Prime Numbers
Share Embed Flag
Download ePaper

Prime Numbers

Prime Numbers Prime Numbers

thales.doa.fmph.uniba.sk
from thales.doa.fmph.uniba.sk More from this publisher
10.12.2012 Views

7.8 Research problems 385 is prime. For more information on “rapid” primality proofs, see [Pomerance 1987a] and the discussion in [Williams 1998, p. 366] in regard to numbers of certain ternary form. 7.34. An interesting problem one may address after having found a factor via an ECM scheme such as Algorithm 7.4.4 is this: What is the actual group order that allowed the factor discovery? One approach, which has been used in [Brent et al. 2000], is simply to “backtrack” on the stage limits until the precise largest- and second-largest primes are found, and so on until the group order is completely factored. But another way is simply to obtain, via Algorithm 7.5.6, say, the actual order. To this end, work out the preparatory curve algebra as follows. First, show that if a curve is constructed according to Theorem 7.4.3, then the rational initial point x/z = u 3 /v 3 satisfies x 3 + Cx 2 z + xz 2 = σ 2 − 5 3 125 − 105σ 2 − 21σ 4 + σ 6 2 in the ring. Then deduce that the order of the curve is either the order of y 2 = x 3 + ax + b, or the order of the twist, depending respectively on whether ( σ3−5σ p )=1or −1, where affine parameters a, b are computed from γ = (v − u)3 (3u + v) 4u 3 v a =1− 1 3 γ2 , b = 2 27 γ3 − 1 3 γ. − 2, These machinations suggest a straightforward algorithm for finding the order of the curve that discovered a factor p. Namely, one uses the starting seed σ, calculates again if necessary the u, v field parameters, then applies the above formulae to get an affine curve parameter pair (a, b),whichinturncanbe used directly in the Schoof algorithm. Here is an explicit example of the workings of this method. The McIntosh– Tardif factor p = 81274690703860512587777 of F18 was found with seed parameter σ = 16500076. One finds with the above formulae that a = 26882295688729303004012, b = 10541033639146374421403,

386 Chapter 7 ELLIPTIC CURVE ARITHMETIC and Algorithm 7.5.6 determines the curve order as #E = 81274690703989163570820 =2 2 · 3 · 5 · 23 · 43 · 67 · 149 · 2011 · 2341 · 3571 · 8161. Indeed, looking at the two largest prime factors here, we see that the factor could have been found with respective stage limits as low as B1 = 4000, B2 = 10000. R. McIntosh and C. Tardif actually used 100000, 4000000, respectively, but as always with ECM, what we might call post-factoring hindsight is a low-cost commodity. Note also the explicit verification that the Brent parameterization method indeed yields a curve whose order is divisible by twelve, as expected. If you are in possession of sufficiently high-precision software, here is another useful test of the above ideas. Take the known prime factor p = 4485296422913 of F21, and for the specific Brent parameter σ = 1536151048, find the elliptic-curve group order (mod p), and show that stage limits B1 = 60000, B2 = 3000000 (being the actual pair used originally in practice to drive this example of hindsight) suffice to discover the factor p.

386 Chapter 7 ELLIPTIC CURVE ARITHMETIC<br />

and Algorithm 7.5.6 determines the curve order as<br />

#E = 81274690703989163570820<br />

=2 2 · 3 · 5 · 23 · 43 · 67 · 149 · 2011 · 2341 · 3571 · 8161.<br />

Indeed, looking at the two largest prime factors here, we see that the factor<br />

could have been found with respective stage limits as low as B1 = 4000, B2 =<br />

10000. R. McIntosh and C. Tardif actually used 100000, 4000000, respectively,<br />

but as always with ECM, what we might call post-factoring hindsight is<br />

a low-cost commodity. Note also the explicit verification that the Brent<br />

parameterization method indeed yields a curve whose order is divisible by<br />

twelve, as expected.<br />

If you are in possession of sufficiently high-precision software, here is<br />

another useful test of the above ideas. Take the known prime factor p =<br />

4485296422913 of F21, and for the specific Brent parameter σ = 1536151048,<br />

find the elliptic-curve group order (mod p), and show that stage limits<br />

B1 = 60000, B2 = 3000000 (being the actual pair used originally in practice<br />

to drive this example of hindsight) suffice to discover the factor p.

logo

products

Resources

Company

Terms of service
Privacy policy
Cookie policy
Cookie settings
Imprint
Change language
Made with love in Switzerland
© 2024 Yumpu.com all rights reserved

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!