Square Roots Modulo a Prime

57  Download (0)

Full text

(1)

Primality Tests

• primes asks if a number N is a prime.

• The classic algorithm tests if k | N for k = 2, 3, . . . ,√ N .

• But it runs in Ω(2(log2 N)/2) steps.

(2)

Primality Tests (concluded)

• Suppose N = P Q is a product of 2 distinct primes.

• The probability of success of the density attack (p. 484) is

2

√N when P ≈ Q.

• This probability is exponentially small in terms of the input length log2 N.

(3)

The Fermat Test for Primality

Fermat’s “little” theorem (p. 487) suggests the following primality test for any given number N:

1: Pick a number a randomly from { 1, 2, . . . , N − 1 };

2: if aN−1 ≡ 1 mod N then

3: return “N is composite”;

4: else

5: return “N is (probably) a prime”;

6: end if

(4)

The Fermat Test for Primality (concluded)

• Carmichael numbers are composite numbers that will pass the Fermat test for all a ∈ { 1, 2, . . . , N − 1 }.a

– The Fermat test will return “N is a prime” for all Carmichael numbers N.

• Unfortunately, there are infinitely many Carmichael numbers.b

• In fact, the number of Carmichael numbers less than N exceeds N2/7 for N large enough.

• So the Fermat test is an incorrect algorithm for primes.

aCarmichael (1910). Lo (1994) mentions an investment strategy based on such numbers!

bAlford, Granville, & Pomerance (1992).

(5)

Square Roots Modulo a Prime

• Equation x2 ≡ a mod p has at most two (distinct) roots by Lemma 63 (p. 492).

– The roots are called square roots.

– Numbers a with square roots and gcd(a, p) = 1 are called quadratic residues.

∗ They are

12 mod p, 22 mod p, . . . , (p − 1)2 mod p.

• We shall show that a number either has two roots or has none, and testing which is the case is trivial.a

aBut no efficient deterministic general-purpose square-root-extracting algorithms are known yet.

(6)

Euler’s Test

Lemma 68 (Euler) Let p be an odd prime and a = 0 mod p.

1. If

a(p−1)/2 ≡ 1 mod p, then x2 ≡ a mod p has two roots.

2. If

a(p−1)/2 ≡ 1 mod p, then

a(p−1)/2 ≡ −1 mod p and x2 ≡ a mod p has no roots.

(7)

The Proof (continued)

• Let r be a primitive root of p.

• Fermat’s “little” theorem says rp−1 ≡ 1 mod p, so r(p−1)/2

is a square root of 1.

• In particular,

r(p−1)/2 ≡ 1 or −1 mod p.

• But as r is a primitive root, r(p−1)/2 ≡ 1 mod p.

• Hence r(p−1)/2 ≡ −1 mod p.

(8)

The Proof (continued)

• Let a = rk mod p for some k.

• Suppose a(p−1)/2 ≡ 1 mod p.

• Then

1 ≡ a(p−1)/2 ≡ rk(p−1)/2 

r(p−1)/2 k

≡ (−1)k mod p.

• So k must be even.

(9)

The Proof (continued)

• Suppose a = r2j mod p for some 1 ≤ j ≤ (p − 1)/2.

• Then

a(p−1)/2 ≡ rj(p−1) ≡ 1 mod p.

• The two distinct roots of a are

rj, −rj(≡ rj+(p−1)/2 mod p).

– If rj ≡ −rj mod p, then 2rj ≡ 0 mod p, which implies rj ≡ 0 mod p, a contradiction as r is a primitive root.

(10)

The Proof (continued)

• As 1 ≤ j ≤ (p − 1)/2, there are (p − 1)/2 such a’s.

• Each such a ≡ r2j mod p has 2 distinct square roots.

• The square roots of all these a’s are distinct.

– The square roots of different a’s must be different.

• Hence the set of square roots is { 1, 2, . . . , p − 1 }.

• As a result,

a = r2j mod p, 1 ≤ j ≤ (p − 1)/2, exhaust all the quadratic residues.

(11)

The Proof (concluded)

• Suppose a = r2j+1 mod p now.

• Then it has no square roots because all the square roots have been taken.

• Finally,

a(p−1)/2 

r(p−1)/2 2j+1

≡ (−1)2j+1 ≡ −1 mod p.

(12)

The Legendre Symbola and Quadratic Residuacity Test

• By Lemma 68 (p. 554),

a(p−1)/2 mod p = ±1 for a ≡ 0 mod p.

• For odd prime p, define the Legendre symbol (a | p) as

(a | p) =

0 if p | a,

1 if a is a quadratic residue modulo p,

−1 if a is a quadratic nonresidue modulo p.

• It is sometimes pronounced “a over p.”

aAndrien-Marie Legendre (1752–1833).

(13)

The Legendre Symbol and Quadratic Residuacity Test (concluded)

• Euler’s test (p. 554) implies

a(p−1)/2 ≡ (a | p) mod p for any odd prime p and any integer a.

• Note that (ab | p) = (a | p)(b | p).

(14)

Gauss’s Lemma

Lemma 69 (Gauss) Let p and q be two distinct odd primes. Then (q | p) = (−1)m, where m is the number of residues in R = { iq mod p : 1 ≤ i ≤ (p − 1)/2 } that are greater than (p − 1)/2.

• All residues in R are distinct.

– If iq = jq mod p, then p | (j − i) or p | q.

– But neither is possible.

• No two elements of R add up to p.

– If iq + jq ≡ 0 mod p, then p | (i + j) or p | q.

– But neither is possible.

(15)

The Proof (continued)

• Replace each of the m elements a ∈ R such that a > (p − 1)/2 by p − a.

– This is equivalent to performing −a mod p.

• Call the resulting set of residues R.

• All numbers in R are at most (p − 1)/2.

• In fact, R = { 1, 2, . . . , (p − 1)/2 } (see illustration next page).

– Otherwise, two elements of R would add up to p,a which has been shown to be impossible.

aBecause then iq ≡ −jq mod p for some i = j.

(16)

5 1 2 3 4

6 5

1 2 3 4

6

p = 7 and q = 5.

(17)

The Proof (concluded)

• Alternatively, R = { ±iq mod p : 1 ≤ i ≤ (p − 1)/2 }, where exactly m of the elements have the minus sign.

• Take the product of all elements in the two representations of R.

• So

[(p − 1)/2]! = (−1)mq(p−1)/2[(p − 1)/2]! mod p.

• Because gcd([(p − 1)/2]!, p) = 1, the above implies 1 = (−1)mq(p−1)/2 mod p.

(18)

Legendre’s Law of Quadratic Reciprocity

a

• Let p and q be two distinct odd primes.

• The next result says (p | q) and (q | p) are distinct if and only if both p and q are 3 mod 4.

Lemma 70 (Legendre, 1785; Gauss)

(p | q)(q | p) = (−1)p−12 q−12 .

aFirst stated by Euler in 1751. Legendre (1785) did not give a cor- rect proof. Gauss proved the theorem when he was 19. He gave at least 8 different proofs during his life. The 152nd proof appeared in 1963. A computer-generated formal proof was given in Russinoff (1990).

As of 2008, there had been 4 such proofs. Wiedijk (2008), “the Law of Quadratic Reciprocity is the first nontrivial theorem that a student encounters in the mathematics curriculum.”

(19)

The Proof (continued)

• Sum the elements of R in the previous proof in mod2.

• On one hand, this is just (p−1)/2

i=1 i mod 2.

• On the other hand, the sum equals mp +

(p−1)/2

i=1



iq − p

iq p



mod 2

= mp +

⎝q (p−1)/2

i=1

i − p

(p−1)/2

i=1

iq p

⎞⎠ mod 2.

m of the iq mod p are replaced by p − iq mod p.

– But signs are irrelevant under mod2.

m is as in Lemma 69 (p. 562).

(20)

The Proof (continued)

• Ignore odd multipliers to make the sum equal

m +

(p−1)/2

i=1

i −

(p−1)/2

i=1

iq p

⎞⎠ mod 2.

• Equate the above with (p−1)/2

i=1 i modulo 2.

• Now simplify to obtain m ≡

(p−1)/2

i=1

iq p



mod 2.

(21)

The Proof (continued)

(p−1)/2

i=1 iqp is the number of integral points below the line

y = (q/p) x for 1 ≤ x ≤ (p − 1)/2.

• Gauss’s lemma (p. 562) says (q | p) = (−1)m.

• Repeat the proof with p and q reversed.

• Then (p | q) = (−1)m, where m is the number of integral points above the line y = (q/p) x for

1 ≤ y ≤ (q − 1)/2.

(22)

The Proof (concluded)

• As a result,

(p | q)(q | p) = (−1)m+m.

• But m + m is the total number of integral points in the [1, p−12 ] × [1, q−12 ] rectangle, which is

p − 1 2

q − 1 2 .

(23)

Eisenstein’s Rectangle

(p,q)

(p - 1)/2 (q - 1)/2

Above, p = 11, q = 7, m = 7, m = 8.

(24)

The Jacobi Symbol

a

• The Legendre symbol only works for odd prime moduli.

• The Jacobi symbol (a | m) extends it to cases where m is not prime.

a is sometimes called the numerator and m the denominator.

• Trivially, (1 | m) = 1.

• Define (a | 1) = 1.

aCarl Jacobi (1804–1851).

(25)

The Jacobi Symbol (concluded)

• Let m = p1p2 · · · pk be the prime factorization of m.

• When m > 1 is odd and gcd(a, m) = 1, then

(a | m) =

k i=1

(a | pi).

– Note that the Jacobi symbol equals ±1.

– It reduces to the Legendre symbol when m is a prime.

(26)

Properties of the Jacobi Symbol

The Jacobi symbol has the following properties when it is defined.

1. (ab | m) = (a | m)(b | m).

2. (a | m1m2) = (a | m1)(a | m2).

3. If a ≡ b mod m, then (a | m) = (b | m).

4. (−1 | m) = (−1)(m−1)/2 (by Lemma 69 on p. 562).

5. (2 | m) = (−1)(m2−1)/8.a

6. If a and m are both odd, then (a | m)(m | a) = (−1)(a−1)(m−1)/4.

aBy Lemma 69 (p. 562) and some parity arguments.

(27)

Properties of the Jacobi Symbol (concluded)

• Properties 3–6 allow us to calculate the Jacobi symbol without factorization.

– It will also yield the same result as Euler’s test (p.

554) when m is an odd prime.

• This situation is similar to the Euclidean algorithm.

• Note also that (a | m) = 1/(a | m) because (a | m) = ±1.a

aContributed by Mr. Huang, Kuan-Lin (B96902079, R00922018) on December 6, 2011.

(28)

Calculation of (2200 | 999)

(2200| 999) = (202 | 999)

= (2 | 999)(101 | 999)

= (−1)(9992−1)/8(101| 999)

= (−1)124750(101| 999) = (101 | 999)

= (−1)(100)(998)/4(999| 101) = (−1)24950(999| 101)

= (999| 101) = (90 | 101) = (−1)(1012−1)/8(45| 101)

= (−1)1275(45| 101) = −(45 | 101)

= −(−1)(44)(100)/4(101| 45) = −(101 | 45) = −(11 | 45)

= −(−1)(10)(44)/4(45| 11) = −(45 | 11)

= −(1 | 11) = −1.

(29)

A Result Generalizing Proposition 10.3 in the Textbook

Theorem 71 The group of set Φ(n) under multiplication mod n has a primitive root if and only if n is either 1, 2, 4, pk, or 2pk for some nonnegative integer k and an odd prime p.

This result is essential in the proof of the next lemma.

(30)

The Jacobi Symbol and Primality Test

a

Lemma 72 If (M | N) ≡ M(N−1)/2 mod N for all M ∈ Φ(N), then N is a prime. (Assume N is odd.)

• Assume N = mp, where p is an odd prime, gcd(m, p) = 1, and m > 1 (not necessarily prime).

• Let r ∈ Φ(p) such that (r | p) = −1.

• The Chinese remainder theorem says that there is an M ∈ Φ(N) such that

M = r mod p, M = 1 mod m.

aMr. Clement Hsiao (B4506061, R88526067) pointed out that the text- book’s proof for Lemma 11.8 is incorrect in January 1999 while he was a senior.

(31)

The Proof (continued)

• By the hypothesis,

M(N−1)/2 = (M | N) = (M | p)(M | m) = −1 mod N.

• Hence

M(N−1)/2 = −1 mod m.

• But because M = 1 mod m,

M(N−1)/2 = 1 mod m, a contradiction.

(32)

The Proof (continued)

• Second, assume that N = pa, where p is an odd prime and a ≥ 2.

• By Theorem 71 (p. 577), there exists a primitive root r modulo pa.

• From the assumption, MN−1 =

M(N−1)/2 2

= (M|N)2 = 1 mod N for all M ∈ Φ(N).

(33)

The Proof (continued)

• As r ∈ Φ(N) (prove it), we have

rN−1 = 1 mod N.

• As r’s exponent modulo N = pa is φ(N) = pa−1(p − 1), pa−1(p − 1) | (N − 1),

which implies that p | (N − 1).

• But this is impossible given that p | N.

(34)

The Proof (continued)

• Third, assume that N = mpa, where p is an odd prime, gcd(m, p) = 1, m > 1 (not necessarily prime), and a is even.

• The proof mimics that of the second case.

• By Theorem 71 (p. 577), there exists a primitive root r modulo pa.

• From the assumption, MN−1 =

M(N−1)/2 2

= (M|N)2 = 1 mod N for all M ∈ Φ(N).

(35)

The Proof (continued)

• In particular,

MN−1 = 1 mod pa (14)

for all M ∈ Φ(N).

• The Chinese remainder theorem says that there is an M ∈ Φ(N) such that

M = r mod pa, M = 1 mod m.

• Because M = r mod pa and Eq. (14), rN−1 = 1 mod pa.

(36)

The Proof (concluded)

• As r’s exponent modulo N = pa is φ(N) = pa−1(p − 1), pa−1(p − 1) | (N − 1),

which implies that p | (N − 1).

• But this is impossible given that p | N.

(37)

The Number of Witnesses to Compositeness

Theorem 73 (Solovay & Strassen, 1977) If N is an

odd composite, then (M | N) ≡ M(N−1)/2 mod N for at most half of M ∈ Φ(N).

• By Lemma 72 (p. 578) there is at least one a ∈ Φ(N) such that (a | N) ≡ a(N−1)/2 mod N.

• Let B = { b1, b2, . . . , bk } ⊆ Φ(N) be the set of all

distinct residues such that (bi | N) ≡ b(N−1)/2i mod N.

• Let aB = { abi mod N : i = 1, 2, . . . , k }.

• Clearly, aB ⊆ Φ(N), too.

(38)

The Proof (concluded)

• | aB | = k.

abi ≡ abj mod N implies N | a(bi − bj), which is

impossible because gcd(a, N) = 1 and N > | bi − bj |.

• aB ∩ B = ∅ because

(abi)(N−1)/2 ≡ a(N−1)/2b(N−1)/2i ≡ (a | N)(bi | N) ≡ (abi | N).

• Combining the above two results, we know

| B |

φ(N) | B |

| B ∪ aB | = 0.5.

(39)

1: if N is even but N = 2 then

2: return “N is composite”;

3: else if N = 2 then

4: return “N is a prime”;

5: end if

6: Pick M ∈ { 2, 3, . . . , N − 1 } randomly;

7: if gcd(M, N ) > 1 then

8: return “N is composite”;

9: else

10: if (M | N ) ≡ M(N−1)/2 mod N then

11: return “N is (probably) a prime”;

12: else

13: return “N is composite”;

14: end if

15: end if

(40)

Analysis

• The algorithm certainly runs in polynomial time.

• There are no false positives (for compositeness).

– When the algorithm says the number is composite, it is always correct.

(41)

Analysis (concluded)

• The probability of a false negative (again, for compositeness) is at most one half.

– Suppose the input is composite.

– By Theorem 73 (p. 585),

prob[ algorithm answers “no”| N is composite ] ≤ 0.5.

– Note that we are not referring to the probability that N is composite when the algorithm says “no.”

• So it is a Monte Carlo algorithm for compositeness.a

aNot primes.

(42)

The Improved Density Attack for compositeness

All numbers < N

Witnesses to compositeness of

N via Jacobi Witnesses to

compositeness of N via common

factor

(43)

Randomized Complexity Classes; RP

• Let N be a polynomial-time precise NTM that runs in time p(n) and has 2 nondeterministic choices at each step.

• N is a polynomial Monte Carlo Turing machine for a language L if the following conditions hold:

– If x ∈ L, then at least half of the 2p(n) computation paths of N on x halt with “yes” where n = | x |.

– If x ∈ L, then all computation paths halt with “no.”

• The class of all languages with polynomial Monte Carlo TMs is denoted RP (randomized polynomial time).a

aAdleman & Manders (1977).

(44)

Comments on RP

• In analogy to Proposition 40 (p. 328), a “yes” instance of an RP problem has many certificates (witnesses).

• There are no false positives.

• If we associate nondeterministic steps with flipping fair coins, then we can phrase RP in the language of

probability.

– If x ∈ L, then N(x) halts with “yes” with probability at least 0.5 .

– If x ∈ L, then N(x) halts with “no.”

(45)

Comments on RP (concluded)

• The probability of false negatives is  ≤ 0.5.

• But any constant between 0 and 1 can replace 0.5.

– Repeat the algorithm k = −log12  times and answer

“no” only if all the runs answer “no.”

– The probability of false negatives becomes k ≤ 0.5.

(46)

Where RP Fits

• P ⊆ RP ⊆ NP.

– A deterministic TM is like a Monte Carlo TM except that all the coin flips are ignored.

– A Monte Carlo TM is an NTM with more demands on the number of accepting paths.

• compositeness ∈ RP;a primes ∈ coRP;

primes ∈ RP.b

– In fact, primes ∈ P.c

• RP ∪ coRP is an alternative “plausible” notion of efficient computation.

aRabin (1976); Solovay & Strassen (1977).

bAdleman & Huang (1987).

cAgrawal, Kayal, & Saxena (2002).

(47)

ZPP

a

(Zero Probabilistic Polynomial)

• The class ZPP is defined as RP ∩ coRP.

• A language in ZPP has two Monte Carlo algorithms, one with no false positives (RP) and the other with no false negatives (coRP).

• If we repeatedly run both Monte Carlo algorithms, eventually one definite answer will come (unlike RP).

– A positive answer from the one without false positives.

– A negative answer from the one without false negatives.

aGill (1977).

(48)

The ZPP Algorithm (Las Vegas)

1: {Suppose L ∈ ZPP.}

2: {N1 has no false positives, and N2 has no false negatives.}

3: while true do

4: if N1(x) = “yes” then

5: return “yes”;

6: end if

7: if N2(x) = “no” then

8: return “no”;

9: end if

10: end while

(49)

ZPP (concluded)

• The expected running time for the correct answer to emerge is polynomial.

– The probability that a run of the 2 algorithms does not generate a definite answer is 0.5 (why?).

– Let p(n) be the running time of each run of the while-loop.

– The expected running time for a definite answer is

 i=1

0.5iip(n) = 2p(n).

• Essentially, ZPP is the class of problems that can be solved, without errors, in expected polynomial time.

(50)

Large Deviations

• Suppose you have a biased coin.

• One side has probability 0.5 +  to appear and the other 0.5 − , for some 0 <  < 0.5.

• But you do not know which is which.

• How to decide which side is the more likely side—with high confidence?

• Answer: Flip the coin many times and pick the side that appeared the most times.

• Question: Can you quantify your confidence?

(51)

The Chernoff Bound

a

Theorem 74 (Chernoff, 1952) Suppose x1, x2, . . . , xn are independent random variables taking the values 1 and 0 with probabilities p and 1 − p, respectively. Let X = n

i=1 xi. Then for all 0 ≤ θ ≤ 1,

prob[X ≥ (1 + θ) pn ] ≤ e−θ2pn/3.

• The probability that the deviate of a binomial random variable from its expected value

E[ X ] = E

 n



i=1

xi



= pn decreases exponentially with the deviation.

aHerman Chernoff (1923–). The bound is asymptotically optimal.

(52)

The Proof

• Let t be any positive real number.

• Then

prob[X ≥ (1 + θ) pn ] = prob[ etX ≥ et(1+θ) pn ].

• Markov’s inequality (p. 535) generalized to real-valued random variables says that

prob

etX ≥ kE[ etX ]

≤ 1/k.

• With k = et(1+θ) pn/E[ etX ], we havea

prob[X ≥ (1 + θ) pn ] ≤ e−t(1+θ) pnE[ etX ].

aNote that X does not appear in k. Contributed by Mr. Ao Sun (R05922147) on December 20, 2016.

(53)

The Proof (continued)

• Because X = n

i=1 xi and xi’s are independent, E[ etX ] = (E[ etx1 ])n = [ 1 + p(et − 1) ]n.

• Substituting, we obtain

prob[X ≥ (1 + θ) pn ] ≤ e−t(1+θ) pn[ 1 + p(et − 1) ]n

≤ e−t(1+θ) pnepn(et−1) as (1 + a)n ≤ ean for all a > 0.

(54)

The Proof (concluded)

• With the choice of t = ln(1 + θ), the above becomes prob[X ≥ (1 + θ) pn ] ≤ epn[ θ−(1+θ) ln(1+θ) ].

• The exponent expands to

−θ2

2 + θ3

6 θ4

12 + · · · for 0 ≤ θ ≤ 1.

• But it is less than

−θ2

2 + θ3

6 ≤ θ2



1

2 + θ 6

≤ θ2



1

2 + 1 6

= −θ2 3 .

(55)

Other Variations of the Chernoff Bound

The following can be proved similarly (prove it).

Theorem 75 Given the same terms as Theorem 74 (p. 599),

prob[X ≤ (1 − θ) pn ] ≤ e−θ2pn/2.

The following slightly looser inequalities achieve symmetry.

Theorem 76 (Karp, Luby, & Madras, 1989) Given the same terms as Theorem 74 (p. 599) except with 0 ≤ θ ≤ 2,

prob[X ≥ (1 + θ) pn ] ≤ e−θ2pn/4, prob[X ≤ (1 − θ) pn ] ≤ e−θ2pn/4.

(56)

Power of the Majority Rule

The next result follows from Theorem 75 (p. 603).

Corollary 77 If p = (1/2) +  for some 0 ≤  ≤ 1/2, then prob

 n



i=1

xi ≤ n/2



≤ e−2n/2.

• The textbook’s corollary to Lemma 11.9 seems too loose, at e−2n/6.a

• Our original problem (p. 598) hence demands, e.g.,

n ≈ 1.4k/2 independent coin flips to guarantee making an error with probability ≤ 2−k with the majority rule.

aSee Dubhashi & Panconesi (2012) for many Chernoff-type bounds.

(57)

BPP

a

(Bounded Probabilistic Polynomial)

• The class BPP contains all languages L for which there is a precise polynomial-time NTM N such that:

– If x ∈ L, then at least 3/4 of the computation paths of N on x lead to “yes.”

– If x ∈ L, then at least 3/4 of the computation paths of N on x lead to “no.”

• So N accepts or rejects by a clear majority.

aGill (1977).

Figure

Updating...

References

Related subjects :