6.046 Lecture 8

3/2/04

Recall:

Z_N^* = {0 <a < N : gcd(a,N) = 1}.

Z_N^* is a group under multiplication mod N:

For each a in Z_n^* can compute an inverse using the extended GCD:

a number b such that ab = 1 mod n.

Define: phi(n) = |Z_n^*|. Called "Euler Phi function"

FACT:

Let S be a subgroup of Z_N^*, then |G| divides |Z_N^*|

EULER'S THEOREM: for any a in Z_N^*, a^{phi(N)} = 1 (mod N).

PROOF: Let t = order(a). Notice that {1, a, a^2, ..., a^{t-1}} is a subgroup of Z_N^*: it's closed under multiplication and inverses.

Now we can use the fact from group theory that the size of any subgroup divides the group. Get that phi(N) = b*t for some multiple b. So, a^{phi(N)} =(a^t)^b = 1 (mod N).

Primality Testing for an n-bit number N

Ideally,
we'd like to show a fast deterministic algorithm for primality that
runs in time O(n^{c}) for some c>0.
Instead, we're going to give a randomized algorithm that on
input (N,k) it has the following property:

if N is prime, then it always outputs ``probably PRIME’’

if N is composite, then it outputs ``composite’’ with probability at least 1 - 1/2^k.

So, if our algorithm will say `probably prime’, you don't have a 100% proof that the number is prime, but quite high probability.

Theorem: On input N:

1. If N is prime, then for all a, a ^{N-1} = 1 mod N.

2. If N is composite AND there exists an a in Z_N^* such that a^{N-1} != 1 mod N, then for at least ½ of the a’s in Z_N^*, a^{N-1} != 1 mod N.

Proof:

By Euler’s theorem (also called Fermat’s little theorem), when N is prime phi(N) = N-1 and thus a^{N-1} = 1 mod N for all a in Z_N^*.

Let S = {a such that a^{N-1} = 1 mod N. Then this set is a subset of Z_N^* which is closed under multiplication, closed under inverses, and contains the identity 1. Thus S is a subgroup of Z_N^*. We know that S != Z_N^* (since assumed there exists an a in Z_N^*, such that a^{N-1} != 1 mod N), and we know by the fact from group theory that |S| divides the |Z_N^*|, so |S| <= ½ |Z_N^*| and at least ½ of Z_N^* is not in S, namely at least ½ of the a’s are such that a^{N-1} mod N != 1

Can we make an algorithm out of this theorem?

Unfortunately,
not yet, since there exists composite N such that for **all a in
Z_N^*, a^{N-1} mod N = 1.** These are called *Carmichael*
*numbers.* Smallest is 561. Fortunately, they are easy to
recognize and even factor.

Putting it all together you get the following probabilistic primality test for N.

MILLER-RABIN PRIMALITY TEST

On input: N,k

Let N-1 = 2^t * r where r is an odd number.

Repeat k times:

Pick a in {1,...,N-1} at random.

If GCD(a,N) != 1, output N is composite, else continue.

Compute a^r, a^2r, a^4r, ..., a^{N-1} mod N.

If a^{N-1} != 1 (mod n), then output COMPOSITE

If any e in {r,2r,...}

have a^e != {1,-1} mod N, but a^{2e} = 1 mod N,

then GCD(a^t - 1,N) is a factor of N, Output COMPOSITE

Otherwise, output "PROBABLY PRIME".

The proof that this works uses the following key lemma:

KEY LEMMA: Suppose N is odd and Carmichael ( means not a prime power or perfect square). Let r odd < N. If there exists a in Z_N^* such that a^r != 1 (mod N), then at least half of x in Z_n^* have x^r != {-1,+1} mod n, and such an a always exists.