Math on kenji.blog

[Complete Anatomy] Understanding the Strongest Cryptanalysis Algorithm "GNFS" by Implementing it in C++

Sat, 05 Sep 2026 13:04:59 +0900

[Complete Anatomy] Understanding the Strongest Cryptanalysis Algorithm “GNFS” by Implementing it in C++

The “RSA cryptography” fundamentally supports the modern Internet. Its robustness relies on the mathematical belief that “factoring huge composite numbers is practically impossible with current computers.”

However, humanity has never given up. Currently, for classical computers (regular computers, not quantum computers), there exists the **strongest and most advanced algorithm of humanity ** for performing giant prime factorizations. That is the “General Number Field Sieve (GNFS)”.

In this article, we will strictly model the state-of-the-art computational logic of GNFS in C++ (using the multiple-precision integer boost::multiprecision from the Boost library), publish the entire implementation code, and thoroughly explain the depths of “algebraic number theory” behind it.

Please enjoy the mystery of mathematics and the brute force of computer science that wrestles it down, along with the source code.

1. GNFS State-of-the-Art Logic Framework (Full Source Code)

First, here is the full picture of the C++ implementation of GNFS that we will explain this time. The actual number field sieve (such as CADO-NFS) is an ultra-massive distributed system spanning hundreds of thousands of lines, but this code extracts the “5 essential pipelines (phases)” that make up GNFS, designs them as classes, and models them in a minimal configuration without losing their mathematical meaning.

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227


#include <iostream>
#include <vector>
#include <cmath>
#include <map>
#include <set>
#include <chrono>
#include <boost/multiprecision/cpp_int.hpp>

// Using Boost.Multiprecision for multiple-precision integers
using namespace boost::multiprecision;

// ============================================================================
// [SOTA GNFS] General Number Field Sieve State-of-the-Art Logic Framework
//
// This code strictly models the 5 pipelines of state-of-the-art GNFS used in
// CADO-NFS etc., as a class design in C++ (Boost).
// ============================================================================

struct Relation {
 int64_t a;
 int64_t b;
 std::vector<uint32_t> rational_primes;
 std::vector<uint32_t> algebraic_primes;
};

// ============================================================================
// Phase 1: Polynomial Selection (KleinJung's algorithm)
// ============================================================================
class PolynomialSelector {
public:
 int degree;
 std::vector<cpp_int> f; // Algebraic side polynomial f(x)
 std::vector<cpp_int> g; // Rational side polynomial g(x) = x - m
 cpp_int m;

 PolynomialSelector(int d) : degree(d) {}

 // Initial polynomial generation based on base-m expansion (actually uses more advanced lattice basis reduction LLL)
 void select(const cpp_int& N) {
 std::cout << "[Phase 1] Polynomial Selection (Degree " << degree << ") starting..." << std::endl;
 // Simple base-m expansion (degree d)
 // m = N^(1/d)
 cpp_int N_copy = N;
 m = 1;
 // Simple approximation of m (approximation without using Boost functions)
 cpp_int low = 1, high = N;
 while (low <= high) {
 cpp_int mid = low + (high - low) / 2;
 cpp_int p = 1;
 for(int i=0; i<degree; ++i) p *= mid;
 if (p <= N) { m = mid; low = mid + 1; }
 else { high = mid - 1; }
 }

 f.resize(degree + 1);
 cpp_int temp = N;
 for (int i = 0; i <= degree; ++i) {
 f[i] = temp % m;
 temp /= m;
 }

 g = {-m, 1}; // g(x) = x - m

 std::cout << " -> m = " << m << std::endl;
 std::cout << " -> f(x) = ";
 for(int i = degree; i >= 0; --i) {
 std::cout << f[i] << "x^" << i << (i > 0 ? " + " : "");
 }
 std::cout << "\n[Phase 1] Complete." << std::endl;
 }
};

// ============================================================================
// Phase 2: Lattice Sieving
// ============================================================================
// In recent GNFS, instead of Line Sieve, Special-q Lattice Sieving by
// Franke-Kleinjung et al. is the de facto standard.
class LatticeSieve {
 uint32_t rational_bound;
 uint32_t algebraic_bound;
 std::vector<uint32_t> rational_fb;
 std::vector<uint32_t> algebraic_fb;

public:
 LatticeSieve(uint32_t rb, uint32_t ab) : rational_bound(rb), algebraic_bound(ab) {}

 void generate_factor_bases() {
 std::cout << "[Phase 2] Generating Factor Bases (Rational Bound: " << rational_bound << ", Algebraic Bound: " << algebraic_bound << ")" << std::endl;
 // (Omitted) In reality, it generates primes and filters them using Legendre symbols, etc.
 }

 std::vector<Relation> sieve(const PolynomialSelector& poly) {
 std::cout << "[Phase 2] Special-q Lattice Sieving active..." << std::endl;
 std::vector<Relation> relations;
 // Mock implementation: Actual lattice sieving scans hundreds of GB of memory space block by block.
 // It maps (a, b) pairs to lattices for each special prime q (a = i*q + j*...),
 // and executes a sieve that maximizes cache efficiency.

 // Add one dummy relation for demo
 Relation r; r.a = 17; r.b = 3;
 r.rational_primes = {2, 5};
 r.algebraic_primes = {3, 7};
 relations.push_back(r);

 std::cout << "[Phase 2] Found " << relations.size() << " relations." << std::endl;
 return relations;
 }
};

// ============================================================================
// Phase 3: Filtering (Singleton removal and clique merging)
// ============================================================================
class Filter {
public:
 void reduce_matrix(std::vector<Relation>& relations) {
 std::cout << "[Phase 3] Filtering Relations..." << std::endl;
 // 1. Singleton removal (removing relations with primes that appear only once)
 // 2. Clique merging (merging relations to make a sparse matrix denser)
 // In reality, it compresses a matrix of hundreds of millions of rows down to several million using algorithms like Union-Find.
 std::cout << "[Phase 3] Matrix size reduced optimally." << std::endl;
 }
};

// ============================================================================
// Phase 4: Linear Algebra over GF(2) (Block Wiedemann method)
// ============================================================================
class LinearAlgebraGF2 {
public:
 // In modern supercomputing environments, the Block Wiedemann method (Coppersmith implementation),
 // which is more suitable for distributed computing than the Block Lanczos method, is used as the state-of-the-art.
 std::vector<std::vector<int>> solve_nullspace(const std::vector<Relation>& relations) {
 std::cout << "[Phase 4] Block Wiedemann algorithm over GF(2) starting..." << std::endl;
 // Iterates matrix-vector multiplication of a sparse matrix,
 // and finds multiple solution vectors (kernels) where M * x = 0 mod 2.

 std::vector<std::vector<int>> dependencies; // List of dependencies
 // Dummy data
 dependencies.push_back({0});

 std::cout << "[Phase 4] Found " << dependencies.size() << " linear dependencies (perfect squares)." << std::endl;
 return dependencies;
 }
};

// ============================================================================
// Phase 5: Algebraic Square Root
// ============================================================================
class AlgebraicSquareRoot {
public:
 void compute_and_factor(const std::vector<Relation>& relations, const std::vector<int>& dep, const cpp_int& N) {
 std::cout << "[Phase 5] Algebraic Square Root computation..." << std::endl;

 // 1. Compute the rational side square root V (simple integer arithmetic)
 cpp_int V = 1;
 // V = sqrt( prod(a - bm) ) mod N

 // 2. Compute the algebraic side square root gamma (Montgomery's method, etc.)
 // Find an element gamma in the huge algebraic field O_K, and map it to the real world using the homomorphism map phi
 // Y = phi(gamma) mod N
 cpp_int Y = 1;

 // Assuming that sequences of Quadratic Characters were added in Phases 2 and 4
 // to bypass the obstruction of the ideal class group and the unit group.

 std::cout << " -> Homomorphism map phi applied." << std::endl;
 std::cout << "[Phase 5] Calculating GCD(V - Y, N)..." << std::endl;

 cpp_int factor = gcd(V - Y, N); // GCD(X-Y, N)

 if (factor > 1 && factor < N) {
 std::cout << "\n================================================================" << std::endl;
 std::cout << "[SUCCESS] Non-trivial factor found: " << factor << std::endl;
 std::cout << " Other factor: " << N / factor << std::endl;
 std::cout << "================================================================" << std::endl;
 } else {
 std::cout << "[FAILURE] Trivial solution. Trying next dependency..." << std::endl;
 }
 }
};

// ============================================================================
// Main Execution Pipeline
// ============================================================================
int main() {
 std::cout << "================================================================" << std::endl;
 std::cout << " [SOTA GNFS] General Number Field Sieve Engine (Boost C++) " << std::endl;
 std::cout << "================================================================" << std::endl;

 // Huge composite number N to factor, such as RSA-270
 cpp_int N("233108530344407544527637656910680524145619812480305449042948611968495918245135782867888369318577116418213919268572658314913060672626911354027609793166341626693946596196427744273886601876896313468704059066746903123910748277606548649151920812699309766587514735456594993207");

 // Degree of the polynomial (normally select degree 5-6 for numbers over 130 digits)
 int degree = 6;

 // Initialize pipeline
 PolynomialSelector poly_select(degree);
 LatticeSieve sieve(10000000, 20000000); // Actual bounds are tens of millions to hundreds of millions
 Filter filter;
 LinearAlgebraGF2 linalg;
 AlgebraicSquareRoot sqrt_step;

 auto start_time = std::chrono::high_resolution_clock::now();

 // 1. Polynomial selection
 poly_select.select(N);

 // 2. Sieving process
 sieve.generate_factor_bases();
 std::vector<Relation> relations = sieve.sieve(poly_select);

 // 3. Filtering (matrix compression)
 filter.reduce_matrix(relations);

 // 4. Linear algebra (nullspace search over GF(2))
 std::vector<std::vector<int>> dependencies = linalg.solve_nullspace(relations);

 // 5. Algebraic square root computation and GCD
 for (const auto& dep : dependencies) {
 sqrt_step.compute_and_factor(relations, dep, N);
 }

 auto end_time = std::chrono::high_resolution_clock::now();
 std::chrono::duration<double> elapsed = end_time - start_time;
 std::cout << "\n[System] SOTA GNFS Pipeline completed in " << elapsed.count() << " seconds." << std::endl;

 return 0;
}

Now, how does this code destroy the cryptographic wall? I will break down and explain the meticulous algorithm and advanced mathematics phase by phase.

2. The Final Goal of GNFS: $X^2 \equiv Y^2 \pmod N$

The goal that not only GNFS but most modern large integer factorization algorithms aim for is to find a non-trivial pair $(X, Y)$ that satisfies the following congruence:

$$X^2 \equiv Y^2 \pmod N$$

This equation means that “the remainders of $X^2$ and $Y^2$ divided by $N$ are equal”. If we transform this: $X^2 - Y^2 \equiv 0 \pmod N$ In other words, $(X-Y)(X+Y)$ becomes a multiple of $N$.

If $X \not\equiv \pm Y \pmod N$ (a non-trivial solution), then between $(X-Y)$ and $N$, there exists a “common divisor greater than 1 and less than $N$”. Here, if we compute $\gcd(X-Y, N)$ using the Euclidean algorithm, the prime factors of $N$ can be easily found.

However, finding these $X$ and $Y$ is like looking for a needle in a desert. Thus, GNFS takes the genius approach of creating two worlds, the “real integer world” and the “algebraic field of polynomials world”, and distributing the computation.

3. Phase 1: Polynomial Selection

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


class PolynomialSelector {
 // ...
 void select(const cpp_int& N) {
 // Calculation of m = N^(1/d) and base-m expansion
 // ...
 for (int i = 0; i <= degree; ++i) {
 f[i] = temp % m;
 temp /= m;
 }
 g = {-m, 1}; // g(x) = x - m
 }
};

The first step of GNFS is to create a “magic polynomial” to bridge the two worlds. For a huge number $N$, we choose an integer $m$. Usually, it is chosen such that $m \approx N^{1/d}$ (in the code, a polynomial of degree $d=6$ is assumed).

Then, $N$ is expanded in base $m$, and its coefficients are used to construct the polynomial $f(x)$.

$$N = c_d m^d + c_{d-1} m^{d-1} + \dots + c_1 m + c_0$$ $$f(x) = c_d x^d + c_{d-1} x^{d-1} + \dots + c_1 x + c_0$$

This polynomial $f(x)$ has the extremely important property that “substituting $m$ for the variable $x$ evaluates exactly to $N$ ($f(m) = N$)”. In other words, $f(m) \equiv 0 \pmod N$. The rational side polynomial is defined as $g(x) = x - m$.

This strongly connects the “algebraic field world $\mathbb{Z}[\alpha]$” ruled by the root $\alpha$ of $f(x)=0$, and the normal “rational (integer) world $\mathbb{Z}$”, via a “ring homomorphism” of $x \to m$.

In state-of-the-art systems like CADO-NFS, it takes months to search for the “most convenient polynomial $f(x)$” using KleinJung’s algorithm and the LLL lattice basis reduction algorithm, so that the coefficients of the polynomial do not become excessively large, and primes are likely to appear (become smooth) in the subsequent steps.

4. Phase 2: Special-q Lattice Sieving

1
2
3
4
5
6
7
8
9


class LatticeSieve {
 // ...
 std::vector<Relation> sieve(const PolynomialSelector& poly) {
 // ...
 // Maps (a, b) pairs to lattices for each special prime q,
 // and executes a sieve that maximizes cache efficiency.
 // ...
 }
};

Once the two worlds are prepared, the next step is to search for “smooth numbers (numbers composed entirely of small prime factors)” in both worlds. An infinite number of integer pairs $(a, b)$ are generated, and the following two values are calculated:

Rational side value: $a - bm$
Algebraic side norm: $b^d f(a/b)$

The goal of GNFS is to collect tens of millions to hundreds of millions of these “pairs (Relations) where both the rational side and algebraic side values can be completely factored into only small prime factors”.

In the early GNFS, a “Line Sieve” was used, lining up $(a, b)$ on the $xy$ plane and sequentially dividing them by primes from the edges. However, this caused frequent cache misses due to accessing various parts of memory, and its weakness was being extremely slow.

Therefore, the current state-of-the-art code uses the “Special-q Lattice Sieve” method. By fixing a moderately large prime $q$, we restrict the calculation targets to only “pairs of $(a, b)$ where the algebraic side value is always divisible by $q$”. Since $(a, b)$ satisfying this condition form a “lattice” on the plane, the jump width of calculated addresses becomes constant, fitting perfectly into the CPU’s L1/L2 cache. With the introduction of this lattice sieving, the calculation speed of GNFS improved dramatically.

5. Phase 3: Filtering

1
2
3
4
5
6
7


class Filter {
public:
 void reduce_matrix(std::vector<Relation>& relations) {
 // 1. Singleton removal (removing relations with primes that appear only once)
 // 2. Clique merging (merging relations to make a sparse matrix denser)
 }
};

Hundreds of millions of relations collected over months by computers around the world in Phase 2. However, if this is thrown as-is into the next “step of solving simultaneous equations (matrix calculation)”, the supercomputer’s memory will blow up.

Thus, an ultra-compression process of the matrix called Filtering is performed.

Singleton removal Suppose a huge prime $p$ appeared “only once” in hundreds of millions of relations. Since our goal is to “make the exponents of all primes even (multiples of 2)”, a prime that appears only once can never be made even. Therefore, relations containing that prime are immediately removed (purged) as “useless garbage”. As this happens in a chain reaction, the data that had hundreds of millions of rows is rapidly reduced.
Clique merging Furthermore, by multiplying (adding) relations that share specific primes together, it reduces the number of rows while compressing the sparse (empty) matrix into a denser state (using a method similar to clique search in graph theory).

With this optimization, the massive sparse matrix is dramatically compressed to a computable size.

6. Phase 4: Linear Algebra over GF(2) (Block Wiedemann Method)

1
2
3
4
5
6
7


class LinearAlgebraGF2 {
public:
 std::vector<std::vector<int>> solve_nullspace(const std::vector<Relation>& relations) {
 // Iterates matrix-vector multiplication of a sparse matrix,
 // and finds multiple solution vectors (kernels) where M * x = 0 mod 2.
 }
};

Finally, the core of the puzzle. We multiply the collected relations to find the “combination where the exponents of all prime factors become even”.

Mathematically, this means using a huge matrix $M$ whose elements are the “even/odd (i.e., 0 or 1)” of the exponent of each prime, and a vector $x$ representing which relations to use, and finding the solution vector $x$ (nullspace/kernel) such that: $M \cdot x \equiv 0 \pmod 2$

We must solve a system of simultaneous equations for a matrix of an enormous size, millions of rows by millions of columns. With standard Gaussian elimination, the computational complexity would be $O(N^3)$, and the calculation wouldn’t finish until the end of the universe.

Thus, the “Block Wiedemann method” is adopted in state-of-the-art implementations. This is a type of Krylov subspace method that leverages the fact that the matrix $M$ is “extremely sparse (mostly 0s)” to derive a solution by iteratively performing matrix-vector multiplications. Unlike the older Block Lanczos method, the Block Wiedemann method can completely divide the computational process across multiple clusters, making it overwhelmingly powerful for parallel computing in modern distributed cloud computing and supercomputers.

7. Phase 5: Algebraic Square Root and Cryptographic Collapse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


class AlgebraicSquareRoot {
public:
 void compute_and_factor(...) {
 // 1. Compute the rational side square root V
 cpp_int V = 1;

 // 2. Compute the algebraic side square root gamma
 cpp_int Y = 1;

 // ...
 cpp_int factor = gcd(V - Y, N); // GCD(X-Y, N)
 }
};

Through the matrix calculation in Phase 4, we obtained a “set of relations $S$ whose product yields even powers for all prime factors”. With this, we can construct a “square” in both the rational side and the algebraic side worlds.

For the rational side, it’s just integer multiplication, so computing the square root $V$ is easy.

$$V^2 = \prod_{S} (a - bm)$$

However, the real hell lies on the “algebraic side”. In the algebraic field world $\mathbb{Z}[\alpha]$, since the uniqueness of prime factorization does not hold, calculations have been performed using ideals. What was guaranteed by the matrix calculation is only that it becomes a “square of an ideal”, and it is not guaranteed that it becomes a “square of an element ($\gamma^2$)”.

Here stands a formidable wall in algebraic number theory: the “obstruction of the ideal class group” and the “obstruction of the unit group”. In GNFS, we use the magic of “Quadratic Characters” to break through this wall. Columns of quadratic residues (Legendre symbols) for several tens of special prime ideals are secretly added in advance to the matrix in Phase 4. As a result, the found set $S$ ignores the obstructions with an overwhelming probability and successfully forms the “true square of an element $\gamma^2$”.

The work of finding $\gamma$ (algebraic square root) is computed using highly complex algorithms such as Montgomery’s method.

And finally, we warp the algebraic side square root $\gamma$ into the real world (by substituting $m$ for $x$) via the ring homomorphism $\phi$, yielding $Y$. If we simply set the rational side $V$ as $X$, the absolute equation we have been pursuing is finally complete.

$$X^2 \equiv Y^2 \pmod N$$

All that is left is to compute $\gcd(X-Y, N)$. Running through the 0.001-second process, the moment a non-trivial factor is printed on the screen, the proudly impregnable RSA cryptography completely collapses.

Conclusion

GNFS is not just a programming technique. It is a crystal of human intellect that has wrestled down the “depths of pure mathematics” like abstract algebra, ring theory, and ideal class groups using “extreme engineering” like supercomputer distributed architectures and cache optimizations.

The chat messages and credit card information we casually transmit are protected upon such astronomical mathematical defense and offense.

Through this C++ framework, I hope you have felt the “romance of mathematics and computers” behind state-of-the-art cryptanalysis algorithms.

What is the "General Number Field Sieve (GNFS)", Humanity's Strongest Math that Breaks Internet Cryptography?

Sat, 05 Sep 2026 02:09:08 +0900

What is the “General Number Field Sieve (GNFS)”, Humanity’s Strongest Math that Breaks Internet Cryptography?

The internet we use every day. LINE messages, YouTube, Amazon shopping—all communications are protected by “cryptography.” Currently, the most widely used cryptography in the world is “RSA cryptography.”

The cornerstone of RSA cryptography’s defense is very simple. It utilizes the mathematical property that “factoring a gigantic number into primes cannot be solved even by computers.” For example, for “15”, we immediately know it’s “3 × 5”, but the moment this becomes a “270-digit number”, even if we bundle all the supercomputers in the world, it would take hundreds of millions of years to solve.

However, mathematicians do not stay silent either. To break this ironclad cryptography, humanity created a magical algorithm (calculation procedure) called the “General Number Field Sieve (GNFS)”.

In this article, without using any specialized jargon, and only with knowledge of junior high school math (prime factorization, algebraic expressions, greatest common divisor), we will completely explain the mechanism step-by-step by which this “humanity’s strongest algorithm” breaks cryptography!

Chapter 1: The Goal of Decryption is a “Junior High School Formula”

The ultimate special move to confront gigantic prime factorizations. It’s this formula learned in junior high school.

$X^2 - Y^2 = (X + Y)(X - Y)$

You might think, “Eh, can such a basic formula break cryptography?” However, this is the master key that unlocks everything.

The ultimate goal for breaking the cryptography is to find, for a gigantic number $N$, “Numbers ($X$ and $Y$) where the remainder of $X^2$ and $Y^2$ divided by $N$ are the same.”

Why does “same remainder” solve the cryptography?

Suppose two numbers, $X^2$ and $Y^2$, have the “same remainder when divided by $N$.” Having the same remainder means there is a rule that the subtracted “$X^2 - Y^2$” will always be perfectly divisible by $N$ (it becomes a multiple of $N$).

Here, let’s say the gigantic number $N$ used for cryptography is made of the multiplication of two secret prime numbers ($p$ and $q$) ($N = p \times q$).

Factoring $X^2 - Y^2$ results in $(X - Y)(X + Y)$. The fact that this is a multiple of $N$ means that somewhere in this multiplication, the secret primes $p$ and $q$ are hidden.

Here a miracle occurs. There is mathematically a 50% (1/2) probability that the two prime numbers $p$ and $q$ will naturally separate into different rooms, with "$p$ going to the $(X - Y)$ room" and "$q$ going to the $(X + Y)$ room".

With only the prime number $p$ in the $(X - Y)$ room, let’s calculate the “Greatest Common Divisor (the largest common part)” of $(X - Y)$ and $N$.

Contents of $(X - Y)$ = $p \times$ some number
Contents of $N$ = $p \times q$ The only common part is "$p$"!

In other words, the moment you calculate the greatest common divisor, the hidden prime number $p$ pops out, and the cryptography is completely decrypted. (*The greatest common divisor can be calculated instantly even on a smartphone using the “Euclidean Algorithm”.)

[A Little Column: Why squared? Why not cubed or doubled?]

If it’s “$2X - 2Y$”, it becomes $2(X - Y)$, and since there’s only one room, you can’t separate the primes. If it’s “$X^3 - Y^3$”, the size of the rooms becomes unbalanced, making the calculations unnecessarily heavy. To separate the primes into two, “squaring”, which beautifully divides into two rooms, is the most cost-effective.

Chapter 2: How to Find X and Y? The “Prime Card Collection Puzzle”

The goal is clear. However, if you blindly search for “$X^2$ and $Y^2$ that yield the same remainder”, you won’t find it until the end of the universe. Therefore, mathematicians came up with a genius method called the “Prime Card Collection Puzzle”.

Step 1: Collect Only Gold Dust (Smooth Numbers) with a Sieve

First, prepare an appropriate number $Z$, square it, and calculate the remainder $W$ when divided by $N$. (The world of remainders where $Z^2 = W$)

Factorize the resulting remainder $W$. Here, only when a "$W$ made only of small prime numbers like 2, 3, 5, 7" appears, you keep that equation as a “winning card”, and throw it away if large primes are mixed in. It’s a task like discarding large stones with a sieve in a river and collecting only gold dust.

Step 2: The Puzzle of Making Everything an “Even Number”

For example, suppose the following three gold dust cards were collected.

Card A: $Z_1^2 = 2^3 \times 3^1$
Card B: $Z_2^2 = 2^1 \times 5^1$
Card C: $Z_3^2 = 3^1 \times 5^1$

Let’s multiply all these together. The right side becomes $(2^3 \times 3^1) \times (2^1 \times 5^1) \times (3^1 \times 5^1)$, and when summarized and organized, it becomes "$2^4 \times 3^2 \times 5^2$".

Amazingly, the number of prime numbers became “4, 2, 2”, which are all even numbers! Having all even numbers means that if you halve the count of everything, it becomes the “square of something.” In other words, $(2^2 \times 3^1 \times 5^1)^2 = (60)^2$.

The left side is $(Z_1 \times Z_2 \times Z_3)^2$, so with this, finally, $X = (Z_1 \times Z_2 \times Z_3)$ $Y = 60$ The long-awaited “$X^2 = Y^2$” pair is completed!

For computers, the puzzle of calculating whether the number of primes is “even or odd (0 or 1)” is something they are very good at, so with this method, they can find $X$ and $Y$ at high speed.

Chapter 3: The Wall of Despair That Stands in the Way

Now any cryptography can be broken!… Or so we thought, but a big problem arises. If the cryptography number $N$ is up to about “100 digits”, it can be solved with this method (called the Quadratic Sieve), but when $N$ becomes “200 digits or 300 digits”, the $W$ that appears during the calculation becomes too huge.

When the numbers get too huge, “numbers made only of small prime numbers (gold dust)” completely stop appearing. It becomes harder than searching for a contact lens in a desert, and you can’t collect the cards to solve the puzzle at all.

Here finally, humanity’s ultimate weapon, the “General Number Field Sieve (GNFS)”, makes its appearance.

Chapter 4: Humanity’s Strongest Idea, Creating “Two Worlds”

The genius idea of GNFS is: “Calculating only in the real world makes the numbers huge. So, let’s create a ‘hidden world’ using polynomials (algebraic expressions) and split the weight of the calculation into two.”

The Magic of Algebraic Expressions

GNFS converts the gigantic number $N$ into an algebraic expression using a base number $m$. For example, if $N=100$, let $m=4$, so $100 = 4^3 + 2(4^2) + 4$. This is turned into the expression (the hidden world) $f(x) = x^3 + 2x^2 + x$ using the letter $x$.

The interesting thing about this expression is that it has the property: “If you substitute $m$ (4 in the example above) for the letter $x$, you can always warp back to the real number $N$.”

Searching for Gold Dust in Two Worlds Simultaneously

GNFS creates many pairs of random integers $(a, b)$ and performs the following two calculations simultaneously.

Real World: $a - b \times m$
World of Algebraic Expressions: The value calculated by the rules of algebraic expressions for $a - b \times x$

By splitting the problem into two worlds, the size of the numbers handled becomes dramatically smaller (lighter). It’s the image of splitting a huge rock into two to make them easy-to-handle stones.

Then, you sift and collect only the miracle pairs $(a, b)$ where “Both in the real world and in the world of algebraic expressions, they are ‘made only of small prime numbers (gold dust)’”. This is the origin of the name “Number Field Sieve.”

The Moment the Cryptography is Finally Broken

Once tens of millions of “gold dust cards” are collected from both worlds, using the giant matrix calculations of supercomputers, you find the “combination where the number of prime numbers all become even”, just as we did in Chapter 2.

Once the combination is found,

Let the squared number made in the real world be $X^2$
Let the squared expression made in the world of algebraic expressions be $Y(x)^2$

Finally, substitute $m$ into $x$ of $Y(x)$ in the world of algebraic expressions to warp to the real world and merge them. Then, just like mathematical magic, a state where “the remainders of $X^2$ and $Y^2$ are the same” is strictly completed!

After that, just like in Chapter 1, if you calculate the greatest common divisor of $X - Y$ and $N$, the impregnable RSA cryptography collapses with a crash, and the secret primes reveal themselves.

Conclusion: Mathematics Never Ends

You might have thought, “Alright, with GNFS, any cryptography can be broken!” However, RSA cryptography is not giving up either. What is currently used on the internet is a monstrously huge number called “RSA-2048 (about 617 digits)”.

Even though GNFS is humanity’s strongest algorithm, it is said that even to solve 270 digits (RSA-270), it would take thousands or tens of thousands of years even if all the computers in the world were connected. For now, our LINE and bank data are safe.

But what if a “magic that instantly finds $X$ and $Y$ for any gigantic number” appears? Actually, the closest thing to that is the “Quantum Computer (Shor’s Algorithm)” currently under development. It has been mathematically proven that by using the wave properties of quantum mechanics, one can ignore the tedious card collecting puzzle and draw the answer in one shot.

The endless battle of wits between the people who make cryptography (defense) and the people who make algorithms to break it (attack). When you learn that the “prime factorization” and “algebraic expressions” learned in junior high school are actually weapons fiercely fighting on the front lines of global security, doesn’t math class seem just a little bit more interesting?

The person to discover the strongest algorithm of the future might just be you reading this article!

(Note: This article conceptualizes the mathematical charm of cryptography decryption for junior high school students. Actual GNFS is strictly calculated using advanced university mathematics such as ideal class groups of algebraic number fields and homomorphisms.)

Collatz Conjecture

Tue, 15 Jul 2025 18:03:03 +0900

Is it true that “any number eventually becomes 1”? ── Playing with the Collatz Conjecture

Hello! I’m kenji.

Suddenly, but if you hear “a rule where any number eventually becomes 1”, isn’t it a bit mysterious?

For example, 19, or 87, or even 1000000. If you tweak the numbers according to appropriate rules, for some reason it converges to “1” at the end.

Such a dream-like story is the Collatz Conjecture.

What is the Collatz Conjecture anyway?

First, let me introduce the rules.

Start: Choose any positive integer
Operation:
- If it is even → Halve it (n → n / 2)
- If it is odd → Triple it and add 1 (n → 3n + 1)

If you repeat this forever, the conjecture says that any number will eventually reach 1.

For example, starting from 6:

1

6 → 3 → 10 → 5 → 16 → 8 → 4 → 2 → 1

It properly became “1”. Welcome back!

Let’s do it in code: Collatz in Python

Now, in times like this, it’s faster to try it in code! Let’s output the “Collatz sequence” in Python.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


def collatz(n):
 steps = [n]
 while n != 1:
 if n % 2 == 0:
 n = n // 2
 else:
 n = 3 * n + 1
 steps.append(n)
 return steps

# Example: Starting from 19
print(collatz(19))

When you execute it:

1

[19, 58, 29, 88, 44, 22, 11, 34, 17, 52, 26, 13, 40, 20, 10, 5, 16, 8, 4, 2, 1]

It splendidly reaches 1. Even though it takes quite a detour, it firmly reaches the goal at the end!

By the way, even if you start from 29, it reaches 1 in the same way.

1

print(collatz(29))

When you execute it:

1
2
3
4
5
6
7
8


[27, 82, 41, 124, 62, 31, 94, 47, 142, 71, 214, 107, 322, 161, 484, 242,
121, 364, 182, 91, 274, 137, 412, 206, 103, 310, 155, 466, 233, 700, 350,
175, 526, 263, 790, 395, 1186, 593, 1780, 890, 445, 1336, 668, 334, 167,
502, 251, 754, 377, 1132, 566, 283, 850, 425, 1276, 638, 319, 958, 479,
1438, 719, 2158, 1079, 3238, 1619, 4858, 2429, 7288, 3644, 1822, 911,
2734, 1367, 4102, 2051, 6154, 3077, 9232, 4616, 2308, 1154, 577, 1732,
866, 433, 1300, 650, 325, 976, 488, 244, 122, 61, 184, 92, 46, 23, 70, 35,
106, 53, 160, 80, 40, 20, 10, 5, 16, 8, 4, 2, 1]

Surprisingly, it takes 111 steps!

Moreover, there are scenes where it balloons to over 9000 along the way. It’s a pattern that takes a huge detour before reaching the goal.

So, what’s amazing about it in the end?

What’s amazing about this conjecture is,

Even though it hasn’t been proven, it seems to become 1 no matter what number you use

That’s the point.

Eh? Then, what about 1 trillion, or 10 quadrillion…?

If you thought that, you are sharp. Actually, it has been verified up to about “2 to the 68th power” using computers, and all have reached 1. Unbelievable…

But, it hasn’t been theoretically proven that “it always happens”. This is what they call an “unsolved problem” in the world of mathematics.

Who is Mr. Collatz?

So, reading this far, you might wonder “who is Collatz anyway?”. Let me introduce him properly!

Name: Lothar Collatz
Nationality: Germany
Year of birth: 1910 - 1990
Title: Mathematician (Active in the fields of functional analysis and number theory)

He proposed this conjecture in 1937, and since then, for over 80 years, no one has been able to prove or disprove it.

By the way, this problem is so simple yet so deep that even Paul Erdős (a super famous mathematician) is said to have said this:

“Mathematics may not be ready for such problems.”

In other words, the theory that human mathematics hasn’t caught up with this mystery yet…

No “complex math formulas” are necessary

The good thing about the Collatz Conjecture is that anyone can play with it.

You can do it if you have paper and pen. If you write code in Python, you can test it automatically. And yet, cutting-edge mathematicians are seriously challenging it.

Doesn’t it make you excited?

Bonus: Code to test it all at once

I’ll also include code to test various numbers all at once.

1
2
3


for n in range(1, 21):
 steps = collatz(n)
 print(f"{n}: {steps} (Steps: {len(steps)-1})")

This outputs the Collatz sequences from “1 to 20” all at once.

Conclusion: This world is indeed mysterious

So, that’s the Collatz Conjecture.

Even though it’s super simple
No one can prove it
It’s a huge problem in the math community

It’s an existence like a cluster of mysteries.

Even programming beginners can try it, so please definitely play with it~!

P≠NP Conjecture

Wed, 11 Sep 2024 02:22:39 +0900

Overview

1

Class P is the class of problems that are decidable in polynomial time by a deterministic Turing machine. Class NP is the class of problems for which the correctness of a witness (evidence that the answer is Yes) can be verified in polynomial time when given the witness. Since problems decidable in polynomial time are also verifiable in polynomial time, it is obvious that P ⊆ NP. However, it is not clear whether P is a proper subset of NP. Although there is no proof yet, many researchers believe that P ≠ NP. This conjecture that class P and class NP are not equal is known as the "P ≠ NP conjecture".

Reference site : https://daigakudenki.com/np-hard/

Introduction to Mathematica

Thu, 25 Jul 2024 01:36:19 +0900

Introduction to Mathematica

Solve an equation

1

Solve[x^2 - 3 x + 2 == 0, x]

Output

1

{{x -> 1}, {x -> 2}}

Solve an equation within integers

1

Solve[x^2 - 3 x + 2 == 0 && 0 <= x <= 2, x, Integers]

Output

1

{{x -> 1}, {x -> 2}}

Solve simultaneous equations

1

Solve[{x + y == 3, x - y == 1}, {x, y}]

Output

1

{{x -> 2, y -> 1}}

Solve an inequality

1

Reduce[x^2 - 3 x + 2 > 0, x]

Output

1

x < 1 || x > 2

Differentiate

1

D[x^2, x]

Output

1

2 x

Integrate

1

Integrate[x^2, x]

Output

1

x^3/3

Find a limit

1

Limit[1/x, x -> 0]

Output

1

Infinity

Find a series

1

Sum[1/n^2, {n, 1, Infinity}]

Output

1

π^2/6

Create a matrix

1

m = {{1, 2}, {3, 4}}

Find the product of matrices

1

m . m

Output

1

{{7, 10}, {15, 22}}

Find the inverse matrix

1

Inverse[m]

Output

1

{{-2, 1}, {1.5, -0.5}}

Find eigenvalues and eigenvectors

1

Eigensystem[m]

Output

1

{{5, 0}, {{1, 1}, {1, -1}}}

Find the inner product of vectors

1

{1, 2} . {3, 4}

Output

1

11

Find the cross product of vectors

1

Cross[{1, 2, 3}, {4, 5, 6}]

Output

1

{-3, 6, -3}

Find the magnitude of a vector

1

Norm[{1, 2, 3}]

Output

1

√14

Find the angle between vectors

1

ArcCos[{1, 2} . {3, 4}/(Norm[{1, 2}] Norm[{3, 4}])]

Output

1

ArcCos[11/(√5 √25)]

Find the projection of a vector

1

{1, 2} . {3, 4}/Norm[{3, 4}] {3, 4}/Norm[{3, 4}]

Output

1

{11/5, 22/5}

Find the rotation of a vector

1

RotationMatrix[π/2].{1, 0}

Output

1

{0, 1}

Find the translation of a vector

1

TranslationTransform[{1, 2}][{3, 4}]

Output

1

{4, 6}

Find the scaling of a vector

1

ScalingTransform[{2, 3}][{1, 1}]

Output

1

{2, 3}

Find the reflection of a vector

1

ReflectionTransform[{1, 1}][{1, 1}]

Output

1

{0, 0}

Generate random numbers

1

RandomReal[]

Output

1

0.123456

Generate random numbers (integers)

1

RandomInteger[]

Output

1

123456

Generate random numbers (range specified)

1

RandomReal[{1, 10}]

Output

1

5.6789

Generate random numbers (integers, range specified)

1

RandomInteger[{1, 10}]

Output

1

5

Generate random numbers (distribution specified)

1

RandomVariate[NormalDistribution[0, 1]]

Output

1

0.123456

Generate random numbers (distribution specified, number specified)

1

RandomVariate[NormalDistribution[0, 1], 10]

Output

1

{0.123456, 0.234567, ..., 0.987654}

Generate random numbers (distribution specified, number specified, seed specified)

1
2


SeedRandom[12345]
RandomVariate[NormalDistribution[0, 1], 10]

Output

1

{0.123456, 0.234567, ..., 0.987654}

Apply a function to array elements

1
2
3


Map[Sqrt, {1, 4, 9}]
Sqrt /@ {1, 4, 9}
Map[#^(1/2)&, {1, 4, 9}]

Output

1

{1, 2, 3}

Define a function using lambda expressions

1
2


f = Function[x, x^2]
f[3]

Output

1

9

Compose functions

1
2
3
4


f = Function[x, x^2]
g = Function[x, x + 1]
h = Function[x, f[g[x]]]
h[3]

Output

1

16

Reference the previous calculation result

1

% + 1

Output

1

17

Pure functions

1

(#+3)&[5]

Output

1

8

Extract from an array

1
2


Select[{1, 2, 3, 4, 5}, EvenQ]
Select[{1, 2, 3, 4, 5}, Mod[#,2]==0&]

Output

1

{2, 4}

Monty Hall problem

Sun, 31 Mar 2024 23:41:51 +0900

What is the Monty Hall problem?

The Monty Hall problem is a brain teaser, in the form of a probability puzzle, loosely based on the American television game show “Let’s Make a Deal” and named after its original host, Monty Hall. The problem is as follows:

Premise: One of the three doors has a prize behind it, and the other two have a dud (goat).

The participant chooses one of the three doors.
The host opens one of the other two doors that the participant did not choose, revealing a dud.
The participant is asked whether they want to change their chosen door.

The problem is to consider whether the participant should change the door or not.

Solution

The solution to the Monty Hall problem is as follows:

If the participant does not change the initially chosen door
- Probability of winning: 1/3
- Probability of losing: 2/3
After the host opens the dud door
- If not changed, probability of winning: 1/3 (Does not change from the winning probability in step 1.)
- If changed, probability of winning: 2/3 (The probability of the remaining options.)

Therefore, the participant has a higher probability of winning by changing the door.

Reference

Wikipedia Monty Hall problem

How to Enumerate Prime Numbers Up to 1000 Using the Sieve of Eratosthenes

Sun, 09 Apr 2023 12:54:24 +0900

What is the Sieve of Eratosthenes?

The Sieve of Eratosthenes is an algorithm for finding all prime numbers up to any given limit. The algorithm is simple and can be implemented with the following steps:

Create an array of boolean values with N elements, and initialize all elements to true.
Set the 0th and 1st elements of the array to false (because 0 and 1 are not prime numbers).
If the 2nd element of the array is true, output 2 as a prime number.
Set all multiples of 2 from $2^2$ onwards in the array to false.*
If the 3rd element of the array is true, output 3 as a prime number.
Set all multiples of 3 from $3^2$ onwards in the array to false.
Repeat the same process for the 4th, 5th, …, Nth elements.

*The reason for targeting elements from the square of the number onwards to become false is because the numbers smaller than the square have already been processed (enumeration is complete).

Implementation in Rust

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


fn main() {
 let n = 1000;
 let mut is_prime = vec![true; n+1];
 is_prime[0] = false;
 is_prime[1] = false;
 for i in 2..=n {
 if is_prime[i] {
 println!("{}", i);
 let mut j = i * i;
 while j <= n {
 is_prime[j] = false;
 j += i;
 }
 }
 }
}

Slightly Faster Version

Considering the following points, we implement a slightly faster version:

Instead of initializing the array with true, initialize it with false (this is faster).
Since multiples of 2 are not prime numbers, omit the process of setting the elements of multiples of 2 to false.
There is no need to loop up to n; by enumerating primes up to the square root of n, you can enumerate primes up to n.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


fn main() {
 let n = 1000;
 let mut is_prime = vec![false; n+1];
 is_prime[2] = true;
 for i in (3..=n).step_by(2) {
 is_prime[i] = true;
 }
 for i in 3..=((n as f64).sqrt() as usize) {
 if is_prime[i] {
 let mut j = i * i;
 while j <= n {
 is_prime[j] = false;
 j += i * 2;
 }
 }
 }
 for i in (2..=n).filter(|&x| is_prime[x]) {
 println!("{}", i);
 }
}

References

Sieve of Eratosthenes

How to draw graphs using Python (matplotlib.pyplot)

Sun, 09 Apr 2023 01:02:19 +0900

Requirements

Google Account

Steps

Access https://colab.research.google.com/
Select “File” -> “New notebook”
Paste and run the following code

1
2
3
4
5
6
7


import matplotlib.pyplot as plt
import numpy as np
x = np.linspace(0, 2*np.pi, 500)
plt.plot(x, np.sin(x), label="sin curve")
plt.plot(x, np.cos(x), label="cos curve")
plt.legend() # Show legend
plt.show()

Execution Result

References

matplotlib.pyplot — Matplotlib 3.5.3 documentation

How to enable KaTeX (LaTeX-style math formulas) in Hugo

Fri, 31 Mar 2023 23:11:26 +0900

What is KaTeX

KaTeX is a JavaScript library for displaying LaTeX-style mathematical formulas in HTML.

Specifically, it can display formulas like the following:

$$f(x) = x^2 + x + 41$$

There seem to be other LaTeX-style math rendering libraries, but KaTeX is known for being simple and fast.

How to introduce it to Hugo

Create a new layouts/partials/math.html in your Hugo folder hierarchy.

Make the contents as follows:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.16.4/dist/katex.min.css" integrity="sha384-vKruj+a13U8yHIkAyGgK1J3ArTLzrFGBbBc0tDp4ad/EyewESeXE/Iv67Aj8gKZ0" crossorigin="anonymous">
<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.4/dist/katex.min.js" integrity="sha384-PwRUT/YqbnEjkZO0zZxNqcxACrXe+j766U2amXcgMg5457rve2Y7I6ZJSm2A0mS4" crossorigin="anonymous"></script>
<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.4/dist/contrib/auto-render.min.js" integrity="sha384-+VBxd3r6XgURycqtZ117nYw44OOcIax56Z4dCRWbxyPt0Koah1uHoK0o4+/RRE05" crossorigin="anonymous"></script>
<script>
document.addEventListener("DOMContentLoaded", function() {
 renderMathInElement(
 document.body,
 {
 delimiters: [
 {left: "$$", right: "$$", display: true},
 {left: "\\[", right: "\\]", display: true},
 {left: "$", right: "$", display: false},
 {left: "\\(", right: "\\)", display: false}
 ]
 });
 });
</script>

Next, add the following code to the existing file layouts/partials/extend_head.html.

1
2
3


{{ if or .Params.math .Site.Params.math }}
{{ partial "math.html" . }}
{{ end }}

Now you are ready to use KaTeX.

You can enable KaTeX by adding math: true to the front matter of a page.

All you have to do is write formulas in LaTeX style in the body of the page article.

1

$$ e^{i \pi} = -1 $$

If you describe it as above, it will be displayed as follows:

$$ e^{i \pi} = -1 $$

Math on kenji.blog

[Complete Anatomy] Understanding the Strongest Cryptanalysis Algorithm "GNFS" by Implementing it in C++

[Complete Anatomy] Understanding the Strongest Cryptanalysis Algorithm “GNFS” by Implementing it in C++

1. GNFS State-of-the-Art Logic Framework (Full Source Code)

2. The Final Goal of GNFS: $X^2 \equiv Y^2 \pmod N$

3. Phase 1: Polynomial Selection

4. Phase 2: Special-q Lattice Sieving

5. Phase 3: Filtering

6. Phase 4: Linear Algebra over GF(2) (Block Wiedemann Method)

7. Phase 5: Algebraic Square Root and Cryptographic Collapse

Conclusion

What is the "General Number Field Sieve (GNFS)", Humanity's Strongest Math that Breaks Internet Cryptography?

What is the “General Number Field Sieve (GNFS)”, Humanity’s Strongest Math that Breaks Internet Cryptography?

Chapter 1: The Goal of Decryption is a “Junior High School Formula”

Why does “same remainder” solve the cryptography?

Chapter 2: How to Find X and Y? The “Prime Card Collection Puzzle”

Step 1: Collect Only Gold Dust (Smooth Numbers) with a Sieve

Step 2: The Puzzle of Making Everything an “Even Number”

Chapter 3: The Wall of Despair That Stands in the Way

Chapter 4: Humanity’s Strongest Idea, Creating “Two Worlds”

The Magic of Algebraic Expressions

Searching for Gold Dust in Two Worlds Simultaneously

The Moment the Cryptography is Finally Broken

Conclusion: Mathematics Never Ends

Collatz Conjecture

Is it true that “any number eventually becomes 1”? ── Playing with the Collatz Conjecture

What is the Collatz Conjecture anyway?

Let’s do it in code: Collatz in Python

So, what’s amazing about it in the end?

Who is Mr. Collatz?

No “complex math formulas” are necessary

Bonus: Code to test it all at once

Conclusion: This world is indeed mysterious

Recommended Links (For interested people)

P≠NP Conjecture

Overview

Introduction to Mathematica

Introduction to Mathematica

Solve an equation

Solve an equation within integers

Solve simultaneous equations

Solve an inequality

Differentiate

Integrate

Find a limit

Find a series

Create a matrix

Find the product of matrices

Find the inverse matrix

Find eigenvalues and eigenvectors

Find the inner product of vectors

Find the cross product of vectors

Find the magnitude of a vector

Find the angle between vectors

Find the projection of a vector

Find the rotation of a vector

Find the translation of a vector

Find the scaling of a vector

Find the reflection of a vector

Generate random numbers

Generate random numbers (integers)

Generate random numbers (range specified)

Generate random numbers (integers, range specified)

Generate random numbers (distribution specified)

Generate random numbers (distribution specified, number specified)

Generate random numbers (distribution specified, number specified, seed specified)

Apply a function to array elements

Define a function using lambda expressions

Compose functions

Reference the previous calculation result

Pure functions

Extract from an array

Monty Hall problem

What is the Monty Hall problem?

Solution

Reference

How to Enumerate Prime Numbers Up to 1000 Using the Sieve of Eratosthenes

What is the Sieve of Eratosthenes?

Implementation in Rust

Slightly Faster Version