We introduce a new approach to (deterministic) integer factorisation, which could be described in the cryptographically fashionable term of “factoring with hints”: we prove that, for any ϵ > 0, given the knowledge of the factorisations of O(N1/3+ϵ) terms surrounding N = pq product of two large primes, we can recover deterministically p and q in O(N1/3+ϵ) bit operations. This shows that the factorisations of close integers are non trivially related and that consequently one can expect more results along this line of thought.
The problem of quickly factoring large integers is central in cryptography and computational number theory. The current state of the art in factoring large integers N, the Number Field Sieve algorithm [5, 6], stems from the earlier Quadratic Sieve  and Continued Fraction .We should also mention the Elliptic Curve Method by H. Lenstra , which is particularly useful when N has a small prime factor p. They are all probabilistic factoring algorithms.
These algorithms have heuristic running times respectively and and for some constant c (not always the same). The first two strive to find nontrivial arithmetical relations of the form x2 ≡ y2 (mod N) (which lead to a nontrivial factor by computing gcd(N, x + y)), whereas the third is a generalisation of Pollard’s p − 1 method , involving computations in some elliptic curve group instead of ℤ/N. We should note, however, that there exist probabilistic algorithms with proved running time O (exp((1+ o(1))(log N)1/2(log log N)1/2)) . As far as the author is aware, no such rigorous bound exists in the form O(exp ((log N)c)) for c < 1/2. Similarly, no deterministic subexponential algorithm is currently known, the best one being Shanks’ square form factorization SQUFOF which runs in O(N1/4+∊), or in O(N1/5+∊) on the Extended Riemann Hypothesis. Recently Hittmeir  has somewhat improved Shanks’ unconditional result to Ofor some explicit constant C > 0. This is currently the best unconditional deterministic factoring algorithm.
In this work, we want to introduce a new paradigm in integer factorisation, one that doesn’t supersede previous efforts, but rather complements it by showing that the factorisation of a small number of consecutive integers is related in a nontrivial way. Therefore, if numbers close to a product N = pq of two primes are easier to factor than N itself, we can expect a reduction in the time to factor N. Here we content ourselves with a first nontrivial result.
Let N = pq a product of two primes. Then, given an arbitrary ϵ > 0, the factors p and q can be recovered in O(N1/3+ϵ) bit operations from the knowledge of the factorisations of O(N1/3+ϵ) integers closest to N. The memory requirement is polynomial for the computational part.
Remark that integers close to N = pq do no contain the factors p or q in the case of a RSA modulus, when bit operations mentioned in the theorem essentially involve the factorisations of the first O(N1/3+ϵ) integers, where similarly the factors p, q of a RSA modulus would not appear. Thus we can loosely say that our result proves that the factorisation of N = pq is related to the factorisations of the O(N1/3+ϵ) integers closest to it and to the O(N1/3+ϵ) smallest positive integers.
The structure of this article will be as follows. After recalling notations (Section 2) we explain the main idea of the method: finding a close enough approximation to the value of a multiplicative function and deduce a corresponding approximation a to p dividing N (Section 3).
In Section 4, we use generating functions (products of zeta functions) and their inverse Mellin transforms when multiplied by an appropriate kernel to define the quantities that we will be led to evaluate: Fν(x) and Pν(x).
In Section 6, we obtain a different expression for Fν(x) by making use of the functional equation of the generating function. We discover that the new expression can be easily computed save for two families of oscillating series.
Finally, in Section 7, we show that by computing around N1/3+ϵ terms in the oscillating series, each of which can be done in polynomial time, one can get a block approximation to σ1/2(n) for n = N together with about N1/3+ϵ of its neighbours. Therefore, knowing the factorisation of these neighbours would allow us to find an approximation to σ1/2(N) and therefore to a divisor p of N.
In this work N = pq where p, q are distinct prime numbers. We follow standard notations in analytic number theory and indeed a classical reference on the subject is the treatise of Davenport . In particular, we will make liberal use of the O notation in Landau’s as well as Vinogradov’s form (≪). Hence, for instance
means that g(u) > 0 and |f (u)|/g(u) is bounded above (usually as u → ∞ or u → 0+, depending clearly on the context). Unless specified, the implied constants are absolute.
Any sum such as
is to be understood as taken over all positive integers a, b, c such that abc = n. We also define
so that for instance the number of divisors of n isand its sum of divisorsWe also write s = σ+it, with σ, t ∈ R, according to the established convention in analytic number theory.
Finally, we write a ≐ b to signify that a = b + terms that are not necessarily negligible in size but can be computed in polynomial time (in the bit size of the challenge to be factored), so that they are negligible in time.
3 Choice of a Multiplicative Function
For λ ∈ ℝ define
Our goal will be to compute within O(1/N). If so, then one gets an approximation 𝓐 to
Let us study the function in (0,∞)
The function f is convex in with a unique critical point (and therefore absolute minimum) at We will suppose that N = pq with In fact, we may as well suppose that by inspection. Note that for and therefore for Define by To see that such a exists, notice that f is decreasing in If then, for some we can write
contradicting (1). Given then with we obtain, for some
and therefore p = ⌊a⌉, the integer nearest to a.
4 Choice of a Test Function
Consider the Riemann zeta function
convergent for ℜs > 1. Then
absolutely convergent whenever Now let for  with ν ≥ 2,
The Mellin transform of f is by definition the beta function
hence by the inverse Mellin transform,
Call the right-hand side
and note that
is a piecewise polynomial (given by a different expression between consecutive integers).
5 Functional Equation of the Riemann Zeta Function
The Riemann zeta function is a meromorphic function having a simple pole with residue 1 at s = 1 and satisfying the functional equation (given here in asymmetric form)
6 Another Expression for Fν(x)
In fact, we can move the line of integration to ℜs = −1/4, since to the right of that line, for any given ϵ > 0,
In particular the integral on the right-hand side is absolutely convergent when ν ≥ 4. It is this integral is the next focus of our investigation. It is natural at this point to use the functional equation. We get quite straightforwardly
Using the Legendre duplication formula
together with the functional equations we obtain
We can further transform (3) by noting that there exist unique constants c0,ν = 1, . . . , cν,ν such that
whenever this expression makes sense. To see this, multiply both sides by (2s − 1)(2s − 2) · · · (2s − 2ν). The resulting left-hand side is a polynomial of degree ν, expressed as a linear combination of the polynomials resulting from the right-hand side, which form a basis of the vector space of polynomials of degree ≤ ν. For instance, and From (3) we get
Putting it together we obtain
We have, for y > 0,
and after collecting the residues of the gamma function at the negative integers,
Remark that if k ≥ 1, since onthe left-hand side of the previous expression is analytic for and continuous up to Therefore the previous formula for k ≥ 1 holds in the closed half-plane With this explicit expression we find that
7 Factoring with Hints
We show here, given 0 < ϵ < 1, how to calculate in bit operations, assuming the factorisation knowledge of integers immediately around N = pq, the quantity within O(N−1), which is sufficient to derive p and q. In the following, we suppose that ν is a fixed (in terms of N) integer with ν ≥ 20/3ϵ. The work done in the previous section allows us to write
Having fixed ϵ > 0, we approximate the series
by its th partial sum, with a corresponding error
since ϵν ≥ 20/3 (and ϵ < 1). Remark that the truncated series with
can be computed trivially within O(x−ν) in O(x1/3+ϵ) bit operations since there are O(y log y) positive integer pairs (n1, n2) with n1n2 ≤ y. Computing each term in the sum to the required precision can be achieved by calculating
to within O(x−ν). This can be done by calculating a ∈ [0, 2π) such that (mod 1) with error≪ x−ν and then using a Maclaurin expansion of the exponential truncated after ν log x terms. To summarise, we can compute the right-hand side of (6), (7) within O(xν/3) in O(x1/3+ϵ) bit operations.
On the other hand, let h > 0 and define for k ≥ 1. The following statements can easily be shown by induction.
If P is a polynomial of degree d then
Letting and we see that can be expressed as
Therefore we can compute in bit operations an approximation of within O(Nν/3). This leads to an approximation of within
since ϵν ≥ 7/3 . Recovering p | N is explained in Section 3.
8 Final Considerations
Our method relates the factorisations of O(Nθ+ϵ) numbers close to N with the factorisations of the first O(Nθ+ϵ) integers. The result given here (with θ = 1/3) is rather crude, because the series (6) and (7) were approximated by trivially computing the partial sum (8). An avenue for improvement would be in the selection of a better suited test function or another (or more than one) multiplicative function.
Research supported in part by a grant from the Social Development Fund.
 P. Borwein. An efficient algorithm for the Riemann zeta function. In Constructive, experimental, and nonlinear analysis (Limoges, 1999), volume 27 of CRC Math. Model. Ser., pages 29–34. CRC, Boca Raton, FL, 2000.Search in Google Scholar
 A. K. Lenstra, H. W. Lenstra Jr., M. S. Manasse, and J. M. Pollard. The Number Field Sieve. In ACM Symposium on Theory of Computing, pages 564–572, 1990.10.1145/100216.100295Search in Google Scholar
 A. K. Lenstra and H. W. Lenstra, Jr., editors. The development of the number field sieve, volume 1554 of Lecture Notes in Mathematics. Springer-Verlag, Berlin, 1993.10.1007/BFb0091534Search in Google Scholar
 M. A. Morrison and J. Brillhart. A method of factoring and the factorization of F7 Math. Comp., 29:183–205, 1975. Collection of articles dedicated to Derrick Henry Lehmer on the occasion of his seventieth birthday.10.1090/S0025-5718-1975-0371800-5Search in Google Scholar
 C. Pomerance. Analysis and comparison of some integer factoring algorithms. In Computational methods in number theory, Part I, volume 154 of Math. Centre Tracts, pages 89–139. Math. Centrum, Amsterdam, 1982.Search in Google Scholar
© 2020 F. Sica, published by De Gruyter
This work is licensed under the Creative Commons Attribution 4.0 International License.