Prime Numbers

7.4 Elliptic curve method 341
propagates forever afterward during further evaluations of functions addh()
and doubleh(). Thus, the parameterization in question allows us to continually
check gcd(n, Z), and if this is ever greater than 1, it may well be the hidden
factor p. In practice, we “accumulate” Z-coordinates, and take the gcd only
rarely, for example after stage one, and as we shall see, one final time after a
stage two.
On enhancement (2), it is an observation of Suyama that under
Montgomery parameterization the group order #E is divisible by 4. But
one can press further, to ensure that the order be divisible by 8, 12, or even
16. Thus, in regard to enhancement (2) above, we can make good use of a
convenient result [Brent et al. 2000]:
Theorem 7.4.3 (ECM curve construction). Define an elliptic curve
Eσ(Fp) to be governed by the cubic
y 2 = x 3 + C(σ)x 2 + x,
where C depends on field parameter σ = 0, 1, 5 according to
u = σ 2 − 5,
v =4σ,
C(σ) = (v − u)3 (3u + v)
4u 3 v
− 2.
Then the order of Eσ is divisible by 12, and moreover, either on E or a twist
E ′ (see Definition 7.2.5) there exists a point whose x-coordinate is u 3 v −3 .
Now we can ignite any new curve attempt by simply choosing a random σ.
We use, then, Algorithm 7.2.7 with homogeneous x-coordinatization starting
in the form X/Z = u 3 /v 3 , proceeding to ignore all y-coordinates throughout
the factorization run. What is more, we do not even care whether an initial
point is on E or its twist, again because y-coordinate ignorance is allowed.
On enhancements (3), there are ideas that can reduce stage-two computations.
One trick that some researchers enjoy is to use a “birthday paradox”
second stage, which amounts to using semirandom multiples for two sets of coordinates,
and this can sometimes yield performance advantages [Brent et al.
2000]. But there are some ideas that apply in the scenario of simply checking
all outlying primes q up to some “stage-two limit” B2 >B1; that is, without
any special list-matching schemes. Here is a very practical method that
reduces the computational effort asymptotically down to just two (or fewer)
multiplies (mod n) for each outlying prime candidate. We have already argued
above that if qn,qn+1 are consecutive primes, one can add some stored multiple
[∆n]Q to any current calculation [qn]Q to get the next point [qn+1]Q, and
that this involves just one elliptic operation per prime qm. Though that may be
impressive, we recall that an elliptic operation is a handful, say, of multiplies
(mod n). We can bring the complexity down simply, yet dramatically, as follows.
If we know, for some prime r, the multiple [r]Q =[Xr : Zr] and we have