Pollard's ''p'' − 1 algorithm is a
number theoretic integer factorization
In mathematics, integer factorization is the decomposition of a positive integer into a product of integers. Every positive integer greater than 1 is either the product of two or more integer factors greater than 1, in which case it is a comp ...
algorithm
In mathematics and computer science, an algorithm () is a finite sequence of Rigour#Mathematics, mathematically rigorous instructions, typically used to solve a class of specific Computational problem, problems or to perform a computation. Algo ...
, invented by
John Pollard in 1974. It is a special-purpose algorithm, meaning that it is only suitable for
integer
An integer is the number zero (0), a positive natural number (1, 2, 3, ...), or the negation of a positive natural number (−1, −2, −3, ...). The negations or additive inverses of the positive natural numbers are referred to as negative in ...
s with specific types of factors; it is the simplest example of an
algebraic-group factorisation algorithm.
The factors it finds are ones for which the number preceding the factor, ''p'' − 1, is
powersmooth; the essential observation is that, by working in the multiplicative group
modulo
In computing and mathematics, the modulo operation returns the remainder or signed remainder of a division, after one number is divided by another, the latter being called the '' modulus'' of the operation.
Given two positive numbers and , mo ...
a composite number ''N'', we are also working in the multiplicative groups modulo all of ''Ns factors.
The existence of this algorithm leads to the concept of
safe prime
In number theory, a prime number ''p'' is a if 2''p'' + 1 is also prime. The number 2''p'' + 1 associated with a Sophie Germain prime is called a . For example, 11 is a Sophie Germain prime and 2 × 11 +&nbs ...
s, being primes for which ''p'' − 1 is two times a
Sophie Germain prime
In number theory, a prime number ''p'' is a if 2''p'' + 1 is also prime. The number 2''p'' + 1 associated with a Sophie Germain prime is called a . For example, 11 is a Sophie Germain prime and 2 × 11 +&nbs ...
''q'' and thus minimally smooth. These primes are sometimes construed as "safe for cryptographic purposes", but they might be ''unsafe'' — in current recommendations for cryptographic
strong primes (''e.g.''
ANSI X9.31), it is
necessary but not sufficient that ''p'' − 1 has at least one large prime factor. Most sufficiently large primes are strong; if a prime used for cryptographic purposes turns out to be non-strong, it is much more likely to be through malice than through an accident of
random number generation
Random number generation is a process by which, often by means of a random number generator (RNG), a sequence of numbers or symbols is generated that cannot be reasonably predicted better than by random chance. This means that the particular ou ...
. This terminology is considered
obsolete
Obsolescence is the process of becoming antiquated, out of date, old-fashioned, no longer in general use, or no longer useful, or the condition of being in such a state. When used in a biological sense, it means imperfect or rudimentary when comp ...
by the cryptography industry: the
ECM factorization method is more efficient than Pollard's algorithm and finds safe prime factors just as quickly as it finds non-safe prime factors of similar size, thus the size of ''p'' is the key security parameter, not the smoothness of ''p'' − 1.
What are strong primes and are they necessary for the RSA system?
RSA Laboratories (2007)
Base concepts
Let ''n'' be a composite integer with prime factor ''p''. By Fermat's little theorem
In number theory, Fermat's little theorem states that if is a prime number, then for any integer , the number is an integer multiple of . In the notation of modular arithmetic, this is expressed as
a^p \equiv a \pmod p.
For example, if and , t ...
, we know that for all integers ''a'' coprime to ''p'' and for all positive integers ''K'':
:
If a number ''x'' is congruent to 1 modulo
In computing and mathematics, the modulo operation returns the remainder or signed remainder of a division, after one number is divided by another, the latter being called the '' modulus'' of the operation.
Given two positive numbers and , mo ...
a factor of ''n'', then the will be divisible by that factor.
The idea is to make the exponent a large multiple of ''p'' − 1 by making it a number with very many prime factors; generally, we take the product of all prime powers less than some limit ''B''. Start with a random ''x'', and repeatedly replace it by as ''w'' runs through those prime powers. Check at each stage, or once at the end if you prefer, whether is not equal to 1.
Multiple factors
It is possible that for all the prime factors ''p'' of ''n'', ''p'' − 1 is divisible by small primes, at which point the Pollard ''p'' − 1 algorithm simply returns ''n''.
Algorithm and running time
The basic algorithm can be written as follows:
:Inputs: ''n'': a composite number
:Output: a nontrivial factor of ''n'' or failure
:# select a smoothness bound ''B''
:# define (note: explicitly evaluating ''M'' may not be necessary)
:# randomly pick a positive integer, ''a'', which is coprime to ''n'' (note: we can actually fix ''a'', e.g. if ''n'' is odd, then we can always select ''a'' = 2, random selection here is not imperative)
:# compute (note: exponentiation can be done modulo ''n'')
:# if then return ''g''
:# if then select a larger ''B'' and go to step 2 or return failure
:# if then select a smaller ''B'' and go to step 2 or return failure
If in step 6, this indicates there are no prime factors ''p'' for which ''p'' − 1 is ''B''-powersmooth. If in step 7, this usually indicates that all factors were ''B''-powersmooth, but in rare cases it could indicate that ''a'' had a small order modulo ''n''. Additionally, when the maximum prime factors of ''p'' − 1 for each prime factors ''p'' of ''n'' are all the same in some rare cases, this algorithm will fail.
The running time of this algorithm is ; larger values of ''B'' make it run slower, but are more likely to produce a factor.
Example
If we want to factor the number ''n'' = 299.
:# We select ''B'' = 5.
:# Thus ''M'' = 22 × 31 × 51.
:# We select ''a'' = 2.
:# ''g'' = gcd(''a''''M'' − 1, ''n'') = 13.
:# Since 1 < 13 < 299, thus return 13.
:# 299 / 13 = 23 is prime, thus it is fully factored: 299 = 13 × 23.
Methods of choosing ''B''
Since the algorithm is incremental, it is able to keep running with the bound constantly increasing.
Assume that ''p'' − 1, where ''p'' is the smallest prime factor of ''n'', can be modelled as a random number of size less than . By the Dickman function, the probability that the largest factor of such a number is less than (''p'' − 1)''1/ε'' is roughly ''ε''−''ε''; so there is a probability of about 3−3 = 1/27 that a ''B'' value of ''n''1/6 will yield a factorisation.
In practice, the elliptic curve method
The Lenstra elliptic-curve factorization or the elliptic-curve factorization method (ECM) is a fast, sub-exponential running time, algorithm for integer factorization, which employs elliptic curves. For general-purpose computer, general-purpose ...
is faster than the Pollard ''p'' − 1 method once the factors are at all large; running the ''p'' − 1 method up to ''B'' = 232 will find a quarter of all 64-bit factors and 1/27 of all 96-bit factors.
Two-stage variant
A variant of the basic algorithm is sometimes used; instead of requiring that ''p'' − 1 has all its factors less than ''B'', we require it to have all but one of its factors less than some ''B''1, and the remaining factor less than some . After completing the first stage, which is the same as the basic algorithm, instead of computing a new
:
for ''B''2 and checking , we compute
:
where and check if produces a nontrivial factor of ''n''. As before, exponentiations can be done modulo ''n''.
Let be successive prime numbers in the interval and ''d''''n'' = ''q''''n'' − ''q''''n''−1 the difference between consecutive prime numbers. Since typically , are even numbers. The distribution of prime numbers is such that the ''d''''n'' will all be relatively small. It is suggested that . Hence, the values of , , , … (mod ''n'') can be stored in a table, and be computed from , saving the need for exponentiations.
Implementations
* Th
GMP-ECM
package includes an efficient implementation of the ''p'' − 1 method.
* Prime95 and MPrime
Prime95, also distributed as the command-line utility mprime for FreeBSD and Linux, is a freeware application software, application written by George Woltman. It is the official client of the Great Internet Mersenne Prime Search (GIMPS), a volunte ...
, the official clients of the Great Internet Mersenne Prime Search
The Great Internet Mersenne Prime Search (GIMPS) is a collaborative project of volunteers who use freely available software to search for Mersenne prime numbers.
GIMPS was founded in 1996 by George Woltman, who also wrote the Prime95 client and ...
, use a modified version of the ''p'' − 1 algorithm to eliminate potential candidates.
See also
* Williams's ''p'' + 1 algorithm
References
*
*
*
{{DEFAULTSORT:Pollard's p - 1 algorithm
Integer factorization algorithms