MASARYK UNIVERSITY FACULTY OF INFORMATICS Baillie-PSW pseudoprimes MASTER'S THESIS Ondřej Krčma Brno, Spring 2021 MASARYK UNIVERSITY FACULTY OF INFORMATICS Baillie-PSW pseudoprimes MASTER'S THESIS Ondřej Krčma Brno, Spring 2021 This is where a copy of the official signed thesis assignment and a copy of the Statement of an Author is located in the printed version of the document. Declaration Hereby I declare that this paper is my original authorial work, which I have worked out on my own. All sources, references, and literature used or excerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Ondřej Krčma Advisor: Mgr. Marek Sys, Ph.D. i Acknowledgements I would like to thank Mgr. Marek Sys, Ph.D. for his invaluable advice during my work on this thesis. Computational resources were supplied by the project "e-Infrastruktura CZ" (e-INFRA LM2018140) provided within the program Projects of Large Research, Development and Innovations Infrastructures. iii Abstract The goal of this thesis is to examine and look for a weaker version of the Baillie-PSW pseudoprimes. First we examine the Fermat and the Lucas pseudoprimes and the divisibility properties of the order and the rank of appearance. We present the known theory and complete some missing proofs and algorithms. We also examine the notion of admissibility, which is the main necessary condition for the sought pseudoprimes. In the last chapter, we apply the theory and attempt to find the pseudoprimes in several special cases. iv Keywords primality tests, pseudoprimes, Baillie-PSW, PSW-challenge pseudo- primes, rank of appearance, admissibility v Contents Introduction 1 1 The Fermat test 3 1.1 Order of a modulo n 4 1.2 Fermat pseudoprimes to base 2 7 2 Lucas sequences 9 2.1 Computing Lucas sequences 10 2.2 Lucas pseudoprimes 13 2.3 Rank of appearance of n 15 2.4 Lucas pseudoprimes in the Fibonacci sequence 19 3 The Baillie-PSW test 21 3.1 Challenge pseudoprimes 22 3.1.1 Admissibility 23 3.1.2 Computing last prime 28 4 Search for challenge psudoprimes 31 4.1 Small prime factors 32 4.1.1 Admissibility from order and rank 33 4.1.2 Full version of the algorithm 34 4.2 Pseudoprimes of the form 2n_1 — 1 34 4.2.1 Primes with rank equal to a power of two .... 35 4.2.2 Mersenne primes 35 4.3 Two prime factors 36 4.3.1 Admissible primes p with e(p) = 1 37 4.3.2 Computing the other prime 37 4.4 Even number of prime factors 38 4.4.1 Case of p > 245 38 4.4.2 Case of p < 245 39 4.5 Lattice based solutions 40 4.5.1 Searching for the pseudoprimes 40 4.5.2 Transformation of the problem 41 4.5.3 Lattice for Fermat pseudoprimes 42 4.5.4 Example for Fermat pseudoprimes 43 4.5.5 Lattice for both Fermat and Lucas pseudoprimes 44 vii Conclusion Bibliography viii Introduction Generating large random primes is a key component of cryptosystems such as RSA. However, deciding whether a random large (in the order of thousands of bits) integer is prime or composite is computationally expensive. There are two basic kinds of primality tests: deterministic and probabilistic. Deterministic tests will give us a definitive answer on whether the input integer is prime or not, but they are often too slow. In general, probabilistic tests are fast, however some composite integers also pass through. These composite integers which pass some probabilistic primality test are called pseudoprimes and the more pseudoprimes there are for a given test, the worse the test is. In this thesis we are looking for pseudoprimes for a weaker version of the Baillie-PSW test, because, so far, no pseudoprimes for this test have been found. The text of this thesis is split into four chapters. In the first chap• ter we introduce Fermat pseudoprimes and examine some of their properties, for example the order. In the second chapter we look at Lucas sequences and Lucas pseudoprimes. We briefly discuss how to compute Lucas sequences and then examine Lucas pseudoprimes and their properties, especially the rank of appearance. There are many similarities between the Fermat and the Lucas pseudoprimes, and the lemmas in the second chapter often parallel lemmas from the first chapter. In the third chapter we combine the two tests into the Baillie-PSW test and examine PSW-challenge pseudoprimes, which are composite integers passing the weaker version of the test. We mostly focus on the notion of admissibility, which is a strong neces• sary condition, which all PSW-challenge pseudoprimes must satisfy. And finally, in the fourth chapter we describe our attempts to find the PSW-challenge pseudoprimes. The reader is expected to be familiar with basic algebraic concepts such as the order of a group element, modular arithmetic or the Chi• nese Remainder Theorem. The first two chapters mostly cover the known theory, so a reader who is confident in their knowledge of Fer• mat and Lucas pseudoprimes may skip directly to the third chapter. However, we present some proofs and algorithms missing from the literature, and so we recommend starting from the beginning. 1 1 The Fermat test One of the simplest primality tests is the Fermat test. Fermat's little theorem gives the following necessary condition which all primes must satisfy. Theorem 1.1 (Fermat's little theorem). Let p be prime and a an integer such that a ^ 0 (mod p), then aP'1 = 1 (mod p). To test whether given n is prime, we choose a coprime to n (for example a = 2) and calculate an~x mod n. If the resulting value is not 1, then we are sure that n is not prime. Whereas if the result is 1, then n may or may not be prime. For example 2340 = 1 (mod 341), however 341 = 11 x 31 is a composite integer. Composite numbers which pass a primality test such as the Fermat test are called pseudoprimes. There are many different primality tests and an integer may be a pseudoprime relative to one test and not a pseudoprime relative to other tests. This gives us different types and definitions of pseu• doprimes, the first of which is the Fermat pseudoprime. Note that different authors may have slightly different definitions of the indi• vidual types of pseudoprimes. We will follow the terminology from [!]• Definition 1. An odd composite integer n is a (Fermat) pseudoprime to base a if a""1 = 1 (mod n). An integer n may be pseudoprime to some bases and not others, so if the test fails for one base, we may try another. Note that the set of bases to which n is pseudoprime forms a subgroup of Z*, so trying multiple bases one after another may lead to diminishing returns. The main problem however is that there exist Carmichael numbers, which are integers that are Fermat pseudoprimes to all possible bases. In 1994 Pomerance showed that there are infinitely many Carmichael numbers [2]. To get around this problem we may define stronger necessary conditions and stronger tests. 3 i. THE FERMAT TEST Definition 2. An odd composite integer n is an Euler pseudoprime to base a if gcd(a, n) = 1 and cf^ = ^—j (mod n), where (|) is the Jacobi symbol. Clearly, an Euler pseudoprime is also Fermat pseudoprime. Be• cause of the multiplicative property of Jacobi symbols, the bases of an Euler pseudoprime still form a multiplicative group. However Lehmer showed that there are no integers which are Euler pseudoprimes to all possible bases [3] (i.e. there is no equivalent of Carmichael numbers for Euler pseudoprimes). Since the bases to which n is Euler pseudo- prime form a subgroup of Z* and n cannot be pseudoprime to all the bases, then n is pseudoprime to at most half of the possible bases. The test can be strengthened even further. Definition 3. An odd composite integer n = d • 2s + 1, where d is odd, is a strong (Fermat) pseudoprime to base a if ad = 1 (mod ft) or ad-r = -1 (mod n) for some 0 < r < s. A strong (Fermat) pseudoprime is both Euler and Fermat pseu• doprime. Since it's an Euler pseudoprime, there are no equivalents of Carmichael numbers, but the bases no longer form a group. Unfortu• nately, there are still infinitely many strong pseudoprimes to any base [!]• 1.1 Order of a modulo n In the rest of this thesis we will focus mainly on the basic Fermat test (in the second and the third chapters in combination with the Lucas test). In this chapter we present some properties of Fermat pseudoprimes and the order of base a modulo n. 4 i. THE FERMAT TEST Definition 4. Given an odd positive integer n and a base a, the order of a modulo n is the least positive integer k such that ak = 1 (mod n). We will follow the notation of Pomerance, Self ridge and Wagstaff [1] and denote the order as la (n). The reason we do not follow the standard notation of ordn (a) is that in this context the order is a property of the modulus n and not of the base a. k It is well known [4] that if a = 1 (mod n), then la{n) \ k. This means that if n is a Fermat pseudoprime, then la(n) \ (n — 1). The order la (n) also divides the group order (p{n), where cp denotes Euler's totient function.