Lenstra’s integer factorization algorithm is asymptotically one of the fastest known algorithms, and is also ideally suited for parallel computation. We suggest a way in which the algorithm can be speeded up by the addition of a second phase. Under some plausible assumptions, the speedup is of order log(p), where p is the factor which is found. In practice the speedup is significant. We mention some refinements which give greater speedup, an alternative way of implementing a second phase, and the connection with Pollard’s “p − 1” factorization algorithm. 1

this paper average estimates related to the Lang-Trotter conjecture. The average distribution fits the one predicted by the conjecture, and the conjectural constant C E,r of Lang and Trotter is confirmed by our results, as seen in Section 2. Average estimates for the case r 0 were already obtained by Fouvry and Murty [6], and we obtain a generalization of their results for any r Z. The techniques of Fouvry and Murty do not seem to extend to the general case r Z. Our proof then differs significantly from theirs. In the following, we fix r Z, and we denote by E(a, b) the elliptic curve Y b with a, b Z. Then . Following [11], we define 2 # t log t # . Theorem 1.2. Let r be an integer,A,B# 1. For every c>0, we have 1 , (2) where . (3) The constants in the O-symbol depend only on c and r. As the infinite product of (3) converges to a positive number, the constant C r is nonzero, even if some C E,r can be zero, as mentioned above. From the last theorem, we immediately obtain that the Lang-Trotter conjecture is true "on average." Corollary 1.3. Let #>0. If A,B>x , we have as x ##, . In analogy with the classical terminology, we can say that the average order of E(a,b) (x)isC r ( # x/ log x). Using the same techniques, we can also prove that the normal order of # E(a,b) (x)isC r ( # x/log x). Then,# C r ( # x/ log x) for "almost all" E(a, b) rather than on average (see Corollary 1.5). We are grateful to A. Granville for suggesting this application of our techniques

We determine the probability that a randomly chosen elliptic curve E/Fp over a randomly chosen prime field Fp has an ℓ-primary part E(Fp)[ℓ ∞ ] isomorphic with a fixed abelian ℓ-group H (ℓ) α,β = Z/ℓα × Z/ℓ β. Probabilities for “|E(Fp) | divisible by n”, “E(Fp) cyclic ” and expectations for the number of elements of precise order n in E(Fp) are derived, both for unbiased E/Fp and for E/Fp with p ≡ 1 (ℓ r).

Three questions concerning the distribution of the numbers of points on elliptic curves over a finite prime field are considered. First, the previously published bounds for the distribution are tightened slightly. Within these bounds, there are wild fluctuations in the distribution, and some heuristics are discussed (supported by numerical evidence) which suggest that numbers of points with no large prime divisors are unusually prevalent. Finally, allowing the prime field to vary while fixing the field of fractions of the endomorphism ring of the curve, the order of magnitude of the average order of the number of divisors of the number of points is determined, subject to assumptions about primes in quadratic progressions. There are implications for factoring integers by Lenstra’s elliptic curve method. The heuristics suggest that (i) the subtleties in the distribution actually favour the elliptic curve method, and (ii) this gain is transient, dying away as the factors to be found tend to infinity. 1.

In this paper we consider the Lang-Trotter conjecture (Conjecture 1 below) for various families of elliptic curves with prescribed torsion structure. We prove that the Lang-Trotter conjecture holds in an average sense for these families of curves (see Theorem 3).

For each prime p, we determine the distribution of the p th Fourier coefficients of the Hecke eigenforms of large weight for the full modular group. As p !1, this distribution tends to the Sato-Tate distribution.

In these lectures, I will try to explain some interactions between the classic theory of linear differential equations in one complex variable with polynomial coefficients, and the theory of one-parameter families of exponential sums over finite fields. What kind of exponential sums are we talking about? Suppose we start with some polynomial over Z in some number n of variables f(Xl9X29...9Xn)€Z[Xl9X29...,Xn]. A fundamental question (perhaps the fundamental question) we can ask about such an ƒ is: Does ƒ = 0 have a solution in integers? Clearly, if there exists an integer solution, then for any prime p there exists a solution in the finite field Z/pZ; simply reduce mod p any integer solution. (For any ring R, ƒ maps R n to R. When we say "a solution of ƒ = 0 in R, " we mean an «-tuple of elements (a{,..., an) of R such that f (a) = 0 in R.) Thus, for example, equations of the form Y a-Y b =X c-X d-l, with any exponents a, b, c, d all> 1, have no integer solutions, because they have no solutions mod 2. Similarly, the equation Received by the editors September 13, 1989.

Abstract. We obtain average results on the Sato-Tate conjecture for elliptic curves for small angles.

Abstract. We provide a number of results that can be used to derive approximations for the Euler product representation of the zeta function of an arbitrary algebraic function field. Three such approximations are given here. Our results have two main applications. They lead to a computationally suitable algorithm for computing the class number of an arbitrary function field. The ideas underlying the class number algorithms in turn can be used to analyze the distribution of the zeros of its zeta function. 1.

this paper, and Tom Tucker for useful conversations. REFERENCES