Prime Numbers

7.8 Research problems 385
is prime.
For more information on “rapid” primality proofs, see [Pomerance 1987a]
and the discussion in [Williams 1998, p. 366] in regard to numbers of certain
ternary form.
7.34. An interesting problem one may address after having found a factor
via an ECM scheme such as Algorithm 7.4.4 is this: What is the actual group
order that allowed the factor discovery?
One approach, which has been used in [Brent et al. 2000], is simply to
“backtrack” on the stage limits until the precise largest- and second-largest
primes are found, and so on until the group order is completely factored.
But another way is simply to obtain, via Algorithm 7.5.6, say, the actual
order. To this end, work out the preparatory curve algebra as follows. First,
show that if a curve is constructed according to Theorem 7.4.3, then the
rational initial point x/z = u 3 /v 3 satisfies
x 3 + Cx 2 z + xz 2 = σ 2 − 5 3 125 − 105σ 2 − 21σ 4 + σ 6 2
in the ring. Then deduce that the order of the curve is either the order of
y 2 = x 3 + ax + b,
or the order of the twist, depending respectively on whether ( σ3−5σ p )=1or
−1, where affine parameters a, b are computed from
γ = (v − u)3 (3u + v)
4u 3 v
a =1− 1
3 γ2 ,
b = 2
27 γ3 − 1
3 γ.
− 2,
These machinations suggest a straightforward algorithm for finding the order
of the curve that discovered a factor p. Namely, one uses the starting seed σ,
calculates again if necessary the u, v field parameters, then applies the above
formulae to get an affine curve parameter pair (a, b),whichinturncanbe
used directly in the Schoof algorithm.
Here is an explicit example of the workings of this method. The McIntosh–
Tardif factor
p = 81274690703860512587777
of F18 was found with seed parameter σ = 16500076. One finds with the above
formulae that
a = 26882295688729303004012,
b = 10541033639146374421403,