In order to protect the equipment or some important information from evil internet users, information security technology has played a key role. RSA cryptosystem is the most widely used public-key cryptosystem but its key for ensuring sufficient security reaches about 2000 bits long. Therefore, it is not efficient to implement RSA cryptosystem on terminal with scarce computation resources. On the other hand, elliptic curve cryptosystem(ECC) [l] has' the same security level with about 7-fold smaller length key as compared to RSA cryptosystem, it is said that ECC is more practical as compared to RSA.We deal with elliptic curves of which defining equation is given in the form of E(z,y) = y2 -x3 -aa:b = 0.In general, the coefficients a, b are elements in a certain finite field, which is called coefficient field, and the solutions (z, y) to the equation are called rational points.Rational points over an elliptic curve forms an additive Abelian group. The security of ECC relies upon difficulty of a discrete logarithm problem on a cyclic group in the additive Abelian group, and the problem is called elliptic curve discrete logarithm problem(ECDLP) . In addition, the generator of this cyclic group is called base point in the elliptic curve cryptosystem. Since the additive Abelian group plays a role of key space in ECC, the order of the group, that is, the number of rational points must be a large prime or divisible by a large prime factor in order to ensure the security. Moreover, the order is preferred to be a prime for constructing the ECC. In order to make sure the security of ECC, we have to determine the order of the adopted elliptic curve, which costs O(log6 q) polynomial modulo arithmetic operations over Fq by using Schoof Extended Algorithm (SEA)[l]. Therefore, generating an elliptic curve with a large primeorder takes much computation time. Horiuchi et al. have proposed an algorithm to generate a prime-order elliptic curve defined over Fp with SEA algorithm improved[2], where p is the characteristic. This algorithm, however, requires as much computation time as several repetitions of SEA algorithm. On the other hand, if the coefficient and definition field are Fq and its extension field F p , then its order in Fqm can be obtained by computing its order over F4 and then applying the Weil's theorem[l].Therefore, the order computation in this case becomes much faster by restricting q so as to be small. However, its order becomes a composite and there exists some insecure curves fragile to hey-Ruck attack [3].In order to overcome such an undesirable property, we 'This work was supported by KAKENHI 14750296. firstly adopt twist technique[l] since we can obtain the order of the twisted elliptic curve without any additional computation, where the twisted elliptic curve is given byTo be more detailed, let #E(Fqm) be the order of elliptic curve over Fqm , then its twisted order is given by 2q + 2 -#E(Fqm) when A is a quadratic power non residue over Fqm . Accordingly, we obtain an order elliptic curve, however, if t...
