8,044 research outputs found
Accelerating the CM method
Given a prime q and a negative discriminant D, the CM method constructs an
elliptic curve E/\Fq by obtaining a root of the Hilbert class polynomial H_D(X)
modulo q. We consider an approach based on a decomposition of the ring class
field defined by H_D, which we adapt to a CRT setting. This yields two
algorithms, each of which obtains a root of H_D mod q without necessarily
computing any of its coefficients. Heuristically, our approach uses
asymptotically less time and space than the standard CM method for almost all
D. Under the GRH, and reasonable assumptions about the size of log q relative
to |D|, we achieve a space complexity of O((m+n)log q) bits, where mn=h(D),
which may be as small as O(|D|^(1/4)log q). The practical efficiency of the
algorithms is demonstrated using |D| > 10^16 and q ~ 2^256, and also |D| >
10^15 and q ~ 2^33220. These examples are both an order of magnitude larger
than the best previous results obtained with the CM method.Comment: 36 pages, minor edits, to appear in the LMS Journal of Computation
and Mathematic
Complex Multiplication Tests for Elliptic Curves
We consider the problem of checking whether an elliptic curve defined over a
given number field has complex multiplication. We study two polynomial time
algorithms for this problem, one randomized and the other deterministic. The
randomized algorithm can be adapted to yield the discriminant of the
endomorphism ring of the curve.Comment: 13 pages, 2 tables, 1 appendi
Finding Significant Fourier Coefficients: Clarifications, Simplifications, Applications and Limitations
Ideas from Fourier analysis have been used in cryptography for the last three
decades. Akavia, Goldwasser and Safra unified some of these ideas to give a
complete algorithm that finds significant Fourier coefficients of functions on
any finite abelian group. Their algorithm stimulated a lot of interest in the
cryptography community, especially in the context of `bit security'. This
manuscript attempts to be a friendly and comprehensive guide to the tools and
results in this field. The intended readership is cryptographers who have heard
about these tools and seek an understanding of their mechanics and their
usefulness and limitations. A compact overview of the algorithm is presented
with emphasis on the ideas behind it. We show how these ideas can be extended
to a `modulus-switching' variant of the algorithm. We survey some applications
of this algorithm, and explain that several results should be taken in the
right context. In particular, we point out that some of the most important bit
security problems are still open. Our original contributions include: a
discussion of the limitations on the usefulness of these tools; an answer to an
open question about the modular inversion hidden number problem
Computing Hilbert class polynomials with the Chinese Remainder Theorem
We present a space-efficient algorithm to compute the Hilbert class
polynomial H_D(X) modulo a positive integer P, based on an explicit form of the
Chinese Remainder Theorem. Under the Generalized Riemann Hypothesis, the
algorithm uses O(|D|^(1/2+o(1))log P) space and has an expected running time of
O(|D|^(1+o(1)). We describe practical optimizations that allow us to handle
larger discriminants than other methods, with |D| as large as 10^13 and h(D) up
to 10^6. We apply these results to construct pairing-friendly elliptic curves
of prime order, using the CM method.Comment: 37 pages, corrected a typo that misstated the heuristic complexit
- …