Continued fractions and Parallel SQUFOF 6 0 0 S. McMath, F. Crabbe∗, D. Joyner† 2 n 1-9-2006 a J 1 1 ] Dedication To thememory of Daniel Shanks(1917-1996). T N Abstract h. In this partly expository paper, we provetwo results. t Thatthetwo-sidedcontinuedfractionofthenormalizedsquareroot a • m (an important part of theSQUFOFalgorithm) has several very at- tractiveproperties-periodicity,asymmetrypointcorrespondingto [ a factorization of N, and so on. 1 The infrastructure distance formula. v • 3 Finally, we describe a method for parallelization of SQUFOF that main- 6 tainsitsefficiencyperprocesorasthenumberofprocessorsincreases,and 2 thusis predicted to beuseful for very large numbersof processors. 1 0 6 1 Introduction 0 / Though there are many fast algorithms for factoring numbers, this paper focuses on h t one known as square forms factorization or SQUFOF (see Algorithm 4 below for a a precisedescription). DanielShanksdevelopedSQUFOFinthe1970’s,anditisstillthe m fastestknownalgorithmforfactoringintegersinthe20-to30-digitrange. SQUFOFis : usedtothisdayinconjunctionwithotherfactorization algorithmsthatneedtofactor v 20-digit numbersin order to generate thefactors of higher digit numbers. i X Most of the Shanks’ original work on SQUFOF was not published (see however, r [Sh1])andhisnotesareincomplete1. OnepurposeofthispaperistopresentShanks’s a original SQUFOF algorithm in its entirety. The paper goes on to present several results concerning both traditional SQUFOFand its parallelization. This papercontains three main results: 1. Aproofthatthetwo-sidedcontinuedfractionofthenormalizedsquareroot(an importantpartoftheSQUFOFalgorithm)hasseveralveryattractiveproperties - periodicity, a symmetry point corresponding to a factorization of N, and so on(seeTheorems2.6,2.8,and2.9fordetails). Thisresult wasprobablyknown ∗U. S. Naval Academy, Computer Science Department, Annapolis, MD 21402, crabbe@usna.edu †U.S.NavalAcademy,Mathematics Department, Annapolis,MD21402, wdj@usna.edu 1Thesenotes havebeentypedinLaTeX andareavailableontheweb[Sh2],[Sh3],[Sh4]. 1 200 years ago to Lagrange and Galois and Gauss - see for example, Perron [P], Buell [Bu], and Williams [W]. 2. A proof of the infrastructure distance formula, Theorem 2.10 below, which is also an important part of SQUFOF. This is in some sense well-known but a proof has not, as far as we can see, appeared in the literature. (However, see Cohen[Coh2],Proposition 5.8.4, andWilliams andWunderlich[WW]Theorem 5.2 for closely related results.) 3. Investigationofamethodforparallelization ofSQUFOFthatmaintainsitseffi- ciencyperprocesorasthenumberofprocessorsincreases,andthusispredicted tobeusefulforlargenumbersofprocessors. (See[W],[WW],and[Go]forwork onsimilarideas.) TheimplementationinC,andsubsequentnumericaldatadue tothefirstauthor,isnewasfarasweknow. Thisisbrieflysketchedin 4below. § Althoughthetheoreticalresultsinthispaperareknowntotheexperts,itishoped that putting all these results together will serve a useful purpose. This paper is a version of the first author’s undergraduate “Trident” thesis, advised by the second two authors. 2 Continued Fractions and Quadratic Forms The stepping stone for SQUFOF is the continued fraction expansion for the square root of N. (We slightly simplify matters by instead using the “normalized square root (equation 4) here.) The terms of this continued fraction expansion give rise to a sequence of quadratic forms of discriminant N via (5). Weshall describe SQUFOF intermsofthe“cycle” ofcontinuedfractions intheperiodic expansionof (4)andthe corresponding quadratic forms. 2.1 Integral binary quadratic forms There is a “dictionary” between certain aspects of indefiniteintegral binary quadratic forms, • ideals in a real quadratic numberfield, • the simple continued fraction of quadratic surds. • The reader will be assumed to be familiar with at least the basic aspects of this correspondence. For details, see for example, Buell [Bu], Lenstra [Len], Williams [W] (especially pp. 641-645), Cohen [Coh1] and thereferences found there, or [M]. Abinary quadratic form(orsimplya“form”)isahomogeneousformofdegree two in two variables x,y, a b/2 x f(x,y)=ax2+bxy+cy2=(x,y) , · b/2 c · y (cid:18) (cid:19) (cid:18) (cid:19) for some constants a,b,c. This form shall also be denoted by the triple (a,b,c). The discriminant2 of f is D = disc(f) = b2 4ac. We shall focus on the case D > 0, − inwhich case theform iscalled indefinite. From now on, we assume without further mention that D>0 is a non-square such that D 0 (mod 4) or D 1 (mod 4). ≡ ≡ 2Sometimesalsocalledthedeterminantoff. 2 If a,b,c Z then we say f is integral. If moreover gcd(a,b,c) = 1, then we say ∈ the form is primitive. Let F(D) denote the set of all integral forms of discriminant D and let F(D) denotethe subset of primitiveones. p The groups s t GL (Z)= γ = s,t,u,v Z, det(γ)= 1 , 2 { u v | ∈ ± } (cid:18) (cid:19) and SL (Z)= γ GL (Z) det(γ)=1 2 2 { ∈ | } act on the polynomials Z[x,y]via s t γ = :(x,y) (sx+ty,ux+vy). u v 7−→ (cid:18) (cid:19) Therefore, they also act on theset of integral forms via (γ∗f)(x,y)=f(sx+ty,ux+vy), a b/2 for γ GL (Z). In terms of the symmetric matrix A= associated to ∈ 2 b/2 c (cid:18) (cid:19) theform f, this action may be epressed as γ∗(A)= tγ A γ. · · We say that two forms f1,f2 are equivalentif f2 =γ∗f1, for some γ GL2(Z). We ∈ saythattwoformsf1,f2 areproperly equivalent,written f1 f2,iff2 =γ∗f1,for ∼ some γ SL (Z). For f F(D), we let 2 ∈ ∈ F(D)f =[f]= f′ F(D) f f′ { ∈ | ∼ } denote the proper equivalence class of f. An element γ GL (Z) is called an au- 2 ∈ tomorph of f if γ∗f = f. A form f is called ambiguous if it has an automorph in GL2(Z) SL2(Z). Note that if f F(D) is ambiguous then each f′ [f] is also − ∈ ∈ ambiguous. We say that two forms (a ,b ,c ),(a ,b ,c ) F(D) are adjacent if c = a 1 1 1 2 2 2 1 2 ∈ and b +b 0 (mod 2a ). In this case, we say that (a ,b ,c ) is to the right of 1 2 2 2 2 2 ≡ (a ,b ,c ) ((a ,b ,c ) is to theleft of (a ,b ,c )). 1 1 1 1 1 1 2 2 2 2.1.1 Reduction A form (a,b,c) is called reduced if D1/2 2a 0 there are usually several f′ F(D)r ∈ ∈ which are properly equivalent to f. In otherwords, thecycle F(D)r,f = f′ F(D)r f f′ = f′ =ρnf n Z { ∈ | ∼ } { | ∈ } can be rather large. Indeed, it is known that F(D) = O(D1/2+ǫ), (where the O- r,f | | constantdependsonǫ)forallǫ>0,wheretheexponent1/2isbestpossible(Lagarias [Len, L2]) and . 4 2.1.2 Composition The composition of forms has important properties for SQUFOF. The rules of composition are fairly general. A binary quadratic form F is called a composition of f,g F(D) if it satisfies an equation such as ∈ f(x,y)g(u,v)=F(B (x,y,u,v),B (x,y,u,v)), (2) 1 2 where B and B are quadratic forms in x,y,u,v of a certain type. The exact con- 1 2 ditions B ,B satisfy do not concern us here (see Cox [Cox] if you are curious and 1 2 Gauss [G] if you are really curious). The point is that there may be more than one pairB ,B satisfying(2),sothatthecompositionF isnotunique. (However,thecon- 1 2 ditions on B ,B specified by Gauss do imply that, for a given f,g F(D) any two 1 2 ∈ suchcompositions mustbeequivalenttoeach other.) Onewayaroundthisambiguity is to specify a choice of B ,B and hence defineF uniquely. 1 2 TheideadescribedbelowwasknowninsomeformtoDirichletandpossiblyGauss. Algorithm 2. Input:(a ,b ,c ),(a ,b ,c ) F(D). 1 1 1 2 2 2 Output:Acomposition(am1a22,B,(B24−a1Da)2m2∈)∈F(D). 1. Computem = gcd(a ,a ,b1+b2). (SinceD = b2 4a c , fori = 1,2, b andb 1 2 2 i − i i 1 2 havethesameparity.) 2. Solvethecongruences a mB mb a (mod 2a a ), 2 1 2 1 2 ≡ a mB mb a (mod 2a a ), 1 2 1 1 2 ≡ b1+b2mB mb1b2+D (mod 2a a ), 2 ≡ 2 1 2 simultaneouslyanintegerB. Choosethesolutionwithsmallestabsolutevalue. See [Sh1] or [Bu] for a proof of the correctness of this algorithm. Buell [Bu] also providesthesubstitutionsthatwouldbeneededforGauss’sdefinitionofcomposition. Inotherwords,wedefinethecompositionof(a ,b ,c ),(a ,b ,c ) F(D)tobe 1 1 1 2 2 2 ∈ theform resulting from the abovealgorithm: a a (B2 D)m2 (a1,b1,c1)∗(a2,b2,c2)=( m122,B, 4−a1a2 ). Remark. The binary operation : F(D) F(D) F(D) is associative but not ∗ × → its “restriction” # : F(D) F(D) F(D) (where # is composition algorithm 2 r r r × → followed by reduction algorithm 1). Let f,g F(D) be elements in the principal cycle of discriminant D. It was r ∈ observedbyShanks(see 5in Lenstra[Len]) thatcyclesenjoya“coset-likeproperty” ρkf#ρℓg=ρak,ℓ(f#g),fo§r some ak,ℓ Z . In particular, theprincipal cycle is closed ∈ under composition. Therefore, the the set of complete quotients of the continued fraction of such an α can beidentified with a set closed under#. For further discussion of this, see Lenstra [Len] (5.1). The“structure”ofacyclehasbeentermedthe“infrastructure”ofF(D)byShanks. If f,f′,g,g′,h F(D) then Gauss showed ∈ (a) (f g) h f (g h), and ∗ ∗ ∼ ∗ ∗ (b) f f′ and g g′ imply f g f′ g′. ∼ ∼ ∗ ∼ ∗ 5 These imply that the set of equivalence classes of forms of discriminant D is a group C(D),calledtheclassgroupofD. Fromtheconstruction,itisclearthatf g g f, ∗ ∼ ∗ so C(D) is abelian. Thefollowing Theorem was knownto Shanks,since SQUFOFdependsessentially on it. Theorem 2.4. An equivalence class has order 2 or 1 in the class group if and only if it is ambiguous. Any form (1,b,c) F(D) acts as the identity for . The cycle of the identity is ∈ ∗ the principal cycle of forms. Any form f whose square f2 = f f belongs to the ∗ principal cycle is an ambiguous form ([Bu], Corollary 4.9). 2.2 Continued fractions Throughout, assume that N 1 (mod 4) and is not a perfect square. ≡ We shall only consider simple continued fractions here. In other words, if α R ∈ is the number we want to compute the continued fraction of, let x = α, b = α , 0 0 ⌊ ⌋ where x denotes thefloor of x,and, for i>0, let ⌊ ⌋ 1 x = , b = x . (3) i xi 1 bi 1 i ⌊ i⌋ − − − Thetermx iscalledtheith complete quotientofαandb iscalled theith partial i i quotientof α. The simple continued fraction of α is ([HW]): 1 α=b + , 0 b + 1 1 b2+... also written [b ,b ,b ,...]. We are only concerned with continued fractions of an irra- 0 1 2 tional α K =Q(√N). In this case, thesequence b ,b ,b ,... is eventually periodic. 0 1 2 ∈ For example, let √N+⌊√N⌋−1, √N even, α= 2 (4)  √N+⌊√N⌋, j√Nk odd.  2 Wecall thisα thenormalized square root ofjN. kThe continuedfraction sequence  b ,b ,... is (purely) periodic. In general, the period of α is the size of the cycle 0 1 associated to the identityin theclass group (Buell [Bu], Theorem 3.18 (a)). At each step in the continued fraction expansion, it is possible to simplify x b i i − to the form √NQ−iPi ∈ [0,1), where Pi,Qi ∈ Z satisfy Pi2 ≡ N (mod Qi). In general, if P,Q are positive integers and x= √N+P satisfies P2 N (mod Q), 0

Continued fractions and Parallel SQUFOF

Similar Continued fractions and Parallel SQUFOF