dissertacao.pdf

2.2.2 Pollard’s ρ Algorithm
Pollard’s ρ Algorithm, described by Pollard in 1975[35], aims to find a small
factor p of a given integer N. Because of this focusing on a small factor of N,
Pollard’s ρ is considered a special purpose factoring algorithm. We present a
simplified version the algorithm:
Algorithm 6. Pollard’s ρ Algorithm: Given a composite N:
1. Set a = 2, b = 2.
2. Define the modular polynomial f(x) = (x 2 + c) (mod N) with c = 0, −2
3. For i=1,2,.., do:
(a) Compute a = f(a), b = f(f(b)).
(b) Compute d = (a − b, N).
(c) If 1 < d < N then return d with success.
(d) If d = N then terminate the algorithm with failure.
The function f is used to create two pseudo random sequences on ZN. The
reason for this is that, picking randomly two numbers x, y ∈ ZN , there is a
probability of 0.5 that after 1.777 √ N tries one will be congruent modulo N[37].
If they are and a = b, then (a − b, N) yields a factor of N.
The runtime of the algorithm is O( √ p)[24], where p is N’s smallest prime
factor. This means that against an RSA modulus N with balanced primes the
runtime of the algorithm is O(N 1
4 ), making it an inefficient method.
2.2.3 Elliptic Curve Method
In 1985, Hendrik Lenstra had a visionary idea. He thought of using Elliptic
Curves to factor integers. It is said that that Lenstra’s discovery was based on
Pollard’s (ρ − 1) method[44], a variant of Pollard’s ρ method described above.
The Elliptic Curve Method’s (ECM) running time depends on the smallest
factor p of the integer N being factored, making it particularly powerful for
finding ”medium-sized” factors of large integers. As we will show in the next
section, ECM is not used directly to factor RSA modulus, instead it is used as
an auxiliary step in the General Number Field Sieve algorithm [44] described in
the next section. The basis of the algorithm is the following result:
29