Prime Numbers

314 Chapter 6 SUBEXPONENTIAL FACTORING ALGORITHMS
where the ± ambiguities are tried one at a time, until the vector resulting
from this multiplication by H−1 has all integer components. Such a vector
will be a square root in the number field. To aid in any implementations,
we give here an explicit, small example of this rooting method. Let us
take the polynomial f(x) = x3 +5x + 6 and square-root the entity
γ2 = 117 − 366x +46x2 modulo f(x) (we are using preknowledge that the
entity here really is a square). We construct the Vandermode matrix using
zeros of f, namely(α1,α2,α3) = −1, 1 − i √ 23 /2, 1+i √ 23 /2 ,asa
numerical entity whose first row is (1, −1, 1) with complex entries in the
other rows. There needs to be enough precision, which for this present
example is say 12 decimal digits. Then we take a (componentwise) square
root and try the eight possible (±) combinations
γ = H −1
⎛
⎝ ±r1
⎞ ⎛
±r2 ⎠ , ⎝
±r3
r1
⎞
⎛
r2 ⎠
= H ⎝
r3
177
⎞
− 366 ⎠.
46
Sure enough, one of these eight combinations is the vector
⎛
γ = ⎝ 15
⎞
− 9 ⎠
−1
indicating that
15 − 9x − x 2 2 mod f(x) = 117 − 366x +46x 2
as desired.
(8) Just as with Exercise 6.14, we can only go so far with symbolic
processors and must move to fast, compiled programs to handle large
composites. Still, numbers in the region of 30 digits can indeed be handled
interpretively. Take the repunit n = (10 29 − 1)/9, force d =4,B = 30000,
and this time force also k = 100, to see a successful factorization that
is doable without fast programs. In this case, you can use any of the
above methods for handling degree-4 number fields, still with bruteforce
multiplying-out for the γ 2 entity (although for the given parameters
one already needs perhaps 3000-digit precision, and the advanced means
discussed in the text and in Exercise 6.18 start to look tantalizing for the
square-rooting stage).
The explicit tasks above should go a long way toward the polishing of a serious
NFS implementation. However, there is more that can be done even for these
relatively minuscule composites. For example, the free relations and other
optimizations of Section 6.2.7 can help even for the above tasks, and should
certainly be invoked for large composites.
6.16. Here we solve an explicit and simple DL problem to give an illustration
of the index-calculus method (Algorithm 6.4.1). Take the prime p =2 13 − 1,