S S symmetry

Article The Improvement of Method to Recover RSA’s Prime Factors

Kritsanapong Somsuk

Department of Computer and Communication Engineering, Faculty of Technology, Udon Thani Rajabhat University, UDRU, Udon Thani 41000, Thailand; [email protected]

Abstract: Elliptic Curve Factorization Method (ECM) is the general-purpose factoring method used in the digital computer era. It is based on the medium length of the modulus; ECM is an efficient when the length of modulus is between 40 and 50 digits. In fact, the main costs for each iteration are modular inverse, modular multiplication, modular and greatest common . However, when compared to modular multiplication and modular square, the costs of modular inverse and are very high. The aim of this paper is to improve ECM in order to reduce the costs to compute both of modular inverse and greatest common divisor. The proposed method is called Fast Elliptic Curve Factorization Method (F-ECM). For every two adjacent points on the curve, only one modular inverse and one greatest common divisor will be computed. That means it implies that the costs in both of them can be split in half. Furthermore, the length of modulus in the experiment spans from 30 to 65 bits. The experimental results show that F-ECM can finish the task faster than ECM for all cases of the modulus. Furthermore, the computation time is reduced by 30 to 38 percent.

  Keywords: ECM; F-ECM; computation time; RSA; modulus

Citation: Somsuk, K. The Improvement of Elliptic Curve Factorization Method to Recover 1. Introduction RSA’s Prime Factors. Symmetry 2021, 13, 1314. https://doi.org/10.3390/ RSA [1] is one of the most well-known in the digital com- sym13081314 puter era. It is classified as asymmetric key cryptography or public key cryptography [2]. In fact, this algorithm which was proposed in 1977 by Ron Rivest, and Leonard Academic Editor: Debiao He Adleman, can be used to secure secret information transferred via an unsecure channel as well as sign digital signatures. RSA algorithm, on the other hand, is based on the integer Received: 26 June 2021 factorization problem [3,4]. As a result, when one of the two prime factors is revealed, RSA Accepted: 20 July 2021 is broken. Furthermore, there are two types of integer factorization algorithms [5]. The Published: 21 July 2021 first category is known as special-purpose factoring. The efficiency of each algorithm in this is determined by the properties of prime factors. The other group is known Publisher’s Note: MDPI stays neutral as general-purpose factoring, and the algorithms are based on the length of the modulus. with regard to jurisdictional claims in Assuming that two strong prime factors and 1024 bits of the modulus are selected, none of published maps and institutional affil- proposed integer factorization algorithms can break RSA in polynomial time by using the iations. digital computer. Elliptic Curve Cryptography (ECC) [6,7] is another public key cryptography that can be used for data security as well as . In addition, Neal Koblitz and Victor S. Miller proposed ECC in 1985. Despite the fact that the bit-length of ECC is shorter, the Copyright: © 2021 by the author. security level is the same as RSA. ECC, on the other hand, differs from RSA in which it Licensee MDPI, Basel, Switzerland. is based on the Elliptic Curve Problem (ECDLP) [8–10]. Moreover, This article is an open access article Elliptic Curve can be used to factor the as well. That is, it is possible to distributed under the terms and break RSA. The Lenstra Elliptic Curve Factorization or Elliptic Curve Factorization Method conditions of the Creative Commons (ECM) is used for this task. However, ECM requires a large number of modular inverses Attribution (CC BY) license (https:// and greatest common , which are known as the expensive costs. That is, it takes a creativecommons.org/licenses/by/ significant amount of time to finish the task. 4.0/).

Symmetry 2021, 13, 1314. https://doi.org/10.3390/sym13081314 https://www.mdpi.com/journal/symmetry Symmetry 2021, 13, 1314 2 of 15

The modified method for speeding ECM is proposed in this paper. In fact, the proposed method is known as the Fast Elliptic Curve Factorization Method (F-ECM). The main idea is to reduce the number of modular inverses and greatest common divisors in order to shorten the computation time. Even though the number of modular multiplications and modular squares are increased, these costs are very low when compared to modular inverse and greatest common divisor. In fact, every classical algorithm linked to the RSA and ECC algorithms is the digital computer-based. If the digital computer era is not disrupted, they are all still effective. Therefore, it implies that F-ECM is still an efficient method for the medium length of the modulus in the digital computer era. However, if the quantum computer that is being developed becomes practical, all algorithms pertaining to digital technology, including RSA, ECC and the block chain that is controlled by cryptography, will be insecure. For example, RSA may be easily broken by using Shor’s [11] when the quantum computer is completely used. As a result, if such a scenario occurs, new security algorithms based on quantum computers may be devised in order to control all technology at the time. The rest of the paper is organized as follows. In Section2, RSA and ECC which are public key cryptography are reviewed. Some integer factorization algorithms will be mentioned in Section3. The overviews of and Shor’s Factoring algorithm will be mentioned in Section4. The proposed method is presented in Section5. Loop analysis will be discussed in Section6. In Section7, the experimental results about the comparison between ECM and F-ECM are shown. The conclusion is discussed in the last section.

2. Overviews of RSA and ECC The idea behind public key cryptography is that the encryption and decryption processes necessitate the use of a pair of keys that are mathematically related to one another. The first key, named the public key, is made available to all group members. The owner keeps the other key, known as the private key, hidden. In fact, if one of the keys is chosen for encryption, the other must be chosen for decryption. Furthermore, for data security, the public key is used in the encryption process. In the case of digital signatures, however, the private key is used in this process. This section examines two types of public key cryptography algorithms, RSA and ECC.

2.1. RSA RSA algorithm is a type of public key cryptography. Its security is based on the integer factorization problem. As a result, it should be assigned at least 1024 bits to avoid intruders attacking rapidly. Furthermore, RSA can be used for a variety of tasks, including data security and digital signatures. For RSA, there are three processes: the key generation algorithm, the encryption and the decryption. However, the processes for data security are as follows: Process 1 (Key generation Algorithm): it is the algorithm to generate a pair of keys and the modulus. There are four steps as follows: Step 1: Choose two prime numbers randomly, p and q Step 2: Calculate the modulus, n = p ∗ q, and calculate the Euler totient function, Φ(n) = (p − 1) ∗ (q − 1), using the Extended Euclidean Algorithms [12–14] Step 3: Choose the public key (e) from the following conditions, 1 < e < Φ(n) and gcd (e, Φ(n)) = 1 Step 4: Compute the private key (d) from the following equation, e ∗ d mod Φ(n) = 1 Where, the public key is {e, n} and the private key is {d, n} Process 2 (Encryption): senders must convert the original plaintext (m) into the unreadable message or the ciphertext (c). There are three steps as follows: Step 1: Receive the receiver’s public key {e, n} Step 2: Represent m as the positive integer, M, where 1 < M < n Symmetry 2021, 13, 1314 3 of 15

Step 3: Encrypt M by using the Equation (1):

c = Memod n (1)

Step 4: Send c to receivers Process 3 (Decryption): After receiving c, receivers can recover m by using the following steps: Step 1: Use the private key {d, n} to decrypt c by using the Equation (2):

M = cdmod n (2)

Step 2: Transform M as the original plaintext, m For this system, p and q are the attackers’ target, because Φ(n) can be computed rapidly to recover d.

2.2. Elliptic Curve Cryptography Another type of public key cryptography is Elliptic Curve Cryptography (ECC). This method comes in a variety of forms, including ECC over Field of Characteristic Two, ECC over Field of Characteristic Three and ECC over Finite Field (Zp), where p is a . However, only ECC over Finite Field (Zp) is focused in this paper. Assuming that p is a prime number, the ECC’s equation over Finite Field (Zp) is as follows:

y2 = x3 + ax + b mod p (3)

where, 4a3 + 27b2 mod p 6= 0. Assuming that P = (xp, yp) and Q = (xq, yq) are the points on the curve, the main processes for finding the new point on the curve are point addition and point doubling. In fact, there are two cases to find R = (xr, yr) = P + Q as follows: Case 1 (P = Q): Point doubling is required:

2 3xp + a m = mod p (4) 2yp

2 xr = m − 2xp mod p (5)

yr = m(xp − xr) − yp mod p (6) Case 2 (P 6= Q): Point addition is required:

yq − yp m = mod p (7) xq − xp

2 xr = m − xq − xp mod p (8)

yr = m(xp − xr) − yp mod p (9) Assuming that I, M, S and G are represented as the number of modular inverses, number of modular multiplications, number of modular squares and number of greatest common divisor computations, point doubling requires 1I, 2M and 2S. On the other hand, point addition requires 1I, 2M and 1S. Assuming that 2P + Q must be calculated, there are two ways to complete this task. The first method is to compute 2P and then 2P + Q. It requires 2I, 4M and 3S. The second technique is to compute P + Q and then compute (P + Q) + P = 2P + Q. It requires 2I, 4M and 2S. As a result, the total costs of the second method are lower than those of the first method. Therefore, choosing the best method to find the new point should also be taken into account. Symmetry 2021, 13, 1314 4 of 15

In 2003, an improved technique for speeding up ECC was introduced [15]. However, only Equations (7) and (8) are computed, then yr is not included. The next process is to compute S = (xs, ys) = R + P = 2P + Q from the following idea: y −y First, compute m = r p mod p xr−xp From (6), m0(x −x )−y −y m = p r p p mod p xr−xp m0(x −x )−2y −y p r p p mod p xr−xp Therefore, 2yp m = −m0 − mod p (10) xr − xp y −y where, m0 = q p mod p xq−xp Since yr is not included to compute R = P + Q, this result requires 1I, 1M and 1S. However, the algorithm to compute S = R + P = 2P + Q requires 1I, 2M and 1S. Therefore, the total costs to compute 2P + Q are 2I, 3M and 2S. Assuming that Q = kP, where both of Q and P are disclosed, k is the attackers’ target. This problem is known as the Elliptic Curve Discrete Logarithm Problem (ECDLP). In fact, many solutions to solve this problem have been proposed, including brute force attack [16], Baby-Step-Giant-Step [17] and Pohlig-Hellman attack [18]. In addition, the improved method to solve ECDLP [19] was proposed in 2018. This method is based on brute force attack. To reduce the number of modular inverses, every two adjacent points will be computed together. Furthermore, the y-coordinate is removed to decrease number of modular multiplications. Assuming that P = (x1, y1) and 2P = (x2, y2) are disclosed, there are two parts to find the new points. Part 1: Algorithm to find the x-coordinate of 3P = (x3, y3) and the x-coordinate of 4P = (x4, y4), 1 I = (11) 2y2 ∗ (x2 − x1)

m3 = (y2 − y1) ∗ 2y2 ∗ I (12) 2 m4 = (x2 − x1) ∗ (3x2 + a) ∗ I (13) Therefore, the x-coordinate of 3P and 4P can be computed from (14) and (15),

2 x3 = m3 − x2 − x1 (14)

2 x4 = m4 − 2x2 (15)

Part 2: Algorithm to find the x-coordinate of aP = (xa, ya) and x-coordinate of (a + 1) P = (x(a+1), y(a+1)), where a > 4,

1 I = (16) (x(i−1) − x2) ∗ (x(i−2) − x2)

mi = (m(i−2) ∗ (x2 − x(i−2)) − 2y2) ∗ I ∗ (x(i−1) − x2) (17)

m(i+1) = (m(i−1) ∗ (x2 − x(i−1)) − 2y2) ∗ I ∗ (x(i−2) − x2) (18) Therefore, the x-coordinate of aP and (a + 1)P can be computed from (19) and (20),

2 xi = mi − x2 − x(i−2) (19)

2 x(i+1) = m(i+1) − x2 − x(i−2) (20) Symmetry 2021, 13, 1314 5 of 15

From the Equations (11)–(15) and the Equations (16)–(20), it implies that the modular inverse is shared by every two adjacent points. Furthermore, the y-coordinate is not taken into account in the calculation.

3. Overviews of Integer Factorization Algorithms For RSA algorithm, d is easily recovered when both of p and q are found by using some integer factorization algorithms. Since at least 1024 bits of n are assigned and its prime factors are strong in practice, there is currently no efficient algorithm that can break RSA algorithm in polynomial time by using the digital computer. Several algorithms, however, are constantly being developed to solve this problem. Generally, factorization algorithms are classified into two types.

3.1. Special-Purpose Factoring Assuming that some weak points of n or its prime factors are discovered, some algorithms that respond well to the weak point can factor n quickly, even if the length of n is large. These algorithms are organized into a category known as Special-purpose Factoring. The example of algorithms in this group are shown as below: The simplest algorithm in this group is the algorithm (TDA) [20,21]. For the division process, the initial integer is chosen as the divisor of n. If no remainder exists, this divisor is one of the two prime factors of n. The divisor, on the other hand, is changed until the target is found. In fact, there are two types of TDA. The first type is that the initial divisor√ is 3 and it is increased when the result has the remainder. The other is to choose  n as the initial divisor [22] and it must be decreased when the result is not still the target. In 1600, Pierre de Fermat proposed the factorization algorithm which is called Fermat’s Factorization Algorithm (FFA) [23]. In that time, he found that n = p ∗ q can be also rewritten as the following equation: p + q 2 p − q 2 n = ( ) − ( ) (21) 2 2 In fact, FFA’s goal is to find two integers whose difference in perfect square numbers is equal to n. Even though both of p and q are large, this method is very efficient when p is very close to q. Furthermore, many FFA-modified algorithms, such as [24–28], were proposed to reduce computation time. Pollard’s p − 1 algorithm [29] is another factorization algorithm in Special-purpose Factoring group. It was proposed by John Pollard in 1974. When all prime factors of p − 1 or all prime factors of q − 1 are small, this algorithm can recover p and q very quickly. Assuming that k! = (p − 1) ∗ q and according to Fermat’s little theorem, ap–1 mod p = 1 and gcd(a, p) = 1, therefore: ak! ≡ a(p−1)∗q mod p (22) Or, ak! ≡ 1 mod p

Furthermore, p|ak! − 1 and p | n, then gcd(ak! − 1, n) = p In 2011, Murat Sahin presented the factorization algorithm which is called Generalized + Trial Division√ [30]. Assuming√ that a∈ Z , this method is very efficient when a ∗ p is very close to. n In fact, x = n is the initial value to compute gcd(x, n). If the result is not equal to 1, then it is one of two prime factors of n. On the other hand, a = x + 1 and b = x − 1 are chosen to compute gcd(a, n) and gcd(b, n) until one of the results which is not equal to 1 is found.

3.2. General-Purpose Factoring General-purpose Factoring is a class of factorization algorithms whose performance is determined solely by the size of n. That is, the size of n is only a parameter that affects to time to finish the task. As a result, when the length of n is small, all algorithms in this group can factor n quickly. The example of algorithms in this group are shown as below: Symmetry 2021, 13, 1314 6 of 15

The first algorithm is Lenstra elliptic-curve factorization or Elliptic-curve Factorization Method (ECM) [31]. In fact, this algorithm is applied from ECC over finite field (Zp). However, for ECM, the finite field is changed from Zp as Zn, where n = p ∗ q. Therefore, the ECM’ s equation is shown below:

y2 = x3 + ax + b mod n (23)

The idea behind ECM is to find the new point until it cannot be calculated, there is no modular inverse. The prime factor can be recovered from gcd(s, n), where s ∈ Z. Algorithm 1 is shown the steps to recover p and q by using ECM.

Algorithm 1 ECM

Input: n, P = (x1, y1) Output: p, q

1. s ← 2 ∗ y1 mod n 2. t ← gcd(s, n) 3.IF t equals to 1 then 4. I ← s−1 mod n 2 5. m ← (3 ∗ x1 + a) ∗ I mod n 2 6. xt ← m − 2 ∗ x1 mod n 7. yt ← m(x1 − xt) − y1 mod n 8. Else 9. Jumping to step 23 10. End IF 11. While True Do 12. s ← (xt − x1) mod n 13. t ← gcd(s, n) 14. IF t equals to 1 then 15. I ← s−1 mod n 16. m ← (yt − y1) ∗ I mod n 2 17. xt ← m − xt − x1 mod n 18. yt ← m(x1 − xt) − y1 mod n 19. Else 20. Jumping to Step 23 21. End IF 22. End While 23. p ← t 24. q ← n/p

In fact, ECM is suitable for the medium length of n which is between 40 and 50 digits. The next algorithm in this group is (QS) [32]. This algorithm is modified from FFA. In addition, QS is an efficient algorithm when size of n is less than √  2 100 digits. Assuming that m = n and f (a) = (a + m) − n, where a∈ Z. Then, it implies 2 2 that f (a) ≡ (a + m) mod n. The main algorithm is to find X = f (a1) ∗ f (a2) ∗ ... ∗ f (ak), where k∈ Z, that the multiplication of their prime factors can be rewritten as the following 2 2 form: Y = (p1 ∗ p2 ∗ p3 ∗ ... ∗ pl) , where l∈ Z. Therefore,

X2 ≡ Y2 mod n (24)

Therefore, the prime factor can be calculated from p = gcd(X − Y, n). Number Field Sieve (NFS) [33] is known as the best integer factorization algorithm at present. This method is suitable for a large size of n. Even though the length of n is greater than 10100, it is still efficient. In fact, NFS is also categorized into two types, General Number Field Sieve (GNFS) and Special Number Field Sieve (SNFS). Symmetry 2021, 13, 1314 7 of 15

4. Overviews of Quantum Computer and Shor’s Factoring In fact, all of algorithms that mentioned in the Sections2 and3 are developed algo- rithms on a digital computer. At present, there is currently no method or procedure that can break 2048 bits of RSA in a polynomial time. However, RSA along with every other present cryptosystem, is no longer secure if the a fully efficient quantum computer is developed in that time. The quantum computer is a new computer technology that processes data using quantum phenomena. The advantage of a quantum computer is that it can process data much faster. In general, bit is the smallest unit of data in a digital computer. Assuming that computer must evaluate 2-bit data consisting of 00, 01, 10 and 11, the digital computer can only evaluate one of the four conditions in any given time. The quantum computer’s processing unit, on the other hand, is known as a Quantum Bit or Qubit. The strength of this theory is that it gathers all potential conditions as well as the amount of qubits. For instance, a quantum computer with 2-qubit size will be able to divide as 4 conditions at the same time. Consequently, it indicates that the quantum computer can process data much quicker than the digital computer. In 1994, presented integer factorization algorithm [11] that could be run on a quantum computer. Assuming that a quantum computer with various qubits is developed, Shor’s factorization algorithm can retrieve the prime factor of n within a polynomial time. In fact, Shor’s Factoring algorithm is divided into 2 sections as follows. Part 1 (A reduction): This part is performed on the digital computer. Assuming that the order-finding problem is solved, two prime factors of n are found. The process is as follows. First, choose a ∈ Z randomly and consider the sequence 1, a mod n, a2 mod n, a3 mod n, ··· . Assuming that ar ≡ 1 mod n is found, it implies that the sequence repeats every r term. The reason is as follows:

ax+r mod n = ax ∗ ar mod n

Since ar mod n = 1, then:

ax+r mod n = ax mod n

Assuming that r is an even number, then r can be rewritten as r = 2i∗j, where j is an j odd number, then the next step is to compute b0 = a mod n. The next step is to square b0 to acquire b1, b2, b3, ··· until bk is the last value that bk mod n 6= 1. As a result, one of two prime factors is computed from p = gcd(bk − 1, n). Part 2 (A Quantum algorithm): The quantum computer’s algorithm in part 1 is to find r which is known as the period. In addition, quantum Fourier transform is required in this part. However, the algorithm explored in this section is extensively discussed in [11]. However, to solve factorization problem in RSA by using Shor’s factoring algo- rithm, huge amount of quantum gates is required. Assuming that 4096-bit RSA which is the most current software supports is selected to secure the information, 72 ∗ 40963 or 4,947,802,324,992 quantum gates is required to recover two prime factors in polynomial time. Therefore, RSA is still secure at present. In addition, it is the reason that many factorization algorithms and the quantum computer are still continuously developed. In fact, the aim of this paper is to reduce the expensive costs in ECM. Assuming that the quantum computer is perfectly developed, the time required to finish the procedure is certainly decreased if the proposed method is applied in this quantum computer.

5. The Proposed Method In this paper, the new method based on ECM is proposed to speed up the task by using the digital computer. The proposed method is known as the Fast Elliptic Curve Factorization Method (F-ECM). The main idea behind F-ECM derives from integrating the method in [19] with ECC. As a result, three major tasks are limited in order to reduce Symmetry 2021, 13, 1314 8 of 15

computation time. In fact, all of them are modular inverse, greatest common divisor and the determining y-coordinate on the curve. + Let a = (x(i−1) − x2) ∗ (x(i−2) − x2), where i∈ Z and i > 4, and P, 2P, 3P and 4P are disclosed, then p and q can be found when gcd(a, n) > 1. In fact, if this condition is found, both of p and q can be calculated by using the following equations: p = gcd(a, n) and q = n/p. Before using F-ECM, one of several equations for ECC over Finite Field (Zn) must be chosen at first. Therefore, two algorithms are presented in this section. The first algorithm is assigned for generating ECC over Finite Field (Zn). For this algorithm, a and P = (x1, y1) are selected to find b to save the cost to find the new equation. Following that, this algorithm computes 2P = (x2, y2), 3P = (x3, y3) and 4P = (x4, y4). In fact, point doubling is selected to find 2P whereas the method in [19] is chosen to find 3P and 4P in order to reduce the cost to compute modular inverse without computing the y-coordinate. F-ECM is the other algorithm used to retrieve recover p and q. Before using F-ECM to recover p and q, Algorithm 2 is chosen to generate the new ECC over Finite Field (Zn). In this algorithm, two points on the curve must be also constructed, both of which are P and 2P. Furthermore, the x-coordinates of 3P and 4P are computed. However, F-ECM may not be implemented whenever gcd(g, n) 6= 1 or gcd(h, n) 6= 1.

Algorithm 2 Generating the ECC over Finite Field Input: n Output: P = (x1, y1), 2P = (x2, y2), a, b, x3 (3P = (x3, y3)), x4 (4P = (x4, y4)), m3, m4

1. Generating the point P = (x1, y1) randomly, where x1, y1∈ Zn 2. Generating a∈ Zn randomly 2 3 3. b ← (y1 − x1 − ax) mod n 4. t ← 4a3 + 27b2 mod n 5.IF t equals to 0 then 6. Back to Step 1 7. End IF 8. g ← 2y1 mod n 9. IF gcd(g, n) equals to 1 then 10. Computing 2P = (x2, y2) by using point doubling 11. h ← (2y2) ∗ (x2 − x1) mod n 12. IF gcd(h, n) equals to 1 then 13. m ← h−1 mod n 14. m3 ← (y2 − y1) ∗ m ∗ 2y2 mod n 2 15. x3 ← m3 − x2 − x1 mod n 2 16. m4 ← (x2 − x1) ∗ m ∗ (3x2 + a) mod n 2 17. x4 ← m4 − 2x2 mod n 18. End IF 19. EndIF

In fact, the time required to find p and q is also determined by using the ECC’s equation. That is, when the same value of n is used in different equations, the time may be very different. However, the purpose of this paper is not related to select the best equation. In fact, it compares the time required to finish between ECM and F-ECM (Algorithm 3), which both use the similar ECC’s equation. Symmetry 2021, 13, 1314 9 of 15

Algorithm 3 F-ECM

Input: n, P = (x1, y1), 2P = (x2, y2), a, b, x3, x4, m3, m4 Output: p, q

1. Y2 ← 2 ∗ y2 mod n 2. x(i−2) ← x3 3. x(i−1) ← x4 4. m(i−2) ← m3 5. m(i−1) ← m4 6. While True Do 7. X1 ← x2 − x(i−1) mod n 8. X2 ← x2 − x(i−2) mod n 9. s ← X1 ∗ X2 mod n 10. t ← gcd(s, n) 11. IF t equals to 1 then 12. I ← s−1 mod n 13. mi ← (m(i−2) ∗ X2 − Y2) ∗ I ∗ (−X1) mod n 14. m(i+1) ← (m(i−1) ∗ X1− Y2) ∗ I ∗ (−X2) mod n 2 15. xi ← mi − x(i−2) − x2 mod n ← 2 − − 16. x(i+1) m(i+1) x(i−1) x2 mod n 17. Else 18. Jumping to Step 25 19. End IF 20. m(i−2) ← mi 21. m(i−1) ← m(i+1) 22. x(i−2) ← xi 23. x(i−1) ← x(i+1) 24. End While 25. p ← t 26. q ← n/p

The key feature of F-ECM is that every two adjacent points are computed by using the same modular inverse in each iteration. Furthermore, F-ECM does not include the y-coordinate of the point on the curve. As a result, many computation costs are reduced. While the processes in loop are considered, the number of M, S, I and G, when t = 1 are as follows: Step 9: requiring 1 M Step 10: requiring 1 G Step 12: requiring 1 I Step 13: requiring 3 M Step 14: requiring 3 M Step 15: requiring 1 S Step 16: requiring 1 S Therefore, each loop, F-ECM requires 1I, 7M, 2S and 1G Example 1: Assuming that n = 33233, finding ECC’s equation over Finite Field (Zn) by using Algorithm 2 Sol: From Algorithm 2, Step 1: P = (241, 227), x1 = 241, y1 = 227 Step 2: a = 37 Step 3: b = (2272 − 2413 − (37)(241)) mod 33,233 = 2951 Step 4: t = 4(373) + 27(29512) mod 33,233 = 6566 Step 5–7: Since t 6= 0, continue to Step 8 Step 8: g = 2(227) mod 33,233 = 454 Step 9: Since gcd(454, 33233) = 1, continue to Step 10 Step 10: 2P = (23,424, 10,611), x2 = 23,424, y2 = 10,611 Step 11: h = 2(10,611)(23,424 − 241) mod 33,233 = 8294 Symmetry 2021, 13, 1314 10 of 15

Step 12: Since gcd(8294, 33,233) = 1, continue to Step 13 Step 13: m = 8294−1 mod 33,233 = 1166 Step 14: m3 = (10,611 − 227) ∗ 1166 ∗ 2(10,611) mod 33,233 = 32,564 2 Step 15: x3 = (32,564 − 23,424 − 241) mod 33,233 = 25,100 2 Step 16: m4 = (23,424 − 241) ∗ 1166 ∗ (3(23,424) + 37) mod 33,233 = 26,386 2 Step 17: x4 = (26,386 − 2(23,424)) mod 33,233 = 26,386 = 9264 Therefore, the equation is: y2 = x3 + 37x + 2951 mod 33,233 where 2P = (23,424, 10,611) is the point on the curve, x3 = 25,100 is the coordinate x of 3P and x4 = 9264 is the coordinate x of 4P. In fact, once all of the output parameters in Algorithm 2 have been identified, they are used as input for F-ECM to recover p and q. Example 2: Assuming that P = (x1, y1), 2P = (x2, y2), x3, x4, m3 and m4 are disclosed (see in Example 1), factoring n = 33,233 by using F-ECM with the following ECC’s equation: y2 = x3 + 37x + 2951 mod 33,233 Sol: From F-ECM, Step 1: Y2 = 2 ∗ 10,611 mod 33,233 = 21,222 Step 2: x(i−2) = x3 = 25,100 Step 3: x(i−1) = x4 = 9264 Step 4: m(i−2) = m3 = 32,564 Step 5: m(i−1) = m4 = 26,386 Steps 6–24: Process in Loop Loop 1: Step 7: X1 = 23,424 − 9264 mod 33,233 = 14,160 Step 8: X2 = 23,424 − 25,100 mod 33,233 = 31,557 Step 9: s = 14,160 ∗ 31,557 mod 33,233 = 29,435 Step 10: t = gcd(29,435, 33,233) = 1 Since t = 1, the process is in the condition (Steps 11–16) Step 12: I = 29,435−1 mod 33,233 = 16,634 Step 13: mi = (32,564 ∗ 31,557 − 21,222) ∗ 16,634 ∗ (−14,160) mod 33,233 = 22,349 Step 14: m(i+1) = (26,386 ∗ 14,160 − 21,222) ∗ 16,634 ∗ (−31,557) mod 33,233 = 19,677 2 Step 15: xi = 22,349 − 25,100 − 23,424 mod 33,233 = 3753 2 Step 16: x(i+1) = 19,677 − 9264 − 23,424 mod 33,233 = 20,424 Steps 20–23: m(i−2) = 22,349, m(i−1) = 19,677, x(i−2) = 3753, x(i−1) = 20,424 Loop 2: Step 7: X1 = 23,424 − 20,424 mod 33,233 = 3000 Step 8: X2 = 23,424 − 3753 mod 33,233 = 19,671 Step 9: s = 3000 ∗ 19,671 mod 33,233 = 24,425 Step 10: t = gcd(24,425, 33,233) = 1 Since t = 1, the process is in the condition (Steps 11–16) Step 12: I = 24,425−1 mod 33,233 = 21,978 Step 13: mi = (22,349 ∗ 19,671– 21,222) ∗ 21,978 ∗ (−3000) mod 33,233 = 21,042 Step 14: m(i+1) = (19,677 ∗ 3000 − 21,222) ∗ 21,978 ∗ (−19,671) mod 33,233 = 1001 2 Step 15: xi = 21,042 − 3753 − 23,424 mod 33,233 = 8561 2 Step 16: x(i+1) = 1001 − 20,424 − 23,424 mod 33,233 = 27,629 Steps 20–23: m(i−2) = 21,042, m(i−1) = 1001, x(i−2) = 8561, x(i−1) = 27,629 Loop 3: Step 7: X1 = 23,424 − 27,629 mod 33,233 = 29,028 Step 8: X2 = 23,424 − 8561 mod 33,233 = 14,863 Step 9: s = 29,028 ∗ 14,863 mod 33,233 = 12,358 Step 10: t = gcd(12,358, 33,233) = 167 Since t = 167, then jumping to Step 25 Step 25: p = 167 Step 26: q = 33,233/167 = 199 Therefore, 167 and 199 are two prime factors of n = 33,233. Table1 displays the costs of Example 2. It is shown that t = 1 in the first and second iterations, and t = 167 in the third Symmetry 2021, 13, 1314 11 of 15

iteration. Therefore, total costs are 2I, 15M, 4S and 3G. However, if ECM is considered, where P, 2P, 3P and 4P are already disclosed, it requires 5I, 10M, 5S and 6G. Despite the fact that ECM has less M than F-ECM, F-ECM is quicker than ECM because the most expensive costs are modular inverse and greatest common divisor.

Table 1. Comparison about costs in Example 2 between F-ECM and ECM.

Computation Costs Algorithm IMSG F-ECM 2 15 4 3 ECM 5 10 5 6

Example 3: Assuming that P = (x1, y1)= (179, 157), 2P = (x2, y2)= (6910, 5868), x3 = 13,813, x4 = 1906 m3 = 5659 and m4 = 30,371 are disclosed, factoring n = 33,233 by using F-ECM with the following ECC’s equation: y2 = x3 + 61x + 27,700 mod 33,233 Sol: From F-ECM, Step 1–5: Y2 = 11,736, x(i−2) = 13,813, x(i−1) = 1906, m(i−2) = 5659, m(i−1) = 30,371 Steps 6–24: Process in Loop Loop 1: Step 7–10: X1 = 5004, X2 = 26,330, s = 19,708, t = 1 Since t = 1, the process is in the condition (Steps 11–16) Step 12–16: I = 19,957, mi = 27,269, m(i+1) = 1908, xi = 22,496, x(i+1) = 9251 Steps 20–23: m(i−2) = 27,269, m(i−1) = 1908, x(i−2) = 22,496, x(i−1) = 9251 Loop 2: Step 7–10: X1 = 30,892, X2 = 17,647, s = 30,225, t = 1 Since t = 1, the process is in the condition (Steps 11–16) Step 12–16: I = 22,461, mi = 6701, m(i+1) = 8876, xi = 9445, x(i+1) = 5005 Steps 20–23: m(i−2) = 6701, m(i−1) = 8876, x(i−2) = 9445, x(i−1) = 5005 Loop 3: Step 7–10: X1 = 1905, X2 = 30,698, s = 22,843, t = 1 Since t = 1, the process is in the condition (Steps 11–16) Step 12–16: I = 886, mi = 2694, m(i+1) = 3743, xi = 29,720, x(i+1) = 7041 Steps 20–23: m(i−2) = 2694, m(i−1) = 2694, x(i−2) = 29,720, x(i−1) = 7041 Loop 4: Step 7–10: X1 = 33,102, X2 = 10,423, s = 30,373, t = 1 Since t = 1, the process is in the condition (Steps 11–16) Step 12–16: I = 23,205, mi = 17,458, m(i+1) = 15,955, xi = 31,757, x(i+1) = 16,527 Steps 20–23: m(i−2) = 17,458, m(i−1) = 15,955, x(i−2) = 31,757, x(i−1) = 16,527 Loop 5: Step 7–10: X1 = 23,616, X2 = 8386, s = 8329, t = 1 Since t = 1, the process is in the condition (Steps 11–16) Step 12–16: I = 8008, mi = 9087, m(i+1) = 3195, xi = 17,363, x(i+1) = 15,290 Steps 20–23: m(i−2) = 9087, m(i−1) = 3195, x(i−2) = 17,363, x(i−1) = 15,290 Loop 6: Step 7–10: X1 = 24,853, X2 = 22,780, s = 27,185, t = 1 Since t = 1, the process is in the condition (Steps 11–16) Step 12–16: I = 5896, mi = 27,747, m(i+1) = 22,232, xi = 29,291, x(i+1) = 31,681 Steps 20–23: m(i−2) = 27,747, m(i−1) = 22,232, x(i−2) = 29,291, x(i−1) = 31,681 Loop 7: Step 7–10: X1 = 8462, X2 = 10,852, s = 6845, t = 1 Since t = 1, the process is in the condition (Steps 11–16) Step 12–16: I = 164,49, mi = 20,946, m(i+1) = 27,937, xi = 23,115, x(i+1) = 26,839 Steps 20–23: m(i−2) = 20,946, m(i−1) = 27,937, x(i−2) = 23,115, x(i−1) = 26,839 Loop 8: Symmetry 2021, 13, 1314 12 of 15

Step 7–10: X1 = 13,304, X2 = 17,028, s = 24,384, t = 1 Since t = 1, the process is in the condition (Steps 11–16) Step 12–16: I = 24,967, mi = 30,204, m(i+1) = 28,538, xi = 5741, x(i+1) = 9030 Steps 20–23: m(i−2) = 30,204, m(i−1) = 28,538, x(i−2) = 5741, x(i−1) = 9030 Loop 9: Step 7–10: X1 = 31113, X2 = 1169, s = 14,195, t = 167 Since t = 167, then jumping to Step 25 Step 25: p = 167 Step 26: q = 33,233/167 = 199 Therefore, 167 and 199 are two prime factors of n = 33,233. Table2 displays the costs of Example 3. It is shown that t = 1 is between 1st iteration to 8th iteration, and t = 167 in 9th iteration. Therefore, total costs are 8I, 57M, 16S and 9G. However, if ECM is considered, where P, 2P, 3P and 4P are already disclosed, it requires 16I, 32M, 16S and 17G. Despite the fact that ECM has less M than F-ECM, F-ECM is quicker than ECM because the most expensive expenses are modular inverse and greatest common divisor.

Table 2. Comparison about costs in Example 3 between F-ECM and ECM.

Computation Costs Algorithm IMSG F-ECM 8 57 16 9 ECM 16 32 16 17

According to examples 2 and 3, even though the total costs from each example are different, the costs of F-ECM are always less than the costs of ECM.

6. Loop Analysis Assuming that y2 = x3 + ax + b mod n is the proposed equation for recovering two prime factors of n, P is the revealed point on the curve and a prime factor is discovered in iP, where i∈ Zn, the costs for both of ECM and F-ECM can be calculated as follows: For ECM, to compute point addition or point doubling, i − 1 iterations are required. However, assuming that 2P, 3P and 4P have already been disclosed prior to using ECM, the total loops of ECM are i − 4. Therefore, TECM_i = (i − 4) − 1 (25)

TECM_gcd = i − 4 (26)

where, TECM_i is numbers of modular inverse when ECM is performed. TECM_gcd is numbers of computing greatest common divisor when ECM is performed. For F-ECM, assuming that 2P, 3P and 4P have already been disclosed prior to use F-ECM, the total loops of F-ECM are (i − 4)/2. Therefore,

(i − 4) T − = − 1 (27) F ECM_i 2 (i − 4) T − = (28) F ECM_gcd 2

where, TF-ECM_i is numbers of modular inverse when F-ECM is performed. TF-ECM_gcd is numbers of computing greatest common divisor when F-ECM is performed. Therefore, the number of modular inverse and gcd computations is always reduced by twice when F-ECM is used in place of ECM for implementation.

7. Experimental Results The average computation time for each length of n is shown in this section. In this section, the length of n is assigned from 30 to 65 bits. Furthermore, all experiments were Symmetry 2021, 13, 1314 14 of 16 Symmetry 2021, 13, 1314 14 of 16

Symmetry 2021, 13, 1314 13 of 15 TheThe averageaverage computationcomputation timetime forfor eacheach lengthlength ofof nn isis shownshown inin thisthis section.section. InIn thisthis section,section, thethe lengthlength ofof nn isis assignedassigned fromfrom 3030 toto 6565 bits.bits. Furthermore,Furthermore, allall experimentsexperiments werewere performed on a 2.53 GHz Intel® Core i5 with 8 GB memory to control the same resource. performedperformed onon aa 2.532.53 GHzGHz IntelIntel®® Core i5 with 8 GB memory to control the same resource. BigInteger class in Java is chosen for implementation because it can manage an infinite BigIntegerBigInteger classclass inin JavaJava isis chosenchosen forfor implementationimplementation becausebecause itit cancan managemanage anan infiniteinfinite number of integers generated by the String class. For each length, 20 values of n are numbernumber ofof integersintegers generatedgenerated byby thethe StringString class.class. For each length,length, 2020 valuesvalues ofof nn areare generated randomly. Moreover, 10 equations of ECC are generated to factor the same generatedgenerated randomly.randomly. Moreover, Moreover, 10 10 equations equations of ECCof ECC are generatedare generated to factor to factor the same the valuesame value of n in order to calculate the average computation time. ofvalue n in of order n in toorder calculate to calculate the average the average computation computation time. time. Figure 1 depicts a time comparison between ECM and F-ECM for completing the FigureFigure1 1 depicts depicts a a time time comparison comparison between between ECM ECM and and F-ECM F-ECM for for completing completing the the process. For all cases of n, the experimental results show that F-ECM can complete the process.process. ForFor all all cases cases of of n, n, the the experimental experimental results results show show that that F-ECM F-ECM can completecan complete the task the fastertasktask fasterfaster than ECM.thanthan ECM.ECM. When WhenWhen compared comparedcompared to ECM, toto theECM,ECM, average thethe averageaverage computation computationcomputation time for timetime each forfor length eacheach usinglengthlength F-ECM usingusing F-ECMF-ECM is reduced isis reducedreduced by 30 to byby 38 3030 percent. toto 3838 percent.percent. The greatest TheThe greatestgreatest time decreased timetime decreaseddecreased is actually isis actuallyactually 65 bits in6565 length. bitsbits inin length.length. When F-ECM WhenWhen F-ECMF-ECM is used, isis the used,used, task thethe is completedtatasksk isis completedcompleted in 3351 inin s. 33513351 ECM, s.s. onECM,ECM, the on otheron thethe hand, otherother takeshand,hand, approximately takestakes approximatelyapproximately 5420 s. 54205420 s.s.

Figure 1. Comparison about time to finish the algorithm between ECM and F-ECM. FigureFigure 1.1. ComparisonComparison aboutabout timetime toto finishfinish thethe algorithmalgorithm betweenbetween ECMECM andand F-ECM.F-ECM.

However,However,However, the thethe information informationinformation in inin Figure FigureFigure1 1 1is isis unclear unclearunclear because becausebecause both bothboth ECM ECMECM and andand F-ECM F-ECMF-ECM take taketake onlyonlyonly a aa short shortshort time timetime when whenwhen the thethe length lengthlength of ofofn isnn is betweenis betweenbetween 30 3030 and andand 55. 55.55. Assuming AssumingAssuming that thatthatt is t thet isis the timethe timetime (in seconds)(in(in seconds)seconds) required requiredrequired to complete toto completecomplete the task,thethe task,task, Figure FigureFigure2 shows 22 showsshows log(t) log(t)log(t) for each forfor biteacheach to bitbit confirm toto confirmconfirm that F-ECMthatthat F-ECMF-ECM is faster isis fasterfaster than than ECMthan ECMECM in all inin cases allall casescases of n. ofof nn..

Figure 2. Comparison about log(t) to finish the algorithm between ECM and F-ECM. FigureFigure 2.2. ComparisonComparison aboutabout log(log(tt)) toto finishfinish thethe algorithmalgorithm betweenbetween ECMECM andand F-ECM.F-ECM. Figure2 depicts a comparison of log( t) results for ECM and F-ECM. In fact, it is based FigureFigure 22 depictsdepicts aa comparisoncomparison ofof log(log(tt)) resultsresults forfor ECMECM andand F-ECM.F-ECM. InIn fact,fact, itit isis basedbased on the results shown in Figure1. For all cases of n, the results show that F-ECM is clearly onon thethe resultsresults shownshown inin FigureFigure 1.1. ForFor allall casescases ofof nn,, thethe resultsresults showshow thatthat F-ECMF-ECM isis clearlyclearly faster than ECM. Based on the information in this figure, it can be confirmed that F-ECM is fasterfaster thanthan ECM.ECM. BasedBased onon thethe informationinformation inin thisthis figure,figure, itit cancan bebe confirmedconfirmed thatthat F-ECMF-ECM faster than ECM when the length of n is greater than 65 bits. isis fasterfaster thanthan ECMECM whenwhen thethe lengthlength ofof nn isis greatergreater thanthan 6565 bits.bits. 8. Conclusions In this study, the improved method to find two large prime factors of RSA is proposed. The Fast Elliptic Curve Factorization Method (F-ECM) is a variant of the Elliptic-curve

Symmetry 2021, 13, 1314 14 of 15

Factorization Method (ECM). The idea behind F-ECM is that every two adjacent points will be computed together in order to share a modular inverse computing and greatest common divisor computing to reduce computation costs. In general, the algorithm requires one modular inverse to find a new point. That is, this cost is cut in half. Even though number of modular multiplications are increased, the cost for this algorithm is very low when it is compared with the cost for modular inverse. Furthermore, the y-coordinate is removed from the process in order to reduce the cost of computing modular multiplication and the length of modulus spans from 30 to 65 bits. The experimental results show that F-ECM can finish the task faster than ECM for all cases of modulus. Furthermore, the computation time is reduced by 30 to 38 percent.

Funding: This research was funded by Department of Computer and Communication Engineering, Faculty of Technology, Udon Thani Rajabhat University, Udon Thani, Thailand. Institutional Review Board Statement: Not applicable. Informed Consent Statement: Not applicable. Data Availability Statement: Not applicable. Conflicts of Interest: The author declares no potential conflict of interest.

References 1. Rivest, R.L.; Shamir, A.; Adleman, L. A method for obtaining digital signatures and public key cryptosystems. Commun. ACM 1978, 21, 120–126. [CrossRef] 2. Diffie, W.; Hellman, M.E. New directions in cryptography. IEEE Trans. Inf. Theory 1976, 22, 644–654. [CrossRef] 3. Sitalakshmi, V.; Anthony, O. New Method of Prime Factorisation-Based Attacks on RSA Authentication in IoT. Cryptography 2019, 3, 20. 4. Ruzai, W.N.A.; Ariffin, M.R.K.; Asbullah, M.A.; Mahad, Z.; Nawawi, A. On the Improvement Attack upon Some Variants of RSA Cryptosystem via the Continued Fractions Method. IEEE Access 2020, 8, 80997–81006. [CrossRef] 5. Sharma, P.; Gupta, A.K.; Vijay, A. Modified Integer Factorization Algorithm using V-Factor Method. In Proceedings of the International Conference on Advanced Computing & Communication Technologies, Rohtak, India, 7–8 January 2012; pp. 423–425. 6. Koblitz, N. Elliptic Curve Cryptosystems. Math. Comput. 1987, 48, 203–209. [CrossRef] 7. Miller, V.S. Uses of elliptic curves in cryptography. Lect. Notes Comput. Sci. 1986, 218, 417–428. 8. Amadori, A.; Pintore, F.; Sala, M. On the discrete logarithm problem for prime-field elliptic curves. Finite Fields Appl. 2018, 51, 168–182. [CrossRef] 9. Yang, C.C.; Chang, T.Y.; Hwang, M.S. A new anonymous conference key distribution system based on the elliptic curve discrete logarithm problem. Comput. Stand. Interfaces 2003, 25, 141–145. [CrossRef] 10. Su, P.C.; Change, H.K.C.; Lu, L.H. ID-based threshold digital signature schemes on the elliptic curve discrete logarithm problem. Appl. Math. Comput. 2005, 164, 757–772. [CrossRef] 11. Shor, P.W. Algorithms for quantum computation: Discrete logarithms and factoring. In Proceedings of the Annual Symposium on Foundations of , Santa Fe, NM, USA, 20–22 November 1994; pp. 124–134. 12. Zhou, Q.; Tian, C.; Zhang, H.; Yu, J.; Li, F. How to securely outsource the extended for large-scale polynomials over finite fields. Inf. Sci. 2020, 512, 641–660. [CrossRef] 13. Hazmi, I.; Gebali, F.; Ibrahim, A. High Speed and Low Area Complexity Extended Euclidean Inversion Over Binary Fields. IEEE Trans. Consum. Electron. 2019, 65, 408–417. [CrossRef] 14. Horng, S.J.; Tzeng, S.F.; Fan, P.; Wang, X.; Li, T.; Khan, M.K. Secure Convertible Undeniable Signature Scheme Using Extended Euclidean Algorithm without Random Oracles. KSII Trans. Internet Inf. Syst. 2013, 7, 1512–1532. 15. Eisentrager, K.; Lauter, K.; Montgomery, P.L. Fast Elliptic curve arithmetic and improved Weil pairing evaluation. Lect. Notes Comput. Sci. 2003, 2612, 343–354. 16. Obaidat, M.; Brown, J.; Obeidat, S.; Rawashdeh, M. A Hybrid Dynamic Encryption Scheme for Multi-Factor Verification: A Novel Paradigm for Remote Authentication. Sensors 2020, 20, 4212. [CrossRef] 17. Singh, L.D.; Debbrama, T. A new approach to Elliptic curve cryptography. In Proceedings of the International Conference on Advanced Communication Control and Computing Technologies, Ramanathapuram, India, 8–10 May 2014; pp. 78–82. 18. Tange, H.; Anderson, B. Attacks and Countermeasures on AES and ECC. In Proceedings of the International Symposium on Wireless Personal Multimedia Communications, Atlantic City, NJ, USA, 24–27 June 2013; pp. 1–5. 19. Somsuk, K.; Sanemueang, C. The New Modified Methodology to Solve ECDLP Based on Brute Force Attack. Adv. Intell. Syst. Comput. 2019, 769, 255–264. Symmetry 2021, 13, 1314 15 of 15

20. Nidhi, L.; Anurag, P.; Shishupal, K. Modified Trial Using KNJ-Factorization Method to Factorize RSA Public Key Encryption. In Proceedings of the International Conference on Contemporary Computing and Informatics, Mysore, India, 27–29 November 2014; pp. 992–995. 21. Raghunandan, K.R.; Aithal, G.; Shetty, S. Comparative Analysis of Encryption and Decryption Techniques Using Numbers and Phony Modulus to Avoid Factorization Attack of RSA. In Proceedings of the International Conference on Advanced Mechatronic Systems, Kusatsu, Japan, 26–28 August 2019; pp. 152–157. 22. Somsuk, S.; Chiawchanwattana, T.; Sanemueang, C. Estimating the new Initial Value of Trial Division Algorithm for Balanced Modulus to Decrease Computation Loops. In Proceedings of the International Joint Conference on Computer Science and Software Engineering, Chonburi, Thailand, 10–12 July 2019; pp. 137–141. 23. Ambedkar, B.R.; Gupta, A.; Gautam, P.; Bedi, S.S. An Efficient Method to Factorize the RSA Public Key Encryption. In Proceedings of the International Conference on Communication Systems and Network Technologies, Katra, India, 3–5 June 2011; pp. 108–111. 24. Wu, M.E.; Tso, R.; Sun, H.M. On the improvement of Fermat factorization using a continued fraction technique. Future Gener. Comput. Syst. 2014, 30, 162–168. [CrossRef] 25. Somsuk, K. The improvement of initial value closer to the target for Fermat’s factorization algorithm. J. Discret. Math. Sci. Cryptogr. 2018, 21, 1573–1580. [CrossRef] 26. Tahir, R.R.M.; Asbullah, M.A.; Ariffin, M.R.K.; Mahad, Z. Determination of a Good Indicator for Estimated Prime Factor and Its Modification in Fermat’s Factoring Algorithm. Symmetry 2021, 13, 735. [CrossRef] 27. Somsuk, K.; Tientanopajai, K. An Improvement of Fermat’s Factorization by Considering the Last m Digits of Modulus to Decrease Computation Time. Int. J. Netw. Secur. 2017, 19, 99–111. 28. Omar, K.; Szalay, L. Sufficient conditions for factoring a class of large integers. J. Discret. Math. Sci. Cryptogr. 2010, 13, 95–103. 29. Pollard, J.M. Theorems of factorization and primality testing. Math. Proc. Camb. Philos. Soc. 1974, 76, 521–528. [CrossRef] 30. Murat, S. Generalized Trial Division. Int. J. Contemp. Math. Sci. 2011, 6, 59–64. 31. Lenstra, H.W., Jr. Factoring integers with elliptic curves. Ann. Math. 1987, 126, 649–673. [CrossRef] 32. Macariu, G.; Petcu, D. Parallel Multiple Polynomial Quadratic Sieve on Multi-Core Architectures. In Proceedings of the International Symposium on Symbolic and Numeric Algorithms for Scientific Computing, Timisoara, Romania, 26–29 September 2017; pp. 59–65. 33. Gaj, K.; Kwon, S.; Baier, P.; Kohlbrenner, P.; Le, H.; Khaleeluddin, M.; Bachimanchi, R.; Rogawski, M. Area-Time Efficient Implementation of the Elliptic Curve Method of Factoring in Reconfigurable Hardware for Application in the Number Field Sieve. IEEE Trans. Comput. 2010, 59, 1264–1280. [CrossRef]