1 Montgomery Modular Multiplication in Hard- ware

FEI KEMT
3.3.2 ECM Algorithm
In 1987, H. Lenstra came up with the idea of translating Pollard’s method from
the groups Gp and Gn to the groups of points on elliptic curves E modulo n and
modulo q [82]. Indeed, a group operation in E(Zn) can be defined by using the
given addition formulae [32].
The corresponding homomorphism φ to the one defined in Equation 3.2 is:
φ : E(Zn) → E(Zq) (reduction of coordinates modulo q) (3.3)
The exponentiation in Pollard’s (p−1) method is replaced by a point multiplication.
Let n be an integer without small prime factors which is divisible by at least two
different primes, one of them q. Such numbers appear after trial division and a quick
prime power test. Let E(Zn) be an elliptic curve with good reduction at all prime
divisors of n (this can be checked by calculating the gcd of n and the discriminant
of E, which very rarely yields a prime factor of n) and a point P ∈ E(Zn) �= O.
A factor of n is found if k · P is not equal to the identity element in E(Zn) but
k · φ(P ) equals to the identity element in E(Zq), i.e.
∀k1 ∈ N : k �= k1 · ordE(Zn)(P ),
∃k2 ∈ N : k = k2 · ordE(Zq)(φ(P )).
Let the elliptic curve E be defined by the homogeneous Weierstrass Equation:
y 2 z = x 3 + axz 2 + bz 3
(3.4)
In this case, above conditions yield two properties for the z-coordinate zQ of the
resulting point Q = k · P :
k �= k1 · ordE(Zn)(P ) ⇐ n ∤ zQ
k = k2 · ordE(Zq)(φ(P )) ⇐ q | zQ.
Under these conditions, a non-trivial factor d of n is obtained by d = gcd(zQ, n).
With the assumption that the order of P is B1-smooth and does not contain
any prime power larger than B2, the scalar k is computed in the same way as e in
Equation 3.1 as
k =
�
pi∈P,pi≤B1
p ep i
i , epi = max{r ∈ N : pr i ≤ B2} . (3.5)
49