ON REMARKS OF LIFTING PROBLEMS FOR ELLIPTIC CURVES 1 ...

ON REMARKS OF LIFTING PROBLEMS FOR ELLIPTIC CURVES 9
practice, since n has only large prime factors, it is very rare that the pseudo-addition
is not defined.
Moreover, we have an inclusion
φ : Ẽ(Z/nZ) ↩→ Ẽ′ (Z/nZ) = Ẽ(Z/p 1Z) × · · · × Ẽ(Z/p sZ)
which is defined as φ(P ) = (P mod p 1 , · · · , P mod p s ). Therefore, even though
Ẽ(Z/nZ) is not a group, we can define the order of ˜P in Ẽ(Z/nZ) to be the order
of φ( ˜P ) in Ẽ′ (Z/nZ).
Now, we compute the order of a point ˜P of an elliptic curve Ẽ defined over Z/nZ.
First, let ˜P i = n i ˜P for some integers n1 , · · · , n r . Assuming that we find a good
lifting (E, P 1 , · · · , P r ) for (Ẽ, ˜P 1 , · · · , ˜P r ), then we can use the descent method so
as to get
(6)
α 1 P 1 + · · · + α r P r = O,
for some integers α 1 , · · · , α r . By reduction modulo n, we get
∑
αi ˜Pi = ( ∑ α i n i ) ˜P = O.
That is, we get α = ∑ α i n i as a multiple of the order of ˜P . So, by factorizing α,
we can compute the exact order of ˜P . 7
Note that α may be 0. But, α = 0 implies (α 1 , · · · , α r ) is the solution of
α 1 n 1 + · · · + α r n r = 0.
So, if n 1 , · · · , n r are chosen to be relatively prime, the possibility of α 1 n 1 + · · · +
α r n r = 0 is not so high even though α i ’s satisfy (6). Moreover, even in the case of
α = 0, we can repeat the same procedure for different n i ’s until we have non-zero
α.
3.2. Integer Factorization. Suppose that n is a square-free integer that we want
to factorize.
Step 1 Take a random elliptic curve Ẽ over Z/nZ and a random point ˜P in
Ẽ(Z/nZ) and compute a non-zero integer α with α ˜P = O by the above procedure.
Step 2 Factorize α and find a divisor d of α such that
(α/d)P = (x : y : t) with 1 < gcd(t, n) < n.
Then we can get a non-trivial divisor gcd(t, n) of n. Go to Step 1 with n ← gcd(t, n)
(or n/ gcd(t, n)).
Step 3 If we get a prime divisor d of α such that
(α/d)P = (x : y : t) with gcd(t, n) = 1 and
d > ( 4√ n + 1) 2 ,
then n is a prime.
Note that if n = p 1 p 2 · · · p r , then the order of ˜P in Ẽ(Z/nZ) is the least common
multiplier (LCM) of ord( ˜P mod p i ) in Ẽ(Z/p iZ) (i = 1, · · · , r).
Therefore, if ord( ˜P mod p i ) divide α/d and if ord( ˜P mod p j ) does not divide
α/d, then
(α/d)P ≡ O in Ẽ(Z/p iZ) and
7 Also, if we can compute the order Nn of Ẽ(Z/nZ), by computing the GCD of Nn and α, we
can compute the order of ˜P more easily.