Number theory for positive characteristics and its application to elliptic curve cryptography

建立并发展了小特征有限域上椭圆曲线的p-ady点计数算法。设p是一个固定的小素数，q是p的N次方.对于定义在q元的有限域k上的一条有序椭圆曲线E，我们构造了一个快速算法来计算E的k有理点的个数.当一个小素数p是固定的且N趋于无穷时，我们的算法比所谓的SEA算法更快.首先，我们把一条给定的有序椭圆曲线提升到它的标准提升。我们利用提升曲线的两个j-不变量通过p次模多项式相关的事实。因此，减少了正则升降机的构造，以求某个非线性方程组的解。其次，我们计算了p阶Frobenius态射的升力的对偶的先导系数。这不应该与逆Frobenius代换混淆，因为一旦曲线被抬起，我们就会研究特征零域。第三，通过观察提升的Frobenius态射的对偶的作用，我们可以计算q次Frobenius自同态的迹。利用著名的Hasse等式，我们得到了有理点的个数，这样我们就完成了。我们进一步构造了一个更快的算法，其中一些预计算只依赖于Q。当N小于，比如说，500的情况下，预计算是相当可行的。因此，预计算成本对于实际应用来说是不成问题的。另一方面，由于有了预计算，我们可以快速评估Frobenius代换。这至少以N的平方根为因数改善了相对于多个比特操作的时间复杂性的增长率。

We establish and develop a p-adic point counting algorithm for elliptic curves over finite fields of small characteristics. Let p be a fixed small prime and put q to be the N-th power of p. For a given ordinal elliptic curve E defined over the finite field k of q elements, we construct a fast algorithm to compute the number of k-rational points of E. When a small prime p is fixed and N tends to infinity, our algorithm is faster than the so-called SEA algorithm.Our algorithm is based on the canonical lifts of elliptic curves. First we lift a given ordinal elliptic curve to its canonical lift. We use the fact that two j-invariants of lifted curves are related by the p-th modular polynomial. So, construction of the canonical lifts is reduced to find a solution to a certain system of non-linear equations. Second, we compute the leading coefficient of the dual of the lift of the p-th Frobenius morphism. This should not be confused with the inverse Frobenius substitution, since we are working over the field of characteristic zero once the curve is lifted. Third, by looking at the action of the dual of the lifted Frobenius morphism, we can compute the trace of the q-th Frobenius endomorphism. Using well-known Hasse's equality, we obtain the number of the rational points and we are done.We further construct a faster algorithm, with some precomputations which depends on only on q. The precomputation is quite feasible for the case that N is less than, say, 500. Hence the cost of precomputation is no problem for practical applications. On the other hand, thanks to the precomputation, we can evaluate the Frobenius substitution quickly. This ameliorates the growth rate of time complexity with respect to a number of bit operations by a factor of at least the square root of N.