PROCEEDINGS OF THE AMERICAN MATHEMATICAL SOCIETY Volume 140, Number 8, August 2012, Pages 2653–2661 S 0002-9939(2011)11196-1 Article electronically published on December 20, 2011
GENERALIZED LUCAS-LEHMER TESTS USING PELL CONICS
SAMUEL A. HAMBLETON
(Communicated by Ted Chinburg)
Abstract. Pell conics are used to write a Proth-Riesel twin-primality test. We discuss easy-to-find primality certificates for integers of the form mnh ± 1. The known primality test for 3nh ± 1 is associated with X2 +3Y 2 =4.
1. Introduction Like elliptic curves, there is a group law on the Pell conics [4]. These are affine curves of genus 0 of the form C : X2 − ΔY 2 = 4 where Δ is a fundamental dis- criminant. Geometrically, points P and Q on Pell conics are added by taking the line parallel to PQ, passing through the point O =(2, 0), and intersecting with C at P + Q. Algebraically this is x x +Δy y x y + x y (1) (x ,y )+(x ,y )= 1 2 1 2 , 1 2 2 1 . 1 1 2 2 2 2 Multiplication by 2 and 3 is given by
2(x, y)=(x2 − 2,xy), (2) 3(x, y)=(x3 − 3x, (x2 − 1)y).
Lemmermeyer [4] considered the arithmetic of Pell conics indicating many inter- esting similarities with elliptic curves. The following theorem appears in [4] in a Δ more general form. We use p to mean the Legendre symbol.
Theorem 1.1. Let C : X2 − ΔY 2 =4, Δ be a fundamental discriminant, p be prime and N be an integer. Then: •C(Z) is an abelian group with identity O =(2, 0),andpointT =(−2, 0) of order 2. No other points have y =0or x = ±2. The inverse of (x, y) is (x, −y). •C(Z/N ) is an abelian group with identity O. •CF − Δ ( p) is a cyclic group of order p p .
Received by the editors June 11, 2009 and, in revised form, November 9, 2010 and March 15, 2011. 2010 Mathematics Subject Classification. Primary 11Y11; Secondary 11G30. Key words and phrases. Pell conics, Lucas-Lehmer, primality.
c 2011 American Mathematical Society Reverts to public domain 28 years from publication 2653
License or copyright restrictions may apply to redistribution; see https://www.ams.org/journal-terms-of-use 2654 S. HAMBLETON
For multiplication by m ≥ 1, including points of Equation (2), we define poly- nomials
(3) f0 =2;f1 = x; fi+1 = xfi − fi−1,
(4) g0 =0;g1 =1;gi+1 = xgi − gi−1,
(5) F1 =1;F3 = x +1;F2i+3 = xF2i+1 − F2i−1. Lemma 1.2. Let C be a Pell conic and P =(x, y) ∈C(Z). Then for m ≥ 1, mP = fm(x),y· gm(x) ,andforoddm ≥ 1, 2 (6) fm(x)=(x − 2)Fm(x) +2. Proof. mP = fm(x),y· gm(x) may be proved by induction using Equations (1), (3), and (4). To prove Equation (6), induction shows that 2 − · 2 (7) F2i−1 x F2i−1F2i+1 + F2i+1 = x +2, and using Equation (7) in another induction proves Equation (6).
Corollary 1.3 is a direct result of Lemma 1.2. C(Fp)[m] is used to denote the set of points P of C(Fp) for which mP = O.
Corollary 1.3. Let C be a Pell conic, P =(x, y) ∈C(Fp),andp prime. Then for odd m ≥ 1, P ∈C(Fp)[m]\O if and only if Fm(x) ≡ 0(modp). Lemmermeyer [4] discussed primality proving using Pell conics, giving Theo- rem 1.5 as an analogue of Lucas’ theorem. It is assumed that the integers N are greater than 1 and coprime to 6.
− N−1 Theorem 1.4 (Lucas). If aN 1 ≡ 1(modN) but a q ≡ 1(modN) for every prime factor q of N − 1,thenN is prime. Theorem 1.5. Let N ≥ 5 and C : X2 − ΔY 2 =4be a Pell conic defined over Z Δ − P ∈C Z /N with N = 1.ThenN is prime if and only if for some point ( /N ), P O N+1 P O (N +1) = ,but q = for every prime factor q of N +1. Lemmermeyer [4] remarked that there are Proth versions in which only part of N ± 1 needs to be factored and commented that in the same way Gross [2] gave an elliptic curve ‘Lucas-Lehmer’ test, the Lucas-Lehmer test itself may be proved with the Pell conic C : X2 − 12Y 2 = 4 and the point (4, 1). This method is extended here to more general primality proving.
2. Twin primes of the form 2nh ± 1 The theory of Pell conics is applied to a test similar to Riesel’s [6] generalization of the Lucas-Lehmer test to N =2nh − 1. Our test, however, also includes Proth’s Theorem. One advantage in their combination is a single primality certificate for a pair of twin primes. The uppercase letter Q will henceforth be used exclusively for a fixed generator of C(Fp). Lemma 2.1. Let p be an odd prime and let C : X2 − ΔY 2 =4be a Pell conic such ≡ Δ that p p (mod 4). There is an exact sequence of group homomorphisms
(8) 0 −→ 2C(F ) −→ C (F ) −→θ { ± 1}× −→ 0, p p → x+2 where θ :(x, y) p .
License or copyright restrictions may apply to redistribution; see https://www.ams.org/journal-terms-of-use GENERALIZED LUCAS-LEHMER TESTS USING PELL CONICS 2655 Proof. Let P1, P2 ∈C(Fp). We must prove that θ(P1) · θ(P2)=θ P1 + P2 .We will use the fact that θ(P) = 1 if and only if P ∈ 2C(Fp), but this also establishes that ker θ =2C(Fp). By Theorem 1.1, C(Fp) is cyclic, generated by Q,sothere exist integers 1 and 2 such that P1 = 1Q and P2 = 2Q.Ifθ(P1)=θ(P2)then ≡ P P Q ∈ C F 1 2 (mod 2) so 1 + 2 is even and 1 + 2 =(1 + 2) 2 ( p)sothat P P P P ≡ θ 1 + 2 =1.Ifθ( 1) = θ( 2)then 1 2 (mod 2) so 1 + 2 is odd and P P Q ∈ C F P P − 1 + 2 =(1 + 2) 2 ( p)sothatθ 1 + 2 = 1. It follows that θ is a group Q − C F − Δ ≡ Q homomorphism. θ( )= 1 since # ( p)=p p 0(mod4)andθ(2 )=1, so θ is surjective.
It follows that if p =2nh ± 1 is prime, whereh is odd and n ≥ 2, and the Pell C 2 − 2 ≡ Δ conic : X ΔY = 4 is chosen such that p p (mod 4), then: P • If x( )+2 =1,thenP ∈ 2C(F )and2n−1hP = O. p p • x(P)+2 − P ∈ C F n−1 P T If p = 1, then 2 ( p)and2 h = . n n−1 Observe that the order of C(Fp)isequalto2h,so2 hP = O or T.Now − − − P = Q,so2n 1hP =2n 1hQ = O if and only if 2nh | 2n 1h, because Q is the x(P)+2 − n−1 P T generator, if and only if is even. If p = 1, then 2 h = . Lemma 2.2. Let N =2nh ± 1,whereh is odd. Let C : X2 − ΔY 2 =4be a Pell − conic with Δ N.Ifthereexistsa P∈C(Z/N ) such that 2n 1hP = T, then every ≡ Δ n prime factor q of N satisfies q q (mod 2 ).
n−1 Proof. Suppose 2 hP = T in C(Z/N ). Let q be a prime divisor of N.Letoq(P) 2 2 denote the order of the point P on C : X − ΔY =4overFq. Clearly we also have n−1 P T C F P | n P n−1 2 h = in ( q). Therefore oq( ) 2 h, but oq( ) 2 h.Since h is odd, 2n | o (P). Now C(F )iscyclicoforderq − Δ ,soo (P) | q − Δ .Thatis, q q q q q n | − Δ ≡ Δ n 2 q q or simply q q (mod 2 ). · For the following, · will mean the Jacobi symbol. Theorem 2.3. Let N =2nh ± 1 where 0 License or copyright restrictions may apply to redistribution; see https://www.ams.org/journal-terms-of-use 2656 S. HAMBLETON We will assume from here on that f, g,andF always refer to the polynomi- als defined in Equations (3), (4), and (5) respectively. We give an application of Theorem 2.3 to pairs of twin primes. Algorithm 2.4. To certify the primality of a pair of twin primes of the form 2nh ± 1: n n (1) Choose an integer n ≥ 2 and a positive odd integer h< 2 ,andset r =2 h. Δ − Δ (2) Find a fundamental discriminant Δ such that r−1 = 1 and r+1 =1. x+2 x+2 x−2 − x−2 − (3) Find an integer x such that r−1 = r+1 = r+1 = r−1 = 1. (4) Compute fr/2(x) modulo r −1 and r +1.Ifbothfr/2(x) ≡−2(modr ±1), then the points (x, ·) and Pell conic C : X2 − ΔY 2 =4certify that r ± 1 is apairoftwinprimes. ± ≡− ± Proof. If r 1 are composite, then by Theorem 2.3, fr/2(x) 2(mod r 1), so ± x+2 x+2 x−2 − x−2 − we must prove that if r 1 are prime and r−1 = r+1 = r+1 = r−1 = 1 P ∈C F P P ∈ C F then there exist points ( r±1) such that x = x( )and 2 ( r±1). Clearly, x2− Δ there exist points P ∈C(F ± ) such that x = x(P) if and only if 4 = r 1 r±1 r±1 x−2 ∓ if and only if r±1 = 1. Part (4) then follows from Theorem 2.3. In Step (4) of Algorithm 2.4, it is unnecessary to evaluate, at the integer x chosen in Step (3), each of the polynomials fi preceding fr/2, as illustrated in the following example. Example 2.5. The Pell conic C : X2 − 28Y 2 = 4 and points (17,y) ∈C(Z/r ± 1) certify the twin primes 191 and 193: (1) r =26 · 3. 28 − 28 C 2 − 2 (2) 191 = 1and 193 =1,so :X 28Y = 4 is suitable. 19 19 15 − 15 − ∈CZ (3) 191 = 193 = 193 = 191 = 1, so the points (17, 50) ( /191) and (17, 47) ∈C(Z/193) have the required properties. (4) To compute f25·3(17) modulo 191 and 193, write h = 3 in binary as b = 11. The k-th term tk of a sequence B is obtained by taking the first k digits of b from left to right, B = {1, 11}. To compute fh(17) (mod 191) and fh(17) (mod 193), for each tk ∈ B, we wish to compute a sequence of pairs (f (17),f (17)) evaluated modulo 191 and 193, where tk 1+tk 2 (f − 2,ft · f1+t − x)iftk+1 is even, (9) (f ,f )= tk k k tk+1 1+tk+1 (f · f − x, f 2 − 2) if t is odd tk 1+tk 1+tk k+1 2 and f1(x)=x and f2(x)=x − 2. We have f3(17) ≡ 87 (mod 191) and f3(17) ≡ 37 (mod 193). Using f2n−1h = f2n−1 (fh), we iterate terms of the sequences determined by repeated doubling, n − 1 = 5 times, modulo 191 and 193: {87, 118, 170, 57, 0, 189} (mod 191) and {37, 16, 61, 52, 0, 191} (mod 193). Equation (9) has been used by Williams [7] in the same way to efficiently evaluate Lucas sequences. 3. Easy-to-find primality certificates for mnh ± 1 The main result of this section differs from the previous since we use solved Pell conics over integers to certify primes of the form mnh ± 1. The smallest non-trivial License or copyright restrictions may apply to redistribution; see https://www.ams.org/journal-terms-of-use GENERALIZED LUCAS-LEHMER TESTS USING PELL CONICS 2657 point of C(Z) with x, y > 0, the fundamental solution, is usually a generator of C(Fp). We begin with the main result which builds on a result of Williams [7]. The lemmas supporting Theorem 3.4 are included below. Remark 3.1 allows a comparison with Lemma 2.1. Remark 3.1. Let p be an odd prime, m be an odd integer and C : X2 − ΔY 2 =4be ≡ Δ a Pell conic such that p p (mod m). Let μm denote the multiplicative group of m-th roots of unity, generated by ω. There is an exact sequence φ 0 −→ mC(Fp) −→ C (Fp) −→ μm −→ 0, where φ : P = Q → ω. Proof. Let P1, P2 ∈C(Fp). Writing P1 = 1Q and P2 = 2Q, φ(P1) · φ(P2)= 1 2 1+2 ω ω = ω = φ(P1 + P2). Again letting P = Q, φ(P) = 1 if and only if ω = 1, if and only if m | , if and only if P ∈ mC(Fp). So ker(φ)=mC(Fp). Lemma 3.2. Let p = mnh ± 1 be prime, where m is odd, h is even, not divisible ≥ C 2 − 2 Δ ≡ by m and n 2.Let : X ΔY =4be a Pell conic where p p (mod m). If P =(x, y) ∈C(Fp) but P ∈ mC(Fp),thens ≡ fmn−1h(x)(modp) satisfies Fm(s) ≡ 0(modp).IfP ∈ mC(Fp),thens ≡ 2(modp). n−1 n Proof. If P ∈ mC(Fp), then m hP = m hQ = O so that s ≡ 2(modp). Points n−1 P ∈C(Fp)satisfym hP ∈C(Fp)[m]. Assuming P ∈C(Fp) \ mC(Fp)wemust show that mn−1hP = O.NowP = Q for some positive integer ,somn−1hP = mn−1hQ = O if and only if mnh | mn−1h, because Q is a generator, if and only n−1 if m | .SinceP ∈ mC(Fp), m ,som hP ∈C(Fp)[m] \ O, and it follows that s ≡ fmn−1h(x)(modp) satisfies Fm(s) ≡ 0(modp) by Corollary 1.3. The proof of Lemma 3.3 is similar to the proof of Lemma 2.2. Lemma 3.3. Let N = mnh ± 1,wherem is odd, h is even, not divisible by m and ≥ C 2 − 2 Δ ≡ n 2.Let : X ΔY =4be a Pell conic satisfying N N (mod m).If P ∈C Z ≡ − P ≡ there exists a ( /N ) such that s fmn 1h(x( )) (mod p) satisfies Fm(s) 0 ≡ Δ n (mod N), then every prime factor q of N satisfies q q (mod m ). For the purpose of certifying primes of the form mnh ± 1 in the case where it is not checked whether the point P belongs to mC(Z/N ), it should be assumed that the Pell conic satisfies Δ > 0andP is the fundamental solution of C(Z), reduced modulo N to an element of C(Z/N ), in order to increase the chance that P ∈ mC(Z/N ). Theorem 3.4. Let N = mnh ± 1,wherem is odd, h is even, not divisible by m, n ≥ C Δ ≡ 0 (1) If Fm(s) ≡ 0(modN),thenN is prime. (2) If s ≡ 2(modN) and Fm(s) ≡ 0(modN),thenN is composite. (3) If s ≡ 2(modN),thenN is either prime or a Lucas pseudoprime. Another Pell conic is required. (4) If it is known that P ∈ mC(Z/N ),thenN is prime if and only if Fm(s) ≡ 0 (mod N). License or copyright restrictions may apply to redistribution; see https://www.ams.org/journal-terms-of-use 2658 S. HAMBLETON Proof. If N is prime, then by Lemma 3.2, Fm(s) ≡ 0(modN)ors ≡ 2(modN). Conversely, suppose Fm(s) ≡ 0(modN) while N is composite. By Lemma 3.3 every prime factor q of N, and hence every factor, satisfies q ≡±1(modmn). If n n n N ≡ 1(modm), then N may factor as N =(m h1 +1)(m h2 +1) or N =(m h1 − n n 1)(m h2 − 1). These correspond to h = ±(h1 + h2)+h1h2m = n n n n h1(m ± 1) + h2(m ± 1) − m +(h1 − 1)(h2 − 1)m .Nowh1 and h2 must be even since h is even so that h>mn, a contradiction, and N must be prime. If N ≡−1 n n (mod m), then N may factor as N =(m h1 +1)(m h2 − 1). This corresponds n n to h = h2 − h1 + h1h2m .Ifh1 = h2 =2,thenh =4· m so that m | h,a n n contradiction. Writing h = h2 + h1(m − 1) + h1(h2 − 1)m and noting that h2 must be even, h>mn, a contradiction, so N must be prime. This completes the proof of case (1). If the conditions of case (2) are satisfied, then mnhP = O,so N is composite by Theorem 1.1. Case (3) follows from Lemma 3.2, noting that N may be a Lucas psuedoprime since the fi are terms of a Lucas sequence. If N is prime and P ∈ mC(FN ), then by Lemma 3.2, Fm(s) ≡ 0(modN). This, together with case (1), completes the proof of case (4). C Δ ≡ Given that N is prime and the Pell conic ,withΔ> 0and N N (mod m), is randomly chosen while always using the fundamental solution of C(Z) reduced modulo N to a point of C(Z/N ) as the point P of Theorem 3.4, this result leads to − 1 a primality certificate with a probability of 1 m . This attests to the occurrence of item (3) of Theorem 3.4 being unlikely. The fm(x) are in fact the Dickson polynomials of the first kind Dm(x, a), with a = 1. The following comes from [5]. ∗ Theorem 3.5 (Dickson). Let a ∈ Fq ,whereq is the power of a prime. The 2 Dickson polynomial Dm(x, a) permutes the field Fq if and only if gcd(m, q −1) = 1. If p = mnh ± 1isprimeandm is odd while h is even, then gcd(m, p2 − 1) = m and fm(x)=Dm(x, 1) cannot permute Fp. That is, there exists a P ∈C(Fp)such P ∈ C F C 2 − 2 that m ( p), where : X ΔY = 4 is a Pell conic with the required property Δ ≡ p p (mod m). Corollary 3.6. Let p = mnh± 1 be prime where m is odd. Let C : X2 − ΔY 2 =4 Δ ≡ 1 be a Pell conic satisfying p p (mod m). Then the proportion m of the points P ∈C(Fp) satisfy P ∈ mC(Fp). Proof. Let Q be the generator of the cyclic group C(Fp). Suppose Q = mP.Then all of the elements of C(Fp) are divisible by m, contradicting Theorem 3.5. Thus Q C F Z n 1 is not divisible by m. Under the isomorphism ( p) /m h, the proportion m of the points of C(Fp) are divisible by m. Remark 3.7. Let h be an integer. Neglecting the computation of the binary sequence B of Example 2.5 and modular additions, the evaluation of fh modulo an integer N requires at most 2 log2(h) modular multiplications [5]. Induction may be used with Equations (5) and (7) to establish the identities · − 2 F4j−1 = F2j+1 F2j−1 F2j−1 +1, 2 − · − (10) F4j+1 = F2j+1 F2j+1 F2j−1 1, − 2 − F4j+3 =(x 1)F2j+1 F2j+1F2j−1 +1. We give an example showing how the Fm may be computed using Equation (10). License or copyright restrictions may apply to redistribution; see https://www.ams.org/journal-terms-of-use GENERALIZED LUCAS-LEHMER TESTS USING PELL CONICS 2659 Example 3.8. We show how F795(x) may be evaluated. The binary representation of m = 795 is m2 = 1100011011. The k-th term uk of a sequence U = {uk} is obtained by taking the first k + 1 digits of a from left to right from k =1upto, − but not including m2,tok = log2(m) 1: U = {11, 110, 1100, 11000, 110001, 1100011, 11000110, 110001101}. Define a new sequence V = {vk} by vk =2 uk/2 : V = {10, 110, 1100, 11000, 110000, 1100010, 11000110, 110001100} = {2, 6, 12, 24, 48, 98, 198, 398} in base 10. The pairs (F−1+vk ,F1+vk ) may be evaluated recursively by using 2 F F− − F +1 ifv ≡ 0(mod4), 1+vk 1+vk −1+vk k+1 (11) F−1+vk+1 = 2 F − F1+v F−1+v − 1ifvk+1 ≡ 2(mod4), 1+vk k k 2 F − F F− − 1ifv ≡ 0(mod4), 1+vk 1+vk 1+vk k+1 (12) F1+vk+1 = 2 (x − 1)F − F F− +1 ifv ≡ 2(mod4), 1+vk 1+vk 1+vk k+1 which follow from Equations (10), until the value of (F397,F399) is known. Finally · − 2 F795 = F399 F397 F397 +1. 5 · − 13 Example 3.9. We certify the primality of N = 795 1588 1. Now N = −1 ≡ N (mod 795), so the Pell conic C : X2 − 13Y 2 = 4 is suitable for applying Theorem 3.4. The point (11, 3) is the fundamental solution of C(Z). We must 4 evaluate s ≡ f7954·1588(11) (mod N). The binary representation of 795 · 1588 is 10010000001110110010111101110001101010001011110100. As in Example 2.5 we recursively evaluate modulo N, the sequence of pairs (f1(11),f2(11)), (f2(11),f3(11)), (f4(11),f5(11)), (f9(11),f10(11)), ...,(f7954·794(11),f7954·794+1(11)) (mod N) using Equation (9) ≡ (119, 1298), (14159, 154451), (2186871698, 23855111399), ...,(363731798219995454, 244122496081218988) (mod N), s ≡ 3637317982199954542 − 2 ≡ 388011723344360862 (mod N). To evaluate F795(s)(modN), we proceed as in Example 3.8 using Equations (11) and (12): {(F1(s),F3(s)), (F5(s),F7(s)), (F11(s),F13(s)),...,(F397(s),F399(s))} (mod N) ≡{(1, 388011723344360863), (329280233123969461, 62155946453030219), ...,(139048125143085063, 364686195778250318)} (mod N). · − 2 ≡ Now F795(s)=F399(s) F397(s) F397(s)+1 0(modN), so N is prime. 4. The primality test for 3nh ± 1 using X2 +3Y 2 =4 The recursions of both the classical Lucas-Lehmer test and that of the primality test [1] for 3nh ± 1 coincide with repeated duplication and repeated multiplication by 3 respectively. We have a geometric variation of the test of Berrizbeitia and Berry [1]. Theorem 4.2 relies on the cubic reciprocity law in the unique factorization domain Z[ω]whereω is a primitive cube root of unity. See [3] for the following and for the · other various identities of the cubic residue symbol · 3. License or copyright restrictions may apply to redistribution; see https://www.ams.org/journal-terms-of-use 2660 S. HAMBLETON Theorem 4.1 (Eisenstein) . If α and π are primes of Z[ω] which are congruent to ± π α 1(mod3),then α 3 = π 3. Below we simply associate the primality test [1] for 3nh ± 1 with the curve X2 +3Y 2 = 4. This avoids case (3) of Theorem 3.4 altogether, since one may not wish to accept 2 chances in 3 for obtaining a primality certificate. Theorem 4.2. Let N =3nh + ,where = ±1, h is even, not divisible by 3, 0