Counting Points on Elliptic Curves over Finite Fields of Small Characteristic in Quasi Quadratic Time

Abstract

Abstract. Let p be a small prime and q = p n . Let E be an elliptic curve over Fq. We propose an algorithm which computes without any preprocessing the j-invariant of the canonical lift of E with the cost of O(log n) times the cost needed to compute a power of the lift of the Frobenius. Let µ be a constant so that the product of two n-bit length integers can be carried out in O(n µ ) bit operations, this yields an algorithm to compute the number of points on elliptic curves which reaches, at the expense of a O(n 5 2 ) space complexity, a theoretical time complexity bound equal to O(n max(1.19,µ)+µ+ 1 2 log n). When the field has got a Gaussian Normal Basis of small type, we obtain furthermore an algorithm with O(log(n)n 2µ ) time and O(n 2 ) space complexities. From a practical viewpoint, the corresponding algorithm is particularly well suited for implementations. We outline this by a 100002-bit computation.

Examination and implementation of the fast method for computing the order of elliptic curve

“…The problem to calculate the number of points on EC is a non-trivial one and, at present, in Ukraine there are no data in the available sources on the execution order and essence of this stage. However, articles [5][6][7][8][9][10][11][12][13] present an overview and proof of mathematical methods that can be employed to count the number of points on EC.…”

“…Further, in the present study, there will be a detailed analysis of articles [10,12] and we shall experimentally test the effectiveness of such improvement. Papers [11,13] describe a variety of solutions to the Artin-Schreier equation for various bases. In [11], for optimal polynomial basis, in [13], for the Gaussian normal basis.…”

“…Papers [11,13] describe a variety of solutions to the Artin-Schreier equation for various bases. In [11], for optimal polynomial basis, in [13], for the Gaussian normal basis. A detailed theoretical and practical analysis of these studies will be presented further in our research.…”

Algorithms for improved performance in cryptographic protocols.

“…Variants and improvements of this idea have appeared since then (e.g. [7,48,8,32,17]) the main variant being how the curve is lifted. The best run time for these algorithms over fields of small characteristic is currently about O(log 2+ q) (e.g.…”

“…The best run time for these algorithms over fields of small characteristic is currently about O(log 2+ q) (e.g. [17]). …”