A. K. Lenstra, M. Manasse, Factoring with two large primes, preprint 1992  Home/Search   Document Not in Database   Summary   Related Articles   Check

....b) l, a, b) and A,2 (a, b) also may be 1. We also determine a small set FQ of degree one prime ideals of [p] of norms bigger than LA and for each Q E Fc we set ec2(a,b) 0 if a b is a suare in M Q = t otherwise. The large primes are handled by constructing cycles as discribed in [1] and [6]. By calculating a non trivial lin ear dependency the vectors over IF2 we determine the subset S of the set of all pairs (a, b) that we are look ing for. As noted in [2] it may be necessary to replace in (3) by (f, p) 2, to guarantee that the square belongs to 7Z, Lo ] rather than to the ....

A. K. Lenstra, M. Manasse, Factoring with two large primes, preprint 1992

....partial relations together involves only a hashing process in order to be able to spot partial relations containing an already met large prime. The number of full relations reconstructed this way grows quadratically vs. the number of partial relations. When up to two large primes are used (see [30]) an algorithm resembling union nd helps to nd cycles : relation after relation, we build a graph whose vertices are the large primes. An edge connects two vertices if a partial relations exists involving them. There is also a special vertex named 1 , to which all primes involved alone in a ....

A. K. Lenstra and M. S. Manasse. Factoring with two large primes. Math. Comp., 63(208):785798, Oct. 1994.

....to succeed. This is k 1 k 2 1. However, a particular successful factorization given by (2a,2b) may or not be useful. In order for one to be useful, we must find other such results with matching large primes. Large primes B i which only appear once can never be part of a square. Work by Lenstra [13], Lambert [12] and Kovalenko [11] shows that the number of double large prime factorizations needed is Poisson distributed and has variance equal to its mean. Practical experience has shown that the number of two large prime factorizations needed is unpredictable up to perhaps a factor of 1.5. ....

A.K. Lenstra & M.S. Manasse, Factoring with two large primes, Advances in Cryptology-EUROCRYPT '90, Lecture Notes in Computer Science, Springer-Verlag, 1990, pp. 72-82.

....improvements. We just mention two of these. In Eq. 1) we consider only messages m i whose largest prime factor (modulo n) is pB . As for modern factorization methods, a substantial speed up can be obtained by also considering the m i s which are pB smooth except for one or two factors [15]. Another speed up can be obtained by using structured Gaussian elimination to solve Eq. 11) see [18] for an e#cient variation directly applicable to our case. 4 Generalizations 4.1 Higher exponents The signature scheme presented in Section 2 can be generalized to other even public exponents ....

Arjen K. Lenstra and Mark S. Manasse. Factoring with two large primes. Mathematics of Computation, 63:785--798, 1994.

....such subsets, it looks for smooth n s, factors each n as a product of powers of 1; 2; 3; 5; and then nds linear relations among the exponent vectors mod 2. See [101] 124] 180] 140] 129] 152] 168] 181] 178] 172] 146] and [147] See also [149] 99] 176] 56] 55] [107], 122] 67] and [16] for relevant linear algebra algorithms. The integers n in the continued fraction method are bounded in absolute value by x for some x 2 D 1=2 o(1) one chooses y with (log y) 2 2 (1=2 o(1) log x log log x. It seems that the rst y 2 o(1) values of n always suce to ....

Arjen K. Lenstra, Mark S. Manasse, Factoring with two large primes, Mathematics of Computation 63 (1994), 785-798. MR 95a:11107.

....which arise from random divisors which are t smooth except for one irreducible factor of high degree. Any two partial relations containing the same large irreducible factor can be combined to yield a relation. This method has been successfully employed in other index calculus algorithms (e.g. see [26]) and initial experiments indicate that it may be useful in our setting as well. 3. Experiment with Bernstein s methods [4] for fast smoothness testing. 4. Experiment with sieving methods (see [10] to determine if they can be used to generate relations faster than the random walk method. 6 ....

A. Lenstra and M. Manasse, \Factoring with two large primes", Advances in Cryptology { Eurocrypt '90, LNCS 473, 1991, 72-82.

....and the double large prime variation (PPMPQS) of MPQS, and we factor many numbers in the 66 88 decimal digits range, mainly with PPMPQS, both on SGI workstations, and on a Cray C90 vectorcomputer. PPMPQS is known to be faster than PMPQS by approximately a factor of 2:5 for sufficiently large n [LM94], but the cross over point depends heavily on the choice of the parameters in the two methods, on the computer, on the available memory, and on the implementation. It is stated further in [LM94] that PPMPQS was found to be faster than PMPQS for numbers of at least 75 decimal digits, and that the ....

....PPMPQS is known to be faster than PMPQS by approximately a factor of 2:5 for sufficiently large n [LM94] but the cross over point depends heavily on the choice of the parameters in the two methods, on the computer, on the available memory, and on the implementation. It is stated further in [LM94] that PPMPQS was found to be faster than PMPQS for numbers of at least 75 decimal digits, and that the speed up factor of 2.5 was obtained for numbers of more than 90 digits. As a comparison, a 106 digit number was factored with PMPQS in about 140 mips years, and a 107 digit number with PPMPQS ....

[Article contains additional citation context not shown here]

A.K. Lenstra and M.S. Manasse. Factoring with Two Large Primes. Mathematics of Computation, 63:785--798, 1994.

....sometimes a suboptimal M will give a better timing due to luck . This can happen because different M correspond to sieving on different polynomials: recall, the leading coefficient is determined by M . Determination of the optimal factor base depends on whether the double large prime variation [14] or the single large prime variation is used. In the single large prime variation, if a residue is found which has all its primes less than F except one large prime between F and F 2 , it is kept. This is called a partial relation. If another partial is found with the same large prime, the two ....

....It also makes it difficult to predict the time to complete a factorization. For example, Lenstra and Manasse observed that the number of smooths obtained from combining partials and partial partials may differ greatly when factoring two numbers of the same size with the same parameter settings [14]. This makes it very time consuming to find the optimal factor base size. We also do not believe the double large prime variation will have much of an affect on our conclusion, that siqs is about twice as fast as mpqs. One may argue that it causes more time to be spent on the sieving stage (i.e. ....

A. K. Lenstra, M. S. Manasse, "Factoring with two large primes," Advances in Cryptology, Eurocrypt '90, Lecture Notes in Comput. Sci. 473 (1991), pp. 72-82.

.... prime (P MPQS) variation w i is allowed to have one prime factor exceeding m (but not too much larger than m) In the two large prime (PP MPQS) variation w i can have two prime factors exceeding m this gives a further performance improvement at the expense of higher storage requirements [33]. 4.1 Parallel Distributed Implementation of MPQS The sieving stage of MPQS is ideally suited to parallel implementation. Di#erent processors may use di#erent polynomials, or sieve over di#erent intervals with the same polynomial. Thus, there is a linear speedup so long as the number of ....

A. K. Lenstra and M. S. Manasse, Factoring with two large primes, Math. Comp. 63 (1994), 785--798.

....1040 Delta 1051 Delta 1063 Delta 1077 2 j Gamma 2 3 Delta 7 3 Delta 13 2 Delta 17 Delta 23 Delta 43 Delta 2 ; which simplifies to 970009 2 j 257894 2 and factors N . Another variation of MPQS uses two large primes instead of one; this version is known as PPMPQS. See [6]. 7.8. Number Field Sieve The Number Field Sieve (NFS) uses ideas from algebraic number theory. It made newspaper headlines in 1990 when it was used to factor the 148 digit cofactor (2 512 1) 2424833 of the ninth Fermat number[ Suppose N is a composite integer to be factored. NFS ....

A.K. Lenstra and M.S. Manasse. Factoring with two large primes. Mathematics of Computation, 63:785--798, 1994.

....hashing techniques or with sorting. Theoretically, hashing is faster since it takes linear time (as opposed to O(n log n) when sorting is used) In practice there is no significant difference in using either method. We did not implement the double large prime variation of Lenstra and Manasse [5]. In theory, this technique should almost double the speed of our implementation. We are currently considering implementation of this and other speedups. 3.2 Small prime variation A prime p 2 SP will land in the sieve array about 4M p times. Thus, smaller primes land in the sieve array the ....

Lenstra, A. K., Manasse, M.: Factoring with two large primes. In Advances in Cryptology - Proceedings of EUROCRYPT 90 (1991) vol. 473 of Lecture Notes in Computer Science, Springer-Verlag pp. 72--82.

....semi smooths. If k 1 semi smooths are found with the same large prime, then these can be matched to obtain k Gamma 1 smooth relations. Keeping these residues will significantly speed up the algorithm. Some discussion on predicting the number of matches in the large prime variation is given in [5]. However, they comment that their predictions were consistently too high. Our method is quite accurate. We simplify the problem, without introducing a significant error, by assuming that residues generated by the algorithm are random and of size M p N . Let (X; Y ) be the probability that ....

Lenstra, A. K., Manasse, M.: Factoring with two large primes. In Advances in Cryptology - Proceedings of EUROCRYPT 90 (1991) vol. 473 of Lecture Notes in Computer Science, Springer-Verlag pp. 72--82.

.... large prime (P MPQS) variation w i is allowed to have one prime factor exceeding m (but not too much larger than m) In the two large prime (PPMPQS) variation w i can have two prime factors exceeding m this gives a further performance improvement at the expense of higher storage requirements [33]. 4.1 Parallel distributed implementation of MPQS The sieving stage of MPQS is ideally suited to parallel implementation. Di erent processors may use di erent polynomials, or sieve over di erent intervals with the same polynomial. Thus, there is a linear speedup so long as the number of ....

A. K. Lenstra and M. S. Manasse, Factoring with two large primes, Math. Comp. 63 (1994), 785-798.

....more frequently than larger ones, that matches between large primes occur often enough to make this approach worthwhile. Actually, it more than halves the sieving time. The obvious extension is to allow more than a single large prime. Using two large primes again more than halves the sieving time [68]. Three large primes have, yet again, the same e ect, according to an as yet unpublished experiment. Large primes can be seen as a cheap way to extend the size of the factor base P cheap because the large primes are not sieved with. Parallelization The multiple polynomial variation of the ....

A.K. Lenstra, M.S. Manasse, Factoring with two large primes, Proceedings Eurocrypt '90, LNCS 473, Springer-Verlag

....Curve algorithm [25] in 1987, and the Number Field Sieve in 1990 [20] The largest factored (difficult) numbers were registered carefully, and reports of new records were invariably presented at cryptographic conferences. We mention Eurocrypt 89 (C100 1 [22] Eurocrypt 90 (C107 and C116 [23]) Crypto 93 (C120, 13] Asiacrypt 94 (C129, 2] Asiacrypt 96 (C130, 11] and Asiacrypt 99 (C140, 8] The C130 and C140 were factored with help of the Number Field Sieve (NFS) the other numbers were factored using the Quadratic Sieve (QS) For additional information, implementations ....

....or year (MIPS years) 39 Sep 13, 1970 CF F 7 = 2 2 7 1 [29, 30] 50 1983 CF [6, pp. xliv xlv] 55 71 1983 1984 QS [12, Table I on p. 189] 45 81 1986 QS [39, p. 336] 78 90 1987 1988 QS [40] 87 92 1988 QS [35, Table 3 on p. 274] 93 102 1989 QS [22] 107 116 1990 QS 275 for C116 [23] RSA 100 Apr 1991 QS 7 [37] RSA 110 Apr 1992 QS 75 [14] RSA 120 Jun 1993 QS 835 [13] RSA 129 Apr 1994 QS 5000 [2] RSA 130 Apr 1996 NFS 1000 [11] RSA 140 Feb 1999 NFS 2000 [8] RSA 155 Aug 1999 NFS 8400 this paper Based on this table and on the factoring algorithms which we currently ....

A.K. Lenstra and M.S. Manasse. Factoring with two large primes. In I.B. Damgard, References 19 editor, Advances in Cryptology -- Eurocrypt '90, volume 473 of Lecture Notes in Computer Science, pages 72--82, Springer-Verlag, Berlin, 1991.

....1977, of the public key cryptosystem RSA [22] Since then, people have started to keep track of the largest (di#cult) numbers factored so far, and reports of new records were invariably presented at cryptographic conferences. We mention Eurocrypt 89 (C100 1 [14] Eurocrypt 90 (C107 and C116 [15]) Crypto 93 (C120, 8] Asiacrypt 94 (C129, 1] and Asiacrypt 96 (C130, 6] The 130 digit number was factored with help of the Number Field Sieve method (NFS) the others were factored using the Quadratic Sieve method (QS) For information about QS, see [21] For information about NFS, ....

A.K. Lenstra and M.S. Manasse. Factoring with two large primes. In I.B. Damgard, editor, Advances in Cryptology -- Eurocrypt '90, volume 473 of Lecture Notes in Computer Science, pages 72--82. Springer-Verlag, Berlin, 1991.

....Curve algorithm [25] in 1987, and the Number Field Sieve in 1990 [20] The largest factored (difficult) numbers were registered carefully, and reports of new records were invariably presented at cryptographic conferences. We mention Eurocrypt 89 (C100 1 [22] Eurocrypt 90 (C107 and C116 [23]) Crypto 93 (C120, 13] Asiacrypt 94 (C129, 2] Asiacrypt 96 (C130, 11] and Asiacrypt 99 (C140, 8] The C130 and C140 were factored with help of the Number Field Sieve (NFS) the other numbers were factored using the Quadratic Sieve (QS) For additional information, implementations ....

....or year (MIPS years) 39 Sep 13, 1970 CF F7 = 2 2 7 1 [29, 30] 50 1983 CF [6, pp. xliv xlv] 55 71 1983 1984 QS [12, Table I on p. 189] 45 81 1986 QS [39, p. 336] 78 90 1987 1988 QS [40] 87 92 1988 QS [35, Table 3 on p. 274] 93 102 1989 QS [22] 107 116 1990 QS 275 for C116 [23] RSA 100 Apr 1991 QS 7 [37] RSA 110 Apr 1992 QS 75 [14] RSA 120 Jun 1993 QS 835 [13] RSA 129 Apr 1994 QS 5000 [2] RSA 130 Apr 1996 NFS 1000 [11] RSA 140 Feb 1999 NFS 2000 [8] RSA 155 Aug 1999 NFS 8400 this paper Based on this table and on the factoring algorithms which we currently ....

A.K. Lenstra and M.S. Manasse. Factoring with two large primes. In I.B. Damgard, editor, Advances in Cryptology -- Eurocrypt '90, volume 473 of Lecture Notes in Computer Science, pages 72--82, Springer-Verlag, Berlin, 1991.

No context found.

A. K. Lenstra, M. Manasse, Factoring with two large primes, preprint 1992

No context found.

A. K. Lenstra and M.S. Manasse. Factoring with two large primes. Math. Comp., 63:77--82, 1994.

No context found.

A. K. Lenstra and M. S. Manasse. Factoring with two large primes. Math. Comp., 63(208):785-- 798, Oct. 1994.

No context found.

A. K. Lenstra and M. S. Manasse, Factoring with two large primes, Math. Comp. 63 (1994), 785--798.

No context found.

A. K. Lenstra and M. S. Manasse, Factoring with two large primes, Math. Comp. 63 (1994), 785--798.

No context found.

A.K. Lenstra and M.S. Manasse. Factoring with two large primes. In Advances in Cryptology - Eurocrypt '90, pages 72-82, Springer-Verlag, Berlin, 1991.

No context found.

A.K. Lenstra and M.S. Manasse. Factoring with two large primes. In Advances in Cryptology - Eurocrypt '90, pages 72-82, Springer-Verlag, Berlin, 1991.

No context found.

A.K. Lenstra and M.S. Manasse, Factoring with two large primes, Advances in Cryptology - EUROCRYPT '90, Lecture Notes in Computer Science, Berlin: Springer-Verlag, to appear.

First 50 documents

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC