Generating random primes faster The standard algorithm to generate - PowerPoint PPT Presentation

1 2 Generating random primes faster The standard algorithm to generate random primes: D. J. Bernstein proof.arithmetic(False) while True: pqRSA project team: p = randrange(2^(n-1),2^n) Daniel J. Bernstein p = ZZ(p) Josh Fried if p.is_prime(): print p Nadia Heninger n 1+ o (1) iterations per prime. Paul Lou Luke Valenta cr.yp.to/papers.html#pqrsa

1 2 Generating random primes faster The standard algorithm to generate random primes: D. J. Bernstein proof.arithmetic(False) while True: pqRSA project team: p = randrange(2^(n-1),2^n) Daniel J. Bernstein p = ZZ(p) Josh Fried if p.is_prime(): print p Nadia Heninger n 1+ o (1) iterations per prime. Paul Lou Luke Valenta Standard speedup using wheels: e.g., force p mod 6 ∈ { 1 ; 5 } . cr.yp.to/papers.html#pqrsa Wheel using all primes q ≤ n O (1) : n 1+ o (1) iterations per prime. 1 − 1 1 ` ´ ` ´ Recall Q ∈ Θ . q ≤ y log y q

1 2 Generating random primes faster The standard algorithm 2007 Mihailescu: n 3+ o (1) bit to generate random primes: Bernstein proof.arithmetic(False) while True: project team: p = randrange(2^(n-1),2^n) J. Bernstein p = ZZ(p) ried if p.is_prime(): print p Heninger n 1+ o (1) iterations per prime. Lou alenta Standard speedup using wheels: e.g., force p mod 6 ∈ { 1 ; 5 } . cr.yp.to/papers.html#pqrsa Wheel using all primes q ≤ n O (1) : n 1+ o (1) iterations per prime. 1 − 1 1 ` ´ ` ´ Recall Q ∈ Θ . q ≤ y log y q

1 2 random primes faster The standard algorithm 2007 Mihailescu: conjecturally n 3+ o (1) bit ops to to generate random primes: proof.arithmetic(False) while True: team: p = randrange(2^(n-1),2^n) Bernstein p = ZZ(p) if p.is_prime(): print p n 1+ o (1) iterations per prime. Standard speedup using wheels: e.g., force p mod 6 ∈ { 1 ; 5 } . cr.yp.to/papers.html#pqrsa Wheel using all primes q ≤ n O (1) : n 1+ o (1) iterations per prime. 1 − 1 1 ` ´ ` ´ Recall Q ∈ Θ . q ≤ y log y q

1 2 faster The standard algorithm 2007 Mihailescu: conjecturally n 3+ o (1) bit ops to prove p prime. to generate random primes: proof.arithmetic(False) while True: p = randrange(2^(n-1),2^n) p = ZZ(p) if p.is_prime(): print p n 1+ o (1) iterations per prime. Standard speedup using wheels: e.g., force p mod 6 ∈ { 1 ; 5 } . cr.yp.to/papers.html#pqrsa Wheel using all primes q ≤ n O (1) : n 1+ o (1) iterations per prime. 1 − 1 1 ` ´ ` ´ Recall Q ∈ Θ . q ≤ y log y q

2 3 The standard algorithm 2007 Mihailescu: conjecturally n 3+ o (1) bit ops to prove p prime. to generate random primes: proof.arithmetic(False) while True: p = randrange(2^(n-1),2^n) p = ZZ(p) if p.is_prime(): print p n 1+ o (1) iterations per prime. Standard speedup using wheels: e.g., force p mod 6 ∈ { 1 ; 5 } . Wheel using all primes q ≤ n O (1) : n 1+ o (1) iterations per prime. 1 − 1 1 ` ´ ` ´ Recall Q ∈ Θ . q ≤ y log y q

2 3 The standard algorithm 2007 Mihailescu: conjecturally n 3+ o (1) bit ops to prove p prime. to generate random primes: 2010 Bernstein conjecture: proof.arithmetic(False) correctly recognize primality using while True: n o (1) tests, total n 2+ o (1) bit ops. p = randrange(2^(n-1),2^n) Fermat test, then Lucas test p = ZZ(p) (as in 1980 Baillie–Wagstaff, 1980 if p.is_prime(): print p Pomerance–Selfridge–Wagstaff), n 1+ o (1) iterations per prime. then cubic test (1995 Atkin), etc.; Standard speedup using wheels: or some elliptic-curve tests. e.g., force p mod 6 ∈ { 1 ; 5 } . Wheel using all primes q ≤ n O (1) : n 1+ o (1) iterations per prime. 1 − 1 1 ` ´ ` ´ Recall Q ∈ Θ . q ≤ y log y q

2 3 The standard algorithm 2007 Mihailescu: conjecturally n 3+ o (1) bit ops to prove p prime. to generate random primes: 2010 Bernstein conjecture: proof.arithmetic(False) correctly recognize primality using while True: n o (1) tests, total n 2+ o (1) bit ops. p = randrange(2^(n-1),2^n) Fermat test, then Lucas test p = ZZ(p) (as in 1980 Baillie–Wagstaff, 1980 if p.is_prime(): print p Pomerance–Selfridge–Wagstaff), n 1+ o (1) iterations per prime. then cubic test (1995 Atkin), etc.; Standard speedup using wheels: or some elliptic-curve tests. e.g., force p mod 6 ∈ { 1 ; 5 } . Most iterations are much simpler: Wheel using all primes q ≤ n O (1) : Fermat test rejects p . n 1+ o (1) iterations per prime. Fast reject by trial division/ECM? 1 − 1 1 ` ´ ` ´ Recall Q ∈ Θ . q ≤ y Still n 3+ o (1) bit ops per prime. log y q

2 3 New: n 2 standard algorithm 2007 Mihailescu: conjecturally n 3+ o (1) bit ops to prove p prime. generate random primes: to generate 2010 Bernstein conjecture: proof.arithmetic(False) correctly recognize primality using True: n o (1) tests, total n 2+ o (1) bit ops. randrange(2^(n-1),2^n) Fermat test, then Lucas test ZZ(p) (as in 1980 Baillie–Wagstaff, 1980 p.is_prime(): print p Pomerance–Selfridge–Wagstaff), (1) iterations per prime. then cubic test (1995 Atkin), etc.; Standard speedup using wheels: or some elliptic-curve tests. rce p mod 6 ∈ { 1 ; 5 } . Most iterations are much simpler: using all primes q ≤ n O (1) : Fermat test rejects p . (1) iterations per prime. Fast reject by trial division/ECM? 1 − 1 1 ` ´ ` ´ Q ∈ Θ . q ≤ y Still n 3+ o (1) bit ops per prime. log y q

2 3 New: n 2 : 5+ o (1) bit algorithm 2007 Mihailescu: conjecturally to generate 2 n 0 : 5+ o n 3+ o (1) bit ops to prove p prime. random primes: 2010 Bernstein conjecture: proof.arithmetic(False) correctly recognize primality using n o (1) tests, total n 2+ o (1) bit ops. randrange(2^(n-1),2^n) Fermat test, then Lucas test (as in 1980 Baillie–Wagstaff, 1980 p.is_prime(): print p Pomerance–Selfridge–Wagstaff), iterations per prime. then cubic test (1995 Atkin), etc.; eedup using wheels: or some elliptic-curve tests. d 6 ∈ { 1 ; 5 } . Most iterations are much simpler: primes q ≤ n O (1) : Fermat test rejects p . iterations per prime. Fast reject by trial division/ECM? − 1 1 ´ ` ´ ∈ Θ . Still n 3+ o (1) bit ops per prime. log y q

2 3 New: n 2 : 5+ o (1) bit ops per p 2007 Mihailescu: conjecturally to generate 2 n 0 : 5+ o (1) primes. n 3+ o (1) bit ops to prove p prime. rimes: 2010 Bernstein conjecture: correctly recognize primality using n o (1) tests, total n 2+ o (1) bit ops. randrange(2^(n-1),2^n) Fermat test, then Lucas test (as in 1980 Baillie–Wagstaff, 1980 p Pomerance–Selfridge–Wagstaff), e. then cubic test (1995 Atkin), etc.; wheels: or some elliptic-curve tests. } . Most iterations are much simpler: n O (1) : Fermat test rejects p . e. Fast reject by trial division/ECM? 1 ` ´ . Still n 3+ o (1) bit ops per prime. log y

3 4 New: n 2 : 5+ o (1) bit ops per prime 2007 Mihailescu: conjecturally to generate 2 n 0 : 5+ o (1) primes. n 3+ o (1) bit ops to prove p prime. 2010 Bernstein conjecture: correctly recognize primality using n o (1) tests, total n 2+ o (1) bit ops. Fermat test, then Lucas test (as in 1980 Baillie–Wagstaff, 1980 Pomerance–Selfridge–Wagstaff), then cubic test (1995 Atkin), etc.; or some elliptic-curve tests. Most iterations are much simpler: Fermat test rejects p . Fast reject by trial division/ECM? Still n 3+ o (1) bit ops per prime.

� 3 4 New: n 2 : 5+ o (1) bit ops per prime 2007 Mihailescu: conjecturally to generate 2 n 0 : 5+ o (1) primes. n 3+ o (1) bit ops to prove p prime. 2010 Bernstein conjecture: Recall: correctly recognize primality using many n -bit integers, n o (1) tests, total n 2+ o (1) bit ops. total ≥ y bits Fermat test, then Lucas test batch (as in 1980 Baillie–Wagstaff, 1980 smoothness detection: n (lg y ) 2+ o (1) bit ops Pomerance–Selfridge–Wagstaff), per integer then cubic test (1995 Atkin), etc.; or some elliptic-curve tests. largest y -smooth divisor of each integer Most iterations are much simpler: Fermat test rejects p . Fast reject by trial division/ECM? Still n 3+ o (1) bit ops per prime.

� 3 4 New: n 2 : 5+ o (1) bit ops per prime 2007 Mihailescu: conjecturally to generate 2 n 0 : 5+ o (1) primes. n 3+ o (1) bit ops to prove p prime. 2010 Bernstein conjecture: Recall: correctly recognize primality using many n -bit integers, n o (1) tests, total n 2+ o (1) bit ops. total ≥ y bits Fermat test, then Lucas test batch (as in 1980 Baillie–Wagstaff, 1980 smoothness detection: n (lg y ) 2+ o (1) bit ops Pomerance–Selfridge–Wagstaff), per integer then cubic test (1995 Atkin), etc.; or some elliptic-curve tests. largest y -smooth divisor of each integer Most iterations are much simpler: Fermat test rejects p . Apply batch smoothness detection for y = 2 2 0 , then y = 2 2 1 , then Fast reject by trial division/ECM? Still n 3+ o (1) bit ops per prime. y = 2 2 2 , : : : , then y ≈ 2 n 0 : 5+ o (1) .