Integer factorization: Exercise for the reader: a progress report Find a nontrivial factor of 6366223796340423057152171586. D. J. Bernstein Thanks to: University of Illinois at Chicago NSF DMS–0140542 Alfred P. Sloan Foundation
rization: Exercise for the reader: Exercise for the reader: rt Find a nontrivial factor of Find a nontrivial facto 6366223796340423057152171586. 6366223796340423057152171586. Small prime factors are easy to find. Illinois at Chicago DMS–0140542 Larger primes are ha Foundation “Elliptic-curve metho scales surprisingly (1987 Lenstra) ECM has found a p (2005 Dodson; rather � 10 12 Opteron 3 www.loria.fr/~zimmerma/records
Exercise for the reader: Exercise for the reader: Find a nontrivial factor of Find a nontrivial factor of 6366223796340423057152171586. 6366223796340423057152171586. Small prime factors are easy to find. Larger primes are harder. “Elliptic-curve method” (ECM) scales surprisingly well. (1987 Lenstra) 2 219 . ECM has found a prime (2005 Dodson; rather lucky; � 10 12 Opteron cycles) 3 www.loria.fr/~zimmerma/records/p66
� reader: Exercise for the reader: For worst-case integers nontrivial factor of Find a nontrivial factor of two very large prime 6366223796340423057152171586. 6366223796340423057152171586. ECM does not scale “number-field sieve” Small prime factors (1988 Pollard, et al.) are easy to find. Latest record: NFS Larger primes are harder. two prime factors “Elliptic-curve method” (ECM) of “RSA-200” challenge. scales surprisingly well. Bahr Boehm Frank � 10 18 Opteron (1987 Lenstra) 5 2 219 . ECM has found a prime How much more difficult (2005 Dodson; rather lucky; is it to find prime facto � 10 12 Opteron cycles) 3 of an integer 2 www.loria.fr/~zimmerma/records/p66 www.loria.fr/~zimmerma/records
� Exercise for the reader: For worst-case integers with Find a nontrivial factor of two very large prime factors, 6366223796340423057152171586. ECM does not scale as well as “number-field sieve” (NFS). Small prime factors (1988 Pollard, et al.) are easy to find. Latest record: NFS has found Larger primes are harder. 2 332 two prime factors “Elliptic-curve method” (ECM) of “RSA-200” challenge. (2005 scales surprisingly well. Bahr Boehm Franke Kleinjung; � 10 18 Opteron cycles) (1987 Lenstra) 5 2 219 . ECM has found a prime How much more difficult 2 512 (2005 Dodson; rather lucky; is it to find prime factors � 10 12 Opteron cycles) 3 2 1024 ? of an integer www.loria.fr/~zimmerma/records/p66 www.loria.fr/~zimmerma/records/rsa200
� � � ✁ � � � ✁ ✁ ✂ ✂ ✂ ✁ � � � ✄ � ✁ ✄ ☎ ✄ � � � � � ✄ ☎ ✄ � � � reader: For worst-case integers with NFS step 1: find attractive nontrivial factor of two very large prime factors, NFS tries to factor 6366223796340423057152171586. ECM does not scale as well as inspecting values of “number-field sieve” (NFS). factors Select integer (1988 Pollard, et al.) find integers 5 4 Latest record: NFS has found 5 + re harder. with = 5 2 332 two prime factors for various integers method” (ECM) of “RSA-200” challenge. (2005 ✄ 5 + 4 ( )( 5 risingly well. Bahr Boehm Franke Kleinjung; � 10 18 Opteron cycles) Practically every choice 5 will succeed in facto 2 219 . a prime How much more difficult Better speed from 2 512 rather lucky; is it to find prime factors ✄ 5 + 4 ( )( 5 Opteron cycles) 2 1024 ? of an integer www.loria.fr/~zimmerma/records/p66 www.loria.fr/~zimmerma/records/rsa200
✂ � ✁ ✁ ✂ ✂ � ✁ � � ✄ � ✁ ✄ ☎ � � ✄ ☎ � � ✁ For worst-case integers with NFS step 1: find attractive ’s two very large prime factors, NFS tries to factor by ECM does not scale as well as inspecting values of a polynomial. “number-field sieve” (NFS). � 6 � 5 ]; � 1 � 1 Select integer [ (1988 Pollard, et al.) find integers 5 4 0 Latest record: NFS has found 5 + 4 + � + with = 0 ; 5 4 2 332 two prime factors for various integers inspect of “RSA-200” challenge. (2005 ✄ 5 + 4 ✄ 4 + � + 0 5 ). ( )( 5 Bahr Boehm Franke Kleinjung; � 10 18 Opteron cycles) Practically every choice of 5 � . will succeed in factoring How much more difficult Better speed from smaller values 2 512 is it to find prime factors ✄ 5 + 4 ✄ 4 + � + 0 5 ). ( )( 5 2 1024 ? of an integer www.loria.fr/~zimmerma/records/rsa200
✄ ☎ ✂ ✂ ✂ ✁ � � � ✄ ✁ ☎ � � ✄ � ✁ � � � ✄ ☎ � � � ✄ ✁ ✄ ☎ ✄ ✁ ✄ � ✁ � � integers with NFS step 1: find attractive ’s e.g. = 314159265358979323: rime factors, Can choose = 1000, NFS tries to factor by scale as well as 5 = 314, 4 = 159, inspecting values of a polynomial. sieve” (NFS). 2 = 358, 1 = 979, � 6 � 5 ]; � 1 � 1 Select integer [ et al.) NFS succeeds in facto find integers 5 4 0 NFS has found by inspecting values 5 + 4 + � + with = 0 ; 5 4 2 332 ✄ 5 rs ( 1000 )(314 for various integers inspect challenge. (2005 for various integer ✄ 5 + 4 ✄ 4 + � + 0 5 ). ( )( 5 ranke Kleinjung; But NFS succeeds Practically every choice of Opteron cycles) using = 1370, insp � . will succeed in factoring ✄ 5 + difficult ( 1370 )(65 Better speed from smaller values ✄ 3 2 + 377 ✄ 2 3 + 2 512 rime factors 38 ✄ 5 + 4 ✄ 4 + � + 0 5 ). ( )( 5 2 1024 ? www.loria.fr/~zimmerma/records/rsa200
� � � ✄ ✄ ☎ ✄ � � � ✄ � ☎ ✄ ✄ ☎ ☎ ✄ � � � � ✁ ✁ ✂ ✁ � ✁ ✂ ✂ ✁ NFS step 1: find attractive ’s e.g. = 314159265358979323: Can choose = 1000, NFS tries to factor by 5 = 314, 4 = 159, 3 = 265, inspecting values of a polynomial. 2 = 358, 1 = 979, 0 = 323. � 6 � 5 ]; � 1 � 1 Select integer [ NFS succeeds in factoring find integers 5 4 0 by inspecting values 5 + 4 + � + with = 0 ; 5 4 ✄ 5 + � + 323 5 ) ( 1000 )(314 for various integers inspect ✁ ). for various integer pairs ( ✄ 5 + 4 ✄ 4 + � + 0 5 ). ( )( 5 But NFS succeeds more quickly Practically every choice of using = 1370, inspecting � . will succeed in factoring ✄ 5 + 130 ✄ 4 + ( 1370 )(65 Better speed from smaller values ✄ 3 2 + 377 ✄ 2 3 + 127 4 + 33 5 ). 38 ✄ 5 + 4 ✄ 4 + � + 0 5 ). ( )( 5
✄ � ✂ ☎ ✄ ✂ � � ✂ � � ✂ � ✄ ☎ ✄ � � � ✁ ✂ ☎ � ✄ � � ✁ ✂ ✄ ☎ ✁ ✄ � � � ✂ ✂ ✄ ✂ � ✁ � � � ✁ ✂ ✂ ✂ ✁ ✁ ✁ ✁ � ✄ ✁ ✁ ✄ ☎ ✄ ✂ ✂ � � attractive ’s e.g. = 314159265358979323: NFS step 1: Consider, 2 45 possible choices Can choose = 1000, factor by 5 = 314, 4 = 159, 3 = 265, Quickly identify, e.g., values of a polynomial. 2 25 attractive candidates. 2 = 358, 1 = 979, 0 = 323. � 6 � 5 ]; � 1 � 1 [ NFS succeeds in factoring Will choose one 4 0 by inspecting values 4 + � + + 0 ; If and 4 ✄ 5 + � + 323 5 ) ( 1000 )(314 ✄ 5 + ✂ ( integers inspect )( 5 ✁ ). for various integer pairs ( ✄ 4 + 6 where � + 0 5 ). ( ) 4 ✁ 1 + )( 5 But NFS succeeds more quickly ( 5 choice of using = 1370, inspecting � . factoring Attractive : small ✄ 5 + 130 ✄ 4 + ( 1370 )(65 from smaller values (1999 Murphy) ✄ 3 2 + 377 ✄ 2 3 + 127 4 + 33 5 ). 38 ✄ 4 + � + 0 5 ). 4
� ✂ ✄ � ☎ ✄ � � ✂ ✄ ☎ ✄ � � � � ✂ ✄ � ✁ ✁ ✂ ✂ ✂ � ✂ ☎ ✂ ✂ � ✁ ✁ ✄ � e.g. = 314159265358979323: NFS step 1: Consider, e.g., 2 45 possible choices of Can choose = 1000, . 5 = 314, 4 = 159, 3 = 265, Quickly identify, e.g., 2 25 attractive candidates. 2 = 358, 1 = 979, 0 = 323. NFS succeeds in factoring Will choose one in step 2. by inspecting values ✁ 1 If and then ✄ 5 + � + 323 5 ) ( 1000 )(314 ✄ 5 + ✂ ( � + 0 5 ) )( 5 ✁ ). for various integer pairs ( 6 where ( ) ( ) = � + ✂ + ✂ ). ✁ 1 + )( 5 ✁ 5 But NFS succeeds more quickly ( 5 0 using = 1370, inspecting Attractive : small ( ). ✄ 5 + 130 ✄ 4 + ( 1370 )(65 (1999 Murphy) ✄ 3 2 + 377 ✄ 2 3 + 127 4 + 33 5 ). 38
� ✁ � � ✂ ✄ ☎ � � ✂ ✂ ✁ ✁ ✁ ✂ � ✂ ✁ ✂ � � � ✂ ✂ � ✂ ✁ � � ✄ � ✁ ✄ � ✄ ☎ � � ✄ ✄ ☎ ✄ � ✄ � � 314159265358979323: NFS step 1: Consider, e.g., Choosing one typical 2 45 possible choices of ✁ 1) 1000, . produces ( 159, 3 = 265, Quickly identify, e.g., Question: How much 2 25 attractive candidates. 979, 0 = 323. need to save factor factoring Will choose one in step 2. with ( ) values ✁ 1 If and then This has as much impact ✄ 5 + � + 323 5 ) ✄ 5 + ✂ ( � + 0 5 ) )( 5 chopping 3 lg ✁ ). integer pairs ( 6 where ( ) ( ) = Searching for good � + ✂ + ✂ ). ✁ 1 + )( 5 ✁ 5 succeeds more quickly ( 5 0 takes noticeable fraction 1370, inspecting Attractive : small ( ). total time of optimized ✄ 5 + 130 ✄ 4 + (1999 Murphy) (If not, consider mo 3 + 127 4 + 33 5 ). End up with rather
Recommend
More recommend
