ON REMARKS OF LIFTING PROBLEMS FOR ELLIPTIC CURVES 1 ...

ON REMARKS OF LIFTING PROBLEMS FOR ELLIPTIC CURVES 13
Since ˜P , ˜Q satisfy the ɛ-difficult ECDLP, we get
ɛ √ ∣
∑ ∣ ∣ ∣∣ ∣∣ ∑ ∣ ∣∣)
q < max(
xi α i , yi α i
(7)
< r max
i
The following lemma proves the theorem.
(|x i |, |y i |) max(|α i |).
Lemma 4.5. Let E be an elliptic curve defined over K and the points P 1 , · · · , P r
of E(K) are linearly independent. Define the matrix
where
A = (a ij ) 1≤i,j≤r
a ij = ĥ(P i + P j ) − ĥ(P i) − ĥ(P j),
i
(i, j = 1, · · · , r).
If we define
c k = a kk − a k A −1
k aT k (k = 1, · · · , r)
where a k = (a k1 , · · · , a kk−1 , a kk+1 , · · · , a kr ) and A k is the matrix obtained by removing
kth-row and kth-column in A, then, for any integers n 1 , · · · , n r ,
ĥ(n 1 P 1 + · · · + n r P r ) ≥ c max(n1, 2 · · · , nr)
2
where
Especially, in the case of r = 2,
Proof. Note that
c = c(E, P 1 , · · · , P r ) = 1 2 min(c 1, · · · , c r ) > 0.
c = min(ĥ(P 1), ĥ(P 2)) − (ĥ(P 1 + P 2 ) − ĥ(P 1) − ĥ(P 2)) 2
4 max(ĥ(P 1), ĥ(P .
2))
〈P, Q〉 = ĥ(P + Q) − ĥ(P ) − ĥ(Q)
is the positive-definite symmetric bilinear form on E(K)/E(K) tor . Moreover, it
can be extended to
〈 , 〉 : (E(K)/E(K) tor ⊗ R) 2 → R
with taking tensor product on (E(K)/E(K) tor by R [10].
For simplicity, we may assume that |n 1 | = max i (|n i |). Then if we define a ij =
〈P i , P j 〉 and x i = n i /n 1 (i = 1, · · · , r), then
〈n 1 P 1 + · · · + n r P r , n 1 P 1 + · · · + n r P r 〉 = n 2 1(a 11 + 2 ∑ a 1i x i + ∑
a ij x i x j ).
i≥2
i,j≥2
Since 〈, 〉 is the positive-definite symmetric bilinear form, it is easy to show that
f(x 2 , · · · , x r ) = a 11 + 2 ∑ a 1i x i + ∑
a ij x i x j
i≥2
i,j≥2
has the minimum
when
That is,
a 11 − (a 12 , · · · , a 1r )A −1
1 (a 12, · · · , a 1r ) T
(x 2 , · · · , x r ) T = −A −1
1 (a 12, · · · , a 1r ) T .
2ĥ(n 1P 1 + · · · + n r P r ) = 〈n 1 P 1 + · · · + n r P r , n 1 P 1 + · · · + n r P r 〉 ≥ c 1 n 2 1.