Prime Numbers

300 Chapter 6 SUBEXPONENTIAL FACTORING ALGORITHMS
lattice. Using techniques to find such short vectors, they came up with a
choice for A, B, C all at most 36 digits long. They then used both f(x) and
g(x) =Ax 2 + Bx+ C to complete the factorization of n, finding that n is the
product of two primes, the smaller being
447798287131284928051408304965265782892174953181087929.
Many polynomials
It is not hard to come up with many polynomials that may be used
in NFS. For example, choose the degree d, letm = n 1/(d+1) ,writen in
base m, getting n = cdn d + ··· + c0, letf(x) = cdx d + ··· + c0, andlet
fj(x) =f(x)+jx − mj for various small integers j. Or one could look at the
family fj,k(x) =f(x)+kx 2 − (mk − j)x − mj for various small integers k, j.
Each of these polynomials evaluated at m is n.
One might use such a family to search for a particularly favorable
polynomial, such as one where there is a tendency for many small primes
to have multiple roots. Such a polynomial may have its homogeneous form
being smooth more frequently than a polynomial where the small primes do
not have this tendency.
But can all of the polynomials be used together? There is an obvious
hindrance to doing this. Each time a new polynomial is introduced, the
factor base must be extended to take into account the ways primes split
for this polynomial. That is, each polynomial used must have its own field
of coordinates in the exponent vectors, so that introducing more polynomials
makes for longer vectors.
In [Coppersmith 1993] a way is found to (theoretically) get around this
problem. He uses a large factor base for the linear form a − bm and small
factor bases for the various polynomials used. Specifically, if the primes up
to B are used for the linear form, and k polynomials are used, then we use
primes only up to B/k for each of these polynomials. Further, we consider
only pairs a, b where both a − bm is B-smooth and the homogeneous form of
one of the polynomials is (B/k)-smooth. After B relations are collected, we
(most likely) have more than enough to create congruent squares.
Coppersmith suggests first sieving over the linear form a − bm for Bsmooth
numbers, and then individually checking at the homogeneous form of
each polynomial used to see if the value at a, b is B/k-smooth. This check can
be quickly done using the elliptic curve method (see Section 7.4). The elliptic
curve method (ECM) used as a smoothness test is not as efficient in practice as
sieving. However, if one wanted to use ECM in QS or NFS instead of sieving,
the overall heuristic complexity would remain unchanged, the only difference
coming in the o(1) expression. In Coppersmith’s variant of NFS he cannot
efficiently use sieving to check his homogeneous polynomials for smoothness,
since the pairs a, b that he checks for are irregularly spaced, being those where
a−bm has passed a smoothness test. (One might actually sieve over the letter
j in the family fj(x) suggested above, but this will not be a long enough array
to make the sieve economical.) Nevertheless, using ECM as a smoothness test