This article describes an implementation of the NFS, including the choice of two quadratic polynomials, both classical sieving and a special form of lattice sieving (line sieving), the block Lanczos method and a new square root algorithm. Finally some data on factorizations obtained with this implementation are listed, including the record factorization of 12^151 -1.

The Number Field Sieve (NFS) is the asymptotically fastest factoring algorithm known. It had spectacular successes in factoring numbers of a special form. Then the method was adapted for general numbers, and recently applied to the RSA-130 number [6], setting a new world record in factorization. The NFS has undergone several modifications since its appearance. One of these modifications concerns the last stage: the computation of the square root of a huge algebraic number given as a product of hundreds of thousands of small ones. This problem was not satisfactorily solved until the appearance of an algorithm by Peter Montgomery. Unfortunately, Montgomery only published a preliminary version of his algorithm [15], while a description of his own implementation can be found in [7]. In this paper, we present a variant of the algorithm, compare it with the original algorithm, and discuss its complexity.

A novel portable hardware architecture of the Elliptic Curve Method of factoring, designed and optimized for application in the relation collection step of the Number Field Sieve, is described and analyzed. A comparison with an earlier proof-of-concept design by Pelzl, Simka, et al. has been performed, and a substantial improvement has been demonstrated in terms of both the execution time and the area-time product. The ECM architecture has been ported across five different families of FPGA devices in order to select the family with the best performance to cost ratio. A timing comparison with the highly optimized software implementation, GMP-ECM, has been performed. Our results indicate that low-cost families of FPGAs, such as Spartan-3 and Spartan-3E, offer at least an order of magnitude improvement over the same generation of microprocessors in terms of the performance to cost ratio. 1.

The Number Field Sieve (NFS) is the asymptotically fastest known factoring algorithm for large integers. This article describes an implementation of the NFS, including the choice of two quadratic polynomials, both classical and lattice sieving, the block Lanczos method and a new square root algorithm. Finally some data on factorizations obtained with this implementation are listed, including the record factorization of 12 151 \Gamma 1. AMS Subject Classification (1991): 11Y05, 11Y40 Keywords & Phrases: number field sieve, factorization Note: This report has been submitted for publication elsewhere. Note: This research is funded by the Nederlandse Organisatie voor Wetenschappelijk Onderzoek (Netherlands Organization for Scientific Research, NWO) through the Stichting Mathematisch Centrum (SMC), under grant number 611-307-022. 1. Introduction The Number Field Sieve (NFS) --- introduced in 1988 by John Pollard [19] --- is the asymptotically fastest known algorithm for factoring inte...

25> f(a=b) and of a=b\Gammam are both smooth, meaning that only small prime factors divide these numerators. These are more likely to be smooth when 1 We assume the reader to be familiar with this factoring method, although no expert knowledge is required to understand the spirit of this announcement. 2 NFSNET is a collaborative effort to factor numbers by the Number Field Sieve. It relies on volunteers from around the world who contribute the "spare time" of a large number of workstations to perform the sieving. In addition to completing work on other numbers, their 75 workstations sieved (3 349 \Gamma 1)=2 during the months of December 1996 and January 1997. The organizers and principal researchers of NFSNET are: Marije ElkenbrachtHuizing, Peter Montgomery, Bob Silverman, Richard Wackerbarth, and Sam Wagstaff, Jr. 1. the polynomial values themselves are

In this thesis design alternatives for hardware solutions that accelerate flexible elliptic curve cryptography in GF (2 m ) are evaluated.