Continued fractions and Parallel SQUFOF

0.24 MB·English

by  S. McMath

Continued fractions and Parallel SQUFOF
6
0
0
S. McMath, F. Crabbe∗, D. Joyner†
2

n
1-9-2006
a
J

1
1

] Dedication To thememory of Daniel Shanks(1917-1996).
T
N Abstract
h. In this partly expository paper, we provetwo results.
t Thatthetwo-sidedcontinuedfractionofthenormalizedsquareroot
a
•
m (an important part of theSQUFOFalgorithm) has several very at-
tractiveproperties-periodicity,asymmetrypointcorrespondingto
[
a factorization of N, and so on.

1
The infrastructure distance formula.
v •
3 Finally, we describe a method for parallelization of SQUFOF that main-
6 tainsitsefficiencyperprocesorasthenumberofprocessorsincreases,and
2 thusis predicted to beuseful for very large numbersof processors.
1
0
6 1 Introduction
0
/ Though there are many fast algorithms for factoring numbers, this paper focuses on
h
t one known as square forms factorization or SQUFOF (see Algorithm 4 below for a
a precisedescription). DanielShanksdevelopedSQUFOFinthe1970’s,anditisstillthe
m
fastestknownalgorithmforfactoringintegersinthe20-to30-digitrange. SQUFOFis
: usedtothisdayinconjunctionwithotherfactorization algorithmsthatneedtofactor
v
20-digit numbersin order to generate thefactors of higher digit numbers.
i
X Most of the Shanks’ original work on SQUFOF was not published (see however,
r [Sh1])andhisnotesareincomplete1. OnepurposeofthispaperistopresentShanks’s
a original SQUFOF algorithm in its entirety. The paper goes on to present several
results concerning both traditional SQUFOFand its parallelization.
This papercontains three main results:
1. Aproofthatthetwo-sidedcontinuedfractionofthenormalizedsquareroot(an
importantpartoftheSQUFOFalgorithm)hasseveralveryattractiveproperties
- periodicity, a symmetry point corresponding to a factorization of N, and so
on(seeTheorems2.6,2.8,and2.9fordetails). Thisresult wasprobablyknown
∗U. S. Naval Academy, Computer Science Department, Annapolis, MD 21402,
[email protected]
†U.S.NavalAcademy,Mathematics Department, Annapolis,MD21402, [email protected]
1Thesenotes havebeentypedinLaTeX andareavailableontheweb[Sh2],[Sh3],[Sh4].
1
200 years ago to Lagrange and Galois and Gauss - see for example, Perron [P],
Buell [Bu], and Williams [W].
2. A proof of the infrastructure distance formula, Theorem 2.10 below, which is
also an important part of SQUFOF. This is in some sense well-known but a
proof has not, as far as we can see, appeared in the literature. (However, see
Cohen[Coh2],Proposition 5.8.4, andWilliams andWunderlich[WW]Theorem
5.2 for closely related results.)
3. Investigationofamethodforparallelization ofSQUFOFthatmaintainsitseffi-
ciencyperprocesorasthenumberofprocessorsincreases,andthusispredicted
tobeusefulforlargenumbersofprocessors. (See[W],[WW],and[Go]forwork
onsimilarideas.) TheimplementationinC,andsubsequentnumericaldatadue
tothefirstauthor,isnewasfarasweknow. Thisisbrieflysketchedin 4below.
§
Althoughthetheoreticalresultsinthispaperareknowntotheexperts,itishoped
that putting all these results together will serve a useful purpose. This paper is a
version of the first author’s undergraduate “Trident” thesis, advised by the second
two authors.
2 Continued Fractions and Quadratic Forms
The stepping stone for SQUFOF is the continued fraction expansion for the square
root of N. (We slightly simplify matters by instead using the “normalized square
root (equation 4) here.) The terms of this continued fraction expansion give rise to
a sequence of quadratic forms of discriminant N via (5). Weshall describe SQUFOF
intermsofthe“cycle” ofcontinuedfractions intheperiodic expansionof (4)andthe
corresponding quadratic forms.
2.1 Integral binary quadratic forms
There is a “dictionary” between certain aspects of
indefiniteintegral binary quadratic forms,
•
ideals in a real quadratic numberfield,
•
the simple continued fraction of quadratic surds.
•
The reader will be assumed to be familiar with at least the basic aspects of this
correspondence. For details, see for example, Buell [Bu], Lenstra [Len], Williams [W]
(especially pp. 641-645), Cohen [Coh1] and thereferences found there, or [M].
Abinary quadratic form(orsimplya“form”)isahomogeneousformofdegree
two in two variables x,y,
a b/2 x
f(x,y)=ax2+bxy+cy2=(x,y) ,
· b/2 c · y
(cid:18) (cid:19) (cid:18) (cid:19)
for some constants a,b,c. This form shall also be denoted by the triple (a,b,c). The
discriminant2 of f is D = disc(f) = b2 4ac. We shall focus on the case D > 0,
−
inwhich case theform iscalled indefinite. From now on, we assume without further
mention that D>0 is a non-square such that D 0 (mod 4) or D 1 (mod 4).
≡ ≡
2Sometimesalsocalledthedeterminantoff.
2
If a,b,c Z then we say f is integral. If moreover gcd(a,b,c) = 1, then we say
∈
the form is primitive. Let F(D) denote the set of all integral forms of discriminant
D and let F(D) denotethe subset of primitiveones.
p
The groups
s t
GL (Z)= γ = s,t,u,v Z, det(γ)= 1 ,
2 { u v | ∈ ± }
(cid:18) (cid:19)
and
SL (Z)= γ GL (Z) det(γ)=1
2 2
{ ∈ | }
act on the polynomials Z[x,y]via
s t
γ = :(x,y) (sx+ty,ux+vy).
u v 7−→
(cid:18) (cid:19)
Therefore, they also act on theset of integral forms via
(γ∗f)(x,y)=f(sx+ty,ux+vy),
a b/2
for γ GL (Z). In terms of the symmetric matrix A= associated to
∈ 2 b/2 c
(cid:18) (cid:19)
theform f, this action may be epressed as
γ∗(A)= tγ A γ.
· ·
We say that two forms f1,f2 are equivalentif f2 =γ∗f1, for some γ GL2(Z). We
∈
saythattwoformsf1,f2 areproperly equivalent,written f1 f2,iff2 =γ∗f1,for
∼
some γ SL (Z). For f F(D), we let
2
∈ ∈
F(D)f =[f]= f′ F(D) f f′
{ ∈ | ∼ }
denote the proper equivalence class of f. An element γ GL (Z) is called an au-
2
∈
tomorph of f if γ∗f = f. A form f is called ambiguous if it has an automorph
in GL2(Z) SL2(Z). Note that if f F(D) is ambiguous then each f′ [f] is also
− ∈ ∈
ambiguous.
We say that two forms (a ,b ,c ),(a ,b ,c ) F(D) are adjacent if c = a
1 1 1 2 2 2 1 2
∈
and b +b 0 (mod 2a ). In this case, we say that (a ,b ,c ) is to the right of
1 2 2 2 2 2
≡
(a ,b ,c ) ((a ,b ,c ) is to theleft of (a ,b ,c )).
1 1 1 1 1 1 2 2 2
2.1.1 Reduction
A form (a,b,c) is called reduced if D1/2 2a <b<D1/2. Let F(D) denote the
r
| − | ||
subset of reduced forms of discriminant D.
Lemma 2.1. (a) Given any f F(D)r there is a unique f′ F(D)r adjacent to the
∈ ∈
right of f and a unique f′′ F(D)r adjacent to the left of f.
∈
(b) There are exactly two reduced ambiguous forms in a cycle of reduced forms in
an ambiguous class.
For(a)seeBuell[Bu],page23;for(b),see[Bu],Theorem9.12. Lemma2.1allows
us to define the cycle of reduced forms associated to f F(D) : it is the set of all
r
∈
f′ F(D)r which is adjacent tothe left or right of f. This cycleis denoted F(D)r,f.
∈
3
Lemma 2.2. An ambiguous equivalence class contains two points of symmetry, that
is, pairs of reduced adjacent forms, (c,b,a) to the left of (a,b,c), in the cycle that are
the symmetric reverse of each other. Inthat case, either adivides the determinant, or
a/2 divides the determinant.
This follows from Theorem 2.9 below.
Itis evidentthatifaform isambiguous, theneach form in its equivalenceclass is
also ambiguous.
Proposition 2.3. The set F(D) of reduced forms can be partitioned into cycles of
r
adjacent forms.
Consider theaction of
1 m
T =
m 0 1
(cid:18) (cid:19)
on a form (a,b,c): Tm(a,b,c) =(a′,b′,c′), where a′ = a, b′ = b+2am, c′ = (b′4)2a−′D.
This definesa map T :F(D) F(D), for each m Z.
m
→ ∈
Consider theaction of
0 1
W = −
1 0
(cid:18) (cid:19)
on a form (a,b,c): W(a,b,c)=(a′,b′,c′), where a′ =c, b′ = b, c′ =a. This defines
−
a map W :F(D) F(D).
→
Algorithm 1. (Reduction)
Input:f F(D).
∈
Output:f′ F(D)r withf f′.
∈ ∼
Letf(x,y)=ax2+bxy+cy2andlet
J = x a <x< a, if a D1/2, 2a <x<D1/2, if a <D1/2 .
a,D
{ | −| | | | | |≥ − | | | | }
1. ApplyTm to(a,b,c)toobtainaform(a,b′,c′),whereb′ Ja,D andc′ ischosen
∈
sothatthenewformhasdiscriminantD.
2. If(a,b′,c′)isreducedthenreturnf′(x,y)=ax2+b′xy+c′y2. Otherwise,replace
(a,b′,c′)byW(a,b′,c′)=(c′, b′,a)andgotostep1.
−
According to Lagarias [L1], this has complexity O(log(max(a, b, c))).
| | | | | |
Definetheadjacency mapρ:F(D) F(D) by
→
ρ(a,b,c)=(a′,b′,c′), (1)
where a′ =c, b′ Jc,D, and b′ b (mod 2c), and c′ is determined by the condition
∈ ≡−
disc(a′,b′,c′)=D. This defines a bijection ρ:F(D)r F(D)r.
→
Unfortunately, given f F(D) with D > 0 there are usually several f′ F(D)r
∈ ∈
which are properly equivalent to f. In otherwords, thecycle
F(D)r,f = f′ F(D)r f f′ = f′ =ρnf n Z
{ ∈ | ∼ } { | ∈ }
can be rather large. Indeed, it is known that F(D) = O(D1/2+ǫ), (where the O-
r,f
| |
constantdependsonǫ)forallǫ>0,wheretheexponent1/2isbestpossible(Lagarias
[Len, L2]) and .
4
2.1.2 Composition
The composition of forms has important properties for SQUFOF. The rules of com-
position are fairly general. A binary quadratic form F is called a composition of
f,g F(D) if it satisfies an equation such as
∈
f(x,y)g(u,v)=F(B (x,y,u,v),B (x,y,u,v)), (2)
1 2
where B and B are quadratic forms in x,y,u,v of a certain type. The exact con-
1 2
ditions B ,B satisfy do not concern us here (see Cox [Cox] if you are curious and
1 2
Gauss [G] if you are really curious). The point is that there may be more than one
pairB ,B satisfying(2),sothatthecompositionF isnotunique. (However,thecon-
1 2
ditions on B ,B specified by Gauss do imply that, for a given f,g F(D) any two
1 2
∈
suchcompositions mustbeequivalenttoeach other.) Onewayaroundthisambiguity
is to specify a choice of B ,B and hence defineF uniquely.
1 2
TheideadescribedbelowwasknowninsomeformtoDirichletandpossiblyGauss.
Algorithm 2. Input:(a ,b ,c ),(a ,b ,c ) F(D).
1 1 1 2 2 2
Output:Acomposition(am1a22,B,(B24−a1Da)2m2∈)∈F(D).
1. Computem = gcd(a ,a ,b1+b2). (SinceD = b2 4a c , fori = 1,2, b andb
1 2 2 i − i i 1 2
havethesameparity.)
2. Solvethecongruences
a mB mb a (mod 2a a ),
2 1 2 1 2
≡
a mB mb a (mod 2a a ),
1 2 1 1 2
≡
b1+b2mB mb1b2+D (mod 2a a ),
2 ≡ 2 1 2
simultaneouslyanintegerB. Choosethesolutionwithsmallestabsolutevalue.
See [Sh1] or [Bu] for a proof of the correctness of this algorithm. Buell [Bu] also
providesthesubstitutionsthatwouldbeneededforGauss’sdefinitionofcomposition.
Inotherwords,wedefinethecompositionof(a ,b ,c ),(a ,b ,c ) F(D)tobe
1 1 1 2 2 2
∈
theform resulting from the abovealgorithm:
a a (B2 D)m2
(a1,b1,c1)∗(a2,b2,c2)=( m122,B, 4−a1a2 ).
Remark. The binary operation : F(D) F(D) F(D) is associative but not
∗ × →
its “restriction” # : F(D) F(D) F(D) (where # is composition algorithm 2
r r r
× →
followed by reduction algorithm 1).
Let f,g F(D) be elements in the principal cycle of discriminant D. It was
r
∈
observedbyShanks(see 5in Lenstra[Len]) thatcyclesenjoya“coset-likeproperty”
ρkf#ρℓg=ρak,ℓ(f#g),fo§r some ak,ℓ Z . In particular, theprincipal cycle is closed
∈
under composition. Therefore, the the set of complete quotients of the continued
fraction of such an α can beidentified with a set closed under#.
For further discussion of this, see Lenstra [Len] (5.1).
The“structure”ofacyclehasbeentermedthe“infrastructure”ofF(D)byShanks.
If f,f′,g,g′,h F(D) then Gauss showed
∈
(a) (f g) h f (g h), and
∗ ∗ ∼ ∗ ∗
(b) f f′ and g g′ imply f g f′ g′.
∼ ∼ ∗ ∼ ∗
5
These imply that the set of equivalence classes of forms of discriminant D is a group
C(D),calledtheclassgroupofD. Fromtheconstruction,itisclearthatf g g f,
∗ ∼ ∗
so C(D) is abelian.
Thefollowing Theorem was knownto Shanks,since SQUFOFdependsessentially
on it.
Theorem 2.4. An equivalence class has order 2 or 1 in the class group if and only if
it is ambiguous.
Any form (1,b,c) F(D) acts as the identity for . The cycle of the identity is
∈ ∗
the principal cycle of forms. Any form f whose square f2 = f f belongs to the
∗
principal cycle is an ambiguous form ([Bu], Corollary 4.9).
2.2 Continued fractions
Throughout, assume that N 1 (mod 4) and is not a perfect square.
≡
We shall only consider simple continued fractions here. In other words, if α R
∈
is the number we want to compute the continued fraction of, let x = α, b = α ,
0 0
⌊ ⌋
where x denotes thefloor of x,and, for i>0, let
⌊ ⌋
1
x = , b = x . (3)
i xi 1 bi 1 i ⌊ i⌋
− − −
Thetermx iscalledtheith complete quotientofαandb iscalled theith partial
i i
quotientof α. The simple continued fraction of α is ([HW]):
1
α=b + ,
0 b + 1
1 b2+...
also written [b ,b ,b ,...]. We are only concerned with continued fractions of an irra-
0 1 2
tional α K =Q(√N). In this case, thesequence b ,b ,b ,... is eventually periodic.
0 1 2
∈
For example, let
√N+⌊√N⌋−1, √N even,
α= 2 (4)
 √N+⌊√N⌋, j√Nk odd.
 2
Wecall thisα thenormalized square root ofjN. kThe continuedfraction sequence

b ,b ,... is (purely) periodic. In general, the period of α is the size of the cycle
0 1
associated to the identityin theclass group (Buell [Bu], Theorem 3.18 (a)).
At each step in the continued fraction expansion, it is possible to simplify x b
i i
−
to the form √NQ−iPi ∈ [0,1), where Pi,Qi ∈ Z satisfy Pi2 ≡ N (mod Qi). In general,
if P,Q are positive integers and x= √N+P satisfies P2 N (mod Q), 0<P <√N,
Q ≡
√N Q <P, then we say that x is reduced. It is known that if x,y are two such
| − |
a b
reducednumbersandy=γ(x)(whereγ = SL (Z)actsonRˆ =R
c d ∈ 2 ∪{∞}
(cid:18) (cid:19)
by γ(x) = ax+b) then y occurs in the simple continued fraction expansion of x as a
cx+d
complete quotient (and x occurs in the simple continued fraction expansion of y as a
complete quotient). SeeBuell [Bu], Proposition 3.20 for a proof.
If P,Q are positive integers and x= √N+P then we associate to x the quadratic
Q
forms
P2 N P2 N
f− =(−Q/2,P,− 2−Q ), f+ =(Q/2,P, 2−Q ), (5)
6
whichhavediscriminantN. (Weimplicitlyassumeherethat P22−QN ∈ZandQiseven.
Notethat if x is reduced then so are f , and conversely.)
±
Lemma 2.5. (H. Cohen [Coh1], 5.7.1) The continued fraction expansion of the
§
quadratic irrational corresponding to the unit reduced form is not only periodic but
symmetric.
What is the continued fraction analog of “adjacency” of forms? Applying the
adjacency map (1) is roughly analogous to the “stepping” process of going from one
completequotienttothenextinacontinuedfraction. SeeWilliams 5foradiscussion
§
of thetheideal-theoretic analog, at least for thecase of thesimplecontinued fraction
of −1+2√N.
Onetoolusedbymanydifferentalgorithmsisthecontinuedfractionexpressionfor
(4), where N is the number to be factored. This expression is calculated recursively:
x = α, b = x , and using (3) in general. Observe that solving equation (3) for
0 0 0
⌊ ⌋
x gives x =b + 1 .
i−1 i−1 i−1 xi
The recursive formulas are, for i 0,
≥
x = 1
i+1 = xi−Qbii
= √√NN−+PPii (6)
Qi+1
=bi+1+ √NQ−i+P1i+1,
b = x .
i i
⌊ ⌋
Theorem 2.6 provides some well-known fundamental properties and identities of con-
tinued fractions.
Theorem 2.6. ([Ri])
In the continued fraction expansion of (4), with x = α, each x reduces to the
0 i
form √N+Pi−1, with unique Q ,P Z satisfying
Qi i i ∈
(a) N =P2+Q Q ,
i i i+1
(b) P =b Q P ,
i i i i 1
− −
(c) bi = ⌊√N⌋Q+iPi−1 ≥1,
j k
(d) 0<P <√N,
i
(e) √N Q <P ,
i i 1
| − | −
(f) Q is an integer,
i
(g) Q =Q +b (P P ).
i+1 i 1 i i 1 i
− − −
(h) This sequence is eventually periodic.
(i) √N+Pi = √N+Pi−1 =b .
Qi Qi i
j k j k
Thesedenominators Q willbereferredtoaspseudo-squares. (Indeed,fori
i
0,ifwewrite[b ,b ,...b ]{= A}i thenA2 B2 N =( 1)iQ andsoA2 ( 1)iQ≥
0 1 i Bi i−1− i−1 − i i−1 ≡ − i
(mod N).)
7
Remark. Thefactthateachx reducestotheform √N+Pi−1 isimportantforcompu-
i Qi
tationalefficiencybecausethistogetherwith(c)implythatfloatingpointarithmeticis
notnecessaryforanyofthesecalculations. Also,byuseof(b)and(g),thearithmetic
used in thisrecursion is on integers <2√N.
Since the continued fraction is eventually periodic, it is reasonable to consider
that when it loops around on itself, the terms being considered may have come from
someterms“earlier”intherecursion. Lemma2.7showsthatbyexchangingthesetwo
related expressions, thedirection is reversed. The algorithm for stepping a continued
fraction expansion in the opposite direction will be precisely the same as the one for
theforwarddirection,exceptthatthenumeratorischangedfirst. Notethatthissame
change (with the exception of c ) could be achieved by merely changing the sign of
0
P .
i 1
−
Lemma 2.7. Let N, and, for i 0, let x ,b ,P ,Q be as in Theorem 2.6. Let
i i i i
≥
y = √N+Pi+1 andletc = y . Ifwedefine,forj 1,y = 1 ,c =[y ]
0 Qi+1 0 ⌊ 0⌋ ≥ j yj−1−cj−1 j−1 j−1
then c =b and y = √N+Pi−j+1, when 0 j i.
0 i+1 j Qi−j+1 ≤ ≤
UsingLemma2.7togobackwardsinthecontinuedfraction expansion,denotethe
termsbeforex asx ,x ,.... Thesequence x i Z willbecalledthetwo-sided
0 1 2 i
− − { | ∈ }
continued fraction of x . DefineQ and P similarly, i 0.
0 i i
− − ≥
Theorem 2.8. (a) With these conventions on the negative indices, Theorem 2.6 ap-
plies for all i Z.
∈
(b) Define x as inTheorem 2.6, i Z. There exists a positive integer π such that
i
∈
for all i Z, x =x .
i i+π
∈
(c) Let x =α such that Q 2P (as in equation (4)). The sequence of pseudo-
0 0 1
squares is symmetric about Q , s|o th−at for all i Z, Q =Q .
0 i i
∈ −
This follows easily from thelemma aboveso theproof is omitted.
Thisdemonstratesanimportantfactaboutcontinuedfractions: thatthedirection
of the sequences of pseudo-squares and residues can be reversed (i.e. the indices
decrease)bymakingaslightchangeandapplyingthesamerecursivemechanism. The
presence of one point of symmetry allows a proof that another point of symmetry
exists and that a factorization of N may be obtained from this symmetry3:
Theorem 2.9. Let s = π , where π is the period from Theorem 2.8. If π is even
⌊2⌋
then (a) Q =Q , (b) Q =Q , (c) P =P , and (d) Q 2N, for all i Z. If
s+i s i s 0 s s 1 s
− 6 − | ∈
π is odd then, for all i Z,
∈
Q =Q , and
s+i+1 s i
• −
either(a)gcd(Q ,N)isanontrivialfactorofN,or(b) 1isaquadraticresidue
s
• −
of N.
The argument for the first statement is in [W], pages 641-642. For an elementary
proof of both statements, see [M].
3This was actually discovered in the opposite order. It was clear that ambiguous forms
that met this criteria provided a factorization but was later realized that these same forms
produced symmetry points. This was first noticed by Gauss [G] andfirst appliedby Shanks
[Sh4].
8
2.3 Infrastructure distance formula
Form<n,andfor xi i Z,thetermsinthecontinuedfractionin(6),Shanksdefined
infrastructure dis{tan}c∈e by
n
D(x ,x )=log x . (7)
m n k
!
k=Ym+1
We abuse notation and write D(F ,F ) as well for this quantity, where a form F
m n
corresponds to a term x in the continued fraction via the map x f (5). Lenstra
+
7−→
[Len] addsa term of 1log(Q /Q ) to this (where Q denotes thepseudo-squareterm
2 n m
of x),with theeffect that theresulting formulas are slightly simplified butthe proofs
are more complicated and less intuitive. Definition 7 is also used byWilliams in [W].
Since the quadratic forms are cyclic, in order for the distance between two forms
to be measured consistently, it must be considered modulo the distance around the
principal cycle.
Definition. Letπ betheperiodoftheprincipalcycle. TheregulatorRoftheclass
group is thedistance around theprincipal cycle, that is, R=D(F ,F ).
0 π
Therefore, distance must be considered modulo R, so that D is a map from pairs
of forms to the interval [0,R) R. The addition of two distances must be reduced
⊂
modulo R as necessary.
Theorem 2.10. (infrastructure distance formula) If F F are equivalent forms
1 k
∼
and G G are equivalent forms and D is the reduction distance for F G and
1 ℓ ρ,1 1 1
∼ ∗
D is the reduction distance for F G and m and m are the factors cancelled in
ρ,2 k ℓ 1 k
∗
each respective composition (Algorithm 2), then
D(F #G ,F #G )=D(F ,F )+D(G ,G )+D D +log(m /m )
1 1 k ℓ 1 k 1 ℓ ρ,2 ρ,1 2 1
−
proof: Hereis a sketch. (For more details, see Theorem A.5.2 in [M].)
Aseachquadraticformisassociatedwithareducedlattice,ananalysisofdistance
requires a connection between reduced lattices (see 3 of [W] for the definition of
§
reduced lattice). We use the notation of Williams [W] without further mention.
If denoteslatticeinQ(√N),letL( )denotetheleastpositiveintegercontained
L L
in it.
Lemma 2.11. (Lemma A.4.2 of [M]) Let I be a primitive ideal and let denote the
L
lattice corresponding to I. If ′ is a lattice with basis 1,ξ and for some θ, θ ′ = ,
L { } L L
then the ideal J corresponding to the lattice ′ is a primitive ideal and
L
(L(I)θ)J =(L(J))I (8)
The method of Voronoi (see for example [W]) is used to obtain a sequence of
adjacentminima,correspondingtoasequenceofreducedlattices. Considerasequence
of lattices , , corresponding to ideals K ,K , corresponding to binary
1 2 1 2
L L ··· ···
quadratic forms F ,F , , corresponding to terms x ,x , in a continued fraction
1 2 1 2
··· ···
expansion (6). If, for two adjacent lattices in the sequence, ξ is defined by =
i i+1
1/ξiLi, then the chain of adjacent minima of L1 are defined by θk = ki=−1L1ξi, so
θ = (see [W], 3). Distance between such lattices is then definedby
k k 1
L L § Q
D( , )=log(θ /θ ) (9)
k ℓ k ℓ
L L
9
andthisdefinitionofdistancecorrespondsexactlytothedefinitiongivenforquadratic
forms (see [W], 6).
§
Although this definition has so far only been applied to reduced ideals (for the
definitionofreducedideal,seeforexample[W] 2)andlattices,thereductionofideals
§
and lattices corresponding to quadratic form and continued fraction reduction is well
known:
Lemma 2.12. (Lemma A.5.1 in [M]) Let I be any primitive ideal in Z[√N]. There
exists a reduced ideal I and a θ I such that (L(I)θ )I =(L(I ))I.
k k k n k
∈
Hereθ maybeefficientlycomputedbyVoronoi’smethodorbycontinuedfractions.
k
Then the reduction distance is defined by D = log(θ ) and may be considered as
ρ k
−
thedistance from I toI .
k
LetI denotetheidealcorrespondingtotheformF intheusualway(asin[Len]),
1 1
let J be the ideal corresponding to G , and let K denote the ideal corresponding
1 1 1
to F G . We have that (s)K = I J , for some s. Let K be a reduced ideal and
1 1 1 1 1 j
∗
λ K such that
1
∈
λK =K . (10)
j 1
Then K is theideal corresponding to F #G .
j 1 1
Similarly, let I denote the ideal corresponding to the quadratic form F and J
k k ℓ
be the ideal corresponding to the form G . If H denotes the ideal corresponding to
ℓ 1
thecomposition F G ,then(t)H =I J ,forsomet. LetH beareducedidealand
k ℓ 1 k ℓ
∗
choose η H such that ηH =H . Then H corresponds to F #G .
1 1 k ℓ
∈
Let µ and φ be such that µI = I and φJ = J . Combining these equations,
k 1 ℓ 1
gives
µφ sµφ sµφη
K =K /λ=I J /λs=( )I J =( )H =( )H.
j 1 1 1 λs k ℓ λt 1 λt
Set ψ= sµφη and then ψH =K , so that by (9),
λt j
D(K ,H)= log(ψ)= log(µ) log(φ) log(η)+log(λ) log(s/t)
j
− − − − −
=D(I ,I )+D(J ,J )+D(H ,H ) D(K ,K )+log(t/s),
1 k 1 ℓ 1 j 1 j
−
as desired. 2
Remark. Shanks stated Square Forms Factorization has an expected runtime of
O(√4N) (see Gower [Go] for a detailed discussion of this).
We explain a related idea remarked on byH. Lenstra [Len], page 148.
The idea is to first compute the regulator R. This has complexity O(N51+ǫ),
assuming theRiemann hypothesis[Len]. Nowusethe“baby-stepgiant-step”method
(as discussed in 13 of [Len]) to get close to thesymmetry point:
§
Algorithm 3. (Baby-stepgiant-step)
Input:N andR
Output:FactorizationofN
1. Compute the form F associated to the first or second steps of the continued
fractionalgorithmofthenormalizedsquarerootofN,(4).
10