Prime Numbers

Chapter 6
SUBEXPONENTIAL FACTORING ALGORITHMS
The methods of this chapter include two of the three basic workhorses of
modern factoring, the quadratic sieve (QS) and the number field sieve (NFS).
(The third workhorse, the elliptic curve method (ECM), is described in
Chapter 7.) The quadratic sieve and number field sieve are direct descendants
of the continued fraction factoring method of Brillhart and Morrison, which
was the first subexponential factoring algorithm on the scene. The continued
fraction factoring method, which was introduced in the early 1970s, allowed
complete factorizations of numbers of around 50 digits, when previously, about
20 digits had been the limit. The quadratic sieve and the number field sieve,
each with its strengths and domain of excellence, have pushed our capability
for complete factorization from 50 digits to now over 150 digits for the size
of numbers to be routinely factored. By contrast, the elliptic curve method
has allowed the discovery of prime factors up to 50 digits and beyond, with
fortunately weak dependence on the size of number to be factored. We include
in this chapter a small discussion of rigorous factorization methods that in
their own way also represent the state of the art. We also discuss briefly some
subexponential discrete logarithm algorithms for the multiplicative groups of
finite fields.
6.1 The quadratic sieve factorization method
Though first introduced in [Pomerance 1982], the quadratic sieve (QS) method
owes much to prior factorization methods, including the continued-fraction
method of [Morrison and Brillhart 1975]. See [Pomerance 1996b] for some of
the history of the QS method and also the number field sieve.
6.1.1 Basic QS
Let n be an odd number with exactly k distinct prime factors. Then there are
exactly 2 k square roots of 1 modulo n. Thisiseasyinthecasek =1,andit
follows in the general case from the Chinese remainder theorem; see Section
2.1.3. Two of these 2 k square roots of 1 are the old familiar ±1. All of the
others are interesting in that they can be used to split n. Indeed,ifa 2 ≡ 1
(mod n) anda ≡ ±1(modn), then gcd(a − 1,n) must be a nontrivial factor
of n. To see this, note that n|(a−1)(a+1), but n does not divide either factor,
so part of n must divide a − 1 and part must divide a +1.