Past exam of the analytic number theory and elliptic curves course of the University of Oxford / 2008 / B / 8 / c / Solution

For prescribing a factor by elliptic-curve tripling, quadratic reciprocity gives $(3/p)=1$ when $p\equiv 1(\mathrm{mod}12)$. Choose $r\in {\mathbb{F}}_p$ with $r^2=3$ and choose an integer $a$ by the Chinese remainder theorem so thatThen $a^2+6a-3\equiv 0(\mathrm{mod}p)$ and it is four modulo $q$.

The curve $E:y^2=x^3+ax-a$ has discriminant $-16a^2(4a+27)$. At $p$, $a\ne 0$, since otherwise $r=3/2$ would force $p=3$. Also $4a+27=15+8r$ cannot vanish: squaring $8r=-15$ would give $192=225(\mathrm{mod}p)$, forcing $p=3$ or 11, neither in the required class. At $q$, $a=1$ makes $a(4a+27)=31$, and $q\equiv 5(\mathrm{mod}12)$ excludes $q=31$. Thus both reductions are nonsingular.

The point $P=(1,1)$ is on every curve in this family. Doubling it uses the invertible denominator two and givesModulo $p$ this difference vanishes, and the doubling ordinate is $-1$, so $2P=-P$ and $3P$ is the identity. Modulo $q$, taking $a=1$ gives $x(2P)=2$, so $2P$ and $P$ have distinct abscissas and their sum is a finite point.

Consequently the attempted addition computing $3P$ modulo $N$ asks to invert a denominator divisible by $p$ and not by $q$. Its numerator is nonzero modulo $p$, since the two ordinates there are minus one and one, so this is not a removable coincidence. The Euclidean gcd used for inversion returnsa proper factor. Thus the specified elliptic-curve computation successfully factors $N$.