The aim of this paper is to justify the common cryptographic practice of selecting elliptic curves using their order as the primary criterion. We can formalize this issue by asking whether the discrete log problem (DLOG) has the same difficulty for all curves over a given finite field with the same order. We prove that this is essentially true by showing polynomial time random reducibility of DLOG among such curves, assuming the Generalized Riemann Hypothesis (GRH). We do so by constructing certain expander graphs, similar to Ramanujan graphs, with elliptic curves as nodes and low degree isogenies as edges.
The result is obtained from the rapid mixing of random walks on this graph. Our proof works only for curves with (nearly) the same endomorphism rings. Without this technical restriction such a DLOG equivalence might be false; however, in practice the restriction may be moot, because all known polynomial time techniques for constructing equal order curves produce only curves with nearly equal endomorphism rings.
We define three hard problems in the theory of elliptic divisibility sequences (EDS Association, EDS Residue and EDS Discrete Log), each of which is solvable in sub-exponential time if and only if the elliptic curve discrete logarithm problem is solvable in sub-exponential time. We also relate the problem of EDS Association to the Tate pairing and the MOV, Frey-Rück and Shipsey EDS attacks on the elliptic curve discrete logarithm problem in the cases where these apply.
A new algorithms for computing discrete logarithms on elliptic curves defined over finite fields is suggested. It is based on a new method to find zeroes of summation polynomials. In binary elliptic curves one is to solve a cubic system of Boolean equations. Under a first fall degree assumption the regularity degree of the system is at most $4$. Extensive experimental data which supports the assumption is provided. An heuristic analysis suggests a new asymptotical complexity bound $2^{c\sqrt{n\ln n}}, c\approx 1.69$ for computing discrete logarithms on an elliptic curve over a field of size $2…
We analyze log-algebraic power series identities for formal groups of elliptic curves over $\mathbb{Q}$ which arise from modular parametrizations. We further investigate applications to special values of elliptic curve $L$-functions.
Elliptic bases, introduced by Couveignes and Lercier in 2009, give an elegant way of representing finite field extensions. A natural question which seems to have been considered independently by several groups is to use this representation as a starting point for small characteristic finite field discrete logarithm algorithms. This idea has been recently proposed by two groups working on it, in order to achieve provable quasi-polynomial time for discrete logarithms in small characteristic finite fields. In this paper, we don't try to achieve a provable algorithm but, instead, investigate the p…
We give an account of the complex Arithmetic-Geometric Mean (AGM), as first studied by Gauss, together with details of its relationship with the theory of elliptic curves over $\C$, their period lattices and complex parametrisation. As an application, we present efficient methods for computing bases for the period lattices and elliptic logarithms of points, for arbitrary elliptic curves defined over $\C$. Earlier authors have only treated the case of elliptic curves defined over the real numbers; here, the multi-valued nature of the complex AGM plays an important role. Our method, which we hav…
In this paper, we investigate extreme values of $ω(E(\mathbb{F}_p))$, where $E/\mathbb{Q}$ is an elliptic curve with complex multiplication and $ω$ is the number-of-distinct-prime-divisors function. For fixed $γ> 1$, we prove that \[ \#\{p \leq x : ω(E(\mathbb{F}_p)) > γ\log\log x\} = \frac{x}{(\log x)^{2 + γ\logγ- γ+ o(1)}}. \] The same result holds for the quantity $\#\{p \leq x : ω(E(\mathbb{F}_p)) < γ\log\log x\}$ when $0 < γ< 1$. The argument is worked out in detail for the curve $E : y^2 = x^3 - x$, and we discuss how the method can be adapted for other CM elliptic curves.
Let $E$ be an elliptic curve over the finite field $\mathbb F_q$. We prove that, when $n$ is a sufficiently large positive integer, $\#E(\mathbb F_{q^n})$ has a prime factor exceeding $n\exp(c\log n/\log\log n)$.
Let $E/\mathbb{Q}$ be an elliptic curve over the rational numbers. It is known, by the work of Bombieri and Zannier, that if $E$ has full rational $2$-torsion, the number $N_E(B)$ of rational points with Weil height bounded by $B$ is $\exp\left(O\left(\frac{\log B}{\sqrt{\log\log B}}\right)\right)$. In this paper we exploit the method of descent via $2$-isogeny to extend this result to elliptic curves with just one nontrivial rational $2$-torsion point. Moreover, we make use of a result of Petsche to derive the stronger upper bound $N_{E}(B) = \exp\left(O\left(\frac{\log B}{\log\log B}\right)\…
Most, if not all, unconditional results towards the abc-conjecture rely ultimately on classical Baker's method. In this article, we turn our attention to its elliptic analogue. Using the elliptic Baker's method, we have recently obtained a new upper bound for the height of the S-integral points on an elliptic curve. This bound depends on some parameters related to the Mordell-Weil group of the curve. We deduce here a bound relying on the conjecture of Birch and Swinnerton-Dyer, involving classical, more manageable quantities. We then study which abc-type inequality over number fields could be …
Let $E/\mathbb{Q}$ be an elliptic curve. For a prime $p$ of good reduction, let $r(E,p)$ be the smallest non-negative integer that gives the $x$-coordinate of a point of maximal order in the group $E(\mathbb{F}_p)$. We prove unconditionally that $r(E,p)> 0.72\log\log p$ for infinitely many $p$, and $r(E,p) > 0.36 \log p$ under the assumption of the Generalized Riemann Hypothesis. This can be viewed as elliptic curve analogues of classical lower bounds on the least primitive root of a prime.
We prove several results regarding some invariants of elliptic curves on average over the family of all elliptic curves inside a box of sides $A$ and $B$. As an example, let $E$ be an elliptic curve defined over $\mathbb{Q}$ and $p$ be a prime of good reduction for $E$. Let $e_{E}(p)$ be the exponent of the group of rational points of the reduction modulo $p$ of $E$ over the finite field $\mathbb{F}_p$. Let $\mathcal{C}$ be the family of elliptic curves $$E_{a,b}:~y^2=x^3+ax+b,$$ where $|a|\leq A$ and $|b|\leq B$. We prove that, for any $c>1$ and $k\in \mathbb{N}$, $$\frac{1}{|\mathcal{C}|} \s…
For any elliptic curve $E$ over $k\subset \Bbb R$ with $E({\Bbb C})={\Bbb C}^\times/q^{\Bbb Z}$, $q=e^{2πiz}, \Im(z)>0$, we study the $q$-average $D_{0,q}$, defined on $E({\Bbb C})$, of the function $D_0(z) = \Im(z/(1-z))$. Let $Ω^+(E)$ denote the real period of $E$. We show that there is a rational function $R \in {\Bbb Q}(X_1(N))$ such that for any non-cuspidal real point $s\in X_1(N)$ (which defines an elliptic curve $E(s)$ over $\Bbb R$ together with a point $P(s)$ of order $N$), $πD_{0,q}(P(s))$ equals $Ω^+(E(s))R(s)$. In particular, if $s$ is $\Bbb Q$-rational point of $X_1(N)$, a rare o…
The aim of this article is to give some numerical data related to the order of the Selmer groups in twist families of elliptic curves. To do this we assume the Birch and Swinnerton-Dyer conjecture is true and we use a celebrated theorem of Waldspurger to get a fast algorithm to compute $% L_{E}(1)$. Having an extensive amount of data we compare the distribution of the order of the Selmer groups by functions of type $α\frac{(\log \log (X))^{1+\varepsilon}}{\log (X)}$ with $\varepsilon $ small. We discuss how the "best choice" of $α$ is depending on the conductor of the chosen elliptic curves an…
We present an algorithm that, on input of a positive integer N together with its prime factorization, constructs a finite field F and an elliptic curve E over F for which E(F) has order N. Although it is unproved that this can be done for all N, a heuristic analysis shows that the algorithm has an expected run time that is polynomial in 2^omega(N) log N, where omega(N) is the number of distinct prime factors of N. In the cryptographically relevant case where N is prime, an expected run time O((log N)^{4+epsilon}) can be achieved. We illustrate the efficiency of the algorithm by constructing el…
We give explicit formulae for the logarithmic class group pairing on an elliptic curve defined over a number field. Then we relate it to the descent relative to a suitable cyclic isogeny. This allows us to connect the resulting Selmer group with the logarithmic class group of the base. These constructions are explicit and suitable for computer experimentation. From a conceptual point of view, the questions that arise here are analogues of "visibility" questions in the sense of Cremona and Mazur.
The elliptic curve primality proving (ECPP) algorithm is one of the current fastest practical algorithms for proving the primality of large numbers. Its running time cannot be proven rigorously, but heuristic arguments show that it should run in time O ((log N)^5) to prove the primality of N. An asymptotically fast version of it, attributed to J. O. Shallit, runs in time O ((log N)^4). The aim of this article is to describe this version in more details, leading to actual implementations able to handle numbers with several thousands of decimal digits.
We propose a randomized algorithm to compute isomorphisms between finite fields using elliptic curves. To compute an isomorphism between two fields of cardinality $q^n$, our algorithm takes $$n^{1+o(1)} \log^{1+o(1)}q + \max_{\ell} \left(\ell^{n_\ell + 1+o(1)} \log^{2+o(1)} q + O(\ell \log^5q)\right)$$ time, where $\ell$ runs through primes dividing $n$ but not $q(q-1)$ and $n_\ell$ denotes the highest power of $\ell$ dividing $n$. Prior to this work, the best known run time dependence on $n$ was quadratic. Our run time dependence on $n$ is at worst quadratic but is subquadratic if $n$ has no …
Let $E$ be an elliptic curve defined over $\mathbb{Q}$ and let $N$ be a positive integer. Now, $M_E(N)$ counts the number of primes $p$ such that the group $E_p(\mathbb{F}_p)$ is of order $N$. In an earlier joint work with Balasubramanian, we showed that $M_E(N)$ follows Poisson distribution when an average is taken over a family of elliptic curve with parameters $A$ and $B$ where $A,\, B\ge N^{\frac{\ell}{2}}(\log N)^{1+γ}$ and $AB>N^{\frac{3\ell}{2}}(\log N)^{2+γ}$ for a fixed integer $\ell$ and any $γ>0$. In this paper, we show that for sufficiently large $N$, the same result holds even if …
For an elliptic curve with CM by $K$ defined over its Hilbert class field, $E/H$, we extend Lenstra's finite fields test to generators of norms of certain ideals in $\mathcal{O}_H$, yielding a sufficient $\widetilde{O}(\log^3 N)$ primality test and partially answering an open question of Lemmermeyer in the case of CM elliptic curves. Letting $ι,γ, b\in \mathcal{O}_K$, $(ι)$ prime, and $b$ a primitive $k$-th root of unity modulo $(ι)^n$ we specialize this test to rational integers of the form $N_{K/\mathbb{Q}}(γι^n+b)$ with the norm of $γ$ small, giving a Las Vegas test for primality with avera…
We establish a congruence formula between $p$-adic logarithms of Heegner points for two elliptic curves with the same mod $p$ Galois representation. As a first application, we use the congruence formula when $p=2$ to explicitly construct many quadratic twists of analytic rank zero (resp. one) for a wide class of elliptic curves $E$. We show that the number of twists of $E$ up to twisting discriminant $X$ of analytic rank zero (resp. one) is $\gg X/\log^{5/6}X$, improving the current best general bound towards Goldfeld's conjecture due to Ono--Skinner (resp. Perelli--Pomykala). We also prove th…
We present two algorithms to compute the endomorphism ring of an ordinary elliptic curve E defined over a finite field F_q. Under suitable heuristic assumptions, both have subexponential complexity. We bound the complexity of the first algorithm in terms of log q, while our bound for the second algorithm depends primarily on log |D_E|, where D_E is the discriminant of the order isomorphic to End(E). As a byproduct, our method yields a short certificate that may be used to verify that the endomorphism ring is as claimed.
Given an elliptic curve E over a field of positive characteristic p, we consider how to efficiently determine whether E is ordinary or supersingular. We analyze the complexity of several existing algorithms and then present a new approach that exploits structural differences between ordinary and supersingular isogeny graphs. This yields a simple algorithm that, given E and a suitable non-residue in F_p^2, determines the supersingularity of E in O(n^3 log^2 n) time and O(n) space, where n=O(log p). Both these complexity bounds are significant improvements over existing methods, as we demonstrat…
Let $E$ be an elliptic curve defined over ${\mathbb Q}$. For a prime $p$ of good reduction for $E$, denote by $e_p$ the exponent of the reduction of $E$ modulo $p$. Under GRH, we prove that there is a constant $C_E\in (0, 1)$ such that $$ \frac{1}{π(x)} \sum_{p\le x} e_p = 1/2 C_E x + O_E\big(x^{5/6} (\log x)^{4/3}\big) $$ for all $x\ge 2$, where the implied constant depends on $E$ at most. When $E$ has complex multiplication, the same asymptotic formula with a weaker error term $O_E(1/(\log x)^{1/14})$ is established unconditionally. These improve some recent results of Freiberg and Kurlberg.
