## Efficient CM-constructions of elliptic curves over finite fields (2007)

### Cached

### Download Links

Venue: | MATH. COMP. |

Citations: | 4 - 2 self |

### BibTeX

@ARTICLE{Bröker07efficientcm-constructions,

author = {Reinier Bröker and Peter Stevenhagen},

title = {Efficient CM-constructions of elliptic curves over finite fields},

journal = {MATH. COMP. },

year = {2007},

volume = {76},

number = {260}

}

### OpenURL

### Abstract

We present an algorithm that, on input of an integer N ≥ 1 together with its prime factorization, constructs a finite field F and an elliptic curve E over F for which E(F) hasorderN. Although it is unproved that this can be done for all N, a heuristic analysis shows that the algorithm has an expected run time that is polynomial in 2 ω(N) log N, whereω(N) isthe number of distinct prime factors of N. In the cryptographically relevant case where N is prime, an expected run time O((log N) 4+ε) can be achieved. We illustrate the efficiency of the algorithm by constructing elliptic curves with point groups of order N =10 2004 and N = nextprime(10 2004)=10 2004 +4863.

### Citations

913 | A Course in Computational Algebraic Number Theory - Cohen - 1993 |

820 | The Arithmetic of Elliptic Curves - Silverman - 1986 |

170 |
Elliptic curves over finite fields and the computation of square roots mod p
- Schoof
- 1985
(Show Context)
Citation Context ... N =#E(Fq) of the group of Fq-rational points of E is an integer in the Hasse interval (1.1) Hq =[( √ q − 1) 2 , ( √ q +1) 2 ]=[q +1− 2 √ q,q +1+2 √ q] around q + 1. Various point counting algorithms =-=[24]-=-, [21], [14], [11] have been developed over the last 20 years that compute N in polynomial time from the standard representation of E by a Weierstrass equation over Fq. A natural ‘inverse problem’ to ... |

146 | Modern Computer Algebra - Gathen, Gerhard, et al. - 1999 |

82 | Counting points on elliptic curves over finite fields - Schoof |

81 | Counting points on hyperelliptic curves using Monsky-Washnitzer cohomology
- Kedlaya
(Show Context)
Citation Context ...f the group of Fq-rational points of E is an integer in the Hasse interval (1.1) Hq =[( √ q − 1) 2 , ( √ q +1) 2 ]=[q +1− 2 √ q,q +1+2 √ q] around q + 1. Various point counting algorithms [24], [21], =-=[14]-=-, [11] have been developed over the last 20 years that compute N in polynomial time from the standard representation of E by a Weierstrass equation over Fq. A natural ‘inverse problem’ to the point co... |

70 |
and J.Pintz, The difference between consecutive primes
- Baker
(Show Context)
Citation Context ... statement that the size of the ‘gaps’ between consecutive primes around N does not exceed 4 √ N. Although prime gaps of this size are not believed to exist, the best proven upper bound on their size =-=[2]-=- is currently O(N α ), with α = .525 > 1 2 . Even under assumption of the generalized Riemann hypothesis, the best result [13, Theorem 12.10] is only O(N1/2 log N). This means that we have no proof th... |

63 |
The canonical lift of an ordinary elliptic curve over a prime field and its point counting
- Satoh
- 2000
(Show Context)
Citation Context ...(Fq) of the group of Fq-rational points of E is an integer in the Hasse interval (1.1) Hq =[( √ q − 1) 2 , ( √ q +1) 2 ]=[q +1− 2 √ q,q +1+2 √ q] around q + 1. Various point counting algorithms [24], =-=[21]-=-, [14], [11] have been developed over the last 20 years that compute N in polynomial time from the standard representation of E by a Weierstrass equation over Fq. A natural ‘inverse problem’ to the po... |

45 |
Constructing elliptic curves with given group order over large finite fields. Algorithmic Number Theory
- Lay, Zimmer
- 1994
(Show Context)
Citation Context ...e value of q =#F is less relevant. In this case one needs a solution to Problem 2, not to Problem 1. The observation is not new, and both problems occur in the list of problems in the introduction of =-=[16]-=- that ‘can be solved’. The main result of this paper is that, even though no efficient solution to Problem 1 is known, Problem 2 does admit such a solution if N is provided to the algorithm in factore... |

43 | A rigorous time bound for factoring integers - Lenstra, Pomerance - 1992 |

33 | The complexity of class polynomial computation via floating point approximations
- Enge
(Show Context)
Citation Context ...and the size of its coefficients both grow like |∆| 1/2 for ∆ →−∞, the run time can be no better than � O(|∆|).sCM-CONSTRUCTIONS OF ELLIPTIC CURVES OVER FINITE FIELDS 2165 This is the actual run time =-=[9]-=- for the classical analytic approach using the modular function j : H → C. The same is true for the more recent non-archimedean approach [8], [5], [4] to the evaluation of P∆, which approximates the r... |

27 | Implementing the asymptotically fast version of the elliptic curve primality proving algorithm
- Morain
(Show Context)
Citation Context ...l evidence for such unproved statements. In the case where N is prime, the heuristic arguments are very similar to those going into the analysis of the elliptic curve primality proving algorithm ECPP =-=[20]-=-. Section 5 comments on an efficient implementation of the Algorithm to solve Problem 2. It illustrates its practical applicability by treating as examples ‘random’ values of N such as N =102004 and N... |

25 | Action of modular correspondences around CM points
- Couveignes, Henocq
- 2002
(Show Context)
Citation Context ... CURVES OVER FINITE FIELDS 2165 This is the actual run time [9] for the classical analytic approach using the modular function j : H → C. The same is true for the more recent non-archimedean approach =-=[8]-=-, [5], [4] to the evaluation of P∆, which approximates the roots of P∆ by a Newton iteration process over Qℓ for a suitable small prime ℓ. For both methods, it is possible to reduce the run time by si... |

21 |
Hilbert’s 12th problem, complex multiplication and Shimura reciprocity
- Stevenhagen
- 2001
(Show Context)
Citation Context ...n process over Qℓ for a suitable small prime ℓ. For both methods, it is possible to reduce the run time by sizable constant factors if one replaces the j-function by ‘smaller’ modular functions [12], =-=[27]-=-, [4], [23]. This is very important from a practical, but not from a computational complexity point of view. In the complex multiplication method, one can save some work by computing the class polynom... |

18 | Proving primality in essentially quartic random time
- Bernstein
(Show Context)
Citation Context ... be done deterministically in time polynomial in log N by the 2002 result of Agrawal, Kayal and Saxena [1]. Recent speed-ups of the test [18] take time O((log N) 6+ε ), whereas probabilistic versions =-=[3]-=-, [19] have expected run time O((log N) 4+ε ). Using the various subroutines specified in the tasks above, we formulate an Algorithm to solve Problem 3. A slightly more practical algorithm that we use... |

17 | Constructing elliptic curves of prescribed order
- Bröker
- 2006
(Show Context)
Citation Context ...ER FINITE FIELDS 2165 This is the actual run time [9] for the classical analytic approach using the modular function j : H → C. The same is true for the more recent non-archimedean approach [8], [5], =-=[4]-=- to the evaluation of P∆, which approximates the roots of P∆ by a Newton iteration process over Qℓ for a suitable small prime ℓ. For both methods, it is possible to reduce the run time by sizable cons... |

17 | Primality testing with gaussian periods
- Pomerance
- 2009
(Show Context)
Citation Context ...rimality test to prove primality of p = N + 1 − Tr(α). This can be done deterministically in time polynomial in log N by the 2002 result of Agrawal, Kayal and Saxena [1]. Recent speed-ups of the test =-=[18]-=- take time O((log N) 6+ε ), whereas probabilistic versions [3, 19] have expected run time O((log N) 4+ε ). Using the various subroutines specified in the tasks above, we formulate an Algorithm to solv... |

16 |
Generating class fields using Shimura reciprocity, Algorithmic Number Theory — ANTS-III
- Gee, Stevenhagen
- 1998
(Show Context)
Citation Context ...eration process over Qℓ for a suitable small prime ℓ. For both methods, it is possible to reduce the run time by sizable constant factors if one replaces the j-function by ‘smaller’ modular functions =-=[12]-=-, [27], [4], [23]. This is very important from a practical, but not from a computational complexity point of view. In the complex multiplication method, one can save some work by computing the class p... |

15 | A comparison and a combination of SST and AGM algorithms for counting points of elliptic curves in characteristic 2
- Gaudry
- 2002
(Show Context)
Citation Context ...group of Fq-rational points of E is an integer in the Hasse interval (1.1) Hq =[( √ q − 1) 2 , ( √ q +1) 2 ]=[q +1− 2 √ q,q +1+2 √ q] around q + 1. Various point counting algorithms [24], [21], [14], =-=[11]-=- have been developed over the last 20 years that compute N in polynomial time from the standard representation of E by a Weierstrass equation over Fq. A natural ‘inverse problem’ to the point counting... |

13 |
Weber’s class invariants revisited
- Schertz
(Show Context)
Citation Context ...eration process over Qℓ for a suitable small prime ℓ. For both methods, it is possible to reduce the run time by sizable constant factors if one replaces the j-function by ‘smaller’ modular functions =-=[12, 27, 4, 23]-=-. This is very important from a practical, but not from a computational complexity point of view. In the complex multiplication method, one can save some work by computing the class polynomial PD for ... |

11 | Elliptic curves with a given number of points
- Bröker, Stevenhagen
(Show Context)
Citation Context ...ES OVER FINITE FIELDS 2165 This is the actual run time [9] for the classical analytic approach using the modular function j : H → C. The same is true for the more recent non-archimedean approach [8], =-=[5]-=-, [4] to the evaluation of P∆, which approximates the roots of P∆ by a Newton iteration process over Qℓ for a suitable small prime ℓ. For both methods, it is possible to reduce the run time by sizable... |

6 | On the construction of prime order elliptic curves
- Konstantinou, Stamatiou, et al.
(Show Context)
Citation Context ...subroutines of the kind mentioned above, the heuristic run time of our algorithm is O(2 ω(N) (log N) 4+ε )for every ε>0 (Corollary 4.4.). In the cryptographically relevant case where N is prime [22], =-=[15]-=-, this becomes O((log N) 4+ε ) (Corollary 4.2). It should not come as a surprise that our solutions to Problem 2 are elliptic curves defined over prime fields. Indeed, it is easy to see that the union... |

5 |
C.K.: Generating elliptic curves of prime order. In: Cryptographic hardware and embedded systems—CHES 2001
- Savas, Schmidt, et al.
- 2001
(Show Context)
Citation Context ...istic subroutines of the kind mentioned above, the heuristic run time of our algorithm is O(2 ω(N) (log N) 4+ε )for every ε>0 (Corollary 4.4.). In the cryptographically relevant case where N is prime =-=[22]-=-, [15], this becomes O((log N) 4+ε ) (Corollary 4.2). It should not come as a surprise that our solutions to Problem 2 are elliptic curves defined over prime fields. Indeed, it is easy to see that the... |

4 |
An application of computing to class field theory, Algebraic Number Theory
- Swinnerton-Dyer
- 1967
(Show Context)
Citation Context ...s prime. The curve Y 2 = X3 + X having j = 1728 and CM by Z[i] has 4 twists over Fp for each of these p, but in all cases Y 2 = X3 + X is the curve having 102004 points. This follows from a result in =-=[28]-=- going back to Gauss. It says if we choose the prime element π = a + bi dividing a prime p ≡ 1 mod 4 in Z[i] to satisfy π ≡ 1 mod (1 + i) 3 , then the curve Y 2 = X3 + X has exactly p + 1 − ( −1 π ) 4... |

3 |
L-series in algorithmic number theory”, in Surveys in algorithmic number theory, edited by
- Buhler
- 2006
(Show Context)
Citation Context ...N)(log N) 2 ). Task 2: Finding generators for principal ideals of norm N. For each ideal kI = k·(N0,ω−r) ⊂ Z[ω]ofnormN found, we use the 1908 algorithm of Cornacchia described in [25, pp. 229–232] or =-=[6]-=- to find a generator of I, ifit exists. This algorithm performs a number of steps of the Euclidean algorithm to the basis elements N0 and ω − r of the Z-lattice I =(N0,ω− r) ⊂ Z[ω] inorder to decide w... |

2 | The theory of the Riemann Zeta-Function with applications - Ivić - 1985 |

1 |
Efficient ‘quasi’-deterministic primalisty test improving AKS, preprint
- Mihăilescu, Avanzi
- 2003
(Show Context)
Citation Context ...one deterministically in time polynomial in log N by the 2002 result of Agrawal, Kayal and Saxena [1]. Recent speed-ups of the test [18] take time O((log N) 6+ε ), whereas probabilistic versions [3], =-=[19]-=- have expected run time O((log N) 4+ε ). Using the various subroutines specified in the tasks above, we formulate an Algorithm to solve Problem 3. A slightly more practical algorithm that we use to ac... |

1 |
Weber’s class invariants revisited,J.Théorie des Nombres de
- Schertz
(Show Context)
Citation Context ...ver Qℓ for a suitable small prime ℓ. For both methods, it is possible to reduce the run time by sizable constant factors if one replaces the j-function by ‘smaller’ modular functions [12], [27], [4], =-=[23]-=-. This is very important from a practical, but not from a computational complexity point of view. In the complex multiplication method, one can save some work by computing the class polynomial PD for ... |