# Recent Breakthrough in Primality Testing

Save this PDF as:

Size: px
Start display at page:

## Transcription

1 Nonlinear Analysis: Modelling and Control, 2004, Vol. 9, No. 2, Recent Breakthrough in Primality Testing R. Šleževičienė, J. Steuding, S. Turskienė Department of Computer Science, Faculty of Physics and Mathematics Šiauliai University, Višinskio st. 19, Šiauliai, Lithuania Received: Accepted: Abstract. This paper briefly surveys the history of primality tests. The recently discovered deterministic polynomial time primality test due to Agrawal, Kayal and Saxena is presented and some improvements are shortly discussed. Keywords: primality tests, polynomial time, P and N P. AMS classifications: 11A51, 11A41. 1 Prime numbers and their global distribution Prime numbers are rather old objects in mathematics, however, they did not loose their fascination and importance. Invented by the ancient Greek in analogy to the indivisible atoms in physics, primes are the multiplicative atoms of the integers. Their properties are studied in number theory but they occur in many other subfields of mathematics. In the last decades prime numbers entered the real world in many applications, e.g. as generator for keys in modern cryptographical algorithms. An integer n > 1 is called prime if it has no other positive divisors than 1 and itself (within the set of integers); otherwise n is said to be composite. Every integer has a unique factorization into powers of distinct prime numbers. Euclid was the first who proved that there are infinitely many primes. His simple proof is now taught at school: if p 1,...,p m are prime, then the number q := p 1... p m

2 R. Šleževičienė, J. Steuding, S. Turskienė is not divisible by any of the p j s. Thus q has a prime divisor different from p 1,...,p m (which can be q itself). This construction of a new prime number out of an arbitrary finite collection of given primes implies the infinitude of prime numbers. For other, partially astonishing proofs of this basic fact we refer to [7]. The celebrated prime number theorem gives information how the primes are distributed. On the first view the prime numbers seem to appear in the sequence of positive integers without any visible rule. However, as conjectured about two hundred years ago by Gauss (at the early age of 17) and first proved about hundred years ago by Hadamard and de la Vallée-Poussin (independently) on the base of outstanding contributions due to Riemann, they satisfy a distribution law. Roughly speaking, the number π(x) of primes less than or equal to x is π(x) = x 2 du + error term; (1) log u the appearing logarithmic integral is asymptotically equal to x/ log x, where log x is here and in the sequel the natural logarithm. The error term in the prime number theorem is small in comparison with x/log x and is closely related to the zero distribution of the Riemann zeta-function 1 ζ(s) = n s = ( 1 1 ) 1 p s, (2) p n=1 where s has to be regarded as a complex variable and the product is taken over all primes; the series, and so the product, converges absolutely for Re s > 1. The identity between the series and the product is nothing else than the analytic version of the unique factorization of integers, and provides another proof for the existence of infinitely many prime numbers which is due to Euler: assuming that there are only finitely many primes, the product converges throughout the complex plane, contradicting the fact that the series reduces for s = 1 to the divergent harmonic series. The Riemann hypothesis claims that the complex zeros of ζ(s) all lie on the so-called critical line Re s = 1/2 in the complex plane. This famous conjecture was stated by Riemann in 1859 and is still unproved. Its 172

3 Recent Breakthrough in Primality Testing value for mathematics is outstanding and so it is one of the seven millenium problems for which the Clay Institute awarded 1 million US-Dollars (see http: / If the Riemann hypothesis is true, the error term in the prime number theorem is as small as possible, namely x 1/2 log x, and so the prime numbers are distributed as uniformly as possible! For details on this fascinating link between elementary number theory and complex analysis we refer once more to [7]. 2 The local decision problem: prime or not prime? It is easy to check that 97 is prime and 99 is not, but it seems much harder to answer the same question for the numbers and , at least in the same time. Indeed, a fundamental problem in number theory is the decision problem Primes: given a positive integer n, decide whether n is prime or not! This problem became very important by developments in cryptography in the late 1970s. It is easy to multiply two large prime numbers but it is much harder to factor a given large integer; at least there are no factoring algorithms of satisfying speed known so far. This simple observation led to so-called public keycryptosystems where the key, a large integer N of about two hundred digits, is public knowledge (as the telephone number) but its prime factorization is the secret of its owner. This idea is attackable if N splits into small primes, but if N is the product of two (carefully chosen) primes with about hundred digits, the factorization of N is a nearly unsolvable task with present day computers; for more details we refer to [4]. For generating such keys one needs to find large prime numbers or, in other words, one needs to have a fast primality test, where fast means that the running time depending on the size of the number to be tested is small. Notice that a factoring algorithm and a primality test are different things: a number n can fail a primality test and the test does not tell us any of its divisors, whereas a factoring algorithm gives the complete factorization of n. One of the first ideas for testing a given number n of being prime might be trial division, i.e., to try all positive integers n whether they divide n 173

4 R. Šleževičienė, J. Steuding, S. Turskienė or not. Obviously, if there is no divisor of n among them, then n is prime. This strategy is not very useful if n is large. For example, it would take about arithmetic operations to test an integer with 100 digits; if now operations can be performed by a computer within one second, then this test would take about seconds which is still much more than 12 billion years, the estimated age of the Universe. However, hypothetical quantum computers, that are computers which compute with quantum states, if once realized, would solve this factorization problem within a fraction of a second (see for more information). The simple idea of trial division leads to the sieve of Eratosthenes (due to the ancient greek Eratosthenes who was the first to measure approximately the circumference of the Earth 250 B.C.). If one deletes out of a list of integers 1 < n x all multiples n of the primes p x, then only the prime numbers in between x and x remain. This gives a list of all primes under a given magnitude (and this is up to slight refinements still the best algorithm for this aim). Moreover, we obtain the factorizations of all integers in the list. For a primality test, this is a lot of superfluous information and we might ask for faster algorithms for detecting primes. For numbers of special shape primality tests of satisfying speed are known for quite a long time. For instance, the Mersenne numbers, invented by the monk Mersenne in 1644, are defined by M p := 2 p 1, where p 3 is prime; it is easily seen that composite exponents cannot produce primes of this form. In 1750 Euler corrected Mersenne s erroneous list of Mersenne prime numbers by use of the following criterion: if p is a prime number of the form p = 4k + 3, then q = 2p + 1 is a divisor of M p if and only if q is prime; primes of the form 2p + 1 for prime p are called Sophie Germain-primes (in honour for the French mathematician Sophie Germain and her work on Fermat s last theorem). For example, M 11 = 2047 = is not prime as it was stated by Mersenne. In 1878 Lucas found a simple and fast primality test for Mersenne numbers (but only in 1935 Lehmer gave the first proof of the underlying mathematical theorem). His algorithm makes use of the congruence calculus. Given a positive integers n and arbitrary integers a 174

5 Recent Breakthrough in Primality Testing and b, we say that a is congruent to b modulo n and write a b mod n if n divides a b. The set of integers b satisfying the above congruence forms the so-called residue class a modulo n, and we denote the smallest nonnegative integer of this set by a mod n; this number is the remainder of any b from this residue class by division with n. With this notation the Lucas-Lehmer test can be described as follows: Input: a prime p 3. Output: M p is PRIME or COMPOSITE. 1. Put s = For j from 3 to p do s := s 2 2 mod M p. 3. If s = 0, return PRIME; otherwise return COMPOSITE. A proof can be found in [4]. The first iterations (without reducing modulo M p ) are s = 4 14 = = , which yields the first two Mersenne primes M 3 = 7 and M 5 = 31. The world record among prime numbers, i.e., the largest known prime number, is a Mersenne prime, namely M = This number has more than six million digits and if these digits are typed in the size of this text, this world record would have a length of approximately 17 kilometers. This huge Mersenne prime was found by M. Shafer in November 2003 within the GIMPS-project (Great Internet Mersenne Prime Search); initiated by G. Woltman, GIMPS is a huge parallel computer connecting PCs and workstations worldwide via the internet (more details can be found under It is an open question whether there are infinitely many Mersenne primes. With a bit heuristics we can be optimistic. We may interpret the prime number theorem (1) as follows: a positive integer n 175

6 R. Šleževičienė, J. Steuding, S. Turskienė is prime with probability 1/ log n. Then the expectation value for the number of Mersenne primes M p with p x is p x 1 log(2 p 1) 1 1 log log x log 2 p log 2, p x which tends with x to infinity; the last asymptotic identity relies on taking the logarithm in (2). Note that this fits pretty well to the number of detected Mersenne primes. 3 Efficiency and Fermat s little theorem First general primality tests superior to trial division (which actually is a factoring algorithm) were found rather late. One of the reasons might be that this question was not of striking importance in the early age of mathematics (which mainly was geometry and simple algebra). With the rise of number theory in the middle ages primality testing and factoring became fundamental problems in mathematics. Gauss wrote in his famous disquisitiones arithmeticae from 1801 (see [6], article 329): The problem of distinguishing prime numbers from composite numbers and of resolving the latter into their prime factors is known to be one of the most important and useful in arithmetic (...). Nevertheless we must confess that all methods that have been proposed thus far are either restricted to very special cases or are so laborious and prolix that (...) these methods do not apply at all to larger numbers. About two hundred years before the computer age, this quotation points out the bottle neck of applying mathematics to the real world. Trial division yields the factorization of any integer after some time and thus it is the theoretical solution of the factoring problem. It works pretty well for small integers in particular, but it is hopeless if applied to integers with more than ten digits. The solution of a theoretical problem with respect to applications is only as good as its realization in practice! For our later purpose we have to introduce a measure for efficiency. Roughly speaking, a primality test is fast if its running time is polynomial in the 176

7 Recent Breakthrough in Primality Testing input data. To be more precisely, we adopt now a bit from the language of complexity theory of computations. In computer science, the class P of problems solvable in polynomial time is of special interest. By definition, a decision problem P lies in the class P of polynomial time problems if there exists a polynomial p and an algorithm such that if any instance of P has input length m, then the algorithm answers the question correctly in time p(m). Despite of its definition, it is a priori not clear that P is the class of problems which in practice can be solved rapidly. An algorithm with polynomial running time m 100 is slowlier than another algorithm with exponential running time exp(m/10000) until m is greater than about ten million. However, experience shows that whenever an interesting problem was shown to be in P, then there is also an algorithm for it whose running time is bounded by a small power of the input length. What is the input length in the decision problem Primes? In view of the binary expansion of integers, n = a 0 + a a a m 2 m with a j {0, 1}, we need m+1 C log n bits to describe an integer n, where C is an absolute constant, independent of n. Thus, a primality test for n is of polynomial time if its running time is bounded by some absolute constant times a fixed power of log n; we shall denote this by O ((log n) c ). If we are satisfied with a primality test which gives with a high probability the correct answer, then we can easily do better than trial division. Fermat s little theorem from 1640 states that if p is prime and a is not a multiple of p, then a p 1 1 mod p. (3) For our later purpose, we shall have a closer look on Fermat s little theorem. The residue classes a mod n obey a lot of algebraic structure, more precisely, they form a ring (that means roughly that they are closed under addition and multiplication) and we denote this ring traditionally by Z/nZ. If a is coprime with n, the residue class a mod n possesses an inverse in Z/nZ which can be found by solving (with the Euclidean algorithm) the linear diophantine equation ax + ny =

8 R. Šleževičienė, J. Steuding, S. Turskienė Such residue classes are called prime residue classes and they form the multiplicative group (Z/nZ) ; its cardinality is denoted by ϕ(n). The order of an element a (Z/nZ), denoted by o n (a), is the smallest positive integer k for which a k 1 mod n. If there are no divisors of zero, the ring of residue classes has even more structure. The ring Z/nZ is a field (which means that every non-zero element has a multiplicative inverse) if and only if n is prime. This can be regarded as a characterization of prime numbers but it does not give a practicable primality test. In this group-theoretical setting, Fermat s little theorem is nothing else than the statement that the order of each element of the multiplicative group of the finite field Z/pZ is a divisor of p 1, the number of elements (resp. the order) of the multiplicative group (Z/pZ). The converse implication of Fermat s little theorem is not true as the following example shows: mod 341 and 341 = But how can we quickly compute congruences with such big numbers? The trick is called fast exponentiation and works in the above example as follows: taking into account the binary expansion 340 = , we may easily compute = = 2 4 (2 4 ) 2 ((2 4 ) 2) ( 2 ((2 4 ) 2) ) mod 341 by iterating (2 k ) 2 (2 k mod 341) 2 mod 341. Fast exponentiation uses only small integers, in our case non-negative integers < 341, and so the computation of congruences with powers is a simple task. Composite numbers n for which a n 1 1 mod n (4) holds true are called pseudoprimes to base a. Integers n that are pseudoprime for all bases a 2, coprime with n, are called Carmichael numbers (after 178

9 Recent Breakthrough in Primality Testing their discoverer Carmichael in 1912); the first one is 561 = , and there are infinitely many of them. Fortunately, Carmichael numbers do not appear too often if compared with primes (see [2]). Thus one can derive a probabilistic primality test from Fermat s little theorem as follows: an integer n is with a high probability prime if (4) holds for 1 a m, where m < n is a parameter; note that increasing m gives a higher probability for n being prime. In view of fast exponentiation this is a fast algorithm for generating prime candidates for public keys in cryptosystems. However, once found such a candidate for being prime, often we need a deterministic primality test, i.e., a test which gives the correct answer whether a given integer n is prime or not, and not only an answer which is very likely correct. In the 1970s Miller found a primality test in polynomial time under assumption of the truth of the unproved Riemann hypothesis (more precisely, of the analogue of the Riemann hypothesis for Dirichlet L-functions). Miller s test is based on an extension of Fermat s little theorem. If one is not willing to accept any conditional result, there is the Jacobi sum test which has a running time ( O (log n) clog log n), where c is a positive absolute constant; the exponent is tending so slowly with n to infinity, that this running time is nearly polynomial for the range of numbers with which humans compute. For more details concerning these tests we refer to [4]. 4 Recent breakthrough: the AKS-algorithm It was an unexpected breakthrough when the Indian computer scientist Agrawal together with his students Kayal and Saxena published in August 2002 online a preprint [1] entitled Primes is in P in which they gave a first deterministic primality test in polynomial time without assuming any unproven hypothesis. Surprisingly, the test and its mathematical proof are quite simple. The main idea of this new primality test, the so-called AKS-algorithm, is the following extension of Fermat s little theorem to polynomials: a positive 179

10 R. Šleževičienė, J. Steuding, S. Turskienė integer n > 1 is prime if and only if (x + 1) n = x n + 1 (5) in the ring of polynomials with coefficients from Z/nZ. For example, the Carmichael number n = 561 leads to the polynomial (x + 1) 561 = x x mod 561. The proof of (5) is rather simple and makes only use of Fermat s little theorem (3) and divisibility properties of binomial coefficients. However, this characterization would not give a polynomial time primality test since for testing n one has to compute about n coefficients for the polynomial on the left hand side of (5). It was the ingenious idea of Agrawal and his students to replace the polynomial identity (5) by a set of weaker congruences (x a) n x n a mod (n, x r 1), (6) where the a s have to be small residue classes modulo n and the r is a small positive integer. However, to assure that switching from the polynomial identity (5) to the set of congruences (6) still yields a characterization of prime numbers, one has to consider quite many a s and r s. On the contrary, these congruences can be checked much faster than (5) since it suffices to compute with polynomials of degree 2r. The right balance leads to a deterministic primality test with polynomial running time. Theorem 1 (Agrawal, Kayal, Saxena). Let s, n be positive integers. Suppose that q and r are primes such that q divides r 1, n (r 1)/q 0, 1 mod r, and ( ) q + s 1 n 2[ r]. s If for all 1 a < s, a coprime with n, the congruence (5) holds to be true, then n is a prime power. We give a sketch of proof following Bernstein s shortened argument [3]. Let p be a prime divisor of n. Consider numbers of the form t k = n i kp j k with 0 i k, j k [ r], where, as usual, [x] denotes the largest integer x. The 180

11 Recent Breakthrough in Primality Testing pigeonhole principle shows that at least two distinct pairs of exponents (i k, j k ) lead to numbers t k lying in the same residue class modulo r. Without loss of generality, t 1 t 2 mod r. (7) Fermat s little theorem (3) implies that (x a) t k x t k a mod (p, x r 1) holds for all 1 a p and k = 1, 2. In view of (7) x r 1 divides x t 1 x t 2, and thus (x a) t 1 x t 2 a mod (p, x r 1). It follows that g t 1 = g t 2 for all elements g of the multiplicative subgroup G generated by the linear factors (ζ r a) inside the cyclotomic field over Z/pZ, generated by adjunction of the rth roots of unity ζ r (this step needs some fundamentals from algebra). Consequently, t 1 t 2 is a multiple of the group order of G. Since a is coprime with n, and since p (r 1)/q 0, 1 mod n, G has at least ( ) q+s 1 s elements (this step requires some elementary number theory). In view of the condition of the theorem ( ) q + s 1 t 1 t 2 < (np) [ r] n 2[ r]. s Since this is a lower bound for the group order of G, it follows that t 1 = t 2 which implies n = p m for some non-negative integer m. This is the assertion of the theorem. How does this theorem lead to a fast primality test? By some kind of Newton iteration one can check in polynomial time whether a given integer is a power of an integer. The congruence (5) can be tested by Fast Fourier transformation arithmetic in Õ ( sr(log n) 2) steps; the notation Õ incorporates further logarithmic factors in s, r and log n. If now the quantities s and r in the Theorem of Agrawal et al. can be chosen as being bounded by some power 181

12 R. Šleževičienė, J. Steuding, S. Turskienė of log n, we get a primality test with polynomial running time. By Stirling s formula it turns out that the hypothetical prime divisor q of r 1 is at least c[ r] log n, where c is an absolute constant depending on s. The existence of such large prime divisors of integers of the shape p 1 follows from a deep theorem of Fouvry [5] (which became famous by its applications to Fermat s last theorem, before Wiles final proof). Roughly speaking, Fouvry s result states that there are many primes r such that r 1 has a sufficiently large prime divisor; more precisely, there is a set of prime numbers r with positive density such that the largest prime divisor q of r 1 satisfies q r The proof relies on advanced sieve methods. However, Hendrik Lenstra replaced the use of Fouvry s theorem by a tricky but elementary argument which we do not give here. According to the improvements by Lenstra and others, the AKS-algorithm has now the following form: Input: an integer n > 1. Output: n is PRIME or COMPOSITE. 1. Test whether n is a prime power. 2. Find the smallest r such that the order o r (n) of n mod r is greater than 4(log n) Test whether n has prime divisors r. 4. If n r, then return PRIME. 5. Test (6) for all 1 a 2 ϕ(r) log n. 6. If n survived all tests, then return PRIME; otherwise return COMPOSITE. (Several implementations of this or related algorithms can be found under This primality test has a running time of O ( (log n) 12). Lenstra and Pomerance are working on refined faster versions of the new ideas of Agrawal and his collaborators (e.g. polynomials different from x r 1); so far, they succeeded in the estimate O ( (log n) 7.5) for the running time. With some heuristics on the distribution of Sophie Germainprimes, which brings analytic number theory back into the game, the running time is expected to be O ( (log n) 3) (but a proof seems to be as hard as a proof 182

13 Recent Breakthrough in Primality Testing of the twin prime conjecture on the existence of infinitely many pairs of prime numbers p, p + 2). For a discussion of the progress made since the appearance of the original AKS-algorithm we refer to the survey paper by Bernstein [3]). 5 P N P? In view of the primality test of Agrawal and his students it follows that the decision problem Primes P. On the other side, the integer factoring problem, Factoring: given an integer N, find the prime factzorization of N, is not expected to lie in P but in N P. The class N P is, roughly speaking, the class of decision problems having solutions that, once given, can be verified in polynomial time. By definition the classes P and N P seem to be quite different: solving a problem seems to be harder than verifying a given solution. In the language of prime numbers, it is rather difficult to factor a given large integer, e.g., N = , into its prime divisors, but it is easy to check whether or not is the prime factorization of N. Once the factorization of an integer is produced by some factoring algorithm, we can use the AKS-algorithm to test its factors on primality in polynomial time. This shows that Factoring N P. It is widely expected that Factoring does not lie in P; we already mentioned in Section 2 that public key-cryptography relies in the main part on this belief (however, this is not true for hypothetical quantum computers). Surprisingly, it seems to be rather difficult to find an example which is a member of N P but not of P. Moreover, it is an open problem to prove (or disprove) P N P. This fundamental conjecture in theoretical computer science is another millenium problem (see Problems/). We conclude our report on primes, primality testing and open problems with a nice quotation due to Paul Leyland who expressed his surprise about 183

14 R. Šleževičienė, J. Steuding, S. Turskienė the unexpected discovery of a simple deterministic polynomial time primality test by saying: Everyone is now wondering what else has been similarly overlooked. References 1. Agrawal M., Kayal N., Saxena N. Primes is in P, available at cse.iitk.ac.in/news/primality.html 2. Alford W.R., Granville A., Pomerance C. There are infinitely many Carmichael numbers, Ann. of Math., 139, p , Bernstein D. Proving primality after Agrawal-Kayal-Saxena, available at aks 4. Crandall R., Pomerance C. Prime numbers a computational perspective, Springer Fouvry E. Théorème de Brun-Titchmarsh; application à théorème de Fermat, Inventiones, 79, p , Gauss C.F. Disquisitiones arithmeticae, Yale University Press, New Haven, translated by A.A. Clarke, Ribbenboim P. The new book of prime number records, Springer, 3rd ed.,

### Primality - Factorization

Primality - Factorization Christophe Ritzenthaler November 9, 2009 1 Prime and factorization Definition 1.1. An integer p > 1 is called a prime number (nombre premier) if it has only 1 and p as divisors.

### Is this number prime? Berkeley Math Circle Kiran Kedlaya

Is this number prime? Berkeley Math Circle 2002 2003 Kiran Kedlaya Given a positive integer, how do you check whether it is prime (has itself and 1 as its only two positive divisors) or composite (not

### Prime Numbers The generation of prime numbers is needed for many public key algorithms:

CA547: CRYPTOGRAPHY AND SECURITY PROTOCOLS 1 7 Number Theory 2 7.1 Prime Numbers Prime Numbers The generation of prime numbers is needed for many public key algorithms: RSA: Need to find p and q to compute

### Prime Numbers. Chapter Primes and Composites

Chapter 2 Prime Numbers The term factoring or factorization refers to the process of expressing an integer as the product of two or more integers in a nontrivial way, e.g., 42 = 6 7. Prime numbers are

### U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009. Notes on Algebra

U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009 Notes on Algebra These notes contain as little theory as possible, and most results are stated without proof. Any introductory

### Factoring & Primality

Factoring & Primality Lecturer: Dimitris Papadopoulos In this lecture we will discuss the problem of integer factorization and primality testing, two problems that have been the focus of a great amount

### FACTORING. n = 2 25 + 1. fall in the arithmetic sequence

FACTORING The claim that factorization is harder than primality testing (or primality certification) is not currently substantiated rigorously. As some sort of backward evidence that factoring is hard,

### Doug Ravenel. October 15, 2008

Doug Ravenel University of Rochester October 15, 2008 s about Euclid s Some s about primes that every mathematician should know (Euclid, 300 BC) There are infinitely numbers. is very elementary, and we

### (x + a) n = x n + a Z n [x]. Proof. If n is prime then the map

22. A quick primality test Prime numbers are one of the most basic objects in mathematics and one of the most basic questions is to decide which numbers are prime (a clearly related problem is to find

### Lecture 13 - Basic Number Theory.

Lecture 13 - Basic Number Theory. Boaz Barak March 22, 2010 Divisibility and primes Unless mentioned otherwise throughout this lecture all numbers are non-negative integers. We say that A divides B, denoted

### Is n a prime number? Nitin Saxena. Turku, May Centrum voor Wiskunde en Informatica Amsterdam

Is n a prime number? Nitin Saxena Centrum voor Wiskunde en Informatica Amsterdam Turku, May 2007 Nitin Saxena (CWI, Amsterdam) Is n a prime number? Turku, May 2007 1 / 36 Outline 1 The Problem 2 The High

### 2 Primality and Compositeness Tests

Int. J. Contemp. Math. Sciences, Vol. 3, 2008, no. 33, 1635-1642 On Factoring R. A. Mollin Department of Mathematics and Statistics University of Calgary, Calgary, Alberta, Canada, T2N 1N4 http://www.math.ucalgary.ca/

### Solutions to Practice Problems

Solutions to Practice Problems March 205. Given n = pq and φ(n = (p (q, we find p and q as the roots of the quadratic equation (x p(x q = x 2 (n φ(n + x + n = 0. The roots are p, q = 2[ n φ(n+ ± (n φ(n+2

### Elementary Number Theory We begin with a bit of elementary number theory, which is concerned

CONSTRUCTION OF THE FINITE FIELDS Z p S. R. DOTY Elementary Number Theory We begin with a bit of elementary number theory, which is concerned solely with questions about the set of integers Z = {0, ±1,

### Prime and Composite Terms in Sloane s Sequence A056542

1 2 3 47 6 23 11 Journal of Integer Sequences, Vol. 8 (2005), Article 05.3.3 Prime and Composite Terms in Sloane s Sequence A056542 Tom Müller Institute for Cusanus-Research University and Theological

### STRUCTURE AND RANDOMNESS IN THE PRIME NUMBERS. 1. Introduction. The prime numbers 2, 3, 5, 7,... are one of the oldest topics studied in mathematics.

STRUCTURE AND RANDOMNESS IN THE PRIME NUMBERS TERENCE TAO Abstract. A quick tour through some topics in analytic prime number theory.. Introduction The prime numbers 2, 3, 5, 7,... are one of the oldest

### Is n a Prime Number? Manindra Agrawal. March 27, 2006, Delft. IIT Kanpur

Is n a Prime Number? Manindra Agrawal IIT Kanpur March 27, 2006, Delft Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 1 / 47 Overview 1 The Problem 2 Two Simple, and Slow, Methods

### Faster deterministic integer factorisation

David Harvey (joint work with Edgar Costa, NYU) University of New South Wales 25th October 2011 The obvious mathematical breakthrough would be the development of an easy way to factor large prime numbers

### Prime numbers and prime polynomials. Paul Pollack Dartmouth College

Prime numbers and prime polynomials Paul Pollack Dartmouth College May 1, 2008 Analogies everywhere! Analogies in elementary number theory (continued fractions, quadratic reciprocity, Fermat s last theorem)

### ORDERS OF ELEMENTS IN A GROUP

ORDERS OF ELEMENTS IN A GROUP KEITH CONRAD 1. Introduction Let G be a group and g G. We say g has finite order if g n = e for some positive integer n. For example, 1 and i have finite order in C, since

### Lecture 3. Mathematical Induction

Lecture 3 Mathematical Induction Induction is a fundamental reasoning process in which general conclusion is based on particular cases It contrasts with deduction, the reasoning process in which conclusion

### Factoring integers, Producing primes and the RSA cryptosystem Harish-Chandra Research Institute

RSA cryptosystem HRI, Allahabad, February, 2005 0 Factoring integers, Producing primes and the RSA cryptosystem Harish-Chandra Research Institute Allahabad (UP), INDIA February, 2005 RSA cryptosystem HRI,

### EULER S THEOREM. 1. Introduction Fermat s little theorem is an important property of integers to a prime modulus. a p 1 1 mod p.

EULER S THEOREM KEITH CONRAD. Introduction Fermat s little theorem is an important property of integers to a prime modulus. Theorem. (Fermat). For prime p and any a Z such that a 0 mod p, a p mod p. If

### Practice Problems for First Test

Mathematicians have tried in vain to this day to discover some order in the sequence of prime numbers, and we have reason to believe that it is a mystery into which the human mind will never penetrate.-

### MA257: INTRODUCTION TO NUMBER THEORY LECTURE NOTES

MA257: INTRODUCTION TO NUMBER THEORY LECTURE NOTES 2016 47 4. Diophantine Equations A Diophantine Equation is simply an equation in one or more variables for which integer (or sometimes rational) solutions

### CONTINUED FRACTIONS AND FACTORING. Niels Lauritzen

CONTINUED FRACTIONS AND FACTORING Niels Lauritzen ii NIELS LAURITZEN DEPARTMENT OF MATHEMATICAL SCIENCES UNIVERSITY OF AARHUS, DENMARK EMAIL: niels@imf.au.dk URL: http://home.imf.au.dk/niels/ Contents

### Integer Factorization using the Quadratic Sieve

Integer Factorization using the Quadratic Sieve Chad Seibert* Division of Science and Mathematics University of Minnesota, Morris Morris, MN 56567 seib0060@morris.umn.edu March 16, 2011 Abstract We give

### Notes on Factoring. MA 206 Kurt Bryan

The General Approach Notes on Factoring MA 26 Kurt Bryan Suppose I hand you n, a 2 digit integer and tell you that n is composite, with smallest prime factor around 5 digits. Finding a nontrivial factor

### 8 Primes and Modular Arithmetic

8 Primes and Modular Arithmetic 8.1 Primes and Factors Over two millennia ago already, people all over the world were considering the properties of numbers. One of the simplest concepts is prime numbers.

### Summer High School 2009 Aaron Bertram. 1. Prime Numbers. Let s start with some notation:

Summer High School 2009 Aaron Bertram 1. Prime Numbers. Let s start with some notation: N = {1, 2, 3, 4, 5,...} is the (infinite) set of natural numbers. Z = {..., 3, 2, 1, 0, 1, 2, 3,...} is the set of

### On Generalized Fermat Numbers 3 2n +1

Applied Mathematics & Information Sciences 4(3) (010), 307 313 An International Journal c 010 Dixie W Publishing Corporation, U. S. A. On Generalized Fermat Numbers 3 n +1 Amin Witno Department of Basic

### THE MATHEMATICS OF PUBLIC KEY CRYPTOGRAPHY.

THE MATHEMATICS OF PUBLIC KEY CRYPTOGRAPHY. IAN KIMING 1. Forbemærkning. Det kan forekomme idiotisk, at jeg som dansktalende og skrivende i et danskbaseret tidsskrift med en (formentlig) primært dansktalende

### 3. Applications of Number Theory

3. APPLICATIONS OF NUMBER THEORY 163 3. Applications of Number Theory 3.1. Representation of Integers. Theorem 3.1.1. Given an integer b > 1, every positive integer n can be expresses uniquely as n = a

### Primes in Sequences. Lee 1. By: Jae Young Lee. Project for MA 341 (Number Theory) Boston University Summer Term I 2009 Instructor: Kalin Kostadinov

Lee 1 Primes in Sequences By: Jae Young Lee Project for MA 341 (Number Theory) Boston University Summer Term I 2009 Instructor: Kalin Kostadinov Lee 2 Jae Young Lee MA341 Number Theory PRIMES IN SEQUENCES

### Revised Version of Chapter 23. We learned long ago how to solve linear congruences. ax c (mod m)

Chapter 23 Squares Modulo p Revised Version of Chapter 23 We learned long ago how to solve linear congruences ax c (mod m) (see Chapter 8). It s now time to take the plunge and move on to quadratic equations.

### Mathematics of Cryptography

CHAPTER 2 Mathematics of Cryptography Part I: Modular Arithmetic, Congruence, and Matrices Objectives This chapter is intended to prepare the reader for the next few chapters in cryptography. The chapter

### Prime Numbers and Irreducible Polynomials

Prime Numbers and Irreducible Polynomials M. Ram Murty The similarity between prime numbers and irreducible polynomials has been a dominant theme in the development of number theory and algebraic geometry.

### MATH10040 Chapter 2: Prime and relatively prime numbers

MATH10040 Chapter 2: Prime and relatively prime numbers Recall the basic definition: 1. Prime numbers Definition 1.1. Recall that a positive integer is said to be prime if it has precisely two positive

### International Journal of Information Technology, Modeling and Computing (IJITMC) Vol.1, No.3,August 2013

FACTORING CRYPTOSYSTEM MODULI WHEN THE CO-FACTORS DIFFERENCE IS BOUNDED Omar Akchiche 1 and Omar Khadir 2 1,2 Laboratory of Mathematics, Cryptography and Mechanics, Fstm, University of Hassan II Mohammedia-Casablanca,

### MA2C03 Mathematics School of Mathematics, Trinity College Hilary Term 2016 Lecture 59 (April 1, 2016) David R. Wilkins

MA2C03 Mathematics School of Mathematics, Trinity College Hilary Term 2016 Lecture 59 (April 1, 2016) David R. Wilkins The RSA encryption scheme works as follows. In order to establish the necessary public

### 11 Ideals. 11.1 Revisiting Z

11 Ideals The presentation here is somewhat different than the text. In particular, the sections do not match up. We have seen issues with the failure of unique factorization already, e.g., Z[ 5] = O Q(

### MATH 168: FINAL PROJECT Troels Eriksen. 1 Introduction

MATH 168: FINAL PROJECT Troels Eriksen 1 Introduction In the later years cryptosystems using elliptic curves have shown up and are claimed to be just as secure as a system like RSA with much smaller key

### CHAPTER SIX IRREDUCIBILITY AND FACTORIZATION 1. BASIC DIVISIBILITY THEORY

January 10, 2010 CHAPTER SIX IRREDUCIBILITY AND FACTORIZATION 1. BASIC DIVISIBILITY THEORY The set of polynomials over a field F is a ring, whose structure shares with the ring of integers many characteristics.

### Homework 5 Solutions

Homework 5 Solutions 4.2: 2: a. 321 = 256 + 64 + 1 = (01000001) 2 b. 1023 = 512 + 256 + 128 + 64 + 32 + 16 + 8 + 4 + 2 + 1 = (1111111111) 2. Note that this is 1 less than the next power of 2, 1024, which

### NUMBER THEORY AMIN WITNO

NUMBER THEORY AMIN WITNO ii Number Theory Amin Witno Department of Basic Sciences Philadelphia University JORDAN 19392 Originally written for Math 313 students at Philadelphia University in Jordan, this

### ELLIPTIC CURVES AND LENSTRA S FACTORIZATION ALGORITHM

ELLIPTIC CURVES AND LENSTRA S FACTORIZATION ALGORITHM DANIEL PARKER Abstract. This paper provides a foundation for understanding Lenstra s Elliptic Curve Algorithm for factoring large numbers. We give

### OPENING THE BLACK BOX OF RANDOM NUMBERS

International Journal of Pure and Applied Mathematics Volume 81 No. 6 2012, 831-839 ISSN: 1311-8080 (printed version) url: http://www.ijpam.eu PA ijpam.eu OPENING THE BLACK BOX OF RANDOM NUMBERS Yutaka

### Odd Perfect Numbers. way back to the ancient Greek era. A perfect number is both a positive integer that is the sum of

Stephanie Mijat Math 301 Odd Perfect Numbers Perfect numbers have been an interesting topic of study for mathematicians dating all the way back to the ancient Greek era. A perfect number is both a positive

### Discrete Mathematics, Chapter 4: Number Theory and Cryptography

Discrete Mathematics, Chapter 4: Number Theory and Cryptography Richard Mayr University of Edinburgh, UK Richard Mayr (University of Edinburgh, UK) Discrete Mathematics. Chapter 4 1 / 35 Outline 1 Divisibility

### Lecture 1: Elementary Number Theory

Lecture 1: Elementary Number Theory The integers are the simplest and most fundamental objects in discrete mathematics. All calculations by computers are based on the arithmetical operations with integers

### An Overview of Integer Factoring Algorithms. The Problem

An Overview of Integer Factoring Algorithms Manindra Agrawal IITK / NUS The Problem Given an integer n, find all its prime divisors as efficiently as possible. 1 A Difficult Problem No efficient algorithm

### Structure and randomness in the prime numbers. Science colloquium January 17, A small selection of results in number theory. Terence Tao (UCLA)

Structure and randomness in the prime numbers A small selection of results in number theory Science colloquium January 17, 2007 Terence Tao (UCLA) 1 Prime numbers A prime number is a natural number larger

### The van Hoeij Algorithm for Factoring Polynomials

The van Hoeij Algorithm for Factoring Polynomials Jürgen Klüners Abstract In this survey we report about a new algorithm for factoring polynomials due to Mark van Hoeij. The main idea is that the combinatorial

### WHAT ARE MATHEMATICAL PROOFS AND WHY THEY ARE IMPORTANT?

WHAT ARE MATHEMATICAL PROOFS AND WHY THEY ARE IMPORTANT? introduction Many students seem to have trouble with the notion of a mathematical proof. People that come to a course like Math 216, who certainly

### Factoring integers and Producing primes

Factoring integers,..., RSA Erbil, Kurdistan 0 Lecture in Number Theory College of Sciences Department of Mathematics University of Salahaddin Debember 4, 2014 Factoring integers and Producing primes Francesco

### Factoring Algorithms

Factoring Algorithms The p 1 Method and Quadratic Sieve November 17, 2008 () Factoring Algorithms November 17, 2008 1 / 12 Fermat s factoring method Fermat made the observation that if n has two factors

### Computational Number Theory

Computational Number Theory C. Pomerance 1 Introduction Historically, computation has been a driving force in the development of mathematics. To help measure the sizes of their fields, the Egyptians invented

### Further linear algebra. Chapter I. Integers.

Further linear algebra. Chapter I. Integers. Andrei Yafaev Number theory is the theory of Z = {0, ±1, ±2,...}. 1 Euclid s algorithm, Bézout s identity and the greatest common divisor. We say that a Z divides

### The Laws of Cryptography Cryptographers Favorite Algorithms

2 The Laws of Cryptography Cryptographers Favorite Algorithms 2.1 The Extended Euclidean Algorithm. The previous section introduced the field known as the integers mod p, denoted or. Most of the field

### Primality Testing and Factorization Methods

Primality Testing and Factorization Methods Eli Howey May 27, 2014 Abstract Since the days of Euclid and Eratosthenes, mathematicians have taken a keen interest in finding the nontrivial factors of integers,

### ON INTEGERS EXPRESSIBLE BY SOME SPECIAL LINEAR FORM

Acta Math. Univ. Comenianae Vol. LXXXI, (01), pp. 03 09 03 ON INTEGERS EXPRESSIBLE BY SOME SPECIAL LINEAR FORM A. DUBICKAS and A. NOVIKAS Abstract. Let E(4) be the set of positive integers expressible

### Homework until Test #2

MATH31: Number Theory Homework until Test # Philipp BRAUN Section 3.1 page 43, 1. It has been conjectured that there are infinitely many primes of the form n. Exhibit five such primes. Solution. Five such

### MTH 382 Number Theory Spring 2003 Practice Problems for the Final

MTH 382 Number Theory Spring 2003 Practice Problems for the Final (1) Find the quotient and remainder in the Division Algorithm, (a) with divisor 16 and dividend 95, (b) with divisor 16 and dividend -95,

### Arithmetic algorithms for cryptology 5 October 2015, Paris. Sieves. Razvan Barbulescu CNRS and IMJ-PRG. R. Barbulescu Sieves 0 / 28

Arithmetic algorithms for cryptology 5 October 2015, Paris Sieves Razvan Barbulescu CNRS and IMJ-PRG R. Barbulescu Sieves 0 / 28 Starting point Notations q prime g a generator of (F q ) X a (secret) integer

### PRIMES is in P. Manindra Agrawal Neeraj Kayal Nitin Saxena

PRIMES is in P Manindra Agrawal Neeraj Kayal Nitin Saxena Department of Computer Science & Engineering Indian Institute of Technology Kanpur Kanpur-208016, INDIA Email: {manindra,kayaln,nitinsa}@iitk.ac.in

### Alex, I will take congruent numbers for one million dollars please

Alex, I will take congruent numbers for one million dollars please Jim L. Brown The Ohio State University Columbus, OH 4310 jimlb@math.ohio-state.edu One of the most alluring aspectives of number theory

### Continued Fractions. Darren C. Collins

Continued Fractions Darren C Collins Abstract In this paper, we discuss continued fractions First, we discuss the definition and notation Second, we discuss the development of the subject throughout history

### MATH 361: NUMBER THEORY FIRST LECTURE

MATH 361: NUMBER THEORY FIRST LECTURE 1. Introduction As a provisional definition, view number theory as the study of the properties of the positive integers, Z + = {1, 2, 3, }. Of particular interest,

### a = bq + r where 0 r < b.

Lecture 5: Euclid s algorithm Introduction The fundamental arithmetic operations are addition, subtraction, multiplication and division. But there is a fifth operation which I would argue is just as fundamental

### Module MA3411: Abstract Algebra Galois Theory Appendix Michaelmas Term 2013

Module MA3411: Abstract Algebra Galois Theory Appendix Michaelmas Term 2013 D. R. Wilkins Copyright c David R. Wilkins 1997 2013 Contents A Cyclotomic Polynomials 79 A.1 Minimum Polynomials of Roots of

### Number Theory Hungarian Style. Cameron Byerley s interpretation of Csaba Szabó s lectures

Number Theory Hungarian Style Cameron Byerley s interpretation of Csaba Szabó s lectures August 20, 2005 2 0.1 introduction Number theory is a beautiful subject and even cooler when you learn about it

### CHAPTER 5. Number Theory. 1. Integers and Division. Discussion

CHAPTER 5 Number Theory 1. Integers and Division 1.1. Divisibility. Definition 1.1.1. Given two integers a and b we say a divides b if there is an integer c such that b = ac. If a divides b, we write a

### Mathematics of Cryptography Part I

CHAPTER 2 Mathematics of Cryptography Part I (Solution to Odd-Numbered Problems) Review Questions 1. The set of integers is Z. It contains all integral numbers from negative infinity to positive infinity.

### Mathematics is the queen of sciences and number theory is the queen of mathematics.

Number Theory Mathematics is the queen of sciences and number theory is the queen of mathematics. But why is it computer science? It turns out to be critical for cryptography! Carl Friedrich Gauss Division

### The Quadratic Sieve Factoring Algorithm

The Quadratic Sieve Factoring Algorithm Eric Landquist MATH 488: Cryptographic Algorithms December 14, 2001 1 Introduction Mathematicians have been attempting to find better and faster ways to factor composite

### Factoring integers, Producing primes and the RSA cryptosystem

Factoring integers,..., RSA Erbil, Kurdistan 0 Lecture in Number Theory College of Sciences Department of Mathematics University of Salahaddin Debember 1, 2014 Factoring integers, Producing primes and

MODULAR ARITHMETIC KEITH CONRAD. Introduction We will define the notion of congruent integers (with respect to a modulus) and develop some basic ideas of modular arithmetic. Applications of modular arithmetic

### Chapter 6. Number Theory. 6.1 The Division Algorithm

Chapter 6 Number Theory The material in this chapter offers a small glimpse of why a lot of facts that you ve probably nown and used for a long time are true. It also offers some exposure to generalization,

### Factorization Methods: Very Quick Overview

Factorization Methods: Very Quick Overview Yuval Filmus October 17, 2012 1 Introduction In this lecture we introduce modern factorization methods. We will assume several facts from analytic number theory.

### Continued fractions and good approximations.

Continued fractions and good approximations We will study how to find good approximations for important real life constants A good approximation must be both accurate and easy to use For instance, our

### Chapter 4, Arithmetic in F [x] Polynomial arithmetic and the division algorithm.

Chapter 4, Arithmetic in F [x] Polynomial arithmetic and the division algorithm. We begin by defining the ring of polynomials with coefficients in a ring R. After some preliminary results, we specialize

### An Introductory Course in Elementary Number Theory. Wissam Raji

An Introductory Course in Elementary Number Theory Wissam Raji 2 Preface These notes serve as course notes for an undergraduate course in number theory. Most if not all universities worldwide offer introductory

### SUM OF TWO SQUARES JAHNAVI BHASKAR

SUM OF TWO SQUARES JAHNAVI BHASKAR Abstract. I will investigate which numbers can be written as the sum of two squares and in how many ways, providing enough basic number theory so even the unacquainted

### ALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION

ALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION Aldrin W. Wanambisi 1* School of Pure and Applied Science, Mount Kenya University, P.O box 553-50100, Kakamega, Kenya. Shem Aywa 2 Department of Mathematics,

### The Mathematics of the RSA Public-Key Cryptosystem

The Mathematics of the RSA Public-Key Cryptosystem Burt Kaliski RSA Laboratories ABOUT THE AUTHOR: Dr Burt Kaliski is a computer scientist whose involvement with the security industry has been through

### Mathematics of Cryptography Modular Arithmetic, Congruence, and Matrices. A Biswas, IT, BESU SHIBPUR

Mathematics of Cryptography Modular Arithmetic, Congruence, and Matrices A Biswas, IT, BESU SHIBPUR McGraw-Hill The McGraw-Hill Companies, Inc., 2000 Set of Integers The set of integers, denoted by Z,

### Determining the Optimal Combination of Trial Division and Fermat s Factorization Method

Determining the Optimal Combination of Trial Division and Fermat s Factorization Method Joseph C. Woodson Home School P. O. Box 55005 Tulsa, OK 74155 Abstract The process of finding the prime factorization

### Series. Chapter Convergence of series

Chapter 4 Series Divergent series are the devil, and it is a shame to base on them any demonstration whatsoever. Niels Henrik Abel, 826 This series is divergent, therefore we may be able to do something

### On the largest prime factor of x 2 1

On the largest prime factor of x 2 1 Florian Luca and Filip Najman Abstract In this paper, we find all integers x such that x 2 1 has only prime factors smaller than 100. This gives some interesting numerical

### MOP 2007 Black Group Integer Polynomials Yufei Zhao. Integer Polynomials. June 29, 2007 Yufei Zhao yufeiz@mit.edu

Integer Polynomials June 9, 007 Yufei Zhao yufeiz@mit.edu We will use Z[x] to denote the ring of polynomials with integer coefficients. We begin by summarizing some of the common approaches used in dealing

### CHAPTER 5: MODULAR ARITHMETIC

CHAPTER 5: MODULAR ARITHMETIC LECTURE NOTES FOR MATH 378 (CSUSM, SPRING 2009). WAYNE AITKEN 1. Introduction In this chapter we will consider congruence modulo m, and explore the associated arithmetic called

### Continued Fractions and the Euclidean Algorithm

Continued Fractions and the Euclidean Algorithm Lecture notes prepared for MATH 326, Spring 997 Department of Mathematics and Statistics University at Albany William F Hammond Table of Contents Introduction

### Students in their first advanced mathematics classes are often surprised

CHAPTER 8 Proofs Involving Sets Students in their first advanced mathematics classes are often surprised by the extensive role that sets play and by the fact that most of the proofs they encounter are

### CONTRIBUTIONS TO ZERO SUM PROBLEMS

CONTRIBUTIONS TO ZERO SUM PROBLEMS S. D. ADHIKARI, Y. G. CHEN, J. B. FRIEDLANDER, S. V. KONYAGIN AND F. PAPPALARDI Abstract. A prototype of zero sum theorems, the well known theorem of Erdős, Ginzburg

### Recent progress in additive prime number theory

Recent progress in additive prime number theory University of California, Los Angeles Mahler Lecture Series Additive prime number theory Additive prime number theory is the study of additive patterns in

### = 2 + 1 2 2 = 3 4, Now assume that P (k) is true for some fixed k 2. This means that

Instructions. Answer each of the questions on your own paper, and be sure to show your work so that partial credit can be adequately assessed. Credit will not be given for answers (even correct ones) without

### 2 The Euclidean algorithm

2 The Euclidean algorithm Do you understand the number 5? 6? 7? At some point our level of comfort with individual numbers goes down as the numbers get large For some it may be at 43, for others, 4 In

### Pr ime Tuples in Function Fields

Snapshots of modern mathematics from Oberwolfach 10/2016 Pr ime Tuples in Function Fields Lior Bar y- Soroker How many prime numbers are there? How are they distributed among other numbers? These are questions