The Great Trinomial Hunt Richard P
Total Page:16
File Type:pdf, Size:1020Kb
The Great Trinomial Hunt Richard P. Brent and Paul Zimmermann trinomial is a polynomial in one vari- illustrate why this might be true, consider a able with three nonzero terms, for sequence (z0; z1; z2; : : .) satisfying the recurrence example P = 6x7 + 3x3 − 5. If the co- (1) zn = zn−s + zn−r mod 2; efficients of a polynomial P (in this case 6; 3; −5) are in some ring or field where r and s are given positive integers, r > s > 0, A and the initial values z ; z ; : : : ; z are also given. F, we say that P is a polynomial over F, and 0 1 r−1 write P 2 F[x]. The operations of addition and The recurrence then defines all the remaining terms multiplication of polynomials in F[x] are defined in zr ; zr+1;::: in the sequence. the usual way, with the operations on coefficients It is easy to build hardware to implement the performed in F. recurrence (1). All we need is a shift register capable Classically the most common cases are F = of storing r bits and a circuit capable of computing Z; Q; R, or C, respectively the integers, rationals, the addition mod 2 (equivalently, the “exclusive reals, or complex numbers. However, polynomials or”) of two bits separated by r − s positions in the over finite fields are also important in applications. shift register and feeding the output back into the We restrict our attention to polynomials over the shift register. This is illustrated in Figure 1 for r = 7, s = 3. simplest finite field: the field GF(2) of two elements, usually written as 0 and 1. The field operations of addition and multiplication are defined as for ! ! integers modulo 2, so 0 + 1 = 1, 1 + 1 = 0, 0 × 1 = 0, ! 1 × 1 = 1, etc. An important consequence of the definitions is + ! that, for polynomials P;Q 2 GF(2)[x], we have ! (P + Q)2 = P 2 + Q2 Output Figure 1. Hardware implementation of because the “cross term” 2PQ vanishes. High z = z + z mod 2. school algebra would have been much easier if we n n−3 n−7 had used polynomials over GF(2) instead of over R! The recurrence (1) looks similar to the well- Trinomials over GF(2) are important in cryp- known Fibonacci recurrence tography and random number generation. To Fn = Fn−1 + Fn−2; Richard Brent is professor of mathematics at the Mathe- indeed, the Fibonacci numbers mod 2 satisfy matical Sciences Institute of the Australian National Uni- our recurrence with r = 2, s = 1. This gives a versity, Canberra. His email address is [email protected]. sequence (0; 1; 1; 0; 1; 1; : : .) with period 3: not very Paul Zimmermann is directeur de recherche at INRIA interesting. However, if we take r larger, we can Nancy. His email address is [email protected]. get much longer periods. February 2011 Notices of the AMS 233 The period can be as large as 2r − 1, which We are interested in primitive polynomials makes such sequences interesting as components because x is a generator of the multiplicative group in pseudo-random number generators or stream of the finite field GF(2)[x]/P(x) if P(x) is primitive. ciphers. In fact, the period is 2r − 1 if the initial If r is large and 2r − 1 is not prime, it can be values are not all zero and the associated trinomial difficult to test primitivity of a polynomial of degree xr + xs + 1; r, because we need to know the prime factors of 2r − 1. Thanks to the Cunningham project [20], regarded as a polynomial over GF(2), is primitive. these are known for all r < 929, but not in general A primitive polynomial is one that is irreducible (it for larger r. On the other hand, if 2r − 1 is prime, has no nontrivial factors) and satisfies an additional then all irreducible polynomials of degree r are condition given in the “Mathematical Foundations” primitive. This is the reason that we consider section below. degrees r that are Mersenne exponents. A Mersenne prime is a prime of the form 2r − 1. Such primes are named after Marin Mersenne (1588–1648), who corresponded with many of the Starting the Search scholars of his day, and in 1644 gave a list (not In the year 2000 the authors were communicating quite correct) of the Mersenne primes with r ≤ 257. by email with each other and with Samuli Larvala A Mersenne exponent is the exponent r of a when the topic of efficient algorithms for testing Mersenne prime 2r − 1. A Mersenne exponent irreducibility or primitivity of trinomials over is necessarily prime, but not conversely. For GF(2) arose. The first author had been interested example, 11 is not a Mersenne exponent because in this topic for many years because of the 211 − 1 = 23 · 89 is not prime. application to pseudo-random number generators. The topic of this article is a search for primitive Publication of a paper by Kumada et al. [12], trinomials of large degree r, and its interplay with describing a search for primitive trinomials of a search for large Mersenne primes. First, we need degree 859 433 (a Mersenne exponent), prompted to explain the connection between these two topics the three of us to embark on a search for primitive and briefly describe the GIMPS project. Then we trinomials of degree r, for r ranging over all describe the algorithms used in our search, which known Mersenne exponents. At that time, the can be split into two distinct periods, “classical” largest known Mersenne exponents were 3 021 377 and “modern”. Finally, we describe the results and 6 972 593. The existing programs took time obtained in the modern period. proportional to r 3. Since (6972593=859433)3 ≈ 534, and the computation by Kumada et al. had Mathematical Foundations taken three months on nineteen processors, it was As stated above, we consider polynomials over quite a challenge. the finite field GF(2). An irreducible polynomial is a polynomial that is not divisible by any The GIMPS Project nontrivial polynomial other than itself. For example, GIMPS stands for Great Internet Mersenne Prime 5 + 2 + 5 + + x x 1 is irreducible, but x x 1 is not, since Search. It is a distributed computing project x5 + x + 1 = (x2 + x + 1)(x3 + x2 + 1) in GF(2)[x]. started by George Woltman, with home page We do not consider binomials xr + 1, because they http://www.mersenne.org. The goal of GIMPS is are divisible by x + 1, and thus reducible for r > 1. to find new Mersenne primes. As of December 2010, An irreducible polynomial P of degree r > 1 GIMPS has found thirteen new Mersenne primes yields a representation of the finite field GF(2r ) of in fourteen years and has held the record for the 2r elements: any polynomial of degree less than r largest known prime since the discovery of M represents an element, the addition is polynomial 35 addition, whose result still has degree less than r, in 1996. Mersenne primes are usually numbered 2 and the multiplication is defined modulo P: one in increasing order of size: M1 = 2 − 1 = 3, M2 = 3 5 7 first multiplies both inputs and then reduces their 2 − 1 = 7, M3 = 2 − 1 = 31, M4 = 2 − 1 = 127, 6972593 product modulo P. Thus GF(2r ) ' GF(2)[x]/P(x). …, M38 = 2 − 1, etc. An irreducible polynomial P of degree r > 0 Since GIMPS does not always find Mersenne over GF(2) is said to be primitive iff P(x) 6= x primes in order, there can be some uncertainty in and the residue classes xk mod P; 0 ≤ k < 2r − 1, numbering the largest known Mersenne primes. 0 are distinct. In order to check primitivity of an We write Mn for the nth Mersenne prime in order irreducible polynomial P, it is only necessary to of discovery. There are gaps in the search above k 13466917 0 0 check that x 6= 1 mod P for those k that are M39 = 2 −1. Thus we can have Mn > Mn+1 for r 0 43112609 maximal nontrivial divisors of 2 − 1. For example, n > 39. For example, M45 = 2 − 1 was found 5 2 6 3 0 37156667 0 42643801 x + x + 1 is primitive; x + x + 1 is irreducible before M46 = 2 − 1 and M47 = 2 − 1. but not primitive, since x9 = 1 mod (x6 + x3 + 1). At the time of writing this article, forty-seven Here 9 divides 26 − 1 = 63 and is a maximal divisor Mersenne primes are known, and the largest is 0 43112609 as 63=9 = 7 is prime. M45 = 2 − 1. 234 Notices of the AMS Volume 58, Number 2 It is convenient to write rn for the exponent of A GCD computation for polynomials of degree 0 0 Mn, and rn for the exponent of Mn. For example, bounded by r costs O(M(r) log r) using a “divide 0 r45 = 43 112 609. and conquer” approach combined with Schönhage’s fast polynomial multiplication. The costs are Swan’s Theorem summarized in Table 1. We state a useful theorem known as Swan’s theorem, although the result was found much earlier by Table 1: Cost of the basic operations. Pellet [14] and Stickelberger [18]. In fact, there are several theorems in Swan’s paper [19]. We state a modular squaring O(r) simplified version of Swan’s Corollary 5. modular product O(M(r)) GCD O(M(r) log r) Theorem 1.