. A speedup of Lenstra's Elliptic Curve Method of factorization is presented. The speedup works for integers of the form N = PQ^2 , where P is a prime sufficiently smaller than Q. The result is of interest to cryptographers, since integers with secret factorization of this form are being used in digital signatures. The algorithm makes use of what we call "Jacobi signatures". We believe these to be of independent interest. 1 Introduction It is not known how to efficiently factor a large integer N . Currently, the algorithm with best asymptotic complexity is the Number Field Sieve (see [6] ). For numbers below a certain size (currently believed to be about 120 integers), either the Quadratic Sieve [14] or the Elliptic Curve Method [7] are faster. Which of these algorithms to use depends on the size of N and of the smallest prime factor of N . When the size of the smallest factor is sufficiently smaller than p N , the Elliptic Curve Method is the fastest of the three. In this no...

This report is a survey on public key cryptosystems that use the theory of elliptic curves. A considerable part will be about the theory of elliptic curves. Encryption systems, digital signature schemes and key agreement schemes using elliptic curves will be described. Their workload and bandwidth will be addressed and some attacks will be described. For all systems the security is based either on the elliptic curve discrete logarithm problem or on the difficulty of factorization. The differences between conventional and elliptic curve systems shall be addressed. Systems based on the elliptic curve discrete logarithm problem can be used with shorter keys to provide the same security, compared to similar conventional systems. Elliptic curve systems based on factoring are slightly more resistant as conventional systems against some attacks.

We discuss two combinatorial problems for which we have only sub-optimal solutions. We describe known solutions and we explain why better solutions would be of importance to Cryptography. The areas of application are in improving the efficiency of Zero-Knowledge proofs, in relating the quadratic residuosity problem to the problem of integer factorization, and in analyzing some cryptographic schemes based on number-theory. 1 Reduction of integer factorization to a combinatorial optimization problem plus a quadratic residuosity oracle. The "quadratic residuosity assumption" (QRA) states that having any significant advantage in deciding quadratic residuosity is asymptotically infeasible for random elements of Z N whose Jacobi symbol is +1, whenever N is an RSA number [4]. This assumption is widely used in cryptography, yet there is no known reduction from integer factorization to deciding quadratic residuosity (the other direction is easy). It is conceivable that factoring is hard ...

Abstract not found