[FactInt] 3 The Routines for Specific Factorization Methods

[Up] [Previous] [Next] [Index]

# 3 The Routines for Specific Factorization Methods

### Sections

1. Trial Division
2. Pollard's p-1
3. Williams' p+1
4. The Elliptic Curves Method (ECM)
5. The Continued Fraction Algorithm (CFRAC)
6. The Multiple Polynomial Quadratic Sieve (MPQS)

Descriptions of the factoring methods implemented in this package can be found in Bressoud89 and in Cohen93. The last book contains also descriptions of the other methods mentioned in the preface.

## 3.1 Trial Division

- `FactorsTD(` n`[,` Divisors`] ) F`

  `FactorsTD` tries to factor n using Trial Division.

  The optional argument Divisors is the list of trial divisors. If absent, it defaults to the list of primes p < 1000.

  The result is returned as a list of two lists. The first list contains the prime factors found, and the second list contains remaining unfactored parts of n, if there are any.

      gap> FactorsTD(12^25+25^12);
      [ [ 13, 19, 727 ], [ 5312510324723614735153 ] ]

  ## 3.2 Pollard's p-1

- `FactorsPminus1(` n`[, [` a`, ]` Limit1`[,` Limit2`] ] ) F`

  `FactorsPminus1` tries to factor n using Pollard's p-1.

  It uses a as base for exponentiation, Limit1 as first stage limit and Limit2 as second stage limit. If the function `FactorsPminus1` is called with three arguments, these arguments are regarded as n, Limit1 and Limit2. The function `FactorsPminus1` chooses defaults for all arguments which are not explicitly given.

  The result is returned as a list of two lists. The first list contains the prime factors found, and the second list contains remaining unfactored parts of n, if there are any.

  Pollard's p-1 is based on the fact that exponentiation (mod n) can be done efficiently enough to compute ak! mod n for sufficiently large k in a reasonable amount of time. Assume that p is a prime factor of n which does not divide a, and that k! is a multiple of p-1. Then Lagrange's Theorem states that ak! equiv1 (mod p). If k! is not a multiple of q-1 for another prime factor q of n, it is likely that the factor p can be determined by computing Gcd(ak!-1,n). A prime factor p is usually found if the largest prime factor of p-1 is not larger than Limit2, and the second-largest one is not larger than Limit1. (Compare with FactorsPplus1 and FactorsECM.)

      gap> FactorsPminus1( Factorial(158) + 1, 100000, 1000000 );
      [ [ 2879, 5227, 1452486383317, 9561906969931, 18331561438319,
            483714299709483760811581110341732950506493218122654853400674921345082310\
      906370452295654816571305041217323052879842924826121333143254713674832962773107\
      806789945715570386038565256719614524924705165110048148716160964980629081176057\
      0095669 ], [  ] ]
      gap> List( last[ 1 ]{[ 3, 4, 5 ]}, p -> Factors( p - 1 ) );
      [ [ 2, 2, 3, 3, 81937, 492413 ], [ 2, 3, 3, 3, 5, 7, 7, 1481, 488011 ],
        [ 2, 3001, 7643, 399613 ] ]

  ## 3.3 Williams' p+1

- `FactorsPplus1(` n`[, [` Residues`, ]` Limit1`[,` Limit2`] ] ) F`

  `FactorsPplus1` tries to factor n using a variant of Williams' p+1.

  It tries Residues different residues, and uses Limit1 as first stage limit and Limit2 as second stage limit. If the function `FactorsPplus1` is called with three arguments, these arguments are regarded as n, Limit1 and Limit2. The function `FactorsPplus1` chooses defaults for all arguments which are not explicitly given.

  The result is returned as a list of two lists. The first list contains the prime factors found, and the second list contains remaining unfactored parts of n, if there are any.

  Williams' p+1 is very similar to Pollard's p-1 (see FactorsPminus1). The difference is that the underlying group here can either have order p+1 or p-1, and that the group operation takes more time. A prime factor p is usually found if the largest prime factor of the group order is at most Limit2 and the second-largest one is not larger than Limit1. (Compare also with FactorsECM.)

      gap> FactorsPplus1( Factorial(55) - 1, 10, 10000, 100000 );
      [ [ 73, 39619, 277914269, 148257413069 ],
        [ 106543529120049954955085076634537262459718863957 ] ]
      gap> List( last[ 1 ], p -> [ Factors( p - 1 ), Factors( p + 1 ) ] );
      [ [ [ 2, 2, 2, 3, 3 ], [ 2, 37 ] ],
        [ [ 2, 3, 3, 31, 71 ], [ 2, 2, 5, 7, 283 ] ],
        [ [ 2, 2, 2207, 31481 ], [ 2, 3, 5, 9263809 ] ],
        [ [ 2, 2, 47, 788603261 ], [ 2, 3, 5, 13, 37, 67, 89, 1723 ] ] ]

  ## 3.4 The Elliptic Curves Method (ECM)

- `FactorsECM(` n`[,` Curves`[,` Limit1`[,` Limit2`[,` Delta`] ] ] ] ) F`
- `ECM(` n`[,` Curves`[,` Limit1`[,` Limit2`[,` Delta`] ] ] ] ) F`

  `FactorsECM` tries to factor n using the Elliptic Curves Method (ECM).

  The argument Curves is the number of curves to be tried. The argument Limit1 is the initial first stage limit, and Limit2 is the initial second stage limit. The argument Delta is the increment per curve for the first stage limit. The second stage limit is adjusted appropriately. `FactorsECM` chooses defaults for all arguments which are not explicitly given. It recognizes the option ECMDeterministic. If set, the choice of the curves is deterministic. This means that repeated calls of `FactorsECM` yield the same curves and hence for the same n the result after the same number of trials.

  The result is returned as a list of two lists. The first list contains the prime factors found, and the second list contains remaining unfactored parts of n, if there are any.

  The Elliptic Curves Method is based on the fact that exponentiation in the elliptic curve groups E(a,b)/n can be performed efficiently enough to compute for example gk! for k large enough (e.g. 100000 or so) in a reasonable amount of time and without using much memory, and on Lagrange's Theorem. Assume that p is a prime divisor of n. Then Lagrange's Theorem states that if k! is a multiple of |E(a,b)/p|, then for any elliptic curve point g, the power gk! is the identity element of E(a,b)/p. In this situation -- under reasonable circumstances -- the factor p can be determined by taking an appropriate Gcd.

  In practice, the algorithm chooses in some sense ``better'' products Pk of small primes rather than k! as exponents. After reaching the first stage limit with PLimit1, it considers further products PLimit1q for primes q up to the second stage limit Limit2, which is usually set equal to something like 100 times the first stage limit. The prime q corresponds to the largest prime factor of the order of the group E(a,b)/p.

  A prime divisor p is usually found if the largest prime factor of the order of one of the examined elliptic curve groups E(a,b)/p is at most Limit2 and the second-largest one is at most Limit1. Thus trying a larger number of curves increases the chance of factoring n as well as taking a larger value for Limit1 and/or Limit2. It turns out to be not optimal either to take a large number of curves with very small Limit1 and Limit2 or to grind on with a single curve and very large limits. (Compare with FactorsPminus1.)

  The elements of the group E(a,b)/n are the points (x,y) given by the solutions of y2 = x3 + ax + b in the residue class ring (mod n), and an additional point infty at infinity, which serves as identity element. To turn this set into a group, define the product (although elliptic curve groups are usually written additively, I prefer using the multiplicative notation here to retain the analogy to FactorsPminus1 and FactorsPplus1) of two points p1 and p2 as follows: If p1 neqp2, let l be the line through p1 and p2, otherwise let l be the tangent to the curve C given by the above equation in the point p1 = p2. The line l intersects C in a third point, say p3. If l does not intersect the curve in a third affine point, then set p3 := infty. Define p1.p2 by the image of p3 under the reflection across the x-axis. Define the product of any curve point p and infty by p itself. This -- more or less obviously, checking associativity requires some calculation -- turns the set of points on the given curve into an abelian group E(a,b)/n.

  However, the calculations are done in projective coordinates to have an explicit representation of the identity element and to avoid calculating inverses (mod n) for the group operation. Otherwise this would require using an O((log n)3)-algorithm, while multiplication (mod n) is only O((log n)2). The corresponding equation is given by bY2Z = X3 + aX2Z + XZ2. This form allows even more efficient computations than the Weierstrass model Y2Z = X3 + aXZ2 + bZ3, which is the projective equivalent of the affine representation y2 = x3 + ax + b mentioned above. The algorithm only keeps track of two of the three coordinates, namely X and Z. The curves are chosen in a way that ensures the order of the corresponding group to be divisible by 12. This increases the chance that it is smooth enough to find a factor of n. The implementation follows the description of R. P. Brent given in Brent96, pp. 5 -- 8. In terms of this paper, for the second stage the ``improved standard continuation'' is used.

      gap> FactorsECM(2^256+1,100,10000,1000000,100);
      [ [ 1238926361552897,
            93461639715357977769163558199606896584051237541638188580280321 ], [  ] ]

  ## 3.5 The Continued Fraction Algorithm (CFRAC)

- `FactorsCFRAC(` n`) F`
- `CFRAC(` n`) F`

  `FactorsCFRAC` tries to factor n using the Continued Fraction Algorithm (CFRAC), also known as Brillhart-Morrison Algorithm.

  The result is returned as a list of the prime factors of n. In case of failure an error is signalled.

  The same warning applies as to the Quadratic Sieve (see FactorsMPQS).

  The Continued Fraction Algorithm tries to find integers x, y, such that x2 equivy2 (mod n), but not pmx equivpmy (mod n). In this situation, taking Gcd(x - y,n) yields a non-trivial factor of n. For determining such a pair (x,y), the algorithm uses the continued fraction expansion of the square root of n. If xi/yi is a continued fraction approximation for the square root of n, then ci := xi2 - nyi2 is bounded by a small constant times the square root of n. The algorithm tries to find as many ci as possible which factor completely over a chosen factor base (a list of small primes) or with only one factor not in the factor base. The latter ones can be used if and only if a second ci with the same ``large factor'' is found.

  If enough values ci have been factored, as a final stage Gaussian Elimination over GF(2) is used to determine which of the congruences xi2 equivci (mod n) have to be multiplied together to get a congruence of the desired form x2 equivy2 (mod n). Let M be the corresponding matrix. Then the entries of M are given by Mij = 1 if an odd power of the j-th element of the factor base divides the i-th usable factored value, and Mij = 0 otherwise. For obtaining the desired congruence, it is necessary that the lines of M are linearly dependent. In other words, this means that the number of factored ci has to be larger than the rank of M, which is approximately given by the size of the factor base. (Compare with FactorsMPQS.)

      gap> FactorsCFRAC( Factorial(34) - 1 );
      [ 10398560889846739639, 28391697867333973241 ]

  ## 3.6 The Multiple Polynomial Quadratic Sieve (MPQS)

- `FactorsMPQS(` n`) F`
- `MPQS(` n`) F`

  `FactorsMPQS` tries to factor n using the Single Large Prime Variation of the Multiple Polynomial Quadratic Sieve (MPQS).

  The result is returned as a list of the prime factors of n. In case of failure an error is signalled.

  The intermediate results of a computation can be saved by interrupting it with [Ctrl][C] and calling `Pause();` from the break loop. This causes `FactorsMPQS` to push all data important for resuming the computation again as a record MPQSTmp on the options stack. When called again with the same argument n, it takes the record from the options stack and gets the previously computed factorization data. For continuing the factorization process in another session, it is necessary to write this record to a file. This can be done by the function `SaveMPQSTmp(` filename`)`. The file written by this function is readable by the standard `Read`-function of GAP.

  Caution: The runtime of `FactorsMPQS` depends only on the size of n, not on the size of the factors. Thus if a small factor is not found during the preprocessing which is done before invoking the sieving process, the runtime is as long as if n would have two prime factors of roughly equal size.

  The Multiple Polynomial Quadratic Sieve tries to find integers x, y, such that x2 equivy2 (mod n), but not pmx equivpmy (mod n). In this situation, taking Gcd(x - y,n) yields a non-trivial factor of n. For determining such a pair (x,y), the algorithm chooses polynomials fa of the form fa(r) = ar2 + 2br + c with suitably chosen coefficients a, b and c, satisfying b2 equivn (mod a) and c = (b2 - n)/a. The identity a timesfa(r) = (ar + b)2 - n yields a congruence (mod n) with a perfect square on one side and a timesfa(r) on the other. The algorithm uses a sieving technique similar to the Sieve of Eratosthenes over an appropriately chosen sieving interval to search for factorizations of values fa(r) over a chosen factor base. Any two factorizations with the same single ``large'' factor which does not belong to the factor base can also be used. Taking more polynomials and hence shorter sieving intervals yields the advantage of having to factor smaller values fa(r) over the factor base.

  If enough values fa(r) have been factored, as a final stage Gaussian Elimination over GF(2) is used to determine which congruences have to be multiplied together to get a congruence of the desired form x2 equivy2 (mod n). Let M be the corresponding matrix. Then the entries of M are given by Mij = 1 if an odd power of the j-th element of the factor base divides the i-th usable factored value, and Mij = 0 otherwise. For obtaining the desired congruence, it is necessary that the lines of M are linearly dependent. In other words, this means that the number of usable factorizations of values fa(r) has to be larger than the rank of M. The latter is approximately equal to the size of the factor base. (Compare with FactorsCFRAC.)

      gap> FactorsMPQS( Factorial(38) + 1 );
      [ 14029308060317546154181, 37280713718589679646221 ]

  [Up] [Previous] [Next] [Index]