## The Probability That The Number Of Points On An Elliptic Curve Over A Finite Field Is Prime (0)

Venue: | Journal of the London Mathematical Society |

Citations: | 10 - 1 self |

### BibTeX

@TECHREPORT{Galbraith_theprobability,

author = {Steven Galbraith and James Mckee},

title = {The Probability That The Number Of Points On An Elliptic Curve Over A Finite Field Is Prime},

institution = {Journal of the London Mathematical Society},

year = {}

}

### Years of Citing Articles

### OpenURL

### Abstract

. The paper gives a formula for the probability that a randomly chosen elliptic curve over a nite eld has a prime number of points. Two heuristic arguments in support of the formula are given as well as experimental evidence. The paper also gives a formula for the probability that a randomly chosen elliptic curve over a nite eld has kq points where k is a small number and where q is a prime. 1. Introduction Cryptographic and computational applications have recently motivated the study of several questions in the theory of elliptic curves over nite elds. For instance, the analysis of the elliptic curve factoring method leads to estimates ([7], [8]) for the probability that the number of points on an elliptic curve is smooth. In this paper, motivated by the use of elliptic curves in public key cryptosystems, we consider the \opposite" problem. More specically, we ask the question: What is the probability that a randomly chosen elliptic curve over F p has kq points, where k is sm...

### Citations

553 |
A classical introduction to modern number theory (Second edition). Graduate texts
- Ireland, Rosen
- 1990
(Show Context)
Citation Context ...he case of interest, and it provides a comforting check that the average is 1 for each l, lending support to assumption (ii). We recall the character sum (see, for example, exercise 8 of chapter 5 in =-=-=-[4]) l X t=1 t 2 4p l = 1 if l does not divide 4p. This tells us how many times the Legendre symbol is 1 or 1, given that it is zero for 1 + p l values of t (mod l). The prime 2 requires special tr... |

240 |
Factoring integers with elliptic curves
- Lenstra
- 1987
(Show Context)
Citation Context ...lications have recently motivated the study of several questions in the theory of elliptic curves oversniteselds. For instance, the analysis of the elliptic curve factoring method leads to estimates (=-=[7], [8]-=-) for the probability that the number of points on an elliptic curve is smooth. In this paper, motivated by the use of elliptic curves in public key cryptosystems, we consider the \opposite" prob... |

80 |
An Introduction to the Theory of Numbers, 5th edition
- Hardy, Wright
- 1979
(Show Context)
Citation Context ...l>2 1 1 (l 1) 2 Y ljp 1; l>2 1 + 1 (l + 1)(l 2) : 4. Second derivation of Conjecture A Consider the following non-equality: P 1 6= Y l p p 1 1 l : Indeed Mertens' theorem (Theorem 429 in [2]) tells us that Q l p p 1 1 l 2e = log p as p !1, wheresis Euler's constant, whereas one expects that P 1 1= log p. If we replace 1 1=l by the probability that the number of points on an ellipt... |

45 |
Constructing elliptic curves with given group order over large finite fields. Algorithmic Number Theory
- Lay, Zimmer
- 1994
(Show Context)
Citation Context ...ryptography there is some concern about the use of elliptic curves whose endomorphism ring has small class number, such as those elliptic curves which are generated using the CM method (see [1], [9], =-=[6]-=-). This is one of the reasons why it is recommended that elliptic curves should be chosen at random. We will now indicate that the class numbers corresponding to the randomly chosen elliptic curves us... |

30 | Finding suitable curves for the elliptic curve method of factorization
- Atkin, Morain
- 1993
(Show Context)
Citation Context ...size. In cryptography there is some concern about the use of elliptic curves whose endomorphism ring has small class number, such as those elliptic curves which are generated using the CM method (see =-=[1]-=-, [9], [6]). This is one of the reasons why it is recommended that elliptic curves should be chosen at random. We will now indicate that the class numbers corresponding to the randomly chosen elliptic... |

23 |
Primality of the number of points on an elliptic curve over a finite field, Pacific J.Math.131
- Koblitz
- 1988
(Show Context)
Citation Context ...n elliptic curve over F p has kq points, where k is small and q is prime? Initially we take p to be prime. The minor modications needed to deal with arbitrarysniteselds are considered later. Koblitz [=-=5-=-] has considered the analogous problem when the elliptic curve E issxed and where it is the prime p which varies. The paper [5] gives a conjectural formula that the number of primes p n such that #E(... |

18 | Building Cyclic Elliptic Curves Modulo Large Primes
- Morain
- 1991
(Show Context)
Citation Context ... In cryptography there is some concern about the use of elliptic curves whose endomorphism ring has small class number, such as those elliptic curves which are generated using the CM method (see [1], =-=[9]-=-, [6]). This is one of the reasons why it is recommended that elliptic curves should be chosen at random. We will now indicate that the class numbers corresponding to the randomly chosen elliptic curv... |

15 |
On the group orders of elliptic curves over finite fields
- Howe
- 1993
(Show Context)
Citation Context ...; l62fp 1 ;::: ;pmg ` 1 \Gamma 1 l ' : For the analogous non-equality for elliptic curves, we need Howe's extension of Lenstra's probabilities to cover all small divisors of the number of points (see =-=[3]-=-): the probability that the number of points is divisible by l t tends to r(l t ) (as defined in Conjecture B) as p !1. Hence our second desired non-equality is Q k 6= m Y i=1 \Gamma r(p ff i i ) \Gam... |

4 | Subtleties in the distribution of the numbers of points on elliptic curves over a finite prime field
- McKee
- 1999
(Show Context)
Citation Context ...ions have recently motivated the study of several questions in the theory of elliptic curves oversniteselds. For instance, the analysis of the elliptic curve factoring method leads to estimates ([7], =-=[8]) for-=- the probability that the number of points on an elliptic curve is smooth. In this paper, motivated by the use of elliptic curves in public key cryptosystems, we consider the \opposite" problem. ... |

1 |
On the group orders of elliptic curves over
- Howe
- 1993
(Show Context)
Citation Context ...Y l p p; l62fp1 ;::: ;pmg 1 1 l : For the analogous non-equality for elliptic curves, we need Howe's extension of Lenstra's probabilities to cover all small divisors of the number of points (see [3]): the probability that the number of points is divisible by l t tends to r(l t ) (as dened in Conjecture B) as p !1. Hence our second desired non-equality is Q k 6= m Y i=1 r(p i i ) r(p i +1 i ... |