## Some integer factorization algorithms using elliptic curves (1986)

Venue: | Australian Computer Science Communications |

Citations: | 49 - 13 self |

### BibTeX

@ARTICLE{Brent86someinteger,

author = {Richard P. Brent},

title = {Some integer factorization algorithms using elliptic curves},

journal = {Australian Computer Science Communications},

year = {1986},

volume = {8},

pages = {149--163}

}

### Years of Citing Articles

### OpenURL

### Abstract

Lenstra’s integer factorization algorithm is asymptotically one of the fastest known algorithms, and is also ideally suited for parallel computation. We suggest a way in which the algorithm can be speeded up by the addition of a second phase. Under some plausible assumptions, the speedup is of order log(p), where p is the factor which is found. In practice the speedup is significant. We mention some refinements which give greater speedup, an alternative way of implementing a second phase, and the connection with Pollard’s “p − 1” factorization algorithm. 1

### Citations

3133 | A Method for Obtaining Digital Signatures and Public Key Cryptosystems
- Rivest, Shamir, et al.
- 1978
(Show Context)
Citation Context ...urves. Other algorithms [27] may be even more effective on numbers which are the product of two roughly equal primes. This implies that the composite numbers N on which the RSA publickey cryptosystem =-=[25, 26]-=- is based should have at least 100 decimal digits if the cryptosystem is to be reasonably secure. 11 Acknowledgements I wish to thank Sam Wagstaff, Jr. for introducing me to Lenstra's algorithm, and B... |

2531 |
The design and analysis of computer algorithms
- Aho, Hopcroft, et al.
- 1975
(Show Context)
Citation Context ...c operations are performed modulo N , where N is the number which we are trying to factorize. 7 Because a suitable root of unity (mod N) is not known, we are unable to use algorithms based on the FFT =-=[1]-=-. However, it is still possible to reduce M(r) below the obvious O(r 2 ) bound. For example, binary splitting and the use of Karatsuba's idea [13] gives M(r) = O(r log 2 3 ). The Toom-Cook algorithm [... |

2303 |
The art of computer programming
- Knuth
- 1969
(Show Context)
Citation Context ...ions mod N or of multiplications/divisions by small (i.e. single-precision) integers, so long as the total number of such operations is not much greater than the number of multiplications mod N . See =-=[13, 20]-=- for implementation hints. In some of the algorithms considered below it is necessary to compute inverses modulo N , i.e. given an integer a in (0; N ), compute u in (0; N) such that asu = 1 (mod N ).... |

582 |
A classical introduction to modern number theory
- Ireland, Rosen
- 1990
(Show Context)
Citation Context ...of work), a squaring then requires 12 units and a nonsquaring multiplication requires 9 units of work. The reader who is interested in learning more about the theory of elliptic curves should consult =-=[11]-=-, [12] or [15]. 5 Lenstra's algorithm The idea of Lenstra's algorithm is to perform a sequence of pseudo-random trials, where each trial uses a randomly chosen elliptic curve and has a nonzero probabi... |

444 |
Modular Multiplication Without Trial Division
- Montgomery
(Show Context)
Citation Context ...ions mod N or of multiplications/divisions by small (i.e. single-precision) integers, so long as the total number of such operations is not much greater than the number of multiplications mod N . See =-=[13, 20]-=- for implementation hints. In some of the algorithms considered below it is necessary to compute inverses modulo N , i.e. given an integer a in (0; N ), compute u in (0; N) such that asu = 1 (mod N ).... |

322 |
An Introduction to the Theory of
- Hardy, Wright
- 1978
(Show Context)
Citation Context ...her than m 0 = N , because this significantly reduces the cost of a trial without significantly reducing the probability of success. Assuming m 0 = m, well-known results on the distribution of primes =-=[10]-=- give ln(E)sm, so the work per trial is approximately c 1 m, where c 1 = ( 11 3 + K) 3 2 ln 2 . Here c 1 is the product of the average work required to perform a multiplication in G times the constant... |

107 |
Sequences of numbers generated by addition in formal groups and new primality and factorization tests
- Chudnovsky, Chudnovsky
- 1986
(Show Context)
Citation Context ...=12 in the analysis above, so gives a speedup which is very significant in practice, although not significant asymptotically. 9.4 Faster group operations Montgomery [21] and Chudnovsky and Chudnovsky =-=[8]-=- have shown that the Weierstrass normal form (5.1) may not be optimal if we are interested in minimizing the number of arithmetic operations required to perform group operations. If (5.1) is replaced ... |

101 |
The Computational Complexity of Algebraic and Numeric Problems
- Borodin, Munro
- 1975
(Show Context)
Citation Context ...1 of (7.1) in O(M(r)) multiplications, and it is then easy to obtain the coefficients b j = (j + 1)a j+1 in the formal derivative P 0 (x) = \Sigmab j x j . Using fast polynomial evaluation techniques =-=[4], we can n-=-ow evaluate P 0 (x) at r points in time O(M(r)). However, D 2 = r Y j=1 P 0 (x j ); (7:4) so we can evaluate D 2 and then GCD (N; D 2 ). Thus, we can perform the "birthday paradox" algorithm... |

74 |
Theorems on factorization and primality testing
- Pollard
- 1974
(Show Context)
Citation Context ...deas we obtain a speedup of about 6.6 over the one-phase algorithm for p = 10 20 . 9.2 Other second phases Our birthday paradox idea can be used as a second phase for Pollard's "p \Gamma 1" =-=algorithm [23]. The only-=- change is that we work over a different group. Conversely, the conventional second phases for Pollard's "p \Gamma 1" algorithm can be adapted to give second phases for elliptic curve algori... |

72 |
The multiple polynomial quadratic sieve
- Silverman
- 1987
(Show Context)
Citation Context ...ed time T 1 (p) = exp `q (2 + o(1)) ln p ln ln p ' ; (1:1) where "o(1)" means a term which tends to zero as p ! 1. Previously algorithms with running time exp i p (1 + o(1)) ln N ln ln N j w=-=ere known [27]. However,-=- since p 2sN , Lenstra's algorithm is comparable in the worst case and often much better, since it often happens that 2 ln psln N . The Brent-Pollard "rho" algorithm [5] is similar to Lenstr... |

52 |
An improved Monte Carlo factorization algorithm
- Brent
- 1980
(Show Context)
Citation Context ...n ln N j were known [27]. However, since p 2sN , Lenstra's algorithm is comparable in the worst case and often much better, since it often happens that 2 ln psln N . The Brent-Pollard "rho" =-=algorithm [5]-=- is similar to Lenstra's algorithm in that its expected running time depends on p, in fact it is of order p 1=2 . Asymptotically T 1 (p)sp 1=2 , but because of the overheads associated with Lenstra's ... |

49 | On the number of nonscalar multiplications necessary to evaluate polynomials
- Paterson, Stockmeyer
- 1973
(Show Context)
Citation Context ... ; x r and x 1 ; : : : ; x s in O((r + s)e) group operations. The values of x j do not need to be stored, so storage requirements are O(r) even if s AE r. Moreover, by use of rational preconditioning =-=[22, 29]-=- it is easy to evaluate (9.1) in (r + O(log r))s=2 multiplications. Using these ideas we obtain a speedup of about 6.6 over the one-phase algorithm for p = 10 20 . 9.2 Other second phases Our birthday... |

48 |
On the frequency of numbers containing prime factors of a certain relative magnitude
- Dickman
- 1930
(Show Context)
Citation Context ...e definition of "a random integer close to M ", see [14]. It is sufficient to consider integers uniformly distributed in [1; M ]:) Several authors have considered the function ae(ff), see fo=-=r example [7, 9, 13, 14, 18]-=-. It satisfies a differential-difference equation ffae 0 (ff) + ae(ff \Gamma 1) = 0 and may be computed by numerical integration from ae(ff) = ( 1 if 0sffs1 1 ff R ff ff\Gamma1 ae(t) dt if ff ? 1: We ... |

43 |
Elliptic curves: Diophantine analysis
- Lang
- 1978
(Show Context)
Citation Context ...uaring then requires 12 units and a nonsquaring multiplication requires 9 units of work. The reader who is interested in learning more about the theory of elliptic curves should consult [11], [12] or =-=[15]-=-. 5 Lenstra's algorithm The idea of Lenstra's algorithm is to perform a sequence of pseudo-random trials, where each trial uses a randomly chosen elliptic curve and has a nonzero probability of findin... |

32 |
Prime numbers and computer methods for factorization. Birkhauser, 2nd edition
- Riesel
- 1994
(Show Context)
Citation Context ... algorithm can be speeded up by the addition of a second phase which is based on the same idea as the well-known "paradox" concerning the probability that two people at a party have the same=-= birthday [25]. The twop-=-hase algorithm has expected running time O(T 1 (p)= ln p). In practice, for p around 10 20 , the "birthday paradox algorithm" is about 4 times faster than Lenstra's (one-phase) algorithm. Th... |

30 |
Euclid’s algorithm for large numbers
- Lehmer
- 1938
(Show Context)
Citation Context .... Suppose that the computation of a \Gamma1 (mod N) by the extended GCD algorithm takes the same time as K multiplications (mod N ). Our first implementation gave K ' 30, but by using Lehmer's method =-=[16]-=- this was reduced to 6sKs10 (the precise value depending on the size of N ). It turns out that most computations of a \Gamma1 (mod N) can be avoided at the expense of about 8 multiplications (mod N ),... |

28 |
How the number of points of an elliptic curve over a fixed prime field varies
- Birch
- 1968
(Show Context)
Citation Context ...mma 1j ! 2 p p: (4:2) Lenstra's heuristic hypothesis is that, if a and b are chosen at random, then g will be essentially random in that the results of x3 will apply with M = p. Some results of Birch =-=[3]-=- suggest its plausibility. Nevertheless, the divisibility properties of g are not quite what would be expected for a randomly chosen integer near p, e.g. the probability that g is even is asymptotical... |

15 |
Trabb Pardo, Analysis of a simple factorization algorithm, Theoret
- Knuth, L
- 1976
(Show Context)
Citation Context ...: : . For ffs1, fis1, define ae(ff) = lim M!1 Prob i n 1 ! M 1=ff j and (ff; fi) = lim M!1 Prob i n 2 ! M 1=ff and n 1 ! M fi=ff j : 2 (For a precise definition of "a random integer close to M &q=-=uot;, see [14]-=-. It is sufficient to consider integers uniformly distributed in [1; M ]:) Several authors have considered the function ae(ff), see for example [7, 9, 13, 14, 18]. It satisfies a differential-differen... |

14 | A Monte Carlo method for factorization, Bit - Pollard - 1975 |

13 |
Equations et variétés algébriques sur un corps
- Joly
- 1973
(Show Context)
Citation Context ...amma x 2 ) mod p; y 3 := ((x 1 \Gamma x 3 ) \Gamma y 1 ) mod p end: It is well-known that (G; ) forms an Abelian group with identity element I. Moreover, by the "Riemann hypothesis for finite fie=-=lds" [12]-=-, the group order g = jGj satisfies the inequality jg \Gamma p \Gamma 1j ! 2 p p: (4:2) Lenstra's heuristic hypothesis is that, if a and b are chosen at random, then g will be essentially random in th... |

10 |
de Brui jn, The asymptotic behaviour of a function occurring in the theory of primes
- G
- 1951
(Show Context)
Citation Context ...e definition of "a random integer close to M ", see [14]. It is sufficient to consider integers uniformly distributed in [1; M ]:) Several authors have considered the function ae(ff), see fo=-=r example [7, 9, 13, 14, 18]-=-. It satisfies a differential-difference equation ffae 0 (ff) + ae(ff \Gamma 1) = 0 and may be computed by numerical integration from ae(ff) = ( 1 if 0sffs1 1 ff R ff ff\Gamma1 ae(t) dt if ff ? 1: We ... |

9 |
On the numerical solution of a differential-difference equation arising in analytic number theory
- Lune, Wattel
- 1969
(Show Context)
Citation Context ...e definition of "a random integer close to M ", see [14]. It is sufficient to consider integers uniformly distributed in [1; M ]:) Several authors have considered the function ae(ff), see fo=-=r example [7, 9, 13, 14, 18]-=-. It satisfies a differential-difference equation ffae 0 (ff) + ae(ff \Gamma 1) = 0 and may be computed by numerical integration from ae(ff) = ( 1 if 0sffs1 1 ff R ff ff\Gamma1 ae(t) dt if ff ? 1: We ... |

3 |
Informal preliminary report (8), personal communication
- Suyama
- 1985
(Show Context)
Citation Context ... table (or on-line generation) of primes for the second phase, so it is easier to program and has lower storage requirements. 11 9.3 Better choice of random elliptic curves Montgomery [21] and Suyama =-=[28] have show-=-n that it is possible to choose "random" elliptic curves so that g is divisible by certain powers of 2 and/or 3. For example, we have implemented a suggestion of Suyama which ensures that g ... |

3 |
Evaluating polynomials using rational auxiliary functions, IBM Technical Disclosure Bulletin 13
- Winograd
- 1970
(Show Context)
Citation Context ... ; x r and x 1 ; : : : ; x s in O((r + s)e) group operations. The values of x j do not need to be stored, so storage requirements are O(r) even if s AE r. Moreover, by use of rational preconditioning =-=[22, 29]-=- it is easy to evaluate (9.1) in (r + O(log r))s=2 multiplications. Using these ideas we obtain a speedup of about 6.6 over the one-phase algorithm for p = 10 20 . 9.2 Other second phases Our birthday... |

1 | Lenstra's Algorithm for Factoring with Elliptic Curves (expos'e - Bach - 1985 |

1 |
Elliptic Curve Factorization, personal communication via Samuel Wagstaff Jr
- Lenstra
- 1985
(Show Context)
Citation Context ...factorization algorithm. 1 Introduction Recently H.W. Lenstra Jr. proposed a new integer factorization algorithm, which we shall call "Lenstra's algorithm" or the "one-phase elliptic cu=-=rve algorithm" [17]. Under so-=-me plausible assumptions Lenstra's algorithm finds a prime factor p of a large composite integer N in expected time T 1 (p) = exp `q (2 + o(1)) ln p ln ln p ' ; (1:1) where "o(1)" means a te... |

1 |
Speeding the Pollard methods of factorization, preprint
- Montgomery
- 1983
(Show Context)
Citation Context ...up. Conversely, the conventional second phases for Pollard's "p \Gamma 1" algorithm can be adapted to give second phases for elliptic curve algorithms, and various tricks can be used to spee=-=d them up [19]-=-. Theoretically these algorithms give a speedup of the order log log(p) over the one-phase algorithms, which is not as good as the log(p) speedup for the birthday paradox algorithm [6]. However, in pr... |

1 | Factorization of the tenth Fermat number, Mathematics of Computation 68 - Brent - 1999 |