Prime Numbers

7.8 Research problems 383
highly efficient, able to resolve the curve order for a 200-bit value of p in a
matter of minutes. For example, there is the implementation in [Scott 1999],
which uses projective coordinates and the Shoup method (see Exercise 9.70)
for polynomial multiplication, and for the SEA extension, uses precomputed
polynomials.
But there is another tantalizing option: Employ Montgomery representation,
as in Algorithm 7.2.7, for which the Schoof relation
x p2
,y p2
+[k](x, y) =[t](x p ,y p )
can be analyzed in x-coordinates alone. One computes x p2
(but no powers
of y), uses division polynomials to find the x-coordinate of [k](x, y) (and
perhaps the [t] multiple as well), and employs Algorithm 7.2.8 to find doublyambiguous
values of t. This having been done, one has a “partial-CRT”
scenario that is itself of research interest. In such a scenario, one knows not
a specific t mod l for each small prime l, but a pair of t values for each l. At
first it may seem that we need twice as many small primes, but not really so.
If one has, say, n smaller primes l1,...,ln one can perform at most 2 n elliptic
multiplies to see which genuine curve order annihilates a random point. One
might say that for large n this is too much work, but one could just use the xcoordinate
arithmetic only on some of the larger l. So the research problem is
this: Given that x-coordinate (Montgomery) arithmetic is less expensive than
full (x, y) versions, how does one best handle the ambiguous t values that
result? Besides the 2 n continuation, is there a Shanks–Mestre continuation
that starts from the partial-CRT decomposition? Note that in all of this
analysis, one will sometimes get the advantage that t = 0, in which case
there is no ambiguity of (p +1± t) modl.
7.30. In Exercise 7.21 was outlined “symbolic” means for carrying out
Schoof calculations for an elliptic curve order. Investigate whether the same
manipulations can be effected, again (mod 3), for curves governed by
y 2 = x 3 + ax,
or for that matter, curves having both a, b nonzero—which cases you would
expect to be difficult. Investigate whether any of these ideas can be effected
for small primes l>3.
7.31. Describe how one may use Algorithm 7.5.10 to create a relatively
simple primality-proving program, in which one would search only for
discriminant-D curves with h(D) =1, 2. The advantage of such a scheme
is obvious: The elliptic curve generation is virtually immediate for such
discriminants. The primary disadvantage, of course, is that for large probable
primes under scrutiny, a great deal of effort must go into factoring the severely
limited set of curve orders (one might even contemplate an ECM factoring
engine, to put extra weight on the factoring part of ECPP). Still, this could be
a fine approach for primes of a few hundred binary bits or less. For one thing,