dissertacao.pdf

2.2.4 General Number Field Sieve
The General Number Field Sieve (GNFS) is the fastest known general purpose
method for factoring large integers. For this reason, it is very suitable for
attacking RSA, as the factors p and q are balanced and so N does not have a
small factor, which makes the special purpose algorithms weaker.
For a pleasant reading about the contributions several people gave to the
development of this algorithm and a simple explanation of its procedure one
can read [36].
The GNFS is an extremely complex algorithm using results from several
fields of mathematics and for this reason it was not possible to present it in
our work. For an extensive explanation of the mathematical basis behind this
algorithm we suggest the reading of [6]. The running time of the GNFS for
factoring an integer N of size n is E(n) = exp(1.923n 1
3 log 2
3 n)[4][24].
As the state of the art in integer factoring, GNFS’s complexity has a double
importance: attacks on RSA which take more time than GNFS to factor the
number are not interesting anymore.
GNFS actually holds the record for the largest general integer ever factored,
the RSA-200, a number with 200 digits.
2.3 Overview of the Different Methods
Regarding the primality tests we described, clearly AKS is the most promising
one. For this reason, developments regarding this algorithm should be followed
closely. In what concerns the probabilistic tests described before, we think that
the Miller-Rabin test is the most efficient and reliable test. It is of special in-
terest that, if some advances will be made, it can become an extremely simple
polynomial time deterministic test. Finally, FTP was included solely for demon-
strative purposes and the Solovay-Strassen test was included because it was the
(now obsolete) primality test proposed in the original RSA article[38].
Regarding the factorization algorithms presented in this work, Fermat’s fac-
torization method does not present a serious menace for a RSA session unless
the primes chosen are (almost) consecutive. It is usually advised to use Pollard’s
ρ method to find factors of up to 30 bits [11] and then switch to the Elliptic
Curve Method if we are searching for factors larger than 30 bits. However, recent
developments described in [11] suggest that this number of bits should actually
31