如何找到椭圆曲线的最小y坐标y ^ 2 = x ^ 3 +

Question

How can I find the minimum y coordinate for elliptical curve y^2 = x^3 + ax + b on a finite field F(p) in SAGE where a and b are large about the order of 10^15 and the integer p is very large about the order of 10^45 ? I need to find it in SAGE and I have been trying many ways. I am posting some of my code:

    maxtime=120960000
    p = 976324781263478623476912346213469128736427364
    a = 783468734639429
    b = 98347874287423
    E = EllipticCurve(GF(p),[a,b])
    length =50
    for i in range(1,maxtime):
        e = ZZ.random_element(999999999999)
            if E.is_x_coord(I) == true:
                temp = E.lift_x(I)
                break
    i=0
    print 'P1:'
    print temp
    length=0
    t=50
    count=2
    p2=temp+temp
    while count < 10000000000:
        count=count+1
        p2=p2+temp
        if (p2[1]>0):
            if (ZZ(p2[1]) < ZZ(p-1)):
                if (p2[0] > 0):
                    if( ZZ(p2[0]) < ZZ(p-1)):
                        if E.is_x_coord(p2[0]) == true:
                            y2 = E.lift_x(p2[0])
                            length=len(str(y2[1]))
                            if length <=11:
                                print 'p2:'
                                print y2
                                print 'count:'
                                print count
                                break
                            if t > length:
                                t= length
                                print 'length:'
                                print t
                                print 'count:'
                                print count
                                print 'p2:'
                                print y2
    print 'failed:'

The above is just sample code with random numbers. Any suggestions or an entirely different Idea would also be very helpful.

Thanks a lot JS

Answer 1

There is no natural ordering on the elements of GF(p). By minimum y, I guess you mean by the usual order on the integers. Here's an example with p=17, a=11, b=3. Solution is y=3, x=4.

sage: K = GF(17)
sage: a, b = 11, 3
sage: _.<X> = K[]
sage: P = X^3 + a*X + b
sage: next(((P - y^2).roots(), y) for y in K if (P - y^2).roots())
([(4, 1)], 3)
sage: 3^2 == P(4)
True

Beware that your p is not prime.

Answer 2

The elliptic curve E has at least p+1-2p^{1/2} points and for large p and one has that (p+1-2p^{1/2})/p is almost equal to 1. This means that on average every value of y has one value of x such that (x,y) lies on the elliptic curve. This means that unless there is something strange going on I would expect that the smallest y will be really small (I expect it to be 0,1 or 2 most of the times). This suggest just trying different values of y from small to big will be very fast in practice. But I have no proof that it will always be very fast, because if indeed something strange is happening and the smallest y is in fact really big it will take very long.

p = next_prime(976324781263478623476912346213469128736427364)
a = 7834684394239111322316457
b = 98347872833141
E = EllipticCurve(GF(p),[a,b])
Fx.<x> = GF(p)[]
f = x^3 + a*x + b
for y in GF(p):
    xs=(f-y^2).roots(multiplicities=False)
    if len(xs)>0:
        x = xs[0]
        P = E(x,y)
        print P
        break

Gives the point (544771569075032357553369359272826923818637077 : 1 : 1) within 1/10 of a second.

I tried 5000 random values of a and b with the above prime p and below you get to see how often I got which value of y as smallest value. Just to give you some sense on how good this will work in practice.

0 3361
1 1089
2 364
3 119
4 41
5 20
6 3
7 2
8 1