Independence of the Miller-Rabin and Lucas Probable Prime Tests Alec Leng Mentor: David Corwin March 30, 2017 1 Abstract In the modern age, public-key cryptography has become a vital component for se- cure online communication. To implement these cryptosystems, rapid primality test- ing is necessary in order to generate keys. In particular, probabilistic tests are used for their speed, despite the potential for pseudoprimes. So, we examine the commonly used Miller-Rabin and Lucas tests, showing that numbers with many nonwitnesses are usually Carmichael or Lucas-Carmichael numbers in a specific form. We then use these categorizations, through a generalization of Korselt’s criterion, to prove that there are no numbers with many nonwitnesses for both tests, affirming the two tests’ relative independence. As Carmichael and Lucas-Carmichael numbers are in general more difficult for the two tests to deal with, we next search for numbers which are both Carmichael and Lucas-Carmichael numbers, experimentally finding none less than 1016. We thus conjecture that there are no such composites and, using multi- variate calculus with symmetric polynomials, begin developing techniques to prove this. 2 1 Introduction In the current information age, cryptographic systems to protect data have become a funda- mental necessity. With the quantity of data distributed over the internet, the importance of encryption for protecting individual privacy has greatly risen. Indeed, according to [EMC16], cryptography is allows for authentication and protection in online commerce, even when working with vital financial information (e.g. in online banking and shopping). Now that more and more transactions are done through the internet, rather than in person, the importance of secure encryption schemes is only growing. Thus, as some commonly used public key cryptography algorithms rely on large semi- primes that are extremely difficult to factor, fast prime generation is vital for key gener- ation. For example, the RSA cryptosystem is one of the most widely used systems for cryptography—even when not used directly, its often used to encrypt the keys for other cryptographic algorithms ([CSE11]). To implement it, RSA requires semiprimes that are around 2048 bits (about 600 decimal digits) for its key ([EMC16]). These semiprimes are the product of two primes, so one needs to quickly generate primes that are around 1048 bits (around 300 decimal digits). If we have a way to quickly determine if a number is prime, we can quickly generate the necessary primes by choosing “candidate” numbers in the right size, until we find one that is prime. 1.1 Primality Tests Methods for determining whether or not a number n is prime are simply called primality tests. There are two distinct types of primality tests. On one hand, deterministic tests always decide for certain whether or not n is prime. On the other hand, probabilistic tests determine either that n is composite, or that it might be prime. This is done by checking whether or not n satisfies some properties which are true of all primes and few composites. While these probabilistic tests do not always correctly determine if a number is prime, they are generally far faster than deterministic tests. Indeed, when compared with the fast (in the sense that it runs in polynomial-time), deterministic, Agrawal-Kayal-Saxena (AKS) primality test, effective probabilistic primality tests are still millions of times faster [AKS04]. Thus, probabilistic primality tests remain very relevant. Indeed, even when attempting to prove that a number is prime, probabilistic tests can be rapidly applied to quickly exclude most composite numbers, reducing the overall time the primality test takes. 3 1.2 The Fermat Primality Test The Fermat test is constructed from Fermat’s Little Theorem, which says that for a prime p, and any a relatively prime to p, we have ap−1 ≡ 1 (mod p). So, to turn this into a primality test, given an odd number n, we choose some positive integer a < n that is relatively prime to n and see if an−1 ≡ 1 (mod n). If the congruence holds, then n might be prime. However, if the congruence does not hold, then we know n is a composite, and we call a a witness for n’s compositeness. Similarly, if n is actually composite, and the congruence holds for some a, then we call that a a nonwitness, and n a Fermat pseudoprime. However, the Fermat Primality test itself is not particularly useful; there are some n for which every a is a nonwitness. These numbers are called Carmichael numbers, and they will play a vital role when looking at pseudoprimes to the Miller-Rabin test. 1.3 The Miller-Rabin Primality Test In the Miller-Rabin test, we express our odd integer n as n = 1+d ·2k, for d an odd integer. Then, as with the Fermat test, we choose a positive integer a < n, relatively prime to n, as a potential witness. However, with the Miller-Rabin test, we check that either ad ≡ 1 r (mod n); or a2 ·d ≡ −1 (mod n) for some r < k. If one of these conditions hold, then n is a probable prime. If n is actually composite, then we say that it is a strong pseudoprime, and that a is a nonwitness. Likewise, if neither of the conditions hold, then a is a witness to n and n is known to be composite. As this paper will not examine the Fermat test, “witness” and “nonwitness,” when used to describe an integer a, will be used to mean a “witness” or “nonwitness” for the Miller-Rabin test. For a given n, we will use N(n) to denote the number of Miller-Rabin nonwitnesses to n. We will focus on this test, and the Lucas Probable Prime test which we now introduce. 1.4 The Lucas Probable Prime Test To construct the weak Lucas test, we first define the Lucas Sequences U and V, when given two integers P and Q, by U0 = 0, U1 = 1, Uk+2 = PUk+1 − QUk, and V0 = 2, V1 = 2 P, Vk+2 = PVk+1 − QVk. Then, let D = P − 4Q, and let e(n) denote the Jacobi symbol D . We have the following as a well-known theorem: n Theorem. [Arn97] Let p be a prime number, relatively prime to 2QD. Set p − e(p) = 2kq for q an odd integer. Then, pjU2kq. 4 Note that this condition can be viewed as analogous to the condition for the Fermat test. So, just like with the Fermat test, there is a stronger form of the statement; if p is prime, then one of the following conditions is satisfied: pjUq or there exists some i, 0 ≤ i < k, where pjV i : 2 q p Let O be the ring of algebraic integers in Q( D). Then, [Arn97] shows that each Lucas sequence is in a one-to-one correspondence with the norm-1 elements t in O where t − 1 is a unit in O=n. Furthermore, [Arn97] also shows that for a given Lucas sequence, if n is k k relatively prime to 2QD, then njUk () t ≡ 1 (mod n) and njVk () t ≡ −1 (mod n). In light of these equivalences, we will often study the Lucas test with algebraic integers, not with Lucas sequences. Now, we can turn the Lucas condition into a primality test, starting with some n rel- atively prime to 2QD and setting n − e(n) = 2kq for q odd. If, for a composite n, either njUq or there is some i, 0 ≤ i < k, where pjV2iq; then we call n a strong Lucas pseudoprime, since it satisfies the strong form of the Lucas test, and the pair of parameters (P;Q) (or the corresponding quadratic integer t), a nonwitness. We will now introduce some notation that is useful when talking about Lucas pseudo- e1 em primes. Suppose n > 2 factors into primes as n = p1 ··· pm . Let ei denote e(pi). Then, ki for 1 ≤ i ≤ m, let pi − ei = 2 qi for qi odd. Finally, let SL(D;n) denote the number of nonwitnesses, analogous to N(n) for Miller-Rabin nonwitnesses. The Lucas test, when used correctly, can be highly independent of the Miller Rabin test, making it particularly interesting. Indeed, several algorithms exploit this independence to yield extremely powerful primality tests; of particular note is the Baillie-PSW test, for which there are no known composite n which are “probably prime.” 1.5 This Research In Section 2, we begin by examining prior results about numbers with many nonwitnesses for both the Miller-Rabin and Lucas Pseudoprime tests. We define our concept of “Lucas- Carmichael numbers” as an analog of the Carmichael numbers, but for the Lucas Probable Prime test, and give a categorization of numbers with many nonwitnesses for both the Miller-Rabin and Lucas tests in terms of Carmichael and Lucas-Carmichael numbers. In order to prove that no numbers have many nonwitnesses for both tests, we prove that if a composite has three prime factors, then it cannot be a Carmichael number and a Lucas- Carmichael number. Then, in Section 3, we begin to generalize this result to show that there are no composites that are both Carmichael and Lucas-Carmichael numbers, developing 5 lemmas and techniques before applying them to a particular form of numbers with five prime factors to show that there are no numbers in that form that are both Carmichael and Lucas-Carmichael numbers. We conclude in Section 4 by considering possible future work. 2 Finding Composites with Many Nonwitnesses 2.1 Prior Results In the case of the Miller-Rabin test, we have the below classification for the numbers with high amounts of nonwitnesses, where j(n) denotes the Euler totient function, and v2(n) is v2(n) the greatest natural number so that 2 jn.