Pollard's p−1 Method and Its Relatives

Q: How should the bounds be chosen?

B1 sets the smoothness threshold and the cost of stage one; B2 extends the reach for one additional prime. Standard practice is to start with modest bounds, run the method as a cheap speculative stage, and escalate only if the structure of the problem suggests smoothness is likely.

Q: Does the method work when n has several smooth factors?

It finds them all at once, returning n and thus nothing useful. Taking GCDs at intervals during the exponentiation separates the factors, because the first one to satisfy the condition is caught before the others do.

Q: Is p-1 obsolete now that ECM exists?

No. It is far cheaper per attempt, and when p−1 happens to be smooth it succeeds immediately where ECM would need many curves. It costs one exponentiation to try, so it remains a standard early stage.

Executive summary

A special-purpose method that is nearly free to try

If p − 1 is smooth, then for a suitable exponent M built from small prime powers, a^M ≡ 1 (mod p) by Fermat, so gcd(a^M − 1, n) reveals p. The method succeeds only for factors with this special property, but it costs little to attempt and is therefore standard in every pipeline. Its failure against deliberately chosen primes is exactly what motivated ECM.

Learning objectives

State the smoothness condition the method requires.
Implement both stages and explain what the second stage adds.
Describe the p+1 variant and when it applies.
Explain the implications for cryptographic prime selection.
Position the method relative to ECM.

Section 01The first stage

AlgorithmPollard p−1, stage onein: n, bound B₁ → out: a factor p with p−1 B₁-smooth

Choose a smoothness bound B₁ and a base a, commonly 2.
Set M ← ∏ q^{⌊log_q B₁⌋} over primes q ≤ B₁. M is divisible by every B₁-smooth number.
Compute x ← a^M mod n, accumulating the exponent prime by prime rather than forming M explicitly.
Set g ← gcd(x − 1, n).
If 1 < g < n, return g. If g = 1, increase B₁ or go to stage two. If g = n, back off and retry with a smaller exponent.

The g = n case

If every prime factor of n has smooth order, the GCD returns n and no information. Restart with a smaller bound, or take GCDs more frequently during the exponentiation so the factors are separated before both are absorbed.

Section 02The second stage

Stage two handles the common case where p − 1 is B₁-smooth except for a single larger prime factor q between B₁ and a second bound B₂.

AlgorithmStage two (standard continuation)in: stage-one result, bounds B₁, B₂ → out: a factor

Let x be the stage-one result a^M mod n.
Precompute x^d for the small gaps d between consecutive primes in (B₁, B₂]. Gaps are small and repeat, so the table is short.
Step through the primes q in that range, updating x^q by one table multiplication each.
Accumulate the product of (x^q − 1) over a batch and take a single GCD per batch.
Return any non-trivial GCD found.

The same two-stage structure appears in ECM

Stage one raises to a smooth exponent; stage two sweeps a range for one remaining large prime. ECM uses exactly this structure on an elliptic curve group, which is why the two implementations share so much code.

Section 03The p+1 method and variants

Related special-purpose methods
Method	Succeeds when	Arithmetic
p − 1 (Pollard)	p − 1 is smooth	Modular exponentiation
p + 1 (Williams)	p + 1 is smooth	Lucas sequences
Cyclotomic variants	Φ_k(p) is smooth for small k	Arithmetic in higher extensions
ECM (Lenstra)	Some curve order near p is smooth — resamplable	Elliptic curve group law

Why the p+1 method needs a parameter search

The Lucas sequence works in the norm-one subgroup of a quadratic extension, whose order is p + 1 only when the discriminant is a non-residue modulo p — which is unknown in advance. Several parameters must be tried, half of which land in the p − 1 case instead.

Section 04Consequences for prime selection

Because the method succeeds precisely when p − 1 is smooth, cryptographic primes are chosen so that it is not. A safe prime has p = 2q + 1 with q prime, making p − 1 maximally non-smooth.

A defence against one method only

Choosing safe primes defeats p−1 and p+1 completely, and defeats ECM not at all — ECM's group order varies with the curve and does not depend on p ± 1. Resistance to special-purpose methods must not be confused with resistance to general-purpose ones.

ReferenceFrequently asked questions

How should the bounds be chosen?

B1 sets the smoothness threshold and the cost of stage one; B2 extends the reach for one additional prime. Standard practice is to start with modest bounds, run the method as a cheap speculative stage, and escalate only if the structure of the problem suggests smoothness is likely.

Does the method work when n has several smooth factors?

It finds them all at once, returning n and thus nothing useful. Taking GCDs at intervals during the exponentiation separates the factors, because the first one to satisfy the condition is caught before the others do.

Is p-1 obsolete now that ECM exists?

No. It is far cheaper per attempt, and when p−1 happens to be smooth it succeeds immediately where ECM would need many curves. It costs one exponentiation to try, so it remains a standard early stage.

NavigateContinue in this stream

Curated next steps from this page. The site also surfaces algorithmically related reading below.

ProvenanceSources and further reading

This page is an original KEVOS explanatory article. It presents the underlying mathematics — definitions, algorithms, complexity results and selection criteria — in KEVOS editorial voice. No text is reproduced from any copyrighted source. Where numerical tables are relevant, KEVOS links to live authoritative databases rather than republishing static values.

Handbook application: from concept to controlled practice

Purpose. This expanded section turns the original page into a practical handbook. It preserves the supplied material and adds a repeatable way to apply, check and review Pollard's p−1 Method and Its Relatives. It does not replace a contract, legislation, a controlled standard, competent engineering judgement or specialist advice.

The operating aim is to turn a compact mathematical statement into a usable chain of definitions, claims, examples and checks. Read the original explanation first, then use the workflow and checks below to convert knowledge into evidence.

Treat Pollard's p−1 Method and Its Relatives as a network of definitions and implications, not as a list of formulas. The working vocabulary on this page—method, section, stage, pollard's, relatives—should be made explicit before any proof or computation begins. Record the ambient set or structure, the permitted operations and the equality or equivalence relation in use. A compact theorem often changes meaning when the base field, finiteness condition, commutativity assumption or direction of an action changes.

For a proof, write the hypotheses as a checklist and mark the line at which each one is used. For a computation, state the representation of the input, the arithmetic model, the termination condition and the output invariant. For a classification problem, distinguish existence from uniqueness and distinguish an object from its representation. These separations prevent a correct local calculation from being mistaken for the general result.

A useful worked example should be small enough to inspect completely but rich enough to exercise the main mechanism. Compute the result in two ways where practical: symbolically and by substitution, structurally and numerically, or directly and through a normal form. Then include one near-miss example in which a hypothesis fails. The contrast explains why the theorem is shaped as it is and gives the reader a diagnostic pattern for later problems.

Verification is part of the mathematics. Check domains and codomains, substitute proposed solutions, test identity and zero cases, compare dimensions or cardinalities, and confirm that maps respect the required operations. In numerical work, report precision, conditioning and a residual rather than digits alone. In algorithmic work, separate mathematical correctness from implementation complexity and resource limits.

Step-by-step operating method

Fix the setting. State the objects, ambient structure, notation and assumptions before manipulating symbols.
Separate claims. Distinguish definitions, hypotheses, conclusions, equivalent conditions and consequences.
Choose a method. Select proof, construction, calculation or algorithm according to the question actually asked.
Work a small case. Use the smallest non-trivial example to expose the mechanism and test edge behaviour.
Verify independently. Substitute back, check invariants, test boundary cases or use an alternative derivation.

Worked-example protocol

Illustrative method—not a source theorem. Start with a small admissible input and list the definitions it must satisfy. Carry out each transformation on a separate line, citing the property that permits it. Preserve exact values until approximation is necessary. At the end, verify the output against the original definition and one invariant such as dimension, degree, determinant, order, norm or residual. Then alter one hypothesis and observe which step ceases to be valid. This protocol creates a reusable example without inventing a theorem-specific numerical answer.

Stage	Record	Quality check
Input	Objects, domain, notation, assumptions	Every symbol is defined
Method	Permitted operation or cited result at each step	All hypotheses hold
Output	Exact result and representation	Correct type, domain and form
Verification	Substitution, invariant or alternative derivation	Independent agreement
Boundary test	Zero, identity, degenerate or failed hypothesis	Scope is understood

Common failure modes and recovery actions

1. Watch for

Using a theorem without checking every hypothesis.

Recovery: Return to the governing definition or requirement and restate the decision in one sentence.

2. Watch for

Treating a suggestive example as a proof of the general case.

Recovery: Separate evidence from assumption, assign an owner and set a date for validation.

3. Watch for

Changing notation or conventions part-way through an argument.

Recovery: Run a small counterexample, boundary test, pilot or independent check before proceeding.

4. Watch for

Hiding a division-by-zero, convergence, finiteness or commutativity assumption.

Recovery: Record the consequence, decision and rationale, then update the controlled baseline.

5. Watch for

Reporting a computed result without a residual, substitution or structural check.

Recovery: Escalate when the issue affects safety, compliance, acceptance, material value or an agreed tolerance.

Review checklist

Can every symbol be traced to a definition or prior result?
Which hypothesis does each major step use?
Does the method cover zero, identity, degenerate and boundary cases?
Can the conclusion be checked by a second representation or calculation?
Are mandatory requirements distinguished from recommendations and illustrative values?
Are sources, assumptions, units, dates and versions recorded closely enough to reproduce the decision?
Have safety, legal, ethical, stakeholder and operational consequences been considered at the appropriate level?
Is there a named owner and a trigger for review, escalation, change or retirement?

Questions for deeper application

What is the most important distinction a practitioner must preserve when applying Pollard's p−1 Method and Its Relatives?