Starfish on Strike

Abstract

This paper improves the price-performance ratio of ECM, the elliptic-curve method of integer factorization. In particular, this paper constructs "a = −1" twisted Edwards curves having Q-torsion group Z/2 × Z/4, Z/8, or Z/6 and having a known non-torsion point; demonstrates that, compared to the curves used in previous ECM implementations, some of the new curves are more effective at finding small primes despite being faster; and precomputes particularly effective curves for several specific sizes of primes.

Parametrizations for Families of ECM-Friendly Curves

“…On the other hand, the fastest scalar multiplication is obtained in [7] for a = −1 twisted Edward curves; as shown in [5], however, this limits the possibilities for interesting torsion groups (i.e., with cardinality greater than four) to Z/6Z, Z/8Z or Z/2Z × Z/4Z, thereby in particular excluding the two most profitable ones. For ECM the issue was settled in [4] where a = −1 twisted Edwards curves were compared to curves with E tors isomorphic to Z/12Z and Z/2Z × Z/8Z: it was found that the disadvantage of the formers' smaller torsion groups is outweighed by their faster scalar multiplication.…”

“…In [4] these are shown to be the curves −x 2 + y 2 = 1 − e 4 x 2 y 2 with e / ∈ {0, ±1}. Compared to generic e-values and averaging over the primes p of good reduction, [2] .…”

“…The first known parametrization for the general case of such curves is the elliptic parametrization from [4,Theorem 3.3]; it generates a target curve (and a point of infinite order on it) as a function of a point on another elliptic curve of positive rank. Our goal is to find elliptic parametrizations for all four families (i)-(iv) in (2.1) and (2.2).…”

“…For this reason, curves are used that are known to have favorable smoothness properties, such as a large torsion group over Q or a cardinality that is divisible by a fixed factor. Constructions of ECM-friendly curves were published by Suyama [11] (with a slight improvement by Montgomery in [10,Section 10.3.2]), Atkin-Morain [1], and generalized by Bernstein et al in [4].…”

“…With the introduction of Edwards curves [6], a number of follow-up papers by Bernstein et al [3,5] ultimately led to "a = −1 twisted Edwards" curves by Hisil et al [7] with torsion group isomorphic to Z/2Z×Z/4Z as one of the current most efficient ways to implement ECM, as shown by Bernstein et al in [4]. For these curves, Barbulescu et al in [2] identify three families that all have the same larger smoothness probability and an even better fourth family.…”