Prime Numbers

230 Chapter 5 EXPONENTIAL FACTORING ALGORITHMS
There is one further ingredient in the Pollard rho method. We surely
should not be expected to search over all pairs j, k with 0 ≤ j < k and
to compute gcd(F (j) (s) − F (k) (s),n) for each pair. This could easily take
longer than a trial division search for the prime factor p, since if we search
up to B, there are about 1
2B2 pairs j, k. And we do not expect to be
successful until B is of order √ p. So we need another way to search over
pairs other than to examine all of them. This is afforded by a fabulous
expedient, the Floyd cycle-finding method. Let l = k − j, so that for any
m ≥ j, F (m) (s) ≡ F (m+l) (s) ≡ F (m+2l) (s) ≡ ... (mod p). Consider this for
m = l ⌈j/l⌉, the first multiple of l that exceeds j. ThenF (m) (s) ≡ F (2m) (s)
(mod p), and m ≤ k = O( √ p).
So the basic idea of the Pollard rho method is to compute the sequence
gcd(F (i) (s) − F (2i) (s),n)fori =1, 2,..., and this should terminate with a
nontrivial factorization of n in O( √ p) steps, where p is the least prime factor
of n.
Algorithm 5.2.1 (Pollard rho factorization method). We are given a composite
number n. This algorithm attempts to find a nontrivial factor of n.
1. [Choose seeds]
Choose random a ∈ [1,n− 3];
Choose random s ∈ [0,n− 1];
U = V = s;
Define function F (x) =(x 2 + a) modn;
2. [Factor search]
U = F (U);
V = F (V );
V = F (V ); // F (V ) intentionally invoked twice.
g =gcd(U − V,n);
if(g == 1) goto [Factor search];
3. [Bad seed]
if(g == n) goto [Choose seeds];
4. [Success]
return g; // Nontrivial factor found.
A pleasant feature of the Pollard rho method is that very little space is
required: Only the number n that is being factored and the current values of
U, V need be kept in memory.
The main loop, Step [Factor search], involves 3 modular multiplications
(actually squarings) and a gcd computation. In fact, with the cost of one
extra modular multiplication, one may put off the gcd calculation so that it
is performed only rarely. Namely, the numbers U − V may be accumulated
(multiplied all together) modulo n for k iterations, and then the gcd of this
modular product is taken with n. Soifk is 100, say, the amortized cost of
performing a gcd is made negligible, so that one generic loop consists of 3
modular squarings and one modular multiplication.