The well-known fundamental theorem of arithmetic asserts that every integer can be written as in a unique way, up to permutation of the factors, as
where the are distinct primes, and each . Making this theorem explicit by computing the prime factorization of —that is, computing the and —is a fundamental problem in algorithmic number theory. This article is concerned with deterministic factorization algorithms.
Some numbers are easy to factor, even deterministically. For example, if is prime, then this can be proven in deterministic polynomial time in theory 
, and more efficiently (though heuristically) in practice. Prime powers can be detected in linear time .
But when has more than one prime factor, hard work is generally required. In the quantum world, we can apply Shor’s algorithm . In the classical world, the fastest algorithms are non-deterministic: depending on the size of , one may use Lenstra’s ECM or the Number Field Sieve (NFS), the best general-purpose factoring algorithm, which runs in time . This complexity explains the success of the RSA cryptosystem, which is based on the supposed difficulty of factoring numbers with only two prime factors.
Deterministic unconditional methods of factoring are rare, and all have exponential running time for general . The first such method was due to Fermat, followed by Lehman ; more recent methods include Bostan–Gaudry–Schost  and Costa–Harvey , which is currently the fastest deterministic factoring algorithm for general . Better results exist for numbers with special forms: for example,  describes a method to factor that runs in polynomial time when and are of roughly the same size and is in . This was extended in  to numbers with and/or in .
The use of oracles allows us to abstract and encapsulate the availability of extra information about the number . It is thus a traditional way of trying to understand the difficulty of factoring. In this work, we consider factoring algorithms with access to the following oracles in particular:
: on input returns , the value of the Euler totient function (see §2.1);
: on input returns , the value of the Carmichael lambda function (see §2.2);
: on input and with , returns the order of modulo (see §2.3).
We study the conditions under which these oracles can be used to factor deterministically, unconditionally, and in a time complexity better than exponential.
The story of factoring with oracles began with Miller  and Long , who considered randomized factoring algorithms with access to . Woll  explored relationships between number-theoretic problems including factorization and the and oracles. Recently, Z̀ralek  has shown that iterated calls to allow deterministic factoring in subexponential time, after using Landau’s algorithm to reduce to the squarefree case as in §5.1. In a different direction, Bach, Miller, and Shallit  showed that an oracle yielding the sum of the divisors of allows efficient factoring. Chow  has studied factoring with an oracle of a completely different nature, using coefficients of modular forms; this turns out to be very powerful, since it solves the integer factorization problem.
There is also an important practical motivation for oracles in factoring. In the context of RSA moduli , the problem of factoring given additional information on and has been studied since 1985. For example, Rivest and Shamir showed in  that if has bitlength and the factors and are balanced (with bitlengths close to ), then can be factored in polynomial time if we have access to an oracle returning the most significant bits of . Beyond its theoretical interest, these algorithms are motivated by cryptographic hardware attacks: the oracle is an abstraction representing side-channel analysis revealing some of the bits of the secret factors. In 1996, Coppersmith improved Rivest and Shamir’s results by applying lattice-based methods to the problem of finding small integer roots of bivariate integer polynomials (what is now called Coppersmith’s method ). This requires only half of the most or least significant bits of to be known to factor with a polynomial time complexity.
In this article we combine these approaches, applying lattice-based techniques to factoring with number-theoretic oracles. Our results rely on diophantine geometry, using classical continued fractions and the LLL algorithm in a manner inspired by the cryptographic work mentioned above. We obtain results include the following:
Assume is squarefree and has at least three prime factors, of which the largest satisfies . Then we can recover in deterministic polynomial time in given or .
See Theorem 5.10. ∎
Assume is squarefree and has exactly three prime factors , where . Then we can compute a nontrivial factor of in deterministic polynomial time in given or if at least one of the following conditions hold:
We recall the definition of our oracles, and some associated number-theoretic results, in §2. We then state the relevant results of Coppersmith and Howgrave-Graham in §3. These underpin our core results in §4, which solve (generalizations of) the following problem: given and such that there exists a (large enough) prime with and , recover in deterministic polynomial time. We apply these algorithms to factoring with and in §5, and with in §6.
Similar algorithms and results hold given an oracle yielding the value of the sum-of-divisors function , but we do not pursue these analogues here. We also note that all results involving can be easily adapted to use instead.
2. The oracles
As above, we suppose , where the are distinct primes and . We let denote the number of prime divisors of (so above). Recall that is trivially bounded above by , and is of order on average.
2.1. The oracle
Given as above, the oracle returns the value of the Euler totient function,
This function counts the number of integers in that are prime to ; that is, it gives the cardinality of the multiplicative group of .
2.2. The oracle
Given as above, the oracle returns the value of Carmichael’s function. This is the exponent of , the maximal order of an element modulo ; so
2.3. The oracle
Given and with , the oracle returns the order
Shor’s quantum factorization algorithm applies the Quantum Fourier Transform to construct a quantum polynomial-time order-finding algorithm, which yields an efficient factorization algorithm after some classical postprocessing (similar to the process in §2.5 below). This order-finding algorithm should not be seen as a true realization of , since it is only guaranteed to return a divisor of
; however, for most inputs it returns the true order with very high probability. Hence, factoring withcan give us some valuable intuition into Shor-style quantum factoring algorithms.
2.4. Relationships between the oracles
Lagrange’s theorem tells us that the order of an element divides the order of the group, and indeed the exponent. Applying this to gives
for all and all prime to .
While the and functions may seem very close, it is easy to see that can be made quite large. For example, if where (so is a Sophie Germain prime), then . However, the following easy result will be useful to us.
If is odd,
is odd, then.
Expanding and , we have . ∎
Recall that if is a prime, then the valuation of an integer at is defined to be the maximal such that . For odd , we see that gives an easy upper bound for , which may be useful when we have access to (though this bound is generally far from tight). In contrast, gives us no information about on its own—and so neither does for any .
2.5. Randomized algorithms
All three oracles give efficient randomized factoring algorithms. The key is to find some in such that (that is, a non-trivial square root of 1); then is a nontrivial factor of . Such always exist if is not prime.
To find a nontrivial square root of modulo using , note that is even, so we can write with odd. Then, from we can deduce such that . The same relations hold with in place of (though generally with different values of and ), so the same algorithm works with in place of .
If we use the order oracle , then we may need to try several random values of until we find one with even order . Then, with probability , the element will be a non-trivial square root of and therefore yield a nontrivial factor of .
Folklore tells us that there is a randomized polynomial-time reduction between computating square roots modulo and factoring . Rabin gives a precise analysis when is a product of two primes in [36, Theorem 1]. To render this approach deterministic (as in ) one needs a bound on non-quadratic residues, but this bound can only be obtained under ERH.
3. Lattices, Coppersmith’s method, and approximate GCDs
In this section we recall some essential results on our two basic tools: Coppersmith’s method for finding small roots of polynomials, and Howgrave-Graham’s approximate GCDs. We also introduce some elementary subroutines that we will use to improve the quality of our factorizations.
The Lenstra–Lenstra–Lovasz lattice basis reduction algorithm (LLL) is at the heart of both Coppersmith’s and Howgrave-Graham’s methods. Recall that if is a lattice of dimension in (with the Euclidean norm ), then we say that a basis of is LLL-reduced if
The LLL algorithm computes an LLL-reduced basis for in polynomial time in , , and . Moreover, the resulting is approximately as short as possible: .
3.1. Univariate Coppersmith
use lattice reduction to find small roots of modular univariate or multivariate integer polynomials. The general principle is to build a lattice of coefficient vectorsof real polynomials sharing common roots, and then find short vectors in this lattice using LLL. Some cleverness is needed to construct small lattices that yield large bounds on the expected roots. We refer the reader to  for a survey on this topic, and  for the best complexity result.
Let be an integer with an unknown factor with . Let be a univariate monic polynomial of degree . Then we can find all solutions to the equation
with in polynomial time in and .
3.2. Bivariate Coppersmith
Theorem 3.2 describes Coppersmith’s method for finding small zeroes of bivariate polynomials. Unlike the univariate result above, these bivariate equations are not modular. Subsequent clarifications of Coppersmith’s algorithm appear in  and , and extensions to the general multivariate case in , , , and . For Theorem 3.2, we refer to Coron’s treatment in .
Let be irreducible, of degree at most in each variable, and suppose for some , . If
then we can find all such solutions in time polynomial in and .
In this article we will apply the special cases of Theorems 3.1 and 3.2 where the polynomial is linear in each variable to find divisors of . In another direction, but using the same techniques, Theorem 3.3 improves on a result of Lenstra .
Theorem 3.3 (Coppersmith–Howgrave-Graham–Nagaraj ).
Let with and for some . The number of divisors of that are congruent to is in . The divisors can be found in deterministic polynomial time.
The results obtained by using Coppersmith’s methods are asymptotic: they use lattices of dimensions which tend to . To make these methods practical generally requires an exhaustive search (see  for the best known practical algorithm).
3.3. Approximate GCDs
One of the first applications of Coppersmith’s theorems was to attack RSA moduli, factoring in polynomial time given half of the bits of . The algorithmic presentation of these theorems used today is the one due to Howgrave-Graham , who later used this result to solve the Approximate GCD problem , formalized in Definition 3.4.
Given integers and , and bounds and for which there exists some and with such that and , the PACDP problem is to find all such .
3.4. Computing approximate GCDs via continued fractions
Proposition 3.5 (Howgrave-Graham ).
Given integers , Algorithm 1 (PacdCF) computes all solutions to the PACDP for with for any in deterministic polynomial time in .
Suppose is one of the desired PACDP solutions: then and , and and for some . Write and ; then and , from which
The classical theory of continued fraction approximations tells us that must be a convergent of . Algorithm 1 therefore begins by computing the convergents (this is closely related to the computation of , and can be done in deterministic polynomial time [26, 42]). For each convergent , if then we recover the PACDP solution . We can stop as soon as , because such cannot divide . ∎
The bound in Proposition 3.5 can be relaxed to (without the factor of ) if we use intermediate convergents, but asymptotically this has no real importance.
3.5. Computing approximate GCDs via lattice reduction
Theorem 3.6 (Howgrave-Graham ).
Given integers , and in and in , Algorithm 2 (PacdL) computes all solutions to the PACDP for with in deterministic polynomial time in and where .
Sketch of proof.
We use two auxiliary integer parameters , whose precise values will be determined later. The idea is to build an -dimensional lattice of polynomials that are multiples of and , and so have a common root modulo . Let
and set . Finding a small row vector in the lattice of yields a polynomial with a small root over . The parameters are chosen such that
in order to optimize the size of the shortest vector found by LLL. This gives an optimal value of , close to , for which
It remains to take . ∎
As noted in , the continued fraction (PacdCF) and lattice (PacdL) approaches are subtly different: PacdCF requires only a lower bound on one exponent , whose precise value does not matter, but PacdL requires some relation between two exponents, and (or ). We will encounter this difference in §5.4. Similar phenomena appear in the context of implicit factorization (e.g. [32, 39, 20, 40]), but in these cases the two exponents can be handled more easily.
3.6. Refining partial factorizations
PacdCF and PacdL both return nontrivial divisors of , rather than complete factorizations. We can improve the quality of these partial factorizations using some basic auxiliary algorithms.
CleanDivisors takes an integer and a list of divisors of , and returns a set of pairs such that . This can be done by applying Refine to , which yields such that . These are all multiples of , so the result to be returned is .
4. Finding particular divisors of an integer
This section describes algorithms that find a large divisor of if for an auxiliary integer and some small . We use the simplest case, where is prime and , for factoring with in §5, but we think that these more general results have independent interest.
4.1. Factoring with known auxiliary and unknown difference
First, consider the search for divisors of such that that where is given and the small is unknown. We can compute such in deterministic polynomial time by solving a univariate modular equation.
Let and be integers, and suppose there exists such that for a small unknown integer . Then we can compute in deterministic polynomial time if
Let , so ; computing the product leads to the divisor by computing . But is the solution of the modular equation , and thus is a solution to PACDP. By Theorem 3.1, we can compute in polynomial time if , which is equivalent to . ∎
Using the notation of Theorem 4.1: if and then we can recover in deterministic polynomial time provided .
The hypothesis implies ; hence , and the result follows. ∎
4.2. Factoring with known difference and unknown auxiliary
Now we consider the opposite case: finding such that where is known and is unknown. In our applications, for example, . In full generality, provided is especially small, say , we can use Coppersmith’s bivariate method from Theorem 3.2 to obtain the following results.
Let and be integers with and , and suppose there exists such that for some integer with . Then we can compute in deterministic polynomial time if
Now is irreducible, and linear in and , so meets the conditions of Theorem 3.2 with ; and . Assume and . The crucial bound is
Using gives and . Ignoring small constants, we want
which implies ; the result follows. ∎
Using the notation of Theorem 4.3: if , then we can recover in deterministic polynomial time provided .
A weaker but simpler result can be obtained using Coron’s algorithm, as in [15, §2]: if we use , then is enough to recover .
5. Factoring with the and oracles
We now return to factoring with oracles. We treat the closely-related problems of factoring with and simultaneously here, before treating in §6. We consider odd , since detecting and removing powers of is easy. Ordering the prime divisors of by decreasing size, we write
The two arithmetical functions we are interested in are
5.1. Reduction to the squarefree case
We begin by reducing to the case of squarefree : that is, with . We do this using Landau’s algorithm (Algorithm 3), which factors an integer into a product of pairwise coprime perfect powers using either or .
Theorem 5.1 (Landau ).
Given and or , Algorithm 3 (SquareFree) returns such that , each is squarefree or 1, and the are pairwise coprime using calls to .
Let . Lemma 2.1 shows that if is either or , then
where each is or according to whether or not for some .
If then is already squarefree, and we are done. Otherwise, let . We observe that , since divides but cannot divide , because it is too large to divide any for . If is a prime dividing both and , then , and there is a unique such that : we should replace by and by . This is dealt with in the loop at Line 3. The primes dividing but not should be put with , as in Line 3. ∎
5.2. Reduction to the case
Suppose is squarefree. If (resp. ), then obviously we learn a nontrivial factor of ; but further, we learn that some also divides at least one of the . As a consequence, we get a factorization of that can be continued with the number of prime factors decreasing on each cofactor. Thus, we reduce to the problem of factoring squarefree where (resp. ).
5.3. Products of two primes
It is well-known that we can factor a product of two distinct primes given , as we recall in Lemma 5.2. This immediately yields Algorithm 4 (FactorizationWithPhi2), which factors a squarefree integer with given .
If is a product of two distinct primes and is known, then the two primes are
If with and prime, then ; so , and and are the roots of the quadratic equation . ∎
To convert Algorithm 4 into an algorithm that takes instead of , we use Lemma 5.3, which shows that when , we can efficiently compute from . Thus, any algorithm calling can be immediately transformed into an algorithm making the same number of calls to . In particular, Algorithm 4 can be used with instead of .
If is a product of two distinct primes, then .
Suppose . Write ; then and with . Now
from which , but . ∎
5.4. Products of more than two primes
Returning to the general squarefree case, suppose
Clearly and ; so, in particular, and .
The results of §4 yield conditions on the under which factors of can be computed with the algorithms of §3. As a first step, Theorem 5.4 and Corollary 5.5 give conditions for efficient factoring using Algorithm 5 (SplitCF), which applies PacdCF using or .
Suppose and there exists such that
Then PacdCF recovers the factor in deterministic polynomial time using given .
Write . The hypothesis implies ; otherwise and , hence , which is impossible. Expanding the formula for yields for some and . If , then is a solution to the PACDP for with , and PacdCF will find because . In this case , and the condition becomes , which yields Inequality (3). ∎
If , then Algorithm 5 (SplitCF) recovers in deterministic polynomial time after a single call to or .
This is just the special case of Theorem 5.4 (for which ). ∎
If there exist in and in such that and for some , then we can recover the divisors and of in deterministic polynomial time given , , and a single call to or .
Theorem 3.6 will use PacdL given , , , and to find where and . ∎
Theorem 5.6 is difficult to apply directly, because of the subtlety alluded to in §3.5: it is not enough to simply know that the parameters and satisfying the bounds exist, because we need to use them as parameters to PacdL. On the other hand, PacdL does not need their exact values (indeed, if we knew the exact value for , then we would already know the prime factor ). If we can guess that a suitable exists, then we can give a lower bound for implying a lower bound for and an upper bound for that allow us to apply PacdL. While the bounds may be far from the optimal values of and , thus yielding suboptimal performance for PacdL, the solution is still polynomial time, and it allows us to factor some integers that PacdCF cannot.
For each positive integer , we define a constant
|The first few of these constants are|
If for some , then , , and meet the conditions of Theorem 5.6.