Prime Numbers

Note that the definition of χp,q and of l imply that

G(p, q)pw(p)up ≡ ζpl(p,q) = ζpl(q) = χp,q (gql(q)) = χp,q (l) (mod r)

for every pair of primes p, q with q|F, p|q − 1. Thus, from (4.22) and Lemma 4.4.2,

χp,q (r) = χp,q (r)bp ≡ G(p, q)(rp−1−1)bp = G(p, q)pw(p)up ap

≡ χp,q (l)ap = χp,q (la) (mod r),

and so by Lemma 4.4.3 we have

χp,q (r) = χp,q (la).

The product of the characters χp,q for p prime, p|I and p|q − 1, is a character

we have r ≡ la (mod q). As this holds for each prime q|F and F is squarefree, it follows that (4.23) holds. This completes the proof of correctness of Algorithm 4.4.5.

It is clear that the running time is bounded by a fixed power of I, so the running time assertion follows immediately from Theorem 4.3.5.

With some extra work one can extend the Gauss sums primality test to the case where I is not assumed squarefree. This extra degree of freedom allows for a speedier test. In addition, there are speed-ups that use randomness, thus eschewing the deterministic aspect of the test. For a reasonably fast version of the Gauss sums primality test, one might consult the new paper [Schoof 2004].

4.4.2Jacobi sums test

We have just mentioned some ways that the Gauss sums test can be improved in practice, but the principal way is to not use Gauss sums! Rather, as with the original test of Adleman, Pomerance and Rumely, Jacobi sums are used. The Gauss sums G(p, q) are in the ring Z[ζp, ζq ]. Doing arithmetic in this ring modulo n requires dealing with vectors with (p − 1)(q − 1) coordinates, with each coordinate being a residue modulo n. It is likely in practice that we can take the primes p to be very small, say less than ln n. But the primes q can be somewhat larger, as large as (ln n)c ln ln ln n. The Jacobi sums J(p, q) that we shall presently introduce lie in the much smaller ring Z[ζp], and so doing arithmetic with them is much speedier.

Recall the character χp,q from Section 4.4.1, where p, q are primes with p|q − 1. We shall suppose that p is an odd prime. Let b = b(p) be the least

positive integer with (b + 1)p ≡bp + 1 (mod p2). (As shown in [Crandall et al. 1997] we may take b = 2 for every prime p up to 1012 except p = 1093 and p = 3511, for which we may take b = 3. It is probably true that b(p) = 2 or 3 for every prime p. We certainly have b(p) < ln2 p; see Exercise 3.19.)

We now define a Jacobi sum J(p, q). This is

The connection to the supposed primality of n is made with the following more general result. Suppose n is an odd prime not divisible by p. Let f be the multiplicative order of n in Zp. Then the ideal (n) in Z[ζp] factors into (p − 1)/f prime ideals N1, N2, . . . , N(p−1)/f each with norm nf . If α is in Z[ζp] but not in Nj , then there is some integer aj with α(nf −1)/p ≡ ζpaj (mod Nj ). The Jacobi sums test tries this congruence with α = J(p, q) for the same pairs p, q (with p > 2) that appear in the Gauss sums test. To implement this, one also needs to find the ideals Nj . This is accomplished by factoring the polynomial xp−1 + xp−2 + · · · + 1 modulo n into h1(x)h2(x) · · · h(p−1)/f (x), where each hj (x) is irreducible of degree f . Then we can take for Nj the ideal generated by n and hj (ζp). These calculations can be attempted even if we don’t know that n is prime, and if they should fail, then n is declared composite.

For a complete description of the test, the reader is referred to [Adleman et al. 1983]. For a practical version and other improvements see [Bosma and van der Hulst 1990].

4.5The primality test of Agrawal, Kayal, and Saxena (AKS test)

In August 2002, M. Agrawal, N. Kayal, and N. Saxena announced a spectacular new development, a deterministic, polynomial-time primality test. This is now known as the AKS test. We have seen in Algorithm 3.5.13 that such a test exists on the assumption of the extended Riemann hypothesis. Further, in Algorithm 3.5.6 (the “Miller–Rabin test”), we have a random algorithm that expects to prove that composite inputs are composite in polynomial time. We had known a random algorithm that expects to prove that prime inputs are prime in polynomial time; this is the Adleman–Huang test, which will be briefly described in Section 7.6. Finally, as we just saw in Theorem 4.4.6, Algorithm 4.4.5 is a fully proved, deterministic primality test that runs within the “almost polynomial” time bound (ln n)c ln ln ln n. We say “almost polynomial” because the exponent ln ln ln n grows so very slowly that for practical purposes it might be considered bounded. (A humorous way of putting this: Though we have proved that ln ln ln n tends to infinity with n, we have never observed it doing so!)

The new test is not just sensational because it finally settles the theoretical issue of primality testing after researchers were so close in so many ways,

it is remarkable in that the test itself is quite simple. And further, two of the authors, Kayal and Saxena, had worked on this problem for their senior project, having just received their bachelor’s degrees three months before the announcement. A short time later, after suggestions from various quarters, Agrawal, Kayal, and Saxena came out with an even simpler version of the test. These two versions may be found in [Agrawal et al. 2002], [Agrawal et al. 2004].

In this section we shall present the second version of the Agrawal–Kayal– Saxena algorithm, as well as some more recent developments. As of this writing, it remains to be seen whether the AKS test will be useful in proving large numbers prime. The quartic time test at the end of the section stands the best chance.

4.5.1Primality testing with roots of unity

If n is prime, then

for any a Z. Further, if (4.24) holds for just one value of a with gcd(a, n) = 1, then n must be prime; see Exercise 4.25. That is, (4.24) is an if-and-only-if primality criterion. The trouble is that we know no speedy way of verifying (4.24) even for the simple case a = 1; there are just too many terms on the left side of the congruence.

If f (x) Z[x] is an arbitrary monic polynomial, then (4.24) implies that

for every integer a. So, if n is prime, then (4.25) holds for every integer a and every integer monic polynomial f (x). Further, it should be possible to rapidly check (4.25) if deg f (x) is not too large. As an example, take a = 1 and f (x) = x − 1. Then (4.25) is equivalent to

2n ≡ 2 (mod n),

the Fermat congruence to the base 2. However, as we have seen, while this congruence is necessary for the primality of n, it is not su cient. So, by introducing the modulus f (x) we gain speed, but perhaps lose our primality criterion.

But (4.25) allows more generality; we are not required to take f (x) of degree 1. For example, we might take f (x) = xr − 1 for some smallish number r, and so be implicitly dealing with the r-th roots of unity. Essentially, all that needs to be done is to choose r appropriately (but bounded by a polylogarithmic expression in n), and to verify (4.25) for every a up to a certain point (again bounded by a polylogarithmic expression in n).

The new primality test is so simple and straightforward that we cannot resist stating it first as pseudocode, discussing the details only afterward.

Algorithm 4.5.1 (Agrawal–Kayal–Saxena (AKS) primality test). We are given an integer n ≥ 2. This deterministic algorithm decides whether n is prime or composite.

1. [Power test]

If n is a square or higher power, return “n is composite”;

2. [Setup]

Find the least integer r with the order of n in Zr exceeding lg2 n;

If n has a proper factor in [2, ϕ(r) lg n], return “n is composite”;

// ϕ is Euler’s function.

Square testing in Step [Power test] may be done by Algorithm 9.2.11, and higher-power testing may be done by a similar Newton iteration, cf. Exercise 4.11. Note that one has only to test that n is in the form ab for b ≤ lg n. (Note too that from Exercise 4.28, Step [Power test] may actually be skipped entirely!) The integer r in Step [Setup] may be found by sequential search over the integers exceeding lg2 n. In this search, if a value of r is found for which 1 < gcd(r, n) < n, one has of course proved n composite, and the algorithm might be modified to reflect this. With such a modification, one need subsequently search for a proper factor of n only in the interval [2, lg2 n],

rather than [2, ϕ(r) lg n], since the search for r would itself recognize those n with a proper factor in (lg2 n, r], and r > ϕ(r) lg n. Since Step [Setup]

involves a search for small divisors of n, it may occur that all possibilities up

√

to n are accounted for, and so n is proved prime. In this case, of course, one need not continue to Step [Binomial congruences], but this event can occur only for fairly small values of n. See the end of Section 4.5.4 for more notes on AKS implementation.

We shall return to the issue of the size of r when we discuss the complexity of the algorithm, but first we will discuss why the algorithm is correct. Algorithm 4.5.1 is based principally on the following beautiful criterion.

0≤a≤ ϕ(r) lg n

where each a is a nonnegative integer, is in G. Note too that since p >

ϕ(r) lg n, these polynomials are all distinct and nonzero in Zp[x], so that G has many members. We shall make good use of this observation shortly.

We now show that G is a union of residue classes modulo xr − 1. That is, if g1(x) G, g2(x) Zp[x], and g2(x) ≡ g1(x) (mod xr − 1), then g2(x) G. Indeed, by replacing each x with xn, we have g1(xn) ≡ g2(xn) (mod xnr − 1), and since xr − 1 divides xnr − 1, this congruence holds modulo xr − 1 as well.

Thus,

g2(x)n ≡ g1(x)n ≡ g1(xn) ≡ g2(xn) (mod xr − 1),

so that g2(x) G as claimed. Summarizing:

• The set G is closed under multiplication, each monomial x + a is in G for

0 ≤ a ≤ ϕ(r) lg n, and G is a union of residue classes modulo xr − 1.

Let

J = {j Z : j > 0, g(x)j ≡ g(xj ) (mod xr − 1) for each g(x) G}.

By the definition of G, we have n J, and trivially 1 J. We also have p J. Indeed, for every polynomial g(x) Zp[x] we have g(x)p = g(xp), so certainly this relation holds modulo xr − 1 for every g G. It is easy to see that J is closed under multiplication. Indeed, let j1, j2 J and g(x) G. We have g(x)j1 G, since G is closed under multiplication, and since g(x)j1 ≡ g(xj1 ) (mod xr − 1), it follows by the preceding paragraph that g(xj1 ) G. So, since j2 J,

g(x)j1j2 ≡ g(xj1 )j2 ≡ g((xj2 )j1 ) = g(xj1j2 ) (mod xr − 1),

and so j1j2 J. Thus J also has many members. Summarizing:

• The set J contains 1, n, p and is closed under multiplication.

Let K be the splitting field for xr − 1 over the finite field Fp. Thus, K is a finite field of characteristic p and is the smallest one that contains all of the r-th roots of unity. In particular, let ζ K be a primitive r-th root of

of h(x) is the multiplicative order of p in Zr , but we will not be needing this

fact. The key fact that we will need is that K is the homomorphic image of the ring Zp[x]/(xr − 1) where the coset representing x is sent to ζ. Indeed, all that is used for this observation is that h(x)|xr − 1. Let G denote the image of G under this homomorphism. Thus,

G = {γ K : γ = g(ζ) for some g(x) G}.

Note that if g(x) G and j J, then g(ζ)j = g(ζj ).

Let d denote the order of the subgroup of Zr generated by n and p. Let

Gd = {g(x) G : g(x) = 0 or deg g(x) < d}.

Since d ≤ ϕ(r) < r, the members of Gd are all distinct modulo xr −1. We show that our homomorphism to K is one-to-one when restricted to Gd. Indeed, say g1(x), g2(x) Gd and g1(ζ) = g2(ζ). We claim that this forces g1(x) = g2(x). If j = napb, where a, b are nonnegative integers, then j J, so that

g1(ζj ) = g1(ζ)j = g2(ζ)j = g2(ζj ).

This equation holds for d distinct values of j modulo r. But the powers ζj are distinct if the exponents j are distinct modulo r, since ζ is a primitive r-th root of 1. Thus, the polynomial g1(x) − g2(x) has at least d distinct roots in K. But a polynomial cannot have more roots in a field than its degree, and since g1(x), g2(x) are in Gd, it must be that g1(x) = g2(x) as claimed. Summarizing:

•Distinct polynomials in Gd correspond to distinct members of G. We apply this principle to the polynomials

we do not choose all of the exponents a as 1, we will have each g(x) in Gd. Hence there are at least

√ √ √

1 + (2 d lg n +1 − 1) > 2 d lg n = n d

√

members of Gd, and so there are also more than n d members of G. Summarizing:

√

•We have #G ≥ #Gd > n d.

Recall that K F [x]/(h(x)), where h(x) is an irreducible polynomial in

=p

Fp[x]. Denote the degree of h(x) by k. Thus, K Fpk , so it follows that if

=

j, j0 are positive integers with j ≡ j0 (mod pk − 1), and β K, then βj = βj0 .

Let

J = {j Z : j > 0, j ≡ j0 (mod pk − 1) for some j0 J}.

•The set J is closed under multiplication, it contains 1, p, n/p, and for each j J , g(x) G, we have g(ζ)j = g(ζj ).

√

Consider the integers pa(n/p)b, where a, b are integers in [0, d]. Since p, n/p are in the order-d subgroup of Zr generated by p and n, and since there are more than d choices for the ordered pair (a, b), there must be two di erent choices (a1, b1), (a2, b2) with j1 := pa1 (n/p)b1 and j2 := pa2 (n/p)b2 congruent modulo r. Thus, ζj1 = ζj2 , and since j1, j2 J , we have

g(ζ)j1 = g(ζj1 ) = g(ζj2 ) = g(ζ)j2 for all g(x) G.

That is, γj1 = γj2 for all elements γ G. But we have seen that G has more

√ √ √ √

than n d elements, and since j1, j2 ≤ p d(n/p) d = n d, the polynomial xj1 − xj2 has too many roots in K for it not to be the 0-polynomial. Thus, we must have j1 = j2; that is, pa1 (n/p)b1 = pa2 (n/p)b2 . Hence,

nb1−b2 = pb1−b2−a1+a2 ,

and since the pairs (a1, b1), (a2, b2) are distinct, we have b1 =b2. By unique factorization in Z we thus have that n is a power of p.

The preceding proof uses some ideas in the lecture notes [Agrawal 2003]. The correctness of Algorithm 4.5.1 follows immediately from Theorem

4.5.2; see Exercise 4.26.

4.5.2The complexity of Algorithm 4.5.1

The time to check one of the congruences

(x + a)n ≡ xn + a (mod xr − 1, n)

in Step [Binomial congruences] of Algorithm 4.5.1 is polynomial in r and ln n. It is thus crucial to show that r itself is polynomial in ln n. That this is so follows from the following theorem.

Theorem 4.5.3. Given an integer n ≥ 3, let r be the least integer with the order of n in Zr exceeding lg2 n. Then r ≤ lg5 n.

Proof. Let r0 be the least prime number that does not divide

so that r ≤ r0. It follows from inequality (3.16) in [Rosser and Schoenfeld

1962] that the product of the primes in [1, x] exceeds 2x when x ≥ 41. More simply, and more strongly, the Chebyshev-type estimate of Exercise 1.28 givesp≤x p > 2x when x ≥ 31. Now the product of the primes dividing N is at most N , and

N < n1+1+2+···+ lg2 n = n 12 lg2 n 2+ 12 lg2 n +1 < nlg4 n = 2lg5 n.

Hence there is a prime r0 ≤ lg5 n with r0 not dividing N when lg5 n ≥ 31. This last inequality holds when n ≥ 4. However, for n = 3 the least r in the theorem is 5, so the theorem holds in this case as well.

So, the proof is complete that the deterministic Algorithm 4.5.1 decides whether n is prime or composite in polynomial time. But as soon as one problem is solved, new ones naturally arise. Among these: Exactly how fast is Algorithm 4.5.1? Can we do better? Is it practical?

First, we analyze Algorithm 4.5.1 using only elementary, naive subroutines. The bit complexity to check just one of the congruences in Step [Binomial congruences] is O(r2 ln3 n). Thus the time to check all of them is bounded by O(r2.5 ln4 n). Using r = O(ln5 n) from Theorem 4.5.3, we get a total bit complexity for the congruences of O(ln16.5 n). It is easy to see that the other steps of the algorithm are bounded by smaller expressions, so we have our first O-estimate for the complexity of the algorithm, namely O(ln16.5 n).

Sometimes elementary and naive is the best road to take. But for large numbers and high-degree polynomials, the methods of Chapter 8.8 are indicated. To obtain (x + a)n modulo xr − 1 and modulo n, we may employ a power ladder (of O(ln n) steps) with internal modular polynomial multiplies of degree less than r, and with coe cients always smaller than n. Thus the dominant calculation—that for (x + a)n—comes down to O((ln n)(r ln r)M (ln n)) bit operations, where M (b) is the bit complexity for multiplying two integers of b bits each (see, for example, the discussion following Algorithm 9.6.1). So, with fast algorithms, the time for one of the

˜

is sometimes called “soft O notation.” Thus, if g(n) = O(f (n)), where f (n) tends to infinity, then g(n) = O(f (n)1+ ) for each fixed > 0.) We conclude that the total bit complexity for the congruences, and the entire algorithm, is

Theorem 4.5.3, we will have a better estimate for the bit complexity of

seems very unlikely that one could ever verify one of the congruences in Step [Binomial congruences] in significantly fewer than r ln2 n bit operations, it would seem that r1.5 ln3 n is likely as a lower bound for the order of magnitude of the bit complexity of the entire algorithm (though not necessarily a lower bound for perhaps some other primality test). And since the algorithm forces us to choose r > lg2 n, it would seem then that we

√

for each integer a with 0 ≤ a ≤ d lg n. Then if n is divisible by a prime

√

p > d lg n, then n = pm for some positive integer m.

The notion of two polynomials being coprime in Zn[x] was discussed in Definition 4.3.1. Note that reduction modulo n for polynomial coe cients is assumed, since the polynomials in Theorem 4.5.4 are assumed to be in Zn[x].

Proof. We largely follow the proof of Theorem 4.5.2. Let p be a prime factor

√

of n that exceeds d lg n. As before, but with f (x) in place of xr −1, we define

G = {g(x) Zp[x] : g(x)n ≡ g(xn) (mod f (x))}.

And as before, but this time by assumption (4.27), we have f (x)|f (xn) in Zp[x]. Thus, G is closed under multiplication and is a union of residue classes modulo f (x). Thus, our proof that

J = {j Z : j > 0, g(x)j ≡ g(xj ) (mod f (x)) for all g(x) G}

is closed under multiplication is also as before. Let h(x) be an irreducible factor of f (x) when considered modulo p, and denote by ζ a root of h(x) in the splitting field K of h(x) over Fp. Then the finite field K = Fp(ζ) is the homomorphic image of the ring Zp[x]/(f (x)), where the coset representing x is sent to ζ. By (4.28), x is coprime to f (x) in Zp[x], so that ζ = 0 inK. Let

r be the multiplicative order of ζ. By (4.28) we must have ζnd/q =ζ for each prime q|d, so that ζnd/q −1 = 1 for theseq’s. Also, by (4.27) and the fact that

ζ is nonzero in K, we have ζnd −1 = 1. Thus, the order of n in Zr is exactly d. In the argument for Theorem 4.5.2 we had d equal to the order of the subgroup generated by n and p in Zr , while now it is just the order of the subgroup generated by n. However, in our present context, the two subgroups are the same; that is, p ≡ ni (mod r) for some nonnegative integer i. We see this as follows. First note that clearly we have f (x) G, since f (xn) ≡ 0 ≡ f (x)n (mod f (x)). Thus, f (ζ)j = f (ζj ) for all j J. But f (ζ) = 0, so that each ζj is a root of f in K. Now ζ has order r and f has degree d, so that the number of residue classes occupied by j mod r for j J is at most d; indeed, f cannot have more roots in the finite field K than its degree. However, the powers of n already occupy d residue classes modulo r,