polynomial multiplication (see text
following Algorithm 7.5.6), and perhaps also a Shanks–Mestre boost. Finally,
what can be said about bit complexity to resolve curve order for a prime p
having n bits?
7.20. Elliptic curve theory can be used to establish certain results on sums of
cubes in rings. By way of the Hasse Theorem 7.3.1, prove that if p>7isprime,
then every element of Fp is a sum of two cubes. By analyzing, then, prime
powers, prove the following conjecture (which was motivated numerically and
communicated by D. Copeland): Let dN be the density of representables (as
(cube+cube)) in the ring ZN. Then
if 63|N then dN =25/63, otherwise
if 7|N then dN =5/7, or
if 9|N then dN =5/9,
and in all other cases dN =1.
An extension is: Study sums of higher powers (see Exercise 9.80).
7.21. Here is an example of how symbolic exercise can tune one’s
understanding of the workings a specific, tough algorithm. It is sometimes
possible actually to carry out what we might call a “symbolic Schoof
algorithm,” to obtain exact results on curve orders, in the following fashion.
Consider an elliptic curve E0,b(Fp) forp>3, and so governed by the cubic
y 2 = x 3 + b.
We shall determine the order (mod 3) of any such curve, yet do this via
symbolic manipulations alone; i.e., without the usual numerical calculations
associated with Schoof implementations. Perform the following proofs, without
the assistance of computing machinery (although a symbolic machine may be
valuable in checking one’s algebra):
(1) Argue that with respect to the division polynomial Ψ3, wehave
(2) Prove that for k>0,
x 4 ≡−4bx (mod Ψ3).
x 3k ≡ (−4b) k−1 x 3 (mod Ψ3).