The Complexity Of Primality Testing

Editor's Notes

• #4: Ancient Greek, Persian, and Chinese philosophers all studied properties of prime numbers.
• #7: RSA (for R. Rivest, A. Shamir, and L, Adelman, the inventors of the technique)
• #8: Public-Key Cryptography You want to buy a book from an on-line bookseller. The seller asks for your credit-card number, but it is too risky to type the number into a form and have the form transmitted over phone fines or the Internet. The reason is that someone could be snooping on your line, or otherwise intercept packets as they travel over the Internet. To avoid a snooper being able to read your card number, the seller sends your browser a key k, perhaps the 128-bit product of two primes that the sellers computer has generated just for this purpose. Your browser uses a function у = fk(x) that takes both the key k and the data x that you need to encrypt. The function f, which is part of the RSA scheme, may be generally known, including to potential snoopers, but it is believed that without knowing the factorization of k, the inverse function fk-1 such that x = fk-1(y) cannot be computed in time that is less than exponential in the length of k. Thus, even if a snooper sees у and knows how f works, without first figuring out what k is and then factoring it, the snooper cannot recover x, which is in this case your credit-card number. On the other hand, the on-line seller, knowing the factorization of key k because they generated it in the first place, can easily apply fk-1 and recover x from y.
• #9: Public-Key Signatures The original scenario for which RSA codes were developed is the following. You would like to be able to “sign” email so that people could easily determine that the email was from you, and yet no one could “forge” your name to an email. For instance, you might wish to sign the message x “I promise to pay Sally Lee $10”, but you don’t want Sally to be able to create the signed message herself, or for a third party to create such a signed message without your knowledge. To support these aims, you pick a key k, whose prime factors only you know. You publish k widely, say on your Web site, so anyone can apply the function fk to any message. If you want to sign the message x above and send it to Sally, you compute у = fk-1(x) and send у to Sally instead. Sally can get fk, your public key, from your Web site, and with it compute x = fk(y). Thus, she knows that you have indeed promised to pay $10. If you deny having sent the message y, Sally can argue before a judge that only you know the function fk-1, and it would be “impossible” for either her or any third party to have discovered that function. Thus, only you could have created y. This system relies on the likely-but-unproven assumption that it is too hard to factor numbers that are the product of two large primes.
• #10: Requirements Regarding Complexity of Primality Testing Both scenarios above are believed to work and to be secure, in the sense that it really does take exponential time to factor the product of two large primes. The complexity theory we have studied here and in Chapter 10 enter into the study of security and cryptography in two ways: 1. The construction of public keys requires that we be able to find large primes quickly. It is a basic fact of number theory that the probability of an n-bit number being a prime is on the order of 1/n. Thus, if we had a polynomial-time {in n, not in the value of the prime itself) way to test whether an n-bit number was prime, we could pick numbers at random, test them, and stop when we found one to be prime. That would give us a polynomial-time Las-Vegas algorithm for discovering primes, since the expected number of numbers we have to test before meeting a prime of n bits is about n. For instance, if we want 64-bit primes, we would have to test about 64 integers on the average, although by bad luck we could have to try indefinitely more than that. Unfortunately, there does not appear to be a guaranteed, polynomial-time test for primes, although there is a Monte-Carlo Algorithm that is polynomial-time, as we shall see in Section 11.5,4. 2. The security of RSA-based cryptography depends on there being no polynomial (in the number of bits of the key) way to factor in general, in particular no way to factor a number known to be the product of exactly two large primes. We would be very happy if we could show that the set of primes is an NP-complete language, or even that the set of composite numbers was NP-complete. For then, a polynomial factoring algorithm would prove P = NP, since it would yield polynomial-time tests for both these languages. Alas, we shall see in Section 11.5.5 that both the primes and the composite numbers axe in NP. Since they are complements of each other, should either be NP-complete, it would follow that NP = co-NP, which we doubt is the case. Further, the fact that the set of primes is in RP means that if we could show the primes to be NP-complete then we could conclude RP = co-NP, another unlikely situation.
• #12: basic concepts regarding modular arithmetic, that is, the usual arithmetic operations executed modulo some integer, often a prime. Let p be any integer. The integers modulo p are 0,1,... ,p - 1. We can define addition and multiplication modulo p to apply only to this set of p integers by performing the ordinary calculation and then computing the remainder when the result is divided by p. Addition is quite straightforward, since the sum is either less than p, in which case we have nothing additional to do, or it is between p and 2p - 2, in which case we subtract p to get an integer in the range 0,1,... ,p - 1. Modular addition obeys the usual algebraic laws; it is commutative, associative, and has 0 as the identity. Subtraction is still the inverse of addition, and we can compute the modular difference x - у by subtracting as usual, and adding p if the result is below 0. The negation of x, which is -X, is the same as 0 - x, just as in ordinary arithmetic. Thus, -0 = 0, and if x ≠ 0, then -x is the same as p - x. Multiplication modulo p is performed by multiplying as ordinary numbers, and then taking the remainder of the result divided by p. Multiplication also satisfies the usual algebraic laws; it is commutative and associative, 1 is the identity, 0 is the annihilator, and multiplication distributes over addition. However, division by nonzero values is trickier, and even the existence of inverses for integers modulo p depends on whether or not p is a prime. In general, if x is one of the integers modulo p, that is, 0 ≤ x < p, then x-1, or 1/x is that number y, if it exists, such that x y = 1 modulo p.
• #13: Basic concepts regarding modular arithmetic, The usual arithmetic operations executed modulo some integer, often a prime. Let p be any integer. The integers modulo p are 0,1,... ,p - 1. We can define addition and multiplication modulo p to apply only to this set of p integers by performing the ordinary calculation and then computing the remainder when the result is divided by p. Addition is quite straightforward, since the sum is either less than p, in which case we have nothing additional to do, or it is between p and 2p - 2, in which case we subtract p to get an integer in the range 0,1,... ,p - 1. Modular addition obeys the usual algebraic laws; it is commutative, associative, and has 0 as the identity. Subtraction is still the inverse of addition, and we can compute the modular difference x - у by subtracting as usual, and adding p if the result is below 0. The negation of x, which is -X, is the same as 0 - x, just as in ordinary arithmetic. Thus, -0 = 0, and if x ≠ 0, then -x is the same as p - x.
• #14: Example 11.22: In Fig. 11.9 we see the multiplication table for the nonzero integers modulo the prime 7. The entry in row i and column j is the product ij modulo 7. Notice that each of the nonzero integers has an inverse; 2 and 4 are each other’s inverses, so are 3 and 5, while 1 and 6 are their own inverses. That is, 2 x 4, 3 x 5, 1 x 1, and 6 x 6 are all 1. Thus, we can divide by any nonzero number x/y by computing y-1 and then multiplying x x y-1 For instance, 3/4 = 3x4-1=3x2=6. Compare this situation with the multiplication table modulo 6. First, we observe that only 1 and 5 even have inverses; they are each their own inverse. Other numbers have no inverse. In addition, there are numbers that are not 0, but whose product is 0, such as 2 and 3. That situation never occurs for ordinary integer arithmetic, and it never happens when arithmetic is modulo a prime. There is another distinction between multiplication modulo a prime and modulo a composite number that turns out to be quite important for primality tests. The degree of a number a modulo p is the smallest positive power of a that is equal to 1. Return Example 11.23: Consider again the multiplication table modulo 7 in Fig. 11.9. The degree of 2 is 3, since 22 = 4, and 23 = 1. The degree of 3 is 6, since 32 = 2, 33 = 6, 34 = 4, 35 = 5, and 36 = 1. By similar calculations, we find that 4 has degree 3, 5 has degree 6, б has degree 2, and 1 has degree 1.
• #15: There is another distinction between multiplication modulo a prime and modulo a composite number that turns out to be quite important for primality tests. The degree of a number a modulo p is the smallest positive power of a that is equal to 1. Go back moluda 7
• #16: Before proceeding to the applications of modular arithmetic to primality testing, We must establish some basic facts about the running time of the essential operations. Suppose we wish to compute modulo some prime p, and the binary representation of p is n bits long; i.e., p itself is around 2n. So any computation that Involves p steps, will not be polynomial-time, as a function of n.
• #17: However, we can surely add two numbers modulo p in O(n) time on a typical computer or multitape TM. Recall that we simply add the binary numbers, and if the result is p or greater, then subtract p. Likewise, we can multiply two numbers in O(n2) time, either on a computer or a Turing machine. After multiplying the numbers in the ordinary way, and getting a result of at most 2n-bits, we divide by p and take the remainder.
• #18: As we shall see, an important step is raising x to the power p - 1.
• #19: xp-1 (or any other power of x up to p) in time
• #21: We shall now discuss how to use randomized computation to find large prime numbers. More precisely, we shall show that the language of composite numbers is in RP.
• #22: Recall Fermat’s theorem tells us that if p is a prime, then xp-1 modulo p is always 1, It is also a fact that if p is a composite number, and there is any x at all for which xp-1 modulo p is not 1, then for at least half the values of x in the range 1 to p-1, we shall find xp-1 ≠ 1. - that is one part of the Monte-Carlo requirement, that if the input is not in the language, then we never accept. For almost all the composite numbers, at least half the values of x will have xp-1 ≠ 1, so we have at least 50% chance of acceptance on any one run of this algorithm; that is the other requirement for an algorithm to be Monte-Carlo.
• #23: كارمايكل: In number theory, a Carmichael number is a composite number which satisfies the modular arithmetic congruence relation: xn = x modulo n Fermat’s فيرما What we have described so far would be a demonstration that the composite numbers are in RP, if it were not for the existence of a small number of composite numbers с that have xc-1 ≠ 1 modulo c, for the majority of x in the range 1 to с - 1, in particular for those x that do not share a common prime factor with c. require us to do another, more complex test to detect that they are composite.
• #25: Let us now take up another interesting and significant result about testing primality: That the language of primes is in NP ∩ co-NP. Therefore the language of composite numbers, the complement of the primes, is also in NP ∩ co-NP. The significance of this fact is that it is unlikely to be the case that the primes or the composite numbers are NP-complete, for if either were true then we would have the unexpected equality NP = co-NP. One part is easy: The composite numbers are obviously in NP, so the primes are in co-NP. We prove that fact first.
• #26: This part is nondeterministic, with all possible values of f being guessed along some sequence of choices. This part is deterministic and can be carried out in time O(n2) on a multi tape TM. If p is composite, then it must have at least one factor f other than 1 and p. The NTM, since it guesses all possible numbers of up to n bits, will in some branch guess f. That branch leads to acceptance. Conversely, acceptance by the NTM implies that a factor of p other than 1 or p itself has been found. Thus, the NTM described accepts the language consisting of all and only the composite numbers.
• #29: The number of these tests is O(n), so we can perform them all in a polynomial-time algorithm. The details of the algorithm, and the proof that it is nondeterministic, polynomial-time, are in the proof of the theorem below.
• #30: e.g., if p = 13, then the prime factors of p - 1 = 12 are in the list (2,2,3). This part is nondeterministic, but each branch takes O(n) time.
• #31: كما في الجزء المتعلق Modular complixty The exponentiations can be done by the efficient method described in Section 11.5.3.
• #32: Lastly, we must verify that this nondeterministic algorithm is polynomial-time. Each of the steps except the recursive step (3) takes time at most O(n4) along any nondeterministic branch. While this recursion is complicated, we can visualize the recursive calls as a tree suggested by Fig. 11.11. At the root is the prime p of n bits that we want to verify. The children of the root are the qj’s, which are the guessed factors of p - 1 that we must also verify are primes. Below each qj are the guessed factors of qj - 1 that we must verify, and so on, until we get down to numbers of at most 2 bits, which are leaves of the tree. Since the product of the children of any node is less than the value of the node itself, we see that the product of the values of nodes at any depth from the root is at most p. The work required at a node with value i, exclusive of work done in recursive calls, is at most a(log2 i)4 for some constant a; the reason is that we determined this work to be on the order of the fourth power of the number of bits needed to represent that value in binary.
• #33: the reason is that we determined this work to be on the order of the fourth power of the number of bits needed to represent that value in binary. Since the product of the children of any node is less than the value of the node itself, we see that the product of the values of nodes at any depth from the root is at most p. The work required at a node with value i, exclusive of work done in recursive calls, is at most a(log2 i)4 for some constant a; Thus, to get an upper bound on the work required by any one level, we must maximize the sum ∑ja(log2(ij))4, subject to the constraint that the product i1i2… is at most p. Because the fourth power is convex, عدسة محدب
• #34: the maximum occurs when all of the value is in one of the ij’s . If i1=p, and there are no other ij’s, then the sum is a(log2p)4. That is at most an4, since n is the number of bits in the binary representation of p, and therefore log2p is at most n. Our conclusion is that the work required at each depth is at most O(n4). Since there are at most n levels, O(n5) work suffices in any branch of the nondeterministic test for whether p is prime. Now we know that both the primes and their complement are in NP. If either were NP-complete, then we would have a proof that NP=co-NP.