Prime Numbers

336 Chapter 7 ELLIPTIC CURVE ARITHMETIC
7.4.1 Basic ECM algorithm
The ECM algorithm uses many of the concepts of elliptic arithmetic developed
in the preceding sections. However, we shall be applying this arithmetic to a
construct Ea,b(Zn), something that is not a true elliptic curve, when n is a
composite number.
Definition 7.4.1. For elements a, b in the ring Zn, withgcd(n, 6) = 1 and
discriminant condition gcd(4a 3 +27b 2 ,n) = 1, an elliptic pseudocurve over
theringisaset
Ea,b(Zn) ={(x, y) ∈ Zn × Zn : y 2 = x 3 + ax + b}∪{O},
where O is the point at infinity. (Thus an elliptic curve over Fp = Zp from
Definition 7.1.1 is also an elliptic pseudocurve.)
(Curves given in the form (7.5) are also considered as pseudocurves, with the
appropriate discriminant condition holding.) We have seen in Section 7.1 that
when n is prime, the point at infinity refers to the one extra projective point
on the curve that does not correspond to an affine point. When n is composite,
there are additional projective points not corresponding to affine points, yet
in our definition of pseudocurve, we still allow only the one extra point,
corresponding to the projective solution [0, 1, 0]. Because of this (intentional)
shortchanging in our definition, the pseudocurve Ea,b(Zn), together with the
operations of Definition 7.1.2, does not form a group (when n is composite).
In particular, there are pairs of points P, Q for which “P + Q” is undefined.
This would be detected in the construction of the slope m in Definition 7.1.2;
since Zn is not a field when n is composite, one would be called upon to
invert a nonzero member of Zn that is not invertible. This group-law failure
is the motive for the name “pseudocurve,” yet, happily, there are powerful
applications of the pseudocurve concept. In particular, Algorithm 2.1.4 (the
extended Euclid algorithm), if called upon to find the inverse of a nonzero
member of Zn that is in fact noninvertible, will instead produce a nontrivial
factor of n. It is Lenstra’s ingenious idea that through this failure of finding
an inverse, we shall be able to factor the composite number n.
We note in passing that the concept of elliptic multiplication on a
pseudocurve depends on the addition chain used. For example, [5]P may be
perfectly well computable if one computes it via P → [2]P → [4]P → [5]P ,
but the elliptic addition may break down if one tries to compute it via
P → [2]P → [3]P → [5]P . Nevertheless, if two different addition chains
to arrive at [k]P both succeed, they will give the same answer.
Algorithm 7.4.2 (Lenstra elliptic curve method (ECM)). Given a composite
number n to be factored, gcd(n, 6) = 1, andn not a proper power, this
algorithm attempts to uncover a nontrivial factor of n. There is a tunable parameter
B1 called the “stage-one limit” in view of further algorithmic stages in the
modern ECM to follow.
1. [Choose B1 limit]