Generating Random Factored Gaussian Integers, Easily

Transcription

1 Generating Random Factored Gaussian Integers, Easily Noah Lebowitz-Lockard Advisor: Carl Pomerance June 6, 03 Abstract We introduce an algorithm to generate a random Gaussian integer with the uniform distribution among those with norm at most N, along with its rime factorization Then, we show that the algorithm runs in olynomial time The hard art of this algorithm is determining a norm at random with a secific distribution After that, finding the actual Gaussian integer is easy We also consider the analogous roblem for Eisenstein integers and quadratic integer rings

2 Generating Random Factored Numbers, Easily Consider the following roblem: Given a ositive integer N, generatearandomintegerlessthanorequalton with uniform distribution, along with its factorization in olynomial time (In this context, olynomial time refers to a olynomial in the number of digits of N, not the size of N So,the running time of our algorithm should be O(log k N), for some real k) At first glance, this seems very simle Simly choose a random integer in the range [,N] and factor it However, there are no known olynomial time factorization algorithms But, the roblem does not exlicitly state that we need to factor anything We need a random factored number, not a method to factor random numbers In 988, Eric Bach resented an algorithm without any factorizations at all in his aer How to Generate Random Factored Numbers [] Bach s algorithm requires O(log N) rimality tests In 003, Adam Kalai resented another algorithm in his Generating Random Factored Numbers, Easily, which used O(log N)rimalitytests[] ThoughKalai s algorithm is slower, it is also easier to understand and we shall send the rest of the aer discussing modifications of it Also note that though we will not factor any numbers, every one of the algorithms resented in this aer will erform rimality tests, which we can run in olynomial time The two olynomial time rimality algorithms are the Miller-Rabin Test and the Agrawal-Kayal- Saxena (AKS) Algorithm A rogrammer running the algorithms in this aer should use either of the two rimality tests just mentioned Because Kalai s algorithm requires O(log N) rimality tests, using Miller-Rabin or AKS enables the algorithm to run in olynomial time Either of these algorithms could be used as a subroutine within the rogram Strictly seaking, the Miller-Rabin Test can only check comositeness Running Miller- Rabin once will either tell you that a given number is comosite or the test will be inconclusive If you run the test many times, and it is consistently inconclusive, then the given number is almost certainly rime By running the test many times, we can be arbitrarily accurate, ie the robability of error is less than for a given ositive real For a given function f, wedefineõ(f) aso(f logk f), where k is some ositive real number Note that log k f grows much more slowly than f Running the Miller-Rabin Test on N once has a running time of Õ(log N) assuming we erform multilications using a Fast Fourier Transform [] If the Generalized Riemann Hyothesis is true, then the Miller- Rabin Test becomes deterministic after running it O(log N)times Inthisscenario,we could determine whether or not a given integer is rime in Õ(log4 N)time[8] AKS will tell you whether a given number is rime or comosite with erfect accuracy, but it is significantly slower AKS runs in Õ(log5/ N) time [] Secifically, AKS runs in O((log N) 5/ ( + log log N) c )forsomeconstantc H W Lenstra and Carl Pomerance recently found a faster deterministic algorithm that runs in time O((log N) 6 ( + log log N) c ) [9] If erfect accuracy is required, then we suggest Lenstra and Pomerance s algorithm If you can settle for very good accuracy, then we suggest Miller-Rabin

3 Kalai s Algorithm Here is the algorithm from Adam Kalai s Generating Random Factored Numbers, Easily [7] Algorithm Given a ositive integer N, this algorithm roduces a random ositive integer r ale N, along with its factorization, with uniform distribution Create a list of integers s s s k, where s is chosen uniformly at random in [,N] and if s i has been chosen and s i >, then s i+ is chosen uniformly at random in [,s i ] Call this list S The rocedure terminates when is chosen When the rocedure terminates, go to Ste Let r be the roduct of the rime elements of S 3 If r>n, return to Ste Otherwise, outut r, along with its rime factorization, with robability r/n If you did not outut r, return to Ste For examle, let N 00 The algorithm might generate the list [98, 4, 38, 3, 3, ] When we multily the rime elements of the list, we obtain 369, so we would create a new list We might obtain [70, 5, 5,, ], in which case we would outut 50 with robability 05 We have to rove two facts about this algorithm The algorithm generates each r ale N with robability /N The algorithm exects to use O(log N)rimalitytests How do we determine the robability of obtaining r? Consider the following generalized rime factorization of r: r Y alen (Throughout this aer, will always be a rime) For any ale N, is the highest ower of that is a factor of r Note that in our definition, 0if is not a factor of r Inanormalrimefactorization,wewouldsimly ignore any rime that is not a factor of r, but in this case, we must include all rimes less than or equal to N In order for our algorithm to outut r, thelistmustcontainexactly coies of for each ale N But,whatistherobabilitythatthelistcontains coies of? Suosewe have not yet finished our list and every element of the list so far is greater than or equal to Then, itisstillossibletoaddacoyof to the list The conditional robability of choosing given that you are choosing some number in [,]is/ The conditional robability of adding a number smaller than is (/) The robability that the list contains n coies of is equal to the robability of adding one coy of ntimes in a row, then adding a number less than, namely, P (n coies of ) n 3

4 Let P (r) be the robability that the roduct of the rimes in a list is equal to r Inother words, P (r) istherobabilityofoututtingr if we ran Kalai s algorithm without Ste 3 We can use the equation above to determine the initial robability that we obtain r: P (r) Y alen P ( coies of ) Y alen Y alen Y alen Notice that the roduct of / for all ale N is equal to /r Also note that the roduct of (/) isafunctionofn and not r WecandefineM N as this roduct: M N Y alen We can exress the roduct of obtaining r at the end of Ste more succinctly as P (r) M N r Here, r is any ositive integer suorted on the rimes in [,N] Ste 3 states that if r ale N, then we should outut r with robability r/n Otherwise, we should not outut r at all P (r) isequaltop (r) timestheconditionalrobabilitythatthealgorithmoututsr given that it is the roduct of the rimes in the list Here is the actual robability that we outut r: P (r) P (r) r N M N r r N M N N Note that the robability that we outut r does not actually deend on the value of r, as long as r ale N Thus,Kalai salgorithmoututseverynumberlessthanorequalton with a uniform distribution Now, we have to rove that Kalai s algorithm requires an average of O(log N)rimality tests We will do this by showing that the algorithm roduces an average of O(log N) lists and by showing that the average list has O(log N) distinctelements We have just shown that the robability of the algorithm roducing a list and oututting r is M N /N There are N ossible numbers that we can outut The robability that the algorithm terminates is equal to N(M N /N ), or M N Therefore,theexectednumberoflists we have to roduce is M N InordertoestimateM N,weintroduceMertens TwoTheorems Our roofs of them come from [0] The value of comes from [6] Definition For any ositive real number x, A(x) alex log Theorem For any real x, A(x) logx + O() 4

5 If there were only finitely many rimes, then the sum of (log )/ for all rime ale x would be bounded above by some constant C But, log x diverges Therefore, Theorem rovides an alternate roof for the infinitude of the rimes Theorem (Mertens First Theorem) As N aroaches infinity, the sum of the recirocals of the rimes that are less than or equal to N becomes asymtotic to log log N Proof In order to take the sum of / for all ale N, wewillslititintotwosearatesums: log log + log log log N log log N alen alen alen alen Theorem makes the first sum easy to handle: log N alen log A(N) log N +O log N The second sum is more di cult It aears as though we should be able to write it in terms of A(N), but it is di cult to see how We can rewrite the argument by de-telescoing it, ie writing it as a sum of terms that contract: log N log N log n n log(n +) Therefore, alen log log log log N alen N n log n log(n +) We can switch the sums around Instead, we are taking the sum of (/ log n) ( log(n+)) for all ale n and all n from to N : alen log log log N N n N n A(n) log n log n log log(n +) alen log(n +) Observe that / log t, likealldi erentiablefunctions,istheintegralofitsownderivative: N n A(n) log n N log(n +) n Z n+ A(n) n t log t dt 5

6 For any t in the half-oen interval [n, n +), A(t) A(n) becausearimemustbeall rimes are integers Every rime that is less than or equal to t is also less than or equal to n Therefore,A(t) isaconstantovertheinterval[n, n + ], allowing us to move A(n) inside the integral: N n Z n+ A(n) n t log t dt N n Z n+ n Z A(t) N t log t dt A(t) t log t dt Once again, we break our exression into a sum and ut asymtotic estimates on both of its comonents: Z N Z A(t) N Z t log t dt N t log t dt + A(t) log t t log dt t For the first integral, Z N dt loglogn log log t log t Theorem states that A(t) logt + O() Therefore, A(t) some ositive constant C Hence, Z N Z A(t) log t N t log dt ale C t t log t dt C log Putting all of this together gives us our result: alen loglogn + O() log t is bounded above by O() log N Theorem 3 (Mertens Second Theorem) Let 0577 be the Euler-Mascheroni Constant Then, lim M N log N e N! Proof Let x be a real number with absolute value less than The Taylor Exansion of log( + x) is x x + x3 3 + ( x) k k Let x k / for some rime Makingthissubstitutiongivesus log + + k k k We can also searate out the first term and ut the other terms into a searate sum Ultimately, we will rove that for su ciently large rimes, onlythefirsttermreallya ects 6

7 our roof This makes sense on an intuitive level As aroaches infinity, / becomes meaningless next to / Wehave log k k At this oint, we take the logarithm of M N in order to use this result log M N log Y log alen alen alen alen k k k k Mertens First Theorem states that the sum of / for all ale N is asymtotic to log log N We will rove that the other sum in the equation above is on a smaller order and may be ignored For any rime, Therefore, k k < k k k alen k k k k < alen k ( ) ale < n We can rove that the sum of the recirocals of the squares converges Note that the number m is equal to the integral of m over an interval of unit length That allows us to ut the integral into the last art of the equation: n n + n (n +) + n n (n +) + n Z n+ n (n +) dx Observe that for any real x in the interval [n, n +], /x > /(n +) Therefore, the integral of /x on the range [n, n +] is greater than the integral of /(n +) Wecanuse this fact to set an integral as the uer bound for our sum: n n + n Z n+ n (n +) dx < + n Z n+ n dx + x Z n dx x (To be exact, the sum of the recirocals of the squares is /6, but that is beyond the scoe of this aer) To summarize, we have two di erent limits: alen log log N, alen k k k O() Therefore, lim N! log M N log log N 7

8 We raise e to both sides in order to obtain an asymtotic limit for M N : lim M N e log log N + O() O(log N) N! In the equation above, C is some constant Though we will not rove it here, C e Though it is di cult to rove, one could verify the value of C by calculating M N and log N for very large values of N From this oint onward, whenever we refer to Mertens Theorem, we will be referring to his second theorem We exect to create M N lists As N aroaches infinity, the ratio between M N is asymtotic to e log N Hence, M N O(log N) and Kalai s algorithm creates an average of O(log N) listsbut,howmanydistinctelementsdoesalistcontain?letn be an integer that is less than or equal to N The robability that the list contains at least one coy of n is /n If the list contains a coy of n, thenwemustcheckifn is rime exactly once Otherwise, we do not have to check whether or not n is rime The exected number of times the algorithm checks if n is rime when rocessing a given list is /n Byadditivity of exectation, the exected number of rimality tests required for a given list is N N We can write both an uer and lower bound for this sum Consider the integral of (/x)dx as x goes from to N Wecanslitthisintegralintoasumofsmallerintegralsasfollows: Z N N x dx n Z n+ n n n x dx The minimum value of /x on the interval [n, n +]is/(n +) Thelengthoftheinterval [n, n + ] is Thus, N n Z n+ n N x dx > n N n Adding to both sides gives us a useful inequality: N < + Z N dx +logn x The maximum value of /x on the interval [n, n +]is/n, sothat log N Z N N x dx n Z n+ n N x dx < n N n < n n N 8

9 We can now write both an uer and lower bound for our sum We have Our takeaway is that log N< N n N n n n < +logn O(log N) Thus, the exected number of rimality tests the algorithm erforms for a given list is O(log N) Since we ve seen that the exected number of lists is O(log N), Kalai s algorithm does an average of O(log N)rimalitytests 3 The Gaussian Problem Our new goal is to generate a random Gaussian integer with norm less than or equal to given integer N, alongwithitsfactorizationintogaussianrimes Fromhereon,N(z) willbethe norm of the comlex number z Ourlanofattackwillbeasfollows: Find a formula for G(r), the number of Gaussian integers in the first quadrant with a given norm r Modify Kalai s Algorithm so that the robability of oututting a given r is roortional to G(r) 3 For a given r, along with its factorization into rational rimes, roduce a random Gaussian integer with norm r, alongwithitsfactorizationintogaussianrimes The Gaussian integers have four units, unlike the rational integers, which have Throughout this section, we will only be concerned the outcome u to a unit For simlicity, we may assume that the Gaussian rimes we generate are all in the first quadrant If not, we multily them by a ower of i and then they will be However, this means that for a given outut z, we cannot obtain iz, z, or iz Torectifythis,thereadermayinsertaSte4attheendof the algorithm Ste 4 multilies the Gaussian integer that the algorithm was just oututted by i k,wherek is a random integer in the range [0, 4] Units will not seriously concern us in this section In order to find a formula, we will introduce the function D and then rove that G is identical to D We will do this by showing that G and D both ossess a certain set of roerties, then roving that any two functions that ossess all of these roerties are identical In order to define D, wemustdefineafewotherfunctionsfirst Definition The divisor function d gives the number of ositive divisors of a given integer 9

10 Definition Let r be a ositive integer with the rime factorization used in the theorem above Let r be the largest factor of r which only contains rimes that are congruent to mod 4 Let r 3 be the largest factor of r which only contains rimes that are congruent to 3 mod 4 Note that with this notation, there exists some nonnegative integer k such that r k r r 3 Definition Let r be a ositive integer Let D(r) bethefollowingfunction: d(r ) r D(r) 3 is a square, 0 otherwise At this oint, we shall define a new roerty of functions and rove that d, D, andg all have this roerty Definition Afunctionf : N! R is multilicative if f(mn) f(m)f(n) forallrelatively rime m, n Theorem 4 Let r be a ositive integer with rime factorization e em m Then, d(r) (e +)(e m +) Proof Let r 0 be a factor of r Any rime factor of r 0 must also be a rime factor of r The exonent of i in r 0 can be any number that is less than or equal to e i In other words, r 0 f fm m,whereeachf i is an integer in the range [0,e i ] There are e i +ossibilities for each f i Therefore,thereare(e +)(e m +)factorsofr Theorem 5 The function d is multilicative Proof Let a e en n and b q f qm fm be two relatively rime integers Then, we can determine d(ab) d(a)d(b) It is easy to write out d(a)d(b): d(a)d(b) (e +)(e n +)(f +)(f m +) Because a and b are relatively rime, there do not exist integers i and j such that i q j This makes writing ab esecially easy: We then aly the divisor function to ab: Hence, d is multilicative ab e en n q f q fm m d(ab) (e +)(e n +)(f +)(f m +)d(a)d(b) Theorem 6 The function D is multilicative 0

11 Proof Once again, let a e en n and b q f q fm m Suosea 3 and b 3 are both squares Then, a 3 b 3 is a square hence, D(ab) d(a b )d(a )d(b )D(a)D(b) Suose either a 3 or b 3 is not a square Then, a 3 b 3 is not a square Hence, (ab) 3 is not a square So, D(ab) 0D(a)D(b) Thus, D is multilicative To rove that G is multilicative, we need a few results Definition AGaussianrimeis a Gaussian integer z such that if z ab, wherea and b are Gaussian integers, then either a or b is a unit The fact that we can factor Gaussian integers comes from the following theorem: Theorem 7 (Fundamental Theorem of Gaussian Integers) [] The exression of an integer as a roduct of rimes is unique, aart from the order of the rimes, the resence of unities, and ambiguities between associated rimes At this oint, we will resent an outline of the roof of the Fundamental Theorem Definition [5] Let R be a commutative ring The subset I of R is an ideal if I is a grou under addition and for any a I and r R, ar is an element of I Definition An element a of R is irreducible if it is not a unit and its only divisors are and itself u to a unit It may seem as though we have just defined a rime, but in fact, for the Gaussian integers, the two concets are one and the same Definition An element R is rime if for any a, b R such that ab, either a or b Definition AringR is a unique factorization domain if for every r R, there is a unique way of writing r as the roduct of irreducible elements, u to a change in units Definition AringR is a rincial ideal domain if for every ideal I R, there exists some element r R such that I {rx x R} Definition AringR is a Euclidean domain if there exists a function satisfies the following two roerties: : R! N that For any a, b R\{0}, (ab) (a) (b) For any a, b R with b 6 0,thereexistq, r R such that (r) < (b)orbotha bq+r and (r) < (b) The Euclidean algorithm is an e cient method for finding the greatest common divisor of two numbers When a ring is a Euclidean domain, it means that the Euclidean algorithm alies to the ring Therefore, we can define an analogous notion of a gcd for the Gaussian integers Theorem 8 Primes and irreducibles are identical in a unique factorization domain

12 Theorem 9 Every Euclidean domain is a rincial ideal domain The reason that this theorem is true is that the gcd of all the elements of an ideal must be contained in the ideal Every element of the ideal must be a multile of that element Alternately, every multile of the element must be contained in the ideal Theorem 0 Every rincial ideal domain is a unique factorization domain Theorem The Gaussian integers form a Euclidean domain Putting all these theorems and definitions together roves the Fundamental Theorem of Gaussian Integers Because the Gaussian integers from a Euclidean domain, they must form arincialidealdomainandauniquefactorizationdomain Theorem G is multilicative Proof For a given integer n, letg n be the set of all Gaussian integers with norm n By definition, G(n)isthesizeofG n Letaand b be two relatively rime integers We shall rove that G(ab) G(a)G(b) bycreatingabijectionfromg a G b to G ab Define the function f : G a G b! G ab as f(x, y) xy To rove that f is a bijection, we must show that it is injective and surjective Suose f(x, y) f(x 0,y 0 )forsomex,x G a and y,y G b Then, x y x y So, x y and x y have the same factorization into Gaussian rimes Let z be a Gaussian rime that divides x y Ifthenormofzdivides a, thenz must divide both x and x,butnoty and y Otherwise, the norm of z divides b and z divides y and y,butnotx and x It is imossible for z to divide both a and b because a and b are relatively rime Therefore, x and x are comosed of the exact same Gaussian rimes, imlying that (x,x )(y,y ) Every element of G ab has at most one inverse Therefore, f is injective Now, we must rove that f is surjective Let w G ab Bydefinition,N(w) ab Let be a rime factor of ab where n is the largest ower of that divides ab There exists some Gaussian integer with norm n that divides w Either n divides a or n divides b Let w be the roduct of the Gaussian integers with norm n that divide a and w be the roduct of the Gaussian integers with norm n that divide b Then,w has norm a and w has norm b Also, w w w All this imlies that f(w,w )w and f is surjective Hence, f is bijective and G(ab) G(a)G(b) By definition, G is multilicative At this oint, we will determine G( n )where is a rime and n is a ositive integer First, we shall introduce the notion of a quadratic residue Definition Let be an odd rime and a be an integer that is not a multile of Wesay that a is a quadratic residue mod if the equation x a mod has a solution Otherwise, a is a quadratic non-residue Toexressthequadraticresiduescomactly,weuseaLegendre symbol: a a is a quadratic residue mod, a is a quadratic non-residue mod

13 The Legendre symbol can be easily calculated for secific values of a and with a congruence Theorem 3 (Euler s Criterion) [4] Let be an odd rime Then, a a mod For this section, we will only need to know whether or not isaquadraticresiduefor agivenrime ThiscanbeeasilysolvedwiththefollowingtheoremanditscorollaryIn Section 0, we will use other values of a Corollary Let be an odd rime Then, mod 4 is a quadratic residue mod if and only if Proof Let mod4 Then, isamultileof4 Therefore,( )/ isevenand ( ) By the theorem above, isaquadraticresidue Suose 3mod4 Then, mod4and( )/ is odd Hence, ( ) By the theorem above, isaquadraticnon-residue In order to address Point, we shall rove the following theorem, which determines the number of Gaussian integers with norm, where is a rime We treat two Gaussian integers as equal if one divided by the other is a ower of i Inotherwords,youcouldtransformone Gaussian integer into the other simly by rotating it with a series of right angles Later in this section, we will introduce an algorithm for finding solutions to x a mod in the case where such a solution exists Theorem 4 A Gaussian rime in the first quadrant ossesses exactly one of the following three roerties: The Gaussian integer is equal to +i It is equal to, where is a rime that is congruent to 3mod4 3 Its norm is, where is a rime that is congruent to mod4 Proof +i has norm Any factor of + i must have norm or But, + i is the only Gaussian integer in the first quadrant Therefore, + i is a Gaussian rime Let be a a rime that is congruent to 3 mod 4 We can rove that the only Gaussian factors of are and Let a + bi be a Gaussian rime with norm Then, a + b, which is imossible because the sum of two squares cannot be congruent to 3 mod 4 There are no Gaussian rimes with norm is a Gaussian rime Let be a rime that is congruent to mod 4 We already roved that isaquadratic residue of Therefore,thereexistssomeositiveintegerx<such that x mod Let z be the gcd of x + i and Thenormofx + i is a multile of, butnot,whilethe norm of is Thenormofzmust be the gcd of x + i and,whichis So, has some roer Gaussian rime factor, namely z 3

14 Theorem 5 For a rime, we have 8 < mod4, G() 0 3mod4, : Proof It is easy to see why this theorem is true for and 3mod4 The only Gaussian integers with norm have the form ± ± i However, all of these numbers are considered the same because the quotient of any air of them is a ower of i Thus,G() Let 3mod4Suosea + bi has norm Then, a + b Hence, a + b Every square is equivalent to 0 or mod 4 So, a + b is 0,, or mod 4 But, 3mod4 Hence, a + b has no solutions If 3mod4,thenG() 0 Finally, suose mod4 Onceagain,suosea + bi has norm and a + b The Corollary states that isaquadraticresiduemod There exists some solution to the equation x mod Therefore,x +isamultileof Thereexistssomeinteger k such that x +k Wecanfactorx +inthegaussianintegers: x +(x + i)(x i) Thus, (x + i)(x i) isamultileof But, cannot divide either x + i or x i because their imaginary comonents are ±, which is not a multile of Bothx + i and x i share a common factor with, thatisnot itself To find this common factor, simly calculate gcd(x + i, ) Suose z is a Gaussian integer that is not a unit that divides, butisnot amultileof Then, z is a roer divisor of The only ossibilities are z and z Because z is not a unit, z 6 Thus, z Let a + bi z Then, a + bi is a Gaussian integer with norm As an examle of the construction in the roof above, consider 4 Thereexistsome a, b Z + such that a + b because mod4onesolutiontox + 0mod4is x 9 So,wewanttofindthegcdof9+i and 4 Just as in Z, wemayusetheeuclidean Algorithm: gcd(9 + i, 4) gcd(9 + i, 4 4(9 + i)) gcd(9 + i, 5 4i) Note that 5 4i divides 9 + i Secifically, 9 + i (5+4i)( + i) Hence, the gcd of 9 + i and 5 4i is 5 4i Hence, 5 4i is our Gaussian integer of norm 4 We confirm this fact by noting that Now that we know G(), we can find G( n ) Theorem 6 For any rime and ositive integer n: 8 < ( + ( ) n )/ 3mod4, G( n ) n + mod4, : 4

15 Proof Let mod4andletz be a Gaussian integer with norm n Then,z is the roduct of n Gaussian integers with norm But,thereareexactlytwoGaussianintegerwithnorm, utoaunit Thesetwointegershavetheformsa + bi and a bi, forsomea, b Z + Therefore, z (a + bi) m (a bi) n m,wherem is a nonnegative integer Thus, m can range from 0 to n So,therearen +ossibilitiesforz Let andletz be a Gaussian integer with norm n Then, z is the roduct of n Gaussian integers with norm However, + i is the only Gaussian integer with norm Hence, z (+i) n,imlyingthatz is unique Let 3andletz be a Gaussian integer with norm n Once again, z is the roduct of n Gaussian integers with norm But,therearenoGaussianintegerswithnorm, imlying that z cannot exist Note that D( n )G( n ) We introduce a theorem that shows that G and D are identical Theorem 7 Let f and g be two multilicative functions If f( n )g( n ) for all rime and ositive n, then f and g are identical Proof Let r be a ositive integer with rime factorization e e k k By assumtion, we have: f(r) f( e e k k )f( e ) f( e k k )g( e ) g( e k k )g( e e k k )g(r) f and g are identical Note that G( n )D( n )forallrime and ositive n Thisrovesthefollowingresult Theorem 8 For a ositive integer r, d(r ) r G(r) 3 is a square, 0 otherwise In Kalai s algorithm, the robability that r is the roduct of the rime elements of a list was /N WewanttherobabilitytoberoortionaltoG(r)/N Thenextfewsectionwill be sent finding such an algorithm and roving that it accomlishes this task We still need a way to solve the congruence x mod, where is a rime that is congruent to mod 4 Algorithm Given an rime mod4, this algorithm roduces a solution to the congruence x mod Choose a random integer a in the interval [, ] Let x a ( )/ mod If x mod, then outut a ( )/4 Ifx mod, choose a new value of a The rocess for finding a square root of israndomized Leta be an integer Euler s Criterion states that a is a residue if and only if a ( )/ mod Observe that (a ( )/ ) a mod So,a ( )/ must be congruent to one of the two square roots 5

16 of, which are and If a is a quadratic non-residue, then a ( )/ mod Therefore, x ( )/4 is one of the square roots of mod Half of all elements of F are quadratic residues and the other half are non-residues All our algorithm does is find a non-residue and raises it to an exonent of ( )/4 On average, we will have to choose values of a Once, you have found the square root a, simlytakethegcdofa + i and Here is an examle Let 53 Wechoosearandomintegera in [, 5], say 6 Then, we calculate 6 (53 )/ 6 6 mod53 Wechooseanewnumber Leta Wecalculate 6 mod53 Weoutut 3 30 mod 53 Let s confirm this: mod53 Our algorithm roduced 30, which is a square root of mod53 Observe that to calculate a ( )/ mod, onedoesnotactuallyhavetocalculatea ( )/ Use a fast modular exonentiation algorithm To calculate a general a x mod b, writethe binary form of x Then,obtaina raised to every ower of that is less than or equal to x by squaring the revious value and reducing it mod b Finally, multily the necessary owers of a together At this oint, we know how many Gaussian integers have a given norm and how to generate Gaussian rimes with a given norm This leads us to an imortant conclusion about how to extend Kalai s Algorithm to the Gaussian integers Generate each integer r with a robability roortional to d(r ) Outut r if r is a Gaussian norm Generate arandomgaussianintegerwithnormr with uniform distribution At this oint, we will demonstrate a rocedure to generate the random Gaussian integers with a given norm and its rime factorization Algorithm 3 Given a ositive integer r, along with its factorization, this algorithm roduces a random Gaussian integer with norm r, u to a ower of i, with uniform distribution Let z For each that divides r, do one of the the following three things If, multily z by ( + i) 3 If 3mod4, multily z by / 4 If mod4, determine the ositive solutions to the equation a + b Choose a random integer m in the interval [0, ] Multily z by (a + bi) m (a bi) m 4 Choosing Less Often Definition The -uniform robability distribution on {,N} is half as likely to choose asitistochooseanyothernumber Consider a -uniform version of Kalai s algorithm Let the robability of choosing in the interval [,N]be Then, the robability that we choose any other integer must be But, the robability that we choose some number must be equal to We have (N ), 6

17 which imlies that N We lan to choose integers from to N, thenmultilythembyandsubtract,ensuring that we only obtain odd numbers This begs the question, Why not choose odd numbers from the get go? For the next algorithm, we do just that We get to relace every instance of s withs, makingthealgorithmeasiertounderstand Algorithm 4 Given a ositive integer N, this algorithm roduces a random ositive integer r ale N, along with its factorization, where the robability of obtaining r is roortional to G(r) Let M be the largest odd number that is less than or equal to N Create a list s s s k of all odd numbers, where s is with robability /M and any odd element of [3,N] with robability /M Ifs i has already been chosen, then let s i+ equal with robability /s i and any other odd integer in the interval [3,s i ] with robability /s i Let r be the roduct of the rime s i for each s i in the list 3 Multily r by with robability / If you just added a, reeat this ste Otherwise, go to Ste 4 4 If r>nor r 3 is not a square, do not outut r and return to Ste Otherwise, outut r with robability rd(r )/( 0(r) N) How does this change the robability distribution? Given an integer r, wecomute the robability that the algorithm oututs r First, we must solve a simler roblem We comute the robability that we obtain n coies of the number s> in a given list As long as it is ossible to choose s, wewillchooseitwithrobability/s If we have chosen anumberlessthans, then the robability of choosing s is 0 We have to choose ns s in a row and then choose a number smaller than s This occurs with a robability n P (n coies of s) s s Let P (r) be the robability that the number r is roduced in Ste Then, P (r) Y alen Once again, we can write the robability that r is the roduct of each rime following equation: P (r) Y Y alen alen withthe 7

18 We may kee the Kalai s definition of r, namely r Y alen This allows us to write the robability of obtaining r in a more comact manner: P (r) Y Y r alen alen To simlify this further, we must introduce some new symbols Definition Let the factorization of n be e e k k Then, (n) e + e k In other words, (n) isthesumofthenumberofrimefactorsofn, countedwithmultilicity Let 0 (n) bethesumofthenumberofoddrimesfactorsofn, countedwithmultilicity The use of the symbol allows us to write our robability more succinctly: P (r) 0(r) Y r alen Note that the roduct of /( ) for all ale N is indeendent of r Call this number L N We use 0,insteadof becauseonlyinsertcoiesofduringste3 The robability has a new equation, namely P (r) 0(r) L N r Once again, we outut r with robability r/n, leadingtoasimlerequationforp (r): P (r) 0(r) L N N But, we can do better We wanted the robability that we oututted r to be roortional to d(r ), not (r) However, d(r )islessthan 0(r) So, instead of oututting r with robability r/n, oututr with robability (rd(r ))/( 0(r) N) Here is the robability that we obtain r: P (r) (r) L N rd(r ) r (r) N L Nd(r ) N However, a robability can never be greater than So, we must verify the following inequality: rd(r ) ale 0(r) N We already know that r ale N Therefore, it is su cient to rove that d(r ) ale 0(r) This time, let the rime factorization of r be k e en n Everyfactorofr is also a factor of r Therefore, d(r ) ale d(r), giving us d(r ) ale d(r/ k )(e +)(e n +) 8

19 and 0(r) e ++e n e en For any nonnegative integer m, m +ale m Hence, d(r ) ale (r) Therefore, rd(r ) (r) N ale 5 Proof That Algorithm 4 Works To verify that Algorithm 4 works, we must rove two statements If r is a Gaussian norm, then the robability that the algorithm oututs r is roortional to d(r ) Otherwise, the algorithm does not outut r at all The algorithm runs in olynomial time We roved Statement in the revious section and showed that the robability that the algorithm oututs r is P (r) L NG(r) N In the revious section, we roved that the algorithm generates Gaussian norms with a robability roortional to the number of Gaussian integers that have that norm Now, we must rove that the algorithm runs in olynomial time To do this, we set an uer bound on the number of rimality tests that the algorithm will require This uer bound will have the form O(log k N)forsomeositivek Here is the robability that the algorithm will generate some Gaussian norm after making a list: P (outut) ralen L N G(r) N L N N G(r) By definition, G(r) isthenumberofgaussianintegersofnormr Therefore, the sum of G(r) forallralen is equal to the number of Gaussian integers with norm ale N As N goes to infinity, this sum becomes asymtotic to the area of a the uer quarter of a circle with radius N Hence, we can make this substitution for large N: P (outut) L N N N 4 <alen L N 4 ralen O(L N ) We can aroximate L N by noting that its formula is very similar to the formula for MN : L N Y 9

20 Clearly, 4M N L N WehaveL N /M N ale 4 Here is the formula for M N : M N Y alen Y alen + We will rove that L N /MN is bounded below by a ositive number: L N 4 Y + 4 Y + 4 Y M N <alen + 4 Y <alen <alen ( +) ale 4 For a given rime,, wecanexand( (/ )) : <alen Y <alen < 4 Y rime Hence, L N MN < 4 Y rime i0 For any integer n, thereisexactlyone/n term in the sum Thus, the term on the right is equal to 4 times the sum of the recirocals of the squares, which we already roved is at most Now, we can lug this into our earlier inequality and multily both sides by M N : L N < 8M N Therefore, L N O(log N) The exected number of lists is on the order of /L N,whichis O(log N) At this oint, we have to determine how many distinct elements occur in a list The robability that the list contains least one coy of is/( ) E(length of list) <nalen n odd n i O(log N) The exected number of distinct elements in a list is O(log N) The exected number of lists is O(log N) Therefore, the exected number of rimality tests is O(log 3 N) 6 Imrovement We can make an imrovement to this algorithm by adding one extra ste This imrovement reduces the exected time from O(log 3 N)toO(log N) Strictly seaking, this imrovement 0

21 is not necessary for our algorithm Our goal was simly to create a olynomial time algorithm and O(log 3 N) is olynomial time However, a O(log N) time reduction is nothing to ignore This section is imortant because it shows that our algorithm runs as quickly as Kalai s, Here is the imrovement In the revious algorithm, we simly threw away r if r 3 is not a square Instead, we divide r by a certain number T and outut r/t with a certain robability Once again, N is our inut and M is the largest odd number that is less than or equal to N Algorithm 5 Given a ositive integer N, this algorithm roduces a random ositive integer r ale N, along with its factorization, with a robability roortional to G(r) This algorithm serves the same function as Algorithm 4 However, Algorithm 4 requires O(log 3 N) rimality tests, while this algorithm only requires O(log N) rimality tests Let M be the largest odd number that is less than or equal to N Create a list s s s k of odd numbers, where s is with robability /M and any odd element of [3,N] with robability /M Ifs i has already been chosen, then let s i+ equal with robability /s i and any other odd integer in the interval [3,s i ] with robability /s i Let r be the roduct of the rime s i for each s i in the list 3 Multily r by with robability / If you just added a, reeat this ste Otherwise, go to Ste 4 4 Let T be the roduct of all distinct rime factors of r that are congruent 3 mod 4 and occur an odd number of times in the rime factorization of r Let R r/t IfR ale N, outut R with robability Rd(R )/( (r) N) If you did not outut R, return to Ste The change in this algorithm is that instead of throwing r away if it is not a Gaussian norm, we divide it by a number T and outut r/t with a certain robability To show that this is accetable, we must rove three statements The number r/t is a Gaussian norm, whether or not r is not a Gaussian norm Our modification oututs every Gaussian norm R with a robability roortional to d(r ) 3 Our modification imroves the exected running time by a factor of log N Let be a rime factor of r 3 Let k be the largest ower of that is a factor of r If k is even, then k is also a factor of R because we do not divide by Ifk is odd, then we divide by Inthiscase, k is the largest ower of that divides R If is a rime factor of r 3,thenoccurs an even number of times in the rime factorization of R Hence, R 3 is a square because every one of its rime factors occurs an even number of times When R 3 is asquare,r is a Gaussian norm Let R be a Gaussian norm We can list all values of r such that R r/t By definition, R is formed from r by dividing every rime that is congruent to 3 mod 4 that occurs an odd number of times in the rime factorization of r from r So,T can be any square-free roduct of rime numbers that are congruent to 3 mod 4 and are less than or equal to N

22 Definition Let P (r) is the robability of arriving at r after Ste 3 Let P (r) bethe robability of oututting r with our new algorithm Let r 7! R mean that R is the largest factor of r that is also a Gaussian norm Theorem 9 Let r be a ositive integer whose rime factors are less than or equal to N Then, P (r) (r) L N /r for all r In order to outut R, wemustobtainrt,wheret can be any square-free roduct of rime numbers that are congruent to 3 mod 4 and are less than or equal to N The robability of oututting R is the sum of P (RT )forallt times the robability that the algorithm decides to outut R uon selecting it Hence, P (R) Rd(R ) (R) N r7!r P (r) Rd(R ) (R) N r7!r (r) L N r d(r )L N N r7!r (r/r) (r/r) Observe that r/r can be any square-free roduct of rimes that are less than or equal to N and are congruent to 3 mod 4 Taking a sum over all ossible r/r is equivalent to taking the sum of all of these roducts Let P(N) bethesetofallsuchroducts Thesetofall ossible values of r/r is indeendent of R Let n be a ositive integer and be a rime Then, (n) (n)+ Thus, np(n) (n) n Y 3(4) alen + The roduct of + (/) forallrimealen is on the order of log N However, we are only taking the roduct over the rimes that are congruent to 3 mod 4 Hence, it is on the order of log N Wecansummarizeallofthiswith P (R) d(r )L N N Y 3(4) alen + We can asymtotically estimate the roduct of + (/) usingamethodsimilartoourroof of Mertens Theorem [0] First, we will consider all rimes less than or equal to N, then we will modify our argument so that we only consider rimes that are also congruent to 3 mod 4 We write the logarithm of + (/) forarime>usingataylorexansion: log Then, we write the log of the roduct as a sum of log s: 0 Y log + C alen 3(4) A alen 3(4) log + k k alen 3(4) k k k k

23 For each, there is an infinite sum To deal with these infinite sums, we use a method similar to the one we used to rove Mertens Theorem We searate the first terms of all of those sums from the other terms as follows: alen 3(4) k k k alen 3(4) alen 3(4) Putting an uer bound on the second term is the easy art: k k k k k k ale k k k ale k k ( ) Observe that alen 3(4) k k k ale alen 3(4) ( ) ale alen 3(4) 6 < n 6 n We established earlier that the sum of the recirocals of the squares is a ositive constant Therefore, the sum written above is bounded above by a constant Once again, we need to estimate the sum of the recirocals of the rimes However, we are only considering rimes that are less than or equal to N and congruent to 3 mod 4 A artial summation argument similar to the roof of Mertens First Theorem gives us alen 3(4) log alen ale3(4) log log N alen 3(4) log Z N 0 alet 3(4) log C A d log t The roblem is that we no longer want the sum of (log )/ for all rimes ale N We need to also have the additional condition that 3mod4 Thereisatheoremthatlets us handle this roblem Theorem 0 [0] Let a and m be relatively rime integers with m>0 For any ositive real number x, log log x + O(), (m) where to m alex a(m) (m) is the number of numbers that are less than or equal to m and relatively rime Intuitively, Theorem 0 makes sense Dirichlet s Theorem states that in the long run every integer that is relatively rime with m is equally likely to occur as the residue of a 3

24 rime mod m Therefore,wewouldexectthatthesumof(log)/ would behave similarly However, we will not rove that statement here In our case, a 3andm 4 Observe that (4) because the only ositive integers that are less than and relatively rime to 4 are and 3 Hence, log N alen 3(4) log log N + O() log N + O log N We can also use Theorem 0 to evaluate the integral: 0 Z N Z B log C A d log t alet t log log t + O() dt t 3(4) There exists some ositive constant E such that Z N t log log t + O() dt ale t Z N t log t dt + Z N Putting all this together gives us In other words, We now have alen 3(4) log N + O log N 0 Z N E t log t dt log log N alen 3(4) alen 3(4) Y log alen 3(4) log Z N 0 t log t alet 3(4) log t + E log log + O log dt C A d log t + log log N log log + O log N log log N + O() + C A loglogn + O() Raising e to both sides allows us to estimate our roduct Y + O(log N) alen 3(4) 4 log N

25 This equation shows we have decreased the exected number of lists by a factor of O(log N) Therefore, we exect to make O(log N), instead of O(log N)listsTheexectednumberof rimality tests for a given list is O(log N) Hence, we exect to make O(log N)rimality tests, just like in Kalai s algorithm 7 Eisenstein Integers The Gaussian integers are the elements of the ring Z[ ] But, what would would haen if we considered Z[ 3 ]? Then, we would have a new ring The elements of Z[ 3 ] are known as the Eisenstein integers and they form a triangular lattice in the comlex lane Let 3 e i/3 We can write any Eisenstein integer as a linear combination of 3 and Here is the norm of an arbitrary Eisenstein integer: N(x + y 3 )N x + y!! 3 + i N Simlifying this exression gives us our norm: x N(x + y 3 )x xy + y! y + y 3 i x y y! 3 + When we considered the Gaussian integers, we defined a function D that determined how many ways a given integer could be written as the sum of two squares Now, we want to know how many ways a given integer can be written in the form x xy + y Once again, we answer this question for the rimes and work our way u to an arbitrary integer r The Gaussian integers had four units, while the Eisenstein integers have six (the owers of e i/3 ) Therefore, the actual answer that we obtain will be one sixth of the actual number of Eisenstein integers with norm r Think of this as only considering the solutions that occur in the uer right sextant of the comlex lane Once again, units are not a serious issue Theorem [4] Let d b 4ac Then, there exist integral x and y that solve ax + bxy + cy n if and only if h d mod 4n has a solution in h For examle, consider x +y Thediscriminantis 4 To determine whether x +y n has any solutions, we would see if we can solve h 4mod4n Any ossible values of h would be even Let h 0 h/ Then, h 0 modn As we saw before, if n is rime, then h orh is equivalent to mod 4 For the Eisenstein integers, we want to solve x xy + y n The discriminant is 3 Hence, we want to find all solutions to h 3mod4n Since4n is even, h must be odd Thus, h 3mod4 Wealsowanttodeterminewhenh 3modn We need to determine all rimes for which 3isaquadraticresidue Thisisequivalenttosayingthat both or neither of and3arequadraticresiduesforagivenrime is a non-residue mod 3 For rimes greater than 3, we must introduce a new theorem 5

26 Theorem (Quadratic Recirocity Law) Let and q be odd rimes If both and q are congruent to 3 mod 4, then q q Otherwise, q q Using the Quadratic Recirocity Law, we can determine when 3 is quadratic residue Simly let q 3 Let be an odd rime greater than 3 If 3mod4,then 3 3 Otherwise, 3 3 It is easy to determine whether or not is a residue mod 3 is a residue and is a nonresidue The roduct of two residues or two non-residues is a residue, while the roduct of aresidueandanon-residueisanon-residue If 3mod4and mod3,then3isa residue mod 3isalsoaresidueif mod4and mod3 Inanyothercase,3is a non-residue Thus, whether or not 3 is a residue mod only deends uon the value of mod 3 We already know when, mod,, 5, 7mod isaresiduemod, namely, mod4, 3mod4 3isaresiduemodif and only if both or neither of and 3 are residues We can combine our revious two formulae: 3, 7mod,, 5, mod Finally, note that is an Eisenstein norm From this information, we can write a new theorem Theorem 3 A rime number is the norm of an Eisenstein integer if and only if it is congruent to, 3, or 7 mod Recall that with the Gaussian integers was a secial case in that there was exactly one Gaussian integer with norm For the Eisenstein integers, 3 is the secial case We can enumerate the number of Eisenstein integers with a given norm with the following definitions and theorem 6

27 Definition Let E(r) bethenumberofeisensteinintegerswiththenormr Definition Let r be a ositive integer Let r be the largest factor of r which only contains rimes that are congruent to mod 3 Let r be the largest factor of r which only contains rimes that are congruent to mod 3 With this notation, there exists some nonnegative integer k such that r 3 k r r Theorem 4 Let r be a ositive integer Let E(r) be the number of Eisenstein integers with norm r Then, d(r ) r E(r) is a square, 0 otherwise Given a rime number, weneedawayofgeneratingtheeisensteinintegerswithnorm Thisisequivalenttofindingaairofnonnegativeintegers(x, y)suchthatx xy+y We can use the aroach analogous to the one we used for Gaussian integers In the Gaussian case, we wanted to solve x + y So, we let y Wefoundavalueofx such that divides x + Then,welettookthegcdofx + i and For the Eisenstein case, we may use a similar rocess Let y Now, we want to find avalueofx such that divides x x + However, x 3 +(x +)(x x +) Therefore, must also divide x 3 + We intend to find a solution to the congruence x 3 modwith x 6 mod Before, we can do that, we have to show there is such a solution Note that mod3 Fermat slittletheoremstatesthatifa<,then a mod3 Inoursituation, isamultileof3 Therefore,a ( )/3 is a cube root of mod 3 So, a ( )/3 is a cube root of This observation allows to create the following algorithm for cube roots: Algorithm 6 Given a rime mod 3, this algorithm roduces a ositive integer x that satisfies the congruence x 3 mod Choose a random value of a in the interval [, ] Let x a ( )/3 mod If x ± mod, then outut x The rocess for finding cube roots is randomized But, one in every three elements of F has an order of at most ( )/3 [Phrase this without using grou theory] So, the robability that a given value of a will be successful will be /3 On average, we will have to choose 3 values of a Once,youhavefoundthecuberoota, simly take the gcd of a + and Here is an examle of this algorithm in action Let 6 Wechooseanumbera from to 59, say 33 Next, we raise it to our exonent: 33 (6 )/ mod43 Because we obtained, we have to choose a new number Let a 6 This time, mod 43 Our solution is 47, which is equivalent to 4 mod 6 To check this, we observe that Now, we take the gcd of 4 + and 6, like so: gcd(4 +,6) gcd(4 +,5 4 ) 5 4 We could tell that 5 4 was the gcd because its norm is 4 Thus, 5 ± 4 are the two distinct Eisenstein rimes with norm 4 7

28 8 Eisenstein Algorithm In this section, define r as the largest factor of r where every rime factor is congruent to mod 3 Define r 3 as the largest factor of r where every rime factor is congruent to mod 3 The number of Eisenstein integers in the first sextant with a norm r is d(r )ifr 3 is a square and 0 otherwise We must modify our Gaussian algorithm accordingly In the Gaussian roblem, was the only secial case Now, however, we still cannot obtain But, is just another number that is congruent to mod 3 and we must treat it as such The robability that there are n coies of in the list should be roortional to n We do not have to treat any di erently One secial case is 3 because it is the only rime that is not congruent to or mod 3 The robability that there are k coies of 3 should be roortional to /3 k Define (n) as the number of rime factors of n, excluding 3 u to multilicity Just as we used 0 in the case of the Gaussian integers, we use here Algorithm 7 Given a ositive integer N, this algorithm roduces a random ositive integer r ale N, along with its factorization, with robability roortional to E(r) Let M be the largest odd number less than or equal to N Create a list s s s k of odd numbers, where s is with robability /M, where M is the number of odd numbers less than or equal to N and any odd element of [3,N] with robability /M Ifs i has already been chosen, then let s i+ equal with robability /s i and any other odd integer in the interval [,s i ] with robability /s i If s i 3, discard it and go Ste Add a to S with robability / If you just added a, reeat this ste Otherwise, go to Ste 3 3 Let r be the roduct of the rime s i for each s i in the list If r>nor r 3 is not a square, do not outut r Otherwise, outut r with robability rd(r )/( (r) N) If you did not outut r, return to Ste We can imrove our Eisenstein algorithm just as we did with the Gaussian integers by adding a ste that is exactly the same Simly relace the r that refers to a roduct of rimes that congruent to mod 4 with an r that refers to a roduct of rimes that are congruent to mod 3 9 Quadratic Integer Rings In this section, we shall generalize our algorithms for the Gaussian and Eisenstein integers to quadratic integer rings Unfortunately, unique factorization is imossible for many of these rings, which renders the roblem unsolvable as we have stated it Wewillshowthatwecan factor any ideal into rime ideals, then modify our revious algorithms so that they aly to ideals, rather than numbers 8