Factoring large integers

Abstract

A method for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N_0=r×s, where N_0, r and s are integers. There is the step of obtaining the electromagnetic signal W from a telecommunications network, or a data network or an Internet or a first non-transient memory. There is the step of storing the electromagnetic signal W in a second non-transient memory. There is the step of decoding with a second computer in communication with the second non-transient memory the electromagnetic signal W in the second non-transient memory by factoring the public key N_0 in at most a time O(log^6 N_0). A non-transitory readable storage medium which includes a computer program stored on the storage medium for decoding an encrypted electromagnetic signal W.

Description

FIELD OF THE INVENTION

The present invention is related to solving an equation in two or more unknown integer variables, where each variable is represented by a multiplicity of powers of multiples of an odd prime p. Specifically, the present invention is related to factoring an integer N₀, restating the problem into the factorization of an appropriate integer N which is a quadratic residue modulo p, then factoring N.

BACKGROUND

The problem of resolving a large integer into the product of its prime factors has stimulated the intellectual curiosity and the imagination of many generations of mathematicians.

In 1801 Gauss wrote: “. . . the dignity of the science itself seems to require that every possible means be explored for the solution of a problem so elegant and so celebrated.” See page 397 of [3].

The problem has attracted renewed interest, ever since R. L. Rivest, A. Shamir, and L. Adleman proposed an encryption method which is based on the computational difficulty of the factorization problem [4].

This note introduces a method and apparatus which lead to the factorization of a large odd integer N₀.

SUMMARY

The present invention pertains to a method for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers. The method comprises the steps of obtaining the electromagnetic signal W from a telecommunications network, or a data network or an Internet or a first non-transient memory. There is the step of storing the signal W in a second non-transient memory. There is the step of decoding with a second computer in communication with the second non -transient memory the signal W in the second non-transient memory by factoring the public key N₀ in at most a time O(log⁶N₀) with the second computer generated steps of selecting integers a, b. There is the step of electing an initial point in a set of quartuples of integers modulo N₀ (a projective space) [X₀, X₁, X₂, X₃]=[1,0,b,0]. There is the step of applying a semigroup law repeatedly starting from the initial point, where the semigroup law is defined as: given a pair of elements [X₀: X₁: X₂: X₃] and [Y₀: Y₁: Y₂: Y₃] of the projective space, there is produced a third point [Z₀, Z₁, Z₂, Z₃]. There is the step of determining that [X₀: X₁: X₂: X₃]=[Y₀: Y₁: Y₂: Y₃] (mod N₀), and thus the third point is

$Z_0\equiv 16X_0^4{X}_2^4\left(\mathrm{mod}{N}_0\right)$ $Z_1\equiv X_0^4{X}_2^2\left(4X_3^2-16b^2{X}_0^{2}a-32b^2{X}_0{X}_1\right)\left(\mathrm{mod}{N}_0\right)$ $Z_2\equiv -2X_0{X}_2\left(\begin{array}{c}8X_0^3{X}_1^3{a}^3+36X_0^2{X}_1^4{a}^2-8X_0^3{X}_1{X}_2^2{a}^2+54X_0{X}_1^{5}a-\\ 36X_0^2{X}_1^2{X}_2^{2}a+27X_1^6-36X_0{X}_1^3{X}_2^2+8X_0^2{X}_2^4\end{array}\right)\left(\mathrm{mod}{N}_0\right)$ $Z_3\equiv {\left(4X_0^2{X}_1^2{a}^2+12X_0{X}_1^{3}a-4X_0^2{X}_2^{2}a+9X_1^4-8X_0{X}_1{X}_2^2\right)}^2\left(\mathrm{mod}{N}_0\right)$

Otherwise, the point [Z₀, Z₁, Z₂, Z₃] is:

$Z_0\equiv {\left(X_1{Y}_0-X_0{Y}_1\right)}^4{X}_0^2{Y}_0^2\left(\mathrm{mod}{N}_0\right)$ $Z_1\equiv X_0^3{Y_0^3\left(X_1{Y}_0-X_0{Y}_1\right)}^2\left(2b^2{X}_0{Y}_0+2X_1{Y}_{1}a+X_3{Y}_1-2X_2{Y}_2+X_1{Y}_3\right)\left(\mathrm{mod}{N}_0\right)$ $Z_2\equiv X_0^3{Y}_0^3\left(X_1{Y}_0-X_0{Y}_1\right)\left(\begin{array}{c}-4b^2{X}_0{X}_2{Y}_0^2+4b^2{X}_0^2{Y}_0{Y}_2+X_1{X}_3{Y}_0{Y}_2+\\ 3X_0{X}_3{Y}_1{Y}_2-3X_1{X}_2{Y}_0{Y}_3-X_0{X}_2{Y}_1{Y}_3-\\ 2a\left(X_1{X}_2{Y}_0{Y}_1-X_0{X}_3{Y}_0{Y}_2-X_0{X}_1{Y}_1{Y}_2+X_0{X}_2{Y}_0{Y}_3\right)\end{array}\right)\left(\mathrm{mod}{N}_0\right)$ $Z_3\equiv {\left(\begin{array}{c}{\left(X_1{Y}_0-X_0{Y}_1\right)}^2{X}_0{Y}_{0}a+X_1^3{Y}_0^3-X_0{X}_2^2{Y}_0^3-X_0{X}_1^2{Y}_0^2{Y}_1-\\ X_0^2{X}_1{Y}_0{Y}_1^2{X}_0^3{Y}_1^3+2X_0^2{X}_2{Y}_0^2{Y}_2-X_0^3{Y}_0{Y}_2^2\end{array}\right)}^2\left(\mathrm{mod}{N}_0\right).$

There is the step of testing if any component of the third point shares a factor with N₀ and is a shared factor with N₀. There is the step of identifying the shared factor with N₀ as one of plurality of prime factors of N₀, and a quotient of N₀ by the shared factor as another prime factor. There is the step of decrypting with the second computer the signal W with the public key N₀ and prime factors of the integer N₀. There is the step of reviewing the decrypted signal W for predetermined words with the second computer to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law, wherein the signal W representative of the message is effectively decrypted and deciphered thereby a threat to property or individuals in violation of the law can be acted upon to mitigate or eliminate the threat before the threat occurs and actual damage to property or injury to individuals is prevented or mitigated.

The present invention pertains to a second computer for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers and W is a function of r and s. The second computer comprises an input for obtaining the electromagnetic signal W from a telecommunications network, or a data network or an Internet or a first non-transient memory, a second non-transient memory in communication with the input in which the signal W is stored. The second computer comprises a cpu in communication with the second non-transient memory with the signal W in the second non-transient memory that decodes the signal W by factoring the public key N₀ in time O(log⁶N₀) by the second computer generated steps of selecting integers a, b. There is the step of electing an initial point in a set of quartuples of integers modulo N₀ (a projective space) [X₀, X₁, X₂, X₃]=[1,0,b,0]. There is the step of applying a semigroup law repeatedly starting from the initial point, where the semigroup law is defined as: given a pair of elements [X₀: X₁: X₂: X₃] and [Y₀: Y₁: Y₂: Y₃] of the projective space, there is produced a third point [Z₀, Z₁, Z₂, Z₃]. There is the step of determining that [X₀: X₁: X₂: X₃]≡[Y₀: Y₁: Y₂: Y₃] (mod N₀), and thus the third point is

$Z_0\equiv 16X_0^4{X}_2^4\left(\mathrm{mod}{N}_0\right)$ $Z_1\equiv X_0^4{X}_2^2\left(4X_3^2-16b^2{X}_0^{2}a-32b^2{X}_0{X}_1\right)\left(\mathrm{mod}{N}_0\right)$ $Z_2\equiv -2X_0{X}_2\left(\begin{array}{c}8X_0^3{X}_1^3{a}^3+36X_0^2{X}_1^4{a}^2-8X_0^3{X}_1{X}_2^2{a}^2+54X_0{X}_1^{5}a-\\ 36X_0^2{X}_1^2{X}_2^{2}a+27X_1^6-36X_0{X}_1^3{X}_2^2+8X_0^2{X}_2^4\end{array}\right)\left(\mathrm{mod}{N}_0\right)$ $Z_3\equiv {\left(4X_0^2{X}_1^2{a}^2+12X_0{X}_1^{3}a-4X_0^2{X}_2^{2}a+9X_1^4-8X_0{X}_1{X}_2^2\right)}^2\left(\mathrm{mod}{N}_0\right)$

Otherwise, the point [Z₀, Z₁, Z₂, Z₃] is:

$Z_0\equiv {\left(X_1{Y}_0-X_0{Y}_1\right)}^4{X}_0^2{Y}_0^2\left(\mathrm{mod}{N}_0\right)$ $Z_1\equiv X_0^3{Y_0^3\left(X_1{Y}_0-X_0{Y}_1\right)}^2\left(2b^2{X}_0{Y}_0+2X_1{Y}_{1}a+X_3{Y}_1-2X_2{Y}_2+X_1{Y}_3\right)\left(\mathrm{mod}{N}_0\right)$ $Z_2\equiv X_0^3{Y}_0^3\left(X_1{Y}_0-X_0{Y}_1\right)\left(\begin{array}{c}-4b^2{X}_0{X}_2{Y}_0^2+4b^2{X}_0^2{Y}_0{Y}_2+X_1{X}_3{Y}_0{Y}_2+\\ 3X_0{X}_3{Y}_1{Y}_2-3X_1{X}_2{Y}_0{Y}_3-X_0{X}_2{Y}_1{Y}_3-\\ 2a\left(X_1{X}_2{Y}_0{Y}_1-X_0{X}_3{Y}_0{Y}_2-X_0{X}_1{Y}_1{Y}_2+X_0{X}_2{Y}_0{Y}_3\right)\end{array}\right)\left(\mathrm{mod}{N}_0\right)$ $Z_3\equiv {\left(\begin{array}{c}{\left(X_1{Y}_0-X_0{Y}_1\right)}^2{X}_0{Y}_{0}a+X_1^3{Y}_0^3-X_0{X}_2^2{Y}_0^3-X_0{X}_1^2{Y}_0^2{Y}_1-\\ X_0^2{X}_1{Y}_0{Y}_1^2{X}_0^3{Y}_1^3+2X_0^2{X}_2{Y}_0^2{Y}_2-X_0^3{Y}_0{Y}_2^2\end{array}\right)}^2\left(\mathrm{mod}{N}_0\right).$

There is the step of testing if any component of the third point shares a factor with N₀ and is a shared factor with N₀. There is the step of identifying the shared factor with N₀ as one of plurality of prime factors of N₀, and a quotient of N₀ by the shared factor as another prime factor. The cpu decrypting the signal W with the public key N₀ and prime factors of integer N₀. The cpu reviewing the decrypted signal W for predetermined words to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law, wherein the signal W representative of the message is effectively decrypted and deciphered thereby a threat to property or individuals in violation of the law can be quickly acted upon to eliminate the threat before the threat occurs and actual damage to property or injury to individuals is prevented or mitigated.

The present invention pertains to a non-transitory readable storage medium which includes a computer program stored on the storage medium for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers and W is a function of r and s, where the signal W has been stored in a second non-transient memory of a second computer, and the second computer factoring the public key N₀ in time O(log⁶N₀). The signal W obtained from a telecommunications network, or a data network or an Internet or a first non-transient memory. The computer program having the second computer generated steps of selecting integers a, b. There is the step of electing an initial point in a set of quartuples of integers modulo N₀ (a projective space) [X₀, X₁, X₂, X₃]=[1,0,b,0]. There is the step of applying a semigroup law repeatedly starting from the initial point, where the semigroup law is defined as: given a pair of elements [X₀: X₁: X₂: X₃] and [Y₀: Y₁: Y₂: Y₃] of the projective space, there is produced a third point [Z₀, Z₁, Z₂, Z₃]. There is the step of determining that [X₀: X₁: X₂: X₃]≡[Y₀: Y₁: Y₂: Y₃] (mod N₀), and thus the third point is

$Z_0\equiv 16X_0^4{X}_2^4\left(\mathrm{mod}{N}_0\right)$ $Z_1\equiv X_0^4{X}_2^2\left(4X_3^2-16b^2{X}_0^{2}a-32b^2{X}_0{X}_1\right)\left(\mathrm{mod}{N}_0\right)$ $Z_2\equiv -2X_0{X}_2\left(\begin{array}{c}8X_0^3{X}_1^3{a}^3+36X_0^2{X}_1^4{a}^2-8X_0^3{X}_1{X}_2^2{a}^2+54X_0{X}_1^{5}a-\\ 36X_0^2{X}_1^2{X}_2^{2}a+27X_1^6-36X_0{X}_1^3{X}_2^2+8X_0^2{X}_2^4\end{array}\right)\left(\mathrm{mod}{N}_0\right)$ $Z_3\equiv {\left(4X_0^2{X}_1^2{a}^2+12X_0{X}_1^{3}a-4X_0^2{X}_2^{2}a+9X_1^4-8X_0{X}_1{X}_2^2\right)}^2\left(\mathrm{mod}{N}_0\right)$

Otherwise, the point [Z₀, Z₁, Z₂, Z₃] is:

$Z_0\equiv {\left(X_1{Y}_0-X_0{Y}_1\right)}^4{X}_0^2{Y}_0^2\left(\mathrm{mod}{N}_0\right)$ $Z_1\equiv X_0^3{Y_0^3\left(X_1{Y}_0-X_0{Y}_1\right)}^2\left(2b^2{X}_0{Y}_0+2X_1{Y}_{1}a+X_3{Y}_1-2X_2{Y}_2+X_1{Y}_3\right)\left(\mathrm{mod}{N}_0\right)$ $Z_2\equiv X_0^3{Y}_0^3\left(X_1{Y}_0-X_0{Y}_1\right)\left(\begin{array}{c}-4b^2{X}_0{X}_2{Y}_0^2+4b^2{X}_0^2{Y}_0{Y}_2+X_1{X}_3{Y}_0{Y}_2+\\ 3X_0{X}_3{Y}_1{Y}_2-3X_1{X}_2{Y}_0{Y}_3-X_0{X}_2{Y}_1{Y}_3-\\ 2a\left(X_1{X}_2{Y}_0{Y}_1-X_0{X}_3{Y}_0{Y}_2-X_0{X}_1{Y}_1{Y}_2+X_0{X}_2{Y}_0{Y}_3\right)\end{array}\right)\left(\mathrm{mod}{N}_0\right)$ $Z_3\equiv {\left(\begin{array}{c}{\left(X_1{Y}_0-X_0{Y}_1\right)}^2{X}_0{Y}_{0}a+X_1^3{Y}_0^3-X_0{X}_2^2{Y}_0^3-X_0{X}_1^2{Y}_0^2{Y}_1-\\ X_0^2{X}_1{Y}_0{Y}_1^2{X}_0^3{Y}_1^3+2X_0^2{X}_2{Y}_0^2{Y}_2-X_0^3{Y}_0{Y}_2^2\end{array}\right)}^2\left(\mathrm{mod}{N}_0\right).$

There is the step of testing if any component of the third point shares a factor with N₀ and is a shared factor with N₀. There is the step of identifying the shared factor with N₀ as one of plurality of prime factors of N₀, and a quotient of N₀ by the shared factor as another prime factor. There is the step of decrypting with the second computer the signal W with the public key N₀ and prime factors of the integer N₀. There is the step of reviewing the decrypted signal W for predetermined words with the second computer to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law, wherein the signal W representative of the message is effectively decrypted and deciphered thereby a threat to property or individuals in violation of the law can be acted upon to mitigate or eliminate the threat before the threat occurs and actual damage to property or injury to individuals is prevented or mitigated.

The present invention pertains to a method for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers. The method comprises the steps of obtaining the electromagnetic signal W from a telecommunications network, or a data network or an Internet or a first non-transient memory. There is the step of storing the signal W in a second non-transient memory. There is the step of decoding with a second computer in communication with the second non-transient memory the signal W in the second non-transient memory by factoring the public key N₀ in at most a time O(log⁶N₀) with the second computer generated steps of selecting a prime p and vector of positive integers k=[k₀, k₁, . . . , k_M−1]. There is the step of determining a polynomial v(x)=v₀+v₁x+ . . . +v_n−1xⁿ⁻¹ such that v(p)=N is a predetermined multiple of N₀. There is the step of determining a p^k-standard polynomial A(x) such that A(x)²≡v(x) (SP_pk), where a polynomial f(x)=f₀+f₁x+f₂x²+ . . . +f_M−1x^M−1 is called p^k-standard if0≤f_i<p^ki for i=0,1, . . . ,M−1, a p^k-standard part of the polynomial f(x) is computed by reducing the coefficient of xⁱ modulo p^ki and truncating all terms x^m for m≥M. There is the step of determining a roster of pairs (U(x), V(x)) such that there is a persistent standard polynomial factorization:(A(x)−U(x)−V(x))(A(x)+U(x)−V(x))≡v(x) (SP_pk)where a standard polynomial factorization v(x)≡r(x)s(x) is called persistent if r(x) and s(x) have the same degree as their reductions modulo p. There is the step of determining a shared factor that integers r(p) and s(p) share with N₀, where the shared factor with N₀ as one of plurality of prime factors of N₀. There is the step of obtaining another prime factor by division of N₀ by the shared factor. There is the step of identifying the shared factor with N₀ as one of plurality of prime factors of N₀, and a quotient of N₀ by the shared factor as another prime factor. There is the step of decrypting with the second computer the signal W with the public key N₀ and prime factors of the integer N₀. There is the step of reviewing the decrypted signal W for predetermined words with the second computer to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law, wherein the signal W representative of the message is effectively decrypted and deciphered thereby a threat to property or individuals in violation of the law can be acted upon to mitigate or eliminate the threat before the threat occurs and actual damage to property or injury to individuals is prevented or mitigated.

The present invention pertains to a second computer for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers and W is a function of r and s. The second computer comprises an input for obtaining the electromagnetic signal W from a telecommunications network, or a data network or an Internet or a first non-transient memory. The second computer comprises a second non-transient memory in communication with the input in which the signal W is stored. The second computer comprises a cpu in communication with the second non -transient memory with the signal W in the second non-transient memory. The cpu decodes the signal W by factoring the public key N₀ in time O(log⁶N₀) by the second computer generated steps of selecting a prime p and vector of positive integers k=[k₀, k₁, . . . , k_M−1]. There is the step of determining a polynomial v(x)=v₀+v₁x+ . . . +v_n−1xⁿ⁻¹ such that v(p)=N is a predetermined multiple of N₀. There is the step of determining a p^k-standard polynomial A(x) such that A(x)²≡v(x) (SP_pk), where a polynomial f(x)=f₀+f₁x+f₂x²+ . . . +f_M−1x^M−1 is called p^k-standard if0≤f_i<p^ki for i=0,1, . . . ,M−1, a p^k-standard part of the polynomial f(x) is computed by reducing the coefficient of xⁱ modulo p^kt and truncating all terms x^m for m≥M. There is the step of determining a roster of pairs (U(x), V(x)) such that there is a persistent standard polynomial factorization:(A(x)−U(x)−V(x))(A(x)+U(x)−V(x))≡v(x) (SP_pk)where a standard polynomial factorization v(x)≡r(x)s(x) is called persistent if r(x) and s(x) have the same degree as their reductions modulo p. There is the step of determining a shared factor that integers r(p) and s(p) share with N₀, where the shared factor with N₀ as one of plurality of prime factors of N₀. There is the step of obtaining another prime factor by division of N₀ by the shared factor. There is the step of identifying the shared factor with N₀ as one of plurality of prime factors of N₀, and a quotient of N₀ by the shared factor as another prime factor. The cpu decrypting with the second computer the signal W with the public key N₀ and prime factors of the integer N₀. The cpu reviewing the decrypted signal W for predetermined words to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law, wherein the signal W representative of the message is effectively decrypted and deciphered thereby a threat to property or individuals in violation of the law can be acted upon to mitigate or eliminate the threat before the threat occurs and actual damage to property or injury to individuals is prevented or mitigated.

The present invention pertains to a non-transitory readable storage medium which includes a computer program stored on the storage medium for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers and W is a function of r and s, where the signal W has been stored in a second non-transient memory of a second computer, and the second computer factoring the public key N₀ in time O(log⁶N₀). The signal W obtained from a telecommunications network, or a data network or an Internet or a first non-transient memory. The computer program having the second computer generated steps of: selecting a prime p and vector of positive integers k=[k₀, k₁, . . . , k_M−1]. There is the step of determining a polynomial v(x)=v₀+v₁x+ . . . +v_n−1xⁿ⁻¹ such that v(p)=N is a predetermined multiple of N₀. There is the step of determining a p^k-standard polynomial A(x) such that A(x)²≡v(x) (SP_pk), where a polynomial f(x)=f₀+f₁x+f₂x²+ . . . +f_M−1x^M−1 is called p^k-standard if0≤f_i<p^ki for i=0,1, . . . ,M−1, a p^k-standard part of the polynomial f(x) is computed by reducing the coefficient of xⁱ modulo p^kt and truncating all terms x^m for m≥M. There is the step of determining a roster of pairs (U(x), V(x)) such that there is a persistent standard polynomial factorization:(A(x)−U(x)−V(x))(A(x)+U(x)−V(x))≡v(x) (SP_pk)where a standard polynomial factorization v(x)≡r(x)s(x) is called persistent if r(x) and s(x) have the same degree as their reductions modulo p. There is the step of determining a shared factor that integers r(p) and s(p) share with N₀, where the shared factor with N₀ as one of plurality of prime factors of N₀. There is the step of obtaining another prime factor by division of N₀ by the shared factor. There is the step of identifying the shared factor with N₀ as one of plurality of prime factors of N₀, and a quotient of N₀ by the shared factor as another prime factor. There is the step of decrypting with the second computer the signal W with the public key N₀ and prime factors of the integer N₀. There is the step of reviewing the decrypted signal W for predetermined words with the second computer to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law, wherein the signal W representative of the message is effectively decrypted and deciphered thereby a threat to property or individuals in violation of the law can be acted upon to mitigate or eliminate the threat before the threat occurs and actual damage to property or injury to individuals is prevented or mitigated.

BRIEF DESCRIPTION OF THE FIGURE

FIG. 1 is a block diagram regarding the claimed invention.

FIG. 2. is a flow chart of the factorization process regarding the claimed invention.

FIG. 3 is a flow chart for obtaining a public/private key pair regarding the claimed invention.

FIG. 4 is a flow chart for decoding, decrypting, and scanning electromagnetic signal W regarding the claimed invention.

THE PROBLEM

Given a positive odd integer N₀, it is desired to determine a pair of integers r₀ and s₀ such thatN₀=r₀·s₀.  (1)

The problem can also be stated as the search for two integers Y₀and X₀such that Y₀>X₀ andN₀=Y₀²−X₀².  (2)

The pairs (r₀, s₀) and (Y₀, X₀) are related as follows:

$\begin{array}{cc}\{\begin{array}{c}{Y}_0=\frac{r_0+s_0}{2}\\ X_0=\frac{r_0-s_0}{2}\end{array}.& \left(3\right)\end{array}$

Conversely,

$\begin{array}{cc}\{\begin{array}{c}{r}_0=Y_0+X_0\\ s_0=Y_0-X_0\end{array}.& \left(4\right)\end{array}$

If r₀>s₀>0, both Y₀ and X₀ are positive. In this case it is useful to consider some limit cases in order to develop an appreciation for the magnitude of the variables.

One of the limit cases occurs when the pair (r₀, s₀) is a pair of “twin primes”, such as (43, 41). In these cases,

$\begin{array}{cc}\{\begin{array}{c}{X}_0=1\\ Y_0=\sqrt{N_0+1}\end{array}.& \left(5\right)\end{array}$

At the other end is the case when r₀ approximates N₀. At the limit, consider a pair (r₀, s₀) equaling (N₀, 1). Then

$\begin{array}{cc}\{\begin{array}{c}{X}_0=\frac{N_0-1}{2}\\ Y_0=\frac{N_0+1}{2}\end{array}.& \left(6\right)\end{array}$

Therefore, in all cases

$\begin{array}{cc}\{\begin{array}{c}{X}_0^2<Y_0^2\\ 1\le X_0^2<{\left(\frac{N_0-1}{2}\right)}^2\\ N_0+1\le Y_0^2<{\left(\frac{N_0+1}{2}\right)}^2\end{array}& \left(7\right)\end{array}$

Thus, in all cases, Y₀²>N₀. In some cases, X₀² is greater than N₀.

A Restatement

Given N₀ and an odd prime p, the general solution of (1) has the following form:

$\begin{array}{cc}\{\begin{array}{c}{r}_0=\alpha +{\lambda }_0·p\\ s_0=\beta +{\mu }_0·p\end{array}.& \left(8\right)\end{array}$ where α, β, λ₀, and μ₀ denote integers and where α·β≡N₀ (mod p). If α and β are both even or both odd, λ₀ and μ₀ have the same parity. Otherwise, define β′=β+p and μ′₀=μ₀−1. Thus, without loss of generality, it is possible to define two integers U₀ and V₀ as follows:

$\begin{array}{cc}\{\begin{array}{c}{U}_0=\frac{{\lambda }_0-{\mu }_0}{2}\\ V_0=\frac{{\lambda }_0+{\mu }_0}{2}\end{array}.& \left(9\right)\end{array}$ Then

$\begin{array}{cc}\{\begin{array}{c}{r}_0=\alpha +U_0·p+V_0·p\\ s_0=\beta -U_0·p+V_0·p\end{array}.& \left(10\right)\end{array}$

The integers V₀ and U₀ are usually referred to as the symmetric and antisyrnmetric components of the pair (r₀, s₀), respectively. In general, in the search for (U₀, V₀), all values of α in the interval 1≤α<p may need to be tested.

The complexity of the problem is reduced in the cases when

$\begin{array}{cc}\{\begin{array}{c}\alpha \equiv \beta \left(\mathrm{mod}p\right)\\ \alpha ·\beta \equiv N_0\left(\mathrm{mod}{p}^2\right).\end{array}& \left(11\right)\end{array}$

In such cases V₀≡0 (mod p).

In order to realize this situation, it is possible to restate the problem of factoring N₀ into the problem of factoring some integer N which satisfies (11). To this end, select a prime p, and let n₀ be the unique integer with pⁿ⁰⁻¹<N₀<pⁿ⁰. Select a candidate value of α, say {tilde over (α)}. Then define τ by the following:N₀≡τ·{tilde over (α)}² (mod p²).  (12)

Let {tilde over (τ)} denote the least positive residue of (12). Then β≡{tilde over (τ)}·{tilde over (α)} (mod p). If {tilde over (τ)} is odd, define the integer N by the followingN={tilde over (τ)}·N₀  (13)where, for some integer n, pⁿ⁻¹<N<pⁿ. Then N is a quadratic residue modulo p andN≡{tilde over (τ)}²·{tilde over (α)}² (mod p).  (14)

Note that now there is a factorization N=r·s, with r≡s (mod p), namely r={tilde over (τ)}r₀ and s=s₀. There exist unique integers U and V such that

$\begin{array}{cc}\{\begin{array}{c}r=\tilde{\tau }·\tilde{\alpha }+U·p+V·p^2\\ s=\tilde{\tau }·\tilde{\alpha }-U·p+V·p^2,\end{array}& \left(15\right)\end{array}$ where

$\begin{array}{cc}\{\begin{array}{c}r=\tilde{\tau }·r_0\\ s=s_0\end{array}& \left(16\right)\end{array}$

Notice that, if U>0, r>s.

In the case of (15), it will be

$\begin{array}{cc}\{\begin{array}{c}Y=\tilde{\tau }·\tilde{\alpha }+V·p^2\\ X=U·p.\end{array}& \left(17\right)\end{array}$

Also, since {tilde over (τ)} is odd,

$\begin{array}{cc}\{\begin{array}{c}Y=\frac{\tilde{\tau }·r_0+s_0}{2}\\ X=\frac{\tilde{\tau }·r_0-s_0}{2}\end{array}.& \left(18\right)\end{array}$

The factorization problem requires the identification of a pair (Ũ, {tilde over (V)}) such that, for the corresponding ({tilde over (r)}, {tilde over (s)}), it isN={tilde over (r)}·{tilde over (s)}.  (19)

In general, all the values of α should be tested.

Consider the expression of Y when à is used in lieu of {tilde over (τ)}·{tilde over (α)}:

$\begin{array}{cc}\begin{array}{c}Y=\tilde{\tau }·\tilde{\alpha }+V·p^2\\ =\tilde{A}+V_1·p^2\end{array}& \left(20\right)\end{array}$ for some integer V₁. Recall that, by (7),√{square root over (N)}<Y<N.  (21)

There are two significant particular cases: if Ã<√{square root over (N)}, then V₁>0. Also, if Ã>N, then V₁<0. Throughout this presentation, Ã will be greater than N. For simplicity of notation, the integer V will be constrained to be positive. Then (15) takes the following form:

$\begin{array}{cc}\{\begin{array}{c}\tilde{A}>N\\ r=\tilde{A}+U·p-V·p^2\\ s=\tilde{A}-U·p-V·p^2\end{array}.& \left(22\right)\end{array}$

A particular definition of N can be produced when τ is computed modulo pⁿ⁰. In this presentation, without loss of generality, it will be assumed that {tilde over (τ)} is a positive odd integer, and so N={tilde over (τ)}N₀ is an odd quadratic residue modulo p.

A Note on the Representation of N

Given pⁿ⁻¹<N<pⁿ, where N is a quadratic residue modulo p, let

$\begin{array}{cc}N=\sum _{i=0}^{n-1}{v}_i·p^i,& \left(23\right)\end{array}$ where {v_i} denote integers, and 0≤v_i<p.

It is desired to compute a solution of the following:N≡A² (mod pⁿ)  (24)where

$\begin{array}{cc}A\equiv \sum _{i=0}^{n-1}{a}_i·p^i\left(\mathrm{mod}{p}^n\right),& \left(25\right)\end{array}$ and where0≤α_i<p.  (26)

Subject to (26), the solution of (24) is provided by the following:

$\begin{array}{cc}\{\begin{array}{c}{v}_0\equiv a_0^2\left(\mathrm{mod}p\right)\\ v_1\equiv 2·a_0·a_1+\frac{a_0^2-v_0}{p}\left(\mathrm{mod}p\right)\\ v_2\equiv 2·a_0·a_1+a_1^2+\frac{{\mathrm{RH}}_1-{\mathrm{LH}}_1}{p}\left(\mathrm{mod}p\right)\\ \dots \\ v_i\equiv \sum _{k=0}^i{a}_k·a_{i-k}+\frac{{\mathrm{RH}}_{t-1}-{\mathrm{LH}}_{t-1}}{p}\left(\mathrm{mod}p\right)\\ \dots \\ v_{n-1}\equiv \sum _{k=0}^{n-1}{a}_k·a_{n-k}+\frac{{\mathrm{RH}}_{n-2}-{\mathrm{LH}}_{n-2}}{p}\left(\mathrm{mod}p\right)\end{array},& \left(27\right)\end{array}$ where RH_i and LH_i denote the RHS and LHS, respectively, of the congruence containing v_i.

The terms (RH_i−LH_i)/p are usually referred to as carries. They are caused by the constraint (26) and flow from the less significant digits to the more significant ones. As an example, consider the problem of solvingN≡A² (mod p⁵),  (28)where N is a quadratic residue modulo p. Assume p=13 and

$\begin{array}{cc}\begin{array}{c}N=\sum _{i=0}^4{v}_i·p^i\\ =10+2·p+10·p^2+5·p^3+0·p^4\\ =12711.\end{array}& \left(29\right)\end{array}$

If 0≤α_i<p, a solution of (28), say Ã, can be represented as follows:Ã=6+0·p+3·p²+10·p³+5·p⁴.  (30)

A second solution of (28) occurs when {tilde over (α)}₀=6 is replaced by α₀=p−{tilde over (α)}₀=7. In this caseĀ=7+12·p+9·p²+2·p³+7·p⁴.  (31)

Consider removing the magnitude constraints (26) from all α_i and representing A asA≡ω₀+ω₁·p+ω₂·p²+ω₃·p³+ω₄·p⁴ (mod p⁵),  (32)where the coefficients of any power of p are positive integers and are constrained by the following conditions:0≤ω_i<pⁿ⁻ⁱ.  (33)

Then the congruence (28) can be satisfied if the sum of the coefficients of any power of p, say pⁱ, is congruent to zero modulo p⁵⁻ⁱ. Specifically, in the example, it must be

$\begin{array}{cc}\{\begin{array}{c}{v}_0\equiv {\omega }_0^2\left(\mathrm{mod}{p}^5\right)\\ v_1·p\equiv 2·{\omega }_0·{\omega }_1·p\left(\mathrm{mod}{p}^5\right)\\ v_2·p^2\equiv {\omega }_1^2·P^2+2·{\omega }_0·{\omega }_2·p^2\left(\mathrm{mod}{p}^5\right)\\ v_3·p^3\equiv 2·{\omega }_1·{\omega }_2·p^3+2·{\omega }_0·{\omega }_3·p^3\left(\mathrm{mod}{p}^5\right)\\ v_4·p^4\equiv {\omega }_2^2·p^4+2·{\omega }_1·{\omega }_3·p^4+2·{\omega }_0·{\omega }_4\left(\mathrm{mod}{p}^5\right)\end{array}& \left(34\right)\end{array}$

In the example, consider the condition10≡ω₀² (mod p⁵)  (35)

For ω₀≡6 (mod p) , the least positive solution, say {tilde over (ω)}₀, is {tilde over (ω)}₀=181200. For {tilde over (ω)}₀≡p−6≡7 (mod p), it is ω₀=190043. To satisfy the second of (34) when {tilde over (ω)}₀=181200, it must be2·p≡2·{tilde over (ω)}₀·ω₁·p (mod p⁵).  (36)

The least positive solution, say {tilde over (ω)}₁, is {tilde over (ω)}₁=18120.

Thereafter, from the third of (34), let10·p²≡({tilde over (ω)}₁²+2·{tilde over (ω)}₀·{tilde over (ω)}₂)·p² (mod p⁵),  (37)whence {tilde over (ω)}₂=1814. Likewise, from the fourth of (34), let5·p³≡2·{tilde over (ω)}₁·{tilde over (ω)}₂·p³+2·ω₀·ω₃·p³ (mod p⁵),  (38)whence {tilde over (ω)}₃=97. Finally, from the fifth of (34), let0·p⁴≡ω₂²·p⁴+2ω₁·ω₃p⁴+2ω₀·p⁴ (mod p⁵),  (39)whence {tilde over (ω)}₄=12. ThenN≡(181200+18120·p+1814·p²+97·p³+12·p⁴)² (mod p⁵)  (40)

Proceeding in a similar fashion with ω₀=190093, it isN≡(190093+10441·p+383·p²+72·p³+1·p⁴)² (mod p⁵)  (41)

Comparison of the resulting {tilde over (ω)}_i with the corresponding ω_i yields

$\begin{array}{cc}\{\begin{array}{c}{\omega }_i+{\stackrel{\_}{\omega }}_i=p^{5-i}\\ 0<{\omega }_i<p^{5-i}\end{array}& \left(42\right)\end{array}$ or(ω_i+ω_i)·pⁱ=p⁵.  (43)

Thus, in the example,

$\begin{array}{cc}\begin{array}{cc}181200+190093& =p^5\\ 18120+10441& =p^4\\ 1814+383& =p^3\\ 97+72& =p^2\\ 12+1& =p\end{array}& \left(44\right)\end{array}$ andÃ+Ā=5·p⁵.  (45)

Notice that, when à and Ā are subject to the constraint (26), as in (40) and (31), their sum equals 5p⁵.

Comparing the representations of à of (40) and (30), it can be stated that the representation proposed by (40) entails an equipartition of weight among the 5 degrees of freedom of (32).

Remark 1. In the example, each coefficient {tilde over (ω)}_i of à is computed modulo p⁵⁻ⁱ. If the magnitude constraint (26) were to be applied to the coefficients on the RHS of (40) and (41), the coefficients ω_i would be reduced modulo p and the structure (34) would be demolished.

In practice, the integer N, as represented on the RHS of (40) and (41), should be treated as a polynomial in some integer variable u, say P(u), where P(u) happens to be computed at u=p.

Remark 2. In (32) the representation of the coefficients ω_i i is arbitrary. In (40) and (41) such coefficients are represented in base 10. They may be represented in any other base, such as p.

Remark 3. It should be noted that in (28) p⁴<N<p⁵ and in (32) A is being defined modulo p⁵. In general, such may not be the case. It is possible that A be defined modulo a larger power of p, depending on the requirements of the problem on hand. A similar situation occurs in the domain of irrational numbers, such as √{square root over (2)}. √{square root over (2)} may be computed with a large number of decimal digits, depending on the precision required by the problem on hand. No harm is done if the precision of the computed value of √{square root over (2)} is greater than needed.

As an example, consider the case when p=13 and N_1<p². Assume that N₁=v₀+v₁·p=10+2·p. It is desired to solveN₁≡A² (mod p⁵).  (46)

In this case the integers ω_i are defined by the following:

$\begin{array}{cc}\{\begin{array}{cc}{v}_0\equiv {\omega }_0^2& \left(\mathrm{mod}{p}^s\right)\\ v_1·p\equiv 2·{\omega }_0·{\omega }_1·P& \left(\mathrm{mod}{p}^5\right)\\ 0\equiv {\omega }_1^2·p^2+2·{\omega }_0·{\omega }_z·p^2& \left(\mathrm{mod}{p}^5\right)\\ 0\equiv 2·{\omega }_1·{\omega }_2·p^3+2·{\omega }_0·{\omega }_3·p^3& \left(\mathrm{mod}{p}^5\right)\\ 0\equiv 2·{\omega }_1·{\omega }_3·p^4+2·{\omega }_0·{\omega }_4·p^4+{\omega }_2^2·p^4& \left(\mathrm{mod}{p}^5\right)\end{array}& \left(47\right)\end{array}$

For ω₀=6 (mod p), the result is

$\begin{array}{cc}\begin{array}{c}{N}_1=10+2·p\\ \equiv {\left(181200+18120·p+1291·p^2+23·p^3+2·p^4\right)}^2\left(\mathrm{mod}{p}^5\right).\end{array}& \left(48\right)\end{array}$

Compare with (40).

Remark 4. As a further application of this method of representation of integers, consider the problem of computing Ã⁻¹ (mod p⁵) when à is defined as in (32). LetĀ⁻¹≡w₀+w₁·p+w₂·p²+w₃·p³+w₄·p⁴ (mod p⁵)  (49)and÷Ã⁻¹≡1 (mod p⁵)  (50)

The coefficients w_i should be defined as the least positive solutions of the following:

$\begin{array}{cc}\{\begin{array}{cc}{\tilde{\omega }}_0·w_0& \equiv 1\left(\mathrm{mod}{p}^5\right)\\ {\tilde{\omega }}_0·w_1+{\tilde{\omega }}_1·{\tilde{w}}_0& \equiv 1\left(\mathrm{mod}{p}^4\right)\\ {\tilde{\omega }}_0·w_2+{\tilde{\omega }}_1·{\tilde{w}}_1+{\tilde{\omega }}_2·{\tilde{w}}_0& \equiv 0\left(\mathrm{mod}{p}^3\right)\\ {\tilde{\omega }}_0·w_3+{\tilde{\omega }}_1·{\tilde{w}}_2+{\tilde{\omega }}_2·{\tilde{w}}_1+{\tilde{\omega }}_3·{\tilde{w}}_0& \equiv 0\left(\mathrm{mod}{p}^2\right)\\ {\tilde{\omega }}_0·w_4+{\tilde{\omega }}_1·{\tilde{w}}_3+{\tilde{\omega }}_2·{\tilde{w}}_2+{\tilde{\omega }}_3·{\tilde{w}}_1+{\tilde{\omega }}_4·{\tilde{w}}_0& \equiv 0\left(\mathrm{mod}p\right)\end{array}& \left(51\right)\end{array}$

In the example, Ã⁻¹≡18120+26749·p+1590·p²+73·p³+9·p⁴ (mod p⁵). The product ÷Ã⁻¹ also contains the following terms:

$\begin{array}{cc}\{\begin{array}{cc}\left({\omega }_1·w_4+{\omega }_2·w_3+{\omega }_3·w_2+{\omega }_4·w_1\right)·p^5& =347391·p^5\\ \left({\omega }_2·{\tilde{w}}_4+{\tilde{\omega }}_3·{\tilde{w}}_3+{\tilde{\omega }}_4·{\tilde{w}}_z\right)·p^6& =15478·p^6\\ \left({\tilde{\omega }}_3·{\tilde{w}}_4+{\tilde{\omega }}_4·{\tilde{w}}_3\right)·p^7& =353·p^7\\ {\tilde{\omega }}_4·{\tilde{w}}_4·P^8& =18·p^8.\end{array}& \left(52\right)\end{array}$

Supercongruences

This section summarizes the approach of U.S. Pat. No. 10,298,393 B1. This is generalized and improved upon via standard polynomials later.

Given p and N, select à as one of the solutions of (24) modulo pⁿ, computed using the procedure described in Section 7. Assume Ã>pⁿ.

Then, using (26), letN=òU²·p²−2·Ã·V·p²+V²·p⁴,  (53)where

$\begin{array}{cc}\{\begin{array}{c}\tilde{A}=\sum _{i=0}^{n-1}{\tilde{\omega }}_i·p^i\\ U=\sum _{i=1}^{n-1}{u}_i·p^{i-1}\\ V=\sum _{i=1}^{n-1}{v}_i·p^{i-2}\end{array}& \left(54\right)\end{array}$

Referring to (40), recall that each ω_i can be represented as

$\begin{array}{cc}{\omega }_i=\sum _{k=0}^{n-1-i}{\omega }_{i,k}·p^k.& \left(55\right)\end{array}$

Also,

$\begin{array}{cc}\{\begin{array}{c}{u}_i=\sum _{k=1}^{n-1-i}{u}_{i,k}·p^{k-1}\\ v_i=\sum _{k=1}^{n-1-i}{v}_{i,k}·p^{k-2}\end{array}& \left(56\right)\end{array}$ and

$\begin{array}{cc}\{\begin{array}{cc}{U}_{i,j}& =\stackrel{j}{\sum _{k=1}}{u}_{i,j}·p^{k-1}\\ V_{i,j}& =\sum _{k=1}^j{v}_{i,k}·p^{k-2}\end{array}& \left(57\right)\end{array}$ Then

$\begin{array}{cc}\{\begin{array}{c}r\equiv \tilde{A}+u_1·p+\left(-v_2+u_2\right)·p^2+\left(-v_3+u_3\right)·p^3+\dots +\left(-v_{n-1}+u_{n-1}\right)·p^{n-1}\left(\mathrm{mod}{p}^n\right)\\ s\equiv \tilde{A}-u_1·p+\left(-v_2-u_2\right)·p^2+\left(-v_3-u_3\right)·p^3+\dots +\left(-v_{n-1}-u_{n-1}\right)·p^{n-1}\left(\mathrm{mod}{p}^n\right)\end{array}& \left(58\right)\end{array}$

The representation (58) of r and s accounts for the fact that both r and s are smaller than pⁿ. However, using (58), the product of r by s contains powers of p greater than pⁿ, actually as high as p^2·n−2.

In order to uncover the properties which relate the coefficients of (58), it is necessary to compute, and represent without loss of information, the multiples of any pⁱ which results from the multiplication of r and s. To this end a new modulus is introduced, namely p^M, where M>n. The use of M does not affect the magnitude of N. If N<pⁿ, it can be represented as follows:

$\begin{array}{cc}\{\begin{array}{c}N=\sum _{i=0}^{n-1}{v}_i·p^i\\ v_i=0\mathrm{for}n-1<i\le M-1\end{array}& \left(59\right)\end{array}$

When M is employed in lieu of n, Ã should be computed as a solution of the following:N≡A² (mod p^M).  (60)

The Approach

In the case where (59) is employed, reduction of (58) modulo p³ yields

$\begin{array}{cc}\frac{N-{Ã}^2}{p^M}·p^M\equiv \left(-u_1^2-2·Ã·v_2\right)·p^2\left(\mathrm{mod}{p}^3\right).& \left(61\right)\end{array}$

Then, if the pair (ũ₁, {tilde over (v)}₂) is a solution of (61) modulo p, it is

$\begin{array}{cc}\frac{N-{Ã}^2}{p^M}·p^M+\left(\frac{{\tilde{u}}_1^2+2·\tilde{A}·{\tilde{v}}_2}{p}·p\right)·p^2\equiv \left(-2·{\tilde{u}}_1·u_2-2·\tilde{A}·v_3\right)·p^3\left(\mathrm{mod}{p}^4\right)& \left(62\right)\end{array}$

The LHS of this congruence contains a contribution to the set of multiples of p³. This contribution is usually denoted as a “carry”. The flow of carries from one digit to the higher powers of p increases the complexity of the factorization problem. The flow of carries would be controlled better if (61) were solved modulo p^M and the pair (u₁², v₂) were defined modulo p^M−2. In this case (62) could take the following form:

$\begin{array}{cc}\frac{N-{\tilde{A}}^2}{p^M}·p^M+\left(\frac{{\tilde{u}}_1^2+2·\tilde{A}·{\tilde{v}}_2}{p^{M-2}}·p^{M-2}\right)·p^2\equiv \left(-2·{\tilde{u}}_1·u_2-2·\tilde{A}·v_3\right)·p^3\left(\mathrm{mod}{p}^4\right)& \left(63\right)\end{array}$

This approach would require replacing the magnitude constraints (25) from the elements of {u_i} and {v_i} and assuring that the RHS of congruences such as (63) include all the terms which are multiples of any given pⁱ. Following this procedure, still there would be carries, as shown on the LHS of (63). However, such carries would flow from any given congruence directly into a pool of multiples of p^M.

In this approach, quantities such as ò−N are treated as polynomials in p, where the coefficients are integers unconstrained by (26) but instead subject to a different constraint such as (33).

Consider the representation of the pair (r, s) as in (58), where à is constructed as described above, and M is used in lieu of n. Thus, when r is multiplied by s, it is possible to group all the terms which contain any multiple of any given power of p, say pⁱ, and place the condition that the sum of their coefficients be congruent to zero modulo p^M−i.

However, resolving the integer ò−N into its components, the sum of the coefficients of pⁱ in (ò−N) equals

$\begin{array}{cc}\begin{array}{c}\sum _{k=0}^i{\tilde{\omega }}_k·{\tilde{\omega }}_{i-k}-v_i\equiv \text{\hspace{0.22em}}0\left(\mathrm{mod}{p}^{M-i}\right)\\ ={\tilde{\eta }}_i·p^{M-i}.\end{array}& \left(64\right)\end{array}$ (n_i an integer).

As a result, consider the case when it is desired to express v₆ as a function of all the u_l (1≤l≤5) and the v_j (2≤j≤5). It will be−(2·{tilde over (ω)}₀·v₆+2·{tilde over (ω)}₁·v₅+2·{tilde over (ω)}₂·v₄+2·{tilde over (ω)}₃·v₃+2·{tilde over (ω)}₄·v₂)+2·v₂·v₄+v₃²≡2·u₁·u₅+2·u₂·u₄+u₃² (mod p^M−6).  (65)

This congruence defines v₆ modulo p^M−6 as a function of lesser degree variables. If u₁≢0 (mod p) and if all variables of lesser degree are known, (65) defines a linear congruence between v₆ and u₅ modulo p^M−6. After determination of v₆, upon multiplication by p⁶, it will be

$\begin{array}{cc}\left(\frac{L{H}_6-R{H}_6}{p^{M-6}}·p^{M-6}\right)·p^6\equiv 0\left(\mathrm{mod}{p}^M\right),& \left(66\right)\end{array}$

where LH₆ and RH₆ denote the LHS and RHS of (65), respectively. The LHS of this latter congruence is a multiple of p^M and does not contain any power of p greater than p^M. In general, for 2≤i≤M−1,

$\begin{array}{cc}\{\begin{array}{c}{u}_1\not\equiv 0\left(\mathrm{mod}p\right)\\ 2\le i\le M-1\\ -2·\sum _{k=2}^i{\tilde{\omega }}_{i-k}·v_{\kappa }+\sum _{\kappa =2}^{i-2}{v}_k·v_{i-k}\equiv \sum _{/𝔠=1}^{i-1}{u}_k·u_{i-k}\left(\mathrm{mod}{p}^{M-i}\right).\end{array}& \left(67\right)\end{array}$

The first summation on the LHS of (67) contains terms which result from the multiplication of −2·Ã by (Ã−Y), when à is represented as described in Section 7. The second summation on the LHS results from (Ã−Y)².

In general, assume that u_M−j=0 for 1≤j≤j₀. Therefore, at this point, j₀ is an undetermined integer. The pair (r, s) is dependent on the set {u_i} and on the first elements of {v_i}, for 2≤i≤j₀+1. The general expression of (r, s) is

$\begin{array}{cc}\{\begin{array}{c}r={\tilde{\omega }}_0+{\tilde{\omega }}_1·p+{\tilde{u}}_1·p+\sum _{i=2}^{j_0}\tilde{\zeta }·p^i+{\zeta }_{j_0+1}·p^{j_0+1}+2·\sum _{i=2}^{j_0}{\tilde{u}}_i·p^i·2\sum _{i=j_0+1}^{M-j_0-1}{u}_i·p^i\\ s={\tilde{\omega }}_0+{\tilde{\omega }}_1·p-{\tilde{u}}_1·p+\sum _{i=2}^{j_0}{\tilde{\zeta }}_i·p^{\dot{t}}+{\zeta }_{j_0+1}·p^{j_0+1}\end{array}& \left(68\right)\end{array}$ whereζ_k={tilde over (ω)}_k−v_k−u_k.  (69)

Supercongruence for u₁ and u₂

To determine the first two coefficients of U, impose the condition that u_M−1=0 andω_i−u_i−v_i≡0 (mod p^M−i)for all i>2, also put ζ₂=ω₂−u₂−v₂. Then

Consider the case when it has been assumed that u_M−1=0. It is desired to determine a pair of divisors (r, s) when u_M−2≠0, if such a pair exists. In this case (68) can be written as follows:

$\begin{array}{cc}\{\begin{array}{cc}{u}_{M-1}=& 0\\ r=& {\tilde{A}}_2+u_1·p+\left(-v_2+u_2\right)·p^2\\ s=& \widetilde{A_2}-u_1·p+\left(-v_2+u_2\right)·p^2-2·\sum _{i=3}^{M-2}{u}_i·p^i\end{array}& \left(70\right)\end{array}$ whereÃ₂={tilde over (ω)}₀+{tilde over (ω)}₁·p+{tilde over (ω)}₂·p²  (71)and

$\begin{array}{cc}\{\begin{array}{c}{u}_{M-1}=0\\ r={\tilde{A}}_1+u_1·p+{\zeta }_2·p^2+2·\sum _{i=2}^{M-2}{u}_i·p^i\\ s={\tilde{A}}_1-u_1·p+{\zeta }_2·p^2\end{array}& \left(72\right)\end{array}$ whereÃ₁={tilde over (ω)}₀+{tilde over (ω)}₁·p  (73)and where ζ₂ is defined as in (69):

$\begin{array}{cc}\{\begin{array}{c}{u}_{M-1}=0\\ u_{M-2}\ne 0\\ {\zeta }_2={\omega }_2-v_2-u_2.\end{array}& \left(74\right)\end{array}$

Compare with (68) and (69).

Using (72), multiply r by s modulo p^M. Setting the sum of the coefficients of any given power of p congruent to zero (mod p^M−i) yields

$\begin{array}{cc}\{\begin{array}{c}{v}_0\equiv {\tilde{\omega }}_0^2\left(\mathrm{mod}{p}^M\right)\\ v_1\equiv 2·{\tilde{\omega }}_0·{\tilde{\omega }}_1\left(\mathrm{mod}{p}^{M-1}\right)\\ v_2\equiv -u_1^2+{\tilde{\omega }}_1^2+2·{\tilde{\omega }}_0·{\zeta }_2+2·{\tilde{\omega }}_0·u_2\left(\mathrm{mod}{p}^{M-2}\right)\\ v_3\equiv 2·{\tilde{\omega }}_0·u_3+2·\left({\tilde{\omega }}_1-u_1\right)·u_2+2·{\tilde{\omega }}_1·{\zeta }_2\left(\mathrm{mod}{p}^{M-3}\right)\\ v_4\equiv 2·{\tilde{\omega }}_0·u_4+2·\left({\tilde{\omega }}_1-u_1\right)·u_3+2·{\zeta }_2·u_2+{\zeta }_2^2\left(\mathrm{mod}{p}^{M-4}\right)\\ \mathrm{for}i>4\\ v_i\equiv 2·{\tilde{\omega }}_0·u_2+2·\left({\tilde{\omega }}_i-u_i\right)·u_{i-1}+2·{\zeta }_2·u_{i-2}\left(\mathrm{mod}{p}^{M-i}\right)\\ \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \\ v_{M-2}\equiv 2·{\tilde{\omega }}_0·u_{M-2}+2·\left({\tilde{\omega }}_1-u_1\right)·u_{M-3}+2·{\zeta }_2·u_{M-4}\left(\mathrm{mod}{p}^2\right)\\ v_{M-1}\equiv 2·\left({\tilde{\omega }}_1-u_1\right)·u_{M-2}+2·{\zeta }_2·u_{M-3}\left(\mathrm{mod}p\right)\end{array}& \left(75\right)\end{array}$

Let RH_i and LH_i denote the RHS and the LHS, respectively, of that congruence in (75) which is defined modulo p^M−i. Then, it must beRH_i−LH_i≡0 (mod p^M−i)  (76)

Define

$\begin{array}{cc}{C}_i=\frac{{\mathrm{RH}}_i-{\mathrm{LH}}_i}{p^{M-i}}& \left(77\right)\end{array}$

There is one condition which is not contained in (75): that is the condition that the sum of all multiples of p^M in the system be equal to zero:

$\begin{array}{cc}0=\sum _{i=0}^{M-1}{C}_i.& \left(78\right)\end{array}$

Refer to (72).

In this equation the integer u_M−2 is defined modulo p² by the second last congruence of (75). Also in the computation of C_M−1, the integers u_M−2 and u_M−3 equal the corresponding values in the second last congruence of (75). The set of congruences (75) shall be referred as a supercongruence.

Supercongruence for u₃

Consider the case when, given M, the system (75) has produced a set of viable pairs (u₁, u₂). In general, the majority of such pairs do not satisfy the conditions on the carries and cannot be considered as viable candidates.

Given a selection of u₁, upon multiplication of r by s, the following relationships are applicable:

$\begin{array}{c}{u}_{M-1}=0\\ v_0\equiv {\omega }_0^2\left(\mathrm{mod}{p}^M\right)\\ v_1\equiv 2·{\omega }_0·{\omega }_1\left(\mathrm{mod}{p}^{M-1}\right)\\ v_2\equiv 2·{\omega }_0·{\omega }_2+{\omega }_1^2-u_1^2-2·{\omega }_0·v_2\left(\mathrm{mod}{p}^{M-2}\right)\\ \equiv {\omega }_1^2-u_1^2+2·{\omega }_0·{\zeta }_2+2·{\omega }_0·u_2\left(\mathrm{mod}{p}^{M-2}\right).\end{array}$

Given u₁, this congruence produces v₂ modulo p^M−2. The last congruence makes use of the definitionζ₂≡{tilde over (ω)}₂−v₂−u₂ (mod p^M−2).

Given a selection of u₂,

$\begin{array}{c}{v}_3\equiv 2·{\omega }_0·{\omega }_3+2·{\omega }_1·{\omega }_2-2·u_1·u_2-2·{\omega }_1·v_2-2·{\omega }_0·v_3\left(\mathrm{mod}{p}^{M-3}\right)\\ \equiv 2·{\tilde{\omega }}_0·u_3+2·\left({\tilde{\omega }}_1-u_1\right)·u_2+2·{\tilde{\omega }}_1·{\zeta }_2+2·{\tilde{\omega }}_0·{\zeta }_3\left(\mathrm{mod}{p}^{M-3}\right)\end{array}$

Given u₂, this congruence produces v₃ modulo p^M−3. The last congruence makes use of the definitionζ₃≡{tilde over (ω)}₃−v₃−u₃ (mod p^M−3).

Given a selection of the auxiliary variable u₃, letv₄≡2·ω₀·ω₄+2·ω₁·ω₃+ω₂²−2·u₁·u₃−u₂²−2·ω₂·v₂−2·ω₁·v₃+v₂²−2·ω₀·v₄ (mod p^M−4)

Given u₃, this congruence produces v₄ modulo p^M−4.

Multiplication of r by s producesv₅≡2·ω₀·u₅+2·(ω₁−u₁)·u₄+2·ζ₂·u₃+2·ζ₃·u₂+2·ζ₂·ζ₃ (mod p^M−5)v₆≡2·ω₀·u₆+2·(ω₁−u₁)·u₅+2·ζ₂·u₄+2·ζ₃·u₃+ζ₃² (mod p^M−6)

For i>6, it will bev₇≡2·ω₀·u₇+2·(ω₁−u₁)·u₆+2·ζ₂·u₅+2·ζ₃·u₄ (mod p^M−7)v_i≡2·ω₀·u_i+2·(ω₁−u₁)·u_i−1+2·ζ₂·u_i−2+2·ζ₃·u_i−3 (mod p^M−i)with, finally:v_M−3≡2·ω₀·u_M−3+2·(ω₁−u₁)·u_M−4+2·ζ₂·u_M−5+2·ζ₃·u_M−6 (mod p³)v_M−2≡2·(ω₁−u₁)·u_M−3+2·ζ₂·u_M−4+2·ζ₃·u_M−5 (mod p²)v_M−1≡2·ζ₂·u_M−3+2·ζ₃·u_M−4 (mod p)

IN SUMMARY, given (u_i, u₂) and the selection of u₃, IF the pair (r, s) is represented as follows:

$\begin{array}{cc}\{\begin{array}{c}{u}_{M-1}=0\\ u_{M-2}=0\\ r={\tilde{A}}_1+{\tilde{u}}_1·p+{\tilde{\zeta }}_2·p^2+{\zeta }_3·p^3+2·{\tilde{u}}_2·p^2+2·\sum _{i=2}^{M-4}{u}_i·p^i\\ s={\tilde{A}}_1+{\tilde{u}}_1·p+{\tilde{\zeta }}_2·p^2+{\zeta }_3·p^3\left(\mathrm{mod}p\right),\end{array}& \left(79\right)\end{array}$ multiplication of r by s modulo p^M yields:

$\begin{array}{cc}\{\begin{array}{c}{u}_{M-2}=0\\ u_{M-1}=0\\ v_0\equiv {\tilde{\omega }}_0^2\left(\mathrm{mod}{p}^M\right)\\ v_1\equiv 2·{\tilde{\omega }}_0·{\tilde{\omega }}_1\left(\mathrm{mod}{p}^{M-1}\right)\\ v_2\equiv {\tilde{\omega }}_1^2-u_1^2+2·{\tilde{\omega }}_0·{\zeta }_2+2·{\tilde{\omega }}_0·u_2\left(\mathrm{mod}{p}^{M-2}\right)\\ v_3\equiv 2·{\tilde{\omega }}_0·u_3+2·\left({\tilde{\omega }}_1-u_1\right)·u_2+2·{\stackrel{.}{\stackrel{~}{\omega }}}_1·{\zeta }_2+2·{\tilde{\omega }}_0·{\zeta }_3\left(\mathrm{mod}{p}^{M-3}\right)\\ v_4\equiv 2·{\omega }_0·u_4+2·\left({\omega }_1-u_1\right)·u_3+2·{\zeta }_2·u_2+2·{\tilde{\omega }}_1{\zeta }_3+{\zeta }_2^2\left(\mathrm{mod}{p}^{M-4}\right)\\ v_5\equiv 2·{\omega }_0·u_5+2·\left({\omega }_1-u_1\right)·u_4+2·{\zeta }_2·u_3+2·{\zeta }_3·u_2+2·{\zeta }_2·{\zeta }_3\left(\mathrm{mod}{p}^{M-5}\right)\\ v_6\equiv 2·{\omega }_0·u_6+2·\left({\omega }_1-u_1\right)·u_5+2·{\zeta }_2·u_4+2·{\zeta }_3·u_3+{\zeta }_3^2\left(\mathrm{mod}{p}^{M-6}\right)\\ \mathrm{for}i>6\\ v_i\equiv 2·{\omega }_0·u_i+2·\left({\omega }_1-u_1\right)·u_{i-1}+2·{\zeta }_2·u_{i-2}+2·{\zeta }_3·u_{i-3}\left(\mathrm{mod}{p}^{M-i}\right)\\ \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \cdots \\ v_{M-3}\equiv 2·{\omega }_0·u_{M-3}+2·\left({\omega }_1-u_1\right)·u_{M-4}+2·{\zeta }_2·u_{M-5}+2·{\zeta }_3·u_{M-6}\left(\mathrm{mod}{p}^3\right)\\ v_{M-2}\equiv 2·\left({\omega }_1-u_1\right)·u_{M-3}+2·{\zeta }_2·u_{M-4}+2·{\zeta }_3·u_{M-5}\left(\mathrm{mod}{p}^2\right)\\ v_{M-1}\equiv 2·{\zeta }_2·u_{M-3}+2·{\zeta }_3·u_{M-4}\end{array}& \left(80\right)\end{array}$

For each initial selection of the pair (u₁, u₂), the system (80) may produce a quintuple (u₁, u₂, u₃, ζ₂, ζ₃) such that r·s≡N (mod p^M).

Supercongruence for u₄

After the determination of the roster of candidates quintuples (ũ₁, ũ₂, ũ₃, {tilde over (ζ)}₂, {tilde over (ζ)}₃), a similar procedure can be used to determine the roster {(u₄, ζ₄)}.

In this case, (68) yields:

$\begin{array}{cc}\{\begin{array}{c}{v}_0\equiv {\tilde{\omega }}_0^2\left(\mathrm{mod}{p}^M\right)\\ v_1\equiv 2·{\tilde{\omega }}_0·{\tilde{\omega }}_1\left(\mathrm{mod}{p}^{M-1}\right)\\ v_2\equiv -{\tilde{u}}_1^2+{\tilde{\omega }}_1^2+2·{\tilde{\omega }}_0·{\zeta }_2+2·{\tilde{\omega }}_0·{\tilde{u}}_2\left(\mathrm{mod}{p}^{M-2}\right)\\ v_3\equiv 2·{\tilde{\omega }}_0·u_3+2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·{\tilde{u}}_2+2·{\tilde{\omega }}_1·{\hat{\zeta }}_2+2·{\tilde{\omega }}_0·{\tilde{\zeta }}_3\left(\mathrm{mod}{p}^{M-3}\right)\\ v_4\equiv 2·{\tilde{\omega }}_1·{\tilde{\zeta }}_3+2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·{\tilde{u}}_3+2·{\tilde{\omega }}_0·\left({\tilde{\omega }}_4-v_{4,1}\right)+{\tilde{\zeta }}_2^2+2·{\tilde{u}}_2·{\tilde{\zeta }}_2^2(\mathrm{mod}{p}^{M-4)}\\ v_5\equiv 2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·u_4+2·{\tilde{\omega }}_0·u_5+2·{\tilde{\omega }}_1·{\tilde{\zeta }}_4+\sum _{k=2}^3{\tilde{\zeta }}_k·{\tilde{\zeta }}_{5-k}+2·\sum _{k=2}^3{\tilde{u}}_{5-k}·{\tilde{\zeta }}_k\left(\mathrm{mod}{p}^{M-5}\right)\\ \mathrm{For}6\le h\le 8\\ v_h\equiv 2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·u_{h-1}+2·{\tilde{\omega }}_0·u_h+\sum _{k=h-4}^4{\tilde{\zeta }}_k·{\tilde{\zeta }}_{h-k}+2·\sum _{k=2}^3{\tilde{u}}_{h-k}·{\tilde{\zeta }}_k+2·u_{h-4}·{\zeta }_4\left(\mathrm{mod}{p}^{M-h}\right)\\ \mathrm{For}6\le h\le M-4\\ v_h\equiv 2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·u_{h-1}+2·{\tilde{\omega }}_0·u_h+2·\sum _{k=2}^3{\tilde{u}}_{h-k}·{\tilde{\zeta }}_k+2·u_{h-4}·{\zeta }_4(\mathrm{mod}{p}^{M-h)}\end{array}& \left(81\right)\end{array}$

To determine u₄ (mod p), consider the raster of candidate triads (ũ₁, ũ₂, ũ₃) which were already produced. Substitute ũ₁, ũ₂, and ũ₃ into (81) in lieu of u₁, u₂, and u₃, respectively, and search for an integer u₄ modulo p which satisfies (81).

The General Supercongruence, Persistent Solutions

Consider the case when a candidate set (ũ₁, {tilde over (ζ)}₂, . . . , {tilde over (ζ)}_j0, ζ_j0|M) has been determined. It is desired to determine a candidate set (ũ₁, {tilde over (ζ)}₂, . . . , {tilde over (ζ)}_j0, ζ_j0+1|M), if such a set exists.

Notice that in (68) the unknown variables are ζ_j0+1 and the integers u_i, or j₀+1≤i≤M−j₀−1.

Proceeding as in (75) and (80), multiply r by s modulo p^M and define the corresponding congruences modulo p^M−i. The congruences which are defined modulo p^M−2 through p^M−j0 are not affected by ζ_j0+1·p^j0+1).

The congruence modulo p^M−j0−1 does not contain u_j0+1. After the computation of u_j0+1,1, the system of congruences allows one to determine the whole set {u_i}.

In general, multiplication of r by s modulo p^M using (68) yields

$\begin{array}{cc}\{\begin{array}{c}{v}_{j_0+1}\equiv 2·{\tilde{\omega }}_0·{\zeta }_{j_0+1}+2·{\tilde{\omega }}_1·{\tilde{\zeta }}_{j_0}+\sum _{k=2}^{j_0-1}{\tilde{\zeta }}_k·{\tilde{\zeta }}_{j_0+1-k}+2·{\tilde{\omega }}_0·{\tilde{u}}_{j_0+1}+2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·{\tilde{u}}_{j_0}+2·\sum _{k=2}^{j_0-1}{\tilde{u}}_{j_0+1-k}·{\tilde{\zeta }}_k\left(\mathrm{mod}{p}^{M-j_0-1}\right)\\ v_{j_0+2}\equiv 2·{\tilde{\omega }}_1·{\zeta }_{j_0+1}+\sum _{k=2}^{j_0-1}{\tilde{\zeta }}_{j_0+2-k}·{\tilde{\zeta }}_k+2·{\tilde{\omega }}_0·{\tilde{u}}_{j_0+2}+2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·{\tilde{u}}_{j_0+1}+2·\sum _{k=2}^{j_0}{\tilde{u}}_{j_0+2-k}·{\tilde{\zeta }}_k\left(\mathrm{mod}{p}^{M-j_0-2}\right)\\ \mathrm{For}3\le \delta \le j_0+2\\ v_{j_0+\delta }=\sum _{k=\delta -1}^{j_0+1}{\tilde{\zeta }}_{j_0+\delta -k}·{\tilde{\zeta }}_k+2·{\tilde{\omega }}_0·u_{j_0+\delta }+2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·u_{j_0+\delta -1}+2·\sum _{k=2}^{j_0+1}{u}_{j_0+\delta -k}·{\tilde{\zeta }}_k\left(\mathrm{mod}{p}^{M-j_0-\delta }\right)\\ \mathrm{For}{j}_0+4\le \delta \le n-1-j_0\\ v_{j_0+\delta }\equiv 2·{\tilde{\omega }}_0·u_{j_o+\delta }+2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·u_{j_0+\delta -1}+2·\sum _{k=2}^{j_0+1}{u}_{j_0+\delta -k}·{\tilde{\zeta }}_k\left(\mathrm{mod}{p}^{M-j_0-\delta }\right).\end{array}& \left(82\right)\end{array}$

Note that u_j0+δ=0 for n−2−j₀≤δ≤M−1−j₀.

A set of coefficients (ũ₁, ũ₂, . . . , ũ_M−1) and ({tilde over (v)}₂, {tilde over (v)}₃, . . . , {tilde over (v)}_M−1) is called a persistent solution if the first j₀+1 of the u_i satisfy the corresponding supercongruence (82).

Standard Polynomials

The supercongruences can be clarified with the use of polynomials. The approach here shall be slightly more general than that taken previously.

This section shall make use of vectors of non-negative integers k=[k₀, . . . , k_M−1]. If k and k′ are two such vectors, then write k≤k′ if k_i≤k′_i for i=0, . . . , M−1. It is also occasionally convenient to regard k and k′ as zero-padded on the right, so that the comparison k≤k′ becomes meaningful even if k and k′ have different lengths.

A vector k=[k₀, . . . , k_M−1] is called monotone decreasing if k₀≥k₁≥ . . . ≥k_M−1.

Definition 1. Let p be prime, M be a positive integer, and k=[k₀, . . . , k_M−1] be a vector of non-negative integers. A polynomial f(x)=f₀+f₁x+f₂x²+ . . . +f_M−1x^M−1 is called p^k-standard if0≤f_i<p^ki for i=0,1, . . . ,M−1.

Definition 2. Let p, k be as in Definition 1. Let f(x)=f₀+f₁x+ . . . +f_nxⁿ be a polynomial with integer coefficients. The p^k-standard part of f(x) is the polynomialSP_pkf(x)=f₀+f₁x+ . . . +f_nxⁿ where, for 0≤i<M,f_i=f_i mod p^ki.

Note that if f is p^k-standard, then it is p^k′-standard for all k′≥k. When p and k are understood, SP_pk may be abbreviated as SP.

Definition 3. If f and g are integer polynomials, thenf≡g (SP_pk)shall mean thatSP_pkf=SP_pkg.

Digit expansions of positive integers:

Suppose the integer N is prepared as above, and N=v₀+v₁p+ . . . +v_n−1pⁿ⁻¹ is the p-adic digit expansion of N. Thenv(x)=v₀+v₁x+ . . . +v_n−1xⁿ⁻¹ is p¹ⁿ-standard where 1_n=[1, 1, . . . , 1] (n times).

Theorem 1. Given a non-negative integer N, there exists a unique 1_n-standard polynomial v(x) such that v(p)=N.

The following recursive algorithm produces the coefficients of the polynomial v(x).

• • If N=0, then v(x)=0.
  • Otherwise, let N₁, a₀ be the quotient and remainder of N on division by p, respectively. Then let v(x)=α₀+xv₁ (x) where v₁(x) is the polynomial obtained from applying this algorithm to N₁.

This algorithm terminates after [1+log_pN] steps, and it is clear by induction that N=v(p). For uniqueness, if v and it are two standard polynomials such that v(p)=μ(p), say v(x)=a₀+xv₁(x) and μ(x)=b₀+xμ₁ (x), then v(p)≡μ(p) (mod p) implies that a₀≡b₀(mod p) and therefore a₀=b₀ since both are non-negative integers less than p. It then follows that v₁(p)=μ₁(p), which now implies uniqueness by induction on the degree.

Properties of the standard part

Proposition 1. f+g≡SP_pkf+SP_pkg (SP_pk) and, if k is monotone decreasing, then f·g≡SP_pkf·SP_pkg (SP_pk)

The following proposition motivates a choice of standard polynomials relevant to the supercongruences:

Proposition 2. Suppose that k=[M, M−1, . . . , 1]. Iff(x)≡g(x) (SP_pk),thenf(p)≡g(p) (mod p^M).

In particular, this implies that if standard polynomials A, U, V are chosen such thatv(x)≡(A(x)−U(x)−V(x))(A(x)+U(x)−V(x)) (SP_pk),then the difference(A(p)−U(p)−V(p))(A(p)−U(p)+V(p))−v(p)is a multiple of p^M, and represents the accumulated carry of the product, which for the purposes of factorization is desired to be zero. The advantage of this approach is that it allows the carry to be deferred to the final stage of the process.

Standard Polynomial Inversion

Theorem 2. Let p be prime and k a nonempty vector of positive exponents. Suppose that f(x) is a p^k-standard polynomial such that f(0)≢0 (mod p). Then there exists a unique p^k-standard polynomial g(x) such that f(x)g(x)≢1 (SP_pk).

Proof The theorem shall be established by first giving its iterative solution. Since f(0)≢0 (mod p), there exists an integer γ₀ such that γ₀f(0)≡1 (mod p). Let g₀(x)=γ₀ and, for j=0,1, . . . , defineg_j+1(x)=SP((2−f(x)g_j(x))g_j(x)).

The iteration reaches a fixed point within ┌log₂max(k₀, k₁+1, . . . , k_M−1+M−1)┌ iterations. Indeed, define a norm on the set of integer polynomials via|f|_p=inf{p^−r−s|r, sϵ, f≡O(x^r) (mod p⁵)}.

Then, it shall be shown below that|1−fg_j+1|_p≤|1−fg_j|_p².  (83)

The constant term of 1−fg₀ is zero mod p: i.e., |1−fg₀|<p⁻¹. Consequently it follows by repeated squaring that |1−fg_j|≤p^−2j for all j. Thus as soon as 2^j>max(k₀, k₁+1, . . . , k_M−1+M−1), the standard part of 1−fg_j is zero and g_j is the standard polynomial inverse to f.

It remains to compute 1−fg_j+1:

$\begin{array}{c}1-{\mathrm{fg}}_{j+1}=1-f\left(2-{\mathrm{fg}}_j\right)g_j\\ =\left(1-{\mathrm{fg}}_j\right)-\left(1-{\mathrm{fg}}_j\right)g_j\\ ={\left(1-{\mathrm{fg}}_j\right)}^2\end{array}$ whence (83) by multiplicativity of the norm. □

Standard Polynomial Square Root

Theorem 3. Let p be an odd prime and k a nonempty vector of positive exponents. If v(x) is an integer polynomial such that v(0)≡α² (mod p), then there exists a unique standard polynomial A(x) such that:A²(x)≡v(x) (SP_pk),andA(0)≡α (mod p).

(This theorem implies in particular that, given {tilde over (ω)}₀, there is a unique sequence {tilde over (ω)}₁, {tilde over (ω)}₂, . . . , {tilde over (ω)}_M−1 such that (64) holds.)

Proof. By assumption, v(0) is a quadratic residue. Let α²≡v(0) (mod p). Define A₀(x)=αand, for k=0,1, . . . , defineA_k+1(x)=2⁻¹(A_k(x)+v(x)A_k(x)⁻¹) (SP)where at each stage of the iteration, the inverses are computed as in the previous section.

Consider the difference

$\begin{array}{c}v-A_{j+1}^2\equiv v-\frac{1}{4}{A}_j^2-\frac{1}{2}v-\frac{1}{4}{v}^2{A}_j^{-2}\\ =\frac{1}{2}\left(v-A_j^2\right)+\frac{1}{4}\left(A_j^2-\frac{v^2}{A_j^2}\right)\\ =\frac{1}{2}\left(v-A_j^2\right)+\frac{1}{2}\frac{A_{j+1}}{A_j}\left(A_j-\frac{v}{A_j}\right)\\ =\frac{1}{2}\left(v-A_j^2\right)\left(1-\frac{A_{j+1}}{A_j}\right).\end{array}$

Next, note that

$1-\frac{A_{j+1}}{A_j}=\frac{1}{2}\left(\frac{v-A_j^2}{A_j}\right).$

Substituting into the above gives

$v-A_{j+1}^2=\frac{1}{4}{\left(v-A_j^2\right)}^2{A}_j^{-1}$

and therefore, by multiplicativity of the norm from the proof of Theorem 2,|v−A_j+1²|_p≤|v−A_j²|_p².

Hence,A_j²≡v (SP)as soon as 2^j>max(k₀, k₁+1, . . . , k_M−1+M−1).□

Standard Polynomial Factorization

Let N be an integer prepared as in the previous section, and let v(x) be the polynomial obtained from the p-adic digit expansion of N Let A(x) be a standard polynomial such thatA²(x)≡v(x) (SP_pk).

Definition 4. A standard polynomial factorization of v(x) is a pair of standard polynomials U(x), V(x) such that U(0)=V(0)=V′(0)=0 for which:

• • the standard part of the polynomial(A(x)+U(x)−V(x))(A(x)−U(x)−V(x))is equal to v(x).

That is:(A(x)+U(x)−V(x))(A(x)−U(x)−V(x))≡v(x) (SP_pk).  (84)

The condition U(0)=0 shall be abbreviated U(x)=O(x), and the pair of conditions V(0)=V′(0)=0 shall be abbreviated V(x)=O(x²). Note polynomial factorization in the usual sense will not work: v(x) is very unlikely to factor completely, even if N is guaranteed to have factors. For example, with N=15, p=11, v(x)=2+91x+6x² is irreducible, even though N=v(11)=15 has factors 3×5.

U(x) determines V(x) uniquely:

Theorem 4. Suppose A(x) is a standard polynomial such that A(x)²≡v(x) (SP_pk). Let U(x) be a standard polynomial satisfying U(x)=O(x), Then there exists a unique standard polynomial V(x) satisfying V(x)=O(x²) such that (A(x)+U(x)−V(x))(A(x)−U(x)−V(x))≡v(x) (SP_pk)

Proof. Rearranging(A+U−V)(A−U−V)−v=0as a quadratic equation in V gives:V²−2AV+(A²−U²−v)=0.

Let Δ(x)=U²(x)+v(x) be the quarter discriminant of the quadratic. Since U(0)=0 and v(0) is a quadratic residue modulo p, Δ(0) is also a quadratic residue modulo p, having square root ω₀ mod p. Therefore by Theorem 3, there exists a unique standard polynomial √{square root over (Δ)}(x) with the property that √{square root over (Δ)}(0)≡ω₀ (mod p) and√{square root over (Δ)}(x)²≡Δ(x) (SP)

Note that√{square root over (Δ)}(x)=A(x)+O(x²)

ThereforeV(x)=A(x)−√{square root over (Δ)}(x) (SP_pk)satisfies V(x)=O(x²).

For uniqueness, notice that the other candidate solution to the quadratic isA(x)+√{square root over (Δ)}(x)≡2A(x)+O(x²) (SP_pk)has nonzero lower order terms in x. □

Different Forms of Standard Polynomial Factorization

Definition 5. Given a Factorization

v(x)≡(A(x)+U(x)−V(x))(A(x)−U(x)−V(x)) (SP_pk)where U(0)=V(0)=V′(0)=0, define a polynomial ζ(x) byζ(x)=A₍₂₎(x)−U₍₂₎(x)−V(x),where A₍₂₎(x) and U₍₂₎(x) are the quadratic Taylor remainders of A(x) and U(x):A₍₂₎(x)=A(x)−A₁(x), U₍₂₎(x)=U(x)−U₁(x)where A₁ and U₁ denote the linearizations of A an U, respectively:A₁(x)=A(0)+A′(0)x=ω₀+ω₁x U₁(x)=U′(0)x=u₁x.

Plugging the definition of ζ(x) into the standard factorization problem(A(x)+U(x)−V(x))(A(x)−U(x)−V(x))≡v(x) (SP_pk).gives(A₁(x)−U₁(x)+2U(x)+ζ(x))(A₁(x)−U₁(x)+ζ(x))≡v(x) (SP)  (85)

That is,r(x)s(x)≡v(x) (SP)where

$\begin{array}{cc}\{\begin{array}{c}r\left(x\right)=A_1\left(x\right)-U_1\left(x\right)+2U\left(x\right)+\zeta \left(x\right))\\ s\left(x\right)=A_1\left(x\right)-U_1\left(x\right)+\zeta \left(x\right)\end{array}& \left(86\right)\end{array}$

Persistent factorizations

Definition 6. A k-Standard Polynomial Factorization

v(x)≡r(x)s(x) (SP_pk)is called persistent if, for all k′≥k, there exist k′-standard polynomials r′(x) and s′(x) having the same degree as r(x) and s(x), respectively, such thatr′(x)≡r(x) (SP_pk)s′(x)≡s(x) (SP_pk)v(x)≡r′(x)s′(x) (SP_pk′).

Persistent factorizations as lifts of factorizations mod p:

The following theorem allows polynomials U(x) and ζ(x) modulo p to be determined from a factorization modulo p of v(x). A standard polynomial factorization may then be obtained by applying a lift.

Theorem 5. Suppose that v(x)≡a(x)b(x) (mod p) where a, b are polynomials mod p, and a(0)≡b(0)≡ω₀ (mod p). Then the polynomialsA₁(x)=ω₀+ω₁x ζ(x)=b(x)−b(0)−b′(0)x mod pU(x)=(a(x)−b(x))/2 mod p satisfyA₁(x)−u₁x+2U(x)+ζ(x)=a(x)A₁(x)−u₁x+ζ(x)=b(x),where u₁=U′(0). That is,(A₁(x)−u₁x+2U(x)+ζ(x))(A₁(x)−u₁x+ζ(x))≡v(x) (mod p).

Proof. Write a(x)=ω₀+a₁x+a₂x²+ . . . , b(x)=ω₀+b₁x+b₂x²+ . . . Then since a(x)b(x)≡v(x)≡ω₀²+2ω₀ω₁x+O(x²) (mod p),

it follows that2ω₁=a₁+b₁ and so u₁=(a₁−b₁)/2=ω₁−b₁ Now,

$\begin{array}{c}{A}_1\left(x\right)-u_{1}x+\zeta \left(x\right)={\omega }_0+{\omega }_{1}x-\left({\omega }_1-b_1\right)x+\zeta \left(x\right)\\ ={\omega }_0+b_{1}x+\zeta \left(x\right)\\ =b\left(x\right).\end{array}$

Also, since 2U(x)=a(x)−b(x),

$\begin{array}{c}{A}_1\left(x\right)-u_{1}x+2U\left(x\right)+\zeta \left(x\right)={\omega }_0+1/2\left({\alpha }_1+b_1\right)x-1/2\left(a_1-b_1\right)x+a\left(x\right)-b\left(x\right)+\zeta \left(x\right)\\ ={\omega }_0+b_{1}x+a\left(x\right)-b\left(x\right)\zeta \left(x\right)\\ =a\left(x\right)\end{array}$ as claimed.□

Carry Phase

The final phase is concerned with an equation of the formA²=T·N+correction where the correction is a multiple of p^M. That isA²=T·N+k·p^M expresses A² as the sum of a main term T·N and a correction k·p^M. To analyze the correction term in more detail, a standard polynomial factorization yields a standard polynomial A(x) and a roster of pairs of standard polynomials (U(x), V(x)) such that(A(x)−U(x)−V(x))(A(x)+U(x)−V(x))−v(x)≡0 (SP_pk).  (87)

Consider the case where k=[M,M−1, . . . , 2,1]. Then, evaluating at x=p yields(A(p)−U(p)−V(p))(A(p)+U(p)−V(p))≡v(p) (mod p^M).

This equation implies that the difference(A(p)−U(p)−V(p))(A(p)+U(p)−V(p))−v(p)is a multiple of p^M, which shall be thought of as a carry, comprised of the carries from the individual terms of the difference (A−U−V)(A+U−V)−v, and deferred to the final phase of the process.

In the carry phase, the roles of the correction term and main term are reversed. What was formerly the correction term, the “carry” −k·p^M is now the main term. And what was formerly the main term T·N is now the correction.

Geometric Semigroup Law

Henceforth, set A=A(p), U=U(p), V=V(p) with U≡0 (mod p), V≡0 (mod p²), Let C be an integer for which (A−U−V)(A+U−V)−N≡C (mod V), which is to say that:(A−U−V)(A+U−V)−N=BV+C for some integers B and C. Assume that C does not share a factor with N. Regard the integer V as a parameter and consider the quadratic polynomial in V:q(V)=(A−U−V)(A+U−V)−BV−C.

Note that q(V)≡0 (mod N₀). The discriminant of this quadratic isΔ=B²+4(U²+AB+C).

To facilitate the goal of factorization of q(V), it is desired to change parameters (U, V, C) such that the discriminant becomes a perfect square, because in this case Δ will factor over the integers.

A set of rescalings of the parameters is proposed that shall preserve the property of being a perfect square. Specifically, rescale U, V, C such that CU and UV remain constant. To this end, introduce free homogeneous parameters X₀, X₁ and:

• • rescale C so that X₀C′≡X₁ (mod N₀);
  • rescale V so that X₁V≡X₀CV′ (mod N₀); and
  • rescale U so that X₀U≡X₁U′ (mod N₀).

Prolong by introducing a parameter X₂ such that C²Δ=X₂² (mod N), and X₃ such that X₀X₃≡X₁² (mod N). Then points [X₀, X₁, X₂, X₃] are desired such that the quadratic equations are satisfied:

$\begin{array}{cc}\begin{array}{cccc}{Q}_1:& X_0{X}_3-X_1^2& \equiv 0& \left(\mathrm{mod}{N}_0\right)\\ Q_2:& 4X_1{X}_3+\left(B^2+4AB\right)X_0{X}_3+4U^2{C}^2{X}_0^2-4X_2^2& \equiv 0& \left(\mathrm{mod}{N}_0\right)\end{array}\}& \left(88\right)\end{array}$

A factor is found once one of the scaling parameters [X₀, X₁, X₂, X₃] has a non-trivial factor in common with N. Note that the first equation of (88) is a cylinder over a plane conic. The lines X₀, X₁, X₃=constant are the reguli of the cylinder. An initial non-trivial point on the intersection is [X₀, X₁, X₂, X₃]=[1,0,CU,0].

The following operations are well-defined on the quartuples P: [X₀, X₁, X₂, X₃] satisfying (88), are defined:

The point [X₀, X₁, −X₂, X₃] is the other point on the quadric Q₂ lying on the same regulus as P.

Given two points in general position P: [X₀, X₁, X₂, X₃], Q: [Y₀, Y₁, Y₂, Y₃], there is a third point R: [Z₀, Z₁, Z₂, Z₃] satisfying both (88) such that OPQR are coplanar, where O=[0,0,0,1].

Let a=(B²/4+AB) mod N₀. Let [X₀, X₁, X₂, X₃] be coordinates of the first point and [Y₀, Y₁, Y₂, Y₃] coordinates of the second point, so the congruences hold:X₂²≡X₁X₃+aX₀X₃+C²U²X₀² (mod N₀)Y₂²≡Y₁Y₃+aY₀Y₃+C²U²Y₀² (mod N₀).

Then the coordinates of the third point [Z₀, Z₁, Z₂, Z₃] are determined mod N₀ by:

• • If [X₀: X₁: X₂: X₃]=[Y₀: Y₁: Y₂: Y₃], then

$\begin{array}{c}{Z}_0=16X_0^4{X}_2^4\\ Z_1=X_0^4{X}_2^2\left(4X_3^2-16C^2{U}^2{X}_0^{2}a-32C^2{U}^2{X}_0{X}_1\right)\\ Z_2=-2X_0{X}_2\left(\begin{array}{c}8X_0^3{X}_1^3{a}^3+36X_0^2{X}_1^4{a}^2-8X_0^3{X}_1{X}_2^2{a}^2+54X_0{X}_1^{5}a-\\ -36X_0^2{X}_1^2{X}_2^{2}a+27X_1^6-36X_0{X}_1^3{X}_2^2+8X_0^2{X}_2^4\end{array}\right)\\ Z_3={\left(4X_0^2{X}_1^2{a}^2+12X_0{X}_1^{3}a-4X_0^2{X}_2^{2}a+9X_1^4-8X_0{X}_1{X}_2^2\right)}^2\end{array}$

• • Otherwise,

$\begin{array}{c}{Z}_0={\left(X_1{Y}_0-X_0{Y}_1\right)}^4{X}_0^2{Y}_0^2\\ Z_1=X_0^3{Y_0^3\left(X_1{Y}_0-X_0{Y}_1\right)}^2\left(2C^2{U}^{\angle }{X}_0{y}_0+2X_1{Y}_{1}a+X_3{Y}_1-2X_2{Y}_2+X_1{Y}_3\right)\\ Z_2=X_0^3{Y}_0^3\left(X_1{Y}_0-X_0{Y}_1\right)\left(\begin{array}{c}-4C^2{U}^2{X}_0{X}_2{Y}_0^2+4C^2{U}^2{X}_0^2{Y}_0{Y}_2+X_1{X}_3{Y}_0{Y}_2+\\ +3X_0{X}_3{Y}_1{Y}_2-3X_1{X}_2{Y}_0{Y}_3-X_0{X}_2{Y}_1{Y}_3-\\ -2a\left(X_1{X}_2{Y}_0{Y}_1-X_0{X}_3{Y}_0{Y}_2-X_0{X}_1{Y}_1{Y}_2+X_0{X}_2{Y}_0{Y}_3\right)\end{array}\right)\\ Z_3={\left(\begin{array}{c}{\left(X_1{Y}_0-X_0{Y}_1\right)}^2{X}_0{Y}_{0}a+X_1^3{Y}_0^3-X_0{X}_2^2{Y}_0^3-X_0{X}_1^2{Y}_0^2{Y}_1-\\ -X_0^2{X}_1{Y}_0{Y}_1^2+X_0^3{Y}_1^3+2X_0^2{X}_2{Y}_0^2{Y}_2-X_0^3{Y}_0{Y}_2^2\end{array}\right)}^2\end{array}$

The following theorem motivates this choice of polynomial transformation:

Theorem 6. Suppose that the points [X₀: X₁: X₂: X₃] and [Y₀: Y₁: Y₂: Y₃] obey (88). Then [Z₀: Z₁: Z₂: Z₃] given above also satisfies (88).

This can be proven by a brute-force calculation.

Polynomial Reformulation

Similarly to how the integer factorization problem can be partially reformulated using standard polynomials, the treatment of the carries can be reformulated using polynomial operations. This reformulation has the advantage of being more general than the prior discussion.

Suppose that A(x) has been determined, and U(x) is a polynomial coming from a standard polynomial factorization of v. There is an associated polynomial V(x), such that(A(x)−U(x)−V(x))(A(x)+U(x)−V(x))≡v(x) (mod p).

The carry is the obstruction to factorization of N that comes when evaluated at x=p:(A−U−V)(A+U−V)−N where the notations are used A=A(p), U=U(p), V=V(p). One would like a way to manipulate this carry in order to guarantee a greater likelihood of factorization. To that end, let C be an integer for which (A−U−V)(A+U−V)−N≡C (mod V), which is to say that:(A−U−V)(A+U−V)−N=BV+C for some integer C. Assume that C does not share a factor with N. Replace the integer V by an indeterminate v, and then consider the quadratic polynomial in v:q(v)=(A−U−v)(A+U−v)−Bv−C.

Note that q(V)≡0 (mod N). The constants A, U , B, C are regarded as parameters in this quadratic. In particular, its discriminantΔ=B²+4(U²+AB+C)depends on all four parameters. To change parameters to achieve a factorization, first rescale the parameters v, C, U, in such a way that Uv, UC, and v/C mod N₀ remain constant (modulo N₀). Consider therefore a residue x modulo N₀, and rescalings of the form v→xv, C→xC mod N₀, and U→x⁻¹U where x⁻¹ is computed modulo N₀ so that xx⁻¹≡1 (mod N₀). (Assume that x has no factor in common with N₀.) The new quadratic is thus{tilde over (q)}(v)=(A−x⁻¹U−xv)(A+x⁻¹U−xv)−xBv−xC, and the new discriminant modulo N₀ is{tilde over (Δ)}≡4Cx³+(B²+4AB)x²+4U² (mod N₀).

Now, it is desired that the discriminant becomes a perfect square modulo N₀. That is, a solution is desired toy²≡{tilde over (Δ)} (mod N₀).

That isy²≡4Cx³+(B²+4AB)x²+4U² (mod N₀).

Multiply both sides by C²/4 (mod N₀):

$\frac{C^2}{4}{y}^2\equiv C^3{x}^3+\left(\frac{B^2}{4}+AB\right)C^2{x}^2+C^2{U}^2\left(\mathrm{mod}{N}_0\right).$

Letting Y=Cy/2 and X=Cx, this equation becomes

$\begin{array}{cc}{y}^2\equiv X^3+\left(\frac{B^2}{4}+AB\right)X^2+C^2{U}^2\left(\mathrm{mod}{N}_0\right).& \left(89\right)\end{array}$

Let f(X) denote the right-hand side of (89). Associate to any solution of (89) an affine-linear form ξ with the property that ξ(X)=0. The pair (ξ, Y) can be used in place of a solution (X, Y).

Note that ξ(X)=0, Y=CU is a solution. The following semigroup law takes a pair of solutions (ξ₁, Y₁) and (ξ₂, Y₂) and produces a third solution (ξ₃, Y₃).

• • If degξ₁<1, then let (ξ₃, Y₃)←(ξ₂, Y₂). Else degξ₂<1, then let (ξ₃, Y₃)←(ξ₁, Y₁). Return (ξ₃, Y₃) and exit.
  • Else let g=gcd(ξ₁, ξ₂).
  • If g=1, let μ be the linear polynomial such that μ≡Y_i (mod for i=1,2. Let ξ₃=(f−μ²)/(ξ₁ξ₂), and let Y₃ be the value of μ evaluated at the zero of ξ₃. Return the pair (ξ₃, Y₃) and exit.
  • Else if Y₁+Y₂=0, then return (ξ₃, Y₃)←(1,0) and exit.
  • Otherwise, let μ=((Y₁+f/Y₁)/2) mod ξ₁², where the multiplicative inverses are determined modulo N₀. Then let ξ₃=(f−μ²)/(ξ₁²), and let Y₃ be the value of μ evaluated at the zero of ξ₃. Return (ξ₃, Y₃) and exit.

To turn this into a factorization method, it is desirable to have versions of the polynomial extended Euclid algorithm (xgcd) and Chinese remainder theorem (crt) that return a factor if their inputs are degenerate modulo N₀: i.e., if a factor is “discovered” by polynomial division.

The Semigroup Law in General

In general, suppose that F is a (fixed) squarefree polynomial modulo N₀ of even degree 2k≥4. Let ∂ be the set of polynomials (α(x), β(x), γ(x)) modulo N, where β is a monic polynomial, degα<degβ<k andα(x)²≡F(x)+β(x)γ(x) (mod N₀).

Define a binary operation ⊕ on δ as follows. Suppose given a pair X₁=(α₁, β₁, γ₁), X₂=(α₂, β₂, γ₂). Let δ be the greatest common divisor of β₁, β₂, and d the greatest common divisor of α₁+α₂, β₁, β₂. Let β₃=β₂/d² mod N₀. Then there exists a polynomial α₃ of degree<degβ₃ such thatα₃≡α₁ (mod β₁/δ)α₃≡α₂ (mod β₂/δ)F−α₃²≡0 (mod β₃).

To determine this α₃, there exist polynomials σ₁ and and σ₂ such thatσ₁β₁+σ₂β₂≡δ (mod N₀)and polynomials ρ and ϵ such thatρδ+ϵ(α₁+α₂)≡d (mod N₀).

Then

${\alpha }_3=\frac{1}{d}\left(\rho \left({\sigma }_2{\beta }_2{\alpha }_1+{\sigma }_1{\beta }_1{\alpha }_2\right)+ϵ\left(F+{\alpha }_1{\alpha }_2\right)\right)\left(\mathrm{mod}{\beta }_3\right).$

Next, put

${\gamma }_3=\frac{F-{\alpha }_3^2}{{\beta }_3}\left(\mathrm{mod}{N}_0\right).$

While degβ₃≥k, let

${\beta }_3={\gamma }_3,{\gamma }_3=\frac{F-{\alpha }_3^2}{{\beta }_3}\left(\mathrm{mod}{N}_0\right),$ andα₃=−α₃ (mod β₃).

Finally make β₃ monic by dividing by its leading coefficient. The binary operation ⊕ is thus defined asX₁⊕X₂=X₃ whereX₃=(α₃, β₃, γ₃).

Since N₀ is assumed to be composite, the polynomial division operations (or the normalization of β₃ in the last step) of the semigroup law may not be well defined. In that case, a factor of N₀ shall have been discovered, and the process terminates.

Examples

Small Example

Let N₀=797×991=789827. Select the parameters p=13, M=4, and k=[1,1,1,1]. Note that N₀ is a quadratic residue mod p, so that α=1 is a possible candidate α. Note that T=790087 is a prime greater than N₀ such that N₀≡Tα² (mod p). Then, with N=TN₀=624032044949, the digits of N modulo p form the polynomial:v(x)=1+5x+5x²+6x³+9x⁴+7x⁵+12x⁶+12x⁷+10x⁸+6x⁹+4x¹⁰.

Modulo p=13, this polynomial factorizes as:v(x)=(4)(x²+8)(x³+6x²+4x+1)(x⁵+2x⁴+11x³+7x²+11x+11).

The coefficients ω₀, ω₁, ω₂, ω₃ are determined so thatA(x)=ω₀+ω₁x+ω₂x²+ω₃x³ obeysA(x)²≡v(x) (mod p, x⁴).

To begin the process, let ω₀ be a root of ω₀²≡v₀ (mod p), for instance ω₀=1 satisfies 1²≡1 (mod 13). The remaining coefficients w_i must satisfy congruencesv₁≡2ω₀ω₁ (mod p)v₂≡2ω₀ω₂+ω₁² (mod p)v₃≡2ω₀ω₃+2ω₁ω₂ (mod p)

The first of these congruences reads5≡2ω₁ (mod 13)and a solution of ω₁=9 is found by modular inversion (2⁻¹≡7 (mod 13)). The second congruence now reads5≡2ω₂+3 (mod 13)giving ω₂=1. The third congruence is now6≡2ω₃+18 (mod 13)

That is, 2ω₃≡1 (mod 13), giving ω₃=7. Thus the polynomialA(x)=1+9x+x²+7x³ satisfiesA(x)²≡v(x) (SP_pk)

With the trivial divisor of 1, the associated polynomial U is

$\begin{array}{c}U={\mathrm{SP}}_{p^k}\left(\frac{{\omega }_0}{2}\left(1-\frac{v}{v_0}\right)\right)\\ =4x+4x^2+10x^3\end{array}.$

The polynomial V is now determined from the data of v, A, U asV=A±√{square root over (v+U²)} (SP)where the square root is taken in p^k-standard polynomials, and the sign is chosen so that the result is O(x²). Note thatv+U²≡1+5x+8x²+12x³ (SP).

Denoting √{square root over (v+U²)}=σ₀+σ₁x+σ₂x²+σ₃x³ (SP), the unknown coefficients σ₀, σ₁, σ₂, σ₃ must obey1≡σ₀² (mod p)5≡2σ₀σ₁ (mod p)8≡2σ₀σ₂+ν₁² (mod p)12≡2σ₀σ₃+2σ₁σ₂ (mod p)where the integers on the left-hand side are the corresponding coefficients of the standard part of v+U². Solving this system as above gives or σ₀=ω₀=1, σ₁=ω₁=9, σ₂=9, σ₃=3. Thus:V=A−(1+9x+9x²+3x³)≡4x²+5x³ (mod 13).

In summary, the polynomials A, U, V areA(x)=1+9x+x²+7x³ U(x)=4x+4x²+10x³ V(x)=4x²+5x³

Evaluating these polynomials at x=p gives integersA(p)=15666, U(p)=22698, V(p)=9633which are henceforth denoted A, U, V, respectively.

However, observe that the difference(A−U−V)(A+U−V)−N=−624510847064is not zero, nor do either r=A−U−V nor s=A+U−V share a nontrivial factor with N₀. So, decompose the difference mod V:−624510847064=(−64830359)V+1183.

This gives values for the parameters B=−64830359 and C=1183.

The objective is now to consider variables x such that the discriminant

$\begin{array}{cc}\Delta =x^3+\left(\frac{B^2}{4}+\mathrm{AB}\right)x^2+U^2{C}^2& \mathrm{mod}{N}_0\\ =x^3+536317x^2+154667& \end{array}$

is a perfect square modulo N₀. To that end, let (ξ₁, y₁) be a pair comprising the monic affine -linear form ξ₁ modulo N₀ in one variable, and the integer y₁ modulo N₀, given by:ξ₁=x, y₁=CU mod N₀=787443.

The pair (ξ₁, y₁) is the initial point for an iteration. The next point in the iteration (ξ₂, y₂) shall be determined as follows:

• • Let ξ₂=ξ₁²=x² and y₂=(Δ+y₁²) mod ξ₂=152283.
  • Now let

${\xi }_2=\frac{\Delta -y_2^2}{{\xi }_2}$ and y₂=y₂ mod ξ₂. So ξ₂=x+536317 and y₂=2384.

To find the next point (ξ_n+1, y_n+1) from the previous point (ξ_n, y_n), the following procedure can be used.

• • If ξ_n≡ξ₁ (mod N₀), let δ=ξ₁, σ₁=0, σ_n=1. Otherwise, ξ_n−ξ₁ is a nonzero constant modulo N₀. If it is not invertible modulo N₀, then a factor is found. Otherwise, let δ=1, λ=(ξ_n−ξ₁)⁻¹ (mod N₀), σ₁=−λ, σ₂=λ. In either case, one has σ₁ξ₁+σ_nξ_n=δ where δ is the polynomial gcd of ξ₁ and ξ_n.
  • Next, if y_n≡−y₁ (mod N₀), then let d=δ, ρ=1, ϵ=0. Else, if y_n+y₁ is not invertible modulo N₀, it means that a factor is found. Otherwise, let d=1, ρ=0, and λ=(y_n+y₁)⁻¹ mod N₀. In any case, the congruence ρδ+ϵ(y₁+y_n)≡d (mod N₀) now holds, where d is the polynomial gcd of δ and y₁+y_n.
  • Let ξ_n+1←ξ_nξ₁/d². Define y_n+1 (mod N₀) such that the congruence holds:dy_n+1≡ρ(σ₁ξ₁y_n+σ_nξ_ny₁)+ϵδ (mod ξ_n+1)where the modulo is with respect to polynomial division by ξ_n+1 (mod N₀). (Note: because at this step, ξ_n+1 is guaranteed to be monic, no factorization will be discovered here.) If ξ_n+1 is quadratic rather than linear, then let

${\xi }_{n+1}\leftarrow \frac{\Delta -y_{n+1}^2}{{\xi }_{n+1}}.$

Test if the greatest common divisor of the leading coefficient of ξ_n+1 and N₀ is nontrivial: if so, then it means a factor is found. Otherwise, normalize ξ_n+1 by dividing (modulo N₀) by its leading coefficient. Now update y_n+1:y_n+1←−y_n+1 mod ξ_n+1,with the same meaning of mod.

To illustrate, to find (ξ₃, y₃) given the previously determined (ξ₁, y₁) and (ξ₂, y₂), note that ξ₂−ξ₁=536317, whose inverse modulo N₀ is 114631. Let δ=1, σ₁=−114631 and σ₂=114631. Now, y₂≡−y₁ (mod N₀), so let d=δ=1, ρ=1, ϵ=0. Let

${\xi }_3=\frac{{\xi }_1{\xi }_2}{d^2}=x^2+536317x$ and

$\begin{array}{c}{y}_3=\left(-114631{\xi }_1{y}_2+114631{\xi }_2{y}_1\right)\mathrm{mod}{\xi }_3\\ =\left(-114631\right)\left(2384\right)x+114631\left(787443\right)\left(x+536317\right)\mathrm{mod}{\xi }_3\\ =789503x+787443\end{array}$ after taking coefficients modulo N₀ and obtaining the remainder from polynomial long division by ξ₃. Because ξ₃ is quadratic and not linear, replace it with

${\xi }_3\leftarrow \frac{\Delta -y_3^2}{{\xi }_3}=x+684851$ and update y₃ viay₃←−y₃ (mod ξ₃)=52047.

The results of continuing this process for successive iterations is presented in Table 1. The final line gives y=704548. The gcd with N₀ is then gcd(N₀, y)=gcd(789827,704548)=797, and so a factor of N₀ has been found. (The other factor can be obtained by division: N₀/797=991.)

TABLE 1
First seven iterations of the process
ξ                      ⁢                                              (                        x                        )                                                              x y                    787443
x + 536317                       2384
x + 684851                       52047
x + 225605                       682442
x + 572007                       587941
x + 538246                       275646
x + 369405                       385164
x + 711460                       704548

Large Example

Consider the integer of 201 digits, composed of two large prime factors:

N₀=22967931147801119577057392151555297515908528818203114721284113333931 69938767039237859844411753308995545617879257906080518909576843342909 2047830345207451926941075428246929075122113723634319517491078477.

Let p=1299721 and α=89. The integer

T=229679311478011195770573921515552975159085288182031147212841133339316 99387670392378598444117533089955456178792579060805189095768433429092 047830345207451926941075428246929075122113723634319517592414719

is a prime greater than N₀ such that N₀≡Tα² (mod p). Then

v=1008831 +1136976x¹+956702x²+288775x³+618031x⁴+786694x⁵++959534x⁶+982257x⁷+1079763x⁸+606595x⁹+1119948x¹⁰+315803x¹¹++163055x¹²+277569x¹³+397201x¹⁴+845775x¹⁵+325656x¹⁶+401316x¹⁷++938657x¹⁸+445914x¹⁹+700279x²⁰+1078663x²¹+1021990x²²+267966x²³++980433x²⁴+864073x²⁵+424418x²⁶+501729x²⁷+36106x²⁸+24162x²⁹++27979x³⁰+250922x³¹+289611x³²+1050104x³³+1050583x³⁴+442750x³⁵++1280878x³⁶+1072587x³⁷+460680x³⁸+1126283x³⁹+679997x⁴⁰+1014612x⁴¹++1071670x⁴²+478751x⁴³+479058x⁴⁴+1180741x⁴⁵+832872x⁴⁶+508143x⁴⁷++63586x⁴⁸+170412x⁴⁹+851654x⁵⁰+673439x⁵¹+1294284x⁵²+760587x⁵³++906884x⁵⁴+973676x⁵⁵+50261x⁵⁶+1032425x⁵⁷+903379x⁵⁸+1286973x⁵⁹++180314x⁶⁰+1066029x⁶¹+213083x⁶²+1032351x⁶³+1284994x⁶⁴+20x⁶⁵.

It is now desired to find integers ω₀, ω₁, . . . modulo p such that

$\begin{array}{ccc}{v}_0& \equiv {\omega }_0^2& \left(\mathrm{mod}p\right)\\ v_1& \equiv 2{\omega }_0{\omega }_1& \left(\mathrm{mod}p\right)\\ v_2& \equiv 2{\omega }_0{\omega }_2+{\omega }_1^2& \left(\mathrm{mod}p\right)\\ v_3& \equiv 2{\omega }_0{\omega }_3+2{\omega }_1{\omega }_2& \left(\mathrm{mod}p\right)\\ v_4& \equiv 2{\omega }_0{\omega }_4+2{\omega }_1{\omega }_3+{\omega }_2^2& \left(\mathrm{mod}p\right)\\ ⋮& ⋮& ⋮\\ v_k& \equiv \sum _{i=0}^k{\omega }_i{\omega }_{k-i}& \left(\mathrm{mod}p\right)\\ ⋮& ⋮& ⋮\end{array}$

With ω=649676, the unique integers ω_i determined by these congruences are found in 1 millisecond on a single thread of an Intel(®) Core(™) i7-10700 CPU at 2.90 GHz, and are tabulated in Table 1, up to M=99.

ωi for 0 ≤ i < M = 99 in the example
ω0	649676	ω1	176555	ω2	1210316
ω3	880935	ω4	990258	ω5	1193444
ω6	61049	ω7	404278	ω8	301580
ω9	869756	ω10	1182221	ω11	157526
ω12	106958	ω13	412412	ω14	97078
ω15	1058759	ω16	601585	ω17	283394
ω18	30547	ω19	1154202	ω20	85723
ω21	1230004	ω22	478092	ω23	124906
ω24	537915	ω25	1149285	ω26	811132
ω27	25307	ω28	181194	ω29	334252
ω30	1122689	ω31	1274176	ω32	582005
ω33	65984	ω34	767541	ω35	966192
ω36	26289	ω37	1255833	ω38	1277307
ω39	930123	ω40	666184	ω41	168986
ω42	1095395	ω43	653414	ω44	28041
ω45	353354	ω46	273125	ω47	980499
ω48	218587	ω49	739819	ω50	632834
ω51	1055915	ω52	715651	ω53	156745
ω54	885257	ω55	1024532	ω56	1188376
ω57	296168	ω58	474923	ω59	1083529
ω60	948621	ω61	1024778	ω62	539727
ω63	53812	ω64	176433	ω65	825291
ω66	1093610	ω67	91679	ω68	1019182
ω69	937590	ω70	754793	ω71	441590
ω72	343128	ω73	507560	ω74	272679
ω75	536524	ω76	1069159	ω77	255311
ω78	325334	ω79	919125	ω80	541698
ω81	995762	ω82	679297	ω83	910068
ω84	1116934	ω85	832307	ω86	1066863
ω87	302115	ω88	360316	ω89	188493
ω90	260955	ω91	286776	ω92	6525
ω93	1128692	ω94	842066	ω95	135610
ω96	382721	ω97	705108	ω98	658922

The complete factorization of v(x) modulo p is determined using the procedure described in 2 milliseconds on a single thread of an Intel(®) Core(™) i7-10700 CPU at 2.90 GHz:

$v=\left(20\right)\times \left(x+1164545\right)\times \left(x^3+401265x^2+1232398x+446873\right)\times \left(\begin{array}{c}{x}^{25}+1126379x^{24}+1007770x^{23}+566898x^{22}+468042x^{21}+\\ 1072384x^{20}+1286593x^{19}+1165876x^{18}+531903x^{17}+427926x^{16}+\\ 731970x^{15}+461270x^{14}+245668x^{13}+98598x^{12}+641038x^{11}+\\ 605298x^{10}+217543x^9+174186x^8+1081462x^7+315399x^6+\\ 203594x^5+659685x^4++325480x^3+150243x^2+11211680x+\\ 456996\end{array}\right)\times \left(\begin{array}{c}{x}^{36}+361419x^{35}+314100x^{34}+375904x^{33}+338514x^{32}+648035x^{31}+\\ 529983x^{30}+640529x^{29}+382523x^{28}+920414x^{27}+899851x^{26}+\\ 276259x^{25}+227435x^{24}+1192845x^{23}+262010x^{22}+846862x^{21}+\\ 475004x^{20}+31544x^{19}+1140348x^{18}+914003x^{17}+107624x^{16}+\\ 350295x^{15}+407742x^{14}+138534x^{13}+756626x^{12}+391910x^{11}+\\ 83332x^{10}+741465x^9+822812x^8+456431x^7+890299x^6+\\ 181841x^5+852774x^4++499863x^3+248842x^2+107144x+399396\end{array}\right)$

Up to a constant multiple, there are 2⁴=16 divisors of the polynomial v(x) modulo p, and so 16 pairs of polynomials (U(x),V(x)) to inspect. Inspecting all of these, the procedure discovers a factor at

$U\left(x\right)=1123166x+523890x^2+927142x^3+167222x^4+822823x^5+502764x^6+583838x^7+1249813x^8+1012538x^9+203805x^{10}+141747x^{11}+14531x^{12}+729864x^{13}+916869x^{14}+1111810x^{15}+1205502x^{16}+233558x^{17}+270237x^{18}+159711x^{19}+875423x^{20}+189604x^{21}+411354x^{22}+793239x^{23}+2657x^{24}+738498x^{25}+99774x^{26}+1216546x^{27}+683420x^{28}+486140x^{29}+746799x^{30}+997485x^{31}+381191x^{32}+207138x^{33}+443132x^{34}+1075495x^{35}+1035499x^{36}+245944x^{37}+550724x^{38}+1211194x^{39}+206135x^{40}+108418x^{41}+62783x^{42}+765632x^{43}+1057982x^{44}+1140896x^{45}+594000x^{46}+656521x^{47}+324222x^{48}+898643x^{49}+999113x^{50}+480855x^{51}+753753x^{52}+1185547x^{53}+978129x^{54}+523936x^{55}+35359x^{56}+407860x^{57}+252530x^{58}+700899x^{59}+1039561x^{60}+520664x^{61}+247137x^{62}+1217984x^{63}+200730x^{64}+870003x^{65}.$

The entire procedure takes 5263 seconds on a Slurm cluster consisting of 4 PCs, each with 16 threads running on an Intel(®) Core(™) i7-10700 CPU at 2.90 GHz.

Appendices

The Euclidean Algorithm

The extended Euclidean algorithm is an iteration of the division algorithm that allows one to compute s, t such thatsa+tb=gcd(a, b),

Inputs: Positive integers a and b.

Outputs: Integers s,t,dsa+tb=d whered=inf{sa+tb|s,tϵ, sa+tb>0}is the greatest common divisor of a and b.

• • 1. Let α←a, β←b, S←1, T←0, s←0, t←1
  • 2. If β=0 then output s, t, α and exit the program.
  • 3. Let q and r be the unique integers (from the division algorithm) such thatα=qβ+r
  • 4. Let (S, s)←(s−q*S, S), (T, t)←(t−q*T, T), α←β, β←r, and go to 2.

Python Source Code

Here is an implementation in Python:

def euclid(a, b) :
    S=0
    T=1
    s=1
    t=0
    alpha  =  a
    beta  =  b
    while  beta  !=  0:
    (q, r)  =  divmod(alpha, beta)
    (S, s)  = (s−q*S, S)
    (T, t)  =  (t−q*T, T)
    alpha=beta
    beta=r
    return(s, t, alpha)

Modular Inversion

Given a modulus M and integer a relatively prime to M, a modular inverse of a is an integer b such that ab≡1 (mod M). The Euclidean algorithm can be used to determine a modular inverse as follows. Since a and M are relatively prime, apply the Euclidean algorithm to find integers s, t such thatsa+tM=1.

Then, sa=1−tM implies sa≡1 (mod M). That is b=s is a modular inverse of a.

Euclidean Algorithm for Polynomials Modulo N

Suppose that N is an integer, possibly composite.

Inputs: Polynomials a and b modulo N.

Outputs: Integers s, t, d such thatsa+tb=d wheredegd=inf{deg(sa+tb)|s,tϵ, sa+tb≠0}is the greatest common divisor of a and b, or else a nontrivial factor of N.

• • 1. Let α←a, β←b, S←1, T←0, s←0, t←1
  • 2. If β=0, then let α₀ be the leading coefficient of α. If α₀ is not coprime to N, then output their greatest common divisor. Else, output s/a₀, t/a₀, a/a₀and exit the program.
  • 3. If the leading coefficient of β is not coprime with N, then output their greatest common divisor. Else let q and r be the unique polynomials (from the division algorithm) such that degr<degα andα=qβ+r
  • 4. Let (S, s)←(s−q*S, S), (T, t)←(t−q*T, T), α←β, β←r, and go to 2.

Python-Sage code
def euclid(g, a, b) :
    S=0
    T=1
    s=1
    t=0
    alpha  =  a
    beta  =  b
    while  beta  !=  0:
    assert(s*a+t*b  ==  alpha  and  S*a+T*b  ==  beta)
    betad0  =  beta.leading_coefficient( )
    d  =  gcd(beta0,beta.base_ring( ).characteristic( ) )
    if  d  >  1:
    g.append(d)
    return(alpha, s, t)
    q  =  alpha  //  beta
    r  =  alpha  %  beta
    (S, s)  =  (s−q*S, S)
    (T, t)  =  (t−g*q*T, T)
    alpha=beta
    beta=r
alpha0  =  alpha.leading_coefficient( )
d  =  gcd(beta0,beta.base_ring( ).characteristic( ) )
if  d  >  1:
    g.append (d)
else:
    alpha  =  alpha  /  alpha0
    s  =  s  /  alpha0
    t  =  t  /  alpha0
return(alpha, s, t)

Chinese Remainder Theorem

A version of the Chinese remainder theorem is needed that operates on polynomials modulo N, in the following sense. Suppose that x₁ and x₂ are two given polynomials modulo N and m₁ and m₂ are relatively prime, meaning that there exist u₁ and u₂ such that u₁m₁+u₂m₂≡1 (mod N). Then there exists a polynomial x such that x≡x₂ (mod m₁) and x≡x₂ (mod m₂), namely x=x₁u₂m₂+x₂u₁m₁. The polynomial x is unique modulo m₁m₂.

The following algorithm is sufficient to produce the required polynomial x, or else to produce a factor of N.

def crt_f(g, x1, x2, m1, m2) :
    (d, u1, u2)  =  euclid(g, m1, m2)
    if  d.degree( )  >  0  and  g  ==  [ ] :
    print(″Unsupported:  m1  and  m2  must  be  coprime″)
    elif  d  !=  1  and  g  ==  [ ] :
    d  =  gcd(d[0],d.base_ring( ).characteristic( ) )
    g.apend(d)
    return(x1*u2*m2 + x2*u1*m1)

Digit Expansions

Division Theorem

Suppose that p is prime and N, r are given integers. It is of interest to determine whether there is an integer s such thatN≡rs (mod p^k).  (90)

Basically one can perform ordinary digitwise long division to compute s mod p^k for which this holds. Note that this can be done for any r that is not divisible by p, so that solutions of (90) do not confer anything about potential factors of N. More precisely:

Theorem 7. Let N be an integer. For any integer r not divisible by p, there exists for every positive k a unique integer s with 0≤S s<p^k such that (90) holds. The solution s=s_k to (90) depends only on the reduction of r modulo p^k. Furthermore, when r is fixed, s_k≡s_l (mod p^k) whenever k<l.

Proof. Since p is prime and r is not divisible by p, gcd(r, p^k)=1 for all k≥0. From the division algorithm, there exist integers α_k, β_k such thatα_kr+β_kp^k=1.  (91)

Moreover, the residues α_k (mod p^k), β_k (mod r) of a pair satisfying (91), are uniquely determined. Let s be the unique residue in 0≤s<p^k such that Nα_k≡s (mod p^k). Thenrs≡N·(α_kr)=N·(1−β_kp^k)=N−β_kNp^k≡N (mod p^k).

This proves existence.

For the uniqueness of the residue s_k (mod p^k), suppose s, s′ both satisfy (90). Then rs≡rs′ (mod p^k), or r·(s−s′)≡0 (mod p^k). Since r is not divisible by p, this implies that p^k|(s−s′). That is, s≡s′ (mod p^k). The residue s_k (mod p^k) is thus unique.

Finally, since s=s_k and s=s_l both satisfy N≡rs (mod p^k), it follows by uniqueness of the residue s_k that s_l≡s_k mod p^k. □

Long Division

Corollary 1. Given the integers N and r as in Theorem 7, there exists a unique sequence of digits (a₀, a₁, . . . ) having the property that, for each k, N≡r·(a₀+a₁p+a₂p²+ . . . +a_kp^k) (mod p^k+1).

One way to find the sequence a_i is by “long division” of r into N, working from the lowest digits to the highest (unlike ordinary long division, which works from the most significant to least).

For example, long division of 137/352 in base p=5 returns the sequence of digits (up to the 18th digit);1,1,3,4,4,4,2,2,1,4,1,2,4,0,1,1,4,3 . . .

That is,

$$\begin{gathered} s_{18}=1+1p+3p^2+4p^3+4p^4+4p^5+2p^6+2p^7+1p^8+4p^9+1p^{10}+\text{ \\ 2⁢p1⁢1+4⁢p1⁢2+0⁢p1⁢3+1⁢p1⁢4+1⁢p15+4⁢p1⁢6+3⁢p1⁢7}=2936883406206. \end{gathered}$$

This integer satisfies352·s₁₈≡137 (mod p^k)for k=1, 2, . . . , 18.

The long division can be prolonged to obtain more terms of the digit sequence. For example,

$$\begin{gathered} S_{24}=1+1p+3p^2+4p^3+4p^4+4p^5+2p^6+2p^7+1p^8+4p^9+1p^{10}+\text{ \\ 2⁢p1⁢1+4⁢p1⁢2+0⁢p1⁢3+1⁢p1⁢4+1⁢p1⁢5+4⁢p1⁢6+3⁢p1⁢7+2⁢p1⁢8+ \\ 0⁢p1⁢9+3⁢p2⁢0+3⁢p2⁢1+0⁢p2⁢2+2⁢p2⁢3}=25569037957624956 \end{gathered}$$ which satisfies352·s₂₄≡137 (mod p^k)for k=1,2, . . . ,24.

However, despite the fact that and 352·s_k≡137 (mod 5^k) for all k, and s_k and s_l will share the first k digits whenever l≥k, there is clearly no integer s that satisfies 352·s=137.

Factorization by Trial Division

Consider an example where an integer N=rs has been prepared, say N=250641205046503. With p=29, one hasN=10+14p+11p²+4p³+14p⁴+24p⁵+0p⁶+1p⁷+8p⁸+17p⁹.

The goal of factorization is to find integers r, s>1 such that N=r·s. Assuming r is a candidate divisor, a possible s can be constructed using long division. For example, if a hypothesis is made that the first two digits of r are 12 and 6, that is r≡12+6p (mod p²). Then an s, should it exist, would be found by long division of r into N, tabulated in (92).

$\begin{array}{cc}\begin{array}{cccc}& & 25& 12\\ 12& 6& 10& 14\\ & & 10& 15\\ & & & 28\\ & & & 28\end{array}& \left(92\right)\end{array}$

Note that there is no obstruction to performing the division out to this number of digits. Corollary 1 implies that “long division” can be carried out to arbitrarily many digits, so there will never be an obstruction. Information on whether r is a divisor of N must therefore come from a magnitude constraint: that is, is the resulting quotient s obtained by long division null-terminated? Since the product (25+12·p) (12+6·p) has fewer digits than N, no information is inferred on whether r could be a divisor of N from this division. It is necessary to consider more digits.

For example, hypothesizing thatr=12+6p+1p²+5p³,then (93) tabulates the resulting long division.

$\begin{array}{cc}\begin{array}{cccccccc}& & & & 25& 12& 21& 4\\ 12& 6& 1& 5& 10& 14& 11& 4\\ & & & & 10& 15& 1& 10\\ & & & & & 28& 9& 23\\ & & & & & 28& 18& 14\\ & & & & & & 20& 8\\ & & & & & & 20& 18\\ & & & & & & & 19\\ & & & & & & & 19\end{array}& \left(93\right)\end{array}$

Because the integer r·s is still not as long as N, it is required to specify still more digits. Since N has ten digits mod p, it will only be possible for r·s to have enough digits if at least six digits of r are known. For example, hypothesizing thatr=12+6p+1p²+5p³+23p⁴+26p⁵,the answer is tabulated in (94).

$\begin{array}{cc}\begin{array}{cccccccccccccccc}& & & & & & 25& 12& 21& 4& 4& 18& 23& 6& 20& 21\\ 12& 6& 1& 5& 23& 26& 10& 14& 11& 4& 14& 24& 0& 1& 8& 17\\ & & & & & & 10& 15& 1& 10& 28& 2& 23& & & \\ & & & & & & & 28& 9& 23& 14& 21& 6& 0& 8& 17\\ & & & & & & & 28& 18& 14& 2& 17& 2& 11& & \\ & & & & & & & & 20& 8& 12& 4& 4& 18& 7& 17\\ & & & & & & & & 20& 18& 25& 18& 22& 11& 19& \\ & & & & & & & & & 19& 15& 14& 10& 6& 17& 16\\ & & & & & & & & & 19& 25& 4& 20& 5& 20& 3\\ & & & & & & & & & & 19& 9& 19& 0& 26& 12\\ & & & & & & & & & & 19& 25& 4& 20& 5& 20\\ & & & & & & & & & & & 13& 14& 9& 20& 21\\ & & & & & & & & & & & 13& 28& 21& 3& 11\\ & & & & & & & & & & & & 15& 16& 16& 10\\ & & & & & & & & & & & & 15& 2& 28& 28\\ & & & & & & & & & & & & & 14& 17& 10\\ & & & & & & & & & & & & & 14& 9& 7\\ & & & & & & & & & & & & & & 8& 3\\ & & & & & & & & & & & & & & 8& 12\\ & & & & & & & & & & & & & & & 20\\ & & & & & & & & & & & & & & & 20\end{array}& \left(94\right)\end{array}$

Only now, in (94), does it become clear that there is no divisor r≡12 +6p+1p²+5p³+23p⁴+26p⁵ (mod p⁶), because the product of r and the digit sequence s resulting from long division (mod p⁶) has more digits than the integer N to be factored.

A seemingly plausible way to factor is to inspect all choices of digits in r, testing whether there is an s such that rs=N. Unfortunately, Corollary 1 implies that any selection of digits in r, provided the first digit is not zero, gives rise to a unique digit sequence s. This digit sequence corresponds to an integer if and only if it terminates. However, to check the termination condition requires to carry the long division out far enough. This example illustrates a general principle that no information on the feasibility of a factor r can be determined until about half the digits of N are specified. So searching over r and using long division is no better than brute force trial division,

Inversion Modulo p^k

Related to the problem of division modulo powers of p is that of inversion: given the digits of an integer a, to find a digit expansion x such that xa≡1 (mod p^k). The following theorem characterizes the solutions to this problem. Later an algorithm shall be given for finding them.

Theorem 8. Let p be prime and a an integer not divisible by p. Then, for any positive integer k, there exists a unique integer x_k between 0 and p^k such that x_ka≡1 (mod p^k). Furthermore, if k<l, then x_l≡x_k (mod p^k).

Proof For uniqueness, suppose that two solutions x_k and y_k are given. Then:(x_k−y_k)a≡0 (mod p^k).

Since p is prime and does not divide a, it follows that p^k|(x_k−y_k). That is, x_k−y_k≡0 (mod p^k) or x_k≡y_k (mod p^k). Because x_k and y_k are between 0 and p^k by assumption, they must therefore be equal.

For existence, since a is prime to p^k, the Euclidean algorithm gives integers s, t such thatsa+tp^k=1.

Thus sa≡1 (mod p^k), so setting x_k=s mod p^k gives the required (unique) solution. □

An alternative algorithm can be given that usually requires fewer divisions. Specifically, an iteration is given that computes x_2j. The case of general x_k can be inferred from this by exploiting the uniqueness established in the theorem: x_k=x_2j (mod p^k) for any power of two 2^j≥k.

For j=0, the Euclidean algorithm is applied to obtain s, t such that sa+tp=1. Then take x₁=s mod p, which then satisfies x₁a≡1 (mod p). Next, supposing that x_2j has been calculated, letx_2j+1=(2−x_2jα)x_2j mod p^2j+1.

Let |·|_p denote the p-adic norm on the integers:|n|_p=inf{p^−r|p^r|n}.

Note that|1−x₁α|_p≤p⁻¹  (95)because p divides 1−x₁a. It shall be shown that|1−x_2j+1α|_p≤|1−x_2jα|_p².  (96)

From (95) and (96) it follows by induction that|1−x_2jα|_p≤p^−2j for all j; that is:x_2jα≡1 (mod p^2j),as required.

It remains to show that (96) holds. Consider:

$\begin{array}{c}1-x_{2^{j+1}}a=1-2\left(2-x_{2^j}a\right)x_{2j}a\\ =\left(1-x_{2j}a\right)-\left(1-x_{2^j}a\right)x_{2^j}a\\ ={\left(1-x_{2^j}a\right)}^2.\end{array}$

So (96) now follows by multiplicativity of the norm.

The Algorithm

To summarize, the following algorithm can be used for inversion:

Inputs: A prime p, non-negative integer j, and integer a that is not divisible by p.

Output: An integer 0<x_2k<p^2k such that x_2kα≡1 (mod p^2k).

• • 1. Let (s, t, 1) be the output of the Euclidean algorithm with inputs a and p, so thatsa+tp=1.

Let x←s mod p.

2. For j=1 to k, let x←(2−x*a)*x mod p^2k.

3. Return x.

Python Source Code

Here is an implementation:

#Compute  the  inverse  of  modulo  p{circumflex over ( )}(2{circumflex over ( )}k)
def modInv(a, p, k) :
    (s, t, d)  =  euclid(a, p)
    x=s  %  p
    q=p
    for  _  in  range (0, k) :
    q  *=  q
    x  =  ( (2−x*a) *x)  %  q
    return(x)

Square Root of Digit Expansions

Let N be a quadratic residue modulo p.

Theorem 9. Let p be an odd prime and N a positive integer not divisible by p. Suppose that 0≤A₁<p satisfies A₁²≡N (mod p). Then, for any positive integer k there exists a unique integer A_k in 0≤A_k<p^k such that A_k²≡N (mod p^k) and A_k≡=A₁ (mod p). Furthermore, if k<l, then A_l≡A_k (mod p^k).

Proof For uniqueness, if A_k, B_k are two solutions between 0 and p^k, thenA_k²−B_k²=(A_k−B_k)(A_k+B_k)≡0 (mod p^k).

Reducing modulo p, it follows that p divides A_k−B_k. If p were to also divide A_k+B_k, then p would divide A_kand B_k, and therefore would also divide N (because A_k²≡N (mod p)). But this is contrary to the choice of N. Therefore, p^k divides A_k−B_k. That is A_k≡B_k (mod p^k). Since A_k and B_k are between 0 and p^k by hypothesis, this implies A_k=B_k, and hence uniqueness. The last statement of the theorem is a consequence of the uniqueness, since A_k and A_l satisfy A_k²≡N (mod p^k) and A_l²≡N (mod p^k) implies that A_l≡A_k (mod p^k).

This leaves only the matter of existence. The solution A_k is computed as A_k=A_2j mod p^k for a power of two 2^j≥k. The solution with k=2^j is constructed by the following iterationA_2j+1=2⁻¹(A_2j+NA_2j⁻¹)  (97)where the inverses are computed modulo p^2j+1 using the algorithm of inversion modulo p.

Note that |N−A₁²|_p≤p⁻¹. It will be shown that|N−A_2j+1²|_p=|N−A_2j|² so that, by induction,|N−A_2j²|_p=p^−2j,i.e.,A_2j²≡N (mod p^2j),as desired.

To prove it, denote by 1/A_2j the inverse of A_2j modulo p^2j+1. Then:

$\begin{array}{c}N-A_{2^{j+1}}^2\equiv N-\frac{1}{4}{A}_{2^j}^2-\frac{1}{2}N-\frac{1}{4}{N}^2{A}_{2^j}^{-2}\\ \equiv \frac{1}{2}\left(N-A_{2^j}^2\right)+\frac{1}{4}\left(A_{2^j}^2-\frac{N^2}{A_{2^j}^2}\right)\\ \equiv \frac{1}{2}\left(N-A_{2^j}^2\right)+\frac{1}{2}\frac{A_{2^{j+1}}}{A_{2}j}\left(A_{2^j}-\frac{N}{A_{2^j}}\right)\\ \equiv \frac{1}{2}\left(N-A_{2^j}^2\right)\left(1-\frac{A_{2^j}+1}{A_{2^j}}\right)\left(\mathrm{mod}{p}^{2^{j+1}}\right).\end{array}$

Next, note that

$1-\frac{A_{2^{j+1}}}{A_{2^j}}\equiv \frac{1}{2}\left(\frac{N-A_{2^j}^2}{A_{2^j}}\right).$

Substituting into the above now gives

$N-A_{2^{j+1}}^2\equiv \frac{1}{4}{\left(N-A_{2^j}^2\right)}^2{A}_{2^j}^{-1}$ and therefore, by multiplicativity of the norm and since |A_2j|_p=1,|N−A_2j+1²|_p=|N−A_2j²|_p′² as required. □

The Algorithm

The proof above contains the following algorithm, optimized to compute all of the required inverses together with the iterations.

Inputs: An odd prime p, integer N, integer A₁ such that A₁²≡N (mod p), and a non -negative integer k.

Output: An integer A_2k such that A_2k²≡N (mod p^2k).

1. If k=0 then output A₁ and exit. Else continue.

2. Let (s, t, 1) be the result of applying the Euclidean algorithm with inputs 2 and p, so that 2s+pt=1. Let s←mod p.

3. Let A←A₁, q←p.

4. Let (u, v, 1) be the result of applying the Euclidean algorithm with inputs A₁ and p, so that A₁u+pv=1. Let u←u mod p.

5. For j=1 to k repeat:

• • q←q*q
  • s←2*(1−s)*s (mod q)
  • u←(2−u*A)*u (mod q)
  • u←(2−u*A)*u (mod q)
  • A←s*(A+N*u) (mod q)

6. Return A.

(Note the repeated step in the inner loop.)

Python source code
#Return the A such that A{circumflex over ( )}2 == N (mod p{circumflex over ( )}(2{circumflex over ( )}k) ) and A==A1 (mod p)
#Uses the algorithm euclid(a,b) from earlier
def modSqrt(N, A1, p, k) :
    if  k==0:
    return(A1  %  p)
    q=p
    (s, _, _)  =  euclid(2, p)
    s  =  s  %  p
    (u, _, _)  =  euclid (A1, p)
    u  =u  %  p
    A=  A1  %  p
    for  j  in  range(0, k) :
    q  *=  q
    s= (2*s* (1−s) )  %  q
    u= (u* (2−u*A) )  %  q
    u= (u* (2−u*A) )  %  q
    A= (s* (A+N*u) )  %  q
    return (A)

Infinite Digit Expansions:

Naturally an infinite digit expansion cannot be fully represented on a computer, so consider such digit expansions as a computation that can be continued indefinitely:

• • An infinite digit expansion is a rule that, for each n=0,1 . . . , given the first n digits (x₀, x₁, . . . , x_n−1), gives the next digit x_n.

In representing an infinite digit expansion in computer memory, it is necessary to truncate it to some machine-sized limit. If such a cutoff is employed, it shall be chosen large enough not to interfere with any relevant features of the problem.

Carry Arithmetic

A digit expansion shall be a sequence of integers (x₀, x₁, . . . ) with 0≤x₁<p, i=0,1, . . . Sequences can be subjected to the usual rules of addition-with-carry, multiplication-with -carry, subtraction-with-borrow, without regard for their size. Note that it is necessary to introduce some non-terminating sequences. For example, with p=5, the difference (3+5+5²)−(1+2·5+5²) can be found. After subtracting one from three without difficulty in the ones' place, it is now required to subtract two from one in the p's place, so a borrow of one. That leaves a deficit of one in the p² place, so it is then necessary to borrow one from the next place, and so forth. Note that borrowing converts a 0 into p−1 (=4) plus a borrow from the next digit. Taken out to several digits, that is:

$\begin{array}{ccccccc}& 3& 1& 1& 0& 0& 0\\ -& 1& 2& 1& 0& 0& 0\\ -& -& -& -& -& -& -\\ & 2& 4& 4& 4& 4& 4\end{array}$

But clearly this process of borrowing from 0 can be continued indefinitely, and the outcome of this computation is the non-terminating sequence (2,4,4,4,4, . . . ). It is also instructive to reverse the process, adding (1,2,1) to (2,4,4,4, . . . ):

$\begin{array}{ccccccc}& 2& 4& 4& 4& 4& 4\\ +& 1& 2& 1& 0& 0& 0\\ -& -& -& -& -& -& -\\ & 3& 1& 1& 0& 0& 0\end{array}$

All of the borrows are now carries: whenever a 1 overflows into a 4, it gives zero with a carry of one to the next 4 in the chain, and so on ad infinitum.

It is convenient to identify the sequence (x₀, x₁, . . . ) with a formal sum of powers of p,

$x=\sum _{n=0}^{\infty }{x}_n{p}^n.$

Then the arithmetic operations have their usual meanings, with carry, on infinite expressions.

Explicitly, suppose

$\begin{array}{c}x=\sum _{n=0}^{\infty }{x}_n{p}^n\\ y=\sum _{n=0}^{\infty }{y}_n{p}^n.\end{array}$

Then the following rules hold:

Addition

$x+y=\sum _{n=0}^{\infty }{z}_n{p}^n$ where for n=0,1, . . . ,z_n=(x_n+y_n+c_n) mod p, c_n+1=└(x_n+y_n+c_n)/p┘and c₀=0.

Subtraction

$x-y=\sum _{n=0}^{\infty }{z}_n{p}^n$ where for n=0,1, . . . ,z_n=(x_n−y_n+c_n) mod p, c_n+1=└(x_n−y_n+c_n)/p┘and c₀=0.

Multiplication

$x·y=\sum _{n=0}^{\infty }{z}_n{p}^n$ where for n=0,1, . . . ,

$z_n=\left(c_n+\sum _{k=0}^n{x}_k{y}_{n-k}\right)\mathrm{mod}p$ $c_{n+1}=\lfloor p^{-1}\left(c_n+\sum _{k=0}^n{x}_k{y}_{n-k}\right)\rfloor$ and c₀=0.

Theorem 9 can be reformulated using infinite digit expansions:

Theorem 10. Let p be an odd prime and N a positive integer not divisible by p. Suppose that 0≤a₀<p satisfies a₀²≡N (mod p). Then there exists a unique digit expansion A=(a₀, a₁, . . . ) such that A²=N.

Every quadratic residue has a square root.

Clearly not every quadratic residue is a perfect square. For example, the integer 6 is a quadratic residue modulo 5, but is plainly not a perfect square.

However, because of Theorem 10, any integer N that is a quadratic residue modulo p is a “perfect square” in the sense that there exists a digit expansion A such that N=A². Clearly such a digit expansion A must be infinite, unless N is a perfect square in the usual sense, as the example N=6, p=5 shows.

Because of Theorem 10, it is possible to solve the equation N=r·s, with the constraint that r and s have the same digits as one another (i.e., s=r). So although N has a “factorization” N=r·s where r and s are the same digit sequence, this common digit sequence does not terminate (unless N is a perfect square, which it is not in these applications). The algorithm described in conjunction with Theorem 9 supplies a rule for producing as many digits of the expansion A as desired.

In the example of 6 modulo 5, if A denotes the infinite digit expansionA=1+3·5+0·5²+4·5³+2·5⁴+1·5⁵+2·5⁶+3·5⁷+1·5⁸+3·5⁹+ . . .thenA²1+1·5+0·5²+0·5³+0·5⁴+0·5⁵+0·5⁶+0·5⁷+0·5⁸+0.·5⁹+ . . .i.e., one hasA²=6even though obviously no integer has this property.

Congruences

Definition 7. Let A, B, M be integers. The notationA≡B (mod M)means that there exists an integer k such that

A=B+kM.

Here are properties of integer congruences:

Proposition 3

• • (a) A≡A (mod M).
  • (b) For any integer l, lM≡0 (mod M).
  • (c) If A≡B (mod M) then B≡A (mod M).
  • (d) If l is a non-zero integer and A≡B (mod l)M, then A≡B (mod M).
  • (e) If A≡B (mod M) and C≡D (mod M), then A+C≡B+D (mod M) and AC≡BD (mod M).
  • (f) If A≡B (mod M) and f(x) is a polynomial with integer coefficients, then f(A)≡f(B) (mod M).

Proof

• • (a) Consider Definition 7 with k=0. Then A=A+kM. That is, A≡A (mod M).
  • (b) Taking k=1, M=0+1M, so M≡0 (mod M).
  • (c) If A=B+kM, then B=A−kM=A+(−k)M. That is, B≡A (mod M).
  • (d) If A≡B (mod M), then A=B+klM=B+(kl)M, so A≡B (mod M) (with kl playing the role of k in Definition 7).
  • (e) Suppose that A=B+kM and C=D+lM. Then A+C=B+D+(k+l)M and AC=BD+(Bl+Dk)M show, respectively, that A+C≡B+D and AC≡BD (mod M).
  • (f) This is true when f(x)=x^k, by the previous part. It is true for f(x)=ax^k, by (a) and the previous part. Then it is true if f(x) is an arbitrary integral linear combination of power functions, again by the previous part.□

Proposition 4. Let M be a positive integer. Then, for each integer A, there exists a unique integer r with 0≤r<M, such that A≡r (mod M).

Proof Recall that Euclidean division guarantees that there exist unique integers q and r, the quotient and remainder upon division of A by M , such that A=qM+r where the remainder satisfies 0>r<M. □

Theorem 11. If A and M are coprime integers, then, for any integer B, there exists an integer x such that Ax≡B (mod M). Moreover, there is a unique x in the interval 0≤x<M, and any two solutions differ by a multiple of M.

The uniqueness is of special importance here because of the fact that it is usually simpler to check whether an integer x satisfies Ax≡B (mod M) than it is to construct a solution. In cases where such solutions are desired, it is sufficient to check explicitly that the solution is correct: the details of the applications of the Euclidean division required to produce the solution in the first place can be omitted.

Proof The following lemma holds: the greatest common divisor of A and M is the least positive integer of the form sA+tM for integers s, t. To prove the lemma, let d=sA+tM be the least such positive integer. Since any common divisor of A and M divides d, it follows that gcd(A, M)|d. To show the opposite, that d divides A and M, and it is sufficient by symmetry to show that it divides A. Recall that if q and r are the quotient and remainder of division of A by d, thenA=qd+r where 0≤r<d. To show that r=0, were it not the case, then note that r=A−qd=A−q(sA+tM)=(1−qs)A+(−qt)M is a positive integer of the form s′A+t′M that is less than d. But d was supposed to be the least such positive integer, so this contradicts the choice of d. Thus it has been shown that d|A. Since also then d|M by symmetry, it now follows that d|gcd(A, M) and now it is proven these positive integers divide one another and thus they are equal.

Returning to the proof of the theorem, since A, M are coprime, there are integers s and t such that As+Mt=1. Multiplying by B this is A(Bs)+M(Bt)=B so that A(Bs)≡B (mod M). Thus x=Bs is the required solution.

For uniqueness, suppose two solutions x, x′ are given, with 0≤x, x′<M, then A(x−x′)≡0 (mod M). Since A has no divisors in common with M, this implies that |x−x′| is divisible by M and the only integer in the interval 0≤|x−x′|<M with this property is |x−x′|=0, so x=x′. This completes the proof. □

Systems of Congruences

The systems of congruence employed here have the following form where p is a prime and the exponents k_i are positive integers:

$\begin{array}{cc}\{\begin{array}{ccc}{A}_1& \equiv B_1& \left(\mathrm{mod}{p}^{k_1}\right)\\ A_2& \equiv B_2& \left(\mathrm{mod}{p}^{k_2}\right)\\ ⋮& ⋮& \\ A_m& \equiv B_m& \left(\mathrm{mod}{p}^{k_m}\right)\end{array}.& \left(98\right)\end{array}$

The following corollary to Proposition 3 holds:

Proposition 5. Suppose that the pairs of integers (A_i, B_i) satisfy the system (98) and k_i′ are any positive integers such that k_i′≤k_i for 1≤i≤m. Then for any integer pairs (A_i′, B_i′) such thatA_i′≡A_i (mod p^ki′)B_i′≡B_i (mod p^ki′)for 1≤i≤m, the system of congruences (99) also holds:

$\begin{array}{cc}\{\begin{array}{ccc}{A}_1^{\prime }& \equiv B_1^{\prime }& \left(\mathrm{mod}{p^{k_1}}^{\prime }\right)\\ A_2^{\prime }& \equiv B_2^{\prime }& \left(\mathrm{mod}{p^{k_2}}^{\prime }\right)\\ ⋮& ⋮& \\ A_m^{\prime }& \equiv B_m^{\prime }& \left(\mathrm{mod}{p^{k_m}}^{\prime }\right)\end{array}.& \left(99\right)\end{array}$

This proposition facilitates checking certain systems of congruences by hand.

Lifting Solutions of Systems of Congruences

When a system of congruences (99) is obtained from (98) as in Proposition 5, the system of congruences (99) arises from (98) by truncation. Proposition 5 implies that every solution to a system of congruence is also a solution to its truncation.

The converse is not true. However, the following principle does hold: every solution to a truncated system of non-degenerate polynomial congruences can be prolonged to a solution of the original system.

In more detail,

Theorem 12. Let F₁(X₁, . . . , X_n), . . . , F_n(X₁, . . . , X_n) be integer polynomials in the indeterminates X₁, . . . , X_n. For any solution any positive integers k₁, . . . , k₁, and for every solution (X₁*, X₂*, . . . , X_n*) modulo p to the system of congruences

$\begin{array}{cccc}{F}_1^{*}\left(X_1^{*},\dots ,X_n^{*}\right)& \equiv 0& & \left(\mathrm{mod}p\right)\\ F_2\left(X_1^{*},\dots ,X_n^{*}\right)& \equiv 0& & \left(\mathrm{mod}p\right)\\ ⋮& & ⋮& \\ F_M\left(X_1^{*},\dots ,X_n^{*}\right)& \equiv 0& & \left(\mathrm{mod}p\right)\end{array}$

such that the determinant of the matrix of partial derivatives (∂F_i/∂X_j)(X₁*, . . . , X_n*) is not divisible by p. Then there exists a unique solution (X₁′, . . . , X_n′) of

$\begin{array}{cccc}{F}_1\left(X_1^{\prime },\dots ,X_n^{\prime }\right)& \equiv 0& & \left(\mathrm{mod}{p}^{k_1}\right)\\ F_2\left(X_1^{\prime },\dots ,X_n^{\prime }\right)& \equiv 0& & \left(\mathrm{mod}{p}^{k_2}\right)\\ ⋮& & ⋮& \\ F_M\left(X_1^{\prime },\dots ,X_n^{\prime }\right)& \equiv 0& & \left(\mathrm{mod}{p}^{k_m}\right)\end{array}$

such that (X₁′, . . . , X_n′) modulo p is congruent to (X₁*, . . . , X_n*).

Proof Let X=(X₁, . . . , X_n) and DF(X) be the matrix of partial derivatives of F. If Σ is any n -dimensional vector of integers, thenF(X*+pΣ)=F(X*)+pDF(X*)·Σ (mod p²).  (100)

Since F(X*)≡0 (mod p), all components of the vector F(X*) are divisible by p, and so the following definition is allowed:Σ=−DF(X*)⁻¹ (F(X*)/p)where the inverse matrix DF(X*)⁻¹ is computed modulo p (by hypothesis, it is invertible).

Then (100) implies that F(X*+pΣ)≡0 (mod p²). Now iterate this construction with p² instead of p, and so on. The iteration is none other than Newton's method:X_n+1=X_n−DF(X_n)⁻¹F(X_n)and the same argument shows by induction that F(x_n+1)≡0 (mod p²ⁿ⁺¹).

For uniqueness, it is sufficient to exhibit a metric space for which the iteration Φ(X)=X−DF(X)⁻¹F(X) is strictly contractive. To this end, let _p denote the p-adic integers and extend Φ by density onto _pⁿ, where _pⁿ is given the finite-dimensional l^∞ metric. Then:

• • Φ(x) is contractive on the closed subset F(X)≡0 (mod p).

To prove it, suppose F(X),F(Y)≡0 (mod p). Denote by A the linear form such that DF(Y)⁻¹=DF(X)⁻¹+A(Y−X)+o(|Y−X|_∞). Note that A is an integral form (i.e., has entries in _p), because of the hypothesis on the determinant of DF(X). Then

$\begin{array}{c}\varphi \left(Y\right)-\varphi \left(X\right)=\left(Y-X\right)+\left({\mathrm{DF}\left(X\right)}^{-1}F\left(X\right)-{\mathrm{DF}\left(Y\right)}^{-1}F\left(Y\right)\right)+o\left(❘Y-X❘\right)\\ =\left(Y-X\right)+({\mathrm{DF}\left(X\right)}^{-1}F\left(X\right)-{\mathrm{DF}\left(X\right)}^{-1}+\\ A\left(Y-X\right))\left(F\left(X\right)+\mathrm{DF}\left(X\right)\left(Y-X\right)\right))+o\left(❘Y-X❘\right)\\ =A\left(Y-X\right)F\left(X\right)+o\left(❘Y-X❘\right).\end{array}$

Since F(X)≡0 (mod p), it then follows that |Φ(Y)−Φ(X)|≤p⁻¹|Y−X|. Thus Φ is a strict contraction on a closed subset of a complete metric space, and therefore has a unique fixed point. □

Note that the proof of the theorem also contains an effective method for constructing the lifted solution (Newton's method).

Triangular Systems

A system of polynomials F₁(X₁), F₂(X₁, X₂), . . . , F_n(X₁, . . . , X_n), where the k-th polynomial of the system depends only on the first k variables, is called lower triangular. It is easier to formulate uniqueness for lower-triangular systems, and these are the only kinds of systems that shall be considered henceforth.

Theorem 13. Suppose that F₁(X₁), F₂(X₁, X₂), . . . , F_n(X₁, X₂, . . . , X_n) is a lower-triangular system such that the diagonal partial derivatives ∞F₁, ∞X₁, ∞F₂/∞X₂, . . . , ∞F_n/∞X_n are non-zero constants modulo p. Then for any positive integers k_i, there exists a unique solution to the system

$\begin{array}{cccc}{F}_1\left(X_1\right)& \equiv 0& & \left(\mathrm{mod}{p}^{k_1}\right)\\ F_1\left(X_1,X_2\right)& \equiv 0& & \left(\mathrm{mod}{p}^{k_2}\right)\\ ⋮& & ⋮& \\ F_n\left(X_1,X_2,\dots ,X_n\right)& \equiv 0& & \left(\mathrm{mod}{p}^{k_n}\right)\end{array}$ such that 0≤X_i<p^ki for i=1, . . . n. Moreover, any two solutions X_i and X_i′ are congruent modulo p^ki.

Proof. The proof is by induction on the number of equations. The condition on ∞F₁/ ∞X₁ implies that F₁ has the following formF₁(X₁)=a₁X₁+b₁+pR₁(X₁)where R₁ (X₁) is an integral polynomial. By hypothesis, a₁ is not zero modulo p, and so a₁X₁+b₁≡0 (mod p) has a unique solution modulo p. Theorem 12 implies the uniqueness of the lift.

Assuming the theorem has been established for a lower triangular system F₁(X₁), . . . , F_n (X₁, . . . , X_n) it is now sufficient to show how to prove it when there is one more relation F_n+1(X₁, . . . , X_n+1). As in the n=1 case, the hypothesis impliesF_n+1(X₁, . . . , X_n+1)=a_n+1X_n+1+b_n+1+pR_n+1(X₁, . . . , X_n+1))where a_n+1 is a nonzero constant and b_n+1 is a polynomial in (X₁, . . . , X_n), which have already been determined and so can be eliminated. Because a_n+1X_n+1+b_n+1≡0 (mod p) has a unique solution for X_n+1, it therefore follows, again by Theorem 12, that the equation a_n+1X_n+1+b_n+1+pR_n+1≡0 (mod p^kn+1) also has a unique solution. □

Polynomial Factorization

Suppose that f(x) is a polynomial of degree d≥1 modulo p^M where p is prime and M≥1. Factorization of f has two phases. The second phase is known as Hensel lifting: given any factorization of f(x) modulo p, say f(x)≡f₁(x)f₂(x) . . . f_r(x) (mod p), there exists a unique factorization of f(x) modulo p^M, f(x)≡f₁(x)f₂(x) . . . f_r(x) (mod p^M) such that f_i(x)≡f_i(x) (mod p) for each i. Moreover, there exists a O ^˜(dM) algorithm for determining the factors f_i. Therefore, the problem of factoring modulo a prime power reduces to the problem of factoring modulo a prime.

Factorization Modulo a Prime

Factorization modulo an odd prime p is achieved with the following algorithm.

Input

A monic polynomial f(x) of degree d≥1, modulo an odd prime p.

Output

A set of pairs {(f_i(x), e_i)} of monic polynomials f_i(x) that are irreducible mod p, and multiplicities e_i, for 1≥i≥r, such that f(x)≡f₁(x)^e1f₂^e2 . . . f_r(x)^er.

• • 1. Initialize: Let h←x, ϕ←f, i←0, U←{ }.
  • 2. Let i←i+1
  • 3. By repeated squaring mod f, computeh←h^p mod f.

Then setg←gcd(h−x, ϕ)

4. If g≠1, then call the equal-degree factorization subroutine, with input g and i, and keep the list of irreducible factors g₁, . . . , g_s of g.

• • 5. For j=1 to s do:
    • Let e←0

$\mathrm{While}{g}_j❘\varphi \mathrm{do}\varphi \leftarrow \frac{\varphi }{g_j}\mathrm{and}e\leftarrow e+1.$

• • • U←U∪{(g_j, e)}
  • 6. If ϕ≠1, then go to 2. Else return U.

Equal-Degree Factorization Subroutine

The following subroutine is used in the main algorithm.

Input

A square-free monic polynomial f modulo p of degree n>0, and a divisor d<n of n, such that all irreducible factors of f have degree d.

Output

The monic irreducible factors f mod p.

• • 1. If n=d, return {f}.
  • 2. Choose a polynomial a mod p with 1<degα<n.
  • 3. Let g₁←gcd(a, f). If g₁≠1, then call the algorithm recursively with g₁ and f/g₁, and return the union of the outputs of the two function calls. Else, go to 4.
  • 4. Compute b←a^(pd−1)/2 mod f, by using repeated squaring modulo f, p.
  • 5. Let g₂←gcd(b−1, f). If g₂≠1 and g₂≠f, then call the algorithm recursively with g₂ and f/g₂, and return the union of the outputs of the two function calls. Else go to 2.

Lifting to Higher Powers of p

Recall Hensel's lemma:

Theorem 14. Let p be a prime and f(x) be an integer polynomial admitting a factorization f(x)≡a(x)b(x) (mod p). Then, for any M≥1, there exist unique (p,M)-standard polynomials ã(x), {tilde over (b)}(x) with ã(x)≡a(x) (mod p) and b(x)≡b(x) (mod p) such that f(x)≡ã(x){tilde over (b)}(x) (mod p^k).

The polynomials ã(x) and {tilde over (b)}(x) are called the lifts of the factors a(x) and b(x).

A corollary in the present application is:

• • Every persistent solution tor(x)s(x)≡v(x) (mod p)where r(x)=A(x)+U(x)−V(x), s(x)=A(x)−U(x)−V(x), lifts to a unique solution tor(x)s(x)≡v(x) (SP _pk)where U(x) and V(x) are standard polynomials.

One Step of the Lift

For a factorization f=gh into a pair of factors, the lift is constructed using the following recursive procedure.

Inputs: A p-adic polynomial f and p-adic polynomials g_k, h_k, s_k, t_k such thatf≡g_kh_k (mod p^2k)s_kg_k+t_kh_k≡1 (mod p^2k).

Outputs: p-adic polynomials g_k+1, h_k+1, s_k+1, t_k+1 such thatf≡g_kh_k (mod p^2k+1)s_kg_k+t_kh_k≡1 (mod p^2k+1).

• • Let e←f−g_kh_k, and then s_ke←qh_k+r using the division algorithm for polynomials.
  • Let h_k+1←h_k+r and g_k+1←g_k+t_ke_k+qg_k.
  • Let b←s_kg_k+1+t_kh_k+1−1 and then s_kb←ch_k+1+d using the division algorithm for polynomials.
  • Let s_k+1←s_k−d and t_k+1←t_k−t_kb−cg_k+1.

Multifactor Lifting

To lift several factors, one employs a divide and conquer approach. Given a (pairwise coprime) factorization of f=g₁g₂ . . . g_r:

• • If r is 1, there is nothing to do. Otherwise, divide the g_i into two sets, and let (say) g be the product of the polynomials g_i in the first set and h the product of the polyniomials h_i in the second. For the factorizations g=Π_ig_i and h=Π_ih_i, recursively call the (multifactor) algorithm. Then, for f=gh call the algorithm of (12.4.4).

Polynomials Modulo a Prime

Polynomial Inversion

Let p be an odd prime and consider polynomials v(x)=α₀+α₁x+ . . . +α_nxⁿ where the coefficients are integers 0≤α_i<p for each i. The usual rules for polynomial arithmetic are observed, but the coefficients are reduced modulo p. The rules for arithmetic are then extended to power series modulo p. Operating on sequences, the rules are the same as those of digit sequences except that the carry is discarded. Thus the arithmetic of power series modulo p is arithmetic without carry.

Theorem 15. Let f(x) be a polynomial modulo p and suppose that p does not divide f(0). Then there exists a unique power series g(x) such that f(x)g(x)≡1 (mod p).

Proof. For uniqueness, if there were two solutions g and g′, then f(x)(g(x)−g′(x))≡0 (mod p) implies that g(x)−g′(x)≡0 (mod p) and so the polynomials g(x) and g′(x) are the same modulo p.

For existence, it will suffice to give an efficient algorithm for constructing the inverse. Since p does not divide f(0), the Euclidean algorithm gives a coefficient g₀ modulo p such thatf(0)g₀≡1 (mod p).

Then, for k=0,1, . . . , defineg_k+1=(2−g_kf)g_k mod p^2k+1.

Let |·| denote the x-adic norm on the power series:|g(x)|=inf{2^−k|x^k|g(x)}.

Note that|1−g₀f|≤2⁻¹   (101)because x divides 1−g₀f. It is now shown that also|1−g_k+1f|≤|1−g_kf|².  (102)

From (101) and (102) it follows by induction that|1−g_kf|≤2^−2k for all j; that is:g_kf≡1 (mod x^2k).

Also, if k<k′, |g_k−g_k′|<2^−2k, and it follows that g_k and g_k′, agree for the first 2^k terms. Thus the series whose first 2^k terms agree with g_k is well-defined.

It remains to show that (102) holds. Consider

$\begin{array}{c}1-g_{k+1}f=1-2\left(2-g_{k}f\right)g_{k}f\\ =\left(1-g_{k}f\right)-\left(1-g_{k}f\right)g_{k}f\\ ={\left(1-g_{k}f\right)}^2.\end{array}$

So (102) now follows by multiplicativity of the norm.□

Square Root

Theorem 16. Suppose that v(x) is a polynomial modulo p such that v(0) is a quadratic residue modulo p, say α²≡v(0) (mod p). Then there exists a unique power series A(x) mod p such that A(x)²≡v(x) (mod p) and A(0)≡α (mod p).

Proof. For uniqueness, if A, B are two solutions, thenA²−B²=(A−B)(A+B)≡0 (mod p).

Thus p divides either A−B or A+B, meaning that A≡±B (mod p). Hence, only one of A, B can satisfy A≡α (mod p). Therefore the solution is unique.

This leaves only the matter of existence. Define a sequence A₀, A₁, . . . by A₀=α, andA_k+1=2⁻¹ (A_k+vA_k⁻¹) mod x^2k+1  (103)where the inverses are computed modulo x^2k+1 using the algorithm of inversion modulo p.

Note that |v−A₀²|≤2⁻¹. It shall be shown that|v−A_k+1²|=|v−A_k|² so that, by induction,|v−A_k²|_p=2^−2k,i.e.,A_k²≡v (mod x^2k).as desired.

To prove it, denote by 1/A_k the inverse of A_k modulo x^2k+1. Then:

$\begin{array}{cc}v-A_{k+1}^2\equiv v-\frac{1}{4}{A}_k^2-\frac{1}{2}v-\frac{1}{4}{v}^2{A}_k^{-2}& \\ \equiv \frac{1}{2}\left(v-A_k^2\right)+\frac{1}{4}\left(A_k^2-\frac{v^2}{A_k^2}\right)& \\ \equiv \frac{1}{2}\left(v-A_k^2\right)+\frac{1}{2}\frac{A_{k+1}}{A_k}\left(A_k-\frac{v}{A_k}\right)& \\ \equiv \frac{1}{2}\left(v-A_k^2\right)\left(1-\frac{A_{k+1}}{A_k}\right)\left(\mathrm{mod}{x}^{2^{k+1}}\right).& \end{array}$

Next, note that

$1-\frac{A_{k+1}}{A_k}\equiv \frac{1}{2}\left(\frac{v-A_k^2}{A_k}\right).$

Substituting into the above now gives

$v-A_{k+1}^2\equiv \frac{1}{4}{\left(v-A_k^2\right)}^2{A}_k^{-1}$ and therefore, by multiplicativity of the norm and since |A_k|=1,|v−A_k+1²|=|v−A_k²|²,as required. □

References, All of Which are Incorporated by Reference Herein

• • 1. Coraluppi, Giorgio, Method and apparatus for factoring large integers, U.S. Pat. No. 10,298,393, 21 May 2019.
  • 2. von zur Gathen, Joachim and Gerhard, Jürgen, Modern computer algebra, Cambridge University Press, 2013.
  • 3. C. F. Gauss, Disquisitiones Arithmeticae, New York, NY: Springer-Verlag, 1986.
  • 4. R. L. Rivest, A. Shamir, L. Adleman, A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, Communications of the ACM, 21, 120-125, 1978.

Preferred Embodiment

• • An integer N₀ to be factored is given. A prime p and vector of positive integers k=[k₀, k₁, . . . , k_M−1] are selected. See FIG. 2.
  • A polynomial v(x)=v₀+v₁x+ . . . +v_n−1xⁿ⁻¹ is determined such that v(p)=N is a predetermined multiple of N₀.
  • A p^k-standard polynomial A(x) is determined such that A(x)²≡v(x) (SP_pk).
  • A polynomial f(x)=f₀+f₁x+f₂x²+ . . . +f_M−1x^M−1 is called p^k-standard if0≤f_i<p^ki for i=0,1, . . . , M−1.
  • The “p^k-standard part” of a polynomial f(x) is computed by reducing the coefficient of xⁱ by p^ki, using the division algorithm.
  • The standard polynomial A(x) is determined by starting with the constant polynomial A₀(x)=ω₀ where ω₀ is an integer such that ω₀²≡N₀ (mod p), and then performing the iterationA_j+1(x)=2⁻¹(A_j(x)+v(x)A_j(x)⁻¹) (SP_pk).
  • The roster of pairs (U(x), V(x)) is determined such that there is a persistent standard polynomial factorization:(A(x)−U(x)−V(x))(A(x)+U(x)−V(x))≡v(x) (SP_pk)
  • A standard polynomial factorization v(x)≡r(x)s(x) is called persistent if r(x) and s(x) have the same degree as their reductions modulo p.
  • The persistent factorizations are determined by first factoring v(x) modulo p, and then lifting to a standard polynomial factorization.
  • The factorization of v(x) is achieved by first splitting factors by iterating, with repeated squaring, x→x^p (mod v), using the division algorithm to compute the remainder on division by v, then computing the greatest common divisor using the Euclidean algorithm with x^q−x and v(x). Then, with each of the factors so split, further splitting into factors of equal degree.
    • The Euclidean algorithm for inputs f and g is a procedure for determining their greatest common divisor. Exchange f and g if necessary so that degf≥degg. If g is the zero polynomial, return f. If f or g has degree 0, then the output is 1. Otherwise use the division algorithm to compute the remainder r of f on division by g, which will have degree less than that of g, and recursively call the Euclidean algorithm with inputs g, r.
    • Factors of a polynomial f of degree n that splits as a product of distinct polynomials all known to have the same degree d proceeds by starting with a random non-constant polynomial a of degree less than f, computing α^(pd−1) (mod f) using the division algorithm and repeated squaring, using the Euclidean algorithm to test if α^pd−1 −1 shares a factor with f. If so, then f splits and the algorithm is called recursively on the parts. If not, then a new (random) polynomial a is selected.
  • The lift is computed as follows. If v(x) factors modulo p as a product g₀(x)h₀(x), where g₀, h₀ share no common factor, then the extended Euclidean algorithm is employed to find polynomials s₀(x), t₀(x) modulo p such that s₀(x)g(x)+t₀(x)h(x)=1. For each integer j starting from 0 and increasing until the desired lift is obtained (for a p^k-standard factorization), a polynomial is computed e=f−g_jh_j, then polynomials q, r are computed using the division algorithm so that s_je=qh_j+r. Let h_j+1=h_j+r and g_j+1=g_j+t_je_j+qg_j. Then let b=s_jg_j+1+t_jh_j+1 and use the division algorithm to find c, d where s_jb=ch_j+1+d. Then let s_j+1=s_j−d and t_j+1=t_j−t_jb−cg_j+1.
  • The extended Euclidean algorithm takes inputs a, b and produces (s, t, α) where sa+tb=a and a is the greatest common divisor of a, b. (1) Let α=α, β=b, S=1, T=0, s=0, t=1. (2) If β=0, then output (s, t, α). Use the division algorithm to find q, r such that degr<deβ and α=qβ+r. Let (S, s)=(s−qS, S) and (T, t)=(t−qT, T), α=β, β=r and go back to (2).
  • For each persistent standard polynomial factorizationv(x)≡(A(x)−U(x)−V(x))(A(x)+U(x)−V(x)) (SP)the carry is determined by(A(p)−U(p)−V(p))(A(p)+U(p)−V(p))−v(p)≡BV(p)+C which defines constants B and C.
  • An integer a is computed using the division and extended Euclidean algorithms such that a=(B²/4+A(p)B) mod N₀. (The extended Euclidean algorithm is necessary to invert 4 modulo N₀.)
  • An initial point in a set of quartuples of integers modulo N₀ (the projective space) is [X₀, X₁, X₂, X₃]=[1,0,CU(p) mod N₀, 0], and the semigroup law is repeated starting from this point.
  • The semigroup law applies, given a pair of elements [X₀: X₁: X₂: X₃] and [Y₀: Y₁: Y₂: Y₃] of the projective space, to produce a third point [Z₀, Z₁, Z₂, Z₃]:
    • It is tested whether [X₀: X₁: X₂: X₃]≡[Y₀: Y₁: Y₂: Y₃] (mod N₀). If so, then the point [Z₀, Z₁, Z₂, Z₃] is

$$\begin{gathered} \begin{array}{c}{Z}_0\equiv 16X_0^4{X}_2^4\left(\mathrm{mod}{N}_0\right)\\ Z_1\equiv X_0^4{X}_2^2\left(4X_3^2-16C^2{U}^2{X}_0^{2}a-32C^2{U\left(p\right)}^2{X}_0{X}_1\right)\left(\mathrm{mod}{N}_0\right)\\ Z_2\equiv -2X_0{X}_2\left(\begin{array}{c}8X_0^3{X}_1^3{a}^3+36X_0^2{X}_1^4{a}^2-8X_0^3{X}_1{X}_2^2{a}^2+54X_0{X}_1^{5}a-\\ -36X_0^2{X}_1^2{X}_2^{2}a+27X_1^6-36X_0{X}_1^3{X}_2^2+8X_0^2{X}_2^4\end{array}\right)\text{ \\ (mod⁢N0)}\\ Z_3\equiv {\left(4X_0^2{X}_1^2{a}^2+12X_0{X}_1^{3}a-4X_0^2{X}_2^{2}a+9X_1^4-8X_0{X}_1{X}_2^2\right)}^2\left(\mathrm{mod}{N}_0\right)\end{array} \end{gathered}$$

• • Otherwise, the point [Z₀, Z₁, Z₂, Z₃] is:

$\begin{array}{c}{Z}_0\equiv {\left(X_1{Y}_0-X_0{Y}_1\right)}^4{X}_0^2{Y}_0^2\left(\mathrm{mod}{N}_0\right)\\ Z_1\equiv X_0^3{Y_0^3\left(X_1{Y}_0-X_0{Y}_1\right)}^2\left(2C^2{U\left(p\right)}^2{X}_0{Y}_0+2X_1{Y}_{1}a+X_3{Y}_1-2X_2{Y}_2+X_1{Y}_3\right)\left(\mathrm{mod}{N}_0\right)\\ Z_2\equiv X_0^3{Y}_0^3\left(X_1{Y}_0-X_0{Y}_1\right)\left(\begin{array}{c}-4C^2{U\left(p\right)}^2{X}_0{X}_2{Y}_0^2+4C^2{U\left(p\right)}^2{X}_0^2{Y}_0{Y}_2+\\ +X_1{X}_3{Y}_0{Y}_2+3X_0{X}_3{Y}_1{Y}_2-3X_1{X}_2{Y}_0{Y}_3-\\ -X_0{X}_2{Y}_1{Y}_3-2a\left(\begin{array}{c}{X}_1{X}_2{Y}_0{Y}_1-X_0{X}_3{Y}_0{Y}_2-\\ -X_0{X}_1{Y}_1{Y}_2+X_0{X}_2{Y}_0{Y}_3\end{array}\right)\end{array}\right)\left(\mathrm{mod}{N}_0\right)\\ Z_3\equiv {\left(\begin{array}{c}{\left(X_1{Y}_0-X_0{Y}_1\right)}^2{X}_0{Y}_{0}a+X_1^3{Y}_0^3-X_0{X}_2^2{Y}_0^3-X_0{X}_1^2{Y}_0^2{Y}_1-\\ -X_0^2{X}_1{Y}_0{Y}_1^2+X_0^3{Y}_1^3+2X_0^2{X}_2{Y}_0^2{Y}_2-X_0^3{Y}_0{Y}_2^2\end{array}\right)}^2\left(\mathrm{mod}{N}_0\right)\end{array}$

• • The semigroup law is repeated, possibly in batches to minimize the number of arithmetic operations performed. There is a test if the semigroup reaches the boundary of the projective space; when it does so, a factorization of N₀ is achieved.
  • If a factorization of N₀ is not achieved after a preselected amount of time, a different multiple of N₀ shall be selected in lieu of N, and the process is repeated until a factor is found.

DESCRIPTION OF THE INVENTION

The present invention pertains to a method for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers. See FIGS. 1-4. The method comprises the steps of obtaining the electromagnetic signal W from a telecommunications network, or a data network or an Internet or a first non-transient memory. There is the step of storing the signal W in a second non-transient memory. There is the step of decoding with a second computer in communication with the second non -transient memory the signal W in the second non-transient memory by factoring the public key N₀ in at most a time O(log⁶N₀) with the second computer generated steps of selecting integers a, b. There is the step of electing an initial point in a set of quartuples of integers modulo N₀ (a projective space) [X₀, X₁, X₂, X₃]=[1,0,b,0]. There is the step of applying a semigroup law repeatedly starting from the initial point, where the semigroup law is defined as: given a pair of elements [X₀: X₁: X₂: X₃] and [Y₀: Y₁: Y₂: Y₃] of the projective space, there is produced a third point [Z₀, Z₁, Z₂, Z₃]. There is the step of determining that [X₀: X₁: X₂: X₃]≡[Y₀: Y₁: Y₂: Y₃] (mod N₀), and thus the third point is

$\begin{array}{c}{Z}_0\equiv 16X_0^4{X}_2^4\left(\mathrm{mod}{N}_0\right)\\ Z_1\equiv X_0^4{X}_2^2\left(4X_3^2-16b^2{X}_0^{2}a-32b^2{X}_0{X}_1\right)\left(\mathrm{mod}{N}_0\right)\\ Z_2\equiv -2X_0{X}_2\left(\begin{array}{c}8X_0^3{X}_1^3{a}^3+36X_0^2{X}_1^4{a}^2-8X_0^3{X}_1{X}_2^2{a}^2+54X_0{X}_1^{5}a-\\ -36X_0^2{X}_1^2{X}_2^{2}a+27X_1^6-36X_0{X}_1^3{X}_2^2+8X_0^2{X}_2^4\end{array}\right)\left(\mathrm{mod}{N}_0\right)\\ Z_3\equiv {\left(4X_0^2{X}_1^2{a}^2+12X_0{X}_1^{3}a-4X_0^2{X}_2^{2}a+9X_1^4-8X_0{X}_1{X}_2^2\right)}^2\left(\mathrm{mod}{N}_0\right);\end{array}$ otherwise, the point [Z₀, Z₁, Z₂, Z₃] is:

$\begin{array}{c}{Z}_0\equiv {\left(X_1{Y}_0-X_0{Y}_1\right)}^4{X}_0^2{Y}_0^2\left(\mathrm{mod}{N}_0\right)\\ Z_1\equiv X_0^3{Y_0^3\left(X_1{Y}_0-X_0{Y}_1\right)}^2\left(2b^2{X}_0{Y}_0+2X_1{Y}_{1}a+X_3{Y}_1-2X_2{Y}_2+X_1{Y}_3\right)\left(\mathrm{mod}{N}_0\right)\\ Z_2\equiv X_0^3{Y}_0^3\left(X_1{Y}_0-X_0{Y}_1\right)\left(\begin{array}{c}-4b^2{X}_0{X}_2{Y}_0^2+4b^2{X}_0^2{Y}_0{Y}_2+X_1{X}_3{Y}_0{Y}_2+\\ +3X_0{X}_3{Y}_1{Y}_2-3X_1{X}_2{Y}_0{Y}_3-X_0{X}_2{Y}_1{Y}_3-\\ -2a\left(X_1{X}_2{Y}_0{Y}_1-X_0{X}_3{Y}_0{Y}_2-X_0{X}_1{Y}_1{Y}_2+X_0{X}_2{Y}_0{Y}_3\right)\end{array}\right)\left(\mathrm{mod}{N}_0\right)\\ Z_3\equiv {\left(\begin{array}{c}{\left(X_1{Y}_0-X_0{Y}_1\right)}^2{X}_0{Y}_{0}a+X_1^3{Y}_0^3-X_0{X}_2^2{Y}_0^3-X_0{X}_1^2{Y}_0^2{Y}_1-\\ -X_0^2{X}_1{Y}_0{Y}_1^2+X_0^3{Y}_1^3+2X_0^2{X}_2{Y}_0^2{Y}_2-X_0^3{Y}_0{Y}_2^2\end{array}\right)}^2\left(\mathrm{mod}{N}_0\right).\end{array}$

There is the step of testing if any component of the third point shares a factor with N₀ and is a shared factor with N₀. There is the step of identifying the shared factor with N₀ as one of plurality of prime factors of N₀, and a quotient of N₀ by the shared factor as another prime factor. There is the step of decrypting with the second computer the signal W with the public key N₀ and prime factors of the integer N₀. There is the step of reviewing the decrypted signal W for predetermined words with the second computer to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law, wherein the signal W representative of the message is effectively decrypted and deciphered thereby a threat to property or individuals in violation of the law can be acted upon to mitigate or eliminate the threat before the threat occurs and actual damage to property or injury to individuals is prevented or mitigated.

There may be the step of displaying on a display the decrypted signal W. The display may be any type of computer display, tablet display, telephone display or paper which allows the decrypted signal W to be read by a person.

There may be the steps of, if a factorization of N₀ is not found after a preselected amount of time, re-initializing the semigroup law with different values of a and b; and repeating the electing, applying, determining, testing and Identifying steps until a factor with N₀ is found.

There may be the second computer generated steps of selecting a prime p and vector of positive integers k=[k₀, k₁, . . . , k_M−1]. There may be the step of determining a polynomial v(x)=v₀+v₁x+ . . . +v_n−1xⁿ⁻¹ such that v(p)=N is a predetermined multiple of N₀. There may be the step of determining a p^k-standard polynomial A(x) such that A(x)²≡v(x) (SP_pk), where a polynomial f(x)=f₀+f₁x+f₂x²+ . . . +f_M−1x^M−1 is called p^k-standard if0≤f_i<p^ki for i=0,1, . . . ,M−1, a p^k-standard part of the polynomial f(x) is computed by reducing the coefficient of xⁱ modulo p^ki and truncating all terms x^m for m≥M. There may be the step of determining a roster of pairs (U(x), V(x)) such that there is a persistent standard polynomial factorization:(A(x)−U(x)−V(x))(A(x)+U(x)−V(x))≡v(x) (SP_pk)where a standard polynomial factorization v(x)≡r(x)s(x) is called persistent if r(x) and s(x) have the same degree as their reductions modulo p.

There may be the second computer generated steps of for each item of the roster, a standard polynomial factorization isv(x)≡(A(x)−U(x)−V(x))(A(x)+U(x)−V(x)) (SP)determining a carry by(A(p)−U(p)−V(p))(A(p)+U(p)−V(p))−v(p)≡BV(p)+C which defines constants B and C for each pair of the roster, for those elements of the roster of (U(x), V(x)) such that both corresponding constants B, C are simultaneously zero, the integers r(p)=A(p)−U(p)−V(p) and s(p)=A(p)+U(p)−V(p) contain divisors of N₀. There may be the step of extracting the divisors to obtain the prime factors of N₀.

The present invention pertains to a second computer for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers and W is a function of r and s, as shown in FIG. 1 and FIG. 3. The second computer comprises an input for obtaining the electromagnetic signal W from a telecommunications network, or a data network or an Internet or a first non-transient memory, a second non -transient memory in communication with the input in which the signal W is stored. The second computer comprises a cpu in communication with the second non-transient memory with the signal W in the second non-transient memory that decodes the signal W by factoring the public key N₀ in time O(log⁶N₀) by the second computer generated steps of selecting integers a, b. There is the step of electing an initial point in a set of quartuples of integers modulo N₀ (a projective space) [X₀, X₁, X₂, X₃]=[1,0,b,0]. There is the step of applying a semigroup law repeatedly starting from the initial point, where the semigroup law is defined as: given a pair of elements [X₀: X₁: X₂: X₃] and [Y₀: Y₁: Y₂: Y₃] of the projective space, there is produced a third point [Z₀, Z₁, Z₂, Z₃]. There is the step of determining that [X₀: X₁: X₂: X₃]≡[Y₀: Y₁: Y₂: Y₃] (mod N₀), and thus the third point is

$\begin{array}{c}{Z}_0\equiv 16X_0^4{X}_2^4\left(\mathrm{mod}{N}_0\right)\\ Z_1\equiv X_0^4{X}_2^2\left(4X_3^2-16b^2{X}_0^{2}a-32b^2{X}_0{X}_1\right)\left(\mathrm{mod}{N}_0\right)\\ Z_2\equiv -2X_0{X}_2\left(\begin{array}{c}8X_0^3{X}_1^3{a}^3+36X_0^2{X}_1^4{a}^2-8X_0^3{X}_1{X}_2^2{a}^2+54X_0{X}_1^{5}a-\\ -36X_0^2{X}_1^2{X}_2^{2}a+27X_1^6-36X_0{X}_1^3{X}_2^2+8X_0^2{X}_2^4\end{array}\right)\left(\mathrm{mod}{N}_0\right)\\ Z_3\equiv {\left(4X_0^2{X}_1^2{a}^2+12X_0{X}_1^{3}a-4X_0^2{X}_2^{2}a+9X_1^4-8X_0{X}_1{X}_2^2\right)}^2\left(\mathrm{mod}{N}_0\right);\end{array}$

otherwise, the point [Z₀, Z₁, Z₂, Z₃] is:

$\begin{array}{c}{Z}_0\equiv {\left(X_1{Y}_0-X_0{Y}_1\right)}^4{X}_0^2{Y}_0^2\left(\mathrm{mod}{N}_0\right)\\ Z_1\equiv X_0^3{Y_0^3\left(X_1{Y}_0-X_0{Y}_1\right)}^2\left(2b^2{X}_0{Y}_0+2X_1{Y}_{1}a+X_3{Y}_1-2X_2{Y}_2+X_1{Y}_3\right)\left(\mathrm{mod}{N}_0\right)\\ Z_2\equiv X_0^3{Y}_0^3\left(X_1{Y}_0-X_0{Y}_1\right)\left(\begin{array}{c}-4b^2{X}_0{X}_2{Y}_0^2+4b^2{X}_0^2{Y}_0{Y}_2+X_1{X}_3{Y}_0{Y}_2+\\ +3X_0{X}_3{Y}_1{Y}_2-3X_1{X}_2{Y}_0{Y}_3-X_0{X}_2{Y}_1{Y}_3-\\ -2a\left(X_1{X}_2{Y}_0{Y}_1-X_0{X}_3{Y}_0{Y}_2-X_0{X}_1{Y}_1{Y}_2+X_0{X}_2{Y}_0{Y}_3\right)\end{array}\right)\left(\mathrm{mod}{N}_0\right)\\ Z_3\equiv {\left(\begin{array}{c}{\left(X_1{Y}_0-X_0{Y}_1\right)}^2{X}_0{Y}_{0}a+X_1^3{Y}_0^3-X_0{X}_2^2{Y}_0^3-X_0{X}_1^2{Y}_0^2{Y}_1-\\ -X_0^2{X}_1{Y}_0{Y}_1^2+X_0^3{Y}_1^3+2X_0^2{X}_2{Y}_0^2{Y}_2-X_0^3{Y}_0{Y}_2^2\end{array}\right)}^2\left(\mathrm{mod}{N}_0\right).\end{array}$

There is the step of testing if any component of the third point shares a factor with N₀ and is a shared factor with N₀. There is the step of identifying the shared factor with N₀ as one of plurality of prime factors of N₀, and a quotient of N₀ by the shared factor as another prime factor. The cpu decrypting the signal W with the public key N₀ and prime factors of integer N₀. The cpu reviewing the decrypted signal W for predetermined words to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law, wherein the signal W representative of the message is effectively decrypted and deciphered thereby a threat to property or individuals in violation of the law can be quickly acted upon to eliminate the threat before the threat occurs and actual damage to property or injury to individuals is prevented or mitigated. The steps described above for the method are also applicable to the second computer.

The present invention pertains to a non-transitory readable storage medium which includes a computer program stored on the storage medium for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers and W is a function of r and s, where the signal W has been stored in a second non-transient memory of a second computer, and the second computer factoring the public key N₀ in time O(log⁶N₀). The signal W obtained from a telecommunications network, or a data network or an Internet or a first non-transient memory. The computer program having the second computer generated steps of selecting integers a, b. There is the step of electing an initial point in a set of quartuples of integers modulo N₀ (a projective space) [X₀, X₁, X₂, X₃]=[1,0,b,0]. There is the step of applying a semigroup law repeatedly starting from the initial point, where the semigroup law is defined as: given a pair of elements [X₀: X₁: X₂: X₃] and [Y₀: Y₁: Y₂: Y₃] of the projective space, there is produced a third point [Z₀, Z₁, Z₂, Z₃]. There is the step of determining that [X₀: X₁: X₂: X₃]≡[Y₀: Y₁: Y₂: Y₃] (mod N₀), and thus the third point is

$\begin{array}{c}{Z}_0\equiv 16X_0^4{X}_2^4\left(\mathrm{mod}{N}_0\right)\\ Z_1\equiv X_0^4{X}_2^2\left(4X_3^2-16b^2{X}_0^{2}a-32b^2{X}_0{X}_1\right)\left(\mathrm{mod}{N}_0\right)\\ Z_2\equiv -2X_0{X}_2\left(\begin{array}{c}8X_0^3{X}_1^3{a}^3+36X_0^2{X}_1^4{a}^2-8X_0^3{X}_1{X}_2^2{a}^2+54X_0{X}_1^{5}a-\\ -36X_0^2{X}_1^2{X}_2^{2}a+27X_1^6-36X_0{X}_1^3{X}_2^2+8X_0^2{X}_2^4\end{array}\right)\left(\mathrm{mod}{N}_0\right)\\ Z_3\equiv {\left(4X_0^2{X}_1^2{a}^2+12X_0{X}_1^{3}a-4X_0^2{X}_2^{2}a+9X_1^4-8X_0{X}_1{X}_2^2\right)}^2\left(\mathrm{mod}{N}_0\right);\end{array}$

otherwise, the point [Z₀, Z₁, Z₂, Z₃] is:

$\begin{array}{c}{Z}_0\equiv {\left(X_1{Y}_0-X_0{Y}_1\right)}^4{X}_0^2{Y}_0^2\left(\mathrm{mod}{N}_0\right)\\ Z_1\equiv X_0^3{Y_0^3\left(X_1{Y}_0-X_0{Y}_1\right)}^2\left(2b^2{X}_0{Y}_0+2X_1{Y}_{1}a+X_3{Y}_1-2X_2{Y}_2+X_1{Y}_3\right)\left(\mathrm{mod}{N}_0\right)\\ Z_2\equiv X_0^3{Y}_0^3\left(X_1{Y}_0-X_0{Y}_1\right)\left(\begin{array}{c}-4b^2{X}_0{X}_2{Y}_0^2+4b^2{X}_0^2{Y}_0{Y}_2+X_1{X}_3{Y}_0{Y}_2+\\ +3X_0{X}_3{Y}_1{Y}_2-3X_1{X}_2{Y}_0{Y}_3-X_0{X}_2{Y}_1{Y}_3-\\ -2a\left(X_1{X}_2{Y}_0{Y}_1-X_0{X}_3{Y}_0{Y}_2-X_0{X}_1{Y}_1{Y}_2+X_0{X}_2{Y}_0{Y}_3\right)\end{array}\right)\left(\mathrm{mod}{N}_0\right)\\ Z_3\equiv {\left(\begin{array}{c}{\left(X_1{Y}_0-X_0{Y}_1\right)}^2{X}_0{Y}_{0}a+X_1^3{Y}_0^3-X_0{X}_2^2{Y}_0^3-X_0{X}_1^2{Y}_0^2{Y}_1-\\ -X_0^2{X}_1{Y}_0{Y}_1^2+X_0^3{Y}_1^3+2X_0^2{X}_2{Y}_0^2{Y}_2-X_0^3{Y}_0{Y}_2^2\end{array}\right)}^2\left(\mathrm{mod}{N}_0\right).\end{array}$

There is the step of testing if any component of the third point shares a factor with N₀ and is a shared factor with N₀. There is the step of identifying the shared factor with N₀ as one of plurality of prime factors of N₀, and a quotient of N₀ by the shared factor as another prime factor. There is the step of decrypting with the second computer the signal W with the public key N₀ and prime factors of the integer N₀. There is the step of reviewing the decrypted signal W for predetermined words with the second computer to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law, wherein the signal W representative of the message is effectively decrypted and deciphered thereby a threat to property or individuals in violation of the law can be acted upon to mitigate or eliminate the threat before the threat occurs and actual damage to property or injury to individuals is prevented or mitigated. The steps described above for the method are also applicable for the computer program.

Alternatively, the present invention pertains to a method for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers. The method comprises the steps of obtaining the electromagnetic signal W from a telecommunications network, or a data network or an Internet or a first non -transient memory. There is the step of storing the signal W in a second non-transient memory. There is the step of decoding with a second computer in communication with the second non-transient memory the signal W in the second non-transient memory by factoring the public key N₀ in at most a time O(log⁶N₀) with the second computer generated steps of selecting a prime p and vector of positive integers k=[k₀, k₁, . . . , k_M−1]. There is the step of determining a polynomial v(x)=v₀+v₁x+ . . . +v_n−1xⁿ⁻¹ such that v(p)=N is a predetermined multiple of N₀. There is the step of determining a p^k-standard polynomial A(x) such that A(x)²≡v(x) (SP_pk), where a polynomial f(x)=f₀+f₁x+f₂x²+ . . . +f_M−1x^M−1 is called p^k-standard if0≤f_i<p^ki for i=0,1, . . . ,M−1, a p^k-standard part of the polynomial f(x) is computed by reducing the coefficient of xⁱ modulo p^ki and truncating all terms x^m for m≥M. There is the step of determining a roster of pairs (U(x), V(x)) such that there is a persistent standard polynomial factorization:(A(x)−U(x)−V(x))(A(x)+U(x)−V(x))≡v(x) (SP_pk)where a standard polynomial factorization v(x)≡r(x)s(x) is called persistent if r(x) and s(x) have the same degree as their reductions modulo p. There is the step of determining a shared factor that integers r(p) and s(p) share with N₀, where the shared factor with N₀ as one of plurality of prime factors of N₀. There is the step of obtaining another prime factor by division of N₀ by the shared factor. There is the step of identifying the shared factor with N₀ as one of plurality of prime factors of N₀, and a quotient of N₀ by the shared factor as another prime factor. There is the step of decrypting with the second computer the signal W with the public key N₀ and prime factors of the integer N₀. There is the step of reviewing the decrypted signal W for predetermined words with the second computer to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law, wherein the signal W representative of the message is effectively decrypted and deciphered thereby a threat to property or individuals in violation of the law can be acted upon to mitigate or eliminate the threat before the threat occurs and actual damage to property or injury to individuals is prevented or mitigated.

There may be the second computer generated steps of, for each item of the roster, a standard polynomial factorization isv(x)≡(A(x)−U(x)−V(x))(A(x)+U(x)−V(x)) (SP)then determining a carry by(A(p)−U(p)−V(p))(A(p)+U(p)−V(p))−v(p)=BV(p)+C which defines constants B and C for each pair of the roster, for those elements of the roster of (U(x), V(x)) such that both corresponding constants B, C are simultaneously zero, the integers r(p)=A(p)−U(p)−V(p) and s(p)=A(p) +U(p)−V(p) contain divisors of N₀. There may be the step of extracting the divisors to obtain the prime factors of N₀.

There may be the second computer generated steps of given the initial pair ξ₁=0, y₁=CU(p) mod N₀, calculating a discriminant Δ from

$\begin{array}{cc}\Delta =x^3+\left(\frac{B^2}{4}+A\left(p\right)B\right)x^2+{U\left(p\right)}^2{C}^2& \mathrm{mod}{N}_0.\end{array}$

There may be the step of iterating a semigroup law until a factor is found, where the semigroup law is defined as:

If ξ_n≡ξ₁ (mod N₀), let δ=ξ₁, σ₁=0, σ_n=1, otherwise, ξ_n . . . ξ₁ is a nonzero constant modulo N₀; checking whether ξ_n−ξ₁ shares a factor with N₀; if so, then terminating the semigroup iteration and the factor identified is one of the prime factors of N₀, where the other prime factor is found by division of N₀ by the first factor; let δ=1, λ=(ξ_n−ξ₁)⁻¹ (mod N₀), σ₁=−λ, σ₂=λ; so irrespective of whether ξ_n≡ξ₁ (mod N₀), it holds that σ₁ξ₁+σ_nξ_n=δ where δ is a polynomial gcd of ξ₁ and ξ_n;

Next, if y_n≡−y₁ (mod N₀), then let d=δ, ρ=1, ϵ=0; else, checking if y_n+y₁ shares a factor with N₀ and if so then terminating the semigroup iteration and the first factor identified as one of the prime factors of N₀, where the other prime factor is found by division of N₀ by the first factor; otherwise, let d=1, ρ=0, and λ=(y_n+y₁)⁻¹ mod N₀, so that for either sign in y_n≡±y₁ (mod N₀), a congruence ρδ+ϵ(y₁+y_n)≡d (mod N₀) now holds, where d is a polynomial gcd of δ and y₁+y_n;

Finally, let ξ_n+1←ξ_nξ₁/d², define y_n+1 (mod N₀) such that the congruence holds:dy_n+1≡ρ(σ₁ξ₁y_n+σ_nξ_ny₁)+ϵδ(mod ξ_n+1)where the modulo is with respect to polynomial division by ξ_n+1 (mod N₀), and, if ξ_n+1 is quadratic rather than linear, then let

${\xi }_{n+1}\leftarrow \frac{\Delta -y_{n+1}^2}{{\xi }_{n+1}}.$

There may then be the step of testing whether the leading coefficient of ξ_n+1 and N₀ share a factor, and if so, then terminating the semigroup iteration and the first factor is found by division of N₀ by the first factor; else, normalize ξ_n+1 by dividing (modulo N₀) by the leading coefficient of ξ_n+1 and update y_n+1:y_n+1←−y_n+1 mod ξ_n+1.

There may be the step of iterating the semigroup law until a prime factor is found. There may be the step of identifying this prime factor as the first factor of N₀. There may be the step of obtaining the other prime factor by division of N₀ by the first prime factor.

The present invention pertains to a second computer for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers and W is a function of r and s. The second computer comprises an input for obtaining the electromagnetic signal W from a telecommunications network, or a data network or an Internet or a first non-transient memory. The second computer comprises a second non-transient memory in communication with the input in which the signal W is stored. The second computer comprises a cpu in communication with the second non -transient memory with the signal W in the second non-transient memory. The cpu decodes the signal W by factoring the public key N₀ in time O(log⁶N₀) by the second computer generated steps of selecting a prime p and vector of positive integers k=[k₀, k₁, . . . , k_M−1]. There is the step of determining a polynomial v(x)=v₀+v₁x+ , , , +v_n−1xⁿ⁻¹ such that v(p)=N is a predetermined multiple of N₀. There is the step of determining a p^k-standard polynomial A(x) such that A(x)²≡v(x) (SP_pk), where a polynomial f(x)=f₀+f₁x+f₂x²+ . . . +f_M−1x^M−1 called p^k-standard if0≤f_i<p^ki for i=0,1, . . . ,M−1, a p^k-standard part of the polynomial f(x) is computed by reducing the coefficient of xⁱ modulo p^ki and truncating all terms x^m for m≥M. There is the step of determining a roster of pairs (U(x), V(x)) such that there is a persistent standard polynomial factorization:(A(x)−U(x)−V(x))(A(x)+U(x)−V(x))≡v(x) (SP_pk)where a standard polynomial factorization v(x)≡r(x)s(x) is called persistent if r(x) and s(x) have the same degree as their reductions modulo p. There is the step of determining a shared factor that integers r(p) and s(p) share with N₀, where the shared factor with N₀ as one of plurality of prime factors of N₀. There is the step of obtaining another prime factor by division of N₀ by the shared factor. There is the step of identifying the shared factor with N₀ as one of plurality of prime factors of N₀, and a quotient of N₀ by the shared factor as another prime factor. The cpu decrypting with the second computer the signal W with the public key N₀ and prime factors of the integer N₀. The cpu reviewing the decrypted signal W for predetermined words to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law, wherein the signal W representative of the message is effectively decrypted and deciphered thereby a threat to property or individuals in violation of the law can be acted upon to mitigate or eliminate the threat before the threat occurs and actual damage to property or injury to individuals is prevented or mitigated. The steps described above for the alternative method are also applicable for the second computer.

The present invention pertains to a non-transitory readable storage medium which includes a computer program stored on the storage medium for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers and W is a function of r and s, where the signal W has been stored in a second non-transient memory of a second computer, and the second computer factoring the public key N₀ in at most a time O(log⁶N₀). The signal W obtained from a telecommunications network, or a data network or an Internet or a first non-transient memory. The computer program having the second computer generated steps of: selecting a prime p and vector of positive integers k=[k₀, k₁, . . . , k_M−1]. There is the step of determining a polynomial v(x)=v₀+v₁x+ . . . +v_n−1xⁿ⁻¹ such that v(p)=N is a predetermined multiple of N₀. There is the step of determining a p^k-standard polynomial A(x) such that A(x)²≡v(x) (SP_pk), where a polynomial f(x)=f₀+f₁x+f₂x²+ . . . +f_M−1x^M−1 is called p^k-standard if0≤f_i<p^ki for i=0,1, . . . ,M−1, a p^k-standard part of the polynomial f(x) is computed by reducing the coefficient of xⁱ modulo p^ki and truncating all terms x^m for m≥M. There is the step of determining a roster of pairs (U(x), V(x)) such that there is a persistent standard polynomial factorization:(A(x)−U(x)−V(x))(A(x)+U(x)−V(x))≡v(x) (SP_pk)where a standard polynomial factorization v(x)≡r(x)s(x) is called persistent if r(x) and s(x) have the same degree as their reductions modulo p. There is the step of determining a shared factor that integers r(p) and s(p) share with N₀, where the shared factor with N₀ as one of plurality of prime factors of N₀. There is the step of obtaining another prime factor by division of N₀ by the shared factor. There is the step of identifying the shared factor with N₀ as one of plurality of prime factors of N₀, and a quotient of N₀ by the shared factor as another prime factor. There is the step of decrypting with the second computer the signal W with the public key N₀ and prime factors of the integer N₀. There is the step of reviewing the decrypted signal W for predetermined words with the second computer to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law, wherein the signal W representative of the message is effectively decrypted and deciphered thereby a threat to property or individuals in violation of the law can be acted upon to mitigate or eliminate the threat before the threat occurs and actual damage to property or injury to individuals is prevented or mitigated. The steps described above for the alternative method are also applicable for the computer program.

Although the invention has been described in detail in the foregoing embodiments for the purpose of illustration, it is to be understood that such detail is solely for that purpose and that variations can be made therein by those skilled in the art without departing from the spirit and scope of the invention except as it may be described by the following claims.

Claims

1. A method for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N0=r×s, where N0, r and s are integers comprising the steps of: obtaining an electromagnetic signal W from a telecommunications network, or a data network or an Internet or a first non-transient memory;storing the electromagnetic signal W in a second non-transient memory;decoding with a second computer in communication with the second non-transient memory the electromagnetic signal W in the second non-transient memory by factoring the public key N0 in at most a time O(log6N0) with the second computer generated steps of selecting integers a, b;electing an initial point in a set of quartuples of integers modulo N0 (a projective space) [X0, X1, X2, X3]=[1,0,b,0];applying a semigroup law repeatedly starting from the initial point, where the semigroup law is defined as: given a pair of elements [X0: X1: X2: X3] and [Y0: Y1: Y2: Y3] of the projective space, there is produced a third point [Z0, Z1, Z2, Z3];determining that [X0: X1: X2: X3]≡[Y0: Y1: Y2: Y3] (mod N0), and thus the third point is

2. The method of claim 1 including the steps of if a factorization of N0 is not found after a preselected amount of time, re-initializing the semigroup law with different values of a and b; and repeating the electing, applying, determining, testing and Identifying steps until a factor with N0 is found.

3. The method of claim 2 including the second computer generated steps of selecting a prime p and vector of positive integers k=[k0, k1, . . . , kM−1]; Determining a polynomial v(x)=v0+v1x+ . . . +vn−1xn−1 such that v(p)=N is a predetermined multiple of N0;Determining a pk-standard polynomial A(x) such that A(x)2≡v(x) (SPpk), where a polynomial f(x)=f0+f1x+f2x2+ . . . +fM−1xM−1 is called pk-standard if 0≤fi<pki

4. The method of claim 3 including the second computer generated steps of for each item of the roster, a standard polynomial factorization is v(x)≡(A(x)−U(x)−V(x))(A(x)+U(x)−V(x)) (SP)

5. A non-transitory readable storage medium which includes a computer program stored on the storage medium for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N0=r×s, where N0, r and s are integers, where the electromagnetic signal W has been stored in a second non-transient memory of a second computer, and the second computer factoring the public key N0 in time O(log6N0), the electromagnetic signal W obtained from a telecommunications network, or a data network or an Internet or a first non-transient memory, the computer program having the second computer generated steps of: selecting Integers a, b; electing an initial point in a set of quartuples of integers modulo N0 (a projective space) [X0, X1, X2, X3]=[1,0,b,0];applying a semigroup law repeatedly starting from the initial point, where the semigroup law is defined as: given a pair of elements [X0: X1: X2: X3] and [Y0: Y1: Y2: Y3] of the projective space, there is produced a third point [Z0, Z1, Z2, Z3];

6. The non-transitory readable storage medium of claim 5 wherein the software program includes the second computer generated steps of if a factorization of N0 is not found after a preselected amount of time, re-initializing the semigroup law with different values of a and b; and repeating the electing, applying, determining, testing and Identifying steps until a factor with N0 is found.

7. The non-transitory readable storage medium of claim 6 wherein the software program includes the second computer generated steps of selecting a prime p and vector of positive integers k=[k0, k1, . . . , kM−1]; determining a polynomial v(x)=v0+v1x+ . . . +vn−1xn−1 such that v(p)=N is a predetermined multiple of N0;determining a pk-standard polynomial A(x) such that A(x)2≡v(x) (SPpk), where apolynomial f(x)=f0+f1x+f2x2+ . . . +fM−1xM−1 is called pk-standard if 0≤fi<pki

8. The non-transitory readable storage medium of claim 7 wherein the computer program includes the second computer generated steps of for each item of the roster, a standard polynomial factorization is v(x)≡(A(x)−U(x)−V(x))(A(x)+U(x)−V(x)) (SP)

9. A method for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N0=r×s, where N0, r and s are integers comprising the steps of: obtaining an electromagnetic signal W from a telecommunications network, or a data network or an Internet or a first non-transient memory;storing the electromagnetic signal W in a second non-transient memory;decoding with a second computer in communication with the second non-transient memory the electromagnetic signal W in the second non-transient memory by factoring the public key N0 in at most a time O(log6N0) with the second computer generated steps of selecting a prime p and vector of positive integers k=[k0, k1, . . . , kM−1];determining a polynomial v(x)=v0+v1x+ . . . +vn−1xn−1 such that v(p)=N is a predetermined multiple of N0;determining a pk-standard polynomial A(x) such that A(x)2≡v(x) (SPpk), where apolynomial f(x)=f0+f1x+f2x2+ . . . +fM−1xM−1 is called pk-standard if 0≤fi<pki

10. The method of claim 9 including the second computer generated steps of for each item of the roster, a standard polynomial factorization is v(x)≡(A(x)−U(x)−V(x))(A(x)+U(x)−V(x)) (SP)

11. The method of claim 10 including the second computer generated steps of given the initial pair ξ1=0, y1=CU(p) mod N0, calculating a discriminant Δ from

12. A non-transitory readable storage medium which includes a computer program stored on the storage medium for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N0=r×s, where N0, r and s are integers, where the electromagnetic signal W has been stored in a second non-transient memory of a second computer, and the second computer factoring the public key N0 in time O(log6N0), the electromagnetic signal W obtained from a telecommunications network, or a data network or an Internet or a first non-transient memory, the computer program having the second computer generated steps of: selecting a prime p and vector of positive integers k=[k0, k1, . . . , kM−1]; determining a polynomial v(x)=v0+v1x+ . . . +vn−1xn−1 such that v(p)=N is a predetermined multiple of N0;determining a pk-standard polynomial A(x) such that A(x)2≡v(x) (SPpk), where a polynomial f(x)=f0+f1x+f2x2+ . . . +fM−1xM−1 is called pk-standard if 0≤fi<pki

13. The non-transitory readable storage medium of claim 12 wherein the computer program including the second computer generated steps of for each item of the roster, a standard polynomial factorization is v(x)≡(A(x)−U(x)−V(x))(A(x)+U(x)−V(x)) (SP)

14. The non-transitory readable storage medium of claim 13 wherein the computer program including the second computer generated steps of given the initial pair ξ1=0, y1=CU(p) mod N0, calculating a discriminant Δ from