WO2020231439A1 - Method and apparatus for factoring large integers - Google Patents

Abstract

This patent describes a method, apparatus and computer program which factor a large integer N ₀ in a time of the order of p ², logp ⁴, N ₀ where p denotes a prime.

Description

l

. METHOD AND APPARATUS FOR FACTORING , LARGE INTEGERS

CROSS-REFERENCE TO RELATED APPLICATIONS

4

5

ft

7

<1. FIELD OF THE INVENTION s The present invention is related to solving an equation in two or more unknown io integer variables, where each variable is represented by a multiplicity of multiples of u powers of an odd prime p. Specifically, the present invention is related to factoring an i2 integer N_Q by restating the problem into the factorization of an appropriate integer N is which is a quadratic residue modulo p, then factoring N in a time of order of

is P. BACKGROUND * The problem of resolving a large integer into the product of its prime factors has IT stimulated the intellectual curiosity and the imagination of many generations of i* mathematicians.

is In 1801 Gauss wrote: the dignity of the science itself seems to require that at every possible means be explored for the solution of a problem so elegant and so ji celebrated.” [1, 397]

2 The problem has attracted renewed interest, ever since R.L, Rivest, A. Shamir

23 and L. Adleman proposed an encryption method which is based on the computational u difficulty of the factorization problem [2].

5 This note introduces a method and apparatus which allows the factorization of a * large odd integer //in logarithmic time. 7 III. SUMMARY

The present invention pertains to a method for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N_Q = r s ,0 where N₀ , r and s are integers and W is a function of r and s. The method comprises the1 steps of storing the signal W in a non-transient memory. There is the step of decoding2 with a second computer in communication with the memory the signal W in the memory3 with the second computer generated steps of selecting a prime number p of the form4 p— 4L+ 1 for an odd integer k such that the public key N₀ is a non-quadratic residue 5 modulo p calculating n₀ satisf ing the inequalities p*^{0 1} < N₀ < p"° ; computing N = t N₀ with a selection of r such that N is a quadratic residue modulo p”° ; 7 calculating n satisfying the inequalities p <N<p and calculating a solution to

NºA^Z (mod p") (1) 9 by using the representation

i where a>_t satisfies the condition 42 0 < w _t <p^{n 1} (3)

43 There is the step of decrypting with the second computer the signal W with the public key JV₀ and the prime factors of integer N₀ There is the step of displaying on a

₄₅ display by the second computer the decrypted signal W. There is the step of reviewing

46 the decrypted signal W and its relevance.

7 The present invention pertains to a second computer for decoding an encrypted

48 electromagnetic signal W encoded by a first computer with public key N₀ = r x , 9 where N₀ , r and s are integers and W is a function of r and s, comprising:

50

si a non-transient memory in which the signal W is stored,

52

53 decoding with a CPU in communication with the memory the signal W in the

5₄ memory that decodes the signal W by the second computer generated steps of selecting a

55 prime number p of the form p— 4k + 1 for an odd integer k such that the public key N₀ so is a non-quadratic residue modulo p calculating; «₀ satisfying the inequalities

57 p ⁰ < N_Q <p ⁰ ; computing N = tN₀ with a selection of t such that W is a quadratic s» residue modulo pⁿ° ; calculating n satisfying the inequalities p^{n ~ 1} < N<pⁿ and 5 calculating a solution to

60 Nº A² (mod pⁿ) (4)

6i by using the representation 63 where (o_l satisfies the condition

64 0 < w_i < pⁿ (6)

65 the CPU decrypting the signal W with the public key N₀ and the prime factors of integer

66 N_Q ; and

67 a display on which the decrypted signal W is displayed so the decrypted signal W

68 can be reviewed to determine the relevance of the decrypted signal W. The display can

69 be a computer screen or smart phone screen or any screen or piece of paper on which the

70 decrypted signal W is printed or any medium on which the decrypted signal W can be

7₁ reviewed.

72 The present invention pertains to a non-transitory readable storage medium

73 which includes a computer program stored on the storage medium for decoding an

7 encrypted electromagnetic signal W encoded by a first computer with public key

75 N_Q = r x r, where N₀ , r and s are integers and W is a function of r and s, where the

7 signal W has been stored in a non-transient memory of a second computer, having the

77 second computer generated steps of.

re selecting a prime number p of the form p = 4k + \ for an odd integer k such that

79 the public key N₀ is a non-quadratic residue modulo p; calculating N_Q satisfying the go inequalities p ⁰ < N₀ <p ⁰ ; computing N = TN_Q with a selection of t such that N is si a quadratic residue modulo ”⁰; calculating « satisfying the inequalities pⁿ <N <pⁿ ; 82 and calculating a solution to M by using the representation

86 where w_ί satisfies the condition

87 0 < w, <r^h ~ⁱ (9)

8« There is the step of decrypting with the second computer the signal W with the

89 public key N₀ , and the prime factors of integer N₀. There is the step of displaying on a so display by the second computer the decrypted signal W for predetermined words to 9i determine the relevance of the decrypted signal W. 9 IV. BRIEF DESCRIPTION OF THE FIGURES

2

98 Figure 1 is a graphical representation of the integer A - N,

to Figure 2 is a graphical representation of the integer A _* (Y A) .

- 2

95 F igure 3 is a graphical representation of the integer Y-A) .

6 Figure 4 is a graphical representation of the integer X .

97 Figure 5 is a block diagram regarding the claimed invention. 8 V. DESCRIPTION OF THE INVENTION: THE PROBLEM 99 Given a positive odd integer N_Q , it is desired to determine a pair of integers r₀ too such that

ioi 0 r₀ - s₀. (10)

102 The problem can also be stated as the search for two integers Y₀ and X_Q such

1 3 that

105 The pairs (r₀, S_Q) and (F₀, X_Q) are related as follows·

107 Conversely,

if» If r₀ > Ϊ₀ > 0 , both U₀ and X_Q are positive In this case it is useful to consider some limit no cases in order to develop an appreciation for the magnitude of the variables,

in One of the limit cases occurs when the pair (r₀, i₀) is a pair of“twin primes”,

112 such as (43, 41) In these cases,

iu At the other end is the case when r₀ approximates N_Q . At the limit, consider a uspair (r₀, s_Q) equaling (N₀, 1) Then

i Therefore, in all cases

2 2

ns Thus, in all cases, Y_Q > JV₀. In some cases, X₀ is greater than N₀.

120 VI. A RESTATEMENT

Hi Given N₀ and an odd prime p, the general solution of ( 10) has the following

122 form:

124 where or, ?, l_ϋ and m₀ denote integers and where a b= N₀ (mod p). If a and b are

125 both even or both odd, _Q and m₀ have the same parity. Otherwise, define b' = b + p no and m'₀ = m₀ - 1 . Thus, without loss of generality, it is possible to define two integers 127 t/₀ and V_Q as follows:

29 Then

is! The integers V₀ and U₀ are usually referred to as the symmetric and

132 antisymmetric components of the pair (r₀, s₀) , respectively In general, in the search for

133 ( U_Qi V_Q) , all values of a in the interval 1 £ a <p may need to be tested.

134 The complexity of the problem is reduced in the cases when

In such cases V_{0 º} 0 (mod p).

137 In order to realize this situation, it is possible to restate the problem of factoring i3s N₀ into the problem of factoring some integer N which satisfies (20). To this end, select 139 a prime p such that JV₀ is a non-quadratic residue modulo p. It will be p ⁰ <N₀ <p ⁰ ,

HO for some integer n_Q .

HI Select a candidate value of a, say a. Then define r by the following:

- 2 2

142 N_n = T· a (mod p ). (21)

M3 Let r denote the least positive residue of (21 ) modulo p . Then b º t · a (mod p).

1 ₄ Since N₀ is a non-quadratic residue modulo p, so is r . If r is odd, define the integer N us by the following

146 N = T- N_Q (22) n

H7 where, for some integer n, p < N <p . Then LG is a quadratic residue modulo p and

143 Nº t² · a² (mod p²). (23)

us If p = 4 · k + 1 , then t¹± 1 (mod p) for all a and t ¹ 1 (mod p)

iso The integer r² a² can be partitioned into the product of r- a by r a or i5i -r· a by -r- a, yielding

i53 where

iso and where U and V denote integers. Similar relationships hold if r = s =— r a (mod 156/7). Notice that, if U> 0, r > s.

157 In the case of (24), it will be iso Also, since r is odd,

1 1 The factorization problem requires the identification of a pair (U , V) such that,

162 for the corresponding (/·, s ) , it is

16 N = r - s (28)

iM If, using the given a, the algorithm were successful in factonng N, then r would be «s divisible

166 NOTE 1: There is the possibility that r - a be divisible by some integer /_j = 1 + h ·r

-2 - 2

167 with 0 < h <p . In this case, the product t a may be partitioned into the pair i

which satisfies the second of (20). This case will not be considered _lea here because the pair {X, Y) would not be represented as in (26)

370 It should be noted that the proposed restatement of the problem is motivated by the i7i convenience of using search tools such as (24) and (26), which operate on lattices of

2

1 2 rectangular cells of sides p and p .

173 NOTE 2: In general, all the values of a should be tested. Since N₀ is a non-quadratic

174 residue modulo p, it is sufficient to test the values of a which are non-quadratic residues us modulo p.

ns NOTE 3 : In order to avoid singular cases, it is convenient to select p in such a way that, 1 7 for all non-quadratic residues modulo p, it is

ns Such is the case when 2 is a primitive root modulo p.

iso The prime p was selected of the form 4 k + 1 . Also, it has been shown that the integer _lei 2 is a primitive of the primes of the form 8 - A ± 3 [3, p.79] Therefore, 2 is a primitive 182 of the primes defined by

8 A ± 3 = 4 - A + t (30)

184 or

p = 4 · ODD + 1 . (31) 189

187 NOTE 4: In general, in (24) the product t _* a can be replaced by any integer A such

w „ 2 _* 2 2

1 e that º r -or (mod p ) and N = t · N₀ = A (mod p ). In particular, such is the case _lea when

JV º r² · a²(mod p²)

190 (32) º ¾²(mod p^n<>)

191 Consider the expression of Y when A is used in lieu of t a:

193 for some integer V_l .

194 Recall that, by (16),

195 JN < Y< N . (34)

I% There are two significant particular cases· If A < JN, then V > 0. Also, if

197 A > N, then V_l < 0 . is» Throughout this presentation, A will be greater than N. For simplicity of notation, the 1 integer V will be constrained to be positive. Then (24) takes the following form:

201 NOTE 5: A particular definition of N can be produced when r is computed modulo

202 pⁿ° . In this case, define the integer to T_Q by the following:

203 N₀ º T₀ - a modpⁿ°) . (36)

£

aw Let T denote the least positive residue of T_Q modulo p" . It will be

7b º N₀ · a ² (mod p °)

(37) º r(mod p²) .

odd let 20» In this case, the magnitude of N_To is of the order of

.

it» NOTE 6: Consider the case where, after the selection of p and «, the integer U is 210 selected or computed to be U º u _{t ^ |} (mod p) . In this case it would be possible to define 2P an integer t₂ as the least positive solution of the following:

4

212

(mod p ) . (39)

213 Then N could be defined as follows:

15 and (24) could be replaced by the following: 2₁₇ for some integers U₂ and V₄

218 NOTE 7: There is the possibility that the solution r of (21) be even In this case, let

220 Then Ύ is odd. Thus,—T may be used in lieu of r m (22) and in (24)

221 As an example, let N₀ = 73 71 = 5,183 . If p = 29, 73 = 15 + 2 p and

222 71 = 13 + 2 -p For a = 15, r is defined by N_{Q º} t 15² (mod p²) The least

„ _ 2 ~ 2 - 2

223positive solution is t = 722 . It will be r = p — r = 119 Then— JV_{0 º} (p — r) - 15

2 2 2 2 2 2

224 (mod p ) and -N₀ (p —r) = (p — r) 15 (mod p ) Therefore, in this case, define

226 N = -(p² - r) N₀. (43)

226 Then (24) takes the following form where

Consider an algorithm which determines the pair (r, s) by successive approximations. In particular, consider the case when a candidate solution of s is determined sequentially

2 k

modulo p,p , ...,p . In such a case, it is convenient to verify, at each step, whether a proposed candidate solution yields a divisor of N₀. Let s denote the least positive residue of s modulo p^k Then let 5_Q= p^k— s and venfy whether gcd ( ₀, N_Q) ¹ 1 In this presentation, without loss of generality, it will be assumed that r is a positive odd integer. Vn. A NOTE ON THE REPRESENTATION OF N Given p^{n 1} < N < pⁿ , where N is a quadratic residue modulo p, let

where { v_t } denote mtegers, and 0 < v_t <p . 24i It is desired to compute a solution of the following:

242 Nº A² (mod p¹) (47)

2n where

n

4 (mod p ), (48)

«a and where

246 0 < a_t <p. (49)

247 Subject to (49), the solution of (47) is provided by the following:

and LH_t denote the RHS and LHS, respectively, of the congruence

0 containing v_t .

1 The terms ( RH_t—LH_l ) /p are usually referred to as carries. They are caused by2 the constraint (49) and flow from the less significant digits to the more significant ones.3 As an example, consider the problem of solving

1 N= A ² (mod p⁵), (51)

5 where N is a quadratic residue modulo p Assume p = 13 and

= 12,711 . ₂₅₇ If 0 < a_t <p a solution of (51), say A , can be represented as follows:

253 A second solution of (51 ) occurs when a₀ = 6 is replaced by o₀ = p - a₀ = 7. In this 60 case

262 Consider removing the magnitude constraints (49) from all a_t and representing

264 ._<4 as

264

265 where the coefficients of any power of p are positive integers and are constrained by the sue following conditions

n - i

267 0 < w_i < p (56)

268 Then the congruence (51) can be satisfied if the sum of the coefficients of any power of B p, say p , is congruent to zero modulo p⁵ * . Specifically, in the example , it must be

.

71 In the example, consider the condition

2 5

72 10 s 62 ø (mod p ) . (58)

73 For w ₀ º 6 (mod p) , the least positive solution, say w ₀ , is w ₀ = 181 ,200 For

(mod p) , it is w ₀ = 190,043 .

¾ To satisfy the second of (57) when ώ ₀ = 181,200 , it must be

w 5

7b 2 · p º 2 · _Q - w _j ·r (mod p ), .

? The least positive solution, say

= 18,120 .

8 Thereafter, from the third of (57), let 279 (mod r⁵) ,

28owhence ώ ₂ ^~ 1,814.

281 Likewise, from the fourth of (57), let

282

283 whence ₃ = 97 .

284 Finally, from the fifth of (57), let

285

280 whence _<¾₄ = 12. Then

Nº( 181,200 + 18,120 ·r + 1,814 ·r² + 97 ·r³ + 12 ~p⁴i( S§p⁵ .

!«8 Proceeding in a similar fashion with eo_Q = 190,093 , it is

2 9 A/'s (190,093 + 10,441 -/>+ 383 ·r² + 72 ·r³ + 1 ./>⁴)²(pck¾50). 290 Comparison of the resulting w _{ with the corresponding w_x yields

292 or

24 Thus, in the example,

181,200 + 190,093 = p ⁵

18,120 +10,441 = p⁴

1,814 +383 = p³ <⁶³>

97 + 72 = p

12+1 = p

£6 and

297 A+A = 5 p^S (64) assNotice that, when A and A are subject to the constraint (49), as in (53) and (54), their aw sum equals p^S .

300 Comparing the representations of A by (59) and (53), it can be stated that the 01 representation proposed by (59) entails an equipartition of weight among the 5 degrees

302 of freedom of (55).

303 NOTE 1 : In the example, each coefficient w ₍ of A is computed modulo p⁵ ~ ' . If the magnitude constraint (49) were to be applied to the coefficients on the RHS of (59) and 303 (60), the coefficients w _f would be reduced modulo p and the structure (57) would be ace demolished

307 In practice, the integer N, as represented on the RHS of (59) and (60), should be treated

308 as a polynomial in some integer variable u, say P(u), where P( ) happens to be computed 3w at w— p .

sioNOTE 2: In (55) the representation of the coefficients

is arbitrary. In (59) and (60)

311 such coefficients are represented in base 10. They may be represented in any other base,

312 such as p

313 NOTE 3. It should be noted that in (51 ) p⁴ < N<p⁵ and in (55) A is being defined an modulo p . In general, such may not be the case. It is possible that A be defined modulo 3i5 a larger power of p, depending on the requirements of the problem on hand. A similar sis situation occurs in the domain of irrational numbers, such as J2.

may be computed

31 with a large number of decimal digits, depending on the precision required by the prob- 18 Iem on hand No harm is done if the precision of the computed value of J2 is greater

319 than needed

20 As an example, consider the case when p = 13 and N₁ <p . Assume that

321 Ng = v₀ + Vj ·r = 10 + 2’p . It is desired to solve 322 (mod p ⁵) (65)

323 In this case the integers w ₍ are defined by the following:

326 For w₀º6 (mod p), the result is

27 X 1 - 10 + 2 -p

3 (67)

= (181,200 + 18, 120 -p+ 1,291 -p + 23 ·r + 2·r⁴) (mod p⁵).

32b Compare with (59)

39 NOTE 4. As a further application of this method of representation of integers, consider MO the problem of computing A '(mod p) when A is defined as in (55), Let A * º w₀ + W_j -p + w_2‘p¹ + -p + w₄ · / (mod p ) (68)

and

A ' ºº 1 (mod p⁵) . (69)

The coefficients w should be defined as the least positive solutions of the following:

I

The product A - also contains the following terms:

vm. THE ROADMAP. 1) Introduction. Definition of M.

Given p and N_t select A as one of the solutions of (47) modulo p" , computed using the procedure described in Section VII. Assume A >pⁿ (64).

Then, using (35), let

where

Referring to (59), recall that each w can be represented as

Also,

and

Then 356

_{358 .} The representation (77) of r and s accounts for the fact that both r and s are

359 smaller than pⁿ , However, using (77), the product of r by s contains powers of p greater

360 than pⁿ , actually as high as p ^{" n ~ 2}.

61 In order to uncover the properties which relate the coefficients of (77), it is

₃₆₂ necessary to compute, and represent without loss of information, the multiples of any p

363 which results from the multiplication of r by s To this end a new modulus is introduced, 363 namely p^M , where

fi5

(78)

_36b It should be noticed that

67 1) Mis always odd

36¾2) If n = 2 k + 1, then M= 4 · + 1 .

see 3) The use of M does not affect the magnitude of N. If N < pⁿ , it can be represented

3₇₀ as follows·

₃₇₃4) When M is employed m lieu of n, A should be computed as a solution of the 373 following:

374 Aº 4²(mod p^M) . (80)

3 ¾ 5) s = S_Q and r > s₀.

6) A comparable result is achieved when T₀ is employed in lieu of r.

3772) The Approach

378 In the case where (79) is employed, reduction of (77) modulo p yields

38 Then, if the pair (m_l, ¾> is a solution of (81) modulo p, it is

382 The LHS of this congruence contains a contribution to the set of multiples of p ³.

38₃ This contribution is usually denoted as a“carry”. The flow of carries from one digit to

38 the higher powers of p increases the complexity of the factorization problem. The flow 383 of carries would be controlled better if (81) were solved modulo p^M and the pair 2 2

38 («_j, u₂) were defined modulo p . In this case (82) could take the following form:

This approach would require replacing the magnitude constraints (49) from the

3 elements of { u }

and assuring that the RHS of congruences such as (83)

390 include all the terms which are multiples of any given p . Following this procedure, still

3 1 there would be carries, as shown on the LHS of (83). However, such carries would flow

3₉₂ from any given congruence directly into a pool of multiples of p^M ,

393 The plan of this presentation consists of analyzing each of the terms of (72) with

394 the appropriate definition of A and resolving them into the sum of powers of p. Then,

395 for any given power of p , say p¹ , add all the coefficients of p¹ which are produced by ~2 - - 2 2

3 A — N,—2 ·A ·{A— U\ (A - Y) and -X and place the condition that their sum be

397 congruent to zero modulo p^M~ ¹. 2

9s3) _ The Integer A —N

399 Let A be defined as in (73), where the integers w _t are determined using the

400 procedure illustrated in Section VII Thus, for / < M,

02 where

(mod p)

403 (85)

(mod p²).

4M In fact, Nº T a (mod p²) and also Nº (o ₀ + w _j ·r ) (mod p²).

" 2

405 Consider then the integer A - N. As an illustration, refer to Figure 1. The 06 headings of the rows and columns represent the coefficients w _t of A . Multiplication of

₄₀₇ A by A generates the products w ₍ · w _} which are represented by the cells of Figure 1. Cells on any given line of slope 1 contribute to the coefficient of the same power of p. 0 Let LH₍ and RH₁ denote the LHS and the RHS, respectively, of the congruence 1₀ containing v_t . For i < M each (LH_i - RH_t) , multiplied by the corresponding p‘ , in contributes to the resulting polynomial a known multiple of p^M . In fact,

412 (mod p^M). (86)

—

413 For i > M , A contains terms of degree greater than p . The highest power

4i of p in A - is p . In fact, the highest power of p in A is p . After squaring,

2 2 _

₄₁₃ the highest power in this representation of A is p

say

M—j— 1

i = 1

420 The total contribution, for all / > 0 , is

422 As a conclusion:

423 1) For i < M, by (84),

(mod />"). (89)

32) For i = M each of the terms on the corresponding line of slope 1 is a coefficient

- M

426 01 /7 .

4273) For i > M each of the terms on the corresponding line of slope 1 is a coefficient Refer to Figure 1.

29 In particular, in the example (59), it is

3 4) The Relationship Between u₍ and u_{i- 1} when

(mod p)

₄₃₂ Consider the representation of the pair (r, 5) as in (77), where A is constructed

433 as described in Section VII, and Jl is used in lieu of n. Thus, when r is multiplied by s, it

43 is possible to group all the terms which contain any multiple of any given power of 7, say 3s p ' , and place the condition that the sum of their coefficients be congruent to zero modulo M- t

436 p

*' 2

437 However, by (84), resolving the integer A - N into its components, the sum of

w2

38 the coefficients of p in ( A— N) equals

41 As a result, consider the case when it is desired to express L>₆ as a function of all 442the u s 1 £ / < 5' and the vj s (2 £ j £ 5) . It will be -(2- w₀- ϋ₆ + 2·ά ! u₅ + 2.ώ₂· ϋ₄ + 2-w₃. i¾ + 2·w₄· u₂) + 2-u₂- u_A+

, 2

2 «i -«5 + 2- w₂-w₄ + w₃ (mod p

M This congruence defines u₆ modulo p^M~6 as a function of lesser degree

45 variables. If « ₍ ¹ 0 (mod p ) and if all the variables of lesser degree are known, (92)

446 defines a linear congruence between i¾ and u_s modulo p^{M 6} After the determination AA7 of u₆ , upon multiplication by p⁶ , it will be

448 (mod p^M), (93)

4« where LH₆ and RH₆ denote the LHS and RHS of (92), respectively. The LHS of this w latter congruence is a multiple of p^M and does not contain any power of p greater than hi

451 p .

452 In general, for 2 £ i £M- 1 ,

u,^0(mod p)

k = 2 k = 2 k = 1 5 The first summation on the LHS of (94) contains terms which result from the

55 multiplication of—2 · A by (A— Y), when A is represented as described in Section VII.

w 2

56 The second summation on the LHS results from A - Y) . 575) The Product 2 · ·(A - Y

8 Figure 2 illustrates the product A -(A - Y). The columns are headed by the is· coefficients v_t of p in Y The rows are headed by the coefficients w of p^J in A . loo Some of the cells represent products ώ -

which have been included in (94)

461 Refer to (92) as an example. As a further example, the cells on the line of slope 1 which

462 contains w ₀ · v_M_ _j and w _{w- 3} · u₂ represent coefficients of p which are employed 65 to write (94) modulo p .

46 The cells on the line of slope 1 which contains w _M_ ₍ · u₂ represent coefficients

465 of p^{M+ 1} and are not included in (94).

466 The highest power of p contained in 2 - A· (A - Y) is p , obtained through

467 the product of w _M_ , · p^M~ ¹ by u_M_ i p^{M~ 1}.

4686) The Integer (A— F)²

469 Figure 3 illustrates ( — Y) . Rows and columns are headed by the coefficients

470 v_t of m Some of the cells represent products of o_f · v_} which have been included in 4P (94). Refer to (92) as an example.

472 Since the largest power ofp in Tis p^{M~ 1} , (94) must also be written for 473 1— M— 1 . Then the LHS of (94) must include cells representing the products 7 v₂ ¾/-3_* °_{3 '} ^u _M~4_> ^etc- Cells representing coefficients of higher powers of p are not

475 absorbed into (94) and contribute to 2 ₀ , when å_Q denotes the sum of all the products

476 u_{{ * Vj}-p -p ^J which have not been absorbed as terms of any of the congruences (94). It 77 will be

+ 2 M- 2 2

R V - I'

₄₇₉7) The Integer X^2,

80 Figure 4 illustrates X¹. Rows and columns are headed by the coefficients u_t of 81 p in Some of the cells represent products w ·

which have been included in (94). sa Refer to (92) as an example.

83 Smce the largest power of p in is p^{M~ 1} , (94) must also be writen for 8 i = M- 1 . Then the RHS of (94) must include cells representing the products

_{4 5} , M3 - _{M- 4}, etc. The cells on the line of slope one which contains u_x · u _{i- x} 8b represents multiples of p^M . The cells on the line of slope one which contains u₂ - ^Uu- 1

₄₈₇ represents multiples of p^{M+ 1} . In general, let X₀ denote the sum of the products

488 u_t -u p¹ - p- which have not be absorbed as terms of any of the (94). It will be 89

«₁ Consider the case when u_M_ _l = 0 and u_M_ ₂ ¹ 0. In this case u₂ · u_M_ _j = 0.

492 Then the line of slope one containing multiples of p^{M+ 1} does not contain any cell which 93 has a coefficient of p^{M+ 1} dependent on u₂. Refer to Figure 4. If u_M _₂ ¹ 0, the sum of

A/+ l

9 the coefficients of p includes a term dependent on w₃.

5 IX. THE RELATIONSHIP

4 61) The Approach

4 7 Consider the general expression of (r, s ) (77). Multiply r by s modulo p . Using 496 (94), it will be

(mod ^M), (97)

soo where the LH_l and RH_i denote the LHS and RHS of (94), respectively

sol Therefore, 97) (98)

505

506 Recall that, when using (94), for / £M— 1 , the multiples of p^M produced by so? (97) do not contain any power of p greater than p^M . Thus, their presence on the RHS of see (98) does not interfere with the process of analyzing the coefficients of higher powers of

50 p.

510 A relationship between v_t and u_t can be produced by placing the condition that sit the carriers flow from any power ofp greater than p^M _t say p^M+J(j ³ 1 ) , to higher

512 powers ofp, say p^{M+J + 1} . This condition implies that the sum of the coefficients of any

513 power of p greater than p^M equal zero modulo p^J and no carry flows into

51 Starting from the highest power of p, observe that in (95) the highest power of p sis is p ². In fact, Y < p^M and the highest power of p in Y is p^{M 1}. After squaring, 5i6the highest power is p ~ . A similar situation occurs for A - TV, where

- 2

517

QM- 2 ^w M- \ · (99)

sis Concerning the product -2 A 'V_M_ _j , the highest power of p it contains is p ^{M 2} , with 5 q a coefficient

Then

520

22 As a result, 524 or

5

527 Consider (98) in the case when u_M_ _{j >} 0 and

. The

2 A/— 3 ~ 2

52s second highest power of in 2₀ is p ^' . The same is true in A -N. In

529 -2 · A ( A - Y ) the coefficient

530 Therefore,

531 ⁰

532 or

3 By (102), if u_M_ _j ¹ 0 and w_M_ ,— u_M_ _j = u_M_ _t , it must be 535 ^w M-2^~uM-2~ ^u M—2 (105)

536 At the next iteration, the contributions to (98) are the following multiples of

2 M-4

537 p :

S3! Therefore,

540

542 (107)

543 By (102) and (105),

544 ^w hi-3~°M-3 ^UM- 3 (108) 545 At every iteration the sequence produces a similar relationship between and

5 6 u_t . The sequence ends after it concludes that

547 ^w 2^{— u}2‘ U 2 (109)

548 In general

549 (110)

550 These conclusions were reached without interference from (97), which contains

551 multiples of p^M only. Indeed, the last equation in the sequence, the one which

552 produced (109), is an equation which operates on multiples of p^{M+ 1} . Refer to (94) and sis the illustration in Figure 3.

55 Consider the representation of the pair (r, s) as in (77) Substitution of (110)

555 into (77) yields

57 OG 558

5603) The Case when w _M- - v_M _ , = -u_M_ _j

sol Consider (98) in the case when u_M_ _} > 0 and _M_ _j - v_M_ _t = -u_M_ _j . In this

562 case (104) yields

565 ^w M-2~°M-2 —U M—2 (113)

5M Likewise, (107) yields

565 ^w M-3~^uM 3 = — U A -3 (114)

5₆₆ and, in general,

567 (115)

56* In this case, substitution of (115) into (77) yields 570 or

572 NOTE 1 : There are two sets of conditions which can assist in the solution of the factor-

573 ization problem. The first set are the congruences (94). If u_x ¹ 0 (mo p), for

5₇₄ 2 < i < M they establish linear relationships between u_t and u_{_ _j modulo p ^{4 1} when

5 5 the variables v_} and u_} of lesser degree are known Refer to the example in (92).

576 The second set are the equations (110) or (115).

577 Substitution of (110) into (77) produced (111) and (112). Substitution of (115) into (77) 5₇₈ produced (116) and (117).

579 NOTE 2· Using (111) or (112) to compute (r + s ) /2 and (r - s) /2 produce the same

580 results as (77). The benefit of ( 111 ) and (112) lies in the fact that, when r is multiplied by set s modulo p^M , the product does not contain any power of p higher than p^M . Also, except 582 for U_j , with u_x ¹ 0 (mod/7), (112) and (111) are linear functions which contain only the 583 set { ^u,} or { u_f } , respectively. Similar considerations apply to (116) and (117)

5M 4) The Case when u_{M- x} = 0

585 Consider the case when u_M_ _x = 0 In this case, equation (102) becomes 586 ® M— 1 ^{— V}M- 1 ⁼ ® · (118)

sg7 Therefore, no information can be produced using (104). However, (107) yields

588 ¥ M-2 ~ ^VM- 2 ^{± u}M- 2 (119)

5S9 If u_M_2 ¹ 0 , the process can be continued until it concludes that

590

® 3 - ^y3 « 3 (120)

591 or

593 In fact, if u_M_ , = 0 , w₃ - p³ is the lowest degree element which, when multiplied by sw ^UM- 2 ' P^{M 2} _> produces a multiple of p^{M+ 1} . Again, there is the possibility that u_M_ ₂

595 be zero. In this case (110) or (115) are applicable only when i equals or exceeds 4. The

596 situation is illustrated by Section VIII.7 and Figure 4.

597 In general, assume that ΐ _cm 0 modulo p and _M-j = 0 for 1 < j £ j_Q . Then

598 (110) is applicable only fo

2 . In these cases the general expression of the pair

5 9 (r, s') is GOO

002 Compare with (111) Also, in this case, (112) becomes

60

605 Similarly, if (93) is used in lieu of (110), (116) is replaced by

60G

08 and (117) is replaced by 09

ii Notice that a priori there is no knowledge of whether u_M_ _j is or is not zero. Thei2 same is true for w_jtf_2 , etc. Therefore, at this point, /₀ is an undetermined integer. 13 NOTE 1 : When using (124) and (122), the pair {r, s) is dependent on the set { u_t} andH on the first elements of { u_{ } , for 2 < / £j_Q + 1 . In such cases, the general expression of15 ( r, s ) is

17 where ei<) OG

621 where

e**X. THE PROCESS

6M 1) The Case when u_M _ _l ¹ 0 (y₀ = 0)

1.1) Overview

62G Consider the case when u_M_ _j ¹ 0. In this case (111) becomes

If

(mod p)

(131)

(mod p) ,

M

multiplication of r by s modulo p yields ·

Let ί// (132), and L//(132), denote the RHS and the LHS, respectively, of that congruence in (132) which is defined modulo p^{M t} . Then, it must be

(mod p^{M~ l}). (133) 636 Define

637

RH (132), -LH (132),

6ΐ C (132), (134)

M- i

P

639 There is one condition which is not contained in (132): that is the condition that MO the sum of all the multiples of p^M in the system be equal to zero Specifically, refer to

, the highest power oip is produced when (w _j- u_x) p is multiplied There are other multiples of p^M in the system, specifically Q · p^M , and the integers C(133), · p^M for i³ 2. (Refer to (87) and (91)). e sum of all the coefficients of p^M , it must be

6161.2) Tidbits

647 NOTE 1 : Refer to (77). By (7), X< N. The magnitude of the integer X is not depen- 646 dent on the representation of N. If N and X were represented in base p, and X were to M9 approximate closely N , it would be 0 < u_M_ < p and one of the two factors of N would 650 approximate closely 1

651 NOTE 2. In general, the integers N₀ are pre-screened to test divisibility by the first ele-

652 ments of the sequence of primes. Thus, it is reasonable to assume that in all cases 653 «_{Aί- 1} = 0 . Recall that the representation of U as in (73), where { u_t} are p^{M 1} - con-

65 strained positive integers, offers many degrees of freedom and no practical limitation on

₆₅₅ the magnitude of U results when u_M_ _t is set equal to zero. In fact, any integer U can be

656 represented by a multitude of selections of the set ( K ,

657 NOTE 3 There is a peculiar situation when the pair (r, s) can be described as in (130).

- 2

ess Consider the case when v₀ is a perfect square, say v¾ = A_Q <p . In these cases w ₀ is a 659 small integer and w ₀ = A_Q Then the second of (130) yields

eel Some cases were observed when v_Q= A₀ <p, s was two digits long in base p and u_{M- l} 662 was nonzero.

_^ 2 2

663 NOTE 4: In this presentation it will be assumed that w₀ >p .

6 42) The Case when /„ = 1 (u_{Af- J} = 0 and u_{M- 2}¹ 0)

2.1) Overview

666 Consider the case when it has been assumed that

_x = 0. It is desired to

667 determine a pair of divisors ( r , 5) when u_M_ ₂ ¹ 0 , if such a pair exists. In this case 6 8 (126) and (128) can be written as follows:

_^ 670 where

672 and

674 where Ac = w₀ + w_i · r (140)

and where z₂ is defined as in (129):

Compare with (128) and (129).

Using (139), multiply r by J modulo p^M . Setting the sum of the coefficients of any given power of p congruent to zero (mod p^{M 1} ) yields

^UM- 2 ^¹ 0

Let Aίί(142), and LH (142), denote the RHS and the LHS, respectively, of that congruence in (142) which is defined modulo p^M~l . Then, it must be

RH (142), LH (142), º0 (mod p^U '). (143)

Define

RH (142 ) -LH (142),

C(142), (144)

M-t

P

There is one condition which is not contained in (142): that is the condition that 689 the sum of all the multiples of p^M in the system be equal to zero. Specifically, refer to

690 (139). If 2 ¹ 0 _> the highest power of p is produced when z · p is multiplied by

The other multiples of p^M in the system are Q p^M , h ₀ ·r^M, h _j -p^M 692and the integers C( 142)_t p^M . Then, equating to zero the sum of the coefficients of 693 p^M _t it must be

ess Refer to (88) and (91).

2

69b In this equation the integer

defined modulo p by the second last congruence of

697(142).

698 Also, in the computation of C (142) _M_ _j , the integers w_Ai-2 and w_{A/- 3} equal esq the corresponding values in the second last congruence of (142)

700 The set of congruences (142) can be referred to as a SUPERCONGRUENCE.

7012_*2) Tidbits

702 1) Subject to the condition (131 ), if (142) and (145) do not admit integer solutions,

703 there does not exist an integer r which can be described as in (142) and such that r| / . 012) The system (142) consists of M congruences Given the selection of an integer

70s «_j <p , the third congruence of (142) defines a corresponding value of o modulo

7073) The selection of an integer u₂ <p defines

70S z₂ 0⁾ ₂— L>₂ ~ ^U ₂ · (146)

709 Refer to (141). 7104) The solution of the fourth congruence of (142) produces a corresponding u₃.

7P 5) The last congruence of (142) verifies the compatibility between u_{M- 2} and

_j

712 and causes a paring down of the roster of candidate pairs (w u₂) .

7₁₃6) If the system (142) produces a candidate pair («_j, u₂) . the viability of that pair 7M should be tested using (145). Of course, (145) can be satisfied only if

716 Refer to (87). 17 NOTE 1 : To expedite the execution of ( 142), observe that each one of the higher degree

718 congruences of (142) must hold true if they were reduced modulo p². Therefore, (142)

719 could be reduced as follows:

^uM-2 ^¹ 0

In (148) each congruence produces a carry which must be added to

i < M- 1 the carries produced by the congruences (148) are

The total of these carries must satisfy the following:

+ 2 - ₂ -u_M-2(mod p) .

72D Notice that the magnitude of M does not burden the execution time of any of the

727 congruences of (148). However, it determines the NUMBER of such congruences and

728 the time required to execute the addition of M two digit numbers (which are represented

729 in base p).

7902.3) A Test

m Consider the case when the true divisors of N_Q , say r₀ and 5₀ , are known. Then,

732 after the computation of T_Q,N_Tf> and the definition of M, the system (142) can be set into

733 place.

7₉₄ If the true solution pair (r₀, j?₀) were known, it would be

795

(mod p ), (151)

736 and the pair (W_{j j},u_{2 I}) would be an element of the set of pairs which satisfy (142).

7₉₇ (Table I).

7₉₈ In general, such is not the case.

779 The contradiction can be explained by observing that, given V₀ , the set of

740 feasible pairs represented in Table I is dependent on the prior definition of M. Should 4₁ M be replaced by some M_x = M + 2 - m_x (m_x integer > 0) , the set of feasible pairs in

_{7 2} Table I would be different

3 Since J_Q is not known, the situation can be addressed by exploring independently

7₄ all the possible definitions of (148), each one associated with a distinct value of M. TABLE I -PART 1

M = 4097

M - 1 > 2 - «r_o-2

b?₀»4.78 x 10⁷⁴⁸

a?_!* 3.765 xlO⁷⁴⁸

*4.11 x 10⁷⁵²

7₄₉

75 TABLE I - PART 2

751 Feasible

752

7532.4) The Periodic Components of (148)

54 Consider the case when M has been defined using (78) In this case the system 755 (142) consists of M congruences The LHS of the last n— 1 congruences is congruent 756 to zero modulo p^M~^S . Thus, if n ~ 1 < i < M- 1 , it is

2

757

(mod p ). (152)

75b Notice that the coefficients w₀, w^—u^ , and z₂ , after reduction modulo p , do 7 0 not depend on i, but depend on the selection of the pair (u w₂) ,

7B0 Thus, the system (142) contains a sequence of components which are related to

₇₆₁ one another as follows:

762

7 m To clarify the role of the integer p - 1 , assume that (142) is satisfied. Then, if

767 and

768

770 whence

?72 In a similar fashion,

774 Similar relationships can be developed to relate u_{M- l} to u_{M- 2} modulo p

775 Such relationships contain two terms As i increases, both terms display a periodicity of

776 p— 1 , or its divisors.

777 Thus, given a selection of the pair

u₂ ) , the specific embodiment of (142) for

778 a given M can be related to a corresponding embodiment for Af — M+ k - (p - l) for

779 some integer k. Recall that, if M is increased by p— 1 , the number of congruences in 780 ( 142) is increased by p— 1 .

7812.5) A New Definition of M

82 The variability of M can be reduced by observing (24) and (41). Consider a

783 process which evolves (24) into (41). Assume it can be iterated into higher powers of p 783 until the resulting product r -

exceeds the corresponding N. The process could end at

785 that point and would offer a conclusion on the viability of a, U_{\ \} and the subsequent

7 6 sets of (U_t , V₂ ,) variables

87 Notice that in (32), after multiplication of r by J₀ , the highest power of p in the

_* 4 S 2*

788 system is p . In (37) it is p . In the subsequent iterations it would be p for k > 2.

789 Thus, it is reasonable to select

791 or

792 (159)

793 Compare with (78).

7 1 .6) Privileged sets of exponents M

795 Consider the case when an integer A: - (p— 1) is added to M. It is desired that the 796pairs («,, u₂) be proven still viable when Mis replaced by M_l = M+ k - (p - l) . This

797 condition can be satisfied if both L/_j and M satisfy (159).

9₈ In this case, 2^A + £ · 4 · ODD = 2^J (160)

800 OG

802 where

803 k - 2^{h ~ 2} _* k’ . (161)

804 If p - 29 = 4 - 7 + 1 , the condition is satisfied when k' = 1 and j ~ h = 2 . «os For the example of Table I, Table II shows the feasible (w₁ u₂) pairs for a eo6 sequence of values of M which satisfy (159).

807 Table III discards the

w₂) pairs which are not confirmed when M— 1 is

3

so* multiplied by p .

800 Table IV shows an example of confirmed pair when p = 61.

810 Table V shows the values of k ' and p^{J ~ h} for a set of primes of the form eii p = 4 ODD + 1 .

S12

TABLE II - PART 1

3

814 Feasible (u_{j |}, u_{2 j} Pairs for the Example of TABLE 1 with Increments of A/by 2

3 g7 Feasible (u_{j lt}u_{2 i}) Pairs for the Example of TABLE 1 with Increments of by 2

TABLE III

Example of Confirmed (U_{j lt}u_{2 j} ) Pairs in Table II

TABLE IV

Example of a Confirmed («, _[, u_{2 l}) Pairs with Increment of M by 2 for/? = 61

N₀ = 100301963155829713685288333

= 165636239140789-605555666297

M~ 4097

82G

827 TABLE V

828 Examples of Privileged Sets of Exponents

829

83ONOTE 1 : The periodicity of (148) is dependent on the periodicity of the two coeffi- 831 cients of u_{M- 2} in (157). If both coefficients have periodicity p - 1 , the resulting pen- ₈₃₂odicity of (148) and M are illustrated by Table V.

833 However, in general, each one of the two coefficients of u_M-2 may have its own

8 4 periodicity, which equals any one of the divisors of p - 1 .

835 Table VI shows a case when p = 29 and the integer 2^{J h} of Table V is replaced by 2* .

8362.7) The Determination of U_{l 2}

837 The system (142) has been developed without placing any condition on the sis magnitude of U_j , u₂ , and the subsequent u_t's . It is useful to explore the case when

839 and «2 are defined as follows 0

1 TABLE VI

2 Example of a Different Periodicity of M for p = 29

N₀ - 100301962714574772614226437

= 165636239140789 - 605555663633

w_i * 9.57 x lO²"⁴

A * 2.86 lO²⁹"

8 6 Consider the system (128) when /₀ = 1 , In this case the general expression of s

847 IS

8 9 If the pair («, , , u_2, ,) were substituted in lieu of

u₂) , it would be 2 3

850

(mod _/? ) (164)

851 If the pair (t _{j 2}, t/_{2 2}) were substituted in lieu of

u₂) , it would be

852

(mod p) . (165)

853 If u 2 ¹ 0 , reduction of (165) modulo p would produce a congruence which is not

85 consistent with (164). Therefore, U_{j 2} must equal zero.

ess 2.8) The Determination of U_{2 2}

856 Consider the case when, given M, the systems (142) and (148) have produced a 857 set of viable pairs (« _{j i} , u_{2 i} ) . Such pairs define viable expressions of s (mod p³).

4

858 It is desired to define corresponding viable expressions of s (mod p ).

859 This can be accomplished by defining that value of U₂ 2 which satisfies both

860 (142) and the corresponding condition on the carries. For this purpose:

861 1) Substitute a candidate U₂ 2 into (142) in lieu of u₂ .

862 2) Define the integer

864 and substitute it into (142) in lieu of z₂ - sea Notice that after these substitutions, every selection of U_{2 2} satisfies (142). see However, the pair

feasible only if there exists at least one value of u_{2 2} 867 which satisfies the condition (147) on the carries modulo p

see To produce the solution u_{2 2} , it is convenient to use an approach similar to (148) sea Specifically, after replacement of u₂ 1 by f/₂ 2 _» all the congruences of (148), with the 870 exception of the last two congruences, can be reduced modulo p yielding

2 3

Q (mod P )

_* — 3

· w ₀· w I (mod p )

2 _^2 - 3

«i + w_i + 2^•i^y _0* ^' ₂2⁺2 -fi>₀-u₂ (mod p )

w₀· W₃+2 (w _i- ₁)-u₂+ 2 ·w_i·z_2>2(ihoά p³)

6⁾Q’U₄+ 2 w _t -U_j) -t₃+ 2 i’2,2'^u2⁺^2,2(^°^ ³) for i> 4

·w₀·ί/,+ 2 (¾!-«_!)·«,__!+ 2 _{2 2}· w,_ (mod p³) vA/-3= ^{2 *} "o^{' W}A/-3^{+ 2} (" I - »l) · «L/-4 + ² 2, 2^‘uA/-5(^mod )

^VM- 2=² -"0-^uA/-2⁺² · (*> 1— Mi) -¾_₃ + ^{2 '} ₂,2-^wA/-4(^mod L

^-1 = 2- ("] - »i) -«M-2 ^{+ 2} 2.2^{‘ U}Af-3 (^m0d P) ·

Correspondingly, with the exception of the last two congruences, the carries should be defined as

and the condition (150) can be restated as follows 877 NOTE 1 : Compare two different expressions of s (mod p⁴) :

878

880 and

881

(mod p⁴)_„ (171)

883 Then

884

(mod />) (172)

ess Recall that L>₃ can be computed using (94).

see Table Vff shows the resulting

i) triads for the example of Table III. TABLE VII

Confirmed (w_{j j}, «_{2, i*} ^u3, i) triads for the Example of Table III

89₁ NOTE 2: In general, the execution of (167) and the corresponding (169) produce only

892 one candidate value of H₂

some cases, more than one value results. In these cases, ess all the corresponding value of U_{2i 2} must be explored.

8942.9) The General Case

8 5 After the determination of

2 _> ^a similar procedure can be employed to 8 0 determine U₂ , where

898 and

899 ~~^U2, 3 = w₄— L - w₄(mod p) . (174)

^goo In this case the moduli of (167) should be increased to p and the corresponding 01 carries (168) should be adjusted accordingly. The resulting condition on the carries

902 (169) would be computed modulo p .

«a Thereafter, the procedure can be iterated to determine the higher components of

904 U.

905 Each step would propose a new value of s as a candidate divisor of N_Q . If none 0 of such steps offers a divisor of

, the initial (u_{j j}, u_{2 j}) pair must be discarded.

9072.10) Execution Time

908 This section contains an estimate of the upper bound of the time required to ^goo factor N using the procedure just described.

910 For the purpose of this estimate, it will be assumed that elementary arithmetic on operations require a time of an order not exceeding log_p N, where p denotes the base of 912 representation of N. 911 The same can be assumed for the computation of multiplicative inverses, other an linear congruences and square roots.

15 The proposed algorithm requires repeated execution of supercongruences such as 16 (142) or (148). These systems consist of M congruences which are defined by a modulus

917 as high as p^M . Thus, their execution can be assumed to require a time of the order of

918 Af* .

91 Usually (142) is executed for the purpose of identifying the feasible values of a

920 particular variable. Such is the case when (142) is executed to identify the values of 21 «2, 1 which are consistent with a known u_{x j} . Thus, the execution time of a

922 supercongruence is p M .

23 Accounting for the variability of u , and a, the production of all the feasible requires a time of the order of p³ L/³.

BLE III, it can be concluded that the number of feasible triads

the order of p - .

7 After the determination of the feasible pairs (w_{t x}, u_{2> t}) for a given a, such 928 pairs are employed to determine the corresponding sequence of u₂ s . The

29 determination of all «'s for a given or requires the execution of as many as log^, N₀

910 supercongruences. Thus the execution time for all or would be of the order of

32 In particular, when p approximates the value of M, execution time is of the order

933 of p .

9343) The Case when

353.1) Overview

9 6 Consider the case when a roster of candidate pairs {( E/^ i, U )} has been

937 determined and none of the corresponding pairs (r, s ) represent divisors of N. Thus a 8 new variable, z₃ , can be introduced. The pair { ( t i_{, i} ,

i) } is feasible only if there 39 exists an integer z₃ such that, MI Notice that in (175) u , u₂ and z₂ are known integers, say «₍ , «₂ and z_z .

M2 Multiplication of r by s modulo p^M yields:

_{L- f-3 3 W-4} p 944 For each initial selection of the pair (u_j, u₂) , the system (176) may produce a triad

4

945 («,, «2, ^*3) such that r -sº N (mod p ). 63.2) Determination of u₃ (mod p) using (176)

element of the roster { (w_t, w₂) } representing a solution of (142), say

4), compute u₃ (mod p ), say L>₃ J The same result can be

0 obtained by observing that in (176) the congruence which is defined modulo p^{M 3} can 51 be written as follows·

953 This congruence does not contain w₃ and allows one to determine L>₃ J modulo p^{M 3}.

954 STEP 3: To compute an integer w₃ (mod p) which satisfies (176), select an initial value ass of w₃ (mod p), say w_{3 1} .

95b STEP 4: Compute a corresponding value of z₃ , say z^i , where

ess STEP 5: Substitute U\ _j , i/2, 1 and ^*2 in lieu of U_j, u₂ and z₂ into (176). Also,

959 substitute in lieu of z₃ into (176). Solve the congruences (176) starting with the 9w condition on v₄ and proceeding to the condition on v_{n - 3} (mod p ). The last two i congruences of (176) verify the consistency of

with the corresponding LHS’s, 62 which are defined modulo p and modulo p, respectively. In the event such a

963 consistency is satisfied, a value of u_M_ ₃ (mod p) is produced and w_{3 1} is validated.

964 All possible selections of u_{3 1} must be tested If no selection of w₃ , satisfies (176) for 965 the given pair ( u _{j i} , 11 _> then such a pair must be discarded.

9663_*3) Validation of u_{2 2}

967 The integer u_{3 j} produced by (176) should be consistent with the value of

₂ 68 produced by (167) However, there are many selections of («_{j x}, u₂ ,) which, by (167), ««a produce a corresponding w₂, 2

do not produce any corresponding «_{3> j} .

070 Thus it appears that (176) is more severe than (167) in the determination of «₃ , .

971 Therefore, it is possible to execute (176) for all the confirmed pairs («_{j j}, u₂ 1

972 which survive (142) and are listed in TABLE III and produce a corresponding roster of

973 viable triads

974 This step depopulates TABLE III drastically. Compare TABLE VII with TABLE

975 VIII.

TABLE VIII

Example of Feasible (u_(> ,, u₂ ,, u_{3, j}) Triads for Increasing M and p = 29 using Supercongruence (176)

TABLE IX

Calculation

Calculation of u_{2 n}

Calculation of u

This corresponds to the factor s₀ = 605555653519.

9383.4) Execution Time

89 After the depopulation of Table VII into Table VIII, the algorithm of Section 2.9

990 can resume and determine the appropriate u_{2 j}'s , for all i > 2. For the example of Table 911, Table IX shows the resulting values of

₍ and u_I for all / > 2

9₉₂ The benefit of the validation of u_{2 2} is the reduction of the total execution time

9 3 by a factor of approximately p, thus reducing the total execution time to approximately

6

994 p .

995 XL AN ALTERNATIVE APPROACH TO THE HIGHER POWERS OF p 961) The Approach

997 Consider the case when the triad (a, U_{\ \} , ¾ 2) is a solution of (142) and (150), 9 S when JVis defined as in (37) and Mis used in lieu of n₀.

9 In this case, it is possible to compute r₀ modulo p as

1000 r o T_Q * r (mod p⁴) (179)

looi where

1002

(mod p⁴) . (180)

loos Define r_{0 2} as the least positive solution of the following:

loos Define T₂ as the least positive solution of the following:

1007 If T₂ is odd, define

1008 N₂ = T₂ - N₀. (183)

1000 Define A₂ as a solution of the following

1010 N₂ º A₂ (mod p^M) . (184)

1011 Then the general expression of the pair ( r_ts ) will be

ion for some integers U(T₂) and V(T₂) .

ion Compare with (41). 2 4 ids Notice that (41) and (185) operate on rectangular lattices of sides p and p . Compare ids with (24)

1017 NOTE 1 : The integers u₂ and U(T₂) are related to each other. In fact,

T$ = N_Q - a ²(mod p^M)

1013 (186)

T₂ = N< r₀ ^“¾mod p^M)

1019 and

1020 U (f₂) º T₂ · TQ - ¼,2 (mod p⁴) (187)

1021 Thus ί/2,2 ^a known quantity, and the solution of (183) follows the pattern of (142). j _n _ I

1022 NOTE 2: In (142) the congruences modulo p and p do not depend explicitly on

1023 the variables of the system ( u_t and D₍ ), because such dependence is embedded in the IO2 definition of N. Likewise, the four highest degree congruences

io s (say p^M ,p^M p^{M 2},p^{M 3} ) do not depend explicitly on the corresponding vari- io G ables

1027 X11. THE CASE WHEN it_{i B} 0(mod p )

1028 Consider the case when N_Q is known not to be a prime number, and the algorithm

1029 does not determine any divisor of N₀ for any a and for u_l fi O (mod p). 10 0 It has been observed that, given p, this situation occurs in less than 1% of the

1₀₃₁ integers under test.

1032 The problem can be addressed by defining T₂ as a solution of the following:

1033 N_Q = T₂ · a { mod p ) (188)

low and restating (185) accordingly. In this case, a solution of (185) may exist only if is U(T₂) ¹ 0(mod p²) .

10₃₆ One possible strategy is to select a different prime, say p’ , relying on the low

1037 probability that w be congruent to zero both modulo p and modulo p' . Of course, it is mis also possible to execute the proposed algorithm in parallel using both p and p' .

10» xm. THE CASES WHEN w] - u\ =0(mod p) two A similar situation may occur when eo_l ~ _{l º}0(mod p) . This situation was

1041 observed in less than 1 % of the cases under test Again duplicating the algorithm using a

10₄₂ different pnme may solve the problem.

1043 XIV. OTHER SINGULAR EVENTS

1044 A variety of rare, singular events occur occasionally. Some of the Tables

1045 presented in this document describe unexpected events Gradually, such events are being io b understood. All of them can be sidestepped by changing the selection of p

1047 Fundamentally, the proposed representation of integers and the resulting

10 8 management of the carries offer a primary avenue towards the control of the factorization

10 9 problem. 1050 APPENDIX

1051 A NOTE ON CONGRUENCES WITH TRUNCATED VARIABLES

1052

1053 Consider the linear congruence

1054 A - x + B - y º C (modp²) (A.1)

loss where A 0(_jnodp) and B_j 0 (mod p) ,

1056 Let

105» Consider the case when x and y are constrained by the conditions that lose 0 £ x₀, y₀ £p - 1 and also X_j = 0 and y_x = 0. In other words, x and y are“truncated” _looo modulo p

loti To solve (A.1) under these constraints, let C— c₀ + c_l p and solve

1062 A - x + B - y º c₀ (mod p) . (A.3)

1003 There exist p solution pairs (*ø,_,>¾) f°^r this congruence. For each solution pair, low compute the integer 1065 l ·r = A - X_Q + B y₀ -c₀. (A 4)

io6b Depending on the value of c _j , there may be one or more solution pairs which

1067 satisfy

ltiGR (A 1), even though x and y are truncated modulo p. Also, in some cases, there is no loos solution pair for which l º C_j(mod p) .

1070 The situation is illustrated by Table A.I, which shows the case when

ion p ^~ 29, A = 38, B = 41, c₀ = 2, = 13

1072 The example illustrates the fact that a pair

y₀) , which was truncated modulo

2

₁₀₇₃ p ₉ may satisfy a congruence modulo p _*

1074

1075 TABLE A.l

1076 Example of Truncated Linear Congruence

1077

1078 iP= 29, A = 38, 5-41, c₀ = 2, c, - 13)

1079

1080

1081

10 REFERENCES (All of which are incorporated by reference, herein)

1083

1084 [1] C. F. Gauss, Disquisitiones Arithmeticae , New York, NY: Springer- Verlag, 19S6. loss [2] R. L. Rivest, A Shamir, L. Adleman,“A Method for Obtaining Digital lose Signatures and Public-Key Cryptosystems,” Communications of the ACM, Vol. 21 , pp 1087 120-125, 1978

ss [3] G H. Hardy, E. M. Wright, In Introduction to the Theory of Numbers, Oxford, U. 3089 K.,

1090 The Clarendon Press, 1979.

109 i

1092 Following is a list of relevant features of the invention.

The present invention pertains to a method for decoding an encrypted

1094 electromagnetic signal W representative of a message encoded by a first computer with _loos public key N₀ = r x s , where N₀ , r and s are integers and W is a function of r and s. low The method comprises the steps of storing the signal W in a non-transient memory.

1097 There is the step of decoding with a second computer in communication with the

1098 memory the signal Win the memory with the second computer generated steps of

1099 selecting a prime number p of the form _jt = 4& + 1 for an odd integer £ such that the

1100 public key N₀ is a non-quadratic residue modulo p, calculating w₀ satisfying the

HOI inequalities p < N_Q <p ⁰ computing N = tN₀ with a selection of r such that Wis a

1 102 quadratic residue modulo p ⁰ ; calculating n satisfying the inequalities p^{n l} < N<pⁿ P03 and calculating a solution to

1104 Nº A^2" (mod pⁿ) (189)

nos by using the representation

1107 where w₍ satisfies the condition nm There is the step of decrypting with the computer the signal W with the public mo key N₀ and the prime factors of integer N₀. There is the step of displaying on a display mi by the computer the decrypted signal W. There is the step of reviewing the decrypted m2 signal W to determine if the decrypted signal W indicates an act has occurred or will m3 occur that violates a law, or will violate a law.

mi There may be the second computer generated steps of defining M = 2 + 1 , for ms N ~ r x s with r > s , take the solution 1 and construct relations

in? with U, V as unknowns; forming a set of Supercongruence equations by matching ms coefficients of /V and coefficients of (A + U x p - Vx p )(A - U x p—V p ) , the set of ins Supercongruence equations establishes M relations m terms of M, 'S and v₍‘s, which are

1120 coefficients of U and V respectively; performing steps 1-4 using the Supercongruence mi equations where steps 1-7 are as follows

1122 1) Testing feasibilities of digits u_x‘s and i/₂‘s.

1123 2) Calculating carries by tallying differences on two sides of the

1121 Supercongmence equations

1125 3) Using carries to identify subsequent digits given a feasible pair of u _x and u₂ by mo using Supercongruence equations again

1127 4) Using the Euclidean algorithm to test whether A + U x p - Vx p is a divisor

1128 of N_Q .

1129 There may be the step of enablmg the alerting of a government agency to prevent 1130 the act that will occur to prevent physical damage or bodily in_jury to a person occurring mi The steps described herein allows for the ability to alert a desired government agency if a

1132 review of the decrypted signal W indicates that an alert is warranted.

ip3 By using the methods described herein, N₀ is factored m time O ( log⁶JV₀) . This

1134 speed is important, which only the operation of the second computer performing the

11 5 second computer generated steps can achieve, because by havmg this speed for

11 6 factoring, the signal W representative of a message can be effectively decrypted and

1137 deciphered in real time so any threat to property or individuals can be quickly acted upon

1138 to eliminate the threat before it occurs and actual damage to property or injury to

1139 mdivi duals is prevented or mitigated. In other words, for W to be effectively understood,

n 40 it must by decrypted fast enough that any threat identified m W can be stopped. The

ini present invention with the use of the second computer allows for this capability. Here, it

P42 is inherent that to save lives if required, the second computer is required.

P43 There may be the step of obtaining the electromagnetic signal W representative

11 4 of a message from a telecommunications network, or a data network or an Internet or a

11 5 non-transient memory Law enforcement departments, such as Homeland Security, the

ins FBI, the CIA, NS A, state and local Police or the Military have the well-known capability

1147 of obtaining or intercepting messages sent encrypted by a first computer operated by a

ins potential terrorist or criminal as an electromagnetic signal, such as by smart phone or

₁₁₄₉ computer or internet, or stored in the memory of a smart phone or computer, or a flash i use drive. The encrypted electromagnetic signal W can be extracted from such messages or

1151 memories and operated upon by the techniques described herein to decrypt the encrypted

1152 messages and read them to determine whether there is any violation of law or threat to

1153 property or individuals Of course, the intended recipient of the encrypted message W

1154 by the first computer has the key so the recipient can decrypt the encrypted message W

1155 the recipient has received and understand it It is the object of this invention, and the

use problem this invention solves, to allow a recipient of the encrypted message W who does

P57 not have the key to read it, to determine what the key N_{Q i}s by the techniques described

1158 here, and then using the determined key N_Q , decrypting the encrypted message W,

l_isa reviewing what the decrypted message says, and acting as necessary to protect property

i_lea damage or bodily injury or any type of crime, as deemed appropriate. 1161 The present invention pertains to a second computer for decoding an encrypted

1162 electromagnetic signal W representative of a message encoded by a first computer with ii63public key N₀ = r x s, where N_Q , r and s are integers and W is a function of r and s,

116 comprising-

1165

nee a non-transient memory in which the signal W is stored,

1167

1168 decoding with a CPU in communication with the memory the signal Win the lies memory that decodes the signal W by the second computer generated steps of selecting a

1170 prime number p of the form p = 4A + 1 for an odd integer k such that the public key N₀ mi is a non-quadratic residue modulo p; calculating n₀ satisfying the inequalities

< N₀ <p ⁰ computing N = TN_Q with a selection of t such that //is a quadratic

1171 residue modulo p ; calculating n satisfying the inequalities p < N <p ; and i calculating a solution to

1175 Nº A² (mo dp") (193)

lire by using the representation

1178 where w₍ satisfies the condition 1179 0 < a_t <p , (195)

use the CPU decrypting the signal W with the public key N₀ and the prime factors of integer Me_l N₀ ; and a display on which the decrypted signal W is displayed so the decrypted signal

1182 W can be reviewed to determine if the decrypted signal W indicates an act has occurred lies or will occur that violates a law or will violate a law. The display can be a computer

1183 screen or smart phone screen or any screen or piece of paper on which the decrypted nes signal W is printed or any medium on which the decrypted signal W can be reviewed, use The CPU of the second computer may perform the CPU generated steps of

U₈₇ defining M = 2 + 1 for JV₀ = r x s with r > s, take the solution 1 and construct nee relations

iiTO with U, V as unknowns; forming a set of Supercongruence equations by matching Hoi coefficients of TV and coefficients of A + U x p ~ V x p )(A— U x p - V x p ) , the set ii92of Supercongruence equations establishes M relations in terms u₍‘s and v₍‘s, which are

P93 coefficients ofU and V respectively; performing steps 1-4 using the Supercongruence

119₃ equations where steps 1-4 are as follows:

nos I) Testing feasibilities of digits u 's and u₁ ^t s.

1196 2) Calculating carries by tallying differences on two sides of the

1197 Supercongruence equations.

nos 3) Using carries to identify subsequent digits given a feasible pair of u , and u₂ by imusing Supercongruence equations again. la» 4) Using the Euclidean algorithm to test whether A + U x p— Vxp is a divisor

1201 of N_Q

1202

1202 N₀ is factored by the CPU of the second computer in the time O ( log⁶JV₀).

1204 The present invention pertains to a non-transitoiy readable storage medium

1205 which includes a computer program stored on the storage medium for decoding an

1206 encrypted electromagnetic signal W encoded by a first computer with public key

1207 N₀— r x s , where N₀ , r and s are integers and W is a function of r and s, where the

12 8 signal W has been stored in a non-transient memory of a second computer, having the

1209 second computer generated steps of.

1210 Selecting a pnme number p of the form p = 4k + 1 for an odd integer k such

1211 that the public key N_Q is a non-quadratic residue modulo p ; calculating n_Q satisfying the

1212 inequalities p ⁰ < N₀ <p ⁰ computing N = TN_Q with a selection of t such that W is a

1213 quadratic residue modulo p”⁰ ; calculating n satisfying the inequalities p^{n ~ 1} < N < pⁿ ; i2]4 and calculating a solution to

1215 Nº A² (mod p") (197)

1216 by using the representation

1218 where w_t satisfies the condition 1219 0 < <y₍ < p ^{1 1} (199)

1220 There is the step of decrypting with the second computer the signal W with the

1221 public key N₀ and the prime factors of integer JV₀. There is the step of displaying on a

1222 display by the second computer the decrypted signal W. There is the step of reviewing

1223 the decrypted signal W for predetermined words to determine if the decrypted signal W

1224 indicates an act has occurred or will occur that violates a law, or will violate a law. It is

1225 well know in the art to search for words, such as bomb or gun, to flag a message for i22f> further review for possible action, as deemed appropriate.

1227 The computer program may have the second computer generated steps of

1223 defining M ~ 2 + 1 for L¾ = r x s with r > s , take the solution 1 and construct i 2<) relations

1211 with U, Fas unknowns; forming a set of Supercongruence equations by matching «.w coefficients of Nand coefficients of (A + U x p - Vx p )(A - U x p— Vx p ) , the set 1233 of Supercongnience equations establishes M relations in terms of u_t‘s and v,‘s, which

12.4 are coefficients of U and V respectively; performing steps 1-4 using the

12 5 Supercongruence equations where steps 1-4 are as follows:

12.6 1) Testing feasibilities of digits u_x‘s and u₂ s.

1237 2) Calculating carries by tallying differences on two sides of the

1233 Supercongruence equations.

i2 !i 3) Using carries to identify subsequent digits given a feasible pair of u _j and u₂ by ] 240 using Supercongruence equations again.

2

1241 4) Using the Euclidean algorithm to test whether A + Ux p—Vx p is a divisor

1242 Of N_Q .

1241

124 Although the invention has been described in detail in the foregoing

1245 embodiments for the purpose of illustration, it is to be understood that such detail is

12 6 solely for that purpose and that variations can be made therein by those skilled in the art

1247 without departing from the spirit and scope of the invention except as it may be

12 8 described by the following claims.

Claims

Claims:

1. A method for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N_Q = G X S, where N_Q, r and s are integers comprising the steps of: obtaining the electromagnetic signal W from a telecommunications network, or a data network or an Internet or a first non-transient memory; storing the signal W in a second non-transient memory; decoding with a second computer in communication with the second non-transient memory the signal W in the memory by factoring the public key N₀ in time 0(log⁶ N₀) with the second computer generated steps of selecting a prime number p of the form p = 4fc + 1 for an odd integer k such that the public key N_Q is a non-quadratic residue modulo p; Calculating n₀ satisfying the inequalities pⁿ°^{~ 1} < N_Q < pⁿ°; Computing N = r N₀ with a selection of t such that N is a quadratic residue modulo p; Calculating n satisfying the inequalities p”^-1 < N < p"; and Calculating a solution to

N ~ A² (mod r^p) by using the representation

where satisfies the condition

decrypting with the second computer the signal W with the public key N₀ and prime factors of integer N_Q displaying on a display by the second computer the prime factors of integer N₀ ; and reviewing the decrypted signal W for predetermined words with the second computer to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law, wherein the signal W representative of the message is effectively decrypted and deciphered thereby a threat to property or individuals in violation of the law can be acted upon to mitigate or eliminate the threat before the threat occurs and actual damage to property or injury to individuals is prevented or mitigated.

2. The method of claim 1 including the second computer generated steps of defining M = 2^h + 1, for N = r X s with r > s, and constructing relations

with U, V as unknowns,

forming a set of Supercongruence equations by matching coefficients of N and coefficients of C A + U x p—V x p²) {A— U x p— V x p²), the set of Supercongmence equations establishes M relations in terms of ii_t's and Vi's, which are coefficients of U and V respectively; performing steps 1-4 using the Supercongmence equations where steps 1-4 are as follows:

1) Testing feasibilities of digits Ui's and U2's. 2) Calculating carries by tallying differences on two sides of the Supercongruence equations

3) Using carries to identify subsequent digits given a feasible pair of

and u₂ by using Supercongruence equations again.

4) Using the Euclidean algorithm to test whether A—U X p— Vx p² is a divisor of NQ.

3. The method of claim 2 enabling alerting a government agency to prevent the act that will occur to prevent physical damage or bodily injury to a person occurring.

4. A second computer for decoding an encrypted electromagnetic signal W encoded by a first computer with public key NQ— T X S, where N_{Q i} r and s are integers and W is a function of r and s, comprising: an input for obtaining the electromagnetic signal W from a telecommunications network, or a data network or an Internet or a first non-transient memory a second non-transient memory in communication with the input in which the signal W is stored; a cpu in communication with the second non-transient memory the signal W in the memory that decodes the signal W by factoring the public key N₀ in time 0(log⁶ 7V₀) by the second computer generated steps of selecting a prime number p of the form p = 4k + 1 for an odd integer k such that the public key N₀ is a non-quadratic residue modulo p; calculating n_Q satisfying the inequalities

computing N = t N₀ with a selection of t such that N is a quadratic residue modulo p; calculating n satisfying the inequalities ^n_1 < N < pⁿ ; and calculating a solution to N ~ A² (mod pⁿ) by using the representation

where w_i satisfies the condition

0 < 0)₍ < pⁿ the cpu decrypting the signal W with the public key N₀ and prime factors of integer W₀; and the cpu reviewing the decrypted signal W for predetermined words to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law, wherein the signal W representative of the message is effectively decrypted and deciphered thereby a threat to property or individuals in violation of the law can be quickly acted upon to eliminate the threat before the threat occurs and actual damage to property or injury to individuals is prevented or mitigated.

5, The apparatus of claim 4 wherein the cpu of the second computer performs the cpu generated steps of defining M— 2^h + 1, for W = r X S with r > s, and constructing relations

= A + U x p— V x p^z

- A - U x p - V x p² with U, V as unknowns;

forming a set of Supercongruence equations by matching coefficients of N and coefficients of ( + U x p— V X p²) Q4— U x p— V x p²), the set of Supercongruence equations establishes M relations in terms of t^'s and v^s, which are coefficients of U and V respectively; performing steps 1_*4 using the Supercongruence equations where steps 1 -4 are as follows:

1) Testing feasibilities of digits uTs and it₂'s.

2) Calculating carries by tallying differences on two sides of the Supercongruence equations.

3) Using carries to identify subsequent digits given a feasible pair of V-i and U₂ by using Supercongruence equations again.

4) Using the Euclidean algorithm to test whether A—U X p— Vx ² is a divisor of N₀.

6. A non-transitory readable storage medium which includes a computer program stored on the storage medium for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀ — r X s, where N_0, r and s are integers and W is a function of r and s, where the signal W has been stored in a second non-transient memory of a second computer, and the second computer factoring the public key N_Q in time 0 (log⁶ LG₀), the signal W obtained from a telecommunications network, or a data network or an Internet or a first non-transient memory, the computer program having the second computer generated steps of: selecting a prime number p of the form p = 4k + 1 for an odd integer k such that the public key N₀ is a non-quadratic residue modulo p; calculating 7l₀ satisfying the inequalities pⁿ°^-1 < N₀ < pⁿ°; computing N = T N₀ with a selection of T such that N is a quadratic residue modulo p; calculating 71 satisfying the inequalities p^n_1 < N < pⁿ; and calculating a solution to

N º A² (mod pⁿ) by using the representation

where (Oi satisfies the condition

decrypting with the second computer the signal W with the public key N_Q and prime factors of integer N_Q displaying on a display by the second computer the decrypted signal W; and reviewing the decrypted signal W for predetermined words to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law .wherein the signal W representative of the message is effectively decrypted and deciphered thereby a threat to property or individuals in violation of the law can be quickly acted upon to eliminate the threat before the threat occurs and actual damage to property or injury to individuals is prevented or mitigated.

7. The storage medium of claim 6 having the second computer generated steps of defining M = 2^h + 1, for N = r X S with r > s, and constructing relations

( r— A + U x p—V x p²

Is = A— U x p— V x p² with U , V as unknowns;

forming a set of Supercongruence equations by matching coefficients of N and coefficients of (A + U x p— V X p²)( 4— U X p— V x p²), the set of Supercongruence equations establishes M relations in terms of

and V_l's, which are coefficients of U and V respectively; performing steps 1-4 using the Supercongruence equations where steps 1-4 are as follows:

1) Testing feasibilities of digits U_j s and ti₂'s.

2) Calculating carries by tallying differences on two sides of the Supercongruence equations.

3) Using carries to identify subsequent digits given a feasible pair of

and u₂ by using Supercongruence equations again.

4) Using the Euclidean algorithm to test whether A—U x p— Vx p² is a divisor of N₀.