Prime Numbers

6.2 Number field sieve 289
We use Lemma 6.2.3 as follows. Instead of holding out for a set S of
coprime integers with
(a,b)∈S (a−bα) beingasquareinZ[α], as we originally
desired, we settle instead for the product being a square in I, sayγ2 .Then
by Lemma 6.2.3, f ′ (α)γ ∈ Z[α], so that f ′ 2 (α) (a,b)∈S (a − bα) isasquarein
Z[α].
The first three obstructions are all quite different, but they have a common
theme, namely well-studied groups. Obstruction (1) is concerned with the
group I/Z[α]. Obstruction (2) is concerned with the class group of I. And
obstruction (3) is concerned with the unit group of I. A befuddled reader may
well consult a text on algebraic number theory for full discussions of these
groups, but as we shall see below, a very simple device will let us overcome
these first three obstructions. Further, to understand how to implement the
number field sieve, one needs only to understand this simple device. This
hypothetical befuddled reader might well skip ahead a few paragraphs!
For obstruction (1), though the prime ideal factorization (into prime ideals
in I) of (a,b)∈S (a − bα) may not have all even exponents, the prime ideals
with odd exponents all lie over prime numbers that divide the index of Z[α]
in I, so that the number of these exceptional prime ideals is bounded by the
(base-2) logarithm of this index.
Obstruction (2) is more properly described as the ideal class group modulo
the subgroup of squares of ideal classes. This is a 2-group whose rank is the
2-rank of the ideal class group, which is bounded by the (base-2) logarithm
of the order of the class group; that is, the logarithm of the class number.
Obstruction (3) is again more properly described as the group of units
modulo the subgroup of squares of units. This again is a 2-group, and its rank
is ≤ d, the degree of f(x). (We use here the famous Dirichlet unit theorem.)
The detailed analysis of these obstructions can be found in [Buhler et al.
1993]. We shall be content with the conclusion that though all are different,
obstructions (1), (2), and (3) are all “small.” There is a brute force way
around these three obstructions, but there is also a beautiful and simple
circumvention. The circumvention idea is due to Adleman and runs as follows.
For a moment, suppose you somehow could not tell positive numbers from
negative numbers, but you could discern prime factorizations. Thus both 4
and −4 would look like squares to you, since in their prime factorizations we
have 2 raised to an even power, and no other primes are involved. However,
−4 is not a square. Without using that it is negative, we can still tell that −4
is not a square by noting that it is not a square modulo 7. We can detect
this via the Legendre symbol
−4
7 = −1. More generally, if q is an odd
prime and if
m
q = −1, then m is not a square. Adleman’s idea is to use
the converse statement, even though it is not a theorem! The trick is to think
probabilistically. Suppose for a given integer m, we choose k distinct odd
primes q at random in the range q