Prime Numbers

6.2 Number field sieve 279
6.2.1 Basic NFS: Strategy
The quadratic sieve factorization method is fast because it produces small
quadratic residues modulo the number we are trying to factor, and because
we can use a sieve to quickly recognize which of these quadratic residues
are smooth. The QS method would be faster still if the quadratic residues
it produces could be arranged to be smaller, since then they would be more
likely to be smooth, and so we would not have to sift through as many of
them. An interesting thought in this regard is that it is not necessary that
they be quadratic residues, only small! We have a technique through linear
algebra of multiplying subsets of smooth numbers so as to obtain squares. In
the quadratic sieve, we had only to worry about one side of the congruence,
since the other side was already a square. In the number field sieve we use the
linear algebra method on both sides of the key congruence.
However, our congruences will not start with two integers being congruent
mod n. Rather, they will start with pairs θ, φ(θ), where θ lies in a particular
algebraic number ring, and φ is a homomorphism from the ring to Zn. (These
concepts will be described concretely, in a moment.) Suppose we have k such
pairs θ1,φ(θ1),...,θk,φ(θk), such that the product θ1 ···θk is a square in
the number ring, say γ 2 , and there is an integer square, say v 2 , such that
φ(θ1) ···φ(θk) ≡ v 2 (mod n). Then if φ(γ) ≡ u (mod n) for an integer u, we
have
u 2 ≡ φ(γ) 2 ≡ φ(γ 2 ) ≡ φ(θ1 ···θk) ≡ φ(θ1) ···φ(θk) ≡ v 2 (mod n).
That is, stripping away all of the interior expressions, we have the congruence
u 2 ≡ v 2 (mod n), and so could try to factor n via gcd(u − v, n).
The above ideas constitute the strategy of NFS. We now discuss the basic
setup that introduces the number ring and the homomorphism φ. Suppose we
are trying to factor the number n, which is odd, composite, and not a power.
Let
f(x) =x d + cd−1x d−1 + ···+ c0
be an irreducible polynomial in Z[x], and let α be a complex number that
is a root of f. We do not need to numerically approximate α; we just use
the symbol “α” to stand for one of the roots of f. Our number ring will
be Z[α]. This is computationally thought of as the set of ordered d-tuples
(a0,a1,...,ad−1) of integers, where we “picture” such a d-tuple as the element
a0 + a1α + ···ad−1α d−1 . We add two such expressions coordinatewise, and we
multiply via the normal polynomial product, but then reduce to a d-tuple via
the identity f(α) = 0. Another, equivalent way of thinking of the number ring
Z[α] istorealizeitasZ[x]/(f(x)), that is, involving polynomial arithmetic
modulo f(x).
The connection to the number n we are factoring comes via an integer m
with the property that
f(m) ≡ 0(modn).
We do need to know what the integer m is. We remark that there is a
very simple method of coming up with an acceptable choice of f(x) and