\chapter{Applications of Elliptic Curves}
\section{Cryptography}

Today's lecture is about an application of elliptic curves to
cryptography.  

\hd{Disclaimer:} I do not endorse breaking laws, and give the examples
below as a pedagogical tool in the hope of making the mathematics in
our course more fun and relevant to everyday life.  I don't think I
have violated the Digital Millenium Copyright Act, because I have
given very few details about Microsoft's actual protocols, and I've
given absolutely no source code.

\subsection{Microsoft Digital Rights Management}
Today I will describe one way to use elliptic curves in cryptography.
Our central example will involve 
version 2 of the Microsoft Digital Rights Management (MS-DRM) system,
as applied to {\tt .wma} audio files.  
\begin{center}
\includegraphics[width=1in]{graphics/wma.eps}
\end{center}
I learned about this protocol from 
a paper by ``Beale Screamer''.

\subsubsection{Microsoft's Favorite Elliptic Curve}
\noindent{}The elliptic curve used in MS-DRM is an elliptic curve over the finite
field $k=\Z/p\Z$, where
$$
  p=785963102379428822376694789446897396207498568951.
$$
As Beale Screamer remarks, this modulus has high nerd appeal because in
hexadecimal it is 
\begin{center}
89ABCDEF012345672718281831415926141424F7,
\end{center}
 which
includes counting in hexadecimal, and digits of~$e$, 
$\pi$, and $\sqrt{2}$.
The Microsoft elliptic curve~$E$ is
\begin{align*}
y^2 = x^3 &+ 317689081251325503476317476413827693272746955927x \\
             &\qquad +79052896607878758718120572025718535432100651934.
\end{align*}
We have
$$\# E(k) = 785963102379428822376693024881714957612686157429,$$
and the group $E(k)$ is cyclic with generator 
\begin{align*}
B &= (771507216262649826170648268565579889907769254176, \\
&\qquad 390157510246556628525279459266514995562533196655).
\end{align*}
\subsubsection{Nikita and Michael}
\vspace{-4ex}Our heros Nikita and Michael love to share digital music
\includegraphics[width=1in]{graphics/notes.eps} 
when they aren't out thwarting terrorists.
When Nikita installed Microsoft's 
content rights management software on
her compute, it sneakily generated a private key
$$
n = 670805031139910513517527207693060456300217054473,
$$
which it very stealthily hid in bits and pieces of files (e.g., {\tt
blackbox.dll}, {\tt v2ks.bla}, and {\tt IndivBox.key}).  In order for
Nikita to play Juno Reactor's latest hit {\tt juno.wma}, her web
browser contacts a Microsoft rights management partner.  After Nikita
gives Microsoft her credit card number, she is allowed to download a
license to play {\tt juno.wma}.  Microsoft created the license using
the ElGamal public-key cryptosystem (see below) in the group $E(k)$.
Nikita's license file can now be used to unlock {\tt juno.wma}, but
{\em only} on Nikita's computer.  When she shares both {\tt juno.wma}
and the license file with Michael, he is very annoyed because he can't
play {\tt juno.wma}. This is because Michael's computer doesn't know
Nikita's computer's private key (that integer~$n$ above), 
so Michael's computer can't decrypt the license file.
\begin{center}
\includegraphics[width=1.5in]{graphics/juno.eps}\\
{\tt juno.wma}
\end{center}


\subsection{The Elliptic Curve Discrete Logarithm Problem}
\begin{definition}
If $E$ is an elliptic curve over $\Z/p\Z$ and~$B$ is a point on~$E$,
then the {\em discrete log problem} on~$E$ to the base~$B$ is the
following problem: given a point $P\in E$, find an integer~$n$
such that $nB = P$, if such an integer exists.
\end{definition}

For example, let $E$ be the elliptic curve given by $y^2 = x^3 + x+1$
over the field $\Z/7\Z$.  We have
$$
  E(\Z/7\Z) = \{\O, (2, 2), (0,1), (0,6), (2,5) \}.
$$
If $B=(2,2)$ and $P=(0,6)$, then $3B=P$, so $n=3$
is a solution to the discrete logarithm problem.

To the best of my knowledge, the discrete logarithm problem on~$E$
is {\em really hard} unless $\#E(\Z/p\Z)$ is ``smooth'', i.e., a
product of small primes, or $E$ is ``supersingular'' in the sense
that $p\mid \#E(\Z/p\Z)$.  
The Microsoft curve has neither of these deficiencies, and I 
expect that the discrete logarithm on that curve is quite difficult.
This is not the weekness that ``Beale Screamer'' exploits in
breaking MS-DRM.

\subsection{ElGamal}
How can we set up a public-key cryptosystem using an elliptic curve?
The only public-key crytosystem that we've studied so far is the RSA
cryptosystem; unfortunately, there is no analogue of RSA for elliptic
curves!  (Informal Exercise: Think about what goes wrong.)

MS-DRM uses the El Gamal system.  Here's how it works. 
Start with a fixed, publicly known prime~$p$, an elliptic
curve~$E$ over $\Z/p\Z$, and a point $B\in E(\Z/p\Z)$.
Michael and Nikita choose random integers~$m$ and~$n$, which
are kept secret, and compute and publish $mB$ and $nB$.

In order to send a message $P$ to Michael, Nikita
computes a random integer~$r$ and sends the pair of
points $(rB, P+r(mB))$.  To read the message, 
Michael multiplies $rB$ by his secret key~$m$
to get $m(rB) = r(mB)$, and subtracts this from
the second point to get 
  $$P = P+r(mB)-r(mB).$$

As far as I can tell, breaking this cryptosystem requires solving the
discrete logarithm problem, so it's very difficult.

The following example is based on an example taken from Beale
Screamer's paper.
\begin{example}
Nikita's license files contains the pair of points
$(rB,P+r(nB))$, where
{\tiny$$
  rB = (179671003218315746385026655733086044982194424660,
697834385359686368249301282675141830935176314718)
$$}
and
{\tiny$$
 P+r(nB) = (137851038548264467372645158093004000343639118915,
110848589228676224057229230223580815024224875699).
$$}
Nikita's computer sneakily loads the secret key
$$
n = 670805031139910513517527207693060456300217054473
$$ into memory
and computes
{\tiny$$n(rB) = r(nB) = 
  (328901393518732637577115650601768681044040715701,
  586947838087815993601350565488788846203887988162).
$$}
It then subtracts this from $P+r(nB)$ to get
$$
  P = (14489646124220757767, \,669337780373284096274895136618194604469696830074).
$$
That~$x$ coordinate, $14489646124220757767$, is the top secret magic ``content
key'' that unlocks {\tt juno.wma}.
\end{example}

If Nikita knew the private key~$n$ that her computer generated, she
could compute~$P$ herself and unlock {\tt juno.wma} and share her
music with Michael, just like she used to share her favorite CDs with
Michael.  Beale Screamer found a weakness in Microsoft's system that
let him find~$n$:
\begin{quote}
``These secret keys are stored in linked lists ... interspersed with the
code in the library.  The idea is that they can be read by that
library, used internally by that library, and never communicated
outside the library.  Since the {\tt IndivBox.key} file is shuffled in
a random way for each client, these keys would be extremely difficult
to extract from the file itself. Fortunately, we don't have to: these
keys are part of the object state that is maintained by this library,
and since the offset within this object of these secret keys is known,
we can let the library itself extract the secret keys!  The code for
this simply loads up the `black box' library, has it initialize an
instance of the object, and then reads the keys right out of that
object.  This is clearly a weakness in the code which can be corrected
by the DRM software fairly easily, but for now it is the basis of our
exploit.''
\end{quote}

As you can see, Microsoft has undertaken a difficult and interesting
problem.  {\em How can Microsoft  store data on Nikita's
computer in such a way that Nikita can not access it, but Nikita's
computer can?}

\subsection{Why Use Elliptic Curves?}
There are several advantages to using elliptic curves instead
of $\Z/p\Z$ for cryptography, though the people at RSA Corporation
might disagree.  Elliptic curve cryptosystems with smaller key sizes
appear to be just as secure as ``classical'' $\Z/p\Z$ cryptosystems
with much larger key sizes, so elliptic curve cryptosystems can
be more efficient.  Another advantage, which I won't explain
at all, is that elliptic curve cryptosystems appear to be vastly
more secure over
``large finite fields of characteristic~$2$'' than RSA, which is
is very important in practical applications.  Also,
elliptic curves are simply way cooler than $\Z/p\Z$, so
they (used to) attract venture capitalists.

Some mobile phones also use elliptic curve cryptography.  Do you have an
elliptic curve in your pocket right now?


\begin{verbatim}
/* Base conversion */

function ToDeci(s)
   c := ["0","1","2","3","4","5","6","7","8","9","a","b","c","d","e","f"];
   ans := 0;
   b := 1;
   for i in [1..#s] do
      ans := ans + b*(Index(c,s[#s-i+1])-1);
      b := b*16;
   end for;  
   return ans;
end function;


p := 785963102379428822376694789446897396207498568951
k := GF(p);
E := EllipticCurve([317689081251325503476317476413827693272746955927,  79052896607878758718120572025718535432100651934]);
B  := E![k|771507216262649826170648268565579889907769254176, 390157510246556628525279459266514995562533196655];
rB := E![k|179671003218315746385026655733086044982194424660,697834385359686368249301282675141830935176314718];
PrnB := E![k|137851038548264467372645158093004000343639118915,110848589228676224057229230223580815024224875699];
n := 670805031139910513517527207693060456300217054473;
PrnB - n*rB;
(14489646124220757767 : 669337780373284096274895136618194604469696830074 : 1)
\end{verbatim}


\section{Factorization}

In 1987, Hendrik Lenstra published the landmark paper {\em Factoring
Integers with Elliptic Curves}, Annals of Mathematics, {\bf 126},
649--673, which you can download from the Math 124 web page. 
Lenstra's method is also described in \S{}IV.4 of Silverman and Tate's {\em
Rational Points on Elliptic Curves}, \S{}VIII.5 of [Davenport], and in
\S10.3 of Cohen's {\em A Course in Computational Algebraic Number
Theory}.

In this lecture and the next, I will tell you about Lenstra's clever
algorithm.  It shines at finding ``medium sized'' factors of an
integer~$N$, which these days means~$10$ to~$20$ decimal digits but
probaby not $30$ decimal digits.  The ECM method is thus not useful
for earning money by factoring RSA challenge numbers, but is 
essential when factoring most integers.  It also has small storage
requirements.   Lenstra writes:\vspace{1ex}

\begin{tabular}{lr}
\begin{minipage}{.6\textwidth}
{\sl ``It turns out that ... the elliptic curve method is one
of the fastest integer factorization methods that is currently
used in practice.  The quadratic sieve algorithm still seems
to perform better on integers that are built up from two prime
numbers of the same order of magnitude; such integers are of interest
in cryptography.''}
\end{minipage}\hspace{.5in}
&
\begin{minipage}{1.5in}
\includegraphics[width=1.5in]{graphics/lenstra.eps}
\end{minipage}
\end{tabular}

%Because one takes apart an integer using several different methods in
%concert, so it is necessary to know a wide range of factorization
%algorithms.

Lenstra's discover of the elliptic curve method was inspired by
Pollard's $(p-1)$-method.  I will spend most of the rest
of this lecture introducing you to it.

\subsection{Power-Smoothness}
\begin{definition}[Power-smooth]
Let $B$ be a positive integer.  A positive integer~$n$ is
{\em $B$-power-smooth} if all prime powers dividing~$n$ are
less than or equal to~$B$.  The {\em power-smoothness} of~$n$ is
the largest~$B$ such that~$n$ is $B$-power-smooth.
\end{definition}

The following two PARI functions compute whether or not an
integer is $B$-power-smooth and also the power-smoothness of~$n$.
\begin{verbatim}
{ispowersmooth(n, B) =   \\ true if and only if n is B-powersmooth
   local(F,i);
   F = factor(n);
   for(i=1,matsize(F)[1],if(F[i,1]^F[i,2]>B,return(0)));
   return(1);
}

{powersmoothness(n) =    \\ the powersmoothness of n.
   local(F,L,i);
   F = factor(n);
   L = 1;
   for(i=1,matsize(F)[1],L=max(L,F[i,1]^F[i,2]));
   return(L);
}
\end{verbatim}

\subsection{Pollard's $(p-1)$-Method}
Let~$N$ be an integer that we wish to factor.  Choose a positive
integer~$B$ (usually $\leq 10^6$ in practice).  The Pollard
$(p-1)$-method hunts for prime divisors~$p$ of~$N$ such that $p-1$ is
$B$-power-smooth.  Here is the strategy.
Suppose that $p\mid N$ and $a>1$ is an integer that is prime to~$p$.
By Fermat's Little Theorem, 
$$
  a^{p-1}\con 1\pmod{p}.
$$  
Assume that further that $p-1$
is $B$-power-smooth and let $m=\lcm(1,2,3,\ldots B)$.  Then
$B\mid m$, so 
$p-1\mid m$, and so 
$$
  a^m \con 1 \pmod{p}.
$$
Thus 
$$
  p\mid \gcd(a^m-1,N) > 1.
$$
Usually $\gcd(a^m-1,N)<N$ also, and when this is the case
we have split~$N$.  In the
unlikely case when $\gcd(a^m-1,N)=N$, then $a^m\con 1\pmod{q^r}$ for
every prime power divisor of~$N$.  In this case, repeat the above
steps but with a smaller choice of~$B$ (so that~$m$ is smaller).
Also, it's a good idea to check from the start whether or
not~$N$ is not a perfect power $M^r$, and if so replace~$N$ by~$M$.

In practice, we don't know~$p$.  We choose a~$B$, then an~$a$,
cross our fingers, and proceed.  If we split~$N$, great!
If not, increase~$B$ or change~$a$ and try again.

For fixed~$B$, this algorithm works when~$N$ is divisible by a
prime~$p$ such that $p-1$ is $B$-power-smooth.  How many primes $p$
have the property that $p-1$ is $B$-power-smooth?    Is this very
common or not?
Using the above two functions, we find that roughly 15\% of
primes~$p$ between $10^{15}$ and $10^{15}+10000$ are such that
 $p-1$ is $10^6$ power-smooth.

\begin{verbatim}
\\ Count the number of B-power-smooth numbers an interval.
{cnt(B)= s=0;t=0; 
   for(p=10^15, 10^15+10000,  
      if(isprime(p), 
         t++;if(ispowersmooth(p-1,B),s++)
      )
   ); 
   s/t*1.0
}
? cnt(10^6)
%5 = 0.1482889733840304182509505703
\end{verbatim}
Thus the Pollard $(p-1)$-method with $B=10^6$ is blind to 85\% of the
primes around~$10^{15}$.  There are nontrivial theorems about
densities of power-smooth numbers, but I will not discuss them today.

\subsection{Pollard's Method in Action!}
We now illustrate the Pollard $(p-1)$-method through several
examples.   

\begin{example}
Let $N=5917$.  We try to use the Pollard $p-1$ method with
$B=5$ to split~$N$.  We have 
$m = \lcm(1,2,3,4,5)=60$.  Take $a=2$.  We have
$$
  2^{60} - 1 \con 3416\pmod{5917},\qquad\text{(can compute quickly!)}
$$
so 
$$
 \gcd(2^{60}-1,5917) = \gcd(3416,5917) = 61.
$$
Wow, we found a prime factor of~$N$!

In PARI, these computations are carried out as follows:
\begin{verbatim}
      {lcmfirst(B) =  \\ compute the lcm of 1,2,3,...,B
          local(L,i);
          L=1;
          for(i=2,B,L=lcm(L,i));
          return(L);}
      ? lcmfirst(5)
      %8 = 60
      ? Mod(2,5917)^60 - 1
      %9 = Mod(3416, 5917)
      ? gcd(3416,5917)
      %10 = 61
\end{verbatim}
\end{example}

\begin{example}
Let $N=779167$.  First try $B=5$ and $a=2$:
$$
   2^{60}-1 \con 710980\pmod{N},
$$
and $\gcd(2^{60}-1,N) = 1.$
Thus no prime divisor~$p$ of~$N$ has the property that
$p-1$ is $5$-power-smooth.  Next, we try $B=15$.
We have $m=\lcm(1,2,\ldots,15)=360360$, and
$$
  2^{360360}-1 \con 584876\pmod{N},
$$
so
$$\gcd(2^{360360}-1 , N) = 2003,$$
and we have split~$N$!
\end{example}


\begin{example}
Let $N=61\cdot 71$.  Then both $61-1=60=2^2\cdot 3\cdot 5$ 
and $71-1=2\cdot 5\cdot 7$ are $7$-power-smooth, so 
Pollard's $(p-1)$-method with any $B\geq 7$ will fail, but
in a confidence-inspiring way. 
Suppose  $B=7$, so 
$
  m=\lcm(1,2,\ldots,7)=420.
$
Then
$$
  2^{420} - 1 \con 0 \pmod{N},
$$
so 
$\gcd(2^{420} - 1, N) = N$,
and we get nothing.
If we shrink~$B$ to $5$, then Pollard works:
$$
  2^{60} - 1\con 1464\pmod{N},
$$
and $\gcd(2^{60}-1,N) = 61$, so we split~$N$.
\end{example}


\subsection{Motivation for the Elliptic Curve Method}
Fix an integer~$B$.  If $N=pq$ with $p$ and $q$ prime and
neither $p-1$ nor $q-1$ a $B$-power-smooth number, then 
the Pollard $(p-1)$-method
is extremely unlikely to work.  For example,
let $B=20$ and 
suppose that $N=59\cdot 101 = 5959$.  Note that
neither~$59-1=2\cdot29$ nor $107-1=2\cdot 53$ is $B$-power-smooth.
With $m=\lcm(1,2,3,\ldots,20)=232792560$, we have
$$2^m - 1 \con 5944\pmod{N},$$
and 
$\gcd(2^m-1,N)=1$, so we get nothing.  

As remarked above, the problem is that $p-1$ is not $20$-power-smooth for
either $p=59$ or $p=101$.  However, notice that $p-2=3\cdot 19$ is
$20$-power-smooth!  If we could somehow
replace the group $(\Z/p\Z)^*$, which has order $p-1$, by a group
of order $p-2$, and compute $a^m$ for an element of this {\em new}
group, then we might easily split~$N$.  Roughly speaking, this is 
what Lenstra's elliptic curve factorization method does; it
replaces $(\Z/p\Z)^*$ by an elliptic curve~$E$ over $\Z/p\Z$.
The order of the group $E(\Z/p\Z)$ is $p+1\pm s$ for some
nonnegative integer $s<2\sqrt{p}$ (any $s$ can occur).  
For example, if~$E$ is the elliptic curve
$$
   y^2 = x^3 + x + 54
$$
over $\Z/59\Z$ then $E(\Z/59\Z)$ is cyclic of order~$57$.
The set of numbers $59+1\pm s$ for $s\leq 15$ contain
numbers with very small power-smoothness.

I won't describe the elliptic curve factorization method until the
next lecture.  The basic idea is as follows.  Suppose that we wish to
factor~$N$.  Choose an integer~$B$.  Choose a random point~$P$ and a
random elliptic curve $y^2=x^3+ax+b$ ``over $\Z/N\Z$'' that goes
through~$P$.  Let $m=\lcm(1,2,\ldots,B)$.  Try to compute~$mP$ working
modulo~$N$ and using the group law formulas.  If at some
point it is necessary to divide modulo~$N$, but division is not
possible, we (usually) find a nontrivial factor of~$N$.  Something
going wrong and not being able to divide is analogous to $a^m$ being
congruent to~$1$ modulo~$p$.

More details next time!



\subsection{The Elliptic Curve Method}
\begin{verbatim}
{isalmostpowersmooth(p,B)= local(r);
   for(r=p+1-floor(2*sqrt(p)),p+1+floor(2*sqrt(p)),
   if(ispowersmooth(r,B), return(1)) ) }
   cnt(B)=s=0;t=0;for(p=10^15,10^15+10000,
   if(isprime(p),t++;if(isalmostpowersmooth(p,B),s++,print("BAD
   ",p));print(s/t*1.0))); s/t*1.0
\end{verbatim}

I constructed
$
  N = 800610470601655221392794180058088102053408423
$
by multiplying together five random (and promptly
forgotten) primes~$p$ with the property that $p-1$ is not
$B$-power-smooth for $B=10^8$.  Since~$N$ is a product of five
not-too-big primes,~$N$ begs to be factored using the elliptic
curve method.

\subsection{The Elliptic Curve Method (ECM)}
The following description of the algorithm is taken from Lenstra's
paper [{\em Factoring Integers with Elliptic Curves}, Annals of Mathematics,
{\bf 126}, 649--673], which you can download from the Math 124 
web page.\vspace{1em}

\hspace{-4em}\noindent\begin{tabular}{lr}
\begin{minipage}{1.5in}
\includegraphics[width=1.5in]{graphics/cohen_lenstra.eps}
\vspace{-2em}
\begin{center}
\small Cohen and Lenstra
\end{center}
\vspace{.4in}
\end{minipage}
&\begin{minipage}{.77\textwidth}
``The new method is obtained from Pollard's $(p-1)$-method by replacing
the multiplicative group by the group of points on a random elliptic curve.
To find a non-trivial divisor of an integer $n>1$, one begins by
selecting an elliptic curve~$E$ over $\Z/n\Z$, a point~$P$ on~$E$
with coordinates in $\Z/n\Z$, and an integer~$k$ as above 
[$k=\lcm(2,3,\ldots,B)$].
Using the addition law of the curve, one next calculates the
multiple $k\cdot P$ of $P$.  One now hopes that there is a prime 
divisor~$p$ of~$n$ for which $k\cdot P$ and the neutral element~$\O$
of the curve become the same modulo~$p$; if~$E$ is 
given by a homogeneous Weierstrass equation
$y^2 z = x^3 + axz^2 + bz^3$, with $\O=(0:1:0)$, then this
is equivalent to the $z$-coordinate of $k\cdot P$ being divisible
by~$p$.  Hence one hopes to find a  non-trivial factor of~$n$
by calculating the greatest common divisor of this $z$-coordinate with~$n$.''
\end{minipage}\hspace{.1in}
\vspace{1em}
\end{tabular}

If the above algorithm fails with a specific elliptic curve~$E$, there
is an option that is unavailable with Pollard's $(p-1)$-method.  We may
repeat the above algorithm with a different choice of~$E$.  The number
of points on~$E$ over $\Z/p\Z$ is of the form $p+1-t$ for some~$t$
with $|t|<2\sqrt{p}$, and the algorithm is likely to succeed if
$p+1-t$ is $B$-power-smoth.

Suppose that $P=(x_1,y_1)$ and $Q=(x_2,y_2)$ are nonzero points
on an elliptic curve $y^2 = x^3 + ax + b$ and that $P\neq \pm Q$.  
Let $\lambda = (y_1-y_2)/(x_1-x_2)$ and
$\nu = y_1 - \lambda x_1$. 
Recall that $P+Q = (x_3,y_3)$ where 
$$x_3 = \lambda^2 -x_1 - x_2\qquad\text{and}\qquad
y_3 = -\lambda x_3 - \nu.$$

If we do arithmetic on an elliptic curve modulo~$N$ and at some point
we can not compute~$\lambda$ because we can not compute the inverse
modulo~$N$ of $x_1-x_2$, then we (usually) factor~$N$.

\subsection{Implementation and Examples}
For simplicity, we use an elliptic curve
of the form
$$y^2 = x^3 + ax + 1,$$
which has the point $P=(0,1)$ already on it.

The following tiny PARI function implements the ECM.  It
generates an error message along with a usually nontrivial factor of~$N$
exactly when the ECM succeeds.
\begin{verbatim}
{ECM(N, m)= local(E);
   E = ellinit([0,0,0,random(N),1]*Mod(1,N));
   print("E: y^2 = x^3 + ",lift(E[4]),"x+1,  P=[0,1]");
   ellpow(E,[0,1]*Mod(1,N),m);  \\ this fails if and only if we win!
}
\end{verbatim}
The following two functions are also useful:
\begin{verbatim}
{lcmfirst(B) =  
   local(L,i); L=1; for(i=2,B,L=lcm(L,i));
   return(L);
}
numpoints(a,p) = return(p+1 - ellap(ellinit([0,0,0,a,1]),p));
\end{verbatim}

First we will try the program on a small integer~$N$, then we will try
it on the~$N$ at the top of this lecture.  ({\tt ECM} uses the random
function, so the results of your run may differ from the one below.)

\begin{verbatim}
? N = 5959;           \\ This number motivated the ECM last time.
\\ Recall what happened when we tried to factor 5959 using the p-1 method.
? m = lcmfirst(20);   \\ B = 20.
? Mod(2,N)^m-1
%108 = Mod(5944, 5959)
? gcd(5944,5959)
%109 = 1               \\ bummer!
\\ Now we try the ECM:
? ECM(N,m)
E: y^2 = x^3 + 1201x+1,  P=[0,1]
%112 = [Mod(666, 5959), Mod(3229, 5959)]
? ECM(N,m)
E: y^2 = x^3 + 1913x+1,  P=[0,1]
  ***   impossible inverse modulo: Mod(101, 5959).
\\ Wonderful!! There's a factor--------/\
? factor(numpoints(1913,101))
%120 =
[2 4]                          \\ #E(Z/101) is 16-power-smooth, 
[7 1]                          \\ so ECM sees 101.
? factor(numpoints(1913,59))
%119 =
[2 1]                          \\ #E(Z/59) is 29-power-smooth,
[29 1]                         \\ so ECM doesn't see 59.

\\ Here's the view from another angle:
? E = ellinit([0,0,0,1752,0]*Mod(1,5959));
? P = [0,1]*Mod(1,5959);
? ellpow(E,P,2)
%127 = [Mod(4624, 5959), Mod(1495, 5959)]
? ellpow(E,P,3)
%128 = [Mod(3435, 5959), Mod(1031, 5959)]
? ellpow(E,P,4)
%129 = [Mod(803, 5959), Mod(5856, 5959)]
? ellpow(E,P,8)
%133 = [Mod(1347, 5959), Mod(2438, 5959)]
? ellpow(E,P,m)
  ***   impossible inverse modulo: Mod(101, 5959).
\end{verbatim}

Now we are ready to try the big integer~$N$ from the begining of the lecture.
\begin{verbatim}
? N = 800610470601655221392794180058088102053408423;
? B = 100;
? m = lcmfirst(B);
? ECM(N,m);
E: y^2 = x^3 + 273687051132207711452727265152539544370874547x+1,  P=[0,1]
... many tries .. 
? ECM(N,m);
E: y^2 = x^3 + 174264237886300715545169749498695137077020788x+1,  P=[0,1]
? B=1000;  \\ give up and try a bigger B.
? m=lcmfirst(B);
? ECM(N,m);
E: y^2 = x^3 + 652986182461202633808585244537305097270008449x+1,  P=[0,1]
... many tries ...
? ECM(N,m);
E: y^2 = x^3 + 755060727645891482095225151281965348765197238x+1,  P=[0,1]
? B=10000; \\ try an even bigger B
? m=lcmfirst(B);
? ECM(N,m);
E: y^2 = x^3 + 722355978919416556225676818691766898771312229x+1,  P=[0,1]
? ECM(N,m);
E: y^2 = x^3 + 124781379199538996805045456359983628056546634x+1,  P=[0,1]
? ECM(N,m);
E: y^2 = x^3 + 350310715627251979278144271594744514052364663x+1,  P=[0,1]
? ECM(N,m);
E: y^2 = x^3 + 39638500146503230913823829562620410547947307x+1,  P=[0,1]
  ***   impossible inverse modulo: Mod(1004320322301182911, 
                            800610470601655221392794180058088102053408423).
\end{verbatim}
Thus
$
 N = N_1 \cdot N_2 = 1004320322301182911 \cdot 797166454590134548773760793.
$
One checks that neither $N_1$ nor $N_2$ is prime.  Next we try ECM on each:
\begin{verbatim}
? N1 = 1004320322301182911; N2 = N / N1;
? ECM(N1,m);
E: y^2 = x^3 + 725771039569085210x+1,  P=[0,1]
  ***   impossible inverse modulo: Mod(1406051123, 1004320322301182911).
? ECM(N2,m);
E: y^2 = x^3 + 573369475441522110156437806x+1,  P=[0,1]
  ***   impossible inverse modulo: Mod(2029256729, 
                                        797166454590134548773760793).
\end{verbatim}
Now 
$$N = N_{1,1}\cdot N_{1,2} \cdot N_{2,1} \cdot N_{2,2} 
    = 1406051123\cdot 714284357 \cdot 2029256729 \cdot  392836669307471617,$$
and one can check that $N_{1,1}$, $N_{1,2}$, $N_{2,1}$ are
prime but that $N_{2,2}$ is composite.  Again, we apply ECM:
\begin{verbatim}
? N22 = 392836669307471617
%173 = 392836669307471617
? ECM(N22,m)
E: y^2 = x^3 + 133284810657519512x+1,  P=[0,1]
%174 = [0]
? ECM(N22,m)
E: y^2 = x^3 + 368444010842952211x+1,  P=[0,1]
%175 = [Mod(236765299763600601, 392836669307471617), 
                       Mod(63845045623767003, 392836669307471617)]
? ECM(N22,m)
E: y^2 = x^3 + 245772885854824846x+1,  P=[0,1]
%176 = [0]
? ECM(N22,m)
E: y^2 = x^3 + 33588046732320063x+1,  P=[0,1]
  ***   impossible inverse modulo: Mod(615433499, 392836669307471617).
\end{verbatim}
This time it took a long time to factor $N_{2,2}$ because~$m$ 
is too large so we often get both factors.   A smaller~$m$ would
have worked more quickly.
In any case, we discover that the prime factorization is
$$N = 1406051123\cdot 714284357 \cdot 2029256729 \cdot 615433499 \cdot 638308883.$$



\subsection{How Good is ECM?}

According to Henri Cohen (page 476 of {\em A Course in Computational
Algebraic Number Theory}):
\begin{quote}
``Unique among modern factoring algorithms however, it is sensitive to
the size of the prime divisors .  In other words, its running time
depends on the size of the smallest prime divisor~$p$ of~$N$, and not
on~$N$ itself.  Hence, it can be profitably used to remove ``small''
factors [...]. Without too much trouble, it can find prime factors
having~$10$ to~$20$ decimal digits [with $B$ around $10^4$].  
On the other hand, it very rarely finds prime factors having 
more than~$30$ decimal digits.  
\end{quote}



\section{Fermat's Last Theorem and Modularity}

In this section we sketch an outline of the proof of Fermat's last
theorem, then give a rigorous account of what it means for an elliptic
curve to be ``modular''.

\subsection{Fermat's Last Theorem}

\begin{theorem}
Let $n>2$ be an integer.  If $a, b, c\in\Z$ and
$$a^n + b^n = c^n,$$
then $abc=0$.
\end{theorem}


\begin{proof}[Proof (sketch)]
First reduce to the case when $n=\ell$ is
a prime greater than~$3$ (see Exercise~\ref{ex:prime}).  Suppose that 
$$
  a^\ell + b^\ell = c^\ell
$$
with $a, b,c\in\Z$ and $abc\neq 0$.  
Permuting $(a,b,c)$, we may suppose that $b$ is even and
that we have $a\con 3\pmod{4}$. 
Following Gerhard Frey, consider the elliptic curve~$E$ defined by 
$$
  y^2 = x(x-a^{\ell})(x+b^{\ell}).
$$
The discriminant of~$E$ is~$2^4(abc)^{2\ell}$
(see Exercise~\ref{ex:disc} below).


Andrew Wiles and Richard Taylor [Annals of Math., May 1995] proved that~$E$ 
must be ``modular''.  This means that there is a ``modular form'' 
$$f(z) = \sum_{n=1}^{\infty} a_n e^{2\pi i n z}$$
of ``level $N=abc$'' 
such that for all primes $p\nmid abc$, 
$$
  a_p = p+1-\#E(\Z/p\Z).
$$

Ken Ribet [Inventiones Math., 1991] used that the
discriminant of~$E$ is a perfect~$\ell$th power (away from~$2$)
to prove that there is  a cuspidal modular form 
$$
 g(z) = \sum_{n=1}^{\infty} b_n e^{2\pi i n z}
$$
of ``level~$2$'' such that 
$$
  a_p \con b_p \pmod{\ell}\qquad\text{for all }p\nmid abc.
$$  
This is a contradiction because
the space of ``cuspidal modular forms'' of level~$2$ 
has dimension~$0$ (see Section~\ref{sec:dim}).
\end{proof}


\begin{exercise}\label{ex:prime}
Reduce to the prime case.  That is, show that if Fermat's last theorem is
true for prime exponents, then it is true.
\end{exercise}

\begin{exercise}\label{ex:disc}
Prove that 
$y^2 = x(x-a^{\ell})(x+b^{\ell})$ has
discriminant $2^4(abc)^{2\ell}$.
\end{exercise}
% disc = (al^2*bl^2*2^4)*(al+bl)^2 = (al^2*bl^2*2^4)*(cl)^2 = (a*b*c)^(2l)*2^4.

The rest of this lecture is about the words in the proof that
are in quotes.

\subsection{Holomorphic Functions}
The complex {\em upper half plane} is the set
$$
  \h = \{z\in\C \,:\, \Im(z) > 0\}.
$$
A {\em holomorphic function} $f:\h\ra\C$ is a function
such that for all $z\in\h$ the derivative
$$
  f'(z) = \lim_{h\ra 0} \frac{f(z+h) - f(z)}{h}
$$
exists.  Holomorphicity is a very strong condition 
because $h\in\C$ can approach~$0$ in many ways.

\begin{example}
Let $\SL_2(\Z)$ denote the set of $2\times 2$ integers matrices
with determinant~$1$.   If $\gamma=\abcd{a}{b}{c}{d}\in\SL_2(\Z)$,
then the corresponding {\em linear fractional transformation}
$$
   \gamma(z) = \frac{az+b}{cz+d}
$$
is a holomorphic function on $\h$.  (Note that the only possible
pole of $\gamma$ is $-\frac{d}{c}$, which is not an element of~$\h$.)

For future use, note that if $f : \h\ra \C$ is a holomorphic
function, and $\gamma=\abcd{a}{b}{c}{d}\in\SL_2(\Z)$, then
$$
  f|_\gamma(z) = f(\gamma(z)) (cz+d)^{-2}
$$
is again a holomorphic function.
\end{example}

\begin{example}
Let $q(z) = e^{2\pi i z}$.  Then~$q$ is a holomorphic function
on~$\h$ and $q'=2\pi i q$.  Moreover,~$q$ defines a surjective
map from $\h$ onto the punctured open unit 
disk $D=\{z\in\C : 0<|z|<1\}$.
\end{example}

\subsection{Cuspidal Modular Forms}
Let~$N$ be a positive integer and consider the set
$$
  \Gamma_0(N) = \left\{\mtwo{a}{b}{c}{d}\in\SL_2(\Z) \,:\, N \mid c\right\}.
$$

\begin{definition}[Cuspidal Modular Form]
A {\em cuspidal modular form} of level~$N$ is a holomorphic function
$
  f : \h \ra \C
$
such that 
\begin{enumerate}
\item
   $f|_\gamma = f$ for all $\gamma\in\Gamma_0(N)$, 
\item 
   for every $\gamma\in\SL_2(\Z)$,
$$\lim_{z\ra \infty} f(\gamma(z)) = 0,$$ and
\item 
  $f$ has a Fourier expansion:
$$
    f = \sum_{n=1}^{\infty} a_n  q^n.
$$
\end{enumerate}
\end{definition}

\begin{exercise}
Prove that condition 3 is implied by conditions 1 and 2, so condition
3 is redundant.  [Hint: Since
$\gamma=\abcd{1}{1}{0}{1}\in\Gamma_0(N)$, condition 1 implies that
$f(z+1)=f(z)$, so there is a function $F(q)$ on the open punctured
unit disc such that $F(q(z)) = f(z)$.  
Condition 2 implies that $\lim_{q\ra 0} F(q) = 0$, 
so by complex analysis $F$ extends to a holomorphic function on the 
full open unit disc.]


\end{exercise}



\begin{definition}
The {\em $q$-expansion} of~$f$ is the Fourier expansion
$
  f = \sum_{n=1}^\infty a_n q^n.
$
\end{definition}

\begin{exercise}
Suppose that $f\in S_2(\Gamma_0(N))$.  Prove that
$$
 f(z) dz = f(\gamma(z))d(\gamma(z))
$$
for all $\gamma\in\Gamma_0(N)$.  [Hint: This is simple
algebraic manipulation.]
\end{exercise}

\begin{exercise}
Let $S_2(\Gamma_0(N))$ denote the set of cuspidal modular forms
of level~$N$.
Prove that
$S_2(\Gamma_0(N))$ forms a $\C$-vector space under addition.
\end{exercise}

\subsubsection{The Dimension of $S_2(\Gamma_0(N))$}\label{sec:dim}
The dimension of $S_2(\Gamma_0(N))$ is
$$
  \dim_\C S_2(\Gamma_0(N)) = 
   1+ \frac{\mu}{12} - \frac{\nu_2}{4} - \frac{\nu_3}{3} 
      - \frac{\nu_\infty}{2},
$$
  where
$\mu = N \prod_{p\mid N} (1+1/p)$,
and $\nu_2 = \prod_{p\mid N} \left(1+\kr{-4}{p}\right)$ unless $4\mid N$ in which case
$\nu_2=0$, and 
$\nu_3 = \prod_{p\mid N} \left(1+\kr{-3}{p}\right)$ unless $2\mid N$ or $9\mid N$
in which case $\nu_3=0$, and 
$\nu_\infty = \sum_{d\mid N} \vphi(\gcd(d,N/d))$.
For example, 
$$
  \dim_\C S_2(\Gamma_0(2)) = 
  1+ \frac{3}{12} - \frac{1}{4} - \frac{0}{3} - \frac{2}{2} = 0,
$$
and
$$
  \dim_\C S_2(\Gamma_0(11)) = 
  1+ \frac{12}{12} - \frac{0}{4} - \frac{0}{3} - \frac{2}{2} = 1.
$$
One can prove that the vector space $S_2(\Gamma_0(11))$ has basis 
$$
  f = q\prod_{n=1}^{\infty}(1-q^n)^2(1-q^{11n})^2 = 
q - 2q^2 - q^3 + 2q^4 + q^5 + 2q^6 - 2q^7 + \cdots.
$$

\begin{exercise}
Compute the dimension of $S_2(\Gamma_0(25))$.
\end{exercise}


\subsection{Modularity of Elliptic Curves}
Let $E$ be an elliptic curve defined
by a Weierstrass equation $y^2 = x^3 + ax + b$ 
with $a,b\in\Q$.
For each prime $p\nmid \Delta = -16(4a^3 + 27b^2)$,
set 
$$
  a_p  = p+1 - \#E(\Z/p\Z).
$$

\begin{definition}[Modular]
$E$ is {\em modular} if there
exists a cuspidal modular form
$$
  f(z) = \sum_{n=1}^{\infty} b_n q^n\in S_2(\Gamma_0(\Delta))
$$
such that
$b_p = a_p$ for all $p\nmid \Delta$.
\end{definition}

At first glance, modularity appears to be a bizarre and unlikely
property for an elliptic curve to have.  When poor Taniyama (and
Shimura) first suggested in 1955 that every elliptic curve is modular,
people were dubious.  But Taniyama was right.  The proof of that conjecture
is one of the crowning achievements of number theory.

\begin{theorem}[Breuil, Conrad, Diamond, Taylor, Wiles]
\mbox{}\vspace{-1.5em}\\
\begin{center}
{\sc Every elliptic curve over~$\Q$ is modular.}
\end{center}

\end{theorem}

\vfill

\noindent{}\includegraphics[width=1in]{graphics/wiles.eps}\\
\mbox{ }\hspace{1.5em}{\small Wiles}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%




\begin{exercises}

\item Make up a simple example that illustrates how to use
the ElGamal elliptic curve cryptosystem (see Lecture 29).  You
may mention Nikita and Michael if you wish.  Be very clear about what
you are illustrating so that the grader can effortlessly understand your
example.

\item Make up an example that illustrates an interesting
aspect of the Pollard $(p-1)$ factorization method.  

\item Make up an example that illustrates something that you
consider an interesting aspect of Lenstra's elliptic curves
factorization method.

\item Let~$R$ be a ring.  We say that Fermat's last
theorem is false in~$R$ if there exists $x,y,z\in R$ and $n\in
\mathbb{Z}$ with $n\geq 3$ such that $x^n + y^n = z^n$ and $xyz\neq
0$.  For which prime numbers~$p$ is Fermat's last theorem false in the
ring $\mathbb{Z}/p\mathbb{Z}$?

\end{exercises}
