2

I have seen your example about ecdlp solver :The Problem is as follows:

$$E\backslash GF(p):y^2=x^3+17230x+22699$$

where $p=23981$, point $G$ with prime order $|G| = 109$

Alice creates a public key by selecting a private key $d<q$, public key $Q=[d]G = (3141,12767)$

Therefore;

  • public information : $a,b,p,G,q,Q$
  • private key : $d$

However, this curve has the following characteristic:

$\Delta= −16( 4a^3+27b^2) \bmod p =0$ That is, the discriminant is 0. and embedding degree is 2

I, however, don't understand where comes out the value (23796,0) i.e how can I calculate it? and then the following formula equation: after which we obtain the corresponding curve $$y^2=x^3+23426x^2$$

  • is it possible for a further explanation of how you determine the point $(27396,0)$?
kelalaka
  • 48,443
  • 11
  • 116
  • 196
fabio
  • 21
  • 1

1 Answers1

2

Let $f(x,y) = -y^2 + x^3+17230x+22699$ over $\Bbb F_p$ with $p=23981$. A point on the curve is a singular point if and only if the partial derivatives are vanishes at that point. The partial derivatives are;

  • $\frac{\partial f}{\partial x} = 3x^2 + 17230 =0 \pmod p$ and vanishes at $x=\{185,23796\}$ found by WolframAlpha or it can be found by Tonelli-Shanks.

  • $\frac{\partial f}{\partial y} = -2y = 0 \pmod p$ and vanishes at $y=0$

The vanishing point $(185,0)$ is not on the curve, however, $(23796,0)$ is.

Therefore $(23796,0)$ is a singular point for the Curve.

Then we then translate the origin to this singular point $(23796,0)$, that is replace $(x,y)$ by $(x+23796,y+0$) in the equation of $E$, yielding the equation of the curve in the shifted referential: $$y^2 = x^3 + 23426x^2$$ The rest is in the answer which the OP had trouble with.

Note: credit goes to @kelalaka for the better of the present answer, in particular introducing $f(x,y)$ and its partial derivatives.

fgrieu
  • 140,762
  • 12
  • 307
  • 587
  • We begin with the singular curve y2=x3+17230x+22699. This curve is singular, as can be immediately determined by its 0 discriminant. Furthermore, it has a singular point (23796,0), where both partial derivatives vanish. We translate the curve to have this singular point at (0,0) by changing thanks for your explaination.variables (x,y)↦(x−23796,y−0), after which we obtain the corresponding curve y2=x3+23426x2, which can be rewritten as y2=x2(x+23426). – fabio Dec 09 '19 at 20:25
  • thanks for your explaination, after i have obtained the point of the curve, (23796,0) how can i obtain the value 23426 put in the script? how can i obtain the new equation: y2=x^3+23426^x2? – fabio Dec 09 '19 at 20:27
  • @fabio did you apply the change of variables? – kelalaka Dec 09 '19 at 20:28
  • @kelalaka..can you write me as i can do the change of variables please? – fabio Dec 09 '19 at 20:35
  • @fabio Actually, it was written in the answer. here Wolfram – kelalaka Dec 09 '19 at 20:38
  • 1
    Thanks @kelalaka – fabio Dec 09 '19 at 20:40
  • @fabio: do yourself the favor of finding precisely at what step attempting that procedure with a non-singular curve fails. – fgrieu Dec 10 '19 at 13:33
  • @fabio: The best known method for elliptic curves of medium size are Pollard's rho and Rubber-hose (with the later summarized by this obligatory XKCD) – fgrieu Dec 10 '19 at 13:47