Special Number Field Sieve - Details of Method

Details of Method

Let n be the integer we want to factor. We pick an irreducible polynomial f with integer coefficients, and an integer m such that f(m)≡0 (mod n) (we will explain how they are chosen in the next section). Let α be a root of f; we can then form the ring Z. There is a unique ring homomorphism φ from Z to Z/nZ that maps α to m. For simplicity, we'll assume that Z is a unique factorization domain; the algorithm can be modified to work when it isn't, but then there are some additional complications.

Next, we set up two parallel factor bases, one in Z and one in Z. The one in Z consists of all the prime ideals in Z whose norm is bounded by a chosen value . The factor base in Z, as in the rational sieve case, consists of all prime integers up to some other bound.

We then search for relatively prime pairs of integers (a,b) such that:

• a+bm is smooth with respect to the factor base in Z (i.e., it is a product of elements in the factor base).
• a+bα is smooth with respect to the factor base in Z; given how we chose the factor base, this is equivalent to the norm of a+bα being divisible only by primes less than .

These pairs are found through a sieving process, analogous to the Sieve of Eratosthenes; this motivates the name "Number Field Sieve".

For each such pair, we can apply the ring homomorphism φ to the factorization of a+bα, and we can apply the canonical ring homomorphism from Z to Z/nZ to the factorization of a+bm. Setting these equal gives a multiplicative relation among elements of a bigger factor base in Z/nZ, and if we find enough pairs we can proceed to combine the relations and factor n, as described above.