Pollard's lambda method