Prime Numbers

6.2 Number field sieve 283
a − bα. There is a problem with units, and if we were to take this route, we
would also want to find a system of “fundamental units” and have coordinates
in our exponent vectors for each of these. (In the case of Z[i] the fundamental
unit is rather trivial, it is just i, and we can take for distinguished primes
in each associate class the one that is in the first quadrant but not on the
imaginary axis.)
However, we shall see that the number field sieve can work just fine even
if the ring Z[α] is far from being a unique factorization domain, and even if
we have no idea about the units.
For each prime p, letR(p) denote the set of integers r ∈ [0,p− 1] with
f(r) ≡ 0(modp). For example, if f(x) =x 2 +1, then R(2) = {1}, R(3) = {},
and R(5) = {2, 3}. Thenifa, b are coprime integers,
F (a, b) ≡ 0(modp) if and only if a ≡ br (mod p) forsomer ∈ R(p).
Thus, if we discover that p|F (a, b), we also have a second piece of information,
namely a number r ∈ R(p) witha ≡ br (mod p). (Actually, the sets R(p) are
used in the sieve that we use to factor the numbers F (a, b). We may fix
the number b and consider F (a, b) as a polynomial in the variable a. Then
when sieving by the prime p, we sieve the residue classes a ≡ br (mod p) for
multiples of p.) We keep track of this additional information in our exponent
vectors. The field of coordinates of our exponent vectors that correspond to
the factorization of F (a, b) will have entries for each pair p, r, wherep is a
prime ≤ B, andr ∈ R(p).
Let us again consider the polynomial f(x) = x 2 +1. If B = 5,
then exponent vectors for B-smooth members of Z[i] (that is, members
of Z[i] whose norms are B-smooth integers) will have three coordinates,
corresponding to the three pairs: (2,1), (5,2), and (5,3). Then
F (3, 1) = 10 has the exponent vector (1, 0, 1),
F (2, 1) = 5 has the exponent vector (0, 1, 0),
F (1, 1) = 2 has the exponent vector (1, 0, 0),
F (2, −1) = 5 has the exponent vector (0, 0, 1).
Although F (3, 1)F (2, 1)F (1, 1) = 100 is a square, the exponent vectors allow
us to see that (3 + i)(2 + i)(1 + i) isnot a square: The sum of the three
vectorsmodulo2is(0, 1, 1), which is not the zero vector. But now consider
(3 + i)(2 − i)(1 + i) =8+6i. The sum of the three corresponding exponent
vectorsmodulo2is(0, 0, 0), and indeed, 8 + 6i is a square in Z[i].
This method is not foolproof. For example, though i has the zero vector
as its exponent vector in the above scheme, it is not a square. If this were
the only problem, namely the issue of units, we could fairly directly find a
solution. However, this is not the only problem.
Let I denote the ring of algebraic integers in the algebraic number field
Q[α]. That is, I is the set of elements of Q[α] that are the root of some monic
polynomial in Z[x]. The set I is closed under multiplication and addition.