🚀 go-pugleaf

In article <1992Aug22.113206.4385@linus.mitre.org> bs@gauss.mitre.org (Robert D. Silverman) writes:
> I presented the results of quite a few benchmarks for the
> sieving phase of GNFS on general numbers ranging from 30 to 90 digits.

And you try to extrapolate by 45 digits from your highly suboptimal
polynomial choices. You didn't even take Pollard's lattice sieve into
account.

I defy you to make a statement of the form ``GNFS will use more than G
MIPS-years to factor RSA-129, while MPQS will take under M MIPS-years to
factor RSA-129, and G > M,'' rather than hiding behind loose comparisons
such as ``I estimate the crossover point to be around 135 digits.''
Either make a definite statement so that I can demonstrate by actual
experiments that you're wrong, or admit that you can't accurately
estimate the time taken by GNFS.

> Dan's labelling of detractors as 'pretending' is both insulting
> and unprofessional.

I don't think so. Your estimates of GNFS's speed have no more validity
than Adleman's ridiculous estimates a year ago. They are based on
wishful thinking (such as your incorrect estimate of coefficient digits
for a 145-digit number on sci.crypt a few weeks ago) as well as neglect
of existing algorithmic improvements (such as the special-q method).

It was irresponsible of Adleman to state that it wasn't clear whether
GNFS would be faster than MPQS for 330-digit numbers. It is just as
irresponsible of you to claim a 135-digit crossover point. It is neither
insulting nor unprofessional for me to demand that you make your
estimates of GNFS speed sufficiently detailed that I can prove them
false.

> But he still lacks data on QS. Lenstra and Manasse have
> done a few dozen numbers with QS. I've done in excess of 500.

I can't speak for either Arjen Lenstra or Mark Manasse, but it seems to
me that a few dozen numbers ranging up to 116 digits have far more
relevance to 129-digit factorizations than several hundred wimpy
numbers.

---Dan