Prime Numbers

370 Chapter 7 ELLIPTIC CURVE ARITHMETIC
In practice one would iterate the algorithm, getting a chain of inferences,
with the last number q so small it can be proved prime by trial division. If some
intermediate q is composite, then one can retreat one level in the chain and
apply the algorithm again. Iterating the Goldwasser–Kilian scheme not only
provides a rigorous primality test but also generates a certificate of primality.
This certificate can be thought of as the chain
(n = n0,a0,b0,m0,q0,P0), (q0 = n1,a1,b1,m1,q1,P1),...
consisting of consecutive n, a, b, m, q, P entities along the recursion. The
primary feature of the certificate is that it can be published alongside, or
otherwise associated with, the original n that is proven prime. This concise
listing can then be used by anyone who wishes to verify that n is prime, using
Theorem 7.6.1 at the various steps along the way. The reconstruction of the
proof usually takes considerably less time than the initial run that finds the
certificate. The certificate feature is nontrivial, since many primality proofs
must be run again from scratch if they are to be checked.
It should be noted that the elliptic arithmetic in Algorithm 7.6.2 can
be sped up using Montgomery coordinates [X : Z] with“Y ”dropped,as
discussed in Section 7.2.
To aid in the reader’s testing of any implementations, we now report a
detailed example. Let us take the prime p =10 20 + 39. On the first pass of
Algorithm 7.6.2, we use n = p and obtain random parameters in Step [Choose
a pseudocurve ...]as
a = 69771859804340235254, b = 10558409492409151218,
for which 4a 3 +27b 2 is coprime to n. The number that would be the order of
Ea,b(Zn) ifn is indeed prime is found, via Algorithm 7.5.6 to be
m =#E = 99999999985875882644 = 2 2 · 59 · 1182449 · q,
where 2, 59, 1182449 are known primes (falling below the threshold 2 32
suggested in the algorithm description), and q = 358348489871 is a probable
prime. Then, in Step [Choose point ...] the random point obtained is
P =[X : Z] = [31689859357184528586 : 1],
where for practical simplicity we have adopted Montgomery parameterization,
with a view to using Algorithm 7.2.7 for elliptic multiples. Accordingly, it was
found that
U =[m/q]P = [69046631243878263311 : 1] = O,
V =[q]U = O.
Therefore, p is prime if q is. So now we assign n = 358348489871 and run
again through Algorithm 7.6.2. In so doing the relevant values encountered
are
a = 34328822753, b = 187921935449,
m =#E = 358349377736 = 2 3 · 7 · 7949 · 805019,