Elliptic Curve Primality Proving

Executive summary

The group order is no longer fixed by n

The Pocklington test fails when n − 1 cannot be factored, and nothing can be done about it — the group is determined by n. On an elliptic curve modulo n the group order varies with the curve, so a curve can be sought whose order has a large easily-certified prime factor. That reduces primality of n to primality of a smaller number, and iterating produces a short certificate that verifies quickly.

Learning objectives

State the elliptic curve analogue of the Pocklington criterion.
Explain the downstep and why the certificate terminates.
Describe how the CM method avoids general point counting.
Interpret and verify an ECPP certificate.
State the practical limits of the method.

Section 01The criterion

Let E be a curve modulo n and P a point on it. Suppose m is a candidate for the group order, q a prime divisor of m with q > (n^1/4 + 1)², and

[m]P = O and [m/q]P ≠ O

Then n is prime, provided q is prime. The bound on q comes from Hasse: it forces any prime factor of n to exceed n^1/2, which is impossible unless n is prime.

The downstep

Primality of n is reduced to primality of q, which is roughly the same size as n but strictly smaller. Iterating gives a decreasing chain that terminates at a small prime. The chain is the certificate.

Section 02Goldwasser–Kilian and Atkin–Morain

Goldwasser–KilianRandom curves plus point counting

Choose random curves and count points with Schoof's algorithm until an order with a large prime factor appears. Theoretically clean; the point counting is the bottleneck.

Atkin–MorainCM curves with known order

Choose a CM discriminant D, solve 4n = u² + |D|v² by Cornacchia, and the candidate orders are n + 1 ± u immediately. Build the curve only after a suitable order is found — no point counting at all.

AlgorithmAtkin–Morain stepin: probable prime n → out: a curve, point and prime q for the certificate

For each small CM discriminant D in order of increasing class number:
Check that D is a quadratic residue modulo n; if not, skip.
Solve 4n = u² + |D|v² by Cornacchia's algorithm. Fails quickly when no representation exists.
Test the candidate orders m = n + 1 ± u for a large prime factor q after removing small factors.
If a suitable q is found, compute the class polynomial for D, find a root modulo n, and build the curve.
Find a point P and verify the two multiplication conditions; recurse on q.

Failure is cheap and expected

Most discriminants yield no representation, or an order with no large prime factor. Each attempt is fast, and the search simply moves on. The randomised character of the method lies here, in how many attempts are needed — not in the correctness of the result.

Section 03Certificates

The certificate is the chain of steps: for each level, the curve parameters, the point, the candidate order and the next prime. Verification repeats only the scalar multiplications.

O(log^4+ε n)heuristic running time

O(log³ n)verification cost per step

30 000+ digitssizes proved in practice

Stage 01Read the levelTake n, the curve parameters, the point P, the order m and the prime q.
Stage 02Check the curveConfirm the discriminant is invertible modulo n and P lies on E.
Stage 03Check the conditionsVerify [m]P = O and [m/q]P ≠ O.
Stage 04DescendMove to the next level with n replaced by q; stop at a small prime verified directly.

Verification is the point

A certificate that takes minutes to verify for a proof that took weeks to find is what makes a primality claim publicly checkable. This is the decisive advantage over the Jacobi sum test, which offers no such artefact.

Section 04Practical considerations

ECPP in practice
Aspect	Guidance
Preliminary screening	Always run strong probable prime tests first — ECPP on a composite wastes very large amounts of time before failing
Discriminant ordering	Try small class numbers first; the class polynomial cost grows with \|D\|
Backtracking	If a level yields no usable order, return to the previous level and choose a different q — the chain is a search tree, not a line
Parallelism	Independent discriminants can be tried in parallel; distributed ECPP is how record proofs are obtained
Certificate storage	Store and publish the certificate; it is the durable artefact, not the log of the search

The chain can stall

Occasionally no suitable curve is found at a level within a reasonable budget. The remedy is to back up and select a different prime at the previous level. Implementations must support backtracking, since a purely forward search can fail on inputs that are perfectly provable.

ReferenceFrequently asked questions

Why is the bound on q what it is?

It comes from Hasse's theorem: a group order within 2√n of n + 1 combined with a point of order q greater than (n^(1/4) + 1)² forces any prime factor of n to exceed √n, which is impossible for a composite.

What happens if n is actually composite?

The arithmetic modulo n is not field arithmetic, so an inversion will typically fail during a scalar multiplication — revealing a factor of n. Alternatively the multiplication conditions simply fail. Either way the method does not produce a false proof.

How large can ECPP go?

Proofs for numbers of tens of thousands of digits have been completed with distributed computation. The practical limit is set by the class polynomial computation and the search for usable orders, both of which grow steadily rather than abruptly.

NavigateContinue in this stream

Curated next steps from this page. The site also surfaces algorithmically related reading below.

ProvenanceSources and further reading

This page is an original KEVOS explanatory article. It presents the underlying mathematics — definitions, algorithms, complexity results and selection criteria — in KEVOS editorial voice. No text is reproduced from any copyrighted source. Where numerical tables are relevant, KEVOS links to live authoritative databases rather than republishing static values.

Handbook application: from concept to controlled practice

Purpose. This expanded section turns the original page into a practical handbook. It preserves the supplied material and adds a repeatable way to apply, check and review Elliptic Curve Primality Proving. It does not replace a contract, legislation, a controlled standard, competent engineering judgement or specialist advice.

The operating aim is to turn a compact mathematical statement into a usable chain of definitions, claims, examples and checks. Read the original explanation first, then use the workflow and checks below to convert knowledge into evidence.

Treat Elliptic Curve Primality Proving as a network of definitions and implications, not as a list of formulas. The working vocabulary on this page—primality, section, elliptic, curve, proving—should be made explicit before any proof or computation begins. Record the ambient set or structure, the permitted operations and the equality or equivalence relation in use. A compact theorem often changes meaning when the base field, finiteness condition, commutativity assumption or direction of an action changes.

For a proof, write the hypotheses as a checklist and mark the line at which each one is used. For a computation, state the representation of the input, the arithmetic model, the termination condition and the output invariant. For a classification problem, distinguish existence from uniqueness and distinguish an object from its representation. These separations prevent a correct local calculation from being mistaken for the general result.

A useful worked example should be small enough to inspect completely but rich enough to exercise the main mechanism. Compute the result in two ways where practical: symbolically and by substitution, structurally and numerically, or directly and through a normal form. Then include one near-miss example in which a hypothesis fails. The contrast explains why the theorem is shaped as it is and gives the reader a diagnostic pattern for later problems.

Verification is part of the mathematics. Check domains and codomains, substitute proposed solutions, test identity and zero cases, compare dimensions or cardinalities, and confirm that maps respect the required operations. In numerical work, report precision, conditioning and a residual rather than digits alone. In algorithmic work, separate mathematical correctness from implementation complexity and resource limits.

Step-by-step operating method

Fix the setting. State the objects, ambient structure, notation and assumptions before manipulating symbols.
Separate claims. Distinguish definitions, hypotheses, conclusions, equivalent conditions and consequences.
Choose a method. Select proof, construction, calculation or algorithm according to the question actually asked.
Work a small case. Use the smallest non-trivial example to expose the mechanism and test edge behaviour.
Verify independently. Substitute back, check invariants, test boundary cases or use an alternative derivation.

Worked-example protocol

Illustrative method—not a source theorem. Start with a small admissible input and list the definitions it must satisfy. Carry out each transformation on a separate line, citing the property that permits it. Preserve exact values until approximation is necessary. At the end, verify the output against the original definition and one invariant such as dimension, degree, determinant, order, norm or residual. Then alter one hypothesis and observe which step ceases to be valid. This protocol creates a reusable example without inventing a theorem-specific numerical answer.

Stage	Record	Quality check
Input	Objects, domain, notation, assumptions	Every symbol is defined
Method	Permitted operation or cited result at each step	All hypotheses hold
Output	Exact result and representation	Correct type, domain and form
Verification	Substitution, invariant or alternative derivation	Independent agreement
Boundary test	Zero, identity, degenerate or failed hypothesis	Scope is understood

Common failure modes and recovery actions

1. Watch for

Using a theorem without checking every hypothesis.

Recovery: Return to the governing definition or requirement and restate the decision in one sentence.

2. Watch for

Treating a suggestive example as a proof of the general case.

Recovery: Separate evidence from assumption, assign an owner and set a date for validation.

3. Watch for

Changing notation or conventions part-way through an argument.

Recovery: Run a small counterexample, boundary test, pilot or independent check before proceeding.

4. Watch for

Hiding a division-by-zero, convergence, finiteness or commutativity assumption.

Recovery: Record the consequence, decision and rationale, then update the controlled baseline.

5. Watch for

Reporting a computed result without a residual, substitution or structural check.

Recovery: Escalate when the issue affects safety, compliance, acceptance, material value or an agreed tolerance.

Review checklist

Can every symbol be traced to a definition or prior result?
Which hypothesis does each major step use?
Does the method cover zero, identity, degenerate and boundary cases?
Can the conclusion be checked by a second representation or calculation?
Are mandatory requirements distinguished from recommendations and illustrative values?
Are sources, assumptions, units, dates and versions recorded closely enough to reproduce the decision?
Have safety, legal, ethical, stakeholder and operational consequences been considered at the appropriate level?
Is there a named owner and a trigger for review, escalation, change or retirement?

Questions for deeper application

What is the most important distinction a practitioner must preserve when applying Elliptic Curve Primality Proving?