This paper introduces a new algorithm for factoring integers using elliptic curves, building on Pollard's p-1 method. The algorithm replaces the multiplicative group with the group of points on a random elliptic curve. It is conjectured that the algorithm can find a non-trivial divisor of a composite number n under the condition that $ K(p)(\log n)^{2} $, where p is the least prime dividing n and K is a function satisfying $ \log K(z) = \sqrt{(2+o(1))} \log z \log z $ for $ z \to \infty $. The algorithm is particularly effective for small prime factors of n.
The method works by selecting an elliptic curve E over $ \mathbb{Z}/n\mathbb{Z} $, a point P on E, and an integer k. Using the addition law of the curve, the algorithm calculates $ k \cdot P $. If there exists a prime divisor p of n such that $ k \cdot P $ and the neutral element O of the curve become the same modulo p, then the algorithm finds a non-trivial divisor of n by computing the greatest common divisor of the z-coordinate of $ k \cdot P $ with n.
If the algorithm fails with a single curve, it can be repeated with a different elliptic curve. This process continues until a non-trivial divisor is found. The analysis shows that the performance of the algorithm is largely determined by the density of numbers built up from small primes near $ p+1 $. Under a reasonable conjecture about this density, the algorithm is expected to find a non-trivial divisor of n in time $ g K(p)M(n) $, where $ M(n) $ is an upper bound for the time needed to perform a single addition on an elliptic curve modulo n.
The algorithm can be repeated until the complete prime factorization of n is obtained. If the same conjecture holds, the expected time to factor n is $ e^{(1+o(1))\sqrt{\log n \log \log n}} $ for $ n \to \infty $. The worst case occurs if the second largest prime factor of n is not much smaller than $ \sqrt{n} $.
Other factoring algorithms, such as the class group method and the quadratic sieve, are conjectured to have similar expected running times. However, unlike the elliptic curve method, these algorithms do not depend on the size of the prime factors of n. The paper also discusses the theoretical foundations of elliptic curves over finite fields and their properties, including the number of elliptic curves, the order of the group of points on an elliptic curve, and the distribution of such curves.This paper introduces a new algorithm for factoring integers using elliptic curves, building on Pollard's p-1 method. The algorithm replaces the multiplicative group with the group of points on a random elliptic curve. It is conjectured that the algorithm can find a non-trivial divisor of a composite number n under the condition that $ K(p)(\log n)^{2} $, where p is the least prime dividing n and K is a function satisfying $ \log K(z) = \sqrt{(2+o(1))} \log z \log z $ for $ z \to \infty $. The algorithm is particularly effective for small prime factors of n.
The method works by selecting an elliptic curve E over $ \mathbb{Z}/n\mathbb{Z} $, a point P on E, and an integer k. Using the addition law of the curve, the algorithm calculates $ k \cdot P $. If there exists a prime divisor p of n such that $ k \cdot P $ and the neutral element O of the curve become the same modulo p, then the algorithm finds a non-trivial divisor of n by computing the greatest common divisor of the z-coordinate of $ k \cdot P $ with n.
If the algorithm fails with a single curve, it can be repeated with a different elliptic curve. This process continues until a non-trivial divisor is found. The analysis shows that the performance of the algorithm is largely determined by the density of numbers built up from small primes near $ p+1 $. Under a reasonable conjecture about this density, the algorithm is expected to find a non-trivial divisor of n in time $ g K(p)M(n) $, where $ M(n) $ is an upper bound for the time needed to perform a single addition on an elliptic curve modulo n.
The algorithm can be repeated until the complete prime factorization of n is obtained. If the same conjecture holds, the expected time to factor n is $ e^{(1+o(1))\sqrt{\log n \log \log n}} $ for $ n \to \infty $. The worst case occurs if the second largest prime factor of n is not much smaller than $ \sqrt{n} $.
Other factoring algorithms, such as the class group method and the quadratic sieve, are conjectured to have similar expected running times. However, unlike the elliptic curve method, these algorithms do not depend on the size of the prime factors of n. The paper also discusses the theoretical foundations of elliptic curves over finite fields and their properties, including the number of elliptic curves, the order of the group of points on an elliptic curve, and the distribution of such curves.