RSA on kenji.blog

Will Quantum Computers Really Break RSA Encryption? ~Shor's Algorithm and the Current State of the Art~

Sat, 05 Sep 2026 22:09:21 +0900

Introduction: The Intersection of Cryptography and Quantum Computers

In modern Internet society, “public-key cryptography” is the foundation for protecting the secrecy of communications. A representative example of this is “RSA encryption,” developed in 1977 by Ron Rivest, Adi Shamir, and Leonard Adleman. From online shopping payments we use every day to website browsing (HTTPS) and email transmission/reception, RSA encryption functions as the heart of the Internet infrastructure.

However, it has been pointed out that the advent of “quantum computers” could fundamentally overturn this security. Media outlets sometimes run sensational headlines like, “Once quantum computers are completed, passwords and codes worldwide will be decrypted in seconds.” But is this really true?

In this article, we delve deeply into the mechanisms of GNFS (General Number Field Sieve), a classical cryptanalysis method, and “Shor’s Algorithm,” the definitive cryptanalysis algorithm using a quantum computer. We will explain advanced concepts like Quantum Fourier Transform and period finding in an easy-to-understand manner, and examine in detail the current state of quantum hardware in the NISQ (Noisy Intermediate-Scale Quantum) era and the hurdles required to actually break RSA-2048.

The Core of RSA Encryption: The Difficulty of Prime Factorization

The security of RSA encryption relies on a very simple asymmetry in mathematics. It is based on the fact that “it is easy to multiply two enormous prime numbers together, but it is extremely difficult to find the original two prime numbers (prime factorization) from the result of that multiplication (a composite number).”

For example, suppose we have two prime numbers, $ p = 61 $ and $ q = 53 $. Calculating this multiplication $ N = p \times q = 3233 $ is instantaneous. However, if given only the number “3233” and asked, “Which prime numbers were multiplied to get this?”, the computational complexity explodes as the numbers get larger.

In the currently mainstream RSA-2048, a massive composite number $ N $ with a key length of 2048 bits—about 617 decimal digits—is used. If this $ N $ can be factored into primes, the encryption is as good as broken.

The Challenge by Classical Computers: GNFS (General Number Field Sieve)

To solve the prime factorization problem, mathematicians and cryptographers have developed various algorithms over the years. Among them, the fastest currently on classical computers is the General Number Field Sieve (GNFS).

GNFS is a method that extends computations in the ring of integers to more abstract algebraic number fields (Number Fields) to analyze and factorize a huge number $ N $. The rough flow is as follows:

Polynomial Selection: Find a polynomial $ f(x) $ with appropriate degrees and coefficients that has $ N $ as a root.
Data Collection (Sieving): Over the field of rational numbers and algebraic number fields, search for a massive amount of pairs of numbers that can be factored into small prime numbers (Smooth numbers). This process is called “sieving” and is the most time-consuming part.
Matrix Generation and Reduction: Based on the collected relations, generate a huge sparse matrix (a matrix where most components are 0) and find a solution using linear algebraic methods (such as the Block Lanczos algorithm).
Square Root Calculation: Finally, calculate the square root over the algebraic number field and derive the factors (prime factors) of $ N $.

The computational complexity of GNFS is non-asymptotically evaluated as $ O(\exp((\sqrt[3]{\frac{64}{9}} + o(1)) (\log N)^{\frac{1}{3}} (\log \log N)^{\frac{2}{3}})) $. This is called “sub-exponential” time complexity. While faster than exponential time, it is still far slower than polynomial time.

In fact, in 2020, an international research team succeeded in the prime factorization of RSA-250 (an 829-bit, 250-digit composite number) using GNFS. This calculation gathered computing resources from around the world and spent an enormous amount of computing time, roughly 2,700 CPU core years. However, when it comes to 2048 bits, the required computational complexity is said to swell to trillions of times the lifespan of the universe, making it impossible to decrypt within a realistic time frame using classical methods, no matter how many supercomputers are run in parallel.

The Trump Card of Quantum Computers: Shor’s Algorithm

Enter “Shor’s Algorithm,” announced by Peter Shor in 1994. This algorithm was groundbreaking because it could solve the prime factorization problem on a quantum computer in polynomial time ( $ O((\log N)^3) $ ). The difference between sub-exponential time and polynomial time is decisive; in theory, the use of quantum computers means the complete destruction of RSA encryption.

The Overall Flow of Shor’s Algorithm

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


graph TD
 A[Input number N to be factored] --> B[Select a random integer a]
 B --> C{Greatest Common Divisor<br>of a and N}
 C -->|Greater than 1| D[Luckily discovered a prime factor!]
 C -->|1 Mutually prime| E[Quantum computer takes the stage]
 E --> F[Find the period r of the function<br>f_x = a^x mod N<br>using Quantum Fourier Transform]
 F --> G{Is period r even and<br>a^r/2 ≢ -1 mod N?}
 G -->|Yes| H[Calculate greatest common divisor gcd_a^r/2 ± 1, N]
 H --> I((Prime factorization successful!))
 G -->|No| B

Shor’s algorithm does not solve the prime factorization problem directly, but rather uses theorems from number theory to transform it into another problem called the “Period Finding Problem,” and solves that rapidly by leveraging the characteristics of a quantum computer.

Step 1: Reduction from Prime Factorization to the Period Finding Problem (Classical Processing)

The first step of the algorithm is performed on a classical computer. For the number $ N $ you want to factorize, pick a random integer $ a $ ( $ 1 < a < N $ ) that is coprime to $ N $ (their greatest common divisor is 1). If by chance the greatest common divisor is not 1, the common divisor found at that point is a prime factor of $ N $, and decryption is complete, but the probability of this is extremely low.

Next, consider the following sequence of modulo equations: $ f(x) = a^x \pmod N $

If we substitute $ x = 1, 2, 3, \dots $ into this function $ f(x) $, the values may seem random, but because we are calculating within a finite range, it will always return to the original value somewhere and repeat the same sequence of numbers. The period of this repetition is called $ r $. In other words, the problem of finding the smallest positive integer $ r $ such that $ a^r \equiv 1 \pmod N $, this is the “Period Finding Problem”.

If this period $ r $ is found, and $ r $ is an even number, then $ a^r - 1 \equiv 0 \pmod N $, and using the factorization formula, it can be transformed into: $ (a^{r/2} - 1)(a^{r/2} + 1) \equiv 0 \pmod N $ From here, by using the Euclidean algorithm to calculate the greatest common divisor of $ N $ and $ a^{r/2} \pm 1 $, a prime factor of $ N $ can be obtained with extremely high probability.

Finding the period $ r $ on a classical computer ultimately requires an exponential number of steps and cannot be sped up. However, a quantum computer can find this period $ r $ in an instant (in polynomial time).

Step 2: Preparation and Superposition of Quantum States

This is where the quantum computer comes into play. Quantum computers use “Qubits”, which can simultaneously hold the states of “0” and “1”. In Shor’s algorithm, two registers are prepared: a register to store inputs (the first register) and a register to store calculation results (the second register).

First, a quantum gate operation called a Hadamard gate is applied to all qubits in the first register. As a result, the first register becomes an equal superposition state of all conceivable values of $ x $ (from $ 0 $ to $ 2^n-1 $, where $ n $ is a sufficiently large number of bits).

In other words, inside the quantum computer, a state is created where countless input values $ x=0, 1, 2, 3, \dots $ exist simultaneously in parallel.

Step 3: Quantum Modular Exponentiation

Next, taking the superposition state of the first register as input, calculate $ f(x) = a^x \pmod N $ and store the result in the second register. Because this calculation is executed as a unitary transformation on a quantum circuit, the calculation of $ f(x) $ for all $ x $ is performed “simultaneously and in parallel (quantum parallelism)” while maintaining the superposition.

The space of the entire quantum system at this point is an enormous superposition of states: $ |x, a^x \bmod N\rangle $

However, if we simply measure (observe) the second register here, a single random value of $ a^x \bmod N $ will be probabilistically selected, and the $ x $ of the first register will be fixed to one value in conjunction with it. This is exactly the same as calculating it once on a classical computer, and the period $ r $ cannot be found.

Under the rules of quantum mechanics, you cannot directly peek into the contents of a superposition state. So how do we extract the global information of the overall “period”?

Step 4: Quantum Fourier Transform (QFT)

The true brilliance of Shor’s algorithm that breaks through this wall is the application of the Quantum Fourier Transform (QFT) to the first register.

Before making a measurement, we analyze the wave properties of the function $ f(x) $. Suppose we observed the second register. Suppose a value $ y $ was obtained. Then, the state of the first register collapses to a “superposition of all $ x $ such that $ a^x \pmod N = y $”. These values of $ x $ will be in a state that is discretely arranged at intervals of period $ r $, such as $ x_0, x_0 + r, x_0 + 2r, x_0 + 3r, \dots $ (a kind of comb-like probability amplitude distribution).

We apply the Quantum Fourier Transform (QFT) to this state. Just as the classical discrete Fourier transform converts a time-domain signal into the frequency domain, QFT causes interference in the probability amplitudes of the quantum state.

When QFT is applied, due to quantum interference effects, the probabilities of incorrect answers that do not resonate with the period $ r $ (where phases do not align) cancel each other out and approach zero (destructive interference), and only the probability of the correct answer that carries the information of the period $ r $ is amplified (constructive interference).

Step 5: Measurement and Continued Fraction Expansion (Classical Post-Processing)

When the first register is measured after applying QFT, an integer $ c $ close to the form $ c \approx \frac{j \cdot 2^n}{r} $ is obtained with very high probability (where $ j $ is an unknown integer and $ 2^n $ is the size of the register).

By returning this measurement result $ c $ to a classical computer and creating a fraction $ \frac{c}{2^n} \approx \frac{j}{r} $, and then calculating an approximate value using a mathematical method called “Continued fraction expansion”, the denominator, the period $ r $, can be successfully brought to light.

Once $ r $ is known, the prime factors of $ N $ can be calculated using the formula from Step 1, and the RSA encryption is completely broken.

The Capability and Challenges of Current Quantum Computers (NISQ)

While Shor’s algorithm is theoretically perfect, if asked, “Will RSA encryption be broken tomorrow?”, the answer is a definitive “No.” The reason lies in the limitations of current quantum computer hardware technology.

The NISQ (Noisy Intermediate-Scale Quantum) Era

We currently exist in an era known as “NISQ”. NISQ devices have tens to hundreds of physical qubits, but they are extremely vulnerable to noise.

Qubits are susceptible to external environmental influences such as heat and electromagnetic waves, and “decoherence” (loss of quantum entanglement) where the quantum state breaks down, and “gate errors” during gate operations occur frequently. If one tries to execute a very deep quantum circuit (with an enormous number of calculation steps) like Shor’s algorithm, errors accumulate during the calculation, and the final output becomes completely meaningless noise.

Physical Qubits and Logical Qubits

What is indispensable for solving this error problem is “Quantum Error Correction”. While error correction codes are also used in classical computers, quantum error correction is extremely complex due to the “no-cloning theorem” which forbids the duplication of quantum states.

In quantum error correction, an ideal, error-free “logical qubit” is created by combining a large number of noisy “physical qubits” using techniques such as the “Surface Code”.

Assuming current error rates, it is estimated that approximately 1,000 to 10,000 physical qubits will be required to create one logical qubit. This is called “error correction overhead”.

What Resources Are Needed to Break RSA-2048?

So, how many resources are actually needed to run Shor’s algorithm to decrypt RSA-2048?

According to a groundbreaking resource estimation in a 2021 paper by Craig Gidney (Google) and Martin Ekerå, if an optimized Shor’s algorithm is used and error correction by surface codes is performed, the following resources will be required:

Number of logical qubits: Approx. 4,096
**Number of physical qubits : ** Approx. 20 million (Assuming an error rate of about $10^{-3}$)
Computation time: Approx. 8 hours (Millions to billions of physical gate operations required)

In contrast, what is the current state of quantum hardware? The superconducting quantum processor “Condor” announced by IBM at the end of 2023 has 1,121 qubits. In addition, groundbreaking research on the generation of logical qubits (such as the generation of 48 logical qubits using a neutral atom quantum computer by Harvard University and QuEra, etc.) has appeared, but we are not yet at the stage where we can continuously execute “perfect, noise-free calculations” for a long time.

Scaling up from a few thousand physical qubits to 20 million practical physical qubits (and a system that is interconnected, operates stably at cryogenic temperatures, and can process control signals at ultra-high speeds) presents a tremendous engineering wall (wiring problems, limits of cooling capacity, bloating of control electronics). Many experts predict that it will take at least 10 to 30 years, or even longer, to realize a “Fault-Tolerant Quantum Computer (FTQC)” capable of breaking RSA-2048.

The Creeping Threat of “Store Now, Decrypt Later” and the Dawn of PQC

It is premature to think, “We are safe since it will still take more than 10 years.” Currently, there is data that must remain secret for decades to come, such as national classified information, medical data, and long-term infrastructure designs.

What is feared here is the threat of an attack method known as “Store Now, Decrypt Later”. Malicious nations or organizations intercept all communication data currently encrypted with RSA or ECC (Elliptic Curve Cryptography) and store it in storage. Then, 10 or 20 years later, the moment a powerful quantum computer is completed, they use Shor’s algorithm to decrypt all past data and expose secrets.

To counter this time lag threat, the standardization process for “Post-Quantum Cryptography (PQC)” has been rapidly advancing, primarily led by NIST (National Institute of Standards and Technology).

PQC is a new cryptographic algorithm based on mathematical problems that are difficult to solve even with a quantum computer (i.e., Shor’s algorithm cannot be applied). The main approaches include the following:

Lattice-based cryptography: Based on problems such as LWE (Learning with Errors). The mainstream in NIST standardization (Kyber, Dilithium, etc.).
Code-based cryptography: Relies on the difficulty of the decoding problem of error-correcting codes.
Multivariate cryptography: Relies on the difficulty of solving systems of multivariate quadratic equations.
Hash-based signatures: Digital signatures that rely solely on the security of hash functions.

Major software and platforms such as Google Chrome and Apple’s iMessage have already started introduction testing and hybrid implementation of PQC.

Conclusion

Quantum computers are transitioning from a pipe dream in the world of science fiction to a real engineering challenge. Shor’s algorithm is a great intellectual achievement of humanity that merges mathematics and quantum mechanics, but at the same time, it harbors a “destructive power” that shakes the foundations of our digital society.

RSA encryption will not suddenly become unusable tomorrow. However, considering the evolution of quantum technology and the risk of “Store Now, Decrypt Later,” a large-scale migration that will remain in cryptographic history—the transition to PQC—has already begun. We are now witnessing the front lines of a paradigm shift in information security.

[Complete Anatomy] Understanding the Strongest Cryptanalysis Algorithm "GNFS" by Implementing it in C++

Sat, 05 Sep 2026 13:04:59 +0900

[Complete Anatomy] Understanding the Strongest Cryptanalysis Algorithm “GNFS” by Implementing it in C++

The “RSA cryptography” fundamentally supports the modern Internet. Its robustness relies on the mathematical belief that “factoring huge composite numbers is practically impossible with current computers.”

However, humanity has never given up. Currently, for classical computers (regular computers, not quantum computers), there exists the **strongest and most advanced algorithm of humanity ** for performing giant prime factorizations. That is the “General Number Field Sieve (GNFS)”.

In this article, we will strictly model the state-of-the-art computational logic of GNFS in C++ (using the multiple-precision integer boost::multiprecision from the Boost library), publish the entire implementation code, and thoroughly explain the depths of “algebraic number theory” behind it.

Please enjoy the mystery of mathematics and the brute force of computer science that wrestles it down, along with the source code.

1. GNFS State-of-the-Art Logic Framework (Full Source Code)

First, here is the full picture of the C++ implementation of GNFS that we will explain this time. The actual number field sieve (such as CADO-NFS) is an ultra-massive distributed system spanning hundreds of thousands of lines, but this code extracts the “5 essential pipelines (phases)” that make up GNFS, designs them as classes, and models them in a minimal configuration without losing their mathematical meaning.

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227


#include <iostream>
#include <vector>
#include <cmath>
#include <map>
#include <set>
#include <chrono>
#include <boost/multiprecision/cpp_int.hpp>

// Using Boost.Multiprecision for multiple-precision integers
using namespace boost::multiprecision;

// ============================================================================
// [SOTA GNFS] General Number Field Sieve State-of-the-Art Logic Framework
//
// This code strictly models the 5 pipelines of state-of-the-art GNFS used in
// CADO-NFS etc., as a class design in C++ (Boost).
// ============================================================================

struct Relation {
 int64_t a;
 int64_t b;
 std::vector<uint32_t> rational_primes;
 std::vector<uint32_t> algebraic_primes;
};

// ============================================================================
// Phase 1: Polynomial Selection (KleinJung's algorithm)
// ============================================================================
class PolynomialSelector {
public:
 int degree;
 std::vector<cpp_int> f; // Algebraic side polynomial f(x)
 std::vector<cpp_int> g; // Rational side polynomial g(x) = x - m
 cpp_int m;

 PolynomialSelector(int d) : degree(d) {}

 // Initial polynomial generation based on base-m expansion (actually uses more advanced lattice basis reduction LLL)
 void select(const cpp_int& N) {
 std::cout << "[Phase 1] Polynomial Selection (Degree " << degree << ") starting..." << std::endl;
 // Simple base-m expansion (degree d)
 // m = N^(1/d)
 cpp_int N_copy = N;
 m = 1;
 // Simple approximation of m (approximation without using Boost functions)
 cpp_int low = 1, high = N;
 while (low <= high) {
 cpp_int mid = low + (high - low) / 2;
 cpp_int p = 1;
 for(int i=0; i<degree; ++i) p *= mid;
 if (p <= N) { m = mid; low = mid + 1; }
 else { high = mid - 1; }
 }

 f.resize(degree + 1);
 cpp_int temp = N;
 for (int i = 0; i <= degree; ++i) {
 f[i] = temp % m;
 temp /= m;
 }

 g = {-m, 1}; // g(x) = x - m

 std::cout << " -> m = " << m << std::endl;
 std::cout << " -> f(x) = ";
 for(int i = degree; i >= 0; --i) {
 std::cout << f[i] << "x^" << i << (i > 0 ? " + " : "");
 }
 std::cout << "\n[Phase 1] Complete." << std::endl;
 }
};

// ============================================================================
// Phase 2: Lattice Sieving
// ============================================================================
// In recent GNFS, instead of Line Sieve, Special-q Lattice Sieving by
// Franke-Kleinjung et al. is the de facto standard.
class LatticeSieve {
 uint32_t rational_bound;
 uint32_t algebraic_bound;
 std::vector<uint32_t> rational_fb;
 std::vector<uint32_t> algebraic_fb;

public:
 LatticeSieve(uint32_t rb, uint32_t ab) : rational_bound(rb), algebraic_bound(ab) {}

 void generate_factor_bases() {
 std::cout << "[Phase 2] Generating Factor Bases (Rational Bound: " << rational_bound << ", Algebraic Bound: " << algebraic_bound << ")" << std::endl;
 // (Omitted) In reality, it generates primes and filters them using Legendre symbols, etc.
 }

 std::vector<Relation> sieve(const PolynomialSelector& poly) {
 std::cout << "[Phase 2] Special-q Lattice Sieving active..." << std::endl;
 std::vector<Relation> relations;
 // Mock implementation: Actual lattice sieving scans hundreds of GB of memory space block by block.
 // It maps (a, b) pairs to lattices for each special prime q (a = i*q + j*...),
 // and executes a sieve that maximizes cache efficiency.

 // Add one dummy relation for demo
 Relation r; r.a = 17; r.b = 3;
 r.rational_primes = {2, 5};
 r.algebraic_primes = {3, 7};
 relations.push_back(r);

 std::cout << "[Phase 2] Found " << relations.size() << " relations." << std::endl;
 return relations;
 }
};

// ============================================================================
// Phase 3: Filtering (Singleton removal and clique merging)
// ============================================================================
class Filter {
public:
 void reduce_matrix(std::vector<Relation>& relations) {
 std::cout << "[Phase 3] Filtering Relations..." << std::endl;
 // 1. Singleton removal (removing relations with primes that appear only once)
 // 2. Clique merging (merging relations to make a sparse matrix denser)
 // In reality, it compresses a matrix of hundreds of millions of rows down to several million using algorithms like Union-Find.
 std::cout << "[Phase 3] Matrix size reduced optimally." << std::endl;
 }
};

// ============================================================================
// Phase 4: Linear Algebra over GF(2) (Block Wiedemann method)
// ============================================================================
class LinearAlgebraGF2 {
public:
 // In modern supercomputing environments, the Block Wiedemann method (Coppersmith implementation),
 // which is more suitable for distributed computing than the Block Lanczos method, is used as the state-of-the-art.
 std::vector<std::vector<int>> solve_nullspace(const std::vector<Relation>& relations) {
 std::cout << "[Phase 4] Block Wiedemann algorithm over GF(2) starting..." << std::endl;
 // Iterates matrix-vector multiplication of a sparse matrix,
 // and finds multiple solution vectors (kernels) where M * x = 0 mod 2.

 std::vector<std::vector<int>> dependencies; // List of dependencies
 // Dummy data
 dependencies.push_back({0});

 std::cout << "[Phase 4] Found " << dependencies.size() << " linear dependencies (perfect squares)." << std::endl;
 return dependencies;
 }
};

// ============================================================================
// Phase 5: Algebraic Square Root
// ============================================================================
class AlgebraicSquareRoot {
public:
 void compute_and_factor(const std::vector<Relation>& relations, const std::vector<int>& dep, const cpp_int& N) {
 std::cout << "[Phase 5] Algebraic Square Root computation..." << std::endl;

 // 1. Compute the rational side square root V (simple integer arithmetic)
 cpp_int V = 1;
 // V = sqrt( prod(a - bm) ) mod N

 // 2. Compute the algebraic side square root gamma (Montgomery's method, etc.)
 // Find an element gamma in the huge algebraic field O_K, and map it to the real world using the homomorphism map phi
 // Y = phi(gamma) mod N
 cpp_int Y = 1;

 // Assuming that sequences of Quadratic Characters were added in Phases 2 and 4
 // to bypass the obstruction of the ideal class group and the unit group.

 std::cout << " -> Homomorphism map phi applied." << std::endl;
 std::cout << "[Phase 5] Calculating GCD(V - Y, N)..." << std::endl;

 cpp_int factor = gcd(V - Y, N); // GCD(X-Y, N)

 if (factor > 1 && factor < N) {
 std::cout << "\n================================================================" << std::endl;
 std::cout << "[SUCCESS] Non-trivial factor found: " << factor << std::endl;
 std::cout << " Other factor: " << N / factor << std::endl;
 std::cout << "================================================================" << std::endl;
 } else {
 std::cout << "[FAILURE] Trivial solution. Trying next dependency..." << std::endl;
 }
 }
};

// ============================================================================
// Main Execution Pipeline
// ============================================================================
int main() {
 std::cout << "================================================================" << std::endl;
 std::cout << " [SOTA GNFS] General Number Field Sieve Engine (Boost C++) " << std::endl;
 std::cout << "================================================================" << std::endl;

 // Huge composite number N to factor, such as RSA-270
 cpp_int N("233108530344407544527637656910680524145619812480305449042948611968495918245135782867888369318577116418213919268572658314913060672626911354027609793166341626693946596196427744273886601876896313468704059066746903123910748277606548649151920812699309766587514735456594993207");

 // Degree of the polynomial (normally select degree 5-6 for numbers over 130 digits)
 int degree = 6;

 // Initialize pipeline
 PolynomialSelector poly_select(degree);
 LatticeSieve sieve(10000000, 20000000); // Actual bounds are tens of millions to hundreds of millions
 Filter filter;
 LinearAlgebraGF2 linalg;
 AlgebraicSquareRoot sqrt_step;

 auto start_time = std::chrono::high_resolution_clock::now();

 // 1. Polynomial selection
 poly_select.select(N);

 // 2. Sieving process
 sieve.generate_factor_bases();
 std::vector<Relation> relations = sieve.sieve(poly_select);

 // 3. Filtering (matrix compression)
 filter.reduce_matrix(relations);

 // 4. Linear algebra (nullspace search over GF(2))
 std::vector<std::vector<int>> dependencies = linalg.solve_nullspace(relations);

 // 5. Algebraic square root computation and GCD
 for (const auto& dep : dependencies) {
 sqrt_step.compute_and_factor(relations, dep, N);
 }

 auto end_time = std::chrono::high_resolution_clock::now();
 std::chrono::duration<double> elapsed = end_time - start_time;
 std::cout << "\n[System] SOTA GNFS Pipeline completed in " << elapsed.count() << " seconds." << std::endl;

 return 0;
}

Now, how does this code destroy the cryptographic wall? I will break down and explain the meticulous algorithm and advanced mathematics phase by phase.

2. The Final Goal of GNFS: $X^2 \equiv Y^2 \pmod N$

The goal that not only GNFS but most modern large integer factorization algorithms aim for is to find a non-trivial pair $(X, Y)$ that satisfies the following congruence:

$$X^2 \equiv Y^2 \pmod N$$

This equation means that “the remainders of $X^2$ and $Y^2$ divided by $N$ are equal”. If we transform this: $X^2 - Y^2 \equiv 0 \pmod N$ In other words, $(X-Y)(X+Y)$ becomes a multiple of $N$.

If $X \not\equiv \pm Y \pmod N$ (a non-trivial solution), then between $(X-Y)$ and $N$, there exists a “common divisor greater than 1 and less than $N$”. Here, if we compute $\gcd(X-Y, N)$ using the Euclidean algorithm, the prime factors of $N$ can be easily found.

However, finding these $X$ and $Y$ is like looking for a needle in a desert. Thus, GNFS takes the genius approach of creating two worlds, the “real integer world” and the “algebraic field of polynomials world”, and distributing the computation.

3. Phase 1: Polynomial Selection

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


class PolynomialSelector {
 // ...
 void select(const cpp_int& N) {
 // Calculation of m = N^(1/d) and base-m expansion
 // ...
 for (int i = 0; i <= degree; ++i) {
 f[i] = temp % m;
 temp /= m;
 }
 g = {-m, 1}; // g(x) = x - m
 }
};

The first step of GNFS is to create a “magic polynomial” to bridge the two worlds. For a huge number $N$, we choose an integer $m$. Usually, it is chosen such that $m \approx N^{1/d}$ (in the code, a polynomial of degree $d=6$ is assumed).

Then, $N$ is expanded in base $m$, and its coefficients are used to construct the polynomial $f(x)$.

$$N = c_d m^d + c_{d-1} m^{d-1} + \dots + c_1 m + c_0$$ $$f(x) = c_d x^d + c_{d-1} x^{d-1} + \dots + c_1 x + c_0$$

This polynomial $f(x)$ has the extremely important property that “substituting $m$ for the variable $x$ evaluates exactly to $N$ ($f(m) = N$)”. In other words, $f(m) \equiv 0 \pmod N$. The rational side polynomial is defined as $g(x) = x - m$.

This strongly connects the “algebraic field world $\mathbb{Z}[\alpha]$” ruled by the root $\alpha$ of $f(x)=0$, and the normal “rational (integer) world $\mathbb{Z}$”, via a “ring homomorphism” of $x \to m$.

In state-of-the-art systems like CADO-NFS, it takes months to search for the “most convenient polynomial $f(x)$” using KleinJung’s algorithm and the LLL lattice basis reduction algorithm, so that the coefficients of the polynomial do not become excessively large, and primes are likely to appear (become smooth) in the subsequent steps.

4. Phase 2: Special-q Lattice Sieving

1
2
3
4
5
6
7
8
9


class LatticeSieve {
 // ...
 std::vector<Relation> sieve(const PolynomialSelector& poly) {
 // ...
 // Maps (a, b) pairs to lattices for each special prime q,
 // and executes a sieve that maximizes cache efficiency.
 // ...
 }
};

Once the two worlds are prepared, the next step is to search for “smooth numbers (numbers composed entirely of small prime factors)” in both worlds. An infinite number of integer pairs $(a, b)$ are generated, and the following two values are calculated:

Rational side value: $a - bm$
Algebraic side norm: $b^d f(a/b)$

The goal of GNFS is to collect tens of millions to hundreds of millions of these “pairs (Relations) where both the rational side and algebraic side values can be completely factored into only small prime factors”.

In the early GNFS, a “Line Sieve” was used, lining up $(a, b)$ on the $xy$ plane and sequentially dividing them by primes from the edges. However, this caused frequent cache misses due to accessing various parts of memory, and its weakness was being extremely slow.

Therefore, the current state-of-the-art code uses the “Special-q Lattice Sieve” method. By fixing a moderately large prime $q$, we restrict the calculation targets to only “pairs of $(a, b)$ where the algebraic side value is always divisible by $q$”. Since $(a, b)$ satisfying this condition form a “lattice” on the plane, the jump width of calculated addresses becomes constant, fitting perfectly into the CPU’s L1/L2 cache. With the introduction of this lattice sieving, the calculation speed of GNFS improved dramatically.

5. Phase 3: Filtering

1
2
3
4
5
6
7


class Filter {
public:
 void reduce_matrix(std::vector<Relation>& relations) {
 // 1. Singleton removal (removing relations with primes that appear only once)
 // 2. Clique merging (merging relations to make a sparse matrix denser)
 }
};

Hundreds of millions of relations collected over months by computers around the world in Phase 2. However, if this is thrown as-is into the next “step of solving simultaneous equations (matrix calculation)”, the supercomputer’s memory will blow up.

Thus, an ultra-compression process of the matrix called Filtering is performed.

Singleton removal Suppose a huge prime $p$ appeared “only once” in hundreds of millions of relations. Since our goal is to “make the exponents of all primes even (multiples of 2)”, a prime that appears only once can never be made even. Therefore, relations containing that prime are immediately removed (purged) as “useless garbage”. As this happens in a chain reaction, the data that had hundreds of millions of rows is rapidly reduced.
Clique merging Furthermore, by multiplying (adding) relations that share specific primes together, it reduces the number of rows while compressing the sparse (empty) matrix into a denser state (using a method similar to clique search in graph theory).

With this optimization, the massive sparse matrix is dramatically compressed to a computable size.

6. Phase 4: Linear Algebra over GF(2) (Block Wiedemann Method)

1
2
3
4
5
6
7


class LinearAlgebraGF2 {
public:
 std::vector<std::vector<int>> solve_nullspace(const std::vector<Relation>& relations) {
 // Iterates matrix-vector multiplication of a sparse matrix,
 // and finds multiple solution vectors (kernels) where M * x = 0 mod 2.
 }
};

Finally, the core of the puzzle. We multiply the collected relations to find the “combination where the exponents of all prime factors become even”.

Mathematically, this means using a huge matrix $M$ whose elements are the “even/odd (i.e., 0 or 1)” of the exponent of each prime, and a vector $x$ representing which relations to use, and finding the solution vector $x$ (nullspace/kernel) such that: $M \cdot x \equiv 0 \pmod 2$

We must solve a system of simultaneous equations for a matrix of an enormous size, millions of rows by millions of columns. With standard Gaussian elimination, the computational complexity would be $O(N^3)$, and the calculation wouldn’t finish until the end of the universe.

Thus, the “Block Wiedemann method” is adopted in state-of-the-art implementations. This is a type of Krylov subspace method that leverages the fact that the matrix $M$ is “extremely sparse (mostly 0s)” to derive a solution by iteratively performing matrix-vector multiplications. Unlike the older Block Lanczos method, the Block Wiedemann method can completely divide the computational process across multiple clusters, making it overwhelmingly powerful for parallel computing in modern distributed cloud computing and supercomputers.

7. Phase 5: Algebraic Square Root and Cryptographic Collapse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


class AlgebraicSquareRoot {
public:
 void compute_and_factor(...) {
 // 1. Compute the rational side square root V
 cpp_int V = 1;

 // 2. Compute the algebraic side square root gamma
 cpp_int Y = 1;

 // ...
 cpp_int factor = gcd(V - Y, N); // GCD(X-Y, N)
 }
};

Through the matrix calculation in Phase 4, we obtained a “set of relations $S$ whose product yields even powers for all prime factors”. With this, we can construct a “square” in both the rational side and the algebraic side worlds.

For the rational side, it’s just integer multiplication, so computing the square root $V$ is easy.

$$V^2 = \prod_{S} (a - bm)$$

However, the real hell lies on the “algebraic side”. In the algebraic field world $\mathbb{Z}[\alpha]$, since the uniqueness of prime factorization does not hold, calculations have been performed using ideals. What was guaranteed by the matrix calculation is only that it becomes a “square of an ideal”, and it is not guaranteed that it becomes a “square of an element ($\gamma^2$)”.

Here stands a formidable wall in algebraic number theory: the “obstruction of the ideal class group” and the “obstruction of the unit group”. In GNFS, we use the magic of “Quadratic Characters” to break through this wall. Columns of quadratic residues (Legendre symbols) for several tens of special prime ideals are secretly added in advance to the matrix in Phase 4. As a result, the found set $S$ ignores the obstructions with an overwhelming probability and successfully forms the “true square of an element $\gamma^2$”.

The work of finding $\gamma$ (algebraic square root) is computed using highly complex algorithms such as Montgomery’s method.

And finally, we warp the algebraic side square root $\gamma$ into the real world (by substituting $m$ for $x$) via the ring homomorphism $\phi$, yielding $Y$. If we simply set the rational side $V$ as $X$, the absolute equation we have been pursuing is finally complete.

$$X^2 \equiv Y^2 \pmod N$$

All that is left is to compute $\gcd(X-Y, N)$. Running through the 0.001-second process, the moment a non-trivial factor is printed on the screen, the proudly impregnable RSA cryptography completely collapses.

Conclusion

GNFS is not just a programming technique. It is a crystal of human intellect that has wrestled down the “depths of pure mathematics” like abstract algebra, ring theory, and ideal class groups using “extreme engineering” like supercomputer distributed architectures and cache optimizations.

The chat messages and credit card information we casually transmit are protected upon such astronomical mathematical defense and offense.

Through this C++ framework, I hope you have felt the “romance of mathematics and computers” behind state-of-the-art cryptanalysis algorithms.

The True Mathematical Structure of the General Number Field Sieve (GNFS)

Sat, 05 Sep 2026 02:26:13 +0900

The True Mathematical Structure of the General Number Field Sieve (GNFS)

The ultimate goal of GNFS is to find $X^2 \equiv Y^2 \pmod N$. To achieve this, mathematicians built a bridge between the “world of real integers” and the “world of algebraic number fields”. That bridge is the “homomorphism”.

Stage 1: The “Homomorphism” Connecting Worlds

1. Polynomial Selection and Root Definition

For a massive composite number $N$, select an integer $m$ and a polynomial $f(x)$ such that $f(m) \equiv 0 \pmod N$. (Example: Expand $N$ in base $m$ and create $f(x)$ from its coefficients. Here, assume $f(x)$ is irreducible (cannot be factored further) over the field of rational numbers $\mathbb{Q}$).

Next, let one of the “complex roots” of the equation $f(x) = 0$ be $\alpha$. Naturally, $f(\alpha) = 0$. $\alpha$ is not an integer but a complex number (an algebraic number) that may involve square roots or imaginary numbers.

2. Construction of Rings and Homomorphisms

Now, prepare two mathematical “rings” (worlds where addition and multiplication are defined).

World A: $\mathbb{Z}[\alpha]$ (Ring of algebraic integers containing $\alpha$) A world of numbers represented in the form $a + b\alpha + c\alpha^2 + \dots$.
World B: $\mathbb{Z}/N\mathbb{Z}$ (Ring of residues modulo $N$) A modulo arithmetic world consisting only of integers from $0$ to $N-1$.

Here, we define a mapping $\phi$ from World A to World B as follows: $$\phi : \mathbb{Z}[\alpha] \to \mathbb{Z}/N\mathbb{Z}$$ $$\phi(\alpha) = m \pmod N$$

This mapping $\phi$ is a magical operation that completely replaces the variable $\alpha$ in World A with the integer $m$ in World B. This $\phi$ possesses an extremely powerful property known as a “Ring Homomorphism”. A homomorphism is the property of “warping to another world without breaking the structure of addition and multiplication”. In other words, the following equations hold:

$\phi(X \times Y) = \phi(X) \times \phi(Y)$
$\phi(X^2) = \phi(X)^2$

What does this mean? If we can create a “square ($\gamma^2$)” of some complex element $\gamma$ in “World A (the world of $\alpha$)”, warping it to “World B (the modulo world)” via $\phi$ will ** perfectly preserve the square form $\phi(\gamma)^2$**.

Stage 2: The Collapse of Prime Factorization and the Birth of the “Ideal”

We want to collect many appropriate elements $(a - b\alpha)$ in World A ($\mathbb{Z}[\alpha]$) and multiply them together to create a “perfect square (square element)”. Normally, we could simply “prime factorize” each collected $(a - b\alpha)$ and combine them (solving via matrices) so that all prime exponents become even, thus creating a square.

However, here a devastating wall of algebra stands in our way. In algebraic number fields like $\mathbb{Z}[\alpha]$, the “uniqueness of prime factorization (any number can be uniquely expressed as a product of primes in exactly one way)”, which we learn in middle school, collapses.

(Example: In a certain algebraic number field, $6 = 2 \times 3$, but at the same time $6 = (1+\sqrt{-5}) \times (1-\sqrt{-5})$, making it impossible to know which are the true primes.)

If prime factorization is not uniquely determined, the puzzle (sieve method) of “counting the number of primes to make them even” becomes fundamentally impossible to execute.

The Salvation by Kummer and Dedekind: The “Ideal”

What saved us from this collapse was the concept of the “Ideal (ideal number)” created by 19th-century mathematicians. By considering not the elements themselves but the “set of multiples (ideals)” generated by those elements, they made prime factorization possible again.

In the ring of integers of an algebraic number field $\mathcal{O}_K$ (a more complete ring containing $\mathbb{Z}[\alpha]$), even if elements cannot be uniquely prime-factorized, it is proven that “an ideal can always be uniquely prime-factorized into a product of ‘prime ideals ($\mathfrak{p}$)’ in exactly one way”.

Therefore, in GNFS, instead of factorizing the element $(a - b\alpha)$ itself, we perform prime ideal factorization on the principal ideal $\langle a - b\alpha \rangle$ that it generates.

Stage 3: Norms and the Two Sieves

So, how do we know which prime ideals the ideal $\langle a - b\alpha \rangle$ factors into? Here, we use a function called the “Norm”. The norm is a function that converts complex elements of an algebraic number field into “ordinary real integers $\mathbb{Z}$”.

The norm of the element $(a - b\alpha)$ can be calculated by a simple polynomial calculation $b^d f(a/b)$ (where $d$ is the degree of $f(x)$).

Due to algebraic theorems, it is known that “if the norm of a certain ideal can be completely factored into small primes (is smooth), then the original ideal can also be completely factored into small prime ideals.”

Thus, GNFS simultaneously calculates the following two values for a massive number of integer pairs $(a, b)$ and collects only the pairs where both values are “smooth numbers”.

Rational Sieve: $a - bm$ (Values in the real world)
Algebraic Sieve: $b^d f(a/b)$ (Norm in the algebraic number field world)

By collecting tens of millions of pairs $(a, b)$ where both are smooth, and solving the prime factorization data of ideals (how many prime ideals are included) as a giant matrix (linear algebra over GF(2)), we find a set $S$ of pairs such that “when multiplied together, the exponents of all prime ideals become even”.

Stage 4: The Two Confronting “Obstructions” and the Ideal Class Group

Through matrix calculations, we found that multiplying all the ideals of $(a - b\alpha)$ belonging to set $S$ results in the square of a certain ideal $I$.

$$\prod_{S} \langle a - b\alpha \rangle = I^2$$

However, it doesn’t end here. The deepest and most difficult mathematical wall in GNFS lies here.

What we ultimately want is not the “square of an ideal”, but the “square of an element ($\gamma^2$)” to plug into the mapping $\phi$. Just because the ideal is squared doesn’t necessarily mean the element itself is squared. There exist two formidable mathematical obstructions here.

Obstruction 1: The Wall of the Ideal Class Group

The ideal $I$ is not always an “ideal generated by a single element (principal ideal)”. It is impossible to extract a concrete element $\gamma$ from an ideal that is not principal.

Here, the concept of the “Ideal Class Group ($Cl_K$)” comes into play. The ideal class group is a group that measures “how many non-principal ideals exist in that algebraic number field (how much the uniqueness of prime factorization is broken)”. Even if $\prod \langle a - b\alpha \rangle$ becomes $I^2$, if $I$ is not the identity element (principal ideal) in the ideal class group, it cannot be pulled back to the square of an element.

Obstruction 2: The Wall of the Unit Group

Suppose we get lucky and $I$ is a principal ideal $\langle \gamma \rangle$. Then, $\prod \langle a - b\alpha \rangle = \langle \gamma^2 \rangle$. You might think, “Great, the element is squared too!”, but that is a huge mistake.

The fact that ideals (sets of multiples) are equal does not mean the elements are completely equal. A deviation by a “Unit (a number whose reciprocal is also an integer, like 1 or -1)” inevitably occurs. In other words, the actual equality of the elements is as follows:

$$\prod_{S} (a - b\alpha) = u \cdot \gamma^2$$

($u$ is an element of the unit group $U_K$)

Unless this unit $u$ itself is the square of something (a square element), the left side can absolutely never become a “perfect square of an element”.

Stage 5: Adleman’s Magic “Quadratic Characters”

The obstruction of the ideal class group and the obstruction of the unit group. How do we overcome these two? Here, a genius method called “Quadratic Characters”, introduced by cryptographer Leonard Adleman (the “A” in RSA) and others, makes its appearance.

To determine “whether a certain element is a perfect square in the algebraic number field”, we use an algebraic number field version of the Legendre symbol (quadratic residue). To the giant matrix from earlier (the puzzle to make the count of prime ideals even), we secretly append dozens of additional conditions (columns) stating that “the quadratic characters for some special prime ideals $\mathfrak{q}$ also all become $1$ (even)”.

When we find a set $S$ that satisfies even these additional conditions through matrix calculations, deep theorems of algebraic number theory guarantee that “both the obstruction of the ideal class group and the obstruction of the unit group will naturally vanish with overwhelming probability.”

With this, we finally obtain the true equation.

$$\prod_{S} (a - b\alpha) = \gamma^2$$

Final Stage: The Convergence of Worlds and the Fall of Encryption

Finally, all the pieces of the puzzle are in place.

[Element in the Algebraic Number Field World (World A)] $\gamma^2 = \prod (a - b\alpha)$ (We find $\gamma$ from this using a square root algorithm)

[Element in the Real World (World of Rational Numbers)] $V^2 = \prod (a - bm)$ (Since this is just ordinary integer multiplication, the square root $V$ can be found normally)

Now, it’s time for the magical bridge we built at the very beginning, the homomorphism $\phi$, to take the stage. We warp the element $\gamma$ from World A to World B (the world modulo $N$) using $\phi$ (the mapping that substitutes $m$ for $\alpha$).

$$Y = \phi(\gamma) \pmod N$$

Meanwhile, we take the $V$ created in the real world directly to the modulo world and call it $X$.

$$X = V \pmod N$$

Due to the homomorphism’s property of “preserving structure”, the square relationship that held in World A is perfectly preserved in World B (the world modulo $N$) as well. Furthermore, because the original pairs $(a, b)$ were correspondingly created in the forms $a - b\alpha$ and $a - bm$, these $X$ and $Y$ collide in the world modulo $N$ to produce the following absolute equation:

$$X^2 \equiv Y^2 \pmod N$$

All that is left is to pray that these $X$ and $Y$ are not trivial solutions ($X \equiv \pm Y$) and calculate: $\gcd(X - Y, N)$

If it is a non-trivial solution, the Euclidean algorithm will race through in 0.001 seconds, and the secret primes $p$ and $q$, which are the heart of RSA encryption, will be printed on the output screen.

This is the complete form of the “General Number Field Sieve (GNFS)”, gathering the essence of modern mathematics.

What is the "General Number Field Sieve (GNFS)", Humanity's Strongest Math that Breaks Internet Cryptography?

Sat, 05 Sep 2026 02:09:08 +0900

What is the “General Number Field Sieve (GNFS)”, Humanity’s Strongest Math that Breaks Internet Cryptography?

The internet we use every day. LINE messages, YouTube, Amazon shopping—all communications are protected by “cryptography.” Currently, the most widely used cryptography in the world is “RSA cryptography.”

The cornerstone of RSA cryptography’s defense is very simple. It utilizes the mathematical property that “factoring a gigantic number into primes cannot be solved even by computers.” For example, for “15”, we immediately know it’s “3 × 5”, but the moment this becomes a “270-digit number”, even if we bundle all the supercomputers in the world, it would take hundreds of millions of years to solve.

However, mathematicians do not stay silent either. To break this ironclad cryptography, humanity created a magical algorithm (calculation procedure) called the “General Number Field Sieve (GNFS)”.

In this article, without using any specialized jargon, and only with knowledge of junior high school math (prime factorization, algebraic expressions, greatest common divisor), we will completely explain the mechanism step-by-step by which this “humanity’s strongest algorithm” breaks cryptography!

Chapter 1: The Goal of Decryption is a “Junior High School Formula”

The ultimate special move to confront gigantic prime factorizations. It’s this formula learned in junior high school.

$X^2 - Y^2 = (X + Y)(X - Y)$

You might think, “Eh, can such a basic formula break cryptography?” However, this is the master key that unlocks everything.

The ultimate goal for breaking the cryptography is to find, for a gigantic number $N$, “Numbers ($X$ and $Y$) where the remainder of $X^2$ and $Y^2$ divided by $N$ are the same.”

Why does “same remainder” solve the cryptography?

Suppose two numbers, $X^2$ and $Y^2$, have the “same remainder when divided by $N$.” Having the same remainder means there is a rule that the subtracted “$X^2 - Y^2$” will always be perfectly divisible by $N$ (it becomes a multiple of $N$).

Here, let’s say the gigantic number $N$ used for cryptography is made of the multiplication of two secret prime numbers ($p$ and $q$) ($N = p \times q$).

Factoring $X^2 - Y^2$ results in $(X - Y)(X + Y)$. The fact that this is a multiple of $N$ means that somewhere in this multiplication, the secret primes $p$ and $q$ are hidden.

Here a miracle occurs. There is mathematically a 50% (1/2) probability that the two prime numbers $p$ and $q$ will naturally separate into different rooms, with "$p$ going to the $(X - Y)$ room" and "$q$ going to the $(X + Y)$ room".

With only the prime number $p$ in the $(X - Y)$ room, let’s calculate the “Greatest Common Divisor (the largest common part)” of $(X - Y)$ and $N$.

Contents of $(X - Y)$ = $p \times$ some number
Contents of $N$ = $p \times q$ The only common part is "$p$"!

In other words, the moment you calculate the greatest common divisor, the hidden prime number $p$ pops out, and the cryptography is completely decrypted. (*The greatest common divisor can be calculated instantly even on a smartphone using the “Euclidean Algorithm”.)

[A Little Column: Why squared? Why not cubed or doubled?]

If it’s “$2X - 2Y$”, it becomes $2(X - Y)$, and since there’s only one room, you can’t separate the primes. If it’s “$X^3 - Y^3$”, the size of the rooms becomes unbalanced, making the calculations unnecessarily heavy. To separate the primes into two, “squaring”, which beautifully divides into two rooms, is the most cost-effective.

Chapter 2: How to Find X and Y? The “Prime Card Collection Puzzle”

The goal is clear. However, if you blindly search for “$X^2$ and $Y^2$ that yield the same remainder”, you won’t find it until the end of the universe. Therefore, mathematicians came up with a genius method called the “Prime Card Collection Puzzle”.

Step 1: Collect Only Gold Dust (Smooth Numbers) with a Sieve

First, prepare an appropriate number $Z$, square it, and calculate the remainder $W$ when divided by $N$. (The world of remainders where $Z^2 = W$)

Factorize the resulting remainder $W$. Here, only when a "$W$ made only of small prime numbers like 2, 3, 5, 7" appears, you keep that equation as a “winning card”, and throw it away if large primes are mixed in. It’s a task like discarding large stones with a sieve in a river and collecting only gold dust.

Step 2: The Puzzle of Making Everything an “Even Number”

For example, suppose the following three gold dust cards were collected.

Card A: $Z_1^2 = 2^3 \times 3^1$
Card B: $Z_2^2 = 2^1 \times 5^1$
Card C: $Z_3^2 = 3^1 \times 5^1$

Let’s multiply all these together. The right side becomes $(2^3 \times 3^1) \times (2^1 \times 5^1) \times (3^1 \times 5^1)$, and when summarized and organized, it becomes "$2^4 \times 3^2 \times 5^2$".

Amazingly, the number of prime numbers became “4, 2, 2”, which are all even numbers! Having all even numbers means that if you halve the count of everything, it becomes the “square of something.” In other words, $(2^2 \times 3^1 \times 5^1)^2 = (60)^2$.

The left side is $(Z_1 \times Z_2 \times Z_3)^2$, so with this, finally, $X = (Z_1 \times Z_2 \times Z_3)$ $Y = 60$ The long-awaited “$X^2 = Y^2$” pair is completed!

For computers, the puzzle of calculating whether the number of primes is “even or odd (0 or 1)” is something they are very good at, so with this method, they can find $X$ and $Y$ at high speed.

Chapter 3: The Wall of Despair That Stands in the Way

Now any cryptography can be broken!… Or so we thought, but a big problem arises. If the cryptography number $N$ is up to about “100 digits”, it can be solved with this method (called the Quadratic Sieve), but when $N$ becomes “200 digits or 300 digits”, the $W$ that appears during the calculation becomes too huge.

When the numbers get too huge, “numbers made only of small prime numbers (gold dust)” completely stop appearing. It becomes harder than searching for a contact lens in a desert, and you can’t collect the cards to solve the puzzle at all.

Here finally, humanity’s ultimate weapon, the “General Number Field Sieve (GNFS)”, makes its appearance.

Chapter 4: Humanity’s Strongest Idea, Creating “Two Worlds”

The genius idea of GNFS is: “Calculating only in the real world makes the numbers huge. So, let’s create a ‘hidden world’ using polynomials (algebraic expressions) and split the weight of the calculation into two.”

The Magic of Algebraic Expressions

GNFS converts the gigantic number $N$ into an algebraic expression using a base number $m$. For example, if $N=100$, let $m=4$, so $100 = 4^3 + 2(4^2) + 4$. This is turned into the expression (the hidden world) $f(x) = x^3 + 2x^2 + x$ using the letter $x$.

The interesting thing about this expression is that it has the property: “If you substitute $m$ (4 in the example above) for the letter $x$, you can always warp back to the real number $N$.”

Searching for Gold Dust in Two Worlds Simultaneously

GNFS creates many pairs of random integers $(a, b)$ and performs the following two calculations simultaneously.

Real World: $a - b \times m$
World of Algebraic Expressions: The value calculated by the rules of algebraic expressions for $a - b \times x$

By splitting the problem into two worlds, the size of the numbers handled becomes dramatically smaller (lighter). It’s the image of splitting a huge rock into two to make them easy-to-handle stones.

Then, you sift and collect only the miracle pairs $(a, b)$ where “Both in the real world and in the world of algebraic expressions, they are ‘made only of small prime numbers (gold dust)’”. This is the origin of the name “Number Field Sieve.”

The Moment the Cryptography is Finally Broken

Once tens of millions of “gold dust cards” are collected from both worlds, using the giant matrix calculations of supercomputers, you find the “combination where the number of prime numbers all become even”, just as we did in Chapter 2.

Once the combination is found,

Let the squared number made in the real world be $X^2$
Let the squared expression made in the world of algebraic expressions be $Y(x)^2$

Finally, substitute $m$ into $x$ of $Y(x)$ in the world of algebraic expressions to warp to the real world and merge them. Then, just like mathematical magic, a state where “the remainders of $X^2$ and $Y^2$ are the same” is strictly completed!

After that, just like in Chapter 1, if you calculate the greatest common divisor of $X - Y$ and $N$, the impregnable RSA cryptography collapses with a crash, and the secret primes reveal themselves.

Conclusion: Mathematics Never Ends

You might have thought, “Alright, with GNFS, any cryptography can be broken!” However, RSA cryptography is not giving up either. What is currently used on the internet is a monstrously huge number called “RSA-2048 (about 617 digits)”.

Even though GNFS is humanity’s strongest algorithm, it is said that even to solve 270 digits (RSA-270), it would take thousands or tens of thousands of years even if all the computers in the world were connected. For now, our LINE and bank data are safe.

But what if a “magic that instantly finds $X$ and $Y$ for any gigantic number” appears? Actually, the closest thing to that is the “Quantum Computer (Shor’s Algorithm)” currently under development. It has been mathematically proven that by using the wave properties of quantum mechanics, one can ignore the tedious card collecting puzzle and draw the answer in one shot.

The endless battle of wits between the people who make cryptography (defense) and the people who make algorithms to break it (attack). When you learn that the “prime factorization” and “algebraic expressions” learned in junior high school are actually weapons fiercely fighting on the front lines of global security, doesn’t math class seem just a little bit more interesting?

The person to discover the strongest algorithm of the future might just be you reading this article!

(Note: This article conceptualizes the mathematical charm of cryptography decryption for junior high school students. Actual GNFS is strictly calculated using advanced university mathematics such as ideal class groups of algebraic number fields and homomorphisms.)