Prime Numbers

302 Chapter 6 SUBEXPONENTIAL FACTORING ALGORITHMS
Assuming the ERH, see Conjecture 1.4.2, an algorithm of Shanks
deterministically factors n in a running-time bound of O(n 1/5+o(1) ). This
method is described in Section 5.6.4.
That is it for rigorous, deterministic methods. What, then, of probabilistic
methods? The first subexponential probabilistic factoring algorithm with a
completely rigorous analysis was the “random-squares method” of J. Dixon;
see [Dixon 1981]. His algorithm is to take random integers r in [1,n], looking
for those where r 2 mod n is smooth. If enough are found, then congruent
squares can be assembled, as in QS, and so a factorization of n may be
attempted. The randomness of the numbers r that are used allows one to say
rigorously how frequently the residues r 2 mod n are smooth, and how likely
the congruent squares assembled lead to a nontrivial factorization of n. Dixon
showedthat the expected running time for his algorithm to split n is bounded
by exp (c + o(1)) √
ln n ln ln n ,wherec = √ 8. Subsequent improvements by
Pomerance and later by B. Vallée lowered c to 4/3.
The current lowest running-time bound for a rigorous probabilistic
factoring algorithm is exp((1 + o(1)) √ ln n ln ln n). This is achieved by the
“class-group-relations method” of [Lenstra and Pomerance 1992]. Previously,
this time bound was achieved by A. Lenstra for a very similar algorithm,
but the analysis required the use of the ERH. It is interesting that this time
bound is exactly the same as that heuristically achieved by QS. Again the
devil is in the “o(1),” making the class-group-relations method impractical in
comparison.
It is interesting that both the improved versions of the random-squares
method and the class-group-relations method use ECM as a subroutine to
quickly recognize smooth numbers. One might well wonder how a not-yetrigorously
analyzed algorithm can be used as a subroutine in a rigorous
algorithm. The answer is that one need not show that the subroutine
always works, just that it works frequently enough to be of use. It can be
shown rigorously that ECM recognizes most y-smooth numbers below x in
y o(1) ln x arithmetic operations with integers the size of x. Theremaybesome
exceptional numbers that are stubborn for ECM, but they are provably rare.
Concerning the issue of smoothness tests, a probabilistic algorithm
announced in [Lenstra et al. 1993b] recognizes all y-smooth numbers n in
y o(1) ln n arithmetic operations. That is, it performs similarly as ECM, but
unlike ECM, the complexity estimate is completely rigorous and there are
provably no exceptional numbers.
6.4 Index-calculus method for discrete logarithms
In Chapter 5 we described some general algorithms for the computation of
discrete logarithms that work in virtually any cyclic group for which we can
represent group elements on a computer and perform the group operation.
These exponential-time algorithms have the number of steps being about
the square root of the group order. In certain specific groups we have more