Elliptic curve point counting

For my diploma thesis, I have implemented Satoh’s algorithm for counting points on elliptic curves over finite fields of small characteristic in C++ (using NTL and GMP).

Example

GF(2337) = GF(23)[X]/(F(X)), F(X) = 22 + X2 + X37

E/GF(2337): y2 = x3 + ax + b

a = 1 + X + X2 + 19X4 + (F(X))
b = 2 + 3X + 4X2 + 7X5 + (F(X))

#E(GF(2337)) = 11 × 47 × 67 × 37313 × q

q = 187285613829952805985­761367930316131263729

A combination of Satoh’s algorithm and an “early-abort strategy” was used to find cryptographically strong curves (with prime order) for all characteristics up to 1523 (representation). Besides, these results may be current point counting records for elliptic curves over finite fields GF(pn) with 5 ≤ p < 2000 and n≫1.

The needed modular polynomials have to be provided separately. For 367 ≤ p < 1000, I thankfully used the coefficients published by Andrew Sutherland. For p ≥ 1009, the coefficients were generated using PARI/GP (modulo a power of p).

In addition to (classical) modular polynomials, the implementation also relies on division polynomials, which can be partially precomputed (based on the work of James McKee). These computations were done for the first 265 primes greater than 3.

If you are interested in running times, you may follow these links (ordered by speed), where n is always the smallest prime such that pn > 2512 (comparable to AES-256)

Yes, the single core performance of Apple's M4 is really impressive.
See also hashcat benchmarks.