Efficient CM-constructions of elliptic curves over finite fields

Abstract

Abstract. We present an algorithm that, on input of an integer N ≥ 1 together with its prime factorization, constructs a finite field F and an elliptic curve E over F for which E(F) has order N . Although it is unproved that this can be done for all N , a heuristic analysis shows that the algorithm has an expected run time that is polynomial in 2 ω(N ) log N , where ω(N ) is the number of distinct prime factors of N . In the cryptographically relevant case where N is prime, an expected run time O((log N ) 4+ε ) can be achieved. We illustrate the efficiency of the algorithm by constructing elliptic curves with point groups of order N = 10 2004 and N = nextprime(10 2004 ) = 10 2004 +4863.

An Algorithmic Construction of Finite Elliptic Curves of Order Divisible by a Large Prime

“…For this reason ∆ should be sufficiently small to make the CM method work effectively in practice. Many variants, of initial steps of the CM-method, were proposed in the literature [5], [6], [17], [19]. For example, an algorithm proposed in [19] starts with a small ∆ < 0, ∆ ≡ 5 (mod 8).…”

“…Unfortunately, the analysis of computational complexity of this method was not given by the authors. Another variant was proposed by Bröker and Stevenhagen [5], [6]. Given a prime q (or a positive integer n), their method returns a prime p and an elliptic curve E over F p with |E(F p )| equal to q (or equal to n), where t 2 − ∆s 2 = 4p, ∆ < 0, ∆ = O((log q) 2 ).…”

“…Given a prime q (or a positive integer n), their method returns a prime p and an elliptic curve E over F p with |E(F p )| equal to q (or equal to n), where t 2 − ∆s 2 = 4p, ∆ < 0, ∆ = O((log q) 2 ). However, theoretical estimation of the algorithms running time is possible under heuristic assumptions [5], [6]. Now, we introduce the following definition.…”

Genus-2 curves and Jacobians with a given number of points

“…In the elliptic case [3], the expected minimal discriminant of the endomorphism algebra of an elliptic curve of order N over a prime field grows, at least heuristically, as (log N ) 2 , and this gives rise to efficient CM-constructions. For genus 2, we prove that this is not the case.…”

“…The hypothesis on the existence of an elliptic curve of order N in Theorem 1.2 is caused by the fact that we construct the curve C in the theorem as a genus-2 curve with split Jacobian J ∼ E 1 × E 2 , and this requires the construction of auxiliary elliptic curves E 1 and E 2 of given orders. Such elliptic curves can be constructed by the method of [3] discussed in Section 2. The Jacobian J of C is then obtained by gluing E 1 and E 2 along their n-torsion for some integer n > 1.…”