Prime Numbers

298 Chapter 6 SUBEXPONENTIAL FACTORING ALGORITHMS
If S has 2k elements, and φ(γ) ≡ v (mod n), ψ(δ) ≡ w (mod n), then
C k Gx(Cm,C)v 2 ≡ c k Fx(cm, c)w 2 (mod n),
and so we may attempt to factor n via gcd(CkGx(Cm,C)u−ck Fx(cm, c)v, n).
One may wonder why it is advantageous to use two polynomials of degree
higher than 1. The answer is a bit subtle. Though the first-order desirable
quality for the numbers that we sieve for smooth values is their size, there is
a second-order quality that also has some significance. If a number near x is
giventousasaproductoftwonumbersnearx1/2 ,thenitismorelikelyto
be smooth than if it is a random number near x that is not necessarily such a
product. If it is y-smoothness we are interested in and u =lnx/ ln y, then this
second-order effect may be quantified as about 2u . That is, a number near x
given as a product of two random numbers near x1/2 is about 2u timesaslikely
to be y-smooth than is a random number near x. If we have two polynomials in
the number field sieve with the same degree and with coefficients of the same
magnitude, then their respective homogeneous forms have values that are of
the same magnitude. It is the product of the two homogeneous forms that we
are sieving for smooth values, so this 2u philosophy seems to be relevant.
However, in the “ordinary” NFS as described in Algorithm 6.2.5, we
are also looking for the product of two numbers to be smooth: One is the
homogeneous form F (a, b), and the other is the linear form a − bm. Theydo
not have roughly equal magnitude. In fact, using the parameters suggested,
F (a, b) isaboutthe3/4 power of the product, and a − bm is about the 1/4
power of the product. Such numbers also have an enhanced probability of
being y-smooth, namely, 4/33/4u .
So, using two polynomials of the same degree d ≈ 1
2 (3 ln n/ ln ln n)1/3 ,and
with coefficients bounded by about n1/2d , we get an increased probability of
smoothness over the choices in Algorithm 6.2.5 of about 33/4 /2 u
.Now,uis about 2(3 ln n/ ln ln n) 1/3 , so that using the two polynomials of degree d saves
a factor of about (1.46)
(ln n/ ln ln n)1/3
. While not altering the basic complexity,
such a speedup represents significant savings.
The trouble, though, with using dual polynomials is finding them. Other
than an exhaustive search, perhaps augmented with fast lattice techniques, no
one has suggested a good way of finding such polynomials. For example, take
the case of d = 3. We do not know any good method when given a large integer
n of coming up with two distinct, irreducible, degree 3 polynomials f(x),g(x),
with coefficients bounded by n 1/6 , say, and an integer m, perhaps very large,
such that f(m) ≡ g(m) ≡ 0(modn). A counting argument suggests that
such polynomials should exist with coefficients even somewhat smaller, say
bounded by about n 1/8 .
Special number field sieve (SNFS)
Counting arguments show that for most numbers n, we cannot do very
much better in finding polynomials than the simple-minded strategy of
Algorithm 6.2.5. However, there are many numbers for which much better