Factoring numbers with elliptic curves

Jorge Jiménez Urroz,Jacek Pomykała

DOI: https://doi.org/10.1007/s11139-023-00822-1

2024-02-17

The Ramanujan Journal

Abstract:In the present paper, we provide a probabilistic polynomial time algorithm that reduces the complete factorization of any squarefree integer n to counting points on elliptic curves modulo n , succeeding with probability , for any .

mathematics

What problem does this paper attempt to address?

Factoring integers using elliptic curves over q

Liu Xiumei,Jinxiang Zeng,Linsheng Yin

2012-01-01

Abstract:For the integer D = pq of the product of two distinct odd primes, we construct an elliptic curve E2rD : y 2 = x3 − 2rDx over Q, where r is a parameter dependent on the classes of p and q modulo 8, and show, under Birch and Swinnerton-Dyer conjecture, that the elliptic curve has rank one and vp(x([k]Q)) 6= vq(x([k]Q)) for odd k and a generator Q of the free part of E2rD(Q). Thus we can get p or q from D by computing GCD(D, x([k]Q)). Furthermore, under the Generalized Riemann hypothesis, we prove that one can take r < c logD such that the elliptic curve E2rD has these properties, where c is an absolute constant.
Factoring with Hints

Francesco Sica

DOI: https://doi.org/10.48550/arXiv.0912.1585

2017-08-08

Abstract:We introduce a new deterministic factoring algorithm, which could be described in the cryptographically fashionable term of "factoring with hints": we show that, given the knowledge of the factorisations of $O(N^{1/3+\epsilon})$ terms surrounding $N=pq$ product of two large primes, we can recover deterministically $p$ and $q$ in $O(N^{1/3+\epsilon})$ bit operations. Although this is slower than the current best factoring algorithms, this method shows that the factorisations of close integers are related and that consequently one can expect more results along this line of thought.

Number Theory,Cryptography and Security,Complex Variables
An Algebraic-Geometry Approach to Prime Factorization

Alberto Montina,Stefan Wolf

DOI: https://doi.org/10.48550/arXiv.2209.11650

2022-09-23

Abstract:New algorithms for prime factorization that outperform the existing ones or take advantage of particular properties of the prime factors can have a practical impact on present implementations of cryptographic algorithms that rely on the complexity of factorization. Currently used keys are chosen on the basis of the present algorithmic knowledge and, thus, can potentially be subject to future breaches. For this reason, it is worth to investigate new approaches which have the potentiality of giving a computational advantage. The problem has also relevance in quantum computation, as an efficient quantum algorithm for prime factorization already exists. Thus, better classical asymptotic complexity can provide a better understanding of the advantages offered by quantum computers. In this paper, we reduce the factorization problem to the search of points of parametrizable varieties, in particular curves, over finite fields. The varieties are required to have an arbitrarily large number of intersection points with some hypersurface over the base field. For a subexponential or poly- nomial factoring complexity, the number of parameters have to scale sublinearly in the space dimension n and the complexity of computing a point given the parameters has to be subexponential or polynomial, respectively. We outline a procedure for building these varieties, which is illustrated with two constructions. In one case, we show that there are varieties whose points can be evaluated efficiently given a number of parameters not greater than n/2. In the other case, the bound is dropped to n/3. Incidentally, the first construction resembles a kind of retro-causal model. Retro-causality is considered one possible explanation of quantum weirdness.

Cryptography and Security,Computational Complexity,Algebraic Geometry,Number Theory,Quantum Physics
A New Hyperbola based Approach to factoring Integers

Gilda Rech Bansimba,Regis Freguin Babindamana,Basile Guy R. Bossoto

2023-04-15

Abstract:From the results in the literature, the algebraic set of the hyperbola with parameter $n$ defined by $\mathcal{B}_{n}(X, Y, Z)_{\mid_{x\geq 4n}}= \displaystyle \lbrace \left(X: Y: Z\right)\in \mathbb{P}^{2}(\mathbb{Q}) \ \vert \ \displaystyle Y^{2}=X^{2}-4nXZ \rbrace$ where $n$ is a semiprime is proved to be in relation with prime factors of $n$. In the affine space over $\mathbb{Z}_{\geqslant 4n}\times \mathbb{Z}_{\geqslant 0}$, this set has exactly 5 points $\displaystyle\lbrace P_{0}, P_{1}, P_{2}, P_{3}, P_{4} \rbrace$ with $P_{2}+P_{3}=P_{1}+2P_{2}=P_{4}$ for which knowledge of $P_{2}$ or $P_{3}$ yields the factorization of $n$. However, The non cyclicity of this group structure over rationals and integers and moreover its non good reduction over finite fields constitute the main difficulty in finding its solutions. In this paper we describe an approach to finding $P_{2}$ and $P_{3}$. We introduce the concept of Hyperbola X-root and Y-root that the solution's greatest common divisors with $n$ reveal prime factors of $n$. We prove that $P_{2}$ and $P_{3}$ can be found on a singular Weierstrass curve isomorphic to a Jacobi quartic using the Hyperbola X-root and Y-root. We present the mathematical framework for this approach.

Number Theory
Factoring sparse polynomials fast

Alexander Demin,Joris van der Hoeven

2023-12-29

Abstract:Consider a sparse polynomial in several variables given explicitly as a sum of non-zero terms with coefficients in an effective field. In this paper, we present several algorithms for factoring such polynomials and related tasks (such as gcd computation, square-free factorization, content-free factorization, and root extraction). Our methods are all based on sparse interpolation, but follow two main lines of attack: iteration on the number of variables and more direct reductions to the univariate or bivariate case. We present detailed probabilistic complexity bounds in terms of the complexity of sparse interpolation and evaluation.

Symbolic Computation,Commutative Algebra
Some integer factorization algorithms using elliptic curves

Richard P. Brent

DOI: https://doi.org/10.48550/arXiv.1004.3366

2010-04-20

Abstract:Lenstra's integer factorization algorithm is asymptotically one of the fastest known algorithms, and is ideally suited for parallel computation. We suggest a way in which the algorithm can be speeded up by the addition of a second phase. Under some plausible assumptions, the speedup is of order log(p), where p is the factor which is found. In practice the speedup is significant. We mention some refinements which give greater speedup, an alternative way of implementing a second phase, and the connection with Pollard's "p-1" factorization algorithm.

Number Theory,Data Structures and Algorithms
Computing Euler factors of genus 2 curves at odd primes of almost good reduction

Céline Maistret,Andrew Sutherland

2024-05-28

Abstract:We present an efficient algorithm to compute the Euler factor of a genus 2 curve C/Q at an odd prime p that is of bad reduction for C but of good reduction for the Jacobian of C (a prime of ``almost good'' reduction). Our approach is based on the theory of cluster pictures introduced by Dokchitser, Dokchitser, Maistret, and Morgan, which allows us to reduce the problem to a short, explicit computation over Z and Fp, followed by a point-counting computation on two elliptic curves over Fp, or a single elliptic curve over Fp^2. A key feature of our approach is that we avoid the need to compute a regular model for C. This allows us to efficiently compute many examples that are infeasible to handle using the algorithms currently available in computer algebra systems such as Magma and Pari/GP.

Number Theory
Exact polynomial factorization by approximate high degree algebraic numbers

Jing-wei Chen,Yong Feng,Xiao-lin Qin,Jing-zhong Zhang

DOI: https://doi.org/10.1145/1577190.1577199

2009-01-01

Abstract:For factoring polynomials in two variables with rational coefficients, an algorithm using transcendental evaluation was presented by Hulst and Lenstra. In their algorithm, transcendence measure was computed. However, a constant c is necessary to compute the transcendence measure. The size of c involved the transcendence measure can influence the efficiency of the algorithm greatly. In this paper, we overcome the problem arising in Hulst and Lenstra's algorithm and propose a new polynomial time algorithm for factoring bivariate polynomials with rational coefficients. Using an approximate algebraic number of high degree instead of a variable of a bivariate polynomial, we can get a univariate one. A factor of the resulting univariate polynomial can then be obtained by a numerical root finder and the purely numerical LLL algorithm. The high degree of the algebraic number guarantees that this factor corresponds to a factor of the original bivariate polynomial. We prove that our algorithm saves a (log2(mn))2+ε factor in bit-complexity comparing with the algorithm presented by Hulst and Lenstra, where (n, m) represents the bi-degree of the polynomial to be factored. We also demonstrate on many significant experiments that our algorithm is practical. Moreover our algorithm can be generalized to polynomials with variables more than two.
An Efficient Quantum Factoring Algorithm

Oded Regev

2024-01-07

Abstract:We show that $n$-bit integers can be factorized by independently running a quantum circuit with $\tilde{O}(n^{3/2})$ gates for $\sqrt{n}+4$ times, and then using polynomial-time classical post-processing. The correctness of the algorithm relies on a number-theoretic heuristic assumption reminiscent of those used in subexponential classical factorization algorithms. It is currently not clear if the algorithm can lead to improved physical implementations in practice.

Quantum Physics,Computational Complexity
Efficiently factoring polynomials modulo $p^4$

Ashish Dwivedi,Rajat Mittal,Nitin Saxena

DOI: https://doi.org/10.48550/arXiv.1901.06628

2019-01-20

Abstract:Polynomial factoring has famous practical algorithms over fields-- finite, rational \& $p$-adic. However, modulo prime powers it gets hard as there is non-unique factorization and a combinatorial blowup ensues. For example, $x^2+p \bmod p^2$ is irreducible, but $x^2+px \bmod p^2$ has exponentially many factors! We present the first randomized poly(deg $f, \log p$) time algorithm to factor a given univariate integral $f(x)$ modulo $p^k$, for a prime $p$ and $k \leq 4$. Thus, we solve the open question of factoring modulo $p^3$ posed in (Sircana, ISSAC'17). Our method reduces the general problem of factoring $f(x) \bmod p^k$ to that of {\em root finding} in a related polynomial $E(y) \bmod\langle p^k, \varphi(x)^\ell \rangle$ for some irreducible $\varphi \bmod p$. We could efficiently solve the latter for $k\le4$, by incrementally transforming $E(y)$. Moreover, we discover an efficient and strong generalization of Hensel lifting to lift factors of $f(x) \bmod p$ to those $\bmod\ p^4$ (if possible). This was previously unknown, as the case of repeated factors of $f(x) \bmod p$ forbids classical Hensel lifting.

Computational Complexity,Data Structures and Algorithms,Symbolic Computation,Number Theory
Factoring polynomials over function fields

Jose Felipe Voloch

2024-09-13

Abstract:If K/k is a function field in one variable of positive characteristic, we describe a general algorithm to factor one-variable polynomials with coefficients in K. The algorithm is flexible enough to find factors subject to additional restrictions, e.g., to find all roots that belong to a given finite dimensional k-subspace of K more efficiently. It also provides a deterministic polynomial time irreducibility test in small characteristic. We also discuss some applications.

Number Theory
On the factorization of numbers of the form $X^2+c$

Marc Wolf,François Wolf

DOI: https://doi.org/10.48550/arXiv.2208.12579

2022-07-23

Abstract:We study the factorization of the numbers $N = X^2+c$, where $c$ is a fixed constant, and this independently of the value of gcd$(X,c)$. We prove the existence of a family of sequences with arithmetic difference $(U_n, Z_n)$ generating factorizations, i.e. such that: $(U_n)^2+c = Z_nZ_{n+1}$. The different properties demonstrated allow us to establish new factorization methods by a subset of prime numbers and to define a prime sieve. An algorithm is presented on this basis and leads to empirical results which suggest a positive answer to Landau's 4th problem.

General Mathematics
Factoring Catalan numbers

Gennady Eremin

DOI: https://doi.org/10.48550/arXiv.1908.03752

2019-08-10

Abstract:The paper describes a prime factorization of the Catalan numbers. Odd prime factors are distributed in layers in accordance with Legendre's formula. The content of each layer is a network of the intervals, Chebyshev's Segments. The primes of Segment are not calculated and are selected on the basis of its bounds. Layers contain non-repeated primes. Repeated factors are formed when primes are duplicated among different layers. The paper slightly modifies Kummer's theorem for the selection of individual prime factors, also starting from the boundaries of Segments. In conclusion, the reader is offered a software service for factorization of the Catalan number with index up to $10^8$

Number Theory,Combinatorics
Derandomizing Multivariate Polynomial Factoring for Low Degree Factors

Pranjal Dutta,Amit Sinhababu,Thomas Thierauf

2024-11-26

Abstract:For a polynomial $f$ from a class $\mathcal{C}$ of polynomials, we show that the problem to compute all the constant degree irreducible factors of $f$ reduces in polynomial time to polynomial identity tests (PIT) for class $\mathcal{C}$ and divisibility tests of $f$ by constant degree polynomials. We apply the result to several classes $\mathcal{C}$ and obtain the constant degree factors in \begin{enumerate} \item polynomial time, for $\mathcal{C}$ being polynomials that have only constant degree factors, \item quasipolynomial time, for $\mathcal{C}$ being sparse polynomials, \item subexponential time, for $\mathcal{C}$ being polynomials that have constant-depth circuits. \end{enumerate} Result 2 and 3 were already shown by Kumar, Ramanathan, and Saptharishi with a different proof and their time complexities necessarily depend on black-box PITs for a related bigger class $\mathcal{C}'$. Our complexities vary on whether the input is given as a blackbox or whitebox. We also show that the problem to compute the sparse factors of polynomial from a class $\mathcal{C}$ reduces in polynomial time to PIT for class $\mathcal{C}$, divisibility tests of $f$ by sparse polynomials, and irreducibility preserving bivariate projections for sparse polynomials. For $\mathcal{C}$ being sparse polynomials, it follows that it suffices to derandomize irreducibility preserving bivariate projections for sparse polynomials in order to compute all the sparse irreducible factors efficiently. When we consider factors of sparse polynomials that are sums of univariate polynomials, a subclass of sparse polynomials, we obtain a polynomial time algorithm. This was already shown by Volkovich with a different proof.

Computational Complexity
Factoring Multi-power RSA Modulus N = p r q with Partial Known Bits.

Yao Lu,Rui Zhang,Dongdai Lin

DOI: https://doi.org/10.1007/978-3-642-39059-3_5

2013-01-01

Abstract:Factoring large integers is a fundamental problem in algebraic number theory and modern cryptography, which many cryptosystems, e.g. RSA, are based on. Up to now, there is no known polynomial-time algorithm to solve it with classical computers. However, in practice side-channel attacks usually cause serious damage: Even if a small proportion of bits in the secret primes is leaked, one may efficiently factor. In this paper, we study the problem of factoring with partial known bits for multi-power RSA modulus N = pr q. In 1999, Boneh, Durfee and Howgrave-Graham showed that this problem can be solved efficiently given a 1/r+1-fraction of the most significant bits (MSB) of p. In their attack, the unknown bits are located in one consecutive block. We propose two lattice-based approaches that extend the number of unknown blocks to arbitrary n (n ≥ 1). The advantage of our approaches is that now knowledge of a ln(1+r)/r-fraction of the bits of p is already sufficient (for any n). In fact, our result is a first step towards unifying and extending previous works by Boneh-Durfee-Howgrave (Crypto'99) and Herrmann-May (Asiacrypt'08). © 2013 Springer-Verlag.
Solving Generalized Bivariate Integer Equations and Its Application to Factoring With Known Bits

Mengce Zheng,Zhigang Chen,Yaohui Wu

DOI: https://doi.org/10.1109/access.2023.3264590

IF: 3.9

2023-04-14

IEEE Access

Abstract:In this paper, we propose two improved theorems for addressing generalized bivariate integer equations using the lattice-based method. We examine the application of these theorems to the problem of factoring general RSA (Rivest–Shamir–Adleman) moduli of the form where and are prime numbers. These moduli, which are commonly used in the RSA cryptosystem and its variants, have previously been subjected to attacks primarily through the solution of univariate modular equations. In contrast, we investigate the possibility of factoring using leaked most significant bits (MSBs) or least significant bits (LSBs) of the prime numbers by solving generalized bivariate integer equations. We determine the minimum amount of known bits required for implementing the proposed factoring attacks and establish a unifying attack strategy. Furthermore, our results are verified through numerical computer experiments.

computer science, information systems,telecommunications,engineering, electrical & electronic
Integers expressible as the sum of two rational cubes

Levent Alpöge,Manjul Bhargava,Ari Shnidman

2024-10-20

Abstract:We prove that a positive proportion of integers are expressible as the sum of two rational cubes, and a positive proportion are not so expressible, thus proving a conjecture of Davenport. More generally, we prove that a positive proportion (in fact, at least one sixth) of elliptic curves in any cubic twist family have rank 0, and a positive proportion (in fact, at least one sixth) of elliptic curves with good reduction at 2 in any cubic twist family have rank 1. Our method involves proving that the average size of the 2-Selmer group of elliptic curves in any cubic twist family, having any given root number, is 3. We accomplish this by generalizing a parametrization, due to the second author and Ho, of elliptic curves with extra structure by pairs of binary cubic forms. We then use a novel combination of geometry-of-numbers methods and the circle method that builds on earlier work of Ruth and the first author. In particular, we make use of a new interpretation of the singular integral and series arising in the circle method in terms of real and $p$-adic Haar measures on the relevant group. We prove a uniformity estimate for integral points on the relevant quadric, which along with a sieve allows us to prove that the average size of the 2-Selmer group over the cubic twist family is 3. By suitably partitioning the subset of curves in the family with given root number, we effect a further sieve to show that the root number is equidistributed and that the same average, now taken over only those curves of given root number, is again 3. Finally, we apply the $p$-parity theorem of Dokchitser-Dokchitser and a $p$-converse theorem of Burungale-Skinner to conclude. We also prove the analogue of the above results for the sequence of square numbers: namely, we prove that a positive proportion of square integers are expressible as the sum of two rational cubes, and a positive proportion are not.

Number Theory,Algebraic Geometry
Integer Polynomial Factorization by Recombination of Real Factors: Re-evaluating an Old Technique in Modern Era

Shahriar Iravanian

2024-10-21

Abstract:Polynomial factorization over $ZZ$ is of great historical and practical importance. Currently, the standard technique is to factor the polynomial over finite fields first and then to lift to integers. Factorization over finite fields can be done in polynomial time using Berlekamp or Cantor-Zassenhaus algorithms. Lifting from the finite field to $ZZ$ requires a combinatorial algorithm. The van Hoeij algorithm casts the combinatorial problem as a knapsack-equivalent problem, which is then solved using lattice-reduction (the LLL algorithm) in polynomial time, which is implemented in many computer algebra systems (CAS). In this paper, we revisit the old idea of starting with factorization over $RR$ instead of a finite field, followed by recombination of the resulting linear and quadratic factors. We transform the problem into an integer subset sum problem, which is then solved using the Horowizt-Sinha algorithm. This algorithm can factor a random integer polynomial of degree $d$ in a time complexity of $O(2^(d slash 4))$. While the resulting algorithm is exponential, consistent with the integer subset sum problem being in NP, it has a few advantages. First, it is simple and easy to implement. Second, it is almost embarrassingly parallelizable. We demonstrate this by implementing the algorithm in a Graphic Processing Unit (GPU). The resulting code can factor a degree 100 polynomial is a few tenths of a second, comparable to some standard CAS. This shows that it is possible to use current hardware, especially massively parallel systems like GPU, to the benefit of symbolic algebra.

Symbolic Computation,Computational Complexity
Factoring RSA Modulus with Known Bits from Both p and q: A Lattice Method.

Yao Lu,Rui Zhang,Dongdai Lin

DOI: https://doi.org/10.1007/978-3-642-38631-2_29

2013-01-01

Abstract:This paper investigates the problem of factoring RSA modulus N = pq with some known bits from both p and q. In Asiacrypt'08, Herrmann and May presented a heuristic algorithm to factorize N with the knowledge of a random subset of the bits (distributed over small contiguous blocks) of a factor. However, in a real attack, an adversary often obtain some bits which distributed in both primes. This paper studies this extended setting and introduces a lattice-based approach. Our strategy is an extension of Coppersmiths technique on more variables, thus it is a heuristic method, which we heuristically assumed that the polynomials resulting from the lattice basis reduction are algebraically independent. However, in our experiments, we have observed that the well-established assumption is not always true, and for these scenarios, we also propose a method to fix it. © 2013 Springer-Verlag.
Square-free values of polynomials

Prem Prakash Pandey

2023-03-12

Abstract:It is conjectured that all separable polynomials with integers coefficients, satisfying some local conditions, take infinitely many square free values on integer arguments. But not a single polynomial of degree greater than $3$ is proven to exhibit this property. In this article, we propose a method to show that ``cyclotomic polynomials $\Phi_{\ell}(X)$ take square free values with positive proportion". Following this method, conditionally, we do prove the Square-free conjecture for all cyclotomic polynomials. The method is applicable to some other class of polynomials as well. Moreover we show that the method readily succeeds for quadratic polynomials to give unconditional result. In the appendix, we give an elementary proof of the square-free conjecture for cyclotomic polynomials under abc conjecture.

Number Theory

Factoring numbers with elliptic curves

Factoring integers using elliptic curves over q

Factoring with Hints

An Algebraic-Geometry Approach to Prime Factorization

A New Hyperbola based Approach to factoring Integers

Factoring sparse polynomials fast

Some integer factorization algorithms using elliptic curves

Computing Euler factors of genus 2 curves at odd primes of almost good reduction

Exact polynomial factorization by approximate high degree algebraic numbers

An Efficient Quantum Factoring Algorithm

Efficiently factoring polynomials modulo $p^4$

Factoring polynomials over function fields

On the factorization of numbers of the form $X^2+c$

Factoring Catalan numbers

Derandomizing Multivariate Polynomial Factoring for Low Degree Factors

Factoring Multi-power RSA Modulus N = p r q with Partial Known Bits.

Solving Generalized Bivariate Integer Equations and Its Application to Factoring With Known Bits

Integers expressible as the sum of two rational cubes

Integer Polynomial Factorization by Recombination of Real Factors: Re-evaluating an Old Technique in Modern Era

Factoring RSA Modulus with Known Bits from Both p and q: A Lattice Method.

Square-free values of polynomials