Elliptic Curve Primality Proving Jared Asuncion PhD Away Days - - PowerPoint PPT Presentation

▶
elliptic curve primality proving
SMART_READER_LITE
LIVE PREVIEW

Elliptic Curve Primality Proving Jared Asuncion PhD Away Days - - PowerPoint PPT Presentation

Dec 23, 2023 198 likes •609 views

Elliptic Curve Primality Proving Jared Asuncion PhD Away Days Bordeaux-Luxembourg 19 October 2019 Jared Asuncion https://shorturl.at/krtxD PhD Away Days 1 / 11 Definition An elliptic curve over k ( char k = 2 , 3 ) is a smooth projective

slide-1
SLIDE 1

Elliptic Curve Primality Proving

Jared Asuncion PhD Away Days Bordeaux-Luxembourg 19 October 2019

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 1 / 11

slide-2
SLIDE 2

Definition An elliptic curve over k (char k = 2, 3) is a smooth projective curve given by an equation of the form y2 = f (x) = x3 + ax + b where a, b ∈ k and f (x) has no double roots in k. Example Take k = R. Then y2 = x3 + x + 1 is an elliptic curve over R since R = C and x3 + x + 1 has distinct roots over C. Example Take k = F31. Then y2 = x3 + x + 1 is NOT an elliptic curve since (x − 14)2(x − 3) = x3 − 31x2 + 280x − 588 ≡ x3 + x + 1 mod 31.

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 2 / 11

slide-3
SLIDE 3

An elliptic curve has a group structure. The group structure is obtained using the ‘connect-intersect-reflect’ method. The identity of this group is called the point at infinity, denoted by ∞. y2 = x3 + 1 P Q

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 3 / 11

slide-4
SLIDE 4

An elliptic curve has a group structure. The group structure is obtained using the ‘connect-intersect-reflect’ method. The identity of this group is called the point at infinity, denoted by ∞. y2 = x3 + 1 P Q

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 3 / 11

slide-5
SLIDE 5

An elliptic curve has a group structure. The group structure is obtained using the ‘connect-intersect-reflect’ method. The identity of this group is called the point at infinity, denoted by ∞. y2 = x3 + 1 P Q

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 3 / 11

slide-6
SLIDE 6

An elliptic curve has a group structure. The group structure is obtained using the ‘connect-intersect-reflect’ method. The identity of this group is called the point at infinity, denoted by ∞. y2 = x3 + 1 P Q P + Q

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 3 / 11

slide-7
SLIDE 7

An elliptic curve has a group structure. The group structure is obtained using the ‘connect-intersect-reflect’ method. The identity of this group is called the point at infinity, denoted by ∞. y2 = x3 + 1 P

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 4 / 11

slide-8
SLIDE 8

An elliptic curve has a group structure. The group structure is obtained using the ‘connect-intersect-reflect’ method. The identity of this group is called the point at infinity, denoted by ∞. y2 = x3 + 1 P

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 4 / 11

slide-9
SLIDE 9

An elliptic curve has a group structure. The group structure is obtained using the ‘connect-intersect-reflect’ method. The identity of this group is called the point at infinity, denoted by ∞. y2 = x3 + 1 P

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 4 / 11

slide-10
SLIDE 10

An elliptic curve has a group structure. The group structure is obtained using the ‘connect-intersect-reflect’ method. The identity of this group is called the point at infinity, denoted by ∞. y2 = x3 + 1 P P + P

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 4 / 11

slide-11
SLIDE 11

An elliptic curve has a group structure. The group structure is obtained using the ‘connect-intersect-reflect’ method. The identity of this group is called the point at infinity, denoted by ∞. y2 = x3 + 1 P Q

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 5 / 11

slide-12
SLIDE 12

An elliptic curve has a group structure. The group structure is obtained using the ‘connect-intersect-reflect’ method. The identity of this group is called the point at infinity, denoted by ∞. y2 = x3 + 1 P Q

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 5 / 11

slide-13
SLIDE 13

An elliptic curve has a group structure. The group structure is obtained using the ‘connect-intersect-reflect’ method. The identity of this group is called the point at infinity, denoted by ∞. y2 = x3 + 1 P Q

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 5 / 11

slide-14
SLIDE 14

An elliptic curve has a group structure. The group structure is obtained using the ‘connect-intersect-reflect’ method. The identity of this group is called the point at infinity, denoted by ∞ . y2 = x3 + 1 P Q

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 5 / 11

slide-15
SLIDE 15

An elliptic curve has a group structure. The group structure is obtained using the ‘connect-intersect-reflect’ method. The identity of this group is called the point at infinity, denoted by ∞ . So, P + Q = ∞. y2 = x3 + 1 P Q

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 5 / 11

slide-16
SLIDE 16

Using the same equations for the ‘connect-intersect-reflect’ method, we also find a group law for elliptic curves over finite fields. Example The elliptic curve y2 = x3 + x over F7 has eight points with coordinates in F7: E = {∞, (0, 0), (1, ±3), (3, ±4), (5, ±2)} It has other points in extension fields (e.g. in F7(i)) such as (2, 2i): y2 = (2i)2 = −4 ≡ 3 mod 7 x3 + x = 23 + 2 = 10 ≡ 3 mod 7.

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 6 / 11

slide-17
SLIDE 17

Note that ‘multiplication-by-m’ is a group homomorphism from E to E (i.e. an endomorphism of E). −1 · (5, 2) = (5, −2) 2 · (5, 2) = (1, 3) −1 · (1, 3) = (1, −3) 2 · (1, 3) = (0, 0)

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 7 / 11

slide-18
SLIDE 18

Note that ‘multiplication-by-m’ is a group homomorphism from E to E (i.e. an endomorphism of E). −1 · (5, 2) = (5, −2) 2 · (5, 2) = (1, 3) −1 · (1, 3) = (1, −3) 2 · (1, 3) = (0, 0) Some elliptic curves have extra endomorphisms. For example, the elliptic curve y2 = x3 + x has i : (x, y) → (−x, iy). i · (5, 2) = (−5, 2i) i2 · (5, 2) = (5, −2) i · (1, 3) = (−1, 3i) i2 · (1, 3) = (1, −3) i · (−5, 2i) = (5, −2) i2 · (−5, 2i) = (−5, −2i) i · (−1, 3i) = (1, −3) i2 · (−1, 3i) = (1, −3i)

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 7 / 11

slide-19
SLIDE 19

Note that ‘multiplication-by-m’ is a group homomorphism from E to E (i.e. an endomorphism of E). −1 · (5, 2) = (5, −2) 2 · (5, 2) = (1, 3) −1 · (1, 3) = (1, −3) 2 · (1, 3) = (0, 0) Some elliptic curves have extra endomorphisms. For example, the elliptic curve y2 = x3 + x has i : (x, y) → (−x, iy). i · (5, 2) = (−5, 2i) i2 · (5, 2) = (5, −2) i · (1, 3) = (−1, 3i) i2 · (1, 3) = (1, −3) i · (−5, 2i) = (5, −2) i2 · (−5, 2i) = (−5, −2i) i · (−1, 3i) = (1, −3) i2 · (−1, 3i) = (1, −3i) Observe that i2 · P = −P. It is similar to how i2 = −1 (as complex numbers).

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 7 / 11

slide-20
SLIDE 20

Primality Proving Trial Division To prove N is prime, it suffices to check if it is divisible by integers greater than 1 whose value is at most √ N. We prove that q = 31 is prime. Note that √ 31 ≈ 5.5678. 31 divided by 2 = 15 r. 1 31 divided by 3 = 10 r. 1 31 divided by 4 = 7 r. 3 31 divided by 5 = 6 r. 1

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 8 / 11

slide-21
SLIDE 21

Proposition Let 6 < N be an integer. If there exists: an integer m a prime q an elliptic curve E over Z/NZ and a point P on E such that m = qs for some s ∈ Z q >

  • N1/4 + 1

2 mP = ∞ sP = ∞ then N is prime.

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 9 / 11

slide-22
SLIDE 22

Proposition Let 6 < N = 97 be an integer. If there exists: an integer m a prime q an elliptic curve E over Z/NZ and a point P on E such that m = qs for some s ∈ Z q >

  • N1/4 + 1

2 mP = ∞ sP = ∞ then N is prime.

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 9 / 11

slide-23
SLIDE 23

Proposition Let 6 < N = 97 be an integer. If there exists: an integer m = 93 a prime q an elliptic curve E over Z/NZ and a point P on E such that m = qs for some s ∈ Z q >

  • N1/4 + 1

2 mP = ∞ sP = ∞ then N is prime.

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 9 / 11

slide-24
SLIDE 24

Proposition Let 6 < N = 97 be an integer. If there exists: an integer m = 93 a prime q = 31 an elliptic curve E over Z/NZ and a point P on E such that m = qs for some s ∈ Z q >

  • N1/4 + 1

2 mP = ∞ sP = ∞ then N is prime.

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 9 / 11

slide-25
SLIDE 25

Proposition Let 6 < N = 97 be an integer. If there exists: an integer m = 93 a prime q = 31 an elliptic curve E over Z/NZ, say, E : y2 = x3 + 69x + 2 and a point P on E such that m = qs for some s ∈ Z q >

  • N1/4 + 1

2 mP = ∞ sP = ∞ then N is prime.

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 9 / 11

slide-26
SLIDE 26

Proposition Let 6 < N = 97 be an integer. If there exists: an integer m = 93 a prime q = 31 an elliptic curve E over Z/NZ, say, E : y2 = x3 + 69x + 2 and a point P on E, say, P = (12, 91) such that m = qs for some s ∈ Z q >

  • N1/4 + 1

2 mP = ∞ sP = ∞ then N is prime.

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 9 / 11

slide-27
SLIDE 27

Proposition Let 6 < N = 97 be an integer. If there exists: an integer m = 93 a prime q = 31 an elliptic curve E over Z/NZ, say, E : y2 = x3 + 69x + 2 and a point P on E, say, P = (12, 91) such that m = qs for some s ∈ Z. We have s = 3 ∈ Z since 93 = 31 · 3. q >

  • N1/4 + 1

2 mP = ∞ sP = ∞ then N is prime.

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 9 / 11

slide-28
SLIDE 28

Proposition Let 6 < N = 97 be an integer. If there exists: an integer m = 93 a prime q = 31 an elliptic curve E over Z/NZ, say, E : y2 = x3 + 69x + 2 and a point P on E, say, P = (12, 91) such that m = qs for some s ∈ Z. We have s = 3 ∈ Z since 93 = 31 · 3. q >

  • N1/4 + 1

2 ≈ 17.125. mP = ∞ sP = ∞ then N is prime.

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 9 / 11

slide-29
SLIDE 29

Proposition Let 6 < N = 97 be an integer. If there exists: an integer m = 93 a prime q = 31 an elliptic curve E over Z/NZ, say, E : y2 = x3 + 69x + 2 and a point P on E, say, P = (12, 91) such that m = qs for some s ∈ Z. We have s = 3 ∈ Z since 93 = 31 · 3. q >

  • N1/4 + 1

2 ≈ 17.125. mP = ∞. E has exactly 93 points so for any P, we have mP = ∞. sP = ∞ then N is prime.

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 9 / 11

slide-30
SLIDE 30

Proposition Let 6 < N = 97 be an integer. If there exists: an integer m = 93 a prime q = 31 an elliptic curve E over Z/NZ, say, E : y2 = x3 + 69x + 2 and a point P on E, say, P = (12, 91) such that m = qs for some s ∈ Z. We have s = 3 ∈ Z since 93 = 31 · 3. q >

  • N1/4 + 1

2 ≈ 17.125. mP = ∞. E has exactly 93 points so for any P, we have mP = ∞. sP = ∞. 3P = (23, 46) = ∞. then N is prime.

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 9 / 11

slide-31
SLIDE 31

Proposition Let 6 < N = 97 be an integer. If there exists: an integer m = 93 a prime q = 31 an elliptic curve E over Z/NZ, say, E : y2 = x3 + 69x + 2 and a point P on E, say, P = (12, 91) such that m = qs for some s ∈ Z. We have s = 3 ∈ Z since 93 = 31 · 3. q >

  • N1/4 + 1

2 ≈ 17.125. mP = ∞. E has exactly 93 points so for any P, we have mP = ∞. sP = ∞. 3P = (23, 46) = ∞. then N is prime. It remains to prove that q = 31 is prime.

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 9 / 11

slide-32
SLIDE 32

To find the above data: Let D < 0 be a fundamental discriminant. That is, either D = 4m for some m ∈ Z which is square-free

  • r D ≡ 1 mod 4 and D is square-free.

Find integers U, V such that U2 + |D|V 2 = 4N. Take m = N + 1 − U. This requires solving a diophantine equation. Can you write m as m = qs? If not, go back to step 1. This involves removing small prime factors of m. Find an elliptic curve E with complex multiplication by the imaginary quadratic number field K = Q(

  • −|D|).

A twist of this elliptic curve E will have exactly m points modulo N. Find a point P that satisfies the conditions. Guess a point. The odds are in your favor.

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 10 / 11

slide-33
SLIDE 33

Download PARI on your smartphone. Google Play Store: https://shorturl.at/krtxD

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 11 / 11

slide-34
SLIDE 34

Download PARI on your smartphone. Google Play Store: https://shorturl.at/krtxD Enter the following commands: PariDroid ?

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 11 / 11

slide-35
SLIDE 35

Download PARI on your smartphone. Google Play Store: https://shorturl.at/krtxD Enter the following commands: PariDroid ? N = 10^35 + 69 ?

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 11 / 11

slide-36
SLIDE 36

Download PARI on your smartphone. Google Play Store: https://shorturl.at/krtxD Enter the following commands: PariDroid ? N = 10^35 + 69 ? cert = primecert(N) ?

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 11 / 11

slide-37
SLIDE 37

Download PARI on your smartphone. Google Play Store: https://shorturl.at/krtxD Enter the following commands: PariDroid ? N = 10^35 + 69 ? cert = primecert(N) ? print(primecertexport(cert))

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 11 / 11

slide-38
SLIDE 38

Download PARI on your smartphone. Google Play Store: https://shorturl.at/krtxD Enter the following commands: PariDroid ? N = 10^35 + 69 ? cert = primecert(N) ? print(primecertexport(cert)) You can choose a different prime N as long as N > 264. Otherwise, you can just check if N divides any prime less than 232.

Jared Asuncion https://shorturl.at/krtxD PhD Away Days 11 / 11