Is n a Prime Number? Manindra Agrawal. March 27, 2006, Delft. IIT Kanpur
|
|
|
- Dayna Collins
- 8 years ago
- Views:
Transcription
1 Is n a Prime Number? Manindra Agrawal IIT Kanpur March 27, 2006, Delft Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 1 / 47
2 Overview 1 The Problem 2 Two Simple, and Slow, Methods 3 Modern Methods 4 Algorithms Based on Factorization of Group Size 5 Algorithms Based on Fermat s Little Theorem 6 An Algorithm Outside the Two Themes Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 2 / 47
3 Outline 1 The Problem 2 Two Simple, and Slow, Methods 3 Modern Methods 4 Algorithms Based on Factorization of Group Size 5 Algorithms Based on Fermat s Little Theorem 6 An Algorithm Outside the Two Themes Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 3 / 47
4 The Problem Given a number n, decide if it is prime. Easy: try dividing by all numbers less than n. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 4 / 47
5 The Problem Given a number n, decide if it is prime. Easy: try dividing by all numbers less than n. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 4 / 47
6 The Problem Given a number n, decide if it is prime efficiently. Not so easy: several non-obvious methods have been found. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 5 / 47
7 The Problem Given a number n, decide if it is prime efficiently. Not so easy: several non-obvious methods have been found. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 5 / 47
8 Efficiently Solving a Problem There should exist an algorithm for solving the problem taking a polynomial in input size number of steps. For our problem, this means an algorithm taking log O(1) n steps. Caveat: An algorithm taking log 12 n steps would be slower than an algorithm taking log log log log n n steps for all practical values of n! Notation: log is logarithm base 2. O (log c n) stands for O(log c n log log O(1) n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 6 / 47
9 Efficiently Solving a Problem There should exist an algorithm for solving the problem taking a polynomial in input size number of steps. For our problem, this means an algorithm taking log O(1) n steps. Caveat: An algorithm taking log 12 n steps would be slower than an algorithm taking log log log log n n steps for all practical values of n! Notation: log is logarithm base 2. O (log c n) stands for O(log c n log log O(1) n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 6 / 47
10 Efficiently Solving a Problem There should exist an algorithm for solving the problem taking a polynomial in input size number of steps. For our problem, this means an algorithm taking log O(1) n steps. Caveat: An algorithm taking log 12 n steps would be slower than an algorithm taking log log log log n n steps for all practical values of n! Notation: log is logarithm base 2. O (log c n) stands for O(log c n log log O(1) n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 6 / 47
11 Efficiently Solving a Problem There should exist an algorithm for solving the problem taking a polynomial in input size number of steps. For our problem, this means an algorithm taking log O(1) n steps. Caveat: An algorithm taking log 12 n steps would be slower than an algorithm taking log log log log n n steps for all practical values of n! Notation: log is logarithm base 2. O (log c n) stands for O(log c n log log O(1) n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 6 / 47
12 Outline 1 The Problem 2 Two Simple, and Slow, Methods 3 Modern Methods 4 Algorithms Based on Factorization of Group Size 5 Algorithms Based on Fermat s Little Theorem 6 An Algorithm Outside the Two Themes Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 7 / 47
13 The Sieve of Eratosthenes Proposed by Eratosthenes (ca. 300 BCE). 1 List all numbers from 2 to n in a sequence. 2 Take the smallest uncrossed number from the sequence and cross out all its multiples. 3 If n is uncrossed when the smallest uncrossed number is greater than n then n is prime otherwise composite. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 8 / 47
14 Time Complexity If n is prime, algorithm crosses out all the first n numbers before giving the answer. So the number of steps needed is Ω( n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 9 / 47
15 Time Complexity If n is prime, algorithm crosses out all the first n numbers before giving the answer. So the number of steps needed is Ω( n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 9 / 47
16 Wilson s Theorem Based on Wilson s theorem (1770). Theorem n is prime iff (n 1)! = 1 (mod n). Computing (n 1)! (mod n) naïvely requires Ω(n) steps. No significantly better method is known! Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 10 / 47
17 Wilson s Theorem Based on Wilson s theorem (1770). Theorem n is prime iff (n 1)! = 1 (mod n). Computing (n 1)! (mod n) naïvely requires Ω(n) steps. No significantly better method is known! Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 10 / 47
18 Outline 1 The Problem 2 Two Simple, and Slow, Methods 3 Modern Methods 4 Algorithms Based on Factorization of Group Size 5 Algorithms Based on Fermat s Little Theorem 6 An Algorithm Outside the Two Themes Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 11 / 47
19 Fundamental Idea Nearly all the efficient algorithms for the problem use the following idea. Identify a finite group G related to number n. Design an efficienty testable property P( ) of the elements G such that P(e) has different values depending on whether n is prime. The element e is either from a small set (in deterministic algorithms) or a random element of G (in randomized algorithms). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 12 / 47
20 Fundamental Idea Nearly all the efficient algorithms for the problem use the following idea. Identify a finite group G related to number n. Design an efficienty testable property P( ) of the elements G such that P(e) has different values depending on whether n is prime. The element e is either from a small set (in deterministic algorithms) or a random element of G (in randomized algorithms). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 12 / 47
21 Fundamental Idea Nearly all the efficient algorithms for the problem use the following idea. Identify a finite group G related to number n. Design an efficienty testable property P( ) of the elements G such that P(e) has different values depending on whether n is prime. The element e is either from a small set (in deterministic algorithms) or a random element of G (in randomized algorithms). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 12 / 47
22 Fundamental Idea Nearly all the efficient algorithms for the problem use the following idea. Identify a finite group G related to number n. Design an efficienty testable property P( ) of the elements G such that P(e) has different values depending on whether n is prime. The element e is either from a small set (in deterministic algorithms) or a random element of G (in randomized algorithms). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 12 / 47
23 Groups and Properties The group G is often: A subgroup of Z n or Z n [ζ] for an extension ring Z n [ζ]. A subgroup of E(Z n ), the set of points on an elliptic curve modulo n. The properties vary, but are from two broad themes. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 13 / 47
24 Groups and Properties The group G is often: A subgroup of Z n or Z n [ζ] for an extension ring Z n [ζ]. A subgroup of E(Z n ), the set of points on an elliptic curve modulo n. The properties vary, but are from two broad themes. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 13 / 47
25 Groups and Properties The group G is often: A subgroup of Z n or Z n [ζ] for an extension ring Z n [ζ]. A subgroup of E(Z n ), the set of points on an elliptic curve modulo n. The properties vary, but are from two broad themes. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 13 / 47
26 Theme I: Factorization of Group Size Compute a complete, or partial, factorization of the size of G assuming that n is prime. Use the knowledge of this factorization to design a suitable property. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 14 / 47
27 Theme I: Factorization of Group Size Compute a complete, or partial, factorization of the size of G assuming that n is prime. Use the knowledge of this factorization to design a suitable property. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 14 / 47
28 Theme II: Fermat s Little Theorem Theorem (Fermat, 1660s) If n is prime then for every e, e n = e (mod n). Group G = Z n and property P is P(e) e n = e in G. This property of Z n is not a sufficient test for primality of n. So try to extend this property to a neccessary and sufficient condition. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 15 / 47
29 Theme II: Fermat s Little Theorem Theorem (Fermat, 1660s) If n is prime then for every e, e n = e (mod n). Group G = Z n and property P is P(e) e n = e in G. This property of Z n is not a sufficient test for primality of n. So try to extend this property to a neccessary and sufficient condition. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 15 / 47
30 Outline 1 The Problem 2 Two Simple, and Slow, Methods 3 Modern Methods 4 Algorithms Based on Factorization of Group Size 5 Algorithms Based on Fermat s Little Theorem 6 An Algorithm Outside the Two Themes Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 16 / 47
31 Lucas Theorem Theorem (E. Lucas, 1891) Let n 1 = t i=1 pd i i where p i s are distinct primes. n is prime iff there is an e Z n such that e n 1 = 1 and gcd(e n 1 p i 1, n) = 1 for every 1 i t. The theorem also holds for a random choice of e. We can choose G = Z n and P to be the property above. The test will be efficient only for numbers n such that n 1 is smooth. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 17 / 47
32 Lucas Theorem Theorem (E. Lucas, 1891) Let n 1 = t i=1 pd i i where p i s are distinct primes. n is prime iff there is an e Z n such that e n 1 = 1 and gcd(e n 1 p i 1, n) = 1 for every 1 i t. The theorem also holds for a random choice of e. We can choose G = Z n and P to be the property above. The test will be efficient only for numbers n such that n 1 is smooth. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 17 / 47
33 Lucas Theorem Theorem (E. Lucas, 1891) Let n 1 = t i=1 pd i i where p i s are distinct primes. n is prime iff there is an e Z n such that e n 1 = 1 and gcd(e n 1 p i 1, n) = 1 for every 1 i t. The theorem also holds for a random choice of e. We can choose G = Z n and P to be the property above. The test will be efficient only for numbers n such that n 1 is smooth. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 17 / 47
34 Lucas-Lehmer Test G is a subgroup of Z n [ 3] containing elements of order n + 1. The property P is: P(e) e n+1 2 = 1 in Z n [ 3]. Works only for special Mersenne primes of the form n = 2 p 1, p prime. For such n s, n + 1 = 2 p. The property needs to be tested only for e = Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 18 / 47
35 Lucas-Lehmer Test G is a subgroup of Z n [ 3] containing elements of order n + 1. The property P is: P(e) e n+1 2 = 1 in Z n [ 3]. Works only for special Mersenne primes of the form n = 2 p 1, p prime. For such n s, n + 1 = 2 p. The property needs to be tested only for e = Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 18 / 47
36 Lucas-Lehmer Test G is a subgroup of Z n [ 3] containing elements of order n + 1. The property P is: P(e) e n+1 2 = 1 in Z n [ 3]. Works only for special Mersenne primes of the form n = 2 p 1, p prime. For such n s, n + 1 = 2 p. The property needs to be tested only for e = Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 18 / 47
37 Time Complexity Raising to n+1 2 th power requires O(log n) multiplication operations in Z n. Overall time complexity is O (log 2 n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 19 / 47
38 Time Complexity Raising to n+1 2 th power requires O(log n) multiplication operations in Z n. Overall time complexity is O (log 2 n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 19 / 47
39 Pocklington-Lehmer Test Theorem (Pocklington, 1914) If there exists a e such that e n 1 = 1 (mod n) and gcd(e n 1 p j 1, n) = 1 for distinct primes p 1, p 2,..., p t dividing n 1 then every prime factor of n has the form k t j=1 p j + 1. Similar to Lucas s theorem. Let G = Z n and property P precisely as in the theorem. The property is tested for a random e. For the test to work, we need t j=1 n. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 20 / 47
40 Pocklington-Lehmer Test Theorem (Pocklington, 1914) If there exists a e such that e n 1 = 1 (mod n) and gcd(e n 1 p j 1, n) = 1 for distinct primes p 1, p 2,..., p t dividing n 1 then every prime factor of n has the form k t j=1 p j + 1. Similar to Lucas s theorem. Let G = Z n and property P precisely as in the theorem. The property is tested for a random e. For the test to work, we need t j=1 n. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 20 / 47
41 Pocklington-Lehmer Test Theorem (Pocklington, 1914) If there exists a e such that e n 1 = 1 (mod n) and gcd(e n 1 p j 1, n) = 1 for distinct primes p 1, p 2,..., p t dividing n 1 then every prime factor of n has the form k t j=1 p j + 1. Similar to Lucas s theorem. Let G = Z n and property P precisely as in the theorem. The property is tested for a random e. For the test to work, we need t j=1 n. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 20 / 47
42 Time Complexity Depends on the difficulty of finding prime factorizations of n 1 whose product is at least n. Other operations can be carried out efficiently. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 21 / 47
43 Time Complexity Depends on the difficulty of finding prime factorizations of n 1 whose product is at least n. Other operations can be carried out efficiently. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 21 / 47
44 Elliptic Curves Based Tests Elliptic curves give rise to groups of different sizes associated with the given number. With good probability, some of these groups have sizes that can be easily factored. This motivated primality testing based on elliptic curves. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 22 / 47
45 Elliptic Curves Based Tests Elliptic curves give rise to groups of different sizes associated with the given number. With good probability, some of these groups have sizes that can be easily factored. This motivated primality testing based on elliptic curves. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 22 / 47
46 Elliptic Curves Based Tests Elliptic curves give rise to groups of different sizes associated with the given number. With good probability, some of these groups have sizes that can be easily factored. This motivated primality testing based on elliptic curves. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 22 / 47
47 Goldwasser-Kilian Test This is a randomized primality proving algorithm. Under a reasonable hypothesis, it is polynomial time on all inputs. Unconditionally, it is polynomial time on all but negligible fraction of numbers. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 23 / 47
48 Goldwasser-Kilian Test This is a randomized primality proving algorithm. Under a reasonable hypothesis, it is polynomial time on all inputs. Unconditionally, it is polynomial time on all but negligible fraction of numbers. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 23 / 47
49 Goldwasser-Kilian Test This is a randomized primality proving algorithm. Under a reasonable hypothesis, it is polynomial time on all inputs. Unconditionally, it is polynomial time on all but negligible fraction of numbers. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 23 / 47
50 Goldwasser-Kilian Test Consider a random elliptic curve over Z n. By a theorem of Lenstra (1987), the number of points of the curve is nearly uniformly distributed in the interval [n n, n n] for prime n. Assuming a conjecture about the density of primes in small intervals, it follows that there are curves with 2q points, for q prime, with reasonable probability. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 24 / 47
51 Goldwasser-Kilian Test Consider a random elliptic curve over Z n. By a theorem of Lenstra (1987), the number of points of the curve is nearly uniformly distributed in the interval [n n, n n] for prime n. Assuming a conjecture about the density of primes in small intervals, it follows that there are curves with 2q points, for q prime, with reasonable probability. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 24 / 47
52 Goldwasser-Kilian Test Consider a random elliptic curve over Z n. By a theorem of Lenstra (1987), the number of points of the curve is nearly uniformly distributed in the interval [n n, n n] for prime n. Assuming a conjecture about the density of primes in small intervals, it follows that there are curves with 2q points, for q prime, with reasonable probability. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 24 / 47
53 Goldwasser-Kilian Test Theorem (Goldwasser-Kilian) Suppose E(Z n ) is an elliptic curve with 2q points. If q is prime and there exists A E(Z n ) O such that q A = O then either n is provably prime or provably composite. Proof. Let p be a prime factor of n with p n. We have q A = O in E(Z p ) as well. If A = O in E(Z p ) then n can be factored. Otherwise, since q is prime, E(Z p ) q. If 2q < n n then n must be composite. Otherwise, p p > n 2 n which is not possible. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 25 / 47
54 Goldwasser-Kilian Test Theorem (Goldwasser-Kilian) Suppose E(Z n ) is an elliptic curve with 2q points. If q is prime and there exists A E(Z n ) O such that q A = O then either n is provably prime or provably composite. Proof. Let p be a prime factor of n with p n. We have q A = O in E(Z p ) as well. If A = O in E(Z p ) then n can be factored. Otherwise, since q is prime, E(Z p ) q. If 2q < n n then n must be composite. Otherwise, p p > n 2 n which is not possible. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 25 / 47
55 Goldwasser-Kilian Test Theorem (Goldwasser-Kilian) Suppose E(Z n ) is an elliptic curve with 2q points. If q is prime and there exists A E(Z n ) O such that q A = O then either n is provably prime or provably composite. Proof. Let p be a prime factor of n with p n. We have q A = O in E(Z p ) as well. If A = O in E(Z p ) then n can be factored. Otherwise, since q is prime, E(Z p ) q. If 2q < n n then n must be composite. Otherwise, p p > n 2 n which is not possible. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 25 / 47
56 Goldwasser-Kilian Test Theorem (Goldwasser-Kilian) Suppose E(Z n ) is an elliptic curve with 2q points. If q is prime and there exists A E(Z n ) O such that q A = O then either n is provably prime or provably composite. Proof. Let p be a prime factor of n with p n. We have q A = O in E(Z p ) as well. If A = O in E(Z p ) then n can be factored. Otherwise, since q is prime, E(Z p ) q. If 2q < n n then n must be composite. Otherwise, p p > n 2 n which is not possible. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 25 / 47
57 Goldwasser-Kilian Test 1 Find a random elliptic curve over Z n with 2q points. 2 Prove primality of q recursively. 3 Randomly select an A such that q A = O. 4 Infer n to be prime or composite. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 26 / 47
58 Goldwasser-Kilian Test 1 Find a random elliptic curve over Z n with 2q points. 2 Prove primality of q recursively. 3 Randomly select an A such that q A = O. 4 Infer n to be prime or composite. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 26 / 47
59 Goldwasser-Kilian Test 1 Find a random elliptic curve over Z n with 2q points. 2 Prove primality of q recursively. 3 Randomly select an A such that q A = O. 4 Infer n to be prime or composite. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 26 / 47
60 Goldwasser-Kilian Test 1 Find a random elliptic curve over Z n with 2q points. 2 Prove primality of q recursively. 3 Randomly select an A such that q A = O. 4 Infer n to be prime or composite. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 26 / 47
61 Analysis The algorithm never incorrectly classifies a composite number. With high probability it correctly classifies prime numbers. The running time is O(log 11 n). Improvements by Atkin and others result in a conjectured running time of O (log 4 n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 27 / 47
62 Analysis The algorithm never incorrectly classifies a composite number. With high probability it correctly classifies prime numbers. The running time is O(log 11 n). Improvements by Atkin and others result in a conjectured running time of O (log 4 n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 27 / 47
63 Analysis The algorithm never incorrectly classifies a composite number. With high probability it correctly classifies prime numbers. The running time is O(log 11 n). Improvements by Atkin and others result in a conjectured running time of O (log 4 n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 27 / 47
64 Analysis The algorithm never incorrectly classifies a composite number. With high probability it correctly classifies prime numbers. The running time is O(log 11 n). Improvements by Atkin and others result in a conjectured running time of O (log 4 n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 27 / 47
65 Adleman-Huang Test The previous test is not unconditionally polynomial time on a small fraction of numbers. Adleman-Huang (1992) removed this drawback. They first used hyperelliptic curves to reduce the problem of testing for n to that of a nearly random integer of similar size. Then the previous test works with high probability. The time complexity becomes O(log c n) for c > 30! Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 28 / 47
66 Adleman-Huang Test The previous test is not unconditionally polynomial time on a small fraction of numbers. Adleman-Huang (1992) removed this drawback. They first used hyperelliptic curves to reduce the problem of testing for n to that of a nearly random integer of similar size. Then the previous test works with high probability. The time complexity becomes O(log c n) for c > 30! Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 28 / 47
67 Adleman-Huang Test The previous test is not unconditionally polynomial time on a small fraction of numbers. Adleman-Huang (1992) removed this drawback. They first used hyperelliptic curves to reduce the problem of testing for n to that of a nearly random integer of similar size. Then the previous test works with high probability. The time complexity becomes O(log c n) for c > 30! Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 28 / 47
68 Outline 1 The Problem 2 Two Simple, and Slow, Methods 3 Modern Methods 4 Algorithms Based on Factorization of Group Size 5 Algorithms Based on Fermat s Little Theorem 6 An Algorithm Outside the Two Themes Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 29 / 47
69 Solovay-Strassen Test A Restatement of FLT If n is odd prime then for every e, 1 e < n, e n 1 2 = ±1 (mod n). When n is prime, e is a quadratic residue in Z n iff e n 1 2 = 1 (mod n). Therefore, if n is prime then ( e n ) = e n 1 2 (mod n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 30 / 47
70 Solovay-Strassen Test A Restatement of FLT If n is odd prime then for every e, 1 e < n, e n 1 2 = ±1 (mod n). When n is prime, e is a quadratic residue in Z n iff e n 1 2 = 1 (mod n). Therefore, if n is prime then ( e n ) = e n 1 2 (mod n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 30 / 47
71 Solovay-Strassen Test A Restatement of FLT If n is odd prime then for every e, 1 e < n, e n 1 2 = ±1 (mod n). When n is prime, e is a quadratic residue in Z n iff e n 1 2 = 1 (mod n). Therefore, if n is prime then ( e n ) = e n 1 2 (mod n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 30 / 47
72 Solovay-Strassen Test Proposed by Solovay and Strassen (1973). A randomized algorithm based on above property. Never incorrectly classifies primes and correctly classifies composites with probability at least 1 2. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 31 / 47
73 Solovay-Strassen Test Proposed by Solovay and Strassen (1973). A randomized algorithm based on above property. Never incorrectly classifies primes and correctly classifies composites with probability at least 1 2. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 31 / 47
74 Solovay-Strassen Test Proposed by Solovay and Strassen (1973). A randomized algorithm based on above property. Never incorrectly classifies primes and correctly classifies composites with probability at least 1 2. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 31 / 47
75 Solovay-Strassen Test 1 If n is an exact power, it is composite. 2 For a random e in Z n, test if ( e n ) = e n 1 2 (mod n). 3 If yes, classify n as prime otherwise it is proven composite. The time complexity is O (log 2 n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 32 / 47
76 Solovay-Strassen Test 1 If n is an exact power, it is composite. 2 For a random e in Z n, test if ( e n ) = e n 1 2 (mod n). 3 If yes, classify n as prime otherwise it is proven composite. The time complexity is O (log 2 n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 32 / 47
77 Solovay-Strassen Test 1 If n is an exact power, it is composite. 2 For a random e in Z n, test if ( e n ) = e n 1 2 (mod n). 3 If yes, classify n as prime otherwise it is proven composite. The time complexity is O (log 2 n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 32 / 47
78 Solovay-Strassen Test 1 If n is an exact power, it is composite. 2 For a random e in Z n, test if ( e n ) = e n 1 2 (mod n). 3 If yes, classify n as prime otherwise it is proven composite. The time complexity is O (log 2 n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 32 / 47
79 Analysis Consider the case when n is a product of two primes p and q. Let a, b Z p, c Z q with a residue and b non-residue in Z p. Clearly, < a, c > n 1 2 =< b, c > n 1 2 (mod q). If < a, c > n 1 2 < b, c > n 1 2 (mod n) then one of them is not in {1, 1} and so compositeness of n is proven. Otherwise, either ( < a, c > ) < a, c > n 1 2 (mod n), n or ( ) < b, c > n < b, c > n 1 2 (mod n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 33 / 47
80 Analysis Consider the case when n is a product of two primes p and q. Let a, b Z p, c Z q with a residue and b non-residue in Z p. Clearly, < a, c > n 1 2 =< b, c > n 1 2 (mod q). If < a, c > n 1 2 < b, c > n 1 2 (mod n) then one of them is not in {1, 1} and so compositeness of n is proven. Otherwise, either ( < a, c > ) < a, c > n 1 2 (mod n), n or ( ) < b, c > n < b, c > n 1 2 (mod n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 33 / 47
81 Analysis Consider the case when n is a product of two primes p and q. Let a, b Z p, c Z q with a residue and b non-residue in Z p. Clearly, < a, c > n 1 2 =< b, c > n 1 2 (mod q). If < a, c > n 1 2 < b, c > n 1 2 (mod n) then one of them is not in {1, 1} and so compositeness of n is proven. Otherwise, either ( < a, c > ) < a, c > n 1 2 (mod n), n or ( ) < b, c > n < b, c > n 1 2 (mod n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 33 / 47
82 Analysis Consider the case when n is a product of two primes p and q. Let a, b Z p, c Z q with a residue and b non-residue in Z p. Clearly, < a, c > n 1 2 =< b, c > n 1 2 (mod q). If < a, c > n 1 2 < b, c > n 1 2 (mod n) then one of them is not in {1, 1} and so compositeness of n is proven. Otherwise, either ( < a, c > ) < a, c > n 1 2 (mod n), n or ( ) < b, c > n < b, c > n 1 2 (mod n). Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 33 / 47
83 Miller s Test Theorem (Another Restatement of FLT) If n is odd prime and n = s t, t odd, then for every e, 1 e < n, the sequence e 2s 1 t (mod n), e 2s 2 t (mod n),..., e t (mod n) has either all 1 s or a 1 somewhere. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 34 / 47
84 Miller s Test This theorem is the basis for Miller s test (1973). It is a deterministic polynomial time test. It is correct under Extended Riemann Hypothesis. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 35 / 47
85 Miller s Test This theorem is the basis for Miller s test (1973). It is a deterministic polynomial time test. It is correct under Extended Riemann Hypothesis. Manindra Agrawal (IIT Kanpur) Is n a Prime Number? March 27, 2006, Delft 35 / 47
Primality - Factorization
Primality - Factorization Christophe Ritzenthaler November 9, 2009 1 Prime and factorization Definition 1.1. An integer p > 1 is called a prime number (nombre premier) if it has only 1 and p as divisors.
PRIMES is in P. Manindra Agrawal Neeraj Kayal Nitin Saxena
PRIMES is in P Manindra Agrawal Neeraj Kayal Nitin Saxena Department of Computer Science & Engineering Indian Institute of Technology Kanpur Kanpur-208016, INDIA Email: {manindra,kayaln,nitinsa}@iitk.ac.in
Faster deterministic integer factorisation
David Harvey (joint work with Edgar Costa, NYU) University of New South Wales 25th October 2011 The obvious mathematical breakthrough would be the development of an easy way to factor large prime numbers
Factoring integers, Producing primes and the RSA cryptosystem Harish-Chandra Research Institute
RSA cryptosystem HRI, Allahabad, February, 2005 0 Factoring integers, Producing primes and the RSA cryptosystem Harish-Chandra Research Institute Allahabad (UP), INDIA February, 2005 RSA cryptosystem HRI,
An Overview of Integer Factoring Algorithms. The Problem
An Overview of Integer Factoring Algorithms Manindra Agrawal IITK / NUS The Problem Given an integer n, find all its prime divisors as efficiently as possible. 1 A Difficult Problem No efficient algorithm
Factoring integers and Producing primes
Factoring integers,..., RSA Erbil, Kurdistan 0 Lecture in Number Theory College of Sciences Department of Mathematics University of Salahaddin Debember 4, 2014 Factoring integers and Producing primes Francesco
How To Factoring
Factoring integers,..., RSA Erbil, Kurdistan 0 Lecture in Number Theory College of Sciences Department of Mathematics University of Salahaddin Debember 1, 2014 Factoring integers, Producing primes and
Factoring & Primality
Factoring & Primality Lecturer: Dimitris Papadopoulos In this lecture we will discuss the problem of integer factorization and primality testing, two problems that have been the focus of a great amount
U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009. Notes on Algebra
U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009 Notes on Algebra These notes contain as little theory as possible, and most results are stated without proof. Any introductory
Recent Breakthrough in Primality Testing
Nonlinear Analysis: Modelling and Control, 2004, Vol. 9, No. 2, 171 184 Recent Breakthrough in Primality Testing R. Šleževičienė, J. Steuding, S. Turskienė Department of Computer Science, Faculty of Physics
Cryptography and Network Security Number Theory
Cryptography and Network Security Number Theory Xiang-Yang Li Introduction to Number Theory Divisors b a if a=mb for an integer m b a and c b then c a b g and b h then b (mg+nh) for any int. m,n Prime
Integer Factorization using the Quadratic Sieve
Integer Factorization using the Quadratic Sieve Chad Seibert* Division of Science and Mathematics University of Minnesota, Morris Morris, MN 56567 seib0060@morris.umn.edu March 16, 2011 Abstract We give
3. Computational Complexity.
3. Computational Complexity. (A) Introduction. As we will see, most cryptographic systems derive their supposed security from the presumed inability of any adversary to crack certain (number theoretic)
On Generalized Fermat Numbers 3 2n +1
Applied Mathematics & Information Sciences 4(3) (010), 307 313 An International Journal c 010 Dixie W Publishing Corporation, U. S. A. On Generalized Fermat Numbers 3 n +1 Amin Witno Department of Basic
Cryptography and Network Security Chapter 8
Cryptography and Network Security Chapter 8 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 8 Introduction to Number Theory The Devil said to Daniel Webster:
Lecture 13 - Basic Number Theory.
Lecture 13 - Basic Number Theory. Boaz Barak March 22, 2010 Divisibility and primes Unless mentioned otherwise throughout this lecture all numbers are non-negative integers. We say that A divides B, denoted
Study of algorithms for factoring integers and computing discrete logarithms
Study of algorithms for factoring integers and computing discrete logarithms First Indo-French Workshop on Cryptography and Related Topics (IFW 2007) June 11 13, 2007 Paris, France Dr. Abhijit Das Department
2 Primality and Compositeness Tests
Int. J. Contemp. Math. Sciences, Vol. 3, 2008, no. 33, 1635-1642 On Factoring R. A. Mollin Department of Mathematics and Statistics University of Calgary, Calgary, Alberta, Canada, T2N 1N4 http://www.math.ucalgary.ca/
International Journal of Information Technology, Modeling and Computing (IJITMC) Vol.1, No.3,August 2013
FACTORING CRYPTOSYSTEM MODULI WHEN THE CO-FACTORS DIFFERENCE IS BOUNDED Omar Akchiche 1 and Omar Khadir 2 1,2 Laboratory of Mathematics, Cryptography and Mechanics, Fstm, University of Hassan II Mohammedia-Casablanca,
How To Solve The Prime Factorization Of N With A Polynomials
THE MATHEMATICS OF PUBLIC KEY CRYPTOGRAPHY. IAN KIMING 1. Forbemærkning. Det kan forekomme idiotisk, at jeg som dansktalende og skrivende i et danskbaseret tidsskrift med en (formentlig) primært dansktalende
Arithmetic algorithms for cryptology 5 October 2015, Paris. Sieves. Razvan Barbulescu CNRS and IMJ-PRG. R. Barbulescu Sieves 0 / 28
Arithmetic algorithms for cryptology 5 October 2015, Paris Sieves Razvan Barbulescu CNRS and IMJ-PRG R. Barbulescu Sieves 0 / 28 Starting point Notations q prime g a generator of (F q ) X a (secret) integer
Smooth numbers and the quadratic sieve
Algorithmic Number Theory MSRI Publications Volume 44, 2008 Smooth numbers and the quadratic sieve CARL POMERANCE ABSTRACT. This article gives a gentle introduction to factoring large integers via the
Discrete Mathematics, Chapter 4: Number Theory and Cryptography
Discrete Mathematics, Chapter 4: Number Theory and Cryptography Richard Mayr University of Edinburgh, UK Richard Mayr (University of Edinburgh, UK) Discrete Mathematics. Chapter 4 1 / 35 Outline 1 Divisibility
RSA and Primality Testing
and Primality Testing Joan Boyar, IMADA, University of Southern Denmark Studieretningsprojekter 2010 1 / 81 Correctness of cryptography cryptography Introduction to number theory Correctness of with 2
Today s Topics. Primes & Greatest Common Divisors
Today s Topics Primes & Greatest Common Divisors Prime representations Important theorems about primality Greatest Common Divisors Least Common Multiples Euclid s algorithm Once and for all, what are prime
Primality Testing and Factorization Methods
Primality Testing and Factorization Methods Eli Howey May 27, 2014 Abstract Since the days of Euclid and Eratosthenes, mathematicians have taken a keen interest in finding the nontrivial factors of integers,
Computational Number Theory
Computational Number Theory C. Pomerance 1 Introduction Historically, computation has been a driving force in the development of mathematics. To help measure the sizes of their fields, the Egyptians invented
On the largest prime factor of x 2 1
On the largest prime factor of x 2 1 Florian Luca and Filip Najman Abstract In this paper, we find all integers x such that x 2 1 has only prime factors smaller than 100. This gives some interesting numerical
Factoring Algorithms
Factoring Algorithms The p 1 Method and Quadratic Sieve November 17, 2008 () Factoring Algorithms November 17, 2008 1 / 12 Fermat s factoring method Fermat made the observation that if n has two factors
CIS 5371 Cryptography. 8. Encryption --
CIS 5371 Cryptography p y 8. Encryption -- Asymmetric Techniques Textbook encryption algorithms In this chapter, security (confidentiality) is considered in the following sense: All-or-nothing secrecy.
Elements of Applied Cryptography Public key encryption
Network Security Elements of Applied Cryptography Public key encryption Public key cryptosystem RSA and the factorization problem RSA in practice Other asymmetric ciphers Asymmetric Encryption Scheme Let
Lecture 13: Factoring Integers
CS 880: Quantum Information Processing 0/4/0 Lecture 3: Factoring Integers Instructor: Dieter van Melkebeek Scribe: Mark Wellons In this lecture, we review order finding and use this to develop a method
Primes in Sequences. Lee 1. By: Jae Young Lee. Project for MA 341 (Number Theory) Boston University Summer Term I 2009 Instructor: Kalin Kostadinov
Lee 1 Primes in Sequences By: Jae Young Lee Project for MA 341 (Number Theory) Boston University Summer Term I 2009 Instructor: Kalin Kostadinov Lee 2 Jae Young Lee MA341 Number Theory PRIMES IN SEQUENCES
HYPERELLIPTIC CURVE METHOD FOR FACTORING INTEGERS. 1. Thoery and Algorithm
HYPERELLIPTIC CURVE METHOD FOR FACTORING INTEGERS WENHAN WANG 1. Thoery and Algorithm The idea of the method using hyperelliptic curves to factor integers is similar to the elliptic curve factoring method.
FACTORING. n = 2 25 + 1. fall in the arithmetic sequence
FACTORING The claim that factorization is harder than primality testing (or primality certification) is not currently substantiated rigorously. As some sort of backward evidence that factoring is hard,
Computer and Network Security
MIT 6.857 Computer and Networ Security Class Notes 1 File: http://theory.lcs.mit.edu/ rivest/notes/notes.pdf Revision: December 2, 2002 Computer and Networ Security MIT 6.857 Class Notes by Ronald L. Rivest
15 Prime and Composite Numbers
15 Prime and Composite Numbers Divides, Divisors, Factors, Multiples In section 13, we considered the division algorithm: If a and b are whole numbers with b 0 then there exist unique numbers q and r such
2.1 Complexity Classes
15-859(M): Randomized Algorithms Lecturer: Shuchi Chawla Topic: Complexity classes, Identity checking Date: September 15, 2004 Scribe: Andrew Gilpin 2.1 Complexity Classes In this lecture we will look
Factorization Methods: Very Quick Overview
Factorization Methods: Very Quick Overview Yuval Filmus October 17, 2012 1 Introduction In this lecture we introduce modern factorization methods. We will assume several facts from analytic number theory.
8 Primes and Modular Arithmetic
8 Primes and Modular Arithmetic 8.1 Primes and Factors Over two millennia ago already, people all over the world were considering the properties of numbers. One of the simplest concepts is prime numbers.
The Quadratic Sieve Factoring Algorithm
The Quadratic Sieve Factoring Algorithm Eric Landquist MATH 488: Cryptographic Algorithms December 14, 2001 1 Introduction Mathematicians have been attempting to find better and faster ways to factor composite
Determining the Optimal Combination of Trial Division and Fermat s Factorization Method
Determining the Optimal Combination of Trial Division and Fermat s Factorization Method Joseph C. Woodson Home School P. O. Box 55005 Tulsa, OK 74155 Abstract The process of finding the prime factorization
CHAPTER 5. Number Theory. 1. Integers and Division. Discussion
CHAPTER 5 Number Theory 1. Integers and Division 1.1. Divisibility. Definition 1.1.1. Given two integers a and b we say a divides b if there is an integer c such that b = ac. If a divides b, we write a
I. Introduction. MPRI Cours 2-12-2. Lecture IV: Integer factorization. What is the factorization of a random number? II. Smoothness testing. F.
F. Morain École polytechnique MPRI cours 2-12-2 2013-2014 3/22 F. Morain École polytechnique MPRI cours 2-12-2 2013-2014 4/22 MPRI Cours 2-12-2 I. Introduction Input: an integer N; logox F. Morain logocnrs
The Prime Numbers. Definition. A prime number is a positive integer with exactly two positive divisors.
The Prime Numbers Before starting our study of primes, we record the following important lemma. Recall that integers a, b are said to be relatively prime if gcd(a, b) = 1. Lemma (Euclid s Lemma). If gcd(a,
Runtime and Implementation of Factoring Algorithms: A Comparison
Runtime and Implementation of Factoring Algorithms: A Comparison Justin Moore CSC290 Cryptology December 20, 2003 Abstract Factoring composite numbers is not an easy task. It is classified as a hard algorithm,
Integer factoring and modular square roots
Integer factoring and modular square roots Emil Jeřábek Institute of Mathematics of the Academy of Sciences Žitná 25, 115 67 Praha 1, Czech Republic, email: jerabek@math.cas.cz July 28, 2015 Abstract Buresh-Oppenheim
EMBEDDING DEGREE OF HYPERELLIPTIC CURVES WITH COMPLEX MULTIPLICATION
EMBEDDING DEGREE OF HYPERELLIPTIC CURVES WITH COMPLEX MULTIPLICATION CHRISTIAN ROBENHAGEN RAVNSHØJ Abstract. Consider the Jacobian of a genus two curve defined over a finite field and with complex multiplication.
Breaking The Code. Ryan Lowe. Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and
Breaking The Code Ryan Lowe Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and a minor in Applied Physics. As a sophomore, he took an independent study
Prime numbers and prime polynomials. Paul Pollack Dartmouth College
Prime numbers and prime polynomials Paul Pollack Dartmouth College May 1, 2008 Analogies everywhere! Analogies in elementary number theory (continued fractions, quadratic reciprocity, Fermat s last theorem)
Notes on Factoring. MA 206 Kurt Bryan
The General Approach Notes on Factoring MA 26 Kurt Bryan Suppose I hand you n, a 2 digit integer and tell you that n is composite, with smallest prime factor around 5 digits. Finding a nontrivial factor
CONTINUED FRACTIONS AND FACTORING. Niels Lauritzen
CONTINUED FRACTIONS AND FACTORING Niels Lauritzen ii NIELS LAURITZEN DEPARTMENT OF MATHEMATICAL SCIENCES UNIVERSITY OF AARHUS, DENMARK EMAIL: niels@imf.au.dk URL: http://home.imf.au.dk/niels/ Contents
A new probabilistic public key algorithm based on elliptic logarithms
A new probabilistic public key algorithm based on elliptic logarithms Afonso Comba de Araujo Neto, Raul Fernando Weber 1 Instituto de Informática Universidade Federal do Rio Grande do Sul (UFRGS) Caixa
On the number-theoretic functions ν(n) and Ω(n)
ACTA ARITHMETICA LXXVIII.1 (1996) On the number-theoretic functions ν(n) and Ω(n) by Jiahai Kan (Nanjing) 1. Introduction. Let d(n) denote the divisor function, ν(n) the number of distinct prime factors,
On prime-order elliptic curves with embedding degrees k = 3, 4 and 6
On prime-order elliptic curves with embedding degrees k = 3, 4 and 6 Koray Karabina and Edlyn Teske University of Waterloo ANTS VIII, Banff, May 20, 2008 K. Karabina and E. Teske (UW) Prime-order elliptic
How To Prove The Dirichlet Unit Theorem
Chapter 6 The Dirichlet Unit Theorem As usual, we will be working in the ring B of algebraic integers of a number field L. Two factorizations of an element of B are regarded as essentially the same if
Lecture 10: Distinct Degree Factoring
CS681 Computational Number Theory Lecture 10: Distinct Degree Factoring Instructor: Piyush P Kurur Scribe: Ramprasad Saptharishi Overview Last class we left of with a glimpse into distant degree factorization.
A number field is a field of finite degree over Q. By the Primitive Element Theorem, any number
Number Fields Introduction A number field is a field of finite degree over Q. By the Primitive Element Theorem, any number field K = Q(α) for some α K. The minimal polynomial Let K be a number field and
The van Hoeij Algorithm for Factoring Polynomials
The van Hoeij Algorithm for Factoring Polynomials Jürgen Klüners Abstract In this survey we report about a new algorithm for factoring polynomials due to Mark van Hoeij. The main idea is that the combinatorial
ELEMENTARY THOUGHTS ON DISCRETE LOGARITHMS. Carl Pomerance
ELEMENTARY THOUGHTS ON DISCRETE LOGARITHMS Carl Pomerance Given a cyclic group G with generator g, and given an element t in G, the discrete logarithm problem is that of computing an integer l with g l
RSA Question 2. Bob thinks that p and q are primes but p isn t. Then, Bob thinks Φ Bob :=(p-1)(q-1) = φ(n). Is this true?
RSA Question 2 Bob thinks that p and q are primes but p isn t. Then, Bob thinks Φ Bob :=(p-1)(q-1) = φ(n). Is this true? Bob chooses a random e (1 < e < Φ Bob ) such that gcd(e,φ Bob )=1. Then, d = e -1
Number Theory Hungarian Style. Cameron Byerley s interpretation of Csaba Szabó s lectures
Number Theory Hungarian Style Cameron Byerley s interpretation of Csaba Szabó s lectures August 20, 2005 2 0.1 introduction Number theory is a beautiful subject and even cooler when you learn about it
11 Ideals. 11.1 Revisiting Z
11 Ideals The presentation here is somewhat different than the text. In particular, the sections do not match up. We have seen issues with the failure of unique factorization already, e.g., Z[ 5] = O Q(
A Comparison Of Integer Factoring Algorithms. Keyur Anilkumar Kanabar
A Comparison Of Integer Factoring Algorithms Keyur Anilkumar Kanabar Batchelor of Science in Computer Science with Honours The University of Bath May 2007 This dissertation may be made available for consultation
ALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION
ALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION Aldrin W. Wanambisi 1* School of Pure and Applied Science, Mount Kenya University, P.O box 553-50100, Kakamega, Kenya. Shem Aywa 2 Department of Mathematics,
Revised Version of Chapter 23. We learned long ago how to solve linear congruences. ax c (mod m)
Chapter 23 Squares Modulo p Revised Version of Chapter 23 We learned long ago how to solve linear congruences ax c (mod m) (see Chapter 8). It s now time to take the plunge and move on to quadratic equations.
MATH 168: FINAL PROJECT Troels Eriksen. 1 Introduction
MATH 168: FINAL PROJECT Troels Eriksen 1 Introduction In the later years cryptosystems using elliptic curves have shown up and are claimed to be just as secure as a system like RSA with much smaller key
On Factoring Integers and Evaluating Discrete Logarithms
On Factoring Integers and Evaluating Discrete Logarithms A thesis presented by JOHN AARON GREGG to the departments of Mathematics and Computer Science in partial fulfillment of the honors requirements
STUDY ON ELLIPTIC AND HYPERELLIPTIC CURVE METHODS FOR INTEGER FACTORIZATION. Takayuki Yato. A Senior Thesis. Submitted to
STUDY ON ELLIPTIC AND HYPERELLIPTIC CURVE METHODS FOR INTEGER FACTORIZATION by Takayuki Yato A Senior Thesis Submitted to Department of Information Science Faculty of Science The University of Tokyo on
The Prime Facts: From Euclid to AKS
The Prime Facts: From Euclid to AKS c 2003 Scott Aaronson 1 Introduction My idea for this talk was to tell you only the simplest, most basic things about prime numbers the things you need to know to call
How To Factor In Prime Numbers
USING LUCAS SEQUENCES TO FACTOR LARGE INTEGERS NEAR GROUP ORDERS Zhenxiang Zhang* Dept. of Math., Anhui Normal University, 241000 Wuhu, Anhui, P.R. China e-mail: zhangzhx@mail.ahwhptt.net.cn (Submitted
SOLUTIONS FOR PROBLEM SET 2
SOLUTIONS FOR PROBLEM SET 2 A: There exist primes p such that p+6k is also prime for k = 1,2 and 3. One such prime is p = 11. Another such prime is p = 41. Prove that there exists exactly one prime p such
On prime-order elliptic curves with embedding degrees k = 3, 4 and 6
On prime-order elliptic curves with embedding degrees k = 3, 4 and 6 Koray Karabina and Edlyn Teske Dept. of Combinatorics and Optimization University of Waterloo Waterloo, Ontario, Canada NL 3G1, kkarabina@uwaterloo.ca,
CRC Press has granted the following specific permissions for the electronic version of this book:
This is a Chapter from the Handbook of Applied Cryptography, by A. Menezes, P. van Oorschot, and S. Vanstone, CRC Press, 1996. For further information, see www.cacr.math.uwaterloo.ca/hac CRC Press has
minimal polyonomial Example
Minimal Polynomials Definition Let α be an element in GF(p e ). We call the monic polynomial of smallest degree which has coefficients in GF(p) and α as a root, the minimal polyonomial of α. Example: We
Homework until Test #2
MATH31: Number Theory Homework until Test # Philipp BRAUN Section 3.1 page 43, 1. It has been conjectured that there are infinitely many primes of the form n. Exhibit five such primes. Solution. Five such
Elementary Number Theory
Elementary Number Theory A revision by Jim Hefferon, St Michael s College, 2003-Dec of notes by W. Edwin Clark, University of South Florida, 2002-Dec L A TEX source compiled on January 5, 2004 by Jim Hefferon,
Generic attacks and index calculus. D. J. Bernstein University of Illinois at Chicago
Generic attacks and index calculus D. J. Bernstein University of Illinois at Chicago The discrete-logarithm problem Define Ô = 1000003. Easy to prove: Ô is prime. Can we find an integer Ò ¾ 1 2 3 Ô 1 such
c 2007 Society for Industrial and Applied Mathematics ÉRIC SCHOST
SIAM J. COMPUT. Vol. 36, No. 6, pp. 1777 1806 c 2007 Society for Industrial and Applied Mathematics LINEAR RECURRENCES WITH POLYNOMIAL COEFFICIENTS AND APPLICATION TO INTEGER FACTORIZATION AND CARTIER
Factoring Algorithms
Institutionen för Informationsteknologi Lunds Tekniska Högskola Department of Information Technology Lund University Cryptology - Project 1 Factoring Algorithms The purpose of this project is to understand
Math 453: Elementary Number Theory Definitions and Theorems
Math 453: Elementary Number Theory Definitions and Theorems (Class Notes, Spring 2011 A.J. Hildebrand) Version 5-4-2011 Contents About these notes 3 1 Divisibility and Factorization 4 1.1 Divisibility.......................................
A New Generic Digital Signature Algorithm
Groups Complex. Cryptol.? (????), 1 16 DOI 10.1515/GCC.????.??? de Gruyter???? A New Generic Digital Signature Algorithm Jennifer Seberry, Vinhbuu To and Dongvu Tonien Abstract. In this paper, we study
DIVISORS IN A DEDEKIND DOMAIN. Javier Cilleruelo and Jorge Jiménez-Urroz. 1 Introduction
DIVISORS IN A DEDEKIND DOMAIN Javier Cilleruelo and Jorge Jiménez-Urroz 1 Introduction Let A be a Dedekind domain in which we can define a notion of distance. We are interested in the number of divisors
Efficiency of algorithms. Algorithms. Efficiency of algorithms. Binary search and linear search. Best, worst and average case.
Algorithms Efficiency of algorithms Computational resources: time and space Best, worst and average case performance How to compare algorithms: machine-independent measure of efficiency Growth rate Complexity
INTEGER FACTORING USING SMALL ALGEBRAIC DEPENDENCIES
INTEGER FACTORING USING SMALL ALGEBRAIC DEPENDENCIES MANINDRA AGRAWAL, NITIN SAXENA, AND SHUBHAM SAHAI SRIVASTAVA Abstract Integer factoring is a curious number theory problem with wide applications in
On the generation of elliptic curves with 16 rational torsion points by Pythagorean triples
On the generation of elliptic curves with 16 rational torsion points by Pythagorean triples Brian Hilley Boston College MT695 Honors Seminar March 3, 2006 1 Introduction 1.1 Mazur s Theorem Let C be a
Factorizations of a n ± 1, 13 a < 100
Factorizations of a n ± 1, 13 a < 100 Richard P. Brent Computer Sciences Laboratory, Australian National University GPO Box 4, Canberra, ACT 2601, Australia e-mail: rpb@cslab.anu.edu.au and Herman J. J.
The application of prime numbers to RSA encryption
The application of prime numbers to RSA encryption Prime number definition: Let us begin with the definition of a prime number p The number p, which is a member of the set of natural numbers N, is considered
CMSC 858T: Randomized Algorithms Spring 2003 Handout 8: The Local Lemma
CMSC 858T: Randomized Algorithms Spring 2003 Handout 8: The Local Lemma Please Note: The references at the end are given for extra reading if you are interested in exploring these ideas further. You are
An Introductory Course in Elementary Number Theory. Wissam Raji
An Introductory Course in Elementary Number Theory Wissam Raji 2 Preface These notes serve as course notes for an undergraduate course in number theory. Most if not all universities worldwide offer introductory
= 2 + 1 2 2 = 3 4, Now assume that P (k) is true for some fixed k 2. This means that
Instructions. Answer each of the questions on your own paper, and be sure to show your work so that partial credit can be adequately assessed. Credit will not be given for answers (even correct ones) without
3 1. Note that all cubes solve it; therefore, there are no more
Math 13 Problem set 5 Artin 11.4.7 Factor the following polynomials into irreducible factors in Q[x]: (a) x 3 3x (b) x 3 3x + (c) x 9 6x 6 + 9x 3 3 Solution: The first two polynomials are cubics, so if
Factoring. Factoring 1
Factoring Factoring 1 Factoring Security of RSA algorithm depends on (presumed) difficulty of factoring o Given N = pq, find p or q and RSA is broken o Rabin cipher also based on factoring Factoring like
FACTORING LARGE NUMBERS, A GREAT WAY TO SPEND A BIRTHDAY
FACTORING LARGE NUMBERS, A GREAT WAY TO SPEND A BIRTHDAY LINDSEY R. BOSKO I would like to acknowledge the assistance of Dr. Michael Singer. His guidance and feedback were instrumental in completing this
Carmichael numbers and pseudoprimes
Carmichael numbers and pseudoprimes Notes by G.J.O. Jameson Introduction Recall that Fermat s little theorem says that if p is prime and a is not a multiple of p, then a p 1 1 mod p. This theorem gives
Lectures on Number Theory. Lars-Åke Lindahl
Lectures on Number Theory Lars-Åke Lindahl 2002 Contents 1 Divisibility 1 2 Prime Numbers 7 3 The Linear Diophantine Equation ax+by=c 12 4 Congruences 15 5 Linear Congruences 19 6 The Chinese Remainder
AMBIGUOUS CLASSES IN QUADRATIC FIELDS
MATHEMATICS OF COMPUTATION VOLUME, NUMBER 0 JULY 99, PAGES -0 AMBIGUOUS CLASSES IN QUADRATIC FIELDS R. A. MOLLIN Dedicated to the memory ofd. H. Lehmer Abstract. We provide sufficient conditions for the
RSA Attacks. By Abdulaziz Alrasheed and Fatima
RSA Attacks By Abdulaziz Alrasheed and Fatima 1 Introduction Invented by Ron Rivest, Adi Shamir, and Len Adleman [1], the RSA cryptosystem was first revealed in the August 1977 issue of Scientific American.
Basic Algorithms In Computer Algebra
Basic Algorithms In Computer Algebra Kaiserslautern SS 2011 Prof. Dr. Wolfram Decker 2. Mai 2011 References Cohen, H.: A Course in Computational Algebraic Number Theory. Springer, 1993. Cox, D.; Little,
A Study on the Necessary Conditions for Odd Perfect Numbers
A Study on the Necessary Conditions for Odd Perfect Numbers Ben Stevens U63750064 Abstract A collection of all of the known necessary conditions for an odd perfect number to exist, along with brief descriptions