smooth at the same time. The current best-known approach for this search is lattice sieving ; to get acceptable yields, it is necessary to use a large factor base. Having enough such pairs, using Gaussian elimination , one can get products of certain r and of the corresponding s to be squares at the same time. A slightly stronger condition is needed—that they are norms of squares in our number fields, but that condition can be achieved by this method too. Each r is a norm of a − r 1 b and hence that the product of the corresponding factors a − r 1 b is a square in Z [ r 1 ], with a "square root" which can be determined (as a product of known factors in Z [ r 1 ])—it will typically be represented as an irrational algebraic number . Similarly, the product of the factors a − r 2 b is a square in Z [ r 2 ], with a "square root" which also can be computed. It should be remarked that the use of Gaussian elimination does not give the optimal run time of the algorithm. Instead, sparse matrix solving algorithms such as Block Lanczos or Block Wiedemann are used. Since m is a root of both f and g mod n , there are homomorphisms from the rings Z [ r 1 ] and Z [ r 2 ] to the ring Z/nZ (the integers mod n ), which map r