Early History of the Number Field Sieve Retirement Workshop for Herman te Riele Peter L. Montgomery Dec 1, 2011 Early NFS history 1
Early History of the Number Field Sieve Retirement Workshop for Herman te Riele Peter L. Montgomery Dec 1, 2011 Early NFS history 2
The development of the number field sieve (1993) • Pollard factors F 7 = 2 128 + 1 = (x 3 + 2)/2 working in Q (z) , where z 3 = −2 and x =2 43 . Homomorphism φ sends z to x (mod F 7 ). Find many (a, b) s.t. a + bx and a + bz smooth. • Q (z) is a UFD. • Factor both sides of φ (a + bz) a + bx • Multiply to get rational squares on both sides. • Take square roots, as in MPQS. • New method (NFS) factors 148-digit cofactor of 2 512 + 1 in 1990. Dec 1, 2011 Early NFS history 3
Worldwide Acclaim • Quadratic Sieve record had been about 100 digits. • Would generalize to r e ± s (Cunningham table) if some algorithmic hurdles cleared. Dec 1, 2011 Early NFS history 4
I join Oregon State (OSU) Summer 1992 to Summer 1993 • Teach one course/term. Research NFS. • Start of last year of 3-year NSF grant • Renewal application due October • My contract won’t be extended unless grant is renewed. Dec 1, 2011 Early NFS history 5
Oregon colleagues • Joe Buhler (Reed College) (General NFS, Block Wiedemann) Robby Robson (OSU, project manager) Russell Ruby (OSU, system administrator) Dec 1, 2011 Early NFS history 6
Restatement • Want to factor n= (2 512 + 1)/2424833. • Let m = 2 103 . This is a root of f 1 (X) = X− m and f 2 (X) = X 5 +8 (mod n). • Let α i be a complex root of f i . • Homomorphisms φ i map Q( α i ) to Z /n Z with φ i ( α i )= m (mod n). • Find sets of (a j , b j ) pairs (same j’s for both i) such that both product j (a j – b j α i ) are squares. Take sqrt and apply both φ i . Dec 1, 2011 Early NFS history 7
How to take square roots? • If we aim for zero algebraic exponents • UFD required • Linear algebra over Z , not F 2 • Otherwise • Couveignes method (CRT based) • Odd-degree extension • Possibly huge coefficients Dec 1, 2011 Early NFS history 8
New (1992) square root algorithm • Intermediate form A*sqrt(B) in Q ( α ) • Principal ideal (B) factored into prime ideals • B known at complex embed. and CRT primes • Output A partially factored • Principal ideal (P) shares factors with (B) • Replace output by (A*P) * sqrt(B/P^2) • Until B has small coefficients • Took two years to implement (w/ PARI) Dec 1, 2011 Early NFS history 9
Siever enhancements 1992-1993 • Original acquired by Russ from Arjen • Upgrade supports • 2+ polynomials, degree 1, common root (at least two norms must be smooth). • Allow up to two large primes per norm. • Special Fibonacci and cyclotomic forms • But not lattice sieving – academic tasks at OSU kept me busy. Dec 1, 2011 Early NFS history 10
Sharing the work • Sieved many numbers with UFD • Sent OSU siever outputs to Robert Silverman or other third parties • Continued past grant non-renewal Dec 1, 2011 Early NFS history 11
Move to CWI (start Oct 1993) • Henk Boender • Stefania Cavallar • Willemien Ekelkamp • Marije (Elkenbracht-)Huizing • Alexander Kruppa • Walter Lioen • Herman te Riele • Rob Tijdeman • Andrey Timofeev • Dik Winter Dec 1, 2011 Early NFS history 12
Between OSU and CWI • Spoke on sieving with two quadratic polynomials , and on 1992 sqrt algorithm, • at Univ BC conferences August 1993. • Herman was there – hired me. • OSU source files passed on to CWI. Dec 1, 2011 Early NFS history 13
Two major hurdles • 1992 square root implemented April 1994 • None of us had implemented Coppersmith’s Block Wiedemann • Memory considerations limited Gaussian elimination to 40K • Working from invariants, I discover Block Lanczos • Iterative algorithm Dec 1, 2011 Early NFS history 14
Two Spring 94 CWI records • SNFS 12,151− C162 • GNFS 3,367− C105 • Both sieved at OSU a year earlier • 3,367− was first (only?) Cunningham factorization using two quadratics • Linear algebra on CRAY at nearby SARA Dec 1, 2011 Early NFS history 15
Later • Marije article in Exper. Math. • Peter article in CWI Quarterly • Stefania presented at ANTS • Parallel linear algebra • Improved GNFS polynomial selection – Cabal team sieves RSA140 over holidays • Allow large primes over 32 bits Dec 1, 2011 Early NFS history 16
Recommend
More recommend
