## Factorization of the tenth and eleventh Fermat numbers (1996)

Citations: | 17 - 8 self |

### BibTeX

@TECHREPORT{Brent96factorizationof,

author = {Richard P. Brent},

title = {Factorization of the tenth and eleventh Fermat numbers},

institution = {},

year = {1996}

}

### Years of Citing Articles

### OpenURL

### Abstract

. We describe the complete factorization of the tenth and eleventh Fermat numbers. The tenth Fermat number is a product of four prime factors with 8, 10, 40 and 252 decimal digits. The eleventh Fermat number is a product of five prime factors with 6, 6, 21, 22 and 564 decimal digits. We also note a new 27-decimal digit factor of the thirteenth Fermat number. This number has four known prime factors and a 2391-decimal digit composite factor. All the new factors reported here were found by the elliptic curve method (ECM). The 40-digit factor of the tenth Fermat number was found after about 140 Mflop-years of computation. We discuss aspects of the practical implementation of ECM, including the use of special-purpose hardware, and note several other large factors found recently by ECM. 1. Introduction For a nonnegative integer n, the n-th Fermat number is F n = 2 2 n + 1. It is known that F n is prime for 0 n 4, and composite for 5 n 23. Also, for n 2, the factors of F n are of th...

### Citations

3161 | A Method for Obtaining Digital Signatures and Public-Key Cryptosystems
- Rivest, Shamir, et al.
- 1978
(Show Context)
Citation Context ... phase 2 is used. Table 2 shows that the convergence is very slow and that ��(p) ' 1:7 for p in the 25 to 45 digit range. We note a lack of symmetry in (29) which may be of interest to cryptograph=-=ers [70]-=-. If t is much larger than C, say t = 100C, then the probability of failure is exp(\Gamma100), so we are almost certain to find a factor. On the other hand, if t is much smaller than C, say t = C=100,... |

882 |
The Arithmetic of Elliptic Curves
- Silverman
- 1986
(Show Context)
Citation Context .... Lenstra, Jr. [55] in 1985. Various practical refinements were suggested by Montgomery [58, 59], Suyama [80], and others [1, 7, 23]. We refer to [54, 60, 79] for a general description of ECM, and to =-=[24, 44, 77] for relev-=-ant background. Lenstra's key idea was to apply Pollard's "p \Gamma 1" method [66] but to work over a different group G. If the method fails, another group can be tried. This is not possible... |

856 | Algorithms for Quantum Computation: Discrete Log and Factoring
- Shor
- 1994
(Show Context)
Citation Context ...or would have been found with probability greater than 0:9. The complete factorization of F 12 may have to wait for the physical construction of a quantum computer capable of running Shor's algorithm =-=[76], or a sur-=-prising new development such as a classical (deterministic or random) polynomial-time integer factoring algorithm. Here, "polynomial-time" means that the expected run time should be bounded ... |

726 |
The Art of Computer Programming, Volume 2: Seminumerical Algorithms, 3rd ed
- Knuth
- 1997
(Show Context)
Citation Context ...3 \Delta 63766529 \Delta 190274191361 \Delta 1256132134125569 \Delta c 1187 : Thus, F 12 has at least seven prime factors. If the distribution of second-largest prime factors of large random integers =-=[47, 48]-=- is any guide, it is unlikely that c 1187 can be completely factored by ECM. For further discussion, see x10. For one possible application of factorizations of Fermat numbers, observe that the factori... |

246 |
Factoring integers with elliptic curves
- Lenstra
- 1987
(Show Context)
Citation Context ...ion 1899 Cunningham (p 6 ; p 0 6 ) ECM 1988 Brent (p 21 ; p 22 ; p 564 ) ECPP 1988 Morain (primality of p 564 ) 2. Variants of ECM The elliptic curve method (ECM) was discovered by H. W. Lenstra, Jr. =-=[55]-=- in 1985. Various practical refinements were suggested by Montgomery [58, 59], Suyama [80], and others [1, 7, 23]. We refer to [54, 60, 79] for a general description of ECM, and to [24, 44, 77] for re... |

205 |
Speeding the Pollard and Elliptic Curve Methods of Factorization
- Montgomery
- 1987
(Show Context)
Citation Context ...ECPP 1988 Morain (primality of p 564 ) 2. Variants of ECM The elliptic curve method (ECM) was discovered by H. W. Lenstra, Jr. [55] in 1985. Various practical refinements were suggested by Montgomery =-=[58, 59], Suyama [-=-80], and others [1, 7, 23]. We refer to [54, 60, 79] for a general description of ECM, and to [24, 44, 77] for relevant background. Lenstra's key idea was to apply Pollard's "p \Gamma 1" met... |

174 | Elliptic curves and primality proving
- Atkin, Morain
- 1993
(Show Context)
Citation Context ...orain (in June 1988) using a distributed version of his ecpp program [62, p. 13]. We have used the publicly available version of ecpp, which implements the "elliptic curve" method of Atkin a=-=nd Morain [1, 2]-=-, to confirm this result. Version V3.4.1 of ecpp, running on a 60 Mhz SuperSparc, established the primality of p 564 in 28 hours. It took only one hour to prove p 252 prime by the same method. Primali... |

132 |
editors. The development of the number field sieve
- Lenstra, Lenstra
- 1993
(Show Context)
Citation Context ...arge to factor by the continued fraction method or its successor, MPQS. The difficulty was finally overcome by the invention of the (special) number field sieve (SNFS), based on a new idea of Pollard =-=[52]-=-. In 1990, Lenstra, Lenstra, Manasse and Pollard, with the assistance of many collaborators and approximately 700 workstations scattered around the world, completely factored F 9 by SNFS [53, 54]. The... |

118 |
Die Typen der Multiplikatorenringe elliptischer Funktionenkörper
- Deuring
- 1941
(Show Context)
Citation Context ...et g = jGj be the order of G. In the p \Gamma 1 method g = p \Gamma 1, but in ECM we have g = p+1 \Gamma t, where, by a theorem of Hasse [42], t = t(G) satisfies t 2 ! 4p : (4) By a result of Deuring =-=[31]-=-, the result (4) is best possible, in the sense that all integer t 2 (\Gamma2 p p; +2 p p) arise for some choice of a and b in the Weierstrass form (2). The number of curves with given t can be expres... |

107 |
Sequences of numbers generated by addition in formal groups and new primality and factorization tests
- Chudnovsky, Chudnovsky
- 1986
(Show Context)
Citation Context ...64 ) 2. Variants of ECM The elliptic curve method (ECM) was discovered by H. W. Lenstra, Jr. [55] in 1985. Various practical refinements were suggested by Montgomery [58, 59], Suyama [80], and others =-=[1, 7, 23]. We refer-=- to [54, 60, 79] for a general description of ECM, and to [24, 44, 77] for relevant background. Lenstra's key idea was to apply Pollard's "p \Gamma 1" method [66] but to work over a differen... |

107 | Théorie des Fonctions Numériques Simplement Périodiques - Lucas |

75 |
Theorems on factorization and primality testing
- Pollard
- 1974
(Show Context)
Citation Context ...yama [80], and others [1, 7, 23]. We refer to [54, 60, 79] for a general description of ECM, and to [24, 44, 77] for relevant background. Lenstra's key idea was to apply Pollard's "p \Gamma 1&quo=-=t; method [66]-=- but to work over a different group G. If the method fails, another group can be tried. This is not possible for the p \Gamma 1 method, because it uses a fixed group. To be specific, suppose we attemp... |

74 |
The multiple polynomial quadratic sieve
- Silverman
- 1987
(Show Context)
Citation Context .... The rho method could have factored F 7 (with a little more difficulty than F 8 , see [17, Table 2]) if it had been invented earlier. Similarly, the multiple-polynomial quadratic sieve (MPQS) method =-=[78], which is-=- currently the best "general-purpose" method for composite numbers of up to about 100 decimal digits, could have factored both F 7 and F 8 , but it was not available in 1980. Logically, the ... |

55 | Factoring by electronic mail - Lenstra, Manasse - 1989 |

55 |
Ordered cycle lengths in a random permutation
- Shepp, Lloyd
- 1966
(Show Context)
Citation Context ...largest prime factors of n-digit random integers is asymptotically the same as the distribution of j-th longest cycles in random permutations of n objects. Thus, the literature on random permutations =-=[39, 75] is -=-relevant. We define ae(ff) = \Phi 1 (1=ff) for ff ? 0 ; ae 2 (ff) = \Phi 2 (1; 1=ff) for ffs1 ; (14) ��(ff; fi) = \Phi 2 (fi=ff; 1=ff) for 1sfisff : Informally, ae(ff) is the probability that n ff... |

53 |
An improved Monte Carlo factorization algorithm
- Brent
- 1980
(Show Context)
Citation Context ...red F 7 = 59649589127497217 \Delta p 22 by the continued fraction method. Then, in 1980, Brent and Pollard [17] factored F 8 = 1238926361552897 \Delta p 62 by a modification of Pollard's "rho&quo=-=t; method [5, 67]-=-. The modification improved the efficiency of Pollard's original algorithm, for factors of the form (1), by a ratio conjectured to be of order 2 n=2 =n; for F 8 the ratio is about 6. The larger factor... |

52 | Class number, a theory of factorization, and genera - Shanks - 1971 |

51 |
The factorization of the ninth fermat number
- Lenstra, Manasse, et al.
- 1993
(Show Context)
Citation Context ... in size, a method which factors F n may be inadequate for F n+1 . In this section we give a summary of what has been achieved since 1732. Additional historical details and references can be found in =-=[20, 45, 53]-=-, and some recent results are given in [26, 27, 40]. In the following, p n denotes a prime number with n decimal digits, e.g. p 3 = 163. Similarly, c n denotes a composite number with n decimal digits... |

50 | Some integer factorization algorithms using elliptic curves
- Brent
- 1986
(Show Context)
Citation Context ...64 ) 2. Variants of ECM The elliptic curve method (ECM) was discovered by H. W. Lenstra, Jr. [55] in 1985. Various practical refinements were suggested by Montgomery [58, 59], Suyama [80], and others =-=[1, 7, 23]. We refer-=- to [54, 60, 79] for a general description of ECM, and to [24, 44, 77] for relevant background. Lenstra's key idea was to apply Pollard's "p \Gamma 1" method [66] but to work over a differen... |

49 | On the number of nonscalar multiplications necessary to evaluate polynomials
- Paterson, Stockmeyer
- 1973
(Show Context)
Citation Context ...sible, at the cost of one extended GCD computation per point mQ. This is worthwhile if D is sufficiently large. Another reduction by a factor of almost two can be achieved by rational preconditioning =-=[65]-=-. For future reference, we assume K 2 multiplications mod N per comparison of points, where 1=2sK 2s3, the exact value of K 2 depending on the implementation. There is an analogy with Shanks's baby an... |

48 |
On the frequency of numbers containing prime factors of a certain relative magnitude
- Dickman
- 1930
(Show Context)
Citation Context ...teger N with largest prime factor n 1 and second-largest prime factor n 2 . Note that ae(ff) = ��(ff; 1) and ae 2 (ff) = ��(ff; ff). The function ae is usually called Dickman's function after =-=Dickman [32]-=-, though some authors refer to \Phi 1 as Dickman's function, and Vershik [81] calls ' 1 = \Phi 0 1 the Dickman-Goncharov function. It is known (see [7]) that ae satisfies a differential-difference equ... |

42 | Some parallel algorithms for integer factorisation
- Brent
- 1999
(Show Context)
Citation Context ... a probabilistic primality test, and a rigorous proof of primality was provided by Morain (see x9). As details of the factorization of F 11 have not been published, apart from two brief announcements =-=[8, 10]-=-, we describe the computation in x7. The reason why F 11 could be completely factored before F 9 and F 10 is that the difficulty of completely factoring numbers by ECM is determined mainly by the size... |

42 |
An FFT extension of the elliptic curve method of factorization
- Montgomery
- 1992
(Show Context)
Citation Context ...ECPP 1988 Morain (primality of p 564 ) 2. Variants of ECM The elliptic curve method (ECM) was discovered by H. W. Lenstra, Jr. [55] in 1985. Various practical refinements were suggested by Montgomery =-=[58, 59], Suyama [-=-80], and others [1, 7, 23]. We refer to [54, 60, 79] for a general description of ECM, and to [24, 44, 77] for relevant background. Lenstra's key idea was to apply Pollard's "p \Gamma 1" met... |

39 |
Factorization of the eighth Fermat number
- Brent, Pollard
- 1981
(Show Context)
Citation Context ...he digital computer and more efficient algorithms. In 1970, Morrison and Brillhart [64] factored F 7 = 59649589127497217 \Delta p 22 by the continued fraction method. Then, in 1980, Brent and Pollard =-=[17] factored -=-F 8 = 1238926361552897 \Delta p 62 by a modification of Pollard's "rho" method [5, 67]. The modification improved the efficiency of Pollard's original algorithm, for factors of the form (1),... |

31 |
Discrete Weighted Transforms and Large-Integer
- Crandall, Fagin
- 1994
(Show Context)
Citation Context ... cost of ECM is in performing multiplications mod N . Our programs A-G all use the classical O(n 2 ) algorithm to multiply n-bit numbers. Karatsuba's algorithm [47, x4.3.3] or other "fast" a=-=lgorithms [26, 28]-=- would be preferable for large n. The crossover point depends on details of the implementation. Morain [62, Ch. 5] states that Karatsuba's method is worthwhile for ns800 on a 32-bit workstation. The c... |

31 | A pipeline architecture for factoring large integers with the quadratic sieve algorithm - POMERANCE, SMITH, et al. - 1988 |

30 | Finding Suitable Curves for the Elliptic Curve Method of Factorization
- Atkin, Morain
- 1993
(Show Context)
Citation Context ...64 ) 2. Variants of ECM The elliptic curve method (ECM) was discovered by H. W. Lenstra, Jr. [55] in 1985. Various practical refinements were suggested by Montgomery [58, 59], Suyama [80], and others =-=[1, 7, 23]. We refer-=- to [54, 60, 79] for a general description of ECM, and to [24, 44, 77] for relevant background. Lenstra's key idea was to apply Pollard's "p \Gamma 1" method [66] but to work over a differen... |

29 |
A method of factoring and the factorization of F7
- Morrison, Brillhart
- 1975
(Show Context)
Citation Context ...ther examples may be found in [41, Table 2]. Significant further progress was only possible with the development of the digital computer and more efficient algorithms. In 1970, Morrison and Brillhart =-=[64] factored -=-F 7 = 59649589127497217 \Delta p 22 by the continued fraction method. Then, in 1980, Brent and Pollard [17] factored F 8 = 1238926361552897 \Delta p 62 by a modification of Pollard's "rho" m... |

23 |
Topics in Advanced Scientific Computation
- Crandall
- 1996
(Show Context)
Citation Context ...ate for F n+1 . In this section we give a summary of what has been achieved since 1732. Additional historical details and references can be found in [20, 45, 53], and some recent results are given in =-=[26, 27, 40]-=-. In the following, p n denotes a prime number with n decimal digits, e.g. p 3 = 163. Similarly, c n denotes a composite number with n decimal digits, e.g. c 4 = 1729. In cases where one factor can be... |

19 |
Factorization of the eleventh Fermat number (preliminary report
- Brent
- 1989
(Show Context)
Citation Context ...were confident that the quotient was indeed prime and that the factorization of F 11 was complete. This was verified by Morain, as described in x9. The complete factorization of F 11 was announced in =-=[8]-=-: F 11 = 319489 \Delta 974849 \Delta 167988556341760475137 \Delta 3560841906445833920513 \Delta p 564 8. A new factor of F 13 The Dubner Cruncher [22, 34] is a board which plugs into an IBM-compatible... |

19 |
An architecture for the AP1000 highly parallel computer", Fujitsu Sci
- Ishihata, Horie, et al.
- 1993
(Show Context)
Citation Context ...(and hence in the cache). Program D found the p 40 factor of F 10 (see x6). E. Late in 1994, our Sun 4 code was ported to the Fujitsu AP1000, which is a parallel machine using 25 Mhz Sparc processors =-=[35, 43]-=-. The machine available to us has 128 processors. Each processor works on one or more curves independently, and communicates results (if any) after each phase. Program E found the p 41 factor mentione... |

19 |
The asymptotic distribution of factorizations of natural numbers into prime divisors
- Vershik
- 1987
(Show Context)
Citation Context ...f a positive integer N . The n j (N) are not necessarily distinct. For convenience we take n j (N) = 1 if N has less than j prime factors. For ks1, suppose that 1sff 1s: : :sff ks0. Following Vershik =-=[81]-=-, we define \Phi k = \Phi k (ff 1 ; : : : ; ff k ) by \Phi k = lim M!1 # fN : 1sNsM; n j (N)sN ff j for j = 1; : : : ; kg M : Informally, \Phi k (ff 1 ; : : : ; ff k ) is the probability that a large ... |

18 |
Factorizations of b n \Sigma 1 for b
- Brillhart, Lehmer, et al.
- 1983
(Show Context)
Citation Context ... in size, a method which factors F n may be inadequate for F n+1 . In this section we give a summary of what has been achieved since 1732. Additional historical details and references can be found in =-=[20, 45, 53]-=-, and some recent results are given in [26, 27, 40]. In the following, p n denotes a prime number with n decimal digits, e.g. p 3 = 163. Similarly, c n denotes a composite number with n decimal digits... |

18 |
Courbes elliptiques et tests de primalité. Institut National de Recherche en Informatique et en Automatique (INRIA), Rocquencourt
- Morain
- 1990
(Show Context)
Citation Context ... = (v \Gamma u) 3 (3u + v) : 4u 3 v; then the curve (8) with a + 2 = a 0 =a 00 has group order divisible by 12. As starting point we can take (x 1 : : z 1 ). 3. The second phase Montgomery and others =-=[7, 58, 59, 62]-=- have described several ways to improve Lenstra's original ECM algorithm by the addition of a second phase, analogous to phase 2 of the Pollard p \Gamma 1 method. We outline some variations which we h... |

17 |
Massively parallel elliptic curve factoring
- Dixon, Lenstra
- 1993
(Show Context)
Citation Context ...x" continuation is an alternative to the (improved) standard continuation. It was suggested in [7] and has been implemented in several of our programs (see x5) and in the programs of A. Lenstra e=-=t al [3, 33, 54]-=-. There are several variations on the birthday paradox idea. We describe a version which is easy to implement and whose efficiency is comparable to that of the improved standard continuation. Followin... |

16 |
te Riele, Improved techniques for lower bounds for odd perfect numbers
- Brent, Cohen, et al.
- 1991
(Show Context)
Citation Context ...e not time-critical, such as input and output, are performed using the MP package [4]. Program C found the factorization of F 11 (see x7) and many factors, of size up to 40 decimal digits, needed for =-=[15, 16, 18]-=-. Keller [46] used program C to find factors up to 39 digits of Cullen numbers. D. MVFAC also runs with minor changes on other machines with Fortran compilers, e.g. Sun 4 workstations. For machines us... |

15 |
Trabb Pardo, Analysis of a simple factorization algorithm, Theoret
- Knuth, L
- 1976
(Show Context)
Citation Context ...3 \Delta 63766529 \Delta 190274191361 \Delta 1256132134125569 \Delta c 1187 : Thus, F 12 has at least seven prime factors. If the distribution of second-largest prime factors of large random integers =-=[47, 48]-=- is any guide, it is unlikely that c 1187 can be completely factored by ECM. For further discussion, see x10. For one possible application of factorizations of Fermat numbers, observe that the factori... |

15 |
A Monte Carlo method for factorization, BIT
- Pollard
- 1975
(Show Context)
Citation Context ...red F 7 = 59649589127497217 \Delta p 22 by the continued fraction method. Then, in 1980, Brent and Pollard [17] factored F 8 = 1238926361552897 \Delta p 62 by a modification of Pollard's "rho&quo=-=t; method [5, 67]-=-. The modification improved the efficiency of Pollard's original algorithm, for factors of the form (1), by a ratio conjectured to be of order 2 n=2 =n; for F 8 the ratio is about 6. The larger factor... |

14 |
The Dubner PC Cruncher { a microcomputer coprocessor card for doing integer arithmetic, review in
- Caldwell
- 1993
(Show Context)
Citation Context ...he complete factorization of F 11 was announced in [8]: F 11 = 319489 \Delta 974849 \Delta 167988556341760475137 \Delta 3560841906445833920513 \Delta p 564 8. A new factor of F 13 The Dubner Cruncher =-=[22, 34]-=- is a board which plugs into an IBM-compatible PC. The board has a digital signal processing chip (LSI Logic L64240 MFIR) which, when used for multipleprecision integer arithmetic, can multiply two 51... |

14 |
Projects in scientific computation
- Crandall
- 1994
(Show Context)
Citation Context ...= 2710954639361 \Delta 2663848877152141313 \Delta 3603109844542291969 \Delta c 2417 : The first factor was found by Hallyburton and Brillhart [41]. The second and third factors were found by Crandall =-=[25]-=- on Zilla net (a network of about 100 workstations) in January and May 1991, using ECM. On June 16, 1995 our Cruncher program F found a fourth factor p 27 = 319546020820551643220672513 = 2 19 \Delta 5... |

13 | Algorithm 524: MP, A Fortran Multiple-Precision Arithmetic Package
- Brent
- 1978
(Show Context)
Citation Context ...t operations. INT and DFLOAT operations are used to split a product into high and low-order parts. Operations which are not time-critical, such as input and output, are performed using the MP package =-=[4]-=-. Program C found the factorization of F 11 (see x7) and many factors, of size up to 40 decimal digits, needed for [15, 16, 18]. Keller [46] used program C to find factors up to 39 digits of Cullen nu... |

13 | Factorization of cyclotomic polynomials
- Lehmer
- 1933
(Show Context)
Citation Context ...of multipleprecision arithmetic uses strings of decimal digits, so is simple but inefficient. Program B is mainly used to generate tables [18], taking into account algebraic and Aurifeuillian factors =-=[14]-=-, and accessing a database of over 190; 000 known factors. As a byproduct, program B can produce lists of composites which are used as input to other programs, e.g. programs C--E below. 14 R. P. BRENT... |

13 |
Equations et variétés algébriques sur un corps
- Joly
- 1973
(Show Context)
Citation Context .... Lenstra, Jr. [55] in 1985. Various practical refinements were suggested by Montgomery [58, 59], Suyama [80], and others [1, 7, 23]. We refer to [54, 60, 79] for a general description of ECM, and to =-=[24, 44, 77] for relev-=-ant background. Lenstra's key idea was to apply Pollard's "p \Gamma 1" method [66] but to work over a different group G. If the method fails, another group can be tried. This is not possible... |

13 | A survey of modern integer factorization algorithms, CWI Quarterly 7 - Montgomery - 1994 |

13 |
Wagstaff,“A practical analysis of the elliptic curve factoring algorithm
- Silverman, S
- 1993
(Show Context)
Citation Context ...The elliptic curve method (ECM) was discovered by H. W. Lenstra, Jr. [55] in 1985. Various practical refinements were suggested by Montgomery [58, 59], Suyama [80], and others [1, 7, 23]. We refer to =-=[54, 60, 79] for a gen-=-eral description of ECM, and to [24, 44, 77] for relevant background. Lenstra's key idea was to apply Pollard's "p \Gamma 1" method [66] but to work over a different group G. If the method f... |

13 |
How was F6 factored
- Williams
- 1993
(Show Context)
Citation Context ...uld be tedious to write out the 1065-digit prime in decimal (though easy in binary). In 1880, Landry [50] factored F 6 = 274177 \Delta p 14 : Landry's method was never published in full, but Williams =-=[82]-=- has attempted to reconstruct it. 1991 Mathematics Subject Classification. 11Y05, 11B83, 11Y55; Secondary 11-04, 11A51, 11Y11, 11Y16, 14H52, 65Y10, 68Q25. Key words and phrases. computational number t... |

12 | Vector and parallel algorithms for integer factorisation
- Brent
- 1990
(Show Context)
Citation Context ...ct way that, for positive integer m;n such that Pm 6= \SigmaP n , we have an addition formula xm+n : z m+n = z jm\Gammanj (x mx n \Gamma z m z n ) 2 : x jm\Gammanj (x m z n \Gamma z mx n ) 2 (9) 1 In =-=[7, 10, 11]-=- we wrote the group operation multiplicatively because of the analogy with the multiplicative group of GF (p) in the p \Gamma 1 method, and spoke of O as the identity element. 6 R. P. BRENT and a dupl... |

12 | Observationes de theoremate quodam Fermatiano aliisque ad numeros primos spectantibus, Commentarii academiae scientiarum Petropolitanae 6 - Euler |

12 |
Beweis des Analogons der Riemannschen Vermutung fur die Artinschen und F.K. Schmidtschen Kongruenzzetafunktionen in gewissen elliptischen
- Hasse
- 1933
(Show Context)
Citation Context ...eration additively 1 . The (additive) zero element of G is O. Let g = jGj be the order of G. In the p \Gamma 1 method g = p \Gamma 1, but in ECM we have g = p+1 \Gamma t, where, by a theorem of Hasse =-=[42]-=-, t = t(G) satisfies t 2 ! 4p : (4) By a result of Deuring [31], the result (4) is best possible, in the sense that all integer t 2 (\Gamma2 p p; +2 p p) arise for some choice of a and b in the Weiers... |

12 |
The Number Field Sieve
- Pomerance
- 1994
(Show Context)
Citation Context ... the MPQS and general number field sieve (GNFS) methods can be predicted fairly well, because they depend mainly on the size of the number being factored, and not on the size of the (unknown) factors =-=[68]-=-. An important question is how long to spend on ECM before switching to a more predictable method such as MPQS/GNFS. Theorem 3 of Vershik [81] may be helpful. Roughly, it says that the ratios log q= l... |