Batch NFS

This paper shows, assuming standard heuristics regarding the number-field sieve, that a “batch NFS” circuit of area L factors L separate B-bit RSA keys in time L. Here L = exp((log 2)(log log 2)). The circuit’s area-time product (priceperformance ratio) is just L per key. For comparison, the best area-time product known for a single key is L. This paper also introduces new “early-abort” heuristics implying that “early-abort ECM” improves the performance of batch NFS by a superpolynomial factor, specifically exp((c + o(1))(log 2)(log log 2)) where c is a positive constant.