Integer Factorization
By:
Josh Tuggle & Kyle Johnson
What Is It?
• Integer Factorization - The decomposition of a
composite number into its primes.
• Not much of an actual problem until the
number becomes very large.
• No efficient algorithm exists yet.
• Goal: Factor in polynomial time.
What Is It?
• Hardest instance for I.F.: semiprimes.
– Product of two prime numbers.
• An algorithm that can efficiently factor any
integer would compromise RSA Cryptography.
Statistics
• Sept. 1993 – April 1994: RSA-129 becomes first large
distributed factorization.
• Jan – Aug. 1999: RSA-155 is factored using GNFS.
• April 2003: RSA-160 factored using 100 CPUs.
• Dec. 2003 – May 2005: RSA-200 factored using 80
Opteron processors in Germany.
• Dec. 2009: RSA-768 becomes largest semiprime
factored (232 digits) after two years and the
equivalent of 2000 years of processing.
Running Time
• There are many bounds on this problem based on
what is known about the integer to be factored.
• The algorithm with the best running time is the
General Number Field Sieve:
• However, there is an algorithm out there that has a
better factoring time, with a major difference.
Running Time
• Shor’s Algorithm currently has the best
runtime for this problem: O((log N)3).
– N is the input’s size.
• Only works with a quantum computer.
Algorithms
• There exists multiple algorithms for this
particular problem.
• Which one to use depends on what is known
about the input.
• These algorithms can be grouped into two
classes: Special-Purpose and GeneralPurpose.
Special-Purpose (Category 1)
• These algorithms’ runtimes depend on the
size of the smallest prime factor.
• General procedure is to use these algorithms
on an integer first to remove the more
manageable factors.
• Examples: Trial Division, Wheel Factorization,
Euler’s factorization method.
Trial Division
• Requires most work, but easiest to
understand.
• Given an integer n:
– Start at 2
– Move up number line towards n.
– Divide n by each number
– Check if the number went into n
with no remainders
– Repeat until all factors are prime.
General-Purpose (Category 2)
• The runtime for these algorithms depends
only on the size of the integer being factored.
• RSA numbers are factored using algorithms in
this class.
• Examples: Dixon’s Algorithm, Shank’s Square
Forms Factorization, General Number Field
Sieve.
General Number Field Sieve (GNFS)
• Arbitrarily select two polynomials f(x) and g(x)
that must fit several conditions.
– Small degrees d and e.
– Integer coefficients
– Irreducible over rationals
– Must yield same integer root when modded by
the initial number n.
General Number Field Sieve (GNFS)
• Subject the two polynomials to number field rings to
find values of two integers a and b that satisfy:
– r = bdf(a/b) and s = beg(a/b)
– r and s must be numbers that factor into primes only.
• Homomorphisms are then used to find two values x
and y such that x2 – y2 is divisible by n.
• These values are used to find a factor of n by taking
the gcd of n and x – y.
Shor’s Algorithm
• Algorithm developed by Peter Shor in 1994.
• Can factor in polynomial time, but requires a
quantum computer.
• Placed in complexity class BQP
– Bounded-Error Quantum Polynomial Time
Shor’s Process
• The algorithm consists of two key parts:
– A change of the problem from factoring to orderfinding.
– Solving the order-finding problem.
• The problem change portion can be done on a
traditional computer, but the order-finding
portion requires a quantum computer.
Traditional Half
• Pick a random integer a that is less than N, the
integer being factored.
• Find the gcd of the two integers.
• If this value isn’t 1, then there is a factor of N,
and the algorithm is finished.
• If the value is 1, we must go to the quantum
half of the algorithm.
Quantum Half
• Known as the period-finding subroutine.
• Used to find an r value that represents the period of
the function: f(x) = ax mod N.
• Quantum circuits used are custom made for each (a,
N) pair.
• r cannot be odd and ar/2 and -1 cannot be congruent
modulo N.
• If these conditions are both met, then gcd(ar/2 ± 1, N)
is a nontrivial factor of N and the algorithm finishes.
Quantum Half
• Heavily depends on a quantum computer’s
superposition property.
• Evaluates the function at all points
simultaneously.
• The algorithm’s runtime (O(log N)3) stems
from Shor solving three quantum problems in
O(log N) time each.
– Superposition, function as a quantum transform,
and quantum Fourier transform.
Questions?