Prime Numbers

296 Chapter 6 SUBEXPONENTIAL FACTORING ALGORITHMS
being B-smooth, and vice versa. And some even consider using reports where
both numbers in question have up to two large prime factors. One wonders
whether it would not be simpler and more efficient in this case just to increase
the size of the bound B.
Nonmonic polynomials
It is specified in Algorithm 6.2.5 that the polynomial f(x) chosen in Step
[Setup] be done so in a particular way, a way that renders f monic. The
discussion in the above sections assumed that the polynomial f(x) is indeed
monic. In this case, where α is a root of f(x), the ring Z[α] is a subring of the
ring of algebraic integers in Q(α). In fact, we have more freedom in the choice
of f(x) than stated. It is necessary only that f(x) ∈ Z[x] be irreducible. It
is not necessary that f be chosen in the particular way of Step [Setup], nor
is it necessary that f be monic. Primes that divide the leading coefficient of
f(x) have a somewhat suspect treatment in our exponent vectors. But we are
used to this kind of thing, since also primes that divide the discriminant of
f(x) in the treatment of the monic case were suspect, and became part of
the need for the quadratic characters in Step [The matrix] of Algorithm 6.2.5
(discussed in Section 6.2.4). Suffice it to say that nonmonic polynomials do
not introduce any significant new difficulties.
But why should we bother with nonmonic polynomials? As we saw in
Section 6.2.3, the key to a faster algorithm is reducing the size of the numbers
that over which we sieve in the hope of finding smooth ones. The size of
these numbers in NFS depends directly on the size of the number m and the
coefficients of the polynomial f(x), for a given degree d. Choosing a monic
polynomial we could arrange for m and these coefficients to be bounded by
n 1/d . If we now allow nonmonic polynomials, we can choose m to be n 1/(d+1) .
Writing n in base m, wehaven = cdm d + cd−1m d−1 + ···+ c0. This suggests
that we use the polynomial f(x) =cdx d +cd−1x d−1 +···+c0. The coefficients
ci are bounded by n 1/(d+1) , so both m and the coefficients are smaller by a
factor of about n 1/(d2 +d) .
For numbers at infinity, this savings in the coefficient size is not very
significant: The heuristic complexity of NFS stands roughly as before. (The
asymptotic speedup is about a factor of ln 1/6 n.) However, we are still not
factoring numbers at infinity, and for the numbers we are factoring, the savings
is important.
Suppose f(x) = cdx d + cd−1x d−1 + ··· + c0 is irreducible in Z[x] and
that α ∈ C is a root. Then cdα is an algebraic integer. It is a root of
F (x) =xd + cd−1xd−1 + cdcd−2xd−2 + ···+ c d−1
d c0, which can be easily seen,
since F (cdx) =c d−1
d f(x). We conclude that if S is a set of coprime integer
pairs a, b, if
(a,b)∈S
(a − bα)