PROPERTIES OF ELLIPTIC CURVES AND THEIR USE IN FACTORING LARGE NUMBERS

Transcription

1 PROPERTIES OF ELLIPTIC CURVES AND THEIR USE IN FACTORING LARGE NUMBERS A ver important set of curves which has received considerabl attention in recent ears in connection with the factoring of large numbers are the elliptic curves- + a+ b where a and b are integers. We will discuss here some of their properties and then show how the can be used to factor large numbers. Our starting point will be to look at several specific eamples. We show ou the cases of ( a-b and ( a-9, b below- Note that the graphs are smmetric about the ais and that the derivative becomes infinite at one or three distinct values of. Also the curves go to ± as +. The first and second derivatives of these curves are given b- d ( + a d [ ( + and For a>0, there are no points where the derivative is zero and inflection points are encountered when the numerator of the second derivative vanishes. The curves become singular when d/0/0 and thus when -a and 0 simultaneousl. Net consider two neighboring points P(, and Q(, ling along the upper branch of the curve for >0. If we draw a straight line through these points the will generall intersect the curve at a third point R(,. The equation for this straight line will be- 4 a

2 s+ c s( + where s is its slope s ( ( Of particular interest for number factoring is the limiting case where P and Q coincide. Under that condition s can be replaced b the derivative at P(, and one finds on equating the straight line to the cubic we have at that- [ s ( + + a+ b This result ma be rewritten as the cubic- s + ( a s( s + ( b ( s ( ( Looking at just the coefficient of the term and setting it to zero ( since an elliptic curve has no quadratic term, we find that- ( + a ( since when PQ. It also follows that- ( + a ( + to ield a unique point R(,. For the case ( above where a and b-, we find R(, if one takes P(,Q(,. For the case ( where a-9 and b, we find R(69/, 57sqrt(/4 when P(,sqrt(Q(,sqrt(. We test this result b plugging into the cubic curve to find- (57sqrt(/4 (69/ - 9(69/ which checks. In standard mathematical notation one calls R(, P(,. Another particularl interesting elliptic curve is-

3 ( ( + It is rich in integer solutions starting with [, [,4 followed b [6,4, [,6,[8,76,etc. These points along the upper branch of the solution curve are easiest to determine b substituting subsequent values of into the equation and then seeing which sum equals the square of an integer. We find that n+ n +(n+ for the integer solution pair[ n+, n+. A little manipulation then predicts the ver simple result- n + n, n( n +, n,,,4,... n Thus the integer point [980, is guaranteed to lie on the solution curve. Net we demonstrate how one can use elliptic integrals to factor a number N. The idea behind this approach is due to H. Lenstra (An.of Math6,649-67,987 and works as follows. Take the first elliptic curve mentioned above and choose the simple composite number N. We write- + (modn withn This elliptic curve has the simple integer point P(, ling along it and we have alread shown that another point is R(,. To get a point further out on the upper branch of the curve we must first do a bit of manipulation involving modular arithmetic. We note that the derivative of the curve at (, is /6 and that this will not produce a larger value for a new. To get an further out along the upper branch of the curve we must first manipulate the /6 derivative term b carring out a Euclidian Algorithm on the numbers N and 6. Calculating first the greatest common divisor (gcd, we have ; 6 + 0; Looking at the remainder in the first equation, we have the gcd(,6. So we see at once that 6 and are both factored b and hence- Furthermore we can break down the b appling Euclid s Algorithm to and 6. This produces the gcd(,6 so that both 6 and are factored b. Thus we have the final result Which factors our number N. In most cases the factoring is not quite as simple as this and one must work rather hard to actuall find the inverse of a number M appearing in the

4 denominator of the derivative of ( to obtain larger values for. Also one is free to change the a and bs in the elliptic equation. The work can become easier b an appropriate choice of a and b usuall not known beforehand. Net, consider factoring the number N6 7 using the equation +8-8 which also has an integer point P(,. Here the derivative at P(, is d( //. One finds on appling the Euclid Algorithm between and 6 that- 6 + ; So that gcd(6, and on inverting- 6 mod(6 The inverse of then becomes -+[integer (6. One possibilit for - is. Thus we can write- [( ( 90 [(( Notice that these two new large values are integers which contradicts the fact that the cubic +8-8 has onl a limited number of integer points including (,, (,4, (6,6, (7,7 and (,04 along the upper branch. This means that and must be approimations, but probabl prett good ones. Let s check. We find- ( So we indeed see close agreement but not an eact match. Continuing on, we net look at the derivative at the new (. It ields- d( meaning that we have to be able to invert the denominator in the last epression to get the net. It is s clear that 465 and 6 have as its greatest common denominator since the first number is prime. So the process must be continued until a point is reached where the denominator of the derivative factors N6. The factor will turn out to be, 7,or in this case. Computer automation makes this elliptic curve method of factoring large numbers N one of the best presentl available. However, the challenge still remains

5 to find additional and superior methods for quickl factoring ver large numbers of 00 digits or larger as required in crptograph. Finall let us generate the differential equation which has +a+b as a solution. We alread have given the form of the first and second derivatives above. Differentiating the first derivative again one has- d [ + a ( + a d d ( So the governing second order non-linear equation for elliptic curves is- d d Just to show that things work, take the simple solution (/. Here- 9 ( 4 4 / August 00