## Elliptic Curves And Primality Proving (1993)

### Cached

### Download Links

Venue: | Math. Comp |

Citations: | 162 - 22 self |

### BibTeX

@ARTICLE{Atkin93ellipticcurves,

author = {A. O. L. Atkin and F. Morain},

title = {Elliptic Curves And Primality Proving},

journal = {Math. Comp},

year = {1993},

volume = {61},

pages = {29--68}

}

### Years of Citing Articles

### OpenURL

### Abstract

The aim of this paper is to describe the theory and implementation of the Elliptic Curve Primality Proving algorithm.

### Citations

536 | A Classical Introduction to Modern Number Theory,GraduateTexts - Ireland, Rosen - 1982 |

256 | Introduction to Elliptic Curves and Modular Forms - Koblitz - 1984 |

255 |
The Art of Computer Programming, Seminumerical Algorithms Volume 2, third edition
- Knuth
- 1998
(Show Context)
Citation Context ...e most composite numbers using Fermat's little theorem. For cryptographical purposes, this idea was extended and it has yielded some fast probabilistic compositeness algorithms (for this, we refer to =-=[52]-=-, the introduction of [28] and [9]). On the contrary, testing an arbitrary number for primality depended on integer factorization. For this era, see [18, 92, 95]. The reader interested in large or cur... |

233 |
Factoring Integers with Elliptic Curves
- Lenstra
- 1987
(Show Context)
Citation Context ...adratic fields via modular forms. At this point, we introduce Weber's functions as well as Dedekind's j. In Section 4, we present the relevant theory of elliptic curves in a manner similar to that of =-=[57]-=-: This unified approach is well suited for our purpose, which goes from classical elliptic curves over C to curves over a finite field. Section 5 is concerned with primality testing using elliptic cur... |

188 |
History of the Theory
- Dickson
- 1952
(Show Context)
Citation Context ...ute with and then quadratic fields that are well suited for explaining the theory. These are two sides of the same object. 2.1 Quadratic forms The following results are well known and can be found in =-=[35, 30]-=-. Let \GammaD be a fundamental discriminant, i.e., D is a positive integer which is not divisible by any square of an odd prime and which satisfies D j 3 mod 4 or D j 4; 8 mod 16. We can factor \Gamma... |

186 |
Speeding the Pollard and elliptic curve methods of factorization
- Montgomery
- 1987
(Show Context)
Citation Context ...an find small factors of a number in a reasonable amount of time. Apart from trial division that is routinely used to find all factors less than 10 6 , the two best candidates are Pollard's ae method =-=[62]-=- and the ECM method of Lenstra [57]. Following [17], it seems that the first one is worth using for finding factors less than 10 8 and the second for factors from 10 10 to 10 15 using various speedups... |

170 |
Elliptic curves over finite fields and the computation of square roots mod p
- Schoof
- 1985
(Show Context)
Citation Context ...find a similar use for primality testing. This was first done by Goldwasser and Kilian [40] using the architecture of the DOWNRUN algorithm of [97] together with a theoretical algorithm due to Schoof =-=[83]-=-. They found that this algorithm recognizes primes in expected random polynomial time, at least assuming some very plausible conjectures in analytic number theory. Almost simultaneously, the first aut... |

154 |
Factoring polynomials over large finite fields
- Berlekamp
- 1971
(Show Context)
Citation Context ...of E and a point on E. In fact, we compute a root of WD (X) j 0 mod p and we compute j. 8.6.1 Solving WD (X) j 0 mod p The obvious approach to solving WD (X) j 0 mod p is to use Berlekamp's algorithm =-=[10, 52]-=-. The complexity of this algorithm is roughly: O((d 2 (log p) + d 3 )(log d)(log p) 2 ); if we use standard algorithms (with d = h(\GammaD)=g(\GammaD)). For small d, it is possible to mimic the standa... |

131 |
The Book of Prime Number Records
- Ribenboim
(Show Context)
Citation Context ...nd [8]). On the contrary, testing an arbitrary number for primality depended on integer factorization. For this era, see [17, 98, 101]. The reader interested in large or curious primes is referred to =-=[83]-=- as well as [66]. The year 1979 saw the appearance of the first general purpose primality testing algorithm, designed by Adleman, Pomerance and Rumely [3]. The running time of the algorithm was proved... |

114 |
Primes of the form x 2 + ny 2
- Cox
- 1989
(Show Context)
Citation Context ...ely the splitting eld of HD(X). The Galois group H of K H=K is isomorphic to H(;D). IfC is an element of H(;D), the corresponding element C of H acts on j(C 0 ) by: We also require the following (see =-=[31, 33]-=-): C(j(C 0 )) = j(C ;1 C 0 ): (5) Theorem 3.2 Arational prime p is a norm in K if and only if (p) splits completely in K H. This is equivalent to saying that HD(X) (mod p) has only simple roots and th... |

111 | Elliptic Functions - Lang - 1973 |

107 |
On distinguishing prime numbers from composite numbers
- Adleman, Pomerance, et al.
- 1983
(Show Context)
Citation Context ...ed in large or curious primes is referred to [80] as well as [68]. The year 1979 saw the appearance of the first general purpose primality testing algorithm, designed by Adleman, Pomerance and Rumely =-=[3]-=-. The running time of the algorithm was proved to be O((log N) c log log log N ) for some effective c ? 0. This algorithm was simplified and made practical by H. W. Lenstra and H. Cohen [28] and then ... |

102 |
Sequences of numbers generated by addition in formal groups and new primality and factoring tests
- Chudnovsky, Chudnovsky
- 1987
(Show Context)
Citation Context ...ic number theory. Almost simultaneously, the first author [4] designed a practical algorithm based on the same ideas, but using results from the theory of elliptic curves over finite fields (see also =-=[25]-=- and [14] for a first insight). From a practical point of view, this algorithm is faster and yields a proof that the computation is correct in the form of a list of numbers by means of which one can e... |

96 | Speeding up the computation on an elliptic curve using addition-subtraction chains. RAIRO
- Morain, Olivos
- 1990
(Show Context)
Citation Context ...8 ? ! ? : (y 2 \Gamma y 1 )(x 2 \Gamma x 1 ) \Gamma1 if x 2 6= x 1 (3x 2 1 + a)(2y 1 ) \Gamma1 otherwise: We can compute kP using the binary method [52] (see also [27]) or addition-subtraction chains =-=[71]-=-. 4 ELLIPTIC CURVES 9 M 1 M 2 P M 3 D Figure 1: An elliptic curve over R. The same equations are used to define the group law for arbitrary k. An isomorphism between E(a; b) and E(a 0 ; b 0 ) is defin... |

69 | Almost all primes can be quickly certified
- Goldwasser, Kilian
- 1986
(Show Context)
Citation Context ...ON 2 In 1985, H. W. Lenstra (Jr.) introduced the use of elliptic curves in factorization. There was then hope to find a similar use for primality testing. This was first done by Goldwasser and Kilian =-=[40]-=- using the architecture of the DOWNRUN algorithm of [97] together with a theoretical algorithm due to Schoof [83]. They found that this algorithm recognizes primes in expected random polynomial time, ... |

62 |
Yutaka Taniyama. Complex multiplication of abelian varieties and its applications to number theory, volume 6
- Shimura
- 1961
(Show Context)
Citation Context ...fied Abelian extension of an imaginary quadratic field (for a modern presentation of the classical approach, see [13]). An algebraic treatment was given by Deuring [34]. The theory was generalized in =-=[87]-=-. In the present paper, we only need to use a comparatively small part of the theory, which we specify below. Let \GammaD be a fundamental discriminant and K = Q( p \GammaD). The Hilbert Class Field o... |

54 |
Recognizing primes in random polynomial time
- Adleman, Huang
- 1987
(Show Context)
Citation Context ...y properties (see Section 10). In another direction, the theory of elliptic pseudoprimality tests and elliptic pseudoprimes was introduced [41, 61, 8]. Shortly afterwards, Adleman and Huang announced =-=[2]-=- that they designed a primality testing algorithm using curves of genus two whose expected running time is also polynomial, but without any unproven hypothesis. As for now, it seems that this algorith... |

52 | Factoring by electronic mail
- Lenstra, Manasse
(Show Context)
Citation Context ...number of points 8.5.1 Finding all factors of an integer m which are less than B It is well known that the general problem of getting all factors of an arbitrarily large number is very difficult (see =-=[55]-=-). However the problem of getting small factors of a number m is a little better understood. What we want is an algorithm that can find small factors of a number in a reasonable amount of time. Apart ... |

51 |
The number of points on an elliptic curve modulo a prime. manuscript
- Atkin
- 1988
(Show Context)
Citation Context ...blem arising in the ordinary DOWNRUN: this time, we have a lot of numbers which we can try to factor. The problem with GK is that Schoof's algorithm seems almost impossible to implement (however, see =-=[5]-=-). We will use instead the properties of elliptic curves over finite fields related to complex multiplication. 5.3 The ECPP algorithm In algorithm GK, we begin by searching for a curve and then comput... |

50 |
Class number, a theory of factorization, and genera
- Shanks
- 1969
(Show Context)
Citation Context ...nd satisfying jbjsasc and (jbj = a or a = c ) b ? 0). Such a form is called reduced. There is an algorithm that computes a reduced form equivalent to a given form: we refer to the literature for this =-=[85]-=-. The set of primitive reduced quadratic forms of discriminant \GammaD, denoted by H(\GammaD), is finite (for jbjsp D=3 if (a; b; c) is reduced). Moreover, it is possible to define an operation 2 SOME... |

46 | Some integer factorization algorithms using elliptic curves
- Brent
- 1986
(Show Context)
Citation Context ...mount of time. Apart from trial division that is routinely used to find all factors less than 10 6 , the two best candidates are Pollard's ae method [62] and the ECM method of Lenstra [57]. Following =-=[17]-=-, it seems that the first one is worth using for finding factors less than 10 8 and the second for factors from 10 10 to 10 15 using various speedups [62, 7]. However, the very best value among these ... |

46 |
Advanced Number Theory
- Cohn
- 1980
(Show Context)
Citation Context ...ute with and then quadratic fields that are well suited for explaining the theory. These are two sides of the same object. 2.1 Quadratic forms The following results are well known and can be found in =-=[35, 30]-=-. Let \GammaD be a fundamental discriminant, i.e., D is a positive integer which is not divisible by any square of an odd prime and which satisfies D j 3 mod 4 or D j 4; 8 mod 16. We can factor \Gamma... |

37 |
Primes of the Form x + ny
- Cox
- 1989
(Show Context)
Citation Context ...rphic to H(\GammaD). If C is an element of H(\GammaD), the corresponding element oe C of \Sigma H acts on j(C 0 ) by: oe C (j(C 0 )) = j(C \Gamma1 \Delta C 0 ): (5) We also require the following (see =-=[31, 33]-=-): Theorem 3.2 A rational prime p is a norm in K if and only if (p) splits completely in KH . This is equivalent to saying that HD (X) (mod p) has only simple roots and they are all in Z=pZ. Moreover ... |

37 |
Five numbertheoretic algorithms
- Shanks
- 1972
(Show Context)
Citation Context ...() We want to get the representation of a prime p as a norm in K = Q( p \GammaD). Equivalently, we must solve: 4p = A 2 +DB 2 (38) with A and B in Z. We can solve this problem using Shanks' algorithm =-=[86]-=- or lattice reduction [89]. These two algorithms are basically the same and solve the general case of representation of a prime number by a given quadratic form. In the case where we want to represent... |

36 |
On taking roots in finite fields
- Adleman, Manders, et al.
- 1977
(Show Context)
Citation Context ... z 1 . We work over (Z=439Z)[z]=(z 2 + 70z + 1): The corresponding value of i is simply z. A squareroot of \Gamma47 mod 439 is 294. We extract a fifth root of y using an extension of the algorithm of =-=[1]-=- as described in [47] (see also [46]). We find y 5 = 269z + 64 = (383z + 244) 5 mod (439; z 2 + 70z + 1): and x = 15 is a root of W 47 mod 439. The ideas are detailed at some length in [64]. In genera... |

36 |
A Classical Invitation to Algebraic Numbers and Class Fields
- Cohn
- 1978
(Show Context)
Citation Context ...xtension of Q containing K. The Galois group of K G =Q is isomorphic to (Z=2Z) t . We recall that the Artin symbol associated with the quadratic form C (in fact with the genus G containing C) is (see =-=[29]-=-): AG = / K G =K p ! ' ( 1 (G); : : : ;st (G)) ; withsi (G) = (q i =p), where (p) = pp 0 is any prime number represented by a form of G and p the ideal above p in K. 3 Modular forms 3.1 The modular gr... |

34 |
Arithmetic on Elliptic Curves with Complex Multiplication
- Gross
(Show Context)
Citation Context ...94614665695989760000 + 340143739727246741938176000 p 13; v = 1233529551576 \Gamma 4447554048000 13 p 13: Remark. The above results are also related to the concept of Q-curve as introduced by Gross in =-=[43]-=-. Some of the methods used by him would yield the same results, but using deep methods from algebraic geometry. 8.6.3 Finding P on E Let (a; b) be two elements of Z=pZ. If x 0 is any element of Z=pZ, ... |

33 | Primality testing and Jacobi sums - Cohen, Lenstra - 1984 |

32 |
Diophantine Equations with special reference to elliptic curves
- Cassels
- 1966
(Show Context)
Citation Context ...r K () = p+1 \Gamma A with jAj ! 2 p p (this theorem was originally proved by Hasse) and E has complex multiplication by the ring OK . Concerning the structure of E(Z=pZ) as an Abelian group, we have =-=[22]-=-: Theorem 4.1 The group E(Z=pZ) is either cyclic or the product of two cyclic groups of order m 1 and m 2 that satisfy: m 1 jm 2 ; m 1 j gcd(m; p \Gamma 1); (17) where m = #E(Z=pZ). 5 PRIMALITY TESTIN... |

32 |
Algorithms in number theory
- Lenstra, Lenstra
- 1990
(Show Context)
Citation Context ... of prime numbers N of k bits for which the expected time of GK is bounded by c 3 (log N) 11 is at least 1 \Gamma c 8 2 \Gammak 1 log log k . As for ECPP, we only have the heuristic analysis cited in =-=[54]-=-. The authors find that the running time of the algorithm is roughly O((log N) 6+ffl ) for some ffl ? 0. The remaining of this section is devoted to some practical considerations concerning ECPP. 6.2 ... |

30 | Finding suitable curves for the elliptic curve method of factorization
- Atkin, Morain
- 1993
(Show Context)
Citation Context ...and the ECM method of Lenstra [57]. Following [17], it seems that the first one is worth using for finding factors less than 10 8 and the second for factors from 10 10 to 10 15 using various speedups =-=[62, 7]-=-. However, the very best value among these probabilistic factoring methods is given by Pollard's p \Gamma 1, even though this can only be used once. It should be noted that we do not store the interme... |

29 |
The book of prime number
- Ribenboim
- 1989
(Show Context)
Citation Context ...and [9]). On the contrary, testing an arbitrary number for primality depended on integer factorization. For this era, see [18, 92, 95]. The reader interested in large or curious primes is referred to =-=[80]-=- as well as [68]. The year 1979 saw the appearance of the first general purpose primality testing algorithm, designed by Adleman, Pomerance and Rumely [3]. The running time of the algorithm was proved... |

29 |
Ramanujans Vermutung über Zerfällungsanzahlen
- Watson
- 1938
(Show Context)
Citation Context ... u = j, we will abbreviate HD [u] to HD . 7.1 Hilbert polynomials The determination of j as an algebraic integer in Q(j) has been studied by many authors, including Weber [91], Greenhill [42], Watson =-=[90]-=-, Berwick [11] and more recently Gross and Zagier [44] (see also [36]). We first prefer a basic approach. The simplest way to compute j is to compute HD (X) using floating point numbers (see [50, 31, ... |

26 |
Implementation of a new primality test
- Cohen, Lenstra
- 1987
(Show Context)
Citation Context ...(log N) c log log log N ) for some effective c ? 0. This algorithm was simplified and made practical by H. W. Lenstra and H. Cohen [28] and then successfully implemented by H. Cohen and A. K. Lenstra =-=[27]-=-. Motivated by our results with elliptic curves (see below), the algorithm was recently optimized by Bosma and Van der Hulst [15] (see also [60]). However, it is not possible to check the results of t... |

24 |
Modular Forms and Dirichlet Series
- Ogg
(Show Context)
Citation Context ...RECOMPUTATIONS 19 7.2.1 Alternative class invariants The second author is indebted to J.-F. Mestre who explained the following [59]. Let s be a prime positive integer and X 0 (s) be the modular curve =-=[73]-=-. It can be shown that (see, for example [37] or [58]), when X 0 (s) is of genus 0 (i.e., s = 2; 3; 5; 7; 13), it can be parametrized by: x s (z) = ` j(z) j(sz) ' 24=(s\Gamma1) : (27) The modular inva... |

22 | The generation of random numbers that are probably prime
- Beauchemin, Brassard, et al.
(Show Context)
Citation Context ...at's little theorem. For cryptographical purposes, this idea was extended and it has yielded some fast probabilistic compositeness algorithms (for this, we refer to [52], the introduction of [28] and =-=[9]-=-). On the contrary, testing an arbitrary number for primality depended on integer factorization. For this era, see [18, 92, 95]. The reader interested in large or curious primes is referred to [80] as... |

22 |
Die Klassenkörper der komplexen Multiplikation
- Deuring
- 1958
(Show Context)
Citation Context ...e construction of the maximal unramified Abelian extension of an imaginary quadratic field (for a modern presentation of the classical approach, see [13]). An algebraic treatment was given by Deuring =-=[34]-=-. The theory was generalized in [87]. In the present paper, we only need to use a comparatively small part of the theory, which we specify below. Let \GammaD be a fundamental discriminant and K = Q( p... |

22 |
Cours d’arithmetique
- Serre
- 1970
(Show Context)
Citation Context ...(G)) ; withsi (G) = (q i =p), where (p) = pp 0 is any prime number represented by a form of G and p the ideal above p in K. 3 Modular forms 3.1 The modular group and the modular invariant j We follow =-=[84]-=-. The modular group is defined to be \Gamma = SL 2 (Z)=f\Sigma1g. An element g = / a b c d ! of \Gamma acts on H = fz 2 C; Im(z) ? 0g by gz = az + b cz + d : It is known that \Gamma is generated by S ... |

22 |
Primality of the number of points on an elliptic curve over a finite field
- Koblitz
- 1988
(Show Context)
Citation Context ...ber of points divisible by l is asymptotically 1=(l \Gamma 1) and l=(l 2 \Gamma 1) in the two cases. The reader interested in the primality of the number of points of an elliptic curve should consult =-=[55]-=-. In the following paragraph, we will need the following results on the ae 2 function [53]. Definition 6.1 Let M = M 1 \Delta \Delta \Delta M r be any integer with M i prime and M 1sM 2s\Delta \Delta ... |

20 |
Modern Cryptology
- Brassard
- 1988
(Show Context)
Citation Context ...auss [38, Art. 329] 1 Introduction Primality testing is one of the most flourishing fields in computational number theory. Dating back to Gauss, the interest has recently risen with modern cryptology =-=[16]-=-. For quite a long time, it has been known that one could quickly recognize most composite numbers using Fermat's little theorem. For cryptographical purposes, this idea was extended and it has yielde... |

19 |
Analysis of a simple factorization algorithm
- Knuth, Pardo
- 1976
(Show Context)
Citation Context ...two cases. The reader interested in the primality of the number of points of an elliptic curve should consult [55]. In the following paragraph, we will need the following results on the ae 2 function =-=[53]-=-. Definition 6.1 Let M = M 1 \Delta \Delta \Delta M r be any integer with M i prime and M 1sM 2s\Delta \Delta \DeltasM r , and ff any real number greater than 1. We put ae 2 (ff) = lim M!+1 Prob(M 2 !... |

13 |
Elliptic curves and number-theoretic algorithms, in [6
- Lenstra
- 1987
(Show Context)
Citation Context ...od s. We have also: Corollary 5.1 With the same conditions, if s ? ( 4 p N + 1) 2 , then N is prime. Combining this theorem with Schoof's algorithm that computes #E(Z=pZ) in time O((log p) 8+" ) =-=(see [56]-=-), we obtain the Goldwasser-Kilian algorithm. procedure GK(N) 5 PRIMALITY TESTING 11 1. choose an elliptic curve E over Z=NZ, for which the number of points m (computed with Schoof's algorithm) satisf... |

12 | Explicit construction of the Hilbert class fields of imaginary quadratic fields by integer lattice reduction
- Kaltofen, Yui
- 1989
(Show Context)
Citation Context ...tson [90], Berwick [11] and more recently Gross and Zagier [44] (see also [36]). We first prefer a basic approach. The simplest way to compute j is to compute HD (X) using floating point numbers (see =-=[50, 31, 51]-=-). In order to recognize that we have the right polynomial, we use an easy corollary of the work of Gross and Zagier, that can be stated as follows. Proposition 7.1 The norm of j in Q(j), which is the... |

10 |
Weber’s class invariants
- Birch
- 1969
(Show Context)
Citation Context ...) is in K(j(!)) = KH (! is the generator of OK ). It turns out that there are a lot of alternative choices of class invariants other than j. The following results can be found in [91, x125-144] or in =-=[12, 82]-=-. Theorem 7.1 ([91, x125, p. 459]) Let z be a quadratic number defined by Az 2 +Bz+C = 0. If 3 j B; 3 - A; 3 - B 2 \Gamma 4AC; (25) we have Q(fl 2 (z)) = Q(j(z)): 7 PRECOMPUTATIONS 17 Remark that the ... |

10 |
New primality criteria and factorizations of 2 m \Sigma 1
- Brillhart, Lehmer, et al.
- 1975
(Show Context)
Citation Context ...ompositeness algorithms (for this, we refer to [52], the introduction of [28] and [9]). On the contrary, testing an arbitrary number for primality depended on integer factorization. For this era, see =-=[18, 92, 95]-=-. The reader interested in large or curious primes is referred to [80] as well as [68]. The year 1979 saw the appearance of the first general purpose primality testing algorithm, designed by Adleman, ... |

10 |
Riemann hypothesis and finding roots over finite fields
- Huang
- 1985
(Show Context)
Citation Context ...(Z=439Z)[z]=(z 2 + 70z + 1): The corresponding value of i is simply z. A squareroot of \Gamma47 mod 439 is 294. We extract a fifth root of y using an extension of the algorithm of [1] as described in =-=[47]-=- (see also [46]). We find y 5 = 269z + 64 = (383z + 244) 5 mod (439; z 2 + 70z + 1): and x = 15 is a root of W 47 mod 439. The ideas are detailed at some length in [64]. In general, the Abelian Galois... |

10 | An Improved Las Vegas Primality Test
- Kaltofen, Valente, et al.
- 1989
(Show Context)
Citation Context ...PP--- algorithm), together with the implementations made by the authors (other implementations include that of D. Bernardi for the class number one case and more recently that of Kaltofen and Valente =-=[49]-=- and that of Vardi (personal communication, August 1989) for the Mathematica system). Since there are considerable differences of detail between the implementations of the two authors, we have decided... |

9 |
An extension of Heilbronn’s class number theorem
- Chowla
- 1934
(Show Context)
Citation Context ...asing order with respect to (h=g; h; D). The most interesting discriminants are those with h = g, which are called idoneal numbers: Assuming the Extended Riemann Hypothesis, there are 65 of them (see =-=[35, 24]-=-). 8.3 Logistics and Tactics Many of the routines we use are explained and codified in [27]. We mention here one or two additional points. 8.3.1 Multiprecision It is obvious that we need the fastest a... |

9 | Implementation of the Atkin-Goldwasser-Kilian primality testing algorithm. Rapport de Recherche 911, IYRIA, Octobre
- MORAIN
- 1988
(Show Context)
Citation Context ... the q-expansion of j is (Cf. [84]): j(q) = 1 q + 744 + X n1 c n q n ; (4) where the c n are positive integers. For a survey of the arithmetical and numerical properties of the c n , see for instance =-=[84, 63]-=-. 3.2 Complex multiplication for lattices Let L = L(1; !) be a lattice in C. Put M(L) = fff 2 C; ffL ae Lg. It is clear that Z ae M(L). When M(L) is greater than Z, we say that L has complex multiplic... |

9 |
Simple Groups of Square Order and an Interesting Sequence of Primes
- Newman, Shanks, et al.
- 1980
(Show Context)
Citation Context ...ome large probable primes were successfully tested. Among these were S 1493 (572 digits, three weeks on a SUN 3/60) and S 1901 (728 digits, one month) thus solving the problem mentioned at the end of =-=[72]-=-. Apart from these numbers with quite a lot of arithmetical properties, the second author is currently looking for large primes coming from the factorization of the numbers 10 WHAT PROOF DO WE GET? 37... |