## On the exponent of the group of points on elliptic curves in extension fields

Venue: | Intern. Math. Research Notices |

Citations: | 8 - 5 self |

### BibTeX

@ARTICLE{Luca_onthe,

author = {Florian Luca and Igor E. Shparlinski},

title = {On the exponent of the group of points on elliptic curves in extension fields},

journal = {Intern. Math. Research Notices},

year = {},

volume = {2005},

pages = {1391--1409}

}

### OpenURL

### Abstract

Let E be an elliptic curve defined over Fq, a finite field of q elements. Furthermore, we consider

### Citations

305 |
Reducing Elliptic Curves Logarithms to Logarithms in a Finite Field
- Menezes, Okamoto, et al.
- 1993
(Show Context)
Citation Context ...ned over Fq (see [22, 27]). We also give an application of our results to the analysis of the so-called MOV attack on the elliptic curve discrete logarithm developed by Menezes, Okamoto, and Vanstone =-=[17]-=-. This result complements those obtained in [1, 16]. Finally, we show that our bounds are relevant to estimating complexity of the algorithm of [18] which actually computes ℓ(qn ). Throughout this pap... |

168 |
The arithmetic of elliptic curves, Graduate Text
- Silverman
- 1986
(Show Context)
Citation Context ...his group satisfies the Hasse-Weil relation #E � Fqn � n n n = q + 1 − τ − τ , (1.1) where the Frobenius roots τ, τ are complex conjugate quadratic irrationalities with |τ| = |τ| = q 1/2 , (1.2) (see =-=[2, 23]-=- for this, and other general properties of elliptic curves). It is well known that the group of Fqn-rational points E(Fqn) is of the form E � Fqn � ∼= ZL × ZM, (1.3) where the integers L and M are uni... |

117 |
The Weil Pairing, and Its Efficient Calculation
- Miller
(Show Context)
Citation Context ...garithm developed by Menezes, Okamoto, and Vanstone [17]. This result complements those obtained in [1, 16]. Finally, we show that our bounds are relevant to estimating complexity of the algorithm of =-=[18]-=- which actually computes ℓ(qn ). Throughout this paper, we use the symbols “O,” “≪,” “≫,” “≍,” and“o” intheir usual meaning (we recall that A ≪ B and B ≫ A are equivalent to A = O(B)). The implied con... |

89 | Supersingular curves in cryptography - Galbraith - 2001 |

80 |
The improbability that an elliptic curve has subexponential discrete log problem under the Menezes–Okamoto–Vanstone algorithm
- Balasubramanian, Koblitz
- 1998
(Show Context)
Citation Context ...ication of our results to the analysis of the so-called MOV attack on the elliptic curve discrete logarithm developed by Menezes, Okamoto, and Vanstone [17]. This result complements those obtained in =-=[1, 16]-=-. Finally, we show that our bounds are relevant to estimating complexity of the algorithm of [18] which actually computes ℓ(qn ). Throughout this paper, we use the symbols “O,” “≪,” “≫,” “≍,” and“o” i... |

36 |
A Classical Invitation to Algebraic Numbers and Class Fields
- Cohn
- 1978
(Show Context)
Citation Context ...g x for the maximum between 1 and the natural logarithm of x.s1394 F. Luca and I. E. Shparlinski 2 Preparations In this section, we review some standard notions of algebraic number theory (see, e.g., =-=[4, 19, 25]-=-), diophantine equations and diophantine approximations, as well as elliptic curves. For a complex number z, we write z for its conjugate. Let L be an algebraic number field of degree D over Q. Denote... |

35 |
Multiplicities of recurrence sequences
- Schlickewei
- 1996
(Show Context)
Citation Context ...icate the similarities throughoutsExponents of Groups of Points on Elliptic Curves 1393 the proof. A new ingredient introduced in this paper is the use of the bound of van der Poorten and Schlickewei =-=[26]-=- on the number of zeros of nondegenerated linear recurrence sequences, which is based on p-adic methods. Unfortunately, the method of the proof does not allow us to find the set n with ℓ(qn ) <qn(1−ε)... |

22 |
A quantitative version of the Absolute Subspace Theorem
- Evertse, Schlickewei
(Show Context)
Citation Context ...ic methods. Unfortunately, the method of the proof does not allow us to find the set n with ℓ(qn ) <qn(1−ε) explicitly. This is because this technique is based on the celebrated subspace theorem (see =-=[11, 12]-=- for the most recent achievements), which is not effective. In order to get an effective, albeit weaker, estimate of ℓ(qn ), we use lower bounds on linear forms in p-adic logarithms. In particular, we... |

17 |
The exponents of the group of points on the reduction of an elliptic curve
- Schoof
- 1991
(Show Context)
Citation Context .../2 ≥ � q n + 1 − 2q n/2� 1/2 = q n/2 − 1 (1.4) holds for all q and n. For a fixed elliptic curve E which is defined over Q and has no complex multiplication (see [2, 23]), it has been shown by Schoof =-=[21]-=- that for the reduction E(Fp) of E modulo a prime p, the inequality ℓ(p) ≥ C(E) p1/2 log p log log p (1.5) holds for all prime numbers p, where the constant C(E) >0depends only on the curve E. Duke [1... |

15 | Cyclicity of elliptic curves modulo p and elliptic curve analogues of Linnik’s problem. Mathematische Annalen 330
- Cojocaru, Murty
- 2004
(Show Context)
Citation Context ...satisfactorily answered by Vlădut¸ [28]. In the situation where E is defined over Q, the question about the cyclicity of the reduction E(Fp) when p runs over the primes appears to be much harder (see =-=[5, 6, 7]-=- for recent advances and surveys of other related results). In particular, this problem is closely related to the famous Lang-Trotter conjecture. One can also study an apparently easier question about... |

15 |
Algebraic Number Theory and Fermat’s Last Theorem
- Stewart, Tall
- 2002
(Show Context)
Citation Context ...g x for the maximum between 1 and the natural logarithm of x.s1394 F. Luca and I. E. Shparlinski 2 Preparations In this section, we review some standard notions of algebraic number theory (see, e.g., =-=[4, 19, 25]-=-), diophantine equations and diophantine approximations, as well as elliptic curves. For a complex number z, we write z for its conjugate. Let L be an algebraic number field of degree D over Q. Denote... |

13 |
An improvement of the Quantitative Subspace Theorem
- Evertse
- 1996
(Show Context)
Citation Context ...ic methods. Unfortunately, the method of the proof does not allow us to find the set n with ℓ(qn ) <qn(1−ε) explicitly. This is because this technique is based on the celebrated subspace theorem (see =-=[11, 12]-=- for the most recent achievements), which is not effective. In order to get an effective, albeit weaker, estimate of ℓ(qn ), we use lower bounds on linear forms in p-adic logarithms. In particular, we... |

13 |
Elementary and analytic theory of algebraic
- Narkiewicz
- 1990
(Show Context)
Citation Context ...g x for the maximum between 1 and the natural logarithm of x.s1394 F. Luca and I. E. Shparlinski 2 Preparations In this section, we review some standard notions of algebraic number theory (see, e.g., =-=[4, 19, 25]-=-), diophantine equations and diophantine approximations, as well as elliptic curves. For a complex number z, we write z for its conjugate. Let L be an algebraic number field of degree D over Q. Denote... |

12 |
An upper bound for the GCD
- Bugeaud, Corvaja, et al.
(Show Context)
Citation Context ...6 . (1.6) X n<X Our approach is based on a link between the size of ℓ(q n ) and the size of gcd(τ n − 1, τ n − 1). Questions of this kind have recently been extensively studied in the literature, see =-=[3, 8, 9, 24]-=-. In particular, the main result of Corvaja and Zannier [9] immediately implies that W(ε) is bounded for every fixed ε > 0. In order to get an explicit quantitative form of the result, we follow very ... |

12 |
p-Adic Logarithmic Forms and Group Varieties. II.” Acta Arith. 89
- Yu
- 1999
(Show Context)
Citation Context ... s ≤ (K − 1) � 4(D + ω) � 2ω+1 , (2.11) where ω is the number of prime ideal divisors of α1 ···αK in OL. � We will also need the following lower bound for a linear form in p-adic logarithms due to Yu =-=[29]-=-. For a nonzero number γ ∈ L, we use h(γ) = log H(γ) for its logarithmic height. Lemma 2.3. Let π be a nonzero prime ideal in OL dividing a prime number p ∈ Z, and let γ1,...,γM be nonzero numbers in ... |

9 |
On the greatest prime factor of (ab
- Corvaja, Zannier
- 2003
(Show Context)
Citation Context ...6 . (1.6) X n<X Our approach is based on a link between the size of ℓ(q n ) and the size of gcd(τ n − 1, τ n − 1). Questions of this kind have recently been extensively studied in the literature, see =-=[3, 8, 9, 24]-=-. In particular, the main result of Corvaja and Zannier [9] immediately implies that W(ε) is bounded for every fixed ε > 0. In order to get an explicit quantitative form of the result, we follow very ... |

9 |
Cyclicity statistics for elliptic curves over finite fields
- Vlăduţ
- 1999
(Show Context)
Citation Context ...lated to the famous Lang-Trotter conjecture. One can also study an apparently easier question about the distribution of ℓ(q) “on average” over various families of elliptic curves defined over Fq (see =-=[22, 27]-=-). We also give an application of our results to the analysis of the so-called MOV attack on the elliptic curve discrete logarithm developed by Menezes, Okamoto, and Vanstone [17]. This result complem... |

8 |
On the cyclicity of the group of Fp -rational points of non-CM elliptic curves
- Cojocaru
(Show Context)
Citation Context ...satisfactorily answered by Vlădut¸ [28]. In the situation where E is defined over Q, the question about the cyclicity of the reduction E(Fp) when p runs over the primes appears to be much harder (see =-=[5, 6, 7]-=- for recent advances and surveys of other related results). In particular, this problem is closely related to the famous Lang-Trotter conjecture. One can also study an apparently easier question about... |

6 |
The number of solutions of polynomialexponential equations
- Schlickewei, Schmidt
(Show Context)
Citation Context ...d due to van der Poorten and Schlickewei (see [26]) on the number of zeros of linear recurrence sequences. Although there exists a more general result of this type due to Schlickewei and Schmidt (see =-=[20]-=-), it turns out that the above result is more useful for our purpose.s1396 F. Luca and I. E. Shparlinski Lemma 2.2. Let K ≥ 1 be an integer, and let αj,βj ∈ OL\{0}, j = 1,...,K, such that αi/αj is not... |

5 |
Small exponent point groups on elliptic curves
- Luca, McKee, et al.
(Show Context)
Citation Context ... we show that the inequality ℓ � q n� n/2+ϑ(q)n/ log n >q (1.7) holds for all positive integers n with some effective constant ϑ(q) >0depending on q (and E). In the opposite direction, it is shown in =-=[15]-=- that for some absolute constant ρ> 0, the inequality ℓ � q n� ≤ q n exp � ρ/ log log − n n� (1.8) holds for infinitely many positive integers n. The question of cyclicity, that is, whether ℓ(qn ) = #... |

4 | MOV attack in various subgroups on elliptic curves
- Luca, Mireles, et al.
(Show Context)
Citation Context ...ication of our results to the analysis of the so-called MOV attack on the elliptic curve discrete logarithm developed by Menezes, Okamoto, and Vanstone [17]. This result complements those obtained in =-=[1, 16]-=-. Finally, we show that our bounds are relevant to estimating complexity of the algorithm of [18] which actually computes ℓ(qn ). Throughout this paper, we use the symbols “O,” “≪,” “≫,” “≍,” and“o” i... |

3 |
Orders of points on elliptic curves, Affine Algebraic Geometry
- Shparlinski
(Show Context)
Citation Context ...lated to the famous Lang-Trotter conjecture. One can also study an apparently easier question about the distribution of ℓ(q) “on average” over various families of elliptic curves defined over Fq (see =-=[22, 27]-=-). We also give an application of our results to the analysis of the so-called MOV attack on the elliptic curve discrete logarithm developed by Menezes, Okamoto, and Vanstone [17]. This result complem... |

1 |
Almost all reductions modulo pof an elliptic curve have a large exponent
- Duke
(Show Context)
Citation Context ...1] that for the reduction E(Fp) of E modulo a prime p, the inequality ℓ(p) ≥ C(E) p1/2 log p log log p (1.5) holds for all prime numbers p, where the constant C(E) >0depends only on the curve E. Duke =-=[10]-=- has recently shown, unconditionally for elliptic curves with complex multiplication, and under the extended Riemann hypothesis for elliptic curves without complex multiplication, that for any functio... |

1 |
greatest common divisors, divisibility sequences, and Vojta’s conjecture for blowups
- Generalized
(Show Context)
Citation Context ...6 . (1.6) X n<X Our approach is based on a link between the size of ℓ(q n ) and the size of gcd(τ n − 1, τ n − 1). Questions of this kind have recently been extensively studied in the literature, see =-=[3, 8, 9, 24]-=-. In particular, the main result of Corvaja and Zannier [9] immediately implies that W(ε) is bounded for every fixed ε > 0. In order to get an explicit quantitative form of the result, we follow very ... |