Prime Numbers

294 Chapter 6 SUBEXPONENTIAL FACTORING ALGORITHMS
}
Install the exponent vector v(a − bα) as the next row of the matrix;
4. [Linear algebra]
By some method of linear algebra (see Section 6.1.3), find a nonempty
subset S of S ′ such that
(a,b)∈S v(a − bα) is the 0-vector (mod 2);
5. [Square roots]
Use the known prime factorization of the integer square
(a,b)∈S (a − bm)
to find a residue v mod n with
(a,b)∈S (a − bm) ≡ v2 (mod n);
By some method, such as those of Section 6.2.5, find a square root γ in
Z[α] of f ′ 2 (α) (a,b)∈S (a − bα), and, via simple replacement α → m,
compute u = φ(γ) (modn);
6. [Factorization]
return gcd(u − f ′ (m)v, n);
If the divisor of n that is reported in Algorithm 6.2.5 is trivial, one has the
option of finding more linear dependencies in the matrix and trying again. If
we run out of linear dependencies, one again has the option to sieve further
to find more rows for the matrix, and so have more linear dependencies.
6.2.7 NFS: Further considerations
As with the basic quadratic sieve, there are many “bells and whistles” that
may be added to the number field sieve to make it an even better factorization
method. In this section we shall briefly discuss some of these improvements.
Free relations
Suppose p is a prime in the “factor base,” that is, p ≤ B. Our exponent
vectors have a coordinate corresponding to p as a possible prime factor of
a − bm, and#R(p) further coordinates corresponding to integers r ∈ R(p).
(Recall that R(p) is the set of residues r (mod p) withf(r) ≡ 0(modp).) On
average, #R(p) is1,butitcanbeaslowas0(inthecasethatf(x) hasno
roots (mod p), or it can be as high as d, the degree of f(x) (in the case that
f(x) splits into d distinct linear factors (mod p)). In this latter case, we have
that the product of the prime ideals (p, α − r) in the full ring of algebraic
integers in Q[α] is(p).
Suppose p is a prime with p ≤ B, andR(p) hasdmembers. Let us throw
into our matrix an extra row vector v(p), which has 1’s in the coordinates
corresponding to p and to each pair p, r where r ∈ R(p). Also, in the final
field of k coordinates corresponding to the quadratic characters modulo qj
for j =1,...,k, put a 0 in place j of v(p) if p
= 1 and put a 1 in place
qj
j if p
= −1. Such a vector v(p) is called a free relation, since it is found
qj
in the precomputations, and not in the sieving stage. Now, when we find a
subset of rows that sum to the zero vector mod 2, we have that the subset
corresponds to a set S of coprime pairs a, b and a set F of free relations. Let
w be the product of the primes p corresponding to the free relations in F.