## Recent progress and prospects for integer factorisation algorithms (2000)

### Cached

### Download Links

- [wwwmaths.anu.edu.au]
- [xyyxf2.at.tut.by]
- [www.iai.uni-bonn.de]
- [www.math.leidenuniv.nl]
- [wwwmaths.anu.edu.au]
- [ftp.comlab.ox.ac.uk]
- [wwwmaths.anu.edu.au]
- DBLP

### Other Repositories/Bibliography

Venue: | In Proc. of COCOON 2000 |

Citations: | 21 - 1 self |

### BibTeX

@INPROCEEDINGS{Brent00recentprogress,

author = {Richard P. Brent},

title = {Recent progress and prospects for integer factorisation algorithms},

booktitle = {In Proc. of COCOON 2000},

year = {2000},

pages = {3--22},

publisher = {SpringerVerlag}

}

### Years of Citing Articles

### OpenURL

### Abstract

Abstract. The integer factorisation and discrete logarithm problems are of practical importance because of the widespread use of public key cryptosystems whose security depends on the presumed difficulty of solving these problems. This paper considers primarily the integer factorisation problem. In recent years the limits of the best integer factorisation algorithms have been extended greatly, due in part to Moore’s law and in part to algorithmic improvements. It is now routine to factor 100-decimal digit numbers, and feasible to factor numbers of 155 decimal digits (512 bits). We outline several integer factorisation algorithms, consider their suitability for implementation on parallel machines, and give examples of their current capabilities. In particular, we consider the problem of parallel solution of the large, sparse linear systems which arise with the MPQS and NFS methods. 1

### Citations

3319 | A Method for Obtaining Digital Signatures and Public Key Cryptosystems
- Rivest, Shamir, et al.
- 1978
(Show Context)
Citation Context ...olynomial-time algorithm forsnding a factor of a given composite integer N . This empirical fact is of great interest because the most popular algorithm for public-key cryptography, the RSA algorithm =-=[54]-=-, would be insecure if a fast integer factorisation algorithm could be implemented. In this paper we survey some of the most successful integer factorisation algorithms. Since there are already severa... |

2431 | The art of computer programming - Knuth - 1975 |

1031 | A course in computational algebraic number theory, volume 138 of Graduate Texts in Mathematics - Cohen - 1993 |

899 | Algorithms for quantum computation: Discrete logarithms and factoring
- Shor
- 1994
(Show Context)
Citation Context ...y integer factorisation algorithms, provided P is not too large. The speedup of a parallel algorithm is S = T 1 =T P . We aim for a linear speedup, i.e. S = (P ). 1.3 Quantum algorithms In 1994 Shor [=-=57, 58-=-] showed that it is possible to factor in polynomial expected time 2 on a quantum computer [20, 21]. However, despite the best eorts of several research groups, such a computer has not yet been built,... |

722 | Quantum Theory, the Church-Turing Principle and the Universal Quantum
- Deutsch
- 1985
(Show Context)
Citation Context ...hm is S = T 1 =T P . We aim for a linear speedup, i.e. S = (P ). 1.3 Quantum algorithms In 1994 Shor [57, 58] showed that it is possible to factor in polynomial expected time 2 on a quantum computer [=-=20, 21-=-]. However, despite the best eorts of several research groups, such a computer has not yet been built, and it remains unclear whether it will ever be feasible to build one. Thus, in this paper we rest... |

622 | A Classical Introduction to Modern Number Theory (Graduate texts - Ireland, Rosen - 1990 |

257 |
Quantum computational networks
- Deutsch
- 1989
(Show Context)
Citation Context ...hm is S = T 1 =T P . We aim for a linear speedup, i.e. S = (P ). 1.3 Quantum algorithms In 1994 Shor [57, 58] showed that it is possible to factor in polynomial expected time 2 on a quantum computer [=-=20, 21-=-]. However, despite the best eorts of several research groups, such a computer has not yet been built, and it remains unclear whether it will ever be feasible to build one. Thus, in this paper we rest... |

256 |
Factoring integers with elliptic curves
- Lenstra
- 1987
(Show Context)
Citation Context ...ithm, which has run time O(f (log N) 2 ). { Pollard's \rho" algorithm [45], which under plausible assumptions has expected run time O(f 1=2 (log N) 2 ). { Lenstra's Elliptic Curve (ECM) algorit=-=hm [3-=-4], which under plausible assumptions has expected run time O(exp( p c ln f ln ln f) (log N) 2 ); where c 2 is a constant. In these examples, the time bounds are for a sequential machine, and the te... |

195 | Solving sparse linear equations over finite fields - Wiedemann - 1986 |

189 | Solution of systems of linear equations by minimized iterations
- Lanczos
- 1952
(Show Context)
Citation Context ... amongst the columns. It is not practical to do this by structured Gaussian elimination [25, x5] because the \ll in" is too large. Odlyzko [43, 17] and Montgomery [37] showed that the Lanczos met=-=hod [26]-=- could be adapted for this purpose. (This is nontrivial because a nonzero vector x over GF(2) can be orthogonal to itself, i.e. x T x = 0.) To take advantage of bit-parallel operations, Montgomery's p... |

137 |
editors. The development of the number field sieve
- Lenstra, Lenstra
- 1993
(Show Context)
Citation Context ... under plausible assumptions have expected run time O(exp( √ c ln N ln ln N)), where c is a constant (depending on details of the algorithm). For MPQS, c ≈ 1. • The Number Field Sieve (NFS) algorithm =-=[29,30]-=-, which under plausible assumptions has expected run time O(exp(c(ln N) 1/3 (ln ln N) 2/3 )), where c is a constant (depending on details of the algorithm and on the form of N). B. The run time depend... |

113 | Sequences of numbers generated by addition in formal groups and new primality and factorization tests, Adv - Chudnovsky, Chudnovsky - 1986 |

96 | Discrete logarithms in finite fields and their cryptographic significance. Lecture
- Odlyzko
(Show Context)
Citation Context ...em over GF(2) is obtained, and we want to find dependencies amongst the columns. It is not practical to do this by structured Gaussian elimination [25, §5] because the “fill in” is too large. Odlyzko =-=[43,17]-=- and Montgomery [37] showed that the Lanczos method [26] could be adapted for this purpose. (This is nontrivial because a nonzero vector x over GF(2) can be orthogonal to itself, i.e. x T x = 0.) To t... |

75 |
Moore’s law: past, present, and future
- Schaller
- 1997
(Show Context)
Citation Context ...e restrict our attention to algorithms which run on classical (serial or parallel) computers. The reader interested in quantum computers could start by reading [50, 60]. 1.4 Moore's law Moore's \law&q=-=uot; [44, 56]-=- predicts that circuit densities will double every 18 months or so. Of course, Moore's law is not a theorem, and must eventually fail, but it has been surprisingly accurate for many years. As long as ... |

75 |
The multiple polynomial quadratic sieve
- Silverman
- 1987
(Show Context)
Citation Context ...the size of f . Examples are { { Lehman's algorithm [28], which has worst-case run time O(N 1=3 ). { The Continued Fraction algorithm [39] and the Multiple Polynomial Quadratic Sieve (MPQS) algorithm =-=[46, 59-=-], which under plausible assumptions have expected run time O(exp( p c ln N ln ln N)); where c is a constant (depending on details of the algorithm) . For MPQS, c 1. { The Number Field Sieve (NFS) al... |

75 | The number field sieve
- Lenstra, Manasse, et al.
- 1990
(Show Context)
Citation Context ... under plausible assumptions have expected run time O(exp( √ c ln N ln ln N)), where c is a constant (depending on details of the algorithm). For MPQS, c ≈ 1. • The Number Field Sieve (NFS) algorithm =-=[29,30]-=-, which under plausible assumptions has expected run time O(exp(c(ln N) 1/3 (ln ln N) 2/3 )), where c is a constant (depending on details of the algorithm and on the form of N). B. The run time depend... |

71 |
Polynomial time algorithms for prime factorisation and discrete logarithms on a quantum computer
- Shor
- 1997
(Show Context)
Citation Context ...y integer factorisation algorithms, provided P is not too large. The speedup of a parallel algorithm is S = T 1 =T P . We aim for a linear speedup, i.e. S = (P ). 1.3 Quantum algorithms In 1994 Shor [=-=57, 58-=-] showed that it is possible to factor in polynomial expected time 2 on a quantum computer [20, 21]. However, despite the best eorts of several research groups, such a computer has not yet been built,... |

63 |
The quadratic sieve factoring algorithm
- Pomerance
- 1984
(Show Context)
Citation Context ...the size of f . Examples are { { Lehman's algorithm [28], which has worst-case run time O(N 1=3 ). { The Continued Fraction algorithm [39] and the Multiple Polynomial Quadratic Sieve (MPQS) algorithm =-=[46, 59-=-], which under plausible assumptions have expected run time O(exp( p c ln N ln ln N)); where c is a constant (depending on details of the algorithm) . For MPQS, c 1. { The Number Field Sieve (NFS) al... |

58 |
A block Lanczos algorithm for finding dependencies over GF
- Montgomery
(Show Context)
Citation Context ...polynomial selection is called the “base m” method. In principle, we can proceed as in SNFS, but many difficulties arise because of the large coefficients of g(x). For details, we refer the reader to =-=[36,37,41,47,48,62]-=-. Suffice it to say that the difficulties can be overcome and the method works! Due to the constant factors involved it is slower than MPQS for numbers of less than about 110 decimal digits, but faste... |

57 | Factoring by electronic mail
- Lenstra, Manasse
- 1990
(Show Context)
Citation Context ...sieve algorithms the numbers w i are the values of one (or more) quadratic polynomials with integer coecients. This makes it easy to factor the w i by sieving. For details of the process, we refer to =-=[11, 32, 35, 46, 49, 52, 5-=-9]. The best quadratic sieve algorithm (MPQS) can, under plausible assumptions, factor a number N in time (exp(c(ln N ln ln N) 1=2 )), where c 1. The constants involved are such that MPQS is usually ... |

55 |
Lecture Notes for Physics 229: Quantum Information and Computation
- Preskill
- 1998
(Show Context)
Citation Context ...ible to build one. Thus, in this paper we restrict our attention to algorithms which run on classical (serial or parallel) computers. The reader interested in quantum computers could start by reading =-=[50, 60]. 1.4-=- Moore's law Moore's \law" [44, 56] predicts that circuit densities will double every 18 months or so. Of course, Moore's law is not a theorem, and must eventually fail, but it has been surprisin... |

52 |
The factorization of the ninth Fermat number
- Lenstra, Lenstra, et al.
- 1993
(Show Context)
Citation Context ...are much smaller than N , in fact they are O(N 1=d ), where d = 5 is the degree of the algebraic numberseld. (The optimal choice of d is discussed in x6.) Using these and related ideas, Lenstra et al =-=[3-=-1] factored F 9 in June 1990, obtaining F 9 = 2424833 7455602825647884208337395736200454918783366342657 p 99 ; 6 where p 99 is an 99-digit prime, and the 7-digit factor was already known (although S... |

45 | Elliptic Curves. Diophantine Analysis - Lang - 1978 |

44 |
Factoring with two large primes
- Lenstra, Manasse
- 1991
(Show Context)
Citation Context ...uch larger than m). In the \two large prime" (PPMPQS) variation w i can have two prime factors exceeding m { this gives a further performance improvement at the expense of higher storage requirem=-=ents [-=-33]. 4.1 Parallel/distributed implementation of MPQS The sieving stage of MPQS is ideally suited to parallel implementation. Dierent processors may use dierent polynomials, or sieve over dierent inter... |

44 | A tale of two sieves
- Pomerance
- 1996
(Show Context)
Citation Context ...eger multiplication algorithms [19, 24] can be used to reduce the (log N) 2 term. Our survey of integer factorisation algorithms is necessarily cursory. For more information the reader is referred to =-=[8, 35, 48, 53]-=-. 3 Lenstra's Elliptic Curve Algorithm Lenstra's elliptic curve method/algorithm (abbreviated ECM) was discovered by H. W. Lenstra, Jr. about 1985 (see [34]). It is the best known algorithm in class B... |

43 | Parallel algorithms for integer factorisation
- Brent
- 1990
(Show Context)
Citation Context ...ms. Since there are already several excellent surveys emphasising the number-theoretic basis of the algorithms, we concentrate on the computational aspects. This paper can be regarded as an update of =-=[8]-=-, which was written just before the factorisation of the 512-bit number RSA155. Thus, to avoid duplication, we refer to [8] for primality testing, multiple-precision arithmetic, the use of factorisati... |

36 |
The magic words are squeamish ossifrage
- Atkins, Graff, et al.
- 1995
(Show Context)
Citation Context ...[55] 3 This idea of using machines on the Internet as a \free" supercomputer has been adopted by several other computation-intensive projects. 5 number RSA129. It was factored in 1994 by Atkins e=-=t al [1]-=-. The relations formed a sparse matrix with 569466 columns, which was reduced to a dense matrix with 188614 columns; a dependency was then found on a MasPar MP-1. It is certainly feasible to factor la... |

36 |
The Future of Integer Factorization
- Odlyzko
- 1995
(Show Context)
Citation Context ...e restrict our attention to algorithms which run on classical (serial or parallel) computers. The reader interested in quantum computers could start by reading [50, 60]. 1.4 Moore's law Moore's \law&q=-=uot; [44, 56]-=- predicts that circuit densities will double every 18 months or so. Of course, Moore's law is not a theorem, and must eventually fail, but it has been surprisingly accurate for many years. As long as ... |

35 |
A world wide number field sieve factoring record: on to 512 bits
- Cowie, Dodson, et al.
- 1996
(Show Context)
Citation Context ...GNFS is faster [22]. For example, it is estimated in [16] that to factor RSA129 by MPQS required 5000 Mips-years, but to factor the slightly larger number RSA130 by GNFS required only 1000 Mips-years =-=[18]-=-. 5 The Special Number Field Sieve (SNFS) The number field sieve (NFS) algorithm was developed from the special number field sieve (SNFS), which we describe in this section. The general number field s... |

32 |
Discrete weighted transforms and large-integer arithmetic
- Crandall, Fagin
- 1994
(Show Context)
Citation Context ...((log N) c ) for some constant c. 2 a generous allowance for the cost of performing arithmetic operations on numbers which are O(N 2 ). If N is very large, then fast integer multiplication algorithms =-=[19, 24]-=- can be used to reduce the (log N) 2 term. Our survey of integer factorisation algorithms is necessarily cursory. For more information the reader is referred to [8, 35, 48, 53]. 3 Lenstra's Elliptic C... |

31 |
A pipeline architecture for factoring large integers with the quadratic sieve algorithm
- POMERANCE, SMITH, et al.
- 1988
(Show Context)
Citation Context ...sieve algorithms the numbers w i are the values of one (or more) quadratic polynomials with integer coecients. This makes it easy to factor the w i by sieving. For details of the process, we refer to =-=[11, 32, 35, 46, 49, 52, 5-=-9]. The best quadratic sieve algorithm (MPQS) can, under plausible assumptions, factor a number N in time (exp(c(ln N ln ln N) 1=2 )), where c 1. The constants involved are such that MPQS is usually ... |

24 |
Discrete logarithms and their cryptographic significance
- Odlyzko
- 1985
(Show Context)
Citation Context ...ystem over GF(2) is obtained, and we want tosnd dependencies amongst the columns. It is not practical to do this by structured Gaussian elimination [25, x5] because the \ll in" is too large. Odly=-=zko [43, 17]-=- and Montgomery [37] showed that the Lanczos method [26] could be adapted for this purpose. (This is nontrivial because a nonzero vector x over GF(2) can be orthogonal to itself, i.e. x T x = 0.) To t... |

24 |
Prime numbers and computer methods of factorization 2nd
- Riesel
- 1994
(Show Context)
Citation Context ...eger multiplication algorithms [19, 24] can be used to reduce the (log N) 2 term. Our survey of integer factorisation algorithms is necessarily cursory. For more information the reader is referred to =-=[8, 35, 48, 53]-=-. 3 Lenstra's Elliptic Curve Algorithm Lenstra's elliptic curve method/algorithm (abbreviated ECM) was discovered by H. W. Lenstra, Jr. about 1985 (see [34]). It is the best known algorithm in class B... |

21 |
Parallel Implementation of the Quadratic Sieve
- Caron, Silverman
- 1988
(Show Context)
Citation Context ...sieve algorithms the numbers w i are the values of one (or more) quadratic polynomials with integer coecients. This makes it easy to factor the w i by sieving. For details of the process, we refer to =-=[11, 32, 35, 46, 49, 52, 5-=-9]. The best quadratic sieve algorithm (MPQS) can, under plausible assumptions, factor a number N in time (exp(c(ln N ln ln N) 1=2 )), where c 1. The constants involved are such that MPQS is usually ... |

20 |
Square roots of products of algebraic numbers
- Montgomery
- 1994
(Show Context)
Citation Context ...od of polynomial selection is called the \base m" method. In principle, we can proceed as in SNFS, but many diculties arise because of the large coecients of g(x). For details, we refer the reade=-=r to [36, 37, 41, 47, 48, 62]-=-. Suce it to say that the diculties can be overcome and the method works! Due to the constant factors involved it is slower than MPQS for numbers of less than about 110 decimal digits, but faster than... |

19 | Solving sparse linear equations over - Wiedemann - 1986 |

18 |
Discrete logarithms in GF(p). Algorithmica
- Coppersmith, Odlyzko, et al.
- 1986
(Show Context)
Citation Context ...ystem over GF(2) is obtained, and we want tosnd dependencies amongst the columns. It is not practical to do this by structured Gaussian elimination [25, x5] because the \ll in" is too large. Odly=-=zko [43, 17]-=- and Montgomery [37] showed that the Lanczos method [26] could be adapted for this purpose. (This is nontrivial because a nonzero vector x over GF(2) can be orthogonal to itself, i.e. x T x = 0.) To t... |

16 | Polynomial selection for the number field sieve integer factorisation algorithm
- Murphy
- 1999
(Show Context)
Citation Context ...polynomial selection is called the “base m” method. In principle, we can proceed as in SNFS, but many difficulties arise because of the large coefficients of g(x). For details, we refer the reader to =-=[36,37,41,47,48,62]-=-. Suffice it to say that the difficulties can be overcome and the method works! Due to the constant factors involved it is slower than MPQS for numbers of less than about 110 decimal digits, but faste... |

15 |
Large factors found by ECM
- Brent
- 1995
(Show Context)
Citation Context ...or 484061254276878368125726870789180231995964870094916937 of (6 43 1) 42 + 1, found by Nik Lygeros and Michel Mizony with Paul Zimmermann's GMP-ECM program [63] in December 1999 (for more details see =-=[9]-=-). 3.2 Parallel/distributed implementation of ECM ECM consists of a number of independent pseudo-random trials, each of which can be performed on a separate processor. So long as the expected number o... |

14 |
Factoring large integers
- Lehman
- 1974
(Show Context)
Citation Context ...ger N . The most useful algorithms fall into one of two classes { A. The run time depends mainly on the size of N; and is not strongly dependent on the size of f . Examples are { { Lehman's algorithm =-=[28]-=-, which has worst-case run time O(N 1=3 ). { The Continued Fraction algorithm [39] and the Multiple Polynomial Quadratic Sieve (MPQS) algorithm [46, 59], which under plausible assumptions have expecte... |

13 | A survey of modern integer factorization algorithms, CWI Quarterly 7
- Montgomery
- 1994
(Show Context)
Citation Context ...eger multiplication algorithms [19, 24] can be used to reduce the (log N) 2 term. Our survey of integer factorisation algorithms is necessarily cursory. For more information the reader is referred to =-=[8, 35, 48, 53]-=-. 3 Lenstra's Elliptic Curve Algorithm Lenstra's elliptic curve method/algorithm (abbreviated ECM) was discovered by H. W. Lenstra, Jr. about 1985 (see [34]). It is the best known algorithm in class B... |

13 |
The number field sieve
- Pomerance
- 1994
(Show Context)
Citation Context ...polynomial selection is called the “base m” method. In principle, we can proceed as in SNFS, but many difficulties arise because of the large coefficients of g(x). For details, we refer the reader to =-=[36,37,41,47,48,62]-=-. Suffice it to say that the difficulties can be overcome and the method works! Due to the constant factors involved it is slower than MPQS for numbers of less than about 110 decimal digits, but faste... |

12 | Vector and parallel algorithms for integer factorisation
- Brent
- 1990
(Show Context)
Citation Context ...algorithm is found or a quantum computer capable of running Shor's algorithm is built, large factorisations will remain an interesting challenge. A survey similar to this one was written a decade ago =-=[3-=-]. Comparing the examples there with those given here we see that signicant progress has been made. This is partly due to Moore's law, partly due to the use of many machines on the Internet, and partl... |

12 | Parallel Algorithms in Linear Algebra, Algorithms and Architectures
- Brent
- 1993
(Show Context)
Citation Context ...cation being performed in other rows. (Similarly for columns.) The reason why this topology is desirable is that it matches the communication patterns necessary in the linear algebra: see for example =-=[4, 5, 6]-=-. To simplify the description, we assume that the standard Lanczos algorithm is used. In practice, a block version of Lanczos [37] would be used, both to take advantage of word-length Boolean operatio... |

12 | Factoring with the quadratic sieve on large vector computers,’’ report NM-R8805
- Riele, Lioen, et al.
- 1988
(Show Context)
Citation Context |

12 | Factoring integers with elliptic curves, Annals of Mathematics - Lenstra - 1987 |

11 |
te Riele, Factoring integers with large prime variations of the quadratic sieve
- Boender, J
- 1996
(Show Context)
Citation Context ...1=3 . This is because the inner loop of MPQS involves only single-precision operations. Use of \partial relations", i.e. incompletely factored w i , in MPQS gives a signicant performance improvem=-=ent [2]. In the \-=-one large prime" (P-MPQS) variation w i is allowed to have one prime factor exceeding m (but not too much larger than m). In the \two large prime" (PPMPQS) variation w i can have two prime f... |

9 |
editors. The development of the number sieve
- Lenstra, Lenstra
- 1993
(Show Context)
Citation Context ...under plausible assumptions have expected run time O(exp( p c ln N ln ln N)); where c is a constant (depending on details of the algorithm) . For MPQS, c 1. { The Number Field Sieve (NFS) algorithm [=-=29, 30]-=-, which under plausible assumptions has expected run time O(exp(c(ln N) 1=3 (ln ln N) 2=3 )); where c is a constant (depending on details of the algorithm and on the form of N ). B. The run time depen... |

9 |
Faktorisieren mit dem Number Field Sieve
- Zayer
- 1995
(Show Context)
Citation Context ...od of polynomial selection is called the \base m" method. In principle, we can proceed as in SNFS, but many diculties arise because of the large coecients of g(x). For details, we refer the reade=-=r to [36, 37, 41, 47, 48, 62]-=-. Suce it to say that the diculties can be overcome and the method works! Due to the constant factors involved it is slower than MPQS for numbers of less than about 110 decimal digits, but faster than... |

9 |
A multiple polynomial general number field sieve
- Elkenbracht-Huizing
- 1996
(Show Context)
Citation Context ...trix with 188614 columns; a dependency was then found on a MasPar MP-1. It is certainly feasible to factor larger numbers by MPQS, but for numbers of more than about 110 decimal digits GNFS is faster =-=[22]-=-. For example, it is estimated in [16] that to factor RSA129 by MPQS required 5000 Mips-years, but to factor the slightly larger number RSA130 by GNFS required only 1000 Mips-years [18]. 5 The Special... |