Prime Numbers

7.6 Elliptic curve primality proving (ECPP) 369
constant k. Their idea is to find appropriate curves with orders that have
large enough “probable prime” factors, and recurse on the notion that these
factors should in turn be provably prime. In each recursive level but the last,
Theorem 7.6.1 is used with s the probable prime factor of the curve order.
This continues for smaller and smaller probable primes, until the number is
so small it may be proved prime by trial division. This, in turn, justifies all
previous steps, and establishes the primality of the starting number n.
Algorithm 7.6.2 (Goldwasser–Kilian primality test). Given a nonsquare
integer n>2 32 strongly suspected of being prime (in particular, gcd(n, 6) = 1
and presumably n has already passed a probable prime test), this algorithm attempts
to reduce the issue of primality of n to that of a smaller number q. The
algorithm returns either the assertion “n is composite” or the assertion “If q is
prime then n is prime,” where q is an integer smaller than n.
1. [Choose a pseudocurve over Zn]
Choose random (a, b) ∈ [0,n− 1] 2 such that gcd(4a 3 +27b 2 ,n)=1;
2. [Assess curve order]
Via Algorithm 7.5.6 calculate the integer m that would be #Ea,b(Zn) if
n is prime (however if the point-counting algorithm fails, return “n is
composite”);
// If n is composite, Algorithm 7.5.6 could fail if each candidate for t
(mod l) is rejected or if the final curve order is not in the interval
(n +1− 2 √ n, n +1+2 √ n).
3. [Attempt to factor]
Attempt to factor m = kq where k>1 and q is a probable prime exceeding
n 1/4 +1 2 , but if this cannot be done according to some time-limit
criterion, goto [Choose a pseudocurve ...];
4. [Choose point on Ea,b(Zn)]
Choose random x ∈ [0,n− 1] such that Q =(x3 + ax + b) modnhas Q
n = −1;
Apply Algorithm 2.3.8 or 2.3.9 (with a = Q and p = n) to find an integer
y that would satisfy y2 ≡ Q (mod n) if n were prime;
if(y2 mod n = Q) return “n is composite”;
P =(x, y);
5. [Operate on point]
Compute the multiple U =[m/q]P (however if any illegal inversions occur,
return “n is composite”);
if(U == O) goto [Choose point ...];
Compute V =[q]U (however check the above rule on illegal inversions);
if(V = O) return “n is composite”;
return “If q is prime, then n is prime”;
The correctness of Algorithm 7.6.2 follows directly from Theorem 7.6.1, with
q playing the role of s in that theorem.