Counting points on elliptic curves

Counting points on elliptic curves

An important aspect in the study of elliptic curves is devising effective ways of counting points on the curve. There have been several approaches to do so, and the algorithms devised have proved to be useful tools in the study of various fields such as number theory, and more recently in cryptography and Digital Signature Authentication (See elliptic curve cryptography and elliptic curve DSA). While in number theory they have important consequences in the solving of Diophantine equations, with respect to cryptography, they enable us to make effective use of the difficulty of the discrete logarithm problem (DLP) for the group E(\mathbb{F}_q), of elliptic curves over a finite field \mathbb{F}_q, where q = pk and p is a prime. The DLP, as it has come to be known, is a widely used approach to Public key cryptography, and the difficulty in solving this problem determines the level of security of the cryptosystem. This article covers algorithms to count points on elliptic curves over fields of large characteristic, in particular p > 3. For curves over fields of small characteristic more efficient algorithms based on p-adic methods exist.


Approaches to counting points on elliptic curves

There are several approaches to the problem. Beginning with the naive approach, we trace the developments up to Schoof's definitive work on the subject, while also listing the improvements to Schoof's algorithm made by Elkies (1990) and Atkin (1992).

Several algorithms make use of the fact that groups of the form E(\mathbb{F}_q) are subject to an important theorem due to Hasse, that bounds the number of points to be considered.

Hasse's theorem Let E be an elliptic curve over the finite field \mathbb{F}_q. Then the order of E(\mathbb{F}_q) satisfies

|q + 1 - |E(\mathbb{F}_q)|| \leq 2 \sqrt{q}. \,

Naive approach

The naive approach to counting points, which is the least sophisticated, involves running through all the elements of the field \mathbb{F}_q and testing which ones satisfy the Weierstrass form of the elliptic curve

y^2 = x^3 + Ax + B. \,


Let E be the curve y2 = x3 + x + 1 over \mathbb{F}_5. To count points on E, we make a list of the possible values of x, then of x3 + x + 1(mod 5), then of the square roots y of x3 + x + 1(mod 5). This yields the points on E.

x x3 + x + 1 y Points
 \quad 0 1 \pm1 (0,1),(0,4)
 \quad 1 3
 \quad 2 1 \pm1 (2,1),(2,4)
 \quad 3 1 \pm1 (3,1),(3,4)
 \quad 4 4 \pm2 (4,2),(4,3)

Therefore, E(\mathbb{F}_5) has order 9: the 8 points listed before and the point at infinity.

This algorithm requires running time O(q), because all the values of x \in \mathbb{F}_q must be considered.

Baby-step giant-step

An improvement in running time is obtained using a different approach: we pick an element P=(x,y) \in E(\mathbb{F}_q) by selecting random values of x until x3 + Ax + B is a square in \mathbb{F}_q and then computing the square root of this value in order to get y. Hasse's theorem tells us that |E(\mathbb{F}_q)| lies in the interval (q +1 - 2 \sqrt{q}, q + 1 + 2 \sqrt{q}). Thus, by Lagrange's theorem, finding a unique M lying in this interval and satisfying MP = O, results in finding the cardinality of E(\mathbb{F}_q). The algorithm fails if there exist two integers M and M' in the interval such that MP = M'P = O. In such a case it usually suffices to repeat the algorithm with another randomly chosen point in E(\mathbb{F}_q).

Trying all values of M in order to find the one that satisfies MP = O takes around 4 \sqrt{q} steps.

However, by applying the baby-step giant-step algorithm to E(\mathbb{F}_q), we are able to speed this up to around 4 \sqrt[4]{q} steps. The algorithm is as follows.

The algorithm

1. choose m integer, m > \sqrt[4]{q}
2. FOR{j = 0 to m} DO 
3.    P_j \leftarrow jP
5. L \leftarrow 1
6. Q \leftarrow (q+1)P
7. REPEAT compute the points Q + k(2mP)
8. UNTIL \exists j: Q + k(2mP) = \pm P_j  \\the x-coordinates are compared
9. M \leftarrow q + 1 + 2mk \mp j     \\note MP = O
10. Factor M. Let p_1, \ldots, p_r be the distinct prime factors of M.
11. WHILE i \leq r DO
12.    IF \frac{M}{p_i}P=O
13.       THEN M \leftarrow \frac{M}{p_i}
14.       ELSE i \leftarrow i+1 
15.    ENDIF
17. L \leftarrow \operatorname{lcm}(L, M)     \\note M is the order of the point P
18. WHILE L divides more than one integer N in (q+1-2\sqrt{q},q+1+2\sqrt{q})
19.    DO choose a new point P and go to 1.
21. RETURN N     \\it is the cardinality of E(\mathbb{F}_q)

Notes to the algorithm

  • In line 8. we assume the existence of a match. Indeed, the following lemma assures that such a match exists.
Let a be an integer with |a| \leq 2m^2. There exist integers a0 and a1 with

 -m < a_0 \leq m \mbox{ and } -m \leq a_1 \leq m \mbox{ s.t. } a = a_0 + 2ma_1.
  • Computing (j + 1)P once jP has been computed can be done by adding P to jP instead of computing the complete scalar multiplication anew. The complete computation thus requires m additions. 2mP can be obtained with one doubling from mP. The computation of Q requires log(q + 1) doublings and w additions, where w is the number of nonzero digits in the binary representation of q + 1; note that knowledge of the jP and 2mP allows us to reduce the number of doublings. Finally, to get from Q + k(2mP) to Q + (k + 1)(2mP), simply add 2mP rather than recomputing everything.
  • We are assuming that we can factor M. If not, we can at least find all the small prime factors pi and check that \frac{M}{p_i} \neq O for these. Then M will be a good candidate for the order of P.
  • The conclusion of step 17 can be proved using elementary group theory: since MP = O, the order of P divides M. If no proper divisor \bar{M} of M realizes \bar{M}P=O, then M is the order of P.

One drawback of this method is that there is a need for too much memory when the group becomes large. In order to address this, it might be more efficient to store only the x coordinates of the points jP (along with the corresponding integer j). However, this leads to an extra scalar multiplication in order to choose between j and + j.

There are other generic algorithms for computing the order of a group element that are more space efficient, such as Pollard's rho algorithm and the Pollard kangaroo method. The Pollard kangaroo method allows one to search for a solution in a prescribed interval, yielding a running time of O(\sqrt[4]{q}), using O(log 2q) space.

Schoof's algorithm

A theoretical breakthrough for the problem of computing the cardinality of groups of the type E(\mathbb{F}_q) was achieved by René Schoof, who, in 1985, published the first deterministic polynomial time algorithm. Central to Schoof's algorithm are the use of division polynomials and Hasse's theorem, along with the Chinese remainder theorem.

Schoof's insight exploits the fact that, by Hasse's Theorem, there is a finite range of possible values for |E(\mathbb{F}_q)|. It suffices to compute |E(\mathbb{F}_q)| modulo an integer N > 4\sqrt{q}. This is achieved by computing |E(\mathbb{F}_q)| modulo primes \ell_1, \ldots, \ell_s whose product exceeds 4 \sqrt{q}, and then applying the Chinese remainder theorem. The key to the algorithm is using the division polynomial \psi_{\ell} to efficiently compute |E(\mathbb{F}_q)| modulo \ell.

The running time of Schoof's Algorithm is polynomial in n = log q, with an asymptotic complexity of O(n2M(n3) / log n) = O(n5 + o(1)), where M(n) denotes the complexity of multiplication. Its space complexity is O(n3).

Schoof–Elkies–Atkin algorithm

In the 1990s, Noam Elkies, followed by A. O. L. Atkin devised improvements to Schoof's basic algorithm by making a distinction among the primes \ell_1, \ldots, \ell_s that are used. A prime \ell is called an Elkies prime if the characteristic equation of the Frobenius endomorphism, ϕ2tϕ + q = 0, splits over \mathbb{F}_\ell. Otherwise \ell is called an Atkin prime. Elkies primes are the key to improving the asymptotic complexity of Schoof's algorithm. Information obtained from the Atkin primes permits a further improvement which is asymptotically negligible but can be quite important in practice. The modification of Schoof's algorithm to use Elkies and Atkin primes is known as the Schoof–Elkies–Atkin (SEA) algorithm.

The status of a particular prime \ell depends on the elliptic curve E/\mathbb{F}_q, and can be determined using the modular polynomial \Psi_\ell(X,Y). If the univariate polynomial \Psi_\ell(X,j(E)) has a root in \mathbb{F}_q, where j(E) denotes the j-invariant of E, then \ell is an Elkies prime, and otherwise it is an Atkin prime. In the Elkies case, further computations involving modular polynomials are used to obtain a proper factor of the division polynomial \psi_\ell. The degree of this factor is O(\ell), whereas \psi_\ell has degree O(\ell^2).

Unlike Schoof's algorithm, the SEA algorithm is typically implemented as a probabilistic algorithm (of the Las Vegas type), so that root-finding and other operations can be performed more efficiently. Its computational complexity is dominated by the cost of computing the modular polynomials \Psi_\ell(X,Y), but as these do not depend on E, they may be computed once and reused. Under the heuristic assumption that there are sufficiently many small Elkies primes, and excluding the cost of computing modular polynomials, the asymptotic running time of the SEA algorithm is O(n2M(n2) / log n) = O(n4 + o(1)), where n = log q. Its space complexity is O(n3log n), but when precomputed modular polynomials are used this increases to O(n4).

See also


  • I. Blake, G. Seroussi, and N. Smart: Elliptic Curves in Cryptography, Cambridge University Press, 1999.
  • A. Enge: Elliptic Curves and their Applications to Cryptography: An Introduction. Kluwer Academic Publishers, Dordrecht, 1999.
  • G. Musiker: Schoof's Algorithm for Counting Points on E(\mathbb{F}_q). Available at
  • R. Schoof: Counting Points on Elliptic Curves over Finite Fields. J. Theor. Nombres Bordeaux 7:219-254, 1995. Available at
  • L. C. Washington: Elliptic Curves: Number Theory and Cryptography. Chapman \& Hall/CRC, New York, 2003.
  • C. Peters: Counting points on elliptic curves over \mathbb{F}_q. Available at


Wikimedia Foundation. 2010.

Look at other dictionaries:

  • Elliptic curve cryptography — (ECC) is an approach to public key cryptography based on the algebraic structure of elliptic curves over finite fields. The use of elliptic curves in cryptography was suggested independently by Neal Koblitz[1] and Victor S. Miller[2] in 1985.… …   Wikipedia

  • Moduli of algebraic curves — In algebraic geometry, a moduli space of (algebraic) curves is a geometric space (typically a scheme or an algebraic stack) whose points represent isomorphism classes of algebraic curves. It is thus a special case of a moduli space. Depending on… …   Wikipedia

  • Division polynomials — In mathematics the division polynomials provide a way to calculate multiples of points on elliptic curves over Finite fields. They play a central role in the study of counting points on elliptic curves in Schoof s algorithm. Contents 1 Definition …   Wikipedia

  • Riemann surface — For the Riemann surface of a subring of a field, see Zariski–Riemann space. Riemann surface for the function ƒ(z) = √z. The two horizontal axes represent the real and imaginary parts of z, while the vertical axis represents the real… …   Wikipedia

  • Plane curve — In mathematics, a plane curve is a curve in a Euclidean plane (cf. space curve). The most frequently studied cases are smooth plane curves (including piecewise smooth plane curves), and algebraic plane curves. A smooth plane curve is a curve in a …   Wikipedia

  • De Franchis theorem — In mathematics, the de Franchis theorem is one of a number of closely related statements applying to compact Riemann surfaces, or, more generally, algebraic curves, X and Y, in the case of genus g > 1. The simplest is that the automorphism… …   Wikipedia

  • Genus–degree formula — In classical algebraic geometry, the genus–degree formula relates the degree d of a non singular plane curve with its arithmetic genus g via the formula: A singularity of order r decreases the genus by .[1] Proofs The proof follows immediately… …   Wikipedia

  • René Schoof — ist ein niederländischer Mathematiker, der sich mit algebraischer Zahlentheorie, arithmetischer algebraischer Geometrie, algorithmischer Zahlentheorie und Kodierungstheorie beschäftigt. René Schoof, Oberwolfach 2009 Schoof promovierte 1985 an der …   Deutsch Wikipedia

  • Néron–Tate height — In number theory, the Néron–Tate height (or canonical height) is a quadratic form on the Mordell Weil group of rational points of an abelian variety defined over a global field. It is named after André Néron and John Tate. Contents 1 Definition… …   Wikipedia

  • mathematics — /math euh mat iks/, n. 1. (used with a sing. v.) the systematic treatment of magnitude, relationships between figures and forms, and relations between quantities expressed symbolically. 2. (used with a sing. or pl. v.) mathematical procedures,… …   Universalium

We are using cookies for the best presentation of our site. Continuing to use this site, you agree with this.