Primality Proving with Elliptic Curves Laurent Thry Marelle - PowerPoint PPT Presentation

Primality Proving with Elliptic Curves Laurent Théry Marelle Project 29/03/2007 – p.1

Prime Number Inductive N := O: N | S ( n : N ): N Definition m + n := if m is S m ′ then S ( m ′ + n ) else n Definition m * n := if m is S m ′ then n + ( m ′ * n ) else O Definition m | n := ∃ q, n = q * m Definition prime p := ∀ m, m | p ⇒ m = 1 ∨ m = p ∧ p � = 1 29/03/2007 – p.2

Prime Number Theorem ex 1 : prime 1234567891. Proof. Qed. 29/03/2007 – p.3

Fermat little theorem b k − 1 b k − 1 a b k − 1 a 2 . . . b k − 1 a i . . . b k − 1 a m − 1 . . . . . . . . . . . . . . . . . . . . . . . . b i a i . . . b i a m − 1 b i a 2 b i b i a . . . . . . . . . . . . . . . . . . . . . . . . b 1 a i . . . b 1 a m − 1 b 1 a 2 b 1 b 1 a . . . a i . . . a m − 1 a 2 1 a a m = 1 mod n a n − 1 = a mk = ( a m ) k = 1 mod n 29/03/2007 – p.4

Pocklington Certificate m is the order of a : a m = 1 mod n ∧ ∀ k, k | m ⇒ a m/k � = 1 mod n Projection from Z /n Z to Z /p Z ( p | n ) : gcd ( u, n ) = 1 ∧ u � = 0 mod n ⇒ u � = 0 mod p 29/03/2007 – p.5

Pocklington Certificate Let N be an integer. Assume that there exists a coprime to n and m such that a m = 1 mod n ∀ p, prime p ∧ p | m ⇒ gcd ( a m/p − 1 , n ) = 1 Then, if m ≥ √ n , n is prime. 29/03/2007 – p.6

Elliptic Curve Cubic curve: y 2 = x 3 + Ax + B (4 A 3 + 27 B 2 � = 0) Example: y 2 = x 3 − x 29/03/2007 – p.7

Formalisation Inductive elt: Set := | inf_elt: elt | curve_elt (x: K) (y: K) (H: y 2 = x 3 + A * x + B): elt. 29/03/2007 – p.8

Elliptic Curve r q p 29/03/2007 – p.9

Elliptic Curve -p p 29/03/2007 – p.10

Formalisation Definition -p := match p with | inf_elt ⇒ inf_elt | curve_elt x y H ⇒ curve_elt x (-y) opp lem end. 29/03/2007 – p.11

Elliptic Curve q q q p+q p p p 29/03/2007 – p.12

Formalisation Definition p 1 + p 2 := match p1, p2 with | inf_elt, _ ⇒ p 2 | _, inf_elt ⇒ p 1 | curve_elt x 1 y 1 H 1 , curve_elt x 2 y 2 H 2 ⇒ if x 1 = = x 2 then if (y 1 = = -y 2 ) then inf_elt else let l = (3 * x 2 1 + A)/(2 * y1) in let x 3 = l 2 - 2 * x 1 in ⊕ t curve_elt x 3 (-y 1 - l * (x 3 - x 1 )) add lem 1 else let l = (y 2 - y 1 )/(x 2 - x 1 ) in let x 3 = l 2 - x 1 - x 2 in ⊕ g curve_elt x 3 (-y 1 - l * (x 3 - x 1 )) add lem 2 29/03/2007 – p.13

Formalisation ( elt , +) is a commutative group The difficult part: p 1 + ( p 2 + p 3 ) = ( p 1 + p 2 ) + p 3 Reduce to p 1 ⊕ ( p 2 ⊕ p 3 ) = ( p 1 ⊕ p 2 ) ⊕ p 3 Further reduce to 1. p 1 ⊕ g ( p 2 ⊕ g p 3 ) = ( p 1 ⊕ g p 2 ) ⊕ g p 3 . 2. p 1 ⊕ g ( p 2 ⊕ t p 2 ) = ( p 1 ⊕ g p 2 ) ⊕ g p 2 . 3. p 1 ⊕ g ( p 1 ⊕ g ( p 1 ⊕ t p 1 )) = ( p 1 ⊕ t p 1 ) ⊕ t ( p 1 ⊕ t p 1 ) 4. p 1 ⊕ g ( p 2 ⊕ g ( p 1 ⊕ g p 2 )) = ( p 1 ⊕ g p 2 ) ⊕ t ( p 1 ⊕ g p 2 ) 29/03/2007 – p.14

Explicit computation y 2 = x 3 + Ax + B ∧ l = (3 x 2 + A ) / 2 y ∧ x 1 = l 2 − 2 x ∧ y 1 = − y − l ( x 1 − x ) ∧ ⇒ y 2 1 = x 3 1 + Ax 1 + B Common denominator: 2 10 y 8 − 2 10 y 6 x 3 − 2 10 Ay 6 x − 2 10 By 6 = 0 29/03/2007 – p.15

Explicit computation Common denominator: 2 10 y 8 − 2 10 y 6 x 3 − 2 10 Ay 6 x − 2 10 By 6 = 0 Rewriting: 2 10 ( x 3 + Ax + B ) 4 − 2 10 ( x 3 + Ax + B ) 3 x 3 − 2 10 A ( x 3 + Ax + B ) 3 x − 2 10 B ( x 3 + Ax + B ) 3 = 0 Ring Equality: Qed 29/03/2007 – p.16

First equation x 1 − x 2 � = 0 ∧ x 4 − x 3 � = 0 ∧ x 2 − x 3 � = 0 ∧ x 5 − x 1 � = 0 ∧ y 2 1 = x 3 1 + A ∗ x 1 + B ∧ y 2 2 = x 3 2 + A ∗ x 2 + B ∧ y 2 3 = x 3 3 + A ∗ x 3 + B ∧ x 4 = ( y 1 − y 2 ) 2 / ( x 1 − x 2 ) 2 − x 1 − x 2 ∧ y 4 = − ( y 1 − y 2 ) / ( x 1 − x 2 ) ∗ ( x 4 − x 1 ) − y 1 ∧ x 6 = ( y 4 − y 3 ) 2 / ( x 4 − x 3 ) 2 − x 4 − x 3 ∧ y 6 = − ( y 4 − y 3 ) / ( x 4 − x 3 ) ∗ ( x 6 − x 3 ) − y 3 ∧ x 5 = ( y 2 − y 3 ) 2 / ( x 2 − x 3 ) 2 − x 2 − x 3 ∧ y 5 = − ( y 2 − y 3 ) / ( x 2 − x 3 ) ∗ ( x 5 − x 2 ) − y 2 ∧ x 7 = ( y 5 − y 1 ) 2 / ( x 5 − x 1 ) 2 − x 5 − x 1 ∧ y 7 = − ( y 5 − y 1 ) / ( x 5 − x 1 ) ∗ ( x 7 − x 1 ) − y 1 ⇒ x 6 − x 7 = 0 29/03/2007 – p.17

First equation - (2) * y 8 2 * x 7 3 * x 6 2 + 2 * (2 * (1 + 2)) * y 8 2 * x 7 3 * x 5 2 * x 1 - 2 * (1 + 2 * (1 + 2 * (1 + 2))) * y 8 2 * x 7 3 * x 4 2 * x 2 1 + 2 * (2 * (2 * (1 + 4))) * y 8 2 * x 7 3 * x 3 2 * x 3 1 - 2 * (1 + 2 * (1 + 2 * (1 + 2))) * y 8 2 * x 7 3 * x 2 2 * x 4 1 + 2 * (2 * (1 + 2)) * y 8 2 * x 7 3 * x 2 * x 5 1 - 2 * y 8 2 * x 7 3 * x 6 1 + 2 * (2 * (1 + 2)) * y 8 2 * x 6 3 * x 7 2 - 2 * (1 + 2 * (1 + 2 * (2 * 4))) * y 8 2 * x 6 3 * x 6 2 * x 1 + 2 * (2 * (2 * (1 + 2 * (2 * (1 + 4))))) * y 8 2 * x 6 3 * x 5 2 * x 2 1 - 2 * (1 + 2 * (2 * (2 * (1 + 2 * (2 * (1 + 2)))))) * y 8 2 * x 6 3 * x 4 2 * x 3 1 + 2 * (2 * (1 + 2 * (1 + 2 * (2 * 4)))) * y 8 2 * x 6 3 * x 3 2 * x 4 1 - 2 * (1 + 2 * (2 * (1 + 4))) * y 8 2 * x 6 3 * x 2 2 * x 5 1 + 2 * y 8 2 * x 6 3 * x 7 1 - ................................................... ................................................... ................................................... 20000 lines!! 29/03/2007 – p.18

Reflection One Reification Ring Horner Representation: P ❀ P ′ + x i Q ′ Rewrite [ m = R ] Naive: P ❀ P = P ′ + mQ ′ ❀ P ′ + RQ ′ Common denominator P 1 /Q 1 + P 2 /Q 2 ❀ ( P ′ 1 Q ′ 2 + P ′ 2 Q ′ 1 ) /Q ′ 1 Q ′ 2 Result: field[H 1 ; H 2 ] 80 seconds. 29/03/2007 – p.19

Elliptic Certificate Order of a point: m.P = P + · · · + P = 0 � �� � m Projective coordinate: (3 / 4 , 1 / 3) ❀ (9 : 4 : 12) 29/03/2007 – p.20

Elliptic Certificate Let n be an integer. Assume that there exist an elliptic curve y 2 = x 3 + Ax + B with A, B ∈ Z and gcd (4 A 3 + 27 B 2 , n ) = 1 , a point P = ( x P : y P : 1) such that y 2 P = x 3 P + Ax P + B mod n , and an integer m such that • m.P = (0 : 1 : 0) mod n ; • for all prime p | m , ( m/p ) .P = ( x p : y p : z p ) mod n with gcd ( z p , n ) = 1 . Then, if 4 n < ( m − 1) 2 , n is prime 29/03/2007 – p.21

Elliptic Certificate { 329719147332060395689499 , − 94080 , 9834496 , 0 , 3136 , 8209062 , [(40165264598163841 , 1)] } with the curve y 2 = x 3 − 94080 x + 9834496 and the point 8209062 . (0 , 3136) whose order is 40165264598163841 , 329719147332060395689499 is prime if 40165264598163841 is prime . 29/03/2007 – p.22

Checking certificates Definition double( p 1 , sc 1 ) = if p 1 = 0 then (0 , sc 1 ) else let ( x 1 : y 1 : z 1 ) = p 1 in if y 1 = 0 then (0 , z 1 sc 1 ) else let m = 3 x 2 1 + Az 2 1 and l = 2 y 1 z 1 in let l 2 = l 2 and x 2 = m 2 z 1 − 2 x 1 l 2 in (( x 2 l : l 2 ( x 1 m − y 1 l ) − x 2 m : z 1 l 2 l ) , sc 1 ) 29/03/2007 – p.23

A Demo 29/03/2007 – p.24

Conclusions Proving Primality Proving Ubiquity of computing 29/03/2007 – p.25