Prime Numbers

6.1 The quadratic sieve factorization method 269
(1) Since the matrix arithmetic is over F2, it naturally lends itself to computer
implementation. With w being the machine word length (typically 8 or
16 bits on older machines, 32 or 64 or even more bits on newer ones), we
can deal with blocks of w coordinates in a row at a time, where one step
is just a logical operation requiring very few clock cycles.
(2) The initial matrix is quite sparse, so at the start, before “fill in” occurs,
there are few operations to perform, thus somewhat reducing the worst
case time bound.
(3) If the number we are factoring is not too large, we can load the algorithm
toward the sieving stage and away from the matrix stage. That is, we
can choose a bound B that is somewhat too small, thus causing the
sieving stage to run longer, but easing difficulties in the matrix stage.
Space difficulties with higher values of B form another practical reason to
choose B smaller than an otherwise optimal choice.
Concerning point (2), ways have been found to use Gaussian elimination
in an “intelligent” way so as to preserve sparseness as long as possible,
see [Odlyzko 1985] and [Pomerance and Smith 1992]. These methods are
sometimes referred to as “structured-Gauss” methods.
As the numbers we try to factor get larger, the matrix stage of QS
(and especially of the number field sieve; see Section 6.2) looms larger.
The unfavorable complexity bound of Gaussian elimination ruins our overall
complexity estimates, which assume that the matrix stage is not a bottleneck.
In addition, the awkwardness of dealing with huge matrices seems to require
large and expensive computers, computers for which it is not easy to get large
blocks of time.
There have been suggested at least three alternative sparse-matrix
methods intended to replace Gaussian elimination, two of which having
already been well-studied in numerical analysis. These two, the conjugate
gradient method and the Lanczos method, have been adapted to matrices with
entries in a finite field. A third option is the coordinate recurrence method in
[Wiedemann 1986]. This method is based on the Berlekamp–Massey algorithm
for discovering the smallest linear recurrence relation in a sequence of finite
field elements.
Each of these methods can be accomplished with a sparse encoding of the
matrix, namely an encoding that lists merely the locations of the nonzero
entries. Thus, if the matrix has N nonzero entries, the space required is
O(N ln B). Since our factorization matrices have at most O(ln n) nonzero
entries per row, the space requirement for the matrix stage of the algorithm,
using a sparse encoding, is O B ln 2 n .
Both the Wiedemann and Lanczos methods can be made rigorous. The
running time for these methods is O(BN), where N is the number of
nonzero entries in the matrix. Thus, the time bound for the matrix stage
of factorization algorithms such as QS is B 2+o(1) , equaling the time bound for
sieving.