Prime Numbers

6.3 Rigorous factoring 301
allows one to use the same complexity estimates that one would have if one
had sieved instead.
Assuming that about a total of B 2 pairs a, b are put into the linear form
a − bm, at the end, a total of B 2 k pairs of the linear form and the norm
form of a polynomial are checked for simultaneous smoothness (the first being
B-smooth, the second B/k-smooth). If the parameters are chosen so that
at most B 2 /k pairs a, b survive the first sieve, then the total time spent is
not much more than B 2 total. This savings leads to a lower complexity in
NFS. Coppersmith gives a heuristic argument that with an optimal choice of
parameters the running time to factor n is exp (c + o(1))(ln n) 1/3 (ln ln n) 2/3 ,
where
c = 1
92 + 26
3
√ 1/3 13 ≈ 1.9019.
This compares with the value c = (64/9) 1/3 ≈ 1.9230 for the NFS as
described in Algorithm 6.2.5. As mentioned previously, the smaller c in
Coppersmith’s method is offset by a “fatter” o(1). This secondary factor likely
makes the crossover point, after which Coppersmith’s variant is superior, in
the thousands of digits. Before we reach this point, NFS will probably have
been replaced by far better methods. Nevertheless, Coppersmith’s variant of
NFS currently stands as the asymptotically fastest heuristic factoring method
known.
There may yet be some practical advantage to using many polynomials.
For a discussion, see [Elkenbracht-Huizing 1997].
6.3 Rigorous factoring
None of the factoring methods discussed so far in this chapter are rigorous.
However, the subexponential ECM, discussed in the next chapter, comes close
to being rigorous. Assuming a reasonable conjecture about the distribution
in short intervals of smooth numbers, [Lenstra 1987] shows that ECM is
expected to find the least prime factor p of the composite number n in
exp((2 + o(1)) √ ln p ln ln p) arithmetic operations with integers the size of n,
the “o(1)” term tending to 0 as p →∞. Thus, ECM requires only one heuristic
“leap.” In contrast, QS and NFS seem to require several heuristic leaps in their
analyses.
It is of interest to see what is the fastest factoring algorithm that we can
rigorously analyze. This is not necessarily of practical value, but seems to be
required by the dignity of the subject!
The first issue one might address is whether a factoring algorithm
is deterministic or probabilistic. Since randomness is such a powerful
tool, we would expect to see lower complexity records for probabilistic
factoring algorithms over deterministic ones, and indeed we do. The fastest
deterministic factoring algorithm that has been rigorously analyzed is the
Pollard–Strassen method. This uses fast polynomial evaluation techniques as
discussed in Section 5.5, where the running time to factor n is seen to be
O n 1/4+o(1) .