ASPECTS SUBSTANTIATION OF CORRECTNESS AND ADVANTAGES OF LENSTRA FACTORIZATION METHOD ON EDWARDS

The factorization problem, which is the basis for many classical asymmetric cryptosystems (RSA, Rabin, and others) and a cryptographically strong generator of pseudo-random sequences (PBS), has been investigated in this paper. The methods that served as prototypes for the Lenstra method were described, the method for factorization of numbers, which is analogous to the Lenstra method on Edwards curves, has been proposed. To substantiate the correctness of the method, an appropriate mathematical apparatus was developed. In addition, an analog of the Lenstra method on Edwards curves was constructed with the use of the presented apparatus; the appropriate algorithm for the factorization of numbers was designed. The correctness of the method and correctness of the algorithm operation were substantiated mathematically; the top analytical estimates of its performance speed, as well as the lower estimates of success probability, have been strictly proved. The advantages of the developed method in comparison with the classical Lenstra method, which applies elliptic curves in the Weierstrass form, were presented and strictly substantiated. A comparative analysis of the new and the classical algorithms was performed. Results of the research provided a strict proof that the new algorithm on full Edwards curves, in comparison with the classic one, has some advantages in terms of performance speed, by about 1.5 times. The presented experimental results show that the performance speed increases even larger (by up to 30 per cent) in case the twisted and quadratic curves are used instead of full Edwards curves. It was shown that the assessment of probability of success of the new method increases due to the emergence of new conditions that lead to success of the algorithm that are not satisfied for the classical Lenstra algorithm on Weierstrass curves. The obtained results make it possible to decrease the time required for solving the problem on factorization by approximately 1.5 times, and thus, enable the faster breaking of cryptosystems whose stability is based on this problem


Introduction
The problems of information security that exist at present are solved by the methods and algorithms, the cryptographic resistance of which is based, particularly, on the complexity of solution to the factorization problem -the search for a

рази. Наведено експериментальнi результати, якi показують, що швидкодiя зростає iще бiльше (до 30 вiдсоткiв), якщо замiсть повних кривих Едвардса використовувати скрученi та квадратичнi кривi. Показано, що оцiнка iмовiрностi успiху нового методу зросте за рахунок появи нових умов, якi приводять до успiху алгоритму та якi не iснують для класичного алгоритму Лєнстра на кривих Вейєрштраса.
Отриманi результати дозволяють зменшити час, необхiдний для розв'язку задачi факторизацiї, приблизно у 1. 5  were performed, which is equivalent to almost 2,000 years of computations on a single-core processor of 2.2 GHz and the technical potential of more than 5 grid systems, specifically, Grid'5000, was used. Factorization of 1024-bit RSA number according to the estimation of authors in [1] is 1,000 times as complex as RSA-768. That is why modern requirements for the length of the RSA number (1,024 and 2,048 bits) ensure, at a guarantee and with a significant margin, the security of a cryptosystem against a significant increase of computing capabilities or new algorithms emergence. Based on the Moore's law, it can be argued that with the increasing power of computers, it becomes possible to increase proportionally the efficiency of the factorization algorithms. However, in addition to the time of computations another important resource for this problem is the amount of memory used. For example, a significant memory capacity is needed for algorithms of sifting -a numerical sieve and a quadratic sieve.
A more detailed review of the modern factorization methods, including the Lenstra method, the relevance and modern progress in factorization problem solving can be found in papers [2,3].
The Lenstra method [4][5][6][7][8] is one of the fastest general methods of integer number factorization. It can be used both as a separate factorization method, and as one of the stages of the "sifting" methods, which are the fastest factorization methods [9][10][11]. This algorithm uses the elliptic curve over the rational numbers field and some its reduction by the integer modulo, and requires about 2log 2 k additions of the points of this curve, where k is the algorithm parameter, the choice of which defones the probability of success of the algorithm. Therefore, the operation time of the Lenstra algorithm is proportional to the time of points addition. This fact naturally suggests using such elliptic curves, on which the operation of points addition runs fastest, particularly, Edwards curves, to implement this method.
However, it should be noted that the classic Lenstra algorithm is based on some property of elliptic curves in the Weierstrass form, which is absent for Edwards curve. This property is the existence of a point on infinity, which has no coordinates and, therefore, is not a solution of the corresponding curve equation. That is why it is not possible to transfer directly the Lenstra method on Edwards curves.
The existence of fast number factorization algorithms is a sufficient condition for breaking the RSA cryptosystem and other similar cryptosystems. That is why the problem of construction and substantiation of such algorithms will be relevant as long as the RSA-like cryptosystems are widely used.

Literature review and problem statement
The Lenstra number factorization method was proposed in [4]. For factorization of integer n=pq, which is the product of two integers p and q, Lenstra suggested using an analogue of an elliptic curve in the Weierstrass form over ring Z n . The powerful mathematical apparatus that is best described in [7] was developed to substantiate the correctness of operation, estimation of time and probability of success of the method. Although the Lenstra method is not the fastest factorization method, it can perform factorization in those cases where the fastest "sifting" methods appear to be powerless.
Later, the Lenstra method started to be used on the Montgomery curves, which made it possible to increase its speed. With the emergence of a new form of elliptic curves, the so-called Edwards form, the interest in the Lenstra method significantly increased. The first work on this topic is the research of Bernstein [9], which presented the conditions of such Edwards curves existence, which would surely contain the points of small orders, for example, orders of 2, 4, 6, 8. It was also experimentally shown that the probability of success of the algorithm on Edwards curve that contains the points of such orders is increasing within one percent.
In paper [11], the proposed ideas were improved, due to which, according to the experimental data, the probability of success is growing by another 1-2 %. In article [2], it is proposed to combine the use of curves in the Montgomery form and in the Edwards form to achieve the best results when using in some algorithms of factoring integer and computing of discrete logarithm.
However, it should be noted that the following problems were considered in none of these works: -construction of a clear description of the Lenstra factorization algorithm that takes into consideration the specificity of Edwards curves; -mathematical proves of correctness of this algorithm on Edwards curves; -analytical estimations of its speed and a gain in performance speed; -analytical estimations of the probability of success and its increase relative to the probability of success of the Lenstra method on the Weierstrass curves.
The main findings regarding the effectiveness of the method were made based on the experimental data, and the mathematical statements, obtained in them, mostly concerned certain technical details of the algorithm implementation (selection of the parameters of a curve, selection of coordinates, etc.).
That is why many theoretical problems remain unresolved. First of all, it is due to the necessity to develop such a mathematical apparatus that will make it possible to obtain for Edwards curves the similar results to previously obtained for Weierstrass curves. Consequently it appears appropriate to conduct studies in this direction to answer at least a part of the listed issues.

The aim and objectives of the investigations
The aim of this investigation is the development and strict mathematical substantiation of the Lenstra method on Edwards curves, as well as substantiation of its basic properties, advantages and offering the recommendations regarding the application.
That is why the objectives of this research can be stated as follows: -to develop the mathematical apparatus, necessary for adaptation of the Lenstra method for Edwards curves; -using the specified mathematical apparatus, to design the modification of the Lenstra method, adapted to Edwards curves, and to substantiate correctness of this method; -to provide a detailed algorithm that implements the Lenstra method on Edwards curves; -to construct the analytical estimates of the algorithm characteristics (speed, probability of success), to explore possible changes in the algorithm performance, using differ-ent types of Edwards curves, make an additional analysis of the algorithm operation.

1. Basic factorization methods. Features and benefits of the Lenstra method
Among modern factorization methods, we will separate the following exponential by complexity algorithms: the Pollard's p−1 algorithm, probabilistic Pollard's rho algorithm, the Shanks methods. The sub-exponential algorithms include the quadratic sieve algorithm, other sifting algorithms, the Dixon method, the Lenstra elliptic-curve factorization algorithm. We will note that the complexity of some algorithms depends on number of digits of the factorized number, while for the others, such as Pollard's rho-method, the Lenstra algorithm; it depends on the value of the sought-for divisor. We will separately emphasize that the selection of algorithm depends on the information about the factorized number, for example, about its special form or the special properties of its divisors. In addition, it is worth taking into consideration the amount of memory available for storing intermediate computations results, for example, for sifting algorithms.
In terms of security against cryptanalysis algorithms, it is possible to select prime numbers when constructing cryptosystems so that the use of number factorization algorithms would be ineffective. However, this approach will not work for the Lenstra method. This is its essential advantage. It is not possible to sort out all elliptic curves over the specified prime field to check the properties. That is, we can in advance select such prime numbers that their product surely cannot be factorized within the time acceptable for all the other methods, but this statement is not true regarding the Lenstra method. That is why one never knows beforehand how vulnerable to this method such product will be.

2. The prototype of the classic Lenstra methodthe Pollard's p−1 method
Let us start with the description of the Pollard's p-1 method [7,8,14], which can be considered as the Lenstra method prototype. The successful application of the Pollard method is possible only for the numbers of a certain kind. It is quite effective in such cases. The main purpose of this method consists in searching prime divisors of composite number n. Suppose that one of the prime divisors p of this number has the following property: all prime divisors of p-1 are "small", for example, they are not exceeding a certain number B.
Let us assume that a is such natural number that (a, p)=1. Then, according to the Fermat's little theorem a p-1 =1(mod p), that is p|a p-1 -1, therefore, (n, a p -1)=p.
But number p is unknown, so we do the following. Let s 1 , s 2 ,…, s r be first r of prime numbers, e 1 , e 2 ,…, e r are small prime numbers. We will compute The algorithm operation will be successful if Indeed, with respect to condition (2), equality a k ≡ ≡1(mod p) is satisfied, that is why It should be noted that equality (2) is not a necessary condition fulfillment of equality (3). Actually, let us (a, p)=1, then ord(a mod p)=l|p-1. Then to fulfill condition (3), it is enough That is, if number a is such that its multiplicative order is small enough in Z p * , it is sufficient to find divisor p of n from condition (3). In this case, condition (4) is much weaker than condition (2), and probability of its satisfaction for random number a is equal to (4) is satisfied, the time of algorithm operation is equal 2log(2kn) operations. The Pollard algorithm can be written down step-by-step as follows:

Algorithm 1 p-1 -the Pollard method
Input: n -composite. 1. Select k that has the form (1) (or we select in any other way so that k should have many small prime divisors, for example, k=HCK(2,…, M) for natural number M).
2. Randomly select a so that 1<a<n. 3. Compute D=(a k -1, n). If 1<D<n, then p=D. The algorithm derives value p and completes the work.
If D=1, come back to step 1 and select larger value of k.
If D=n, come back to step 2 and select a new value of a. Algorithm 1 successfully completes the work only in case, if one is lucky to find such a, for which condition (4) at some k is satisfied. The higher the value of k, the greater the probability of success. That is why it is necessary to select this number as high as computational capabilities allow. If for all divisors p of n, the following condition is satisfied: p-1 have only large prime divisors, the time algorithm operation is not essentially different from the operation time of the complete sorting algorithm.

3. The classic Lenstra algorithm
The prototype of the classic Lenstra algorithm -the Pollard method -is based on the fact that under certain conditions, it is possible to pick up such natural number a that for some p|n, its order in group Z p * is small enough. However, the main shortcoming of this method is impossibility of using it under condition that all divisors p of number n are the ones that p-1 have large prime divisors. That is, number n can be constructed in advance so that the Pollard algorithm could be impossible to apply.
The method, proposed by Lenstra [4][5][6], does not have this drawback. The reason for this is that the group, in which the Lenstra method operate, for the same number p can be constructed in many different ways. That is why the existence of small orders elements in group does not depend on factorization of number p-1. This is what differs the Lenstra method from the Pollard methods and the others, which can operate only in group Z p * . The basic idea of the Lenstra method is to use group E p of the points at an elliptic curve above field F p instead of group Z p * , and a certain point P of this curve instead of number a. By the Hasse's theorem, the number N(E p ) of the curve points is evenly distributed within ( ) That is why among all the curves, it is possible to find the one, the order of which has many "small" divisors. Then, accordingly, the probability to select point , p P E ∈ that has "small" order, specifically, the order that is a divisor of number k, determined in (1), is quite high. Specifically, if E p is cyclic (like the group of the points on Edwards curve), the probability of selecting a "suitable" point is equal to |k, the probability of success will be equal to 1. Actually, in this case (k, Correctness of the Lenstra algorithm operation is provided by the following theorem. Theorem 1 (The Lenstra theorem, [7]) ∈ is a certain elliptic curve, for which condition (4b 3 +27c 2 , n)=1 is satisfied. Let us assume that P 1 and P 2 are such points on this curve that P 1 ≠P 2 and denominators of coordinates are co-prime with n. Then point P 1 +P 2 has such coordinates, in which denominators are coprime with n, then and only then when for any space p, which is a divisor of number n, the sum of points P 1 modp+P 2 modp on curve Emodp is not equal to a point on infinity.
The Lenstra algorithm can be written down step-by-step as follows:

Algorithm 2
Classic Lenstra method Input: n -composite. 1. Select randomly b, x 0 , y 0 from 2 to n. 5. Using the Horner's scheme, sequentially compute kP from the formulas of points addition on the curve [7]. In this case, if in the process of computation, there occurred a situation when at points addition P 1 (x 1 , y 1 ) and P 2 (x 2 , y 2 ), denominators in coordinates of point P 3 (x 3 , y 3 )=P 1 +P 2 are not co-prime with n, that is, 1<D<n, where ( ) ( ) If D=1 for all the time of computations, or at a certain step D=n, it is necessary to return to step 4 and increase the value of k (as long as computational capabilities allow), or return to step 1 and select a new elliptic curve.
According to approximated estimates, presented in [5,6], if number k has the form (1) Repeating the algorithm several times for different parameters of the curve and different points, we increase the success probability.
The time complexity of algorithm, according to the estimations from the same work is for some λ>0, where parameter λ depends on the time of performance of addition of points on the curve. As we can see, the time complexity of algorithm is the same as the best factorization algorithms.

Development of the mathematical apparatus necessary for the construction and substantiation of the Lenstra method on Edwards curves
The equation of the elliptic curve in the form, which later took the name "Edwards form", was suggested in paper [12]. The isomorphism (under certain conditions) between the curves in the Weierstrass form and in the Edwards form was proved. However, the curves, proposed in [12], were weak from the cryptographic point of view. But paper [12] was quickly followed by paper [13], where the Edwards curves were modified by the introduction of a certain parameter. The equations of the curves, proposed in [13], over a finite field of characteristics p>2 take the form: where parameter d is the quadratic non-residue by modulo p.
Hereafter, for simplification, we will consider e=1 and explore curve E p , assigned over prime field F p by equation The main differences (almost all of which are advantages) of the Edwards curve compared with the Weierstrass curve are the following.
x y x y y y x x x y x y dx x y y dx x y y 2) The absence of "the point on infinity". Thus, the neutral element is a usual point of the Edwards curve with coordinates (0.1), which obviously fulfill equation (7).

3) Group E p is always cyclic. 4) The order of group E p is always divided by 4.
The property of the Edwards curve can be considered an insignificant disadvantage due to the fact that its subgroup of the large prime order, on the basis of which cryptosystems are constructed, will have at least 4 times as few points as the whole group, that is, at least three-quarters of the points of the group are "extra".
5) The record speed of points addition. This property is one of the most important advantages of the Edwards curve. Thus, approximately 1.5 as little bit operations are required for two (different) points addition of the Edwards curve rather than points addition of the Weierstrass curve; at points doubling, the number of bit operations is even less. There is an especially significant gain in performance speed for the so-called twisted Edwards curves, the equations of which differ from equation (7) by the existence of a certain additional parameter [15,16]. 6) Uniformity of the addition law. The formulas for adding points along the Edwards curve are the same for adding different points and for doubling point. This increases stability of cryptosystems on the Edwards curves to timing and capacitive attacks, aimed at determining the number, by which the point of a curve is multiplied.
We will remind that the major operation that is performed in the Lenstra algorithm is adding points on the elliptic curve. More precisely, its implementation requires about k operations of points addition, where k is determined according to (1). That is why at a significant increase in performance speed of this operation, the algorithm time complexity will also be greatly enhanced.
If the order of Weierstrass curve has exactly two points of the fourth order, then it will be isomorphic to some Edwards curve (6). The necessary and sufficient conditions for the existence of exactly two points of the fourth order, as well as formulas that define an isomorphism, can be found in [17,18].
The proposed Lenstra algorithm for the Edwards curve mainly consists of the same steps as the classic algorithm, but the substantiation of the correctness of its operation on the Edwards curve is quite different. Correctness of the operation of the classic algorithm is based on the Lenstra theorem, various modifications of which can be found in [4][5][6][7]. And correctness of the operation of the namesake algorithm for the case with the Edwards curve is partly based on theorem 1 from [19] and will be partly substantiated by the results, proved further in this paper. Similarly, for any point (x 1 , y 1 )∈E p , such point (x 2 , y 2 )∈E p will be found that ( ) Proof Let us take an arbitrary point (x 1 , y 1 ), which satisfies equation (9) and the one that x 1 y 1 ≠0. We will put

A B A B A B x y
x y x y x y dx y dx y dx y that is, (10) where the last but one equation is true due to (12). It follows from (13)  a subset of a set of points of Cartesian product Z n ×Z n , which satisfies the correspondent congruence. Definition 1: a set of points (14) will be called the generalized Edwards curve over the residue ring Z n .
For arbitrary prime p, which is a divisor of n, we will designate by E n modp the curve, formed from E n by the reduction of its coordinates by modulo p:  (14) by reducing by modulo p. We will note that so far we do not introduce the operation of points addition on this curve and do not explore its closure under this operation.  Coordinates of point n T E ∈ will be obtained from the system of congruencies Since (p, q)=1, then according to the Remainder Chinese Theorem, in set {0, 1,…., n-1}×{0, 1,…., n-1} there is a single pair (x, y), which satisfies (18) and (19). In this case, xmodp=x p , ymodp=y p , xmodq=x q , ymodq=y q , that is why for point T=(x, y), Tmodp=T p , Tmodq=T q is satisfied and, as it was mentioned above, this is a single point.
We will show that , n T E ∈ that is, (14) holds for its coordinates (x, y).
Since mod , Based on similar considerations, congruence will fulfill ( ) Since n=pq and (p, q)=1, then, by the properties of congruencies, fulfillment of congruencies follows from (21) and (22) ( ) The theorem is proved. Now we will state the theorem, which will be used during the estimation of the probability of Lenstra algorithm success, proposed below.

Theorem 4.
Let n be composite number, which is divided by prime number p; E n is the Edwards curve over ring Z n , assigned by equation (9); P is its point. Let it for some N k ∈ , condition holds ( ) where by the order of point Pmodp, we imply its order as an group element of Edwards curve points in the generalized form (according to the classification of curves, proposed in [15]) E n modp. Then, the following condition holds for point kP: either enumerators, or denominators of its coordinates have a common divisor with number n that is larger than one.
Proof. Let us assume that denominators of the coordinates of points k(Pmodp) are co-prime with number n. Then, according to Theorem , n)≥p. The Theorem is proved.

The algorithm that implements the Lenstra method on Edwards curves, and its properties: construction and substantiation
We will state the ideas that lie at the core of the Lenstra algorithm on the Edwards curves and construct the algorithm itself. The first of the ideas is the following. If parameter p d Z ∈ in equation (8) is quadratic residue, then according to Theorem 2, there surely be found such pairs of points on the curve (and there will be quite of lot of such pairs), the denominator of points addition will be equal to zero. Then, we consider n=pq, where p and q are unknown prime numbers. If we choose such * , n d Z ∈ that 1, d n   = -    then by the property of multiplicativity of a Jacobi symbol, We will consider for certainty that mod . p d p Q ∈ We will consider E n , determined in the following way: first we will assign curve E:x 2 +y 2 =1+dx 2 y 2 over the field of rational numbers, then we will construct its reduction E n =E modn by modulo n (detailed explanations will be found in [7]). Then such points P 1 and P 2 are sure to be found on curve E n , so, point (P 1 +P 2 )modn will have the denominator that is divided by p, that is, the one, for which the common divisor with number n will be equal to p.
The second idea is similar to the one that is used in the classic Lenstra algorithm. If the order of point Pmodp is "small" enough, i.e. it is a divisor of k, the x-coordinate of point kPmodp is congruent to zero by modulo p, because the largest common divisor of point kPmodp x-coordinate will be larger than one.
It is possible to construct the following Lenstra algorithm for an Edwards curve.

Algorithm 3 Lenstra algorithm on Edwards curves
Input: n -composite. 1. Choose randomly x 0 , y 0 from 2 to n-1. 8. Select k, which takes the form (1) (or select in any other way so that k would have many small prime divisors: for example, k=HCK(2,…, M) for some natural M). 9. Using the Horner's scheme, compute sequentially kP from formulas (7). In this case, every time computing points P 1 (x 1 , y 1 ) and P 2 (x 2 , y 2 ) addition, we compute D i , i=4, 5, 6, 7 from formulas: 10. If in the course of computations there occurred the situation at points addition P 1 (x 1 , y 1 ) and P 2 (x 2 , y 2 ) for some i=4, 5, 6, 7, 1<D i <n, then p=D i . The algorithm derives the values of p and completes the work.
11. If, when computing kP, one failed to find a non-trivial divisor of number n, return to step 1 and re-select x 0 , y 0 , or d, or increase the value of k (as long as computational capabilities allow).

Discussion of the characteristics and advantages of the constructed algorithm
Let us analyze the characteristics of Algorithm 3. The number of its points additions is the same as for Algorithm 2, but due to the fact that Algorithm 3 uses the Edwards curves, each points addition will be performed approximately by 1.5 times faster. That is why the algorithm itself will be not less than 1.5 times better.
Although the main purpose of the work to get a gain in performance speed, it is important that the probability of success of Algorithm 3 should be significantly higher than for Algorithm 2, as a minimum due to extra checks (23), correctness of which is based on Theorem 2.
It is possible to additionally increase the probability of success of the algorithm by using twisted and quadratic Edwards curves instead of full curves. Probability increase in this case will take place at the expense of special points existence on such curves, getting on which also leads to the success of the algorithm. We will note that an increase in the probability of success of the algorithm automatically leads to an increase in computing speed, since in this case the average number of steps to success decreases.
To research an increase in computing speed of Algorithm 3 during the transition to twisted and quadratic curves, we conducted a number of experiments with using standard data types, which show that when using twisted or quadratic Edwards curve, the average number of steps to success is reduced by 20-30 %. These experimental results clearly indicate that the existence of specific points on the Edwards curve greatly affects the algorithm complexity and success probability. However, the analytical expressions for the construction of enhancing speed estimates and probability when using twisted and quadratic curves have not been obtained yet.
The merits of this research in comparison with the analogues [2,3,9,10] is that the theoretical proves of the correctness of the Lenstra method on the Edwards curves was presented, the appropriate step-by-step algorithm was designed and it was proved that its characteristics are better than those of the classic Lenstra algorithm.
A comprehensive analysis of the possibilities and advantages of this algorithm when using quadratic and twisted Edwards curves requires a more complicated mathematical apparatus (it especially applies to the formulation and proof of the generalizations of theorems 3 and 4) and significant computation capacities for carrying out experiments on large numbers.
The shortcomings of the research include the fact that the obtained and theoretically grounded results apply only to the full curves by Edwards. At the same time, the experimental results indicate that time of algorithm operation and the probability of its success for quadratic and twisted curves can be significantly better than those for the full ones.
That is why we believe that further analysis should focus following directions: -development of the mathematical apparatus, which would theoretically prove the correctness of application of the Lenstra method on the twisted and quadratic Edwards curves; -the development of the appropriate algorithm, construction and proof of analytical estimates of its characteristics (time of operation, probability of success).
We will emphasize that one of the main advantages of this algorithm is that we can not only re-select k or P, but the elliptic curve itself, that is, the group in which the algorithm operates. That is why, unlike other known factorization algorithms, it is impossible to protect from this algorithm, picking up some prime divisors of number n, since it is impossible to sort out all elliptic curves over the corresponding fields and check the orders of all points.

Conclusions
1. The new mathematical apparatus was developed and proved that allowed to construct and prove an analogue to the Lenstra algorithm for the full Edwards curves. The necessity of developing the new mathematical apparatus is related to the fact that Lenstra algorithm operation correctness proof on Edwards curve is based on completely different principles than classic case with Weierstrass form elliptic curve.
2. Using the developed mathematical apparatus, the modification to the Lenstra method for Edwards curves was created; the correctness of this method was proved. To substantiate the correctness of the Lenstra method, the theorems about the properties of the group of points at Edwards curves were stated and proved. These theoretical results also make it possible to construct the algorithm that implements the Lenstra method on Edwards curves.
3. A detailed step-by-step algorithm that implements the Lenstra method on Edwards curves was constructed. Theorem 2 and 4 were proved, from which it directly follows that the conditions for the success of this algorithm are wider than those of the classic Lenstra method. That is why the probability of success of the constructed algorithm is higher.
4. Comparative estimates of algorithm time complexity and probabilities of its success were constructed. It was proved that the time complexity of Lenstra algorithm modification on the Edwards curves is at least 1.5 times more efficient in comparison with classic algorithm.
The experimental results of the algorithm application made the basis for a reasonable assumption that using twisted and quadratic Edwards curves (instead of full ones) cause increase of success probability of the algorithm. This is due to the existence of a large number of special points, reaching which during the algorithm implementation leads to its successful completion.