PAPER Special Section on Information Theory and Its Applications New Methods of Generating

In this section, we derive the approximation for the probability that a randomly-chosen odd number belongs to these class of strong primes. Throughout this paper, a prime candidate P denotes a randomlychosen odd number and pi denotes the i-th prime, i.e., p1 = 2, p2 = 3, . . . , and so on. 3.1 Distribution of Primes We approximate the probability that P is a prime as follows: Prob(P : Prime)
where p− and p+ are the largest prime factors of P − 1 and P + 1, respectively. Throughout this paper, p− , p+ , A and B are defined by the following: Definition 1: Let p− be the largest prime factor of P − 1, and let A= P −1 . p− (3)
S Primes are the most secure prime numbers against both P − 1 and P + 1 methods. When all factors of an integer n are less than v , it is called that “the number n is v -smooth.” Even in the case of AB = 24, if AB is v -smooth, and if both p− and p+ are large enough, then P is also secure against both factoring methods.
2.
Secure Primes
If P − 1 cannot be factored into small primes, it is hard to factor N with P − 1 method, where P is a factor of N . Similarly, if P + 1 cannot be factored into small primes, it is hard to factor N with P + 1 method. P − 1 and P + 1 can be represented as P − 1 = Ap− , P + 1 = Bp+ , (1) (2)
1.
Introduction
Security of many modern cryptosystems is based on the difficulty of factoring problem or discrete logarithm problem. Thus it becomes very important to investigate primes sufficiently because cryptosystems based on these problems need large primes. In 1974, Pollard suggested an algorithm of factoring method [1]. This method is widely reffered to as P − 1 method. Factoring the composite number N , P − 1 method is very effective when P − 1 is factored into small primes, where P is a factors of the N . In 1975, Guy suggested P + 1 method which is a similar algorithm to P − 1 method [2]. Since cryptosystem based on the problem of factoring the composite number N can be attacked with P − 1 and P + 1 methods, it is required that P − 1 and P + 1 should be difficult to be factored into many small primes. The trial division method is well known as an efficient method for generating prime numbers [3], [4]. But many primes generated with this method is vulnerable to both P − 1 and P + 1 methods. In this paper, first, we consider the distribution of secure primes against both P − 1 and P + 1 methods. Second, we propose two efficient algorithms for generating secure primes against P − 1 and P + 1 methods by extending the trial division method.
IEICE TRANS. FUNDAMENTALS, VOL.E82–A, NO.10 OCTOBER 1999
2162
Definition 4: v -S Prime : On a prime number P , when AB is v -smooth, we call the number ‘P ’ v -S Prime. In spite that it is more easy to find v -S Primes than to find S Primes, v -S Primes are also secure prime numbers against both P − 1 and P + 1 methods. 3. Distribution of the Secure Primes
3≤pi ≤
The righthand side of Eq. (7) can be given by Prob(P : S Prime) 0.14114
5≤pi≤ 3√源自1−P1 pi
.
(8)
Reason: From the equation: 1− 1 3 = 1− pi pi 1 pi
Manuscript received January 22, 1999. Manuscript revised May 1, 1999. † The authors are with the Department of Electronics and Information Science, Faculty of Engineering and Design, Kyoto Institute of Technology, Kyoto-shi, 606–8585 Japan. ∗ This paper was presented at SITA’98.
Yoshizo SATO† , Nonmember, Yasuyuki MURAKAMI† , and Masao KASAHARA† , Members
SUMMARY Since cryptosystem based on the problem of factoring the composite number N can be attacked with P − 1 and P + 1 methods, it is required that P − 1 and P + 1 should be difficult to be factored into many small primes, where we assume that the P is a factor of N . In this paper, first, we consider the distribution of secure primes against both P − 1 and P + 1 methods. Second, we propose two efficient algorithms for generating secure primes against both P − 1 and P +1 methods by extending the trial division method. key words: prime generation, P − 1 method, P + 1 method, trial division method
IEICE TRANS. FUNDAMENTALS, VOL.E82–A, NO.10 OCTOBER 1999
2161
PAPER
Special Section on Information Theory and Its Applications
New Methods of Generating Primes Secure against Both P − 1 and P + 1 Methods∗
Definition 2: Let p+ be the largest prime factor of P + 1, and let B= P +1 . p+ (4)