Pocklington primality test

In mathematics, the Pocklington–Lehmer primality test is a primality test devised by Henry Cabourn Pocklington^[1] and Derrick Henry Lehmer^[2] to decide whether a given number $N$ is prime. The output of the test is a proof that the number is prime or that primality could not be established.

Pocklington criterion

The test relies on the Pocklington Theorem (Pocklington criterion) which is formulated as follows:

Let $N > 1$ be an integer, and suppose there exist numbers a and q such that

(1) q is prime, $q \vert N - 1$ and $q > \sqrt{N}- 1$

(2) $a^{N-1} \equiv 1 \pmod{N}$

(3) $\gcd{(a^{(N-1)/q} - 1 , N)} = 1$

Then $N$ is prime.^[3]

Proof of this theorem

Suppose N is not prime. This means there must be a prime p, where $p \le \sqrt{N}$ that divides N.

Therefore, $q > p - 1$ which implies $\gcd{(q , p - 1)} = 1$.

Thus there must exist an integer u with the property that

(4) $uq\equiv 1 \pmod{p - 1}$

This implies:

$1 \;\; \equiv a^{N-1}\pmod{p}$, by (2) since $p \vert N$

$\equiv (a^{N-1})^{u}\equiv a^{u(N-1)} \equiv a^{uq((N-1)/q)}\equiv (a^{uq})^{(N-1)/q}\pmod{p}$,

$\equiv a^{(N-1)/q}\pmod{p}$, by (4) and Fermat's little theorem

This shows that $p$ divides $\gcd()$ from (3), and therefore the $\gcd()$ is not $1$; a contradiction.^[3]

The test is simple once the theorem above is established. Given N, seek to find suitable a and q. If they can be obtained, then N is prime. Moreover, a and q are the certificate of primality. They can be quickly verified to satisfy the conditions of the theorem, confirming N as prime.

A problem which arises is the ability to find a suitable q, that must satisfy (1)–(3) and be provably prime. It is even quite possible that such a q does not exist. This is a large probability, indeed only 57.8% of the odd primes, N, $N \le 10, 000$ have such a q. To find a is not nearly so difficult. If N is prime, and a suitable q is found, each choice of a where $1 \le a < N$ will satisfy $a^{N-1} \equiv 1\pmod{N}$, and so will satisfy (2) as long as ord(a) does not divide $(N - 1)/q$. Thus a randomly chosen a is likely to work. If a is a generator mod N its order is N-1 and so the method is guaranteed to work for this choice.^[4]

Generalized Pocklington method

A generalized version of Pocklington's theorem covers more primes N.

Corollary:

Let N − 1 factor as N − 1 = AB, where A and B are relatively prime, $A > \sqrt{N}$ and the factorization of A is known.

If for every prime factor p of A there exists an integer $a_p$ so that

$a^{N - 1}_p\equiv 1 \pmod{N}$

and $\gcd{(a^{(N - 1)/p}_p - 1, N)} = 1$ then N is prime. The reverse implication also holds: If N is prime then every prime factor of A can be written in the above manner.^[5]

Proof of Corollary: Let p be a prime dividing A and let $p^e$ be the maximum power of p dividing A. Let v be a prime factor of N. For the $a_p$ from the corollary set $b \equiv a^{(N-1)/p^e}_p \pmod{v}$. This means $b^{p^e} \equiv a^{N-1}_p \equiv 1 \pmod{v}$ and because of $\gcd{(a^{(N-1)/p}_p - 1, N)} = 1$ also $b^{p^{e-1}} \equiv a^{(N-1)/p}_p \not\equiv 1 \pmod{v}$.

This means that the order of $b \pmod{v}$ is $p^e$

Thus, $p^e \vert (v - 1)$. The same observation holds for each prime power factor $p^e$ of A, which implies $A \vert (v - 1)$.

Specifically, this means $v > A \ge \sqrt{N}.$

If N were composite, it would necessarily have a prime factor which is less than or equal to $\sqrt{N}$. It has been shown that there is no such factor, which implies that N is prime.

To see the converse choose $a_p$ a generator of the integers modulo p.^[6]

The test

The Pocklington–Lehmer primality test follows directly from this corollary. We must first partially factor N − 1 into A and B. Then we must find an $a_p$ for every prime factor p of A, which fulfills the conditions of the corollary. If such $a_p$'s can be found, the Corollary implies that N is prime.

According to Koblitz, $a_p$ = 2 often works.^[3]

Example

$N = 11351$

$N - 1 = 2\cdot 5^2\cdot 227$

Choose $A = 227\cdot5^2$, which means $B = 2$

Now it is clear that $\gcd{(A,B)} = 1$ and $A > \sqrt{N}$.

Next find an $a_p$ for each prime factor p of A. E.g. choose $a_5=2$.

$a^{N-1}_p \equiv 2^{11350} \equiv 1 \pmod{11351}$.

$\gcd{(a^{(N-1)/p}_p - 1, N)} = \gcd{(2^{2\cdot 5\cdot 227} - 1, 11351)} = 1.$

So $a_5=2$ satisfies the necessary conditions. Choose $a_{227} = 7$.

$a^{N-1}_p \equiv 7^{11350} \equiv 1 \pmod{11351}$

and

$\gcd{(a^{(N-1)/p}_p - 1, N)} = \gcd(7^{2\cdot 25} - 1, 11351) = 1.$

So both $a_p$'s work and thus N is prime.

We have chosen a small prime for calculation purposes but in practice when we start factoring A we will get factors that themselves must be checked for primality. It is not a proof of primality until we know our factors of A are prime as well. If we get a factor of A where primality is not certain, the test must be performed on this factor as well. This gives rise to a so-called down-run procedure, where the primality of a number is evaluated via the primality of a series of smaller numbers.

In our case, we can say with certainty that 2, 5, and 227 are prime, and thus we have proved our result. The certificate in our case is the list of $a_p$'s, which can quickly be checked in the corollary.

If our example had given rise to a down-run sequence, the certificate would be more complicated. It would first consist of our initial round of $a_p$'s which correspond to the 'prime' factors of A; Next, for the factor(s) of A of which primality was uncertain, we would have more $a_p$'s, and so on for factors of these factors until we reach factors of which primality is certain. This can continue for many layers if the initial prime is large, but the important thing to note, is that a simple certificate can be produced, containing at each level the prime to be tested, and the corresponding $a_p$'s, which can easily be verified. If at any level we cannot find $a_p$'s then we cannot say that N is prime.

The biggest difficulty with this test is the necessity of discovering prime factors of N - 1, in essence, factoring N − 1. In practice this could be extremely difficult. Finding $a_p$'s is a less difficult problem.^[7]

Extensions and variants

The seminal 1975 paper by Brillhart, Lehmer, and Selfridge^[8] gives a proof for what is shown above as the "generalized Pocklington theorem" as theorem 4 on page 623. Additional theorems are shown allowing less factoring. This includes theorem 3 (a strengthening of Proth 1878):

Let $N-1 = mp$ where p is an odd prime such that $2p+1 \ge \sqrt N$. If there exists an a for which $a^{(N-1)/2} \equiv -1 \pmod{N}$, but $a^{m/2} \not\equiv -1 \pmod{N}$, then N is prime.

and theorem 5 on page 624 that allows a proof when the factored part has reached only $(N/2)^{1/3}$. Many additional theorems are provided.

References

1. Henry Cabourn Pocklington (1914–1916). "The determination of the prime or composite nature of large numbers by Fermat's theorem". Proceedings of the Cambridge Philosophical Society 18: 29–30.
2. Derrick Henry Lehmer (1927). "Tests for primality by the converse of Fermat's theorem". Bull. Amer. Math. Soc. 33 (3): 327–340. doi:10.1090/s0002-9904-1927-04368-3.
3. Koblitz, Neal, A Course in Number Theory and Cryptography, 2nd Ed, Springer,1994
4. http://www.mast.queensu.ca/~math418/m418oh/m418og26.pdf
5. Blake, Ian F., Seroussi, Gadiel, Smart, Nigel Paul, Elliptic Curves in Cryptography, Cambridge University Press, 1999
6. Washington, Lawrence C., Elliptic Curves: Number Theory and Cryptography, Chapman & Hall/CRC, 2003
7. Roberto Avanzi, Henri Cohen, Christophe Doche, Gerhard Frey, Tanja Lange, Kim Nguyen, Frederik Vercauteren (2005). Handbook of Elliptic and Hyperelliptic Curve Cryptography. Boca Raton: Chapman & Hall/CRC.
8. John Brillhart; Derrick Henry Lehmer; John Selfridge (April 1975). "New Primality Criteria and Factorizations of 2^m ± 1". Mathematics of Computation 29 (130): 620–647. doi:10.1090/S0025-5718-1975-0384673-1.

External links