Constructing elliptic curves of prime order

Abstract

We present a very efficient algorithm to construct an elliptic curve E and a finite field F such that the order of the point group E(F) is a given prime number N. Heuristically, this algorithm only takes polynomial time e O((log N) 3 ), and it is so fast that it may profitably be used to tackle the related problem of finding elliptic curves with point groups of prime order of prescribed size.We also discuss the impact of the use of high level modular functions to reduce the run time by large constant factors and show that recent gonality bounds for modular curves imply limits on the time reduction that can be obtained.

p-adic class invariants

“…We have r(γ 2 ) = 3, and the value r(f) = 72 is close to optimal in view of the upper bound r(f ) 101 proved in [5]. We refer to [9] for an overview of the 'available functions' and their reduction factors.…”

“…Here, c i is the x-coordinate of ϕ I (P i ) ∈Ẽ I [3] andẼ I has Weierstraß equation Hence, η 1 = 18 + O(p) is a class invariant. Note that ϕ p2 is just a 2-isogeny, so we do not actually need the 'Atkin-Elkies' techniques from [19,Sections 7 and 8].…”

“…More examples, including a large example and an example where the polynomial P f ∆ does not have integer coefficients, can be found in [3,Chapter 7]. As displaying large numbers is not particularly pleasing to the human eye, we work with a relatively small discriminant.…”

Efficient CM-constructions of elliptic curves over finite fields

“…As the degree of P ∆ and the size of its coefficients both grow like |∆| 1/2 for ∆ → −∞, the run time can be no better than O(|∆|). This is the actual run time [9] for the classical analytic approach using the modular function j : H → C. The same is true for the more recent non-archimedean approach [8], [5], [4] to the evaluation of P ∆ , which approximates the roots of P ∆ by a Newton iteration process over Q for a suitable small prime . For both methods, it is possible to reduce the run time by sizable constant factors if one replaces the j-function by 'smaller' modular functions [12], [27], [4], [23].…”

A Taxonomy of Pairing-Friendly Elliptic Curves

“…The CM method, which was devised for use in primality testing, constructs a curve with endomorphism ring isomorphic to a given order O in a quadratic imaginary field Q( √ −D), and can be used to construct a curve with a specified number of points. The complexity of the method is O(|D O | 1+ ), where D O is the discriminant of the order O [18,29]. Given current computational power, the method can construct curves over finite fields when |D O | ≤ 10 12 [82].…”