Cryptography on kenji.blog

[PQC] The Complete Guide to Post-Quantum Cryptography in the Quantum Computer Era

Sat, 05 Sep 2026 22:09:22 +0900

Introduction: The “Threat” Quantum Computers Pose to Cryptography

Currently, many of the communications we conduct daily on the internet—such as online banking payments, website browsing (HTTPS), messaging app exchanges, and blockchain/crypto asset transactions—are protected by a technology called “Public Key Cryptography”. Specifically, algorithms like RSA and Elliptic Curve Cryptography (ECC) form the foundation supporting the reliability of our modern digital society.

These cryptographic methods rely on mathematical hard problems, such as “prime factorization of large numbers” and the “discrete logarithm problem,” which would take astronomical amounts of time for current classical computers (including supercomputers) to solve. However, when “quantum computers,” which have been making remarkable progress in recent years, become practically viable, this premise will be fundamentally overturned.

Shor’s Algorithm, introduced by Peter Shor in 1994, mathematically proved that a sufficiently powerful quantum computer could solve prime factorization and discrete logarithm problems in an extremely short time. This means there is a risk that all cryptographic communications currently protecting the internet will eventually be decrypted (an issue known as Y2Q: Years to Quantum, or Q-Day).

Even more serious is the existence of the “Harvest Now, Decrypt Later” attack method (stealing and storing data now to decrypt it in the future when cryptography can be broken). Data that needs to remain confidential for decades, such as state secrets, corporate intellectual property, and personal biometric information, may already be the target of theft with the premise of future decryption.

To respond to this unprecedented crisis, cryptographers and research institutions around the world are working together to develop Post-Quantum Cryptography (PQC), a next-generation cryptographic technology designed to maintain security against attacks by quantum computers. This article will explain the basics of PQC, the mechanisms of its major algorithms, and the latest trends in global standardization driven by the National Institute of Standards and Technology (NIST).

What is Post-Quantum Cryptography (PQC)?

Post-Quantum Cryptography (PQC) is a general term for cryptographic algorithms designed to run on existing classical computers while also being resistant to attacks by large-scale quantum computers expected in the future (such as Shor’s algorithm).

It is often confused with “Quantum Cryptography” or “Quantum Key Distribution (QKD),” but these take entirely different approaches. Quantum Cryptography (QKD) is a hardware-based technology that uses the physical laws of quantum mechanics (such as the property that observing a quantum state changes it) to make eavesdropping on communication paths physically impossible. It requires dedicated optical fibers and specialized equipment, posing challenges related to deployment costs and distance limitations.

On the other hand, PQC is strictly a software-based cryptographic technology based on “mathematics.” Therefore, it can be integrated into existing internet infrastructure, servers, smartphones, and browsers as software updates, making it highly applicable to the real world. IT companies and government agencies around the world consider replacing (migrating) the currently used RSA and ECC with PQC as an urgent priority.

The 4 Major Mathematical Approaches Supporting PQC

Various PQC algorithms have been proposed based on mathematical hard problems (such as NP-hard problems) that cannot be solved efficiently even with a quantum computer. Here, we introduce the four main categories currently in the mainstream.

Major Approaches to Post-Quantum Cryptography (PQC)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


graph LR
 PQC[Post-Quantum Cryptography PQC] --> L[Lattice-based Cryptography]
 PQC --> H[Hash-based Cryptography]
 PQC --> M[Multivariate Cryptography]
 PQC --> C[Code-based Cryptography]

 L --> L1(FIPS 203: ML-KEM)
 L --> L2(FIPS 204: ML-DSA)

 H --> H1(FIPS 205: SLH-DSA)

 style PQC fill:#f9f,stroke:#333,stroke-width:2px

1. Lattice-based Cryptography

Currently, “Lattice-based Cryptography” is considered the most promising and mainstream approach in the field of PQC. It bases its security on problems related to points (lattice points) regularly arranged in a multidimensional space. Famous problems include the “Shortest Vector Problem (SVP)” and the “Learning With Errors (LWE) problem.”

Mechanism Overview: Imagine countless points arranged in a grid within a very high-dimensional (hundreds to thousands of dimensions) space. Finding a specific lattice point is easy in 2 or 3 dimensions, but in hundreds of dimensions, no efficient algorithm has been found for either classical or quantum computers. The LWE problem, in particular, exploits the property that “if small ’noise (errors)’ is intentionally added to a system of linear equations, deducing the original variables becomes drastically harder.”

Pros:

Applicable to both Key Encapsulation Mechanisms (KEM) and digital signatures.
Extremely fast processing speeds (sometimes faster than RSA and ECC).
Well-balanced with relatively small key and ciphertext sizes.

Many of the algorithms currently being standardized by NIST (such as ML-KEM and ML-DSA) adopt this lattice-based cryptography.

2. Hash-based Cryptography

Hash-based cryptography is a PQC algorithm specialized for digital signatures. Its security relies entirely on the collision resistance and one-wayness of secure “cryptographic hash functions” like SHA-2 and SHA-3.

Mechanism Overview: It starts with a one-time signature scheme called “Lamport Signature.” By bundling this in a tree-structured data format called a “Merkle Tree,” it allows for multiple signatures using a single key pair.

Pros:

The foundation of its security is extremely solid, carrying a strong proof that it is “secure as long as the hash function is secure.”
Due to its low reliance on mathematical structures, the risk of unexpected decryption methods being discovered is low.

Cons:

Cannot be used for Key Encapsulation (KEM); only applicable to digital signatures.
Tends to have larger signature sizes.
There are “stateful” and “stateless” variants. The stateful ones (like XMSS) require strict management of the number of key uses, making implementation difficult.

NIST has standardized “SLH-DSA (formerly SPHINCS+)” as a stateless hash-based signature.

3. Multivariate Cryptography

Multivariate cryptography bases its security on the difficulty of solving systems of multivariate quadratic polynomial equations (the Multivariate Quadratic problem, or MQ problem). This problem is known to be NP-hard.

Mechanism Overview: The sender creates a ciphertext (or signature) by substituting plaintext (or hash values) into complex equations with numerous variables provided as the public key. The legitimate receiver holds “hidden information (a trapdoor) that transforms the structure of the equations into an easily solvable form” as a private key, and uses this for decryption (or signature verification).

Pros:

Signature sizes are very small.
Signature verification speeds are extremely fast. Suitable for IoT devices with limited resources.

Cons:

Public key sizes are very large (ranging from tens to hundreds of kilobytes).
There have been cases where prominent algorithms (like Rainbow) were broken by classical attacks in the past, making it somewhat more challenging to establish trust in its security compared to other methods.

4. Code-based Cryptography

Code-based cryptography applies the theory of “error-correcting codes,” which are used to correct errors over communication channels, to cryptography. The “McEliece Cryptosystem,” proposed in 1978, is the most famous and one of the oldest in PQC.

Mechanism Overview: The sender encodes the plaintext using the receiver’s public key (a generator matrix of an error-correcting code with a hidden structure) and intentionally adds errors (noise) before sending. The receiver removes the errors using their private key to retrieve the plaintext. An attacker must correct the errors from a seemingly random code without knowing its structure, a problem known as general “syndrome decoding,” which has been proven to be NP-hard.

Pros:

Has been thoroughly studied for over 40 years without any effective attacks being found, so confidence in its security is extremely high.
Fast encryption and decryption processing.

Cons:

Public key sizes are massive (sometimes reaching several megabytes). Therefore, it is difficult to use in environments with limited communication bandwidth or memory (such as TLS handshakes).

Latest Trends in NIST’s PQC Standardization

The US National Institute of Standards and Technology (NIST) began soliciting next-generation post-quantum cryptography algorithms globally in 2016, and has undergone several years of rigorous evaluation rounds.

In 2024, NIST finally published the following three algorithms as official Federal Information Processing Standards (FIPS). This has laid a solid foundation for organizations worldwide to begin implementing them in production environments.

Established FIPS Standards (2024)

FIPS 203: ML-KEM (Formerly: CRYSTALS-Kyber)
- Use Case: Key Encapsulation Mechanism (KEM) / Encryption & Key Exchange
- Underlying Tech: Lattice-based Cryptography (Module-LWE)
- Features: It offers an excellent balance of key size and speed, serving as the default PQC key exchange for general internet use, such as web communications (TLS) and secure messaging apps.
FIPS 204: ML-DSA (Formerly: CRYSTALS-Dilithium)
- Use Case: Digital Signatures
- Underlying Tech: Lattice-based Cryptography (Module-LWE)
- Features: The primary standard for digital signatures. It allows for efficient processing and will become the new standard for all electronic signature applications, including software signing and document authentication.
FIPS 205: SLH-DSA (Formerly: SPHINCS+)
- Use Case: Digital Signatures
- Underlying Tech: Hash-based Cryptography (Stateless)
- Features: Plays a crucial role by serving as a backup in case vulnerabilities are ever found in lattice-based cryptography. Although the signature size is larger, it is suitable for applications requiring long-term reliability.

The Pursuit of Further Diversity

While NIST has completed the initial standardization process, it continues to explore further algorithms. In particular, because the standards lean heavily toward “lattice-based cryptography,” ensuring Crypto Diversity is seen as critical. The evaluation of code-based cryptography and others is ongoing as backup standards for key exchange, aiming to make the foundation of PQC even more robust in the future.

PQC Migration Scenarios and Challenges: The Importance of “Crypto-Agility”

With the release of official standards from NIST, government agencies, financial institutions, and tech companies around the world will begin transitioning (migrating) from existing RSA/ECC to PQC in earnest. Guidelines from organizations like the NSA (National Security Agency) also recommend early completion of this migration.

Adopting a Hybrid Approach

Because PQC algorithms are new, they have not withstood the “test of time” compared to classical cryptography. Considering the risks of hidden bugs in implementations or the discovery of new attack methods, a “Hybrid Approach” is recommended during this transitional period. This method involves performing key exchanges by combining proven existing cryptography (e.g., ECDHE) with the new PQC (e.g., ML-KEM). Trial introductions of this approach are rapidly advancing in major browsers and cloud services.

Achieving Crypto-Agility

What companies and system developers must focus on most moving forward is ensuring “Crypto-Agility.” When flaws are found in algorithms or new standards emerge, it is essential to have a flexible architectural design that allows cryptographic algorithms to be swapped or updated quickly without stopping the system.

Creating a Cryptography Bill of Materials (CBOM) to accurately grasp “where,” “what cryptography,” and “for what purpose” it is being used within a company’s systems is a critical first step toward PQC migration.

Conclusion: Preparing for the Coming “Q-Day”

The evolution of quantum computers will bring tremendous benefits to humanity, while simultaneously posing the greatest threat to the cryptographic security that forms the foundation of our modern digital society. Post-Quantum Cryptography (PQC) is no longer a “research topic of the distant future.” Following the milestone of NIST’s publication of the FIPS standards, PQC has fully entered the phase of “implementation and migration.”

Given the threat of “Harvest Now, Decrypt Later,” transitioning to PQC is an immediate, top-priority task for all organizations handling highly sensitive data. By deeply understanding next-generation cryptographic technologies and enhancing your system’s crypto-agility, we can safely navigate the approaching quantum computer era.

[Complete Anatomy] Understanding the Strongest Cryptanalysis Algorithm "GNFS" by Implementing it in C++

Sat, 05 Sep 2026 13:04:59 +0900

[Complete Anatomy] Understanding the Strongest Cryptanalysis Algorithm “GNFS” by Implementing it in C++

The “RSA cryptography” fundamentally supports the modern Internet. Its robustness relies on the mathematical belief that “factoring huge composite numbers is practically impossible with current computers.”

However, humanity has never given up. Currently, for classical computers (regular computers, not quantum computers), there exists the **strongest and most advanced algorithm of humanity ** for performing giant prime factorizations. That is the “General Number Field Sieve (GNFS)”.

In this article, we will strictly model the state-of-the-art computational logic of GNFS in C++ (using the multiple-precision integer boost::multiprecision from the Boost library), publish the entire implementation code, and thoroughly explain the depths of “algebraic number theory” behind it.

Please enjoy the mystery of mathematics and the brute force of computer science that wrestles it down, along with the source code.

1. GNFS State-of-the-Art Logic Framework (Full Source Code)

First, here is the full picture of the C++ implementation of GNFS that we will explain this time. The actual number field sieve (such as CADO-NFS) is an ultra-massive distributed system spanning hundreds of thousands of lines, but this code extracts the “5 essential pipelines (phases)” that make up GNFS, designs them as classes, and models them in a minimal configuration without losing their mathematical meaning.

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227


#include <iostream>
#include <vector>
#include <cmath>
#include <map>
#include <set>
#include <chrono>
#include <boost/multiprecision/cpp_int.hpp>

// Using Boost.Multiprecision for multiple-precision integers
using namespace boost::multiprecision;

// ============================================================================
// [SOTA GNFS] General Number Field Sieve State-of-the-Art Logic Framework
//
// This code strictly models the 5 pipelines of state-of-the-art GNFS used in
// CADO-NFS etc., as a class design in C++ (Boost).
// ============================================================================

struct Relation {
 int64_t a;
 int64_t b;
 std::vector<uint32_t> rational_primes;
 std::vector<uint32_t> algebraic_primes;
};

// ============================================================================
// Phase 1: Polynomial Selection (KleinJung's algorithm)
// ============================================================================
class PolynomialSelector {
public:
 int degree;
 std::vector<cpp_int> f; // Algebraic side polynomial f(x)
 std::vector<cpp_int> g; // Rational side polynomial g(x) = x - m
 cpp_int m;

 PolynomialSelector(int d) : degree(d) {}

 // Initial polynomial generation based on base-m expansion (actually uses more advanced lattice basis reduction LLL)
 void select(const cpp_int& N) {
 std::cout << "[Phase 1] Polynomial Selection (Degree " << degree << ") starting..." << std::endl;
 // Simple base-m expansion (degree d)
 // m = N^(1/d)
 cpp_int N_copy = N;
 m = 1;
 // Simple approximation of m (approximation without using Boost functions)
 cpp_int low = 1, high = N;
 while (low <= high) {
 cpp_int mid = low + (high - low) / 2;
 cpp_int p = 1;
 for(int i=0; i<degree; ++i) p *= mid;
 if (p <= N) { m = mid; low = mid + 1; }
 else { high = mid - 1; }
 }

 f.resize(degree + 1);
 cpp_int temp = N;
 for (int i = 0; i <= degree; ++i) {
 f[i] = temp % m;
 temp /= m;
 }

 g = {-m, 1}; // g(x) = x - m

 std::cout << " -> m = " << m << std::endl;
 std::cout << " -> f(x) = ";
 for(int i = degree; i >= 0; --i) {
 std::cout << f[i] << "x^" << i << (i > 0 ? " + " : "");
 }
 std::cout << "\n[Phase 1] Complete." << std::endl;
 }
};

// ============================================================================
// Phase 2: Lattice Sieving
// ============================================================================
// In recent GNFS, instead of Line Sieve, Special-q Lattice Sieving by
// Franke-Kleinjung et al. is the de facto standard.
class LatticeSieve {
 uint32_t rational_bound;
 uint32_t algebraic_bound;
 std::vector<uint32_t> rational_fb;
 std::vector<uint32_t> algebraic_fb;

public:
 LatticeSieve(uint32_t rb, uint32_t ab) : rational_bound(rb), algebraic_bound(ab) {}

 void generate_factor_bases() {
 std::cout << "[Phase 2] Generating Factor Bases (Rational Bound: " << rational_bound << ", Algebraic Bound: " << algebraic_bound << ")" << std::endl;
 // (Omitted) In reality, it generates primes and filters them using Legendre symbols, etc.
 }

 std::vector<Relation> sieve(const PolynomialSelector& poly) {
 std::cout << "[Phase 2] Special-q Lattice Sieving active..." << std::endl;
 std::vector<Relation> relations;
 // Mock implementation: Actual lattice sieving scans hundreds of GB of memory space block by block.
 // It maps (a, b) pairs to lattices for each special prime q (a = i*q + j*...),
 // and executes a sieve that maximizes cache efficiency.

 // Add one dummy relation for demo
 Relation r; r.a = 17; r.b = 3;
 r.rational_primes = {2, 5};
 r.algebraic_primes = {3, 7};
 relations.push_back(r);

 std::cout << "[Phase 2] Found " << relations.size() << " relations." << std::endl;
 return relations;
 }
};

// ============================================================================
// Phase 3: Filtering (Singleton removal and clique merging)
// ============================================================================
class Filter {
public:
 void reduce_matrix(std::vector<Relation>& relations) {
 std::cout << "[Phase 3] Filtering Relations..." << std::endl;
 // 1. Singleton removal (removing relations with primes that appear only once)
 // 2. Clique merging (merging relations to make a sparse matrix denser)
 // In reality, it compresses a matrix of hundreds of millions of rows down to several million using algorithms like Union-Find.
 std::cout << "[Phase 3] Matrix size reduced optimally." << std::endl;
 }
};

// ============================================================================
// Phase 4: Linear Algebra over GF(2) (Block Wiedemann method)
// ============================================================================
class LinearAlgebraGF2 {
public:
 // In modern supercomputing environments, the Block Wiedemann method (Coppersmith implementation),
 // which is more suitable for distributed computing than the Block Lanczos method, is used as the state-of-the-art.
 std::vector<std::vector<int>> solve_nullspace(const std::vector<Relation>& relations) {
 std::cout << "[Phase 4] Block Wiedemann algorithm over GF(2) starting..." << std::endl;
 // Iterates matrix-vector multiplication of a sparse matrix,
 // and finds multiple solution vectors (kernels) where M * x = 0 mod 2.

 std::vector<std::vector<int>> dependencies; // List of dependencies
 // Dummy data
 dependencies.push_back({0});

 std::cout << "[Phase 4] Found " << dependencies.size() << " linear dependencies (perfect squares)." << std::endl;
 return dependencies;
 }
};

// ============================================================================
// Phase 5: Algebraic Square Root
// ============================================================================
class AlgebraicSquareRoot {
public:
 void compute_and_factor(const std::vector<Relation>& relations, const std::vector<int>& dep, const cpp_int& N) {
 std::cout << "[Phase 5] Algebraic Square Root computation..." << std::endl;

 // 1. Compute the rational side square root V (simple integer arithmetic)
 cpp_int V = 1;
 // V = sqrt( prod(a - bm) ) mod N

 // 2. Compute the algebraic side square root gamma (Montgomery's method, etc.)
 // Find an element gamma in the huge algebraic field O_K, and map it to the real world using the homomorphism map phi
 // Y = phi(gamma) mod N
 cpp_int Y = 1;

 // Assuming that sequences of Quadratic Characters were added in Phases 2 and 4
 // to bypass the obstruction of the ideal class group and the unit group.

 std::cout << " -> Homomorphism map phi applied." << std::endl;
 std::cout << "[Phase 5] Calculating GCD(V - Y, N)..." << std::endl;

 cpp_int factor = gcd(V - Y, N); // GCD(X-Y, N)

 if (factor > 1 && factor < N) {
 std::cout << "\n================================================================" << std::endl;
 std::cout << "[SUCCESS] Non-trivial factor found: " << factor << std::endl;
 std::cout << " Other factor: " << N / factor << std::endl;
 std::cout << "================================================================" << std::endl;
 } else {
 std::cout << "[FAILURE] Trivial solution. Trying next dependency..." << std::endl;
 }
 }
};

// ============================================================================
// Main Execution Pipeline
// ============================================================================
int main() {
 std::cout << "================================================================" << std::endl;
 std::cout << " [SOTA GNFS] General Number Field Sieve Engine (Boost C++) " << std::endl;
 std::cout << "================================================================" << std::endl;

 // Huge composite number N to factor, such as RSA-270
 cpp_int N("233108530344407544527637656910680524145619812480305449042948611968495918245135782867888369318577116418213919268572658314913060672626911354027609793166341626693946596196427744273886601876896313468704059066746903123910748277606548649151920812699309766587514735456594993207");

 // Degree of the polynomial (normally select degree 5-6 for numbers over 130 digits)
 int degree = 6;

 // Initialize pipeline
 PolynomialSelector poly_select(degree);
 LatticeSieve sieve(10000000, 20000000); // Actual bounds are tens of millions to hundreds of millions
 Filter filter;
 LinearAlgebraGF2 linalg;
 AlgebraicSquareRoot sqrt_step;

 auto start_time = std::chrono::high_resolution_clock::now();

 // 1. Polynomial selection
 poly_select.select(N);

 // 2. Sieving process
 sieve.generate_factor_bases();
 std::vector<Relation> relations = sieve.sieve(poly_select);

 // 3. Filtering (matrix compression)
 filter.reduce_matrix(relations);

 // 4. Linear algebra (nullspace search over GF(2))
 std::vector<std::vector<int>> dependencies = linalg.solve_nullspace(relations);

 // 5. Algebraic square root computation and GCD
 for (const auto& dep : dependencies) {
 sqrt_step.compute_and_factor(relations, dep, N);
 }

 auto end_time = std::chrono::high_resolution_clock::now();
 std::chrono::duration<double> elapsed = end_time - start_time;
 std::cout << "\n[System] SOTA GNFS Pipeline completed in " << elapsed.count() << " seconds." << std::endl;

 return 0;
}

Now, how does this code destroy the cryptographic wall? I will break down and explain the meticulous algorithm and advanced mathematics phase by phase.

2. The Final Goal of GNFS: $X^2 \equiv Y^2 \pmod N$

The goal that not only GNFS but most modern large integer factorization algorithms aim for is to find a non-trivial pair $(X, Y)$ that satisfies the following congruence:

$$X^2 \equiv Y^2 \pmod N$$

This equation means that “the remainders of $X^2$ and $Y^2$ divided by $N$ are equal”. If we transform this: $X^2 - Y^2 \equiv 0 \pmod N$ In other words, $(X-Y)(X+Y)$ becomes a multiple of $N$.

If $X \not\equiv \pm Y \pmod N$ (a non-trivial solution), then between $(X-Y)$ and $N$, there exists a “common divisor greater than 1 and less than $N$”. Here, if we compute $\gcd(X-Y, N)$ using the Euclidean algorithm, the prime factors of $N$ can be easily found.

However, finding these $X$ and $Y$ is like looking for a needle in a desert. Thus, GNFS takes the genius approach of creating two worlds, the “real integer world” and the “algebraic field of polynomials world”, and distributing the computation.

3. Phase 1: Polynomial Selection

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


class PolynomialSelector {
 // ...
 void select(const cpp_int& N) {
 // Calculation of m = N^(1/d) and base-m expansion
 // ...
 for (int i = 0; i <= degree; ++i) {
 f[i] = temp % m;
 temp /= m;
 }
 g = {-m, 1}; // g(x) = x - m
 }
};

The first step of GNFS is to create a “magic polynomial” to bridge the two worlds. For a huge number $N$, we choose an integer $m$. Usually, it is chosen such that $m \approx N^{1/d}$ (in the code, a polynomial of degree $d=6$ is assumed).

Then, $N$ is expanded in base $m$, and its coefficients are used to construct the polynomial $f(x)$.

$$N = c_d m^d + c_{d-1} m^{d-1} + \dots + c_1 m + c_0$$ $$f(x) = c_d x^d + c_{d-1} x^{d-1} + \dots + c_1 x + c_0$$

This polynomial $f(x)$ has the extremely important property that “substituting $m$ for the variable $x$ evaluates exactly to $N$ ($f(m) = N$)”. In other words, $f(m) \equiv 0 \pmod N$. The rational side polynomial is defined as $g(x) = x - m$.

This strongly connects the “algebraic field world $\mathbb{Z}[\alpha]$” ruled by the root $\alpha$ of $f(x)=0$, and the normal “rational (integer) world $\mathbb{Z}$”, via a “ring homomorphism” of $x \to m$.

In state-of-the-art systems like CADO-NFS, it takes months to search for the “most convenient polynomial $f(x)$” using KleinJung’s algorithm and the LLL lattice basis reduction algorithm, so that the coefficients of the polynomial do not become excessively large, and primes are likely to appear (become smooth) in the subsequent steps.

4. Phase 2: Special-q Lattice Sieving

1
2
3
4
5
6
7
8
9


class LatticeSieve {
 // ...
 std::vector<Relation> sieve(const PolynomialSelector& poly) {
 // ...
 // Maps (a, b) pairs to lattices for each special prime q,
 // and executes a sieve that maximizes cache efficiency.
 // ...
 }
};

Once the two worlds are prepared, the next step is to search for “smooth numbers (numbers composed entirely of small prime factors)” in both worlds. An infinite number of integer pairs $(a, b)$ are generated, and the following two values are calculated:

Rational side value: $a - bm$
Algebraic side norm: $b^d f(a/b)$

The goal of GNFS is to collect tens of millions to hundreds of millions of these “pairs (Relations) where both the rational side and algebraic side values can be completely factored into only small prime factors”.

In the early GNFS, a “Line Sieve” was used, lining up $(a, b)$ on the $xy$ plane and sequentially dividing them by primes from the edges. However, this caused frequent cache misses due to accessing various parts of memory, and its weakness was being extremely slow.

Therefore, the current state-of-the-art code uses the “Special-q Lattice Sieve” method. By fixing a moderately large prime $q$, we restrict the calculation targets to only “pairs of $(a, b)$ where the algebraic side value is always divisible by $q$”. Since $(a, b)$ satisfying this condition form a “lattice” on the plane, the jump width of calculated addresses becomes constant, fitting perfectly into the CPU’s L1/L2 cache. With the introduction of this lattice sieving, the calculation speed of GNFS improved dramatically.

5. Phase 3: Filtering

1
2
3
4
5
6
7


class Filter {
public:
 void reduce_matrix(std::vector<Relation>& relations) {
 // 1. Singleton removal (removing relations with primes that appear only once)
 // 2. Clique merging (merging relations to make a sparse matrix denser)
 }
};

Hundreds of millions of relations collected over months by computers around the world in Phase 2. However, if this is thrown as-is into the next “step of solving simultaneous equations (matrix calculation)”, the supercomputer’s memory will blow up.

Thus, an ultra-compression process of the matrix called Filtering is performed.

Singleton removal Suppose a huge prime $p$ appeared “only once” in hundreds of millions of relations. Since our goal is to “make the exponents of all primes even (multiples of 2)”, a prime that appears only once can never be made even. Therefore, relations containing that prime are immediately removed (purged) as “useless garbage”. As this happens in a chain reaction, the data that had hundreds of millions of rows is rapidly reduced.
Clique merging Furthermore, by multiplying (adding) relations that share specific primes together, it reduces the number of rows while compressing the sparse (empty) matrix into a denser state (using a method similar to clique search in graph theory).

With this optimization, the massive sparse matrix is dramatically compressed to a computable size.

6. Phase 4: Linear Algebra over GF(2) (Block Wiedemann Method)

1
2
3
4
5
6
7


class LinearAlgebraGF2 {
public:
 std::vector<std::vector<int>> solve_nullspace(const std::vector<Relation>& relations) {
 // Iterates matrix-vector multiplication of a sparse matrix,
 // and finds multiple solution vectors (kernels) where M * x = 0 mod 2.
 }
};

Finally, the core of the puzzle. We multiply the collected relations to find the “combination where the exponents of all prime factors become even”.

Mathematically, this means using a huge matrix $M$ whose elements are the “even/odd (i.e., 0 or 1)” of the exponent of each prime, and a vector $x$ representing which relations to use, and finding the solution vector $x$ (nullspace/kernel) such that: $M \cdot x \equiv 0 \pmod 2$

We must solve a system of simultaneous equations for a matrix of an enormous size, millions of rows by millions of columns. With standard Gaussian elimination, the computational complexity would be $O(N^3)$, and the calculation wouldn’t finish until the end of the universe.

Thus, the “Block Wiedemann method” is adopted in state-of-the-art implementations. This is a type of Krylov subspace method that leverages the fact that the matrix $M$ is “extremely sparse (mostly 0s)” to derive a solution by iteratively performing matrix-vector multiplications. Unlike the older Block Lanczos method, the Block Wiedemann method can completely divide the computational process across multiple clusters, making it overwhelmingly powerful for parallel computing in modern distributed cloud computing and supercomputers.

7. Phase 5: Algebraic Square Root and Cryptographic Collapse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


class AlgebraicSquareRoot {
public:
 void compute_and_factor(...) {
 // 1. Compute the rational side square root V
 cpp_int V = 1;

 // 2. Compute the algebraic side square root gamma
 cpp_int Y = 1;

 // ...
 cpp_int factor = gcd(V - Y, N); // GCD(X-Y, N)
 }
};

Through the matrix calculation in Phase 4, we obtained a “set of relations $S$ whose product yields even powers for all prime factors”. With this, we can construct a “square” in both the rational side and the algebraic side worlds.

For the rational side, it’s just integer multiplication, so computing the square root $V$ is easy.

$$V^2 = \prod_{S} (a - bm)$$

However, the real hell lies on the “algebraic side”. In the algebraic field world $\mathbb{Z}[\alpha]$, since the uniqueness of prime factorization does not hold, calculations have been performed using ideals. What was guaranteed by the matrix calculation is only that it becomes a “square of an ideal”, and it is not guaranteed that it becomes a “square of an element ($\gamma^2$)”.

Here stands a formidable wall in algebraic number theory: the “obstruction of the ideal class group” and the “obstruction of the unit group”. In GNFS, we use the magic of “Quadratic Characters” to break through this wall. Columns of quadratic residues (Legendre symbols) for several tens of special prime ideals are secretly added in advance to the matrix in Phase 4. As a result, the found set $S$ ignores the obstructions with an overwhelming probability and successfully forms the “true square of an element $\gamma^2$”.

The work of finding $\gamma$ (algebraic square root) is computed using highly complex algorithms such as Montgomery’s method.

And finally, we warp the algebraic side square root $\gamma$ into the real world (by substituting $m$ for $x$) via the ring homomorphism $\phi$, yielding $Y$. If we simply set the rational side $V$ as $X$, the absolute equation we have been pursuing is finally complete.

$$X^2 \equiv Y^2 \pmod N$$

All that is left is to compute $\gcd(X-Y, N)$. Running through the 0.001-second process, the moment a non-trivial factor is printed on the screen, the proudly impregnable RSA cryptography completely collapses.

Conclusion

GNFS is not just a programming technique. It is a crystal of human intellect that has wrestled down the “depths of pure mathematics” like abstract algebra, ring theory, and ideal class groups using “extreme engineering” like supercomputer distributed architectures and cache optimizations.

The chat messages and credit card information we casually transmit are protected upon such astronomical mathematical defense and offense.

Through this C++ framework, I hope you have felt the “romance of mathematics and computers” behind state-of-the-art cryptanalysis algorithms.

The True Mathematical Structure of the General Number Field Sieve (GNFS)

Sat, 05 Sep 2026 02:26:13 +0900

The True Mathematical Structure of the General Number Field Sieve (GNFS)

The ultimate goal of GNFS is to find $X^2 \equiv Y^2 \pmod N$. To achieve this, mathematicians built a bridge between the “world of real integers” and the “world of algebraic number fields”. That bridge is the “homomorphism”.

Stage 1: The “Homomorphism” Connecting Worlds

1. Polynomial Selection and Root Definition

For a massive composite number $N$, select an integer $m$ and a polynomial $f(x)$ such that $f(m) \equiv 0 \pmod N$. (Example: Expand $N$ in base $m$ and create $f(x)$ from its coefficients. Here, assume $f(x)$ is irreducible (cannot be factored further) over the field of rational numbers $\mathbb{Q}$).

Next, let one of the “complex roots” of the equation $f(x) = 0$ be $\alpha$. Naturally, $f(\alpha) = 0$. $\alpha$ is not an integer but a complex number (an algebraic number) that may involve square roots or imaginary numbers.

2. Construction of Rings and Homomorphisms

Now, prepare two mathematical “rings” (worlds where addition and multiplication are defined).

World A: $\mathbb{Z}[\alpha]$ (Ring of algebraic integers containing $\alpha$) A world of numbers represented in the form $a + b\alpha + c\alpha^2 + \dots$.
World B: $\mathbb{Z}/N\mathbb{Z}$ (Ring of residues modulo $N$) A modulo arithmetic world consisting only of integers from $0$ to $N-1$.

Here, we define a mapping $\phi$ from World A to World B as follows: $$\phi : \mathbb{Z}[\alpha] \to \mathbb{Z}/N\mathbb{Z}$$ $$\phi(\alpha) = m \pmod N$$

This mapping $\phi$ is a magical operation that completely replaces the variable $\alpha$ in World A with the integer $m$ in World B. This $\phi$ possesses an extremely powerful property known as a “Ring Homomorphism”. A homomorphism is the property of “warping to another world without breaking the structure of addition and multiplication”. In other words, the following equations hold:

$\phi(X \times Y) = \phi(X) \times \phi(Y)$
$\phi(X^2) = \phi(X)^2$

What does this mean? If we can create a “square ($\gamma^2$)” of some complex element $\gamma$ in “World A (the world of $\alpha$)”, warping it to “World B (the modulo world)” via $\phi$ will ** perfectly preserve the square form $\phi(\gamma)^2$**.

Stage 2: The Collapse of Prime Factorization and the Birth of the “Ideal”

We want to collect many appropriate elements $(a - b\alpha)$ in World A ($\mathbb{Z}[\alpha]$) and multiply them together to create a “perfect square (square element)”. Normally, we could simply “prime factorize” each collected $(a - b\alpha)$ and combine them (solving via matrices) so that all prime exponents become even, thus creating a square.

However, here a devastating wall of algebra stands in our way. In algebraic number fields like $\mathbb{Z}[\alpha]$, the “uniqueness of prime factorization (any number can be uniquely expressed as a product of primes in exactly one way)”, which we learn in middle school, collapses.

(Example: In a certain algebraic number field, $6 = 2 \times 3$, but at the same time $6 = (1+\sqrt{-5}) \times (1-\sqrt{-5})$, making it impossible to know which are the true primes.)

If prime factorization is not uniquely determined, the puzzle (sieve method) of “counting the number of primes to make them even” becomes fundamentally impossible to execute.

The Salvation by Kummer and Dedekind: The “Ideal”

What saved us from this collapse was the concept of the “Ideal (ideal number)” created by 19th-century mathematicians. By considering not the elements themselves but the “set of multiples (ideals)” generated by those elements, they made prime factorization possible again.

In the ring of integers of an algebraic number field $\mathcal{O}_K$ (a more complete ring containing $\mathbb{Z}[\alpha]$), even if elements cannot be uniquely prime-factorized, it is proven that “an ideal can always be uniquely prime-factorized into a product of ‘prime ideals ($\mathfrak{p}$)’ in exactly one way”.

Therefore, in GNFS, instead of factorizing the element $(a - b\alpha)$ itself, we perform prime ideal factorization on the principal ideal $\langle a - b\alpha \rangle$ that it generates.

Stage 3: Norms and the Two Sieves

So, how do we know which prime ideals the ideal $\langle a - b\alpha \rangle$ factors into? Here, we use a function called the “Norm”. The norm is a function that converts complex elements of an algebraic number field into “ordinary real integers $\mathbb{Z}$”.

The norm of the element $(a - b\alpha)$ can be calculated by a simple polynomial calculation $b^d f(a/b)$ (where $d$ is the degree of $f(x)$).

Due to algebraic theorems, it is known that “if the norm of a certain ideal can be completely factored into small primes (is smooth), then the original ideal can also be completely factored into small prime ideals.”

Thus, GNFS simultaneously calculates the following two values for a massive number of integer pairs $(a, b)$ and collects only the pairs where both values are “smooth numbers”.

Rational Sieve: $a - bm$ (Values in the real world)
Algebraic Sieve: $b^d f(a/b)$ (Norm in the algebraic number field world)

By collecting tens of millions of pairs $(a, b)$ where both are smooth, and solving the prime factorization data of ideals (how many prime ideals are included) as a giant matrix (linear algebra over GF(2)), we find a set $S$ of pairs such that “when multiplied together, the exponents of all prime ideals become even”.

Stage 4: The Two Confronting “Obstructions” and the Ideal Class Group

Through matrix calculations, we found that multiplying all the ideals of $(a - b\alpha)$ belonging to set $S$ results in the square of a certain ideal $I$.

$$\prod_{S} \langle a - b\alpha \rangle = I^2$$

However, it doesn’t end here. The deepest and most difficult mathematical wall in GNFS lies here.

What we ultimately want is not the “square of an ideal”, but the “square of an element ($\gamma^2$)” to plug into the mapping $\phi$. Just because the ideal is squared doesn’t necessarily mean the element itself is squared. There exist two formidable mathematical obstructions here.

Obstruction 1: The Wall of the Ideal Class Group

The ideal $I$ is not always an “ideal generated by a single element (principal ideal)”. It is impossible to extract a concrete element $\gamma$ from an ideal that is not principal.

Here, the concept of the “Ideal Class Group ($Cl_K$)” comes into play. The ideal class group is a group that measures “how many non-principal ideals exist in that algebraic number field (how much the uniqueness of prime factorization is broken)”. Even if $\prod \langle a - b\alpha \rangle$ becomes $I^2$, if $I$ is not the identity element (principal ideal) in the ideal class group, it cannot be pulled back to the square of an element.

Obstruction 2: The Wall of the Unit Group

Suppose we get lucky and $I$ is a principal ideal $\langle \gamma \rangle$. Then, $\prod \langle a - b\alpha \rangle = \langle \gamma^2 \rangle$. You might think, “Great, the element is squared too!”, but that is a huge mistake.

The fact that ideals (sets of multiples) are equal does not mean the elements are completely equal. A deviation by a “Unit (a number whose reciprocal is also an integer, like 1 or -1)” inevitably occurs. In other words, the actual equality of the elements is as follows:

$$\prod_{S} (a - b\alpha) = u \cdot \gamma^2$$

($u$ is an element of the unit group $U_K$)

Unless this unit $u$ itself is the square of something (a square element), the left side can absolutely never become a “perfect square of an element”.

Stage 5: Adleman’s Magic “Quadratic Characters”

The obstruction of the ideal class group and the obstruction of the unit group. How do we overcome these two? Here, a genius method called “Quadratic Characters”, introduced by cryptographer Leonard Adleman (the “A” in RSA) and others, makes its appearance.

To determine “whether a certain element is a perfect square in the algebraic number field”, we use an algebraic number field version of the Legendre symbol (quadratic residue). To the giant matrix from earlier (the puzzle to make the count of prime ideals even), we secretly append dozens of additional conditions (columns) stating that “the quadratic characters for some special prime ideals $\mathfrak{q}$ also all become $1$ (even)”.

When we find a set $S$ that satisfies even these additional conditions through matrix calculations, deep theorems of algebraic number theory guarantee that “both the obstruction of the ideal class group and the obstruction of the unit group will naturally vanish with overwhelming probability.”

With this, we finally obtain the true equation.

$$\prod_{S} (a - b\alpha) = \gamma^2$$

Final Stage: The Convergence of Worlds and the Fall of Encryption

Finally, all the pieces of the puzzle are in place.

[Element in the Algebraic Number Field World (World A)] $\gamma^2 = \prod (a - b\alpha)$ (We find $\gamma$ from this using a square root algorithm)

[Element in the Real World (World of Rational Numbers)] $V^2 = \prod (a - bm)$ (Since this is just ordinary integer multiplication, the square root $V$ can be found normally)

Now, it’s time for the magical bridge we built at the very beginning, the homomorphism $\phi$, to take the stage. We warp the element $\gamma$ from World A to World B (the world modulo $N$) using $\phi$ (the mapping that substitutes $m$ for $\alpha$).

$$Y = \phi(\gamma) \pmod N$$

Meanwhile, we take the $V$ created in the real world directly to the modulo world and call it $X$.

$$X = V \pmod N$$

Due to the homomorphism’s property of “preserving structure”, the square relationship that held in World A is perfectly preserved in World B (the world modulo $N$) as well. Furthermore, because the original pairs $(a, b)$ were correspondingly created in the forms $a - b\alpha$ and $a - bm$, these $X$ and $Y$ collide in the world modulo $N$ to produce the following absolute equation:

$$X^2 \equiv Y^2 \pmod N$$

All that is left is to pray that these $X$ and $Y$ are not trivial solutions ($X \equiv \pm Y$) and calculate: $\gcd(X - Y, N)$

If it is a non-trivial solution, the Euclidean algorithm will race through in 0.001 seconds, and the secret primes $p$ and $q$, which are the heart of RSA encryption, will be printed on the output screen.

This is the complete form of the “General Number Field Sieve (GNFS)”, gathering the essence of modern mathematics.

What is the "General Number Field Sieve (GNFS)", Humanity's Strongest Math that Breaks Internet Cryptography?

Sat, 05 Sep 2026 02:09:08 +0900

What is the “General Number Field Sieve (GNFS)”, Humanity’s Strongest Math that Breaks Internet Cryptography?

The internet we use every day. LINE messages, YouTube, Amazon shopping—all communications are protected by “cryptography.” Currently, the most widely used cryptography in the world is “RSA cryptography.”

The cornerstone of RSA cryptography’s defense is very simple. It utilizes the mathematical property that “factoring a gigantic number into primes cannot be solved even by computers.” For example, for “15”, we immediately know it’s “3 × 5”, but the moment this becomes a “270-digit number”, even if we bundle all the supercomputers in the world, it would take hundreds of millions of years to solve.

However, mathematicians do not stay silent either. To break this ironclad cryptography, humanity created a magical algorithm (calculation procedure) called the “General Number Field Sieve (GNFS)”.

In this article, without using any specialized jargon, and only with knowledge of junior high school math (prime factorization, algebraic expressions, greatest common divisor), we will completely explain the mechanism step-by-step by which this “humanity’s strongest algorithm” breaks cryptography!

Chapter 1: The Goal of Decryption is a “Junior High School Formula”

The ultimate special move to confront gigantic prime factorizations. It’s this formula learned in junior high school.

$X^2 - Y^2 = (X + Y)(X - Y)$

You might think, “Eh, can such a basic formula break cryptography?” However, this is the master key that unlocks everything.

The ultimate goal for breaking the cryptography is to find, for a gigantic number $N$, “Numbers ($X$ and $Y$) where the remainder of $X^2$ and $Y^2$ divided by $N$ are the same.”

Why does “same remainder” solve the cryptography?

Suppose two numbers, $X^2$ and $Y^2$, have the “same remainder when divided by $N$.” Having the same remainder means there is a rule that the subtracted “$X^2 - Y^2$” will always be perfectly divisible by $N$ (it becomes a multiple of $N$).

Here, let’s say the gigantic number $N$ used for cryptography is made of the multiplication of two secret prime numbers ($p$ and $q$) ($N = p \times q$).

Factoring $X^2 - Y^2$ results in $(X - Y)(X + Y)$. The fact that this is a multiple of $N$ means that somewhere in this multiplication, the secret primes $p$ and $q$ are hidden.

Here a miracle occurs. There is mathematically a 50% (1/2) probability that the two prime numbers $p$ and $q$ will naturally separate into different rooms, with "$p$ going to the $(X - Y)$ room" and "$q$ going to the $(X + Y)$ room".

With only the prime number $p$ in the $(X - Y)$ room, let’s calculate the “Greatest Common Divisor (the largest common part)” of $(X - Y)$ and $N$.

Contents of $(X - Y)$ = $p \times$ some number
Contents of $N$ = $p \times q$ The only common part is "$p$"!

In other words, the moment you calculate the greatest common divisor, the hidden prime number $p$ pops out, and the cryptography is completely decrypted. (*The greatest common divisor can be calculated instantly even on a smartphone using the “Euclidean Algorithm”.)

[A Little Column: Why squared? Why not cubed or doubled?]

If it’s “$2X - 2Y$”, it becomes $2(X - Y)$, and since there’s only one room, you can’t separate the primes. If it’s “$X^3 - Y^3$”, the size of the rooms becomes unbalanced, making the calculations unnecessarily heavy. To separate the primes into two, “squaring”, which beautifully divides into two rooms, is the most cost-effective.

Chapter 2: How to Find X and Y? The “Prime Card Collection Puzzle”

The goal is clear. However, if you blindly search for “$X^2$ and $Y^2$ that yield the same remainder”, you won’t find it until the end of the universe. Therefore, mathematicians came up with a genius method called the “Prime Card Collection Puzzle”.

Step 1: Collect Only Gold Dust (Smooth Numbers) with a Sieve

First, prepare an appropriate number $Z$, square it, and calculate the remainder $W$ when divided by $N$. (The world of remainders where $Z^2 = W$)

Factorize the resulting remainder $W$. Here, only when a "$W$ made only of small prime numbers like 2, 3, 5, 7" appears, you keep that equation as a “winning card”, and throw it away if large primes are mixed in. It’s a task like discarding large stones with a sieve in a river and collecting only gold dust.

Step 2: The Puzzle of Making Everything an “Even Number”

For example, suppose the following three gold dust cards were collected.

Card A: $Z_1^2 = 2^3 \times 3^1$
Card B: $Z_2^2 = 2^1 \times 5^1$
Card C: $Z_3^2 = 3^1 \times 5^1$

Let’s multiply all these together. The right side becomes $(2^3 \times 3^1) \times (2^1 \times 5^1) \times (3^1 \times 5^1)$, and when summarized and organized, it becomes "$2^4 \times 3^2 \times 5^2$".

Amazingly, the number of prime numbers became “4, 2, 2”, which are all even numbers! Having all even numbers means that if you halve the count of everything, it becomes the “square of something.” In other words, $(2^2 \times 3^1 \times 5^1)^2 = (60)^2$.

The left side is $(Z_1 \times Z_2 \times Z_3)^2$, so with this, finally, $X = (Z_1 \times Z_2 \times Z_3)$ $Y = 60$ The long-awaited “$X^2 = Y^2$” pair is completed!

For computers, the puzzle of calculating whether the number of primes is “even or odd (0 or 1)” is something they are very good at, so with this method, they can find $X$ and $Y$ at high speed.

Chapter 3: The Wall of Despair That Stands in the Way

Now any cryptography can be broken!… Or so we thought, but a big problem arises. If the cryptography number $N$ is up to about “100 digits”, it can be solved with this method (called the Quadratic Sieve), but when $N$ becomes “200 digits or 300 digits”, the $W$ that appears during the calculation becomes too huge.

When the numbers get too huge, “numbers made only of small prime numbers (gold dust)” completely stop appearing. It becomes harder than searching for a contact lens in a desert, and you can’t collect the cards to solve the puzzle at all.

Here finally, humanity’s ultimate weapon, the “General Number Field Sieve (GNFS)”, makes its appearance.

Chapter 4: Humanity’s Strongest Idea, Creating “Two Worlds”

The genius idea of GNFS is: “Calculating only in the real world makes the numbers huge. So, let’s create a ‘hidden world’ using polynomials (algebraic expressions) and split the weight of the calculation into two.”

The Magic of Algebraic Expressions

GNFS converts the gigantic number $N$ into an algebraic expression using a base number $m$. For example, if $N=100$, let $m=4$, so $100 = 4^3 + 2(4^2) + 4$. This is turned into the expression (the hidden world) $f(x) = x^3 + 2x^2 + x$ using the letter $x$.

The interesting thing about this expression is that it has the property: “If you substitute $m$ (4 in the example above) for the letter $x$, you can always warp back to the real number $N$.”

Searching for Gold Dust in Two Worlds Simultaneously

GNFS creates many pairs of random integers $(a, b)$ and performs the following two calculations simultaneously.

Real World: $a - b \times m$
World of Algebraic Expressions: The value calculated by the rules of algebraic expressions for $a - b \times x$

By splitting the problem into two worlds, the size of the numbers handled becomes dramatically smaller (lighter). It’s the image of splitting a huge rock into two to make them easy-to-handle stones.

Then, you sift and collect only the miracle pairs $(a, b)$ where “Both in the real world and in the world of algebraic expressions, they are ‘made only of small prime numbers (gold dust)’”. This is the origin of the name “Number Field Sieve.”

The Moment the Cryptography is Finally Broken

Once tens of millions of “gold dust cards” are collected from both worlds, using the giant matrix calculations of supercomputers, you find the “combination where the number of prime numbers all become even”, just as we did in Chapter 2.

Once the combination is found,

Let the squared number made in the real world be $X^2$
Let the squared expression made in the world of algebraic expressions be $Y(x)^2$

Finally, substitute $m$ into $x$ of $Y(x)$ in the world of algebraic expressions to warp to the real world and merge them. Then, just like mathematical magic, a state where “the remainders of $X^2$ and $Y^2$ are the same” is strictly completed!

After that, just like in Chapter 1, if you calculate the greatest common divisor of $X - Y$ and $N$, the impregnable RSA cryptography collapses with a crash, and the secret primes reveal themselves.

Conclusion: Mathematics Never Ends

You might have thought, “Alright, with GNFS, any cryptography can be broken!” However, RSA cryptography is not giving up either. What is currently used on the internet is a monstrously huge number called “RSA-2048 (about 617 digits)”.

Even though GNFS is humanity’s strongest algorithm, it is said that even to solve 270 digits (RSA-270), it would take thousands or tens of thousands of years even if all the computers in the world were connected. For now, our LINE and bank data are safe.

But what if a “magic that instantly finds $X$ and $Y$ for any gigantic number” appears? Actually, the closest thing to that is the “Quantum Computer (Shor’s Algorithm)” currently under development. It has been mathematically proven that by using the wave properties of quantum mechanics, one can ignore the tedious card collecting puzzle and draw the answer in one shot.

The endless battle of wits between the people who make cryptography (defense) and the people who make algorithms to break it (attack). When you learn that the “prime factorization” and “algebraic expressions” learned in junior high school are actually weapons fiercely fighting on the front lines of global security, doesn’t math class seem just a little bit more interesting?

The person to discover the strongest algorithm of the future might just be you reading this article!

(Note: This article conceptualizes the mathematical charm of cryptography decryption for junior high school students. Actual GNFS is strictly calculated using advanced university mathematics such as ideal class groups of algebraic number fields and homomorphisms.)

Kerckhoffs's Principle

Wed, 16 Apr 2025 23:53:08 +0900

Kerckhoffs’s Principle

Hello!

Today, I’d like to talk about something a bit interesting and actually incredibly important called “Kerckhoffs’s Principle”.

Ah, wait, wait. Some of you might be thinking, “I’ve never heard of ‘Kerckhoffs’s Principle,’ and there are already too many katakana words…” Don’t worry. This article is exactly for you.

What does “Secure Cryptography” mean?

For example, imagine someone telling you, “This safe can only be opened by someone who knows the secret way to open it.”

At first glance, that sounds very secure, right? But if you think about it closely, isn’t it a bit unsettling?

Like, “If that secret leaks, isn’t it all over?”

Actually, this is exactly why Kerckhoffs’s Principle comes into play.

What exactly is “Kerckhoffs’s Principle”?

To put it very simply, it’s the idea that:

“A cryptographic system should be secure even if its inner workings become public knowledge.”

In other words, “Security should rely solely on the ‘secret key’, and it’s perfectly fine for the encryption method itself to be public!”

Conversely, “A system that only relies on keeping the cryptographic algorithm (mechanism) a secret is considered to have low reliability.”

“It’s safe because the mechanism is a secret” might be a bit dangerous

A common line of thought goes like this:

“Nobody has seen the inside of this app, so the security is fine.”

I understand the sentiment. But that’s basically the same as saying, “Nobody is looking, so nobody will find any flaws, so it must be fine.”

In reality, the very fact that “nobody is looking” can become a risk in itself.

But why is this principle so important?

The reason is, if someone manages to get their hands on the mechanism and can easily decrypt it, that encryption is compromised.

To use an analogy, it’s like a door lock built with a super complex mechanism, but which can actually be opened with a spare key made at a dollar store.

It’s not “It’s safe because the key is secret”, but rather “Even if you show the entire mechanism, it can’t be opened without the proper key” that is important.

The feeling of “But isn’t that kinda scary?”

This is where many people feel:

“Isn’t it kind of scary to expose the whole mechanism?”

I get it. You can’t help but think, “If I show everything inside, won’t it be copied or misused?”

But that is exactly the core of Kerckhoffs’s Principle. The true security is the “strength that doesn’t collapse even if you show the inside”.

That being said, it takes a little courage at first

Putting yourself in the shoes of a developer, “Making the mechanism public = exposing weaknesses”, so of course, it’s nerve-wracking.

But think about it.

Something that says “Anyone is welcome to verify it” while properly showing the mechanism will ultimately be trusted more.

It’s a lot like human relationships, isn’t it?

“Someone who gets along with you after you’ve shown your true self” is, after all, the most comforting.

So

Kerckhoffs’s Principle might sound a bit theoretical, but its essence is very simple.

It’s just about: “Let’s build a mechanism that won’t break no matter who sees it.”

Proper design over superficial secrets. Code you aren’t ashamed to show, rather than code you want to hide from everyone.

Perhaps this kind of “strength” is what will be increasingly sought after in the coming era.

Thank you for reading!

Security topics can be a bit difficult, but there are parts that connect to “human relationships” and a “sense of everyday security.” Without feeling pressured, learning about it little by little will surely bring something good.

[Complete Mathematical Guide] Why the Ultimate Classical 'GNFS' Loses to Quantum Algorithms: The Paradigm Shift in Prime Factorization

Mon, 01 Jan 0001 00:00:00 +0000

Information security in the modern internet society is protected by public-key cryptography, such as RSA cryptography. The basis for the security of RSA relies on the fact that “the prime factorization of huge composite numbers is computationally extremely difficult.”

In this article, we will unravel the mathematical mechanism of the “General Number Field Sieve” (GNFS), which is the most powerful prime factorization algorithm for classical computers. We will also dive deeply into why it is completely defeated by “Shor’s Algorithm,” discovered by Peter Shor, exploring this paradigm shift thoroughly with mathematical formulas and conceptual diagrams.

1. The Approach to Prime Factorization in Classical Computing: Evolution from Fermat’s Factorization Method

The prime factorization problem is the problem of finding prime numbers $p$ and $q$ such that $N = p \times q$ for a given composite number $N$.

The basic idea reduces to finding non-trivial $x$ and $y$ that satisfy the following congruence:

$$ x^2 \equiv y^2 \pmod N $$

By rearranging this, we get:

$$ x^2 - y^2 \equiv 0 \pmod N $$ $$ (x - y)(x + y) \equiv 0 \pmod N $$

Here, if $x \not\equiv \pm y \pmod N$, we can obtain a non-trivial factor of $N$ by calculating $\gcd(x-y, N)$ or $\gcd(x+y, N)$. This fact is the foundation of modern prime factorization algorithms like GNFS.

2. The Ultimate Classical Algorithm: The Depths of the “General Number Field Sieve” (GNFS)

“GNFS” is the fastest known prime factorization algorithm for classical computers today. Its time complexity requires sub-exponential time.

Complexity of GNFS

Letting the number of digits (bits) of the number $N$ be $b = \log_2 N$, the computational complexity of GNFS is expressed as follows:

$$ O\left( \exp \left( \left(\frac{64}{9} b\right)^{1/3} (\log b)^{2/3} \right) \right) $$

As can be seen from this formula, the computational complexity is not polynomial time, but “sub-exponential time,” which is slightly slower than exponential time. Still, as the number of digits increases, the computation time grows astronomically.

Mathematical Mechanism of GNFS

GNFS consists broadly of four steps:

Polynomial Selection
Sieving
Matrix Reduction
Square Root

2.1. Polynomial Selection and Number Fields

First, we select irreducible polynomials $f(x)$ and $g(x)$ with integer coefficients. These are set to have a common root $m$ modulo $N$. That is,

$$ f(m) \equiv 0 \pmod N $$ $$ g(m) \equiv 0 \pmod N $$

Usually, $g(x)$ is chosen as a linear polynomial $g(x) = x - m$. If we let $\alpha$ be a root of $f(x)$, a “Number Field” $\mathbb{Q}(\alpha)$ is constructed. We compare operations in the ring of $\mathbb{Q}(\alpha)$ and operations in the normal integer ring $\mathbb{Z}$ through the homomorphism $\phi: \alpha \mapsto m$.

2.2. Sieving

Next, we search for a massive number of coprime integer pairs $(a, b)$. The goal is to find pairs such that the following two values are both “B-smooth” (composed only of relatively small prime factors):

$a - bm$ (value over the integer ring)
$b^d f(a/b)$ (corresponding to the norm $N(a - b\alpha)$ over the number field)

Here, a high-speed search method called a “Sieve” is used. This efficiently extracts $(a, b)$ pairs that satisfy the conditions from a vast number of candidates.

2.3. Linear Algebra over GF(2) (Matrix Reduction)

From the collected pairs $(a, b)$, we construct exponent vectors and find the left null space of a massive sparse matrix over $\mathbb{F}_2$ (the field with only elements 0 and 1).

We find a vector $v$ as a solution so that the relations $ \prod (a_i - b_i m) $ and $ \prod (a_i - b_i \alpha) $ both become squares. This is nothing but solving a system of linear equations:

$$ M \mathbf{x} \equiv \mathbf{0} \pmod 2 $$

Advanced numerical algorithms such as the Block Lanczos Algorithm and the Block Wiedemann Algorithm are utilized here.

2.4. Square Root

Finally, we take square roots in both the number field and the integer ring to derive the relation $x^2 \equiv y^2 \pmod N$. Then, we calculate $\gcd(x-y, N)$ to obtain the factor.

3. The Breakthrough by Quantum Computing: “Shor’s Algorithm”

While GNFS requires sub-exponential time, “Shor’s Algorithm,” published by Peter Shor in 1994, can solve this problem in “polynomial time” by using a quantum computer.

Complexity of Shor’s Algorithm

When the number of qubits is $O(\log N)$, the time complexity is as follows:

$$ O((\log N)^3) $$

This means it does not cause an exponential explosion with respect to the number of bits. This is an astonishing result: even for huge composite numbers where the complexity of “classical computing” exceeds the lifespan of the universe, they can be cracked in hours to days with “quantum computing.”

Overview of Shor’s Algorithm: Reduction to the Period-Finding Problem

Shor’s algorithm cleverly reduces the prime factorization problem to a “period-finding problem.”

Choose a random integer $a$ coprime to $N$ ($1 < a < N$).
Define the function $f(x) = a^x \bmod N$.
Find the period $r$ of $f(x)$, i.e., the smallest positive integer $r$ such that $a^r \equiv 1 \pmod N$.
If $r$ is even, check if $a^{r/2} \not\equiv -1 \pmod N$, and calculate $\gcd(a^{r/2} \pm 1, N)$ to obtain a prime factor.

“Finding the period $r$” in step 3 is the bottleneck that requires exponential time on classical computers, but quantum computers solve this instantly using “quantum superposition” and the “Quantum Fourier Transform” (QFT).

4. Quantum Fourier Transform (QFT) and Period Extraction

Let’s look in detail with formulas at the manipulation of quantum states, which is the core of Shor’s algorithm.

4.1. Generation of Quantum Superposition

First, we prepare two quantum registers. Register 1 holds a superposition state of inputs $x$, and Register 2 holds the computation result $f(x)$. We apply the Hadamard Transform to the initial state $|0\rangle |0\rangle$ to create a superposition of all possible $x$.

$$ |\psi_1\rangle = \frac{1}{\sqrt{Q}} \sum_{x=0}^{Q-1} |x\rangle |0\rangle $$

(Here $Q$ is a power of 2 satisfying $N^2 \le Q < 2N^2$)

Next, we use a quantum oracle $U_f$ to compute $f(x) = a^x \bmod N$ and store it in Register 2.

$$ |\psi_2\rangle = U_f |\psi_1\rangle = \frac{1}{\sqrt{Q}} \sum_{x=0}^{Q-1} |x\rangle |a^x \bmod N\rangle $$

Let’s assume here that we measure Register 2 (in reality, the mathematical structure is the same even without measurement). If a value $y = a^{x_0} \bmod N$ is observed, the state of Register 1 collapses into a superposition of all $x$ such that $f(x) = y$. Letting the period be $r$, such $x$ are $x_0, x_0 + r, x_0 + 2r, \dots$

$$ |\psi_3\rangle = \frac{1}{\sqrt{M}} \sum_{k=0}^{M-1} |x_0 + kr\rangle $$

(Here $M \approx Q/r$ is the number of terms)

This state inherently contains information about the period $r$, but direct measurement will only yield a random $x_0 + kr$, and the period $r$ remains unknown. This is where QFT comes in.

4.2. Application of the Quantum Fourier Transform (QFT)

QFT is an operation that performs a discrete Fourier transform on the amplitudes of quantum states. The action of QFT on state $|x\rangle$ is defined as follows:

$$ \text{QFT} |x\rangle = \frac{1}{\sqrt{Q}} \sum_{y=0}^{Q-1} e^{2\pi i \frac{xy}{Q}} |y\rangle $$

When this is applied to $|\psi_3\rangle$, phase interference (quantum interference) occurs.

$$ |\psi_4\rangle = \text{QFT} |\psi_3\rangle = \frac{1}{\sqrt{MQ}} \sum_{y=0}^{Q-1} \sum_{k=0}^{M-1} e^{2\pi i \frac{(x_0 + kr)y}{Q}} |y\rangle $$

Expanding the sum in this equation reveals the part:

$$ \sum_{k=0}^{M-1} e^{2\pi i \frac{kry}{Q}} $$

This sum of a geometric series reinforces each other (Constructive Interference) only when $ry/Q$ is close to an integer, and cancels each other out (Destructive Interference) otherwise.

Therefore, the state $|y\rangle$ measured with high probability will be an integer $y$ that satisfies the condition:

$$ \frac{y}{Q} \approx \frac{c}{r} $$

(where $c$ is some integer).

4.3. Identifying the Period via Continued Fraction Expansion

After obtaining $y$ through measurement, we perform a “Continued Fraction Expansion” of $y/Q$ using a classical computer. This allows us to calculate the convergent fraction $c/r$ of $y/Q$, and extract candidates for the period $r$ from the denominator with high efficiency.

5. Comparison of Conceptual Models and the Paradigm Shift

To intuitively understand the difference between GNFS and Shor’s algorithm, we present a conceptual diagram using Mermaid notation.

Conceptual Diagram of Shor’s Algorithm via Quantum Circuit

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


graph TD
 A[Initial State: 0...0] --> B[Superposition of all states via Hadamard Transform]
 B --> C[Modular exponentiation a^x mod N]
 C -->|Quantum Entanglement| D[Collapse to a state with periodicity]
 D --> E[Quantum Fourier Transform QFT]
 E -->|Probability amplification via interference| F[Measurement: Obtain y]
 F --> G[Classical processing: Continued Fraction Expansion]
 G --> H[Discovery of period r]
 H --> I[Calculate prime factors of N]

 style A fill:#f9f,stroke:#333,stroke-width:2px
 style E fill:#bbf,stroke:#333,stroke-width:2px
 style I fill:#bfb,stroke:#333,stroke-width:2px

The Essence of the Paradigm Shift

GNFS takes the approach of “searching for relations within a mathematical space (number field).” However, since the search space expands exponentially with the number of digits, it becomes virtually unsolvable for classical computer capabilities (even including parallelization) when the key length exceeds 2048 bits.

On the other hand, Shor’s algorithm utilizes the “wave nature of quantum interference.” It simultaneously evaluates all computation paths in a superposition state, uses QFT to cancel out (destructively interfere) unnecessary answers, and amplifies (constructively interferes) only the probability amplitude of the period that is the correct answer. Through this, instead of searching space, it realizes a completely different dimensional approach of “making the correct answer itself surface.”

6. Summary

In this article, we deeply compared the mathematical backgrounds and algorithmic structures of “GNFS,” the pinnacle of classical limits, and “Shor’s Algorithm,” which demonstrates the power of quantum computing.

While GNFS drove computational complexity down to sub-exponential time by employing mathematical tricks such as polynomial selection and massive matrix calculations, Shor’s algorithm fused the fundamental principles of quantum mechanics—superposition and interference—with a mathematical tool (QFT), achieving a breakthrough to polynomial time in one stroke.

Currently, Fault-Tolerant Quantum Computers (FTQC) capable of executing Shor’s algorithm at a practical scale (thousands of qubits) do not exist. However, the very existence of this mathematical and theoretical paradigm shift is the primary reason why the transition to Post-Quantum Cryptography (PQC) is urgently being accelerated worldwide today.