Prime Numbers

256 Chapter 5 EXPONENTIAL FACTORING ALGORITHMS
it is an established heuristic that the expected number of iterations to uncover
a hidden prime factor p of N is reduced from c √ p to
c √ p
gcd(p − 1, 2K) − 1 .
For research involving this complexity reduction, it may be helpful first to
work through this heuristic and explore some possible implementations based
on the gcd reduction [Brent and Pollard 1981], [Montgomery 1987], [Crandall
1999d]. Note that when we know something about K the speedup is tangible,
as in the application of Pollard-rho methods to Fermat or Mersenne numbers.
(If K is small, it may be counterproductive to use an iteration x = x 2K + a,
even if we know that p ≡ 1(mod2K), since the cost per iteration may not
be outweighed by the gain of a shorter cycle.) However, it is when we do not
know anything about K that really tough complexity issues arise.
So an interesting open issue is this: Given M machines each doing Pollard
rho, and no special foreknowledge of K, what is the optimal way to assign
respective values {Km : m ∈ [1,...,M]} to said machines? Perhaps the
answer is just Km = 1 for each machine, or maybe the Km values should
be just small distinct primes. It is also unclear how the K values should be
altered—if at all—as one moves from an “independent machines” paradigm
into a “parallel” paradigm, the latter discussed in Exercise 5.25. An intuitive
glimpse of what is intended here goes like so: The McIntosh–Tardif factor of
F18, namely
81274690703860512587777 = 1 + 2 23 · 29 · 293 · 1259 · 905678539
(which was found via ECM) could have been found via Pollard rho, especially
if some “lucky” machine were iterating according to
x = x 223 ·29 + a mod F18.
In any complexity analysis, make sure to take into account the problem that
the number of operations per iteration grows as O(ln Km), the operation
complexity of a powering ladder.
5.25. Analyze a particular idea for parallelization of the Pollard rho
factoring method (not the parallelization method for discrete logarithms as
discussed in the text) along the following lines. Say the j-th of M machines
computes a Pollard sequence, from iteration x = x2 +a mod N, withcommon
parameter a but machine-dependent initial x (j)
1 seed, as
x (j)
i : i =1, 2,...,n ,
so we have such a whole length-n sequence for each j ∈ [1,M]. Argue that if
we can calculate the product
Q =
n M M
i=1 j=1 k=1
x (j)
2i
− x(k) i