1

Since the success of the $p - 1$ algorithm depends on $p - 1$ having "small" prime factors, or at least smaller than a reasonable smoothness bound, and Williams' $p + 1$ method has the same constraint for $p + 1$, it seems to me that it would be extremely unlikely for neither $p - 1$ nor $p + 1$ to be smooth. So if we were to construct, say, a tough 500-bit (RSA-type) semiprime such as

$n = pq = \ $ 2218295966162666629041316944231086113195058068148716022472522769336934503490317077398434252307822130896437753111872862038992461352826985916137012449841,

where $p$ and $q$ are both "safe" primes to guarantee worst-case performance for the $p - 1$ algorithm (that is, $(p - 1) / 2$ and $(q - 1) / 2$ are both Sophie Germain primes), would it make sense to attempt the $p + 1$ algorithm after $p - 1$ had bailed out? In other words, is there anything to be gained by trying that before ECM or bringing out the "big guns" of QS or NFS?

Oh, and I also generated the above semiprime with $\frac{p}{q}$ large enough to thwart factoring via Fermat's difference of squares method:

$\left|p - \sqrt{n}\,\right| \gt \sqrt[4]{4n}$.

Dave Schulman
  • 51
  • 5
  • 1
    'The "big guns" of ECM...'; actually, ECM isn't that much more expensive than Pollards. The algorithm is effectively the same as Pollards, just over a pseudocurve instead of $\mathbb{Z}_n^*$; this means that each computation is an EC addition, rather than modular multiplication; that just means that the overall ECM algorithm runs a constant factor slower... – poncho Jun 05 '18 at 12:41
  • 1
    For what it's worth, my "big guns" comment was kind of paraphrasing Richard A. Mollin's Introduction to Cryptography, 2nd Ed, (2007), p. 219. In this, he was specifically referring to the use of QS after trial division, DoS, p-1, and $\rho$ had failed to find small factors. He then suggests that ECM can also be used for this purpose in advance of QS. – Dave Schulman Jun 05 '18 at 14:55

1 Answers1

2

These attacks are not relevant today because ECM, QS, and NFS are more cost-effective at modulus sizes providing serious security, which these days must be well above 1024 bits, preferably at least 2048 bits.

See past questions [1], [2] for more background on these criteria in historical RSA key generation recommendations, which these days are obsolete since the development of ECM, QS, and NFS.

Squeamish Ossifrage
  • 48,392
  • 3
  • 116
  • 223
  • 1
    Yes, I've read Rivest's and Silverman's 2001 paper and understand their argument about how the use of "strong" and "safe" primes (wrt RSA, at any rate) have been made obsolete by the advent of improved factoring techniques since 1982 or so, specifically ECM, QS, and now NFS. I have no problem with any of that, but my question remains: is there any point in attempting p+1 after p-1 has failed, in the hope that p+1 is likely to be smooth if p-1 is not? If the answer is no, of course, the next move would be ECM, followed by (size-dependent) QS or NFS. – Dave Schulman Jun 05 '18 at 14:42
  • 1
    The answer assumes we are attempting to factor a deliberately-chosen 'hard to factor' number (e.g. an RSA modulus). If we are attempting to factor an arbitrary number (for whatever reason), starting off with these 'cheap/find small factors quickly' methods make sense. – poncho Jun 05 '18 at 16:08
  • 1
    Yes, I agree. There's not much point using trial division, SQUFOF, $p - 1, p + 1, \rho$, or maybe even ECM on something like a 617-digit RSA modulus. For semiprimes like that, I see little choice other than GNFS with massive computing power and a great deal of time. I suppose there's always a small chance that one of the probabilistic algorithms might get lucky and come up with a spectacular factorization, but my understanding is that even the upper bound on the probability of that happening is still minuscule. – Dave Schulman Jun 05 '18 at 17:13