0

Euler's factorization determines prime factors if two different sums of squares of number $n$ are given.
I just did that in Python not knowing Euler's method:

>>> (a,b),(c,d) = [(x,y) for x,y in diop_DN(-1, n) if x%2==0]
>>> (a**2 + b**2, c**2 + d**2) == (n, n)
True
>>> gcd(n, (a+c)**2 + (b-d)**2)
997
>>> gcd(n, (a+c)**2 + (b+d)**2)
509
>>> 

Euler's method relies on knowing two different sums of squares.
My question is, whether knowing only one ($n = a^2 + b^2$) with integers $n, a, b$ allows to efficiently factor $n$ as well, somehow?

P.S:
From the link user25406 provided, interpreting the square numbers of a sum as Gaussian integers, "Gaussian integer gcd" directly determines the sum of squares for each prime factor of $n$ (Python lib with ggcd() here):

>>> (a,b),(c,d) = [(x,y) for x,y in diop_DN(-1, n) if x%2==0]
>>> from RSA_numbers_factored import ggcd
>>> ggcd((a,b),(c,d))
(-22, -5)
>>> ggcd((a,b),(c,-d))
(6, -31)
>>> n % (22**2 + 5**2)
0
>>> n % (6**2 + 31**2)
0
>>> 

Or with sympy gcd():

>>> (a,b),(c,d) = [(x,y) for x,y in diop_DN(-1, n) if x%2==0]
>>> from sympy import gcd, I
>>> gcd(a + b * I, c + d * I)
22 + 5*I
>>> gcd(a + b * I, c - d * I)
31 + 6*I

P.P.S:
Analysis of algrorithm user25406 provided as answer.

Find $a,b$ for odd semiprime $n = a^2 + b^2$, by looking at fixed value $s = a + b$ and testing for integer solutions $a, b$ of $n = s^2 - 2ab$. Since $n$ is odd, $s$ has to be odd as well.

Good news, no search for a given $s$ needed, values for $a, b$ are solution of this quadratic equation system with constants $s, n$:
$$s = a + b$$ $$s^2 - 2ab = n$$ Solution:
$$a_{1,2} = \frac{s \pm \sqrt{2n - s^2}}{2}$$ Good if $a_{1,2}$ are integer values:
$s=9$ for $n=65$: $a_{1,2} = 8, 1$
$s=11$ for $n=65$: $a_{1,2} = 7, 4$

Bad if $a_{1,2}$ are non-integer values:
$s=27$ for $n=13*41$: $a_{1,2} = \frac{27 \pm \sqrt(337)}{2}$

So constant runtime for a single value $s$.

This is the range of odd values of $s$ that need to be looked at:
$n = 1^2 + \lfloor{\sqrt{n}}\rfloor^2$, example: $65 = 1^2 + 8^2$
...
$n = \lfloor{\sqrt{\frac{n}{2}}}\rfloor^2 + \lceil{\sqrt{\frac{n}{2}}}\rceil^2$, example: $85 = 6^2 + 7^2$
So $O(\frac{\sqrt{\frac{n}{2}}}{2}) = O(\sqrt{n})$ values need to be tested.

That is not an efficient algorithm (like eg. gcd()), they have polynomial runtime in (binary) input length $\log{n}$ .

  • 1
    I doubt that it's possible. At first glance we can't even tell if it is prime or not. $1^2+4^2=17$ is prime, but $1^2+8^2=65$ is composite. – Michael Stocker Mar 09 '23 at 08:50
  • OK, so for semiprime $n = p * q = (4k+1) (4*l+1) = a^2 + b^2$ with primes $p, q$ and integers $k, l, a, b$ we know that there are two such sums of squares for $n$ by Brahmagupta–Fibonacci identity, since $p$ as well as $q$ have unique sum of squares. Question now is, whether knowing just one sum of squares for $n$ allows for efficient factoring of $n$ in this case? – HermannSW Mar 09 '23 at 09:12
  • Check the answer of Misha Lavrov on this post. Clearly the answer is no. https://math.stackexchange.com/questions/2294749/finding-other-representations-for-a-sum-of-two-squares – user25406 Mar 09 '23 at 19:52
  • Thanks for the link, based on it I added "P.S:" above where code can be viewed nicely. The argument for "no" is that known methods to compute another sum of squares are based on doing prime factorization. But I don't see why not a different method should be able to determine "the other" sum of squares for semiprime $n$ without factorization of $n$. – HermannSW Mar 09 '23 at 20:23
  • @HermannSW, I posted an answer earlier ( too long for a comment) where I gave a method to determine "the other" sum of square without factorization of $n$. – user25406 Mar 09 '23 at 22:49
  • where I gave a method to determine "the other" sum of square without factorization of n.

    See "P.P.S" analysis that the algorithm is not "efficient".

    – HermannSW Mar 10 '23 at 12:19
  • Here's a method that calculatse the sum of two squares using the triangular numbers. It uses the quadratic formula so it may not be fast or the efficient. https://math.stackexchange.com/questions/1972771/is-this-the-general-solution-of-finding-the-two-original-squares-that-add-up-to – user25406 Mar 11 '23 at 14:07
  • I just found easy to understand explanation here why the original $gcd()$ method knowing two distinct sums of squares for odd semiprime $n$ allows to factor $n$ easily. It likely does not help for this question where only one sum of squares for $n$ is known, though. – HermannSW Mar 12 '23 at 13:57

0 Answers0