x <i!€PRgE<RPRaW&gt

)+*,.-0/1324*654-708:9

;=<?>@!"!BAC&ED ACFEGH&IEGH&J(D KMLENJ>'L$'(GO&'IEGO&(

P (P,V)OS ^Q

PRTSU6NWVXY[Z6UE ]\

Q

U^! P`_baW>@! PRUcP`!

N =pq^D

s= (s1, . . . , st)∈R(Z^∗N)^tD v= (s²1^k, . . . , s²_t^k)GdP`#Z6fe>'N#:VXa^"PRgE!%hEGiAG

jcklnmdo6p4qsrbt u #P`N'vPRU

(P,V)OS

L#U6w'! PRNU

P ^{x U Q} V ^y z=#PR<`.>W{PR>'<

kt+k

|

PR~}P`!"!€<

t+2

2 k^{ } x} <i!€PRgE<RPRaW>@! PRUE#Ud‚ƒ

x > Q P`#

x

U6N#UPRU

Z_N^G

„†…ˆ‡‰ q …ˆŠ'‹ŒP

ei = Pk i=1

ei,j2^{j−1D Q} >'U6ULNPRU6UJ!

P ŽY[Z6 Pi! !0hPi! Qt

i=1s^e_i^i,kG

jcklnmdo6p4q‘t“’ #0;”! •6N'#

P˜ ^–#x (P,V)OS

Zb>'LT—3X˜™<RN'"z]#G

ε≥2^−kt+1G

u #PRN'Bš3"gGdhEGiAGiAADde>@#NXVXŽaŽ"PRgE!%hG`AGiv

—4]NPRL!#P`U6#Ug6 'LGbKM<`N6G

AL : (P,v, N)7→(X, Y, l) ^P`!

Y^2k =X^2k+l, X, Y ∈Z^∗N, Y =Y(v), X =X(s), 0≤l < k ^{x U Q} Ew|AL|=O(|P˜|/ε)^G

jcklnmdo6p4q‘›œt !

–

–#x X, Y ^{ž 'UK x} ˜™NJ>'LT$v

Z :=Y^2k−l−1/X^2k−1G

#P i PRU6P`Ÿ>'<P`!

Z²ⁱ = 1, 0≤i≤l+ 1^{G u #PRN'˜™•6} 2^k|p−1^v

K x

˜™N6GdhGb ¡•6

i≤1 NPR<i!.NN'¢

(Z ±1, N) ={p, q} ^P`!.£¤ ≥ ¹₂ ^G

K x

˜™N6Gb¥EGb ¡•6

i≥2 NPR<i!.P`~ d>'<R<

Z²ⁱ⁻¹ 6=−1 ^{Q >'} ggT(Z²ⁱ⁻¹ ±1, N) ={p, q}^G

£¦PR

–

# <`#N'!]>'U

N PR§ d>'<R<

Z²ⁱ⁻¹ =−1 ^¨

©ª¬«b­”®¯ªR°¯v ’ PR±—4X˜™<RNXz]#G

ε ^{L –} P`#ZJ!² P`Y[Z¦>

x ˜

–#x

˜:G

s x U Q¦Q

U³}•6U

– z x

"˜

ž

U

(P,V)OS

GJ}>'U´a'U6X!€

x

PR"!4U6"z=

Q

3"![>W!µG

x

U6>'L6ZGƒ

x > Q

€>W!¶zBG

ž

U −1 modN

Q

]# UEPR

Q

PRN@!

i z]PR·PR~e>'#N'#XV:a^ P`gE!µG