Choosing iteration maps for the parallel Pollard rho method

Abstract

Pollard's rho method finds a prime factor $p$ of an integer $N$ by searching for a collision in a map of the form $x \mapsto x^{2k} + c$ modulo $N$. This search can be parallelized to multiple machines, which may use distinct parameters $k$ and $c$. In this paper, we give an asymptotic estimate for the expected running time of the parallel rho method depending on the choice of $k$ for each machine. We also prove that $k = 1$ is the best choice for one machine, if nothing about $p$ is known in advance.