Prime Numbers

278 Chapter 6 SUBEXPONENTIAL FACTORING ALGORITHMS
As the number b grows in absolute value, y(b) is dominated by the term
−4b 3 m. It is not unreasonable to expect that b will grow as large as 2 40 ,
in which case the size of |y(b)| will be near 2 323 . This does not compare
favorably with the quadratic sieve with multiple polynomials, where the size
of the numbers we sieve for smooths would be about 2 20√ n ≈ 2 301 .(This
assumes a sieving interval of about 2 20 per polynomial.)
However, we can also use multiple polynomials with the special quadratic
sieve. For example, for the above number n0, take b0 = −2u 2 , b1 =2uv,
b2 = v 2 . This then implies that we may take
x(u, v) =v 2 m 2 +2uvm − 2u 2 , y(u, v) =(4v 4 − 8u 3 v)m +16uv 3 +4u 4 ,
and let u, v range over small, coprime integers. (It is important to take u, v
coprime, since otherwise, we shall get redundant relations.) If u, v are allowed
to range over numbers with absolute value up to 220 , we get about the same
number of pairs as choices for b above, but the size of |y(u, v)| is now about
2283 , a savings over the ordinary quadratic sieve. (There is a small additional
savings, since we may actually consider the pair n−1
1
2 x(u, v), 4y(u, v).)
It is perhaps not clear why the introduction of u, v may be considered as
“multiple polynomials.” The idea is that we may fix one of these letters, and
sieve over the other. Each choice of the first letter gives a new polynomial in
the second letter.
The assumption in the above analysis of a sieve of length 240 is probably
on the small side for a number the size of n0. A larger sieve length will make
SQSlookpoorerincomparisonwithordinaryQS.
It is not clear whether the special quadratic sieve, as described above, will
be a useful factoring algorithm (as of this writing, it has not actually been tried
out in significant settings). If the number n is not too large, the growth of the
coefficient of m in y(b) ory(u, v) will dominate and make the comparison with
the ordinary quadratic sieve poor. If the number n is somewhat larger, so that
the special quadratic sieve starts to look better, as in the above example, there
is actually another algorithm that may come into play and again majorize the
special quadratic sieve. This is the number field sieve, something we shall
discuss in the next section.
6.2 Number field sieve
We have encountered some of the inventive ideas of J. Pollard in Chapter 5. In
1988 (see [Lenstra and Lenstra 1993]) Pollard suggested a factoring method
that was very well suited for numbers, such as Fermat numbers, that are close
to a high power. Before long, this method had been generalized so that it
could be used for general composites. Today, the number field sieve (NFS)
stands as the asymptotically fastest heuristic factoring algorithm we know for
“worst-case” composite numbers.