Table Of ContentDigit Polynomials and their application to
integer factorization
5
1
0
2 Markus Hittmeir
c University of Salzburg
e
D Mathematics Department
0
2
] Abstract
T
N
This paper presents the concept of digit polynomials, which leads
.
h to a deterministic and unconditional integer factorization algorithm
at with the runtime complexity (N1/4+ǫ). Strassen’s well known fac-
O
m toringapproach isaspecialcase of ourmethod.We willalsoconsider
[ a possibility to improve upon the complexity bound.
4
v
8 1 Introduction
7
0
3 We consider the problem of computing the prime factorization of a given
0
. natural number N. Currently, the best publicly known deterministic and
1
0 unconditional factorization algorithms all have a runtime complexity of the
5
1 form (N1/4+ǫ) [W, p.240]. A method which achieves this complexity is the
O
v: approach of Strassen [S], based on the idea to compute parts of N1/2 ! to
i ⌊ ⌋
X finda nontrivial factorof N. Arecent improvement of thelogarithmicfactor
r
in the complexity bound can be found in [CH]. For a general overview, the
a
reader may consult [P].
In this paper we present a method based on products of certain poly-
nomials. The main idea is to construct polynomials g Z[X] such that as
∈
many integers x, 0 x N 1, as possible satisfy
≤ ≤ −
1 < gcd(g(x),N) < N.
Several b-adic representations of N are used in Theorem 2.9, which yields a
methodtoconstruct such apolynomialofdegreedwithcomplexity (d1+ǫ).
O
The author is supported by the Austrian Science Fund (FWF): Project F5504-N26.
Address:Hellbrunnerstraße34,A-5020Salzburg.E-Mail:[email protected]
2010 Mathematics Subject Classification: Primary 11A51; Secondary 11A41.
Key words and phrases: Factorization, Primality, Primes.
1
2 M. Hittmeir
In the factorization algorithm we will not only make use of the cardinality,
but also of the position of those x with the property above.
Our deterministic method is not appropriate for factorizing large num-
bers. In practice, probabilistic algorithms with much lower complexity are
used for this task (See [R] and [CP]).
2 Basic Ideas
Throughout this paper, P denotes the set of primes. We call a natural num-
ber semiprime if and only if it is the product of two distinct primes. Let
n N. We denote the complete residue system 0,...,n 1 modulo n by Z
n
∈ { − }
and the residue class ring Z/nZ by Z . For f Z[X], we write the leading
n
∈
coefficient of f as lcf. Until further notice, let N N be fixed.
∈
Definition 2.1. Let b Z. We denote the set of polynomials f Z[X]
∈ ∈
with the property f(b) = N by . The elements of are called digit
N,b N,b
D D
polynomials of N to base b.
Definition 2.2. Let b N, b 2. Let N = n bi be the unique b-adic
∈ ≥ i≥0 i
representation of N with digits n 0,...,bP1 . Define
i
∈ { − }
P := n Xi Z[X].
b i
∈
Xi≥0
We call P the b-adic digit polynomial of N. Clearly, we have P .
b b N,b
∈ D
Lemma 2.3. Let b Z and f . Then, for every x Z, we have
N,b
∈ ∈ D ∈
N f(x) mod x b.
≡ −
Proof. We know that b is a zero of the polynomial f N, hence X b
− −
divides f N in Z[X] and the congruence holds for every evaluation.
−
Corollary 2.4. Let b Z and f . We conclude for every x Z that
N,b
∈ ∈ D ∈
gcd(N,x b) = gcd(f(x),x b), and that x b N iff x b f(x).
− − − | − |
Lemma 2.5. Let u and v be nontrivial and coprime divisors of N. Let b Z
∈
and f such that
N,b
∈ D
1. gcd(lcf,N) = 1 and
2. d := degf is smaller than the largest prime factor of v.
Then there exists x Z with u f(x) and v ∤ f(x).
∈ |
Digit Polynomials 3
Proof. Let y Z be arbitrary. Let x Z with uy = x b. From Lemma
∈ ∈ −
2.3 we derive u f(x), hence u f(uy +b) for any y Z. We have to show
| | ∈
that there exists y Z with v ∤ f(uy+b).
∈
Assume to the contrary that f(uy +b) 0 mod v for all y Z. Write
≡ ∈
f(uy+b) as f(b)+u g(y) for g Z[X]. It is easy to verify that degg = d
· ∈
and lcg = ud−1lcf. Let p be the largest prime factor of v. Then, for every
y Z, it follows that
∈
f(uy +b) = u g(y)+f(b) u g(y) 0 mod p.
· ≡ · ≡
The fact p ∤ u implies g(y) 0 mod p for every y Z. But, since
≡ ∈
gcd(lcf,N) = 1, we get p ∤ lc(g). Therefore, g is of degree d in Z [X] and,
p
for this reason, has at most d zeros in Z [X]. From d < p the contradiction
p
follows.
Intheproofoftheprecedinglemmawehaveseenthat,ifN isacomposite
number and if f is chosen with appropriate degree, we get various
N,b
∈ D
integers x Z such that 1 < gcd(f(x),N) < N.
N
∈
Definition 2.6. Let g Z[X]. An element x Z is called suitable for g,
N
∈ ∈
if and only if 1 < gcd(g(x),N) < N. We also define
ν(g) := # x Z : x is suitable for g. .
N
{ ∈ }
If we multiply two polynomials f,g Z[X], it may happen that x Z is
N
∈ ∈
suitable for f and for g, but not for f g.
·
Definition 2.7. Let d N and f Z[X], 1 i d. An element x Z
i N
∈ ∈ ≤ ≤ ∈
vanishes in g := d f , if and only if gcd(g(x),N) = N and there is at
i=1 i
least one i such thQat x is suitable for f .
i
Theorem 2.8. Let N N be a semiprime number with the prime factors p
∈
and q and assume p < q. Let f Z[X] and d := degf. Let n be the number
∈
of distinct zeros of f modulo p and m be the number of distinct zeros of f
modulo q. Then:
1. ν(f) = mp+nq 2nm.
−
2. Let f = 0 in Z [X] and in Z [X]. If d < p/2, then ν(f) dp+dq 2d2.
p q
6 ≤ −
4 M. Hittmeir
Proof. For 1: Let x Z be suitable for f. Then x is a zero of f either
N
∈
modulo p or modulo q. Let α ,...,α be the distinct zeros of f modulo p and
1 n
β ,...,β bethedistinct zerosoff moduloq.Fori = 1,...,nandj = 1,...,m
1 m
we consider
py +α , for y = 0,...,q 1,
i
−
qy +β , for y = 0,...,p 1.
j
−
Every x which is suitable forf is of that form, andthese area priorimp+nq
values in Z . But some of them might be equal. First, we show that the
N
values of the form py+α are distinct modulo N. We assume that there are
i
y ,y Z with py +α py +α mod N for some i,k 1,...,n . For
1 2 q 1 i 2 k
∈ ≡ ∈ { }
i = k this is not possible, because we get α α mod p, which contradicts
i j
6 ≡
the assumption that the zeros are distinct modulo p. For i = k, it follows
that y y mod q. Hence, the congruence only holds if we compare the
1 2
≡
value py +α with itself. For this reason, all these values are distinct. By
1 i
similar arguments, one can show that this also holds for the values of the
form qy +β .
j
Next, we consider the case that some value of the form py +α is con-
i
gruent to some value of the form qy + β . Then this value is a zero of
j
f modulo N. By the Chinese Remainder Theorem, one can easily verify
that f must have exactly nm distinct zeros modulo N. Since any zero z
of f modulo N is also a zero of f modulo p and modulo q, we can write
z = py +α = qy +β forsomey ,y andi,j.Hence, atevery zerooff mod-
1 i 2 j 1 2
ulo N exactly two equal values of our list above coincide. The other values
all satisfy 1 < gcd(f(x),N) < N. Therefore, we get ν(f) = mp+nq 2nm.
−
For 2: Consider h = 2XY +Xq+Yp Z[X,Y]. Since f has at most d
− ∈
distinct zeros modulo p and modulo q, we want to maximize this function
for (x,y) [0,d]2. We get
∈
h (x,y) = 2y +q and h (x,y) = 2x+p
X Y
− −
as partial derivatives. Hence, the only critical point is (x,y) = (p/2,q/2).
But this point is not in [0,d]2, so we consider h on the boundary and get
g (x) = xq, g (x) = xp, g (x) = x(q 2d)+dp and g (x) = x(p 2d)+dq,
1 2 3 4
− −
for x [0,c]. Since q > 2d and p > 2d, the maximum is
∈
2
g (d) = g (d) = dp+dq 2d .
3 4
−
.
Digit Polynomials 5
For any polynomial f Z[X] with appropriate degree d, there are at
∈
most dp+ dq 2d2 integers which are suitable for f. We are interested in
−
efficient methods to construct polynomials which are best possible in this
sense. The following theorem yields a method with runtime complexity of
the form (d1+ǫ). We will use this idea in the factorization algorithm in
O
Section 3. Therefore, details will be explained in the proof of Theorem 3.4.
Theorem 2.9. Let N N be semiprime with the prime factors p and q.
∈
Let d N and b Z, 1 i d. Let f such that degf = 1
∈ i ∈ ≤ ≤ i ∈ DN,bi i
and write f = l X + c for every i. If gcd(c ,N) = 1 for every i and also
i i i i
gcd(b b ,N) = 1 for every choice of j,k 1,...,d , j = k, then
j k
− ∈ { } 6
d
2
ν f = dp+dq 2d .
i
−
(cid:16)Yi=1 (cid:17)
Proof. For1 i d,consider f . Since gcd(c ,N) = 1,f = 0 aspolynomial
i i i
≤ ≤ 6
in Z [X] and in Z [X]. Therefore, b is the only zero of f modulo p and
p q i i
modulo q.
Now consider g := d f . Obviously, every b , 1 i d, is a zero of
i=1 i i ≤ ≤
g modulo p as well as mQodulo q. Since gcd(b b ,N) = 1 for every choice
j k
−
of j,k 1,...,d , j = k, these zeros are distinct. For this reason, g has
∈ { } 6
d distinct zeros modulo p and d distinct zeros modulo q. Now we apply
Theorem 2.8.
Remark 2.10. For every polynomial f in the theorem above, there are
i
p + q 2 integers which are suitable for f . But, if we multiply all these
i
−
polynomials, we do not get d(p+q 2) suitable integers for the product g.
−
It is easy to see that there are 4 d integers vanishing in g. We get
· 2
(cid:0) (cid:1)
d
d
2
ν f = dp+dq 2d = d(p+q 2) 4 .
i
− − − ·(cid:18)2(cid:19)
(cid:16)Yi=1 (cid:17)
We will now prove a result to ensure the maximum possible number of
suitable integers for the product of digit polynomials of degree 2, which may
be compared to the result in Theorem 2.9. We will see that the b-adic digit
polynomials are especially useful in this case, not only because it is easy
to compute them, but also because of their uniqueness and the special way
they are constructed.
6 M. Hittmeir
Theorem 2.11. Let N N be semiprime with prime factors p and q. Let
∈
d N and b Z, 1 i d. Let f such that degf = 2 and write
∈ i ∈ ≤ ≤ i ∈ DN,bi i
f = n X2 +n X +n for every i.
i 2,i 1,i 0,i
If gcd(n b ,N) = 1 for every i and if for b := n n−1 b−1 mod N,
2,i· i d+i 0,i· 2,i · i
1 i d, we have gcd(b b ,N) = 1 for every choice of j,k 1,...,2d ,
j k
≤ ≤ − ∈ { }
j = k, then
6
d
2
ν f = 2dp+2dq 8d .
i
−
(cid:16)Yi=1 (cid:17)
Proof. For 1 i d, consider f . Since gcd(n ,N) = 1, f is a polynomial
i 2,i i
≤ ≤
of degree 2 modulo p. Therefore f has at most two zeros modulo p. One of
i
them is b . But since Z is a field, there has to be another zero modulo p.
i p
We know from Vieta’s Theorem that this zero has to be the solution of
n b x n mod p.
2,i i 0,i
· ≡
Since b n n−1 b−1 mod p, b is this zero of f modulo p. With
d+i ≡ 0,i · 2,i · i d+i i
similar arguments, one can also show that b and b are the zeros of f
i d+i i
modulo q.
Now consider g := d f . Obviously, every b , 1 i 2d is a zero of
i=1 i i ≤ ≤
g modulo p as well as mQodulo q. Since gcd(b b ,N) = 1 for every choice
j k
−
of j,k 1,...,2d , j = k, these zeros are distinct. For this reason, g has
∈ { } 6
2d distinct zeros modulo p and 2d distinct zeros modulo q. Now we apply
Theorem 2.8.
If we set d = 1 in the theorem above, the following statement is an
immediate consequence.
Corollary 2.12. Let N N be semiprime with prime factors p and q.
∈
Let b Z and f with degf = 2 and f = n X2 + n X + n . If
N,b 2 1 0
∈ ∈ D
gcd(n b,N) = 1 and gcd(N,n b2 n ) = 1, then ν(f) = 2p+2q 8.
2 2 0
· − −
We want to make Theorem 2.11 applicable. Hence, we have to find digit
polynomials for which the condition of distinct zeros modulo the factors of
N can be verified in (d) steps. For the linear polynomials in Theorem 2.9
O
this is feasible, since we are able to choose appropriate bases, for example
consecutive integers. Here, every base b we choose comes with a second
i
integer b , which we have to control. The subsequent lemma allows to
d+i
work with digit polynomials of degree 2 in practice.
Digit Polynomials 7
Lemma 2.13. Let N N, d N and let b N1/2/√2 ,..., N1/2 ,
i
∈ ∈ ∈ {⌈ ⌉ ⌊ ⌋}
1 i d, be coprime to N such that b = b +1. Set D := b + N/b .
i+1 i 1 d
≤ ≤ ⌊ ⌋
If gcd(D +z,N) = 1 for every z 0,...,2d 2 and if the b-adic digit
∈ { − }
polynomials P satisfy n n +1 for every i, then they also satisfy the
bi 1,i ≤ 0,i
conditions in Theorem 2.11.
Proof. Let i 1,...,d be arbitrary. It is easy to see that n = 1 for
2,i
∈ { }
this choice of bases. Since gcd(b ,N) = 1, the first condition of Theorem
i
2.11 is satisfied. Now set b := n b−1 mod N. Consider the division
d+i 0,i i
with remainder of N with respect to b and write m b + n = N. We
i i i 0,i
get m b n b b mod N, hence m b mod N. Next, we
i i 0,i d+i i i d+i
− ≡ ≡ − ≡
consider N = (m 1)(b +1)+r = m b +m b 1+r for some r Z.
i i i i i i
− − − ∈
Assume that r b + 1. Then it follows that N m b + m . But since
i i i i
≥ ≥
b N1/2 , it is easy to see that m b . By n < b we conclude
i i i 0,i i
≤ ⌊ ⌋ ≥
N m b +m m b +b > m b +n = N,
i i i i i i i i 0,i
≥ ≥
hence a contradiction. Now we assume that r < 0. Then it follows that
N < m b + m b 1. But this yields that n + b + 1 < m , and by
i i i i 0,i i i
− −
N > b (n +b +1)+n = b2+(n +1)b +n we conclude n > n +1,
i 0,i i 0,i i 0,i i 0,i 1,i 0,i
which contradicts our assumption. As a consequence, we get 0 r < b +1.
i
≤
Because of the uniqueness of the division with remainder, there has to be
r = n and m = m 1. Altogether we derive
0,i+1 i+1 i
−
b m m +1 b +1 mod N.
d+i+1 i+1 i d+i
≡ − ≡ − ≡
Now assume that there exist j,k 1,...,d such that b b mod p.
d+k j
∈ { } ≡
We write b = b +m for some m 0,...,d 1 and, as we just have shown,
j 1
∈ { − }
we can write
b b l m l N/b l mod p,
d+k 2d d d
≡ − ≡ − − ≡ −⌊ ⌋−
for some l 0,...,d 1 . It follows that N/b l b + m mod p.
d 1
∈ { − } −⌊ ⌋ − ≡
Therefore, we get
0 b + N/b +m+l D +z mod p,
1 d
≡ ⌊ ⌋ ≡
for some z 0,...,2d 2 . But this contradicts our assumption. Hence,
∈ { − }
for every choice of j,k 1,...,d , the integers b are different from the
d+j
∈ { }
integers b modulo p. It is also impossible that there exist j,k 1,...,d ,
k
∈ { }
j = k with b b mod p or with b b mod p, because this would
d+k d+j k j
6 ≡ ≡
imply p d, which as well contradicts the assumption gcd(D +z,N) = 1
≤
for z 0,...,2d 2 . By similar arguments, one can show that the zeros
∈ { − }
are all distinct modulo q.
8 M. Hittmeir
3 The Algorithm and its Parameters
Let N N be a composite number. Without knowledge of the factorization
∈
of N, we are able to construct a polynomial g Z[X] such that
∈
1 < gcd(g(x),N) < N,
for as many x Z as possible. The main idea for the algorithm is to find
N
∈
a subset of Z containing at least one element which is either suitable for
N
or vanishing in g. Let d N. We work with the following parameters.
∈
1. A set := b Z : 1 n d of bases for the digit polynomials.
n N
B { ∈ ≤ ≤ }
2. For every b , we choose exactly one f . We denote the set
b N,b
∈ B ∈ D
of all these polynomials by ( ).
D B
3. A set := s Z : 1 n d , containing at least one element
n N
S { ∈ ≤ ≤ }
suitable for or vanishing in g := f .
b∈B b
Q
These three sets determine the following algorithm, and its correctness
and runtime depends on finding a good choice for them.
Algorithm 3.1. Let N N and the sets = b Z : 1 n d ,
n N
∈ B { ∈ ≤ ≤ }
( ) = f : b and = s Z : 1 n d be given,
b N,b n N
D B { ∈ D ∈ B} S { ∈ ≤ ≤ }
where d N. Set a = 1, a = 1 and take the following steps to factor N:
1 2
∈
1. For every b , compute f ( ). Next, compute the polynomial
b
∈ B ∈ D B
g := f mod N.
b∈B b
Q
2. For every n 1,...,d , compute y := g(s ) mod N.
n n
∈ { }
3. Set j := a .
1
4. If j > d, print ’Error A’. Otherwise compute G := gcd(y ,N). If
j j
G = 1, set a = j+1 and go to Step 3. If 1 < G < N, print G . We
j 1 j j
have found a nontrivial factor of N and the algorithm terminates. If
G = N, go to Step 5.
j
5. Set i := a .
2
6. If i > d, print ’Error B’. Otherwise compute H := gcd(f (s ),N). If
i bi j
H = 1 or H = N, set a = i+1 and go to Step 5. If 1 < H < N,
i i 2 i
print H . We have found a nontrivial factor of N and the algorithm
i
terminates.
Digit Polynomials 9
We now clarify which conditions are necessary to make the algorithm
work. Finding a solution to the following problem is crucial.
Problem 3.2. Let N N be of unknown factorization. Ford N, construct
∈ ∈
two disjoint sets b : 1 n d and s : 1 n d in Z with the
n n N
{ ≤ ≤ } { ≤ ≤ }
property that, if N is composite, there must exist i,j 1,...,d and a prime
∈ { }
factor p of N such that b s mod p.
i j
≡
Example 3.3. Let d := N1/4 . Then it is easy to prove that the choice of
⌈ ⌉
the sets n mod N : 1 n d and (n 1)d mod N : 1 n d is
{− ≤ ≤ } { − ≤ ≤ }
a solution to the problem.
A solution to Problem 3.2 could be used in an obvious way to factor
naturalnumbers in (d2).The subsequent theoremshows howwecanapply
O
a solution to factorize much faster, using Algorithm 3.1.
Theorem 3.4. Let N be a natural number and let b : 1 n d and
n
{ ≤ ≤ }
s : 1 n d be a solution to Problem 3.2. Then Algorithm 3.1 runs in
n
{ ≤ ≤ }
(d1+ǫ) with the parametrization
O
:= b : 1 n d ,
n
B { ≤ ≤ }
( ) := X b : b ,
D B { − ∈ B}
:= s : 1 n d .
n
S { ≤ ≤ }
The algorithm will find a nontrivial factor of N if it is composite, and will
print ’Error A’ if N is prime.
Proof. Let N be composite. Since and are disjoint subsets of Z , we
N
B S
have
s b mod N
6≡
and therefore f (s) 0 mod N for every choice of s and b . This
b
6≡ ∈ S ∈ B
implies that if there is s such that gcd(g(s),N) = N, s vanishes in g
∈ S
and Algorithm 3.1 will find a nontrivial factor in Step 6.
It remains to show there is n 1,...,d with 1 < G N in Step 4.
n
∈ { } ≤
Since the sets and are a solution to Problem 3.2, there is a prime factor
B S
p of N and at least one pair (b′,s′) such that b′ s′ mod p. We
∈ B ×S ≡
get fb′(s′) = s′ b′ 0 mod p, hence 1 < gcd(g(s′),N) N.
− ≡ ≤
Let N be prime. Since and are disjoint subsets of Z , N can not be
N
B S
a divisor of products of differences of their elements. There must be G = 1
n
for every n 1,...,d in Step 4, and the algorithm prints ’Error A’.
∈ { }
10 M. Hittmeir
Let us discuss the runtime complexity of the algorithm. Note that the
multiplication time M(d) for multiplying two integers of length d can be
bounded by (dlogd log(logd)).
O ·
Step 1: We have to multiply d polynomials of degree 1. There are well
known methods to do this by (M(d)logd) arithmetic operations.
O
Step 2: Here we have to evaluate the polynomial g of degree d in d
points. This can be done by (M(d)logd) arithmetic operations, using the
O
well known methods for multipoint evaluation of polynomials.
Step 4 and Step 6: We have to compute at most d greatest common
divisors in each of these steps. For this task, we employ the Euclidean Al-
gorithm.
To summarize, the algorithm runs in (M(d)logd). That proves our
O
claim.
Remark 3.5. We could choose any f satisfying f (s) = 0 mod N
b N,b b
∈ D 6
for every s and b . But for computational convenience, we should
∈ S ∈ B
use f = X + N b X b mod N as digit polynomial to base b. The
b
− ≡ −
possibility to work with a larger variety of digit polynomials seems to be
moreof theoretical interest andhasbeen discussed inSection 2. Fordetailed
information concerning the tools used in Step 1 and Step 2, we refer the
reader to [GG, Ch.10], in particular, to the algorithms in 10.3 and 10.5.
Remark 3.6. (Strassen’s method as special case)
Let d := N1/4 . We recall Strassen’s factoring algorithm. The polynomial
⌈ ⌉
g = (X +1)(X +2) (X +d)
···
is evaluated in 0,d,2d,...,(d 1)din order to compute all parts of N1/2 ! to
− ⌊ ⌋
find a factor of N. But we may also consider the method as an application
of the solution presented in Example 3.3 and, therefore, as Algorithm 3.1
running with the parametrization
:= n mod N : 1 n d ,
B {− ≤ ≤ }
( ) := X +n : 1 n d ,
D B { ≤ ≤ }
:= (n 1)d mod N : 1 n d .
S { − ≤ ≤ }
ThisandothermoreorlesssimilarsolutionstoProblem3.2yieldthecurrent
deterministic complexity bound (N1/4+ǫ) for unconditional integer factor-
O
ization. More generally, if we know that there is a prime factor smaller than
N1/m , which for instance has to be the case if N has at least m nontrivial
⌊ ⌋
1
factors, then it is easy to see that we have a solution for d := N2m . Hence,
⌊ ⌋
we are able to run Algorithm 3.1 in (N21m+ǫ) in these cases.
O
