Finding elliptic curves with a subgroup of prescribed size

Abstract

Assuming the Generalized Riemann Hypothesis, we design a deterministic algorithm that, given a prime p and positive integer m = o(p1/2(logp)-4), outputs an elliptic curve E over the finite field p for which the cardinality of E(p) is divisible by m. The running time of the algorithm is mp1/2+o(1), and this leads to more efficient constructions of rational functions over p whose image is small relative to p. We also give an unconditional version of the algorithm that works for almost all primes p, and give a probabilistic algorithm with subexponential time complexity.