Primality Testing. 1 Brute Force Primality Test. Darren Glass. December 3, 2004

Transcription

1 Primality Testing Darren Glass December 3, 2004 Last time we discussed the Fundamental Theorem of Arithmetic, which said that every integer can be factored uniquely into the product of prime numbers. However, the proof we gave was nonconstructive in the sense that it did not tell us how to factor a given number into the product of prime numbers. In general, this is a very difficult question or at least we think it is, as nobody has written down a fast way of factoring numbers after centuries of contemplating the problem. Furthermore, we hope it is hard because the encryption methods we use every time we send our credit card number over the internet rely on the difficulty of factoring. Today we will discuss an easier problem, which is still far from easy. In particular, given a number how can we tell whether or not that number is prime? 1 Brute Force Primality Test Naively, we can check whether or not n is prime by looking to see if there is a number 1 < m < n such that m n. In particular, we can test whether or not n is prime by simply checking if it is divisible by 2, then checking whether it is divisible by 3, then 4, etc. At first it looks like this test will require n 2 divisions, after which point we will know for sure whether or not n is prime. However, we note that if n is not prime then it factors as n = a b, and in particular one of the numbers a or b must be at most n. So we actually only need to do n 1 divisions (2,3,4,..., n ) in order to test whether or not a number is prime. Note that while this is a much smaller number than n 2, it is still quite large. In particular, if n = 10,000,000,001 this is 99,999 divisions which is much more than I personally would want to do. We can actually do a little better than this result if we have a list of all of the prime numbers less than n. In particular, if n is composite then it will be divisible by a prime number p which is at most n, and therefore we only need to test all of the primes. In practice, however, constructing a list of all of these primes may take a long time in of itself as it will involve testing the primality of many smaller numbers. 1

2 2 Fermat s Little Primality Test There are other properties of prime numbers which can be used in order to check if a number is composite. One example is the following theorem. Fermat s Little Theorem: Let p be a prime number and let a be any integer which is not a multiple of p. Then a p 1 1 is a multiple of p. For those of you who are fluent in the language of congruences note that an equivalent way of stating this theorem would be that if p is a prime number and a is a number relatively prime to p then a p 1 1 (mod p). For those of you not familiar with congruences then just note that we say that a b (mod m) if a b is a multiple of m. We will discuss this notion more at a later date. Proof. Look at the collection of numbers a,2a,...(p 1)a. I claim that each of these numbers has a different remainder when you divide by p. Otherwise, there would exist m,n so that ma and na have the same remainder when you divide by p. But this implies that ma na is a multiple of p. So p a(m n). But p does not divide a by hypothesis and p cannot divide m n if they are both integers between 1 and p 1, so therefore we get a contradiction. So we have p 1 different numbers, each of which is not a multiple of p and has a different remainder when divided by p. So one of them has remainder 1, one has remainder 2, etc. Therefore, if we look at the product a p 1 (p 1)! = a(2a)...((p 1)a) then it can be written as (pb 1 +1)(pb 2 +2)...(pb p 1 + p 1), which can be expressed as pb+(p 1)!. In other words, we have shown that (a p 1 1)(p 1)! is a multiple of p. But p cannot divide (p 1)!, so therefore p must divide a p 1 1, as desired. Examples: p = 5,a = 3. Then 3 4 = 81 and 81 1 = 80 which is a multiple of 5 p = 7,a = 4. Then 4 6 = = 4096 and = 4095 = p = 6,a = 5. Then 5 5 = 3125 and = 3124 which NOT a multiple of 6. This last example shows that the theorem can fail if p is not a prime number. Note: A hint for learning mathematics is that whenever you see a proof it is a good idea to go through the proof and see where it is that you use each of the hypotheses. This will help you understand the proof, and it may allow you to relax the hypotheses. In this case, it would be a good idea to go through and see where we are using the fact that p is prime, and why this theorem will not (necessarily) be true if you tried to use a composite number for p (or an integer a which is divisible by p). 2

3 This Theorem actually gives us a way to test if a number is prime. In particular, is not a multiple of 4 even though 3 is not a multiple of 4, and this proves that 4 is not a prime number. Similarly, the above example shows that 6 is not a prime number. Unfortunately, the theorem is not an if and only if theorem, and in particular there are composite numbers n for which a n 1 1 is a multiple of n. To see an example of this, let a = 2 and n = 341 = Fermat tells us that is a multiple of 11 (as 11 is prime) and therefore = (2 10 1)( ) is a multiple of 11 and thus so is Similarly the fact that is a multiple of 31 tells us that is also a multiple of 31. But these facts together imply that is a multiple of 341 so is a multiple of 341 even though 341 is not prime! Definition 2.1. n is called a 2-pseudoprime if n is a composite number such that 2 n 2 is a multiple of n. We saw above that 2-pseudoprimes exist. It would be nice if there were only finitely many, but unfortunately this is not the case. In the exercises you will prove the following theorem: Theorem 2.2. There are infinitely many 2-pseudoprimes. This tells us that, unfortunately, it will be impossible to prove a number is prime using just Fermat s Little Theorem with a = 2, even if we restrict our attention to really large numbers. The good news is that if we look at the numbers between 1 and 25,000,000,000, then roughly 1 billion of them are prime, and there are only 22,000 2-pseudoprimes. So if a number passes the test, it is very likely a prime. For real life applications, these may be good enough odds, though a mathematician will not be satisfied unless we can prove whether or not the number is prime. What if we use Fermat s Little Theorem with other values of a? Definition 2.3. More generally, n is called an a-pseudoprime if n is a composite number such that a n 1 1 is a multiple of n. A number is called a Carmichael number if it is an a-pseudoprime for all a which are relatively prime to n. In particular, Carmichael Numbers are numbers such that the conclusion of Fermat s Little Theorem holds even though the hypotheses do not! In other words, Carmichael numbers are composite numbers that our test will NEVER tell us are composite. We might be hopeful that Carmichael numbers do not exist, but we quickly find that this is not true. The smallest example of a Carmichael number is 561 = Choose any a which is relatively prime to 561. Then in particular 3 does not divide a so a is a multiple of 3 and thus a = a = (a 2 1)(a a a 2 + 1) is also a multiple of 3. Similarly, a is a multiple of 11 and of 17 and therefore of

4 Even worse, there is a 1992 theorem due to Andrew Granville and Carl Pomerance that shows that there are infinitely many Carmichael numbers. (only seven under 10,000, though...) That s the bad news. The good news, on the other hand is that this test works most of the time... Definition 2.4. If a is a number which is relatively prime to n and a n 1 1 is not a multiple of n then we call a a witness for the compositeness of n. In particular, if n is prime then it has no witnesses, and therefore any number that has a witness is not prime. If n = 190 then 79% of the numbers less than and relatively prime to n are witnesses. If n = 287 then 97% of the numbers less than and relatively prime to n are witnesses. If n = 314 then 98.7% of the numbers less than and relatively prime to n are witnesses. If n = 935 then 97% of the numbers less than and relatively prime to n are witnesses. So most of the time, most numbers are witnesses. In particular, if you choose a 120- digit odd number n at random, and an a < n at random, and if n passes the test, then there is a % chance that it is actually a prime number. 3 Other Primality Tests Fermat s Little Theorem is one example of a fact about prime numbers than can help us check whether or not a number is prime, but there are other properties that are useful as well. The Rabin-Miller primality test uses the following fact about prime numbers: Theorem 3.1. If p is a prime number and p x 2 1 then p x 1 or p x + 1. In particular, there are only two choices of x between one and p such that p x 2 1 (x = 1 and x = p 1). Note that this is not true for composite numbers. In particular, if n = 8 then 1 2 1,3 2 1,5 2 1, and are all multiples of 8. We won t go into the details here but this can be used to give a very fast (polynomial time) probabilistic primality test or a slower (exponential time) deterministic test. If the (Extended) Riemann Hypothesis, one of the largest outstanding problems in mathematics, is proved, then it will give a polynomial time deterministic test. In 2002, Agrawal, Kayal, and Saxon (the latter two of whom were undergraduate students!) used the following theorem to construct a new primality test. Theorem 3.2. Let a be any number such that (a,n) = 1. Then n is prime if and only if (x + a) n (x n + a) is a multiple of n. (Recall that a polynomial is a multiple of n if all of its coefficients are multiples of n) This theorem is especially useful because, unlike Fermat s Little Theorem, it is an if and only if statement. In partciular, it can be used to prove that a given number is 4

5 prime! To check if a number is prime you first check whether n is an a-pseudoprime (in particular, if a n a is a multiple of n) and then you need to compute the coefficients of (x + a) n and check that almost all of them are multiples of n. This is still a slow process if n is large, but Agrawal-Kayal-Saxon found some clever ways to make it faster. Their primality test is deterministic and is also in polynomial time. In other words, the speed of the algorithm can be written down as a polynomial in the number of digits of n. Keep in mind that the naive algorithms we looked at take roughly n steps, which is exponential in the number of digits of n. 4 Exercises 4. Wilson s Theorem says that if n 5 is a composite number then (n 1)! is a multiple of n, and if n is prime then (n 1)! is one less than a multiple of n. Prove the first half of this statement (we will prove the second half in a later seminar), and explain how this can be used as a primality test. Is it a good primality test? 5. Here, you will prove that there are infinitely many 2-pseudoprimes given that we know that one exists (341, in particular). Let n be a 2-pseudoprime. Let n = 2 n 1. a) Show that n 1 is a multiple of n. b) Let k = (n 1)/n, and show that n 2 nk 1 c) Given that n = a b is composite, show that 2 n 1 factors as well. d) Conclude that n is a 2-pseudoprime which is bigger than n and therefore that there are infinitely many 2-pseudoprimes. 5