## Building Cyclic Elliptic Curves Modulo Large Primes (1987)

Venue: | Advances in Cryptology - EUROCRYPT '91, Lecture Notes in Computer Science |

Citations: | 19 - 2 self |

### BibTeX

@INPROCEEDINGS{Morain87buildingcyclic,

author = {François Morain},

title = {Building Cyclic Elliptic Curves Modulo Large Primes},

booktitle = {Advances in Cryptology - EUROCRYPT '91, Lecture Notes in Computer Science},

year = {1987},

pages = {328--336}

}

### OpenURL

### Abstract

Elliptic curves play an important role in many areas of modern cryptology such as integer factorization and primality proving. Moreover, they can be used in cryptosystems based on discrete logarithms for building one-way permutations. For the latter purpose, it is required to have cyclic elliptic curves over finite fields. The aim of this note is to explain how to construct such curves over a finite field of large prime cardinality, using the ECPP primality proving test of Atkin and Morain. 1 Introduction Elliptic curves prove to be a powerful tool in modern cryptology. Following the original work of H. W. Lenstra, Jr. [18] concerning integer factorization, many researchers have used this new idea to work out primality proving algorithms [8, 14, 2, 4, 22] as well as cryptosystems [21, 16] generalizing those of [12, 1, 9]. Recent work on these topics can be found in [20, 19]. More recently, Kaliski [15] has used elliptic curves in the design of one-way permutations. For this, the autho...

### Citations

3188 | A method for obtaining digital signatures and public-key cryptosystems
- Rivest, Shamir, et al.
- 1977
(Show Context)
Citation Context ... Jr. [18] concerning integer factorization, many researchers have used this new idea to work out primality proving algorithms [8, 14, 2, 4, 22] as well as cryptosystems [21, 16] generalizing those of =-=[12, 1, 9]-=-. Recent work on these topics can be found in [20, 19]. More recently, Kaliski [15] has used elliptic curves in the design of one-way permutations. For this, the author needs elliptic curves which are... |

2966 | Hellman: New Directions in Cryptography
- Diffie, Martin
- 1976
(Show Context)
Citation Context ... Jr. [18] concerning integer factorization, many researchers have used this new idea to work out primality proving algorithms [8, 14, 2, 4, 22] as well as cryptosystems [21, 16] generalizing those of =-=[12, 1, 9]-=-. Recent work on these topics can be found in [20, 19]. More recently, Kaliski [15] has used elliptic curves in the design of one-way permutations. For this, the author needs elliptic curves which are... |

905 |
The arithmetic of elliptic curves
- Silverman
- 1986
(Show Context)
Citation Context ...the French Department of Defense, D'el'egation G'en'erale pour l'Armement. 1 2 Elliptic curves modulo p 2.1 Group law We briefly describe some properties of elliptic curves. For more information, see =-=[25]-=-. An elliptic curve E over a field Z/pZ with p a prime greater than 3 can be described as a pair (a; b) of elements of Z/pZ such that \Delta(E) = \Gamma16(4a 3 + 27b 2 ) is invertible in Z/pZ. This qu... |

781 |
Elliptic curve cryptosystems
- Koblitz
- 1987
(Show Context)
Citation Context ...original work of H. W. Lenstra, Jr. [18] concerning integer factorization, many researchers have used this new idea to work out primality proving algorithms [8, 14, 2, 4, 22] as well as cryptosystems =-=[21, 16]-=- generalizing those of [12, 1, 9]. Recent work on these topics can be found in [20, 19]. More recently, Kaliski [15] has used elliptic curves in the design of one-way permutations. For this, the autho... |

588 |
Uses of elliptic curves in cryptography
- Miller
- 1986
(Show Context)
Citation Context ...original work of H. W. Lenstra, Jr. [18] concerning integer factorization, many researchers have used this new idea to work out primality proving algorithms [8, 14, 2, 4, 22] as well as cryptosystems =-=[21, 16]-=- generalizing those of [12, 1, 9]. Recent work on these topics can be found in [20, 19]. More recently, Kaliski [15] has used elliptic curves in the design of one-way permutations. For this, the autho... |

317 |
Reducing elliptic curve logarithms to logarithms in a finite field
- Menezes, Okamoto, et al.
- 1991
(Show Context)
Citation Context ...hers have used this new idea to work out primality proving algorithms [8, 14, 2, 4, 22] as well as cryptosystems [21, 16] generalizing those of [12, 1, 9]. Recent work on these topics can be found in =-=[20, 19]-=-. More recently, Kaliski [15] has used elliptic curves in the design of one-way permutations. For this, the author needs elliptic curves which are cyclic and the easiest solution is to build elliptic ... |

251 |
Factoring integers with elliptic curves
- Lenstra
- 1987
(Show Context)
Citation Context ...dinality, using the ECPP primality proving test of Atkin and Morain. 1 Introduction Elliptic curves prove to be a powerful tool in modern cryptology. Following the original work of H. W. Lenstra, Jr. =-=[18]-=- concerning integer factorization, many researchers have used this new idea to work out primality proving algorithms [8, 14, 2, 4, 22] as well as cryptosystems [21, 16] generalizing those of [12, 1, 9... |

184 |
Elliptic curves over finite fields and the computation of square roots mod p
- Schoof
- 1985
(Show Context)
Citation Context ...t E and its twist have the same invariant j 0 . 2.3 Computing #E(Z=pZ) From a theoretical point of view, there exists an algorithm of Schoof's that solves the problem in time polynomial in log p, see =-=[23]-=-. However, it appears difficult to implement, even after some improvements of Atkin [3] and Elkies [13]. In practice, it is not feasible as soon as p has more than 65 decimal digits. 3 Overview of ECP... |

175 | Morain Elliptic curves and primality proving
- Atkin, F
- 1993
(Show Context)
Citation Context ...l tool in modern cryptology. Following the original work of H. W. Lenstra, Jr. [18] concerning integer factorization, many researchers have used this new idea to work out primality proving algorithms =-=[8, 14, 2, 4, 22]-=- as well as cryptosystems [21, 16] generalizing those of [12, 1, 9]. Recent work on these topics can be found in [20, 19]. More recently, Kaliski [15] has used elliptic curves in the design of one-way... |

118 |
Die Typen der Multiplikatorenringe elliptischer Funktionenkörper
- Deuring
- 1941
(Show Context)
Citation Context ...dinality of an elliptic curve E(Z=pZ), then ( p p \Gamma 1) 2sms( p p + 1) 2 : (1) We use the notations of [18] for what follows and we refer the reader to it for more information. Theorem 2 (Deuring =-=[11]-=-) Let t be any integer such that jtjs2 p p. Letting K(d) denote the Kronecker class number of d, there exists K(t 2 \Gamma 4p) elliptic curves over Z/pZ with number of points m = p + 1 \Gamma t, up to... |

110 |
Sequences of numbers generated by addition in formal groups and new primality and factorization tests
- Chudnovsky, Chudnovsky
- 1986
(Show Context)
Citation Context ...l tool in modern cryptology. Following the original work of H. W. Lenstra, Jr. [18] concerning integer factorization, many researchers have used this new idea to work out primality proving algorithms =-=[8, 14, 2, 4, 22]-=- as well as cryptosystems [21, 16] generalizing those of [12, 1, 9]. Recent work on these topics can be found in [20, 19]. More recently, Kaliski [15] has used elliptic curves in the design of one-way... |

75 | Almost all primes can be quickly certified
- Goldwasser, Kilian
- 1986
(Show Context)
Citation Context ...l tool in modern cryptology. Following the original work of H. W. Lenstra, Jr. [18] concerning integer factorization, many researchers have used this new idea to work out primality proving algorithms =-=[8, 14, 2, 4, 22]-=- as well as cryptosystems [21, 16] generalizing those of [12, 1, 9]. Recent work on these topics can be found in [20, 19]. More recently, Kaliski [15] has used elliptic curves in the design of one-way... |

53 |
The number of points on an elliptic curve modulo a prime. Series of e-mails to the NMBRTHRY mailing list
- Atkin
- 1992
(Show Context)
Citation Context ...l point of view, there exists an algorithm of Schoof's that solves the problem in time polynomial in log p, see [23]. However, it appears difficult to implement, even after some improvements of Atkin =-=[3]-=- and Elkies [13]. In practice, it is not feasible as soon as p has more than 65 decimal digits. 3 Overview of ECPP The following results are at the heart of the Elliptic Curve Primality Proving algori... |

37 | Primes of the Form x + ny - Cox - 1989 |

36 | Algorithms in number theory - LENSTRA, LENSTRA - 1990 |

35 |
Diophantine equations with special reference to elliptic curves
- Cassels
- 1966
(Show Context)
Citation Context ...mber of d, there exists K(t 2 \Gamma 4p) elliptic curves over Z/pZ with number of points m = p + 1 \Gamma t, up to isomorphisms. Concerning the group structure of E(Z=pZ), we have: Theorem 3 (Cassels =-=[7]-=-) The group E(Z=pZ) is either cyclic or the product of two cyclic groups or order m 1 and m 2 that satisfy m 1 jm 2 ; m 1 j gcd(m; p \Gamma 1); (2) where m = #E(Z=pZ). Note that if m is squarefree, th... |

24 |
die Classenzahl quadratischer Zahlkorper
- Siegel, Uber
- 1935
(Show Context)
Citation Context ... is a point of maximal order on E 0 . A rough analysis. We can now state the following result. Proposition 4.1 The running time of BuildCurveGivenM is exponential in log p. Proof: By Siegel's Theorem =-=[24]-=-, we know that h(\GammaD) is O(D 1=2+ffl ). Hence, we may want to find D small. If we brutally apply the preceding algorithm, we require that m be as close of ( p p \Sigma 1) 2 as possible. This impli... |

21 |
The implementation of elliptic curve cryptosystems
- Menezes, Vanstone
- 1990
(Show Context)
Citation Context ...hers have used this new idea to work out primality proving algorithms [8, 14, 2, 4, 22] as well as cryptosystems [21, 16] generalizing those of [12, 1, 9]. Recent work on these topics can be found in =-=[20, 19]-=-. More recently, Kaliski [15] has used elliptic curves in the design of one-way permutations. For this, the author needs elliptic curves which are cyclic and the easiest solution is to build elliptic ... |

19 |
Courbes elliptiques et tests de primalité. thèse, Université Claude Bernard–Lyon I
- Morain
- 1990
(Show Context)
Citation Context |

18 |
Discrete logarithms in GF(p). Algorithmica
- Coppersmith, Odlyzko, et al.
- 1986
(Show Context)
Citation Context ... Jr. [18] concerning integer factorization, many researchers have used this new idea to work out primality proving algorithms [8, 14, 2, 4, 22] as well as cryptosystems [21, 16] generalizing those of =-=[12, 1, 9]-=-. Recent work on these topics can be found in [20, 19]. More recently, Kaliski [15] has used elliptic curves in the design of one-way permutations. For this, the author needs elliptic curves which are... |

9 | Non Supersingular Elliptic Curves for Public Key Cryptosystems - BETH, SCHAEFER - 1991 |

9 |
One-Way Permutations on Elliptic Curves
- Kaliski
- 1991
(Show Context)
Citation Context ...ork out primality proving algorithms [8, 14, 2, 4, 22] as well as cryptosystems [21, 16] generalizing those of [12, 1, 9]. Recent work on these topics can be found in [20, 19]. More recently, Kaliski =-=[15]-=- has used elliptic curves in the design of one-way permutations. For this, the author needs elliptic curves which are cyclic and the easiest solution is to build elliptic curves with squarefree order.... |

1 |
Lecture Notes of a conference Boulder
- Manuscript
- 1986
(Show Context)
Citation Context |

1 |
Computing the number of points on an elliptic curve modulo p. Email to Morain
- Elkies
- 1990
(Show Context)
Citation Context ..., there exists an algorithm of Schoof's that solves the problem in time polynomial in log p, see [23]. However, it appears difficult to implement, even after some improvements of Atkin [3] and Elkies =-=[13]-=-. In practice, it is not feasible as soon as p has more than 65 decimal digits. 3 Overview of ECPP The following results are at the heart of the Elliptic Curve Primality Proving algorithm in [4]. The ... |