Method and apparatus for factoring large integers

Abstract

This patent describes a method, apparatus and computer program which factor a large integer N0 in a time of the order of p2·logp4 N0, where p denotes a prime.

Description

I. FIELD OF THE INVENTION

The present invention is related to solving an equation in two or more unknown integer variables, where each variable is represented by a multiplicity of multiples of powers of an odd prime p. Specifically, the present invention is related to factoring an integer N₀ restating the problem into the factorization of an appropriate integer N which is a quadratic residue modulo p, then factoring N in a time of order of p²·log_p⁴N.

II. BACKGROUND

The problem of resolving a large integer into the product of its prime factors has stimulated the intellectual curiosity and the imagination of many generations of mathematicians.

In 1801 Gauss wrote: “. . . the dignity of the science itself seems to require that every possible means be explored for the solution of a problem so elegant and so celebrated.” [1,397]

The problem has attracted renewed interest, ever since R. L. Rivest, A. Shamir and L. Adleman proposed an encryption method which is based on the computational difficulty of the factorization problem [2].

This note introduces a method and apparatus which allows the factorization of a large odd integer N in logarithmic time.

III. SUMMARY

The present invention pertains to a method for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers and W is a function of r and s. The method comprises the steps of storing the signal W in a non-transient memory. There is the step of decoding with a second computer in communication with the memory the signal W in the memory with the second computer generated steps of selecting a prime number p of the form p=4k+1 for an odd integer k such that the public key N₀ is a non-quadratic residue modulo p calculating n₀ satisfying the inequalities pⁿ⁰⁻¹<N₀<pⁿ⁰; computing N=τN₀ with a selection of τ such that N is a quadratic residue modulo pⁿ⁰; calculating n satisfying the inequalities pⁿ⁻¹<N<pⁿ and calculating a solution toN≡A²(mod pⁿ)  (1)by using the representation

$\begin{array}{cc}A=\sum _{i=0}^n{\omega }_i{p}^i& \left(2\right)\end{array}$ where ω_i satisfies the condition0<ω_i<pⁿ⁻¹.  (3)

There is the step of decrypting with the second computer the signal W with the public key N₀ and the prime factors of integer N₀. There is the step of displaying on a display by the second computer the decrypted signal W. There is the step of reviewing the decrypted signal W and its relevance.

The present invention pertains to a second computer for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers and W is a function of r and s, comprising:

• • a non-transient memory in which the signal W is stored;

decoding with a CPU in communication with the memory the signal W in the memory that decodes the signal W by the second computer generated steps of selecting a prime number p of the form p=4k+1 for an odd integer k such that the public key N₀ is a non-quadratic residue modulo p calculating; n₀ satisfying the inequalities pⁿ⁰⁻¹<N₀<pⁿ⁰; computing N=τN₀ with a selection of τ such that N is a quadratic residue modulo pⁿ⁰; calculating n satisfying the inequalities pⁿ⁻¹<N<pⁿ and calculating a solution toN≡A²(mod pⁿ)   (4)by using the representation

$\begin{array}{cc}A=\sum _{i=0}^n{\omega }_i{p}^i& \left(5\right)\end{array}$ where ω_i satisfies the condition0<ω_i<pⁿ⁻¹.  (6)the CPU decrypting the signal W with the public key N₀ and the prime factors of integer N₀; and

a display on which the decrypted signal W is displayed so the decrypted signal W can be reviewed to determine the relevance of the decrypted signal W. The display can be a computer screen or smart phone screen or any screen or piece of paper on which the decrypted signal W is printed or any medium on which the decrypted signal W can be reviewed.

The present invention pertains to a non-transitory readable storage medium which includes a computer program stored on the storage medium for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers and W is a function of r and s, where the signal W has been stored in a non-transient memory of a second computer, having the second computer generated steps of:

selecting a prime number p of the form p=4k+1 for an odd integer k such that the public key N₀ is a non-quadratic residue modulo p; calculating N₀ satisfying the inequalities pⁿ⁰⁻¹<N₀<pⁿ⁰; computing N=τN₀ with a selection of τ such that N is a quadratic residue modulo pⁿ⁰; calculating n satisfying the inequalities pⁿ⁻¹<N<pⁿ; and calculating a solution toN≡A²(mod pⁿ)   (7)by using the representation

$\begin{array}{cc}A=\sum _{i=0}^n{\omega }_i{p}^i& \left(8\right)\end{array}$ where ω_i satisfies the condition

There is the step of decrypting with the second computer the signal W with the public key N₀, and the prime factors of integer N₀. There is the step of displaying on a display by the second computer the decrypted signal W for predetermined words to determine the relevance of the decrypted signal W.

IV. BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a graphical representation of the integer ò−N.

FIG. 2 is a graphical representation of the integer ò·(Y−Ã).

FIG. 3 is a graphical representation of the integer (Y−Ã)².

FIG. 4 is a graphical representation of the integer X².

FIG. 5 is a block diagram regarding the claimed invention.

V. DESCRIPTION OF THE INVENTION: THE PROBLEM

Given a positive odd integer N₀, it is desired to determine a pair of integers r₀ and s₀ such thatN₀=r₀·s₀.  (10)

The problem can also be stated as the search for two integers Y₀ and X₀ such thatN₀=Y₀²−X₀².  (11)

The pairs (r₀, s₀) and (Y₀, X₀) are related as follows:

$\begin{array}{cc}\{\begin{array}{c}{Y}_0=\frac{r_0+s_0}{2}\\ X_0=\frac{r_0-s_0}{2}\end{array}.& \left(12\right)\end{array}$

Conversely,

$\begin{array}{cc}\{\begin{array}{c}{r}_0=Y_0+X_0\\ s_0=Y_0-X_0\end{array}.& \left(13\right)\end{array}$

If r₀>s₀>0, both Y₀ and X₀ are positive. In this case it is useful to consider some limit cases in order to develop an appreciation for the magnitude of the variables.

One of the limit cases occurs when the pair (r₀, s₀) is a pair of “twin primes”, such as (43, 41). In these cases,

$\begin{array}{cc}\{\begin{array}{c}{X}_0=1\\ Y_0=\sqrt{N_0+1}\end{array}.& \left(14\right)\end{array}$

At the other end is the case when r₀ approximates N₀. At the limit, consider a pair (r₀, s₀) equaling (N₀, 1). Then

$\begin{array}{cc}\{\begin{array}{c}{X}_0=\frac{N_0-1}{2}\\ Y_0=\frac{N_0+1}{2}\end{array}.& \left(15\right)\end{array}$ Therefore, in all cases

$\begin{array}{cc}\{\begin{array}{c}{X}_0^2<Y_0^2\\ 1\le X_0^2<{\left(\frac{N_0-1}{2}\right)}^2\\ N_0+1\le Y_0^2<{\left(\frac{N_0+1}{2}\right)}^2\end{array}.& \left(16\right)\end{array}$ Thus, in all cases, Y₀²>N₀. In some cases, X₀² is greater than N₀.

VI. A RESTATEMENT

Given N₀ and an odd prime p, the general solution of (10) has the following form:

$\begin{array}{cc}\{\begin{array}{c}{r}_0=\alpha +{\lambda }_0·p\\ s_0=\beta +{\mu }_0·p\end{array},& \left(17\right)\end{array}$ where α, β, λ₀ and μ₀ denote integers and where α·β≡N₀ (mod p). If α and β are both even or both odd, A0 and p0 have the same parity. Otherwise, define β′=β+p and μ′₀=μ₀−1. Thus, without loss of generality, it is possible to define two integers U₀ and V₀ as follows:

$\begin{array}{cc}\{\begin{array}{c}{U}_0=\frac{{\lambda }_0-{\mu }_0}{2}\\ V_0=\frac{{\lambda }_0+{\mu }_0}{2}\end{array}.& \left(18\right)\end{array}$ Then

$\begin{array}{cc}\{\begin{array}{c}{r}_0=\alpha +U_0·p+V_0·p\\ s_0=\beta -U_0·p+V_0·p\end{array}.& \left(19\right)\end{array}$

The integers V₀ and U₀ are usually referred to as the symmetric and antisymmetric to components of the pair (r₀, s₀), respectively. In general, in the search for (U₀, V₀), all values of α in the interval 1≤α<p may need to be tested.

The complexity of the problem is reduced in the cases when

$\begin{array}{cc}\{\begin{array}{c}\alpha \equiv \beta \left(\mathrm{mod}p\right)\\ \alpha ·\beta \equiv N_0\left(\mathrm{mod}{p}^2\right)\end{array}.& \left(20\right)\end{array}$

In such cases V₀≡0 (mod p).

In order to realize this situation, it is possible to restate the problem of factoring N₀ into the problem of factoring some integer N which satisfies (20). To this end, select a prime p such that N₀ is a non-quadratic residue modulo p. It will be pⁿ⁰⁻¹<N₀<pⁿ⁰, for some integer n₀. Select a candidate value of α, say {tilde over (α)}. Then define τ by the following:N₀≡τ·{tilde over (α)}² (mod p²).  (21)

Let {tilde over (τ)} denote the least positive residue of (21) modulo p². Then β≡{tilde over (τ)}·{tilde over (α)} (mod p). Since N₀ is a non-quadratic residue modulo p, so is {tilde over (τ)}. If {tilde over (τ)} is odd, define the integer N by the followingN={tilde over (τ)}·N₀  (22)where, for some integer n, pⁿ⁻¹<N<pⁿ. Then N is a quadratic residue modulo p andN≡{tilde over (τ)}²·{tilde over (α)}² (mod p²).  (23)If p=4·k+1, then {tilde over (τ)}≢±1 (mod p) for all {tilde over (α)} and {tilde over (τ)}²≢1 (mod p).

The integer {tilde over (τ)}²·{tilde over (α)}² can be partitioned into the product of {tilde over (τ)}·{tilde over (α)} by {tilde over (τ)}·α or −{tilde over (τ)}·{tilde over (α)} by −{tilde over (τ)}·{tilde over (α)}, yielding

$\begin{array}{cc}\{\begin{array}{c}r=\tilde{\tau }·\tilde{\alpha }+U·p+V·p^2\\ s=\tilde{\tau }·\tilde{\alpha }-U·p+V·p^2\end{array},& \left(24\right)\end{array}$ where

$\begin{array}{cc}\{\begin{array}{c}r=\tilde{\tau }·r_0\\ s=s_0\end{array}& \left(25\right)\end{array}$ and where U and V denote integers. Similar relationships hold if r≡s≡−{tilde over (τ)}·{tilde over (α)} (mod p).Notice that, if U>0, r>s.

In the case of (24), it will be

$\begin{array}{cc}\{\begin{array}{c}Y=\tilde{\tau }·\tilde{\alpha }+V·p^2\\ X=U·p\end{array}.& \left(26\right)\end{array}$

Also, since {tilde over (τ)} is odd,

$\begin{array}{cc}\{\begin{array}{c}Y=\frac{\tilde{\tau }·r_0+s_0}{2}\\ X=\frac{\tilde{\tau }·r_0-s_0}{2}\end{array}.& \left(27\right)\end{array}$

The factorization problem requires the identification of a pair (Ũ, {tilde over (V)}) such that, for the corresponding ({tilde over (r)}, {tilde over (s)}), is itN={tilde over (r)}·{tilde over (s)}.  (28)If, using the given {tilde over (α)}, the algorithm were successful in factoring N, then {tilde over (r)} would be divisible by {tilde over (τ)} and {tilde over (r)}/{tilde over (τ)}=r₀.NOTE 1: There is the possibility that {tilde over (τ)}·{tilde over (α)} be divisible by some integer t₁=1+h·p with 0<h<p. In this case, the product {tilde over (τ)}²·{tilde over (α)}² may be partitioned into the pair

$\left(\frac{\tilde{\tau }·\tilde{\alpha }}{t_1},t_1·\tilde{\tau }·\tilde{\alpha }\right),$ which satisfies the second of (20). This case will not be considered here because the pair (X, Y) would not be represented as in (26).It should be noted that the proposed restatement of the problem is motivated by the convenience of using search tools such as (24) and (26), which operate on lattices of rectangular cells of sides p and p².NOTE 2: In general, all the values of a should be tested. Since N₀ is a non-quadratic residue modulo p, it is sufficient to test the values of a which are non-quadratic residues modulo p.

NOTE 3: In order to avoid singular cases, it is convenient to select p in such a way that, for all non-quadratic residues modulo p, it isα²≢1(mod p²).  (29)Such is the case when 2 is a primitive root modulo p.The prime p was selected of the form 4·k+1. Also, it has been shown that the integer 2 is a primitive of the primes of the form 8·h±3 [3, p.79]. Therefore, 2 is a primitive of the primes defined by8·h±3=4·k+1  (30)orp=4·ODD+1.  (31)

NOTE 4: In general, in (24) the product {tilde over (τ)}·{tilde over (α)} can be replaced by any integer A such that A≡{tilde over (τ)}·{tilde over (α)} (mod p²) and N={tilde over (τ)}·N₀≡A² (mod p²). In particular, such is the case whenN≡{tilde over (τ)}²·{tilde over (α)}²(mod p²)≡ò(mod p²).  (32)Consider the expression of Y when à is used in lieu of {tilde over (τ)}·{tilde over (α)}:Y={tilde over (τ)}·{tilde over (α)}+V·p² =Ã+V₁·p²  (33)for some integer V₁.Recall that, by (16),√{square root over (N)}<Y<N.  (34)There are two significant particular cases: If Ã<√{square root over (N)}, then V₁>0. Also, if Ã>N, then V₁<0. Throughout this presentation, à will be greater than N. For simplicity of notation, the integer V will be constrained to be positive. Then (24) takes the following form:

$\begin{array}{cc}\{\begin{array}{c}\tilde{A}>N\\ r=\tilde{A}+U·p-V·p^2\\ s=\tilde{A}-U·p-V·p^2\end{array}.& \left(35\right)\end{array}$ NOTE 5: A particular definition of N can be produced when τ is computed modulo pⁿ⁰. In this case, define the integer to T₀ by the following:N₀≡T₀·α²(mod pⁿ⁰).  (36)Let {tilde over (T)}₀ denote the least positive residue of T₀ modulo pⁿ⁰. It will be{tilde over (T)}₀≡N₀·α⁻² (mod pⁿ⁰)≡{tilde over (τ)}(mod p²).  (37)If {tilde over (T)}₀ is odd let

$\begin{array}{cc}\{\begin{array}{c}{N}_{T_0}={\tilde{T}}_0·N_0\\ p^{n_{T_0}-1}<N_{T_0}<p^{n_{T_0}}\\ r={\tilde{T}}_0·r_0\\ s=s_0\end{array}.& \left(38\right)\end{array}$ In this case, the magnitude of N_T0 is of the order of N₀².NOTE 6: Consider the case where, after the selection of p and {tilde over (α)}, the integer U is selected or computed to be U≡ũ_{1, 1}(mod p). In this case it would be possible to define an integer {tilde over (τ)}₂ as the least positive solution of the following:N₀≡τ₂·({tilde over (α)}+ũ_{1, 1}·p)²(mod p⁴).  (39)Then N could be defined as follows:N={tilde over (τ)}₂·N₀ =({tilde over (τ)}₂·r₀)·s₀  (40)and (24) could be replaced by the following:

$\begin{array}{cc}\{\begin{array}{c}r={\tilde{\tau }}_2·\left(\tilde{\alpha }+{\tilde{u}}_{1,1}·p\right)+U_2·p^2+V_4·p^4\\ s_0={\tilde{\tau }}_2·\left(\tilde{\alpha }+{\tilde{u}}_{1,1}·p\right)-U_2·p^2+V_4·p^4\end{array},& \left(41\right)\end{array}$ for some integers U₂ and V₄.NOTE 7: There is the possibility that the solution {tilde over (τ)} of (21) be even. In this case, letτ=p²−{tilde over (τ)}>0.  (42)Then τ is odd. Thus, −τ may be used in lieu of {tilde over (τ)} in (22) and in (24).As an example, let N₀=73·71=5,183. If p=29, 73=15+2·p and 71=13+2·p.For {tilde over (α)}=15, τ is defined by N₀≡τ·15² (mod p²). The least positive solution is {tilde over (τ)}=722. It will be τ=p²−τ=119. Then −N₀≡(p²−{tilde over (τ)})·15² (mod p²) and −N₀·(p²−{tilde over (τ)})≡(p²−{tilde over (τ)})²·15² (mod p²). Therefore, in this case, defineN=−(p²−{tilde over (τ)})·N₀.  (43)Then (24) takes the following form

$\begin{array}{cc}\{\begin{array}{c}r=\left(p^2-\tilde{\tau }\right)·\tilde{\alpha }+U·p+V·p^2\\ s=\left(p^2-\tilde{\tau }\right)·\tilde{\alpha }-U·p+V·p^2\end{array}& \left(44\right)\end{array}$ where

$\begin{array}{cc}\{\begin{array}{c}r=\left(p^2-\tilde{\tau }\right)·r_0\\ s=-s_0\end{array}.& \left(45\right)\end{array}$

Consider an algorithm which determines the pair (r, s) by successive approximations. In particular, consider the case when a candidate solution of s is determined sequentially modulo p, p², . . . , p^k. In such a case, it is convenient to verify, at each step, whether a proposed candidate solution yields a divisor of N₀. Let ŝ denote the least positive residue of s modulo p^k. Then let ŝ₀=p^k−ŝ and verify whether gcd (ŝ₀, N₀)≠1.

In this presentation, without loss of generality, it will be assumed that {tilde over (τ)} is a positive odd integer.

VII. A NOTE ON THE REPRESENTATION OF N

Given pⁿ⁻¹<N<pⁿ, where N is a quadratic residue modulo p, let

$\begin{array}{cc}N=\sum _{i=0}^{n-1}{v}_i·p^i,& \left(46\right)\end{array}$ where {v_i} denote integers, and 0≤v_i≤p.

It is desired to compute a solution of the following:N≡A²(mod pⁿ)  (47)where

$\begin{array}{cc}A\equiv \sum _{i=0}^{n-1}{a}_i·p^i\left(\mathrm{mod}{p}^n\right),& \left(48\right)\end{array}$ and where0≤α_i<p.  (49)

Subject to (49), the solution of (47) is provided by the following:

$\begin{array}{cc}\{\begin{array}{cc}{v}_0\equiv a_0^2& \left(\mathrm{mod}p\right)\\ v_1\equiv 2·a_0·a_1+\frac{a_0^2-v_0}{p}& \left(\mathrm{mod}p\right)\\ v_2\equiv 2·a_0·a_2+a_1^2+\frac{{\mathrm{RH}}_1-{\mathrm{LH}}_1}{p}& \left(\mathrm{mod}p\right)\\ \dots & \\ v_i\equiv \sum _{k=0}^t{a}_k·a_{i-k}+\frac{{\mathrm{RH}}_{i-1}-{\mathrm{LH}}_{t-1}}{p}& \left(\mathrm{mod}p\right)\\ \dots & \\ v_{n-1}\equiv \sum _{k=0}^{n-1}{a}_k·a_{n-k}+\frac{{\mathrm{RH}}_{n-2}-{\mathrm{LH}}_{n-2}}{p}& \left(\mathrm{mod}p\right)\end{array},& \left(50\right)\end{array}$ where RH_i and LH_i denote the RHS and LHS, respectively, of the congruence containing v_i.

The terms (RH_i−LH_i)/p are usually referred to as carries. They are caused by the constraint (49) and flow from the less significant digits to the more significant ones.

As an example, consider the problem of solvingN≡A² (mod p⁵),  (51)where N is a quadratic residue modulo p. Assume p=13 and

$\begin{array}{cc}\begin{array}{c}N=\sum _{t=0}^4{v}_i·p^i\\ =10+2·p+10·p^2+5·p^3+0·p^4\\ =12\text{,}711\end{array}.& \left(52\right)\end{array}$ If 0≤α_i<p, a solution of (51), say Ã, can be represented as follows:Ã=6+0·p+3·p²+10·p³+5·p⁴.  (53)A second solution of (51) occurs when {tilde over (α)}₀=6 is replaced by α₀=p−{tilde over (α)}₀=7. In this caseĀ=7+12·p+9·p²+2·p³+7·p⁴.  (54)

Consider removing the magnitude constraints (49) from all α_i and representing A asA≡ω₀+ω₁·p+ω₂·p²+ω₃·p³ω₄·p⁴ (mod p⁵),  (55)where the coefficients of any power of p are positive integers and are constrained by the following conditions:0<ω_i<pⁿ⁻ⁱ.  (56)Then the congruence (51) can be satisfied if the sum of the coefficients of any power of p, say pⁱ, is congruent to zero modulo p⁵⁻ⁱ. Specifically, in the example , it must be

$\begin{array}{cc}\{\begin{array}{c}{v}_0\equiv {\omega }_0^2\left(\mathrm{mod}{p}^5\right)\\ v_1·p\equiv 2·{\omega }_0·{\omega }_1·p\left(\mathrm{mod}{p}^5\right)\\ v_2·p^2\equiv {\omega }_1^2·p^2+2·{\omega }_0·{\omega }_2·p^2\left(\mathrm{mod}{p}^5\right)\\ v_3·p^3\equiv 2·{\omega }_1·{\omega }_2·p^3+2·{\omega }_0·{\omega }_3·p^3\left(\mathrm{mod}{p}^5\right)\\ v_4·p^4\equiv {\omega }_2^2·p^4+2·{\omega }_1·{\omega }_3·p^4+2·{\omega }_0·{\omega }_4\left(\mathrm{mod}{p}^5\right)\end{array}.& \left(57\right)\end{array}$

In the example, consider the condition10≡ω₀² (mod p⁵).  (58)For ω₀≡6 (mod p), the least positive solution, say {tilde over (ω)}₀, is {tilde over (ω)}₀=181,200. For ω₀≡p−6≡7 (mod p), it is ω₀=190,043.To satisfy the second of (57) when {tilde over (ω)}₀=181,200, it must be2·p≡2·{tilde over (ω)}₀·ω₁·p (mod p⁵).The least positive solution, say {tilde over (ω)}₁, is {tilde over (ω)}₁=18,120.Thereafter, from the third of (57), let10·p²≡({tilde over (ω)}₁²+2·{tilde over (ω)}₀·ω₂)·p² (mod p⁵),whence {tilde over (ω)}₂=1,814.Likewise, from the fourth of (57), let5·p³≡2·{tilde over (ω)}₁·{tilde over (ω)}₂·p³+2·{tilde over (ω)}₀·ω₃·p³ (mod p⁵),whence {tilde over (ω)}₃=97.Finally, from the fifth of (57), let0·p⁴≡ω₂²·p⁴+2·ω₁·ω₃·p⁴+2·ω₀·ω₄·p⁴ (mod p⁵),whence {tilde over (ω)}₄=12. ThenN≡(181,200+18,120·p+1,814·p²+97·p³+12·p⁴)² (mod p⁵).  (59)Proceeding in a similar fashion with ω₀=190,093, it isN≡(190,093+10,441·p+383·p²+72·p³+1·p⁴)² (mod p⁵).  (60)

Comparison of the resulting {tilde over (ω)}_i with the corresponding ω_i yields

$\begin{array}{cc}\{\begin{array}{c}{\tilde{\omega }}_i+{\stackrel{\_}{\omega }}_i=p^{5-i}\\ 0<{\tilde{\omega }}_i<p^{6-i}\end{array}& \left(61\right)\end{array}$ or({tilde over (ω)}_i+ω_i)·pⁱ=p⁵.  (62)Thus, in the example,181,200+190,093=p⁵ 18,120+10,441=p⁴ 1,814+383=p³ 97+72=p² 12+1=p  (63)andÃ+Ā=5·p⁵.  (64)Notice that, when à and Ā are subject to the constraint (49), as in (53) and (54), their sum equals p⁵.

Comparing the representations of à by (59) and (53), it can be stated that the representation proposed by (59) entails an equipartition of weight among the 5 degrees of freedom of (55).

NOTE 1: In the example, each coefficient {tilde over (ω)}_i of à is computed modulo p⁵⁻ⁱ. If the magnitude constraint (49) were to be applied to the coefficients on the RHS of (59) and (60), the coefficients ω_i would be reduced modulo p and the structure (57) would be demolished.In practice, the integer N, as represented on the RHS of (59) and (60), should be treated as a polynomial in some integer variable u, say P(u), where P(u) happens to be computed at u=p.NOTE 2: In (55) the representation of the coefficients to, is arbitrary. In (59) and (60) such coefficients are represented in base 10. They may be represented in any other base, such as p.NOTE 3: It should be noted that in (51) p⁴<N<p⁵ and in (55) A is being defined modulo p⁵. In general, such may not be the case. It is possible that A be defined modulo a larger power of p, depending on the requirements of the problem on hand. A similar situation occurs in the domain of irrational numbers, such as √{square root over (2)}. √{square root over (2)} may be computed with a large number of decimal digits, depending on the precision required by the problem on hand. No harm is done if the precision of the computed value of √{square root over (2)} is greater than needed.As an example, consider the case when p=13 and N₁<p². Assume that N₁=ν₀+ν₁·p=10+2·p. It is desired to solveN₁≡A² (mod p⁵).  (65)In this case the integers ω_i are defined by the following:

$\begin{array}{cc}\{\begin{array}{c}{v}_0\equiv {\omega }_0^2\left(\mathrm{mod}{p}^5\right)\\ v_1·p\equiv 2·{\omega }_0·{\omega }_1·p\left(\mathrm{mod}{p}^5\right)\\ 0\equiv {\omega }_1^2·p^2+2·{\omega }_0·{\omega }_2·p^2\left(\mathrm{mod}{p}^5\right)\\ 0\equiv 2·{\omega }_1·{\omega }_2·p^3+2·{\omega }_0·{\omega }_3·p^3\left(\mathrm{mod}{p}^5\right)\\ 0\equiv 2·{\omega }_1·{\omega }_3·p^4+2·{\omega }_0·{\omega }_4·p^4+{\omega }_2^2·p^4\left(\mathrm{mod}{p}^5\right)\end{array}.& \left(66\right)\end{array}$ For ω₀≡6 (mod p), the result isN₁10+2·p≡(181,200+18,120·p+1,291·p²+23·p³+2·p⁴)² (mod p⁵).  (67)Compare with (59).NOTE 4: As a further application of this method of representation of integers, consider the problem of computing Ã⁻¹ (mod p⁵) when à is defined as in (55). LetÃ⁻¹≡w₀+w₁·p+w₂·p²+w₃·p³+w₄·p⁴(mod p)  (68)and÷Ã⁻¹≡1(mod p⁵).  (69)The coefficients w_i should be defined as the least positive solutions of the following:

$\begin{array}{cc}\{\begin{array}{c}{\tilde{\omega }}_0·w_0\equiv 1\left(\mathrm{mod}{p}^5\right)\\ {\tilde{\omega }}_0·w_1+{\tilde{\omega }}_1·{\tilde{w}}_0\equiv 0\left(\mathrm{mod}{p}^4\right)\\ {\tilde{\omega }}_0·w_2+{\tilde{\omega }}_1·{\tilde{w}}_1+{\tilde{\omega }}_2·{\tilde{w}}_0\equiv 0\left(\mathrm{mod}{p}^3\right)\\ {\tilde{\omega }}_0·w_3+{\tilde{\omega }}_1·{\tilde{w}}_2+{\tilde{\omega }}_2·{\tilde{w}}_1+{\tilde{\omega }}_3·{\tilde{w}}_0\equiv 0\left(\mathrm{mod}{p}^2\right)\\ {\tilde{\omega }}_0·w_4+{\tilde{\omega }}_1·{\tilde{w}}_3+{\tilde{\omega }}_2·{\tilde{w}}_2+{\tilde{\omega }}_3·{\tilde{w}}_1+{\tilde{\omega }}_4·{\tilde{w}}_0\equiv 0\left(\mathrm{mod}p\right)\end{array}.& \left(70\right)\end{array}$ In the example, Ã⁻¹≡18,120+26,749·p+1,590·p²+73·p³+9·p⁴ (mod p⁵).The product ÷Ã⁻¹ also contains the following terms:

$\begin{array}{cc}\{\begin{array}{c}\left({\omega }_1·w_4+{\omega }_2·w_3+{\omega }_3·w_2+{\omega }_4·w_1\right)·p^5=347\text{,}391·p^5\\ \left({\tilde{\omega }}_2·{\tilde{w}}_4+{\tilde{\omega }}_3·{\tilde{w}}_3+{\tilde{\omega }}_4·{\tilde{w}}_2\right)·p^6=15\text{,}478·p^6\\ \left({\tilde{\omega }}_3·{\tilde{w}}_4+{\tilde{\omega }}_4·{\tilde{w}}_3\right)·p^7=353·p^7\\ {\tilde{\omega }}_4·{\tilde{w}}_4·p^8=18·p^8\end{array}.& \left(71\right)\end{array}$

VIII. THE ROADMAP.

1) Introduction. Definition of M.

Given p and N, select à as one of the solutions of (47) modulo pⁿ, computed using the procedure described in Section VII. Assume Ã>pⁿ (64).

Then, using (35), letN≡ò−U²·p²−2·Ã·V·p²+V²·p⁴,  (72)where

$\begin{array}{cc}\{\begin{array}{c}\tilde{A}=\sum _{i=0}^{n-1}{\tilde{\omega }}_i·p^i\\ U=\sum _{i=1}^{n-1}{u}_i·p^{i-1}\\ V=\sum _{i=2}^{n-1}{\upsilon }_i·p^{i-2}\end{array}.& \left(73\right)\end{array}$

Referring to (59), recall that each ω_i can be represented as

$\begin{array}{cc}{\omega }_i=\sum _{k=0}^{n-1-i}{\omega }_{i,k}·p^k.& \left(74\right)\end{array}$ Also,

$\begin{array}{cc}\{\begin{array}{c}{u}_i=\sum _{k=1}^{n-1-i}{u}_{i,k}·p^{k-1}\\ {\upsilon }_i=\sum _{k=1}^{n-1-i}{\upsilon }_{i,k}·p^{k-2}\end{array}& \left(75\right)\end{array}$ and

$\begin{array}{cc}\{\begin{array}{c}{U}_{i,j}=\sum _{k=1}^j{u}_{i,k}·p^{k-1}\\ V_{i,j}=\sum _{k=1}^j{\upsilon }_{i,k}·p^{k-2}\end{array}.& \left(76\right)\end{array}$ Then

$\begin{array}{cc}\{\begin{array}{c}r\equiv \tilde{A}+u_1·p+\left(-{\upsilon }_2+u_2\right)·p^2+\left(-{\upsilon }_3+u_3\right)·p^3+\dots +\\ \left(-{\upsilon }_{n-1}+u_{n-1}\right)·p^{n-1}\left(\mathrm{mod}{p}^n\right)\\ s\equiv \tilde{A}-u_1·p+\left(-{\upsilon }_2-u_2\right)·p^2+\left(-{\upsilon }_3-u_3\right)·p^3+\dots +\\ \left(-{\upsilon }_{n-1}-u_{n-1}\right)·p^{n-1}\left(\mathrm{mod}{p}^n\right)\end{array}.& \left(77\right)\end{array}$

The representation (77) of r and s accounts for the fact that both r and s are smaller than pⁿ. However, using (77), the product of r by s contains powers of p greater than pⁿ, actually as high as p^2·n−2.

In order to uncover the properties which relate the coefficients of (77), it is necessary to compute, and represent without loss of information, the multiples of any pⁱ which results from the multiplication of r by s. To this end a new modulus is introduced, namely p^M, where

$\begin{array}{cc}M=\left(2·n-2\right)+1.& \left(78\right)\end{array}$ It should be noticed that:1) M is always odd.2) If n=2·{tilde over (k)}+1, then M=4·{tilde over (k)}+1.3) The use of M does not affect the magnitude of N. If N<pⁿ, it can be represented as follows:

$\begin{array}{cc}\{\begin{array}{c}N=\sum _{i=0}^{n-1}{v}_i·p^i\\ v_i=0\mathrm{for}n-1<i\le M-1\end{array}.& \left(79\right)\end{array}$ 4) When M is employed in lieu of n, Ã should be computed as a solution of the following:N≡A² (mod p^M).  (80)5) s=s₀ and r>s₀.6) A comparable result is achieved when {tilde over (T)}₀ is employed in lieu of {tilde over (τ)}.2) The Approach

In the case where (79) is employed, reduction of (77) modulo p³ yields

$\begin{array}{cc}\frac{N-{\tilde{A}}^2}{p^M}·p^M\equiv \left(-u_1^2-2·\tilde{A}·{\upsilon }_2\right)·p^2\left(\mathrm{mod}{p}^3\right).& \left(81\right)\end{array}$

Then, if the pair (ũ₁, {tilde over (ν)}₂) is a solution of (81) modulo p, it is

$\begin{array}{cc}\frac{N-{\tilde{A}}^2}{p^M}·p^M+\left(\frac{{\tilde{u}}_1^2+2·\tilde{A}·{\tilde{\upsilon }}_2}{p}·p\right)·p^2\equiv \left(-2·{\tilde{u}}_1·u_2-2·\tilde{A}·{\upsilon }_3\right)·p^3\left(\mathrm{mod}{p}^4\right).& \left(82\right)\end{array}$

The LHS of this congruence contains a contribution to the set of multiples of p³. This contribution is usually denoted as a “carry”. The flow of carries from one digit to the higher powers of p increases the complexity of the factorization problem. The flow of carries would be controlled better if (81) were solved modulo p^M and the pair (u₁², ν₂) were defined modulo p^M−2. In this case (82) could take the following form:

$\begin{array}{cc}\frac{N-{\tilde{A}}^2}{p^M}·p^M+\left(\frac{{\tilde{u}}_1^2+2·\tilde{A}·{\tilde{\upsilon }}_2}{p^{M-2}}·p^{M-2}\right)·p^2\equiv \left(-2·{\tilde{u}}_1·u_2-2·\tilde{A}·{\upsilon }_3\right)·p^3\left(\mathrm{mod}{p}^4\right).& \left(83\right)\end{array}$

This approach would require replacing the magnitude constraints (49) from the elements of {u_i} and {ν_i} and assuring that the RHS of congruences such as (83) include all the terms which are multiples of any given pⁱ. Following this procedure, still there would be carries, as shown on the LHS of (83). However, such carries would flow from any given congruence directly into a pool of multiples of p^M.

The plan of this presentation consists of analyzing each of the terms of (72) with the appropriate definition of à and resolving them into the sum of powers of p. Then, for any given power of p, say pⁱ, add all the coefficients of pⁱ which are produced by ò−N, −2·Ã·(Ã−Y), (Ã−Y)² and −X² and place the condition that their sum be congruent to zero modulo p^M−i.

3) The Integer ò−N

Let à be defined as in (73), where the integers {tilde over (ω)}_i are determined using the procedure illustrated in Section VII. Thus, for i<M,

$\begin{array}{cc}\{\begin{array}{c}{v}_0\equiv {\omega }_0^2\left(\mathrm{mod}{p}^M\right)\\ v_1\equiv 2·{\tilde{\omega }}_0·{\omega }_1\left(\mathrm{mod}{p}^{M-1}\right)\\ v_2\equiv {\tilde{\omega }}_1^2+2·{\tilde{\omega }}_0·{\omega }_2\left(\mathrm{mod}{p}^{M-2}\right)\\ \dots \\ v_{M-1}\equiv \sum _{k=1}^{M-2}{\tilde{\omega }}_k·{\tilde{\omega }}_{M-1-k}+2·{\tilde{\omega }}_0·{\omega }_{M-1}\left(\mathrm{mod}p\right)\end{array},& \left(84\right)\end{array}$ where

$\begin{array}{cc}\{\begin{array}{c}{\omega }_0\equiv \pm \tilde{\tau }·\tilde{\alpha }\left(\mathrm{mod}p\right)\\ {\omega }_0+{\omega }_1·p\equiv \pm \tilde{\tau }·\tilde{\alpha }\left(\mathrm{mod}{p}^2\right)\end{array}.& \left(85\right)\end{array}$ In fact, N≡{tilde over (τ)}²·{tilde over (α)}² (mod p²) and also N≡(ω₀+ω₁·p)² (mod p²).

Consider then the integer ò−N. As an illustration, refer to FIG. 1. The headings of the rows and columns represent the coefficients {tilde over (ω)}_i of Ã. Multiplication of à by à generates the products {tilde over (ω)}_i·{tilde over (ω)}_j which are represented by the cells of FIG. 1. Cells on any given line of slope 1 contribute to the coefficient of the same power of p.

Let LH_i and RH_i denote the LHS and the RHS, respectively, of the congruence containing ν_i. For i<M each (LH_i−RH_i), multiplied by the corresponding pⁱ, contributes to the resulting polynomial a known multiple of p^M. In fact,

$\begin{array}{cc}\left(\frac{{\mathrm{LH}}_i-{\mathrm{RH}}_i}{p^{M-i}}·p^{M-i}\right)·p^i\equiv 0\left(\mathrm{mod}{p}^M\right).& \left(86\right)\end{array}$

For i>M, ò contains terms of degree greater than p^M. The highest power of p in ò−N is p^2·M−2. In fact, the highest power of p in à is p^M−1. After squaring, the highest power in this representation of ò is p^2·M−2.

Therefore, for i−M+j, and j≥0, ò−N contains multiples of p^M+j, say p^M+j. Q_j, where

$\begin{array}{cc}{Q}_j=\sum _{k=1}^{M-j-1}{\tilde{\omega }}_{M-k}·{\tilde{\omega }}_{k+j}.& \left(87\right)\end{array}$

The total contribution, for all j≥0, is

$\begin{array}{cc}{p}^M·Q\equiv p^M·\sum _{i=0}^{M-2}{p}^j·Q_j.& \left(88\right)\end{array}$

As a conclusion:

1) For i<M, by (84),(ν_i−RH_i)·pⁱ≡0 (mod p^m).  (89)

2) For i=M each of the terms on the corresponding line of slope 1 is a coefficient of p^M.

3) For i>M each of the terms on the corresponding line of slope 1 is a coefficient of p^M·p^j, where 0<j=i−M. Refer to FIG. 1.

In particular, in the example (59), it is

$\begin{array}{cc}\{\begin{array}{c}\left(2·{\omega }_1·{\omega }_4+2·{\omega }_2·{\omega }_3\right)·p^5=786796·p^5\\ \left(2·{\omega }_2·{\omega }_4+{\omega }_3^2\right)·p^6=52945·p^6\\ \left(2·{\omega }_3·{\omega }_4\right)·p^7=2328·p^7\\ {\omega }_4^2·p^8=144·p^8\end{array}.& \left(90\right)\end{array}$ 4) The Relationship Between ν_i and u_i−1 when u₁≢0 (mod p)

Consider the representation of the pair (r, s) as in (77), where à is constructed as described in Section VII, and M is used in lieu of n. Thus, when r is multiplied by s, it is possible to group all the terms which contain any multiple of any given power of p, say pⁱ, and place the condition that the sum of their coefficients be congruent to zero modulo p^M−i.

However, by (84), resolving the integer ò−N into its components, the sum of the coefficients of pⁱ in (ò−N) equals

$\begin{array}{cc}\begin{array}{c}\sum _{k=0}^i{\tilde{\omega }}_k·{\tilde{\omega }}_{i-k}-v_i\equiv 0\left(\mathrm{mod}{p}^{M-i}\right)\\ ={\tilde{\eta }}_i·p^{M-i}\end{array}.& \left(91\right)\end{array}$ (η_i an integer).

As a result, consider the case when it is desired to express ν₆ as a function of all the u_l's 1≤l≤5′, and the ν_j's (2≤j≤5). It will be−(2·{tilde over (ω)}₀·ν₆+2·{tilde over (ω)}₁·ν₅+2·{tilde over (ω)}₂·ν₄+2·{tilde over (ω)}₃·ν₃+2·{tilde over (ω)}₄·ν₂)+2·ν₂·ν₄+ν₃²≡2·u₁·u₅+2·u₂·u₄+u₃² (mod p^M−6).  (92)

This congruence defines ν₆ modulo p^M−6 as a function of lesser degree variables. If u₁≢0 (mod p) and if all the variables of lesser degree are known, (92) defines a linear congruence between ν₆ and u₅ modulo p^M−6. After the determination of ν₆, upon multiplication by p⁶, it will be

$\begin{array}{cc}\left(\frac{{\mathrm{LH}}_6-{\mathrm{RH}}_6}{p^{M-6}}·p^{M-6}\right)·p^6\equiv 0\left(\mathrm{mod}{p}^M\right)& \left(93\right)\end{array}$ where LH₆ and RH₆ denote the LHS and RHS of (92), respectively. The LHS of this latter congruence is a multiple of p^M and does not contain any power of p greater than p^M.

In general, for 2≤i≤M−1,

$\begin{array}{cc}\{\begin{array}{c}{u}_1\not\equiv 0\left(\mathrm{mod}p\right)\\ 2\le i\le M-1\\ -2·\sum _{k=2}^i{\tilde{\omega }}_{t-k}·{\upsilon }_k+\sum _{k=2}^{i-2}{\upsilon }_k·{\upsilon }_{i-k}\equiv \sum _{k=1}^{i-1}{u}_k·u_{i-k}\left(\mathrm{mod}{p}^{M-i}\right)\end{array}.& \left(94\right)\end{array}$ The first summation on the LHS of (94) contains terms which result from the multiplication of −2·Ã by (Ã−Y), when à is represented as described in Section VII. The second summation on the LHS results from (Ã−Y)².5) The Product 2·Ã·(Ã−Y)

FIG. 2 illustrates the product ÷(Ã−Y). The columns are headed by the coefficients ν_i of pⁱ in Y. The rows are headed by the coefficients {tilde over (ω)}_j of p^j in Ã.

Some of the cells represent products {tilde over (ω)}_j·ν_i which have been included in (94). Refer to (92) as an example. As a further example, the cells on the line of slope 1 which contains {tilde over (ω)}₀·ν_M−1 and {tilde over (ω)}_M−3·ν₂ represent coefficients of p^M−1 which are employed to write (94) modulo p.

The cells on the line of slope 1 which contains {tilde over (ω)}_M−1·ν₂ represent coefficients of p^M+1 and are not included in (94).

The highest power of p contained in 2·Ã·(Ã−Y) is p^2·M−2, obtained through the product of {tilde over (ω)}_M−1·p^M−1by ν_M−1·p^M−1.

6) The Integer (Ã−Y)²

FIG. 3 illustrates (Ã−Y)². Rows and columns are headed by the coefficients ν_i of pⁱ in Y. Some of the cells represent products of ν_i·ν_j which have been included in (94). Refer to (92) as an example.

Since the largest power of p in Y is p^M−1, (94) must also be written for i=M−1. Then the LHS of (94) must include cells representing the products ν₂·ν_M−3, ν₃·ν_M−4, etc. Cells representing coefficients of higher powers of p are not absorbed into (94) and contribute to Σ₀, when Σ₀ denotes the sum of all the products ν_i·ν_j·pⁱ·p^j which have not been absorbed as terms of any of the congruences (94). It will be

$\begin{array}{cc}\underset{0}{\Sigma }=p^M·\left({\upsilon }_2·{\upsilon }_{M-2}+{\upsilon }_3·{\upsilon }_{M-3}+\dots +{\upsilon }_{\frac{M-1}{2}}·{\upsilon }_{\frac{M+1}{2}}\right)+p^{M+1}·\left({\upsilon }_2·{\upsilon }_{M-1}+{\upsilon }_3·{\upsilon }_{M-2}+\dots +{\upsilon }_{M-1}·{\upsilon }_2\right)+p^{M+2}·\left({\upsilon }_3·{\upsilon }_{M-1}+{\upsilon }_4·{\upsilon }_{M-2}+\dots +{\upsilon }_{M-1}·{\upsilon }_3\right)\dots +p^2·p^{M-6}·\left({\upsilon }_{M-1}·{\upsilon }_{M-5}+{\upsilon }_{M-2}·{\upsilon }_{M-4}+\dots +{\upsilon }_{M-1}·{\upsilon }_{M-5}\right)+p^2·p^{M-5}·\left({\upsilon }_{M-1}·{\upsilon }_{M-4}+{\upsilon }_{M-2}·{\upsilon }_{M-3}+\dots +{\upsilon }_{M-4}·{\upsilon }_{M-1}\right)\dots +p^{2·M-2}·{\upsilon }_{M-1}^2.& \left(95\right)\end{array}$ 7) The Integer X²

FIG. 4 illustrates X². Rows and columns are headed by the coefficients u_i of pⁱ in X. Some of the cells represent products uⁱ·u^j which have been included in (94). Refer to (92) as an example.

Since the largest power of p in X is p^M−1, (94) must also be written for i=M−1. Then the RHS of (94) must include cells representing the products u₂·u_M−3, u₃·u_M−4, etc. The cells on the line of slope one which contains u₁·u_M−1 represents multiples of p^M. The cells on the line of slope one which contains u₂·u_M−1 represents multiples of p^M+1. In general, let Ξ₀ denote the sum of the products u_i·u_j·pⁱ·p^j which have not be absorbed as terms of any of the (94). It will be

$\begin{array}{cc}{\Xi }_0=p^M·\left(u_1·u_{M-1}+u_2·u_{M-2}+\dots +u_{\frac{M-1}{2}}·u_{\frac{M+1}{2}}\right)+p^{M+1}·\left(u_2·u_{M-1}+u_3·u_{M-2}+\dots +u_{M-1}·u_2\right)+p^{M+2}·\left(u_3·u_{M-1}+u_4·u_{M-2}+\dots +u_{M-1}·u_3\right)\dots +p^{2·M-3}·2·u_{M-2}·u_{M-1}+p^{2·M-2}·u_{M-1}^2.& \left(96\right)\end{array}$

Consider the case when u_M−1=0 and u_M−2≠0. In this case u₂·u_M−1=0. Then the line of slope one containing multiples of p^M+1 does not contain any cell which has a coefficient of p^M+1 dependent on u₂. Refer to FIG. 4. If u_M−2≠0, the sum of the coefficients of p^M+1 includes a term dependent on u₃.

IX. THE RELATIONSHIP BETWEEN ν_i AND u_i of WHEN u_M−1≠0

1) The Approach

Consider the general expression of (r, s) (77). Multiply r by s modulo p^M. Using (94), it will be

$\begin{array}{cc}\left(\frac{{\mathrm{LH}}_i-{\mathrm{RH}}_i}{p^{M-i}}·p^{M-i}\right)·p^i\equiv 0\left(\mathrm{mod}{p}^M\right),& \left(97\right)\end{array}$ where the LH_i and RH_i denote the LHS and RHS of (94), respectively.Therefore,

$\begin{array}{cc}0=\frac{{\tilde{A}}^2-N}{p^M}·p^M+\mathrm{multiples}\mathrm{of}{p}^M\mathrm{produced}\mathrm{by}\left(97\right)-\mathrm{multiples}\mathrm{of}{p}^M\mathrm{produced}\mathrm{by}2·\tilde{A}·\left(\tilde{A}-Y\right)+\underset{0}{\Sigma }-{\Xi }_0.& \left(98\right)\end{array}$

Recall that, when using (94), for i≤M−1, the multiples of p^M produced by (97) do not contain any power of p greater than p^M. Thus, their presence on the RHS of (98) does not interfere with the process of analyzing the coefficients of higher powers of p.

A relationship between ν_i and u_i can be produced by placing the condition that the carriers flow from any power of p greater than p^M, say p^M+j(j≥1), to higher powers of p, say p^M+j+1. This condition implies that the sum of the coefficients of any power of p greater than p^M equal zero modulo p^j and no carry flows into p^2·(M−1)+1.

Starting from the highest power of p, observe that in (95) the highest power of p is p^2·M−2. In fact, Y<p^M and the highest power of p in Y is p^M−1. After squaring, the highest power is p^2·M−2. A similar situation occurs for ò−N, whereQ_M−2={tilde over (ω)}_M−1².  (99)Concerning the product −2·Ã·ν_M−1, the highest power of p it contains is p^2·M−2, with a coefficient of −2·{tilde over (ω)}_M−1·ν_M−1. Then0=p^M·(Q_M−2·p^M−2)−2·{tilde over (ω)}_M−1·ν_M−1·p^2·M−2+(ν_M−1·p^M−1)²−(u_M−1·p^M−1)².  (100)As a result,({tilde over (ω)}_M−1−ν_M−1)²=u_M−1²,  (101)or({tilde over (ω)}_M−1−ν_M−1−u_M−1)·({tilde over (ω)}_M−1−ν_M−1+u_M−1)=0.  (102)2) The Case when {tilde over (ω)}_M−1−ν_M−1=u_M−1

Consider (98) in the case when u_M−1>0 and {tilde over (ω)}_M−1−ν_M−1=u_M−1. The second highest power of p in Σ₀ is p^2·M−3. The same is true in ò−N. In −2·Ã·(Ã−Y) the coefficient of p^2·M−3 is −2·{tilde over (ω)}_M−2·ν_M−1·u_M−1−2·{tilde over (ω)}_M−1·ν_M−2. Therefore,0=2·{tilde over (ω)}_M−1·{tilde over (ω)}_M−2−2·{tilde over (ω)}_M−1·ν_M−2−2·{tilde over (ω)}_M−2·ν_M−1+2·ν_M−1·ν_M−2−2·u_M−1·u_M−2  (103)or2·({tilde over (ω)}_M−1−ν_M−1)·({tilde over (ω)}_M−2−ν_M−2)=2u_M−1·u_M−2.  (104)By (102), if u_M−1≠0 and {tilde over (ω)}_M−1−ν_M−1=u_M−1, it must be{tilde over (ω)}_M−2−ν_M−2=u_M−2.  (105)

At the next iteration, the contributions to (98) are the following multiples of p^2·M−4:

$\begin{array}{cc}\{\begin{array}{cc}2·{\upsilon }_{M-3}·{\upsilon }_{M-1}+{\upsilon }_{M-2}^2& \mathrm{from}{\left(\tilde{A}-Y\right)}^2\\ \begin{array}{c}-2·{\tilde{\omega }}_{M-3}·{\upsilon }_{M-1}-2·{\tilde{\omega }}_{M-2}·{\upsilon }_{M-2}-\\ 2·{\tilde{\omega }}_{M-1}·{\upsilon }_{M-3}\end{array}& \mathrm{from}-2·\tilde{A}·\left(\tilde{A}-Y\right)\\ 2·{\tilde{\omega }}_{M-3}·{\tilde{\omega }}_{M-1}+{\tilde{\omega }}_{M-2}^2& \mathrm{from}{\tilde{A}}^2-N\\ -2·u_{M-1}·u_{M-3}-u_{M-2}^2& \mathrm{from}-X^2\end{array}.& \left(106\right)\end{array}$ Therefore,2·({tilde over (ω)}_M−1−ν_M−1)·({tilde over (ω)}_M−3−ν_M−3)+({tilde over (ω)}_M−2−ν_M−2)²=2·u_M−1·u_M−3+u_M−2².  (107)By (102) and (105),{tilde over (ω)}_M−3−ν_M−3=u_M−3.  (108)

At every iteration the sequence produces a similar relationship between ν_i and u_i. The sequence ends after it concludes that{tilde over (ω)}₂−ν₂=u₂.  (109)In general

$\begin{array}{cc}{\tilde{\omega }}_i-{\upsilon }_i=u_i.& \left(110\right)\end{array}$

These conclusions were reached without interference from (97), which contains multiples of p^M only. Indeed, the last equation in the sequence, the one which produced (109), is an equation which operates on multiples of p^M+1 Refer to (94) and the illustration in FIG. 3.

Consider the representation of the pair (r, s) as in (77). Substitution of (110) into (77) yields

$\begin{array}{cc}\{\begin{array}{c}r=\tilde{A}+u_1·p+\left(2·u_2-{\tilde{\omega }}_2\right)·p^2+\left(2·u_3-{\tilde{\omega }}_3\right)·p^3+\dots +\\ \left(2·u_{M-1}-{\tilde{\omega }}_{M-1}\right)·p^{M-1}\\ s=\tilde{A}-u_1·p-{\tilde{\omega }}_2·p^2-{\tilde{\omega }}_3·p^3-\dots -{\tilde{\omega }}_{M-1}·p^{M-1}\end{array}& \left(111\right)\end{array}$ or

$\begin{array}{cc}\{\begin{array}{c}r=\tilde{A}+u_1·p+\left(-2·{\upsilon }_2+{\tilde{\omega }}_2\right)·p^2+\left(-2·{\upsilon }_3+{\tilde{\omega }}_3\right)·\\ p^3+\dots +\left(-2·{\upsilon }_{M-1}+{\tilde{\omega }}_{M-1}\right)·p^{M-1}\\ s=\tilde{A}-u_1·p-{\tilde{\omega }}_2·p^2-{\tilde{\omega }}_3·p^3-\dots -{\tilde{\omega }}_{M-1}·p^{M-1}\end{array}.& \left(112\right)\end{array}$ 3) The Case when {tilde over (ω)}_M−1−ν_M−1=−u_M−1

Consider (98) in the case when u_M−1>0 and {tilde over (ω)}_M−1−ν_M−1=−u_M−1. In this case (104) yields{tilde over (ω)}_M−2−ν_M−2=−u_M−2.  (113)Likewise, (107) yields{tilde over (ω)}_M−3−ν_M−3=−u_M−3.  (114)and, in general,ω_i−ν_i=−u_i.  (115)In this case, substitution of (115) into (77) yields

$\begin{array}{cc}\{\begin{array}{c}r=\tilde{A}+u_1·p-{\tilde{\omega }}_2·p^2-{\tilde{\omega }}_3·p^3-\dots -{\tilde{\omega }}_{M-1}·p^{M-1}\\ s=\tilde{A}-u_1·p-\left(2·u_2+{\tilde{\omega }}_2\right)·p^2-\left(2·u_3+{\tilde{\omega }}_3\right)·\\ p^3-\dots -\left(2·u_{M-1}+{\tilde{\omega }}_{M-1}\right)·p^{M-1}\end{array}.& \left(116\right)\end{array}$ or

$\begin{array}{cc}\{\begin{array}{c}r=\tilde{A}+u_1·p-{\tilde{\omega }}_2·p^2-{\tilde{\omega }}_3·p^3-\dots -{\tilde{\omega }}_{M-1}·p^{M-1}\\ s=\tilde{A}-u_1·p+\left(-2·{\upsilon }_2+{\tilde{\omega }}_2\right)·p^2+\left(-2·{\upsilon }_3+{\tilde{\omega }}_3\right)·\\ p^3+\dots +\left(-2·{\upsilon }_{M-1}+{\tilde{\omega }}_{M-1}\right)·p^{M-1}\end{array}.& \left(117\right)\end{array}$ NOTE 1: There are two sets of conditions which can assist in the solution of the factorization problem. The first set are the congruences (94). If u₁≢0 (mod p), for 2<i<M they establish linear relationships between ν_i and u_i−1 modulo p^M−1 when the variables ν_j and u_j of lesser degree are known. Refer to the example in (92).The second set are the equations (110) or (115).Substitution of (110) into (77) produced (111) and (112). Substitution of (115) into (77) produced (116) and (117).NOTE 2: Using (111) or (112) to compute (r+s)/2 and (r−s)/2 produce the same results as (77). The benefit of (111) and (112) lies in the fact that, when r is multiplied by s modulo p^M, the product does not contain any power of p higher than p^M. Also, except for u₁, with u₁≢0 (mod p), (112) and (111) are linear functions which contain only the set {ν_i} or {u_i}, respectively. Similar considerations apply to (116) and (117).4) The Case when u_M−1=0Consider the case when u_M−1=0. In this case, equation (102) becomes{tilde over (ω)}_M−1−ν_M−1=0.  (118)Therefore, no information can be produced using (104). However, (107) yields{tilde over (ω)}_M−2−ν_M−2=±u_M−2.  (119)If u_M−2≠0, the process can be continued until it concludes that{tilde over (ω)}₃−ν₃=u₃.  (120)or{tilde over (ω)}₃−ν₃=−u₃.  (121)In fact, if u_M−1=0, u₃·p³ is the lowest degree element which, when multiplied by u_M−2·p^M−2, produces a multiple of p^M+1. Again, there is the possibility that u_M−2 be zero. In this case (110) or (115) are applicable only when i equals or exceeds 4. The situation is it illustrated by Section VIII.7 and FIG. 4.

In general, assume that u₁≢0 modulo p and u_M−j=0 for 1≤j≤j₀. Then (110) is applicable only for i≥j₀+2. In these cases the general expression of the pair (r, s) is

$\begin{array}{cc}\{\begin{array}{c}r=\tilde{A}+u_1·p+\sum _{i=2}^{j_0+1}\left(-{\upsilon }_i+u_i\right)·p^i+\sum _{i=j_0+2}^{M-j_0-1}\left(2·u_i-{\tilde{\omega }}_i\right)·\\ p^i-\sum _{i=M-j_0}^{M-1}{\tilde{\omega }}_i·p^i\\ s=\tilde{A}-u_1·p+\sum _{i=2}^{j_0+1}\left(-{\upsilon }_i-u_i\right)·p^i-\sum _{i=j_0+2}^{M-j_0-1}{\tilde{\omega }}_i·p^i-\\ \sum _{i=M-j_0}^{M-1}{\tilde{\omega }}_i·p^i\end{array}.& \left(122\right)\end{array}$ Compare with (111). Also, in this case, (112) becomes

$\begin{array}{cc}\{\begin{array}{c}r=\tilde{A}+u_1·p+\sum _{i=2}^{j_0+1}\left(-{\upsilon }_i+u_i\right)·p^i+\sum _{i=j_0+2}^{M-j_0-1}\left(-2·{\upsilon }_i+{\tilde{\omega }}_i\right)·\\ p^i-\sum _{i=M-j_0}^{M-1}{\tilde{\omega }}_i·p^i\\ s=\tilde{A}-u_1·p+\sum _{i=2}^{j_0+1}\left(-{\upsilon }_i-u_i\right)·p^i-\sum _{i=j_0+2}^{M-j_0-1}{\tilde{\omega }}_i·p^i-\\ \sum _{i=M-j_0}^{M-1}{\tilde{\omega }}_i·p^i\end{array}.& \left(123\right)\end{array}$ Similarly, if (93) is used in lieu of (110), (116) is replaced by

$\begin{array}{cc}\{\begin{array}{c}r=\tilde{A}+u_1·p+\sum _{i=2}^{j_0+1}\left(-{\upsilon }_i+u_i\right)·p^i-\sum _{i=j_0+2}^{M-j_0-1}{\tilde{\omega }}_i·p^i-\\ \sum _{i=M-j_0}^{M-1}{\tilde{\omega }}_i·p^i\\ s=\tilde{A}-u_1·p+\sum _{i=2}^{j_0+1}\left(-{\upsilon }_i-u_i\right)·p^i-\sum _{i=j_0+2}^{M-j_0-1}\left(2·u_i+{\tilde{\omega }}_i\right)-\\ \sum _{i=M-j_0}^{M-1}{\tilde{\omega }}_i·p^i\end{array}& \left(124\right)\end{array}$ and (117) is replaced by

$\begin{array}{cc}\{\begin{array}{c}r=\tilde{A}+u_1·p+\sum _{i=2}^{j_0+1}\left(-{\upsilon }_i+u_i\right)·p^i-\sum _{i=j_0+2}^{M-j_0-1}{\tilde{\omega }}_i·p^i-\\ \sum _{i=M-j_0}^{M-1}{\tilde{\omega }}_i·p^i\\ s=\tilde{A}-u_1·p+\sum _{i=2}^{j_0+1}\left(-{\upsilon }_1-u_i\right)·p^i+\sum _{i=j_0+2}^{M-j_0-1}\left(-2·{\upsilon }_i+{\tilde{\omega }}_i\right)·\\ p^i-\sum _{i=M-j_0}^{M-1}{\tilde{\omega }}_i·p^i\end{array}.& \left(125\right)\end{array}$

Notice that a priori there is no knowledge of whether u_M−1 is or is not zero. The same is true for u_M−2, etc. Therefore, at this point, j₀ is an undetermined integer.

NOTE 1: When using (124) and (122), the pair (r, s) is dependent on the set {u_i} and on the first elements of {ν_i}, for 2≤i≤j₀+1. In such cases, the general expression of (r, s) is

$\begin{array}{cc}\{\begin{array}{c}r={\tilde{\omega }}_0+{\tilde{\omega }}_1·p+{\tilde{u}}_1·p+\sum _{i=2}^{j_0}{\tilde{z}}_i·p^i+z_{j_0+1}·p^{j_0+1}\\ s={\tilde{\omega }}_0+{\tilde{\omega }}_1·p-{\tilde{u}}_1·p+\sum _{i=2}^{j_0}{\tilde{z}}_i·p^i+z_{j_0+1}{p}^{j_0+1}-2·\\ \sum _{i=2}^{j_0}{\tilde{u}}_i·p^i-2·\sum _{i=j_0+1}^{M-j_0-1}{u}_i·p^i\end{array},& \left(126\right)\end{array}$ wherez_k={tilde over (ω)}_k−ν_ku_k  (127)or

$\begin{array}{cc}\{\begin{array}{c}r={\tilde{\omega }}_0+{\tilde{\omega }}_1·p+{\tilde{u}}_1·p+\sum _{i=2}^{j_0}{\tilde{\zeta }}_i·p^i+{\zeta }_{j_0+1}·p^{j_0+1}+2·\\ \sum _{i=2}^{j_0}{\tilde{u}}_i·p^i+2·\sum _{i=j_0+1}^{M-j_0-1}{u}_i·p^i\\ s={\tilde{\omega }}_0+{\tilde{\omega }}_1·p+{\tilde{u}}_1·p+\sum _{i=2}^{j_0}{\tilde{\zeta }}_i·p^i+{\zeta }_{j_0+1}·p^{j_0+1}\end{array}.& \left(128\right)\end{array}$ whereζ_k={tilde over (ω)}_kν_ku_k.  (129)X. THE PROCESS1) The Case when u_M−1≠0 (j₀=0)1.1) Overview

Consider the case when u_M−1≠0. In this case (111) becomes

$\begin{array}{cc}\{\begin{array}{c}r={\tilde{\omega }}_0+\left({\tilde{\omega }}_1+u_1\right)·p+2·\sum _{i=2}^{M-1}{u}_i·p^i\\ s={\tilde{\omega }}_0+\left({\tilde{\omega }}_1-u_1\right)·p\end{array}.& \left(130\right)\end{array}$ If

$\begin{array}{cc}\{\begin{array}{c}{u}_1\not\equiv 0\left(\mathrm{mod}p\right)\\ {\tilde{\omega }}_1\pm u_1\not\equiv \left(\mathrm{mod}p\right)\end{array},& \left(131\right)\end{array}$ multiplication of r by s modulo p^M yields:

$\begin{array}{cc}\{\begin{array}{c}{v}_0\equiv {\tilde{\omega }}_0^2\left(\mathrm{mod}{p}^M\right)\\ v_1\equiv 2·{\tilde{\omega }}_0·{\tilde{\omega }}_1\left(\mathrm{mod}{p}^{M-1}\right)\\ v_2={\tilde{\omega }}_0·2·u_2-u_1^2+{\tilde{\omega }}_1^2+\left(\mathrm{mod}{p}^{M-2}\right)\\ v_3\equiv {\tilde{\omega }}_0·2·u_3+\left({\tilde{\omega }}_1-u_1\right)·2·u_2\left(\mathrm{mod}{p}^{M-3}\right)\\ \dots \\ v_{n-2}\equiv {\tilde{\omega }}_0·2·u_{M-2}+\left({\tilde{\omega }}_1-u_1\right)·2·u_{M-3}\left(\mathrm{mod}{p}^2\right)\\ v_{n-1}={\tilde{\omega }}_0·2·u_{M-1}+\left({\tilde{\omega }}_1-u_1\right)·2·u_{M-2}\left(\mathrm{mod}p\right)\end{array}.& \left(132\right)\end{array}$

Let RH (132)_i and LH (132)_i denote the RHS and the LHS, respectively, of that congruence in (132) which is defined modulo p^M−i. Then, it must beRH (132)_i−LH (132)_i≡0 (mod p^M−i).  (133)Define

$\begin{array}{cc}{C\left(132\right)}_i=\frac{{\mathrm{RH}\left(132\right)}_i-{\mathrm{LH}\left(132\right)}_i}{p^{M-1}}.& \left(134\right)\end{array}$

There is one condition which is not contained in (132): that is the condition that the sum of all the multiples of p^M in the system be equal to zero. Specifically, refer to (130). If u_M−1≠0, the highest power of p is produced when ({tilde over (ω)}₁−u₁)·p is multiplied by 2·u_M−1·p^M−1. There are other multiples of p^M in the system, specifically Q·p^M, {tilde over (η)}₀·p^M and {tilde over (η)}₁·p^M and the integers C(133)_i·p^M for i≥2. (Refer to (87) and (91)). Equating to zero the sum of all the coefficients of p^M, it must be

$\begin{array}{cc}0=Q+{\tilde{\eta }}_0+{\tilde{\eta }}_1+\sum _{i=2}^{M-1}{C\left(132\right)}_i+2·\left({\tilde{\omega }}_1-u_1\right)·u_{M-1}.& \left(135\right)\end{array}$ 1.2) TidbitsNOTE 1: Refer to (77). By (7), X<N. The magnitude of the integer Xis not dependent on the representation of N. If Nand Xwere represented in base p, and Xwere to approximate closely N, it would be 0<u_M−1<p and one of the two factors of N would approximate closely 1.NOTE 2: In general, the integers N₀ are pre-screened to test divisibility by the first elements of the sequence of primes. Thus, it is reasonable to assume that in all cases u_M−1=0. Recall that the representation of U as in (73), where {u_i} are p^M−i—constrained positive integers, offers many degrees of freedom and no practical limitation on the magnitude of Uresults when u_M−1 is set equal to zero. In fact, any integer U can be represented by a multitude of selections of the set {u_i}.NOTE 3: There is a peculiar situation when the pair (r, s) can be described as in (130). Consider the case when ν₀ is a perfect square, say ν₀=Ã₀²<p. In these cases {tilde over (ω)}₀ is a small integer and {tilde over (ω)}₀=Ã₀. Then the second of (130) yields

$\begin{array}{cc}\frac{s-{\tilde{A}}_0}{p}={\tilde{\omega }}_1-u_1.& \left(136\right)\end{array}$ Some cases were observed when ν₀=Ã₀²<p, s was two digits long in base p and u_M−1 was nonzero.NOTE 4: In this presentation it will be assumed that {tilde over (ω)}₀²>p².2) The Case when j₀=1 (u_M−1=0 and u_M−2≠0)2.1) Overview

Consider the case when it has been assumed that u_M−1=0. It is desired to determine a pair of divisors (r, s) when u_M−2≠0, if such a pair exists. In this case (126) and (128) can be written as follows:

$\begin{array}{cc}\{\begin{array}{c}{u}_{M-2}\ne 0\\ u_{M-1}=0\\ r={\tilde{A}}_2+u_1·p+\left(-{\upsilon }_2+u_2\right)·p^2\\ s={\tilde{A}}_2-u_1·p+\left(-{\upsilon }_2+u_2\right)·p^2-2·\sum _{i=3}^{M-2}{u}_i·p^i\end{array}& \left(137\right)\end{array}$ whereÃ₂={tilde over (ω)}₀+{tilde over (ω)}₁·p+{tilde over (ω)}₂p²  (138)and

$\begin{array}{cc}\{\begin{array}{c}{u}_{M-2}\ne 0\\ u_{M-1}=0\\ r={\tilde{A}}_1+u_1·p+{\zeta }_2·p^2+2·\sum _{i=2}^{M-2}{u}_i·p^i\\ s={\tilde{A}}_1-u_1·p+{\zeta }_2·p^2\end{array},& \left(139\right)\end{array}$ whereÃ₁={tilde over (ω)}₀+{tilde over (ω)}₁·p  (140)and where ζ₂ is defined as in (129):

$\begin{array}{cc}\{\begin{array}{c}{u}_{M-1}=0\\ u_{M-2}\ne 0\\ {\zeta }_2={\omega }_2-{\upsilon }_2-u_2\end{array}.& \left(141\right)\end{array}$ Compare with (128) and (129).

Using (139), multiply r by s modulo p^M. Setting the sum of the coefficients of any given power of p congruent to zero (mod p^M−i) yields

$\begin{array}{cc}\{\begin{array}{c}{u}_{M-2}\ne 0\\ v_0\equiv {\tilde{\omega }}_0^2\left(\mathrm{mod}{p}^M\right)\\ v_1\equiv 2·{\tilde{\omega }}_0·{\tilde{\omega }}_1\left(\mathrm{mod}{p}^{M-1}\right)\\ v_2\equiv -u_1^2+{\tilde{\omega }}_1^2+2·{\tilde{\omega }}_0·{\zeta }_2+2·{\tilde{\omega }}_0·u_2\left(\mathrm{mod}{p}^{M-2}\right)\\ v_3\equiv 2·{\tilde{\omega }}_0·u_3+2·\left({\tilde{\omega }}_1-u_1\right)·u_2+2·{\tilde{\omega }}_1·{\zeta }_2\left(\mathrm{mod}{p}^{M-3}\right)\\ v_4\equiv 2·{\tilde{\omega }}_0·u_4+2·\left({\tilde{\omega }}_1-u_1\right)·u_3+2·{\zeta }_2·u_2+{\zeta }_2^2\left(\mathrm{mod}{p}^{M-4}\right)\\ \mathrm{for}i>4\\ v_i\equiv 2·{\tilde{\omega }}_0·u_i+2·\left({\tilde{\omega }}_1-u_1\right)·u_{i-1}+2·{\zeta }_2·u_{i-2}\left(\mathrm{mod}{p}^{M-i}\right)\\ \dots \\ v_{M-2}\equiv 2·{\tilde{\omega }}_0·u_{M-2}+2·\left({\tilde{\omega }}_1-u_1\right)·u_{M-3}+2·{\zeta }_2·u_{M-4}\left(\mathrm{mod}{p}^2\right)\\ v_{M-1}\equiv 2·\left({\tilde{\omega }}_1-u_1\right)·u_{M-2}+2·{\zeta }_2·u_{M-3}\left(\mathrm{mod}{p}^2\right)\end{array}.& \left(142\right)\end{array}$

Let RH (142)_i and LH (142)_i denote the RHS and the LHS, respectively, of that congruence in (142) which is defined modulo p^M−i. Then, it must beRH (142)_i−LH (142)_i≡0 (mod p^M−i).  (143)Define

$\begin{array}{cc}{C\left(142\right)}_i=\frac{{\mathrm{RH}\left(142\right)}_i-{\mathrm{LH}\left(142\right)}_i}{p^{M-i}}.& \left(144\right)\end{array}$

There is one condition which is not contained in (142): that is the condition that the sum of all the multiples of p^M in the system be equal to zero. Specifically, refer to (139). If u_M−2≠0, the highest power of p is produced when ζ₂·p² is multiplied by 2·u_M−2·p^M−2. The other multiples of p^M in the system are Q·p^M, {tilde over (η)}₀·p^M, {tilde over (η)}₁·p^M and the integers C(142)_i·p^M. Then, equating to zero the sum of the coefficients of p^M, it must be

$\begin{array}{cc}0=Q+{\tilde{\eta }}_0+{\tilde{\eta }}_1+\sum _{i=2}^{M-1}{C\left(142\right)}_i+2·{\zeta }_2·u_{M-2}.& \left(145\right)\end{array}$ Refer to (88) and (91).In this equation the integer u_M−2 is defined modulo p² by the second last congruence of (142).

Also, in the computation of C(142)_M−1, the integers u_M−2 and u_M−3 equal the corresponding values in the second last congruence of (142).

The set of congruences (142) can be referred to as a SUPERCONGRUENCE.

2.2) Tidbits

1) Subject to the condition (131), if (142) and (145) do not admit integer solutions, there does not exist an integer r which can be described as in (142) and such that r|N.

2) The system (142) consists of M congruences. Given the selection of an integer u₁<p, the third congruence of (142) defines a corresponding value of ν₂ modulo p^M−2.

3) The selection of an integer u₂<p definesζ₂=ω₂−ν₂−u₂.  (146)Refer to (141).4) The solution of the fourth congruence of (142) produces a corresponding u₃.5) The last congruence of (142) verifies the compatibility between ũ_M−2 and ν_M−1 and causes a paring down of the roster of candidate pairs (u₁, u₂).6) If the system (142) produces a candidate pair (u₁, u₂), the viability of that pair should be tested using (145). Of course, (145) can be satisfied only if

$\begin{array}{cc}0\equiv Q_0+{\tilde{\eta }}_0+{\tilde{\eta }}_1+\sum _{i=2}^{M-1}{C\left(142\right)}_i+2·{\zeta }_2·u_{M-2}\left(\mathrm{mod}p\right).& \left(147\right)\end{array}$ Refer to (87).NOTE 1: To expedite the execution of (142), observe that each one of the higher degree congruences of (142) must hold true if they were reduced modulo p². Therefore, (142) could be reduced as follows:

$\begin{array}{cc}\{\begin{array}{c}{u}_{M-2}\ne 0\\ u_{M-1}=0\\ v_0\equiv {\tilde{\omega }}_0^2\left(\mathrm{mod}{p}^2\right)\\ v_1\equiv 2·{\tilde{\omega }}_0·{\tilde{\omega }}_1\left(\mathrm{mod}{p}^2\right)\\ v_2\equiv -u_1^2+{\tilde{\omega }}_1^2+2·{\tilde{\omega }}_0·{\zeta }_2+2·{\tilde{\omega }}_0·u_2\left(\mathrm{mod}{p}^2\right)\\ v_3\equiv 2·{\tilde{\omega }}_0·u_3+2·\left({\tilde{\omega }}_1-u_1\right)·u_2+2·{\tilde{\omega }}_1·{\zeta }_2\left(\mathrm{mod}{p}^2\right)\\ v_4\equiv 2·{\tilde{\omega }}_0·u_4+2·\left({\tilde{\omega }}_1-u_1\right)·u_3+2·{\zeta }_2·u_2+{\zeta }_2^2\left(\mathrm{mod}{p}^2\right)\\ \mathrm{for}i>4\\ v_i\equiv 2·{\tilde{\omega }}_0·u_t+2·\left({\tilde{\omega }}_1-u_1\right)·u_{i-1}+2·{\zeta }_2·u_{i-2}\left(\mathrm{mod}{p}^2\right)\\ \dots \\ v_{M-2}\equiv 2·{\tilde{\omega }}_0·u_{M-2}+2·\left({\tilde{\omega }}_1-u_1\right)·u_{M-3}+2·{\zeta }_2·u_{M-4}\left(\mathrm{mod}{p}^2\right)\\ v_{M-1}\equiv 2·\left({\tilde{\omega }}_1-u_1\right)·u_{M-2}+2·{\zeta }_2·u_{M-3}\left(\mathrm{mod}{p}^2\right)\end{array}.& \left(148\right)\end{array}$

In (148) each congruence produces a carry which must be added to C(142)_M−1. For i<M−1 the carries produced by the congruences (148) are

$\begin{array}{cc}{C\left(148\right)}_i=\frac{{\mathrm{RH}\left(148\right)}_i-{\mathrm{LH}\left(148\right)}_i}{p^2}.& \left(149\right)\end{array}$

The total of these carries must satisfy the following:

$\begin{array}{cc}0\equiv Q_0+{\tilde{\eta }}_0+{\tilde{\eta }}_1+\sum _{i=2}^{M-2}{C\left(148\right)}_i+{C\left(142\right)}_{M-1}+2·{\zeta }_2·{\tilde{u}}_{M-2}\left(\mathrm{mod}p\right).& \left(150\right)\end{array}$

Notice that the magnitude of M does not burden the execution time of any of the congruences of (148). However, it determines the NUMBER of such congruences and the time required to execute the addition of M two digit numbers (which are represented in base p).

2.3) A Test

Consider the case when the true divisors of N₀, say {tilde over (r)}₀ and {tilde over (s)}₀, are known. Then, after the computation of {tilde over (T)}₀,N_T0 and the definition of M, the system (142) can be set into place.

If the true solution pair ({tilde over (r)}₀, {tilde over (s)}₀) were known, it would be{tilde over (s)}₀≡{tilde over (ω)}₀+({tilde over (ω)}₁−ũ_1,1)·p+({tilde over (ω)}₂−{tilde over (ν)}₂ũ_2,1)·p²(mod p³),  (151)and the pair (ũ_1,1,ũ_2,1) would be an element of the set of pairs which satisfy (142). (Table I).

In general, such is not the case.

The contradiction can be explained by observing that, given N₀, the set of feasible pairs represented in Table I is dependent on the prior definition of M. Should M be replaced by some M₁=M+2·m₁ (m₁ integer>0) , the set of feasible pairs in Table I would be different.

Since {tilde over (s)}₀ is not known, the situation can be addressed by exploring independently all the possible definitions of (148), each one associated with a distinct value of M.

TABLE I
PART 1
Example of Feasible (u1,1, u2,1) Pairs
Statement of the Problem
N0	=	100301961039186938810056007
	=	165636239140553 · 605555653519
p	=	29
r0	=	15 + 8 · p + 23 · p2 + 3 · p3 + 20 · p4 + 26 · p5 + 4 · p6 + 3 · p7 + 12 · p8 + 11 · p9
s0	=	20 +5 · p + 2 · p2 + 2 · p3 + 7 · p4 + 1 · p5 + 3 · p6 + 6 · p7 + 1 · p8
α	=	15
pn0−1	<	N0 < pn0
n0	=	18
T0	=	223062825066445118121878597
T0 · α	≡	20 (mod p
NT0	=	T0 · N0 = 22373638789105549923178072390737492094618301624582179
nT0	=	36
	<	NT0 <
M	=	4097
M	−	1 > 2 · nT0 − 2
ω0	≈	4.78 × 10748
ω1	≈	3.765 × 10748
A	≈	4.11 × 10752
PART 2
Feasible (u1,1, u2,1) Pairs
u1,1	u2,1
1	1
3	20
3	27
3	28
4	1
5	15
5	22
6	1
6	7
6	28
7	14
8	14
10	28
11	25
12	2
12	9
13	19
15	3
15	4
15	26
16	10
17	20
18	5
19	5
19	15
19	17
19	25
22	10
23	20
23	23
23	26
24	9
25	28
27	3
27	25
Solutions of (150)
u1,1	u2,1
7	14
Correct Solution
u1,1	u2,1
3	20

2.4) The Periodic Components of (148)

Consider the case when M has been defined using (78). In this case the system (142) consists of M congruences. The LHS of the last n−1 congruences is congruent to zero modulo p^M−i. Thus, if n−1<i<M−1, it is0≡=2·{tilde over (ω)}₀·u_i+2·({tilde over (ω)}₁−u_i)·u_i−1+2·ζ₂·u_i−2(mod p²).  (152)

Notice that the coefficients {tilde over (ω)}₀, {tilde over (ω)}₁−u₁, and ζ₂, after reduction modulo p², do not depend on i, but depend on the selection of the pair (u₁, u₂).

Thus, the system (142) contains a sequence of components which are related to one another as follows:

$\begin{array}{cc}\{\begin{array}{c}\dots \\ 0\equiv 2·{\tilde{\omega }}_0·u_i+2·\left({\tilde{\omega }}_1-u_1\right)·u_{i-1}+2·{\zeta }_2·u_{i-2}\left(\mathrm{mod}{p}^2\right)\\ 0\equiv 2·{\tilde{\omega }}_0·u_{i+1}+2·\left({\tilde{\omega }}_1-u_1\right)·u_i+2·{\zeta }_2·u_{i-1}\left(\mathrm{mod}{p}^2\right)\\ 0\equiv 2·{\tilde{\omega }}_0·u_{i+2}+2·\left({\tilde{\omega }}_1-u_1\right)·u_{i+1}+2·{\zeta }_2·u_i\left(\mathrm{mod}{p}^2\right)\\ 0\equiv 2·{\tilde{\omega }}_0·u_{i+3}+2·\left({\tilde{\omega }}_1-u_1\right)·u_{i+2}+2·{\zeta }_2·u_{i+1}\left(\mathrm{mod}{p}^2\right)\\ \dots \end{array}& \left(153\right)\end{array}$

To clarify the role of the integer p−1, assume that (142) is satisfied. Then, if ω₁−u₁≢0 (mod p), and ζ₂≢0(mod p) (131), it will be0≡ζ₂⁻¹·(ω₁−u₁)·u_M−2+u_M−3(mod p),  (154)and0≡ζ₂⁻¹·ω₀·u_M−2+ζ₂⁻¹·(ω₁−u₁)·u_M−3+u_M−4(mod p),  (155)whence0≡(ζ₂⁻¹·ω₀−ζ₂⁻²(ω₁−u₁)²)·u_M−2+u_M−4(mod p).  (156)In a similar fashion,0≡ζ₂⁻¹·ω₀·u_M−3+ζ₂⁻¹·(ω₁−u₁)·u_M−4+u_M−5(mod p)≡−ζ₂⁻²·ω₀·(ω₁−u₁)·u_M−2−ζ₂⁻²·ω₀·(ω₁−u₁)·u_M−2 −ζ₂⁻³·(ω₁−u₁)³·u_M−2+u_M−5(mod p)≡[−2·ζ₂⁻²·ω₀·(ω₁−u₁)+ζ₂⁻³·(ω₁−u₁)³]·u_M−2+u_M−5(mod p).  (157)

Similar relationships can be developed to relate u_M−i to u_M−2 modulo p. Such relationships contain two terms. As i increases, both terms display a periodicity of p−1, or its divisors.

Thus, given a selection of the pair (u₁, u₂), the specific embodiment of (142) for a given M can be related to a corresponding embodiment for M′=M+k·(p−1) for some integer k. Recall that, if M is increased by p−1, the number of congruences in (142) is increased by p−1.

2.5) A New Definition of M

The variability of M can be reduced by observing (24) and (41). Consider a process which evolves (24) into (41). Assume it can be iterated into higher powers of p until the resulting product r·s₀ exceeds the corresponding N. The process could end at that point and would offer a conclusion on the viability of {tilde over (α)}, Ũ_1,1 and the subsequent sets of (U_i, V_2·i) variables.

Notice that in (32), after multiplication of r by s₀, the highest power of p in the system is p⁴. In (37) it is p⁸. In the subsequent iterations it would be p^2k for k≥2. Thus, it is reasonable to selectM=2^h+1, for h>0  (158)or

$\begin{array}{cc}\{\begin{array}{c}M-1=2^h,\mathrm{for}h>0\\ 2^h>n-1\end{array}.& \left(159\right)\end{array}$ Compare with (78).2.6) Privileged sets of exponents M

Consider the case when an integer k·(p−1) is added to M. It is desired that the pairs (u₁, u₂) be proven still viable when Mis replaced by M₁=M+k·(p−1). This condition can be satisfied if both M₁ and M satisfy (159).

In this case,2^h+k·4·ODD=2^j  (160)or1+k′′ODD=2^j−h wherek=2^h−2·k′.  (161)

If p=29=4·7+1, the condition is satisfied when k′=1 and j−h=2³.

For the example of Table I, Table II shows the feasible (u₁, u₂) pairs for a sequence of values of M which satisfy (159).

Table III discards the (u₁, u₂) pairs which are not confirmed when M−1 is multiplied by p³.

Table IV shows an example of confirmed pair when p=61.

Table V shows the values of k′ and p^j−h for a set of primes of the form p=4·ODD+1.

TABLE II
Feasible (u1,1, u2,1) Pairs for the Example of TABLE I with Increments of M by 23
M    (u1,1, u2,1)
PART 1
65   (1, 1), (1, 28), (3, 5), (3, 20), (3, 28), (5, 15), (5, 23), (6, 1), (6, 7), (6, 28),
     (7, 14), (7, 15), (8, 14), (10, 15), (10, 28), (12, 9), (15, 4), (16, 21), (16, 23),
     (17, 20), (18, 5), (18, 19), (18, 23), (19, 0), (19, 4), (19, 5), (19, 8), (19, 17),
     (19, 25), (20, 0), (20, 3), (23, 14), (23, 20), (23, 23), (25, 28), (26, 17),
     (27, 3), (27, 25), (28, 1)
129  (1, 0), (1, 23), (4, 19), (5, 3), (6, 9), (6, 11), (6, 16), (9, 3), (10, 17), (11, 18),
     (12, 7), (12, 15), (13, 16), (14, 23), (15, 0), (15, 4), (15, 25), (16, 4), (19, 26),
     (20, 1), (21, 8), (23, 1), (23, 22), (23, 28), (24, 1), (25, 7), (26, 23)
257  (2, 26), (4, 20), (5, 8), (5, 20), (6, 3), (6, 9), (7, 19), (10, 14), (12, 26),
     (13, 19), (13, 26), (14, 3), (14, 26), (15, 6), (16, 10), (17, 27), (18, 4),
     (20, 22), (21, 2), (21, 26), (23, 1), (23, 22), (23, 28), (24, 7), (24, 14), (26, 2)
513  (1, 1), (3, 20), (3, 28), (6, 1), (6, 7), (6, 28), (7, 14), (8, 14), (10, 28), (12, 9),
     (14, 4), (15, 4), (15, 27), (16, 13), (17, 20), (17, 22), (18, 5), (18, 14), (19, 5),
     (19, 17), (19, 25), (20, 15), (23, 13), (23, 20), (23, 23), (24, 23), (25, 11),
     (25, 28), (26, 20), (26, 27), (27, 25)
     (1, 23), (1, 28), (2, 11), (2, 26), (5, 3), (6, 5), (6, 9), (6, 11), (6, 15), (9, 0),
1025 (9, 3), (9, 26), (10, 0), (10, 17), (10, 21), (10, 25), (11, 6), (11, 10), (13, 6),
     (13, 8), (14, 0), (14, 23), (15, 4), (16, 4), (20, 1), (23, 1), (23, 22), (23, 28),
     (24, 1), (24, 6), (24, 14), (26, 23), (26, 24), (28, 1), (28, 27)
PART 2
65   (1, 1), (1, 28), (3, 5), (3, 20), (3, 28), (5, 15), (5, 23), (6, 1), (6, 7), (6, 28),
     (7, 14), (7, 15), (8, 14), (10, 15), (10, 28), (12, 9), (15, 4), (16, 21), (16, 23),
     (17, 20), (18, 5), (18, 19), (18, 23), (19, 0), (19, 4), (19, 5), (19, 8), (19, 17),
     (19, 25), (20, 0), (20, 3), (23, 14), (23, 20), (23, 23), (25, 28), (26, 17),
     (27, 3), (27, 25), (28, 1)
129  (1, 0), (1, 23), (4, 19), (5, 3), (6, 9), (6, 11), (6, 16), (9, 3), (10, 17), (11, 18),
     (12, 7), (12, 15), (13, 16), (14, 23), (15, 0), (15, 4), (15, 25), (16, 4), (19, 26),
     (20, 1), (21, 8), (23, 1), (23, 22), (23, 28), (24, 1), (25, 7), (26, 23)
257  (2, 26), (4, 20), (5, 8), (5, 20), (6, 3), (6, 9), (7, 19), (10, 14), (12, 26),
     (13, 19), (13, 26), (14, 3), (14, 26), (15, 6), (16, 10), (17, 27), (18, 4),
     (20, 22), (21, 2), (21, 26), (23, 1), (23, 22), (23, 28), (24, 7), (24, 14), (26, 2)
513  (1, 1), (3, 20), (3, 28), (6, 1), (6, 7), (6, 28), (7, 14), (8, 14), (10, 28), (12, 9),
     (14, 4), (15, 4), (15, 27), (16, 13), (17, 20), (17, 22), (18, 5), (18, 14), (19, 5),
     (19, 17), (19, 25), (20, 15), (23, 13), (23, 20), (23, 23), (24, 23), (25, 11),
     (25, 28), (26, 20), (26, 27), (27, 25)
1025 (1, 23), (1, 28), (2, 11), (2, 26), (5, 3), (6, 5), (6, 9), (6, 11), (6, 15), (9, 0),
     (9, 3), (9, 26), (10, 0), (10, 17), (10, 21), (10, 25), (11, 6), (11, 10), (13, 6),
     (13, 8), (14, 0), (14, 23), (15, 4), (16, 4), (20, 1), (23, 1), (23, 22), (23, 28),
     (24, 1), (24, 6), (24, 14), (26, 23), (26, 24), (28, 1), (28, 27)

TABLE III
Example of Confirmed (u1,1, u2,1) Pairs in Table II
M     (u1,1, u2,1)
65,   (1, 1), (3, 20), (3, 28), (6, 1), (6, 7), (6, 28), (7, 14), (8, 14), (10, 28),
513,  (12, 9), (15, 4), (17, 20), (18, 5), (19, 5), (19, 17), (19, 25), (23, 20), (23, 23),
4097, (25, 28), (27, 25)
32769
129,  (1, 23), (5, 3), (6, 9), (6, 11), (9, 3), (10, 17), (14, 23), (15, 4), (16, 4), (20, 1),
1025, (23, 1), (23, 22), (23, 28), (24, 1), (26, 23)
8193
257,  (4, 20), (5, 8), (6, 9), (12, 26), (13, 26), (15, 6), (20, 22), (21, 2), (21, 26),
2049, (23, 1), (23, 22), (23, 28)
16385

TABLE IV
Example of Confirmed (u1,1, u2,1) Pairs with Increment of M by 24 for p = 61
N0	=	1003019631558929713685288333
	=	165636239140789 · 605555666297
p	=	29
r0	=	54 + 22 · p + 32 · p2 + 34 · p3 + 55 · p4 + 58 · p5 + 42 · p6 + 52 · p7
s0	=	27 + 57 · p + 24 · p2 + 34 · p3 + 59 · p4 + 45 · p5 + 11 · p6
α	=	54
pn0−1	<	N0 < pn0
n0	=	15
T0	=	351071793171532742034651427
T0 · α	≡	27 (mod p)
NT0	=	T0 · N0 = 35213190063742146757748863016054424768295755644901191
	<	NT0 <
nT0	=	30
M	−	1 > 2 · nT0
M	=	4097
M	List of Confirmed (u1,1, u2,1)
65,	(2, 20), (4, 52), (6, 15), (8, 3), (11, 9), (12, 24), (12, 53), (12, 56),
1025	(15, 60), (20, 34), (22, 45), (22, 60), (24, 24), (24, 46), (24, 49),
	(29, 54), (30, 58), (32, 9), (32, 38), (33, 35), (35, 32), (43, 26),
	(43, 43), (44, 53), (47, 13), (50, 48), (52, 2), (54, 34), (54, 47),
	(55, 42), (57, 35), (58, 41)
129,	no (u1,1, u2,1) confirmed pairs
2049
257,	(2, 25), (3, 49), (4, 26), (9, 5), (10, 56), (12 7), (14, 44), (16, 28),
4097	(18, 23), (19, 34), (24, 36), (25, 14), (28, 26), (29, 52), (30, 54),
	(31, 2), (31, 52), (32, 1), (33, 4), (36, 18), (37, 12), (41, 27), (44, 1),
	(46, 9), (48, 0), (49, 5), (49, 8), (49, 37), (50, 52), (53, 1), (55, 39)
513,	(18, 55), (37, 39)
8193
Correct Solution
u1,1	u2,1
20	34

TABLE V
Examples of Privileged Sets of Exponents
	p	(p − 1)/4	k′	2j-h
	13	3	1	22
	29	7	1	23
	37	9	7	26
	53	13	315	212
	61	15	1	24
	101	25	41, 943	220

NOTE 1: The periodicity of (148) is dependent on the periodicity of the two coefficients of u_M−2 in (157). If both coefficients have periodicity p−1, the resulting periodicity of (148) and M are illustrated by Table V.

However, in general, each one of the two coefficients of u_M−2 may have its own periodicity, which equals any one of the divisors of p−1.

Table VI shows a case when p=29 and the integer 2^j−h of Table V is replaced by 2⁴.

2.7) The Determination of U_1,2

The system (142) has been developed without placing any condition on the magnitude of u₁, u₂, and the subsequent u_i's. It is useful to explore the case when u₁ and u₂ are defined as follows:

TABLE VI
Example of a Different Periodicity of M for p = 29
N0	=	100301962714574772614226437
	=	165636239140789 · 605555663633
p	=	29
r0	=	19 + 16 · p + 23 · p2 + 3 · p3 + 20 · p4 + 26 · p5 + 4 · p6 + 3 · p7 + 12 · p8 + 11 · p9
s0	=	13 + 6 · p + 14 · p2 + 2 · p3 + 7 · p4 + 1 · p5 + 3 · p6 + 6 · p7 + 1 · p8
α	=	19
pn0−1	<	N0 < pn0
n0	=	18
T0	=	218313923311049716831435891
T0 · α	≡	20 (modp)
NT0	=	T0 · N0 = 21897314996017444986250462892843316543173648922850367
	<	NT0 <
nT0	=	36
M	−	1 > 2 · nT0 − 2
M	=	4097
ω0	≈	1.24 × 102996
ω1	≈	9.57 × 102994
A	≈	2.86 × 102999
M	List of Confirmed (u1,1, u2,1)
65,	(2, 8), (4, 15), (5, 25), (9, 2), (9, 12), (13, 4), (13, 18), (14, 18),
1025	(14, 22), (15, 20), (18, 13), (22, 0), (22, 8), (26, 4), (26, 15), (28, 20)
129,	(3, 6), (4, 14), (4, 15), (5, 25), (6, 4), (8, 6), (9, 13), (9, 18), (13, 8),
2049	(13, 19), (14, 17), (14, 19), (28, 20)
257,	(1, 9), (3, 14), (5, 14), (6, 10), (7, 8), (9, 7), (11, 25), (15, 11),
4097	(16, 16), (18, 10), (19, 15), (20, 21), (20, 27), (21, 20), (21, 21),
	(23, 9), (24, 4), (24, 21), (25, 14), (27, 11), (28, 1)
513	no (u1,1, u2,1) confirmed pairs
Correct Solution
u1,1	u2,1
22	8

$\begin{array}{cc}\{\begin{array}{c}{U}_{1,2}=u_{1,1}+u_{1,2}·p\\ U_{2,2}=u_{2,1}+u_{2,2}·p\end{array},& \left(162\right)\end{array}$ where 0<u_1,1, u_2,1<p. Refer to (76).

Consider the system (128) when j₀=1. In this case the general expression of s iss≡{tilde over (ω)}₀+({tilde over (ω)}₁−u₁)·p+({tilde over (ω)}₂−{tilde over (ν)}₂−u₂)·p²(mod p³).  (163)If the pair (u_1,1, u_2,1) were substituted in lieu of (u₁, u₂), it would bes≡{tilde over (ω)}₀+({tilde over (ω)}₁−u_1,1)·p+({tilde over (ω)}₂−{tilde over (ν)}₂−u_2,1)·p²(mod p³).  (164)If the pair (U_1,2, U_2,2) were substituted in lieu of (u₁, u₂) , it would bes≡{tilde over (ω)}₀+({tilde over (ω)}₁−U_1,2)·p+({tilde over (ω)}₂−{tilde over (ν)}₂−U_2,2)·p²(mod p⁴).  (165)If u_1,2≠0, reduction of (165) modulo p³ would produce a congruence which is not consistent with (164). Therefore, u_1,2 must equal zero.2.8) The Determination of U_2,2

Consider the case when, given M, the systems (142) and (148) have produced a set of viable pairs (u_1,1, u_2,1). Such pairs define viable expressions of s (mod p³).

It is desired to define corresponding viable expressions of s (mod p⁴).

This can be accomplished by defining that value of U_2,2 which satisfies both (142) and the corresponding condition on the carries. For this purpose:

1) Substitute a candidate U_2,2 into (142) in lieu of u₂.

2) Define the integerζ_2,2={tilde over (ω)}₂{tilde over (ν)}₂−U_2,2  (166)and substitute it into (142) in lieu of ζ₂.

Notice that after these substitutions, every selection of U_2,2 satisfies (142). However, the pair (u_1,1, u_2,1) is feasible only if there exists at least one value of u_2,2 which satisfies the condition (147) on the carries modulo p

To produce the solution u_2,2, it is convenient to use an approach similar to (148). Specifically, after replacement of u_2,1 by U_2,2, all the congruences of (148), with the exception of the last two congruences, can be reduced modulo p³ yielding

$\begin{array}{cc}\hspace{1em}\{\begin{array}{c}{u}_{M-2}\ne 0\\ u_{M-1}=0\\ v_0\equiv {\tilde{\omega }}_0^2\left(\mathrm{mod}{p}^3\right)\\ v_1\equiv 2·{\tilde{\omega }}_0·{\tilde{\omega }}_1\left(\mathrm{mod}{p}^3\right)\\ v_2\equiv -u_1^2+{\tilde{\omega }}_1^2+2·{\tilde{\omega }}_0·{\zeta }_{2,2}+2·{\tilde{\omega }}_0·u_2\left(\mathrm{mod}{p}^3\right)\\ v_3\equiv 2·{\tilde{\omega }}_0·u_3+2·\left({\tilde{\omega }}_1-u_1\right)·u_2+2·{\tilde{\omega }}_1·{\zeta }_{2,2}\left(\mathrm{mod}{p}^3\right)\\ v_4\equiv 2·{\tilde{\omega }}_0·u_4+2·\left({\tilde{\omega }}_1-u_1\right)·u_3+2·{\zeta }_{2,2}·u_2+{\zeta }_{2,2}^2\left(\mathrm{mod}{p}^3\right)\\ \mathrm{for}i>4\\ v_i\equiv 2·{\tilde{\omega }}_0·u_t+2·\left({\tilde{\omega }}_1-u_1\right)·u_{i-1}+2·{\zeta }_{2,2}·u_{i-2}\left(\mathrm{mod}{p}^3\right)\\ \dots \\ v_{M-3}\equiv 2·{\tilde{\omega }}_0·u_{M-3}+2·\left({\tilde{\omega }}_1-u_1\right)·u_{M-4}+2·{\zeta }_{2,2}·\\ u_{M-5}\left(\mathrm{mod}{p}^3\right)\\ v_{M-2}\equiv 2·{\tilde{\omega }}_0·u_{M-2}+2·\left({\tilde{\omega }}_1-u_1\right)·u_{M-3}+2·{\zeta }_{2,2}·\\ u_{M-4}\left(\mathrm{mod}{p}^2\right)\\ v_{M-1}\equiv 2·\left({\tilde{\omega }}_1-u_1\right)·u_{M-2}+2·{\zeta }_{2,2}·u_{M-3}\left(\mathrm{mod}p\right)\end{array}.& \left(167\right)\end{array}$

Correspondingly, with the exception of the last two congruences, the carries should be defined as

$\begin{array}{cc}{C\left(167\right)}_i=\frac{{\mathrm{RH}\left(167\right)}_i-{\mathrm{LH}\left(167\right)}_i}{p^3}& \left(168\right)\end{array}$ and the condition (150) can be restated as follows:

$\begin{array}{cc}0\equiv Q_0+{\tilde{\eta }}_0+{\tilde{\eta }}_1+\sum _{i=2}^{M-3}{C\left(167\right)}_i+{C\left(142\right)}_{M-2}+{C\left(142\right)}_{M-1}+2·{\zeta }_{2,2}·{\tilde{u}}_{M-2}\left(\mathrm{mod}p\right).& \left(169\right)\end{array}$ NOTE 1: Compare two different expressions of s (mod p⁴):s≡{tilde over (ω)}₀+({tilde over (ω)}₁−u₁)p+({tilde over (ω)}₂−{tilde over (ν)}₂−u₂)p²+({tilde over (ω)}₃−ν₃−u₃)·p³(mod p⁴)  (170)ands≡{tilde over (ω)}₀+({tilde over (ω)}₁−u₁)p²+({tilde over (ω)}₂−ν₂−u_2,1−u_2,2·p)·p²(mod p⁴)  (171)Then−u_2,2≡{tilde over (ω)}₃ν₃−u₃ (mod p).  (172)Recall that ν₃ can be computed using (94).Table VII shows the resulting (u_1,1,u_2,1, u_3,1) triads for the example of Table III.

TABLE VII
Confirmed (u1,1, u2,1, u3,1) triads for the Example of Table III
M     (u1,1, u2,1, u3,1)
65,   (1, 1, 9), (1, 1, 28), (3, 20, 6), (3, 28, 25), (6, 1, 5),
513,  (10, 28, 4), (10, 28, 24), (12, 9, 8), (12, 9, 12), (15, 4, 25),
4097, (17, 20, 2), (17, 20, 27), (19, 5, 4), (19, 5, 12), (19, 17, 5),
32769 (19, 17, 25), (19, 25, 25), (23, 20, 1), (23, 20, 25)
129,  (1, 23, 8), (1, 23, 15), (5, 3, 24), (6, 11, 21), (10, 17, 8),
1025, (10, 17, 27), (15, 4, 10), (16, 4, 12), (20, 1, 3), (20, 1, 10),
8193  (20, 1, 27), (23, 22, 1), (23, 22, 4), (23, 22, 8), (23, 28, 5),
      (23, 28, 22), (24, 1, 3), (24, 1, 13), (24, 1, 20), (24, 1, 21),
      (26, 23, 1)
257,  (4, 20, 27), (13, 26, 24), (20, 22, 23), (23, 22, 3),
2049, (23, 22, 5), (23, 22, 21), (23, 22, 22)
16385

NOTE 2: In general, the execution of (167) and the corresponding (169) produce only one candidate value of u_2,2. In some cases, more than one value results. In these cases, all the corresponding value of U_2,2 must be explored.2.9) The General Case

After the determination of U_2,2, a similar procedure can be employed to determine U_2,3, whereζ_2,3={tilde over (ω)}₂−ν₂−u_{2, 1}−u_{2, 2}·p−u_{2, 3}·p²  (173)

In this case the moduli of (167) should be increased to p⁴ and the corresponding carries (168) should be adjusted accordingly. The resulting condition on the carries (169) would be computed modulo p².

Thereafter, the procedure can be iterated to determine the higher components of U.

Each step would propose a new value of s as a candidate divisor of N₀. If none of such steps offers a divisor of N₀, the initial (u_1,1, u_2,1) pair must be discarded.

2.10) Execution Time

This section contains an estimate of the upper bound of the time required to factor N using the procedure just described.

For the purpose of this estimate, it will be assumed that elementary arithmetic operations require a time of an order not exceeding log_P² N, where p denotes the base of representation of N.

The same can be assumed for the computation of multiplicative inverses, other linear congruences and square roots.

The proposed algorithm requires repeated execution of supercongruences such as (142) or (148). These systems consist of M congruences which are defined by a modulus as high as p^M. Thus, their execution can be assumed to require a time of the order of M³.

Usually (142) is executed for the purpose of identifying the feasible values of a particular variable. Such is the case when (142) is executed to identify the values of u_2,1 which are consistent with a known u_1,1. Thus, the execution time of a supercongruence is p·M³.

Accounting for the variability of u_1,1 and α, the production of all the feasible triads (α, u_1,1, u_2,1) requires a time of the order of p³·M³.

Observing TABLE III, it can be concluded that the number of feasible triads (α, u_1,1, u_2,1) is of the order of p². After the determination of the feasible pairs (u_1,1, u_2,1) for a given α, such pairs are employed to determine the corresponding sequence of u_2,i's. The determination of all u's for a given α requires the execution of as many as log_p N₀ supercongruences. Thus the execution time for all α would be of the order of p²·(p·M³)·M.

In particular, when p approximates the value of M, execution time is of the order of p⁷.

3) The Case when j₀=2

3.1) Overview

Consider the case when a roster of candidate pairs {(Ũ_1,1, Ũ_2,1)} has been determined and none of the corresponding pairs (r, s) represent divisors of N. Thus a new variable, ζ₃, can be introduced. The pair {(Ũ_1,1, Ũ_2,1)} is feasible only if there exists an integer ζ₃ such that,

$\begin{array}{cc}\{\begin{array}{c}{u}_{M-1}=0\\ u_{M-2}=0\\ u_{M-3}\ne 0\\ r={\tilde{A}}_1+{\tilde{u}}_1·+{\tilde{\zeta }}_2·p^2+{\zeta }_3·p^3+2·{\tilde{u}}_2·p^2+2·\sum _{i=3}^{M-3}{u}_i·p^i.\\ s={\tilde{A}}_1-{\tilde{u}}_1·p+{\tilde{\zeta }}_2·p^2+{\zeta }_3·p^3.\end{array}& \left(175\right)\end{array}$ Notice that in (175) u₁, u₂ and ζ₂ are known integers, say ũ₁, ũ₂ and {tilde over (ζ)}₂. Multiplication of r by s modulo p^M yields:

$\begin{array}{cc}\{\begin{array}{c}{u}_{M-3}\ne 0\\ u_{M-2}=0\\ u_{M-1}=0\\ v_0\equiv {\tilde{\omega }}_0^2\left(\mathrm{mod}{p}^M\right)\\ v_1\equiv 2·{\tilde{\omega }}_0·{\omega }_1\left(\mathrm{mod}{p}^{M-1}\right)\\ v_2\equiv -{\tilde{u}}_1^2+{\tilde{\omega }}_1^2+2·{\tilde{\omega }}_0·{\tilde{\zeta }}_2+2·{\tilde{\omega }}_0·{\tilde{u}}_2\left(\mathrm{mod}{p}^{M-2}\right)\\ v_3\equiv 2·{\tilde{\omega }}_0·u_3+2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·{\tilde{u}}_2+2·{\tilde{\omega }}_1·{\tilde{\zeta }}_2+2·{\tilde{\omega }}_0·\\ {\tilde{\zeta }}_3\left(\mathrm{mod}{p}^{M-3}\right)\\ v_4\equiv 2·{\tilde{\omega }}_0·u_4+2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·u_3+2·{\tilde{\zeta }}_2·{\tilde{u}}_2+2·{\tilde{\omega }}_1·{\zeta }_3+\\ {\tilde{\zeta }}_2^2\left(\mathrm{mod}{p}^{M-4}\right)\\ v_5\equiv 2·{\tilde{\omega }}_0·u_5+2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·u_4+2·{\tilde{\zeta }}_2·u_3+2·{\zeta }_3·{\tilde{u}}_2+\\ 2·{\tilde{\zeta }}_2·{\zeta }_3\left(\mathrm{mod}{p}^{M-5}\right)\\ v_6\equiv 2·{\tilde{\omega }}_0·u_6+2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·u_5+2·{\tilde{\zeta }}_2·u_4+2·{\zeta }_3·u_3+\\ {\zeta }_3^2\left(\mathrm{mod}{p}^{M-6}\right)\\ \mathrm{for}i>6\\ v_i\equiv 2·{\tilde{\omega }}_0·u_i+2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·u_{i-1}+2·{\tilde{\zeta }}_2·u_{i-2}+2·{\zeta }_3·\\ u_{i-3}\left(\mathrm{mod}{p}^{M-i}\right)\\ \dots \\ v_{n-3}\equiv 2·{\tilde{\omega }}_0·u_{M-3}+2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·u_{M-4}+2·{\tilde{\zeta }}_2·u_{M-5}+2·{\zeta }_3·\\ u_{M-6}\left(\mathrm{mod}{p}^3\right)\\ v_{n-2}\equiv 2·\left({\tilde{\omega }}_1-{\tilde{u}}_1\right)·u_{M-3}+2·{\tilde{\zeta }}_2·u_{M-4}+2·{\zeta }_3·u_{M-5}\left(\mathrm{mod}{p}^2\right)\\ v_{n-1}\equiv 2·{\tilde{\zeta }}_2·u_{M-3}+2·{\zeta }_3·u_{M-4}\left(\mathrm{mod}p\right)\end{array}.& \left(176\right)\end{array}$ For each initial selection of the pair (u₁, u₂) , the system (176) may produce a triad (u₁, u₂, ζ₃) such that r·s≡N (mod p⁴).3.2) Determination of u₃ (mod p) using (176)

STEP 1: Select an element of the roster {(u₁, u₂)} representing a solution of (142), say (Ũ_1,1, Ũ_2,1|M).

STEP 2: Using (94), compute ν₃ (mod p^M−3), say {tilde over (ν)}_3,1. The same result can be obtained by observing that in (176) the congruence which is defined modulo p^M−3 can be written as follows:0≡−2·{tilde over (ω)}₀·ν_3,1−2·{tilde over (ω)}₁·{tilde over (ν)}_{2, 2}−2·Ũ_{1, 1}·Ũ_2,1 (mod p^M−3).  (177)This congruence does not contain u₃ and allows one to determine ν_3,1 modulo p^M−3.STEP 3: To compute an integer u₃ (mod p) which satisfies (176), select an initial value of u₃ (mod p), say ũ_3,1.STEP 4: Compute a corresponding value of ζ₃, say {tilde over (ζ)}_3,1, where{tilde over (ζ)}_3,1={tilde over (ω)}₃−{tilde over (ν)}_3,1−ũ_3,1  (178)STEP 5: Substitute Ũ_1,1, Ũ_2,2 and {tilde over (ζ)}₂ in lieu of u₁, u₂and ζ₂ into (176). Also, substitute {tilde over (ζ)}_3,1 in lieu of ζ₃ into (176). Solve the congruences (176) starting with the condition on ν₄ and proceeding to the condition on ν_n−3 (mod p³). The last two congruences of (176) verify the consistency of u_M−3 with the corresponding LHS's, which are defined modulo p² and modulo p, respectively. In the event such a consistency is satisfied, a value of u_M−3 (mod p) is produced and ũ_3,1 is validated.All possible selections of ũ_3,1 must be tested. If no selection of ũ_3,1 satisfies (176) for the given pair (u_1,1, u_2,1|M), then such a pair must be discarded.3.3) Validation of u_2,2

The integer u_3,1 produced by (176) should be consistent with the value of u_2,2 produced by (167). However, there are many selections of (u_1,1, u_2,1) which, by (167), produce a corresponding u_2,2 and, by (176), do not produce any corresponding u_3,1.

Thus it appears that (176) is more severe than (167) in the determination of u_3,1.

Therefore, it is possible to execute (176) for all the confirmed pairs (u_1,1, u_2,1) which survive (142) and are listed in TABLE III and produce a corresponding roster of viable triads (u_1,1, u_2,1, u_3,1).

This step depopulates TABLE III drastically. Compare TABLE VII with TABLE VIII.

TABLE VIII
Example of Feasible (u1,1, u2,1, u3,1)Triads for
Increasing M and p = 29 using Supercongruence (176)
M    (u1,1, u2,1, u3,1)
65   (3, 20, 6), (6, 28, 4)
129  (23, 1, 25)
257  (23, 1, 25)
513  (3, 20, 6), (6, 28, 4)
1025 (13, 8, 17), (15, 4, 28), (23, 1, 25)
2049 (23, 1, 25)
4097 (3, 20, 6), (6, 28, 4)

TABLE IX
Calculation of u2,i and vi for i > 2
Calculation of u2,n
	u1	u2,1	u2,2	u2,3	u2,4	u2,5	u2,6	u2,7	u2,8	u2,9
	3	20	6	18	3	28	25	9	12	I
Calculation of v1
v2	v3	v4	v5	v6	v7	v8	v9	v10
24	17	25	12	2	9	21	18	7
This corresponds to the factor s0 = 605555653519.

3.4) Execution Time

After the depopulation of Table VII into Table VIII, the algorithm of Section 2.9 can resume and determine the appropriate u_2,1's, for all i>2. For the example of Table I, Table IX shows the resulting values of u_2,i and ν_i for all i>2.

The benefit of the validation of u_2,2 is the reduction of the total execution time by a factor of approximately p, thus reducing the total execution time to approximately p⁶.

XI. AN ALTERNATIVE APPROACH TO THE HIGHER POWERS OF p

1) The Approach

Consider the case when the triad ({tilde over (α)}, Ũ_1,1, Ũ_2,2) is a solution of (142) and (150), when N is to defined as in (37) and M is used in lieu of n₀.

In this case, it is possible to compute r₀ modulo p⁴ asr₀≡{tilde over (T)}₀⁻¹·r (mod p⁴)  (179)wherer≡{tilde over (ω)}₀+({tilde over (ω)}₁+ũ_1,1)·p+({tilde over (ω)}₂−{tilde over (ν)}_2,2+Ũ_2,2)·p² (mod p⁴).  (180)Define {tilde over (r)}_0,2 as the least positive solution of the following:r_0,2≡{tilde over (T)}₀⁻¹({tilde over (ω)}₀+({tilde over (ω)}₁+ũ_1,1)·p)(mod p^M).  (181)Define {tilde over (T)}₂ as the least positive solution of the following:N₀≡{tilde over (T)}₂·{tilde over (r)}_0,2² (mod p^M).  (182)If {tilde over (T)}₂ is odd, defineN₂={tilde over (T)}₂·N₀.  (183)Define Ã₂ as a solution of the followingN₂≡Ã₂⁻²(mod p^M).  (184)Then the general expression of the pair (r,s) will be

$\begin{array}{cc}\{\begin{array}{c}r={\tilde{A}}_2+U\left({\tilde{T}}_2\right)·p^2-V\left({\tilde{T}}_2\right)·p^4\\ s={\tilde{A}}_2+U\left({\tilde{T}}_2\right)·p^2-V\left({\tilde{T}}_2\right)·p^4\end{array},& \left(185\right)\end{array}$ for some integers U({tilde over (T)}₂) and V({tilde over (T)}₂).Compare with (41).Notice that (41) and (185) operate on rectangular lattices of sides p² and p⁴. Compare with (24).NOTE 1: The integers u₂ and U(T₂) are related to each other. In fact,

$\begin{array}{cc}\{\begin{array}{c}{\tilde{T}}_0\equiv N_0·{\alpha }^{-2}\left(\mathrm{mod}{p}^M\right)\\ {\tilde{T}}_2\equiv N_0·r_{0,2}^{-2}\left(\mathrm{mod}{p}^M\right)\end{array}& \left(186\right)\end{array}$ andU({tilde over (T)}₂)≡{tilde over (T)}₂·{tilde over (T)}₀⁻¹·Ũ_2,2(mod p⁴).  (187)Thus U₂,₂ is a known quantity, and the solution of (183) follows the pattern of (142).

NOTE 2: In (142) the congruences modulo pⁿ and pⁿ⁻¹ do not depend explicitly on the variables of the system (u_i and ν_i), because such dependence is embedded in the definition of N. Likewise, the four highest degree congruences (say p^M, P^M−1, p^M−2, p^M−3) do not depend explicitly on the corresponding variables.

XII. THE CASE WHEN ũ₁≡0(mod p)

Consider the case when N₀ is known not to be a prime number, and the algorithm does not determine any divisor of N₀ for any {tilde over (α)} and for ũ₁≢0 (mod p).

It has been observed that, given p, this situation occurs in less than 1% of the integers under test.

The problem can be addressed by defining {tilde over (T)}₂ as a solution of the following:N₀≡T₂·α²(mod p^M)  (188)and restating (185) accordingly. In this case, a solution of (185) may exist only if U({tilde over (T)}₂)≢0 (mod p²).

One possible strategy is to select a different prime, say p′, relying on the low probability that ũ be congruent to zero both modulo p and modulo p′. Of course, it is also possible to execute the proposed algorithm in parallel using both p and p′.

XIII. THE CASES WHEN ω₁²−u₁²≡0 (mod p)

A similar situation may occur when ω₁²−u₁²≡0 (mod p). This situation was observed in less than 1% of the cases under test. Again duplicating the algorithm using a different prime may solve the problem.

XIV. OTHER SINGULAR EVENTS

A variety of rare, singular events occur occasionally. Some of the Tables presented in this document describe unexpected events. Gradually, such events are being understood. All of them can be sidestepped by changing the selection of p.

Fundamentally, the proposed representation of integers and the resulting management of the carries offer a primary avenue towards the control of the factorization problem.

APPENDIX

A NOTE ON CONGRUENCES WITH TRUNCATED VARIABLES

Consider the linear congruenceA·x+B·y≡C (mod p²)  (A.1)where A≢0(modp) and B≢0 (mod p).Let

$\begin{array}{cc}\{\begin{array}{c}x=x_0+x_1·p\\ y=y_0+y_1·p\end{array}.& \left(A\mathrm{.2}\right)\end{array}$

Consider the case when x and y are constrained by the conditions that 0≤x₀, y₀≤p−1 to and also x₁=0 and y₁=0. In other words, x and y are “truncated” modulo p.

To solve (A.1) under these constraints, let C=c₀+c₁·p and solveA·x+B·y≡c₀ (mod p).  (A.3)

There exist p solution pairs (x₀,y₀) for this congruence. For each solution pair, compute the integerλ·p=A·x₀+B·y₀−c₀.  (A.4)

Depending on the value of c₁, there may be one or more solution pairs which satisfy (A.1), even though x and y are truncated modulo p. Also, in some cases, there is no solution pair for which λ≡c₁ (mod p).

The situation is illustrated by Table A.I, which shows the case when p=29, A=38, B=41, c₀=2, c₁=13.

The example illustrates the fact that a pair (x₀, y₀), which was truncated modulo p, may satisfy a congruence modulo p².

TABLE A.1
Example of Truncated Linear Congruence
(p = 29, A = 38, B = 41, c0 = 2, c1 = 13)
	(x0, y0)	A · x0 + B · y0 − c0	c1 · p
	(0, 5)	7 · p	13 p
	(1, 26)	9 p	13 · p
	(2, 18)	28 p	13 · p
	(3, 10)	18 p	13 p
	(4, 2)	8 p	13 p
	(5, 23)	10 · p	13 p
	(6, 15)	0 p	13 p
	(7, 7)	19 · p	13 · p
	(8, 28)	21 p	13 · p
	(9, 20)	11 · p	13 p
	(10, 12)	1 · p	13 · p
	(11, 4)	20 · p	13 p
	(12, 25)	22 p	13 p
	(13, 17)	12 · p	13 p
	(14, 9)	2 · p	13 · p
	(15, 1)	21 · p	13 · p
	(16, 22)	23 · p	13 p
	(17, 14)	13 · p	13 · p
	(18, 6)	3 · p	13 · p
	(19, 27)	5 · p	13 · p
	(20, 19)	24 p	13 · p
	(21, 11)	14 · p	13 · p
	(22, 3)	4 · p	13 · p
	(23, 24)	6 p	13 · p
	(24, 16)	25 · p	13 · p
	(25, 8)	15 · p	13 · p
	(26, 0)	5 p	13 · p
	(27, 21)	7 · p	13 · p
	(28, 13)	26 · p	13 · p
	Number of (x0, y0) pairs	29
	Double Solutions	5, 7, 21
	No Solutions	16, 17, 27

REFERENCES (All of which are incorporated by reference, herein)

[1] C. F. Gauss, Disquisitiones Arithmeticae, New York, N.Y.: Springer-Verlag, 1986.

[2] R. L. Rivest, A. Shamir, L. Adleman, “A Method for Obtaining Digital Signatures and Public-Key Cryptosystems,” Communications of the ACM, Vol. 21, pp. 120-125, 1978.

[3] G. H. Hardy, E. M. Wright, In Introduction to the Theory of Numbers, Oxford, U. K., The Clarendon Press, 1979.

Following is a list of relevant features of the invention.

The present invention pertains to a method for decoding an encrypted electromagnetic signal W representative of a message encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers and W is a function of r and s. The method comprises the steps of storing the signal W in a non-transient memory. There is the step of decoding with a second computer in communication with the memory the signal Win the memory with the second computer generated steps of selecting a prime number p of the form p=4k+1 for an odd integer k such that the public key N₀ is a non-quadratic residue modulo p; calculating n₀ satisfying the inequalities pⁿ⁰⁻¹<N₀<pⁿ⁰ computing N=τN₀ with a selection of τ such that N is a quadratic residue modulo pⁿ⁰; calculating n satisfying the inequalities pⁿ⁻¹<N<pⁿ and calculating a solution toN≡A² (mod pⁿ) (189)by using the representation

$\begin{array}{cc}A=\sum _{i=0}^n{\omega }_i{p}^i& \left(190\right)\end{array}$ where w_i satisfies the condition0<ω_i<pⁿ⁻ⁱ.  (191)

There is the step of decrypting with the computer the signal W with the public key N₀ and the prime factors of integer N₀. There is the step of displaying on a display by the computer the decrypted signal W. There is the step of reviewing the decrypted signal W to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law.

There may be the second computer generated steps of defining M=2^h+1, for N=r×s with r>s, take the solution 1 and construct relations

$\begin{array}{cc}\{\begin{array}{c}r=A+U\times p-V\times p^2\\ s=A-U\times p-V\times p^2\end{array}& \left(192\right)\end{array}$ with U, V as unknowns; forming a set of Supercongruence equations by matching coefficients of N and coefficients of (A+U×p−V×p²)(A−U×p−V×p²), the set of Supercongruence equations establishes M relations in terms of u_i's and v_i's, which are coefficients of U and V respectively; performing steps 1-4 using the Supercongruence equations where steps 1-7 are as follows:

1) Testing feasibilities of digits u₁'s and u₂'s.

2) Calculating carries by tallying differences on two sides of the Supercongruence equations.

3) Using carries to identify subsequent digits given a feasible pair of u₁ and u₂ by using Supercongruence equations again.

4) Using the Euclidean algorithm to test whether A+U×p−V×p² is a divisor of N₀.

There may be the step of enabling the alerting of a government agency to prevent the act that will occur to prevent physical damage or bodily injury to a person occurring. The steps described herein allows for the ability to alert a desired government agency if a review of the decrypted signal W indicates that an alert is warranted.

By using the methods described herein, N₀ is factored in time O(log⁶N₀). This speed is important, which only the operation of the second computer performing the second computer generated steps can achieve, because by having this speed for factoring, the signal W representative of a message can be effectively decrypted and deciphered in real time so any threat to property or individuals can be quickly acted upon to eliminate the threat before it occurs and actual damage to property or injury to individuals is prevented or mitigated. In other words, for W to be effectively understood, it must by decrypted fast enough that any threat identified in W can be stopped. The present invention with the use of the second computer allows for this capability. Here, it is inherent that to save lives if required, the second computer is required.

There may be the step of obtaining the electromagnetic signal W representative of a message from a telecommunications network, or a data network or an Internet or a non-transient memory. Law enforcement departments, such as Homeland Security, the FBI, the CIA, NSA, state and local Police or the Military have the well-known capability of obtaining or intercepting messages sent encrypted by a first computer operated by a potential terrorist or criminal as an electromagnetic signal, such as by smart phone or computer or intemet, or stored in the memory of a smart phone or computer, or a flash drive. The encrypted electromagnetic signal W can be extracted from such messages or memories and operated upon by the techniques described herein to decrypt the encrypted messages and read them to determine whether there is any violation of law or threat to property or individuals. Of course, the intended recipient of the encrypted message W by the first computer has the key so the recipient can decrypt the encrypted message W the recipient has received and understand it. It is the object of this invention, and the problem this invention solves, to allow a recipient of the encrypted message W who does not have the key to read it, to determine what the key N₀ is by the techniques described here, and then using the determined key N₀, decrypting the encrypted message W, reviewing what the decrypted message says, and acting as necessary to protect property damage or bodily injury or any type of crime, as deemed appropriate.

The present invention pertains to a second computer for decoding an encrypted electromagnetic signal W representative of a message encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers and W is a function of r and s, comprising:

• • a non-transient memory in which the signal W is stored;

decoding with a CPU in communication with the memory the signal Win the memory that decodes the signal W by the second computer generated steps of selecting a prime number p of the form p=4k+1 for an odd integer k such that the public key N₀ is a non-quadratic residue modulo p; calculating n₀ satisfying the inequalities pⁿ⁰⁻¹<N₀<pⁿ⁰ computing N=τN₀ with a selection of τ such that N is a quadratic residue modulo pⁿ⁰; calculating n satisfying the inequalities pⁿ⁻¹<N<pⁿ; and calculating a solution toN≡A² (mod pⁿ)  (193)by using the representation

$\begin{array}{cc}A=\sum _{i=0}^n{\omega }_i{p}^i& \left(194\right)\end{array}$ where w_i satisfies the condition0<ω_i<pⁿ⁻ⁱ,  (195)the CPU decrypting the signal W with the public key N₀ and the prime factors of integer N₀; and a display on which the decrypted signal W is displayed so the decrypted signal W can be reviewed to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law or will violate a law. The display can be a computer screen or smart phone screen or any screen or piece of paper on which the decrypted signal W is printed or any medium on which the decrypted signal W can be reviewed.

The CPU of the second computer may perform the CPU generated steps of defining M=2^h+1 for N₀=r×s with r>s, take the solution 1 and construct relations

$\begin{array}{cc}\{\begin{array}{c}r=A+U\times p-V\times p^2\\ s=A-U\times p-V\times p^2\end{array}& \left(196\right)\end{array}$ with U, V as unknowns; forming a set of Supercongruence equations by matching coefficients of N and coefficients of (A+U×p−V×p²)(A−U×p−V×p²), the set of Supercongruence equations establishes M relations in terms u_i's and v_i's, which are coefficients of U and V respectively; performing steps 1-4 using the Supercongruence equations where steps 1-4 are as follows:

1) Testing feasibilities of digits u₁'s and u₂'s.

2) Calculating carries by tallying differences on two sides ofthe Supercongruence equations.

3) Using carries to identify subsequent digits given a feasible pair of u₁ and u₂ by using Supercongruence equations again.

4) Using the Euclidean algorithm to test whether A+U×p−V×p² is a divisor of N₀.

N₀ is factored by the CPU of the second computer in the time O(log⁶N₀).

The present invention pertains to a non-transitory readable storage medium which includes a computer program stored on the storage medium for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N₀=r×s, where N₀, r and s are integers and W is a function of r and s, where the signal W has been stored in a non-transient memory of a second computer, having the second computer generated steps of:

Selecting a prime number p of the form p=4k+1 for an odd integer k such that the public key N₀ is a non-quadratic residue modulo p; calculating n₀ satisfying the inequalities pⁿ⁰⁻¹<N₀<pⁿ⁰ computing N=τN₀ with a selection of τ such that N is a quadratic residue modulo pⁿ⁰; calculating n satisfying the inequalities pⁿ⁻¹<N<pⁿ; and calculating a solution toN≡A² (mod pⁿ)  (197)by using the representation

$\begin{array}{cc}A=\sum _{i=0}^n{\omega }_i{p}^i& \left(198\right)\end{array}$ where w_i satisfies the condition0<ω_i<pⁿ⁻¹.  (199)

There is the step of decrypting with the second computer the signal W with the public key N₀ and the prime factors of integer N₀. There is the step of displaying on a display by the second computer the decrypted signal W. There is the step of reviewing the decrypted signal W for predetermined words to determine if the decrypted signal W indicates an act has occurred or will occur that violates a law, or will violate a law. It is well know in the art to search for words, such as bomb or gun, to flag a message for further review for possible action, as deemed appropriate.

The computer program may have the second computer generated steps of defining M=2^h+1 for N₀=r×s with r>s, take the solution 1 and construct relations

$\begin{array}{cc}\{\begin{array}{c}r=A+U\times p-V\times p^2\\ s=A-U\times p-V\times p^2\end{array}& \left(200\right)\end{array}$ with U, V as unknowns; forming a set of Supercongruence equations by matching coefficients of N and coefficients of (A+U×p−V×p²)(A−U×p−V×p²), the set of Supercongruence equations establishes M relations in terms of u_i's and v_i's, which are coefficients of U and V respectively; performing steps 1-4 using the Supercongruence equations where steps 1-4 are as follows:

1) Testing feasibilities of digits u_i's and v_i's.

2) Calculating carries by tallying differences ontwo sides of the Supercongruence equations.

3) Using carries to identify subsequent digits given a feasible pair of u₁ and u₂ by using Supercongruence equations again.

4) Using the Euclidean algorithm to test whether A+U×p−V×p² is a divisor of N₀.

Although the invention has been described in detail in the foregoing embodiments for the purpose of illustration, it is to be understood that such detail is solely for that purpose and that variations can be made therein by those skilled in the art without departing from the spirit and scope of the invention except as it may be described by the following claims.

Claims

1. A method for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N0=r×s, where N0, r and s are integers comprising the steps of: obtaining the electromagnetic signal W from a telecommunications network, or a data network or an Internet or a first non-transient memory;storing the signal W in a second non-transient memory;decoding with a second computer in communication with the second non-transient memory the signal W in the memory by factoring the public key N0 in time O(log6 N0) with the second computer generated steps of

2. The method of claim 1 including the second computer generated steps of defining M=2h+1, for N=r×s with r>s, and constructing relations

3. The method of claim 2 enabling alerting a government agency to prevent the act that will occur to prevent physical damage or bodily injury to a person occurring.

4. A second computer for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N0=r×s, where N0, r and s are integers and W is a function of r and s, comprising: an input for obtaining the electromagnetic signal W from a telecommunications network, or a data network or an Internet or a first non-transient memorya second non-transient memory in communication with the input in which the signal W is stored;a cpu in communication with the second non-transient memory the signal W in the memory that decodes the signal W by factoring the public key N0 in time O(log6 N0) by the second computer generated steps of selecting a prime number p of the form p=4k+1 for an odd integer k such that the public key N0 is a non-quadratic residue modulo p; calculating n0 satisfying the inequalities pn0−1<N0<pn0; computing N=τN0 with a selection of τ such that N is a quadratic residue modulo p; calculating n satisfying the inequalities pn−1<N<pn; and calculating a solution to N≡A2 (mod pn)

5. The apparatus of claim 4 wherein the cpu of the second computer performs the cpu generated steps of defining M=2h+1, for N=r×s with r×s, and constructing relations

6. A non-transitory readable storage medium which includes a computer program stored on the storage medium for decoding an encrypted electromagnetic signal W encoded by a first computer with public key N0=r×s, where N0, r and s are integers and W is a function of r and s, where the signal W has been stored in a second non-transient memory of a second computer, and the second computer factoring the public key N0 in time O(log6 N0), the signal W obtained from a telecommunications network, or a data network or an Internet or a first non-transient memory, the computer program having the second computer generated steps of: selecting a prime number p of the form p=4k+1 for an odd integer k such that the public key N0 is a non-quadratic residue modulo p; calculating n0 satisfying the inequalities pn0−1<N0<pn0; computing N=τ N0 with a selection of τ such that N is a quadratic residue modulo p; calculating n satisfying the inequalities pn−1<N<pn; and calculating a solution to N≡A2 (mod pn)

7. The storage medium of claim 6 having the second computer generated steps of defining M=2h+1, for N=r×s with r>s, and constructing relations