Integer Factorization
April 30, 2010
; integer factorization
(define (expm b e m)
(define (m* x y) (modulo (* x y) m))
(cond ((zero? e) 1)
((even? e) (expm (m* b b) (/ e 2) m))
(else (m* b (expm (m* b b) (/ (- e 1) 2) m)))))
(define (isqrt n)
(let loop ((x n) (y (quotient (+ n 1) 2)))
(if (<= 0 (- y x) 1) x
(loop y (quotient (+ y (quotient n y)) 2)))))
(define (ilog b n)
(if (zero? n) -1
(+ (ilog b (quotient n b)) 1)))
(define (digits n . args)
(let ((b (if (null? args) 10 (car args))))
(let loop ((n n) (d '()))
(if (zero? n) d
(loop (quotient n b)
(cons (modulo n b) d))))))
(define rand
(let* ((a 3141592653) (c 2718281829)
(m (expt 2 35)) (x 5772156649)
(next (lambda ()
(let ((x-prime (modulo (+ (* a x) c) m)))
(set! x x-prime) x-prime)))
(k 103)
(v (list->vector (reverse
(let loop ((i k) (vs (list x)))
(if (= i 1) vs
(loop (- i 1) (cons (next) vs)))))))
(y (next))
(init (lambda (s)
(set! x s) (vector-set! v 0 x)
(do ((i 1 (+ i 1))) ((= i k))
(vector-set! v i (next))))))
(lambda seed
(cond ((null? seed)
(let* ((j (quotient (* k y) m))
(q (vector-ref v j)))
(set! y q)
(vector-set! v j (next)) (/ y m)))
((eq? (car seed) 'get) (list a c m x y k v))
((eq? (car seed) 'set)
(let ((state (cadr seed)))
(set! a (list-ref state 0))
(set! c (list-ref state 1))
(set! m (list-ref state 2))
(set! x (list-ref state 3))
(set! y (list-ref state 4))
(set! k (list-ref state 5))
(set! v (list-ref state 6))))
(else (init (modulo (numerator
(inexact->exact (car seed))) m))
(rand))))))
(define (randint . args)
(cond ((null? (cdr args))
(floor (* (rand) (car args))))
((< (car args) (cadr args))
(+ (floor (* (rand) (- (cadr args) (car args)))) (car args)))
(else (+ (ceiling (* (rand) (- (cadr args) (car args)))) (car args)))))
(define (primes n)
(let* ((max-index (quotient (- n 3) 2))
(v (make-vector (+ 1 max-index) #t)))
(let loop ((i 0) (ps '(2)))
(let ((p (+ i i 3)) (startj (+ (* 2 i i) (* 6 i) 3)))
(cond ((>= (* p p) n)
(let loop ((j i) (ps ps))
(cond ((> j max-index) (reverse ps))
((vector-ref v j)
(loop (+ j 1) (cons (+ j j 3) ps)))
(else (loop (+ j 1) ps)))))
((vector-ref v i)
(let loop ((j startj))
(if (<= j max-index)
(begin (vector-set! v j #f)
(loop (+ j p)))))
(loop (+ 1 i) (cons p ps)))
(else (loop (+ 1 i) ps)))))))
(define (primes-range l r b)
(let* ((ps (cdr (primes (+ (isqrt r) 1))))
(qs (map (lambda (p) (modulo (* -1/2 (+ l 1 p)) p)) ps))
(zs '()) (z (lambda (p) (set! zs (cons p zs)))))
(do ((t l (+ t b b))
(qs qs (map (lambda (p q) (modulo (- q b) p)) ps qs)))
((= t r) (reverse zs))
(let ((bs (make-vector b #t)))
(do ((qs qs (cdr qs)) (ps ps (cdr ps))) ((null? qs))
(do ((j (car qs) (+ j (car ps)))) ((<= b j))
(vector-set! bs j #f)))
(do ((j 0 (+ j 1))) ((= j b))
(if (vector-ref bs j) (z (+ t j j 1))))))))
(define (save-billion-primes file-name)
(with-output-to-file file-name (lambda ()
(do ((i 0 (+ i 1))) ((= i 10))
(let loop ((ps (if (zero? i) (primes 100000020)
(primes-range (* i 100000020)
(* (+ i 1) 100000020) 10000002)))
(k (quotient (* i 100000020) 30)) (bits 0))
(cond ((null? ps)
(display (integer->char bits))
(do ((k (+ k 1) (+ k 1)))
((= k (quotient (* (+ i 1) 100000020) 30)))
(display (integer->char 0))))
((< k (quotient (car ps) 30))
(display (integer->char bits))
(do ((k (+ k 1) (+ k 1)))
((= k (quotient (car ps) 30)))
(display (integer->char 0)))
(loop ps (quotient (car ps) 30) 0))
(else (case (modulo (car ps) 30)
((1) (loop (cdr ps) k (+ bits 1)))
((7) (loop (cdr ps) k (+ bits 2)))
((11) (loop (cdr ps) k (+ bits 4)))
((13) (loop (cdr ps) k (+ bits 8)))
((17) (loop (cdr ps) k (+ bits 16)))
((19) (loop (cdr ps) k (+ bits 32)))
((23) (loop (cdr ps) k (+ bits 64)))
((29) (loop (cdr ps) k (+ bits 128)))
(else (loop (cdr ps) k bits))))))))))>
; (save-billion-primes "prime.bits") ; only do this once
(define prime-bits #f)
(define (load-primes n file-name)
(with-input-from-file file-name
(lambda ()
(let ((k-max (+ (quotient n 30) (if (zero? (modulo n 30)) 0 1))))
(set! prime-bits (make-vector k-max))
(do ((k 0 (+ k 1))) ((= k k-max))
(vector-set! prime-bits k (char->integer (read-char))))))))
(define max-prime 1000000181)
(load-primes 1000000200 "prime.bits")
(define (next-prime n)
(define (next-bit n)
(let ((index (quotient n 30))
(offset (modulo n 30)))
(case offset
((0) (values index 1))
((1 2 3 4 5 6) (values index 2))
((7 8 9 10) (values index 4))
((11 12) (values index 8))
((13 14 15 16) (values index 16))
((17 18) (values index 32))
((19 20 21 22) (values index 64))
((23 24 25 26 27 28) (values index 128))
((29) (values (+ index 1) 1)))))
(define (bit-value offset)
(case offset
((1) 1) ((2) 7) ((4) 11) ((8) 13)
((16) 17) ((32) 19) ((64) 23) ((128) 29)))
(define (last-pair xs)
(if (null? (cdr xs)) xs
(last-pair (cdr xs))))
(define (cycle . xs)
(set-cdr! (last-pair xs) xs) xs)
(define (get-wheel n)
(let ((base (* (quotient n 30) 30))
(offset (modulo n 30)))
(case offset
((0) (values (+ base 1) (cycle 6 4 2 4 2 4 6 2)))
((1 2 3 4 5 6) (values (+ base 7) (cycle 4 2 4 2 4 6 2 6)))
((7 8 9 10) (values (+ base 11) (cycle 2 4 2 4 6 2 6 4)))
((11 12) (values (+ base 13) (cycle 4 2 4 6 2 6 4 2)))
((13 14 15 16) (values (+ base 17) (cycle 2 4 6 2 6 4 2 4)))
((17 18) (values (+ base 19) (cycle 4 6 2 6 4 2 4 2)))
((19 20 21 22) (values (+ base 23) (cycle 6 2 6 4 2 4 2 4)))
((23 24 25 26 27 28) (values (+ base 29) (cycle 2 6 4 2 4 2 4 6)))
((29) (values (+ base 31) (cycle 6 4 2 4 2 4 6 2))))))
(cond ((< n 2) 2) ((< n 3) 3) ((< n 5) 5)
((< n max-prime)
(let-values (((index offset) (next-bit n)))
(let loop ((index index) (offset offset))
(cond ((= offset 256) (loop (+ index 1) 1))
((zero? (logand (vector-ref prime-bits index) offset))
(loop index (* offset 2)))
(else (+ (* index 30) (bit-value offset)))))))
(else (let-values (((k wheel) (get-wheel n)))
(let loop ((k k) (wheel wheel))
(if (prime? k) k (loop (+ k (car wheel)) (cdr wheel))))))))
(define (prime? n)
(define (expm b e m)
(define (m* x y) (modulo (* x y) m))
(cond ((zero? e) 1)
((even? e) (expm (m* b b) (/ e 2) m))
(else (m* b (expm (m* b b) (/ (- e 1) 2) m)))))
(define (digits n . args)
(let ((b (if (null? args) 10 (car args))))
(let loop ((n n) (d '()))
(if (zero? n) d
(loop (quotient n b)
(cons (modulo n b) d))))))
(define (isqrt n)
(let loop ((x n) (y (quotient (+ n 1) 2)))
(if (<= 0 (- y x) 1) x
(loop y (quotient (+ y (quotient n y)) 2)))))
(define (square? n)
(let ((n2 (isqrt n)))
(= n (* n2 n2))))
(define (jacobi a n)
(if (not (and (integer? a) (integer? n) (positive? n) (odd? n)))
(error 'jacobi "modulus must be positive odd integer")
(let jacobi ((a a) (n n))
(cond ((= a 0) 0)
((= a 1) 1)
((= a 2) (case (modulo n 8) ((1 7) 1) ((3 5) -1)))
((even? a) (* (jacobi 2 n) (jacobi (quotient a 2) n)))
((< n a) (jacobi (modulo a n) n))
((and (= (modulo a 4) 3) (= (modulo n 4) 3)) (- (jacobi n a)))
(else (jacobi n a))))))
(define legendre jacobi)
(define (inverse x n)
(let loop ((x (modulo x n)) (a 1))
(cond ((zero? x) (error 'inverse "division by zero"))
((= x 1) a)
(else (let ((q (- (quotient n x))))
(loop (+ n (* q x)) (modulo (* q a) n)))))))
(define (miller? n a)
(let loop ((r 0) (s (- n 1)))
(if (even? s) (loop (+ r 1) (/ s 2))
(if (= (expm a s n) 1) #t
(let loop ((r r) (s s))
(cond ((zero? r) #f)
((= (expm a s n) (- n 1)) #t)
(else (loop (- r 1) (* s 2)))))))))
(define (chain m f g x0 x1)
(let loop ((ms (digits m 2)) (u x0) (v x1))
(cond ((null? ms) (values u v))
((zero? (car ms)) (loop (cdr ms) (f u) (g u v)))
(else (loop (cdr ms) (g u v) (f v))))))
(define (lucas? n)
(let loop ((a 11) (b 7))
(let ((d (- (* a a) (* 4 b))))
(cond ((square? d) (loop (+ a 2) (+ b 1)))
((not (= (gcd n (* 2 a b d)) 1))
(loop (+ a 2) (+ b 2)))
(else (let* ((x1 (modulo (- (* a a (inverse b n)) 2) n))
(m (quotient (- n (legendre d n)) 2))
(f (lambda (u) (modulo (- (* u u) 2) n)))
(g (lambda (u v) (modulo (- (* u v) x1) n))))
(let-values (((xm xm1) (chain m f g 2 x1)))
(zero? (modulo (- (* x1 xm) (* 2 xm1)) n)))))))))
(cond ((or (not (integer? n)) (< n 2))
(error 'prime? "must be integer greater than one"))
((even? n) (= n 2)) ((zero? (modulo n 3)) (= n 3))
(else (and (miller? n 2) (miller? n 3) (lucas? n)))))
(define (td-factors n b)
(let loop ((n n) (p 2) (fs '()))
(cond ((< n (* p p)) (values (reverse (cons n fs)) 1))
((< b p) (values (reverse fs) n))
((zero? (modulo n p))
(let ((new-n (/ n p)))
(if (prime? new-n)
(values (reverse (cons new-n (cons p fs))) 1)
(loop (/ n p) p (cons p fs)))))
(else (loop n (next-prime p) fs)))))
(define (rho-factor n c b)
(define (f x) (modulo (+ (* x x) c) n))
(let loop ((x 2) (y (f 2)) (q 1) (b b))
(cond ((zero? b) #f)
((zero? (modulo b 100))
(let ((new-x (f x)) (new-y (f (f y))))
(let ((g (gcd q n))) (if (< 1 g n) g
(loop new-x new-y (modulo (* (- new-y new-x) q) n) (- b 1))))))
(else (let ((new-x (f x)) (new-y (f (f y))))
(loop new-x new-y (modulo (* (- new-y new-x) q) n) (- b 1)))))))
(define (pminus1-factor n b)
(let loop ((c 2) (p 2) (k 0))
(cond ((< b p) (let ((g (gcd (- c 1) n))) (if (< 1 g n) g #f)))
((zero? (modulo k 100)) (let ((g (gcd (- c 1) n))) (if (< 1 g n) g
(loop (expm c (expt p (ilog p b)) n) (next-prime p) (+ k 1)))))
(else (loop (expm c (expt p (ilog p b)) n) (next-prime p) (+ k 1))))))
(define (add P1 P2 P1-P2 N)
(define (square x) (* x x))
(let* ((x0 (car P1-P2)) (x1 (car P1)) (x2 (car P2))
(z0 (cdr P1-P2)) (z1 (cdr P1)) (z2 (cdr P2))
(t1 (modulo (* (+ x1 z1) (- x2 z2)) n))
(t2 (modulo (* (- x1 z1) (+ x2 z2)) n)))
(cons (modulo (* (square (+ t2 t1)) z0) n)
(modulo (* (square (- t2 t1)) x0) n))))
(define (double P An Ad N)
(define (square x) (* x x))
(let* ((x (car P)) (z (cdr P))
(x+z2 (modulo (square (+ x z)) N))
(x-z2 (modulo (square (- x z)) N))
(t (- x+z2 x-z2)))
(cons (modulo (* x+z2 x-z2 4 Ad) N)
(modulo (* (+ (* t An) (* x-z2 Ad 4)) t) N))))
(define (multiply K P An Ad N)
(cond ((zero? K) (cons 0 0)) ((= K 1) P) ((= K 2) (double P An Ad N))
(else (let loop ((ks (cdr (digits K 2))) (Q (double P An Ad N)) (R P))
(cond ((null? ks) R)
((odd? (car ks))
(loop (cdr ks) (double Q An Ad N) (add Q R P N)))
(else (loop (cdr ks) (add R Q P N) (double R An Ad N))))))))
(define (curve12 N S)
(let* ((u (modulo (- (* S S) 5) N))
(v (modulo (* 4 S) N)) (v-u (- v u)))
(values (modulo (* (* v-u v-u v-u) (+ u u u v)) N)
(modulo (* 4 u u u v) N)
(cons (modulo (* u u u) N)
(modulo (* v v v) N)))))
(define (ec-factor N B1 B2 S)
(let-values (((An Ad Q) (curve12 N S)))
(let stage1 ((p 2) (Q Q))
(if (< p B1)
(stage1 (next-prime p) (multiply (expt p (ilog p B1)) Q An Ad N))
(let ((g (gcd (cdr Q) n))) (if (< 1 g n) (list 1 g)
(let ((QQ (double Q An Ad N))
(R (multiply (- B1 1) q An Ad n))
(T (multiply (+ B1 1) q An Ad n)))
(let stage2 ((p (next-prime B1)) (g g) (k (+ B1 1)) (R R) (T T))
(cond ((< B2 p) (let ((g (gcd g n))) (if (< 1 g n) (list 2 g) #f)))
((= k p) (stage2 (next-prime p) (modulo (* g (cdr T)) N)
(+ k 2) t (add T QQ R N)))
(else (stage2 p g (+ k 2) t (add T QQ R N))))))))))))
(define verbose? #f)
(define (msg . xs)
(when verbose?
(for-each display xs)
(newline)))
(define (factors n)
; parameters
(define td-limit 100000) ; limit of trial division
(define rho-limit 100000) ; iteration limit per rho trial
(define rho-trials 5) ; number of rho constants to try
(define pminus1-limit 500000) ; iteration limit
(define ecf-init 1000) ; first stage limit on first curve
(define ecf-step 1000) ; increase first stage limit on each curve
(define ecf-limit 100) ; number of curves to try
(define b2/b1 50) ; calculate second stage limit
(let ((n n) (facts '()))
(call-with-current-continuation (lambda (exit)
(define (factor? method f)
(if (not f) #f
(let ((f (if (eq? method 'ecf) (cadr f) f))
(stage (if (eq? method 'ecf) (car f) #f)))
(if (prime? f)
(begin (set! n (/ n f)) (set! facts (cons f facts))
(if (eq? method 'ecf)
(msg " In stage " stage ", found factor "
f ", remaining co-factor " n)
(msg " Found factor " f ", remaining co-factor " n))
(when (prime? n)
(msg " Factorization complete")
(exit (sort < (cons n facts))))
#t)
(begin (if (eq? method 'ecf)
(msg " In stage " stage ", found non-prime factor " f)
(msg " Found non-prime factor " f))
(let ((fs (factors f)))
(if (or (not fs) (pair? (car fs)))
(exit (cons (sort < facts) (* n f)))
(begin (set! n (/ n f))
(set! facts (append fs facts))
(when (prime? n)
(msg " Factorization complete")
(exit (sort < (cons n facts))))
#t))))))))
; check for primality
(when (prime? n) (msg "Input number is prime") (exit (list n)))
; trial division
(msg "Trial division: bound=" td-limit)
(let-values (((fs cofact) (td-factors n td-limit)))
(when (pair? fs) (msg " Found factors " fs)
(when (< 1 cofact) (msg "  Remaining co-factor " cofact)))
(when (= cofact 1) (msg " Factorization complete") (exit fs))
(set! facts (append fs facts)) (set! n cofact))
; pollard rho
(let loop ((k rho-trials) (c (randint n)))
(when (positive? k)
(msg "Pollard rho: bound=" rho-limit ", constant=" c)
(if (factor? 'rho (rho-factor n c rho-limit))
(loop k (randint n))
(loop (- k 1) (randint n)))))
; pollard pminus1
(let loop ()
(msg "Pollard p-1: bound=" pminus1-limit)
(when (factor? 'pm1 (pminus1-factor n pminus1-limit)) (loop)))
; elliptic curve
(let loop ((c 0) (s (randint 6 n)) (b1 ecf-init))
(when (< c ecf-limit)
(msg "Elliptic curve " c ": b1=" b1 ", b2=" (* b1 b2/b1) ", s=" s)
(if (factor? 'ecf (ec-factor n b1 (* b1 b2/b1) s))
(loop 0 (randint 6 n) ecf-init)
(loop (+ c 1) (randint 6 n) (+ b1 ecf-step)))))
; failure -- return factors, remaining co-factor
(cons (sort < facts) n)))))
Programming Praxis 