The Primality Problem •

The Primality Problem

• An integer p is prime if p > 1 and all positive numbers other than 1 and p itself cannot divide it.

• primes asks if an integer N is a prime number.

• Dividing N by 2, 3, . . . ,√

N is not efficient.

– The length of N is only log N , but √

N = 2^{0.5 log N}. – So it is an exponential-time algorithm.

• A polynomial-time algorithm for primes was not found until 2002 by Agrawal, Kayal, and Saxena!

• Later, we will focus on efficient “probabilistic”

algorithms for primes (used in Mathematica, e.g.).

1: if n = a^b for some a, b > 1 then

2: return “composite”;

3: end if

4: for r = 2, 3, . . . , n− 1 do

5: if gcd(n, r) > 1 then

6: return “composite”;

7: end if

8: if r is a prime then

9: Let q be the largest prime factor of r − 1;

10: if q ≥ 4√

r log n and n^(r−1)/q ̸= 1 mod r then

11: break; {Exit the for-loop.}

12: end if

13: end if

14: end for{r − 1 has a prime factor q ≥ 4√

r log n.}

15: for a = 1, 2, . . . , 2√

r log n do

16: if (x− a)ⁿ ̸= (xⁿ − a) mod (x^r − 1) in Zn[ x ] then

17: return “composite”;

18: end if

19: end for

20: return “prime”; {The only place with “prime” output.}

The Primality Problem (concluded)

• NP ∩ coNP is the class of problems that have succinct certificates and succinct disqualifications.

– Each “yes” instance has a succinct certificate.

– Each “no” instance has a succinct disqualification.

– No instances have both.

• We will see that primes ∈ NP ∩ coNP.

– In fact, primes ∈ P as mentioned earlier.

Primitive Roots in Finite Fields

Theorem 49 (Lucas and Lehmer (1927)) ^a A number p > 1 is a prime if and only if there is a number 1 < r < p such that

1. r^p−1 = 1 mod p, and

2. r^(p−1)/q ̸= 1 mod p for all prime divisors q of p − 1.

• This r is called the primitive root or generator.

• We will prove the theorem later (see pp. 442ff).

aFran¸cois Edouard Anatole Lucas (1842–1891); Derrick Henry Lehmer (1905–1991).

Derrick Lehmer (1905–1991)

Pratt’s Theorem

Theorem 50 (Pratt (1975)) primes ∈ NP ∩ coNP.

• primes is in coNP because a succinct disqualification is a proper divisor.

– A proper divisor of a number n means n is not a prime.

• Now suppose p is a prime.

• p’s certificate includes the r in Theorem 49 (p. 431).

• Use recursive doubling to check if r^p−1 = 1 mod p in time polynomial in the length of the input, log₂ p.

– r, r², r⁴, . . . mod p, a total of ∼ log2 p steps.

The Proof (concluded)

• We also need all prime divisors of p − 1: q¹, q₂, . . . , q_k. – Whether r, q₁, . . . , q_k are easy to find is irrelevant.

– There may be multiple choices for r.

• Checking r^(p−1)/qi ̸= 1 mod p is also easy.

• Checking q¹, q₂, . . . , q_k are all the divisors of p− 1 is easy.

• We still need certificates for the primality of the qⁱ’s.

• The complete certificate is recursive and tree-like:

C(p) = (r; q₁, C(q₁), q₂, C(q₂), . . . , q_k, C(q_k)).

• We next prove that C(p) is succinct.

• As a result, C(p) can be checked in polynomial time.

The Succinctness of the Certificate

Lemma 51 The length of C(p) is at most quadratic at 5 log²₂ p.

• This claim holds when p = 2 or p = 3.

• In general, p − 1 has k ≤ log2 p prime divisors q₁ = 2, q₂, . . . , q_k.

– Reason:

2^k ≤

∏k i=1

q_i ≤ p − 1.

• Note also that, as q¹ = 2,

∏k i=2

q_i ≤ p − 1

2 . (4)

The Proof (continued)

• C(p) requires:

– 2 parentheses;

– 2k < 2 log₂ p separators (at most 2 log₂ p bits);

– r (at most log₂ p bits);

– q₁ = 2 and its certificate 1 (at most 5 bits);

– q₂, . . . , q_k (at most 2 log₂ p bits);^a – C(q₂), . . . , C(q_k).

aWhy?

The Proof (concluded)

• C(p) is succinct because, by induction,

|C(p)| ≤ 5 log2 p + 5 + 5

∑k i=2

log²₂ q_i

≤ 5 log2 p + 5 + 5

( _k

∑

i=2

log₂ q_i )²

≤ 5 log2 p + 5 + 5 log²₂ p − 1

2 by inequality (4)

< 5 log₂ p + 5 + 5(log₂ p − 1)²

= 5 log²₂ p + 10 − 5 log2 p ≤ 5 log²2 p for p ≥ 4.

A Certificate for 23

• Note that 7 is a primitive root modulo 23 and 23 − 1 = 22 = 2 × 11.

• So

C(23) = (7, 2, C(2), 11, C(11)).

• Note that 2 is a primitive root modulo 11 and 11 − 1 = 10 = 2 × 5.

• So

C(11) = (2, 2, C(2), 5, C(5)).

aThanks to a lively discussion on April 24, 2008.

A Certificate for 23 (concluded)

• Note that 2 is a primitive root modulo 5 and 5 − 1 = 4 = 2².

• So

C(5) = (2, 2, C(2)).

• In summary,

C(23) = (7, 2, C(2), 11, (2, 2, C(2), 5, (2, 2, C(2)))).

Basic Modular Arithmetics

• Let m, n ∈ Z⁺.

• m | n means m divides n; m is n’s divisor.

• We call the numbers 0, 1, . . . , n − 1 the residue modulo n.

• The greatest common divisor of m and n is denoted gcd(m, n).

• The r in Theorem 49 (p. 431) is a primitive root of p.

• We now prove the existence of primitive roots and then Theorem 49 (p. 431).

aCarl Friedrich Gauss.

Basic Modular Arithmetics (concluded)

• We use

a ≡ b mod n if n| (a − b).

– So 25 ≡ 38 mod 13.

• We use

a = b mod n

if b is the remainder of a divided by n.

– So 25 = 12 mod 13.

Euler’s

Totient or Phi Function

• Let

Φ(n) = {m : 1 ≤ m < n, gcd(m, n) = 1}

be the set of all positive integers less than n that are prime to n.^b

– Φ(12) = {1, 5, 7, 11}.

• Define Euler’s function of n to be ϕ(n) = |Φ(n)|.

• ϕ(p) = p − 1 for prime p, and ϕ(1) = 1 by convention.

• Euler’s function is not expected to be easy to compute without knowing n’s factorization.

aLeonhard Euler (1707–1783).

bZ_n^∗ is an alternative notation.

    Q











I+Q/

HXOHUSKLQE 

Two Properties of Euler’s Function

The inclusion-exclusion principle^a can be used to prove the following.

Lemma 52 ϕ(n) = n∏

p|n(1 − ¹_p).

• If n = p^e₁¹p^e₂² · · · p^e_ℓ^ℓ is the prime factorization of n, then

ϕ(n) = n

∏ℓ i=1

(

1 − 1 p_i

) .

Corollary 53 ϕ(mn) = ϕ(m) ϕ(n) if gcd(m, n) = 1.

aConsult any textbook on discrete mathematics.

A Key Lemma

Lemma 54 ∑

m|n ϕ(m) = n.

• Let ∏ℓ

i=1 p^k_iⁱ be the prime factorization of n and consider

∏ℓ i=1

[ ϕ(1) + ϕ(p_i) + · · · + ϕ(p^k_iⁱ) ]. (5)

• Equation (5) equals n because ϕ(p^k_i ) = p^k_i − p^k_i⁻¹ by Lemma 52 (p. 444) so ϕ(1) + ϕ(p_i) + · · · + ϕ(p^k_iⁱ) = p^k_iⁱ.

• Expand Eq. (5) to yield

∑

k₁^′≤k1,...,k^′_ℓ≤kℓ

∏ℓ i=1

ϕ(p^k_i^′i).

The Proof (concluded)

• By Corollary 53 (p. 444),

∏ℓ i=1

ϕ(p^k_i^′i) = ϕ

( _ℓ

∏

i=1

p^k_i^′i )

.

• So Eq. (5) becomes

∑

k₁^′≤k1,...,k_ℓ^′≤kℓ

ϕ

( _ℓ

∏

i=1

p^k_i^′i )

.

• Each ∏ℓ

i=1 p^k_i^′i is a unique divisor of n = ∏ℓ

i=1 p^k_iⁱ.

• Equation (5) becomes

∑

m|n

ϕ(m).

Leonhard Euler (1707–1783)

The Density Attack for primes

Witnesses to compositeness

of n

All numbers < n

The Density Attack for primes

1: Pick k ∈ {1, . . . , n} randomly;

2: if k| n and k ̸= n then

3: return “n is composite”;

4: else

5: return “n is (probably) a prime”;

6: end if

The Density Attack for primes (continued)

• It works, but does it work well?

• The ratio of numbers ≤ n relatively prime to n (the white ring) is

ϕ(n) n .

• When n = pq, where p and q are distinct primes, ϕ(n)

n = pq − p − q + 1

pq > 1 − 1

q − 1 p.

The Density Attack for primes (concluded)

• So the ratio of numbers ≤ n not relatively prime to n (the grey area) is < (1/q) + (1/p).

– The “density attack” has probability about 2/√

n of factoring n = pq when p ∼ q = O(√

n ).

– The “density attack” to factor n = pq hence takes Ω(√

n) steps on average when p ∼ q = O(√ n ).

– This running time is exponential: Ω(2^{0.5 log2n}).

The Chinese Remainder Theorem

• Let n = n¹n₂ · · · n^k, where n_i are pairwise relatively prime.

• For any integers a¹, a₂, . . . , a_k, the set of simultaneous equations

x = a₁ mod n₁, x = a₂ mod n₂,

...

x = a_k mod n_k,

has a unique solution modulo n for the unknown x.

Fermat’s “Little” Theorem

Lemma 55 For all 0 < a < p, a^p−1 = 1 mod p.

• Recall Φ(p) = {1, 2, . . . , p − 1}.

• Consider aΦ(p) = {am mod p : m ∈ Φ(p)}.

• aΦ(p) = Φ(p).

– aΦ(p) ⊆ Φ(p) as a remainder must be between 1 and p − 1.

– Suppose am = am^′ mod p for m > m^′, where m, m^′ ∈ Φ(p).

– That means a(m − m^′) = 0 mod p, and p divides a or m − m^′, which is impossible.

aPierre de Fermat (1601–1665).

The Proof (concluded)

• Multiply all the numbers in Φ(p) to yield (p − 1)!.

• Multiply all the numbers in aΦ(p) to yield a^p−1(p − 1)!.

• As aΦ(p) = Φ(p), a^p−1(p − 1)! = (p − 1)! mod p.

• Finally, a^p−1 = 1 mod p because p ̸ |(p − 1)!.

The Fermat-Euler Theorem

Corollary 56 For all a ∈ Φ(n), a^ϕ(n) = 1 mod n.

• The proof is similar to that of Lemma 55 (p. 453).

• Consider aΦ(n) = {am mod n : m ∈ Φ(n)}.

• aΦ(n) = Φ(n).

– aΦ(n) ⊆ Φ(n) as a remainder must be between 0 and n − 1 and relatively prime to n.

– Suppose am = am^′ mod n for m^′ < m < n, where m, m^′ ∈ Φ(n).

– That means a(m − m^′) = 0 mod n, and n divides a or m − m^′, which is impossible.

aProof by Mr. Wei-Cheng Cheng (R93922108, D95922011) on Novem- ber 24, 2004.

The Proof (concluded)

• Multiply all the numbers in Φ(n) to yield ∏

m∈Φ(n) m.

• Multiply all the numbers in aΦ(n) to yield a^ϕ(n) ∏

m∈Φ(n) m.

• As aΦ(n) = Φ(n),

∏

m∈Φ(n)

m = a^ϕ(n)



 ∏

m∈Φ(n)

m



 mod n.

• Finally, a^ϕ(n) = 1 mod n because n ̸ | ∏

m∈Φ(n) m.

aSome typographical errors corrected by Mr. Jung-Ying Chen (D95723006) on November 18, 2008.

An Example

• As 12 = 2² × 3,

ϕ(12) = 12 × (

1 − 1 2

) (

1 − 1 3

)

= 4.

• In fact, Φ(12) = {1, 5, 7, 11}.

• For example,

5⁴ = 625 = 1 mod 12.

Exponents

• The exponent of m ∈ Φ(p) is the least k ∈ Z⁺ such that m^k = 1 mod p.

• Every residue s ∈ Φ(p) has an exponent.

– 1, s, s², s³, . . . eventually repeats itself modulo p, say sⁱ = s^j mod p, which means s^j−i = 1 mod p.

• If the exponent of m is k and m^ℓ = 1 mod p, then k|ℓ.

– Otherwise, ℓ = qk + a for 0 < a < k, and

m^ℓ = m^qk+a = m^a = 1 mod p, a contradiction.

Lemma 57 Any nonzero polynomial of degree k has at most k distinct roots modulo p.

Exponents and Primitive Roots

• From Fermat’s “little” theorem, all exponents divide p − 1.

• A primitive root of p is thus a number with exponent p − 1.

• Let R(k) denote the total number of residues in Φ(p) = {1, 2, . . . , p − 1} that have exponent k.

• We already knew that R(k) = 0 for k ̸ |(p − 1).

• So ∑

k|(p−1)

R(k) = p − 1 as every number has an exponent.

Size of R(k)

• Any a ∈ Φ(p) of exponent k satisfies x^k = 1 mod p.

• Hence there are at most k residues of exponent k, i.e., R(k) ≤ k, by Lemma 57 (p. 458).

• Let s be a residue of exponent k.

• 1, s, s², . . . , s^k−1 are distinct modulo p.

– Otherwise, sⁱ = s^j mod p with i < j.

– Then s^j−i = 1 mod p with j − i < k, a contradiction.

• As all these k distinct numbers satisfy x^k = 1 mod p, they comprise all the solutions of x^k = 1 mod p.

Size of R(k) (continued)

• But do all of them have exponent k (i.e., R(k) = k)?

• And if not (i.e., R(k) < k), how many of them do?

• Pick s^ℓ, where ℓ < k.

• Suppose ℓ ̸∈ Φ(k) with gcd(ℓ, k) = d > 1.

• Then

(s^ℓ)^k/d = (s^k)^ℓ/d = 1 mod p.

• Therefore, s^ℓ has exponent at most k/d < k.

• We conclude that

R(k) ≤ ϕ(k).

Size of R(k) (concluded)

• Because all p − 1 residues have an exponent, p − 1 = ∑

k|(p−1)

R(k) ≤ ∑

k|(p−1)

ϕ(k) = p − 1

by Lemma 54 (p. 445).

• Hence

R(k) =





ϕ(k) when k|(p − 1) 0 otherwise

• In particular, R(p − 1) = ϕ(p − 1) > 0, and p has at least one primitive root.

• This proves one direction of Theorem 49 (p. 431).

A Few Calculations

• Let p = 13.

• From p. 455, we know ϕ(p − 1) = 4.

• Hence R(12) = 4.

• Indeed, there are 4 primitive roots of p.

• As

Φ(p − 1) = {1, 5, 7, 11}, the primitive roots are

g¹, g⁵, g⁷, g¹¹ for any primitive root g.

The Other Direction of Theorem 49 (p. 431)

• We show p is a prime if there is a number r such that 1. r^p−1 = 1 mod p, and

2. r^(p−1)/q ̸= 1 mod p for all prime divisors q of p − 1.

• Suppose p is not a prime.

• We proceed to show that no primitive roots exist.

• Suppose r^p−1 = 1 mod p (note gcd(r, p) = 1).

• We will show that the 2nd condition must be violated.

The Proof (continued)

• So we proceed to show r^(p−1)/q = 1 mod p for some prime divisor q of p − 1.

• r^ϕ(p) = 1 mod p by the Fermat-Euler theorem (p. 455).

• Because p is not a prime, ϕ(p) < p − 1.

• Let k be the smallest integer such that r^k = 1 mod p.

• With the 1st condition, it is easy to show that k | (p − 1) (similar to p. 458).

• Note that k | ϕ(p) (p. 458).

• As k ≤ ϕ(p), k < p − 1.

The Proof (concluded)

• Let q be a prime divisor of (p − 1)/k > 1.

• Then k|(p − 1)/q.

• By the definition of k,

r^(p−1)/q = 1 mod p.

• But this violates the 2nd condition.

Function Problems

• Decision problems are yes/no problems (sat, tsp (d), etc.).

• Function problems require a solution (a satisfying truth assignment, a best tsp tour, etc.).

• Optimization problems are clearly function problems.

• What is the relation between function and decision problems?

• Which one is harder?

Function Problems Cannot Be Easier than Decision Problems

• If we know how to generate a solution, we can solve the corresponding decision problem.

– If you can find a satisfying truth assignment efficiently, then sat is in P.

– If you can find the best tsp tour efficiently, then tsp (d) is in P.

• But decision problems can be as hard as the corresponding function problems.

fsat

• fsat is this function problem:

– Let ϕ(x₁, x₂, . . . , x_n) be a boolean expression.

– If ϕ is satisfiable, then return a satisfying truth assignment.

– Otherwise, return “no.”

• We next show that if sat ∈ P, then fsat has a polynomial-time algorithm.

• sat is a subroutine (black box) that returns “yes” or

“no” on the satisfiability of the input.

An Algorithm for fsat Using sat

1: t := ϵ; {Truth assignment.}

2: if ϕ ∈ sat then

3: for i = 1, 2, . . . , n do

4: if ϕ[ x_i = true ] ∈ sat then 5: t := t ∪ { xi = true};

6: ϕ := ϕ[ x_i = true ];

7: else

8: t := t ∪ { xi = false};

9: ϕ := ϕ[ x_i = false ];

10: end if 11: end for 12: return t;

13: else

14: return “no”;

15: end if

Analysis

• If sat can be solved in polynomial time, so can fsat.

– There are ≤ n + 1 calls to the algorithm for sat.^a – Boolean expressions shorter than ϕ are used in each

call to the algorithm for sat.

• Hence sat and fsat are equally hard (or easy).

• Note that this reduction from fsat to sat is not a Karp reduction (recall p. 247).

• Instead, it calls sat multiple times as a subroutine and moves on sat’s outputs.

aContributed by Ms. Eva Ou (R93922132) on November 24, 2004.

tsp and tsp (d) Revisited

• We are given n cities 1, 2, . . . , n and integer distances d_ij = d_ji between any two cities i and j.

• tsp (d) asks if there is a tour with a total distance at most B.

• tsp asks for a tour with the shortest total distance.

– The shortest total distance is at most ∑

i,j d_ij.

∗ Recall that the input string contains d¹¹, . . . , d_nn.

∗ Thus the shortest total distance is less than 2^{| x |} in magnitude, where x is the input (why?).

• We next show that if tsp (d) ∈ P, then tsp has a polynomial-time algorithm.

An Algorithm for tsp Using tsp (d)

1: Perform a binary search over interval [ 0, 2^{| x |} ] by calling tsp (d) to obtain the shortest distance, C;

2: for i, j = 1, 2, . . . , n do

3: Call tsp (d) with B = C and d^ij = C + 1;

4: if “no” then

5: Restore d_ij to old value; {Edge [ i, j ] is critical.}

6: end if

7: end for

8: return the tour with edges whose d_ij ≤ C;

Analysis

• An edge that is not on any optimal tour will be eliminated, with its d_ij set to C + 1.

• An edge which is not on all remaining optimal tours will also be eliminated.

• So the algorithm ends with n edges which are not eliminated (why?).

• This is true even if there are multiple optimal tours!^a

aThanks to a lively class discussion on November 12, 2013.

Analysis (concluded)

• There are O(| x | + n²) calls to the algorithm for tsp (d).

• Each call has an input length of O(| x |).

• So if tsp (d) can be solved in polynomial time, so can tsp.

• Hence tsp (d) and tsp are equally hard (or easy).

Randomized Computation

I know that half my advertising works, I just don’t know which half.

— John Wanamaker

I know that half my advertising is a waste of money, I just don’t know which half!

— McGraw-Hill ad.

Randomized Algorithms

• Randomized algorithms flip unbiased coins.

• There are important problems for which there are no known efficient deterministic algorithms but for which very efficient randomized algorithms exist.

– Extraction of square roots, for instance.

• There are problems where randomization is necessary.

– Secure protocols.

• Randomized version can be more efficient.

– Parallel algorithm for maximal independent set.^b

aRabin (1976); Solovay and Strassen (1977).

b“Maximal” (a local maximum) not “maximum” (a global maximum).

“Four Most Important Randomized Algorithms”

1. Primality testing.^b

2. Graph connectivity using random walks.^c 3. Polynomial identity testing.^d

4. Algorithms for approximate counting.^e

aTrevisan (2006).

bRabin (1976); Solovay and Strassen (1977).

cAleliunas, Karp, Lipton, Lov´asz, and Rackoff (1979).

dSchwartz (1980); Zippel (1979).

eSinclair and Jerrum (1989).