Prime Numbers

466 Chapter 9 FAST ALGORITHMS FOR LARGE-INTEGER ARITHMETIC
Algorithm 2.1.4. Incidentally, the authors of this algorithm also give an
interesting method for rapid calculation of ⌊p/z⌋ when p =2 q −1 is specifically
a Mersenne prime.
Yet other inversion methods focus on the specific case that p is a Mersenne
prime. The following is an interesting attempt to exploit the special form of
the modulus:
Algorithm 9.4.5 (Inversion modulo a Mersenne prime). For p = 2 q − 1
prime and x ≡ 0(modp), this algorithm returns x −1 mod p.
1. [Initialize]
(a, b, y, z) =(1, 0,x,p);
2. [Relational reduction]
Find e such that 2 e y;
y = y/2 e ; // Shift off trailing zeros.
a =(2 q−e a)modp; // Circular shift, by Theorem 9.2.12.
if(y == 1) return a;
(a, b, y, z) =(a + b, a, y + z,y);
goto [Relational reduction];
9.4.3 Recursive-gcd schemes for very large operands
It turns out that the classical bit-complexity O(ln 2 N) for evaluating the gcd of
twonumbers,eachofsizeN, can be genuinely reduced via recursive reduction
techniques, as first observed in [Knuth 1971]. Later it was established that such
recursive approaches can be brought down to complexity
O(M(ln N)lnlnN),
where M(b) denotes the bit-complexity for multiplication of two b-bit integers.
With the best-known bound for M(b), as discussed later in this chapter, the
complexity for these recursive gcd algorithms is thus
O ln N(ln ln N) 2 ln ln ln N .
Studies on the recursive approach span several decades; references include
[Schönhage 1971], [Aho et al. 1974, pp. 300–310], [Bürgisser et al. 1997,
p. 98], [Cesari 1998], [Stehlé and Zimmermann 2004]. For the moment, we
observe that like various other algorithms we have encountered—such as preconditioned
CRT—the recursive-gcd approach cannot really use grammarschool
multiplication to advantage.
We shall present in this section two recursive-gcd algorithms, the original
one from the 1970s that, for convenience, we call the Knuth–Schönhage gcd
(or KSgcd)—–and a very new, pure-binary one by Stehlé–Zimmermann (called
the SZgcd). Both variants turn out to have the same asymptotic complexity,
but differ markedly in regard to implementation details.
One finds in practice that recursive-gcd schemes outperform all known
alternatives (such as the binary gcd forms with or without Lehmer enhancements)
when the input arguments x, y are sufficiently large, say in the region