Prime Numbers

138 Chapter 3 RECOGNIZING PRIMES AND COMPOSITES
The reader should consult Chapter 4 for strategies on proving prime those
numbers we strongly suspect to be prime. However, for practical applications,
one may be perfectly happy to use a number that is almost certainly prime, but
has not actually been proved to be prime. It is with this mindset that people
refer to Algorithm 3.5.6 as a “primality test.” It is perhaps more accurate to
refer to a number produced by such a test as an “industrial-grade prime,” to
use a phrase of H. Cohen.
The following algorithm may be used for the generation of random
numbers that are likely to be prime.
Algorithm 3.5.7 (“Industrial-grade prime” generation). We are given an
integer k ≥ 3 andanintegerT ≥ 1. This probabilistic algorithm produces a
random k-bit number (that is, a number in the interval 2 k−1 , 2 k ) that has not
been recognized as composite by T iterations of Algorithm 3.5.6.
1. [Choose candidate]
Choose a random odd integer n in the interval 2 k−1 , 2 k ;
2. [Perform strong probable prime tests]
for(1 ≤ i ≤ T ) { // i is a dummy counter.
Via Algorithm 3.5.6 attempt to find a witness for n;
if(a witness is found for n) goto [Choose candidate];
}
return n; // n is an “industrial-grade prime.”
An interesting question is this: What is the probability that a number
produced by Algorithm 3.5.7 is composite? Let this probability be denoted
by P (k, T). One might think that Theorem 3.5.4 immediately speaks to
this question, and that we have P (k, T) ≤ 4 −T . However, the reasoning is
fallacious. Suppose k = 500,T = 1. We know from the prime number theorem
(Theorem 1.1.4) that the probability that a random odd 500-bit number is
prime is about 1 chance in 173. Since it is evidently more likely that one
will witness an event with probability 1/4 occurring before an event with
probability 1/173, it may seem that there are much better than even odds
that Algorithm 3.5.7 will produce composites. In fact, though, Theorem 3.5.4
is a worst-case estimate, and for most odd composite numbers the fraction of
witnesses is much larger than 3/4. It is shown in [Burthe 1996] that indeed
we do have P (k, T) ≤ 4 −T .
If k is large, one gets good results even with T = 1 in Algorithm 3.5.7. It
isshownin[Damg˚ard et al. 1993] that P (k, 1)