# Corollary 4.2 (Pepin s Test, 1877). Let F k = 2 2k + 1, the kth Fermat number, where k 1. Then F k is prime iff 3 F k 1

Size: px
Start display at page:

Download "Corollary 4.2 (Pepin s Test, 1877). Let F k = 2 2k + 1, the kth Fermat number, where k 1. Then F k is prime iff 3 F k 1"

Transcription

1 4. Primality testing 4.1. Introduction. Factorisation is concerned with the problem of developing efficient algorithms to express a given positive integer n > 1 as a product of powers of distinct primes. With primality testing, however, the goal is more modest: given n, decide whether or not it is prime. If n does turn out to be prime, then of course you ve (trivially) factorised it, but if you show that it is not prime (i.e., composite), then in general you have learnt nothing about its factorisation (apart from the fact that it s not a prime!). One way of testing a number n for primality is the following: suppose a certain theorem, Theorem X say, whose statement depends on a number n, is true when n is prime. Then if Theorem X is false for a particular n, then n cannot be prime. For instance, we know (Fermat) that a n 1 1 (mod n) when n is prime and n a. So if for such an a we have a n 1 1 (mod n), then n is not prime. This test is called the Pseudoprime Test to base a. Moreover, a composite number n that passes this test is called a Pseudoprime to base a. (It would be good if we could find a Theorem Y that was true iff n was prime, and was moreover easy to test. Then we would know that if the theorem was true for n then n was prime. A result of this type is the following (also on a problem sheet): n is prime iff a n 1 1 (mod n) for a = 1, 2,..., n 1. This is, however, not easy to test; it is certainly no easier than testing whether n is divisible by a for a = 1,...,n.) 4.2. Proving primality of n when n 1 can be factored. In general, primality tests can only tell you that a number n either is composite, or can t tell. They cannot confirm that n is prime. However, under the special circumstance that we can factor n 1, primality can be proved: Theorem 4.1 ( Lucas Test, as strengthened by Kraitchik and Lehmer). Let n > 1 have the property that for every prime factor q of n 1 there is an integer a such that a n 1 1 (mod n) but a (n 1)/q 1 (mod n). Then n is prime. Proof. Define the subgroup G of (Z/nZ) to be the subgroup generated by all such a s. Clearly the exponent of G is a divisor of n 1. But it can t be a proper divisor of n 1, for then it would divide some (n 1)/q say, which is impossible as a (n 1)/q 1 (mod n) for the a corresponding to that q. Hence G has exponent n 1. But then n 1 #G #(Z/nZ) = ϕ(n). Hence ϕ(n) = n 1, which immediately implies that n is prime. Corollary 4.2 (Pepin s Test, 1877). Let F k = 2 2k + 1, the kth Fermat number, where k 1. Then F k is prime iff 3 F k (mod F k ). Proof. First suppose that 3 F k (mod F k ). We apply the theorem with n = F k. So n 1 = 2 2k and q = 2 only, with a = 3. Then 3 F k (mod F k ) and (on squaring) 3 Fk 1 1 (mod F k ), so all the conditions of the Theorem are satisfied. 14

2 Conversely, suppose that F k is prime. Then, by Euler s criterion and quadratic reciprocity (see Chapter 5) we have ( ) ( ) ( ) 3 F k 1 3 Fk 2 2 = = = 1, 3 3 as 2 is not a square (mod 3). F k We can use this to show that F 0 = 3, F 1 = 5, F 2 = 17, F 3 = 257 and F 4 = are all prime. It is known that F k is composite for 5 k 32, although complete factorisations of F k are known only for 0 k 11, and there are no known factors of F k for k = 20 or 24. Heuristics suggest that there may be no more k s for which F k is prime Carmichael numbers. A Carmichael number is a (composite) number n that is a pseudoprime to every base a with 1 a n and gcd(a, n) = 1. Since it it immediate that a n 1 1 (mod n) when gcd(a, n) > 1, we see that Carmichael numbers are pseudoprimes to as many possible bases as any composite number could be. They are named after the US mathematician Robert Carmichael ( ). [But even finding an a with gcd(a, n) > 1 gives you a factor of n. (Imagine that n is around and is a product of three 100-digit primes such a s are going to be few and far between!)] For examples of Carmichael numbers, see problem sheet Strong pseudoprimes. Given n > 1 odd and an a such that a n 1 1 (mod n), factorise n 1 as n 1 = 2 f q, where q is odd, f 1 and consider the sequence S = [a q, a 2q, a 4q,...,a 2fq 1], taken (mod n). If n is prime then, working left to right, either a q 1 (mod n), in which case S consists entirely of 1 s, or the number before the first 1 must be 1. This is because the number following any x in the sequence is x 2, so if x 2 1 (mod n) for n prime, then x ±1 (mod n). (Why?) A composite number n that has this property, (i.e., is a pseudoprime to base a and for which either S consists entirely of 1 s or the number before the first 1 in S is 1) is called a strong pseudoprime to base a. Clearly, if n is a prime or pseudoprime but not a strong pseudoprime, then this stronger test proves that n isn t prime. This is called the Miller-Rabin Strong Pseudoprime Test. Perhaps surprisingly: Theorem 4.3. If n is a pseudoprime to base a but not a strong pseudoprime to base a, with say a 2tq 1 (mod n) but a 2t 1q ±1 (mod n), then n factors nontrivially as n = g 1 g 2, where g 1 = gcd(a 2t 1q 1, n) and g 2 = gcd(a 2t 1q + 1, n). Proof. For then we have, for n 1 = 2 f q and some t f, that a 2tq 1 (mod n) but a 2t 1q ±1 (mod n). Now a 2tq 1 = AB 0 (mod n), where A = (a 2t 1q 1) and 15

3 16 B = (a 2t 1q + 1), and neither A nor B is divisible by n. Hence g 1 is a nontrivial ( 1 or n) factor of n. Since g 1 n, we have gcd(g 1, g 2 ) = gcd(n, g 1, g 2 ) = gcd(n, g 1, g 2 g 1 ) = gcd(n, g 1, 2) = 1, the last step because n is odd. Hence any prime dividing n can divide at most one of g 1 and g 2. So from n = p pep, say, and n AB, we see that each prime power p ep dividing n divides precisely one of A or B, and so divides precisely one of g 1 or g 2. Hence g 1 g 2 = n. Example. Take n = 31621, a pseudoprime to base a = 2. We have n 1 = , (mod n) and (mod n), so n is not a strong pseudoprime to base 2. Then g 1 = gcd(n, 31312) = 103 and g 2 = gcd(n, 31314) = 307, giving n = Note that if n = n 1 n 2 where n 1 and n 2 are coprime integers, then by the Chinese Remainder Theorem we can solve each of the four sets of equations x ±1 (mod n 1 ) x ±1 (mod n 2 ) to get four distinct solutions of x 2 1 (mod n). For instance, for n = 35 get x = ±1 or ±6. For the example n = above, we have (mod 103) and (mod 307), so that four distinct solutions of x 2 1 (mod 31621) are ±1 and ± So what is happening when the strong pseudoprime test detects n as being composite is that some x S is a solution to x 2 1 (mod n) with x ±1 (mod n) because x 1 (mod n 1 ) and x 1 (mod n 2 ) for some coprime n 1, n 2 with n 1 n 2 = n. And then both gcd(x 1, n) (divisible by n 1 ) and gcd(x + 1, n) (divisible by n 2 ) are nontrivial factors of n Strong pseudoprimes to the smallest prime bases. It is known that 2047 is the smallest strong pseudoprime to base 2; is the smallest strong pseudoprime to both bases 2, 3; is the smallest strong pseudoprime to all bases 2, 3, 5; is the smallest strong pseudoprime to all bases 2, 3, 5, 7; is the smallest strong pseudoprime to all bases 2, 3, 5, 7, 11; is the smallest strong pseudoprime to all bases 2, 3, 5, 7, 11, 13; is the smallest strong pseudoprime to all bases 2, 3, 5, 7, 11, 13, 17. (In fact is also a strong pseudoprime to base 19.) Hence any odd n < that passes the strong pseudoprime test for all bases 2, 3, 5, 7, 11, 13, 17 must be prime. So this provides a cast-iron primality test for all such n Primality testing in polynomial time. In 2002 the Indian mathematicians Agrawal, Kayal and Saxena invented an algorithm, based on the study of the polynomial ring (Z/nZ)[x], that was able to decide whether a given n was prime in time O((log n) 6+ε ).

4 (Here the constant implied by the O depends on ε and so could go to infinity as ε 0.) (Search for AKS algorithm on web.) 4.7. The Lucas-Lehmer primality test for Mersenne numbers. Given an odd prime p, let M p = 2 p 1, a Mersenne number (and a Mersenne prime iff it is prime). [It is an easy exercise to prove that if p is composite, then so is M p.] Define a sequence S 1, S 2,...,S n,... by S 1 = 4 and S n+1 = Sn 2 2 for n = 1, 2,.... so we have S 1 = 4, S 2 = 14, S 3 = 194, S 4 = 37634, S 5 = ,.... There is a very fast test for determining whether or not M p is prime. Theorem 4.4 ( Lucas-Lehmer Test). For an odd prime p, the Mersenne number M p is prime iff M p divides S p 1. So M 3 = 7 is prime as 7 S 2, M 5 = 31 is prime as 31 S 4,... In this way get M p prime for p = 3, 5, 7, 13, 17, 19, 31, 61, 89, 107, 127, 521, 607, 1279, 2203,2281,... (47th) There may be others between the 41st and 47th. [as at October 2012.] For the proof, we need two lemmas. Lemma 4.5. Put ω = and ω 1 = 2 3. Then ωω 1 = 1 (immediate) and for n = 1, 2,.... S n = ω 2n 1 + ω 2n 1 1 The proof is a very easy induction exercise. Lemma 4.6. Let r be a prime 1 (mod 3) and 1 (mod 8) (i.e., 7 (mod 24)). Then ω r (mod r). (So it s equal to a + b 3 where a 1 (mod r) and b 0 (mod r).) Proof. Put τ = and τ 1 = Then we immediately get ττ 1 = 1, τ 2 = ω and τ1 2 = ω 1. Next, from τ 2 = we have (τ 2) r = (1 + 3) r, so that r 1 ( ) τ r 2 r 1 r 2 2 = 1 + ( 3) j + 3 r j j= r (mod r), (1) as r ( r j). Since r 1 (mod 8) we have ( ) 2 r = ( 1) r (mod r), r 17

5 18 using Euler s Criterion, and Prop Further, since r 1 (mod 3) and r 1 (mod 4) we have ( ) 3 r 1 3 ( ( ) r 2 = ( 1) r 3) r = ( 1) 1 (mod r), 3 using Euler s Criterion again, and also Quadratic Reciprocity (Th. 5.1). So, from (1), we have successively the last step using τ 2 = ω. τ r (mod r) τ r τ 1 (mod r) τ r+1 ττ 1 = 1 (mod r) ω r (mod r), Proof of Theorem 4.4. M p prime M p S p 1. Assume M p prime. Apply Lemma 4.6 with r = M p, which is allowed as M p 1 (mod 8) and M p ( 1) p 1 1 (mod 3). So ω Mp+1 2 = ω 2p 1 1 (mod M p ) (2) and, using Lemma 4.5, including ω1 1 = ω, we have ( (ω ) S p 1 = ω 2p 2 + ω1 2p 2 = ω1 2p p 2 1 ω 2 p 2 + 1) = ω1 2p 2 ( ) ω 2p (mod M p ), (3) the last step using (2). M p S p 1 M p prime. Assume M p S p 1 but M p composite. We aim for a contradiction. Then M p will have a prime divisor q (say) with q 2 M p. ( Z[ ) 3] Now consider the multiplicative group G = of units of the ring Z[ 3]. Then (q) (q) G has coset representatives consisting of numbers a + b 3 with a, b {0, 1, 2,..., q 1} that are also invertible (mod q). So G is a group of size (order) at most q 2 1, with multiplication defined modulo q. From ω(ω 1 + q 3) 1 (mod q) we see that ω = is invertible, and so ω G. [Strictly speaking, the coset ω (mod q) G.] Now, using M p S p 1 we see that (3) holds even when M p is composite, so we have successively that ω 2p (mod M p ), ω 2p 1 1 (mod q) and ω 2p 1 (mod q). Hence the order of ω in G is 2 p. Then 2 p #G q 2 1 M p 1 = 2 p 2, a contradiction. Hence M p must be prime. In practice, to test M p for primality using Theorem 4.4, one doesn t need to compute S j (j = 1, 2,...,p 1), but only the much smaller (though still large!) numbers S j (mod M p )(j = 1, 2,..., p 1). A good source of information on Mersenne numbers is

6 19

### LARGE PRIME NUMBERS (32, 42; 4) (32, 24; 2) (32, 20; 1) ( 105, 20; 0).

LARGE PRIME NUMBERS 1. Fast Modular Exponentiation Given positive integers a, e, and n, the following algorithm quickly computes the reduced power a e % n. (Here x % n denotes the element of {0,, n 1}

### Advanced Algorithms and Complexity Course Project Report

Advanced Algorithms and Complexity Course Project Report Eklavya Sharma (2014A7PS0130P) 26 November 2017 Abstract This document explores the problem of primality testing. It includes an analysis of the

### Lecture notes: Algorithms for integers, polynomials (Thorsten Theobald)

Lecture notes: Algorithms for integers, polynomials (Thorsten Theobald) 1 Euclid s Algorithm Euclid s Algorithm for computing the greatest common divisor belongs to the oldest known computing procedures

### p = This is small enough that its primality is easily verified by trial division. A candidate prime above 1000 p of the form p U + 1 is

LARGE PRIME NUMBERS 1. Fermat Pseudoprimes Fermat s Little Theorem states that for any positive integer n, if n is prime then b n % n = b for b = 1,..., n 1. In the other direction, all we can say is that

### All variables a, b, n, etc are integers unless otherwise stated. Each part of a problem is worth 5 points.

Math 152, Problem Set 2 solutions (2018-01-24) All variables a, b, n, etc are integers unless otherwise stated. Each part of a problem is worth 5 points. 1. Let us look at the following equation: x 5 1

### An integer p is prime if p > 1 and p has exactly two positive divisors, 1 and p.

Chapter 6 Prime Numbers Part VI of PJE. Definition and Fundamental Results Definition. (PJE definition 23.1.1) An integer p is prime if p > 1 and p has exactly two positive divisors, 1 and p. If n > 1

### Applied Cryptography and Computer Security CSE 664 Spring 2018

Applied Cryptography and Computer Security Lecture 12: Introduction to Number Theory II Department of Computer Science and Engineering University at Buffalo 1 Lecture Outline This time we ll finish the

### Primality testing: then and now

Seventy-five years of Mathematics of Computation ICERM, November 1 3, 2018 Primality testing: then and now Carl Pomerance Dartmouth College, Emeritus University of Georgia, Emeritus In 1801, Carl Friedrich

### 1. Algebra 1.7. Prime numbers

1. ALGEBRA 30 1. Algebra 1.7. Prime numbers Definition Let n Z, with n 2. If n is not a prime number, then n is called a composite number. We look for a way to test if a given positive integer is prime

### LARGE PRIME NUMBERS. In sum, Fermat pseudoprimes are reasonable candidates to be prime.

LARGE PRIME NUMBERS 1. Fermat Pseudoprimes Fermat s Little Theorem states that for any positive integer n, if n is prime then b n % n = b for b = 1,..., n 1. In the other direction, all we can say is that

### The running time of Euclid s algorithm

The running time of Euclid s algorithm We analyze the worst-case running time of EUCLID as a function of the size of and Assume w.l.g. that 0 The overall running time of EUCLID is proportional to the number

### Instructor: Bobby Kleinberg Lecture Notes, 25 April The Miller-Rabin Randomized Primality Test

Introduction to Algorithms (CS 482) Cornell University Instructor: Bobby Kleinberg Lecture Notes, 25 April 2008 The Miller-Rabin Randomized Primality Test 1 Introduction Primality testing is an important

### CHAPTER 6. Prime Numbers. Definition and Fundamental Results

CHAPTER 6 Prime Numbers Part VI of PJE. Definition and Fundamental Results 6.1. Definition. (PJE definition 23.1.1) An integer p is prime if p > 1 and the only positive divisors of p are 1 and p. If n

### Primality Testing. 1 Introduction. 2 Brief Chronology of Primality Testing. CS265/CME309, Fall Instructor: Gregory Valiant

CS265/CME309, Fall 2018. Instructor: Gregory Valiant Primality Testing [These notes may not be distributed outside this class without the permission of Gregory Valiant.] 1 Introduction Prime numbers are

### Factorization & Primality Testing

Factorization & Primality Testing C etin Kaya Koc http://cs.ucsb.edu/~koc koc@cs.ucsb.edu Koc (http://cs.ucsb.edu/~ koc) ucsb ccs 130h explore crypto fall 2014 1/1 Primes Natural (counting) numbers: N

### Part II. Number Theory. Year

Part II Year 2017 2016 2015 2014 2013 2012 2011 2010 2009 2008 2007 2006 2005 2017 Paper 3, Section I 1G 70 Explain what is meant by an Euler pseudoprime and a strong pseudoprime. Show that 65 is an Euler

### Primality Proofs. Geoffrey Exoo Department of Mathematics and Computer Science Indiana State University Terre Haute, IN

Primality Proofs Geoffrey Exoo Department of Mathematics and Computer Science Indiana State University Terre Haute, IN 47809 ge@cs.indstate.edu July 30, 2013 Abstract There is an web site [1] that lists

### Primality testing: variations on a theme of Lucas. Carl Pomerance, Dartmouth College Hanover, New Hampshire, USA

Primality testing: variations on a theme of Lucas Carl Pomerance, Dartmouth College Hanover, New Hampshire, USA In 1801, Carl Friedrich Gauss wrote: The problem of distinguishing prime numbers from composite

### = 1 2x. x 2 a ) 0 (mod p n ), (x 2 + 2a + a2. x a ) 2

8. p-adic numbers 8.1. Motivation: Solving x 2 a (mod p n ). Take an odd prime p, and ( an) integer a coprime to p. Then, as we know, x 2 a (mod p) has a solution x Z iff = 1. In this case we can suppose

### CPSC 467b: Cryptography and Computer Security

CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 10 February 19, 2013 CPSC 467b, Lecture 10 1/45 Primality Tests Strong primality tests Weak tests of compositeness Reformulation

### Primality testing: then and now

Primality testing: then and now Mathematics Department Colloquium Boise State University, February 20, 2019 Carl Pomerance Dartmouth College (emeritus) University of Georgia (emeritus) In 1801, Carl Friedrich

### A Few Primality Testing Algorithms

A Few Primality Testing Algorithms Donald Brower April 2, 2006 0.1 Introduction These notes will cover a few primality testing algorithms. There are many such, some prove that a number is prime, others

### A Guide to Arithmetic

A Guide to Arithmetic Robin Chapman August 5, 1994 These notes give a very brief resumé of my number theory course. Proofs and examples are omitted. Any suggestions for improvements will be gratefully

### ECEN 5022 Cryptography

Elementary Algebra and Number Theory University of Colorado Spring 2008 Divisibility, Primes Definition. N denotes the set {1, 2, 3,...} of natural numbers and Z denotes the set of integers {..., 2, 1,

### LECTURE 5: APPLICATIONS TO CRYPTOGRAPHY AND COMPUTATIONS

LECTURE 5: APPLICATIONS TO CRYPTOGRAPHY AND COMPUTATIONS Modular arithmetics that we have discussed in the previous lectures is very useful in Cryptography and Computer Science. Here we discuss several

### A SURVEY OF PRIMALITY TESTS

A SURVEY OF PRIMALITY TESTS STEFAN LANCE Abstract. In this paper, we show how modular arithmetic and Euler s totient function are applied to elementary number theory. In particular, we use only arithmetic

### CPSC 467b: Cryptography and Computer Security

CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 9 February 6, 2012 CPSC 467b, Lecture 9 1/53 Euler s Theorem Generating RSA Modulus Finding primes by guess and check Density of

### CSE 521: Design and Analysis of Algorithms I

CSE 521: Design and Analysis of Algorithms I Randomized Algorithms: Primality Testing Paul Beame 1 Randomized Algorithms QuickSelect and Quicksort Algorithms random choices make them fast and simple but

### Fermat s Little Theorem. Fermat s little theorem is a statement about primes that nearly characterizes them.

Fermat s Little Theorem Fermat s little theorem is a statement about primes that nearly characterizes them. Theorem: Let p be prime and a be an integer that is not a multiple of p. Then a p 1 1 (mod p).

### D-MATH Algebra II FS18 Prof. Marc Burger. Solution 26. Cyclotomic extensions.

D-MAH Algebra II FS18 Prof. Marc Burger Solution 26 Cyclotomic extensions. In the following, ϕ : Z 1 Z 0 is the Euler function ϕ(n = card ((Z/nZ. For each integer n 1, we consider the n-th cyclotomic polynomial

### Chapter 9 Mathematics of Cryptography Part III: Primes and Related Congruence Equations

Chapter 9 Mathematics of Cryptography Part III: Primes and Related Congruence Equations Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 9.1 Chapter 9 Objectives

### Lucas Lehmer primality test - Wikipedia, the free encyclopedia

Lucas Lehmer primality test From Wikipedia, the free encyclopedia In mathematics, the Lucas Lehmer test (LLT) is a primality test for Mersenne numbers. The test was originally developed by Edouard Lucas

### Lecture 6: Deterministic Primality Testing

Lecture 6: Deterministic Primality Testing Topics in Pseudorandomness and Complexity (Spring 018) Rutgers University Swastik Kopparty Scribe: Justin Semonsen, Nikolas Melissaris 1 Introduction The AKS

### Primality Testing- Is Randomization worth Practicing?

Primality Testing- Is Randomization worth Practicing? Shubham Sahai Srivastava Indian Institute of Technology, Kanpur ssahai@cse.iitk.ac.in April 5, 2014 Shubham Sahai Srivastava (IITK) Primality Test

### Notes on Primitive Roots Dan Klain

Notes on Primitive Roots Dan Klain last updated March 22, 2013 Comments and corrections are welcome These supplementary notes summarize the presentation on primitive roots given in class, which differed

### Introduction to Quantum Information Processing QIC 710 / CS 768 / PH 767 / CO 681 / AM 871

Introduction to Quantum Information Processing QIC 71 / CS 768 / PH 767 / CO 681 / AM 871 Lecture 8 (217) Jon Yard QNC 3126 jyard@uwaterloo.ca http://math.uwaterloo.ca/~jyard/qic71 1 Recap of: Eigenvalue

### IRREDUCIBILITY TESTS IN F p [T ]

IRREDUCIBILITY TESTS IN F p [T ] KEITH CONRAD 1. Introduction Let F p = Z/(p) be a field of prime order. We will discuss a few methods of checking if a polynomial f(t ) F p [T ] is irreducible that are

### Slides by Christopher M. Bourke Instructor: Berthe Y. Choueiry. Spring 2006

Slides by Christopher M. Bourke Instructor: Berthe Y. Choueiry Spring 2006 1 / 1 Computer Science & Engineering 235 Introduction to Discrete Mathematics Sections 2.4 2.6 of Rosen Introduction I When talking

### THE SOLOVAY STRASSEN TEST

THE SOLOVAY STRASSEN TEST KEITH CONRAD 1. Introduction The Jacobi symbol satisfies many formulas that the Legendre symbol does, such as these: for a, b Z and odd m, n Z +, (1) a b mod n ( a n ) = ( b n

### f(n) = f(p e 1 1 )...f(p e k k ).

3. Arithmetic functions 3.. Arithmetic functions. These are functions f : N N or Z or maybe C, usually having some arithmetic significance. An important subclass of such functions are the multiplicative

### Euler s, Fermat s and Wilson s Theorems

Euler s, Fermat s and Wilson s Theorems R. C. Daileda February 17, 2018 1 Euler s Theorem Consider the following example. Example 1. Find the remainder when 3 103 is divided by 14. We begin by computing

### Math 324, Fall 2011 Assignment 7 Solutions. 1 (ab) γ = a γ b γ mod n.

Math 324, Fall 2011 Assignment 7 Solutions Exercise 1. (a) Suppose a and b are both relatively prime to the positive integer n. If gcd(ord n a, ord n b) = 1, show ord n (ab) = ord n a ord n b. (b) Let

### MATH 361: NUMBER THEORY FOURTH LECTURE

MATH 361: NUMBER THEORY FOURTH LECTURE 1. Introduction Everybody knows that three hours after 10:00, the time is 1:00. That is, everybody is familiar with modular arithmetic, the usual arithmetic of the

### PRIMES is in P. Manindra Agrawal. NUS Singapore / IIT Kanpur

PRIMES is in P Manindra Agrawal NUS Singapore / IIT Kanpur The Problem Given number n, test if it is prime efficiently. Efficiently = in time a polynomial in number of digits = (log n) c for some constant

### PRIMALITY TEST FOR FERMAT NUMBERS USING QUARTIC RECURRENCE EQUATION. Predrag Terzic Podgorica, Montenegro

PRIMALITY TEST FOR FERMAT NUMBERS USING QUARTIC RECURRENCE EQUATION Predrag Terzic Podgorica, Montenegro pedja.terzic@hotmail.com Abstract. We present deterministic primality test for Fermat numbers, F

### Cryptography CS 555. Topic 18: RSA Implementation and Security. CS555 Topic 18 1

Cryptography CS 555 Topic 18: RSA Implementation and Security Topic 18 1 Outline and Readings Outline RSA implementation issues Factoring large numbers Knowing (e,d) enables factoring Prime testing Readings:

### A polytime proof of correctness of the Rabin-Miller algorithm from Fermat s Little Theorem

A polytime proof of correctness of the Rabin-Miller algorithm from Fermat s Little Theorem Grzegorz Herman and Michael Soltys November 24, 2008 Abstract Although a deterministic polytime algorithm for

### CSC 373: Algorithm Design and Analysis Lecture 30

CSC 373: Algorithm Design and Analysis Lecture 30 Allan Borodin April 5, 2013 1 / 12 Announcements and Outline Announcements Two misstated questions on term test Grading scheme for term test 3: 1 Test

### SOLUTIONS TO PROBLEM SET 1. Section = 2 3, 1. n n + 1. k(k + 1) k=1 k(k + 1) + 1 (n + 1)(n + 2) n + 2,

SOLUTIONS TO PROBLEM SET 1 Section 1.3 Exercise 4. We see that 1 1 2 = 1 2, 1 1 2 + 1 2 3 = 2 3, 1 1 2 + 1 2 3 + 1 3 4 = 3 4, and is reasonable to conjecture n k=1 We will prove this formula by induction.

### NUMBER THEORY. Anwitaman DATTA SCSE, NTU Singapore CX4024. CRYPTOGRAPHY & NETWORK SECURITY 2018, Anwitaman DATTA

NUMBER THEORY Anwitaman DATTA SCSE, NTU Singapore Acknowledgement: The following lecture slides are based on, and uses material from the text book Cryptography and Network Security (various eds) by William

### PRIME NUMBERS YANKI LEKILI

PRIME NUMBERS YANKI LEKILI We denote by N the set of natural numbers: 1,2,..., These are constructed using Peano axioms. We will not get into the philosophical questions related to this and simply assume

### Definition 6.1 (p.277) A positive integer n is prime when n > 1 and the only positive divisors are 1 and n. Alternatively

6 Prime Numbers Part VI of PJE 6.1 Fundamental Results Definition 6.1 (p.277) A positive integer n is prime when n > 1 and the only positive divisors are 1 and n. Alternatively D (p) = { p 1 1 p}. Otherwise

### Pseudoprimes and Carmichael Numbers

Pseudoprimes and Carmichael Numbers Emily Riemer MATH0420 May 3, 2016 1 Fermat s Little Theorem and Primality Fermat s Little Theorem is foundational to the study of Carmichael numbers and many classes

### MATH 2112/CSCI 2112, Discrete Structures I Winter 2007 Toby Kenney Homework Sheet 5 Hints & Model Solutions

MATH 11/CSCI 11, Discrete Structures I Winter 007 Toby Kenney Homework Sheet 5 Hints & Model Solutions Sheet 4 5 Define the repeat of a positive integer as the number obtained by writing it twice in a

### The group (Z/nZ) February 17, In these notes we figure out the structure of the unit group (Z/nZ) where n > 1 is an integer.

The group (Z/nZ) February 17, 2016 1 Introduction In these notes we figure out the structure of the unit group (Z/nZ) where n > 1 is an integer. If we factor n = p e 1 1 pe, where the p i s are distinct

### Basic elements of number theory

Cryptography Basic elements of number theory Marius Zimand 1 Divisibility, prime numbers By default all the variables, such as a, b, k, etc., denote integer numbers. Divisibility a 0 divides b if b = a

### Basic elements of number theory

Cryptography Basic elements of number theory Marius Zimand By default all the variables, such as a, b, k, etc., denote integer numbers. Divisibility a 0 divides b if b = a k for some integer k. Notation

### PMA225 Practice Exam questions and solutions Victor P. Snaith

PMA225 Practice Exam questions and solutions 2005 Victor P. Snaith November 9, 2005 The duration of the PMA225 exam will be 2 HOURS. The rubric for the PMA225 exam will be: Answer any four questions. You

### MATH 4400 SOLUTIONS TO SOME EXERCISES. 1. Chapter 1

MATH 4400 SOLUTIONS TO SOME EXERCISES 1.1.3. If a b and b c show that a c. 1. Chapter 1 Solution: a b means that b = na and b c that c = mb. Substituting b = na gives c = (mn)a, that is, a c. 1.2.1. Find

### Primality testing: variations on a theme of Lucas

Primality testing: variations on a theme of Lucas Carl Pomerance, Dartmouth College Hanover, NH 03784, USA carl.pomerance@dartmouth.edu In 1801, Carl Friedrich Gauss wrote: The problem of distinguishing

### Chapter 1. Number of special form. 1.1 Introduction(Marin Mersenne) 1.2 The perfect number. See the book.

Chapter 1 Number of special form 1.1 Introduction(Marin Mersenne) See the book. 1.2 The perfect number Definition 1.2.1. A positive integer n is said to be perfect if n is equal to the sum of all its positive

### YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE

YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467a: Cryptography and Computer Security Notes 13 (rev. 2) Professor M. J. Fischer October 22, 2008 53 Chinese Remainder Theorem Lecture Notes 13 We

### Mathematics 4: Number Theory Problem Sheet 3. Workshop 26 Oct 2012

Mathematics 4: Number Theory Problem Sheet 3 Workshop 26 Oct 2012 The aim of this workshop is to show that Carmichael numbers are squarefree and have at least 3 distinct prime factors (1) (Warm-up question)

### Math 110 HW 3 solutions

Math 0 HW 3 solutions May 8, 203. For any positive real number r, prove that x r = O(e x ) as functions of x. Suppose r

### SOLUTIONS Math 345 Homework 6 10/11/2017. Exercise 23. (a) Solve the following congruences: (i) x (mod 12) Answer. We have

Exercise 23. (a) Solve the following congruences: (i) x 101 7 (mod 12) Answer. We have φ(12) = #{1, 5, 7, 11}. Since gcd(7, 12) = 1, we must have gcd(x, 12) = 1. So 1 12 x φ(12) = x 4. Therefore 7 12 x

### Math 120 HW 9 Solutions

Math 120 HW 9 Solutions June 8, 2018 Question 1 Write down a ring homomorphism (no proof required) f from R = Z[ 11] = {a + b 11 a, b Z} to S = Z/35Z. The main difficulty is to find an element x Z/35Z

### Know the Well-ordering principle: Any set of positive integers which has at least one element contains a smallest element.

The first exam will be on Monday, June 8, 202. The syllabus will be sections. and.2 in Lax, and the number theory handout found on the class web site, plus the handout on the method of successive squaring

### THE MILLER RABIN TEST

THE MILLER RABIN TEST KEITH CONRAD 1. Introduction The Miller Rabin test is the most widely used probabilistic primality test. For odd composite n > 1 at least 75% of numbers from to 1 to n 1 are witnesses

### 8 Primes and Modular Arithmetic

8 Primes and Modular Arithmetic 8.1 Primes and Factors Over two millennia ago already, people all over the world were considering the properties of numbers. One of the simplest concepts is prime numbers.

### The RSA cryptosystem and primality tests

Mathematics, KTH Bengt Ek November 2015 Supplementary material for SF2736, Discrete mathematics: The RSA cryptosystem and primality tests Secret codes (i.e. codes used to make messages unreadable to outsiders

### Applied Cryptography and Computer Security CSE 664 Spring 2017

Applied Cryptography and Computer Security Lecture 11: Introduction to Number Theory Department of Computer Science and Engineering University at Buffalo 1 Lecture Outline What we ve covered so far: symmetric

### Lecture 11 - Basic Number Theory.

Lecture 11 - Basic Number Theory. Boaz Barak October 20, 2005 Divisibility and primes Unless mentioned otherwise throughout this lecture all numbers are non-negative integers. We say that a divides b,

### Number Theory and Group Theoryfor Public-Key Cryptography

Number Theory and Group Theory for Public-Key Cryptography TDA352, DIT250 Wissam Aoudi Chalmers University of Technology November 21, 2017 Wissam Aoudi Number Theory and Group Theoryfor Public-Key Cryptography

### RSA Key Generation. Required Reading. W. Stallings, "Cryptography and Network-Security, Chapter 8.3 Testing for Primality

ECE646 Lecture RSA Key Generation Required Reading W. Stallings, "Cryptography and Network-Security, Chapter 8.3 Testing for Primality A.Menezes, P. van Oorschot, and S. Vanstone, Handbook of Applied Cryptography

### PRIMALITY TESTING. Professor : Mr. Mohammad Amin Shokrollahi Assistant : Mahdi Cheraghchi. By TAHIRI JOUTI Kamal

PRIMALITY TESTING Professor : Mr. Mohammad Amin Shokrollahi Assistant : Mahdi Cheraghchi By TAHIRI JOUTI Kamal TABLE OF CONTENTS I- FUNDAMENTALS FROM NOMBER THEORY FOR RANDOMIZED ALGORITHMS:.page 4 1)

### Elliptic curves: Theory and Applications. Day 3: Counting points.

Elliptic curves: Theory and Applications. Day 3: Counting points. Elisa Lorenzo García Université de Rennes 1 13-09-2017 Elisa Lorenzo García (Rennes 1) Elliptic Curves 3 13-09-2017 1 / 26 Counting points:

### Algebraic number theory Solutions to exercise sheet for chapter 4

Algebraic number theory Solutions to exercise sheet for chapter 4 Nicolas Mascot n.a.v.mascot@warwick.ac.uk), Aurel Page a.r.page@warwick.ac.uk) TAs: Chris Birkbeck c.d.birkbeck@warwick.ac.uk), George

### The Chinese Remainder Theorem

Chapter 5 The Chinese Remainder Theorem 5.1 Coprime moduli Theorem 5.1. Suppose m, n N, and gcd(m, n) = 1. Given any remainders r mod m and s mod n we can find N such that N r mod m and N s mod n. Moreover,

### Introduction to Number Theory. The study of the integers

Introduction to Number Theory The study of the integers of Integers, The set of integers = {... 3, 2, 1, 0, 1, 2, 3,...}. In this lecture, if nothing is said about a variable, it is an integer. Def. We

### 1 Structure of Finite Fields

T-79.5501 Cryptology Additional material September 27, 2005 1 Structure of Finite Fields This section contains complementary material to Section 5.2.3 of the text-book. It is not entirely self-contained

### Math 109 HW 9 Solutions

Math 109 HW 9 Solutions Problems IV 18. Solve the linear diophantine equation 6m + 10n + 15p = 1 Solution: Let y = 10n + 15p. Since (10, 15) is 5, we must have that y = 5x for some integer x, and (as we

### 1 Overview and revision

MTH6128 Number Theory Notes 1 Spring 2018 1 Overview and revision In this section we will meet some of the concerns of Number Theory, and have a brief revision of some of the relevant material from Introduction

### Lecture 11: Cantor-Zassenhaus Algorithm

CS681 Computational Number Theory Lecture 11: Cantor-Zassenhaus Algorithm Instructor: Piyush P Kurur Scribe: Ramprasad Saptharishi Overview In this class, we shall look at the Cantor-Zassenhaus randomized

### Iterated Encryption and Wiener s attack on RSA

Iterated Encryption Euler s function Euler s function: φ(n) = {1 x n : gcd(x, n) = 1} Theorem (Euler) If n is a positive integer and m is a positive integer coprime to n then m φ(n) mod n = 1. Iterated

### Wednesday, February 21. Today we will begin Course Notes Chapter 5 (Number Theory).

Wednesday, February 21 Today we will begin Course Notes Chapter 5 (Number Theory). 1 Return to Chapter 5 In discussing Methods of Proof (Chapter 3, Section 2) we introduced the divisibility relation from

### 1 The Fundamental Theorem of Arithmetic. A positive integer N has a unique prime power decomposition. Primality Testing. and. Integer Factorisation

1 The Fundamental Theorem of Arithmetic A positive integer N has a unique prime power decomposition 2 Primality Testing Integer Factorisation (Gauss 1801, but probably known to Euclid) The Computational

### Congruences and Residue Class Rings

Congruences and Residue Class Rings (Chapter 2 of J. A. Buchmann, Introduction to Cryptography, 2nd Ed., 2004) Shoichi Hirose Faculty of Engineering, University of Fukui S. Hirose (U. Fukui) Congruences

### FERMAT S TEST KEITH CONRAD

FERMAT S TEST KEITH CONRAD 1. Introduction Fermat s little theorem says for prime p that a p 1 1 mod p for all a 0 mod p. A naive extension of this to a composite modulus n 2 would be: for all a 0 mod

### NUMBER SYSTEMS. Number theory is the study of the integers. We denote the set of integers by Z:

NUMBER SYSTEMS Number theory is the study of the integers. We denote the set of integers by Z: Z = {..., 3, 2, 1, 0, 1, 2, 3,... }. The integers have two operations defined on them, addition and multiplication,

### Q 2.0.2: If it s 5:30pm now, what time will it be in 4753 hours? Q 2.0.3: Today is Wednesday. What day of the week will it be in one year from today?

2 Mod math Modular arithmetic is the math you do when you talk about time on a clock. For example, if it s 9 o clock right now, then it ll be 1 o clock in 4 hours. Clearly, 9 + 4 1 in general. But on a

### Section 10: Counting the Elements of a Finite Group

Section 10: Counting the Elements of a Finite Group Let G be a group and H a subgroup. Because the right cosets are the family of equivalence classes with respect to an equivalence relation on G, it follows

### Discrete Logarithms. Let s begin by recalling the definitions and a theorem. Let m be a given modulus. Then the finite set

Discrete Logarithms Let s begin by recalling the definitions and a theorem. Let m be a given modulus. Then the finite set Z/mZ = {[0], [1],..., [m 1]} = {0, 1,..., m 1} of residue classes modulo m is called

### God may not play dice with the universe, but something strange is going on with the prime numbers.

Primes: Definitions God may not play dice with the universe, but something strange is going on with the prime numbers. P. Erdös (attributed by Carl Pomerance) Def: A prime integer is a number whose only

### Basic Algorithms in Number Theory

Basic Algorithms in Number Theory Algorithmic Complexity... 1 Basic Algorithms in Number Theory Francesco Pappalardi Discrete Logs, Modular Square Roots & Euclidean Algorithm. July 20 th 2010 Basic Algorithms

### Definitions. Notations. Injective, Surjective and Bijective. Divides. Cartesian Product. Relations. Equivalence Relations

Page 1 Definitions Tuesday, May 8, 2018 12:23 AM Notations " " means "equals, by definition" the set of all real numbers the set of integers Denote a function from a set to a set by Denote the image of

### Winter Camp 2009 Number Theory Tips and Tricks

Winter Camp 2009 Number Theory Tips and Tricks David Arthur darthur@gmail.com 1 Introduction This handout is about some of the key techniques for solving number theory problems, especially Diophantine

### 1. Factorization Divisibility in Z.

8 J. E. CREMONA 1.1. Divisibility in Z. 1. Factorization Definition 1.1.1. Let a, b Z. Then we say that a divides b and write a b if b = ac for some c Z: a b c Z : b = ac. Alternatively, we may say that