
\input amstex


\magnification=1200


\loadmsbm

\input colordvi

\nopagenumbers
\parindent=0pt

\def\cgy{\GreenYellow}     % GreenYellow  Approximate PANTONE 388
\def\cyy{\Yellow}	  % Yellow  Approximate PANTONE YELLOW
\def\cgo{\Goldenrod}	  % Goldenrod  Approximate PANTONE 109
\def\cda{\Dandelion}	  % Dandelion  Approximate PANTONE 123
\def\capr{\Apricot}	  % Apricot  Approximate PANTONE 1565
\def\cpe{\Peach}		  % Peach  Approximate PANTONE 164
\def\cme{\Melon}		  % Melon  Approximate PANTONE 177
\def\cyo{\YellowOrange}	  % YellowOrange  Approximate PANTONE 130
\def\coo{\Orange}	  % Orange  Approximate PANTONE ORANGE-021
\def\cbo{\BurntOrange}	  % BurntOrange  Approximate PANTONE 388
\def\cbs{\Bittersweet}	  % Bittersweet  Approximate PANTONE 167
%\def\creo{\RedOrange}	  % RedOrange  Approximate PANTONE 179
\def\cma{\Mahogany}	  % Mahogany  Approximate PANTONE 484
\def\cmr{\Maroon}	  % Maroon  Approximate PANTONE 201
\def\cbr{\BrickRed}	  % BrickRed  Approximate PANTONE 1805
\def\crr{\Red}		  % Red  VERY-Approx PANTONE RED
\def\cor{\OrangeRed}	  % OrangeRed  No PANTONE match
\def\paru{\RubineRed}	  % RubineRed  Approximate PANTONE RUBINE-RED
\def\cwi{\WildStrawberry}  % WildStrawberry  Approximate PANTONE 206
\def\csa{\Salmon}	  % Salmon  Approximate PANTONE 183
\def\ccp{\CarnationPink}	  % CarnationPink  Approximate PANTONE 218
\def\cmag{\Magenta}	  % Magenta  Approximate PANTONE PROCESS-MAGENTA
\def\cvr{\VioletRed}	  % VioletRed  Approximate PANTONE 219
\def\parh{\Rhodamine}	  % Rhodamine  Approximate PANTONE RHODAMINE-RED
\def\cmu{\Mulberry}	  % Mulberry  Approximate PANTONE 241
\def\parv{\RedViolet}	  % RedViolet  Approximate PANTONE 234
\def\cfu{\Fuchsia}	  % Fuchsia  Approximate PANTONE 248
\def\cla{\Lavender}	  % Lavender  Approximate PANTONE 223
\def\cth{\Thistle}	  % Thistle  Approximate PANTONE 245
\def\corc{\Orchid}	  % Orchid  Approximate PANTONE 252
\def\cdo{\DarkOrchid}	  % DarkOrchid  No PANTONE match
\def\cpu{\Purple}	  % Purple  Approximate PANTONE PURPLE
\def\cpl{\Plum}		  % Plum  VERY-Approx PANTONE 518
\def\cvi{\Violet}	  % Violet  Approximate PANTONE VIOLET
\def\parp{\RoyalPurple}	  % RoyalPurple  Approximate PANTONE 267
\def\cbv{\BlueViolet}	  % BlueViolet  Approximate PANTONE 2755
\def\cpe{\Periwinkle}	  % Periwinkle  Approximate PANTONE 2715
\def\ccb{\CadetBlue}	  % CadetBlue  Approximate PANTONE (534+535)/2
\def\cco{\CornflowerBlue}  % CornflowerBlue  Approximate PANTONE 292
\def\cmb{\MidnightBlue}	  % MidnightBlue  Approximate PANTONE 302
\def\cnb{\NavyBlue}	  % NavyBlue  Approximate PANTONE 293
\def\crb{\RoyalBlue}	  % RoyalBlue  No PANTONE match
%\def\cbb{\Blue}		  % Blue  Approximate PANTONE BLUE-072
\def\cce{\Cerulean}	  % Cerulean  Approximate PANTONE 3005
\def\ccy{\Cyan}		  % Cyan  Approximate PANTONE PROCESS-CYAN
\def\cpb{\ProcessBlue}	  % ProcessBlue  Approximate PANTONE PROCESS-BLUE
\def\csb{\SkyBlue}	  % SkyBlue  Approximate PANTONE 2985
\def\ctu{\Turquoise}	  % Turquoise  Approximate PANTONE (312+313)/2
\def\ctb{\TealBlue}	  % TealBlue  Approximate PANTONE 3145
\def\caq{\Aquamarine}	  % Aquamarine  Approximate PANTONE 3135
\def\cbg{\BlueGreen}	  % BlueGreen  Approximate PANTONE 320
\def\cem{\Emerald}	  % Emerald  No PANTONE match
\def\cjg{\JungleGreen}	  % JungleGreen  Approximate PANTONE 328
\def\csg{\SeaGreen}	  % SeaGreen  Approximate PANTONE 3268
\def\cgg{\Green}	  % Green  VERY-Approx PANTONE GREEN
\def\cfg{\ForestGreen}	  % ForestGreen  Approximate PANTONE 349
\def\cpg{\PineGreen}	  % PineGreen  Approximate PANTONE 323
\def\clg{\LimeGreen}	  % LimeGreen  No PANTONE match
\def\cyg{\YellowGreen}	  % YellowGreen  Approximate PANTONE 375
\def\cspg{\SpringGreen}	  % SpringGreen  Approximate PANTONE 381
\def\cog{\OliveGreen}	  % OliveGreen  Approximate PANTONE 582
\def\pars{\RawSienna}	  % RawSienna  Approximate PANTONE 154
\def\cse{\Sepia}		  % Sepia  Approximate PANTONE 161
\def\cbr{\Brown}		  % Brown  Approximate PANTONE 1615
\def\cta{\Tan}		  % Tan  No PANTONE match
\def\cgr{\Gray}		  % Gray  Approximate PANTONE COOL-GRAY-8
\def\cbl{\Black}		  % Black  Approximate PANTONE PROCESS-BLACK
\def\cwh{\White}		  % White  No PANTONE match


\voffset=-.5in
\hoffset=-.3in
\hsize = 7.2 true in
\vsize=10.2 true in

%\voffset=1.2in
%\hoffset=-.5in
%\hsize = 10.2 true in
%\vsize=8 true in

\overfullrule=0pt


\def\ctln{\centerline}
\def\u{\underbar}
\def\ssk{\smallskip}
\def\msk{\medskip}
\def\bsk{\bigskip}
\def\hsk{\hskip.1in}
\def\hhsk{\hskip.2in}
\def\dsl{\displaystyle}
\def\hskp{\hskip1.5in}

\def\delx{{{\partial}\over{\partial x}}}
\def\dely{{{\partial}\over{\partial y}}}

\def\moda{\medspace {\underset a\to \equiv} \medspace}
\def\modb{\medspace {\underset b\to \equiv} \medspace}
\def\modc{\medspace {\underset c\to \equiv} \medspace}

\def\lra{$\Leftrightarrow$ }


\ctln{\bf Math 445 Number Theory}

\ssk

\ctln{December 6, 2004}

\msk

{\bf Factoring integers using elliptic curves: the Elliptic Curve Method}

\msk

The idea: use elliptic curves  to factor large integers. It uses 
the group operation on ${\Cal C}_f({\Bbb Q})$ , and is based 
on the fact that for a \underbar{finite} group $G$, with
order $n$, every element $g\in G$ satisfies $n\cdot g=0$. 

\ssk

Starting point: \crr{the Pollard $(p-1)$-test.} 
If $N$ is a (large) integer, with \crr{prime factor $p$}, then
by Fermat, $(a,p)=1$ implies $p|a^{p-1}-1$, 
and so the g.c.d. \crr{$(a^{p-1}-1,N)>1$}.
If we \underbar{guess} that
$p-1$ consists of a product of fairly small primes, we can
test $(a^{n}-1,N)$ for $n$ a (large) product of 
fairly small numbers, to arrange
$1<(a^n,N)<N$ , giving
us a proper factor of $N$. In practice, we start with 
a randomly chosen $a$, and a sequence of fairly
small numbers $r_n$, like $r_n=n$. We then \crr{form 
the sequence} $a_1=a$, $a_2=a_1^{r_1}=a^{r_1}$, 
$a_3=a_2^{r_2}=a^{r_1r_2}$, and
\crr{inductively, $a_{i+1}=a_i^{r_i}=a^{r_1\cdots r_i}$, 
and compute $g_i=(a_i-1,N)$}. Since
$a_i-1|a_{i+1}-1$ for every $i$,
so $g_i|g_{i+1}$ for every $i$, we compute 
the g.c.d.'s only occasionally (since we expect to 
get $g_i=1$ for awhile). The process will stop, 
since for any prime divisor $p$ of $N$,
$p-1$ will divide $r_1\cdots r_n=1\cdot 2\cdots n$ for 
some $n$, so $g_n>1$. It might be that $g_n=N$, 
though, and so the test 
fails; we then restart with a different $a$. Typically 
we must wait until $i$ is around the smallest 
of the largest prime factors of  the $p-1$, where $p$ ranges 
among all of the prime factors of $N$. The problem: this 
could be fairly large!

\msk

For the ECM, the basic idea is to take the machinery we 
have developed for \crr{computing on elliptic curves, and do all of
the calculations mod $p$, for some (unknown!) 
prime dividing $N$}. In practice, this really means we do 
the calculations mod $N$. Using the formulas for 
addition we have from above, we can 
create an addition 
formula for points in what we choose to call 
${\Cal C}_f({\Bbb Z}_p)$ . The formulas involve 
division; mod $p$, we use  multiplication 
by the inverse (which we
 find by the Euclidean algorithm). We still need 
to know that this form of addition on 
${\Cal C}_f({\Bbb Z}_p)$ gives us a group; this
 can 
be verified directly  
from the formulas (including associativity!). 

\ssk

\crr{$\dsl A+B = ({{m^2-b}\over{a}}-a_1-b_1,-(a_2+m({{m^2-b}\over{a}}-2a_1-b_1))$ , where
$\dsl m={{b_2-a_2}\over{b_1-a_1}}$ }

\crr{$\dsl 2A = ({{M^2-b}\over{a}}-2a_1,-(a_2+m({{M^2-b}\over{a}}-3a_1))$ , where
$\dsl M={{3a_1^2+2aa_1+b}\over{2a_2}}$}

\ssk

To implement the ECM to find a factor of an integer $N$, 
we \crr{pick an elliptic curve ${\Cal C}_f({\Bbb Z}_p)$ ,
for $f(x,y)=y^2-(x^2+ax+b)$ , by 
choosing values for $a$ and $b$, and a point $A$ on the 
curve.} [Usually we work the other
way around; pick a point, such 
as $A=(1,1)$, and choose the values of $a$ and $b$
accordingly.] ${\Cal C}_f({\Bbb Z}_p)$ is a group of 
some finite (but unknown) order; the idea is
that we \underbar{expect} that for some choices of 
$a$ and $b$, it has order a product of small primes, and so
a calculation like the one in the Pollard $(p-1)$-test 
will quickly succeed. But this is where the fun starts!

\ssk

We \crr{compute high multiples $r_1\cdots r_n A$ 
of the point $A$}; as we did
long ago, we write $r_1\cdots r_n = 2^{i_1}+\cdot +2^{i_k}$
and compute $2^{i_j}A$ 
by repeated doubling, and then adding 
together the $2^{i_j}A$ together.
We want to compute mod $p$, but we \underbar{can't}; we don't know
$p$ ! Instead we compute mod $N$ (while 
pretending we are computing in ${\Cal C}_f({\Bbb Z}_p)$).
But this will not always work; not every integer has an 
inverse mod $N$. So \crr{we might
eventually fail to be able to compute a step. But 
this is a good thing! We will fail, because the 
quantity we need to invert, $b_1-a_1$, is not relatively 
prime to $N$, i.e., $(b_1-a_1,N)>1$ }
(or, when doubling, \hhsk $((2a_2),N)>1$). 
Unless this is a multiple of $N$ 
we have found what 
we want; a proper factor of $N$! 

\ssk

In point of fact, this is 
what the method is designed to do; we don't
want to find the order of $A$ in ${\Cal C}_f({\Bbb Z}_p)$, 
since the order of this group really 
has no relation to $N$. It can, in fact, be any number 
between $p+1-2\sqrt{p}$ and $p+1+2\sqrt{p}$.
What we really want to do is to discover that we 
\underbar{can't} compute the order, because the
formulas break down and finds a factor of $N$, before
the computation finishes. The point is that by varying 
the curve, we should be able to stumble across 
an $f$ for which ${\Cal C}_f({\Bbb Z}_p)$ will 
yield a computation that breaks down.
We typically 
keep the size of $r_1\cdots r_n$ around $\sqrt{N}$, so 
it is at least the expected size of ${\Cal C}_f({\Bbb Z}_p)$
for $p$ the smallest prime dividing $N$, and vary the function $f$.



\vfill
\end





The elliptic curve method attempts to get around this 
problem. The basic idea behind the method above is that
we are attempting to express the identity element in 
${\Bbb Z}_p^*$ (the group of units of ${\Bbb Z}_p$), as 
a power of some number $a$, where the power is a 
product of fairly small numbers. [The fun part is that 
we are doing this without actually choosing $p$ first!] 
The problem is that we are not guaranteed a $p$ where
products of small numbers will \underbar{work}. The 
ECM takes this problem and translates it into a 
framework where it is much more likely to work, 
using elliptic curves mod $p$. 

\ssk






















