The Elliptic Curve Method and Other Integer Factorization Algorithms
Total Page:16
File Type:pdf, Size:1020Kb
The Elliptic Curve Method and Other Integer Factorization Algorithms John Wright April 12, 2012 Contents 1 Introduction 2 2 Preliminaries 3 2.1 Greatest common divisors and modular arithmetic . 3 2.2 Basic definitions and theorems . 6 2.3 RSACryptosystem........................ 9 3 Factorization Algorithms 11 3.1 TheSieveofEratosthenes . 11 3.2 TrialDivision ........................... 12 3.3 Fermat’sLittleTheorem . 13 3.4 PseudoprimeTest......................... 14 3.5 StrongPseudoprimeTest . 16 3.6 AmethodofFermat ....................... 17 3.7 TheQuadraticSieve . 20 3.8 Pollard Rho Factorization Method . 22 4 Elliptic curves 24 4.1 Additiononanellipticcurve . 28 4.2 Reduction of elliptic curves defined modulo N ......... 31 4.3 Reduction of curves modulo p .................. 33 4.4 Lenstra’s Elliptic Curve Integer Factorization Method . 34 4.5 TheECMintheprojectiveplane . 36 5 Improving the Elliptic Curve Method 38 5.1 MontgomeryCurves . 38 5.2 Addition for elliptic curves in Montgomery form . 42 5.3 Montgomery multiplication . 47 5.4 Recentdevelopments . 49 5.5 Conclusion ............................ 50 1 Chapter 1 Introduction The Fundamental Theorem of Arithmetic, first proved by Gauss [2], states that every positive integer has a unique factorization into primes. That is, for every positive integer N, a1 a2 ak N = p1 p2 ...pk where the pi’s are distinct primes and each ai is a positive integer. This paper is motivated by a computational question: given an arbitrary integer N, how might we find a non-trivial factor of N? That is, a factor of N other than N and 1. ± ± While it is computationally easy to multiply numbers together, factor- ing a general integer is “generally believed to be hard” [4]. The security of RSA, the “most widely used public key cryptosystem in the world” [20], relies on this difficulty. Therefore, the study of integer factorization is of great practical importance. The goal of this paper is to describe the Elliptic Curve Method(ECM), an integer factorization algorithm first proposed by Lenstra in [21]. Before describing this algorithm, we first discuss some preliminaries. In Chapter 2, we prove some elementary results from number theory and explicitly describe the RSA algorithm. In Chapter 3, we describe several factorization algorithms, including Pollard’s Rho algorithm and the Quadratic Sieve. In Chapter 4, we discuss the algebraic properties of elliptic curves and the ECM. In Chapter 5, we discuss how performing the ECM with a curve in Montgomery form reduces computations. We conclude Chapter 5 by discussing some recent developments of the ECM. 2 Chapter 2 Preliminaries 2.1 Greatest common divisors and modular arith- metic Definition 2.1. Let a and b be positive integers. If gcd(a, b) = 1 then a is relatively prime to b. Definition 2.2. If a b is a multiple of m, then we write a b (mod m). − ≡ The following property is a basic property of division in the integers. For positive integers a and b with b<a and b = 0, there is a non-negative 6 integer r such that a = bk + r, where k is some positive integer and r < b. We will denote r as a mod b. We will need a way to compute greatest common divisors. The following algorithm, called the Euclidean Algorithm, finds gcd(x, y), where x and y are positive integers. Suppose y<x. Express x as x = m1y +r1, where m1 and r1 are integers with 0 r < y. If r = 0, then y divides x and gcd(x, y) = y. If r = 0, ≤ 1 1 1 6 dividing y by r yields y = m r + r with 0 r <r . If r = 0, we divide 1 2 1 2 ≤ 2 1 2 6 r by r to obtain r = m r + r where 0 r < r . Eventually some ri 1 2 1 3 2 3 ≤ 3 2 will be 0, as each ri is a non-negative integer strictly smaller than ri 1. The − process terminates when rk+1 = 0, for some k. Our last three equations are rk 3 = mk 1rk 2 + rk 1 − − − − rk 2 = mkrk 1 + rk − − rk 1 = mk+1rk + 0 − 3 with 0 < rk < rk 1. Since rk 1 = mk+1rk, rk divides rk 1. Since rk 2 = − − − − mkrk 1 + rk, rk divides rk 2. Since rk divides rk 2 and rk 1, rk divides − − − − rk 3. By working our way backwards through the equations in this manner − we see that rk divides both x and y. We will now show that rk = gcd(x, y). Suppose d is a divisor of both x and y. Since x = m1y + r1, d must divide r1. Since y = m2r1 + r2 and d divides y, if d divides r1 then d also divides r2. Continuing on, d must divide rk, making d less than or equal to rk. This proves that rk = gcd(a, b). Example 2.3. We use the Euclidean Algorithm to calculate gcd(45, 12). 45 = (3)(12) + 9 12 = (1)(9) + 3 9 = (3)(3) + 0 Thus, gcd(45, 12) = 3. We will use big O notation to describe the number of arithmetic in the Euclidean Algorithm. Later, we will use big O notation to describe other integer factorization algorithms. Definition 2.4. Let N(x) be the number of arithmetic operations it takes to factor the integer x using some factorization algorithm. We will write N(x)= O(g(x)) if for some function g(x) there exists a real number x0 and a positive real number M such that N(x) M g(x) for all x>x . ≤ | | 0 In [17](p.339), Knuth proves that the number of steps required to com- pute gcd(x, y) using the Euclidean Algorithm is O(ln N), where N = max(x, y). More precisely, Knuth proves that the number of steps is ln(√5N) 2 2.078 ln N + 1.672 &ln((1 + √5)/2)' − ≈ However, each step in the Euclidean Algorithm requires a long division. In [18](p.13), Cohen states that this long division takes O(ln2 N) operations. 4 In total, Cohen states that finding a greatest common divisor of a and b us- ing the Euclidean Algorithm takes O(ln2 N) operations, including the long division. Extending the Euclidean Algorithm allows us to compute the multi- plicative inverse of x modulo y, provided the inverse exists. In order for this inverse to exist, we require x and y to be relatively prime. Suppose we have integers a and b such that ax + by = gcd(x, y). If x and y are relatively prime, then ax + by = 1, and by considering both sides of this equation mod y, we obtain ax 1 (mod y). ≡ 1 Thus, a = x− mod y. The Extended Euclidean Algorithm finds the integers a and b in the relation ax + by = gcd(x, y), and hence can be used to calculate the mul- tiplicative inverse of x modulo y, provided x and y are relatively prime. The Extended Euclidean Algorithm operates as follows. We first perform the Euclidean Algorithm to find the greatest common divisor of x and y, storing the values ri, mi,ri 1 at each step. By substituting ri into ri 1 we − − can work in reverse to find a solution (a, b) to ax + by = gcd(x, y). Example 2.5. We calculate a solution to the equation 49a+15b = gcd(49, 15). In order to do this, we first calculate gcd(49, 15) using the Euclidean Algo- rithm 49 = (3)(15) + 4 15 = (3)(4) + 3 4 = (1)(3) + 1 3 = (3)(1) this shows that gcd(49, 15) = 1. We now work in reverse to calculate a solution to 49a + 15b = 1. 5 1 = 4 (1)(3) − = 4 (1) (15 (3)(4)) − − = (4)(4) 15 − = (4)(49 (3)(15)) 15 − − = (15)( 13) + (49)(4) − Thus, a = 13, b = 4 is a solution to our equation. Taking both sides of − 1 = (15)( 13) + (49)(4) modulo 49 shows that 13 26 (mod 49) is 1 − − ≡ (15)− mod 49. In [18](p.16), Cohen states that the Extended Euclidean Algorithm has the same run time as the Euclidean Algorithm. 2.2 Basic definitions and theorems Before discussing integer factorization, more preliminaries need to be dis- cussed. Proposition 2.6. If x and m are relatively prime and ax bx (mod m) ≡ then a b (mod m). ≡ Proof. If ax bx (mod m) then m divides ax bx = (a b)x. We will now ≡ − − show that m divides a b, which implies that a b (mod m). Since x and − ≡ m are relatively prime, we can use the Extended Euclidean Algorithm on x and m to find a c and an e such that cx + em = 1. Multiplying both sides of the above equation by (a b) yields − cx(a b)+ em(a b) = (a b). − − − Since m divides both cx(a b) and em(a b), m divides (a b). − − − Definition 2.7. The value of the Euler Phi function, denoted by φ(n), for n a positive integer, equals the number of positive integers less than or equal to n that are relatively prime to n. 6 For any prime p, every positive integer less than p is relatively prime to p. Thus, φ(p)= p 1. − Theorem 2.8. If n and b are positive, relatively prime integers then bφ(n) 1 (mod n). ≡ We will prove the above theorem momentarily. Theorem 2.9. (The Chinese Remainder Theorem) Suppose m1, m2,...,mr are positive, pairwise relatively prime integers. Let M = m1m2 ...mr. Let a1,a2,...,ar be arbitrary integers. Then there exists a unique integer a modulo M such that a ai (mod mi) for every i = 1,...,r.