The Quadratic Sieve and MPQS

Executive summary

The fastest method for numbers up to about a hundred digits

The quadratic sieve evaluates Q(x) = (x + ⌈√n⌉)² − n over an interval. A prime p divides Q(x) exactly at an arithmetic progression of positions, so the whole interval can be processed by adding log p at those positions — no division at all. The multiple polynomial variation keeps values small by switching polynomials, and large prime variations recover near-misses.

Learning objectives

Explain how sieving replaces trial division for smoothness detection.
Describe why multiple polynomials are needed.
Apply single and double large prime variations.
Choose parameters for a given input size.
Select an appropriate algorithm for the linear algebra stage.

Section 01Sieving

The key observation: p divides Q(x) exactly when x lies in one of two residue classes modulo p, found once by solving a quadratic congruence with Tonelli–Shanks.

AlgorithmThe sieving stepin: n, factor base, interval → out: smooth relations

Choose a factor base of primes p ≤ B with (n/p) = 1.
For each p, compute the two roots of Q(x) ≡ 0 (mod p) once.
Allocate an array over the sieving interval, initialised to zero.
For each p and each root r, add log p to array positions r, r + p, r + 2p, … Additions only — no divisions anywhere.
Positions whose accumulated total is close to log|Q(x)| are smooth candidates.
Trial divide only those candidates to obtain exact exponent vectors.

Why sieving wins

CFRAC trial divides every candidate by the entire factor base and discards nearly all of them. Sieving identifies the smooth ones almost for free and trial divides only those. The asymptotic complexity improves from L[1/2, √2] to L[1/2, 1] as a direct result.

Section 02Multiple polynomials

Values of Q grow linearly with distance from the centre of the interval, so a long interval yields large values that are unlikely to be smooth. MPQS switches to a new polynomial once the values grow too large.

Q_a,b(x) = (ax + b)² − n, b² ≡ n (mod a)

Each polynomial is sieved over a short interval where its values stay small, then a new one is generated. Self-initialising MPQS goes further: choosing a as a product of several factor base primes allows many values of b to be derived cheaply from one a, amortising the setup cost across a whole family of polynomials.

L[1/2, 1]MPQS complexity

≈ 100 digitspractical ceiling

Fully parallelsieving splits across machines

Section 03Large prime variations

Recovering near-misses
Variation	Accepts	Effect
Single large prime	One prime factor above B but below a cutoff	Two relations sharing the same large prime combine into one usable relation
Double large prime	Two such primes	Combination becomes a graph problem — cycles among relations yield usable relations; substantially more productive
Triple large prime	Three	Used in the number field sieve; the cycle-finding becomes the dominant bookkeeping task

Near-misses are abundant

Values that factor completely except for one moderately large prime are far more common than fully smooth values. Exploiting them can improve the relation yield by a large factor, which is why every serious implementation includes at least the single large prime variation.

Section 04Linear algebra

The relation matrix is large and extremely sparse. Ordinary Gaussian elimination causes fill-in and exhausts memory, so sparse iterative methods are used.

Method

Block Lanczos

The standard choice for factoring. Preserves sparsity and works over GF(2) with word-level parallelism.

Method

Block Wiedemann

Distributes better across machines, since the expensive phase can be split. Preferred for the largest computations.

Method

Structured Gaussian elimination

A preprocessing pass that removes singleton columns and merges rows, shrinking the matrix considerably before the iterative solver runs.

Linear algebra does not parallelise like sieving

Sieving is embarrassingly parallel; the matrix step is not. For record computations the matrix stage often becomes the bottleneck, and parameter choices are made partly to keep the matrix manageable rather than to minimise sieving time alone.

ReferenceFrequently asked questions

How is the factor base bound chosen?

By balancing two costs: a larger base makes relations easier to find but requires more of them and enlarges the matrix. The optimum follows from the L-notation analysis and is refined empirically; implementations ship tables of tested parameters by digit level.

When does NFS overtake the quadratic sieve?

Around 100 to 120 digits, though the crossover depends on implementation quality and available hardware. Below it MPQS is simpler and faster; above it the number field sieve's better exponent dominates decisively.

Why sieve with logarithms rather than exact values?

Because adding a small approximate logarithm is one cheap operation, while dividing is not. Approximation is acceptable since the array is only used to identify candidates, and every candidate is confirmed by exact trial division afterwards.

NavigateContinue in this stream

Curated next steps from this page. The site also surfaces algorithmically related reading below.

ProvenanceSources and further reading

This page is an original KEVOS explanatory article. It presents the underlying mathematics — definitions, algorithms, complexity results and selection criteria — in KEVOS editorial voice. No text is reproduced from any copyrighted source. Where numerical tables are relevant, KEVOS links to live authoritative databases rather than republishing static values.

Handbook application: from concept to controlled practice

Purpose. This expanded section turns the original page into a practical handbook. It preserves the supplied material and adds a repeatable way to apply, check and review The Quadratic Sieve and MPQS. It does not replace a contract, legislation, a controlled standard, competent engineering judgement or specialist advice.

The operating aim is to turn a compact mathematical statement into a usable chain of definitions, claims, examples and checks. Read the original explanation first, then use the workflow and checks below to convert knowledge into evidence.

Treat The Quadratic Sieve and MPQS as a network of definitions and implications, not as a list of formulas. The working vocabulary on this page—section, quadratic, sieve, sieving, mpqs—should be made explicit before any proof or computation begins. Record the ambient set or structure, the permitted operations and the equality or equivalence relation in use. A compact theorem often changes meaning when the base field, finiteness condition, commutativity assumption or direction of an action changes.

For a proof, write the hypotheses as a checklist and mark the line at which each one is used. For a computation, state the representation of the input, the arithmetic model, the termination condition and the output invariant. For a classification problem, distinguish existence from uniqueness and distinguish an object from its representation. These separations prevent a correct local calculation from being mistaken for the general result.

A useful worked example should be small enough to inspect completely but rich enough to exercise the main mechanism. Compute the result in two ways where practical: symbolically and by substitution, structurally and numerically, or directly and through a normal form. Then include one near-miss example in which a hypothesis fails. The contrast explains why the theorem is shaped as it is and gives the reader a diagnostic pattern for later problems.

Verification is part of the mathematics. Check domains and codomains, substitute proposed solutions, test identity and zero cases, compare dimensions or cardinalities, and confirm that maps respect the required operations. In numerical work, report precision, conditioning and a residual rather than digits alone. In algorithmic work, separate mathematical correctness from implementation complexity and resource limits.

Step-by-step operating method

Fix the setting. State the objects, ambient structure, notation and assumptions before manipulating symbols.
Separate claims. Distinguish definitions, hypotheses, conclusions, equivalent conditions and consequences.
Choose a method. Select proof, construction, calculation or algorithm according to the question actually asked.
Work a small case. Use the smallest non-trivial example to expose the mechanism and test edge behaviour.
Verify independently. Substitute back, check invariants, test boundary cases or use an alternative derivation.

Worked-example protocol

Illustrative method—not a source theorem. Start with a small admissible input and list the definitions it must satisfy. Carry out each transformation on a separate line, citing the property that permits it. Preserve exact values until approximation is necessary. At the end, verify the output against the original definition and one invariant such as dimension, degree, determinant, order, norm or residual. Then alter one hypothesis and observe which step ceases to be valid. This protocol creates a reusable example without inventing a theorem-specific numerical answer.

Stage	Record	Quality check
Input	Objects, domain, notation, assumptions	Every symbol is defined
Method	Permitted operation or cited result at each step	All hypotheses hold
Output	Exact result and representation	Correct type, domain and form
Verification	Substitution, invariant or alternative derivation	Independent agreement
Boundary test	Zero, identity, degenerate or failed hypothesis	Scope is understood

Common failure modes and recovery actions

1. Watch for

Using a theorem without checking every hypothesis.

Recovery: Return to the governing definition or requirement and restate the decision in one sentence.

2. Watch for

Treating a suggestive example as a proof of the general case.

Recovery: Separate evidence from assumption, assign an owner and set a date for validation.

3. Watch for

Changing notation or conventions part-way through an argument.

Recovery: Run a small counterexample, boundary test, pilot or independent check before proceeding.

4. Watch for

Hiding a division-by-zero, convergence, finiteness or commutativity assumption.

Recovery: Record the consequence, decision and rationale, then update the controlled baseline.

5. Watch for

Reporting a computed result without a residual, substitution or structural check.

Recovery: Escalate when the issue affects safety, compliance, acceptance, material value or an agreed tolerance.

Review checklist

Can every symbol be traced to a definition or prior result?
Which hypothesis does each major step use?
Does the method cover zero, identity, degenerate and boundary cases?
Can the conclusion be checked by a second representation or calculation?
Are mandatory requirements distinguished from recommendations and illustrative values?
Are sources, assumptions, units, dates and versions recorded closely enough to reproduce the decision?
Have safety, legal, ethical, stakeholder and operational consequences been considered at the appropriate level?
Is there a named owner and a trigger for review, escalation, change or retirement?

Questions for deeper application

What is the most important distinction a practitioner must preserve when applying The Quadratic Sieve and MPQS?