Prime Numbers

304 Chapter 6 SUBEXPONENTIAL FACTORING ALGORITHMS
Algorithm 6.4.1 (Index-calculus method for F ∗ p). We are given a prime p,
a primitive root g, and a nonzero residue t (mod p). This probabilistic algorithm
attempts to find log g t.
1. [Set smoothness bound]
Choose a smoothness bound B; // See text for reasonable B choices.
Find the primes p1,...,pk in [1,B];
2. [Search for general relations]
Choose random integers r in [1,p−2] until B cases are found with g r mod p
being B-smooth;
// It is slightly better to use the residue of g r mod p closest to 0.
3. [Linear algebra]
By some method of linear algebra, use the relations found to solve for
log g p1,...,log g pk;
4. [Search for a special relation]
Choose random integers R in [1,p− 2] and find the residue closest to 0 of
g R t (mod p) until one is found with this residue being B-smooth;
Use the special relation found together with the values of log g p1,...,log g pk
found in Step [Linear algebra] to find log g t;
This brief description raises several questions:
(1) How does one determine whether a number is B-smooth?
(2) How does one do linear algebra modulo the composite number p − 1?
(3) Are B relations an appropriate number so that there is a reasonable chance
of success in Step [Linear algebra]?
(4) What is a good choice for B?
(5) What is the complexity of this method, and is it really subexponential?
On question (1), there are several options including trial division,
the Pollard rho method (Algorithm 5.2.1), and the elliptic curve method
(Algorithm 7.4.2). Which method one employs affects the overall complexity,
but with any of these methods, the index-calculus method is subexponential.
It is a bit tricky doing matrix algebra over Zn with n composite. In Step
[Linear algebra] we are asked to do this with n = p − 1, which is composite
for all primes p>3. As with solving polynomial congruences, one idea is to
reduce the problem to prime moduli. Matrix algebra over Zq with q prime
is just matrix algebra over a finite field, and the usual Gaussian methods
work, as well as do various faster methods. As with polynomial congruences,
one can also employ Hensel-type methods for matrix algebra modulo prime
powers, and Chinese remainder methods for gluing powers of different primes.
In addition, one does not have to work all that hard at the factorization. If
some large factor of p − 1 is actually composite and difficult to factor further,
one can proceed with the matrix algebra modulo this factor as if it were prime.
If one is called to invert a nonzero residue, usually one will be successful, but
if not, a factorization is found for free. So either one is successful in the matrix