"... In PAGE 6: ... First we consider the curves de ned over Q. See Table1 for the list of integers D, the corresponding j-invariants of the curves whose complex multiplications are the maximal order in Q(p D), and the forms of the primes p such that at least one of the isomorphic classes of the curves has exactly p Fp-points. If p has one of the special forms in Table 1, we can easily construct an elliptic curve E=Fp with exactly p Fp-points.... In PAGE 6: ... See Table 1 for the list of integers D, the corresponding j-invariants of the curves whose complex multiplications are the maximal order in Q(p D), and the forms of the primes p such that at least one of the isomorphic classes of the curves has exactly p Fp-points. If p has one of the special forms in Table1 , we can easily construct an elliptic curve E=Fp with exactly p Fp-points. See [14] for the algorithm to decide the right isomorphic classes.... ..."

"... In PAGE 4: ... If jE(Fp)j = p, then its quadratic twist has p + 2 Fp-points. See Table1 for the list of integers D, the corresponding j-invariants of the curves whose complex multiplications are the maximal order in Q(p D), and the forms of the primes p such that at least one of the isomorphic classes of the curves has exactly p Fp-points. If p has one of the special forms in Table 1, we can easily construct an elliptic curve E=Fp with exactly p Fp-points.... In PAGE 4: ... See Table 1 for the list of integers D, the corresponding j-invariants of the curves whose complex multiplications are the maximal order in Q(p D), and the forms of the primes p such that at least one of the isomorphic classes of the curves has exactly p Fp-points. If p has one of the special forms in Table1 , we can easily construct an elliptic curve E=Fp with exactly p Fp-points. See [10] for the algorithm to decide the right isomorphic classes.... ..."

"... In PAGE 15: ... Thus, Conjecture B of [8] then predicts the number of primes up to M (up to choosing twists) that give prime order elliptic curves. Table4 gives a comparison between the Koblitz predicted value, the Gross- Smith twin primes value, and actual counts of twin primes and of anomolous primes. The anomolous values are primes naturally paired with themselves in our construction.... ..."

"... In PAGE 12: ... Here, we worked with 200 di erent instances of the DLP and performed 10 DL computations for each instance. We did this for several combinations of r and q,asshownin Table5 . A graphic interpretation of these results is given in Figure 5.... ..."

"... In PAGE 10: .... Actions of the functions in (3.1) for G = (Z=11Z) , g = 2, h = 2. When conducting the analogous experiment in elliptic curve subgroups of prime order, we get the results shown in Table4 . They roughly agree with those for prime-order subgroups of (Z=pZ) .... ..."

"... In PAGE 10: ... DL-computation in elliptic curve subgroups of prime order, r-adding walk function of r decreases fast until a close-to-random performance is achieved, and then remains rather constant. 1 On the other hand, for r = 3 we do not even obtain a constant average value for L for di erent ranges of group orders: As the results in Table4 show, we have 1Blackburnand Murphy [BM] suggestunder certainheuristicassumptionsthat the relationship between L and r follows the rule L = c q r r?1. Their reasoning matchesBrent and Pollard [BP81], who conjectured that what matters most for the performance of random walks is the variance of... ..."

"... In PAGE 10: ... DL-computation in elliptic curve subgroups of prime order, r-adding walk function of r decreases fast until a close-to-random performance is achieved, and then remains rather constant. 1 On the other hand, for r = 3 we do not even obtain a constant average value for L for di erent ranges of group orders: As the results in Table4 show, we have 1Blackburn and Murphy [BM] suggest under certain heuristic assumptions that the relationship between L and r follows the rule L = c q r r 1. Their reasoning matches Brent and Pollard [BP81], who conjectured that what matters most for the performance of random walks is the variance of... ..."

"... In PAGE 9: ... For r 4 the average value for L (taken over the ratios for a certain range [10n?1; 10n]) appeared to be independent of the size of the group order. The results for r 4, in terms of the average values for L taken over all 11000 ratios, are shown in Table3... ..."

"... In PAGE 12: ... The corresponding results are given in Table 5. The average values for L shown in Table5 are convincingly stable for dif- ferent sizes of the group order, and very close to the random case value L0 = 1:41. This does not yet guarantee that 20-linear walks suit for sim- ulating random random walks for any size of group orders.... ..."

"... In PAGE 9: ... For r 4 the average value for L (taken over the ratios for a certain range [10n 1; 10n]) appeared to be independent of the size of the group order. The results for r 4, in terms of the average values for L taken over all 11000 ratios, are shown in Table3... ..."