## Return to Answer

2 Reformulated the answer to clarify that the cited random-walk based algorithm is not actually space efficient.; added 63 characters in body

The answer to your question is, essentially

Brent's paper Some integer factorization algorithms using elliptic curves describes a "birthday paradox" ECM extension based on a random walk that only uses $O(\sqrt{r})$ group operations on the elliptic curve (see Section 6), yeshowever it is not space efficient. The use Cycle detection techniques do not apply because the iteration function used is not a deterministic operation on the elliptic curve modulo any of birthday paradox algorithms in the second stage (unknown) prime factors of ECM $n$, and it is standardnot clear how one might construct such a function.

One can apply the usual Pollard-$\rho$ approach to computations on the elliptic curve performed mod $n$, say using an iteration function where $Q_{i+1}$ is $2Q_i$ or $2Q_i+Q$, depending on the parity of the $x$-coordinate of $Q_i$ when viewed as an integer in $[0,n-1]$. This will eventually lead to a cycle, and this which can be done space efficiently recognized using standard techniques (e.g. Floyd's algorithm) with a random walk approachspace complexity of $O(\log n)$ bits. The usual Pollard rho algorithm requires some minor modifications But the expected length of this cycle (using assuming this iteration function actually approximates a slightly different choice of random walk, as you suggested), which are described in detail in section 6 ) is $O(\sqrt{m})$, where $m$ is the order of Brent's 1986 paper Some integer factorization algorithms using elliptic curves.$P$ on $E(\mathbb{Z}/n\mathbb{Z})$, not $O(\sqrt{r})$.

1

The answer to your question is, essentially, yes. The use of birthday paradox algorithms in the second stage of ECM is standard, and this can be done space efficiently using a random walk approach. The usual Pollard rho algorithm requires some minor modifications (using a slightly different choice of random walk, as you suggested), which are described in detail in section 6 of Brent's 1986 paper Some integer factorization algorithms using elliptic curves.
{"extraction_info": {"found_math": true, "script_math_tex": 0, "script_math_asciimath": 0, "math_annotations": 0, "math_alttext": 0, "mathml": 0, "mathjax_tag": 0, "mathjax_inline_tex": 16, "mathjax_display_tex": 0, "mathjax_asciimath": 0, "img_math": 0, "codecogs_latex": 0, "wp_latex": 0, "mimetex.cgi": 0, "/images/math/codecogs": 0, "mathtex.cgi": 0}, "config": {"markdown_headings": true, "markdown_code": true, "boilerplate_config": {"ratio_threshold": 0.18, "absolute_threshold": 10, "end_threshold": 15, "enable": true}, "remove_buttons": true, "remove_image_figures": true, "remove_link_clusters": true, "table_config": {"min_rows": 2, "min_cols": 3, "format": "github"}, "remove_chinese": true, "remove_edit_buttons": true, "extract_latex": true}, "english_confidence": 0.8984909057617188, "perplexity_flag": "head"}