What is The Continued Fraction Factoring Method

Transcription

1 What is The Continued Fraction Factoring Method? Slide /7 What is The Continued Fraction Factoring Method Sohail Farhangi June 208

2 What is The Continued Fraction Factoring Method? Slide 2/7 Why is Factoring Important? The security of some of the most commonly used encryption schemes such as the RSA encryption scheme is proportional to the difficulty of factoring large integers quickly. Consequently, if you can create a fast algorithm for factoring integers, then the RSA encryption scheme will no longer be secure. Alternatively, if you can determine a lower bound for the run time of any integer factoring algorithm, then you will have proven a lower bound on the security of the RSA encryption scheme. 2

3 What is The Continued Fraction Factoring Method? Slide 3/7 Determining the speed of an algorithm. Given an integer factoring algorithm A, we say that A runs in () exponential time if there exists positive real numbers C, D, such that any integer N can be factored by A in at most CN D steps. We note that this running time is exponential with respect to the number of digits of N, not N itself. (2) sub-exponential time if A runs (asymptotically) faster than any exponential time algorithm. (3) polynomial time if there exists positive real numbers C, D, such that any integer N can be factored by A in at most C(log(N)) D steps. We note that the naive factoring method runs in at most C N(log(N)) 2 steps. 3

4 What is The Continued Fraction Factoring Method? Slide 4/7 Why is the Continued Fraction Factoring Method Important? The Continued Fraction Factoring Method was used by John Brillhart and Michael Morrison on September 3, 970, in order to discover that = In particular, this was the first integer factoring algorithm with a sub-exponential running time. It was heuristically (hand-wavingly) shown in 979 by Marvin C. Wunderlich that this algorithm factors an integer N in at most steps, most of the time. Cexp( 3log(N)log(log(N))) = CN 3 log(log(n)) log(n) 4

5 What is The Continued Fraction Factoring Method? Slide 5/7 A Good Idea For Factoring Part If we want to factor an integer N, and we have 2 distinct integers x and y for which x 2 y 2 (mod N), then N divides x 2 y 2 = (x y)(x + y). This tells us that there is a chance that gcd(x y, N) or gcd(x + y, N). In particular, if we find many pairs of integers {(x n, y n )} K n= for which x 2 n y 2 n (mod N), then there is a high chance that a factor of N can be obtained by computing gcd(x n y n, N) and gcd(x n + y n, N) for all n k. We now need a method of generating our good pairs of integers. 5

6 What is The Continued Fraction Factoring Method? Slide 6/7 A Good Idea For Factoring Part 2 Defintion: Given B, N N, we say that N is B-smooth, if every prime factor of N is smaller than B. Let π(n) denote the number of prime numbers smaller than or equal to N, and let K = π(b) +. Now suppose that we have a sequence of integers {x n } K n=, such that x 2 n y n (mod N), and y n is B-smooth. Then through the use of Gaussian elimination over the field F 2, we can find A [, K], such that n A y n is a perfect square denoted by w 2. We have now obtained the good pair ( n A x n, w). We will now see an example of this procedure from [2]. 6

7 What is The Continued Fraction Factoring Method? Slide 7/7 A Good Idea For Factoring Part 3 Suppose that we want to factor We note that (mod 94387) and = (mod 94387) and 9020 = (mod 94387) and = We want to know if we can multiply 2 or 3 of the numbers from {750000, 9020, 49925} to obtain a perfect square. Since being a perfect square depends only on the parity of the prime factors, we see that this amount to the following matrix equation over F 2. 7

8 What is The Continued Fraction Factoring Method? Slide 8/ a 6 3 a 2 = 0 0 a which is solved by a = a 2 = a 3 =, i.e., a a 2 = a , = = Lastly, we note that = ( ) 2 = (mod 94387) and (mod 94387) 8

9 What is The Continued Fraction Factoring Method? Slide 9/7 which lets us see that gcd(94387, ) = gcd(94387, 54420) = =

10 What is The Continued Fraction Factoring Method? Slide 0/7 A Good Idea For Factoring Part 4 The Continued Fraction Factoring Method, the Quadratic Sieve (C. Pomerance 990), and the General Number Field Sieve are 3 different factoring algorithms that do this. Currently (June 208), the General Number Field Sieve is the fastest known integer factoring algorithm for large integers. It was heuristically shown that the General Number Field Sieve can factor an integer N in at most Cexp(( 64 3(log(N)) 3(log(log(N))) 2 3) 9 ) = CN (64 9 ) 3( log(log(n)) ) 2 3 log(n) steps. Integers smaller than 0 00 tend to be factored more quickly by the Quadratic Sieve, and numbers larger than 0 30 tend to be factored more quickly by the General Number Field Sieve. The Quadratic Sieve has the same asymptotic run time as the Continued Fraction Factoring Algorithm, but appears to be faster in practice, as The Continued Fraction Factoring Method seems to only factor numbers of the order

11 What is The Continued Fraction Factoring Method? Slide /7 A Refresher on (simple) Continued Fractions For any θ R + \ Q, there exists a unique sequence of non-negative integers {a n } n=0 for which θ = a 0 + Furthermore, we will use the notation a + a 2 + a P n Q n = [a 0, a,, a n ] = a 0 + a + a 2 + a an which allows us to rigorously define the infinite continued fraction expansion as a limit of the partial expansions.,

12 What is The Continued Fraction Factoring Method? Slide 2/7 In particular, θ P n Q n < Q 2 n P n θ = lim. n Q n To calculate the sequence {a n } n=0, we use induction with θ 0 = θ, a 0 = θ 0, and (θ n+, a n+ ) = (, ). θ n a n θ n a n Furthermore, we may calculate the sequence {(P n, Q n )} n= by (P, Q ) = (, 0), (P 0, Q 0 ) = (a 0, ), and (P n+, Q n+ ) = (a n+ P n + P n, a n Q n + Q n ). 2

13 What is The Continued Fraction Factoring Method? Slide 3/7 The Continued Fraction Expansion of N Let τ = U+ N 2V [0, ], with N a non-square, V > 0, 4V N U 2, and U < N. We note that where V = N U 2 4V τ 2V (U + N) = = U + N, N U 2 2V > 0. We now see that τ = U + N 2V = τ + U + = N 2V where U = U 2 τ V, and τ = U + N 2V [0, ). τ + τ, 3

14 What is The Continued Fraction Factoring Method? Slide 4/7 Since 4V V = N U 2 N U 2 (mod 4V ), we see that 4V N U 2, and U < N. This is significant, because this shows us that the continued fraction expansion of N can be computed precisely without any worries of the accumulation of rounding errors at each step. 4

15 What is The Continued Fraction Factoring Method? Slide 5/7 The Continued Fraction Factoring Method Suppose that we want to factor the non-square integer N. Let us compute the partial continued fractions expansions {(P n, Q n )} n= of N (or kn). We note that P 2 n NQ 2 n = P n + Q n N Pn Q n N = Q 2 n P n Q n + N P n Q n N < P n Q n + N < 2 N +. Since t n = Pn 2 NQ 2 n is small, it has a good chance of being B-smooth, and t n Pn 2 (mod N), so the continued fraction expansion of N (and kn) lets us generate our desired pairs of integers. 5

16 What is The Continued Fraction Factoring Method? Slide 6/7 A slight improvement We note that if p is a prime that divides one of our t n, then p cannot divide Q n since gcd(p n, Q n ) =, so we have that 0 t n Pn 2 NQ 2 n (mod p) N ( P n ) 2 (mod p), Q n which shows us that the only primes p smaller than or equal to B that we need to consider, are the primes that divide N, and the primes for which N is a square modulo p. 6

17 What is The Continued Fraction Factoring Method? Slide 7/7 References () M. C. Wunderlich, A Running Time Analysis of Brillhart s Continued Fraction Factoring Method, in: M.B. Nathanson, ed., Number Theory Carbondale 979, Springer Lecture Notes in Math. 75 (979), (2) J. Hoffstein, J. Pipher, J. Silverman, An Introduction to Mathematical Cryptography, Springer, New York, N.Y., (3) H. Cohen, A Course in Computational Algebraic Number Theory, Springer, Verlag Berlin Heidelberg, 993. (4) C. Pomerance, Analysis and comparison of some integer factoring algorithms, Computational Methods in Number Theory, (982) (5) C. Pomerance, A Tale of Two Sieves, Biscuits of Number Theory,