Tabulating pseudoprimes and tabulating liars

Transcription

1 Illnos Wesleyan Unversty From the SelectedWorks of Andrew Shallue 2016 Tabulatng pseudoprmes and tabulatng lars Andrew Shallue Ths work s lcensed under a Creatve Commons CC_BY-NC Internatonal Lcense. Avalable at:

2 Tabulatng Pseudoprmes and Tabulatng Lars Andrew Shallue 1 Abstract Ths paper explores the asymptotc complexty of two problems related to the Mller-Rabn- Selfrdge prmalty test. The frst problem s to tabulate strong pseudoprmes to a sngle fxed base a. It s now proven that tabulatng up to x requres O(x) arthmetc operatons and O(x log x) bts of space. The second problem s to fnd all strong lars and wtnesses, gven a fxed odd composte n. Ths appears to be unstuded, and a randomzed algorthm s presented that requres an expected O((log n) 2 + S(n) ) operatons (here S(n) s the set of strong lars). Although nterestng n ther own rght, a notable applcaton s the search for sets of compostes wth no relable wtness. 2 Introducton A common way to prove that a postve nteger n s composte s to demonstrate that a necessary condton for prmalty fals. For example, by Fermat s Theorem we know that f p s prme and a s not dvsble by p, then a p 1 1 mod p. The converse of Fermat s Theorem fals, nsprng the followng defnton. Defnton 2.1. Let n be a postve, composte nteger. If a n 1 1 mod n we call a a Fermat lar wth respect to n, and we call n a Fermat a-pseudoprme or a-psp for short. If a 0 mod n and a n 1 1 mod n then a s a Fermat wtness for n. If a 0 mod n then a s nether a wtness nor a lar. Due to the exstence of composte numbers wth many Fermat lars, a stronger condton was developed by Selfrdge, Mller, Rabn and others. Let n > 1 be odd, and wrte n 1 as 2 s d where d s odd. Then f n s prme and gcd(a, n) = 1 we have that ether 1. a d 1 mod n, or 2. a 2d 1 mod n for some 0 s 1. We call ths the strong pseudoprme condton. An algorthm bult around ths condton s known as the Mller-Rabn-Selfrdge test, and t nspres a smlar defnton of lar. 1

3 Defnton 2.2. Let n be an odd, postve, composte nteger. If a satsfes the strong pseudoprme condton, we call a a strong lar wth respect to n, and we call n a strong a-pseudoprme or a-spsp for short. If a 0 mod n and a does not satsfy the condton then a s a strong wtness for n. If a 0 mod n then a s nether a strong wtness nor a strong lar. Note that 1 and n 1 are strong lars for any odd composte n. Excludng the case when gcd(a, n) = n, f gcd(a, n) 1 then a must be a strong wtness. Snce 1, 1 are unts modulo n and a s not, no power of a could result n 1 or 1 modulo n. If n fxed we denote the set of Fermat lars by F (n) and the set of strong lars by S(n). From [20] we have exact formulae for the sze of these sets, namely F (n) = gcd(n 1, p 1) S(n) = ( 1 + 2νω(n) 1 2 ω(n) 1 ) gcd(n, p ) where ω(n) s the number of dstnct prmes dvdng n, ν = mn ν 2 (p 1), and n s the odd part of n 1. Some authors n defnng a lar a nsst upon a < n, a reflecton of the obstructon they pose to dentfyng composte numbers. In ths paper we seek to classfy the set of all postve ntegers, and wll allow a > n. It s natural n ths case to work wth a modulo n, and the defnton gven requres no modfcaton to allow for t. Ths paper wll focus on the asymptotc complexty of two tabulaton problems related to strong lars. Frst, gven a fxed a, tabulate all a-spsp up to a gven bound x. Second, gven a fxed odd composte n, determne all 1 a < n for whch a s a strong lar. Whle many authors have performed pseudoprme searches or pseudoprme tabulatons (especally pseudoprmes to multple bases), fewer analyze algorthms for these problems n terms of ther asymptotc complexty. In fact, the lterature seems to lack algorthms for tabulatng strong wtnesses and lars. The nave complexty to beat s that of smply applyng the strong pseudoprme condton, ether to each odd composte up to x or to each potental lar a. Ths method requres the equvalent of a sngle modular exponentaton for each nteger, whch totals to O(x log x) multplcatons. There has been nterest n tabulatng pseudoprmes snce a varety of prmalty tests were frst developed. A sgnfcant pece of pror work s [24], whch contans a tabulaton of 2-Fermat pseudoprmes up to The key algorthmc dea was to restrct the search to certan equvalence classes. In partcular, f n s a 2-psp wth p n then l 2 (p) n 1 (here l 2 (p) s the multplcatve order of 2 modulo p). Ths tabulaton was extended to n [22]. Pnch added a pre-computaton that matched ntegers f wth all prmes q such that l a (q) = f, then looped over pre-products P, factors f of P 1, and prmes q wth l a (q) = f n search of pseudoprmes P q. A method smlar to Pnch s has been used to tabulate all 2-psp up to [12]. One contrbuton of the present work s demonstratng that l a (q) can be computed for all prme powers q x at a cost of O(x) multplcatons. 2

4 More recent tabulatons have focused on the search for ψ k, defned as the smallest composte whch s a strong pseudoprme to all of the frst k prme bases. The resultng specalzed algorthms take advantage of the fact that pseudoprmes to several bases fall nto an even more restrcted set of congruence classes. Jaeschke n [17] utlzed ths technque to tabulate n whch are smultaneously 2-spsp, 3-spsp, and 5-spsp. Zhang [31] further restrcted the search to pseudoprmes wth two prme factors related by a sngle parameter, fndng all such pseudoprmes to In the process, upper bounds or exact values were gven for ψ k wth k 19. The authors of [18] tabulated pseudoprmes to the frst eght prme bases and provably determned ψ 11. An algorthm developed n [6] tabulates pseudoprmes to two or more bases up to x and has a heurstc complexty of O(x 9/11+o(1) ). Recently, Sorenson and Webster mproved ths to O(x 2/3+o(1) ) and computed ψ 12 and ψ 13 [28]. Two man results wll be dscussed n later sectons. Frst, an algorthm s presented n Secton 6 that returns all a-spsp up to x. For the frst tme t s proven that tabulatng strong pseudoprmes to a sngle fxed base a requres O(x) arthmetc operatons and O(x log x) bts of space. The second new result s an algorthm whch tabulates all strong lars for a gven odd composte n n factored form. Presented as Theorem 8.2 n Secton 8, we frst use a randomzed algorthm to compute the structure of F (n) at an expected cost of O((log n) 2 ) operatons, after whch tabulatng S(n) requres O( S(n) ) operatons. 3 Notaton and model of computaton For a n the unt group (Z/nZ), l a (n) wll denote the multplcatve order of a modulo n. That s, l a (n) s the least nteger e such that a e 1 mod n. By Lagrange s Theorem l a (n) φ(n), where φ(n) s Euler s functon. The largest power of p that dvdes n wll be notated by ν p (n). Note that one way to compute l a (n) s to compute ν p (l a (n)) for all prmes p dvdng φ(n). The number of dstnct prme factors of an nteger n s denoted ω(n) and the largest prme factor of n by P (n). In ths paper log wll stand for the natural logarthm, though log 2 wll occasonally be used n descrbng algorthms. The computatonal model used assumes all arthmetc operatons take constant tme, though the space complexty of algorthms wll always be measured n bts. In partcular, f x s the bound on the tabulaton beng performed, all ntegers consdered have O(log x) bt sze, and we assume arthmetc operatons on such ntegers take constant tme. See [10, Secton 2] for further detals and justfcaton. 3

5 4 Relable wtnesses The nspraton for the present work comes from a queston posed n [1]: fnd the smallest nteger x for whch there s no relable strong wtness for the set of odd compostes up to x. Ths seems dffcult, but f we change the problem to no relable wtness less than or equal to x t becomes more tractable. Defnton 4.1. Let C be a set of composte ntegers. We call postve nteger a a relable Fermat wtness for C f t s a Fermat wtness for every composte n C. We smlarly defne relable strong wtness, and use smply relable wtness f the test s clear from context. A lttle computaton reveals that the answer to the modfed queston s For the frst 2-spsp s 2047, so 2 s a relable wtness for the odd compostes less than Lookng at a < 2047, the smallest a-spsp s always smaller than 2047, except for the fact that the smallest 1320-spsp s However, 1320 s not a relable wtness, because t has odd composte dvsors. For such an odd composte dvsor n, we have mod n and thus 1320 s nether a wtness nor a lar. We conclude that the odd compostes up to 2047 have no relable wtness x, and that ths s the smallest bound wth that property. A natural extenson s to construct a small set of odd compostes x wth no relable wtness x for arbtrary x. By work of Moner [20] and others, we know that the maxmum number of strong lars a composte n can possess s φ(n)/4. By usng n that reach the maxmum we should have a set of compostes wth few relable wtnesses. For each such relable wtness a, add the smallest a-spsp untl the set no longer has a relable wtness. Note that mplementng ths constructon requres algorthms for the two problems under consderaton, namely tabulatng all a-spsp up to a gven bound x and determnng all 1 a < n for whch a s a strong lar. There are known theoretcal bounds on the count of a-pseudoprmes up to x, denoted by P a (x). Snce every Carmchael number relatvely prme to a s an a-pseudoprme, [2] gves a lower bound of x 2/7. Combned wth an upper bound from [23], we have x 2/7 P a (x) x/ exp(log x log log log x/ log log x) for large enough x. Useful theoretcal results are also avalable on counts of Fermat lars and strong lars (here we restrct to lars a wth 1 a n 1). Carmchael numbers are composte ntegers n that are a-psp for all a relatvely prme to n. Thus by [2] there are nfntely many composte n wth φ(n) Fermat lars. The sze of φ(n) depends on how many prme factors n possesses. For each fxed k, there are nfntely many Carmchael numbers n wth no prme factor below (log n) k. For such n, the probablty that gcd(a, n) 1 s at most (log n) k+1, where 1 a n 1 s chosen unformly at random [1, Secton 2]. See [13] for more results and conjectures on counts of Carmchael numbers wth a specfed number of 4

6 prme factors. Bounds on the normal order and average order of the set of strong lars can be found n [11]. Related to relable wtnesses s the noton of the least strong wtness for an odd composte n, denoted W (n). Makng explct a result of Mller, Bach n [4] showed that W (n) < 2(log n) 2 under the Extended Remann Hypothess. For a lower bound, W (n) > (log n) 1/(3 log log log n) for nfntely many Carmchael numbers n [1]. More generally, the authors showed that for x suffcently large and for any set of potental wtnesses not too large, there are Carmchael numbers smaller than x wth no wtness n the set. Thus asymptotcally there cannot be a relable wtness for the set of odd compostes up to x. 5 Prelmnares The algorthms developed n later sectons wll requre access to the factorzaton of any nteger n a gven range. The goal s to create an array that stores n poston the smallest prme factor of. Then, one can retreve the full factorzaton of any n wth O(log n) dvson steps through fndng the prme factor p and recursvely fndng the smallest prme factor of n/p. A factor table for ntegers up to x can be created wth O(x log log x) arthmetc operatons usng the Seve of Eratosthenes [9, Secton 3.2.3]. There s an extensve lterature on lnear and sublnear prme seves one can turn to for an mprovement [10, 25, 26]; the followng theorem only adds the dea of a statc wheel to the Seve of Eratosthenes. Lemma 5.1. Gven a bound x, there exsts an algorthm that outputs an array A of sze x that contans at poston the smallest prme factor of. Ths algorthm requres O(x) arthmetc operatons and O(x log x) bts of space. Proof. For an ntroducton to the wheel datastructure, see [10, Secton 2]. In our case, n addton to storng the dstance to the next nteger relatvely prme to the frst k prmes, we need to compute and store the smallest prme factor for the ntegers up to the wheel sze m = k =1 p whch are dvsble by one of the frst k prmes. If we pck k so that k =1 p s at most x, ths can be done usng the Seve of Eratosthenes n tme O( x log log log x) or even n tme O( x) [10, Lemma 1]. Let array W store the dstance to the next relatvely prme nteger, and array R store the smallest prme factor for ntegers up to m. Now, as a frst step, for each < n set A[] = R[ mod m]. As a second step, for each prme p > p k, and for each f relatvely prme to m, set A[pf] = p f p s smaller than the prevous entry of A[pf]. Ths algorthm s correct, snce f the smallest prme factor of s p p k, then p s also the smallest prme factor of mod m. If the smallest prme factor of s greater than p k, t s caught n Step 2. 5

7 Step 1 requres O(x) arthmetc operatons. Step 2 uses the wheel to step through the ntegers relatvely prme to m n lnear tme. The number of such ntegers s x φ(m) m p k <p<x k ) (1 = x 1p =1 ( = O x log log x [5, Theorem 8.8.6] and so the cost of Step 2 n operatons s ( ) ( ) x x 1 O O = O(x) p log log x log log x p [5, Theorem 8.8.5]. In what follows, we wll assume that such an algorthm has been run, and hence that we have access to any prme factorzaton. To apply seve technques we need a characterzaton of strong pseudoprmes that depends upon propertes of ther prme factors. Ths frst proposton shows that strong pseudoprmes are not much harder to dentfy than Fermat pseudoprmes. Proposton 5.2 ([1]). Let n be a postve, odd composte nteger. Then n s a strong pseudoprme to the base a f and only f a n 1 1 mod n and there exsts an nteger e such that, for every prme factor p of n, ν 2 (l a (p)) = e. We now extend the dea n [24], characterzng a Fermat pseudoprme n by the prme powers that dvde t. Proposton 5.3. Suppose the factorzaton of n s k and only f n 1 s a multple of l a (p r ) for all 1 k. p<x =1 pr ). Then an 1 1 mod n f Proof. Suppose that a n 1 1 mod n. Then snce p r n, a n 1 1 mod p r, and by group theory l a (p r ) n 1. Conversely, f n 1 s a multple of l a (p r ), then an 1 1 mod p r, and snce the factorzaton of n s pr, we use the Chnese Remander Theorem to conclude that a n 1 1 mod n. Ths gves a restrcted set of equvalence classes to whch pseudoprmes belong. Proposton 5.4. Assume that gcd(p r, l a (p r )) = 1, so that l a (p r ) p 1. Then p r n and l a (p r ) n 1 both hold f and only f n p r mod p r l a (p r ). Proof. Frst assume that n 0 mod p r and n 1 mod l a (p r ). Then l a (p r ) p 1 mples l a (p r ) p r 1, and t follows that l a (p r ) (n 1 (p r 1)). So l a (p r ) dvdes n p r. Snce p r also dvdes n p r and gcd(p r, l a (p r )) = 1, the product dvdes n p r and we conclude that n p r mod p r l a (p r ). Now suppose that n p r mod p r l a (p r ). Then p r dvdes n p r, and thus p r dvdes n. We also have l a (p r ) (n 1 (p r 1)) and so l a (p r ) dvdes n 1. 6

8 We wll need to compute l a (p r ) for all prme powers p r up to x. Wth access to the factorzaton of φ(p r ), the preferred algorthm s a known method that determnes the power of each prme dvdng the order [19, Algorthm 4.79]. Algorthm 1: Computng multplcatve order Input : postve ntegers n, a, and factorzaton φ(n) = p r 1 1 prw w Output: l a (n) 1 for 1 w do 2 Compute α = a φ(n)/pr mod n ; 3 Compute α pe power p e ; 4 return w =1 q mod n for 0 e r untl the result s 1. Let q be the frst such As Sutherland notes n [29, Secton 7.3], lne 2 n Algorthm 1 requres w exponentatons whle lne 3 requres O(log n) multplcatons over the entre loop. Snce we are repeatedly powerng the same base a n the same group, t makes sense to apply precomputaton to reduce the number of multplcatons requred. Lemma 5.5 ([7]). Let g be an element of a group of order N. If O(log N/ log log N) powers are precomputed, then we may compute g n usng only group operatons. log (1 + o(1)) 2 N log 2 log 2 N As a corollary, the asymptotc runnng tme of Algorthm 1 s ( ) log n O log n + ω(n) log log n multplcatons. Next, t s necessary to know how many dstnct prme factors φ(p r ) = p r 1 (p 1) has on average. Lemma 5.6. The followng sum s over prme powers. We have ( ) x log log x ω(φ(p r )) = O. log x p r x Proof. From [15] we know that ( ) x log log x ω(p 1) = O log x p x. 7

9 Note that snce φ(p r ) = p r 1 (p 1) we have ω(φ(p r )) = ω(p 1)+1 and hence p x ω(φ(pr )) = O(x log log x/ log x). Now consder prme powers p r wth r > 1. Then ω(p 1) + 1 = p r x r 2 log 2 x r=2 p x 1/r ω(p 1) + 1 = O whch s asymptotcally smaller. Ths completes the proof. 6 Computng a-pseudoprmes ( ) x log log x x log x + log x log x log x Ths secton presents a new algorthm for fndng all a-spsp up to a bound x. As a corollary, an easy modfcaton gves an algorthm wth the same runnng tme that computes all a- psp up to x. The authors of [24] used one drecton of Proposton 5.3 to reduce the number of pseudoprme tests requred. Our mprovement s to consder all prme powers, and the key observaton s that computng l a (p r ) for all prme powers does not spol the asymptotc complexty. Pnch n [22] consdered a smlar sevng strategy, but computed orders n a dfferent way that s hard to analyze. Computng strong pseudoprmes rather than Fermat pseudoprmes does not add much dffculty; snce Fermat pseudoprmes are rare we smply apply the strong pseudoprme test to each Fermat pseudoprme. Note that on average the number of dstnct prme factors of n s O(log log n), and so a worst case analyss of the loop n lne 12 would be O(x log log x) operatons. The success of ths algorthm depends upon the fact that most compostes are not pseudoprmes, and that non-pseudoprmes wll be dscovered rather rapdly, so that on average only a constant number of factors need to be checked before an obstructon to a composte nteger s pseudoprmalty s found. The author s grateful to Jonathan Sorenson for ths nsght. Theorem 6.1. Gven base a and bound x, Algorthm 2 correctly computes all a-spsp up to x. The algorthm has a tme complexty of O(x) arthmetc operatons and requres O(x log x) bts of space. Proof. In lnes 4 and 5 the algorthm dscards cases where n s prme, n s even, or a s not a unt modulo n. If n fals Proposton 5.3 and s thus not a Fermat pseudoprme t s caught at lne 14, whle at lne 16 we catch compostes whch are Fermat pseudoprmes but not strong pseudoprmes. Thus f Algorthm 2 sets P [n] = 0, n s ndeed not a strong pseudoprme. Conversely, f P [n] = 1 at the end of the algorthm, then n s a strong pseudoprme to the base a. For f n has passed the lne 12 whle loop, then l a (p r ) n 1 for all prme powers p r dvdng n, makng n an a-psp by Proposton 5.3. Snce P [n] = 1, we know that n also passed the strong pseudoprme test at lne 16. 8

10 Algorthm 2: Tabulatng strong pseudoprmes Input : postve nteger a, bound x Output: boolean array P [] where P [n] = 1 f n s a spsp(a) 1 Use Lemma 5.1 to create an array contanng smallest prme factors ; 2 Intalze a boolean array P [] of sze x wth all entres as 1 ; 3 for prmes p x do 4 Set P [p] = 0 ; // prmes are not pseudoprmes 5 f p a or p == 2 then 6 set P [n] = 0 for all multples n of p ; // requre gcd(n, a) = 1, n odd 7 for prme powers q = p r do 8 Factor φ(q) usng array from lne 1 ; 9 Compute l a (q) usng Algorthm 1 ; 10 for n = 2 to x wth P [n] == 1 do 11 Set q = p r to be the prme power dvdng n wth smallest p ; 12 whle n 1 mod l a (q) do 13 Set q to be the prme power dvdng n wth the next smallest p ; 14 f n 1 mod l a (q) for some q n then 15 Set P [n] = 0 ; 16 else f n fals the strong pseudoprme test then 17 Set P [n] = 0 ; 9

11 For complexty, lne 1 requres O(x) operatons and O(x log x) space. As noted, Algorthm 1 factors n and computes l a (n) usng O(log n + ω(n) log n/ log log n) multplcatons. By applyng Lemma 5.6 we calculate the total cost n multplcatons of all order computatons as O log φ(q) log φ(q) + ω(φ(q)) = O x + log x ω(φ(q)) = O(x). log log φ(q) log log x q x q x Note that q x 1 = O(x/ log x). Focusng now on lne 12, fndng the next prme power dvdng n and testng a congruence are both sngle operatons. Defne α(n) as f the th prme power s the smallest obstructon to n beng a Fermat pseudoprme, and defne α(n) = ω(n) f n s a Fermat pseudoprme. Then the complexty of the loop at lne 12 over all n s n x α(n). We gan nsght nto ths sum f we consder how much work a sngle prme power q = p e wll create across all n. A prme power q wll fal to cross off a non-pseudoprme and thus create an extra operaton f q n and n 1 mod l a (q). By Proposton 5.4, unless gcd(q, l a (q)) 1 such n are exactly those n the arthmetc progresson n q mod q l a (q). An upper bound on the number of operatons needed for all n s thus O(x) + q x x ql a (q) O(x) + p x x pl a (p) + p r x r>1 x p r. The frst sum s O(x) by [22, Proposton 3] and the second s O(x) by [16, proof of Theorem 430]. Fnally, the strong test at lne 16 s only performed on Fermat pseudoprmes. Snce there are most x/ exp(log x log log log x/ log log x) Fermat pseudoprmes up to x [23] and the strong test takes O(log x) operatons, the total s O(x) operatons. An alternate method of sevng for Fermat pseudoprmes s gven n [22, Secton 7]. Intalze a table of real numbers ndexed by ntegers, and for each prme p add log p to the entres n the arthmetc progresson n p mod pl a (p). Then n s a pseudoprme f the total at the end of sevng s log n. An advantage of Algorthm 2 s that all operatons are nteger arthmetc, obvatng the need to track precson. 7 Fndng prmtve roots and tabulatng Fermat lars Rather than fxng a and lookng for n that are a-pseudoprmes, we next fx a composte n and ask for all a that are lars (or wtnesses) for n. It s suffcent to restrct the tabulaton to 1 a < n, snce by defnton a s a lar for n f (a mod n) s a lar. Throughout the next two sectons we assume n s a postve, odd, composte nteger and that the factorzatons of both n and φ(n) are gven. Let n = q 1 q k, where q = p r 10

12 wth p prme. Our strategy wll be to frst show how to fnd prmtve roots modulo q, and then demonstrate how to tabulate the elements of (Z/nZ) of order dvdng f, where f s an arbtrary postve nteger. Ths solves the problem of tabulatng the set of Fermat lars F (n), but the stuaton wth the set of strong lars s dfferent snce S(n) s not generally a subgroup. In the next secton we overcome ths obstructon through the use of Proposton 5.2. In some sense S(n) s almost a subgroup of the group of unts. It s well-known that for prme power q, (Z/qZ) s cyclc. A generator s called a prmtve root. Fndng a prmtve root s n general a hard problem, but wth factorzatons of n, φ(n) on hand there s a straghtforward strategy. Take a subset S of (Z/qZ). For each s S, compute l s (q) usng Algorthm 1. If t equals φ(q) we know s s a prmtve root. The remanng dffculty comes from choosng a small S that contans a prmtve root. We wll consder two straghtforward methods. One good method s to smply check all ntegers up to some bound. Defne g(p) to be the smallest postve nteger whch s a prmtve root modulo p. Burgess [8] and Wang [30] proved ndependently that g(p) = O(p 1/4+ɛ ). The best explct result s that g(p) < p for p 1 exp(exp(24)) [14]. Under the assumpton of the Extended Remann Hypothess, we have the stronger result that g(p) = O((log p) 6 ) [27]. If g s a prmtve root modulo a prme p, the followng lemma makes t easy to fnd a prmtve root modulo a prme power p r. Lemma 7.1. Let p be an odd prme. 1. If a Z s a prmtve root modulo p, then one of a or a+p s a prmtve root modulo p If a Z s a prmtve root modulo p r wth r 2, then a s a prmtve root modulo p r+1. Proof. See [3, Secton 10.6]. An alternatve method s to smply choose resdues at random. From group theory we know that a cyclc group of order m has φ(m) generators, and thus the probablty of choosng a generator wth a sngle tral s φ(m)/m. We have the followng lemma. Lemma 7.2 ([21], Theorem 2.9). For all n 3, where c s a known absolute constant. φ(n) (c + o(1))n log log n The probablty of choosng a prmtve root wth a sngle tral s then φ(φ(q)) φ(q) (c + o(1))φ(q) log log(φ(q)) 11 1 φ(q) c + o(1) log log q.

13 So a prmtve root modulo q wll be found after an expected O(log log q) trals. Wth ths work we can construct a bass of (Z/nZ), whch we modfy to form a bass for the subgroup of elements of order dvdng f. Denote that subgroup by H f. Defnton 7.3. A tuple g = [g 1,..., g k ] wll be called a bass for a fnte abelan group G f every b G can be expressed unquely as b = g t = g t 1 1 g t k k wth 0 t < g for 1 k. Suppose G = C m1 C mk s a fnte abelan group wrtten as a drect product of cyclc groups, wth g a generator for C m. Then we wrte ĝ = (1, 1,..., g,..., 1) where the non-dentty element occurs at the th place n the tuple. Note that by the theory of drect product groups, {ĝ } forms a bass for G. Proposton 7.4. Let G = C m1 C m2 C mk, where each C m m generator g. Then a bass for H f s {ĝ / gcd(m,f) }. s a cyclc group wth Proof. Let x = m / gcd(m, f), and note that (g x ) f = (g m gcd(m,f) = 1. Thus the set x {ĝ } at least generates a subgroup of H f. Now, focus on a partcular cyclc component C m. Snce g has order m, g x has order gcd(m, f). If b s an arbtrary element of C m whch s also n H f, then the order of b dvdes both f and m, and hence dvdes gcd(m, f). But C m s cyclc, so there s a unque subgroup of order gcd(m, f) that contans all elements of order dvdng gcd(m, f), and as seen a generator s g x. x By group theory, the set {ĝ } s thus a bass for H f. Algorthm 3 apples these deas to compute the structure of the subgroup H f of (Z/nZ). We fnd prmtve roots modulo q for each prme power q dvdng n, use them to create a bass for (Z/nZ), then modfy them to create a bass for H f. Theorem 7.5. Algorthm 3 correctly computes the structure of the subgroup H f of (Z/nZ), gven n and φ(n) n factored form. If prmtve root canddates are chosen unformly at random from the resdues modulo p, Algorthm 3 has an expected complexty of O((log n) 2 ) operatons. Proof. Lne 2 wll eventually result n prmtve roots beng found modulo p for each prme dvdng n. Then by Lemma 7.1, lne 3 fnshes wth g a prmtve root modulo q = p r 1. The Chnese Remander Theorem s then used to construct a bass for the product group C φ(q1 ) C φ(qk ). By Proposton 7.4, rasng these elements to powers x = φ(q )/ gcd(φ(q ), f) results n a bass for H f. For complexty, the length of tme needed to fnd a prmtve root depends upon the method used, and whether we assume the Extended Remann Hypothess. Let S p be the number of trals before a prmtve root modulo p s found. Algorthm 1 has complexty O(log p + ω(p 1) log p log log p ), whle the Chnese Remander Theorem takes O((log n)2 ) bt 12 ) f

14 Algorthm 3: Computng the structure of H f (Z/nZ) Input : Postve nteger n n factored form q 1 q 2 q k, φ(n) n factored form Output: A bass {ĝ 1, ĝ 2,..., ĝ k } for H f along wth ĝ /* Frst create {ĝ } as a bass for (Z/nZ). */ 1 for 1 k do 2 Pck prmtve root canddate g and compute l g (p ) usng Algorthm 1 untl l g (p ) = p 1 ; 3 f q = p r wth r 2 then 4 Use Algorthm 1 to compute l g (p 2 ) ; 5 Set g g + p f l g (p 2 ) p (p 1) ; 6 Use the Chnese Remander Theorem to fnd ĝ such that ĝ 1 mod q j for j and ĝ g mod q j for j = ; /* Now modfy {ĝ } to be a bass for H f. */ 7 for 1 k do 8 return ĝ ĝ x where x = φ(q )/ gcd(φ(q ), f), along wth ĝ = gcd(φ(q ), f); operatons or O(log n) rng operatons [5, Corollary 5.5.3]. So the complexty n rng operatons of the loop at lne 1 s O ( ) log p S p log p + ω(p 1) + log n = O((log n) 2 ) + O (log p)2 S p. log log p log log p If we choose S p at random, ts expected sze s O(log log p). Note that (log p) 2 log p 2 (log n) 2 and so the complexty of the loop at lne 1 s an expected O((log n) 2 ). At lne 7, k = O(log n), and for each 1 k we do a gcd, a dvson, and an exponentaton whch takes O(log n) multplcatons. The total cost of ths step s thus O((log n) 2 ) operatons as well. If we would prefer a determnstc algorthm, the complexty s greater. Assumng the Extended Remann Hypothess, we have (log p)2 S p log log p (log p) 8 (log p) 13 8 = O((log n) 8 )

15 whle uncondtonally ths s nstead (log p)2 S p log log p = p 1/4+ɛ P (n) 1/4+ɛ + n 1/8+ɛ where P (n) s the largest prme factor of n. Once the structure of H f s computed, tabulatng the elements nvolves generatng t (ĝ 1 t 1,..., ĝ k k ) for each tuple t = (t 1,..., t k ) wth 0 t < gcd(φ(q ), f). If we prefer the elements to be ntegers, we can update an nteger value as we cycle. So f the power of ĝ s ncremented by one, the stored nteger s multpled by ĝ modulo n. As a corollary, ths gves us a sub-lnear tme algorthm for tabulatng Fermat lars. Corollary 7.6. Assume n and φ(n) are gven n factored form. Tabulatng F (n) requres at most O(P (n) 1/4+ɛ + n 1/8+ɛ + F (n) ) operatons determnstcally, or an expected O((log n) 2 + F (n) ) operatons f usng a randomzed method for generatng prmtve roots modulo p. Proof. Apply Algorthm 3 wth f = n 1 to compute the structure, then cycle through all the elements. In fact, snce elements of (Z/nZ) have order dvdng φ(n), we could compute F (n) by nstead takng f = gcd(n 1, φ(n)). Ths observaton s due to Noah Lebowtz-Lockard. 8 Tabulatng strong lars The set of strong lars does not form a group, snce f ν 2 (l a (p)) = ν 2 (l b (p)) then ν 2 (l ab (p)) mght not have the same value. Instead we explctly characterze the subset of F (n) wth ν 2 (l a (p)) equal for all p n. After precomputaton, tabulatng S(n) wll requre exactly S(n) operatons. The author s grateful to an anonymous referee for provdng the key dea of ths secton, mprovng upon the orgnal algorthm. We contnue to assume n s odd, and that the factorzatons of n and φ(n) are known. Specfcally let n = q 1 q k. Let {ĝ} be the bass for F (n) computed by Algorthm 3. Recall that ĝ = g x, where g s a prmtve root modulo q = p r and x = φ(q )/ gcd(n 1, p 1). For a prme p dvdng n, decompose p 1 = 2 s d where d s odd, and let v(p) = ν 2 (gcd(n 1, p 1)). Snce the order of ĝ s gcd(n 1, p 1), the power of 2 dvdng the order s at most v(p). Thus f a n 1 1 mod n and ν 2 (l a (p)) = e for all p n, we must have e mn v(p). Proposton 8.1. The set of a (Z/p r Z) wth a F (n) and ν 2 (l a (p r )) = ν 2 (l a (p)) = e s gven by {ĝ t : t 2 v(p) e mod 2 v(p) e+1 }. f 0 < e v(p). If e = 0 the set s nstead the subgroup generated by ĝ 2v(p). 14

16 Proof. The group we are workng wth s cyclc, so we agan use Proposton 7.4 to characterze the subgroup of elements whch are Fermat lars and whose order dvdes 2 e d. Snce ĝ generates a subgroup of order gcd(n 1, p 1), the subgroup we want s generated by ĝ y where gcd(n 1, p 1) gcd(n 1, p 1) y = gcd(gcd(n 1, p 1), 2 e = d) gcd(n 1, 2 e. d) By defnton d s the odd part of p 1 and hence y s a power of 2. Specfcally, y = 2 v(p) e. Smlarly, the subgroup of elements whch are Fermat lars and whose order dvdes 2 e 1 d s generated by ĝ 2v(p) e+1. For e > 0, ν 2 (l a (p)) = e f and only f l a (p) 2 e d and l a (p) 2 e 1 d. By the work above, such a are exactly ĝ t where t s a multple of 2 v(p) e but not of 2 v(p) e+1,.e. t 2 v(p) e mod 2 v(p) e+1. If e = 0 we smply have the subgroup generated by ĝ 2v(p). A consequence of Proposton 8.1 s that the set of a (Z/nZ) wth ν 2 (l a (p)) = e for all t p n s exactly (ĝ 1 t 1,..., ĝ k k ) where tuples (t 1,..., t k ) satsfy t 2v(p) e mod 2 v(p ) e+1 for 1 k. If we repeat ths for all 0 e mn v(p), we wll have tabulated all strong lars at a margnal cost of one operaton per lar. Algorthm 4: Tabulatng strong lars Input : odd composte n n factored form q 1 q k, where q s a prme power of the prme p, φ(n) n factored form Output: lst of strong lars 1 Use Algorthm 3 wth f = n 1 to construct a bass {ĝ } of F (n) ; /* Start wth the e = 0 subgroup case */ 2 Compute ĥ = ĝ 2 v(p ) mod n for 1 k; 3 Cycle through all tuples (ĥ1t 1,..., ĥkt k ) where 0 t < gcd(n, p ), wrtng ĥt to the lst ; /* Now for the other cases */ 4 for e = 1 to v = mn v(p ) do 5 for = 1 to k do 6 precompute ĝ 2 v(p ) e+1 mod n; t 7 Cycle through all tuples (ĝ 1 t 1,..., ĝ k k ) where t 2 v(p) e mod 2 v(p) e+1, wrtng ĝ t to the lst; Theorem 8.2. Assume n and φ(n) are gven n factored form. Then Algorthm 4 correctly returns S(n). Computng the structure of F (n) takes O(P (n) 1/4+ɛ + n 1/8+ɛ ) operatons determnstcally or an expected O((log n) 2 ) operatons usng a randomzed algorthm, after whch tabulatng S(n) requres O( S(n) ) operatons. 15

17 Proof. By Theorem 7.5, Algorthm 3 correctly returns a bass for F (n). Thus every element a constructed durng the cycle s a Fermat lar. By Proposton 8.1, ĝ t wth t 2 v(p ) e mod 2 v(p ) e+1 creates all a (Z/q Z) wth ν 2 (l a (q )) = e f e > 0 and lnes 2-3 accomplsh the same task n the e = 0 case. Then ν 2 (l a (p)) = e for all p n f and only f a = (a 1,... a k ) n (Z/nZ). By Proposton 5.2, ν 2 (l a (p)) = e for some e and for all p n f and only f a s a strong lar for n. If e > mn v(p ), we cannot have a n 1 1 mod n and ν 2 (l a (p )) = e for some. Thus by loopng over all 0 e mn v(p ) we generate all strong lars for n. Lne 1 takes O(P (n) 1/4+ɛ +n 1/8+ɛ ) operatons determnstcally or an expected O((log n) 2 ) by Theorem 7.5. The precomputaton on lne 6 requres mn v(p ) e=1 k v(p ) e + 1 =1 k v(p ) 2 (log p) 2 = O((log n) 2 ) =1 operatons. Once the precomputaton s complete, ncrementng t by one step means 2 multplyng by ĝ v(p ) e+1 mod n, whch s only a sngle operaton. 9 Conclusons and acknowledgements We have shown that tabulatng all a-spsp up to x requres lnear tme n the Bg-Oh sense, as does tabulatng all strong lars for a gven odd composte n. The lterature on prme sevng suggests a host of potental mprovements, ncludng wheel datastructures, segmentaton to save space, sevng n parallel computng models, and ther combnatons. Any or all of these mght apply to the problems of tabulatng pseudoprmes and lars. In partcular, usng a wheel datastructure would certanly speed up the tabulaton of pseudoprmes [25], though analyzng the gan asymptotcally s challengng. Perhaps the most promsng route to achevng sublnear complexty for tabulatng a-spsp les n analyzng the algorthm lad out n [22]. Many thanks to two anonymous referees for helpful comments and to Jonathan Sorenson for helpful dscussons. In partcular, the orgnal verson of ths paper had complexty results wth extra log log x factors, and the referees suggested mprovements for both problems. References [1] W. R. Alford, Andrew Granvlle, and Carl Pomerance, On the dffculty of fndng relable wtnesses, Algorthmc number theory (Ithaca, NY, 1994), Lecture Notes n Comput. Sc., vol. 877, Sprnger, Berln, 1994, pp [2], There are nfntely many Carmchael numbers, Ann. of Math. (2) 139 (1994), no. 3,

18 [3] Tom M. Apostol, Introducton to analytc number theory, Sprnger-Verlag, New York- Hedelberg, 1976, Undergraduate Texts n Mathematcs. [4] Erc Bach, Explct bounds for prmalty testng and related problems, Math. Comp. 55 (1990), no. 191, [5] Erc Bach and Jeffrey Shallt, Algorthmc number theory. Vol. 1. Eeffcent algorthms, Foundatons of Computng Seres, MIT Press, Cambrdge, MA, [6] Danel Blechenbacher, Effcency and securty of cryptosystems based on number theory, Ph.D. thess, Swss Federal Insttute of Technology Zurch, [7] Ernest F. Brckell, Danel M. Gordon, Kevn S. McCurley, and Davd B. Wlson, Fast exponentaton wth precomputaton: algorthms and lower bounds, Advances n Cryptology Proceedngs of Eurocrypt 92, Lecture Notes n Computer Scence, vol. 658, Sprnger, Berln, 1992, pp [8] D. A. Burgess, On character sums and prmtve roots, Proc. London Math. Soc. (3) 12 (1962), [9] Rchard Crandall and Carl Pomerance, Prme numbers: a computatonal perspectve, Sprnger-Verlag, New York, [10] Bran Dunten, Jule Jones, and Jonathan Sorenson, A space-effcent fast prme number seve, Inform. Process. Lett. 59 (1996), no. 2, [11] Paul Erdős and Carl Pomerance, On the number of false wtnesses for a composte number, Math. Comp. 46 (1986), no. 173, [12] Jan Fetsma, The pseudoprmes below 2 64, 2013, psp2/ndex. [13] Andrew Granvlle and Carl Pomerance, Two contradctory conjectures concernng Carmchael numbers, Math. Comp. 71 (2002), no. 238, [14] E. Grosswald, On Burgess bound for prmtve roots modulo prmes and an applcaton to Γ(p), Amer. J. Math. 103 (1981), no. 6, [15] H. Halberstam, On the dstrbuton of addtve number-theoretc functons. III, J. London Math. Soc. 31 (1956), [16] G. H. Hardy and E. M. Wrght, An ntroducton to the theory of numbers, sxth ed., Oxford Unversty Press, Oxford, 2008, Revsed by D. R. Heath-Brown and J. H. Slverman, wth a foreword by Andrew Wles. 17

19 [17] Gerhard Jaeschke, On strong pseudoprmes to several bases, Math. Comp. 61 (1993), no. 204, [18] Yupeng Jang and Yngpu Deng, Strong pseudoprmes to the frst eght prme bases, Math. Comp. 83 (2014), no. 290, [19] Alfred J. Menezes, Paul C. van Oorschot, and Scott A. Vanstone, Handbook of appled cryptography, CRC Press Seres on Dscrete Mathematcs and ts Applcatons, CRC Press, Boca Raton, FL, 1997, wth a foreword by Ronald L. Rvest. [20] Lous Moner, Evaluaton and comparson of two effcent probablstc prmalty testng algorthms, Theoret. Comput. Sc. 12 (1980), no. 1, [21] Hugh L. Montgomery and Robert C. Vaughan, Multplcatve number theory. I. Classcal theory, Cambrdge Studes n Advanced Mathematcs, vol. 97, Cambrdge Unversty Press, Cambrdge, [22] Rchard G. E. Pnch, The pseudoprmes up to 10 13, Algorthmc number theory (Leden, 2000), Lecture Notes n Comput. Sc., vol. 1838, Sprnger, Berln, 2000, pp [23] Carl Pomerance, On the dstrbuton of pseudoprmes, Math. Comp. 37 (1981), no. 156, [24] Carl Pomerance, J. L. Selfrdge, and Samuel S. Wagstaff, Jr., The pseudoprmes to , Math. Comp. 35 (1980), no. 151, [25] Paul Prtchard, Explanng the wheel seve, Acta Inform. 17 (1982), no. 4, [26], Lnear prme-number seves: a famly tree, Sc. Comput. Programmng 9 (1987), no. 1, [27] Vctor Shoup, Searchng for prmtve roots n fnte felds, Math. Comp. 58 (1992), no. 197, [28] Jonathan P. Sorenson and Jonathan Webster, Strong pseudoprmes to twelve prme bases, [29] Andrew V. Sutherland, Order computatons n generc groups, ProQuest LLC, Ann Arbor, MI, 2007, Thess (Ph.D.) Massachusetts Insttute of Technology. [30] Yuan Wang, On the least prmtve root of a prme, Acta Math. Snca 9 (1959), [31] Zhenxang Zhang, Two knds of strong pseudoprmes up to 10 36, Math. Comp. 76 (2007), no. 260,