Implementing the asymptotically fast version of the elliptic curve primality proving algorithm

Abstract

Abstract. The elliptic curve primality proving (ECPP) algorithm is one of the current fastest practical algorithms for proving the primality of large numbers. Its running time currently cannot be proven rigorously, but heuristic arguments show that it should run in timeÕ((log N ) 5 ) to prove the primality of N . An asymptotically fast version of it, attributed to J. O. Shallit, is expected to run in timeÕ((log N ) 4 ). We describe this version in more detail, leading to actual implementations able to handle numbers with several thousands of decimal digits.

Efficient CM-constructions of elliptic curves over finite fields

“…We also present numerical evidence for such unproved statements. In the case where N is prime, the heuristic arguments are very similar to those going into the analysis of the elliptic curve primality proving algorithm ECPP [20].…”

“…From the description of the algorithm we gave in the previous section, and more in particular its relation to ECPP, it is clear that one should be able to construct a curve having a large prime number N of points in all cases where ECPP, as described in [20], can prove primality of a number of the same size. To do so, it makes sense to apply an idea attributed to J. Shallit in [20] to speed up the computation. This idea starts from the observation that for large prime numbers N , the Algorithm spends a lot of time in evaluating (…”

Group order formulas for reductions of CM elliptic curves

“…This answers an open question of Atkin and Morain (Conjecture 8.1 of [2]). As Morain points out in the introduction to [20], for implementing the Atkin-Morain Elliptic Curve Primality Proving algorithm [2,21] and for cryptographic applications, it is important to do this step rapidly, and preferably deterministically.…”

Computing the cardinality of CM elliptic curves using torsion points

“…In the course of implementing the ECPP algorithm [3,20] or for cryptographic reasons, it is important to compute this cardinality rapidly. We could of course try both signs of U yielding cardinalities m, find some random points P on E(j) and check whether [m]P = O E on E. This approach is somewhat probabilistic and we prefer deterministic and possibly faster solutions.…”