JN Journal of Numbers 2314-842X 2356-7511 Hindawi Publishing Corporation 10.1155/2014/298632 298632 Research Article A Mean Value Formula for Elliptic Curves Feng Rongquan 1 http://orcid.org/0000-0003-3321-8594 Wu Hongfeng 2 Li Jiyou 1 LMAM, School of Mathematical Sciences Peking University Beijing 100871 China pku.edu.cn 2 College of Science North China University of Technology Beijing 100144 China ncut.edu.cn 2014 2582014 2014 01 07 2014 18 08 2014 25 8 2014 2014 Copyright © 2014 Rongquan Feng and Hongfeng Wu. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

It is proved in this paper that, for any point on an elliptic curve, the mean value of x-coordinates of its n-division points is the same as its x-coordinate and that of y-coordinates of its n-division points is n times that of its y-coordinate.

1. Introduction

Let K be a field with char(K)2,3 and let K¯ be the algebraic closure of K. Every elliptic curve E over K can be written as a classical Weierstrass equation as follows: (1)E:y2=x3+ax+b

with coefficients a,bK. A point Q on E is said to be smooth (or nonsingular) if (f/x|Q,f/y|Q)(0,0), where f(x,y)=y2-x3-ax-b. The point multiplication is the operation of computing (2)nP=P+P++Pn

for any point PE and a positive integer n. The multiplication-by-n map (3)[n]:EEPnP

is an isogeny of degree n2. For a point QE, any element of [n]-1(Q) is called an n-division point of Q. Assume that (char(K),n)=1. In this paper, the following result on the mean value of the x,y-coordinates of all the n-division points of any smooth point on an elliptic curve is proved.

Theorem 1.

Let E be an elliptic curve defined over K and let Q=(xQ,yQ)E be a point with QO. Set (4)Λ={P=(xP,yP)E(K¯)nP=Q}.

Then (5)1n2PΛxP=xQ,1n2PΛyP=nyQ.

According to Theorem 1, let Pi=(xi,yi), i=1,2,,n2, be all the points such that nP=Q and let λi be the slope of the line through Pi and Q; then yQ=λi(xQ-xi)+yi. Therefore, (6)n2yQ=i=1n2λi·i=1n2xin2-i=1n2λixi+i=1n2yi.

Thus we have (7)yQ=i=1n2λin2·i=1n2xin2-i=1n2λixin2+i=1n2yin2=λi¯·xi¯-λixi¯+yi¯, where λi¯, xi¯, λixi¯, and yi¯ are the average values of the variables λi, xi, λixi, and yi, respectively. Therefore, (8)Q=(xQ,yQ)=(xi¯,λi¯·xi¯-λixi¯+yi¯)=(xi¯,1nyi¯).

Remark 2.

The discrete logarithm problem in elliptic curve E is to find n by given P,QE with Q=nP. The above theorem gives some information on the integer n.

2. Proof of Theorem <xref ref-type="statement" rid="thm1">1</xref>

To prove Theorem 1, define division polynomials  ψnZ[x,y,a,b] on an elliptic curve E:y2=x3+ax+b inductively as follows: (9)ψ0=0,ψ1=1,ψ2=2y,ψ3=3x4+6ax2+12bx-a2,ψ4=4y(x6+5ax4+20bx3-5a2x2-4abx-8b2-a3),ψ2n+1=ψn+2ψn3-ψn-1ψn+13,forn2,2yψ2n=ψn(ψn+2ψn-12-ψn-2ψn+12),forn3.

It can be checked easily by induction that the ψ2n’s are polynomials. Moreover, ψnZ[x,y2,a,b] when n is odd, and (2y)-1ψnZ[x,y2,a,b] when n is even. Define the polynomial (10)ϕn=xψn2-ψn-1ψn+1

for n1. Then ϕnZ[x,y2,a,b]. Since y2=x3+ax+b, replacing y2 by x3+ax+b, one has ϕnZ[x,a,b]. So we can denote it by ϕn(x). Note that ψnψmZ[x,a,b] if n and m have the same parity. Furthermore, the division polynomials ψn have the following properties.

Lemma 3.

Consider (11)ψn=nx(n2-1)/2+n(n2-1)(n2+6)60ax(n2-5)/2+lowerdegreeterms,

when n is odd and (12)ψn=ny(x(n2-4)/2+(n2-1)(n2+6)-3060ax(n2-8)/2111+lowerdegreeterms(n2-1)(n2+6)-3060),

when n is even.

Proof.

We prove the result by induction on n. It is true for n<5. Assume that it holds for all ψm with m<n. We give the proof only for the case for odd n5. The case for even n can be proved similarly. Now let n=2k+1 be odd, where k2. If k is even, then by induction (13)ψk=ky(x(k2-4)/2+(k2-1)(k2+6)-306011111111111×ax(k2-8)/2+(k2-1)(k2+6)-3060),ψk+2=(k+2)yψk+2=×(x(k2+4k)/2+(k2+4k+3)(k2+4k+10)-306011111111111×ax(k2+4k-4)/2+(k2+4k+3)(k2+4k+10)-3060),ψk-1=(k-1)x(k2-2k)/2ψk-1=+(k-1)(k2-2k)(k2-2k+7)60ψk-1=×ax(k2-2k-4)/2+,ψk+1=(k+1)x(k2+2k)/2ψk+1=+(k+1)(k2+2k)(k2+2k+7)60ψk+1=×ax(k2+2k-4)/2+.

Substituting y4 by (x3+ax+b)2, we have (14)ψk+2ψk3=k3(k+2)×(x2k2+2k+4(k+1)(k3+k2+10k+3)601111111×ax2k2+2k-2+4(k+1)(k3+k2+10k+3)60),ψk-1ψk+13=(k-1)(k+1)3x2k2+2k+4k(k-1)(k3+2k2+11k+7)(k+1)360×ax2k2+2k-2+.

Therefore, (15)ψ2k+1=ψk+2ψk3-ψk-1ψk+13=(2k+1)x2k2+2k+(2k+1)(4k2+4k)(4k2+4k+7)60×ax2k2+2k-2+=(2k+1)x((2k+1)2-1)/2+(2k+1)((2k+1)2-1)((2k+1)2+6)60×ax((2k+1)2-5)/2+.

The case when k is odd can be proved similarly.

The following corollary follows immediately from Lemma 3.

Corollary 4.

Consider (16)ψn2=n2xn2-1-n2(n2-1)(n2+6)30axn2-3+,ϕn=xn2-n2(n2-1)6axn2-2+.

Proof of Theorem <xref ref-type="statement" rid="thm1">1</xref>.

Define ωn as (17)4yωn=ψn+2ψn-12-ψn-2ψn+12.

Then for any P=(xP,yP)E, we have () (18)nP=(ϕn(xP)ψn2(xP),ωn(xP,yP)ψn(xP,yP)3).

If nP=Q, then ϕn(xP)-xQψn2(xP)=0. Therefore, for any PΛ, the x-coordinate of P satisfies the equation ϕn(x)-xQψn2(x)=0. From Corollary 4, we have that (19)ϕn(x)-xQψn2(x)=xn2-n2xQxn2-1+lowerdegreeterms.

Since Λ=n2, every root of ϕn(x)-xQψn2(x) is the x-coordinate of some PΛ. Therefore, (20)PΛxP=n2xQ

by Vitae’s theorem.

Now we prove the mean value formula for y-coordinates. Let K be the complex number field C first and let ω1 and ω2 be complex numbers which are linearly independent over R. Define the lattice (21)L=Zω1+Zω2={n1ω1+n2ω2n1,n2Z}

and the Weierstrass -function by (22)(z)=(z,L)=1z2+ωL,ω0(1(z-ω)2-1ω2).

For integers k3, define the Eisenstein series Gk by (23)Gk=Gk(L)=ωL,ω0ω-k.

Set g2=60G4 and g3=140G6; then (24)(z)2=4(z)3-g2(z)-g3.

Let E be the elliptic curve given by y2=4x3-g2x-g3. Then the map (25)CLE(C)z((z),(z)),0

is an isomorphism of groups C/L and E(C). Conversely, it is well known  that, for any elliptic curve E over C defined by y2=x3+ax+b, there is a lattice L such that g2(L)=-4a,g3(L)=-4b and there is an isomorphism between groups C/L and E(C) given by z((z),(1/2)(z)) and 0. Therefore, for any point (x,y)E(C), we have (x,y)=((z),(1/2)(z)) and n(x,y)=((nz),(1/2)(nz)) for some zC.

Let Q=((zQ),(1/2)(zQ)) for a zQC. Then for any PiΛ, 1in2, there exist integers j,k with 0j,kn-1, such that (26)Pi=((zQn+jnω1+knω2),12(zQn+jnω1+knω2)).

Thus, (27)j,k=0n-1(zQn+jnω1+knω2)=n2(zQ)

which comes from i=1n2xi=n2xQ. Differentiate with respect to zQ, we have (28)j,k=0n-1(zQn+jnω1+knω2)=n3(zQ).

That is, (29)i=1n2yi=n3yQ.

Secondly, let K be a field of characteristic 0 and let E be the elliptic curve over K given by the equation y2=x3+ax+b. Then all of the equations describing the group law are defined over Q(a,b). Since C is algebraically closed and has infinite transcendence degree over Q, Q(a,b) can be considered as a subfield of C. Therefore we can regard E as an elliptic curve defined over C. Thus the result follows.

At last assume that K is a field of characteristic p. Then the elliptic curve can be viewed as one defined over some finite field Fq, where q=pm for some integer m. Without loss of generality, let K=Fq for convenience. Let K=Qq be an unramified extension of the p-adic numbers Qp of degree m, and let E¯ be an elliptic curve over K which is a lift of E. Since (n,p)=1, the natural reduction map E¯[n]E[n] is an isomorphism. Now for any point QE with QO, we have a point Q¯E¯ such that the reduction point is Q. For any point PiE(K¯) with nPi=Q, its lifted point P¯i satisfies nP¯i=Q¯ and P¯iP¯j whenever PiPj. Thus, (30)i=1n2y(P¯i)=n3y(Q¯),

since K is a field of characteristic 0. Therefore the formula i=1n2yi=n3yQ holds by the reduction from E¯ to E.

Remark 5.

The result for x-coordinate of Theorem 1 holds also for the elliptic curve defined by the general Weierstrass equation y2+a1xy+a3y=x3+a2x2+a4x+a6.

The mean value formula for x-coordinates was given in the first version of this paper  with a slightly complicated proof. The formula for y-coordinates was conjectured by Feng and Wu based on  and numerical examples in a personal email communication with Moody (June 1, 2010).

Recently, some mean value formulae for twisted Edwards curves [3, 4] and other alternate models of elliptic curves were given by [5, 6].

3. An Application

Let E be an elliptic curve over K given by the Weierstrass equation y2=x3+ax+b. Then we have a nonzero invariant differential ω=dx/y. Let ϕEnd(E) be a nonzero endomorphism. Then ϕ*ω=ωϕ=cϕω for some cϕK¯(E), since the space ΩE of differential forms on E is a 1-dimensional K¯(E)-vector space. Since cϕ0 and div(ω)=0, we have (31)div(cϕ)=div(ϕ*ω)-div(ω)=ϕ*div(ω)-div(ω)=0.

Hence cϕ has neither zeros nor poles and cϕK¯. Let φ and ψ be two nonzero endomorphisms; then (32)cφ+ψω=(φ+ψ)*ω=φ*ω+ψ*ω=cφω+cψω=(cφ+cψ)ω.

Therefore, cφ+ψ=cφ+cψ. For any nonzero endomorphism ϕ, set ϕ(x,y)=(Rϕ(x),ySϕ(x)), where Rϕ and Sϕ are rational functions. Then (33)cϕ=Rϕ(x)Sϕ(x), where Rϕ(x) is the differential of Rϕ(x). In particular, for any positive integer n, the map [n] on E is an endomorphism. Set [n](x,y)=(Rn(x),ySn(x)). From c=1 and [n]=+[(n-1)], we have (34)c[n]=Rn(x)Sn(x)=n.

For any Q=(xQ,yQ)E and any (35)P=(xP,yP)Λ={P=(xP,yP)E(K¯)nP=Q},

we have yP=yQ/Sn(xP). Therefore, Theorem 1 gives (36)PΛ1Sn(xP)=PΛyPyQ=1yQPΛyP=n3.

Thus, (37)PΛ1Rn(xP)=PΛ1n·Sn(xP)=1nPΛ1Sn(xP)=n2,PΛxQRn(xP)=xQPΛ1Rn(xP)=n2xQ=PΛxP.

Conflict of Interests

The authors declare that there is no conflict of interests regarding the publication of this paper.

Acknowledgments

This work was supported by the National Natural Science Foundation of China (no. 11101002, no. 61370187, and no. 11271129) and Beijing Natural Science Foundation (no. 1132009).

Silverman J. H. The Arithmetic of Elliptic Curves 1986 106 New York, NY, USA Springer Graduate Texts in Mathematics 10.1007/978-1-4757-1920-8 MR817210 Feng R. Wu H. A mean value formula for elliptic curves Cryptology ePrint Archive Report 2009 2009/586 http://eprint.iacr.org/ Bernstein D. Birkner P. Joye M. Lange T. Peters C. Twisted Edwards curves Progress in Cryptology—AFRICACRYPT 2008 2008 5023 Berlin, Germany Springer 389 405 Lecture Notes in Computer Science 10.1007/978-3-540-68164-9_26 Edwards H. M. A normal form for elliptic curves Bulletin of the American Mathematical Society 2007 44 3 393 422 10.1090/S0273-0979-07-01153-6 MR2318157 2-s2.0-38349097522 Moody D. Mean value formulas for twisted Edwards curves 2010, http://eprint.iacr.org/2010/142.pdf Moody D. Divison Polynomials for Alternate Models of Elliptic Curves, http://eprint.iacr.org/2010/630.pdf