Deterministic factoring with oracles

02/23/2018
by   François Morain, et al.
ANSSI
0

We revisit the problem of integer factorization with number-theoretic oracles, including a well-known problem: can we factor an integer N unconditionally, in deterministic polynomial time, given the value of the Euler totient (φ(N)? We show that this can be done, under certain size conditions on the prime factors of N. The key technique is lattice basis reduction using the LLL algorithm. Among our results, we show for example that if N is a squarefree integer with a prime factor p > √(N) , then we can recover p in deterministic polynomial time given φ(N)). We also shed some light on the analogous problems for Carmichael's function, and the order oracle that is used in Shor's quantum factoring algorithm.

READ FULL TEXT VIEW PDF

Authors

page 1

page 2

page 3

page 4

06/10/2020

Noisy polynomial interpolation modulo prime powers

We consider the noisy polynomial interpolation problem of recovering an ...
07/20/2020

On completely factoring any integer efficiently in a single run of an order finding algorithm

We show that given the order of a single element selected uniformly at r...
10/12/2020

An exponent one-fifth algorithm for deterministic integer factorisation

Hittmeir recently presented a deterministic algorithm that provably comp...
05/12/2018

An Indexing for Quadratic Residues Modulo N and a Non-uniform Efficient Decoding Algorithm

An indexing of a finite set S is a bijection D : {1,...,|S|}→ S. We pres...
02/20/2019

Counting basic-irreducible factors mod p^k in deterministic poly-time and p-adic applications

Finding an irreducible factor, of a polynomial f(x) modulo a prime p, is...
05/23/2011

A Tool for Integer Homology Computation: Lambda-At Model

In this paper, we formalize the notion of lambda-AT-model (where λ is a ...
04/23/2021

An integer factorization algorithm which uses diffusion as a computational engine

In this article we develop an algorithm which computes a divisor of an i...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1. Introduction

The well-known fundamental theorem of arithmetic asserts that every integer can be written as in a unique way, up to permutation of the factors, as

where the are distinct primes, and each . Making this theorem explicit by computing the prime factorization of —that is, computing the and —is a fundamental problem in algorithmic number theory. This article is concerned with deterministic factorization algorithms.

Some numbers are easy to factor, even deterministically. For example, if is prime, then this can be proven in deterministic polynomial time in theory [1]

, and more efficiently (though heuristically) in practice 

[35]. Prime powers can be detected in linear time [5].

But when has more than one prime factor, hard work is generally required. In the quantum world, we can apply Shor’s algorithm [41]. In the classical world, the fastest algorithms are non-deterministic: depending on the size of , one may use Lenstra’s ECM or the Number Field Sieve (NFS), the best general-purpose factoring algorithm, which runs in time [19]. This complexity explains the success of the RSA cryptosystem, which is based on the supposed difficulty of factoring numbers with only two prime factors.

Deterministic unconditional methods of factoring are rare, and all have exponential running time for general . The first such method was due to Fermat, followed by Lehman [28]; more recent methods include Bostan–Gaudry–Schost [9] and Costa–Harvey [18], which is currently the fastest deterministic factoring algorithm for general . Better results exist for numbers with special forms: for example, [8] describes a method to factor that runs in polynomial time when and are of roughly the same size and is in . This was extended in [17] to numbers with and/or in .

The use of oracles allows us to abstract and encapsulate the availability of extra information about the number . It is thus a traditional way of trying to understand the difficulty of factoring. In this work, we consider factoring algorithms with access to the following oracles in particular:

  • : on input returns , the value of the Euler totient function (see §2.1);

  • : on input returns , the value of the Carmichael lambda function (see §2.2);

  • : on input and with , returns the order of modulo (see §2.3).

We study the conditions under which these oracles can be used to factor deterministically, unconditionally, and in a time complexity better than exponential.

The story of factoring with oracles began with Miller [34] and Long [30], who considered randomized factoring algorithms with access to . Woll [43] explored relationships between number-theoretic problems including factorization and the and oracles. Recently, Z̀ralek [44] has shown that iterated calls to allow deterministic factoring in subexponential time, after using Landau’s algorithm to reduce to the squarefree case as in §5.1. In a different direction, Bach, Miller, and Shallit [3] showed that an oracle yielding the sum of the divisors of allows efficient factoring. Chow [10] has studied factoring with an oracle of a completely different nature, using coefficients of modular forms; this turns out to be very powerful, since it solves the integer factorization problem.

There is also an important practical motivation for oracles in factoring. In the context of RSA moduli , the problem of factoring given additional information on and has been studied since 1985. For example, Rivest and Shamir showed in [38] that if has bitlength and the factors and are balanced (with bitlengths close to ), then can be factored in polynomial time if we have access to an oracle returning the most significant bits of . Beyond its theoretical interest, these algorithms are motivated by cryptographic hardware attacks: the oracle is an abstraction representing side-channel analysis revealing some of the bits of the secret factors. In 1996, Coppersmith improved Rivest and Shamir’s results by applying lattice-based methods to the problem of finding small integer roots of bivariate integer polynomials (what is now called Coppersmith’s method [11]). This requires only half of the most or least significant bits of to be known to factor with a polynomial time complexity.

In this article we combine these approaches, applying lattice-based techniques to factoring with number-theoretic oracles. Our results rely on diophantine geometry, using classical continued fractions and the LLL algorithm in a manner inspired by the cryptographic work mentioned above. We obtain results include the following:

Theorem 1.1.

Assume is squarefree and has at least three prime factors, of which the largest  satisfies . Then we can recover in deterministic polynomial time in given or .

Proof.

See Theorem 5.10. ∎

Theorem 1.2.

Assume is squarefree and has exactly three prime factors , where . Then we can compute a nontrivial factor of in deterministic polynomial time in given or if at least one of the following conditions hold:

  1. ; or

  2. ; or

  3. .

Proof.

Follows from Theorems 5.4, 5.6, 5.9, and 5.10. ∎

We recall the definition of our oracles, and some associated number-theoretic results, in §2. We then state the relevant results of Coppersmith and Howgrave-Graham in §3. These underpin our core results in §4, which solve (generalizations of) the following problem: given and such that there exists a (large enough) prime  with and , recover  in deterministic polynomial time. We apply these algorithms to factoring with and in §5, and with in §6.

Remark 1.1.

Similar algorithms and results hold given an oracle yielding the value of the sum-of-divisors function , but we do not pursue these analogues here. We also note that all results involving can be easily adapted to use instead.

2. The oracles

As above, we suppose , where the are distinct primes and . We let denote the number of prime divisors of  (so above). Recall that is trivially bounded above by , and is of order on average.

2.1. The oracle

Given as above, the oracle returns the value of the Euler totient function,

This function counts the number of integers in that are prime to ; that is, it gives the cardinality of the multiplicative group of .

2.2. The oracle

Given as above, the oracle returns the value of Carmichael’s function. This is the exponent of , the maximal order of an element modulo ; so

2.3. The oracle

Given and with , the oracle returns the order

Shor’s quantum factorization algorithm applies the Quantum Fourier Transform to construct a quantum polynomial-time order-finding algorithm, which yields an efficient factorization algorithm after some classical postprocessing (similar to the process in §

2.5 below). This order-finding algorithm should not be seen as a true realization of , since it is only guaranteed to return a divisor of

; however, for most inputs it returns the true order with very high probability. Hence, factoring with

can give us some valuable intuition into Shor-style quantum factoring algorithms.

2.4. Relationships between the oracles

Lagrange’s theorem tells us that the order of an element divides the order of the group, and indeed the exponent. Applying this to gives

for all and all prime to .

While the and functions may seem very close, it is easy to see that can be made quite large. For example, if where (so is a Sophie Germain prime), then . However, the following easy result will be useful to us.

Lemma 2.1.

If

is odd, then

.

Proof.

Expanding and , we have . ∎

Recall that if is a prime, then the valuation of an integer at is defined to be the maximal  such that . For odd , we see that gives an easy upper bound for , which may be useful when we have access to (though this bound is generally far from tight). In contrast, gives us no information about on its own—and so neither does for any .

2.5. Randomized algorithms

All three oracles give efficient randomized factoring algorithms. The key is to find some in such that (that is, a non-trivial square root of 1); then is a nontrivial factor of . Such always exist if is not prime.

To find a nontrivial square root of modulo using , note that is even, so we can write with odd. Then, from we can deduce such that . The same relations hold with in place of (though generally with different values of and ), so the same algorithm works with in place of .

If we use the order oracle , then we may need to try several random values of  until we find one with even order . Then, with probability , the element will be a non-trivial square root of and therefore yield a nontrivial factor of .

Remark 2.1.

Folklore tells us that there is a randomized polynomial-time reduction between computating square roots modulo and factoring . Rabin gives a precise analysis when is a product of two primes in [36, Theorem 1]. To render this approach deterministic (as in [34]) one needs a bound on non-quadratic residues, but this bound can only be obtained under ERH.

3. Lattices, Coppersmith’s method, and approximate GCDs

In this section we recall some essential results on our two basic tools: Coppersmith’s method for finding small roots of polynomials, and Howgrave-Graham’s approximate GCDs. We also introduce some elementary subroutines that we will use to improve the quality of our factorizations.

The Lenstra–Lenstra–Lovasz lattice basis reduction algorithm (LLL) is at the heart of both Coppersmith’s and Howgrave-Graham’s methods. Recall that if is a lattice of dimension in (with the Euclidean norm ), then we say that a basis of is LLL-reduced if

The LLL algorithm computes an LLL-reduced basis for in polynomial time in , , and . Moreover, the resulting is approximately as short as possible: .

3.1. Univariate Coppersmith

Coppersmith’s breakthrough algorithms [11, 12]

use lattice reduction to find small roots of modular univariate or multivariate integer polynomials. The general principle is to build a lattice of coefficient vectors

of real polynomials sharing common roots, and then find short vectors in this lattice using LLL. Some cleverness is needed to construct small lattices that yield large bounds on the expected roots. We refer the reader to [33] for a survey on this topic, and [6] for the best complexity result.

Theorem 3.1 states Coppersmith’s main result on solving modular univariate equations [11], following Howgrave-Graham’s simpler formulation in [24].

Theorem 3.1.

Let be an integer with an unknown factor with . Let be a univariate monic polynomial of degree . Then we can find all solutions to the equation

with in polynomial time in and .

3.2. Bivariate Coppersmith

Theorem 3.2 describes Coppersmith’s method for finding small zeroes of bivariate polynomials. Unlike the univariate result above, these bivariate equations are not modular. Subsequent clarifications of Coppersmith’s algorithm appear in [15] and [7], and extensions to the general multivariate case in [25], [14], [7], and [37]. For Theorem 3.2, we refer to Coron’s treatment in [16].

Theorem 3.2.

Let be irreducible, of degree at most in each variable, and suppose for some , . If

then we can find all such solutions in time polynomial in and .

In this article we will apply the special cases of Theorems 3.1 and 3.2 where the polynomial is linear in each variable to find divisors of . In another direction, but using the same techniques, Theorem 3.3 improves on a result of Lenstra [29].

Theorem 3.3 (Coppersmith–Howgrave-Graham–Nagaraj [13]).

Let with and for some . The number of divisors of that are congruent to is in . The divisors can be found in deterministic polynomial time.

Remark 3.1.

The results obtained by using Coppersmith’s methods are asymptotic: they use lattices of dimensions which tend to . To make these methods practical generally requires an exhaustive search (see [6] for the best known practical algorithm).

3.3. Approximate GCDs

One of the first applications of Coppersmith’s theorems was to attack RSA moduli, factoring in polynomial time given half of the bits of . The algorithmic presentation of these theorems used today is the one due to Howgrave-Graham [24], who later used this result to solve the Approximate GCD problem [23], formalized in Definition 3.4.

Definition 3.4.

Given integers and , and bounds and for which there exists some and with such that and , the PACDP problem is to find all such .

Howgrave-Graham gives two types of algorithms for solving PACDP instances in [23]. The first, using continued fractions, is described by Proposition 3.5 and Algorithm 1 (PacdCF). The second approach, using LLL, is described by Theorem 3.6 and Algorithm 2 (PacdL).

3.4. Computing approximate GCDs via continued fractions

Proposition 3.5 (Howgrave-Graham [23]).

Given integers , Algorithm 1 (PacdCF) computes all solutions to the PACDP for with for any in deterministic polynomial time in .

Proof.

Suppose is one of the desired PACDP solutions: then and , and and for some . Write and ; then and , from which

The classical theory of continued fraction approximations tells us that must be a convergent of . Algorithm 1 therefore begins by computing the convergents (this is closely related to the computation of , and can be done in deterministic polynomial time [26, 42]). For each convergent , if then we recover the PACDP solution . We can stop as soon as , because such cannot divide . ∎

Remark 3.2.

The bound in Proposition 3.5 can be relaxed to (without the factor of ) if we use intermediate convergents, but asymptotically this has no real importance.

1 Function PacdCF(, )
       Input : 
       Output : The set of solutions to the PACDP for with for some (so and ).
2      
3       continued fraction convergents of , stopping when
4       for  up to  do
5             if  (and ) then
6                  
7                  
8                  
9            
10      return
Algorithm 1 PacdCF: Approximate GCD using continued fractions.

3.5. Computing approximate GCDs via lattice reduction

Theorem 3.6 (Howgrave-Graham [23]).

Given integers , and in and in , Algorithm 2 (PacdL) computes all solutions to the PACDP for with in deterministic polynomial time in and where .

Sketch of proof.

We use two auxiliary integer parameters , whose precise values will be determined later. The idea is to build an -dimensional lattice of polynomials that are multiples of and , and so have a common root modulo . Let

and set . Finding a small row vector in the lattice of yields a polynomial with a small root over . The parameters are chosen such that

in order to optimize the size of the shortest vector found by LLL. This gives an optimal value of , close to , for which

It remains to take . ∎

1 Function PacdL(, , , )
       Input :  and , with
       Output : the set of solutions to the PACDP for with (so and ).
2      
3      
4       the -dimensional lattice of -coefficients defined in the proof of Theorem 3.6
      
        // Use LLL
5      
6       integer roots of
7      
8       for  do
9            
10             if  and  then
11                  
12                  
13            
14      return
15      
Algorithm 2 PacdL: Approximate GCDs using LLL

As noted in [23], the continued fraction (PacdCF) and lattice (PacdL) approaches are subtly different: PacdCF requires only a lower bound on one exponent , whose precise value does not matter, but PacdL requires some relation between two exponents, and (or ). We will encounter this difference in §5.4. Similar phenomena appear in the context of implicit factorization (e.g. [32, 39, 20, 40]), but in these cases the two exponents can be handled more easily.

3.6. Refining partial factorizations

PacdCF and PacdL both return nontrivial divisors of , rather than complete factorizations. We can improve the quality of these partial factorizations using some basic auxiliary algorithms.

  • Refine takes integers , and returns a sequence of pairs with each and , and with the all pairwise coprime, such that . Refine can be implemented by iterating the rewriting formula

    references start with [2], and faster algorithms are given in [4, 5].

  • CleanDivisors takes an integer and a list of divisors of , and returns a set of pairs such that . This can be done by applying Refine to , which yields such that . These are all multiples of , so the result to be returned is .

4. Finding particular divisors of an integer

This section describes algorithms that find a large divisor of if for an auxiliary integer and some small . We use the simplest case, where is prime and , for factoring with in §5, but we think that these more general results have independent interest.

4.1. Factoring with known auxiliary and unknown difference

First, consider the search for divisors of such that that where is given and the small is unknown. We can compute such in deterministic polynomial time by solving a univariate modular equation.

Theorem 4.1.

Let and be integers, and suppose there exists such that for a small unknown integer . Then we can compute in deterministic polynomial time if

(1)
Proof.

Let , so ; computing the product leads to the divisor by computing . But is the solution of the modular equation , and thus is a solution to PACDP. By Theorem 3.1, we can compute in polynomial time if , which is equivalent to . ∎

Corollary 4.2.

Using the notation of Theorem 4.1: if and then we can recover in deterministic polynomial time provided .

Proof.

The hypothesis implies ; hence , and the result follows. ∎

4.2. Factoring with known difference and unknown auxiliary

Now we consider the opposite case: finding such that where is known and is unknown. In our applications, for example, . In full generality, provided is especially small, say , we can use Coppersmith’s bivariate method from Theorem 3.2 to obtain the following results.

Theorem 4.3.

Let and be integers with and , and suppose there exists such that for some integer with . Then we can compute in deterministic polynomial time if

(2)
Proof.

Rewrite the problem as and , so . Eliminating , we see that is a zero of If , then and are both small, and we can use Theorem 3.2 in a deterministic way. First, as in [15], we let

Now is irreducible, and linear in and , so meets the conditions of Theorem 3.2 with ; and . Assume and . The crucial bound is

Using gives and . Ignoring small constants, we want

which implies ; the result follows. ∎

We use Corollary 4.4 in §5.4 to show that unbalanced numbers (having a large prime factor) are easy to factor with . In contrast, compact (with all prime factors ) are harder to factor.

Corollary 4.4.

Using the notation of Theorem 4.3: if , then we can recover in deterministic polynomial time provided .

Remark 4.1.

A weaker but simpler result can be obtained using Coron’s algorithm, as in [15, §2]: if we use , then is enough to recover .

5. Factoring with the and oracles

We now return to factoring with oracles. We treat the closely-related problems of factoring with and simultaneously here, before treating in §6. We consider odd , since detecting and removing powers of is easy. Ordering the prime divisors of by decreasing size, we write

The two arithmetical functions we are interested in are

5.1. Reduction to the squarefree case

We begin by reducing to the case of squarefree : that is, with . We do this using Landau’s algorithm (Algorithm 3), which factors an integer into a product of pairwise coprime perfect powers using either or .

1 Function SquareFree(,)
       Input :  an integer , and an oracle
       Output :  such that with each or squarefree, and all of the pairwise coprime
2      
3      
4       if  then
5             return
6            
7      
8      
9      
10       for  to  do
11            
12             if  then
13                  
14                  
15                  
16            
17      
18       return
19      
Algorithm 3 Landau’s algorithm
Theorem 5.1 (Landau [27]).

Given and or , Algorithm 3 (SquareFree) returns such that , each is squarefree or 1, and the are pairwise coprime using calls to .

Proof.

Let . Lemma 2.1 shows that if is either or , then

where each is or according to whether or not for some .

If then is already squarefree, and we are done. Otherwise, let . We observe that , since divides but cannot divide , because it is too large to divide any for . If is a prime dividing both and , then , and there is a unique such that : we should replace by and by . This is dealt with in the loop at Line 3. The primes dividing but not  should be put with , as in Line 3. ∎

5.2. Reduction to the case

Suppose is squarefree. If (resp. ), then obviously we learn a nontrivial factor of ; but further, we learn that some also divides at least one of the . As a consequence, we get a factorization of  that can be continued with the number of prime factors decreasing on each cofactor. Thus, we reduce to the problem of factoring squarefree where (resp. ).

5.3. Products of two primes

It is well-known that we can factor a product of two distinct primes given , as we recall in Lemma 5.2. This immediately yields Algorithm 4 (FactorizationWithPhi2), which factors a squarefree integer with given .

Lemma 5.2.

If is a product of two distinct primes and is known, then the two primes are

Proof.

If with and prime, then ; so , and and are the roots of the quadratic equation . ∎

1 Function FactorizationWithPhi2
       Input :  and , where is squarefree
       Output :  if is the product of two distinct primes, or
2      
      
        // discriminant of
3       if  is not square then
4             return
5      
6      
7       return
8      
Algorithm 4 Factoring a 2-factor integer using

To convert Algorithm 4 into an algorithm that takes instead of , we use Lemma 5.3, which shows that when , we can efficiently compute from . Thus, any algorithm calling can be immediately transformed into an algorithm making the same number of calls to . In particular, Algorithm 4 can be used with instead of .

Lemma 5.3.

If is a product of two distinct primes, then .

Proof.

Suppose . Write ; then and with . Now

from which , but . ∎

5.4. Products of more than two primes

Returning to the general squarefree case, suppose

Theorems 5.4 and 5.6 show how we can factor by solving PACDP instances if the satisfy certain relative size conditions. To make this precise, we set

Clearly and ; so, in particular, and .

The results of §4 yield conditions on the under which factors of can be computed with the algorithms of §3. As a first step, Theorem 5.4 and Corollary 5.5 give conditions for efficient factoring using Algorithm 5 (SplitCF), which applies PacdCF using or .

Theorem 5.4.

Suppose and there exists such that

(3)

Then PacdCF recovers the factor in deterministic polynomial time using given .

Proof.

Write . The hypothesis implies ; otherwise and , hence , which is impossible. Expanding the formula for yields for some and . If , then is a solution to the PACDP for with , and PacdCF will find because . In this case , and the condition becomes , which yields Inequality (3). ∎

Corollary 5.5.

If , then Algorithm 5 (SplitCF) recovers in deterministic polynomial time after a single call to or .

Proof.

This is just the special case of Theorem 5.4 (for which ). ∎

1 Function SplitCF()
       Input :  to be factored using oracle
       Output :  or a set of pairs , with the pairwise coprime and
2      
      
        // with each
3       if  then
4             return
5            
6      return CleanDivisors
Algorithm 5 Splitting an integer using PacdCF

We can go further using PacdL instead of PacdCF. Theorem 5.6 is the corresponding analogue of Theorem 5.4.

Theorem 5.6.

If there exist in and in such that and for some , then we can recover the divisors and of in deterministic polynomial time given , , and a single call to or .

Proof.

Theorem 3.6 will use PacdL given , , , and to find where and . ∎

Theorem 5.6 is difficult to apply directly, because of the subtlety alluded to in §3.5: it is not enough to simply know that the parameters and satisfying the bounds exist, because we need to use them as parameters to PacdL. On the other hand, PacdL does not need their exact values (indeed, if we knew the exact value for , then we would already know the prime factor ). If we can guess that a suitable exists, then we can give a lower bound for implying a lower bound for and an upper bound for that allow us to apply PacdL. While the bounds may be far from the optimal values of and , thus yielding suboptimal performance for PacdL, the solution is still polynomial time, and it allows us to factor some integers that PacdCF cannot.

Definition 5.7.

For each positive integer , we define a constant

The first few of these constants are
Lemma 5.8.

If for some , then , , and meet the conditions of Theorem 5.6.

Proof.

Let and