Prime Numbers

382 Chapter 7 ELLIPTIC CURVE ARITHMETIC
algorithm whose complexity lies essentially between naive residue counting
and the Shanks–Mestre algorithm. There is yet one more possible avenue of
exploration: The DAGM of Exercise 2.42 might actually apply to truncated
hypergeometric series (mod p) in some sense, which we say because the
classical AGM—for real arguments—is a rapid means of evaluating such as
the hypergeometric form above [Borwein and Borwein 1987].
Incidentally, a profound application of the AGM notion has recently been
used in elliptic-curve point counting; see the end of Section 7.5.2.
7.27. Along the lines of Exercise 7.26, show that for a prime p ≡ 1 (mod 8),
the elliptic curve E with governing cubic
has order
y 2 = x 3 + 3
√ 2 x 2 + x
#E = p +1− 2 (p−1)/4
p−1
2
p−1 mod ± p ,
4
where the mod± notation means that we take the signed residue nearest 0.
Does this observation have any value for factoring of Fermat numbers? Here
are some observations. We do know that any prime factor of a composite Fn
is ≡ 1 (mod 8), and that 3/ √ 2 can be written modulo any Fermat number
Fn > 5as3(23m/4 − 2m/4 ) −1 ,withm =2n ; moreover, this algebra works
modulo any prime factor of Fn. In this connection see [Atkin and Morain
1993a], who show how to construct advantageous curves when potential factors
p are known to have certain congruence properties.
7.28. Implement the ECM variant of [Peralta and Okamoto 1996], in which
composite numbers n = pq2 with p prime, q odd, are attacked efficiently. Their
result depends on an interesting probabilistic way to check whether x1 ≡ x2
(mod p); namely, choose a random r and check whether the Jacobi symbol
equality
x1 + r x2 + r
=
n
n
holds, which check can be performed, remarkably, in ignorance of p.
7.29. Here is a fascinating line of research in connection with Schoof
point counting, Algorithm 7.5.6. First, investigate the time and space
(memory) tradeoffs for the algorithm, as one decides upon one of the
following representation options: (a) the rational point representations
(N(x)/D(x),yM(x)/C(x)) as we displayed; (b) a projective description
(X(x, y),Y(x, y),Z(x, y)) along the lines of Algorithm 7.2.3; or (c) an affine
representation. Note that these options have the same basic asymptotic
complexity, but we are talking here about implementation advantages, e.g.,
the implied big-O constants.
Such analyses have led to actual packages, not only for the “vanilla Schoof”
Algorithm 7.5.6, but the sophisticated SEA variants. Some such packages are