ON REMARKS OF LIFTING PROBLEMS FOR ELLIPTIC CURVES 1 ...

14 HWAN JOON KIM, JUNG HEE CHEON, AND SANG GEUN HAHN
In general
2ĥ(n 1P 1 + · · · + n r P r ) ≥ min(c i ) max(n 2 i ).
i i
Especially, when r = 2, we get
Since
c 1 = 2ĥ(P 1) − (ĥ(P 1 + P 2 ) − ĥ(P 1) − ĥ(P 2)) 2
2ĥ(P 2)
c 2 = 2ĥ(P 2) − (ĥ(P 1 + P 2 ) − ĥ(P 1) − ĥ(P 2)) 2
2ĥ(P .
1)
2 −1 min(c 1 , c 2 ) = min(ĥ(P 1), ĥ(P 2)) − (ĥ(P 1 + P 2 ) − ĥ(P 1) − ĥ(P 2)) 2
4 max(ĥ(P 1), ĥ(P ,
2))
the lemma is done.
By the above lemma, the equation (7) gives
which proves the theorem.
ɛ 2 q < r 2 N 2 ĥ(R)/c(E, P 1 , · · · , P r ),
By the above theorem, if we try to solve the ECDLP by finding a point R ∈ E 1 (Q)
where E is the lifting elliptic curve with r lifted points, then R must satisfies
ĥ(R) ≥ cɛ 2 q/(r 2 N 2 ) with probability (1 − ɛ 2 ), that is too large to be found by
brute force search. That is, some additional technics should be developed to solve
ECDLP by this method.
For example, let p be a 160-bit prime and ɛ = 2 −10 . Then the canonical height
of R is O(2 140 ) and this means that the denominator of x[R] (and numerator of
x[R]) is O(exp(2 140 )).
Example Let E, P, Q be same as the above example and p = 269. Then |Ẽ(F p)| =
277 is a prime, and, for any a 1 , a 2 with |a i | < 16,
a 1 P + a 2 Q ≢ O mod p.
So, P and Q satisfy ɛ-difficult ECDLP for ɛ = 16/ √ 277 ∼ 0.961.
By Theorem 4.4,
ĥ(R) > cɛ 2 q/rN > 97.16207922. 9
In fact, (a 1 , a 2 ) = (16, 7) is the minimal solution, so R = a 1 P + a 2 Q is the point
with minimal canonical height on E 1 (Q). Its x-coordinate is
− 90027506518519817222938275051552491770450764858
66891585307576494736635187698005291974739361783
82912164447862612385890525730762174791232832236
/ 95697838478938530905953909309886609308629748660
41306587066160951814221233253474735923759534191
58624171650295923681533216800048677635500959201 ,
and ĥ(R) is about 162.7319387. It is too large to be found by brute force search.
9 As in the proof of theorem 4.2, we should apply r = 1 in case that we use the original point
˜P , ˜Q as the lifted points.
□
□