C. P. Schnorr and H. W. Lenstra, Jr. A Monte Carlo factoring algorithm with linear storage. Mathematics of Computation, 43(167):289--311, 1984.  Home/Search   Document Not in Database   Summary   Related Articles   Check

.... B # 9 ] Observe that # = is attractive by a complexity theoretic argument, because if # is composite, then Cl(#) has non trivial ambiguous elements, whose components lead immediately to a factorization of #; these ambiguous elements can be obtained by computing discrete logarithms in Cl(#) [25], therefore IFP Cl DLP. This means that if # is chosen like this and p and q are not disclosed, then solving the Cl DLP for # is at least as hard as breaking IFP based cryptosystems such as RSA with modulus pq. 3.2 Class Group Computations by Index Calculus Techniques Let L x [e, c] be defined ....

....is the ith prime, B is a smoothness bound, and e(p i , B) depends only on p i and B. For instance, if e(p i , B) log p i B for each p i , then the algorithm will cover each possible prime power below the smoothness bound. A similar method is used in the factoring algorithm of Schnorr and Lenstra [25]. If h(#) is B smooth, then this computation may yield 1 Cl(#) If this happens, then there is an i such that # i = 1 Cl(#) but # i 1 #= 1 Cl(#) and we immediately know that p i is the largest prime factor of ord Cl(#) #. If we set # # = # where e(p i ) is the smallest positive integer ....

Schnorr, C. P., and Lenstra, Jr., H. W. A monte carlo factoring algorithm with linear storage. Mathematics of Computation 43, 167 (1984), 289--311.

....rst match is expected to occur after p n=2 1:25 p n iterations (n = ord g) and then with Brent s algorithm the rst match is found after an expected number of 1:97 p n iterations. Modi cations of Brent s algorithm that require slightly more storage but less iterations can be found in [SL84] and [Tes98a] Pollard s original application can easily be generalized to any other group. All we need is a rule how to partition the group into 3 disjoint sets of equally large size, which can be done 10 EDLYN TESKE based on the unique encoding of the group elements as binary strings. ....

C. P. Schnorr and H. W. Lenstra, Jr. A Monte Carlo factoring algorithm with linear storage. Mathematics of Computation, 43(167):289-311, 1984.

....of u needed to evaluate current factoring methods. As far as we know, no discrepancy has been observed between values of the rho function and smoothness probabilities, in the range of interest to algorithm designers. For example, Table 3 below exhibits smooth number counts found by Odlyzko (from [21]) as soon as the predicted count of smooth numbers is moderately large, one finds reasonable agreement with the rho function. We note that Odlyzko only counted numbers whose prime power factors are small, a definition more stringent than ours. 14 k count u = log(10 15 ) log(2 k ) 10 5 ....

C.-P. Schnorr and H. W. Lenstra, Jr. A Monte Carlo factoring algorithm with linear storage. Math. Comp., 43:289--311, 1984.

....4 EDLYN TESKE steps. Let L 0 = 1:416. Later, we compare this number with the experimentally determined average values for L : number of iterations performed until a match is found p jGj : 2.3) Remark 2.1. The method we use to find a match generalizes a method used by Schnorr and Lenstra [SL84] such that optimal average case performance (experimentally) is achieved. A family of match finding algorithms with optimal worst case performance is discussed in [SSY82] If storing a large number of terms is not a problem, distinguished point methods as described in [vOW99] can be more efficient ....

....of the sequences (ff k ) and (fi k ) This implies that r adding walks can also be used if the group order is not known. Note that there is a canonical generalization of these walks for the purposes of element order computation and group structure computation (see [Tes98b] Schnorr and Lenstra [SL84] used r adding walks to compute the element order in class groups. Now, the question is whether r adding walks achieve the same performance as a random random walk would do, and, if this is the case, how should the parameter r be chosen. Experiments with elliptic curve subgroups of prime group ....

C. P. Schnorr and H. W. Lenstra, Jr., A Monte Carlo factoring algorithm with linear storage, Mathematics of Computation 43 (1984), no. 167, 289--311. MR 85d:11106

....i ; fi i 1 = fi i ; fi i 1 j 2fi i mod jGj ; or fi i 1 = fi i 1 ; according to the three cases above. While computing the terms (y i ; ff i ; fi i ) we try to find a match (y j ; y i ) for some j i. We use the same method as in Teske [17] which is based on a method of Schnorr and Lenstra [13] but with optimized parameters. This means that we work with a chain of 8 cells, which in each stage of the algorithm store altogether 8 triplets (y oe d ; ff oe d ; fi oe d ) d = 1; 8. In the beginning we put oe d = 0 for all d, thus storing (y 0 ; ff 0 ; fi 0 ) in each cell. After the ....

C. P. Schnorr and H. W. Lenstra, Jr. A Monte Carlo factoring algorithm with linear storage. Mathematics of Computation, 43(167):289--311, 1984.

....is changing. If the field were to stay fixed, then there would be an initial phase that would be about as hard to do as factoring a general integer around p, but then each individual logarithm would be relatively easy to compute. Until recently, it was thought that the Schnorr Lenstra algorithm [60] was the only factorization algorithm that ran in time L, with various other methods, such as the Pomerance quadratic sieve [53] requiring time L 1 d for various d 0. Those conclusions were based on the assumption that one had to use general matrix inversion algorithms to solve systems of ....

....Any algorithm for constructing a , b, and c satisfying (7.3) would help about equally in factoring integers and computing discrete logarithms. In general, while there are algorithms for factorization that do not generalize to give discrete logarithm algorithms (the Schnorr Lenstra algorithm [60], for example) the converse is not the case. Therefore it seems fairly safe to say that discrete logarithms are at least as hard as factoring and likely 64 to remain so. The idea behind the Coppersmith variant cannot be extended to the fields GF(p) with p prime. That idea is based on the ....

C. P. Schnorr and H. W. Lenstra, Jr., A Monte Carlo factoring algorithm with linear storage, Math. Comp. 43 (1984), 289-311.

....ff i ; fi i 1 = fi i ; fi i 1 j 2fi i mod jGj ; or fi i 1 = fi i 1 ; according to the three cases above. While computing the terms (y i ; ff i ; fi i ) we try to find a match (y j ; y i ) for some j i. We use the same method as in Teske [17] which is based on a method of Schnorr and Lenstra [13] but with optimized parameters. This means that we work with a chain of 8 cells, which in each stage of the algorithm store altogether 8 triplets (y oe d ; ff oe d ; fi oe d ) d = 1; 8. In the beginning we put oe d = 0 for all d, thus storing (y 0 ; ff 0 ; fi 0 ) in each cell. After the ....

C. P. Schnorr and H. W. Lenstra, Jr. A Monte Carlo factoring algorithm with linear storage. Mathematics of Computation, 43(167):289--311, 1984.

....not e H( Delta) On peut munir ce groupe d une loi de composition, not ee Delta. Le cardinal de H( Delta) est not e h( Delta) Muni de ces informations, il est tr es facile d imaginer une m ethode de factorisation de type p Gamma 1, qui va marcher si et seulement si h( GammaN ) est friable [SL84] Shanks a donn e une m ethode de factorisation bas ee sur les formes ambiges [Sha71, Coh72, Coh91] A partir de cette m ethode, on peut alors imaginer un algorithme de type combinaisons de congruences, dans laquelle on remplace la factorisation de nombres auxiliaires par celle de formes ....

Schnorr (C. P.) et Lenstra, Jr. (H. W.). -- A Monte-Carlo factoring algorithm with linear storage. Math. Comp., vol. 43, n 167, July 1984, pp. 289--311.

....if jGj is large. 2.2. Finding a match. While computing the terms (y i ; ff i ; fi i ) we try to find a match (y j ; y i ) for some j i. Algorithms for this have been given, for example, by Floyd (see [Knu81, p. 4] and Brent [Bre80] The method we use is based on a method of Schnorr and Lenstra [SL84], but with optimized parameters: we work with a chain of 8 cells, which in each stage of the algorithm store altogether 8 triplets (y oe d ; ff oe d ; fi oe d ) d = 1; 8. In the beginning we put oe d = 0 for all d, thus storing (y 0 ; ff 0 ; fi 0 ) in each cell. After each computation of ....

C. P. Schnorr and H. W. Lenstra, Jr., A Monte Carlo factoring algorithm with linear storage, Mathematics of Computation 43 (1984), no. 167, 289--311.

No context found.

C. P. Schnorr and H. W. Lenstra, Jr. A Monte Carlo factoring algorithm with linear storage. Mathematics of Computation, 43(167):289--311, 1984.

No context found.

Schnorr, C. P., and Lenstra, Jr., H. W. A monte carlo factoring algorithm with linear storage. Mathematics of Computation 43, 167 (1984), 289--311.

No context found.

Schnorr, C. P., and Lenstra, Jr., H. W. A Monte Carlo factoring algorithm with linear storage. Mathematics of Computation 43, 167 (1984), 289311.

No context found.

C.P. Schnorr and H.W. Lenstra, A Monte Carlo factoring algorithm with linear storage, Mathematics of Computation, Vol. 43, No. 167, pp. 289-311, July 1984.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC