FACTORING. n = fall in the arithmetic sequence

The claim that factorization is harder than primality testing (or primality certifi- cation) is not currently substantiated rigorously. As some sort of backward evidence that factoring is hard, this writeup briefly introduces some factoring methods.

1. Futility of Trial Division

Trial division attempts to divide a given integer n by integers 2 through √ n.

Either we find a proper factor of n, or n is prime. A crude estimate shows the hopelessness of this method for factoring integers large enough to be relevant to public-key cryptology. Suppose that n ∼ 10 ²⁰⁰ , and either n is prime or n = pq where p, q ∼ 10 ¹⁰⁰ are primes. Determining whether n is prime or n = pq will take about 10 ¹⁰⁰ trial divisions. If 10 ¹² internet hosts each carried out 10 ¹² trials per second, then since there are fewer than 10 ⁸ seconds per year, even this massively parallel attack would require some 10 ⁶⁸ years.

The skeptics may generate ever larger probable primes and then test trial division on them. The process will become hopeless long before 200 digits.

2. The Euler–Fermat Trick Consider a positive integer of the special form

n = b ^e − 1

For such n, if p is a prime divisor of n then either p | b ^d − 1 for some proper divisor d of e (possibly d = 1), or p = 1 mod e.

This follows from the fact that p | n then b is an eth root of unity in Z/pZ. In formulas, the argument that p | b ^d − 1 for some divisor d of e (possibly d = e) is:

p | b ^e − 1 =⇒ b ^e = 1 mod p

=⇒ b ^d = 1 mod p for some minimal positive d, d | e

=⇒ p | b ^d − 1 for the same d

Now, either d is a proper divisor of e, or d = e. But if d = e then e is the order of b in (Z/pZ) ^× , a cyclic group of order p − 1, and so e | p − 1, i.e., p = 1 mod e. Thus the statement in italics is justified. It reduces by a significant constant factor the amount of required trial division to check the primality of n.

Similarly, if p is a prime divisor of the Fermat number n = 2 ²

+ 1 then 2 would be a 2 ^q th root of −1 in Z/pZ. Thus 2 would be a primitive 2 ^q+1 st root of unity in Z/pZ, forcing 2 ^q+1 | p − 1, i.e., p = 1 mod 2 ^q+1 . Euler used this idea to show that possible prime factors of the fifth Fermat number

n = 2 ²

+ 1 fall in the arithmetic sequence

{64k + 1} = {65, 129, . . . , 641, . . . },

1

and in fact 641 is a factor. The difference between five trial divisions (641 is the fifth prime in the arithmetic sequence) and 116 trial divisions (641 is the 116th prime) is significant. Similarly, this method finds a six-digit prime factor of n = 2 ²

+ 1 in 150 trial divisions. The modern Lucas–Lehmer test is much faster, but it does not actually find a prime factor.

3. Pollard’s Rho Method

This method quickly finds relatively small factors p of composite numbers in per- haps √

p steps, and it uses very little memory. [Pollard’s rho method for discrete logarithms would make a good project topic. See his 1978 paper in Mathematics of Computation.] It is simple to implement, and it demonstrates the suprising power of algorithms that are irremedially probabilistic. Although an obvious heuristic sug- gests the reasonableness of Pollard’s rho, it is difficult to prove that it works as well as it does. [But see the 1991 paper by E. Bach in Information and Computation.]

Here is the method: Given n, define a function

f : {0, . . . , n − 1} −→ {0, . . . , n − 1}, f (x) = x ² + 2 % n.

Then

• Initialize x = 2, y = f (x).

• While gcd(x − y, n) = 1, replace (x, y) by (f (x), f (f (y))).

• Now 1 < gcd(x − y, n) ≤ n. If 1 < gcd(x − y, n) < n then the gcd is a proper factor of n, but if gcd(x − y, n) then the test has failed.

When the test fails it can be tried again with a different starting value of x, or with a different function f . Not only does the test work surprisingly well, but it is hardly matters what starting value x or what function f is used.

The most compelling explanation of Pollard’s rho factorization method is heuris- tic, and attempts to be more rigorous do not succeed easily. The two critical com- ponents of the heuristic explanation are the birthday paradox and Floyd’s cycle- detection method.

3.1. The Birthday Paradox and the First Idea of Pollard’s Rho. The num- ber d of draws (with replacement) from n objects required to make the probability of at least two pair matching exceed 1/2 is essentially 1.2 · √

n. This is perhaps a suprisingly small number.

Indeed, the probability of no match is P _d =

d−1

Y

i=1

(1 − i/n).

So the logarithm of the probability is log P d =

d−1

X

i=1

log

 1 − i

n



≤

d−1

X

i=1

−i

n = − (d − 1)d 2n ≈ − d ²

2n .

So if d ² > 2 log 2 · n then log(P d )  − log 2 = log(1/2), i.e., P d  1/2. Since P d is complementary to the probability of a match, we are done. And the condition is essentially d > √

n.

(If we want to be more finicky, we can note that a precise estimate of the no- match probability is log P _d ≤ −(d − 1) ² /(2n), and so a precise condition to make the match probability exceed 1/2 is d > √

2 log 2 · n + 1.)

Returning to Pollard’s rho method, suppose that n has a proper divisor p that is much smaller than n. If we have more than √

p integers x 1 , . . . , x t , then with probability greater than 1/2, two of the x i should agree modulo p. Since √

p is much smaller than √

n, if the sequence {x i } behaves somewhat randomly then two x i -values should agree modulo p long before any two agree modulo n. If, say, x i = x j mod p then gcd(x i − x j , n) will be divisible by p. The gcd will be a divisor of n greater than 1 and probably smaller than n.

But computing gcd(x i − x j , n) for every pair {x i , x j } as we go along until we find a match could take roughly √

p √ p ∼ √

n comparisons, and this is as bad as trial division. To compute many fewer gcds with confidence of nonetheless finding a match quickly, Pollard’s rho method is using a second idea beyond the birthday paradox.

3.2. Floyd’s Cycle Detection Method and the Second Idea of Pollard’s Rho Method. Pretend that the function

f : {0, . . . , n − 1} −→ {0, . . . , n − 1}, f (x) = x ² + 2 % n is a random map of Z/nZ to itself, and define a sequence

x ₁ = 2, x _i = f (x _i−1 ) for i > 1.

Note that if ever x _j = x _i (where j > i) then also x _j+k = x _i+k for all k ≥ 0. That is, as soon as the sequence reaches its first value that will repeat, it settles into a cycle of length j − i, and so the sequence takes the form of the greek letter ρ.

Consequently,

x _t = x _t−k(j−i) whenever k ≥ 1 and t − k(j − i) ≥ i.

Pollard’s method compares only pairs of terms (x s , y s ) = (x s , x 2s ). That is, it searches for an equality as in the previous display but where t = 2s for some s and where the right subscript is s itself,

x 2s = x _{2s−k(j−i)} whenever 2s − k(j − i) = s ≥ i.

Such an equality will hold under the conditions

s = k(j − i) for some k ≥ 1, s ≥ i.

Since Pollard’s rho method compares x s and x 2s for s = 1, 2, . . . , the analysis here proves that it will find a match.

4. Pollard’s p − 1 Method

Call a positive integer smooth if it divisible only by small primes. Pollard’s p − 1 method finds prime factors p of a given n with the property that p − 1 is smooth.

(Such primes p are called weak.)

More specifically, let B some bound. Then positive integers of the form

m = Y

q<B

q ^e

are called B-smooth. Pollard’s p − 1 method finds a prime factor p of n such

that p − 1 is B-smooth using O(B ln n/ ln b) multiplications modulo n. But the

algorithm can fail. In practice, because the value of B must be kept too small to

find all possible factors, the algorithm is used “just a little” hoping for luck or for

negligence on the part of an adversary. The question of how large we should expect the prime factors of a randomly chosen number to be is not trivial.

Here is the method: Given n, known to be composite but not a prime power, and given a smoothness bound B, proceed as follows.

• Choose a random integer b, with 2 ≤ b ≤ n − 1. Let g = gcd(b, n). If g ≥ 2 then g is a proper factor of n, so stop.

• Otherwise let p ₁ , . . . , p _t be the primes that are at most B. For i = 1, . . . , t, do the following

(1) Let q = p _i .

(2) Let ` = dln n/ ln qe.

(3) Replace b by b ^q

% n.

(4) Compute g = gcd(b − 1, n).

(5) If 1 < g < n then g is a proper factor of n, so stop. If g = n then the algorithm has failed. If g = 1 then continue to the next value of i.

Why does this work? Suppose that n has a prime factor p such that p − 1 is B-smooth,

p = 1 +

t

Y

i=1

p ^e _i

.

For any b such that gcd(b, n) = 1, Fermat’s Little Theorem says that b ^p−1 = 1 mod p, i.e.,

b ^p

^···p

= 1 mod p.

The calculation

ln n ≥ ln p > ln Y

j

p ^e _j

= X

j

e _j ln p _j ≥ e i ln p _i

shows that the quantity ` _i = dln n/ ln p _i e is at least e i . Thus p − 1 = Q

i p ^e _i

diviides the quantity T = Q

i p ^` _i

, and so b ^T = 1 mod p for any integer b coprime to p. That is,

p | gcd(b ^T − 1, n).

The format of the algorithm shows that the bound B serves only to ensure that the algorithm terminates after a while. Instead, one could try successively larger primes until deciding to quit by some criterion such as total time invested.

Example. Factor 54541557732143. Initialize b = 3. The exponent for 2 is 46, the exponent for 3 is 29, and the exponent for 5 is 20. Replace b by

b ²

% 54541557732143 = 7359375584408.

Since gcd(b − 1, n) = 1, continue. Replace b by

b ³

% 54541557732143 = 8632659376632.

Since gcd(b − 1, n) = 1, continue. Replace b by

b ⁵

% 54541557732143 = 22167690980770.

This time the gcd is 54001, giving a proper factor. And indeed, 54001 is {2, 3, 5}- weak because

54000 = 2 ⁴ 3 ³ 5 ³

is {2, 3, 5}-smooth.

There is an analogous p + 1 method due to Williams in Math Comp 39 (1982).

More generally, for any cyclotomic polynomial ϕ n (x) = x ⁿ − 1/ Y

d|n, d<n

ϕ d (x)

there is a ϕ n (p) method. The case n = 1 is Pollard’s p − 1, and the case n = 2 is

Williams’s p + 1.