An Efficient Approach to Point-Counting on Elliptic Curves from a Prominent Family over the Prime Field ${\mathbb{F}}_p$

Abstract

Here, we elaborate an approach for determining the number of points on elliptic curves from the family ${\mathcal{E}}_p=\{E_a:y^2=x^3+a(modp),a\ne 0\}$, where p is a prime number >3. The essence of this approach consists in combining the well-known Hasse bound with an explicit formula for the quantities of interest-reduced modulo p. It allows to advance an efficient technique to compute the six cardinalities associated with the family ${\mathcal{E}}_p$, for $p\equiv 1(mod3)$, whose complexity is $\tilde{O}\left({log}^{2}p\right)$, thus improving the best-known algorithmic solution with almost an order of magnitude.

1. Introduction

The elliptic curves over finite fields play an important role in modern cryptography. We refer to [1] for an introduction concerning their cryptographic significance (see, as well, the pioneering works of V. Miller and N. Koblitz from 1980’s [2,3]). Briefly speaking, the advantage of the so-called elliptic curve cryptography (ECC) over the non-ECC is that it requires smaller keys to provide the same level of security.

It is well-known that to avoid successful relevant attacks against an ECC system, the number of points on the involved curve (called order of the curve) must have at least one very large prime factor. In particular, if the order itself is a (large) prime, then the entire capabilities of the curve are exploited to achieve maximum security.

An efficient deterministic algorithm (of a complexity of, at most, constant times ${log}^{8}q$ bit-operations where q is the order of an employed finite field) which computes the order of a given elliptic curve of a general type is present in [4]. In this paper, however, we are interested in the whole family of curves ${\mathcal{E}}_p=\{E_a:y^2=x^3+a(modp),a\ne 0\}$ of cardinality $p-1$. Thus, it seems that there is no deterministic way to apply the Schoof algorithm for finding the orders of all curves in ${\mathcal{E}}_p$ when p is large, although it is still feasible, taking into account the existence of only six equiprobable possibilities (see Corollary 1) and the so-called coupon collector’s problem from the probability theory (see, e.g., [5]). Of course, a similar claim is valid in respect to the probabilistic improvement of the Schoof algorithm, that is, the SEA algorithm [4] with expected running time, heuristically, $\tilde{O}\left({log}^{4}p\right)$.

Nevertheless, there are more efficient approaches to the problem of interest, like the algorithmic solution presented in [6] that takes $O\left({log}^{3}p\right)$ bit operations. Moreover, an even better approach (to which this article is devoted) does exist.

There are two main differences between the approach followed in [6] and our own:

• Munuera and Tena proposed to use a general-purpose probabilistic algorithm [7] for finding out the square root of arbitrary quadratic residue modulo p in order to find $\sqrt{-3}$, where $p\equiv 1(mod3)$. Their algorithm is of complexity $O\left({log}^{3}p\right)$, whereas our proposal for this task improves to complexity $\tilde{O}\left(lo{g}^{2}p\right)$ due to an efficient targeted method for computing that specific value;
• The authors of [6] find solutions of the Diophantine equation $F(X,Y)=X^2+XY+Y^2=3p$, while we solve for $X^2+3Y^2=p$. However, both tasks are carried out by appropriate utilizations of the Euclidean algorithm involving p and $\sqrt{-3}$ mod p; thus, both take $O\left({log}^{2}p\right)$ bit operations (see, e.g., [8] or [9]).

Hence, our proposal outperforms that in [6] with almost an order of magnitude, although it is of probabilistic type, too.

For an analytic solution of the problem considered here, we refer to [10], where explicit formulae are obtained for the order of a curve $E_a\in {\mathcal{E}}_p$ in terms of a proper representation of the prime p in the form $p=X^2+Y^2-XY$ for some integers X and Y. Those formulas, however, distinguish between many separate cases, and the computational efficiency is certainly beyond the author’s goals (see, for details, [10] Theorem 1). One also may find some particular instances of this problem as exercises in [11] Ch. 8, Ex. 15, 27.

Finally, it is worth pointing out that the results obtained by the approach followed in this article are comprehensive and compact, despite the fact that some long-established facts from the theory of quadratic partitions of primes are used. Additionally, that approach has been described in [12], but its efficiency is demonstrated only in the case $p\equiv 7(mod12)$, while in the present paper, the idea is further refined and elaborated in full generality.

The paper is organized as follows. In the next section, we give some preliminaries. Section 3 exposes our approach to the problem including the amended computational estimates for large p. Section 4 provides an example with a specially constructed prime modulo, and also discusses the results of an program experiment to compare the performance of our proposed algorithmic technique with that of the SEA algorithm in the considered scenario. Some conclusions are drawn in the last section.

2. Preliminaries

Let p be a prime $>3$ and ${\mathbb{Z}}_p$ be the ring of residues modulo p, which can also be identified with the prime field ${\mathbb{F}}_p$. We consider a family of elliptic curves defined as ${\mathcal{E}}_p=\{E_a:y^2=x^3+a(modp),a\in {\mathbb{Z}}_p^{*}\}$, where ${\mathbb{Z}}_p^{*}={\mathbb{Z}}_p\setminus \left\{0\right\}$ is the multiplicative group of ${\mathbb{Z}}_p$. Our aim is to find a suitable method (involving closed-form formulae) for computing the order $\#E_a$ of a general member of that family, the curve $E_a$, in terms of the parameters a and p.

For basic number-theoretic notions as the least non-negative and absolute least residues of an integer z modulo another (odd) integer m, we refer to ([13], p. 93). Notations “≡” for congruence modulo p and “=” in ${\mathbb{Z}}_p$ will be used in an interchangeable manner, depending on the context.

Hereinafter, we recall some necessary supplementary notions and facts (possibly with slight abuses).

An element $z\in {\mathbb{Z}}_p^{*}$ is called a quadratic residue modulo p if there exists $x\in {\mathbb{Z}}_p^{*}$ such that $z=x^2$. Analogously, for $d>2$, an element of $z\in {\mathbb{Z}}_p^{*}$ is called the $d-$th order residue modulo p if there exists $x\in {\mathbb{Z}}_p^{*}$ such that $z=x^d$. The set of all $d-$th order residues form a subgroup of ${\mathbb{Z}}_p^{*}$. We will denote the subgroups of quadratic and cubic residues ($d=2,3$) modulo p by ${\mathcal{QR}}_p$ and ${\mathcal{CR}}_p$, respectively.

The next fact appears to be an immediate extension of the celebrated Euler criterion from the elementary number theory (see, e.g., [14] Ch. 7.5).

Proposition 1.

If d is a factor of $p-1$, then the monomial $\mathbf{m}\left(z\right)=z^{\frac{p-1}{d}}$ takes exactly d distinct values in ${\mathbb{Z}}_p^{*}$, each one of them $\frac{p-1}{d}$ times. These values are the $d-$th roots of unity in ${\mathbb{Z}}_p^{*}$, that is, solutions of the equation: $Z^d=1$. In particular, $\mathbf{m}\left(z\right)$ equals to 1 if, and only if z is a $d-$th power residue.

It is well-known that $-3\in {\mathcal{QR}}_p$ if, and only if $p\equiv 1(mod3)$ (of course, $\sqrt{-3}$ modulo p takes two values with opposite signs to each other). The following statement, which is crucial for the efficiency of our approach, shows how to find such a square root.

Proposition 2.

Let z be a cubic non-residue modulo p, where $p\equiv 1\left(mod3\right)$. Then $2z^{\frac{p-1}{3}}+1$ is equal to one of the square roots of $-3$ modulo p.

Proof. 

Indeed, according to Proposition 1, the assumption $z\notin {\mathcal{CR}}_p$ implies $z^{\prime }=z^{\frac{p-1}{3}}$ is a third root of unity in ${\mathbb{Z}}_p^{*}$, different from 1. Thus, $z^{\prime }$ satisfies the equation $Z^2+Z+1=0$, that is, $z^{\prime }=\frac{-1\pm \sqrt{-3}}{2}$ or equivalently $\pm \sqrt{-3}=2z^{\prime }+1$.  ☐

Remark 1.

Proposition 1 (with $d=3$) easily implies that if $p\equiv 1(mod3)$, the cardinality of the set of cubic non-residues modulo p equals to $\frac{2}{3}(p-1)$. This can be interpreted as a reasoning that a randomly selected element of ${\mathbb{Z}}_p^{*}$ is a cubic non-residue with probability of $2/3$. Thus, provided there is a high-quality generator of random integers in the interval $[2,p-1]$, a cubic non-residue can be found after $1.5$ attempts on average. In turn, the square roots of $-3$ modulo p can be efficiently determined by using Proposition 2.

The next proposition expresses a folklore fact that is decisive for our work.

Proposition 3.

For an odd prime p let $S_k\left(p\right)=1^k+2^k+\dots +{(p-1)}^k$, where $k=0,1,\dots$. Then it holds:

$$S_k\left(p\right)(modp)=\left\{\begin{array}{cc}0,\hfill & \mathrm{if}k\not\equiv 0(modp-1)\hfill \\ -1,\hfill & \mathrm{otherwise}.\hfill \end{array}\right.$$

For completeness, we give an alternative proof of that exposed in [12].

Proof. 

We use the fact that ${\mathbb{Z}}_p^{*}$ is a cyclic group. Let g be its generating element, that is, for any $z\in {\mathbb{Z}}_p^{*}$, there exists an $i:0\le i\le p-2$ such that $z=g^i$. This means that $S_k\left(p\right)={\sum }_{z=1}^{p-1}{z}^k\equiv {\sum }_{i=0}^{p-2}{\left(g^i\right)}^k(modp)$. Putting $u=g^k$ as the last congruence implies that $S_k\left(p\right)(modp)={\sum }_{i=0}^{p-2}{u}^i$. Now, there are two cases to be considered:

• if $k\not\equiv 0(modp-1)$, since the order of ${\mathbb{Z}}_p^{*}$ is $p-1$ then $u\ne 1$, which in turn gives that $S_k\left(p\right)(modp)=(u^{p-1}-1)/(u-1)=0$;
• otherwise, the same reasoning implies $S_k\left(p\right)\equiv p-1(modp)=-1$.

 ☐

There is no explicit formula for the number of points on a general type elliptic curve over ${\mathbb{Z}}_p$. The most relevant well-known result in this direction is the following bound (see, e.g., [15] Ch. 4).

Theorem 1 (Hasse).

The number of points N on an elliptic curve over ${\mathbb{Z}}_p$ satisfies the inequality $|(N-1)-p|\le 2\sqrt{p}$.

At the end of this section, we recall a needed fact from the theory of quadratic partitions of primes. This is a long-standing result due to Jacobi (1827) later elaborated by Stern (1832) (see, [16] vol. III, p. 55 about historical details).

Proposition 4.

If p is a prime of the form $p=6k+1$ for which $p=X^2+3Y^2$, then

$$\pm 2X=\frac{(2k+1)\dots \left(3k\right)}{k!}(modp),$$

where the sign utilized is such that $\pm X\equiv 1(mod3)$.

3. Our Approach

As mentioned in the Introduction, the general framework of our approach was described in [12]. We briefly exhibit its basic steps here.

The following proposition helps to unambiguously fix the number N of points on a given elliptic curve, provided one can compute the absolute least residue of $(N-1)$ modulo p denoted by $\mathcal{ALR}(N-1,p)$.

Proposition 5.

In notations of Theorem 1, for a prime $p\ge 17$, it holds:

$$N=\mathcal{ALR}(N-1,p)+p+1.$$

Proof. 

Indeed, if $p\ge 17$, then evidently, $2\sqrt{p}<\frac{p}{2}$. Thus, the Hasse theorem implies $|(N-1)-p|<\frac{p}{2}$, which means that $\mathcal{ALR}(N-1,p)=(N-1)-p$.  ☐

Remark 2.

Note that if one can compute $z\left(modm\right)$, or equivalently, the least non-negative residue R of an integer z modulo odd m, he/she could easily get:

$$\mathcal{ALR}(z,m)=\left\{\begin{array}{cc}R,\hfill & ifR<\frac{m}{2}\hfill \\ R-m,\hfill & \mathit{otherwise}.\hfill \end{array}\right.$$

3.1. An Explicit Formula for the Order of Elliptic Curve $E_a\in {\mathcal{E}}_p$ Reduced Modulo p

Initially, we yield the following congruence:

$$\begin{array}{c}\hfill \#E_a-1\equiv H(a,p)(modp),\end{array}$$

(1)

where

$$\begin{array}{c}\hfill H(a,p)=\sum _{i=0}^{\frac{p-3}{2}}\left(\genfrac{}{}{0pt}{}{\frac{p-1}{2}}{i}\right)a^i{S}_{3l}\left(p\right),\end{array}$$

(2)

with $l=\frac{p-1}{2}-i$ and sums $S_{3l}\left(p\right)$ defined in Proposition 3.

(For the reader’s convenience, in the Appendix A we present a derivation of the expression for $H(a,p)$, which has already been obtained in [12].)

Further, we evaluate $H(a,p)(modp)$ using Proposition 3 and observe that the involved powers are only multiples of 3 in the interval $[3,3\frac{p-1}{2}]$. Thus, there are two distinct cases to be considered:

• $p\equiv 5(mod6)$
  In this case, Proposition 3 implies that for all summands on the right-hand-side of Equation (2) vanish mod p. So, $H(a,p)\equiv 0(modp)$, and in turn for each a, it holds that $\#E_a=p+1$. Indeed, this is a well-known fact (see, e.g., [11] Ch. 18, Ex.1).
• $p\equiv 1(mod6)$
  In this essential case, it can be easily seen that $H(a,p)$ contains exactly one nonzero summand modulo p, that is, that for $i=\frac{p-1}{6}$. Thus, it holds:

  $$\begin{array}{c}\hfill H(a,p)\equiv \left(\genfrac{}{}{0pt}{}{\frac{p-1}{2}}{\frac{p-1}{6}}\right)a^{\frac{p-1}{6}}{S}_{p-1}\left(p\right)\equiv \end{array}$$

  $$\begin{array}{c}\hfill -\left(\genfrac{}{}{0pt}{}{\frac{p-1}{2}}{\frac{p-1}{6}}\right)a^{\frac{p-1}{6}}(modp).\end{array}$$

  (3)

Finally, together with Proposition 5, this immediately implies the following:

Theorem 2.

For a prime $p\ge 19$ such that $p\equiv 1\left(mod6\right)$, it holds:

$$\begin{array}{c}\hfill \#E_a=\mathcal{R}(a,p)+p+1,\end{array}$$

(4)

where $\mathcal{R}(a,p)$ denotes the absolute least residue of (3).

An immediate consequence (except the trivial cases $p=7,13$) of Proposition 1 with $d=6$, and Theorem 2 is next.

Corollary 1.

If p is a prime $\equiv 1\left(mod6\right)$, then the order of the curves from ${\mathcal{E}}_p$ takes exactly six distinct values, each one $\frac{p-1}{6}$ times in accordance with the sixth roots of unity in ${\mathbb{Z}}_p^{*}$: $\pm 1,\pm \zeta ,\pm (\zeta +\sqrt{-3})$ where $\zeta =\frac{-1-\sqrt{-3}}{2}$.

Remark 3.

Although the claim of Corollary 1 is known in one or another form (see, e.g., [17]), it seems that the uniform distribution of the curves’ order has not been widely discussed in the literature.

3.2. Computational Aspects of Point-Counting in ${\mathcal{E}}_p$ When p Is a Large Prime

In this subsection, we refine and re-estimate the algorithmic technique described roughly in [12].

A key part of those computations is that of $\left(\genfrac{}{}{0pt}{}{\frac{p-1}{2}}{\frac{p-1}{6}}\right)(modp)$. Fortunately, this problem can be addressed by noticing that if p is of the form $p=6k+1$, then it holds:

$$\begin{array}{c}\hfill \left(\genfrac{}{}{0pt}{}{\frac{p-1}{2}}{\frac{p-1}{6}}\right)=\frac{(2k+1)\dots \left(3k\right)}{k!}.\end{array}$$

Hence, Proposition 4 allows modular computation of this binomial coefficient to be performed by taking the proper X from a solution of the quadratic Diophantine equation $X^2+3Y^2=p$ with two unknowns, X and Y. Such a solution can be found by applying a similar method as that exhibited in [18], and consisting of two steps:

• Step 1. Find a square root of $-3$ in ${\mathbb{Z}}_p^{*}$;
• Step 2. Find X by applying (partly) the Euclidean algorithm for p and the already found $\sqrt{-3}\in {\mathbb{Z}}_p^{*}$.

As follows by Proposition 2, Step 1 can be performed if one knows in advance a cubic non-residue mod p. If, for a given p, such a non-residue is not available, it can be found after $1.5$ attempts on average following Remark 1. Namely, in every such attempt for a randomly selected integer $z\in [2,p-1]$, we compute the element $z^{\prime }=z^{\frac{p-1}{3}}$ and check whether $z^{\prime }\ne 1$. If this happens, then $2z^{\prime }+1$ is one of the possible $\sqrt{-3}$ in demand. Thus, taking into account the complexity of single multiplication (squaring) (see, e.g., [19,20]), the expected amount of work in Step 1 is, heuristically, $\tilde{O}\left({log}^{2}p\right)$. Additionally, notice that Step 2 is of complexity $O\left({log}^{2}p\right)$ (see, e.g., [9] Theorem 3.13 about details).

Remark 4.

If $p\equiv 7(mod12)$, there is an efficient deterministic way to find a square root of any quadratic residue ζ, that is, by computing ${\zeta }^{\frac{p+1}{4}}$. In particular, this can be applied for $\zeta =-3$ (see [12]).

Besides that, as can be seen by Corollary 1, the six possible distinct values of the second multiplier $a^{\frac{p-1}{6}}$ in expression (3) are linearly expressed in terms of the already found $\sqrt{-3}$.

In summary, the above considerations show the validity of the next theorem:

Theorem 3.

The total computational complexity for simultaneously finding out the six orders linked with family ${\mathcal{E}}_p$ by the proposed algorithmic technique is $\tilde{O}\left({log}^{2}p\right)$.

4. Example and Efficiency Comparison with the SEA Algorithm

4.1. An Example

The example presented here illustrates our probabilistic approach. We choose as the modulo the following prime

$$p=2^{256}+2^{56}+2^{44}+1,$$

which is congruent to $1(mod12)$.

The numerical data presented below are in the hexadecimal number system.

Consecutively, we:

• Calculate $\pm \sqrt{-3}(modp)$:

  ∘

  choose a random number $z\in [2,p-1]:$

  D03CE6183277A6719AD52F362919187D79CA6A50D000975EC4903782F08DAAEB

  ∘

  calculate $z^{\prime }=z^{\frac{p-1}{3}}:$

  1AF6F28A07E19B1F1FCCB53D1A166E14092BC3AF668514D3D2ABE80CBD6C0A16

  ∘

  $z^{\prime }\ne 1$, thus $2z^{\prime }+1$ is a square root of $-3$ in ${\mathbb{F}}_p^{*}$:

  35EDE5140FC3363E3F996A7A342CDC281257875ECD0A29A7A557D0197AD8142D;

• Find X by applying the Euclidean algorithm for p and the found $\sqrt{-3}\in {\mathbb{Z}}_p^{*}$, and calculate $\left(\genfrac{}{}{0pt}{}{\frac{p-1}{2}}{\frac{p-1}{6}}\right)(modp)=2X:$
  • FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBDB3CE472111CA9F0DC134D795D6BFFF;
• Calculate ${\zeta }_1=\frac{-1-\sqrt{-3}}{2}$ and ${\zeta }_2={\zeta }_1+\sqrt{-3}$:
  • E5090D75F81E64E0E0334AC2E5E991EBF6D43C50997AEB2C2E5427F34293F5EA, 1AF6F28A07E19B1F1FCCB53D1A166E14092BC3AF668514D3D2ABE80CBD6C0A16;
• Calculate the values of expression (3) using $1,{\zeta }_1$ and ${\zeta }_2$ in the role of multiplier $a^{\frac{p-1}{6}}$, and take their opposites. Finally, we find out the six orders associated with ${\mathcal{E}}_p$:
  • 100000000000000000000000000000001424C31B8DEEE3560F43EEB286A294004, FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBDB3CE472111CA9F0DC134D795D6C000, FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE065220C024EA85B297C0746F361E6B81,

  *

  100000000000000000000000000000001F9ADDF3FDB157A4D6A3FAB90C9E19483, 100000000000000000000000000000000B761AD86FC2744EC7700D0685FB85481,

  *

  FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF489E527903D8BB138AFF4F97A047AB83.

Finally, by examining the above numbers with the APR-CL primality test, we detect the presence of two prime orders (remarked by “*”) which correspond to $\#E_{31}$ and $\#E_{11}$.

4.2. Efficiency Comparison with the SEA Algorithm

In the program experiments for comparing efficiency of the SEA algorithm with the proposed one, both working at instances of considered task, we used a common laptop with an Intel Core i7-6820HQ at 2.7 GHz (four cores). The algorithm implementation is written in Python, whereas SEA’s one is a highly optimized code written in C from the PARI/GP computer algebra system designed specifically for fast computations in the number theory.

In Table A1 of the Appendix B, we give a list of $257-$bit primes used as experimental data input. As shown in Table A2, our method is between 20 to 67 times faster, although the implementation is not optimized. We also carried out an experiment with a sporadic $857-$bit prime input, whereby the SEA computes the orders for $22.5$ s, while our own performs the work for $33.1$ milliseconds, that is, almost 680 times faster. The latter fact indicates that the method is much more efficient than the SEA algorithm for large primes, say, above 800 bits.

5. Conclusions

Less or more convenient formulae to compute the orders of elliptic curves over finite fields do exist in contemporary literature (see, e.g., [10,15,21], etc.). In this article, we derive an explicit formula for the order of a curve in the family ${\mathcal{E}}_p=\{E_a:y^2=x^3+a(modp),a\ne 0\}$ reduced modulo p. Alongside the famous Hasse bound, this formula comprehensively and concisely resolves the problem we deal with. Moreover, our approach permits the transparent determination of the spectrum of orders for fixed $p\equiv 1(mod6)$, as well as to re-prove the corresponding known fact in the complementary case $p\equiv 5(mod6)$. Besides that, based on classical results for quadratic partitions of primes, we describe an efficient algorithmic technique (with complexity $\tilde{O}({log}^{2}p$)) to simultaneously compute the six orders associated with ${\mathcal{E}}_p$ in cases of interest. The experimental results confirm theoretical estimations for efficiency within expected slight abuse due to still unoptimized implementation. This technique improves the best previously known algorithmic solution [6] with almost an order of magnitude, thus enabling under the same cost to achieve values of the parameter p peculiar to higher security ECC systems. It is especially useful when looking (say, by random search) for prime order elliptic curves belonging to families of considered type if the modulo p is varied.