Running Time Predictions for Factoring Algorithms

In 1994, Carl Pomerance proposed the following problem:Select integers a1, a2, . . . , aJ at random from the interval [1, x], stopping whensome (non-empty) subsequence, {ai : i ∈ I} where I ⊆ {1, 2, . . ., J}, has a squareproduct (that is Πi∈Iai ∈ Z2). What can we say about the possible stoppingtimes, J? A 1985 algorithm of Schroeppel can be used to show that this process stops afterselecting (1+Ɛ)J0(x) integers aj with probability 1-o(1) (where the functionJ0(x) is given explicitly in (1) below. Schroeppel's algorithm actually finds thesquare product, and this has subsequently been adopted, with relatively minormodifications, by all factorers. In 1994 Pomerance showed that, with probability1-o(1), the process will run through at least J0(x)1-o(1) integers aj, and askedfor a more precise estimate of the stopping time. We conjecture that there is a"sharp threshold" for this stopping time, that is, with probability 1-o(1) onewill first obtain a square product when (precisely) {e-γ + o(1)}J0(x) integershave been selected. Herein we will give a heuristic to justify our belief in thissharp transition. In our paper [4] we prove, with probability 1-o(1), that the first squareproduct appears in time [(π/4)(e-γ - o(1))J0(x), (e-γ + o(1))J0(x)],where γ = 0.577... is the Euler-Mascheroni constant, improving both Schroeppeland Pomerance's results. In this article we will prove a weak version of this theorem(though still improving on the results of both Schroeppel and Pomerance).We also confirm the well established belief that, typically, none of the integersin the square product have large prime factors. Our methods provide an appropriate combinatorial framework for studyingthe large prime variations associated with the quadratic sieve and other factoringalgorithms. This allows us to analyze what factorers have discovered in practice.