 What else can we do with an elliptic curve? Well, one of the more interesting properties of elliptic curves is we can use them to factor large numbers. And this is an interesting problem because, as we'll see, there are some unusual implications of this. So let's consider this basic problem. If I take an elliptic curve E, and I'm going to be working mod n, where n is not necessarily a prime number, suppose I have some point P on the curve. Well, because I'm working mod n, there's only a finite number of points on the curve. So there has to be some k for which kP is 0, or point at infinity. And what this means is the line between k minus 1P and P must have undefined slope. And that's going to occur when the difference of our x values has a common factor with n. And this suggests the following method of factoring using elliptic curves. So I'll pick an arbitrary elliptic curve and any point on the curve. I'll evaluate k factorial P for k equals 2, 3, 4, and so on. And in general, if I want to evaluate k factorial P, I'm going to have to find the multiplicative inverse of a number mod n. Because at some point, I'll have to calculate the slope between two points, which means I'll have to divide, which means I'll have to multiply by the multiplicative inverse. Now, if I can't find that multiplicative inverse, then that means the number I'm working with and my modulus have to have a common divisor, which will be one of our factors. Now let's take a look at that, about 493. So I'll pick an arbitrary elliptic curve, for example, x cubed plus x plus 1. And I'll pick an arbitrary point on the curve. Well, how about 0, 1? That works out nicely. And I'll find k factorial 0, 1 for k equals 2, 3, and so on, as far as we can or as far as we care to. So 2 factorial 0, 1 using my elliptic curve addition formula 370307. 3 factorial 0, 1. Well, remember, as with Pollard's P minus 1 algorithm, the advantage using factorials is that every factorial is n times the preceding factorial. So 3 factorial 0, 1 is 3 times 2 factorial 0, 1. And I know what 2 factorial 0, 1 is. So I'll substitute that in. I'll use my elliptic formula. And there's my point. 4 factorial, well, it's 4 times 3 factorial. I know what 3 factorial is. And I want to find this point, 31629. Now, if I want to find this point, note that if I use the fast-powering algorithm, what I do is I start with finding 2 times 31629. And I have to calculate the slope. So I'll calculate it. This is the slope of the tangent line. So that's 3x squared plus 1 over 2 times y. And I calculate that. And now at this point, I need to find the multiplicative inverse of 58. And well, I can't. I can try to find the multiplicative inverse using the Euclidean algorithm. But when I try to do that, the Euclidean algorithm to find the multiplicative inverse fails. And since it fails to exist, that means 58 and 493 have to have a common divisor. And in fact, I can find that common divisor. It works out to be 29. And in fact, the process of finding that multiplicative inverse will tell us that. And since our goal was to factor 493, I can find the other factor using a division, 493 divided by 29, is 17. Well, let's take a look at another example, 1,081. So again, I'll pick an arbitrary elliptic curve. I'll pick an arbitrary point on the curve. And I'll find k factorial of that point as far as I care to. So 2 factorial, 3 factorial. And using the fast-powering algorithm again, I'm going to find three of these by first finding two of these, which I can do. It's 59, 4, 30. And then I'll add one of these plus two of these to get three of these. So let's see what is that. I have to find the slope, difference of the y-coordinates, difference in the x-coordinates. Works out to be 296 over 329. I need the multiplicative inverse of 329. I apply my algorithm to find it, and I can't. Because in the process of trying to find the multiplicative inverse, I find that these two numbers are modulus. And what I'm trying to find the multiplicative inverse of has a common factor. And that factor is 47. And again, 1,081, 47 times 23 is our actual factorization. At this point, it's worth noticing something very interesting here. We found a factorization of 1,081 in, essentially, two steps. If I had tried to factor this number using Pollard's P minus 1 algorithm, remember that we have to go up to n factorial, where n is the largest prime divisor of P minus 1 or Q minus 1. So here, 47, one of our prime factors, that's P minus 146, is 23 times 2. Here, 23 is our other prime factor. 23 minus 1 is 22. It is 2 times 11. If we tried to use the P minus 1 algorithm to factor this, we'd have to go up to 11 steps to get the factorization. Here, our elliptic curve factorization got the factorization in just two steps. And part of the reason for that is the P minus 1 algorithm requires us to use these two numbers, 47 and 23. Meanwhile, the elliptic curve factorization algorithm, in some sense, is based on numbers close to 1,081. And if numbers close to 1,081 have a set of small prime factors, our elliptic curve factorization algorithm is going to conclude much more quickly. And what this means is that all those nice guidelines we had for choosing P and Q that would make the product hard to factor, elliptic curves bypass many of those requirements. And so now the problem of choosing good prime numbers becomes a lot harder. And in fact, at this point, it is not completely solved.