Prime Numbers

276 Chapter 6 SUBEXPONENTIAL FACTORING ALGORITHMS
B 2 i ≡ n (mod pi) andBi ≡ 0(moda/pi).) If we traverse the 2 k−1 numbers
B1 ± B2 ± ...± Bk using a Gray code and precompute the lists 2Bia −1 mod p
for all p with which we sieve, then we can move from the sieving coordinates
for one polynomial to the next doing merely some low-precision adds and
subtracts for each p. One can get by with storing only the most frequently
used files 2Bia −1 mod a if space is at a premium. For example, storing this
file only for i = k, which is in action every second step in the Gray code,
we have initialization being very cheap half the time, and done with a single
modular multiplication for each p (and a few adds and subtracts) the other
half of the time.
The idea for self initialization was briefly sketched in [Pomerance et al.
1988] and more fully described in [Alford and Pomerance 1995] and [Peralta
1993]. In [Contini 1997] it is shown through some experiments that self
initialization gives about a twofold speedup over standard implementations
of QS using multiple polynomials.
6.1.7 Zhang’s special quadratic sieve
What makes the quadratic sieve fast is that we have a polynomial progression
of small quadratic residues. That they are quadratic residues renders them
useful for obtaining congruent squares that can split n. That they form a
polynomial progression (that is, consecutive values of a polynomial) makes
it easy to discover smooth values, namely, via a sieve. And of course, that
they are small makes them more likely to be smooth than random residues
modulo n. One possible way to improve this method is to find a polynomial
progression of even smaller quadratic residues. Recently, M. Zhang has found
such a way, but only for special values of n, [Zhang 1998]. We call his method
the special quadratic sieve, or SQS.
Suppose the number n we are trying to factor (which is odd, composite,
and not a power) can be represented as
n = m 3 + a2m 2 + a1m + a0, (6.4)
where m, a2,a1,a0 are integers, m ≈ n 1/3 .Actually,everynumbern can be
represented in this way; just choose m = n 1/3 ,leta1 = a2 =0,andlet
a0 = n − m 3 . We shall see below, though, that the representation (6.4) will
be useful only when the ai’s are all small in absolute value, and so we are
considering only special values of n.
Let b0,b1,b2 be integer variables, and let
where m is as in (6.4). Since
we have
x = b2m 2 + b1m + b0,
m 3 ≡−a2m 2 − a1m − a0 (mod n),
m 4 ≡ (a 2 2 − a1)m 2 +(a1a2 − a0)m + a0a2 (mod n),
x 2 ≡ c2m 2 + c1m + c0 (mod n), (6.5)