Deterministic Primality Proving on Proth Numbers Tsz-Wo Sze ([email protected]) November 9, 2018 Abstract We present an algorithm to decide the primality of Proth numbers, N =2et+1, without assuming any unproven hypothesis. The expected running time and the worst case running time of the algorithm are 2 O˜((t log t + log N) log N) and O˜((t log t + log N) log N) bit operations, respectively. 1 Introduction A Proth number is a positive integer of the form N = 2e t +1 forsomeodd t with 2e >t> 0. (1.1) · A self-taught farmer, Fran¸cois Proth, published Theorem 1.1 below in 1878; see [24] for more details and a proof of Theorem 1.1. Theorem 1.1 (Proth Theorem). Let N be a Proth number defined in (1.1). If (N 1)/2 a − 1 (mod N) (1.2) ≡− arXiv:0812.2596v5 [math.NT] 4 Jul 2011 for some integer a, then N is a prime. As a consequence, the primality of Proth numbers can be decided by a simple, fast probabilistic primality test, called the Proth test, which ran- domly chooses an integer a 0 (mod N) and then computes 6≡ (N 1)/2 b a − (mod N). (1.3) ≡ We have the following cases. 2010 Mathematics Subject Classification: Primary 11Y11; Secondary 11A41. Key words and phrases: Proth Numbers, Cullen Numbers, Primality Proving, Pri- mality Test. 1 (i) If b 1 (mod N), then N is a prime by Theorem 1.1. ≡− (ii) If b 1 (mod N) and b2 1 (mod N), then N is composite because 6≡ ± ≡ gcd(b 1,N) are non-trivial factors of N. ± (iii) If b2 1 (mod N), then N is composite by Fermat’s little theorem. 6≡ (iv) If b 1 (mod N), the primality of N remains unknown. ≡ Case (iv) is the reason that the Proth test is probabilistic. In case (i), the integer a is a quadratic nonresidue modulo N. The procedure is repeated until the primality of N is decided. 1 When N is a prime, the Proth test has probability 2 being able to return N prime in one iteration since the number of quadratic nonresidues modulo N 1 N is exactly 2− . The expected number of iterations is O(1). Equation (1.3) can be computed in O˜(log2 N) bit operations using fast integer multiplica- tions [9, 19]. Consequently, the expected running time is O˜(log2 N) bit operations uniformly for all t< 2e. However, the worst case running time is exponential since the number of a such that b 1 (mod N) is linear to N. ≡ For any integer N, when N 1 is fully factored or when N 1 is partially − − factored, deterministic algorithms by Konyagin and Pomerance can be used to prove primality in polynomial time [15]. Their algorithms apply to all Proth numbers N = 2et +1, and run in O˜(log3+C N), where C > 0 is a constant depending on e and t. The key idea is the use of smooth numbers so that an “exponentially large” subgroup of (Z/NZ)× can be created by a “polynomial sized” set of generators. We will use smooth numbers to calculate √ 1 (mod N) in Algorithm 2.3. − There are interesting special cases of Proth numbers. When t = 1, the Proth number N = 2e + 1 is a Fermat number. It is easy to see that N is composite if e is not a power of two. In addition, the primality of N can be decided by the Pepin test [18], which is virtually the same as the Proth test, except that a = 3 is specified in equation (1.2). The Pepin test is deterministic due to the following theorem. Theorem 1.2 (Pepin Test). Let N = 2e + 1 > 3. Then N is a prime if and only if (N 1)/2 3 − 1 (mod N). (1.4) ≡− We skip the proof of Theorem 1.2 and show a trivial generalization, Theorem 1.3, below. As a result, for Proth numbers with t not divisible by 3, the primality can be decided in O˜(log2 N) bit operations. 2 Theorem 1.3 (Generalized Pepin Test). Let N = 2et + 1 > 3 be a Proth number defined in (1.1) such that 3 ∤ t. Then N is a prime if and only if (N 1)/2 3 − 1 (mod N). (1.5) ≡− Proof. For any Proth number, we have e 1 by the condition 2e >t> 0. ≥ If e = 1, then t = 1 by the same condition. However, the case N = 3 is excluded by the assumption N > 3. Therefore, we have e 2. ≥ When N is a prime, we have 3 ∤ N. Then, N 2 (mod 3) by the ≡ assumption 3 ∤ t. The Legendre symbol 3 = N = 2 = 1 so that 3 is N 3 3 − a quadratic nonresidue modulo N. Finally, the theorem follows from Theorem 1.1. Similarly, there is a deterministic, O˜(log2 N) algorithm to decide the primality of Proth numbers with t not divisible by 5. Theorem 1.4. Let N = 2e t + 1 > 5 be a Proth number defined in (1.1) · such that 5 ∤ t. Then N is a prime if and only if (N 1)/2 a − 1 (mod N), ≡− where 5, if N 0, 2, 3 (mod 5); a = 5 √5 ≡ (1.6) ( − ± (mod N), if N 4 (mod 5). 2 ≡ Proof. Suppose N is a prime with N 2, 3 (mod 5). Then, 5(N 1)/2 1 ≡ − ≡− (mod N) since 5 is a quadratic nonresidue modulo N. Suppose N is a prime with N 4 (mod 5). Then, 5 is a quadratic ≡ residue modulo N. Let α + √α2 4 1 √5 Z ζ = − , where α = − ± . 2 2 ∈ NZ Both values of ζ are 5th roots of unity modulo N. However, 5th roots of unity are not in Z/NZ since N 1 (mod 5). Therefore, ζ Z/NZ and 2 5 √5 6≡ 6∈ α 4= − ∓ are quadratic nonresidues modulo N. − 2 The theorem follows from Theorem 1.1. Note that, when N 4 (mod 5), it is unnecessary to calculate √5 ≡ (mod N) in equation (1.6). We may check whether (N 1)/2 5+ x − − 1 (mod x2 5,N) 2 ≡− − 3 5 √5 since, for N prime, both − ±2 are quadratic nonresidues modulo N. Another interesting special case of Proth numbers is Cullen numbers [8]. A Cullen number is a number of the form C = 2n n +1 for n 1. n · ≥ Notice that n is allowed to be even. Obviously, a Cullen number is a Proth number since 2n > n for any positive integer n. There are well-known divisibility properties of Cullen numbers [13]. A list is given below without proofs. Let p be any odd prime. Let n = (2k k)(p 1) k for k 0. Then, p C . • k − − − ≥ | nk Let d = ord 2. If p C , then p C . • p | n | n+pd If the Legendre symbol 2 = 1, then p C . • p − | (p+1)/2 2 If the Legendre symbol p = 1, then p C(3p 1)/2. • | − In [22, 21], a new idea is introduced for deciding the primality of Proth numbers but the details are missing. In this paper, we fill in all the details and extend the idea to obtain the following theorem. Theorem 1.5. Let N be a Proth number defined in (1.1). There is an algorithm deciding the primality of N. The expected running time and the worst case running time of the algorithm are O˜((t log t + log N) log N) and O˜((t log t + log N) log2 N) bit operations, respectively. When t = O(log N), the expected running time and the worst case run- ning time are O˜(log2 N) and O˜(log3 N) bit operations, respectively. Note that Cullen numbers are covered in this case. To the best of our knowledge, our algorithm (Algorithm 4.1) is the fastest among other known primality proving algorithms for numbers of this kind. By primality proving algo- rithms, we mean primality algorithms that always return the correct output. Adleman-Pomerance-Rumely [1] runs in sub-exponential time. The running times of AKS [2] and Lenstra-Pomerance’s modified AKS algorithm [12] are O˜(log7.5 N) and O˜(log6 N), respectively. The algorithms by Konyagin 4 and Pomerance [15] run in O˜(log3+C N) for some 0 < C 3/7, C a con- ≤ stant depending on e and t. All the algorithms mentioned above have been proved unconditionally. With extra assumptions such as the Extended Rie- mann Hypothesis, we have the following results: The elliptic curve primality proving algorithm [5, 10] runs in O˜(log5 N). The running time of Miller’s algorithm [17] is O˜(log4 N). AKS can be improved [6, 16] to O˜(log4 N). The Proth test becomes deterministic and the running time is O˜(log4 N) since it only has to check congruence equation (1.2) with 2 a k, where k is ≤ ≤ O(log2 N) by the results from Ankeny [3]. For t = O(log N), Algorithm 4.1 attains the same order of expected running time, O˜(log2 N), as the probabilistic Proth test. Although Algo- rithm 4.1 is a randomized algorithm, it always returns the correct output in one iteration. In contrast, the Proth test may be unable to decide the primality of N in any fixed number of iterations because of the exponential time worst cases. When the actual numbers of bit operations are compared, the Proth test is faster.