## Computing the endomorphism ring of an ordinary elliptic curve over a finite field

Venue: | Journal of Number Theory |

Citations: | 15 - 7 self |

### BibTeX

@ARTICLE{Bisson_computingthe,

author = {Gaetan Bisson and Andrew and V. Sutherland},

title = {Computing the endomorphism ring of an ordinary elliptic curve over a finite field},

journal = {Journal of Number Theory},

year = {}

}

### OpenURL

### Abstract

Abstract. We present two algorithms to compute the endomorphism ring of an ordinary elliptic curve E defined over a finite field Fq. Under suitable heuristic assumptions, both have subexponential complexity. We bound the complexity of the first algorithm in terms of log q, while our bound for the second algorithm depends primarily on log |DE|, where DE is the discriminant of the order isomorphic to End(E). As a byproduct, our method yields a short certificate that may be used to verify that the endomorphism ring is as claimed. 1.

### Citations

301 | An Introduction to the Theory of - Hardy, Wright - 1960 |

240 |
Factoring integers with elliptic curves
- Lenstra
- 1987
(Show Context)
Citation Context ...tion, then we assume that #R/D1 > #R/D2 with probability bounded above zero. (4) Integer factorization. We assume that ECM finds a prime factor p of an integer n in expected time L [1/2, 2](p)log 2 n =-=[23]-=-, and that the expected running time of the number field sieve is L [1/3, cf] (n) [9]. We identify statements that depend on these heuristics with the label (H).COMPUTING ENDOMORPHISM RINGS 11 Propos... |

238 | Advanced topics in the arithmetic of elliptic curves - Silverman - 1994 |

170 | Elliptic curves and primality proving
- Atkin, Morain
- 1993
(Show Context)
Citation Context ... This may be accomplished in polynomial time if the trace t and the factorizations of v and DK are included in the certificate. One may additionally wish to certify the primes in these factorizations =-=[2]-=-, or the verifier may apply a polynomial-time primality test [1]. Assuming these values are correct, the conductor of O(E) is equal to u if and only if Verify(E, C) returns true. This statement does n... |

117 | Elliptic Curves: number theory and cryptography - Washington - 2003 |

114 |
Primes of the form x 2 + ny 2
- Cox
- 1989
(Show Context)
Citation Context ...ogeny of degree ℓ, and this defines a faithful group action by cl(u 2 DK). For a proof, see Theorems 10.5, 13.12, and 13.14 in [23], or Chapter 3 of [21]. For additional background, we also recommend =-=[12]-=- and [31, Ch. II]. Theorem 1 implies that the cardinality of Ellt,u(Fq) is a multiple of the class number h(u 2 DK), and in fact these values are equal [30]. In general, the curves ℓ-isogenous to E ne... |

95 | Odlyzko – Effective versions of the Chebotarev density theorem, Algebraic number fields - Lagarias, M - 1975 |

88 | Counting points on elliptic curves over finite fields. Journal de Theorie des nombres de
- Schoof
- 1995
(Show Context)
Citation Context ...= Q (√ ) DK : (1) π = t + v√DK with 4q = t 2 2 − v 2 DK. The trace of π may be computed as t = q + 1 − #E. Applying Schoof’s algorithm to count the points on E/Fq, this can be done in polynomial time =-=[29]-=-. The fundamental discriminant DK and the integer v are then obtained by factoring 4q − t2 , which can be accomplished probabilistically in subexponential time [25]. The endomorphism ring of E is isom... |

76 | On a problem of Oppenheim concerning ”Factorisatio Numerorum - Canfield, Erdös, et al. - 1983 |

62 |
Factoring integers with the number field sieve
- BUHLER, LENSTRA, et al.
- 1994
(Show Context)
Citation Context ... and the bound L [1/2 + o(1), 1] (|DE|) + L [1/3, cf ] (q) for Algorithm 2 (Proposition 10). The L [1/3, cf ] term reflects the heuristic complexity of factoring 4q − t 2 using the number field sieve =-=[9]-=-. Algorithm 2 is slower than Algorithm 1 in general, but may be much faster when u ≪ v. In certain cryptographic applications the discriminant DE is an important security parameter (see [6] for one ex... |

61 |
A rigorous subexponential algorithm for computation of class groups
- Hafner, McCurley
- 1989
(Show Context)
Citation Context ...his inequality. As noted at the end of Section 2, this test almost always succeeds, but if not we search for another relation. To find relations that hold in cl(D1), we adapt an algorithm of McCurley =-=[18, 26]-=-. Fix a smoothness bound B, and for each prime ℓ � B with (D1 | ℓ) ̸= −1, let fℓ denote the primeform with norm ℓ. By this we mean the binary quadratic form (ℓ, bℓ, cℓ) of discriminant D1 with bℓ � 0,... |

59 | Elliptic Curves - Husemöller - 2004 |

49 |
Endomorphism rings of elliptic curves over finite fields
- Kohel
- 1996
(Show Context)
Citation Context ...norm ℓ. Then a acts on the set Ellt,u(Fq) via an isogeny of degree ℓ, and this defines a faithful group action by cl(u 2 DK). For a proof, see Theorems 10.5, 13.12, and 13.14 in [23], or Chapter 3 of =-=[21]-=-. For additional background, we also recommend [12] and [31, Ch. II]. Theorem 1 implies that the cardinality of Ellt,u(Fq) is a multiple of the class number h(u 2 DK), and in fact these values are equ... |

46 |
A rigorous time bound for factoring integers
- Pomerance
- 1992
(Show Context)
Citation Context ...this can be done in polynomial time [29]. The fundamental discriminant DK and the integer v are then obtained by factoring 4q − t2 , which can be accomplished probabilistically in subexponential time =-=[25]-=-. The endomorphism ring of E is isomorphic to an order O(E) of K. Once v and DK are known, there are only finitely many possibilities for O(E), since (2) Z [π] ⊆ O(E) ⊆ OK. Here Z [π] denotes the orde... |

27 |
Analytic methods in the analysis and design of number-theoretic algorithms
- Bach
- 1985
(Show Context)
Citation Context ... 1 µ log1/2 |D1|(log log |D1|) −1/2 , since we expect a random B-smooth integer in [1, n] to have (2 + o(1)) log n/ log B distinct prime factors (this may be proven with the random bisection model of =-=[3]-=-). This, together with Heuristic 3, ensures that when Step 8 is reached the algorithm terminates, with some constant probability greater than zero. Thus we expect to reach Step 9 just O(1) times, and ... |

22 | Smooth numbers: computational number theory and beyond
- Granville
- 2008
(Show Context)
Citation Context ...ances the expected running time of FindRelation with that of computing #R/DE. The iteration bound 2m(B, n) = 6 · 107 has been evaluated via m(B, n) = 1/ρ(u) with u = log n/ log B ≈ 8 using Table 1 of =-=[17]-=-, computed by Bernstein. After about 20 minutes, FindRelation outputs the relation R with (ℓ ei i ) = (22533 , 11 752 , 29 2 , 37 47 , 79 1 , 113 1 , 149 1 , 151 2 , 347 1 , 431 1 ), for which #R/D1 =... |

20 |
Fast reduction and composition of binary quadratic forms
- Schönhage
- 1991
(Show Context)
Citation Context ...r ℓ we compute Φℓ/Fq, that is, the integer polynomial Φℓ reduced modulo the characteristic of Fq. This can be accomplished in time O(ℓ 3+ɛ log q) and space O(ℓ 2+ɛ log q) using the 1 The algorithm of =-=[28]-=- has complexity O(log 1+ɛ |D|), but we do not make use of it. 2 This isogeny is necessarily cyclic, since it has prime degree.4 GAETAN BISSON AND ANDREW V. SUTHERLAND CRT method described in [7]. In ... |

19 | Computing Hilbert class polynomials with the Chinese remainder theorem
- Sutherland
(Show Context)
Citation Context ...alks we may take in the isogeny graph, starting from j(E), considering all possible sign vectors τ (these 3 In practice, we may wish to relax the constraint ℓi ∤ v when ℓi is very small (e.g. 2), see =-=[33]-=-. i=1COMPUTING ENDOMORPHISM RINGS 5 walks typically form a tree in which each path from root to leaf has k binary branch points). By the symmetry noted above, we may fix τ1 = 1. Algorithm CountRelati... |

18 | Computing modular polynomials in quasi-linear time
- Enge
(Show Context)
Citation Context ...and E2 defined over Fq are connected by an isogeny of degree ℓ if and only if Φℓ(j(E1), j(E2)) = 0 [34, Thm. 19]. 2 The polynomial Φℓ has size O(ℓ 3 log ℓ) [11], and may be computed in time O(ℓ 3+ɛ ) =-=[14]-=-. When ℓ is small we use precomputed Φℓ ∈ Z[X, Y ], but for larger ℓ we compute Φℓ/Fq, that is, the integer polynomial Φℓ reduced modulo the characteristic of Fq. This can be accomplished in time O(ℓ ... |

18 |
Cryptographic key distribution and computation in class groups
- McCurley, “Short
- 1989
(Show Context)
Citation Context ...certain smooth relation, and by performing similar computations in class groups of orders in OK we are able to determine the power of p dividing u (via Corollary 4). We adapt an algorithm of McCurley =-=[26]-=- to efficiently find smooth relations, achieving a heuristically subexponential running time. First, we present some necessary background. 2.1. Theoretical background. Let us fix an ordinary elliptic ... |

16 | Binary quadratic forms: An algorithmic approach - Buchmann, Vollmer - 2007 |

14 |
Complex multiplication, Algebraic Number Theory
- Serre
- 1967
(Show Context)
Citation Context ...or additional background, we also recommend [12] and [31, Ch. II]. Theorem 1 implies that the cardinality of Ellt,u(Fq) is a multiple of the class number h(u 2 DK), and in fact these values are equal =-=[30]-=-. In general, the curves ℓ-isogenous to E need not belong to Ellt,u(Fq). However, when ℓ does not divide v, we have the following result of Kohel [21, Prop. 23]: Theorem 2. Let ℓ be a prime not dividi... |

13 | An analysis of the reduction algorithms for binary quadratic forms
- Biehl, Buchmann
- 1998
(Show Context)
Citation Context ... − 4ac. The integer a corresponds to the norm of the ideal. Ideal classes in cl(D) are uniquely represented by reduced forms. As typically implemented, the group operation has complexity O(log 2 |D|) =-=[5]-=-. 1 To navigate the isogeny graph, we rely on the classical modular polynomial Φℓ(X, Y ), which parametrizes pairs of ℓ-isogenous elliptic curves. This is a symmetric polynomial with integer coefficie... |

11 |
On the coefficients of the transformation polynomials for the elliptic modular function
- Cohen
- 1984
(Show Context)
Citation Context ...me ℓ not dividing q, two elliptic curves E1 and E2 defined over Fq are connected by an isogeny of degree ℓ if and only if Φℓ(j(E1), j(E2)) = 0 [34, Thm. 19]. 2 The polynomial Φℓ has size O(ℓ 3 log ℓ) =-=[11]-=-, and may be computed in time O(ℓ 3+ɛ ) [14]. When ℓ is small we use precomputed Φℓ ∈ Z[X, Y ], but for larger ℓ we compute Φℓ/Fq, that is, the integer polynomial Φℓ reduced modulo the characteristic ... |

11 |
et al. GNU Multiple Precision Arithmetic Library. URL: http: //gmplib.org
- Granlund
(Show Context)
Citation Context ...ngs we give here were achieved by a simple implementation running on a single 2.4GHz Intel Q6600 core. The algorithm FindRelation was implemented using the GNU C/C++ compiler [32] and the GMP library =-=[16]-=-, and for CountRelation we used a PARI/GP script [27]. We did not attempt to maximize performance, our purpose was simply to demonstrate the practicality of the algorithms on some large inputs. In a m... |

10 |
Isogeny volcanoes and the SEA algorithm, Algorithmic Number Theory — ANTS-V
- Fouquet, Morain
- 2002
(Show Context)
Citation Context ...α corresponds to a cycle of ℓ-isogenies whose length is equal to the order of α in cl(DE). Additional details on the structure of the isogeny graph can be found in [21] and, in a more concise way, in =-=[15]-=-. 2.2. Explicit computation. We implement class group computations using binary quadratic forms. For a negative discriminant D, the ideals in O(D) correspond to primitive, positive-definite, binary qu... |

6 |
Lenstra Jr. Factoring integers with elliptic curves
- Hendrik
- 1987
(Show Context)
Citation Context ...on, then we assume that #R/D1 > #R/D2 with probability bounded above zero. (4) Integer factorization. We assume that ECM finds a prime factor p of an integer n in expected time L [1/2, 2] (p) log 2 n =-=[24]-=-, and that the expected running time of the number field sieve is L [1/3, cf ] (n) [9].COMPUTING ENDOMORPHISM RINGS 11 In the propositions and corollaries that follow, we use the shorthand (H) to ind... |

5 |
How to find smooth parts of integers
- Bernstein
- 2004
(Show Context)
Citation Context ...g negligible within the precision of our subexponential complexity bounds. A faster approach uses Bernstein’s algorithm, which identifies the smooth numbers in a given list in essentially linear time =-=[4]-=-. This does not change our complexity bounds and for the sake of simplicity we use ECM in our analysis. In practice, the bound B is quite small (under 1000 in both our examples), and very little time ... |

3 |
et al., GNU compiler collection, August 2008, version 4.3.2, available at http://gcc.gnu.org
- Stallman
(Show Context)
Citation Context .... Examples The rough timings we give here were achieved by a simple implementation running on a single 2.4GHz Intel Q6600 core. The algorithm FindRelation was implemented using the GNU C/C++ compiler =-=[32]-=- and the GMP library [16], and for CountRelation we used a PARI/GP script [27]. We did not attempt to maximize performance, our purpose was simply to demonstrate the practicality of the algorithms on ... |

2 |
Computing modular polynomials with the CRT method, 2009, in preparation
- Bröker, Lauter, et al.
(Show Context)
Citation Context ... of [28] has complexity O(log 1+ɛ |D|), but we do not make use of it. 2 This isogeny is necessarily cyclic, since it has prime degree.4 GAETAN BISSON AND ANDREW V. SUTHERLAND CRT method described in =-=[7]-=-. In practice one may consider alternative modular polynomials that are sparser and have smaller coefficients than Φℓ. To find the curves that are ℓ-isogenous to E, we compute the roots of the univari... |

1 |
How to find smooth parts of integers, 2004, http://cr.yp.to/papers# smoothparts
- Bernstein
(Show Context)
Citation Context ...g negligible within the precision of our subexponential complexity bounds. A faster approach uses Bernstein’s algorithm, which identifies the smooth numbers in a given list in essentially linear time =-=[4]-=-. This does not change our complexity bounds and for the sake of simplicity we use ECM in our analysis. In practice, the bound B is quite small (under 1000 in both our examples), and very little time ... |