Integer Factorization By: Josh Tuggle & Kyle Johnson What Is It? • Integer Factorization - The decomposition of a composite number into its primes. • Not much of an actual problem until the number becomes very large. • No efficient algorithm exists yet. • Goal: Factor in polynomial time. What Is It? • Hardest instance for I.F.: semiprimes. – Product of two prime numbers. • An algorithm that can efficiently factor any integer would compromise RSA Cryptography. Statistics • Sept. 1993 – April 1994: RSA-129 becomes first large distributed factorization. • Jan – Aug. 1999: RSA-155 is factored using GNFS. • April 2003: RSA-160 factored using 100 CPUs. • Dec. 2003 – May 2005: RSA-200 factored using 80 Opteron processors in Germany. • Dec. 2009: RSA-768 becomes largest semiprime factored (232 digits) after two years and the equivalent of 2000 years of processing. Running Time • There are many bounds on this problem based on what is known about the integer to be factored. • The algorithm with the best running time is the General Number Field Sieve: • However, there is an algorithm out there that has a better factoring time, with a major difference. Running Time • Shor’s Algorithm currently has the best runtime for this problem: O((log N)3). – N is the input’s size. • Only works with a quantum computer. Algorithms • There exists multiple algorithms for this particular problem. • Which one to use depends on what is known about the input. • These algorithms can be grouped into two classes: Special-Purpose and GeneralPurpose. Special-Purpose (Category 1) • These algorithms’ runtimes depend on the size of the smallest prime factor. • General procedure is to use these algorithms on an integer first to remove the more manageable factors. • Examples: Trial Division, Wheel Factorization, Euler’s factorization method. Trial Division • Requires most work, but easiest to understand. • Given an integer n: – Start at 2 – Move up number line towards n. – Divide n by each number – Check if the number went into n with no remainders – Repeat until all factors are prime. General-Purpose (Category 2) • The runtime for these algorithms depends only on the size of the integer being factored. • RSA numbers are factored using algorithms in this class. • Examples: Dixon’s Algorithm, Shank’s Square Forms Factorization, General Number Field Sieve. General Number Field Sieve (GNFS) • Arbitrarily select two polynomials f(x) and g(x) that must fit several conditions. – Small degrees d and e. – Integer coefficients – Irreducible over rationals – Must yield same integer root when modded by the initial number n. General Number Field Sieve (GNFS) • Subject the two polynomials to number field rings to find values of two integers a and b that satisfy: – r = bdf(a/b) and s = beg(a/b) – r and s must be numbers that factor into primes only. • Homomorphisms are then used to find two values x and y such that x2 – y2 is divisible by n. • These values are used to find a factor of n by taking the gcd of n and x – y. Shor’s Algorithm • Algorithm developed by Peter Shor in 1994. • Can factor in polynomial time, but requires a quantum computer. • Placed in complexity class BQP – Bounded-Error Quantum Polynomial Time Shor’s Process • The algorithm consists of two key parts: – A change of the problem from factoring to orderfinding. – Solving the order-finding problem. • The problem change portion can be done on a traditional computer, but the order-finding portion requires a quantum computer. Traditional Half • Pick a random integer a that is less than N, the integer being factored. • Find the gcd of the two integers. • If this value isn’t 1, then there is a factor of N, and the algorithm is finished. • If the value is 1, we must go to the quantum half of the algorithm. Quantum Half • Known as the period-finding subroutine. • Used to find an r value that represents the period of the function: f(x) = ax mod N. • Quantum circuits used are custom made for each (a, N) pair. • r cannot be odd and ar/2 and -1 cannot be congruent modulo N. • If these conditions are both met, then gcd(ar/2 ± 1, N) is a nontrivial factor of N and the algorithm finishes. Quantum Half • Heavily depends on a quantum computer’s superposition property. • Evaluates the function at all points simultaneously. • The algorithm’s runtime (O(log N)3) stems from Shor solving three quantum problems in O(log N) time each. – Superposition, function as a quantum transform, and quantum Fourier transform. Questions?