quadratic sieve


To factor a number n using the quadratic sieveMathworldPlanetmath, one seeks two numbers x and y which are not congruent modulo n with x not congruentMathworldPlanetmath to -y modulo n but have x2y2(modn). If two such numbers are found, one can then say that (x+y)(x-y)0(modn). Then, x+y and x-y must have non-trivial factors in common with n.

The quadratic sieve method of factoring depends upon being able to create a set of numbers whose factorization can be expressed as a productPlanetmathPlanetmath of pre-chosen primes. These factorizations are recorded as vectors of the exponents. Once enough vectors are collected to form a set which contains a linear dependence, this linear dependence is exploited to find two squares which are equivalentMathworldPlanetmathPlanetmathPlanetmathPlanetmath modulo n.

To accomplish this, the quadratic sieve method uses a set of prime numbersMathworldPlanetmath called a factor base. Then, it searches for numbers which can be factored entirely within that factor base. If there are k prime numbers in the factor base, then each number which can be factored within the factor base is stored as a k-dimensional vector where the i-th componentMathworldPlanetmathPlanetmathPlanetmath of the vector for y gives the exponent of the i-th prime from the factor base in the factorization of y. For example, if the factor base were {2,3,5,7,11,13}, then the number y=2332115 would be stored as the vector 3,2,0,0,5,0.

Once k+1 of these vectors have been collected, there must be a linear dependence among them. The k+1 vectors are taken modulo 2 to form vectors in 2k. The linear dependence among them is used to find a combinationMathworldPlanetmathPlanetmath of the vectors which sum up to the zero vectorMathworldPlanetmath in 2k. Summing these vectors is equivalent to multiplying the y’s to which they correspond. And, the zero vector in 2k signals a perfect squareMathworldPlanetmath.

To factor n, chose a factor base 𝐁={p1,p2,,pk} such that 2𝐁 and for each odd prime pj in 𝐁, n is a quadratic residueMathworldPlanetmath of pj. Now, start picking xi near n and calculate yi=xi2-n. Clearly yixi2(modn). If yi can be completely factored by numbers in 𝐁, then it is called 𝐁-smooth. If it is not 𝐁-smooth, then discard xi and yi and move on to a new choice of xi. If it is 𝐁-smooth, then store xi, yi, and the vector of its exponents for the primes in 𝐁. Also, record a copy of the exponent vector with each component taken modulo 2.

Once k+1 vectors have been recorded, there must be a linear dependence among them. Using the copies of the exponent vectors that were taken modulo 2, determine which ones can be added together to form the zero vector. Multiply together the xi that correspond to those chosen vectors—call this x. Also, add together the original vectors that correspond to the chosen vectors to form a new vector v. Every component of this vector will be even. Divide each element of v by 2. Form y=i=1kpivi.

Because each yixi2(modn), x2y2(modn). If xy(modn), then find some more 𝐁-smooth numbers and try again. If x is not congruent to y modulo n, then (x+y) and (x-y) are factors of n.


Consider the number n=16843009 The integer nearest its square root is 4104. Given the factor base


, the first few 𝐁-smooth values of yi=f(xi)=xi2-n are:

xi yi=f(xi) 2 3 5 7 13
4122 147875 0 0 3 1 2
4159 454272 7 1 0 1 2
4187 687960 3 3 1 2 1
4241 1143072 5 6 0 2 0
4497 3380000 5 0 4 0 2
4993 8087040 9 5 1 0 1

Using x0=4241 and x1=4497, one obtains:


Which results in:


From there:


It may not be completely obvious why we required that n be a quadratic residue of each pi in the factor base 𝐁. One might intuitively think that we actually want the pi to be quadratic residues of n instead. But, that is not the case.

We are trying to express n as:




Because we end up squaring y, there is no reason that the pi would need to be quadratic residues of n.

So, why do we require that n be a quadratic residue of each pi? We can rewrite the x2-y2=n as:


If we take that expression modulo pi for any pi for which the corresponding vi is non-zero, we are left with:


Thus, in order for pi to show up in a useful solution, n must be a quadratic residue of pi. We would be wasting time and space to employ other primes in our factoring and linear combinationsMathworldPlanetmath.

Title quadratic sieve
Canonical name QuadraticSieve
Date of creation 2013-03-22 12:48:14
Last modified on 2013-03-22 12:48:14
Owner patrickwonders (217)
Last modified by patrickwonders (217)
Numerical id 9
Author patrickwonders (217)
Entry type AlgorithmMathworldPlanetmath
Classification msc 11Y05
Classification msc 11A51