A variant of the large sieve inequality with explicit constants - PowerPoint PPT Presentation

A variant of the large sieve inequality with explicit constants Maciej Grześkowiak Adam Mickiewicz University Poznań, Poland Number Theoretic Methods in Cryptology Paris 2019 MG (UAM Poznań) Sieve NutMic 2019 1 / 25

Outline 1 The large sieve inequality MG (UAM Poznań) Sieve NutMic 2019 2 / 25

Outline 1 The large sieve inequality 2 The algorithmic number theory problem MG (UAM Poznań) Sieve NutMic 2019 2 / 25

Outline 1 The large sieve inequality 2 The algorithmic number theory problem 3 Application of the large sieve inequality MG (UAM Poznań) Sieve NutMic 2019 2 / 25

Outline 1 The large sieve inequality 2 The algorithmic number theory problem 3 Application of the large sieve inequality MG (UAM Poznań) Sieve NutMic 2019 2 / 25

The large sieve inequality We define M + N � e ( θ ) = e 2 π i θ , S ( x ) = c n e ( nx ) , n = M + 1 where the c n are arbitrary complex numbers. MG (UAM Poznań) Sieve NutMic 2019 3 / 25

The large sieve inequality We define M + N � e ( θ ) = e 2 π i θ , S ( x ) = c n e ( nx ) , n = M + 1 where the c n are arbitrary complex numbers. The distance to nearest integer function � θ � = min {| θ − n | : n ∈ Z } MG (UAM Poznań) Sieve NutMic 2019 3 / 25

The large sieve inequality Let x 1 , . . . x R be points which are well spaced modulo 1 in the sense that � x r − x s � ≥ δ (1) for s � = r , where 0 < δ ≤ 1 2 . MG (UAM Poznań) Sieve NutMic 2019 4 / 25

The large sieve inequality Let x 1 , . . . x R be points which are well spaced modulo 1 in the sense that � x r − x s � ≥ δ (1) for s � = r , where 0 < δ ≤ 1 2 . The large sieve is an inequality of the form R M + N | S ( x r ) | 2 ≤ ∆ � � | c n | 2 , (2) r = 1 n = M + 1 where ∆ = ∆( N , δ ) . MG (UAM Poznań) Sieve NutMic 2019 4 / 25

The large sieve inequality Let x 1 , . . . x R be points which are well spaced modulo 1 in the sense that � x r − x s � ≥ δ (1) for s � = r , where 0 < δ ≤ 1 2 . The large sieve is an inequality of the form R M + N | S ( x r ) | 2 ≤ ∆ � � | c n | 2 , (2) r = 1 n = M + 1 where ∆ = ∆( N , δ ) . [Gallagher] For example, we can take ‘ ∆ = π N + δ − 1 MG (UAM Poznań) Sieve NutMic 2019 4 / 25

Application of the large sieve inequality Let x r = a q be points, where ( a , q ) = 1 , q ≤ Q , . If a q � = a ′ q ′ then MG (UAM Poznań) Sieve NutMic 2019 5 / 25

Application of the large sieve inequality Let x r = a q be points, where ( a , q ) = 1 , q ≤ Q , . If a q � = a ′ q ′ then aq ′ − a ′ q q − a ′ � � � � a qq ′ ≥ 1 1 � � � � � = � ≥ � � � � q ′ qq ′ Q 2 � � We may take δ = Q − 2 , we obtain MG (UAM Poznań) Sieve NutMic 2019 5 / 25

Application of the large sieve inequality Lemma q M + N | S ( a / q ) | 2 ≤ ( N + Q 2 ) � � � | c n | 2 , q ≤ Q a = 1 n = M + 1 ( a , q )= 1 where the summation is over primes q . MG (UAM Poznań) Sieve NutMic 2019 6 / 25

Application of the large sieve inequality Let π ( x ; a , q ) = ♯ { p ≤ x : p ≡ a (mod q ) , ( a , q ) = 1 } MG (UAM Poznań) Sieve NutMic 2019 7 / 25

Application of the large sieve inequality Let π ( x ; a , q ) = ♯ { p ≤ x : p ≡ a (mod q ) , ( a , q ) = 1 } Then 2 y � � log log( 3 y / q ) �� π ( x + y ; a , q ) − π ( x ; a , q ) ≤ 1 + O ϕ ( q ) log( y / q ) log( 2 y / q ) for y > q . MG (UAM Poznań) Sieve NutMic 2019 7 / 25

Application of the large sieve inequality Let M + N � T ( χ ) = c n χ ( n ) n = M + 1 where χ is a Dirichlet character (mod q ) . MG (UAM Poznań) Sieve NutMic 2019 8 / 25

Application of the large sieve inequality Let M + N � T ( χ ) = c n χ ( n ) n = M + 1 where χ is a Dirichlet character (mod q ) . Gallagher show q | T ( χ ) | 2 ≤ ϕ ( q ) � ∗ � | S ( a / q ) | 2 q χ mod q a = 1 ( a , q )= 1 where � ∗ denotes summation over primitive multiplicative characters χ (mod q ) . MG (UAM Poznań) Sieve NutMic 2019 8 / 25

Application of the large sieve inequality We obtain M + N q � ∗ | T ( χ ) | 2 ≤ ( N + Q 2 ) � � | c n | 2 , ϕ ( q ) χ mod q n = M + 1 q ≤ Q where the summation is over primes q and � ∗ denotes summation over primitive multiplicative characters χ (mod q ) . MG (UAM Poznań) Sieve NutMic 2019 9 / 25

Generalization of the large sieve inequality Huxley generalized to algebraic number fields K , [ K : Q ] = k . MG (UAM Poznań) Sieve NutMic 2019 10 / 25

Generalization of the large sieve inequality Huxley generalized to algebraic number fields K , [ K : Q ] = k . He considered algebraic integers of α ∈ K such that α = n 1 ω 1 + . . . + n k ω k , M i + 1 ≤ n i ≤ M i + N i , i = 1 , . . . k , MG (UAM Poznań) Sieve NutMic 2019 10 / 25

Generalization of the large sieve inequality Huxley generalized to algebraic number fields K , [ K : Q ] = k . He considered algebraic integers of α ∈ K such that α = n 1 ω 1 + . . . + n k ω k , M i + 1 ≤ n i ≤ M i + N i , i = 1 , . . . k , Schaal considered α ∈ K lying in the domains which not necessarily depend on special integer basis of K . MG (UAM Poznań) Sieve NutMic 2019 10 / 25

Generalization of the large sieve inequality Huxley generalized to algebraic number fields K , [ K : Q ] = k . He considered algebraic integers of α ∈ K such that α = n 1 ω 1 + . . . + n k ω k , M i + 1 ≤ n i ≤ M i + N i , i = 1 , . . . k , Schaal considered α ∈ K lying in the domains which not necessarily depend on special integer basis of K . Hinz proved a variant of the large sieve inequality to algebraic number K MG (UAM Poznań) Sieve NutMic 2019 10 / 25

Problem Find two primes p and q such that q | ♯ E ( F p ) . MG (UAM Poznań) Sieve NutMic 2019 11 / 25

Problem Find two primes p and q such that q | ♯ E ( F p ) . Our assumptions p should be as close to q as possible MG (UAM Poznań) Sieve NutMic 2019 11 / 25

Problem Find two primes p and q such that q | ♯ E ( F p ) . Our assumptions p should be as close to q as possible works in a polynomial time with respect to p , MG (UAM Poznań) Sieve NutMic 2019 11 / 25

Problem Find two primes p and q such that q | ♯ E ( F p ) . Our assumptions p should be as close to q as possible works in a polynomial time with respect to p , give a proof without assumptions of any hypotheses, any heuristics, MG (UAM Poznań) Sieve NutMic 2019 11 / 25

Problem Find two primes p and q such that q | ♯ E ( F p ) . Our assumptions p should be as close to q as possible works in a polynomial time with respect to p , give a proof without assumptions of any hypotheses, any heuristics, compute the order of magnitude of p , q for which we can proof that the algorithm works MG (UAM Poznań) Sieve NutMic 2019 11 / 25

Application. Elliptic Curve Cryptography (ECC) Theorem [Shparlinski, Sutherland 2014] Given a real number x > 3.There is an Algorithm that outputs p ∈ [ x , 2 x ] , a , b ∈ F p , N = ♯ E ( F p ) , where p is uniformly distributed over primes in [ x , 2 x ] and the pair ( a , b ) is then uniformly distributed over pairs in F p × F p for which ♯ E ( F p ) is prime. Assuming the GRH, the expected running time of the Algorithm is O ((log x ) 5 (log log x ) 3 log log log x ) MG (UAM Poznań) Sieve NutMic 2019 12 / 25

Application. Elliptic Curve Cryptography (ECC) Theorem [Shparlinski, Sutherland 2017] Assume the GRH. There is a deterministic algorithm that, given a prime p and an integer m = o ( p 1 / 2 (log p ) − 4 ) , outputs an elliptic curve E ( F p ) with m | ♯ E ( F p ) in O ( mp 1 / 2 ) time. MG (UAM Poznań) Sieve NutMic 2019 13 / 25

Application. Elliptic Curve Cryptography (ECC) CM method: MG (UAM Poznań) Sieve NutMic 2019 14 / 25

Application. Elliptic Curve Cryptography (ECC) CM method: select p , MG (UAM Poznań) Sieve NutMic 2019 14 / 25

Application. Elliptic Curve Cryptography (ECC) CM method: select p , find ∆ < 0 and s , t ∈ Z such that 4 p = t 2 − ∆ s 2 , MG (UAM Poznań) Sieve NutMic 2019 14 / 25

Application. Elliptic Curve Cryptography (ECC) CM method: select p , find ∆ < 0 and s , t ∈ Z such that 4 p = t 2 − ∆ s 2 , If p + 1 ± t is a prime, then construct E , or MG (UAM Poznań) Sieve NutMic 2019 14 / 25

Application. Elliptic Curve Cryptography (ECC) CM method: select p , find ∆ < 0 and s , t ∈ Z such that 4 p = t 2 − ∆ s 2 , If p + 1 ± t is a prime, then construct E , or If p + 1 ± t has a big prime factor q , then construct E , MG (UAM Poznań) Sieve NutMic 2019 14 / 25

CM-primes MG (UAM Poznań) Sieve NutMic 2019 15 / 25

CM-primes DEFINITION: MG (UAM Poznań) Sieve NutMic 2019 15 / 25

CM-primes DEFINITION: Primes p and q are CM-primes with respect to ∆ < 0 if MG (UAM Poznań) Sieve NutMic 2019 15 / 25

CM-primes DEFINITION: Primes p and q are CM-primes with respect to ∆ < 0 if there exist integers s and t such that | t | ≤ 2 √ p , 4 p − t 2 = ∆ s 2 . q | p + 1 − t , MG (UAM Poznań) Sieve NutMic 2019 15 / 25