## ELLIPTIC PERIODS AND PRIMALITY PROVING (EXTENTED VERSION) (2009)

### BibTeX

@MISC{Couveignes09ellipticperiods,

author = {Jean-marc Couveignes and Tony Ezome and Reynald Lercier},

title = {ELLIPTIC PERIODS AND PRIMALITY PROVING (EXTENTED VERSION)},

year = {2009}

}

### OpenURL

### Abstract

We construct extension rings with fast arithmetic using isogenies between elliptic curves. As an application, we give an elliptic version of the AKS primality criterion.

### Citations

475 | Introduction to Commutative Algebra - Atiyah, Macdonald - 1969 |

96 |
A remark on Stirling’s formula
- Robbins
- 1955
(Show Context)
Citation Context ...k/d. We set −→ α = (α1, . . . , αK) and define the corresponding entropy to be H( −→ α ) = H(α1, . . . , αK) = −α1 log α1 − α2 log α2 − · · · − αK log αK. We recall Robbins effective Stirling formula =-=[21]-=-. For every positive integer d, ( ) √ d d 1 2πd exp( e 12d + 1 ) � d! � √ ( ) d d 2πd exp( e 1 ) . 12d We deduce (2πd) 1−K 2 exp(d × H(α1, . . . , αK) + 1 13 We shall need the following definition. ( ... |

93 |
Schnelle multiplikation grosser zahlen
- Schönhage, Strassen
- 1971
(Show Context)
Citation Context ...og d log log d) operations (additions, subtractions, multiplications) in R = Z/nZ. So the total cost is O((log n) 2 (log log n) 1+o(1) × d log d log log d) elementary operations using fast arithmetic =-=[22, 23]-=-. In Section 3.4, we explain why one can hope to find a degree d that is O((log n) 2 ). With such a d, one can verify Eq. (42) in time O((log n) 4 (log log n) 2+o(1) ). Moreover, we explain how to con... |

56 |
Schnelle Multiplikation von Polynomen über Körpern der Charakteristik 2
- Schönhage
- 1977
(Show Context)
Citation Context ...og d log log d) operations (additions, subtractions, multiplications) in R = Z/nZ. So the total cost is O((log n) 2 (log log n) 1+o(1) × d log d log log d) elementary operations using fast arithmetic =-=[22, 23]-=-. In Section 3.4, we explain why one can hope to find a degree d that is O((log n) 2 ). With such a d, one can verify Eq. (42) in time O((log n) 4 (log log n) 2+o(1) ). Moreover, we explain how to con... |

54 | Éléments de mathématique. Algèbre commutative - Bourbaki - 1983 |

35 | Elliptic Curves and Their Applications to Cryptography — An Introduction - ENGE - 1999 |

32 |
Algorithms in number theory
- Lenstra, Lenstra
- 1990
(Show Context)
Citation Context ...the expected running time of this first step is (log n) 2+o(1) . We note that the search for split discriminants can be accelerated using the same technique as in the J.O. Shallit fast-ECPP algorithm =-=[15, 19]-=-. The second step of the algorithm constructs the ring S from the couple (−∆, d). Once we have found a quadratic order O, we compute the associated Hilbert class polynomial. Computing HO(X) requires q... |

28 | F.: The number field sieve in the medium prime case
- Joux, Lercier, et al.
- 2006
(Show Context)
Citation Context ...f unity ζ. The associated R-algebra S = R[x]/(x d − α) has shown to be extremely useful, including in very recent algorithmic applications such as integer factoring and discrete logarithm computation =-=[12]-=-, primality proving [1, 6], fast polynomial factorization and composition [14], low complexity normal basis [20, 11, 2] of field extensions and ring extensions [17]. Part of this computational relevan... |

27 | Implementing the asymptotically fast version of the elliptic curve primality proving algorithm
- Morain
(Show Context)
Citation Context ...the expected running time of this first step is (log n) 2+o(1) . We note that the search for split discriminants can be accelerated using the same technique as in the J.O. Shallit fast-ECPP algorithm =-=[15, 19]-=-. The second step of the algorithm constructs the ring S from the couple (−∆, d). Once we have found a quadratic order O, we compute the associated Hilbert class polynomial. Computing HO(X) requires q... |

18 |
Isogénies entre courbes elliptiques. Comptes Rendus de l’Académie des Sciences de Paris
- Vélu
- 1971
(Show Context)
Citation Context ... 2 = X 3 + a2X 2 Z + a4XZ 2 + a6Z 3 . b2 = a 2 1 + 4a2 , b4 = a1a3 + 2a4 , b6 = a 2 3 + 4a6 , b8 = a 2 1a6 + 4a2a6 − a1a3a4 + a2a 2 3 − a 2 4 . We denote by O = [0 : 1 : 0] the origin. Following Vélu =-=[26, 25]-=- and Couveignes and Lercier [9], we state a few identities related to a degree d separable isogeny with cyclic kernel I : E → E ′ . We exhibit in Section 2.1.3 a normal basis for the field extension K... |

17 | Fast modular composition in any characteristic
- Umans
(Show Context)
Citation Context ...ly useful, including in very recent algorithmic applications such as integer factoring and discrete logarithm computation [12], primality proving [1, 6], fast polynomial factorization and composition =-=[14]-=-, low complexity normal basis [20, 11, 2] of field extensions and ring extensions [17]. Part of this computational relevance is due to the purely algebraic properties of S: a finite free étale R-algeb... |

17 | Primality testing with gaussian periods
- Pomerance
- 2009
(Show Context)
Citation Context ... the cyclic algebra R[x]/(xr − 1) where r is a well chosen, and rather large, integer. Lenstra and Pomerance generalized this algorithm and obtained the better deterministic complexity (log n) 6+o(1) =-=[16]-=-. The main improvement in Lenstra and Pomerance’s approach consists in using a more general construction for the free commutative algebra S. As a consequence, the dimension of S is much smaller for a ... |

16 |
Courbes elliptiques munies d’un sous-groupe Z/nZ
- Vélu
- 1978
(Show Context)
Citation Context ... 2 = X 3 + a2X 2 Z + a4XZ 2 + a6Z 3 . b2 = a 2 1 + 4a2 , b4 = a1a3 + 2a4 , b6 = a 2 3 + 4a6 , b8 = a 2 1a6 + 4a2a6 − a1a3a4 + a2a 2 3 − a 2 4 . We denote by O = [0 : 1 : 0] the origin. Following Vélu =-=[26, 25]-=- and Couveignes and Lercier [9], we state a few identities related to a degree d separable isogeny with cyclic kernel I : E → E ′ . We exhibit in Section 2.1.3 a normal basis for the field extension K... |

9 | Sharpening ’primes in p’ for a large family of numbers
- Berrizbeitia
- 2005
(Show Context)
Citation Context ...d R-algebra S = R[x]/(x d − α) has shown to be extremely useful, including in very recent algorithmic applications such as integer factoring and discrete logarithm computation [12], primality proving =-=[1, 6]-=-, fast polynomial factorization and composition [14], low complexity normal basis [20, 11, 2] of field extensions and ring extensions [17]. Part of this computational relevance is due to the purely al... |

9 |
Arithmetic moduli of elliptic curves. Annals of Mathematics studies, study 108
- Katz, Mazur
- 1985
(Show Context)
Citation Context ...th equation Y 2 Z + A1XY Z + A3Y Z 2 = X 3 + A2X 2 Z + A4XZ 2 + A6Z 3 . We denote by O the section [0, 1, 0]. We have Eaff = E − O and E is an elliptic curve over (the spectrum of) A1 in the sense of =-=[13]-=-. For every integer k � 0, we denote by ψk(A1, A2, A3, A4, A6, x, y) the functions in A1[x, y]/(Λ) defined recursively as in [10, Prop. 3.53]: ψ0 = 0, ψ1 = 1, ψ2 = 2y + A1x + A3, ψ3 = 3x 4 + B2x 3 + 3... |

9 |
On some subgroups of the multiplicative group of finite rings
- Voloch
(Show Context)
Citation Context ..., 1, . . . , d − 1}, then aS1 and aS2 are distinct elements in S/pS. So the order of a in (S/pS)∗ is at least 2 d −1. This lower bound can be improved by several means (see for instance Voloch’s work =-=[27]-=-). If 2 d is bigger than n ⌊√ d⌋ , we deduce from Theorem 3 that n is a prime power. Corollary 1 (Berrizbeitia criterion). Let n � 3 be an integer and set R = Z/nZ. Let S = R[x]/(xd − α) where d � 2 d... |

8 |
Efficient quasi-deterministic primality test improving AKS
- Avanzi, Mihăilescu
(Show Context)
Citation Context ...robabilistic variant of these algorithms that works in time (log n) 4+o(1) provided n − 1 has a divisor d bigger than (log 2 n) 2 and smaller than a constant times (log 2 n) 2 . Avanzi and Mihăilescu =-=[4]-=-, and independently Bernstein [5], explain how to treat a general integer n using a divisor d of n f − 1 instead, where f is a small integer. The initial idea consists in using R-automorphisms of S to... |

8 | Counting Points on Elliptic Curves over Finite Fields of Small Characteristic in Quasi Quadratic Time
- Lercier, Lubicz
- 2003
(Show Context)
Citation Context ... and discrete logarithm computation [12], primality proving [1, 6], fast polynomial factorization and composition [14], low complexity normal basis [20, 11, 2] of field extensions and ring extensions =-=[17]-=-. Part of this computational relevance is due to the purely algebraic properties of S: a finite free étale R-algebra of rank d, endowed with an R-automorphism σ : x ↦→ ζx such that R is the ring of in... |

6 |
Primality Proving Via One Round
- Cheng
(Show Context)
Citation Context ...ra S. As a consequence, the dimension of S is much smaller for a given n, and this results in a faster algorithm. A nice survey [24] has been written by Schoof. Berrizbeitia first [6], and then Cheng =-=[8]-=-, have proven that there exists a probabilistic variant of these algorithms that works in time (log n) 4+o(1) provided n − 1 has a divisor d bigger than (log 2 n) 2 and smaller than a constant times (... |

4 |
Four primality testing algorithms. In: Algorithmic Number Theory
- Schoof
- 2008
(Show Context)
Citation Context ...ists in using a more general construction for the free commutative algebra S. As a consequence, the dimension of S is much smaller for a given n, and this results in a faster algorithm. A nice survey =-=[24]-=- has been written by Schoof. Berrizbeitia first [6], and then Cheng [8], have proven that there exists a probabilistic variant of these algorithms that works in time (log n) 4+o(1) provided n − 1 has ... |

3 |
Elliptic periods for finite fields. Finite fields and their applications, 2008, à paraître
- Couveignes, Lercier
(Show Context)
Citation Context ... extension R ′ ⊃ R that contains such a primitive root, but this may result in many complications and a great loss of efficiency. Another approach, already experimented in the context of normal bases =-=[9]-=- for finite fields extensions, consists in replacing the multiplicative group Gm by some well chosen elliptic curve E over R. We then look for a section T ∈ E(R) of exact order d. Because elliptic cur... |

2 |
Low complexity normal basis
- Ash, Blake, et al.
- 1989
(Show Context)
Citation Context ...t algorithmic applications such as integer factoring and discrete logarithm computation [12], primality proving [1, 6], fast polynomial factorization and composition [14], low complexity normal basis =-=[20, 11, 2]-=- of field extensions and ring extensions [17]. Part of this computational relevance is due to the purely algebraic properties of S: a finite free étale R-algebra of rank d, endowed with an R-automorph... |

2 |
Proving primality in essentialy quartic random time
- Bernstein
(Show Context)
Citation Context ...orithms that works in time (log n) 4+o(1) provided n − 1 has a divisor d bigger than (log 2 n) 2 and smaller than a constant times (log 2 n) 2 . Avanzi and Mihăilescu [4], and independently Bernstein =-=[5]-=-, explain how to treat a general integer n using a divisor d of n f − 1 instead, where f is a small integer. The initial idea consists in using R-automorphisms of S to speed up the calculations. In th... |

2 |
Optimal normal basis
- Gao, Lenstra
- 1992
(Show Context)
Citation Context ...t algorithmic applications such as integer factoring and discrete logarithm computation [12], primality proving [1, 6], fast polynomial factorization and composition [14], low complexity normal basis =-=[20, 11, 2]-=- of field extensions and ring extensions [17]. Part of this computational relevance is due to the purely algebraic properties of S: a finite free étale R-algebra of rank d, endowed with an R-automorph... |

2 |
Optimal Normal Basis
- Mullin, Onyszchuk, et al.
- 1988
(Show Context)
Citation Context ...t algorithmic applications such as integer factoring and discrete logarithm computation [12], primality proving [1, 6], fast polynomial factorization and composition [14], low complexity normal basis =-=[20, 11, 2]-=- of field extensions and ring extensions [17]. Part of this computational relevance is due to the purely algebraic properties of S: a finite free étale R-algebra of rank d, endowed with an R-automorph... |

1 | Algebraic geometry and arithmetic curves. Paperback edition, Oxford science publications 2006 - Liu |