Prime Numbers

380 Chapter 7 ELLIPTIC CURVE ARITHMETIC
7.22. For the example prime p = 2 31 +1 /3 and its curve orders displayed
after Algorithm 7.5.10, which is the best order to use to effect an ECPP proof
that p is prime?
7.23. Use some variant of ECPP to prove primality of every one of the ten
consecutive primes claimed in Exercise 1.87.
7.24. Here we apply ECPP ideas to primality testing of Fermat numbers
Fm =2 2m
+ 1. By considering representations
4Fm = u 2 +4v 2 ,
prove that if Fm is prime, then there are four curves (mod Fm)
y 2 = x 3 − 3 k x; k =0, 1, 2, 3,
having, in some ordering, the curve orders
2 2m
+2 m/2+1 +1,
2 2m
− 2 m/2+1 +1,
2 2m
− 1,
2 2m
+3.
Prove by computer that F7 (or some even larger Fermat number) is composite,
by exhibiting on one of the four curves a point P that is not annihilated by any
of the four orders. One should perhaps use the Montgomery representation
in Algorithm 7.2.7, so that initial points need have only their x-coordinates
checked for validity (see explanation following Algorithm 7.2.1). Otherwise,
the whole exercise is doomed because one usually cannot even perform squarerooting
for composite Fm, to obtain y coordinates.
Of course, the celebrated Pepin primality test (Theorem 4.1.2) is much
more efficient in the matter of weeding out composites, but the notion of CM
curves is instructive here. In fact, when the above procedure is invoked for
F4 = 65537, one finds that indeed, every one of the four curves has an initial
point that is annihilated by one of the four orders. Thus we might regard
65537 as a “probable” prime in the present sense. Just a little more work,
along the lines of the ECPP Algorithm 7.5.9, will complete a primality proof
for this largest known Fermat prime.
7.8 Research problems
7.25. With a view to the complexity tradeoffs between Algorithms 7.2.2,
7.2.3, 7.2.7, analyze the complexity of field inversion. One looks longingly at
expressions x3 = m 2 − x1 − x2, y3 = m(x1 − x3) − y1, in the realization that
if only inversion were “free,” the affine approach would surely be superior.
However, known inversion methods are quite expensive. One finds in practice
that inversion times tend to be one or two orders of magnitude greater than