HOME

TheInfoList



OR:

In number theory, the general number field sieve (GNFS) is the most efficient classical
algorithm In mathematics and computer science, an algorithm () is a finite sequence of rigorous instructions, typically used to solve a class of specific problems or to perform a computation. Algorithms are used as specifications for performing ...
known for factoring integers larger than . Heuristically, its
complexity Complexity characterises the behaviour of a system or model whose components interact in multiple ways and follow local rules, leading to nonlinearity, randomness, collective dynamics, hierarchy, and emergence. The term is generally used to ch ...
for factoring an integer (consisting of bits) is of the form :\exp\left( \left(\sqrt + o(1)\right)(\ln n)^(\ln \ln n)^\right) =L_n\left frac,\sqrt[3right.html"_;"title=".html"_;"title="frac,\sqrt[3">frac,\sqrt[3right">.html"_;"title="frac,\sqrt[3">frac,\sqrt[3right/math> (in_L-notation.html" ;"title="">frac,\sqrt[3right.html" ;"title=".html" ;"title="frac,\sqrt[3">frac,\sqrt[3right">.html" ;"title="frac,\sqrt[3">frac,\sqrt[3right/math> (in L-notation">">frac,\sqrt[3right.html" ;"title=".html" ;"title="frac,\sqrt[3">frac,\sqrt[3right">.html" ;"title="frac,\sqrt[3">frac,\sqrt[3right/math> (in L-notation), where is the natural logarithm. It is a generalization of the special number field sieve: while the latter can only factor numbers of a certain special form, the general number field sieve can factor any number apart from prime powers (which are trivial to factor by taking roots). The principle of the number field sieve (both special and general) can be understood as an improvement to the simpler
rational sieve In mathematics, the rational sieve is a general algorithm for factoring integers into prime factors. It is a special case of the general number field sieve. While it is less efficient than the general algorithm, it is conceptually simpler. It ser ...
or quadratic sieve. When using such algorithms to factor a large number , it is necessary to search for
smooth number In number theory, an ''n''-smooth (or ''n''-friable) number is an integer whose prime factors are all less than or equal to ''n''. For example, a 7-smooth number is a number whose every prime factor is at most 7, so 49 = 72 and 15750 = 2 × 32 × 5 ...
s (i.e. numbers with small prime factors) of order . The size of these values is exponential in the size of (see below). The general number field sieve, on the other hand, manages to search for smooth numbers that are subexponential in the size of . Since these numbers are smaller, they are more likely to be smooth than the numbers inspected in previous algorithms. This is the key to the efficiency of the number field sieve. In order to achieve this speed-up, the number field sieve has to perform computations and factorizations in number fields. This results in many rather complicated aspects of the algorithm, as compared to the simpler rational sieve. The size of the input to the algorithm is or the number of bits in the binary representation of . Any element of the order for a constant is exponential in . The running time of the number field sieve is super-polynomial but sub-exponential in the size of the input.


Number fields

Suppose is a -degree polynomial over (the rational numbers), and is a complex root of . Then, , which can be rearranged to express as a linear combination of powers of less than . This equation can be used to reduce away any powers of with exponent . For example, if and is the imaginary unit , then , or . This allows us to define the complex product: :(a+bi)(c+di) = ac + (ad+bc)i + (bd)i^2 = (ac - bd) + (ad+bc)i. In general, this leads directly to the
algebraic number field In mathematics, an algebraic number field (or simply number field) is an extension field K of the field of rational numbers such that the field extension K / \mathbb has finite degree (and hence is an algebraic field extension). Thus K is a f ...
, which can be defined as the set of complex numbers given by: :a_r^ + ... + a_r^ + a_r^, \text a_0,...,a_ \text \mathbf. The product of any two such values can be computed by taking the product as polynomials, then reducing any powers of with exponent as described above, yielding a value in the same form. To ensure that this field is actually -dimensional and does not collapse to an even smaller field, it is sufficient that is an irreducible polynomial over the rationals. Similarly, one may define the ring of integers as the subset of which are roots of monic polynomials with integer coefficients. In some cases, this ring of integers is equivalent to the ring . However, there are many exceptions, such as for when is equal to 1 modulo 4.


Method

Two polynomials ''f''(''x'') and ''g''(''x'') of small degrees ''d'' and ''e'' are chosen, which have integer coefficients, which are irreducible over the rationals, and which, when interpreted mod ''n'', have a common integer root ''m''. An optimal strategy for choosing these polynomials is not known; one simple method is to pick a degree ''d'' for a polynomial, consider the expansion of ''n'' in base ''m'' (allowing digits between −''m'' and ''m'') for a number of different ''m'' of order ''n''1/''d'', and pick ''f''(''x'') as the polynomial with the smallest coefficients and ''g''(''x'') as ''x'' − ''m''. Consider the number field rings Z 'r''1and Z 'r''2 where ''r''1 and ''r''2 are roots of the polynomials ''f'' and ''g''. Since ''f'' is of degree ''d'' with integer coefficients, if ''a'' and ''b'' are integers, then so will be ''b''''d''·''f''(''a''/''b''), which we call ''r''. Similarly, ''s'' = ''b''''e''·''g''(''a''/''b'') is an integer. The goal is to find integer values of ''a'' and ''b'' that simultaneously make ''r'' and ''s''
smooth Smooth may refer to: Mathematics * Smooth function, a function that is infinitely differentiable; used in calculus and topology * Smooth manifold, a differentiable manifold for which all the transition maps are smooth functions * Smooth algebraic ...
relative to the chosen basis of primes. If ''a'' and ''b'' are small, then ''r'' and ''s'' will be small too, about the size of ''m'', and we have a better chance for them to be smooth at the same time. The current best-known approach for this search is lattice sieving; to get acceptable yields, it is necessary to use a large factor base. Having enough such pairs, using
Gaussian elimination In mathematics, Gaussian elimination, also known as row reduction, is an algorithm for solving systems of linear equations. It consists of a sequence of operations performed on the corresponding matrix of coefficients. This method can also be used ...
, one can get products of certain ''r'' and of the corresponding ''s'' to be squares at the same time. A slightly stronger condition is needed—that they are norms of squares in our number fields, but that condition can be achieved by this method too. Each ''r'' is a norm of ''a'' − ''r''1''b'' and hence that the product of the corresponding factors ''a'' − ''r''1''b'' is a square in Z 'r''1 with a "square root" which can be determined (as a product of known factors in Z 'r''1—it will typically be represented as an irrational
algebraic number An algebraic number is a number that is a root of a non-zero polynomial in one variable with integer (or, equivalently, rational) coefficients. For example, the golden ratio, (1 + \sqrt)/2, is an algebraic number, because it is a root of the p ...
. Similarly, the product of the factors ''a'' − ''r''2''b'' is a square in Z 'r''2 with a "square root" which also can be computed. It should be remarked that the use of Gaussian elimination does not give the optimal run time of the algorithm. Instead, sparse matrix solving algorithms such as Block Lanczos or Block Wiedemann are used. Since ''m'' is a root of both ''f'' and ''g'' mod ''n'', there are homomorphisms from the rings Z 'r''1and Z 'r''2to the ring Z/''n''Z (the integers modulo ''n''), which map ''r''1 and ''r''2 to ''m'', and these homomorphisms will map each "square root" (typically not represented as a rational number) into its integer representative. Now the product of the factors ''a'' − ''mb'' mod ''n'' can be obtained as a square in two ways—one for each homomorphism. Thus, one can find two numbers ''x'' and ''y'', with ''x''2 − ''y''2 divisible by ''n'' and again with probability at least one half we get a factor of ''n'' by finding the greatest common divisor of ''n'' and ''x'' − ''y''.


Improving polynomial choice

The choice of polynomial can dramatically affect the time to complete the remainder of the algorithm. The method of choosing polynomials based on the expansion of in base shown above is suboptimal in many practical situations, leading to the development of better methods. One such method was suggested by Murphy and Brent; they introduce a two-part score for polynomials, based on the presence of roots modulo small primes and on the average value that the polynomial takes over the sieving area. The best reported results were achieved by the method of
Thorsten Kleinjung Thorsten (Thorstein, Torstein, Torsten) is a Scandinavian given name. The Old Norse name was ''Þórsteinn''. It is a compound of the theonym ''Þór'' ('' Thor'') and ''steinn'' "stone", which became ''Thor'' and ''sten'' in Old Danish and Old Swe ...
, which allows , and searches over composed of small prime factors congruent to 1 modulo 2 and over leading coefficients of which are divisible by 60.


Implementations

Some implementations focus on a certain smaller class of numbers. These are known as special number field sieve techniques, such as used in the Cunningham project. A project called NFSNET ran from 2002 through at least 2007. It used volunteer distributed computing on the Internet.
Paul Leyland Paul Leyland is a British number theorist who has studied integer factorization and primality testing. He has contributed to the factorization of RSA-129, RSA-140, and RSA-155, as well as potential factorial primes as large as 400! + 1. He h ...
of the United Kingdom and Richard Wackerbarth of Texas were involved. Until 2007, the gold-standard implementation was a suite of software developed and distributed by CWI in the Netherlands, which was available only under a relatively restrictive license. In 2007, Jason Papadopoulos developed a faster implementation of final processing as part of msieve, which is in the public domain. Both implementations feature the ability to be distributed among several nodes in a cluster with a sufficiently fast interconnect. Polynomial selection is normally performed by GPL software written by Kleinjung, or by msieve, and lattice sieving by GPL software written by Franke and Kleinjung; these are distributed in GGNFS.
NFS@Home

GGNFS

factor by gnfs

CADO-NFS

msieve
(which contains final-processing code, a polynomial selection optimized for smaller numbers and an implementation of the line sieve)
kmGNFS


See also

* Special number field sieve


Notes


References

* Arjen K. Lenstra and H. W. Lenstra, Jr. (eds.). "The development of the number field sieve". Lecture Notes in Math. (1993) 1554. Springer-Verlag. * Richard Crandall and
Carl Pomerance Carl Bernard Pomerance (born 1944 in Joplin, Missouri) is an American number theorist. He attended college at Brown University and later received his Ph.D. from Harvard University in 1972 with a dissertation proving that any odd perfect number ha ...
. Prime Numbers: A Computational Perspective (2001). 2nd edition, Springer. . Section 6.2: Number field sieve, pp. 278–301. * Matthew E. Briggs: An Introduction to the General Number Field Sieve, 1998 {{Number theoretic algorithms Integer factorization algorithms