The previous post gave two examples of pairs of elliptic curves in which
#(E / Fp) = q
and
#(E / Fq) = p.
That is, the curve E, when defined over integers mod p has q elements, and when defined over the integers mod q has p elements.
Silverman and Stange [1] call this arrangement an amicable pair. They found a small pair of amicable elliptic curves:
y² = x³ + 2
with p and q equal to 13 and 19. They give many other examples, but this one is nice because it’s small enough for hand calculations, unlike the curves mentioned in the previous post that had on the order of 2254 elements.
More generally, amicable curve pairs are amicable curve cycles with cycle length 3. Silverman and Stange give this example of a cycle of length 3:
y² = x³ − 25x − 8
with (p, q, r) = (83, 79, 73). That is, the curve over F83 has 79 elements, the curve over F79 has 73 elements, and the curve over F73 has 83 elements.
The authors show that there exist cycles of every length m ≥ 2.
Why does any of this matter? Cycles of elliptic curves are useful in cryptography, specifically in zero-knowledge proofs. I hope to go into this further in some future post.
Related posts
[1] Joseph H. Silverman and Katherine E. Stange. Amicable pairs and aliquot cycles for elliptic curves. Experimental Mathematics, 20(3):329–357, 2011.
The post Cycles of Elliptic Curves first appeared on John D. Cook.