Prime-order reduction at cryptographic heights: a pre-registered test of the refined Koblitz conjecture over consecutive primes

Prime-order reduction at cryptographic heights: a pre-registered test of the refined Koblitz conjecture over consecutive primes Koblitz (1988) proposed a way to find an elliptic curve group of prime order: fix a curve E over Q, pick a large random odd M, and compute #E(Fp) for the successive primes p ≥ M until it is prime. Zywina (2011) refined the predicted rate of success. That prediction had been tested on exhaustive ranges up to about 109, but not at the sizes where the procedure is actually used. This paper tests it there, at 264, 2128 and 2256. Design. Every test, prediction and line of analysis code was frozen, hashed and made public before any data existed. The random seed was then taken from a drand beacon round published after the freeze (round 6611336). The paper samples fixed-length runs of consecutive primes from uniformly random starts, in four arms: A and B: the non-CM curve 37a1 at 264 and 2128, with every prime eligible; C and D: the CM curve y2 = x3 − x with t = 8 at 2128 and 2256, over ordinary primes p ≡ 1 (mod 4). Supersingular primes are excluded because they give curves of embedding degree 2, which the MOV attack rules out for cryptography. Results. All 12 pre-registered decisive tests came out as predicted. The observed-to-predicted rate ratio was 0.9954 ± 0.0046 and 0.9933 ± 0.0059 for 37a1, and 1.0001 ± 0.0006 and 0.9983 ± 0.0018 for the CM curve. The arm-C figure is based on 2.47 million prime-order events. Among eligible primes, the rate depends on p mod 3 as the Galois images predict: a ratio of 5/4 for 37a1 and 3/4 for the CM curve. Prime-order events at consecutive primes are correlated only through congruence classes, to the precision of the tests. The 99% bounds on any extra effect run from 2.4% to 10.6% of the base rate. The raw lag-1 correlation is negative in all four arms, as expected from the Lemke Oliver–Soundararajan bias acting through classes of p in which #E(Fp)/t is never prime. The paper also proves which congruence classes of p rule out prime order: for y2 = x3 − x, #E(Fp) ≡ 0 (mod 16) when p ≡ 1 (mod 8). This follows from the formula in Gauss's last diary entry, and the mod-16 step is checked in Lean 4. Data and code: doi:10.5281/zenodo.24026057 (all versions of the dataset). Companion paper: doi:10.5281/zenodo.23843403. This upload contains the paper (PDF) and a source bundle: the LaTeX, the figures, the scripts that regenerate them, and the four results files. The paper can be rebuilt from the bundle alone. AI use: the work was produced with AI assistance (Claude, Anthropic) under the author's direction, as described in the paper.