ECM using Edwards curves

Abstract

Abstract. This paper introduces GMP-EECM, a fast implementation of the elliptic-curve method of factoring integers. GMP-EECM is based on, but faster than, the well-known GMP-ECM software. The main changes are as follows: (1) use Edwards curves instead of Montgomery curves; (2) use twisted inverted Edwards coordinates; (3) use signedsliding-window addition chains; (4) batch primes to increase the window size; (5) choose curves with small parameters a, d, X1, Y1, Z1; (6) choose curves with larger torsion.

Parametrizations for Families of ECM-Friendly Curves

“…The two most profitable possibilities, Z/12Z and Z/2Z × Z/8Z, are characterized for families of Edwards curves in [5,Section 6]. On the other hand, the fastest scalar multiplication is obtained in [7] for a = −1 twisted Edward curves; as shown in [5], however, this limits the possibilities for interesting torsion groups (i.e., with cardinality greater than four) to Z/6Z, Z/8Z or Z/2Z × Z/4Z, thereby in particular excluding the two most profitable ones.…”

“…On the other hand, the fastest scalar multiplication is obtained in [7] for a = −1 twisted Edward curves; as shown in [5], however, this limits the possibilities for interesting torsion groups (i.e., with cardinality greater than four) to Z/6Z, Z/8Z or Z/2Z × Z/4Z, thereby in particular excluding the two most profitable ones. For ECM the issue was settled in [4] where a = −1 twisted Edwards curves were compared to curves with E tors isomorphic to Z/12Z and Z/2Z × Z/8Z: it was found that the disadvantage of the formers' smaller torsion groups is outweighed by their faster scalar multiplication.…”

“…For each of the five torsion groups (isomorphic to Z/6Z, Z/8Z, Z/12Z, Z/2Z × Z/4Z, and Z/2Z × Z/8Z) a set of a thousand Edwards curves was generated as described in [4], with a = −1 when possible (i.e., for the three smallest torsion groups). For each of the 5000 resulting curves the EECM software from [5] was applied to all b-bit primes for 15 ≤ b ≤ 26 (with ECM bounds depending on the targeted b-bit prime as in [5]). For each curve and each b the number of b-bit primes found (the "yield") was tallied, with the resulting counts extensively detailed in five very informative tables.…”

“…• the curve C 12 : x 2 + y 2 = 1 − 24167 25 x 2 y 2 from the EECM website, with torsion group of order twelve and a non-torsion point 5 23 , −1 7 with very small coordinates;…”

“…With the introduction of Edwards curves [6], a number of follow-up papers by Bernstein et al [3,5] ultimately led to "a = −1 twisted Edwards" curves by Hisil et al [7] with torsion group isomorphic to Z/2Z×Z/4Z as one of the current most efficient ways to implement ECM, as shown by Bernstein et al in [4]. For these curves, Barbulescu et al in [2] identify three families that all have the same larger smoothness probability and an even better fourth family.…”