Pseudoprime Reductions of Elliptic Curves
Total Page:16
File Type:pdf, Size:1020Kb
Mathematical Proceedings of the Cambridge Philosophical Society VOL. 146 MAY 2009 PART 3 Math. Proc. Camb. Phil. Soc. (2009), 146, 513 c 2008 Cambridge Philosophical Society 513 doi:10.1017/S0305004108001758 Printed in the United Kingdom First published online 14 July 2008 Pseudoprime reductions of elliptic curves BY ALINA CARMEN COJOCARU Dept. of Mathematics, Statistics and Computer Science, University of Illinois at Chicago, Chicago, IL, 60607-7045, U.S.A. and The Institute of Mathematics of the Romanian Academy, Bucharest, Romania. e-mail: [email protected] FLORIAN LUCA Instituto de Matematicas,´ Universidad Nacional Autonoma´ de Mexico,´ C.P. 58089, Morelia, Michoacan,´ Mexico.´ e-mail: [email protected] AND IGOR E. SHPARLINSKI Dept. of Computing, Macquarie University, Sydney, NSW 2109, Australia. e-mail: [email protected] (Received 10 April 2007; revised 25 April 2008) Abstract Let b 2 be an integer and let E/Q be a fixed elliptic curve. In this paper, we estimate the number of primes p x such that the number of points n E (p) on the reduction of E modulo p is a base b prime or pseudoprime. In particular, we improve previously known bounds which applied only to prime values of n E (p). 1. Introduction Let b 2 be an integer. Recall that a pseudoprime to base b is a composite positive integer m such that the congruence bm ≡ b (mod m) holds. The question of the distri- bution of pseudoprimes in certain sequences of positive integers has received some in- terest. For example, in [PoRo], van der Poorten and Rotkiewicz show that any arithmetic 514 A. C. COJOCARU,F.LUCA AND I. E. SHPARLINSKI progression a mod d with a and d coprime contains infinitely many pseudoprimes to base b. Pseudoprime to base b values of the Fibonacci numbers, polynomials and the Euler func- tion are studied in [LuSh1], while pseudoprime Cullen and Woodall numbers are analysed in [LuSh2]. Here, we continue this program and study the presence of base b pseudoprimes in se- quences whose general term is the number of points on the reduction modulo p of a fixed elliptic curve E/Q as the prime p varies. Our motivation also comes from elliptic curve cryptography where finding curves with a prime number of rational points in a given finite field is a very common task. Our results imply that pseudoprimality testing provides a very quick pre-selection procedure for primes p x such that the reduction modulo p of a fixed elliptic curve E/Q has a prime number of points. After this pre-selection, more robust but slower primality testing algorithms can be used for remaining primes (see [CrPo]). For example, Theorem 2 below implies that after such preliminary testing, only O((log log x)2) rounds of more reliable primality testing are expected (compared with about log x rounds in the direct approach). We let E/Q be a fixed elliptic curve over Q of conductor N.Foraprimep H N, we let E p/Fp denote the reduction of E modulo p and put n E (p) = #E p(Fp) for the number of Fp-rational points of E p. When p | N, we simply put n E (p) = p.Fora positive real number x, we let Qb(x) denote the number of primes p x such that n E (p) is either prime or pseudoprime to base b. Our first result gives an unconditional upper bound on Qb(x). We note that, in particular, this bound generalises and improves the bound x R(x) (log x) log log log x of [Co, proposition 7] on the number R(x) of primes p x such that n E (p) is prime. THEOREM 1. For any fixed base b 2 and elliptic curve E/Q, the estimate x(log log log x)2 Q (x) b (log x) log log x holds as x →∞. Naturally, assuming the Generalized Riemann Hypothesis (GRH), we can do much better. THEOREM 2. Under the GRH, for any fixed base b 2 and elliptic curve E/Q, the estimate x(log log x)2 Q (x) b (log x)2 holds as x →∞. In particular, by partial summation, we deduce, under the GRH, the convergence of the series 1 < ∞. p p prime n E (p) b pseudoprime Throughout the paper, any implied constants in symbols O and may occasionally de- pend, where obvious, on the base b 2 and the conductor N of the curve E, but are Pseudoprime reductions of elliptic curves 515 absolute otherwise. We recall that the notations U V and U = O(V ) are both equivalent to the statement that |U| cV holds with some constant c > 0. The letters , p, q and r always denote prime numbers, while k, m and n always denote integer numbers. As usual, we denote by π(x) the number of primes p x. We also use ϕ(m), μ(m), ω(m), and P−(m) for the Euler function, the Mobius¨ function, the number of prime divisors, and the smallest prime divisor of m, respectively. Finally, we use log x for the natural logarithm of a real number x > 0. 2. Preliminaries Let E/Q be an elliptic curve over Q and p a prime. We define aE (p) by the equation aE (p) := p + 1 − n E (p). For a positive real number x and positive integers m, d and t, we use π(x; m, d, t) to denote the number of primes p x with p ≡ d (mod m) and aE (p) ≡ t (mod m). We define the multiplicative function fd,t (m) supported on the set of odd square-free integers by setting ⎧ ⎪ 1 t 2 − 4d ⎨⎪ + if gcd(, d) = 1, () := ( − 1)(2 − 1) fd,t ⎪ ⎩⎪ 0if | d for prime , where (u/) is the Legendre symbol modulo . Our estimates for π(x; m, d, t) needed for the proof of Theorem 1 rely on effective ver- sions of the Chebotarev Density Theorem due to [LaOd]. In fact, they are just slight gener- alizations of the asymptotic formulas on π(x; m, d, t) obtained in the proofs of [CoFoMu, theorems 1·2 and 1·3] for the case where m = r is a product of two primes. In particular, using [CoFoMu, theorem 2·4] together with [CoFoMu, lemma 2·7] (see also [CoFoMu, lemma 2·8]), we obtain: LEMMA 3. For any elliptic curve E/Q without complex multiplication and any suffi- ciently large positive real number x, the estimate 2 −2 π(x; m, d, t) = fd,t (m)π(x) + O(m x exp(−Am log x)) holds with some absolute constant A > 0 uniformly over all odd positive square-free in- tegers m (log x)1/13 and positive integers d and t. Naturally, under the GRH we have a stronger result, which follows from the combination of Theorem 2·4 with Lemma 2·7of[CoFoMu]. LEMMA 4. Under the GRH, for any elliptic curve E/Q without complex multiplication and any sufficiently large positive real number x, the estimate 2 1/2 π(x; m, d, t) = fd,t (m)π(x) + O m x log(mx) holds uniformly over all odd positive square-free integers m and positive integers d and t. 516 A. C. COJOCARU,F.LUCA AND I. E. SHPARLINSKI Let y x be some parameter. Assume that y > 2. Note that if m has the property that P−(m) y, then, in particular, m is odd. Noticing that when gcd(, d) = 1wehave 1 1 f , () = + O , d t 2 3 we obtain the following estimate. LEMMA 5. Assuming that μ(m) 0 and P−(m)>y, we have 1 ω(m) f , (m) = + O . d t m2 m2 y We now define (x; m) as the number of primes p x for which m|n E (p).In particular, m (x; m) = π(x; m, d, t). d,t=0 gcd(d,m)=1 d≡t−1 (mod m) Clearly, for each fixed d the value of t in the above sum is uniquely defined. If every prime divisor of m exceeds y, then mω(m) ϕ(m) = m + O . (2·1) y Combining (2·1) with Lemmas 3 and 5, we deduce the following result. LEMMA 6. For any elliptic curve E/Q without complex multiplication and any suffi- ciently large positive real number x, the estimate 1 ω(m) (x; m) = π(x) + O π(x) + m3x exp(−Am−2 log x) m my holds with some absolute constant A > 0 uniformly over all positive m (log x)1/13 with μ(m) 0 and P−(m)>y. Naturally, under the GRH, we have a stronger result, which is a combination of The- orem 2·4 and Lemma 2·7of[CoFoMu]. LEMMA 7. Under the GRH, for any elliptic curve E/Q without complex multiplication and any sufficiently large positive real number x, the estimate 1 ω(m) (x; m) = π(x) + O π(x) + m2x 1/2 log(mx) m my holds uniformly over all positive integers m with μ(m) 0 and P−(m)>y. The above results are asymptotic formulas. We also need some upper bounds. Note that for an odd prime ,wehave 1 1 f , () ( + 1) = . d t ( − 1)(2 − 1) ( − 1)2 By multiplicativity, we obtain the following estimate. LEMMA 8. For all odd square-free m we have 1 f , (m) . d t ϕ(m)2 Pseudoprime reductions of elliptic curves 517 Combining this with Lemma 3 and noting that for m <(log x)1/13 the inequality π(x) > m2x exp(−Am−2 log x) ϕ(m)2 holds for all sufficiently large values of x, we get that the inequality π(x) π(x; m, d, t) ϕ(m)2 holds uniformly for all positive integers m <(log x)1/13 and all positive integers d and t.