Prime Numbers

6.6 Research problems 315
primitive root g = 17, and say we want to solve g l ≡ 5(modp). Note the
following congruences, which can be obtained rapidly by machine:
g 3513 ≡ 2 3 · 3 · 5 2 (mod p),
g 993 ≡ 2 4 · 3 · 5 2 (mod p),
g 1311 ≡ 2 2 · 3 · 5(modp).
(In principle, one can do this by setting a smoothness limit on prime factors
of the residue, then just testing random powers of g.) Now solve the indicated
DL problem by finding via linear algebra three integers a, b, c such that
6.6 Research problems
g 3513a+993b+1311c ≡ 5(modp).
6.17. Investigate the following idea for forging a subexponential factoring
algorithm. Observe first the amusing algebraic identity [Crandall 1996a]
F (x) = (x 2 − 85) 2 − 4176 2 − 2880 2
=(x − 13)(x − 11)(x − 7)(x − 1)(x + 1)(x + 7)(x + 11)(x + 13),
so that F actually has 8 simple, algebraic factors in Z[x]. Another of this type
is
G(x) =((x 2 − 377) 2 − 73504) 2 − 50400 2
=(x − 27)(x − 23)(x − 15)(x − 5)(x + 5)(x + 15)(x + 23)(x + 27),
and there certainly exist others. It appears on the face of it that for a number
N = pq to be factored (with primes p ≈ q, say) one could simply take
gcd(F (x) modN,N) for random x (mod N), so that N should be factored
in about √ N/(2 · 8) evaluations of F .(Theextra2isbecausewecangetby
chance either p or q as a factor.) Since F is calculated via 3 squarings modulo
N, and we expect 1 multiply to accumulate a new F product, we should have
an operational gain of 8/4 = 2 over naive product accumulation. The gain is
even more when we acknowledge the relative simplicity of a modular squaring
operation vs. a modular multiply. But what if we discovered an appropriate
set {aj} of fixed integers, and defined
H(x) =(···((((x 2 − a1) 2 − a2) 2 − a3) 2 − a4) 2 −···) 2 − a 2 k,
so that a total of k squarings (we assume a2 k prestored) would generate
2k algebraic factors? Can this successive-squaring idea lead directly to
subexponential (if not polynomial-time) complexity for factoring? Or are there
blockades preventing such a wonderful achievement? Another question is,
noting that the above two examples (F, G) have disjoint roots, i.e., F (x)G(x)
has 16 distinct factors, can one somehow use two identities at a time to improve
the gain? Yet another observation is, since all roots of F (x)G(x) are odd, x