Mathematics on kenji.blog

The True Mathematical Structure of the General Number Field Sieve (GNFS)

Sat, 05 Sep 2026 02:26:13 +0900

The True Mathematical Structure of the General Number Field Sieve (GNFS)

The ultimate goal of GNFS is to find $X^2 \equiv Y^2 \pmod N$. To achieve this, mathematicians built a bridge between the “world of real integers” and the “world of algebraic number fields”. That bridge is the “homomorphism”.

Stage 1: The “Homomorphism” Connecting Worlds

1. Polynomial Selection and Root Definition

For a massive composite number $N$, select an integer $m$ and a polynomial $f(x)$ such that $f(m) \equiv 0 \pmod N$. (Example: Expand $N$ in base $m$ and create $f(x)$ from its coefficients. Here, assume $f(x)$ is irreducible (cannot be factored further) over the field of rational numbers $\mathbb{Q}$).

Next, let one of the “complex roots” of the equation $f(x) = 0$ be $\alpha$. Naturally, $f(\alpha) = 0$. $\alpha$ is not an integer but a complex number (an algebraic number) that may involve square roots or imaginary numbers.

2. Construction of Rings and Homomorphisms

Now, prepare two mathematical “rings” (worlds where addition and multiplication are defined).

World A: $\mathbb{Z}[\alpha]$ (Ring of algebraic integers containing $\alpha$) A world of numbers represented in the form $a + b\alpha + c\alpha^2 + \dots$.
World B: $\mathbb{Z}/N\mathbb{Z}$ (Ring of residues modulo $N$) A modulo arithmetic world consisting only of integers from $0$ to $N-1$.

Here, we define a mapping $\phi$ from World A to World B as follows: $$\phi : \mathbb{Z}[\alpha] \to \mathbb{Z}/N\mathbb{Z}$$ $$\phi(\alpha) = m \pmod N$$

This mapping $\phi$ is a magical operation that completely replaces the variable $\alpha$ in World A with the integer $m$ in World B. This $\phi$ possesses an extremely powerful property known as a “Ring Homomorphism”. A homomorphism is the property of “warping to another world without breaking the structure of addition and multiplication”. In other words, the following equations hold:

$\phi(X \times Y) = \phi(X) \times \phi(Y)$
$\phi(X^2) = \phi(X)^2$

What does this mean? If we can create a “square ($\gamma^2$)” of some complex element $\gamma$ in “World A (the world of $\alpha$)”, warping it to “World B (the modulo world)” via $\phi$ will ** perfectly preserve the square form $\phi(\gamma)^2$**.

Stage 2: The Collapse of Prime Factorization and the Birth of the “Ideal”

We want to collect many appropriate elements $(a - b\alpha)$ in World A ($\mathbb{Z}[\alpha]$) and multiply them together to create a “perfect square (square element)”. Normally, we could simply “prime factorize” each collected $(a - b\alpha)$ and combine them (solving via matrices) so that all prime exponents become even, thus creating a square.

However, here a devastating wall of algebra stands in our way. In algebraic number fields like $\mathbb{Z}[\alpha]$, the “uniqueness of prime factorization (any number can be uniquely expressed as a product of primes in exactly one way)”, which we learn in middle school, collapses.

(Example: In a certain algebraic number field, $6 = 2 \times 3$, but at the same time $6 = (1+\sqrt{-5}) \times (1-\sqrt{-5})$, making it impossible to know which are the true primes.)

If prime factorization is not uniquely determined, the puzzle (sieve method) of “counting the number of primes to make them even” becomes fundamentally impossible to execute.

The Salvation by Kummer and Dedekind: The “Ideal”

What saved us from this collapse was the concept of the “Ideal (ideal number)” created by 19th-century mathematicians. By considering not the elements themselves but the “set of multiples (ideals)” generated by those elements, they made prime factorization possible again.

In the ring of integers of an algebraic number field $\mathcal{O}_K$ (a more complete ring containing $\mathbb{Z}[\alpha]$), even if elements cannot be uniquely prime-factorized, it is proven that “an ideal can always be uniquely prime-factorized into a product of ‘prime ideals ($\mathfrak{p}$)’ in exactly one way”.

Therefore, in GNFS, instead of factorizing the element $(a - b\alpha)$ itself, we perform prime ideal factorization on the principal ideal $\langle a - b\alpha \rangle$ that it generates.

Stage 3: Norms and the Two Sieves

So, how do we know which prime ideals the ideal $\langle a - b\alpha \rangle$ factors into? Here, we use a function called the “Norm”. The norm is a function that converts complex elements of an algebraic number field into “ordinary real integers $\mathbb{Z}$”.

The norm of the element $(a - b\alpha)$ can be calculated by a simple polynomial calculation $b^d f(a/b)$ (where $d$ is the degree of $f(x)$).

Due to algebraic theorems, it is known that “if the norm of a certain ideal can be completely factored into small primes (is smooth), then the original ideal can also be completely factored into small prime ideals.”

Thus, GNFS simultaneously calculates the following two values for a massive number of integer pairs $(a, b)$ and collects only the pairs where both values are “smooth numbers”.

Rational Sieve: $a - bm$ (Values in the real world)
Algebraic Sieve: $b^d f(a/b)$ (Norm in the algebraic number field world)

By collecting tens of millions of pairs $(a, b)$ where both are smooth, and solving the prime factorization data of ideals (how many prime ideals are included) as a giant matrix (linear algebra over GF(2)), we find a set $S$ of pairs such that “when multiplied together, the exponents of all prime ideals become even”.

Stage 4: The Two Confronting “Obstructions” and the Ideal Class Group

Through matrix calculations, we found that multiplying all the ideals of $(a - b\alpha)$ belonging to set $S$ results in the square of a certain ideal $I$.

$$\prod_{S} \langle a - b\alpha \rangle = I^2$$

However, it doesn’t end here. The deepest and most difficult mathematical wall in GNFS lies here.

What we ultimately want is not the “square of an ideal”, but the “square of an element ($\gamma^2$)” to plug into the mapping $\phi$. Just because the ideal is squared doesn’t necessarily mean the element itself is squared. There exist two formidable mathematical obstructions here.

Obstruction 1: The Wall of the Ideal Class Group

The ideal $I$ is not always an “ideal generated by a single element (principal ideal)”. It is impossible to extract a concrete element $\gamma$ from an ideal that is not principal.

Here, the concept of the “Ideal Class Group ($Cl_K$)” comes into play. The ideal class group is a group that measures “how many non-principal ideals exist in that algebraic number field (how much the uniqueness of prime factorization is broken)”. Even if $\prod \langle a - b\alpha \rangle$ becomes $I^2$, if $I$ is not the identity element (principal ideal) in the ideal class group, it cannot be pulled back to the square of an element.

Obstruction 2: The Wall of the Unit Group

Suppose we get lucky and $I$ is a principal ideal $\langle \gamma \rangle$. Then, $\prod \langle a - b\alpha \rangle = \langle \gamma^2 \rangle$. You might think, “Great, the element is squared too!”, but that is a huge mistake.

The fact that ideals (sets of multiples) are equal does not mean the elements are completely equal. A deviation by a “Unit (a number whose reciprocal is also an integer, like 1 or -1)” inevitably occurs. In other words, the actual equality of the elements is as follows:

$$\prod_{S} (a - b\alpha) = u \cdot \gamma^2$$

($u$ is an element of the unit group $U_K$)

Unless this unit $u$ itself is the square of something (a square element), the left side can absolutely never become a “perfect square of an element”.

Stage 5: Adleman’s Magic “Quadratic Characters”

The obstruction of the ideal class group and the obstruction of the unit group. How do we overcome these two? Here, a genius method called “Quadratic Characters”, introduced by cryptographer Leonard Adleman (the “A” in RSA) and others, makes its appearance.

To determine “whether a certain element is a perfect square in the algebraic number field”, we use an algebraic number field version of the Legendre symbol (quadratic residue). To the giant matrix from earlier (the puzzle to make the count of prime ideals even), we secretly append dozens of additional conditions (columns) stating that “the quadratic characters for some special prime ideals $\mathfrak{q}$ also all become $1$ (even)”.

When we find a set $S$ that satisfies even these additional conditions through matrix calculations, deep theorems of algebraic number theory guarantee that “both the obstruction of the ideal class group and the obstruction of the unit group will naturally vanish with overwhelming probability.”

With this, we finally obtain the true equation.

$$\prod_{S} (a - b\alpha) = \gamma^2$$

Final Stage: The Convergence of Worlds and the Fall of Encryption

Finally, all the pieces of the puzzle are in place.

[Element in the Algebraic Number Field World (World A)] $\gamma^2 = \prod (a - b\alpha)$ (We find $\gamma$ from this using a square root algorithm)

[Element in the Real World (World of Rational Numbers)] $V^2 = \prod (a - bm)$ (Since this is just ordinary integer multiplication, the square root $V$ can be found normally)

Now, it’s time for the magical bridge we built at the very beginning, the homomorphism $\phi$, to take the stage. We warp the element $\gamma$ from World A to World B (the world modulo $N$) using $\phi$ (the mapping that substitutes $m$ for $\alpha$).

$$Y = \phi(\gamma) \pmod N$$

Meanwhile, we take the $V$ created in the real world directly to the modulo world and call it $X$.

$$X = V \pmod N$$

Due to the homomorphism’s property of “preserving structure”, the square relationship that held in World A is perfectly preserved in World B (the world modulo $N$) as well. Furthermore, because the original pairs $(a, b)$ were correspondingly created in the forms $a - b\alpha$ and $a - bm$, these $X$ and $Y$ collide in the world modulo $N$ to produce the following absolute equation:

$$X^2 \equiv Y^2 \pmod N$$

All that is left is to pray that these $X$ and $Y$ are not trivial solutions ($X \equiv \pm Y$) and calculate: $\gcd(X - Y, N)$

If it is a non-trivial solution, the Euclidean algorithm will race through in 0.001 seconds, and the secret primes $p$ and $q$, which are the heart of RSA encryption, will be printed on the output screen.

This is the complete form of the “General Number Field Sieve (GNFS)”, gathering the essence of modern mathematics.

A Simple Explanation of Kepler's Conjecture

Mon, 21 Jul 2025 22:53:03 +0900

A Simple Explanation of Kepler’s Conjecture! The Best Way to Pack Watermelons Tightly

Hello, this is kenji!

Today, I’d like to explain a mathematical concept with a somewhat difficult-sounding name, “Kepler’s Conjecture,” as simply as possible.

At first glance, it seems like a very niche topic, but it’s actually a quite familiar problem: “How can we pack watermelons as tightly as possible in a box?” It relates to convenience store refrigerators and how cargo is loaded.

And in the world of mathematics, it’s a super romantic story because it could not be proven for over 400 years.

Let’s get started!

Who is Kepler anyway?

First of all, who is the “Kepler” in “Kepler’s Conjecture”?

This is the name of a German astronomer and mathematician, Johannes Kepler.

He was a truly amazing person. For example, he’s the one who discovered that planetary orbits are elliptical. It’s common knowledge now, but back then (around 1600), even the heliocentric theory wasn’t widely believed.

Galileo = The genius of observation
Kepler = The genius who explained the universe with mathematical formulas
Newton = The super genius who compiled those theories into physical laws

In that kind of positioning, Kepler was a pioneer of “explaining the universe with mathematical formulas.”

And then, one day, he brought this up.

What is Kepler’s Conjecture?

Put simply, “Kepler’s Conjecture” is about this:

When packing spheres of the same size (like watermelons or oranges) into a box, which arrangement packs them the tightest?

That’s the problem.

And what Kepler conjectured in the 1600s was:

Isn’t it most efficient to stack them in a triangle-like shape, just like how oranges are displayed at a greengrocer?

That was it.

To say this more mathematically, it’s called the “Sphere Packing Problem,” which is the problem of finding the densest way to pack spheres into space.

Kepler conjectured that an arrangement called “Face-Centered Cubic (FCC)” structure (like stacking watermelons in a triangle) is the most efficient.

And, while everyone thought, “That certainly seems right,” it was incredibly difficult to mathematically prove that “This is absolutely the best!”

400 Years Until It Was Proven!?!

So, when was it actually proven?

Surprisingly, around 1998 to 2005. In other words, no one could prove it for nearly 400 years. That’s crazy.

Moreover, it was proven by an American mathematician named Thomas Hales.

He decided it was impossible to do by hand calculations alone, and proved it using computers. However, the proof was so complex that a problem arose: humans couldn’t properly check it!

This sparked a huge debate in the mathematical world: “So, can we really trust a proof done by a computer?”

In the end, the proof that said, “We have rigorously verified it, including the computer part!” (formally known as a “formal proof”) was completed in 2014.

In other words, it took over 400 years to prove that Kepler’s intuition was right. What a romantic story.

It’s Used a Lot in Real Life Too

You might think that “how to arrange spheres” is just a topic for math nerds, but it’s actually super practical.

Efficiently packing drinks in a convenience store refrigerator
Loading canned goods onto transport pallets
Applied to communications (like digital signal compression)
Used in 3D printers and the design of crystal structures

And so on, it’s a theory that’s actually heavily used behind the scenes in our daily lives.

Summary: Human Intuition is Amazing

So, let’s summarize.

Kepler’s Conjecture = The problem of how to pack spheres as tightly as possible
Mr. Kepler = The mathematician and astronomer who discovered planetary orbits
Conjectured in the 1600s! But proven in the 2000s!
It’s highly applied in real life!

And the most interesting part is that “the way greengrocers intuitively stacked things was mathematically the strongest.”

In short, human intuition is amazing. And the fact that it can take 400 years to prove it is such a romantic story.

If you’re interested, please try searching for things like “Thomas Hales”, “Formal Proof”, and “Sphere Packing”. It’s incredibly fascinating when you dig deeper into it.

See you!

[PR]

Buy Now

C Language Code to Generate Prime Numbers

Sat, 24 Aug 2024 09:38:10 +0900

Here is a simple C language code that generates prime numbers within a specified range. In this example, it enumerates prime numbers from 1 to n.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


#include <stdio.h>
#include <stdbool.h>

bool isPrime(int num) {
 if (num <= 1) return false;
 if (num <= 3) return true;
 if (num % 2 == 0 || num % 3 == 0) return false;

 for (int i = 5; i * i <= num; i += 6) {
 if (num % i == 0 || num % (i + 2) == 0) return false;
 }
 return true;
}

void printPrimes(int n) {
 printf("2 ");
 for (int i = 3; i <= n; i += 2) {
 if (isPrime(i)) {
 printf("%d ", i);
 }
 }
 printf("\n");
}

int main() {
 int n;
 printf("Please enter the maximum value of the range to generate prime numbers: ");
 scanf("%d", &n);
 printf("The prime numbers from 1 to %d are as follows:\n", n);
 printPrimes(n);
 return 0;
}

This code works as follows:

isPrime function: Determines whether a given number is a prime number. For efficiency, it first checks if it is divisible by 2 or 3, and then proceeds to check using steps of 6.
printPrimes function: Outputs the prime numbers within the specified range. It outputs 2 first, and then checks only odd numbers.
main function: Prompts the user to input the maximum value of the range and outputs the prime numbers within that range.

When you compile and run this code, it will display the prime numbers within the specified range.

What is the Birthday Paradox?

Tue, 02 Apr 2024 01:20:50 +0900

Do you know the Birthday Paradox?

Let me tell you a slightly mysterious story. How many people do you think need to gather for the “probability of people having the same birthday” to become high?

For example, a year has 365 days, so when you’re told “if 23 people gather, the probability of someone sharing a birthday is over 50%”… it feels somewhat counterintuitive, right?

But this is actually over 50%.

Why does this happen?

This phenomenon is called the “Birthday Paradox”. Its name contains “paradox”, but there is a proper mathematical reason for it.

When the number of people is “n”, the probability that no one shares a birthday can be calculated with the following formula:

1

P(No one shares) = 365/365 × 364/365 × 363/365 × ... × (365 - n + 1)/365

By subtracting that from 1, you get the “probability of sharing a birthday with someone”.

Looking at the results…

Number of People	Probability of people having the same birthday
10 people	Approx. 11.7%
20 people	Approx. 41.1%
23 people	Approx. 50.7% (Focus here!)
30 people	Approx. 70.6%
70 people	A whopping approx. 99.9%!

In other words, with just 23 people, there is a more than half chance that someone will share a birthday. It seems like this could apply quite often in a school class or a workplace meeting, right?

Conclusion: The gap between intuition and mathematics is interesting

The “Birthday Paradox” is an interesting example where our intuition and actual mathematical probabilities diverge. Knowing this kind of story might make for lively small talk or a fun quiz!

Reference Links

Birthday problem (Wikipedia)

Unsolved Problems in Mathematics

Sat, 02 Mar 2024 22:57:36 +0900

Unsolved Problems in Mathematics

This is an explanation of unsolved problems in mathematics. Although the problems themselves are simple, there are still many that have not been proven.

Are there infinitely many perfect numbers?

A perfect number is a positive integer that is equal to the sum of its positive divisors, excluding the number itself. For example,

6 has divisors 1, 2, and 3, and 1+2+3=6, so it is a perfect number.
28 has divisors 1, 2, 4, 7, and 14, and 1+2+4+7+14=28, so it is a perfect number.

Currently, only 51 perfect numbers have been discovered. It is conjectured that there are infinitely many, but this has not yet been proven.

Goldbach’s Conjecture

Goldbach’s conjecture states that every even integer greater than 2 can be expressed as the sum of two primes. (Here, a prime number is a natural number that has no positive divisors other than 1 and itself.)

For example,

4=2+2
6=3+3
8=3+5
10=3+7=5+5

The problem itself is very simple, but it remains unproven.

Riemann Hypothesis

The Riemann hypothesis is the conjecture that the zeros of the Riemann zeta function are restricted to negative even integers and complex numbers with real part 1 / 2.

The Riemann zeta function is the function $\zeta$ defined by:

$$\zeta(s):=\sum _{n=1}^{\infty }{\frac {1}{n^{s}}}=1+{\frac {1}{2^{s}}}+{\frac {1}{3^{s}}}+{\frac {1}{4^{s}}}+\cdots$$

where $s$ is a complex number and $n$ is a natural number.

History of Mathematics

Sat, 22 Jul 2023 15:25:10 +0900

The Three Classic Problems of Ancient Greek Mathematics

Given a circle, construct a square with the same area (Squaring the circle)
Given an arbitrary angle, trisect it (Angle trisection)
Given a cube, construct a cube with twice the volume (Doubling the cube)

Archimedean Spiral

On a plane, let a ray OB rotate around a fixed point O at a uniform speed. Assuming the initial position is OA, when point P starts from O simultaneously as the ray begins moving from OA, and moves along OB at a constant speed, the curve drawn by point P is an Archimedean spiral.

Pappus’s Theorem

Cycloid
Conchoid of Nicomedes
Cissoid of Diocles
Fermat’s tangent method
Descartes’ normal method

Timeline

Year	Event
c. 3400 BC	Sumerians perform calculations using clay tokens
c. 3000 BC	Hieroglyphic mathematics appears in Egypt
c. 2800 BC	Weights and measures based on the decimal system are used in the Indus Valley Civilization
c. 2700 BC	Egyptians use ropes and Pythagorean triples to verify angles
c. 2500 BC	The abacus, a calculating tool, is discovered
c. 2500 BC

Reference

History of Mathematics

How to enable KaTeX (LaTeX-style math formulas) in Hugo

Fri, 31 Mar 2023 23:11:26 +0900

What is KaTeX

KaTeX is a JavaScript library for displaying LaTeX-style mathematical formulas in HTML.

Specifically, it can display formulas like the following:

$$f(x) = x^2 + x + 41$$

There seem to be other LaTeX-style math rendering libraries, but KaTeX is known for being simple and fast.

How to introduce it to Hugo

Create a new layouts/partials/math.html in your Hugo folder hierarchy.

Make the contents as follows:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.16.4/dist/katex.min.css" integrity="sha384-vKruj+a13U8yHIkAyGgK1J3ArTLzrFGBbBc0tDp4ad/EyewESeXE/Iv67Aj8gKZ0" crossorigin="anonymous">
<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.4/dist/katex.min.js" integrity="sha384-PwRUT/YqbnEjkZO0zZxNqcxACrXe+j766U2amXcgMg5457rve2Y7I6ZJSm2A0mS4" crossorigin="anonymous"></script>
<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.4/dist/contrib/auto-render.min.js" integrity="sha384-+VBxd3r6XgURycqtZ117nYw44OOcIax56Z4dCRWbxyPt0Koah1uHoK0o4+/RRE05" crossorigin="anonymous"></script>
<script>
document.addEventListener("DOMContentLoaded", function() {
 renderMathInElement(
 document.body,
 {
 delimiters: [
 {left: "$$", right: "$$", display: true},
 {left: "\\[", right: "\\]", display: true},
 {left: "$", right: "$", display: false},
 {left: "\\(", right: "\\)", display: false}
 ]
 });
 });
</script>

Next, add the following code to the existing file layouts/partials/extend_head.html.

1
2
3


{{ if or .Params.math .Site.Params.math }}
{{ partial "math.html" . }}
{{ end }}

Now you are ready to use KaTeX.

You can enable KaTeX by adding math: true to the front matter of a page.

All you have to do is write formulas in LaTeX style in the body of the page article.

1

$$ e^{i \pi} = -1 $$

If you describe it as above, it will be displayed as follows:

$$ e^{i \pi} = -1 $$

References

Solving the Traveling Salesperson Problem with Mathematica

Wed, 12 Oct 2022 19:05:58 +0900

Solving the Traveling Salesperson Problem with Mathematica

Problem

電車でこんな広告を見かけました😁📸 pic.twitter.com/iXEgvtXrpL
— 早稲田大学早水桃子研究室 (@hayamizu_lab) October 11, 2022

Solution

1

d=SparseArray[{{1,2}->10,{2,1}->10,{1,5}->15,{5,1}->15,{1,4}->12,{4,1}->12,{1,3}->20,{3,1}->20,{2,5}->10,{5,2}->10,{3,4}->10,{4,3}->10,{3,8}->30,{8,3}->30,{3,7}->20,{7,3}->20,{3,6}->25,{6,3}->25,{4,5}->15,{5,4}->15,{4,8}->20,{8,4}->20,{5,9}->18,{9,5}->18,{5,8}->15,{8,5}->15,{6,7}->5,{7,6}->5,{7,8}->35,{8,7}->35,{8,9}->12,{9,8}->12},{9,9},Infinity];

We create a matrix using the SparseArray function. Each element represents the distance between cities at the row and column of that element. For example, the first element {1,2}->10 means the distance between 1 and 2 is 10. The second to last element {9,9} indicates the size of the matrix, and the final element Infinity means the length of paths between unspecified cities is infinite, meaning there is no path.

1

{len,tour}=FindShortestTour[{1,2,3,4,5,6,7,8,9},DistanceFunction->(d[[#1,#2]]&)]

You can easily solve the traveling salesperson problem with the FindShortestTour function. {1,2,3,4,5,6,7,8,9} represents the city numbers. DistanceFunction->(d[[#1,#2]]&) passes the matrix d which represents the distance between cities.

Output

1

{137, {1, 2, 5, 9, 8, 7, 6, 3, 4}}

The output gives the shortest distance and the tour route for it. The shortest distance is 137, and the route is 1→2→5→9→8→7→6→3→4→1. Converting this to ABC order gives A, B, E, I, H, G, F, C, D.

Favorite Mathematical Formulas

Wed, 05 Oct 2022 13:24:50 +0900

Wilson’s Theorem

When $p$ is a prime number, $(p−1)!≡−1 \pmod p$ holds.

Euler’s Formula

$e^{iπ}+1=0$

Fermat’s Last Theorem

For any integer $n≥3$, there are no positive integer solutions $x, y, z$ to the equation $x^n+y^n=z^n$.

Basel Problem

$1/1^2+1/2^2+1/3^2+1/4^2+...=π^2/6$

Euler’s Prime-Generating Polynomial

$n^2+n+41$ is a prime number for all integers $n$ from $0$ to $39$.

[Complete Mathematical Guide] Why the Ultimate Classical 'GNFS' Loses to Quantum Algorithms: The Paradigm Shift in Prime Factorization

Mon, 01 Jan 0001 00:00:00 +0000

Information security in the modern internet society is protected by public-key cryptography, such as RSA cryptography. The basis for the security of RSA relies on the fact that “the prime factorization of huge composite numbers is computationally extremely difficult.”

In this article, we will unravel the mathematical mechanism of the “General Number Field Sieve” (GNFS), which is the most powerful prime factorization algorithm for classical computers. We will also dive deeply into why it is completely defeated by “Shor’s Algorithm,” discovered by Peter Shor, exploring this paradigm shift thoroughly with mathematical formulas and conceptual diagrams.

1. The Approach to Prime Factorization in Classical Computing: Evolution from Fermat’s Factorization Method

The prime factorization problem is the problem of finding prime numbers $p$ and $q$ such that $N = p \times q$ for a given composite number $N$.

The basic idea reduces to finding non-trivial $x$ and $y$ that satisfy the following congruence:

$$ x^2 \equiv y^2 \pmod N $$

By rearranging this, we get:

$$ x^2 - y^2 \equiv 0 \pmod N $$ $$ (x - y)(x + y) \equiv 0 \pmod N $$

Here, if $x \not\equiv \pm y \pmod N$, we can obtain a non-trivial factor of $N$ by calculating $\gcd(x-y, N)$ or $\gcd(x+y, N)$. This fact is the foundation of modern prime factorization algorithms like GNFS.

2. The Ultimate Classical Algorithm: The Depths of the “General Number Field Sieve” (GNFS)

“GNFS” is the fastest known prime factorization algorithm for classical computers today. Its time complexity requires sub-exponential time.

Complexity of GNFS

Letting the number of digits (bits) of the number $N$ be $b = \log_2 N$, the computational complexity of GNFS is expressed as follows:

$$ O\left( \exp \left( \left(\frac{64}{9} b\right)^{1/3} (\log b)^{2/3} \right) \right) $$

As can be seen from this formula, the computational complexity is not polynomial time, but “sub-exponential time,” which is slightly slower than exponential time. Still, as the number of digits increases, the computation time grows astronomically.

Mathematical Mechanism of GNFS

GNFS consists broadly of four steps:

Polynomial Selection
Sieving
Matrix Reduction
Square Root

2.1. Polynomial Selection and Number Fields

First, we select irreducible polynomials $f(x)$ and $g(x)$ with integer coefficients. These are set to have a common root $m$ modulo $N$. That is,

$$ f(m) \equiv 0 \pmod N $$ $$ g(m) \equiv 0 \pmod N $$

Usually, $g(x)$ is chosen as a linear polynomial $g(x) = x - m$. If we let $\alpha$ be a root of $f(x)$, a “Number Field” $\mathbb{Q}(\alpha)$ is constructed. We compare operations in the ring of $\mathbb{Q}(\alpha)$ and operations in the normal integer ring $\mathbb{Z}$ through the homomorphism $\phi: \alpha \mapsto m$.

2.2. Sieving

Next, we search for a massive number of coprime integer pairs $(a, b)$. The goal is to find pairs such that the following two values are both “B-smooth” (composed only of relatively small prime factors):

$a - bm$ (value over the integer ring)
$b^d f(a/b)$ (corresponding to the norm $N(a - b\alpha)$ over the number field)

Here, a high-speed search method called a “Sieve” is used. This efficiently extracts $(a, b)$ pairs that satisfy the conditions from a vast number of candidates.

2.3. Linear Algebra over GF(2) (Matrix Reduction)

From the collected pairs $(a, b)$, we construct exponent vectors and find the left null space of a massive sparse matrix over $\mathbb{F}_2$ (the field with only elements 0 and 1).

We find a vector $v$ as a solution so that the relations $ \prod (a_i - b_i m) $ and $ \prod (a_i - b_i \alpha) $ both become squares. This is nothing but solving a system of linear equations:

$$ M \mathbf{x} \equiv \mathbf{0} \pmod 2 $$

Advanced numerical algorithms such as the Block Lanczos Algorithm and the Block Wiedemann Algorithm are utilized here.

2.4. Square Root

Finally, we take square roots in both the number field and the integer ring to derive the relation $x^2 \equiv y^2 \pmod N$. Then, we calculate $\gcd(x-y, N)$ to obtain the factor.

3. The Breakthrough by Quantum Computing: “Shor’s Algorithm”

While GNFS requires sub-exponential time, “Shor’s Algorithm,” published by Peter Shor in 1994, can solve this problem in “polynomial time” by using a quantum computer.

Complexity of Shor’s Algorithm

When the number of qubits is $O(\log N)$, the time complexity is as follows:

$$ O((\log N)^3) $$

This means it does not cause an exponential explosion with respect to the number of bits. This is an astonishing result: even for huge composite numbers where the complexity of “classical computing” exceeds the lifespan of the universe, they can be cracked in hours to days with “quantum computing.”

Overview of Shor’s Algorithm: Reduction to the Period-Finding Problem

Shor’s algorithm cleverly reduces the prime factorization problem to a “period-finding problem.”

Choose a random integer $a$ coprime to $N$ ($1 < a < N$).
Define the function $f(x) = a^x \bmod N$.
Find the period $r$ of $f(x)$, i.e., the smallest positive integer $r$ such that $a^r \equiv 1 \pmod N$.
If $r$ is even, check if $a^{r/2} \not\equiv -1 \pmod N$, and calculate $\gcd(a^{r/2} \pm 1, N)$ to obtain a prime factor.

“Finding the period $r$” in step 3 is the bottleneck that requires exponential time on classical computers, but quantum computers solve this instantly using “quantum superposition” and the “Quantum Fourier Transform” (QFT).

4. Quantum Fourier Transform (QFT) and Period Extraction

Let’s look in detail with formulas at the manipulation of quantum states, which is the core of Shor’s algorithm.

4.1. Generation of Quantum Superposition

First, we prepare two quantum registers. Register 1 holds a superposition state of inputs $x$, and Register 2 holds the computation result $f(x)$. We apply the Hadamard Transform to the initial state $|0\rangle |0\rangle$ to create a superposition of all possible $x$.

$$ |\psi_1\rangle = \frac{1}{\sqrt{Q}} \sum_{x=0}^{Q-1} |x\rangle |0\rangle $$

(Here $Q$ is a power of 2 satisfying $N^2 \le Q < 2N^2$)

Next, we use a quantum oracle $U_f$ to compute $f(x) = a^x \bmod N$ and store it in Register 2.

$$ |\psi_2\rangle = U_f |\psi_1\rangle = \frac{1}{\sqrt{Q}} \sum_{x=0}^{Q-1} |x\rangle |a^x \bmod N\rangle $$

Let’s assume here that we measure Register 2 (in reality, the mathematical structure is the same even without measurement). If a value $y = a^{x_0} \bmod N$ is observed, the state of Register 1 collapses into a superposition of all $x$ such that $f(x) = y$. Letting the period be $r$, such $x$ are $x_0, x_0 + r, x_0 + 2r, \dots$

$$ |\psi_3\rangle = \frac{1}{\sqrt{M}} \sum_{k=0}^{M-1} |x_0 + kr\rangle $$

(Here $M \approx Q/r$ is the number of terms)

This state inherently contains information about the period $r$, but direct measurement will only yield a random $x_0 + kr$, and the period $r$ remains unknown. This is where QFT comes in.

4.2. Application of the Quantum Fourier Transform (QFT)

QFT is an operation that performs a discrete Fourier transform on the amplitudes of quantum states. The action of QFT on state $|x\rangle$ is defined as follows:

$$ \text{QFT} |x\rangle = \frac{1}{\sqrt{Q}} \sum_{y=0}^{Q-1} e^{2\pi i \frac{xy}{Q}} |y\rangle $$

When this is applied to $|\psi_3\rangle$, phase interference (quantum interference) occurs.

$$ |\psi_4\rangle = \text{QFT} |\psi_3\rangle = \frac{1}{\sqrt{MQ}} \sum_{y=0}^{Q-1} \sum_{k=0}^{M-1} e^{2\pi i \frac{(x_0 + kr)y}{Q}} |y\rangle $$

Expanding the sum in this equation reveals the part:

$$ \sum_{k=0}^{M-1} e^{2\pi i \frac{kry}{Q}} $$

This sum of a geometric series reinforces each other (Constructive Interference) only when $ry/Q$ is close to an integer, and cancels each other out (Destructive Interference) otherwise.

Therefore, the state $|y\rangle$ measured with high probability will be an integer $y$ that satisfies the condition:

$$ \frac{y}{Q} \approx \frac{c}{r} $$

(where $c$ is some integer).

4.3. Identifying the Period via Continued Fraction Expansion

After obtaining $y$ through measurement, we perform a “Continued Fraction Expansion” of $y/Q$ using a classical computer. This allows us to calculate the convergent fraction $c/r$ of $y/Q$, and extract candidates for the period $r$ from the denominator with high efficiency.

5. Comparison of Conceptual Models and the Paradigm Shift

To intuitively understand the difference between GNFS and Shor’s algorithm, we present a conceptual diagram using Mermaid notation.

Conceptual Diagram of Shor’s Algorithm via Quantum Circuit

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


graph TD
 A[Initial State: 0...0] --> B[Superposition of all states via Hadamard Transform]
 B --> C[Modular exponentiation a^x mod N]
 C -->|Quantum Entanglement| D[Collapse to a state with periodicity]
 D --> E[Quantum Fourier Transform QFT]
 E -->|Probability amplification via interference| F[Measurement: Obtain y]
 F --> G[Classical processing: Continued Fraction Expansion]
 G --> H[Discovery of period r]
 H --> I[Calculate prime factors of N]

 style A fill:#f9f,stroke:#333,stroke-width:2px
 style E fill:#bbf,stroke:#333,stroke-width:2px
 style I fill:#bfb,stroke:#333,stroke-width:2px

The Essence of the Paradigm Shift

GNFS takes the approach of “searching for relations within a mathematical space (number field).” However, since the search space expands exponentially with the number of digits, it becomes virtually unsolvable for classical computer capabilities (even including parallelization) when the key length exceeds 2048 bits.

On the other hand, Shor’s algorithm utilizes the “wave nature of quantum interference.” It simultaneously evaluates all computation paths in a superposition state, uses QFT to cancel out (destructively interfere) unnecessary answers, and amplifies (constructively interferes) only the probability amplitude of the period that is the correct answer. Through this, instead of searching space, it realizes a completely different dimensional approach of “making the correct answer itself surface.”

6. Summary

In this article, we deeply compared the mathematical backgrounds and algorithmic structures of “GNFS,” the pinnacle of classical limits, and “Shor’s Algorithm,” which demonstrates the power of quantum computing.

While GNFS drove computational complexity down to sub-exponential time by employing mathematical tricks such as polynomial selection and massive matrix calculations, Shor’s algorithm fused the fundamental principles of quantum mechanics—superposition and interference—with a mathematical tool (QFT), achieving a breakthrough to polynomial time in one stroke.

Currently, Fault-Tolerant Quantum Computers (FTQC) capable of executing Shor’s algorithm at a practical scale (thousands of qubits) do not exist. However, the very existence of this mathematical and theoretical paradigm shift is the primary reason why the transition to Post-Quantum Cryptography (PQC) is urgently being accelerated worldwide today.