Why are 2 sides needed for number field sieve for DLOG – crypto.stackexchange.com
Oisin Robinson
When the number field sieve (NFS) is applied to integer factorization, there is a crystal clear reason you need two number fields. We need
$$X^2 \equiv Y^2 \bmod N$$
where e.g.
$$X^2 \equiv ...