O10 — Factoring from roots modulo a composite

Definitions and mathematical statement

For $n\ge2$, let $\varphi(n)=|(\mathbb Z/n\mathbb Z)^\times|$, where the superscript denotes the invertible residue classes. A valid root-extraction input consists of positive integers $(n,e,a)$ with $\gcd(e,\varphi(n))=1$ and $\gcd(a,n)=1$. Exponentiation $x\mapsto x^e$ is then a permutation of this finite group. Define an oracle $\mathcal R$ to return its unique inverse image $x\in\{0,\ldots,n-1\}$ satisfying $x^e\equiv a\pmod n$.

Is complete factorization of arbitrary positive integers reducible to $\mathcal R$ in classical randomized polynomial time? Namely, can a uniform probabilistic oracle algorithm, on each binary input $N\ge2$, produce all prime factors and their exponents with probability at least $2/3$, using polynomially many bit operations and oracle queries of polynomial binary length? The modulus in a query need not equal $N$, and queries may depend on previous answers.

The promise on $e$ is essential: extracting arbitrary square roots with multiple possible answers is a different oracle problem. No factorization of $n$, value of $\varphi(n)$, or secret inverse exponent is supplied with an oracle answer. Oracle calls are charged unit cost together with the ordinary cost of writing and reading their encodings. Outside the promise, replies are arbitrary and may never arrive; the reduction must tolerate this and may interleave subroutine calls.

Short English statement

Can arbitrary integers be factored efficiently with randomized access to unique modular root extraction?

Sources

• S1 ULAM.AI and the UnsolvedMath Contributors, supplied problems.json, record 8400011 (AMR-083-0011), AMR Open Problem Lists. Catalogue identity and source transcription; CC BY 4.0. https://huggingface.co/datasets/ulamai/UnsolvedMath.
• S2 Adleman & McCurley - Open Problems in Number Theory Complexity II (1994), O10, p10 / LNCS p300. Original source indexed by AMR-083-0011. https://mccurley.org/papers/open.ps.gz.