Prime Numbers

6.2 Number field sieve 285
ideal of I that divides both (p) and(a−bα), then P divides (p, α −r); that is,
P is one of the Pj. To see this, note that the hypotheses that a, b are coprime
and a ≡ br (mod p) implyb ≡ 0(modp), so there is an integer c with cb ≡ 1
(mod p). Then, since a − bα = a − br − b(α − r) ∈ P and a − br ≡ 0(modp),
we have b(α − r) ∈ P ,sothatcb(α − r) ∈ P ,andα − r ∈ P .Thus,P divides
(p, α − r), as claimed.
Suppose a, b are coprime integers and that P a1 ak
1 ···Pk appears in the prime
ideal factorization of (a − bα). As we have seen, if any of these exponents aj
are positive, it is necessary and sufficient that a ≡ br (mod p), in which case
all of the exponents aj are positive and no other prime ideal divisor of (p)
divides (a − bα). Thus the “p part” of the norm of a − bα is exactly the norm
of P a1
1
···P ak
k ;thatis,
p vp,r(a−bα) = N(P a1
1
···P ak
k )=pe1a1+···+ekak .
Let vP (a − bα) denote the exponent on the prime ideal P in the prime ideal
factorization of (a − bα). Then from the above,
vp,r(a − bα) =
k
j=1
ejvPj (a − bα).
Now, if
(a,b)∈S (a − bα) isasquareinI, then the principal ideal it generates
is a square of an ideal. Thus, for every prime ideal P in I we have that
(a,b)∈S vP (a − bα) is even. We apply this principle to the prime ideals Pj
dividing (p, α − r). We have
(a,b)∈S
vp,r(a − bα) =
k
j=1
ej
(a,b)∈S
vPj (a − bα).
As each inner sum on the right side of this equation is an even integer, the
integer on the left side of the equation must also be even. ✷
6.2.3 Basic NFS: Complexity
We have not yet given a full description of NFS, but it is perhaps worthwhile to
envision why the strategy outlined so far leads to a fast factorization method,
and to get an idea of the order of magnitude of the parameters to be chosen.
In both QS and NFS we are presented with a stream of numbers on which
we may use a sieve to detect smooth values. When we have enough smooth
values, we can use linear algebra on exponent vectors corresponding to the
smooth values to find a nonempty subset of these vectors whose sum in the
zero vector mod 2. Let us model the general problem as follows. We have a
random sequence of positive integers bounded by X. How far does one expect
to go in this sequence before a nontrivial subsequence has product being a
square? The heuristic analysis in Section 6.1.1 gives an answer: It is at most
L(X) √ 2+o(1) , where the smoothness bound to achieve this is L(X) 1/ √ 2 .(We