Prime Numbers

5.2 Monte Carlo methods 229
That is, the probability that a random prime p is in one of these residue classes
is 2 −k ,soifk is large, this should greatly reduce the possibilities and pinpoint
p. But we know no fast way of finding the small solutions that simultaneously
satisfy all the required congruences, since listing the 2 −k ϕ(M) solutions to
find the small ones is a prohibitive calculation. Early computational efforts at
solving this problem involved ingenious apparatus with bicycle chains, cards,
and photoelectric cells. There are also modern special purpose computers that
have been built to solve this kind of problem. For much more on this approach,
see [Williams and Shallit 1993].
5.2 Monte Carlo methods
There are several interesting heuristic methods that use certain deterministic
sequences that are analyzed as if they were random sequences. Though the
sequences may have a random seed, they are not truly random; we nevertheless
refer to them as Monte Carlo methods. The methods in this section are all
principally due to J. Pollard.
5.2.1 Pollard rho method for factoring
In 1975, J. Pollard introduced a most novel factorization algorithm, [Pollard
1975]. Consider a random function f from S to S, whereS = {0, 1,...,l− 1}.
Let s ∈S be a random element, and consider the sequence
s, f(s),f(f(s)),....
Since f takes values in a finite set, it is clear that the sequence must eventually
repeat a term, and then become cyclic. We might diagram this behavior with
the letter ρ, indicating a precyclic part with the tail of the ρ, and the cyclic
part with the oval of the ρ. How long do we expect the tail to be, and how
long do we expect the cycle to be?
It should be immediately clear that the birthday paradox from elementary
probability theory is involved here, and we expect the length of the tail and
the oval together to be of order √ l. But why is this of interest in factoring?
Suppose p is a prime, and we let S = {0, 1,...,p− 1}. Let us specify a
particular function f from S to S, namely f(x) =x 2 +1modp. Soifthis
function is “random enough,” then we will expect that the sequence (f (i) (s)),
i =0, 1,..., of iterates starting from a random s ∈S begins repeating before
O( √ p) steps. That is, we expect there to be 0 ≤ j