## A Montgomery-like Square Root for the Number Field Sieve (1998)

Citations: | 12 - 3 self |

### BibTeX

@MISC{Nguyen98amontgomery-like,

author = {Phong Nguyen},

title = {A Montgomery-like Square Root for the Number Field Sieve },

year = {1998}

}

### Years of Citing Articles

### OpenURL

### Abstract

The Number Field Sieve (NFS) is the asymptotically fastest factoring algorithm known. It had spectacular successes in factoring numbers of a special form. Then the method was adapted for general numbers, and recently applied to the RSA-130 number [6], setting a new world record in factorization. The NFS has undergone several modifications since its appearance. One of these modifications concerns the last stage: the computation of the square root of a huge algebraic number given as a product of hundreds of thousands of small ones. This problem was not satisfactorily solved until the appearance of an algorithm by Peter Montgomery. Unfortunately, Montgomery only published a preliminary version of his algorithm [15], while a description of his own implementation can be found in [7]. In this paper, we present a variant of the algorithm, compare it with the original algorithm, and discuss its complexity.

### Citations

916 |
A course in computational algebraic number theory
- Cohen
- 1993
(Show Context)
Citation Context ...f O. In general, this is a hopeless task (see [13, 2] for a survey), but for the number fields NFS encounters (small degree and large discriminant), this can be done by the so-called round algorithms =-=[16, 4]-=-. Given an order R and several primes p i , any round algorithm will enlarge this order for all these primes so that the new order b R is p i -maximal for every p i . If we take for the p i all the pr... |

704 | Factoring polynomials with rational coefficients. Mathematische Annalen
- Lenstra, Lenstra, et al.
- 1982
(Show Context)
Citation Context ...mall as possible, which is the same as finding a short element in a given ideal. Fortunately an ideal is also a lattice, and there exists a famous polynomial-time algorithm for lattice reduction: LLL =-=[9, 4]-=-. We will use two features of the LLL-algorithm: computation of an LLL-reduced basis, and computation of a short vector (with respect to the Euclidean norm, not to the norm in a number field). First, ... |

291 |
Modern Heuristic Techniques for Combinatorial Problems
- Reeves
- 1993
(Show Context)
Citation Context ...plexity (whether we put a i \Gamma b i ff in the numerator or in the denominator). This behaves better than the random strategy. But the best method so far in practice is based on simulated annealing =-=[18]-=-, a well-known probabilistic solution method in the field of combinatorial optimization. Here, the configuration space is E = f\Gamma1; +1g jSj , and the energy function U maps any e = (e 1 ; : : : ; ... |

235 |
Factoring integers with elliptic curves
- Lenstra
- 1987
(Show Context)
Citation Context ...is sometimes much larger than the number n we wish to factor. However, if one takes a "random" large number, and one removes all "small" prime factors from it (by trial division or=-= by elliptic curves [12]-=-), then in practice the result is quite likely to be squarefree. Furthermore, even in the case b R 6= O, it will be true that b R has almost all of the good properties of O for all ideals that we are ... |

100 |
Zassenhaus: Algorithmic algebraic number theory, revised reprint of the 1989 original
- Pohst, H
- 1997
(Show Context)
Citation Context ...f O. In general, this is a hopeless task (see [13, 2] for a survey), but for the number fields NFS encounters (small degree and large discriminant), this can be done by the so-called round algorithms =-=[16, 4]-=-. Given an order R and several primes p i , any round algorithm will enlarge this order for all these primes so that the new order b R is p i -maximal for every p i . If we take for the p i all the pr... |

69 | The Number Field Sieve
- Lenstra, Jr, et al.
- 1990
(Show Context)
Citation Context ...\Gamma s for small positive r and jsj: this was successfully applied to the Fermat number F 9 = 2 512 + 1 (see [11]). This version of the algorithm is now called the special number field sieve (SNFS) =-=[10]-=-, in contrast with the general number field sieve (GNFS) [3] which can handle arbitrary integers. GNFS factors integers n in heuristic time exp i (c g + o(1)) ln 1=3 n ln 2=3 ln n j with c g = (64=9) ... |

59 |
Factoring integers with the number field sieve
- Buhler, Lenstra, et al.
(Show Context)
Citation Context ...applied to the Fermat number F 9 = 2 512 + 1 (see [11]). This version of the algorithm is now called the special number field sieve (SNFS) [10], in contrast with the general number field sieve (GNFS) =-=[3]-=- which can handle arbitrary integers. GNFS factors integers n in heuristic time exp i (c g + o(1)) ln 1=3 n ln 2=3 ln n j with c g = (64=9) 1=3s1:9. Let n be the composite integer we wish to factor. W... |

49 |
The factorization of the ninth Fermat number
- Lenstra, Jr, et al.
- 1993
(Show Context)
Citation Context ...o factor numbers of form x 3 + k. Then it was modified to handle numbers of the form r e \Gamma s for small positive r and jsj: this was successfully applied to the Fermat number F 9 = 2 512 + 1 (see =-=[11]-=-). This version of the algorithm is now called the special number field sieve (SNFS) [10], in contrast with the general number field sieve (GNFS) [3] which can handle arbitrary integers. GNFS factors ... |

42 | Algorithms in algebraic number theory
- Lenstra
- 1992
(Show Context)
Citation Context ...r field The ring of integers. During the whole algorithm, we need to work with ideals and algebraic integers. We first have to compute an integral basis of O. In general, this is a hopeless task (see =-=[13, 2]-=- for a survey), but for the number fields NFS encounters (small degree and large discriminant), this can be done by the so-called round algorithms [16, 4]. Given an order R and several primes p i , an... |

33 |
A World Wide Number Field Sieve Factoring Record: On to 512 Bits
- Cowie, Dodson, et al.
- 1996
(Show Context)
Citation Context ...lly fastest factoring algorithm known. It had spectacular successes in factoring numbers of a special form. Then the method was adapted for general numbers, and recently applied to the RSA-130 number =-=[6]-=-, setting a new world record in factorization. The NFS has undergone several modifications since its appearance. One of these modifications concerns the last stage: the computation of the square root ... |

18 |
Square roots of products of algebraic numbers
- Montgomery
- 1994
(Show Context)
Citation Context ...j) ln jSj), where M(jSj) is the time required to multiply two jSj-bit integers. The algorithm appears to be impractical for the sets S now in use, and it requires an odd degree. Montgomery's strategy =-=[15, 14, 7]-=- can be viewed as a mix of UFD and bruteforce methods. It bears some resemblance to the square root algorithm sketched in [3] (pages 75-76). It works for all values of d, and does not make any particu... |

16 | Approximating rings of integers in number fields
- Buchmann, Lenstra
- 1994
(Show Context)
Citation Context ...r field The ring of integers. During the whole algorithm, we need to work with ideals and algebraic integers. We first have to compute an integral basis of O. In general, this is a hopeless task (see =-=[13, 2]-=- for a survey), but for the number fields NFS encounters (small degree and large discriminant), this can be done by the so-called round algorithms [16, 4]. Given an order R and several primes p i , an... |

13 | An implementation of the number field sieve
- Elkenbracht-Huizing
- 1996
(Show Context)
Citation Context ...the appearance of an algorithm by Peter Montgomery. Unfortunately, Montgomery only published a preliminary version of his algorithm [15], while a description of his own implementation can be found in =-=[7]-=-. In this paper, we present a variant of the algorithm, compare it with the original algorithm, and discuss its complexity. 1 Introduction The number field sieve [8] is the most powerful known factori... |

12 | Computing a square root for the number field sieve
- Couveignes
- 1993
(Show Context)
Citation Context ...e exists two computable constants C 2 and C 3 depending only on K such that for any integral ideal I ` , there exists a real M and an algebraic 16 integer z 2 I ` ; z 6= 0 satisfying: M dsC 2 Y j2Jsj =-=(5)-=- kzksMN (I ` ) 1=d (6) 8j 2 Jsj kzksMN (I ` ) 1=d (7) k\Omega zksC 3 MN (I ` ) 1=d (8) where J = fj = 1; : : : ; d =sj ? 1g. Proof. Let C 2 = 2 d(d\Gamma1)=4 d d 2 d+1 . Since 2 d(d\Gamma1)=4 d d Y j2... |

8 |
Factoring with cubic integers
- Pollard
- 1993
(Show Context)
Citation Context ...pare it with the original algorithm, and discuss its complexity. 1 Introduction The number field sieve [8] is the most powerful known factoring method. It was first introduced in 1988 by John Pollard =-=[17]-=- to factor numbers of form x 3 + k. Then it was modified to handle numbers of the form r e \Gamma s for small positive r and jsj: this was successfully applied to the Fermat number F 9 = 2 512 + 1 (se... |

2 |
PARI-GP computer package. Can be obtained by ftp at megrez.math.u-bordeaux.fr
- Batut, Bernardi, et al.
(Show Context)
Citation Context ...ften equal to \Sigma1: one should try to bypass the computation of the error and apply OE directly to find some factors of n. The algorithm has been implemented using version 1.39 of the PARI library =-=[1]-=- developed by Henri Cohen et al. In December, 1996, it completed the factorization of the 100-digit cofactor of 17 186 + 1, using the quadratic polynomials 5633687910X 2 \Gamma402481263016857292017234... |

1 |
The development of the Number
- Lenstra, Lenstra
- 1993
(Show Context)
Citation Context ...own implementation can be found in [7]. In this paper, we present a variant of the algorithm, compare it with the original algorithm, and discuss its complexity. 1 Introduction The number field sieve =-=[8]-=- is the most powerful known factoring method. It was first introduced in 1988 by John Pollard [17] to factor numbers of form x 3 + k. Then it was modified to handle numbers of the form r e \Gamma s fo... |