Strongly Non-zero Points and Elliptic Pseudoprimes

TL;DR

This paper explores strongly non-zero points on elliptic curves and their role in elliptic pseudoprimes, providing probabilistic insights into their existence for random points and curves.

Contribution

It introduces the concept of strongly non-zero points and applies it to analyze various types of elliptic pseudoprimes, offering new probabilistic results.

Findings

Probabilistic existence results for strong elliptic pseudoprimes

Introduction of strongly non-zero points as a tool in elliptic pseudoprime analysis

Insights into the distribution of elliptic pseudoprimes for random points and curves

Abstract

We examine the notion of strongly non-zero points and use it as a tool in the study of several types of elliptic pseudoprimes. Moreover, we give give some probabilistic results about the existence of strong elliptic pseudoprimes for a randomly chosen point on a randomly chosen elliptic curve.

Equations

$$E/k:y^2+a_{1}xy+a_{3}y=x^3+a_2{x}^2+a_{4}x+a_6$$

$$E/k:y^{2}z+a_{1}xyz+a_{3}y{z}^2=x^3+a_2{x}^{2}z+a_{4}x{z}^2+a_6{z}^3,$$

$$E/k:y^2=x^3+Ax+B$$

$$L(E,s)=\prod _p\frac{1}{1-a_p{p}^{-s}+1_E(p)p^{1-2s}}$$

$$1_E(p)=\{\begin{array}{ll}1& \text{if }E\text{ has good reduction at }p\\ 0& \text{otherwise}\end{array}$$

$$a_1$$

$$a_{p^e}$$

$$E/k:y^2+a_{1}xy+a_{3}y=x^3+a_2{x}^2+a_{4}x+a_6$$

$$E\left(\mathbb{Z}/N\mathbb{Z}\right)\simeq E\left(\mathbb{Z}/p_1^{e_1}\mathbb{Z}\right)\oplus \cdots \oplus E\left(\mathbb{Z}/p_k^{e_k}\mathbb{Z}\right).$$

$$\#E(\mathbb{Z}/p_i^{e_i}\mathbb{Z})=p_i^{e_i-1}\#E_i({\mathbb{F}}_{p_i})$$

$$(N+1)P\equiv \mathcal{O}(\mathrm{mod}N)$$

$$\left(N+1\right)P\equiv \mathcal{O}\mathrm{mod}N.$$

$$\left(N+1-a_N\right)P\equiv \mathcal{O}\mathrm{mod}N.$$

$$E\left(\mathbb{Z}/N\mathbb{Z}\right)\cong \underset{p\mid N}{⨁}E\left(\mathbb{Z}/p^{{\nu }_p\left(N\right)}\mathbb{Z}\right).$$

$$\gcd \left(p^{{\nu }_p\left(N\right)},z+k{p}^{{\nu }_p\left(N\right)}\right)=\gcd \left(p^{{\nu }_p\left(N\right)},z\right).$$

$$\gcd \left(p^{{\nu }_p\left(N\right)},z\right)\mid \gcd \left(N,z\right)=1$$

$${\sigma }_{m,n}\left(Q\right)=\left(x\mathrm{mod}{p}^n:y\mathrm{mod}{p}^n:z\mathrm{mod}{p}^n\right)$$

$$kP=kyQ+k{P}^{\prime }=kyQ+\mathcal{O}=kyQ=Q$$

$$k{P}^{\prime }=kP-kyQ=Q-Q=\mathcal{O}$$

$$E\left(\mathbb{Z}/p^n\mathbb{Z}\right)\cong \underset{i}{⨁}\mathbb{Z}/p^{a_i}\mathbb{Z}\oplus G$$

$$E\left(\mathbb{Z}/p^{n-1}\mathbb{Z}\right)\cong \underset{i}{⨁}\mathbb{Z}/p^{a_i-b_i}\mathbb{Z}\oplus G$$

$$E\left(\mathbb{Z}/p^n\mathbb{Z}\right)$$

$$E\left(\mathbb{Z}/p^{n-1}\mathbb{Z}\right)$$

$$\psi :\left(y,z\right)\mapsto \left(y,z\mathrm{mod}{p}^{a_j-1}\right)$$

$$\psi \left(P\right)=\psi \left(h,g^{\prime }\right)=\left(h,g\right)=P^{\prime }$$

$$p\cdot \left(p^{n-1}-p^{n-2}\right)=p^{n-1}\left(p-1\right)$$

$$E\left(\mathbb{Z}/n\mathbb{Z}\right)\cong \underset{p|n}{⨁}E\left(\mathbb{Z}/p^{{\nu }_p\left(n\right)}\mathbb{Z}\right)$$

$$P_{p_i}=\{\begin{array}{l}{Q}_{p_i}\text{ if }{Q}_{p_i}\text{ is a strongly non-zero point }\\ T_{p_i}\text{ where }{T}_{p_i}\text{ is a strongly non-zero point and }\mathrm{order}\left(Q_{p_i}\right)|\mathrm{order}\left(T_{p_i}\right)\end{array}$$

$$|Q|\Big{|}|P^{\prime}|\Big{|}N+1$$

$$J(x,p^a):=\frac{\#\{P\in E(\mathbb{Z}/p^a\mathbb{Z}):{\nu }_2(\mathrm{order}(P))=x\}}{\#E(\mathbb{Z}/p^a\mathbb{Z})},$$

$$H(x,N):=\frac{\#\{P\in E(\mathbb{Z}/N\mathbb{Z}):{\nu }_2(\mathrm{order}(P_i))=x\text{ for all }1\le i\le k\}}{\#E(\mathbb{Z}/N\mathbb{Z})}=\prod _{i=1}^{k}J(x,p_i^{a_i})$$

Full text

Supported by the National Science Foundation under the Grant number DMS-1659872.

S Corresponding Author: liljanababinkostova@boisestate.edu

1. Introduction

The notion of testing a number for primality has long been an interesting problem in mathematics. Possibly the most well-known primality test is based on Fermat's Little Theorem: if $p$ is a prime number and $b$ is an integer not divisible by $p$, then $b^{p-1}\equiv 1\pmod{p}$. However, the converse does not hold: there are composite numbers $N$ and positive integers $1<b<N$ for which $b^{N-1}\equiv 1\pmod{N}$. We refer the reader to the survey article by C. Pomerance [25] for a nice introduction to primality testing. Clasically, a natural number $N$ is a pseudoprime to the base $b$ if $N$ is composite and $b^{N-1}\equiv 1\bmod{N}$. If $N$ is a pseudoprime for all $b$ with $\gcd(b,N)=1$ then $N$ is called Carmichael number. In [17], Korselt characterized these numbers as follows: $N$ is a Carmichael number if and only if $N$ is square-free and $p-1\mid N-1$ for every prime $p\mid N$. In 1986, the long-standing conjecture that there are infinitely many Carmichael numbers was proven by Alford, Granville, and Pomerance [2].

Since the 1980's, elliptic curves have been used in algorithmic number theory to give deterministic algorithms that are faster than earlier algorithms that did not use elliptic curves. We refer the reader to [18] for historical remarks on elliptic curve primality testing. The general framework of elliptic curve primality testing is based on the following fundamental theorem of Goldwasser and Kilian [11].

Theorem 1.1**.**

[11]** Let $E/\mathbb{Q}$ be an elliptic curve, and let $M$ and $N$ be positive integers with $M>(N^{1/4+1})2$ and $N$ is coprime to $\Delta(E)$. Suppose there is a point $P\in E/\mathbb{Q}$ such that $MP$ is zero$\mod N$ and $(M/p)P$ is strongly non-zero$\mod N$ for every prime $p\mid M$. Then $N$ is prime.

Although the original algorithm of Goldwasser-Kilian is no longer used, their result is used as a framework for the ``AKS" primality test, developed by Agrawal, Kayal, and Saxena in [3], which is the only known algorithm that determines the primality or compositeness of any integer in deterministic polynomial time.

In 1992, Gordon introduced the notion of an elliptic pseudoprime [13] as a natural extension of the definition of a pseudoprime from groups arising from elliptic curves with complex multiplication.

Definition 1.2**.**

[13] Let $E/\mathbb{Q}$ be an elliptic curve with complex multiplication by an order in $\mathbb{Q}(\sqrt{-d})$ and let $P\in E(\mathbb{Q})$ have infinite order. A composite number $N$ is called an elliptic pseudoprime if $\left(\frac{-d}{N}\right)=-1$, $N$ is coprime to $\Delta(E)$, and $N$ satisfies $(N+1)P\equiv\mathcal{O}\pmod{N}$.

We will use the notation ``G-pseudoprime" to denote Gordon's notion of an elliptic pseudoprime. In [30], Silverman extends Gordon's notion of elliptic pseudoprimes by allowing any elliptic curve $E/\mathbb{Q}$, not just elliptic curves with complex multiplication, as well as any $P\in E\left(\mathbb{Z}/N\mathbb{Z}\right)$.

Definition 1.3**.**

[30] Let $N\in\mathbb{Z}$, let $E/\mathbb{Q}$ be an elliptic curve, and let $P\in E\left(\mathbb{Z}/N\mathbb{Z}\right)$. Write the $L$-series of $E/\mathbb{Q}$ as $L(E/\mathbb{Q},s)=\sum_{n}\frac{a_{n}}{n^{s}}$. Then $N$ is an elliptic pseudoprime for $(E,P)$ if $N$ has at least two distinct prime factors, $E$ has good reduction at every prime $p$ dividing $N$, and $(N+1-a_{N})P\equiv\mathcal{O}\pmod{N}$.

We will use the notation ``S-pseudoprime" to denote Silverman's notion of an elliptic pseudoprime.

In this paper we study elliptic G- and S- pseudoprimes for strongly non-zero points on the elliptic curve $E\left(\mathbb{Z}/N\mathbb{Z}\right)$ (Section 3). Moreover, we give bounds on the number of points on a given elliptic curve for which an odd integer $N$ is a strong elliptic G-pseudoprime and probabilistic results for a given odd integer $N$ being a strong elliptic G- pseudoprime for a randomly chosen point on a randomly chosen elliptic curve (Section 4). We prove similar results for strong elliptic S-pseudoprimes. Prior to these results we give a brief introduction to elliptic curves and elliptic pseudoprimes (Section 2)

2. Preliminaries

2.1. Elliptic Curves

We introduce some elementary features of elliptic curves which are relevant to the topics presented in this paper. We refer the reader to [31] and [32] for detailed introduction to elliptic curves. Let $k$ be a field and let $\overline{k}$ denote its algebraic closure. An elliptic curve $E$ over a field $k$ is a non-singular 111an algebraic curve is said to be non-singular if there is not point on the curve at which all partial derivatives vanish. curve with an affine equation of the form

[TABLE]

where $a_{1},a_{2},a_{3},a_{4},a_{6}\in k$. An equation of the above form (1) is called a generalized Weierstrass equation.

Recall that the points in projective space $\mathbb{P}^{2}(k)$ correspond to the equivalence classes in $k^{3}-\{(0,0,0)\}$ under the equivalence relation $(x,y,z)\sim(ux,uy,uz)$ with $u\in k^{\times}$. The equivalence class containing $(x,y,z)$ is denoted by $[x:y:z]$. The projective equation corresponding to the affine equation (1) is the homogeneous equation

[TABLE]

where $a_{1},a_{2},a_{3},a_{4},a_{6}\in\overline{k}$.

The point $[0:1:0]$ is called the point at infinity and is denoted by $\mathcal{O}$. The projective points of $E$ over $\overline{k}$ form an abelian group with $\mathcal{O}$ as the identity.

If $\text{char}(k)\neq 2,3$, then the equation of $E$ can be written as

[TABLE]

where $A,B\in k$.

An elliptic curve $E/k:y^{2}z=x^{3}+Axz^{2}+Bz^{3}$ is non-singular if and only if its discriminant, $4A^{3}+27B^{2}$, is nonzero. Associated to $E/\mathbb{Q}$ is the $L$-function $L(E,s)$, which is defined as the Euler product

[TABLE]

where

[TABLE]

and $a_{p}=p+1-\#E\left(\mathbb{Z}/p\mathbb{Z}\right)$ whether or not $E$ has good reduction at $p$. Alternatively expressing $L(E,s)$ as the Dirichlet series $L(E,s)=\sum_{n}\frac{a_{n}}{n^{s}}$, the map sending a positive integer $n$ to the coefficient $a_{n}$ is a multiplicative function with

[TABLE]

See [8, Chapter 8.3] and [31, Appendix C, Section 16] for more on $L$-series of elliptic curves.

An elliptic curve $E/\mathbb{Z}/N\mathbb{Z}$ is the set of solutions $[x:y:z]$ (requiring that $\gcd(x,y,z,N)=1$) in projective space over $\mathbb{Z}/N\mathbb{Z}$ to a Weierstrass equation

[TABLE]

where the discriminant $\Delta$ has no prime factor in common with $N$. There is a group law on $E\left(\mathbb{Z}/N\mathbb{Z}\right)$ given by explicit formulae which can be computed (see [32]). For a given elliptic curve $E/\mathbb{Q}:y^{2}=x^{3}+Ax+B$ where $A,B,N\in\mathbb{Z}$ with $N$ positive odd integer such that $\gcd(N,4A^{3}+27B^{2})=1$ there is a group homomorphism from $E/\mathbb{Q}$ to $E\left(\mathbb{Z}/N\mathbb{Z}\right)$ by representing the points in $E/\mathbb{Q}$ as triples $[x:y:z]\in\mathbb{P}^{2}(k)$.

If the prime factorization of $N$ is $N=p_{1}^{e_{1}}\cdots p_{k}^{e_{k}}$ then $E\left(\mathbb{Z}/N\mathbb{Z}\right)$ is isomorphic as a group to the direct product of elliptic curve groups

[TABLE]

In particular, if we let $E_{i}$ be the reduction of $E$ modulo $p_{i}$, then $E_{i}$ is an elliptic curve over the field $\mathbb{F}_{p_{i}}$. It is known that

[TABLE]

We refer the reader to [18, 32] for details about elliptic curves over $\mathbb{Z}/N\mathbb{Z}$.

2.2. Elliptic Pseudoprimes

n this section we give some background on elliptic pseudoprimes in general. For other articles that study elliptic pseudoprimes and related notions see [13, 12, 9, 10, 21, 30].

Definition 2.1**.**

[13] Let $E/\mathbb{Q}$ be an elliptic curve with complex multiplication in $\mathbb{Q}(\sqrt{-d})$, let $P$ be a point in $E$ of infinite order, and let $N$ be a composite number with $\gcd(N,6\Delta)=1$. Then, $N$ is an elliptic pseudoprime for $(E,P)$ if $\left(\frac{-d}{N}\right)=-1$ and

[TABLE]

In [30], Silverman extends Gordon's aforementioned notion of elliptic pseudoprimes by allowing any elliptic curve $E/\mathbb{Q}$, not just elliptic curves with complex multiplication, as well as any $P\in E\left(\mathbb{Z}/N\mathbb{Z}\right)$.

Definition 2.2**.**

[30] Let $N\in\mathbb{Z}$, let $E/\mathbb{Q}$ be an elliptic curve, and let $P\in E\left(\mathbb{Z}/N\mathbb{Z}\right)$. Write the $L$-series of $E/\mathbb{Q}$ as $L(E/\mathbb{Q},s)=\sum_{n}\frac{a_{n}}{n^{s}}$. Then $N$ is an elliptic pseudoprime for $(E,P)$ if $N$ has at least two distinct prime factors, $E$ has good reduction at every prime $p$ dividing $N$, and $(N+1-a_{N})P\equiv\mathcal{O}\pmod{N}$.

It is not hard to check that for (most) $N$, $\left(\frac{-d}{N}\right)=-1$ and $N$ is square-free if and only if $a_{N}=0$. Thus, $(n+1-a_{N})P=(n+1)P$, so (most) elliptic pseudoprimes in Gordon's sense are also pseudoprimes in Silverman's sense.

Definition 2.3**.**

[13] Let $E/\mathbb{Q}$ be an elliptic curve. A composite number $N$ with $\gcd\left(N,6\Delta\right)=1$ is an elliptic G-pseudoprime for the curve $E/\mathbb{Q}$ with complex multiplication by the field $K=\mathbb{Q}\left(\sqrt{-d}\right)$ and a point $P\in E\left(\mathbb{Q}\right)$ of infinite order if $\left(\frac{-d}{N}\right)=-1$ and

[TABLE]

Definition 2.4**.**

[13]

Let $E/\mathbb{Q}$ be an elliptic curve with complex multiplication. Suppose $N$ is a composite number with $\gcd\left(N,6\Delta\right)=1$. Write $N+1=2^{s}t$ where $t$ is odd. Then $N$ is called a strong elliptic G-pseudoprime for a curve $E$ with complex multiplication by $K=\mathbb{Q}\left(\sqrt{-d}\right)$ and a point $P\in E\left(\mathbb{Q}\right)$ with infinite order if $\left(\frac{-d}{N}\right)=-1$ and either

1. (i)

$tP\equiv\mathcal{O}\bmod{N}$, or 2. (ii)

$\left(2^{r}t\right)P\equiv\left(x:0:1\right)\bmod{N}$ for some $0\leq r\leq s-1$ and some $x\in\mathbb{Z}/N\mathbb{Z}$.

Definition 2.5**.**

[13] Let $E/\mathbb{Q}$ be an elliptic curve. A composite number $N$ is an elliptic (strong) G-Carmichael number for $E$ if it is a (strong) G-pseudoprime for $E$ at all points $P\in E\left(\mathbb{Z}/N\mathbb{Z}\right)$.

Definition 2.6**.**

[30] Let $E/\mathbb{Q}$ be an elliptic curve and it's associated L-series be $L(E,s)=\sum_{n\geq 1}a_{n}/n^{s}$. A composite number $N$ is an elliptic S-pseudoprime for $E/\mathbb{Q}$ and a point $P\in E\left(\mathbb{Z}/N\mathbb{Z}\right)$ if $N$ has at least two distinct prime factors, $E$ has good reduction at every prime $p\mid N$, and

[TABLE]

In [4], the authors extend the notion of a strong elliptic G-pseudoprime by considering non-CM curves.

Definition 2.7**.**

[4] Let $E/\mathbb{Q}$ be an elliptic curve and its associated L-series be $L(E,s)=\sum_{n\geq 1}a_{n}/n^{s}$. Let $N$ be an integer, and let $P$ be a point in $E(\mathbb{Z}/N\mathbb{Z})$. Write $N+1-a_{N}=2^{s}t$, where $t$ is odd. Then, $N$ is a strong elliptic S-pseudoprime for $(E,P)$ if $N$ has at least two distinct prime factors, $E/\mathbb{Q}$ has good reduction at every prime $p\mid N$, and one of the following holds:

1. (i)

$tP\equiv\mathcal{O}\bmod{N}$, or 2. (ii)

$\left(2^{r}t\right)P\equiv\left(x:0:1\right)\bmod{N}$ for some $0\leq r\leq s-1$ and some $x\in\mathbb{Z}/N\mathbb{Z}$.

From these definitions of S-pseudoprimes for a specific point $P$ on a curve $E$, it is natural to extend the idea of Carmichael numbers for the group $(\mathbb{Z}/N\mathbb{Z})^{\times}$ to Carmichael numbers for the group $E(\mathbb{Z}/N\mathbb{Z})$.

Definition 2.8** ([30], [4]).**

Let $E/\mathbb{Q}$ be an elliptic curve. A composite number $N$ is a (strong) elliptic S-Carmichael number for $E/\mathbb{Q}$ if it is a (strong) elliptic S-pseudoprime for $E/\mathbb{Q}$ at all points $P\in E\left(\mathbb{Z}/N\mathbb{Z}\right)$.

3. Strongly Nonzero Points and Elliptic Pseudoprimes

In this section we use the notion of strongly non-zero points and use it as a tool for examining G- and S- elliptic Carmichael numbers.

Definition 3.1**.**

Let $P=(x:y:z)$ be a projective point on an elliptic curve $E/\mathbb{Q}$, where $x,y,z\in\mathbb{Z}$, and let $N$ be a nonzero integer. If $z=0\mod N$ then the point $P$ is said to be zero$\mod N$; otherwise, $P$ is non-zero$\mod N$. If $gcd(z,N)=1$ then the point $P$ is said to be strongly non-zero$\mod N$.

Note that if $P$ is strongly non-zero$\mod N$, then $P$ is non-zero$\mod p$ for every prime $p|N$. When $N$ is prime, the notions of nonzero and strongly non-zero coincide.

Lemma 3.2**.**

Let $Q$ be a strongly non-zero point on the elliptic curve $E\left(\mathbb{Z}/N\mathbb{Z}\right)$. Consider the group decomposition

[TABLE]

where $\nu_{p}\left(N\right)$ denotes the $p$-adic valuation of $N$. Let $Q_{p}\in E\left(\mathbb{Z}/p^{\nu_{p}\left(N\right)}\mathbb{Z}\right)$ denote the point corresponding to $Q$ for a prime $p\mid N$. Then $Q_{p}$ is a strongly non-zero point$\mod p^{\nu_{p}(N)}$ for all $p\mid N$.

Proof.

Since $Q$ is strongly non-zero point, we may write $Q=\left(x:y:z\right)$ with $z=1$. Then $Q_{p}=\left(x\bmod p^{\nu_{p}\left(N\right)}:y\bmod p^{\nu_{p}\left(N\right)}:z\bmod p^{\nu_{p}\left(N\right)}\right)$. Note that for any integer $k>0$,

[TABLE]

Also, since $p^{\nu_{p}\left(N\right)}\mid N$,

[TABLE]

Thus $\gcd\left(p^{\nu_{p}\left(N\right)},z\bmod p^{\nu_{p}\left(N\right)}\right)=1$, which implies that $Q_{p}$ is strongly non-zero point$\mod p^{\nu_{p}(N)}$. ∎

Corollary 3.3**.**

Let $Q$ be a point in $E(\mathbb{Z}/N\mathbb{Z})$, and let $Q_{p}$ as defined above. Then $Q$ is a zero point$\mod N$ if and only if there exists a prime $p\mid N$ such that $Q_{p}$ is a zero point$\mod N$.

Throughout the rest of the section we consider the case when $E(\mathbb{Z}/{N\mathbb{Z}})$ has strongly non-zero points$\mod N$.

Proposition 3.4**.**

Let $E(\mathbb{Z}/p^{m}\mathbb{Z})$ be an elliptic curve and $Q\in E(\mathbb{Z}/p^{m}\mathbb{Z})$ a point. Let $\sigma_{m,n}:E\left(\mathbb{Z}/p^{m}\mathbb{Z}\right)\rightarrow E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$, $m\geq n$ be the homomorphism given by

[TABLE]

Then $\sigma_{m,n}\left(Q\right)$ is a non-zero point in $E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$ if and only if $Q$ is a non-zero point in $E\left(\mathbb{Z}/p^{m}\mathbb{Z}\right)$.

Proof.

Write $Q=\left(x:y:z\right)$. Then $\sigma_{m,n}\left(Q\right)=\left(x\bmod p^{n}:y\bmod p^{n}:z\bmod p^{n}\right)$. Then for any integer $k$, $p\mid\left(z-kp^{n}\right)$ if and only if $p\mid z$. Since $p$ is prime, for any integer $i>0$, if $\gcd\left(p^{i},z\right)>1$, then $p\mid z$. It follows that $\gcd\left(p^{n},z\bmod p^{n}\right)>1$ if and only if $\gcd\left(p^{m},z\bmod p^{n}\right)>1$. ∎

Corollary 3.5**.**

If $Q$ is a non-zero point on the elliptic curve $E\left(\mathbb{Z}/p^{m}\mathbb{Z}\right)$, then $|Q|=p^{k}$ for some integer $k<m$.

Proof.

Let $\sigma_{m,1}:E\left(\mathbb{Z}/p^{m}\mathbb{Z}\right)\rightarrow E\left(\mathbb{Z}/p\mathbb{Z}\right)$ be the homomorphism as in Lemma 3.4. Note that the only non-zero point in $E\left(\mathbb{Z}/p\mathbb{Z}\right)$ is the identity $\mathcal{O}$. By Lemma 3.4, $\ker\left(\sigma_{m,1}\right)$ is the set of all non-zero points in $E\left(\mathbb{Z}/p^{m}\mathbb{Z}\right)$. Also, from $E_{m-1}/E_{m}\cong\ker(\sigma_{m,m-1})$ and $\ker(\sigma_{f,f-1})\cong\mathbb{Z}/p\mathbb{Z}$ we have that $\left\lvert\ker\left(\sigma_{m,1}\right)\right\rvert=p^{m-1}$. This implies that that $|Q|\mid p^{m-1}$. Thus $|Q|=p^{k}$ for some integer $0\leq k<m$. ∎

Lemma 3.6**.**

Let $Q$ be a non-zero point on the elliptic curve $E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$ and $k$ coprime to $p$. Then there exists a strongly non-zero point $P\in E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$ such that $kP=Q$ if and only if there exists a strongly nonzero point $P^{\prime}\in E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$ with $|P^{\prime}|$ dividing $k$.

Proof.

Let $Q$, $E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$ and $k$ be given. Let $P^{\prime}\in E(\mathbb{Z}/p^{n}\mathbb{Z})$ a strongly non-zero point such that $|P^{\prime}|$ divides $k$. Since $\gcd(k,p^{n})=1$, there exists a positive integer $y$ such that $ky\equiv 1\bmod p^{n}$. Let $P=yQ+P^{\prime}$. Thus by Corollary 3.5, $P$ is a strongly non-zero point. Note that

[TABLE]

Conversely, assume that $P$ with $kP=Q$ is a a strongly nonzero point. Let $y$ be a positive integer such that $ky=1\bmod p^{n}$. Let $P^{\prime}=P-yQ$. By Corollary 3.5, $P^{\prime}$ is a strongly non-zero point. Note that

[TABLE]

Therefore $|P^{\prime}||k$. ∎

Lemma 3.7**.**

Let $Q$ be a non-zero point in $E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$ and let $\sigma_{n,n-1}:E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)\rightarrow E\left(\mathbb{Z}/p^{n-1}\mathbb{Z}\right)$ be the natural homomorphism. Let $k$ be an integer and $P^{\prime}\in E\left(\mathbb{Z}/p^{n-1}\mathbb{Z}\right)$ be a strongly non-zero point such that $kP^{\prime}=\sigma_{n,n-1}\left(Q\right)$ and $p\nmid k$. Then there exists a point $P\in E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$ such that $kP=Q$.

Proof.

Note that $|\ker\left(\sigma_{n,n-1}\right)|=p$. It follows that $\ker\left(\sigma_{n,n-1}\right)\cong\mathbb{Z}/{p\mathbb{Z}}$. We can write

[TABLE]

where $G$ does not contain any elements of order $p$. Since $\ker\left(\sigma_{n,n-1}\right)\cong\mathbb{Z}/{p\mathbb{Z}}$ is a normal subgroup of $E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$, it follows that

[TABLE]

where $b_{j}=1$ for exactly one index $j$ and $b_{i}=0$ for all other indices $i\neq j$. Let $j$ be the index such that $b_{j}=1$. Then we can write

[TABLE]

where $H\cong\bigoplus_{i\neq j}\mathbb{Z}/{p^{a_{i}}\mathbb{Z}}\oplus G$ . Let $\psi:H\oplus\mathbb{Z}/{p^{a_{j}}\mathbb{Z}}\rightarrow H\oplus\mathbb{Z}/{p^{a_{j}-1}\mathbb{Z}}$ be given by

[TABLE]

where $y\in H$, $z\in\mathbb{Z}/p^{a_{j}}\mathbb{Z}$. Let $Q\in E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$ be a non-zero point, and let $Q\in H\oplus\mathbb{Z}/{p^{a_{j}}\mathbb{Z}}$. Then $\psi\left(Q\right)$ is a non-zero point. Assume that there exists a strongly non-zero point $P^{\prime}\in E\left(\mathbb{Z}/p^{n-1}\mathbb{Z}\right)$ such that $kP^{\prime}=\sigma_{n,n-1}\left(Q\right)$. Write $Q\cong\left(r,s\right)$ with $r\in H$ and $s\in\mathbb{Z}/{p^{a_{j}}\mathbb{Z}}$. Similarly write $P^{\prime}\cong\left(h,g\right)$ with $h\in H$ and $g\in\mathbb{Z}/{p^{a_{j}-1}\mathbb{Z}}$. By assumption, $kh=r$ and $kg\equiv s\bmod{p^{a_{j}-1}}$. Consider the polynomial $f\left(x\right)=kx-s$. Since $k\neq 0\bmod p$, $f\left(x\right)$ does not have any double roots$\mod p^{a_{j}-1}$. Then by Hensel's lemma there exists a number $g^{\prime}\in\mathbb{Z}/p^{a_{j}}\mathbb{Z}$ with $g^{\prime}\equiv g\mod{p^{a_{j}-1}}$ such that $f\left(g^{\prime}\right)=0\bmod p^{a_{j}}$. It follows that $kg^{\prime}-s=0\bmod p^{a_{j}}$. Thus $k\left(h,g^{\prime}\right)=\left(r,s\right)$. Choose $P$ such that $P\cong\left(h,g^{\prime}\right)$ with $h\in H$ and $g^{\prime}\in\mathbb{Z}/{p^{a_{j}-1}\mathbb{Z}}$ yields $kP=Q$.

Note that

[TABLE]

Thus by Lemma 3.4 $P$ is a strongly non-zero point. ∎

Theorem 3.8**.**

Let $p$ be an odd prime and $Q$ be a non-zero point in $E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$. There exists an integer $k$ and a strongly non-zero point $P\in E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$ such that $kP=Q$ if and only if one of the following holds:

• (a)

$E\left(\mathbb{Z}/p\mathbb{Z}\right)$* is not anomalous.*

• (b)

$E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)\cong\mathbb{Z}/{p^{n}\mathbb{Z}}$.

• (c)

$E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)\cong\mathbb{Z}/p\mathbb{Z}\oplus\mathbb{Z}/{p^{n-1}\mathbb{Z}}$* and $Q\cong(Q_{1},Q_{2})$ with $Q_{1}\in\mathbb{Z}/p\mathbb{Z}$, $Q_{2}\in\mathbb{Z}/{p^{n-1}\mathbb{Z}}$, where $Q_{2}$ is not a generator of $\mathbb{Z}/{p^{n-1}\mathbb{Z}}$*

Proof.

The cases when $E$ is not anomalous will be proven by induction on $n$. Note that this is trivially satisfied for $n=1$ because there are no non-zero points and since the order of the curve is coprime to $p$, $k$ is coprime to $p$. Suppose that the statements holds up to $n-1$. Let $Q$ be a non-zero point in $E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$, and $\sigma_{n,n-1}$ be as defined above. Then $\sigma_{n,n-1}\left(Q\right)\in E\left(\mathbb{Z}/p^{n-1}\mathbb{Z}\right)$ is a non-zero point, so by the inductive hypothesis we have $k,P^{\prime}$ such that $kP^{\prime}=\sigma_{n,n-1}\left(Q\right)$ with $k$ coprime to $p$ and $P^{\prime}$ a strongly non-zero point. Then the claim follows by Lemma 3.7. In the case $E\left(\mathbb{Z}/p\mathbb{Z}\right)$ is anomalous at $p$ we have two cases:

1. Case (1):

$E(\mathbb{Z}/{p^{n}\mathbb{Z}})\cong\mathbb{Z}/{p^{n}\mathbb{Z}}$. Consider the natural homomorphism $\sigma_{n,1}:E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)\rightarrow E\left(\mathbb{Z}/p\mathbb{Z}\right)$. Since $\sigma_{n,1}$ is surjective, for any generator $P$ of $E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$, $\sigma_{n,1}\left(P\right)\neq\mathcal{O}$. Thus there are no non-zero points that are generators of $E\left(\mathbb{Z}/{p^{n}\mathbb{Z}}\right)$. Therefore there is a strongly non-zero point $P$ which is a generator of $E\left(\mathbb{Z}/{p^{n}\mathbb{Z}}\right)$. Thus for all points $Q$, there exists a strongly non-zero point $P$ with $kP=Q$ for some integer $k$. 2. Case (2):

$E(\mathbb{Z}/{p^{n}\mathbb{Z}})\cong\mathbb{Z}/{p\mathbb{Z}}\oplus\mathbb{Z}/{p^{n-1}\mathbb{Z}}$. It is well known (CITE SOMETHING) that $E_{1}/E_{n}\cong\mathbb{Z}/p^{n-1}\mathbb{Z}$ and it follows that for any point $P\cong(P_{1},P_{2})$ in $E(\mathbb{Z}/{p^{n}\mathbb{Z}})$ where $P_{1}\in\mathbb{Z}/{p\mathbb{Z}}$ and $P_{2}\in\mathbb{Z}/{p^{n-1}\mathbb{Z}}$, $P$ is a non-zero point if and only if $P_{1}$ is the identity. We want to show a non-zero point $Q\cong(0,Q_{2})$ can be written as $kP$ for some integer $k$ and some strongly non-zero point $P$ if and only if $Q_{2}$ is not a generator of $\mathbb{Z}/{p^{n-1}\mathbb{Z}}$.

($\Rightarrow$) Assume that $Q\cong(0,Q_{2})$ where $Q_{2}\in\mathbb{Z}/{p^{n-1}\mathbb{Z}}$ can be written as $kP$ for some integer $k$ and some strongly non-zero point $P\cong(P_{1},P_{2})$ with $P_{1}\in\mathbb{Z}/{p\mathbb{Z}}$ and $P_{2}\in\mathbb{Z}/{p^{n-1}\mathbb{Z}}$. Since $P$ is strongly non-zero, $P_{1}\neq 0$. However, since $kP_{1}=0$ and $P_{1}\in\mathbb{Z}/p\mathbb{Z}$, $\operatorname{order}(P_{1})=p$, so $p\mid k$, which implies that $p\mid kP_{2}=Q_{2}$. Therefore $Q_{2}$ is not a generator of $\mathbb{Z}/{p^{n-1}\mathbb{Z}}$.

Conversely, assume $Q\cong(0,Q_{2})$ where $Q_{2}\in\mathbb{Z}/{p^{n-1}\mathbb{Z}}$ and $Q_{2}$ is not a generator. Then $Q_{2}=p\cdot r$ for some $r\in\mathbb{Z}/{p^{n-1}\mathbb{Z}}$, and thus $Q=kP$ for $k=p$ and $P\cong(1,r)$.

∎

Note that the last case in Theorem 3.8 only applies for non-zero points that are not generators of the subgroup $\mathbb{Z}/p^{n-1}\mathbb{Z}$ of $E(\mathbb{Z}/p^{n}\mathbb{Z})$. The following holds for all non-zero points in $E(\mathbb{Z}/p^{n}\mathbb{Z})$.

Lemma 3.9**.**

Let $E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$ be an elliptic curve and $Q\in E\left(\mathbb{Z}/p^{n}\mathbb{Z}\right)$ be a non-zero point. Then there exists a strongly non-zero point $P\in E(\mathbb{Z}/p^{n}\mathbb{Z})$ such that $|Q|$ divides $|P|$.

Proof.

We will consider the following cases

1. Case (1):

$Q$ and $E$ satisfy one of the conditions from Theorem 3.8. In this case |Q|\Big{|}|P| since $kP=Q$. 2. Case (2):

$E\left(\mathbb{Z}/{p^{n}\mathbb{Z}}\right)\cong\mathbb{Z}/p\mathbb{Z}\oplus\mathbb{Z}/{p^{n-1}\mathbb{Z}}$ and $Q=(0,Q_{2})$ with $Q_{2}\in\mathbb{Z}/{p^{n-1}\mathbb{Z}}$, where $Q_{2}$ is a generator of $\mathbb{Z}/p^{n-1}\mathbb{Z}$. In the case when $n=1$, this case is trivially true because $Q=\mathcal{O}\in E(\mathbb{Z}/p^{n}\mathbb{Z})$, so $|Q|=1$. When $n>1$, note that the order of any point in $E(\mathbb{Z}/p^{n}\mathbb{Z})$ divides $p^{n-1}$. There are

[TABLE]

elements with order exactly $p^{n-1}$. Thus there are more than $p^{n-1}$ elements with order $p^{n-1}$. Since there are only $p^{n-1}$ non-zero points, there is a strongly non-zero point $P$ with $|P|=p^{n-1}$ and thus for any point $Q$, $|Q|$ divides $|P|$.

∎

Lemma 3.10**.**

If $Q$ is a non-zero point in $E\left(\mathbb{Z}/n\mathbb{Z}\right)$, then there exists a strongly non-zero point $P$ such that $|Q|$ divides $|P|$.

Proof.

Let $Q\in E\left(\mathbb{Z}/n\mathbb{Z}\right)$ be a non-zero point. Recall that

[TABLE]

Thus each point $T\in E(\mathbb{Z}/n\mathbb{Z})$ can be written as $T\cong\left(T_{p_{1}},T_{p_{2}},...T_{p_{r}}\right)$ where $T_{p_{i}}$ denotes the point corresponding to $T$ in the subgroup $E\left(\mathbb{Z}/p_{i}^{\nu_{p_{i}}(n)}\mathbb{Z}\right)$, and $p_{1},p_{2},\ldots,p_{r}$ are the distinct prime divisors of $n$. Due to the direct sum, we have that $|Q|=\operatorname{lcm}\{|Q_{p_{i}}|:1\leq i\leq r\}$. For each $1\leq i\leq r$, let

[TABLE]

By Corollary 3.3, $P$ is a strongly non-zero point. Note that |Q|\Big{|}|P| since |{Q_{p_{i}}}|\Big{|}|P_{p_{i}}| for all $1\leq i\leq r$ by construction. ∎

Corollary 3.11**.**

Let $E/\mathbb{Q}$ be an elliptic curve. A composite number $N$ is an elliptic G-Carmichael number for the curve $E$ if and only if $N$ is a elliptic G-pseudoprime for all strongly non-zero points $P\in E(\mathbb{Z}/N\mathbb{Z})$. Similarly, $N$ is an elliptic S-Carmichael number for the curve $E(\mathbb{Z}/N\mathbb{Z})$ if and only if $N$ is a S-pseudoprime for all strongly non-zero points $P\in E(\mathbb{Z}/N\mathbb{Z})$.

Proof.

We will prove the statement for elliptic G-Carmichael numbers. The proof for elliptic S-Carmichael numbers is similar. Suppose $N$ is an elliptic G-Carmichael number for a curve $E$ i.e. $N$ is an elliptic G-pseudoprime for all strongly non-zero points $P\in E(\mathbb{Z}/N\mathbb{Z})$.

Conversely, assume that $N$ is an elliptic G-pseudoprime for all strongly non-zero points $P\in E(\mathbb{Z}/N\mathbb{Z})$. Then for all strongly non-zero points $P\in E(\mathbb{Z}/N\mathbb{Z})$, the order |P|\Big{|}N+1. By Lemma 3.10, for any non-zero point $Q$, there exists a strongly non-zero point $P^{\prime}$ such that

[TABLE]

Thus $N$ is an elliptic G-pseudoprime for all points $P\in E(\mathbb{Z}/N\mathbb{Z})$ i.e $N$ is an elliptic G-Carmichael number. ∎

Corollary 3.12**.**

Let $E/\mathbb{Q}$ be an elliptic curve, $N$ be a composite integer, and $t$ be any integer. Then $\epsilon_{N,p}\left(E\right)\mid t$ if and only if for all strongly non-zero points $P\in E\left(\mathbb{Z}/N\mathbb{Z}\right)$, |P|\Big{|}t.

Proof.

From [4], we have \epsilon_{N,p}\left(E\right)\Big{|}t if and only if for all points $P\in E\left(\mathbb{Z}/{N\mathbb{Z}}\right)$, $tP=\mathcal{O}$. By Corollary 3.11,

this is true if and only if for all strongly non-zero points $P\in E\left(\mathbb{Z}/{N\mathbb{Z}}\right)$, $tP=\mathcal{O}$. ∎

Theorem 3.13**.**

Let $E/\mathbb{Q}$ be an elliptic curve. There is no composite number $N$ such that $N$ is a strong eliiptic G-pseudoprime for all strongly non-zero points $P\in E(\mathbb{Z}/N\mathbb{Z})$.

Proof.

We prove the claim of the theorem by considering several cases.

1. Case (1):

$N$ contains a square, i.e. $p^{e}||N$ for a prime $p$ and an integer $e>1$. We know that $|E\left(\mathbb{Z}/p^{e}\mathbb{Z}\right)|=p^{e-1}|E(\mathbb{Z}/p\mathbb{Z})|$. Note that $E(\mathbb{Z}/p^{e}\mathbb{Z})$ contains a point of order $p$. By Lemma 3.9, there exists a strongly non-zero point $P\in E(\mathbb{Z}/p^{e}\mathbb{Z})$ such that $|X|\mid|P|$, so p\Big{|}|P|. In particular, $|P|\nmid N+1$, so $\left(N+1\right)P\neq\mathcal{O}$. Therefore $N$ is not a strong elliptic G-pseudoprime for the point $P\in E(\mathbb{Z}/p^{e}\mathbb{Z})$. In the following two cases let $p$ be a prime with $p\mid N$ and $|E\left(\mathbb{Z}/p\mathbb{Z}\right)|=p+1$. Note that such a prime $p$ must exist from our definition of a G-pseudoprime. Also assume $N$ is squarefree. 2. Case (2):

There exists a prime $q\neq p$ such that $|E\left(\mathbb{Z}/q\mathbb{Z}\right)|$ is not a power of $2$. By the first Sylow theorem, there exists a point $Q\in E\left(\mathbb{Z}/q\mathbb{Z}\right)$ of odd order and there exists a point $P\in E\left(\mathbb{Z}/p\mathbb{Z}\right)$ of even order. Note that the points $P$ and $Q$ are both strongly non-zero points. Write $E\left(\mathbb{Z}/N\mathbb{Z}\right)=E\left(\mathbb{Z}/p\mathbb{Z}\right)\oplus E\left(\mathbb{Z}/q\mathbb{Z}\right)\oplus H$ for some group $H$. Take the point $X=\left(P,Q,h\right)$ for any strongly non-zero element $h\in H$. If $\left(N+1\right)X=\mathcal{O}$, then $n$ is not a strong G-pseudoprime at $X$. Otherwise, (letting $N+1=2^{s}t$, where $t$ is odd) we must have $tQ=\mathcal{O}$ in $E\left(\mathbb{Z}/q\mathbb{Z}\right)$ since $Q$ has odd order. But $tP\neq\mathcal{O}\in E(\mathbb{Z}/p\mathbb{Z})$ because $P$ has even order, so $tX\neq\mathcal{O}\in E(\mathbb{Z}/N\mathbb{Z})$. Because $tQ=\mathcal{O}\bmod{q}$, $tX$ is not strongly nonzero and thus $2^{r}tX$ cannot have the form $\left(x:0:1\right)$ for some $x\in\mathbb{Z}/N\mathbb{Z}$. Therefore $N$ is not a strong G-pseudoprime at $X$. 3. Case (3):

For all primes $q\mid N$ with $q\neq p$, $|E\left(\mathbb{Z}/q\mathbb{Z}\right)|$ is a power of $2$. If $|E\left(\mathbb{Z}/p\mathbb{Z}\right)|$ is not a power of two, by the first Sylow theorem there exists a point $P$ of odd order $>1$ in $|E\left(\mathbb{Z}/p\mathbb{Z}\right)|$. Then we can construct a point $X$ as in Case $2$ with $P$ and a point $Q$ of even order from $|E\left(\mathbb{Z}/q\mathbb{Z}\right)|$ for some $q\mid N$. For the rest of the section assume $|E\left(\mathbb{Z}/p\mathbb{Z}\right)|$ is a power of $2$. Since by Definition 2.4, all prime factors of $N$ must be $\geq 5$, we have that $|E\left(\mathbb{Z}/p\mathbb{Z}\right)|=p+1\geq 8$. Recall that the structure of an elliptic curve over a finite field is the product of two cyclic groups. Therefore one of the cyclic groups must contain at least $\sqrt{8}>2$ elements and divide a power of $2$. It follows that we can find of point $P$ of order $4$ in $E\left(\mathbb{Z}/p\mathbb{Z}\right)$.

Let $q\mid N$ be a prime, $q\neq p$. Since $|E\left(\mathbb{Z}/q\mathbb{Z}\right)|$ is a power of $2$ there exists a point $Q\in E\left(\mathbb{Z}/q\mathbb{Z}\right)$ of order $2$. Write $E\left(\mathbb{Z}/N\mathbb{Z}\right)=E\left(\mathbb{Z}/p\mathbb{Z}\right)\oplus E\left(\mathbb{Z}/q\mathbb{Z}\right)\oplus H$ for some group $H$. Take the strongly nonzero point $X=\left(P,Q,h\right)$ for any strongly nonzero $h\in H$. Then $2tX\neq\mathcal{O}$ since $4\mid|P|$, but $2tX$ is not strongly nonzero since $2Q=\mathcal{O}$. Thus $2^{r}tX$ cannot have the form $\left(x:0:1\right)$ for some $x\in\mathbb{Z}/N\mathbb{Z}$. Therefore $N$ is not a strong G-pseudoprime at $X$.

∎

Theorem 3.14**.**

Let $E/\mathbb{Q}$ be an elliptic curve. Then an odd composite number $N$ is a strong S-pseudoprime for all strongly non-zero points $P\in E\left(\mathbb{Z}/{N\mathbb{Z}}\right)$ if and only if $E$ has good reduction at $p$ for every prime $p\mid N$ and either

1. (i)

$\epsilon_{N,p}\left(E\right)\mid t$* for all primes $p\mid N$ or* 2. (ii)

$\epsilon_{N,p}\left(E\right)\mid 2t$* and $E\left(\mathbb{Z}/p\mathbb{Z}\right)\cong\mathbb{Z}/2\mathbb{Z}\oplus\mathbb{Z}/2\mathbb{Z}$ or $\mathbb{Z}/2\mathbb{Z}$ for all primes $p\mid N$.*

Proof.

[4] show condition (i) is equivalent to $N$ being a strong S-Carmichael number and therefore for all strongly non-zero points $P\in E\left(\mathbb{Z}/{N\mathbb{Z}}\right)$, $N$ is a strong S-pseudoprime. We will prove $N$ is not a strong S-Carmichael number for a curve $E$ and $N$ is a strong S-pseudoprime at all strongly nonzero points $P\in E$ if and only if condition (ii) is met. For notational purposes let $P\cong\left(P_{p_{1}},P_{p_{2}}...\right)$ represent the decomposition of the point $P\in E\left(\mathbb{Z}/N\mathbb{Z}\right)$ into $\bigoplus_{p\mid N}E\left(\mathbb{Z}/p_{i}^{\nu_{p_{i}}\left(N\right)}\mathbb{Z}\right)$ with $P_{p_{i}}\in E\left(\mathbb{Z}/p_{i}^{\nu_{p_{i}}\left(N\right)}\mathbb{Z}\right)$.

Let $\epsilon_{N,p}\left(E\right)\mid 2t$ and $E\left(\mathbb{Z}/p\mathbb{Z}\right)\cong\mathbb{Z}/2\mathbb{Z}\oplus\mathbb{Z}/2\mathbb{Z}$ or $\mathbb{Z}/2\mathbb{Z}$ for all primes $p\mid N$. Notice $N$ cannot be a strong S-Carmichael number since there exists a point in $E(\mathbb{Z}/p^{\nu_{p}(N)}\mathbb{Z})$ of order divisible by $2$ and therefore $\epsilon_{N,p}\left(E\right)\nmid t$. For any strongly non-zero point $P\cong\left(P_{p_{1}},P_{p_{2}}\ldots\right)$, consider $P_{p_{i}}\in E\left(\mathbb{Z}/p_{i}^{\nu_{p_{i}}\left(N\right)}\mathbb{Z}\right)$. Let $\sigma:E\left(\mathbb{Z}/p_{i}^{\nu_{p_{i}}\left(N\right)}\mathbb{Z}\right)\rightarrow E\left(\mathbb{Z}/p_{i}\mathbb{Z}\right)$ be the natural homomorphism. Since $P_{p_{i}}$ is strongly nonzero, $\sigma\left(P_{p_{i}}\right)$ is strongly nonzero and thus $|\sigma\left(P_{p_{i}}\right)|=2$. Thus $\sigma\left(tP_{p_{i}}\right)=t\sigma\left(P_{p_{i}}\right)=\sigma\left(P_{p_{i}}\right)\neq\mathcal{O}$ and so $tP_{p_{i}}$ is a strongly non-zero point for all $p_{i}\mid N$. Thus $tP$ is a strongly non-zero point in $E\left(\mathbb{Z}/N\mathbb{Z}\right)$. Since $\epsilon_{N,p}\left(E\right)\mid 2t$ for all $p\mid N$, we have $2tP=\mathcal{O}$. Therefore $tP$ must be a strongly non-zero point of order $2$. Therefore $N$ is a strong S-pseudoprime for $P$.

Conversely, let $N$ be a strong S-pseudoprime for all strongly nonzero points in $E\left(\mathbb{Z}/{N\mathbb{Z}}\right)$ and $N$ not be a strong S-Carmichael number for $E$. Then there exists a point $Q\in E(\mathbb{Z}/N\mathbb{Z})$ such that $tQ\neq\mathcal{O}$. By Lemma 3.10, there exists some strongly non-zero point $P$ with $\operatorname{order}\left(Q\right)\mid\operatorname{order}\left(P\right)$, thus $tP\neq\mathcal{O}$. Then, by assumption that $N$ is a strong S-pseudoprime for all strongly nonzero points $P\in E\left(\mathbb{Z}/{N\mathbb{Z}}\right)$, $2^{r}tP=\left(x:0:1\right)$ for some $0\leq r<s$ and some $x\in\mathbb{Z}/N\mathbb{Z}$. Fix some strongly nonzero point $P\in E\left(\mathbb{Z}/{N\mathbb{Z}}\right)$.

Assume that $r>0$ and let $T=2^{r}tP$. Note that $T_{p_{i}}=2^{r}t{P_{p_{i}}}\in E(\mathbb{Z}/p_{i}^{\nu_{p_{i}}(N)}\mathbb{Z})$ is a strongly nonzero point of order $2$ in $E(\mathbb{Z}/p_{i}^{\nu_{p_{i}}(N)}\mathbb{Z})$ for all $p_{i}\mid N$ and $2T=\mathcal{O}\in E(\mathbb{Z}/N\mathbb{Z})$. Construct the strongly nonzero point $Y\cong\left(T_{p_{1}},P_{p_{2}},\ldots,P_{p_{i}},\ldots\right)$. Notice $2^{r+1}tY=\mathcal{O}$, $2^{r}tY\neq\mathcal{O}$, and $2^{r}tY$ is a non-zero point since $2T_{p_{1}}=\mathcal{O}$ in $E\left(\mathbb{Z}/p_{1}^{\nu_{p_{1}}\left(N\right)}\mathbb{Z}\right)$, thus $N$ is not a strong elliptic S-pseudoprime for the strongly non-zero point $Y$, a contradiction. Therefore $r=0$.

Assume for the sake of contradiction there exists a strongly non-zero point $X$ such that $tX=\mathcal{O}$. Construct the strongly nonzero point $Y^{\prime}\cong\left(X_{p_{1}},P_{p_{2}},\ldots,P_{p_{i}},\ldots\right)$. Notice $tY^{\prime}\neq\mathcal{O}$ since $tP_{p_{2}}\neq\mathcal{O}$. Since $2^{i}tX_{p_{1}}=\mathcal{O}$ for all $i\geq 0$, $2^{i}tY^{\prime}$ is not a strongly non-zero point for all $i\geq 0$. Thus $N$ is not strong elliptic S-pseudoprime at the point $Y^{\prime}$. Therefore for all strongly non-zero points $P\in E\left(\mathbb{Z}/N\mathbb{Z}\right)$, $tP\neq\mathcal{O}$.

Thus for every strongly non-zero point $P\cong(P_{p_{1}},P_{p_{2}}..)$, $2tP=\mathcal{O}$ and so $\epsilon_{N,p}\mid 2t$ . We also conclude that $\nu_{2}(|P_{p_{i}}|)=1$. Let $\sigma:E\left(\mathbb{Z}/{p_{i}^{\nu_{p_{i}}\left(N\right)}\mathbb{Z}}\right)\rightarrow E\left(\mathbb{Z}/p_{i}\mathbb{Z}\right)$ be the natural homomorphism. Since $ker(\sigma)=\mathbb{Z}/p^{\nu_{p_{i}}-1}\mathbb{Z}$ and $p_{i}$ is odd, $\nu_{2}(|\sigma(P_{p_{i}})|)=\nu_{2}(|P_{p_{i}}|)=1$. Since every nonzero point in $X\in E(\mathbb{Z}/p_{i}\mathbb{Z}$ can be lifted to a strongly nonzero point $X^{\prime}\in E(\mathbb{Z}/N\mathbb{Z})$ such that $\sigma(X^{\prime})=X$, $\nu_{2}(X)=1$.

Thus, there are no non-zero points in $E(\mathbb{Z}/p\mathbb{Z})$ have odd order $>1$ or order $4$ thus every non-zero point has order $2$. Therefore $E\left(\mathbb{Z}/p\mathbb{Z}\right)\cong\mathbb{Z}/{2\mathbb{Z}}\oplus\mathbb{Z}/2\mathbb{Z}$ or $E\left(\mathbb{Z}/p\mathbb{Z}\right)\cong\mathbb{Z}/2\mathbb{Z}$. ∎

4. Point-wise Probabilities for Strong Elliptic Pseudoprimes

It is known that no composite number can be a strong G-pseudoprime for all points on a given elliptic curve (see [10]), so we now ask: for how many of the points on a given elliptic curve can a given composite number be a strong G-pseudoprime? Similarly, no composite number can be a strong S-pseudoprime for all points on all elliptic curves, which motivates the following question: given a fixed composite number $N$, what is the probability that $N$ is a strong elliptic S-pseudoprime for a randomly chosen point on a randomly chosen elliptic curve?

Theorem 4.1**.**

A composite number $N$ is a strong elliptic G-pseudoprime for at most $5/8$ of the points in $E\left(\mathbb{Z}/N\mathbb{Z}\right)$.

Notation**.**

Let $E/\mathbb{Q}$ be an elliptic curve, and let $N$ be a positive integer such that $E$ has good reduction at $p$ for every prime $p\mid N$. For a positive integer $x$ and a prime power $p^{a}$, define

[TABLE]

where $\nu_{2}$ denotes 2-adic valuation. Let $N=p_{1}^{a_{1}}\cdots p_{k}^{a_{k}}$ be the prime factorization of $N$, so we may write $E(\mathbb{Z}/N\mathbb{Z})\cong E(\mathbb{Z}/p_{1}^{a_{1}}\mathbb{Z})\oplus\cdots\oplus E(\mathbb{Z}/p_{k}^{a_{k}}\mathbb{Z})$. For each $P\in E(\mathbb{Z}/N\mathbb{Z})$, we can consider $P$ as isomorphic to $(P_{1},\ldots,P_{k})$, where $P_{i}\in E(\mathbb{Z}/p_{i}^{a_{i}}\mathbb{Z})$. Define

[TABLE]

where $\operatorname{order}(P_{i})$ denotes the order of $P_{i}$ as an element of $E(\mathbb{Z}/p_{i}^{a_{i}}\mathbb{Z})$.

Proposition 4.2**.**

Let $N=p_{1}^{\alpha_{1}}...p_{k}^{\alpha_{k}}$ and $M=N/p_{k}^{\alpha_{k}}$. Define $G\left(E,N\right)=\sum_{x\geq 0}H(x,N)$. Then $G\left(E,N\right)\leq G\left(E,M\right)$.

Proof.

[TABLE]

∎

Lemma 4.3**.**

Let $E/\mathbb{Q}$ be an elliptic curve with good reduction at a prime $p>2$. Then for any $x\geq 0$ and any $a\in\mathbb{N}$, $J(x,p^{a})=J(x,p)$.

Proof.

We prove the claim of the theorem by considering several cases.

1. Case (1):

$E\left(\mathbb{Z}/p_{k}^{\alpha_{k}}\mathbb{Z}\right)\cong\mathbb{Z}/p_{k}^{\alpha_{k}-1}\mathbb{Z}\oplus E\left(\mathbb{Z}/p_{k}\mathbb{Z}\right)$.

Take any point $P\cong\left(P_{1},P_{2}\right)$ in $E\left(\mathbb{Z}/p_{k}^{\alpha_{k}}\mathbb{Z}\right)\cong\mathbb{Z}/p_{k}^{\alpha_{k}-1}\mathbb{Z}\oplus E\left(\mathbb{Z}/p_{k}\mathbb{Z}\right)$. Note that the $\operatorname{order}\left(P\right)=\operatorname{lcm}\left(\operatorname{order}\left(P_{1}\right),\operatorname{order}\left(P_{2}\right)\right)$. $2\nmid p_{k}^{\alpha_{k}-1}$, so $\nu_{2}\left(\operatorname{order}\left(P\right)\right)=\nu_{2}\left(\operatorname{order}\left(P_{2}\right)\right)$. 2. Case (2):

$E\left(\mathbb{Z}/p_{k}^{\alpha_{k}}\mathbb{Z}\right)\cong\mathbb{Z}/p_{k}^{\alpha_{k}}\mathbb{Z}$.

Since $p_{k}$ is anomalous, $E\left(\mathbb{Z}/p_{k}\mathbb{Z}\right)\cong\mathbb{Z}/p_{k}\mathbb{Z}$. Since $p_{k}$ is odd, all of the points in $E\left(\mathbb{Z}/p_{k}\mathbb{Z}\right)$ have odd order, and all of the points in $E\left(\mathbb{Z}/p_{k}^{\alpha_{k}}\mathbb{Z}\right)$ have odd order.

∎

Corollary 4.4**.**

Let $N=p_{1}^{a_{1}}\cdots p_{k}^{a_{k}}$ with $p_{i}\neq 2$, and define $M=p_{1}p_{2}\cdots p_{k}$. Then for all $x\geq 0$, $H(x,N)=H(x,M)$.

The statement follows from Lemma 4.3 and the definition of $H(x,N)$ in 6. As a result, we may now assume without loss of generality that $a_{i}=1$ for all $i$.

Lemma 4.5**.**

Consider the group $G\cong\mathbb{Z}/2^{s}t\mathbb{Z}\oplus\mathbb{Z}/2^{r}w\mathbb{Z}$, where $t$ and $w$ are odd and $2^{s}t\mid 2^{r}w$. The proportion of points $P\in G$ such that $\nu_{2}\left(|P|\right)=k$ is

1. (i)

$1/2^{r+s}$* if $k=0$,* 2. (ii)

$3\left(2^{2k-2}\right)/2^{r+s}$* if $1\leq k\leq s$,* 3. (iii)

$2^{s+k-1}/2^{r+s}$* if $s+1\leq k\leq r$, and* 4. (iv)

[math]* for $k>r$.*

Proof.

First let us deal with the proportion of points $P\in G$ of odd order, i.e. when $\nu_{2}(|P|)=0$. Using the isomorphism, we can consider $P\in G$ as the pair of points $(P_{1},P_{2})$, where $P_{1}\in\mathbb{Z}/2^{s}t\mathbb{Z}$ and $P_{2}\in\mathbb{Z}/2^{r}w\mathbb{Z}$. We can consider $P_{1}$ to be an integer modulo $2^{s}t$ in the set $\{0,1,2,\ldots,2^{s}t-1\}$.

Claim 1. The order of $P_{1}$ is odd if and only if $2^{s}\mid P_{1}$.

Proof of Claim 1. Suppose that $P_{1}$ has odd order $d$. Then $dP_{1}\equiv 0\bmod{2^{s}t}$. In particular, $2^{s}t\mid dP_{1}$. Since $d$ is odd, $2^{s}\mid P_{1}$.

Conversely, suppose $2^{s}\mid P_{1}$. Let $d$ be the order of such an element $P_{1}$. Then $dP_{1}\equiv 0\bmod{2^{s}t}$, i.e. $2^{s}t\mid dP_{1}$. If $d$ were even, then we still have that $2^{s}t\mid(d/2)P_{1}$, since $2^{s}\mid P_{1}$, contradicting the minimality of $d$. Therefore $d$ must be odd, concluding the proof of Claim 1.

Therefore to count the points of odd order in $\mathbb{Z}/2^{s}t\mathbb{Z}$, it suffices to count the elements $P_{1}$ in the set $\{0,1,2,\ldots,2^{s}t-1\}$ such that $2^{s}\mid P$. These are exactly the elements $\{0,2^{s},2\cdot 2^{s},\ldots,(t-1)\cdot 2^{s}\}$, of which there are $t$. Because an element of odd order in $G$ must correspond to elements of odd order in both $\mathbb{Z}/2^{s}t\mathbb{Z}$ and $\mathbb{Z}/2^{r}w\mathbb{Z}$, we can see that there are $tw$ points of odd order, including the identity. Dividing by $|G|=2^{r+s}tw$ gives us part (i) of the lemma.

We can also extend this to counting points $P_{1}$ of order $d$ such that $\nu_{2}(d)=k$ for some $1\leq k\leq s$:

Claim 2. Suppose that the order of $P_{1}\in\mathbb{Z}/2^{s}t\mathbb{Z}$ is $d$. Then $\nu_{2}(d)=k$ if and only if $2^{s-k}\mid\mid P_{1}$.

Proof of Claim 2. Suppose that $\nu_{2}(d)=k$. As in the previous claim, we have $dP_{1}\equiv 0\bmod{2^{s}t}$, so $2^{s}t\mid dP_{1}$, so $2^{s}\mid dP_{1}$. By the minimality of $d$, $2^{s}t\nmid(d/2)P_{1}$. Therefore $2^{s}\mid\mid dP_{1}$. Since we know that $2^{k}\mid\mid d$, we must have that $2^{s-k}\mid\mid P_{1}$.

Suppose instead that $2^{s-k}\mid\mid P_{1}$. Let the order of $P_{1}$ be $d$. Then $2^{s}t\mid dP_{1}$, so $2^{k}t\mid d\cdot P_{1}/2^{s-k}$. Since $P_{1}/2^{s-k}$ is odd, we must have that $2^{k}\mid d$. Furthermore, we cannot have that $2^{k+1}\mid d$, otherwise $2^{s}t\mid(d/2)P_{1}$, contradicting the minimality of $d$. Therefore $\nu_{2}(d)=k$, concluding the proof of Claim 2.

From Claim 2, we see that to count the points $P_{1}\in\mathbb{Z}/2^{s}t\mathbb{Z}$ with order $d$ such that $\nu_{2}(d)=k$ for some $1\leq k\leq s$, it suffices to count the number of multiples of $2^{s-k}$ in the set $\{0,1,2,\ldots,2^{s}t-1\}$ which are not multiples of $2^{s-k+1}$. There are exactly $2^{s}t/2^{s-k}-2^{s}t/2^{s-k+1}=2^{k-1}t$ of these. Furthermore, there are exactly $2^{k}$ points $P_{1}$ such that $\nu_{2}(\operatorname{order}(P_{1}))\leq k$.

Let $k$ be an integer such that $0\leq k\leq s$. Note that

[TABLE]

This simplifies to the following

[TABLE]

Dividing this final expression by the order of the group $|G|=2^{r+s}tw$ gives us part (ii) of the lemma.

We are interested in counting the number of points $P$ such that

[TABLE]

when $s<k\leq r$. Because there are no points $P_{1}\in\mathbb{Z}/2^{s}t\mathbb{Z}$ such that $\nu_{2}(\operatorname{order}(P_{1}))=k$, we have

[TABLE]

Dividing the above expression by $|G|=2^{r+s}tw$ gives part (iii) of the lemma. Observe that the order of any element $P=(P_{1},P_{2})\in G$ has an order which is the LCM of the orders of $P_{1}\in\mathbb{Z}/2^{s}t\mathbb{Z}$ and $P_{2}\in\mathbb{Z}/2^{r}w\mathbb{Z}$. Furthermore, since $d_{1}:=\operatorname{order}(P_{1})\mid 2^{s}t$ and $d_{2}:=\operatorname{order}(P_{2})\mid 2^{r}w$, combined with the fact that $2^{s}t\mid 2^{r}w\Rightarrow s\leq r$, we have that $\operatorname{lcm}(d_{1},d_{2})\mid 2^{r}$, so $\nu_{2}(\operatorname{order}(P))\leq r$, which gives us part (iv) of the lemma. ∎

Definition 4.6**.**

Consider the group $G\cong\mathbb{Z}/2^{s}t\mathbb{Z}\oplus\mathbb{Z}/2^{r}w\mathbb{Z}$, where $t$ and $w$ are odd and $2^{s}t\mid 2^{r}w$. Define the vector $h\left(s,r\right)$ in $\mathbb{R}^{\infty}$ such that the $i^{th}$ coordinate of $h(s,r)$ is the proportion of points $P\in G$ such that $\nu_{2}\left(P\right)=i$.

The proof of the following theorem involves a large amount of casework and computation and it is included in the Appendix section.

Theorem 4.7**.**

Suppose $s_{1}\leq r_{1}$ and $s_{2}\leq r_{2}$ and $r_{1}\geq 1$. Then $\vec{h}(s_{1},r_{1})\cdot\vec{h}(s_{2},r_{2})$ is maximized when $r_{1}=r_{2}=s_{1}=s_{2}=1$.

Lemma 4.8**.**

Let $p$ be a prime, $\alpha\geq 2$, and $E(\mathbb{Z}/p^{\alpha}\mathbb{Z})$ be an elliptic curve. The proportion of points in $E(\mathbb{Z}/p^{\alpha}\mathbb{Z})$ with order divisible by $p$ is at least $\frac{p^{\alpha-1}-1}{p^{\alpha-1}}$.

Proof.

We prove the claim of the theorem by considering several cases.

1. Case (1):

p is anomalous for E and $E(\mathbb{Z}/p^{\alpha}\mathbb{Z})\cong\mathbb{Z}/p^{\alpha}\mathbb{Z}$

Every element has order $p^{k}$ for some $0\leq k\leq\alpha$. The only element with order 1 is the identity, so the proportion of points in E with order divisible by p is $\frac{p^{\alpha}-1}{p^{\alpha}}$. 2. Case (2):

: $E(\mathbb{Z}/p^{\alpha}\mathbb{Z})\cong\mathbb{Z}/p^{\alpha-1}\mathbb{Z}\oplus E(\mathbb{Z}/p\mathbb{Z})$

If $P\cong(P_{1},P_{2})$ is in $\mathbb{Z}/p^{\alpha-1}\mathbb{Z}\oplus E(\mathbb{Z}/p\mathbb{Z})$, and if the order of $P_{1}$ is divisible by p, then the order of P is divisible by P. The proportion of points $P=(P_{1},P_{2})$ in $\mathbb{Z}/p^{\alpha-1}\mathbb{Z}\oplus E(\mathbb{Z}/p\mathbb{Z})$ with p dividing the order of $P_{1}$ is at least $\frac{p^{\alpha-1}-1}{p^{\alpha-1}}$.

∎

Finally, we give the proof of Theorem 4.1.

Proof.

(of Theorem 4.1) We prove the claim of the theorem by considering several cases.

1. Case (1):

Suppose $N$ is not squarefree. By Lemma 4.2, the maximum proportion of points that N can be a strong G-pseudoprime for will occur when $N=p^{\alpha}$. Suppose $N=p^{\alpha}$ and $E\left(\mathbb{Z}/N\mathbb{Z}\right)\cong E\left(\mathbb{Z}/p^{\alpha}\mathbb{Z}\right)$ with $\alpha>1$. By Lemma 4.8, the proportion of points in $E\left(\mathbb{Z}/p^{\alpha}\mathbb{Z}\right)$ with order divisible by p is at least $\frac{p^{\alpha-1}-1}{p^{\alpha-1}}$. Since $p\nmid N+1$, if P has order divisible by p, then $\left(N+1\right)P\not\equiv\mathcal{O}$ and N is not a strong G-pseudoprime for (E,P). So the proportion of points in $E\left(\mathbb{Z}/N\mathbb{Z}\right)$ for which $N$ is a strong elliptic G-pseudoprime is at most $\frac{1}{p}<\frac{5}{8}$. 2. Case (2):

Suppose $N$ is squarefree. Since $\left(\frac{-d}{N}\right)=-1$, there exists some prime $p$ such that $\left(\frac{-d}{p}\right)=-1$ thus $|E\left(\mathbb{Z}/p\mathbb{Z}\right)|=p+1$. Since $N$ is composite and squarefree, there exists a prime $q\mid N$, $q\neq p$. Suppose $E\left(\mathbb{Z}/p\mathbb{Z}\right)\cong\mathbb{Z}/2^{s_{1}}t_{1}\mathbb{Z}\oplus\mathbb{Z}/2^{r_{1}}w_{1}\mathbb{Z}$ where $t_{1}$ and $w_{1}$ are odd and $2^{s_{1}}t_{1}\mid 2^{r_{1}}w_{1}$ and $E\left(\mathbb{Z}/q\mathbb{Z}\right)\cong\mathbb{Z}/2^{s_{2}}t_{2}\mathbb{Z}\oplus\mathbb{Z}/2^{r_{2}}w_{2}\mathbb{Z}$ where $t_{2}$ and $w_{2}$ are odd and $2^{s_{2}}t_{2}\mid 2^{r_{2}}w_{2}$. N is a strong G-pseudoprime at a point $P=\left(P_{1},P_{2}\right)$, where $P_{1}\in E\left(\mathbb{Z}/p\mathbb{Z}\right)$ and $P_{2}\in E\left(\mathbb{Z}/q\mathbb{Z}\right)$, only if $\nu_{2}\left(P_{1}\right)=\nu_{2}\left(P_{2}\right)$. The percentage of points that satisfy this is $h\left(s_{1},r_{1}\right)\cdot h\left(s_{2},r_{2}\right)$, with $r_{1}\geq 1$ since $|E\left(\mathbb{Z}/p\mathbb{Z}\right)|$ is even. By Theorem 4.7, this percentage is at most $h\left(1,1\right)\cdot h\left(1,1\right)=5/8$ of the points in $E\left(\mathbb{Z}/N\mathbb{Z}\right)$.

∎

Lemma 4.9**.**

Let $p$ be an odd prime, and let $E/\mathbb{Q}:y^{2}=x^{3}+Ax+B$ be an elliptic curve that has good reduction at $p$. Write $E\left(\mathbb{Z}/p\mathbb{Z}\right)\cong\mathbb{Z}/2^{s}t\mathbb{Z}\oplus\mathbb{Z}/2^{r}w\mathbb{Z}$, where $t,w>0$ are odd integers and $2^{s}t\mid 2^{r}w$. Then

• •

$s=r=0$* if and only if $x^{3}+Ax+B$ is irreducible $\mod p$*

• •

$s=0$* and $r\geq 1$ if and only if $x^{3}+Ax+B$ has one root $\mod p$*

• •

$r\geq s\geq 1$* if and only if $x^{3}+Ax+B$ has three roots $\mod p$*

Proof.

The points of order 2 on $E\left(\mathbb{Z}/p\mathbb{Z}\right)$ are exactly the roots of $x^{3}+Ax+B$ mod $p$. Note this only works for $p$ prime - this statement fails spectacularly for composite numbers. If there are no roots, then the P-Sylow theorems implies that $|E\left(\mathbb{Z}/p\mathbb{Z}\right)|$ is odd since there are no points of order 2. Hence $a_{p}$ is odd. If there is one root, there is one point of order 2, so exactly one of $r$ or $s$ must be nonzero. But by assumption $r\geq s$, so $s=0$ and $r\geq 1$. If there are three roots, there are three points of order 2, so both $r$ and $s$ must be at least 1. The converse of each statement in the theorem also holds since every point of order 2 is a root. ∎

Lemma 4.10**.**

Let $E/\mathbb{Q}$ be an elliptic curve with good reduction at an odd prime $p$. Write $E\left(\mathbb{Z}/p\mathbb{Z}\right)\cong\mathbb{Z}/2^{s}t\mathbb{Z}\oplus\mathbb{Z}/2^{r}w\mathbb{Z}$, where $t,w>0$ are odd integers and $2^{s}t\mid 2^{r}w$. Then

• •

$s=r=0$* with probability $\frac{p+1}{3p}$*

• •

$s=0$* and $r\geq 1$ with probability $\frac{1}{2}$*

• •

$r\geq s\geq 1$* with probability $\frac{p-2}{6p}$.*

Proof.

There are $\binom{p}{3}=\frac{p\left(p-1\right)\left(p-2\right)}{6}$ such curves with 3 roots. There are $p^{2}$ quadratic polynomials in $\mathbb{F}_{p}[x]$, and $\binom{p}{2}+p$ quadratic polynomials with roots in $\mathbb{F}_{p}$. So there are $p\left(p^{2}-\binom{p}{2}-p\right)$ such curves with 1 root. There are $p^{3}-p^{2}-\binom{p}{3}-p\left(p^{2}-\binom{p}{2}-p\right)$ such curves with no roots, and $s=r=0$. There are $p^{3}$ cubic polynomials, and $p^{2}$ cubic polynomials with repeated roots. So there are $p^{3}-p^{2}$ possible curves $E\left(\mathbb{Z}/p\mathbb{Z}\right)$ with good reduction at p. The lemma follows from lemma 4.9 and the counting in the paragraph. ∎

Theorem 4.11**.**

Let $N=p_{1}^{\alpha_{1}}...p_{k}^{\alpha_{k}}$ with $2\nmid N$ and $p,q\mid N$. The probability a random point $P\cong\left(P_{1},...,P_{k}\right)$ has $\nu_{2}\left(\operatorname{order}\left(P_{i}\right)\right)$ all equal for a random curve $E\left(\mathbb{Z}/N\mathbb{Z}\right)\cong E\left(\mathbb{Z}/p_{1}^{\alpha_{1}}\mathbb{Z}\right)\oplus...\oplus E\left(\mathbb{Z}/p_{k}^{\alpha_{k}}\mathbb{Z}\right)$ is at most $\frac{17pq+2p+2q+4}{32pq}$.

Proof.

Let $G\left(E,N\right)$ be the proportion of points $P\cong\left(P_{1},...,P_{k}\right)$ in $E\left(\mathbb{Z}/N\mathbb{Z}\right)\cong E\left(\mathbb{Z}/p_{1}^{\alpha_{1}}\mathbb{Z}\right)\oplus...\oplus E\left(\mathbb{Z}/p_{k}^{\alpha_{k}}\mathbb{Z}\right)$ such that $\nu_{2}|P_{i}|$ are all equal. Let $E\left(\mathbb{Z}/p\mathbb{Z}\right)\cong\mathbb{Z}/2^{s_{i}}t_{i}\mathbb{Z}\oplus\mathbb{Z}/2^{r_{i}}w_{i}\mathbb{Z}$ and $E\left(\mathbb{Z}/q\mathbb{Z}\right)\cong\mathbb{Z}/2^{s_{j}}t_{j}\mathbb{Z}\oplus\mathbb{Z}/2^{r_{j}}w_{j}\mathbb{Z}$. Let $|E|$ be the number of elliptic curves $E\left(\mathbb{Z}/N\mathbb{Z}\right)$ with good reduction. Let $|E^{\prime}|$ be the number of elliptic curves $E\left(\mathbb{Z}/p\mathbb{Z}\right)\oplus E\left(\mathbb{Z}/q\mathbb{Z}\right)$ with good reduction at p and q. By Lemma 4.10 we have

• •

$r_{1}=r_{2}=s_{1}=s_{2}=0$ with probability $\frac{\left(p+1\right)\left(q+1\right)}{9pq}$

• •

$r_{1}=s_{1}=s_{2}=0$ and $r_{2}\geq 1$ with probability $\frac{\left(p+1\right)}{6p}$

• •

$r_{2}=s_{2}=s_{1}=0$ and $r_{1}\geq 1$ with probability $\frac{\left(q+1\right)}{6q}$

• •

$s_{1}=r_{1}=0$ and $r_{2}\geq s_{2}\geq 1$ with probability $\frac{\left(p+1\right)\left(q-2\right)}{18pq}$

• •

$s_{2}=r_{2}=0$ and $r_{1}\geq s_{1}\geq 1$ with probability $\frac{\left(q+1\right)\left(p-2\right)}{18pq}$

• •

$s_{1}=s_{2}=0$, $r_{1}\geq 1$, and $r_{2}\geq 1$ with probability $\frac{1}{4}$

• •

$s_{1}=0$, $r_{1}\geq 1$, and $r_{2}\geq s_{2}\geq 1$ with probability $\frac{\left(p-2\right)}{12p}$

• •

$s_{2}=0$, $r_{2}\geq 1$, and $r_{1}\geq s_{1}\geq 1$ with probability $\frac{\left(q-2\right)}{12q}$

• •

$r_{1}\geq s_{1}\geq 1$ and $r_{2}\geq s_{2}\geq 1$ with probability $\frac{\left(p-2\right)\left(q-2\right)}{36pq}$

By Lemma 4.2 and Lemma 4.3, we have that $G\left(E,N\right)\leq h\left(s_{1},r_{1}\right)\cdot h\left(s_{2},r_{2}\right)$. Then

[TABLE]

∎

Corollary 4.12**.**

Let $N=p_{1}^{\alpha_{1}}...p_{k}^{\alpha_{k}}$ with $2\nmid N$ and p and q the largest primes dividing N. The probability N is a strong S-pseudoprime for a random point $P\cong\left(P_{1},...,P_{k}\right)$ on a random curve $E\left(\mathbb{Z}/N\mathbb{Z}\right)\cong E\left(\mathbb{Z}/p_{1}^{\alpha_{1}}\mathbb{Z}\right)\oplus...\oplus E\left(\mathbb{Z}/p_{k}^{\alpha_{k}}\mathbb{Z}\right)$ is at most $\frac{17pq+2p+2q+4}{32pq}$.

4.1. Strongly Non-zero Point-wise Probabilities

In this section we prove similar probabilistic results for strong elliptic G-pseudoprime (strong elliptic S-pseudoprime) and strongly non-zero points on a given elliptic curve. As in Section 3, we will ignore the case where there are no strongly non-zero points. The proof of following theorem will be given at the end of this section. First we will show several results needed to prove the theorem.

Theorem 4.13**.**

Let $E\left(\mathbb{Z}/N\mathbb{Z}\right)$ be an elliptic curve. A composite number $N$ is a strong elliptic G-pseudoprime for at most 9/11 of the strongly non-zero points in $E\left(\mathbb{Z}/N\mathbb{Z}\right)$.

The following lemma is a direct consequence of Lemma 4.5.

Lemma 4.14**.**

Suppose $G\cong\mathbb{Z}/2^{s}t\mathbb{Z}\oplus\mathbb{Z}/2^{r}w\mathbb{Z}$ where $t$ and $w$ are odd and $2^{s}t\mid 2^{r}w$. The percentage of strongly non-zero points $P\in G$ such that $\nu_{2}(order(P))=x$ is $\frac{tw-1}{2^{r+s}tw-1}$ for $x=0$, $\frac{3(2^{2x-2})tw}{2^{r+s}tw-1}$ for $1\leq x\leq s$, $\frac{2^{s+x-1}tw}{2^{r+s}tw-1}$ for $s+1\leq x\leq r$, and 0 for $x>r$.

Definition 4.15**.**

Define the vector $h^{\prime}(s,r,t,w)$ to be the vector whose $i^{th}$ coordinate is the percentage of strongly non-zero points $P\in G\cong\mathbb{Z}/2^{s}t\mathbb{Z}\oplus\mathbb{Z}/2^{r}w\mathbb{Z}$ where $t$ and $w$ are odd and $2^{s}t\mid 2^{r}w$, such that $\nu_{2}(P)=i$.

The proof of the following theorem a large amount of casework and is placed in the Appendix section.

Theorem 4.16**.**

Suppose $s_{1}\leq r_{1}$ and $s_{2}\leq r_{2}$ and $r_{1}\geq 1$ and $2^{s}_{2}\cdot 2^{r}_{2}\cdot t_{2}\cdot w_{2}>1$. Then $h^{\prime}(s_{1},r_{1},t_{1},w_{1})\cdot h^{\prime}(s_{2},r_{2},t_{2},w_{2})\leq h^{\prime}(1,1,t_{1},w_{1})h^{\prime}(1,1,t_{2},w_{2})$

Finally, we give the proof of Theorem 4.13 stated at the beginning of this section.

Proof.

We prove the claim of the theorem by considering several cases.

1. Case (1):

Suppose $N$ is not squarefree. By Lemma 4.2, the maximum proportion of strongly non-zero points that N can be a strong G-pseudoprime for will occur when $N=p^{\alpha}$. Suppose $N=p^{\alpha}$ and $E(\mathbb{Z}/N\mathbb{Z})\cong E(\mathbb{Z}/p^{\alpha}\mathbb{Z})$ with $\alpha>1$. From the structure theorem for abelian groups, at least $\frac{p^{\alpha}-1}{p^{\alpha}}$ of the strongly non-zero points in $E(\mathbb{Z}/p^{\alpha}\mathbb{Z})$ have order p. Since $p\nmid N+1$, if P has order p, then $(N+1)P\not\equiv\mathcal{O}$ and N is not a strong G-pseudoprime for (E,P). So N can be a strong G-pseudoprime for at most $\frac{1}{p^{\alpha-1}}<\frac{9}{11}$ of the strongly non-zero points in $E(\mathbb{Z}/N\mathbb{Z})$. 2. Case (2):

Suppose $N$ is squarefree. Since $\left(\frac{-d}{N}\right)=-1$, there exists some prime $p$ dividing $N$ such that $\left(\frac{-d}{p}\right)=-1$ thus $|E(\mathbb{Z}/p\mathbb{Z})|=p+1$. Since $N$ is composite and squarefree there exists a prime $q\mid N$, $q\neq p$.

Suppose $E(\mathbb{Z}/p\mathbb{Z})\cong\mathbb{Z}/2^{s_{1}}t_{1}\mathbb{Z}\oplus\mathbb{Z}/2^{r_{1}}w_{1}\mathbb{Z}$ where $t_{1}$ and $w_{1}$ are odd and $2^{s_{1}}t_{1}\mid 2^{r_{1}}w_{1}$ and $E(\mathbb{Z}/q\mathbb{Z})\cong\mathbb{Z}/2^{s_{2}}t_{2}\mathbb{Z}\oplus\mathbb{Z}/2^{r_{2}}w_{2}\mathbb{Z}$ where $t_{2}$ and $w_{2}$ are odd and $2^{s_{2}}t_{2}\mid 2^{r_{2}}w_{2}$. N is a strong G-pseudoprime at a point $P=(P_{1},P_{2})$, only if $\nu_{2}(P_{1})=\nu_{2}(P_{2})$. The percentage of strongly non-zero points that satisfy this is $h^{\prime}(s_{1},r_{1},t_{1},w_{1})\cdot h^{\prime}(s_{2},r_{2},t_{2},w_{2})$, with $r_{1}\geq 1$ since $|E(\mathbb{Z}/p\mathbb{Z})|$ is even. By Theorem 4.16, one can see that this percentage is at most $\frac{9}{11}$.

∎

This proof of the following theorem follows directly along the lines of the proof of Theorem 4.11.

Theorem 4.17**.**

Let $N=p_{1}^{\alpha_{1}}...p_{k}^{\alpha_{k}}$ with $2\nmid N$ and $p,q\mid N$. The probability that a random strongly non-zero point $P\cong\left(P_{1},...,P_{k}\right)$ has $\nu_{2}\left(\operatorname{order}\left(P_{i}\right)\right)$ all equal for a random elliptic curve $E\left(\mathbb{Z}/N\mathbb{Z}\right)\cong E\left(\mathbb{Z}/p_{1}^{\alpha_{1}}\mathbb{Z}\right)\oplus...\oplus E\left(\mathbb{Z}/p_{k}^{\alpha_{k}}\mathbb{Z}\right)$ is at most $\frac{78pq-5p-5q+12}{120pq}$.

Corollary 4.18**.**

Let $N=p_{1}^{\alpha_{1}}...p_{k}^{\alpha_{k}}$ with $2\nmid N$ and $p$ and $q$ the largest primes dividing $N$. The probability that $N$ is a strong S-pseudoprime for a random strongly non-zero point $P\cong\left(P_{1},...,P_{k}\right)$ on a random curve $E\left(\mathbb{Z}/N\mathbb{Z}\right)\cong E\left(\mathbb{Z}/p_{1}^{\alpha_{1}}\mathbb{Z}\right)\oplus...\oplus E\left(\mathbb{Z}/p_{k}^{\alpha_{k}}\mathbb{Z}\right)$ is at most $\frac{78pq-5p-5q+12}{120pq}$.