ON REMARKS OF LIFTING PROBLEMS FOR ELLIPTIC CURVES 1 ...

4 HWAN JOON KIM, JUNG HEE CHEON, AND SANG GEUN HAHN
Step 4 By reduction modulo n, we have
∑
αi x i ˜P +
∑
αi y i ˜Q = O.
Therefore
m ≡ − ∑ α i x i / ∑ α i y i
mod ord ˜Q.
Note that the 2-descent procedure has the polynomial running-time that will be
proved in the next subsection. Therefore, the running-time of the above algorithm
depends only on the lifting problem.
Example Let p = 113 and
Ẽ/F p : y 2 = x 3 + 30x + 30, ˜P = (2, 18), ˜Q = (10, 58).
Then, the lifting (E, P, Q) of (Ẽ, ˜P , ˜Q) is as follows.
E/Q : y 2 − 113y = x 3 − 309x − 1100, P = (2, 18), Q = (10, 58).
Then, by descent method, we can get the dependence equation
Finally, we have
2P + 3Q = O.
log ˜P ˜Q = 17.
2.2. Descent method. In this subsection, we introduce the 2-descent method to
compute the coefficients of the dependence equation for given linearly dependent
points P i ’s of E(Q) and we show that it has the polynomial running-time.
Suppose that P i ’s (i = 1, · · · , r) are given rational points of E(Q).
Step 1 Rearrange the given linearly dependent points P i ’s according to their canonical
heights in an increasing order. and find ɛ 1 , · · · , ɛ r ∈ {−1, 0, 1} which are not
all zero and satisfy
(1)
ɛ 1 P 1 + · · · + ɛ r P r ∈ 2E(Q).
Note that if P 1 , · · · , P r are linearly dependent with
α 1 P 1 + · · · + α r P r = O,
then (1) is satisfied for each ɛ i = (α i mod 2). Moreover, it is also easy to check
whether a given rational point is contained in 2E(Q) or not [1][5].
Step 2 For 2 ≤ k ≤ r, determine the sign of ɛ k to satisfy
k−1
∑
k−1
ĥ( ɛ i P i + ɛ k P k ) ≤ ĥ( ∑
ɛ i P i − ɛ k P k ),
i=1
where ĥ is the canonical height on E/Q [10].
It is not easy to compute the exact values of ĥ(P ) for the rational points P in
general. However, we are enough to compare of the canonical heights, so we can
easily determine the signs of ɛ i ’s [11][12].
Step 3 Compute a point R = R(P 1 , · · · , P r ) of E(Q) with
i=1
2R = ɛ 1 P 1 + · · · + ɛ r P r .
It is easy to compute the “halving” point R of P satisfying 2R = P for a given
P of 2E(Q) because it is equivalent to finding the rational roots of the polynomial