Prime Numbers

272 Chapter 6 SUBEXPONENTIAL FACTORING ALGORITHMS
It is noticed in practice, and this is supported too by theory, that the
larger the large prime, the less likely for it to be matched up. Thus, most
practitioners eschew the larger range for large primes, perhaps keeping only
those in the interval (B,20B] or(B,100B].
Various people have suggested over the years that if one large prime is
good, perhaps two large primes are better. This idea has been developed in
[Lenstra and Manasse 1994], and they do, in fact, find better performance for
larger factorizations if they use two large primes. The landmark factorization
of the RSA129 challenge number mentioned in Section 1.1.2 was factored using
this double large-prime variation.
There are various complications for the double large-prime variation that
are not present in the single large-prime variation discussed above. If an integer
in the interval (1,B 2 ] has all prime factors exceeding B, then it must be
prime: This is the fundamental observation used in the single large-prime
variation. What if an integer in (B 2 ,B 3 ] has no prime factor ≤ B? Then
either it is a prime, or it is the product of two primes each exceeding B.
In essence, the double large prime variation allows for reports where the
unfactored portion is as large as B 3 . If this unfactored portion m exceeds
B 2 , a cheap pseudoprimality test is applied, say checking whether 2 m−1 ≡ 1
(mod m); see Section 3.4.1. If m satisfies the congruence, it is discarded, since
then it is likely to be prime, and also too large to be matched with another
large prime. If m is proved composite by the congruence, it is then factored,
say by the Pollard rho method; see Section 5.2.1. This will then allow reports
that are B-smooth, except for two prime factors larger than B (and not much
larger).
As one can see, this already requires much more work than the single largeprime
variation. But there is more to come. One must search the reported
numbers with a single large prime or two large primes for cycles; that is,
subsets whose product is B-smooth, except for larger primes that all appear
to even exponents. For example, say we have the reports y1P1,y2P2,y3P1P2,
where y1,y2,y3 are B-smooth and P1,P2 are primes exceeding B (so we are
describing here a cycle consisting of two single large prime reports and one
double large prime report). The product of these three reports is y1y2y3P 2 1 P 2 2 ,
whose exponent vector modulo 2 is the same as that for the B-smooth number
y1y2y3. Of course, there can be more complicated cycles than this, some even
involving only double large-prime factorizations (though that kind will be
infrequent). It is not as simple as before, to search through our data set for
these cycles. For one, the data set is much larger than before and there is
a possibility of being swamped with data. These problems are discussed in
[Lenstra and Manasse 1994]. They find that with larger numbers they gain a
more than twofold speed-up using the double large-prime variation. However,
they also admit that they use a value of B that is perhaps smaller than others
would choose. It would be interesting to see an experiment that allows for
variations of all parameters involved to see which combination is the best for
numbers of various sizes.