Computing the cardinality of CM elliptic curves using torsion points

Abstract

Let E be an elliptic curve having complex multiplication by a given quadratic order of an imaginary quadratic field K. The field of definition of E is the ring class field Ω of the order. If the prime p splits completely in Ω, then we can reduce E modulo one the factors of p and get a curve E defined over Fp. The trace of the Frobenius of E is known up to sign and we need a fast way to find this sign. For this, we propose to use the action of the Frobenius on torsion points of small order built with class invariants à la Weber, in a manner reminiscent of the Schoof-Elkies-Atkin algorithm for computing the cardinality of a given elliptic curve modulo p. We apply our results to the Elliptic Curve Primality Proving algorithm (ECPP).

Group order formulas for reductions of CM elliptic curves

“…Step (1) with a different one, though Morain states in §9 of [20] that while "it is easier to use invariants of small height," his article shows that "we might as well favor those invariants that give us a fast way of computing the right equation instead").…”

“…See §6 of [32] for some examples. Related work appears in [20,15,22,23]. Morain, Andreas Enge, and others have done much work on improving the CM method and finding the best class polynomials.…”

“…This answers an open question of Atkin and Morain (Conjecture 8.1 of [2]). As Morain points out in the introduction to [20], for implementing the Atkin-Morain Elliptic Curve Primality Proving algorithm [2,21] and for cryptographic applications, it is important to do this step rapidly, and preferably deterministically.…”

Edwards curves and CM curves

“…The aim of this section is to prove the following results. The following result is taken from [16] (precised by Theorem 11) and starts our proof of Theorem 19. Together with Proposition 15, this proves part of our theorem.…”

Choosing the correct elliptic curve in the CM method

“…See [19] for other recent work on this question. Morain [21] recently gave a way to distinguish between the twists using congruence conditions in certain cases, for example in the case when 3 is not inert in the imaginary quadratic field and (2V )d is divisible by 3.…”