Prabhas Chongstitvatana1 Factorizing large integers Finding the unique decomposition of n into a product of prime factors. Factorize(n) if n is prime done find a non trivial divisor m factorize( m) factorize( n/m )

Prabhas Chongstitvatana2 Looking for divisor smaller than sqrt(n) by trying all m, called “trial division”. “hard” : n is the product of two primes of roughly the same size Let n be a composite integer. Let a and b be distinct integer 1..n-1 such that a+b != n. If a 2 mod n = b 2 mod n then gcd( a+b, n) is a non trivial divisor of n.

Prabhas Chongstitvatana3 Example n = 2537, let a = 2012, b = 1127, a 2 = 1595n b 2 = 500n a != b, a + b != n gcd(a+b, n) = 43 is a divisor of n

Prabhas Chongstitvatana4 How to find a and b ? An integer is k-smooth if all its prime divisors are among the k smallest primes. 120 = 2 3 x 3 x 5 is 3-smooth Use LV choose x randomly 1..n-1 y = x 2 mod n if y is k-smooth store x and factorization of y. Find k+1 different integers of these.

Prabhas Chongstitvatana5 x1 = 2455 y1 = 1650 = 2 x 3 x 5 2 x 11 x2 = 970 y2 = 2210 = 2 x 5 x 13 x 17 x3 = 1105 y3 = 728 = 2 3 x 7 x 13 x4 = 1458 y4 = 2295 = 3 3 x 5 x 17 x5 = 216 y5 = 990 = 2 x 3 2 x 5 x 11 x6 = 80 y6 = 1326 = 2 x 3 x 13 x 17 x7 = 1844 y7 = 756 = 2 2 x 3 3 x 7 x8 = 433 y8 = 2288 = 2 4 x 11 x 13

Prabhas Chongstitvatana6 Form (k+1) x k matrix M over {0, 1}. Each row corresponds to one success, each column corresponds to one admissible primes. Mij = 0 if j-th prime appears to an even power (including zero).

Prabhas Chongstitvatana M = y1 = 1650 = 2 x 3 x 5 2 x 11 y2 = 2210 = 2 x 5 x 13 x 17

Prabhas Chongstitvatana8 Matrix M has more rows than columns hence the rows cannot be linearly independent. There exists a nonempty set of rows that add up to the all-zero vector in arithmetic mod 2. (can be found by Gauss-Jordan elimination) There are seven solutions 1,2,4,8 or 1,3,4,5,6,7...

Prabhas Chongstitvatana9 1, 2, 4,

Prabhas Chongstitvatana10 The exponents are necessarily even by construction. A square root can be found. y 1 y 2 y 4 y 8 = 2 6 x 3 4 x 5 4 x 11 2 x 13 2 x 17 2 y 1 y 3 y 4 y 5 y 6 y 7 = 2 8 x 3 10 x 5 4 x 7 2 x 11 2 x 13 2 x 17 2 a = 2 3 x 3 2 x 5 2 x 11 x 13 x 17 mod 2537 = 1973 b = 2455 x 970 x 1458 x 433 mod 2537 = 1127 x1 * x2 * x4 * x8

Prabhas Chongstitvatana11 The technique yields a, b in 1..n-1 such that a 2 mod n = b 2 mod n but no quarantee that a != b and a+b != n.

Prabhas Chongstitvatana12 The technique yields a, b in 1..n-1 such that a 2 mod n = b 2 mod n but no quarantee that a != b and a+b != n. Choose y1y3y4y5y6y7 It can be proved that this process succeeds with prob. at least 50% a’ = 2 4 x 3 5 x 5 2 x 7 x 11 x 13 x 17 mod 2537 = 1973 b’ = 2455 x 1105 x 1458 x 216 x 80 x 1844 mod 2537 = 1127 But a’ + b’ = n

Prabhas Chongstitvatana13 Determine the value of k k large ; higher prob. That x 2 mod n will be k-smooth k small; the faster for testing k-smoothness and factorize k-smooth values.

Prabhas Chongstitvatana14 Determine the value of k k large ; higher prob. That x 2 mod n will be k-smooth k small; the faster for testing k-smoothness and factorize k-smooth values. Let L = e^ sqrt( log n log log n ) let b an arbitrary positive real number let t = L 1/2 b

Prabhas Chongstitvatana15 If k ~ L b, about one x in t is such that x 2 mod n is k-smooth. To build M, take k+1 successes (each use k div) The expected number of “trial division” approx. O(t k 2 ) = O(L (1/2b) + 2b ) which minimize at O(L 2 ) when b = 1/2 Find set of rows add to zero take O(k 3 ) = O(L 3b ) (use Gauss-Jordan)

Prabhas Chongstitvatana16 Take k ~ sqrt(L), the algorithm splits n after an expected number of divisions that is approx. O(L 2 ). An average 100 decimal digit number L 2 ~ 5 x whereas sqrt(n) ~ 7 x 10 49

Prabhas Chongstitvatana17 Take k ~ sqrt(L), the algorithm splits n after an expected number of divisions that is approx. O(L 2 ). An average 100 decimal digit number L 2 ~ 5 x whereas sqrt(n) ~ 7 x Improvement Choose x so that x 2 mod n is more likely to be k- smooth

Prabhas Chongstitvatana18 Randomness plays a fundamental role in this algorithm because no deterministic approach for finding so many good x’s has been proved efficient. Other heuristic Choose x slightly larger than sqrt(n) Quadratic sieve Double large prime multiple polynomial variation of quadratic sieve Elliptic curve Number field sieve