## Access

You are not currently logged in.

Access your personal account or get JSTOR access through your library or other institution:

## If You Use a Screen Reader

This content is available through Read Online (Free) program, which relies on page scans. Since scans are not currently available to screen readers, please contact JSTOR User Support for access. We'll provide a PDF copy for your screen reader.

# Factoring Integers with Elliptic Curves

H. W. Lenstra, Jr.
Annals of Mathematics
Second Series, Vol. 126, No. 3 (Nov., 1987), pp. 649-673
DOI: 10.2307/1971363
Stable URL: http://www.jstor.org/stable/1971363
Page Count: 25
Since scans are not currently available to screen readers, please contact JSTOR User Support for access. We'll provide a PDF copy for your screen reader.
Preview not available

## Abstract

This paper is devoted to the description and analysis of a new algorithm to factor positive integers. It depends on the use of elliptic curves. The new method is obtained from Pollard's (p-1)-method (Proc. Cambridge Philos. Soc. 76 (1974), 521-528) by replacing the multiplicative group by the group of points on a random elliptic curve. It is conjectured that the algorithm determines a non-trivial divisor of a composite number n in expected time at most K(p)(log n)2, where p is the least prime dividing n and K is a function for which log $K(x) = \sqrt{(2 + o (1))log x log log x}$ for x → ∞. In the worst case, when n is the product of two primes of the same order of magnitude, this is $exp((1 + o(1))\sqrt{log n log log n})$ (for n → ∞). There are several other factoring algorithms of which the conjectural expected running time is given by the latter formula. However, these algorithms have a running time that is basically independent of the size of the prime factors of n, whereas the new elliptic curve method is substantially faster for small p.

• [649]
• 650
• 651
• 652
• 653
• 654
• 655
• 656
• 657
• 658
• 659
• 660
• 661
• 662
• 663
• 664
• 665
• 666
• 667
• 668
• 669
• 670
• 671
• 672
• 673