Lenstra's elliptic curve factorization

The Lenstra elliptic curve factorization method to find a factor of the given number n
works as follows:

• • Pick a random elliptic curve over Z with a point A on it. Then, we consider the group law on this curve mod n — this is possible since almost all residues mod n have inverses, which can be found using the Euclidean algorithm, and finding a noninvertible residue is tantamount to factoring n.

• Compute eA in this group, where e is product of small primes raised to small powers, as in the p-1 algorithm. This can be done one prime at a time, thus efficiently.

• Hopefully, eA is a zero element of the elliptic curve group in Z_p, but not in Z_q  for another prime divisor q of n (as in the p-1 method, it is unlikely that both groups will have an order which is a divisor of e). Then we can find a factor of n by finding the greatest common divisor of the first coordinate of A and n, since this coordinate will be zero in Z_p.


• If it does not work, we can try again with some other curve and starting point.

 

The complexity depends on the size of the factor and can be represented by, where p is the smallest factor of n.