• 沒有找到結果。

# The Primality Problem •

N/A
N/A
Protected

Share "The Primality Problem •"

Copied!
52
0
0

(1)

### The Primality Problem

• An integer p is prime if p > 1 and all positive numbers other than 1 and p itself cannot divide it.

• primes asks if an integer N is a prime number.

• Dividing N by 2, 3, . . . ,√

N is not eﬃcient.

– The length of N is only log N , but

N = 20.5 log N. – So it is an exponential-time algorithm.

• A polynomial-time algorithm for primes was not found until 2002 by Agrawal, Kayal, and Saxena!

• Later, we will focus on eﬃcient “probabilistic”

algorithms for primes (used in Mathematica, e.g.).

(2)

1: if n = ab for some a, b > 1 then

2: return “composite”;

3: end if

4: for r = 2, 3, . . . , n− 1 do

5: if gcd(n, r) > 1 then

6: return “composite”;

7: end if

8: if r is a prime then

9: Let q be the largest prime factor of r − 1;

10: if q ≥ 4

r log n and n(r−1)/q ̸= 1 mod r then

11: break; {Exit the for-loop.}

12: end if

13: end if

14: end for{r − 1 has a prime factor q ≥ 4

r log n.}

15: for a = 1, 2, . . . , 2

r log n do

16: if (x− a)n ̸= (xn − a) mod (xr − 1) in Zn[ x ] then

17: return “composite”;

18: end if

19: end for

20: return “prime”; {The only place with “prime” output.}

(3)

### The Primality Problem (concluded)

• NP ∩ coNP is the class of problems that have succinct certiﬁcates and succinct disqualiﬁcations.

– Each “yes” instance has a succinct certiﬁcate.

– Each “no” instance has a succinct disqualiﬁcation.

– No instances have both.

• We will see that primes ∈ NP ∩ coNP.

– In fact, primes ∈ P as mentioned earlier.

(4)

### Primitive Roots in Finite Fields

Theorem 49 (Lucas and Lehmer (1927)) a A number p > 1 is a prime if and only if there is a number 1 < r < p such that

1. rp−1 = 1 mod p, and

2. r(p−1)/q ̸= 1 mod p for all prime divisors q of p − 1.

• This r is called the primitive root or generator.

• We will prove the theorem later (see pp. 442ﬀ).

aFran¸cois Edouard Anatole Lucas (1842–1891); Derrick Henry Lehmer (1905–1991).

(5)

(6)

### Pratt’s Theorem

Theorem 50 (Pratt (1975)) primes ∈ NP ∩ coNP.

• primes is in coNP because a succinct disqualiﬁcation is a proper divisor.

– A proper divisor of a number n means n is not a prime.

• Now suppose p is a prime.

• p’s certiﬁcate includes the r in Theorem 49 (p. 431).

• Use recursive doubling to check if rp−1 = 1 mod p in time polynomial in the length of the input, log2 p.

– r, r2, r4, . . . mod p, a total of ∼ log2 p steps.

(7)

### The Proof (concluded)

• We also need all prime divisors of p − 1: q1, q2, . . . , qk. – Whether r, q1, . . . , qk are easy to ﬁnd is irrelevant.

– There may be multiple choices for r.

• Checking r(p−1)/qi ̸= 1 mod p is also easy.

• Checking q1, q2, . . . , qk are all the divisors of p− 1 is easy.

• We still need certiﬁcates for the primality of the qi’s.

• The complete certiﬁcate is recursive and tree-like:

C(p) = (r; q1, C(q1), q2, C(q2), . . . , qk, C(qk)).

• We next prove that C(p) is succinct.

• As a result, C(p) can be checked in polynomial time.

(8)

### The Succinctness of the Certificate

Lemma 51 The length of C(p) is at most quadratic at 5 log22 p.

• This claim holds when p = 2 or p = 3.

• In general, p − 1 has k ≤ log2 p prime divisors q1 = 2, q2, . . . , qk.

– Reason:

2k

k i=1

qi ≤ p − 1.

• Note also that, as q1 = 2,

k i=2

qi p − 1

2 . (4)

(9)

### The Proof (continued)

• C(p) requires:

– 2 parentheses;

– 2k < 2 log2 p separators (at most 2 log2 p bits);

– r (at most log2 p bits);

– q1 = 2 and its certiﬁcate 1 (at most 5 bits);

– q2, . . . , qk (at most 2 log2 p bits);a – C(q2), . . . , C(qk).

aWhy?

(10)

### The Proof (concluded)

• C(p) is succinct because, by induction,

|C(p)| ≤ 5 log2 p + 5 + 5

k i=2

log22 qi

≤ 5 log2 p + 5 + 5

( k

i=2

log2 qi )2

≤ 5 log2 p + 5 + 5 log22 p − 1

2 by inequality (4)

< 5 log2 p + 5 + 5(log2 p − 1)2

= 5 log22 p + 10 − 5 log2 p ≤ 5 log22 p for p ≥ 4.

(11)

### A Certificate for 23

a

• Note that 7 is a primitive root modulo 23 and 23 − 1 = 22 = 2 × 11.

• So

C(23) = (7, 2, C(2), 11, C(11)).

• Note that 2 is a primitive root modulo 11 and 11 − 1 = 10 = 2 × 5.

• So

C(11) = (2, 2, C(2), 5, C(5)).

aThanks to a lively discussion on April 24, 2008.

(12)

### A Certificate for 23 (concluded)

• Note that 2 is a primitive root modulo 5 and 5 − 1 = 4 = 22.

• So

C(5) = (2, 2, C(2)).

• In summary,

C(23) = (7, 2, C(2), 11, (2, 2, C(2), 5, (2, 2, C(2)))).

(13)

### Basic Modular Arithmetics

a

• Let m, n ∈ Z+.

• m | n means m divides n; m is n’s divisor.

• We call the numbers 0, 1, . . . , n − 1 the residue modulo n.

• The greatest common divisor of m and n is denoted gcd(m, n).

• The r in Theorem 49 (p. 431) is a primitive root of p.

• We now prove the existence of primitive roots and then Theorem 49 (p. 431).

aCarl Friedrich Gauss.

(14)

### Basic Modular Arithmetics (concluded)

• We use

a ≡ b mod n if n| (a − b).

– So 25 ≡ 38 mod 13.

• We use

a = b mod n

if b is the remainder of a divided by n.

– So 25 = 12 mod 13.

(15)

a

### Totient or Phi Function

• Let

Φ(n) = {m : 1 ≤ m < n, gcd(m, n) = 1}

be the set of all positive integers less than n that are prime to n.b

– Φ(12) = {1, 5, 7, 11}.

• Deﬁne Euler’s function of n to be ϕ(n) = |Φ(n)|.

• ϕ(p) = p − 1 for prime p, and ϕ(1) = 1 by convention.

• Euler’s function is not expected to be easy to compute without knowing n’s factorization.

aLeonhard Euler (1707–1783).

bZn is an alternative notation.

(16)

    Q











I+Q/

(17)

### Two Properties of Euler’s Function

The inclusion-exclusion principlea can be used to prove the following.

Lemma 52 ϕ(n) = n

p|n(1 1p).

• If n = pe11pe22 · · · pe is the prime factorization of n, then

ϕ(n) = n

i=1

(

1 1 pi

) .

Corollary 53 ϕ(mn) = ϕ(m) ϕ(n) if gcd(m, n) = 1.

aConsult any textbook on discrete mathematics.

(18)

### A Key Lemma

Lemma 54

m|n ϕ(m) = n.

• Let

i=1 pkii be the prime factorization of n and consider

i=1

[ ϕ(1) + ϕ(pi) + · · · + ϕ(pkii) ]. (5)

• Equation (5) equals n because ϕ(pki ) = pki − pki−1 by Lemma 52 (p. 444) so ϕ(1) + ϕ(pi) + · · · + ϕ(pkii) = pkii.

• Expand Eq. (5) to yield

k1≤k1,...,k≤k

i=1

ϕ(pkii).

(19)

### The Proof (concluded)

• By Corollary 53 (p. 444),

i=1

ϕ(pkii) = ϕ

(

i=1

pkii )

.

• So Eq. (5) becomes

k1≤k1,...,k≤k

ϕ

(

i=1

pkii )

.

• Each

i=1 pkii is a unique divisor of n =

i=1 pkii.

• Equation (5) becomes

m|n

ϕ(m).

(20)

(21)

(22)

### The Density Attack for primes

1: Pick k ∈ {1, . . . , n} randomly;

2: if k| n and k ̸= n then

3: return “n is composite”;

4: else

5: return “n is (probably) a prime”;

6: end if

(23)

### The Density Attack for primes (continued)

• It works, but does it work well?

• The ratio of numbers ≤ n relatively prime to n (the white ring) is

ϕ(n) n .

• When n = pq, where p and q are distinct primes, ϕ(n)

n = pq − p − q + 1

pq > 1 1

q 1 p.

(24)

### The Density Attack for primes (concluded)

• So the ratio of numbers ≤ n not relatively prime to n (the grey area) is < (1/q) + (1/p).

– The “density attack” has probability about 2/

n of factoring n = pq when p ∼ q = O(√

n ).

– The “density attack” to factor n = pq hence takes Ω(

n) steps on average when p ∼ q = O(√ n ).

– This running time is exponential: Ω(20.5 log2n).

(25)

### The Chinese Remainder Theorem

• Let n = n1n2 · · · nk, where ni are pairwise relatively prime.

• For any integers a1, a2, . . . , ak, the set of simultaneous equations

x = a1 mod n1, x = a2 mod n2,

...

x = ak mod nk,

has a unique solution modulo n for the unknown x.

(26)

### Fermat’s “Little” Theorem

a

Lemma 55 For all 0 < a < p, ap−1 = 1 mod p.

• Recall Φ(p) = {1, 2, . . . , p − 1}.

• Consider aΦ(p) = {am mod p : m ∈ Φ(p)}.

• aΦ(p) = Φ(p).

– aΦ(p) ⊆ Φ(p) as a remainder must be between 1 and p − 1.

– Suppose am = am mod p for m > m, where m, m ∈ Φ(p).

– That means a(m − m) = 0 mod p, and p divides a or m − m, which is impossible.

aPierre de Fermat (1601–1665).

(27)

### The Proof (concluded)

• Multiply all the numbers in Φ(p) to yield (p − 1)!.

• Multiply all the numbers in aΦ(p) to yield ap−1(p − 1)!.

• As aΦ(p) = Φ(p), ap−1(p − 1)! = (p − 1)! mod p.

• Finally, ap−1 = 1 mod p because p ̸ |(p − 1)!.

(28)

### The Fermat-Euler Theorem

a

Corollary 56 For all a ∈ Φ(n), aϕ(n) = 1 mod n.

• The proof is similar to that of Lemma 55 (p. 453).

• Consider aΦ(n) = {am mod n : m ∈ Φ(n)}.

• aΦ(n) = Φ(n).

– aΦ(n) ⊆ Φ(n) as a remainder must be between 0 and n − 1 and relatively prime to n.

– Suppose am = am mod n for m < m < n, where m, m ∈ Φ(n).

– That means a(m − m) = 0 mod n, and n divides a or m − m, which is impossible.

aProof by Mr. Wei-Cheng Cheng (R93922108, D95922011) on Novem- ber 24, 2004.

(29)

### The Proof (concluded)

a

• Multiply all the numbers in Φ(n) to yield

m∈Φ(n) m.

• Multiply all the numbers in aΦ(n) to yield aϕ(n)

m∈Φ(n) m.

• As aΦ(n) = Φ(n),

m∈Φ(n)

m = aϕ(n)

 ∏

m∈Φ(n)

m

 mod n.

• Finally, aϕ(n) = 1 mod n because n ̸ |

m∈Φ(n) m.

aSome typographical errors corrected by Mr. Jung-Ying Chen (D95723006) on November 18, 2008.

(30)

### An Example

• As 12 = 22 × 3,

ϕ(12) = 12 × (

1 1 2

) (

1 1 3

)

= 4.

• In fact, Φ(12) = {1, 5, 7, 11}.

• For example,

54 = 625 = 1 mod 12.

(31)

### Exponents

• The exponent of m ∈ Φ(p) is the least k ∈ Z+ such that mk = 1 mod p.

• Every residue s ∈ Φ(p) has an exponent.

– 1, s, s2, s3, . . . eventually repeats itself modulo p, say si = sj mod p, which means sj−i = 1 mod p.

• If the exponent of m is k and m = 1 mod p, then k|ℓ.

– Otherwise, ℓ = qk + a for 0 < a < k, and

m = mqk+a = ma = 1 mod p, a contradiction.

Lemma 57 Any nonzero polynomial of degree k has at most k distinct roots modulo p.

(32)

### Exponents and Primitive Roots

• From Fermat’s “little” theorem, all exponents divide p − 1.

• A primitive root of p is thus a number with exponent p − 1.

• Let R(k) denote the total number of residues in Φ(p) = {1, 2, . . . , p − 1} that have exponent k.

• We already knew that R(k) = 0 for k ̸ |(p − 1).

• So

k|(p−1)

R(k) = p − 1 as every number has an exponent.

(33)

### Size of R(k)

• Any a ∈ Φ(p) of exponent k satisﬁes xk = 1 mod p.

• Hence there are at most k residues of exponent k, i.e., R(k) ≤ k, by Lemma 57 (p. 458).

• Let s be a residue of exponent k.

• 1, s, s2, . . . , sk−1 are distinct modulo p.

– Otherwise, si = sj mod p with i < j.

– Then sj−i = 1 mod p with j − i < k, a contradiction.

• As all these k distinct numbers satisfy xk = 1 mod p, they comprise all the solutions of xk = 1 mod p.

(34)

### Size of R(k) (continued)

• But do all of them have exponent k (i.e., R(k) = k)?

• And if not (i.e., R(k) < k), how many of them do?

• Pick s, where ℓ < k.

• Suppose ℓ ̸∈ Φ(k) with gcd(ℓ, k) = d > 1.

• Then

(s)k/d = (sk)ℓ/d = 1 mod p.

• Therefore, s has exponent at most k/d < k.

• We conclude that

R(k) ≤ ϕ(k).

(35)

### Size of R(k) (concluded)

• Because all p − 1 residues have an exponent, p − 1 =

k|(p−1)

R(k)

k|(p−1)

ϕ(k) = p − 1

by Lemma 54 (p. 445).

• Hence

R(k) =



ϕ(k) when k|(p − 1) 0 otherwise

• In particular, R(p − 1) = ϕ(p − 1) > 0, and p has at least one primitive root.

• This proves one direction of Theorem 49 (p. 431).

(36)

### A Few Calculations

• Let p = 13.

• From p. 455, we know ϕ(p − 1) = 4.

• Hence R(12) = 4.

• Indeed, there are 4 primitive roots of p.

• As

Φ(p − 1) = {1, 5, 7, 11}, the primitive roots are

g1, g5, g7, g11 for any primitive root g.

(37)

### The Other Direction of Theorem 49 (p. 431)

• We show p is a prime if there is a number r such that 1. rp−1 = 1 mod p, and

2. r(p−1)/q ̸= 1 mod p for all prime divisors q of p − 1.

• Suppose p is not a prime.

• We proceed to show that no primitive roots exist.

• Suppose rp−1 = 1 mod p (note gcd(r, p) = 1).

• We will show that the 2nd condition must be violated.

(38)

### The Proof (continued)

• So we proceed to show r(p−1)/q = 1 mod p for some prime divisor q of p − 1.

• rϕ(p) = 1 mod p by the Fermat-Euler theorem (p. 455).

• Because p is not a prime, ϕ(p) < p − 1.

• Let k be the smallest integer such that rk = 1 mod p.

• With the 1st condition, it is easy to show that k | (p − 1) (similar to p. 458).

• Note that k | ϕ(p) (p. 458).

• As k ≤ ϕ(p), k < p − 1.

(39)

### The Proof (concluded)

• Let q be a prime divisor of (p − 1)/k > 1.

• Then k|(p − 1)/q.

• By the deﬁnition of k,

r(p−1)/q = 1 mod p.

• But this violates the 2nd condition.

(40)

### Function Problems

• Decision problems are yes/no problems (sat, tsp (d), etc.).

• Function problems require a solution (a satisfying truth assignment, a best tsp tour, etc.).

• Optimization problems are clearly function problems.

• What is the relation between function and decision problems?

• Which one is harder?

(41)

### Function Problems Cannot Be Easier than Decision Problems

• If we know how to generate a solution, we can solve the corresponding decision problem.

– If you can ﬁnd a satisfying truth assignment eﬃciently, then sat is in P.

– If you can ﬁnd the best tsp tour eﬃciently, then tsp (d) is in P.

• But decision problems can be as hard as the corresponding function problems.

(42)

### fsat

• fsat is this function problem:

– Let ϕ(x1, x2, . . . , xn) be a boolean expression.

– If ϕ is satisﬁable, then return a satisfying truth assignment.

– Otherwise, return “no.”

• We next show that if sat ∈ P, then fsat has a polynomial-time algorithm.

• sat is a subroutine (black box) that returns “yes” or

“no” on the satisﬁability of the input.

(43)

### An Algorithm for fsat Using sat

1: t := ϵ; {Truth assignment.}

2: if ϕ ∈ sat then

3: for i = 1, 2, . . . , n do

4: if ϕ[ xi = true ] ∈ sat then 5: t := t ∪ { xi = true};

6: ϕ := ϕ[ xi = true ];

7: else

8: t := t ∪ { xi = false};

9: ϕ := ϕ[ xi = false ];

10: end if 11: end for 12: return t;

13: else

14: return “no”;

15: end if

(44)

### Analysis

• If sat can be solved in polynomial time, so can fsat.

– There are ≤ n + 1 calls to the algorithm for sat.a – Boolean expressions shorter than ϕ are used in each

call to the algorithm for sat.

• Hence sat and fsat are equally hard (or easy).

• Note that this reduction from fsat to sat is not a Karp reduction (recall p. 247).

• Instead, it calls sat multiple times as a subroutine and moves on sat’s outputs.

aContributed by Ms. Eva Ou (R93922132) on November 24, 2004.

(45)

### tsp and tsp (d) Revisited

• We are given n cities 1, 2, . . . , n and integer distances dij = dji between any two cities i and j.

• tsp (d) asks if there is a tour with a total distance at most B.

• tsp asks for a tour with the shortest total distance.

– The shortest total distance is at most

i,j dij.

∗ Recall that the input string contains d11, . . . , dnn.

∗ Thus the shortest total distance is less than 2| x | in magnitude, where x is the input (why?).

• We next show that if tsp (d) ∈ P, then tsp has a polynomial-time algorithm.

(46)

### An Algorithm for tsp Using tsp (d)

1: Perform a binary search over interval [ 0, 2| x | ] by calling tsp (d) to obtain the shortest distance, C;

2: for i, j = 1, 2, . . . , n do

3: Call tsp (d) with B = C and dij = C + 1;

4: if “no” then

5: Restore dij to old value; {Edge [ i, j ] is critical.}

6: end if

7: end for

8: return the tour with edges whose dij ≤ C;

(47)

### Analysis

• An edge that is not on any optimal tour will be eliminated, with its dij set to C + 1.

• An edge which is not on all remaining optimal tours will also be eliminated.

• So the algorithm ends with n edges which are not eliminated (why?).

• This is true even if there are multiple optimal tours!a

aThanks to a lively class discussion on November 12, 2013.

(48)

### Analysis (concluded)

• There are O(| x | + n2) calls to the algorithm for tsp (d).

• Each call has an input length of O(| x |).

• So if tsp (d) can be solved in polynomial time, so can tsp.

• Hence tsp (d) and tsp are equally hard (or easy).

(49)

## Randomized Computation

(50)

I know that half my advertising works, I just don’t know which half.

— John Wanamaker

I know that half my advertising is a waste of money, I just don’t know which half!

(51)

### Randomized Algorithms

a

• Randomized algorithms ﬂip unbiased coins.

• There are important problems for which there are no known eﬃcient deterministic algorithms but for which very eﬃcient randomized algorithms exist.

– Extraction of square roots, for instance.

• There are problems where randomization is necessary.

– Secure protocols.

• Randomized version can be more eﬃcient.

– Parallel algorithm for maximal independent set.b

aRabin (1976); Solovay and Strassen (1977).

b“Maximal” (a local maximum) not “maximum” (a global maximum).

(52)

### “Four Most Important Randomized Algorithms”

a

1. Primality testing.b

2. Graph connectivity using random walks.c 3. Polynomial identity testing.d

4. Algorithms for approximate counting.e

aTrevisan (2006).

bRabin (1976); Solovay and Strassen (1977).

cAleliunas, Karp, Lipton, Lov´asz, and Rackoﬀ (1979).

dSchwartz (1980); Zippel (1979).

eSinclair and Jerrum (1989).

(Ⅱ) specific binding theory is a more accurate explanation of the mechanism of action of local anaesthetics. The evidence to support this theory is strong. Different isomers of

We adapt some existing contextual bandit algorithms for our CBMA problem, and developed the new Pairwise Regression with Upper Confidence Bound (PairUCB) algorithm which addresses

Markov chain: a discrete random process with a finite number of states and it satisfies the property that the next state depends only on the current state.. Aperiodic: all states

• There are important problems for which there are no known eﬃcient deterministic algorithms but for which very eﬃcient randomized algorithms exist.. – Extraction of square roots,

• A language in ZPP has two Monte Carlo algorithms, one with no false positives and the other with no

As a byproduct, we show that our algorithms can be used as a basis for delivering more effi- cient algorithms for some related enumeration problems such as finding

• The XYZ.com bonds are equivalent to a default-free zero-coupon bond with \$X par value plus n written European puts on Merck at a strike price of \$30.. – By the

• Program is to implement algorithms to solve problems Program decomposition and flow of problems.. Program decomposition and flow of control are important concepts

In this class, we will learn Matlab and some algorithms which are the core of programming world. Zheng-Liang Lu 26

However, there exist functions of bounded variation that are not continuously differentiable.... However, there exist bounded functions that are not of

But due to the careful construction of the middle state solution for the contact discontinuity, which is extremely important for many diﬃcult multicomponent problems with strong

Then, it is easy to see that there are 9 problems for which the iterative numbers of the algorithm using ψ α,θ,p in the case of θ = 1 and p = 3 are less than the one of the

For different types of optimization problems, there arise various complementarity problems, for example, linear complemen- tarity problem, nonlinear complementarity problem

For different types of optimization problems, there arise various complementarity problems, for example, linear complementarity problem, nonlinear complementarity problem,

On a Saturday afternoon, you pull into a parking lot with unme- tered spaces near a shopping area, where people are known to shop, on average, for 2 hours. You circle around, but

The algorithms have potential applications in several ar- eas of biomolecular sequence analysis including locating GC-rich regions in a genomic DNA sequence, post-processing

Both problems are special cases of the optimum communication spanning tree problem, and are reduced to the minimum routing cost spanning tree (MRCT) prob- lem when all the

Attractions, no matter physical or cultural, are the main pull factor of tourist flow. Without these attractions, there would be no need for other tourist

• There are important problems for which there are no known eﬃcient deterministic algorithms but for which very eﬃcient randomized algorithms exist.. – Extraction of square roots,

There is no general formula for counting the number of transitive binary relations on A... The poset A in the above example is not

There is no bundled means for those who are licensed as motivation for strict execution, which leads to the hesitative attitudes toward HACCP among proprietors of

Though currently there are standard technologies such as OWL-S (Web Ontology Language for Services) and WSMO (Web Service Modeling Ontology) which can be used to build

However, in the Protein Data Bank (PDB), there are problems about certain proteins containing Cα-only atomic coordinates and disordered backbone conformation.. For