计算数论: Number Theory for Computing

230 Pages·2004·21.14 MB·English

by  颜松远 Song Y.Yan

Song Y. Yan
Number Theory
for Computing
Second Edition
Foreword by Martin E. Hellman
With 26 Figures, 78 Images, and 33 Tables
Springer
Berlin
Heidelberg
New York
Barcelona
Hong Kong
London
Milan Springer
Paris
Tokyo
Song Y. Yan
Foreword
Computer Science
Aston University
Birmingham B4 7ET
UK
[email protected]
Modern cryptography depends heavily on number theory, with primality test-
ing, factoring, discrete logarithms (indices), and elliptic curves being perhap s
the most prominent subject. areas. Since my own graduate study had empha-
sized probability theory, statistics, and real analysis, when I started work-
ACM Computing Classification (1998) : F.2.1, E.3-4, D.4.6, B.2.4, 11 .2 ing in cryptography around 1970, I found myself swimming in an unknown ,
AMS Mathematics Subject Classification (1991) : 1 lAxx, 1 IT71, murky sea. I thus know from personal experience how inaccessible numbe r
11Yxx, 11Dxx, 11Z05, 68Q25, 94A60 theory can be to the uninitiated. Thank you for your efforts to ease the
transition for a new generation of cryptographers .
Library of Congress Cataloging-in-Publication Data applied for
Thank you also for helping Ralph Merkle receive the credit he deserves .
Die Deutsche Bibliothek - CIP-Einheitsaufnahme
Diffie, Rix-est. Shamir. Adleman and I had the good luck to get expedited
Yan, Song Y.:
review of our papers, so that they appeared before Merkle's seminal contribu-
Number theory for computing: with 32 tables/Song Y. Yan. - 2. ed., rev.
and extended. - Berlin; Heidelberg; New York; Barcelona; Hong Kong; tion. Your noting his early submission date and referring to what has come to
London; Milan; Paris; Tokyo: Springer, 2002 be called "Diffie-Hellman key exchange" as it should, "Diffie-Hellman-Merkle
ISBN 3-540-43072-5 key exchange", is greatly appreciated.
ISBN 3-540-43072-5 Springer-Verlag Berlin Heidelber New York
It has been gratifying to see how cryptography and number theory hav e
ISBN 3-540-65472-0 Springer-Verlag Berlin Heidelberg New York (1st ed .)
helped each other over the last twenty-five years . Number theory has been
the source of numerous clever ideas for implementing cryptographic systems
This work is subject to copyright. All rights are reserved, whether the whole or part of the and protocols while cryptography has been helpful in getting funding for this
material is concerned, specifically the rights of translation, reprinting, reuse of illustrations ,
recitation, broadcasting, reproduction on microfilm or in any other way, and storage in dat a area which has sometimes been called the queen of mathematics" becaus e
bparnokvsis.i oDnus polfi cthaet iGoner omfa tnh Ciso ppyurbiglihcta Ltiaown oofr S peaprttesm tbheerr 9e,o 1f 9i6s 5p, einrm itist tceudrr eonntl yve ursniodne,r atnhde of its seeming lack of real world applications. Little did they know!
permission for use must always be obtained from Springer-Verlag . Violations are liable for
prosecution under the German Copyright Law.
Springer-Verlag Berlin Heidelberg New York,
a member of BertelsmannSpringer Science+Business Media GmbH
http://www.springende
Springer-Verlag Berlin Heidelberg 2000, 2002 Stanford, 30 .July 2001 Martin E. Hellman
Printed in Germany
The use of general descriptive names, trademarks, etc . in this publication does not imply,
even in the absence of a specific statement, that such names are exempt from the relevan t
protective laws and regulations and therefore free for general use.
Cover Design: KunkelLopka, Heidelberg
Typesetting: Camera ready by the author
Printed on acid-free paper SPIN 10852441 45/3142SR - 5 4 3 2 1 0
Preface to the Second Edition
Number theory is an experimental science
J. W. S. CASSELS (1922-
Professor Emeritus of Mathematics. The University of Cambridge
If you teach a course on number theory nowadays, chances are it will gen-
erate more interest among computer science majors than among mathe-
matics majors. Many will care little about integers that can be expressed
as the sum of two squares. They will prefer to learn how Alice can send a
message to Bob without fear of eavesdropper Eve deciphering it.
BRAIN E. BLANK, Professor of Mathematics
Washington University. St.. Louis, Missouri
The success of the first edition of the book encouraged me to produce thi s
second edition. I have taken this opportunity to provide proofs of many the-
orems, that had not been given in the first edition. Some additions and cor-
rections have also been included.
Since the publication of the first edition. I have received many communica-
tions from readers all over the world. It is my great pleasure to thank the fol-
lowing people for their comments. corrections and encouragements: Prof. Jim
Austin, Prof. Friedrich L. Bauer. Dr. Hassan Daghigh Dr. Deniz Deveci.
Mr. Rich Fearn, Prof. Martin Hellman. Prof. Zixin Hou. Mr. Waseem Hus-
sain, Dr. Gerard R. Maze. Dr. Paul Maguire. Dr. Helmut Mevn. Mr. Robert
Pargeter. Mr. Mok-Kong Shen. Dr. Peter Shiu. Prof. Jonathan P. Sorenson.
and Dr. David L. Stern. Special thanks must be given to Prof. Martin Hell-
man of Stanford University for writing the kind Foreword to this edition and
also for his helpful advice and kind guidance. to Dr. Hans Wossner. Mr. Al-
fred Hofmann, Mrs. Ingeborg Mayer, Mrs. Ulrike Stricken, and Mr. Frank
Holzwarth of Springer-Verlag for their kind help and encouragements dur-
ing the preparation of this edition, and to Dr. Rodney Coleman. Prof. Glyn
James, Mr. Alexandros Papanikolaou. and Mr. Robert Pargeter for proof-
reading the final draft. Finally. I would like to thank Prof. Shiing-Shen Chern.
Preface to the Second Edition
Director Emeritus of the Mathematical Sciences Research Institute in Berke - Preface to the First Edition
ley for his kind encouragements; this edition is dedicated to his 90th birthday!
Readers of the book are, of course, very welcome to communicate with
the author either by ordinary mail or by e-mail to s . yan@aston. ac . uk, so
that your corrections, comments and suggestions can be incorporated into a
future edition.
Birmingham. February 2002 S. Y. Y. Mathematicians do not study objects, but relations among objects; they are
indifferent to the replacement of objects by others as long as relations do
not change. Matter is not important, only form interests them.
HENRI PoINCARr (1854-1912)
Computer scientists working on algorithms for factorization would be well
advised to brush up on their number theory.
IAN STEWART
Geometry Finds Factor Fast
Nature, Vol. 325, 15 January 1987, page 199
The theory of numbers, in mathematics, is primarily the theory of the prop-
erties of integers (i.e., the whole numbers), particularly the positive integers.
For example, Euclid proved 2000 years ago in his Elements that there ex-
ist infinitely many prime numbers. The subject had long been considered as
the purest branch of mathematics, with very few applications to other ar-
eas. However, recent years have seen considerable increase in interest in sev-
eral central topics of number theory, precisely because of their importanc e
and applications in other areas, particularly in computing and informatio n
technology. Today, number theory has been applied to such diverse areas as
physics, chemistry, acoustics, biology, computing, coding and cryptography,
digital communications, graphics design, and even music and business' . In
particular, congruence theory has been used in constructing perpetual calen-
dars, scheduling round-robin tournaments, splicing telephone cables, devisin g
systematic methods for storing computer files, constructing magic squares ,
generating random numbers, producing highly secure and reliable encryptio n
schemes and even designing high-speed (residue) computers . It is specifically
worthwhile pointing out that computers are basically finite machines ; they
1 In his paper [96] in the International Business Week, 20 June 1994, pp. 62-64,
Fred Guterl wrote: "Number Theory, once the esoteric study of what happens
when whole numbers are manipulated in various ways, is becoming a vital prac -
tical science that is helping solve tough business problems ".
Preface to the First Edition Preface to the First Edition
have finite storage. can only deal with numbers of some finite length and can methods. A small number of exercises is also provided in some sections . and
only perform essentially finite steps of computation . Because of such limita- it is worthwhile trying all of them.
tions. congruence arithmetic is particularly useful in computer hardware an d The book is intended to be self-contained with no previous knowledg e
software design. of number theory and abstract algebra assumed . although some familiarity
This book takes the reader on a journey, starting at elementary number with first, year undergraduate mathematics will be helpful . The book is suit-
theory. going through algorithmic and computational number theory. and able either as a text for an undergraduate/postgraduate course in Numbe r
finally finishing at applied number theory in computing science . It is divided Theory/Mathematics for Computing/Cryptography. or as a basic reference
into three distinct parts: researchers in the field.
(1) Elementary Number Theory,
(2) Computational/Algorithmic Number Theory ,
Acknowledgements
(3) Applied Number Theory in Computing and Cryptography.
The first part is mainly concerned with the basic concepts and results of divis- I started to write this book in 1990 when I was a lecturer in the School of
ibility theory, congruence theory, continued fractions . Diophantine equations Mathematical and Information Sciences at La Trobe University . Australia.
and elliptic curves. A novel feature of this part is that it contains an ac- I completed the book when I was at the University of York and finalized i t
count of elliptic curves. which is not normally provided by an elementar y at Coventry and Aston Universities. all in England. I am very grateful to
number theory book. The second part provides a brief introduction to th e Prof. Bertram Mond and Dr. John Zeleznikow of the School of Mathemat-
basic concepts of algorithms and complexity, and introduces some important ical and Information Sciences at La. Trobe University. Dr. Terence Jackson
and widely used algorithms in computational number theory. particularly of the Department of Mathematics and Prof . Jim Austin of the Department
those for prirnality testing, integer factorization. discrete logarithms, and el- of Computer Science at the University of York, Prof. Glyn James. Mr. Brian
liptic curve discrete logarithms . An important feature of this part is that Aspinall and Mr. Eric Tatham of the School of Mathematical and Informa-
it contains a section on quantum algorithms for integer factorization an d tion Sciences at Coventry University, and Prof. David Lowe and Dr . Ted
discrete logarithms, which cannot be easily found, so far, in other texts o n Elsworth of Computer Science and Applied Mathematics at Aston Univer-
computational/algorithmic number theory. This part finishes with sections sity in Birmingham for their many fruitful discussions. kind encouragement
on algorithms for computing x(:r.), for finding amicable pairs, for verifying and generous support. Special thanks must be given to Dr. Hans Wossner
Goldbach's conjecture, and for finding perfect and amicable numbers . The and Mr. Andrew Ross at Springer-Verlag Berlin/Heidelberg and the referees
third part of the book discusses some novel applications of elementary an d of Springer-Verlag, for their comments, corrections and suggestions . During
computational number theory in computing and information technology, par- the long period of the preparation of the book. I also got much help in one
ticularly in cryptography and information security ; it covers a wide range of way or another from, whether they are aware of it, or not, Prof. Eric Bach of
topics such as secure communications, information systems security . com- the University of Wisconsin at Madison . Prof. Jim Davenport of the Univer-
puter organisations and design . error detections and corrections . hash func- sity of Bath. Prof. Richard Guy of the University of Calgary. Prof. Martin
tion design. and random number generation. Throughout the book we follow Hellman of Stanford University. Dr. David Johnson of ATkT Bell Labo-
the style "Definition-Theorem-Algorithm-Example " to present our material, ratories. Prof. S. Lakshmivarahan of the University of Oklahoma, Dr . Ajie
rather than the traditional Hardy Wright "Definition-Theorem-P1oof " style Lenstra. of Bell Communication Research . Prof. Hendrik Lenstra Jr . of the
[100], although we do give proofs to most of the theorems. We believe this is University of California at Berkeley. Prof. Roger Needham and Dr. Richard
the most. suitable way to present mathematical material to computing profes- Pinch of the University of Cambridge. Dr. Peter Pleasants of the Univer-
sionals. As Donald Knuth [121] pointed out in 1974: "It has often been said sity of the South Pacific (Fiji), Prof. Carl Pomerance of the University of
that a. person does not really understand something until he teaches it t o Georgia, Dr. Herman to Riede of the Centre for Mathematics and Computer
someone else. Actually a person does not really understand something until Science (CWI), Amsterdam, and Prof. Hugh William of the University of
he can teach it to a computer. The author strongly recommends readers Manitoba. Finally. I would like to thank Mr. William Bloodworth (Dallas,
to implement all the algorithms and methods introduced in this book on a Texas). Dr. John Cosgrave (St. Patrick's College, Dublin). Dr. Gavin Doherty
computer using a. mathematics (computer algebra) system such as Maple in (Rutherford Appleton Laboratory, Oxfordshire) . Mr. Robert Pargeter (Tiver-
order to get a better understanding of the ideas behind the algorithms and ton, Devon). Mr. Alexandros Papanikolaou (Aston University, Birmingham).
(cid:9)(cid:9)(cid:9)
xii Preface to the First Edition
and particularly Prof. Richard Brent (Oxford University Computing Labora- Table of Contents
tory). Dr. Rodney Coleman (Universite Joseph Fourier, Grenoble) and Prof.
Glyn James (Coventry University) for reading the various versions of the
book. As communicated by Dr. Hans wossner: nothing is perfect and no-
body is perfect. This book and the author are no exception. Any comments.
corrections and suggestions from readers of the book are especially very wel-
come and can be sent to the author either by ordinary mail or by e-mail to
s [email protected].
Birmingham. February 2000 S. Y. Y. 1. Elementary Number Theory(cid:9) 1
1.1 Introduction(cid:9) 1
1.1.1 What is Number Theory?(cid:9) 1
1.1.2 Applications of Number Theory(cid:9) 13
1.1.3 Algebraic Preliminaries(cid:9) 14
1.2 Theory of Divisibility(cid:9) 21
1.2.1 Basic Concepts and Properties of Divisibility(cid:9) 21
1.2.2 Fundamental Theorem of Arithmetic(cid:9) 27
1.2.3 Mersenne Primes and Fermat Numbers(cid:9) 33
1.2.4 Euclid's Algorithm(cid:9) 40
1.2.5 Continued Fractions(cid:9) 44
1.3 Diophantine Equations(cid:9) 52
1.3.1 Basic Concepts of Diophantine Equations(cid:9) 52
1.3.2 Linear Diophantine Equations(cid:9) 54
1.3.3 Pell's Equations(cid:9) 57
1.4 Arithmetic Functions(cid:9) 63
1.4.1 Multiplicative Functions(cid:9) 63
1.4.2 Functions 7(n), a(n) and s(n)(cid:9) 66
1.4.3 Perfect. Amicable and Sociable Numbers(cid:9) 71
1.4.4 Functions 6(n). z\(n) and µ(n) 79
1.5 Distribution of Prime Numbers(cid:9) 8,5
1.5.1 Prime Distribution Function ;r(x)(cid:9) 85
1.5.2 Approximations of (r) by x/ in x(cid:9) 87
1.5.3 Approximations of 'T(x) by Li(r)(cid:9) 94
1.5.4 The Riemann (-Function c(s) 95
1.5.5 The nth Prime(cid:9) 104
1.5.6 Distribution of Twin Primes(cid:9) 106
1.5.7 The Arithmetic Progression of Primes(cid:9) 110
1.6 Theory of Congruences(cid:9) 111
1.6.1 Basic Concepts and Properties of Congruences(cid:9) 111
1.6.2 Modular Arithmetic(cid:9) 118
1.6.3 Linear Congruences(cid:9) 123
1.6.4 The Chinese Remainder Theorem(cid:9) 130
1.6.5 High-Order Congruences(cid:9) 133
Table of Contents Table of Contents xv
1.6.6 Legendre and Jacobi Symbols 139 2.6 Miscellaneous Algorithms in Number Theory 287
1.6.7 Orders and Primitive Roots 150 2.6.1 Algorithms for Computing 7r(x)(cid:9) 287
1.6.8 Indices and kth Power Residues 155 2.6.2 Algorithms for Generating Amicable Pairs 292
1.7 Arithmetic of Elliptic Curves 160 2.6.3 Algorithms for Verifying Goldbach's Conjecture 295
1.7.1 Basic Concepts of Elliptic Curves 160 2.6.4 Algorithm for Finding Odd Perfect Numbers 299
1.7.2 Geometric Composition Laws of Elliptic Curves 163 2.7 Bibliographic Notes and Further Reading 300
1.7.3 Algebraic Computation Laws for Elliptic Curves 164
3. Applied Number Theory in Computing/Cryptography 303
1.7.4 Group Laws on Elliptic Curves 168
3.1 Why Applied Number Theory? 303
1.7.5 Number of Points on Elliptic Curves 169
3.2 Computer Systems Design 305
1.8 Bibliographic Notes and Further Reading 171
3.2.1 Representing Numbers in Residue Number Systems 305
2. Computational/Algorithmic Number Theory 173 3.2.2 Fast Computations in Residue Number Systems 308
2.1 Introduction 173 3.2.3 Residue Computers 312
2.1.1 What is Computational/Algorithmic Number Theory? 174 3.2.4 Complementary Arithmetic 315
2.1.2 Effective Computability 177 3.2.5 Hash Functions 317
2.1.3 Computational Complexity 181 3.2.6 Error Detection and Correction Methods 321
2.1.4 Complexity of Number-Theoretic Algorithms 188 3.2.7 Random Number Generation 326
2.1.5 Fast Modular Exponentiations 194 3.3 Cryptography and Information Security 332
2.1.6 Fast Group Operations on Elliptic Curves 198 3.3.1 Introduction 332
2.2 Algorithms for Primality Testing 202 3.3.2 Secret-Key Cryptography 333
2.2.1 Deterministic and Rigorous Primality Tests 202 3.3.3 Data/Advanced Encryption Standard (DES/AES) 344
2.2.2 Fermat's Pseudoprimality Test 206 3.3.4 Public-Key Cryptography 348
2.2.3 Strong Pseudoprimality Test 208 3.3.5 Discrete Logarithm Based Cryptosystems 354
2.2.4 Lucas Pseudoprimality Test 215 3.3.6 RSA Public-Key Cryptosystem 3.58
2.2.5 Elliptic Curve Test 222 3.3.7 Quadratic Residuosity Cryptosystems 373
2.2.6 Historical Notes on Primality Testing 225 3.3.8 Elliptic Curve Public-Key Cryptosystems 379
2.3 Algorithms for Integer Factorization 228 3.3.9 Digital Signatures 385
2.3.1 Complexity of Integer Factorization 228 3.3.10 Digital Signature Standard (DSS) 392
2.3.2 Trial Division and Fermat Method 232 3.3.11 Database Security 395
2.3.3 Legendre's Congruence 234 3.3.12 Secret Sharing 399
2.3.4 Continued FRACtion Method (CFRAC) 237 3.3.13 Internet/Web Security and Electronic Commerce 403
2.3.5 Quadratic and Number Field Sieves (QS/NFS) 240 3.3.14 Steganography 409
2.3.6 Polland's -rho" and "p — 1" Methods 244 3.3.1.5 Quantum Cryptography 410
2.3.7 Lenstra's Elliptic Curve Method (ECM) 251 3.4 Bibliographic Notes and Further Reading 411
2.4 Algorithms for Discrete Logarithms 2.54
Bibliography 41.5
2.4.1 Shanks' Baby-Step Giant-Step Algorithm 255
2.4.2 Silver—Pohlig--Hellman Algorithm 258 Index 429
2.4.3 Index Calculus for Discrete Logarithms 262
2.4.4 Algorithms for Elliptic Curve Discrete Logarithms 266
2.4..5 Algorithm for Root Finding Problem 270
2..5 Quantum Number Theoretic Algorithms 273
2.5.1 Quantum Information and Computation 273
2.5.2 Quantum Computability and Complexity 278
2.5.3 Quantum Algorithm for Integer Factorization 279
2.5.4 Quantum Algorithms for Discrete Logarithms 285
(cid:9) (cid:9) (cid:9)(cid:9)
Notation
All notation should be as simple as the nature of the operations to which
it is applied.
CHARLES BABBAGE (1791—1871)
Notation Explanation
N set of natural numbers: N = {1, 2, 3, . - • }
Z set of integers (whole numbers): Z = {0, ±n : n E N}
Z+ set. of positive integers: Z+ = N
7L>1 set of positive integers greater than 1 :
7G>i ={n :nEZandn>1}
ba :
set of rational numbers: Q= a. b E Z and b 0
R set of real numbers:
li'={n+0.drdzd3 ••• :nEZ. d1E{0,1,--- ,9}
and no infinite sequence of 9's appears}
C set of complex numbers:
C={a+bi :a,bE andi=-/-1}
Z/nZ also denoted by Za, residue classes modulo n:
a ring of integers: a field if n is prime
(Z/nZ)* multiplicative group; the elements of this group are th e
elements in Z/nZ that are relatively prime to n :
(Z/nZ)* = {[a]„ E Z/nZ : gcd(a,n.) = 1}.
p finite field with p elements, where p is a prime number
~v finite field with q = a prime power
IC (arbitrary) field
ring
(cid:9)(cid:9)(cid:9)(cid:9)(cid:9)(cid:9) (cid:9)(cid:9)
xviii Notation Notation six
c group function of x
order of group inverse of f
B,, Bernoulli numbers:
binomial coefficient
+ n+ 1
1 B,i+ . . .+ B1 +Bo=0
n
integration
F,, Fermat numbers: F,, = 23 + 1, n > 0
lip lersenne primes: logarithmic integral: Li(x) = dt
1111, = 2' – 1 is prime whenever p is prime In t
square root of x sum: XI + x-2 +
R ~. kth root of x
asymptotic equality product: x1x2 - - x„
approximate equality n! factorial: n(n–1)(n–2)•••3 .2 . 1
oc infinity :rk x to the power k
implication kP kP = P :i P' ? . . . . P, where P is a point (x, y) on
equivalence k summands
blank symbol: end of proof an elliptic curve E : y2 = x3 + ax + b
the point at infinity on an elliptic curve E over a field
space
probability measure e the transcendental number e = 1 2.7182818
„>o n.
cardinality of set S
Iogb x logarithm of x to the base b (b 1): x = btOrt
member of
logx binary logarithm: loge x
proper subset
Inx natural logarithm: loge x
subset
binary operations exp(x) exponential of x: —
,x>o n!
binary operation (addition); exclusive or (XOR)
al b a divides b
binary operation (multiplication)
a) b a does not divide b
f(:r) g(x) f(x) and g(x) are asymptotically equal p" II n nbut1P 1 { n
(c. *) = (1-t, *) (g,*) and ("H.*) are isomorphic greatest, common divisor of (a, b)
1 undefined
least common multiple of (a, b)
el, encryption key
the greatest integer less than or equal to x
decryption key
(lk the least integer greater than or equal to x
Ebb (M) encryption process C = ,(M). x
where 11 is the plaintext xmod n remainder: x — n
_n-
Di, (C) decryption process ..11- = Dd,,(C), x=ymod n x is equal to y reduced to modulo n
where C is the ciphertext y (mod n) x is congruent to y modulo n
x tj (mod ii) x is not congruent to p modulo n
(cid:9) (cid:9)(cid:9)(cid:9)(cid:9)(cid:9)(cid:9)(cid:9)(cid:9)(cid:9)(cid:9)(cid:9)(cid:9)
Notation Notation
xx
residue class of a n odulo n [qo. q1 , q2, , q,,] finite simple continued fraction
addition modulo n. Cr. = k-th convergent of a continued fraction
subtraction modulo n-
[go, qi, q2. ] infinite simple continued fraction
multiplication modulo n [gogl, . . ,gk.gk+l,qh+2, . . '
xk mod n. x to the power k modulo 11 periodic simple continued fraction
kP mod n kP modulo n class of problems solvable in deterministic
ord„(a) order of an integer a modulo n; polynomial time
also denoted by ord(a, n) A P class of problems solvable in nondeterministic
indg,,,a index of a to the base g modulo n: polynomial time
also denoted by ind9a whenever n s xed RP class of problems solvable in random polynomial
number of primes less than or equal to x: time with one-sided errors
,; (x) E 1 BPn class of problems solvable in random polynomial
time with two-sided errors
Y(n) number of positive divisors of n: )-(n) E 1 zPP class of problems solvable in random polynomial
time with zero errors
o-(n) sum of positive divisors of n: o-(n) = E d upper bound: f(n) = O(g(n)) if there exists some
constant c > 0 such that f (n) < c g(n)
s(n) sum of proper divisors of n: s(n) = a(n) — n
upper bound that is not asymptotically tight:
0(n) Euler's totient function: 0(n) = E 1 f(n) = O(g(n)), do > 0 such that f(n) < c g(n)
low bound: f(n) = .2(g(n)) if there exists a
Carmichael's function: constant c such that f(n) > g(n)
a(n) = lcln (\(pi')A(pa ) . . .A(p )) ifn = IlK' tight bound: f(n) = 0(n) if f(n) = O(g(n))
i=1 and Pi)) = .2(g(n))
Mobius function
polynomial-time complexity measured in terms of
1
c(s) Riemann zeta-function: S(s) = f s, arithmetic operations. where k > 0 is a constant
where s is a complex variable ,1=1 Ti q ((logN)k) polynomial-time complexity measured in terms of
bit operations. where k > 0 is a constant
Legendre symbol, where p is prime q ((log N)' 1"g N) superpolynomial complexity, where c > 0 is a constant
q (exp (cv/log N log log N
Jacobi symbol, where n is composite
subexponential complexit
set of all quadratic residues of n 0 (exp (cy/log A log log 1' ~l = (NeVlog log N/log N)
set, of all quadratic nonresidues of n. 0 (exp(x)) exponential complexity. sometimes denoted by 0 (e )
Jn = {a E (Z/nZ)` : } 0 (N`) exponential complexity measured in terms of
() =1
bit operations: O (N') = 0 (2E log N)
set of all pseudosquares of n: = Jn — Qn ,
where e > 0 is a constant
set, of all kth power residues of n, where k > 2
CFRAC Continued FRACtion method (for factoring)
K(k)1, set of all kth power nonresidues of n, where k > 2 ECM Elliptic Curve Method (for factoring)