Prime Numbers

7.8 Research problems 381
multiply-mod times. [De Win et al. 1998] explain that it is very hard even
to bring down the cost of inversion (modulo a typical cryptographic prime
p ≈ 2 200 ) to 20 multiplies. But there are open questions. What about primes
of special form, or lookup tables? The lookup notion stems from the simple
fact that if y can be found such that xy ≡ z (mod p) forsomez whose inverse
is already known, then x −1 mod p = yz −1 mod p. Inconnectionwiththe
complexity issue see Algorithm 9.4.5 and Exercise 2.11.
Another research direction is to attempt implementation of the interesting
Sorenson-class methods for k-ary (as opposed to binary) gcd’s [Sorenson 1994],
which methods admit of an extended form for modular inversion.
7.26. For an elliptic curve E(Fp), prime p with governing cubic
y 2 = x(x + 1)(x + c)
(and c ≡ 0, 1(modp)), show by direct appeal to the order relation (7.8) that
#E = p +1− T ,where
Q
T = c n
2 Q
,
n
n=0
with Q =(p − 1)/2 and we interpret the sum to lie modulo p in (−2 √ p, 2 √ p).
(One way to proceed is to write the Legendre symbol in relation (7.8) as a
(p − 1)/2-th power, then formally sum over x.) Then argue that
T ≡ F (1/2, 1/2, 1; c)|Q (mod p),
where F is the standard Gauss hypergeometric function and the notation
signifies that we are to take the hypergeometric series F (A, B, C; z) only
through the zQ term inclusive. Also derive the formal relation
T =(1− c) Q/2 PQ
1 − c/2
√ 1 − c
where PQ is the classical Legendre polynomial of order Q. Using known
transformation properties of such special series, find some closed-form curve
orders. For example, taking p ≡ 1 (mod 4) and the known evaluation
Q
PQ(0) =
Q/2
one can derive that curve order is #E = p +1± 2a, where the prime p
is represented as p = a 2 + b 2 . Actually, this kind of study connects with
algebraic number theory; for example, the study of binomial coefficients
(mod p) [Crandall et al. 1997] is useful in the present context.
Observe that the hypergeometric series can be evaluated in O √ p ln 2 p
field operations, by appeal to fast series evaluation methods [Borwein and
Borwein 1987] (and see Algorithm 9.6.7). This means that, at least for
elliptic curves of the type specified, we have yet another point-counting
,