rast, for N = 93 (next to last point at right in Fig. 20.7) these conditions are not met for 1/3 of all the possible r values, which explains the drop from the global trend. Given an eligible r, and independently of N, the second "luck" factor comes from the number of associated convergents, as measured by the probability pli. For instance, r = 2 has no associated convergent, r = 4 has only one convergent with probabil- ity P2 (i) = 1/4 = 25%, r = 10 has 6 convergents with probability pli = 6/10=60%, and r = 28 has 24 convergents with probabilitypli = 24/28 = 85.7%. The product P1 P2 , thus, determines the weight taken by a given period r out of the possibili- ties indexed by i in the sum in Eq. (20.35) yielding n(N). For N < 100, Fig. 20.7 shows that the maximum is found at N = 85 with n(85) = 41.4%. The logarithmic fit shown in the figure (y = 0.14 ln X - 0.306) suggests that a probability of II = 50% would be reached for x = 316, in the vicinity of the composites N = 319 = 11 X 29 and N = 323 = 17 X 19. As I am not aware that any plot similar to that shown in Fig. 20.7 has ever been published. It remains a reasonable conjecture that for com- posites larger than N = 100, II(N) asymptotically reaches 100%, with some scatter due to the aforementioned effects, with the contribution of p2 (i) becoming negligi- ble as N increases, as S, r in the phase estimate Q = s/r become more likely to be co-prime. Shor's factorization algorithm Public-key cryptography This concluding section is about public-key cryptography (PKC). Such a topic is not completely out of place in this chapter on Shor's factorization algorithm because, as I shall describe, the secrecy involved in PKC heavily relies on the fact that factoriz- ing large numbers is a task that is essentially intractable, which is true according to the best computing means and algorithms currently available. Since PKC is widely used for different applications in the Internet, and since its principle is relatively sim- ple to understand, it is worthwhile to describe it 