MO419 – Probabilistic Algorithms – Flávio K. Miyazawa – IC/UNICAMP 2010
A survey on Probabilistic Algorithms to
Primality Test
Marcio Machado Pereira – RA 780681
Marco Alves Ganhoto – RA 015271
Introduction
One of the longstanding problems in using encryption to encode messages is that the recipient
of the message needs to know the key in order to decrypt the message. Clearly we somehow
have to get the key to the participants so they can use it. We can’t send the key to them without
encrypting *it*, or someone might “eavesdrop” and get it. But this puts us in an infinite loop: the
person getting the key will need to know what second key was used to encrypt the first key, etc.
How can we break this cycle? One amazingly clever idea is called the Diffie-Hellman key
1
agreement protocol . This protocol enables two agents to share a secret, using completely open
communication: Alissa and Ben, who have never interacted before, have an open
conversation—anyone, including Eve, the eavesdropper, may hear the complete conversation.
At the end of the conversation Alissa and Ben will possess a shared secret that no one else,
including Eve, can know. How is this possible? The idea is very simple. It is amazing that it had
not been thought of hundreds of years ago. Here is the idea:
2
• Everyone knows two publicly advertised numbers a, p .
• Alyssa chooses a secret number, Sa, that she remembers.
• Ben chooses a secret number, Sb, that he remembers.
S
• Alyssa computes Pa  a a (mod p) and announces Pa.
Sb
• Ben computes Pb  a (mod p) and announces Pb.
S
S S
• Alyssa computes x  Pb a (mod p)  a b a (mod p).
Sb
S aS b
• Ben computes y  Pa (mod p)  a
(mod p).
• But x = y, so Alyssa and Ben share a secret.
The secret shared by Alyssa and Ben is the number x = y. The reason why Eve cannot obtain
the same secret is that for a sufficiently large prime number p, and sufficiently large secret
S
S
numbers Sa and Sb, given the public information, a, p, a a (mod p), and a b (mod p), there is no
S aS b
3
efficient algorithm known to get a
(mod p ). The secret shared by Alyssa and Ben can then
be used as a key for a cryptographic system to encrypt and decrypt messages that cannot be
read by Eve.












 


               

To implement a Diffie-Hellman key agreement you will have to create procedural and data
abstractions for solving some sub-problems, including:
 modular arithmetic (addition, subtraction, and multiplication mod n);
n
 fast exponentiation (computing a when n is very large);
 generating large random numbers and testing whether this number is prime – also
4
called Primality test (one implementation with Fermat Primality Test, in Scheme
language, is showing in Appendix C).
Primality Test
A primality test is a test to determine whether or not a given number is prime, as opposed to
actually decomposing the number into its constituent prime factors (which is known as prime
factorization).
Primality tests come in two varieties: deterministic and probabilistic. Deterministic tests
determine with absolute certainty whether a number is prime. Examples of deterministic tests
include the Lucas-Lehmer test and elliptic curve primality proving. Probabilistic tests can
potentially (although with very small probability) falsely identify a composite number as prime
(although not vice versa). However, they are in general much faster than deterministic tests.
Numbers that have passed a probabilistic prime test are therefore properly referred to as
probable primes until their primality can be demonstrated deterministically.
A number that passes a probabilistic test but is in fact composite is known as a pseudoprime.
There are many specific types of pseudoprimes, the most common being the Fermat
pseudoprimes, which are composites that nonetheless satisfy Fermat's little theorem.
The Rabin-Miller strong pseudoprime test is a particularly efficient test. Mathematica
versions 2.2 and later have implemented the multiple Rabin-Miller test in bases 2 and 3
combined with a Lucas pseudoprime test as the primality test used by the function PrimeQ[n].
Like many such algorithms, it is a probabilistic test using pseudoprimes. In order to guarantee
primality, a much slower deterministic algorithm must be used. However, no numbers are
actually known that pass advanced probabilistic tests (such as Rabin-Miller) yet are actually
composite.
The state of the art in deterministic primality testing for arbitrary numbers is elliptic curve
primality proving. As of Feb. 2009, the largest number certified by the program PRIMO (7993
decimal digits) took eight months on a 2-GHz processor.
Unlike prime factorization, primality testing was long believed to be a P-problem. This had not
been demonstrated, however, until Agrawal et al. (2002) unexpectedly discovered a polynomial
12
time algorithm for primality testing that has asymptotic complexity of O (ln n). Their algorithm
has come to be called the AKS primality test.
Fermat Pseudoprimes – The Fermat Primality Test
Fermat’s Little Theorem allows us to prove that a number is composite without actually
factoring it.


                     
                  

 
               

Fermat’s Little Theorem (alternate statement): If an-1 1 (mod n) for some
a, with a  0 (mod n), then n is composite.
This statement is absolute: There are no exceptions (see Appendix A). Unfortunately,
the inverse statement is not always true.
Inverse to Fermat’s Little Theorem: If an-1  1 (mod n) for some a with an-1
 0 (mod n), then n is prime.
Some counterexamples:
2340  1 (mod 341), but 341 = 11 * 31 is composite, and
5560  1 (mod 561), but 561 = 3 * 11 * 17 is composite.
We say that 341 is a Fermat pseudoprime (to the base 2), and 561 is a Fermat
pseudoprime to the base 5. It is even possible for an−1  1 (mod n) to hold for every a,
with gcd(a,n) = 1, and still have n be composite. This occurs if n is a Carmichael
number (also called an absolute Fermat pseudoprime). A Carmichael number is a
Fermat pseudoprime to any base a with gcd(a,n) = 1. Carmichael numbers are fairly
rare: There are only seven less than 10000:
561, 1105, 1729, 2465, 2821, 6601, 8911
In fact, there are only 585,355 Carmichael numbers less than 1017. Given a randomly
chosen odd integer n less than 1017, the probability that n is a Carmichael number is
only a little over 10−11 (about one in one hundred billion). For a randomly chosen odd
integer n with 100 to 300 digits, the probability that n is a Carmichael number appears
to be exceedingly low (for practical purpose, zero). On the other hand, prime numbers
are fairly common. The Prime Number Theorem, holds that the number of primes less
than n is roughly n / ln n (see Appendix B).
If n is composite and not a Carmichael number, then there are at most (n)/2 values of
a (1  a < n) for which an−1  1 (mod n).
Let n be any odd integer, other than a Carmichael number. Say we choose 50 random
integers a, and compute that each satisfies an−1  1 (mod n). The probability that this
would occur if n is composite is at most 2−50  10−15.
So we can say with reasonable certainty that n is prime. If n is composite and not a
Carmichael number, then it is actually possible to have (n)/2 values for which an−1  1
(mod n). For example, take n = 91 = 7 * 13 * (n) = 6 * 12 = 72.
There are 36 values of a with a72  1 (mod 91), namely a = 1, 3, 4, 9, 10, 12, 16, 17, 22,
23, 25, 27, 29, 30, 36, 38, 40, 43, 48, 51, 53, 55, 61, 62, 64, 66, 68, 69, 74, 75, 79, 81,
82, 87, 88, 90. But this is unusual.
For nearly all odd composite integers n (other than Carmichael numbers),
(mod n) for far fewer than (n)/2 values of a.
For example, let us look at odd composite integers starting with 10001.
n
(n)
10001
10003
10005
10011
10013
9792
8568
4928
6440
8640
o
n of a with
a  1(mod n)
64
36
64
280
16
n−1
an−1  1
10015
10017
10019
10021
10023
10025
10027
10029
10031
10033
10035
10041
10043
8008
5616
9744
9100
6144
8000
9720
6684
8592
9828
5328
6192
9020
4
16
4
100
8
32
162
4
4
36
8
4
4
This means that far fewer than the 50 random values of a, mentioned earlier, are
typically sufficient to show that an odd integer (not a Carmichael number) is prime, with
near certainty.
For a randomly chosen odd integer n with 100 to 300 digits, it appears that if an−1  1
(mod n) for even a single randomly chosen a, then n is prime with probability very close
to 1.
Fermat Test for Primality: To test whether n is prime or composite, choose a, at
random and compute an−1 (mod n).
i) If an−1  1 (mod n), declare n a probable prime, and optionally repeat the test a
few more times.
ii) If an−1 1 (mod n), declare n composite, and stop.
We have seen that the Fermat test is really quite good for large numbers. One
limitation: If someone is supposed to provide us with a prime number, and sends a
Carmichael number instead, we cannot detect the deception with the Fermat test. In
any case, we can improve upon the Fermat test at almost no cost.
Euler Pseudoprimes – The Euler Test
If n is an odd prime, we know that an integer can have at most two square roots, mod
n. In particular, the only square roots of 1 (mod n) are ±1. If a  0 (mod n), a(n−1)/2 is a
square root of a(n−1)  1 (mod n), so a(n−1)/2  ±1 (mod n). If a(n−1)/2  ±1 (mod n) for some a
with a  0 (mod n), then n is composite.
Euler Test:
For a randomly chosen a with a  0 (mod n), compute a(n− 1)/2 (mod n).
i) If a(n−1)/2  ±1 (mod n), declare n a probable prime, and optionally repeat the
test a few more times.
(If n is large and chosen at random, the probability that n is prime is very close to 1.)
ii) If a(n−1)/2  ±1 (mod n), declare n composite.
(This is always correct.)
The Euler test is more powerful than the Fermat test. If the Fermat test finds that n is
composite, so does the Euler test. But the Euler test may find n composite even when
the Fermat test fails. Why?
If n is an odd composite integer (other than a prime power), 1 has at least 4 square
roots mod n. So we can have a(n−1)/2   (mod n), where   ±1 is a square root of 1.
Then an−1  1 (mod n). In this situation, the Fermat Test (incorrectly) declares n a
probable prime, but the Euler test (correctly) declares n composite.
We noted earlier that
2340  1 (mod 341), even though 340 is composite, and
5560  1 (mod 561), even though 561 is composite.
We can compute that
2170  1 (mod 341), even though 340 is composite, but
5280  67  ±1 (mod 561), showing that 561 is composite.
We call 341 an Euler pseudoprime to the base 2. But note that 561 is not an Euler
pseudoprime base 5, even though it is a Fermat pseudoprime base 5. On the whole,
there are only about half as many Euler pseudoprimes as Fermat pseudoprimes.
Consider the seven Carmichael numbers less than 10000. The Euler test can show
that 5 of the 7 numbers are composite.
n
o
(n)
a
561
1105
1729
2465
2881
6601
8911
320
768
1296
1792
2160
5280
7128
n of a with
 1(mod n)
320
768
1296
1792
2160
5280
7128
n−1
o
a
n of a with
 ±1(mod n)
160
384
1296
1792
1080
2640
1782
(n−1)/2
The integers 1729 and 2465 are called absolute Euler pseudoprimes (by analogy with
the absolute Fermat pseudoprimes, i.e., Carmichael numbers).
These are composite odd integers such that a(n−1)/2  ±1 (mod n) for every a with
gcd(a,n) = 1. These number cannot be proven composite with the Euler test (unless we
happen to choose an a with gcd(a,n) > 1, which is exceedingly unlikely if n is a large
integer lacking small prime factors. There are fewer absolute Euler pseudoprimes than
there are Carmichael numbers, but unfortunately absolute Euler pseudoprimes do
exist.
The Rabin-Miller Primality Test
The Euler test improves upon the Fermat test by taking advantage of the fact, if 1 has a
square root other than ±1 (mod n), then n must be composite. If
a(n−1)/2  ±1 (mod
n), where gcd(a,n) = 1, then n must be composite for one of two reasons:
i) If an−1  1 (mod n), then n must be composite by Fermat’s Little Theorem.
ii) If an−1  1 (mod n), then n must be composite because a(n−1)/2 is a square root
of 1 (mod n) different from ±1.
The limitation of the Euler test is that is does not go to any special effort to find square
roots of 1, different from ±1. The Rabin-Miller test does do this. For example, recall the
Euler Test declares 341 a probable prime because
2170  1 (mod 341). But if we
compute 285 (mod 341), we find 285  32 (mod 341). Thus 32 is a square root of 22*85 
2170  1 (mod 341), different from ±1, so we would find that 341 is composite. In the
s
Rabin-Miller test, we write n −1 = 2 * m, with m odd and s  1.
We then start by compute am (mod n) using fast exponentiation.
If am  ±1 (mod n), we declare n a probable prime, and stop.
Why? We know that an−1  ((am)2)s  1 (mod n), and we will not find a square
root of 1, other than ±1, in repeated squaring of am to get an−1.
Otherwise, unless s = 1, we square am (mod n) to obtain a2m.
If a2m  1 (mod n), we declare n composite, and stop.
Why? am is a square root of a2m  1 (mod n), different from ±1.
If a2m  −1 (mod n), we declare n a probable prime, and stop.
Why? Just as above, we know that an−1  1 (mod n), and we will not find a
square root of 1, other than ±1.
Otherwise, unless s = 2, we square a2m (mod n) to obtain a4*m.
If a4*m  1 (mod n), we declare n composite, and stop.
Why? We have found a square root of 1 (mod n), different from ±1, just as
above.
If a2m  −1 (mod n), we declare n a probable prime, and stop.
Why? Just above, we know that an−1  1 (mod n), and we will not find a square
root of 1, other than ±1.
Otherwise we continue in this manner until either (a) we stop the test, or (b) we have
computed (a2m)s−1, and stopped if (a2m)s−1  a(n− 1)/2  ±1 (mod n).
If we haven’t stopped by this point, we declare n composite and stop.
Why? Exactly as with the Euler test.
Let us carry out the Rabin-Miller test on the absolute Euler pseudoprime 1729, using a
= 671.
1729 − 1 = 1728 = 26 * 27.
So s = 6, m = 27.
27
671
 1084
(mod 1729)
67127*2  10842  1065 (mod 1729)
67127*4  10652  1
(mod 1729)
The test declares n composite, and terminates. Next we test a much larger integer, n =
972133929835994161 (also a Carmichael number), using a = 2.
n − 1 = 24 * 60758370614749635.
260758370614749635
22 * 60758370614749635
24* 60758370614749635
28 * 60758370614749635







338214802923303483 (mod n)
3382148029233034832 (mod n)
332176174063516118 (mod n)
3321761740635161182 (mod n)
779803551049098051 (mod n)
7798035510490980512 (mod n)
1
(mod n)
The test declares n composite, and terminates.
Next we test an integer that is composite, but not a Carmichael number,
2857191047211793, using a = 1003.
n−1
= 24 * 178574440450737.
178574440450737
1003
 1135781085623492 (mod n)
10032 * 178574440450737
 11357810856234922 (mod n)
 84313648747407
(mod n)
(10032) 2* 178574440450737  843136487474072 (mod n)
 2321094267189023 (mod n)
2 3 * 178574440450737
(1003 )
 23210942671890232 (mod n)
 978857874792606 (mod n)
n=
The test declares n composite, and terminates.
Finally we test an integer that is in fact prime, n = 104513, using a = 3.
n−1
= 26 *1633.
1633
3
 88958
(mod n)
32*1633
 889582  10430
(mod n)
34*1633
 104302  91380
(mod n)
38*1633
 913802  29239
(mod n)
316*1633
 292392  2781
(mod n)
332*1633
 27812  −1
(mod n)
The test concludes that n is a probable prime. We might perform a few more tests
before we are convinced that n is in fact prime. Like the Fermat and Euler tests, the
Rabin-Miller test has pseudoprimes (choices of a, for which the test declares a
composite integer to be a probable prime). Rabin-Miller pseudoprimes are called strong
pseudoprimes. There are fewer strong pseudoprimes than Fermat or Euler
pseudoprimes. More importantly, there are no Rabin-Miller absolute pseudoprimes (as
we had absolute Fermat and Euler absolute pseudoprimes).
For any odd composite integer n, there are at most (n)/4 integers a (1  a < n,
gcd(a,n) = 1) for which the Rabin-Miller test declares n prime. In practice, the number
of strong pseudoprimes is usually far, far less than (n)/4, if n is large. There are a
number of other primality tests, but the Rabin-Miller test is the one most commonly
used.
Appendix A
Fermat's Little Theorem
p
If p is a prime number and a, a natural number, then a  a (mod p). Furthermore, if p / a
d
(p does not divide a), then there exists some smallest exponent d such that a -1  0 (mod p)
p-1
and d divides p - 1. Hence, a -1  0 (mod p)
The theorem is sometimes also simply known as Fermat's theorem. It is sometimes called
Fermat's primality test and is a necessary but not sufficient test for primality. Although it was
presumably proved (but suppressed) by Fermat, the first proof was published by Euler in 1749.
p
The theorem is easily proved using mathematical induction on a. Suppose p | a – a (i.e., p
p
p
divides a – a). Then examine (a + 1) – (a + 1). From the binomial theorem,
Rewriting,
But p divides the right side, so it also divides the left side. Combining with the induction
hypothesis gives that p divides the sum
as assumed, so the hypothesis is true for any a. Wilson's theorem follows as a corollary of
Fermat's little theorem. Fermat's little theorem shows that, if p is prime, there does not exist a
p-1
base a < p with (a, p) = 1 such that a - 1 possesses a nonzero residue modulo p. If such base
a exists, p is therefore guaranteed to be composite. However, the lack of a nonzero residue in
Fermat's little theorem does not guarantee that p is prime. The property of unambiguously
certifying composite numbers while passing some primes make Fermat's little theorem a
compositeness test which is sometimes called the Fermat compositeness test. A number
satisfying Fermat's little theorem for some nontrivial base and which is not known to be
composite is called a probable prime.
Appendix B
Prime Number Theorem
The prime number theorem gives an asymptotic form for the prime counting function (n),
which counts the number of primes less than some integer n. Legendre (1808) suggested that
for large n, (n) ~ n / (ln n + B), with B = -1.08366 (where B is sometimes called Legendre's
constant). In 1792, when only 15 years old, Gauss proposed that (n) ~ n / (ln n). Gauss later
refined his estimate to (n) ~ Li (n), where
is the logarithmic integral. Gauss did not publish this result, which he first mentioned in an 1849
letter to Encke. It was subsequently posthumously published in 1863. Note that Li (n) has the
asymptotic expansion about of
and taking the first three terms has been shown to be a better estimate than n / ln n alone. A
plot of (n) (lower curve) and Li (n) is shown below for
.
For small n, it had been checked and always found that (n) < Li (n). As a result, many
prominent mathematicians, including no less than both Gauss and Riemann, conjectured that
the inequality was strict. To everyone's surprise, this conjecture was refuted when Littlewood
(1914) proved that the inequality reverses infinitely often for sufficiently large n. Skewes then
showed that the first crossing of (n) - Li (n) = 0. occurs before
, a number now known
as the Skewes number. The upper bound for the crossing has subsequently been reduced to
371
500
10 . Lehman (1966) proved that at least 10 reversals occur for numbers with 1166 or 1167
decimal digits. Chebyshev put limits on the ratio:
Appendix C
;; Random Prime Generator using Probabilistic Algorithm
;; @author Marcio Machado Pereira, RA 780681
;; @version 1.0 2010-05-28 - initial version
;; == Auxiliary Functions ==
; modular take a modulus and an ordinary arithmetic procedure and
; produce a modular arithmetic procedure. For example,
;((modular 8 +) 7 5) should compute (7 + 5) (mod 8) = 4
(define modular
(lambda (modulus op)
(lambda (a1 a2)
(modulo (op a1 a2) modulus))))
; exptmod computes ab (mod n) using repeated squaring
(define (exptmod p)
(let ((mod* (modular p *)))
(define (square x)
(mod* x x))
(define (em base exponent)
(cond ((= exponent 0) 1)
((even? exponent)
(square (em base (/ exponent 2))))
(else (mod* base (em base (- exponent 1))))))
em))
; random-k-digit-number takes an integer k > 0 and returns
; a large random k-digit number
(define random-k-digit-number
(lambda (n)
(if (= n 1)
(random 10)
(+ (* 10 (random-k-digit-number (- n 1))) (random 10)))))
; count-digits takes an integer n > 0 and returns the number
; of digits in its decimal representation
(define count-digits
(lambda (n)
(if (= n 0)
0
(+ 1 (count-digits (quotient n 10))))))
; big-random takes an integer n > 0 and
; returns a random number from 0 to n-1
(define big-random
(lambda (n)
(let ((x (random-k-digit-number (count-digits n))))
(if (< x n)
x
(big-random n)))))
; prime? uses Test Fermat's Little Theorem using exptmod and a few
; suitable choices of a and p to test whether its parameter p is prime
(define prime-test-iterations 50)
(define prime?
(lambda (p)
(define (prime-iter? count)
(let ((x (big-random p)))
(if (= x ((exptmod p) x p))
(if (> count prime-test-iterations)
#t
(prime-iter? (+ count 1)))
#f)))
(prime-iter? 1)))
; This main procedure random-k-digits-prime returns:
; ("the number of iterations used to find p" .
; "a random prime number p with about k digits")
(define random-k-digits-prime
(lambda (k)
(define (random-iter? count)
(let ((p (random-k-digit-number k)))
(if (prime? p)
(cons count p)
(random-iter? (+ count 1)))))
(random-iter? 1)))
Petite Chez Scheme Version 8.0
Copyright (c) 1985-2010 Cadence Research Systems
Linked with Pthreads-Win32 under GNU LGPL
http://sources.redhat.com/pthreads-win32/
Copyright (c) 1998 John E. Bossom
Copyright (c) 1999,2002 Pthreads-win32 contributors
> (time (random-k-digits-prime 100))
1 collection
125 ms elapsed cpu time, including 0 ms collecting
114 ms elapsed real time, including 0 ms collecting
5834416 bytes allocated, including 4199832 bytes reclaimed
(8 .
693706675169999047869879937208851012555538819804611750095219107060249312416477958338
4731049526303199)
> (time (random-k-digits-prime 200))
15 collections
1623 ms elapsed cpu time, including 0 ms collecting
1616 ms elapsed real time, including 4 ms collecting
64516528 bytes allocated, including 63161000 bytes reclaimed
(115 .
825047751352049155711330049182804699834045587415622501995222416321739352459445412662
931220719379782903376935043593669388569905458833569011641072666479347318803872584899
00340816117238194197444169708009)
> (time (random-k-digits-prime 300))
162 collections
21091 ms elapsed cpu time, including 0 ms collecting
21107 ms elapsed real time, including 23 ms collecting
682504128 bytes allocated, including 684540272 bytes reclaimed
(713 .
824820995205606179062663311942047176408717470512615702848011929044803108271218659226
847863860379785785653660982513414893091846449513089905301943034935313026562396878341
032800124552693723938885635557889987137962484789305219901186292920373955756235258494
540192895911511179346363048248266003237323191473)
>(time (random-k-digits-prime 500))
189 collections
34945 ms elapsed cpu time, including 47 ms collecting
35032 ms elapsed real time, including 37 ms collecting
800422456 bytes allocated, including 799779872 bytes reclaimed
(268 .
631679548073156529212560018232815593468445668009289787128760641283659249715669354331
124252291812719612057922990615346537279137927083193245556312298399986116510963440647
581826562371022773438134711069235869815094710317049475609381586198860987545074067905
915850722495484679005463924991350055349199811379162291919211871908561867430857079009
527383631070276122984739199113766836552721663002234348130586244754095722090641323808
99535661086934181300315049446238718635990438955190748845264554039333353946038373)
References
Arnault, F. "Rabin-Miller Primality Test: Composite Numbers Which Pass It." Math. Comput. No.
64, 355-361, 1995.
Baillie, R. and Wagstaff, S. W. Jr. "Lucas Pseudoprimes." Math. Comput. 35, 1391-1417, 1980.
Beauchemin, P.; Brassard, G.; Crépeau, C.; Goutier, C.; and Pomerance, C. "The Generation of
Random Numbers that are Probably Prime." J. Crypt. 1, 53-64, 1988.
Brillhart, J.; Lehmer, D. H.; Selfridge, J.; Wagstaff, S. S. Jr.; and Tuckerman, B. “Factorizations
of b-n+/-1, b=2, 3, 5, 6, 7, 10, 11, 12 Up to High Powers”, rev. ed. Providence, RI: Amer. Math.
Soc., pp. lviii-lxv, 1988.
Bruckman, P. S. "Lucas Pseudoprimes are Odd." Fib. Quart. 32, 155-157, 1994.
Cohen, H. and Lenstra, A. K. "Primality Testing and Jacobi Sums." Math. Comput. 42, 297-330,
1984.
Crandall, R. and Pomerance, C. “Prime Numbers”. New York: Springer-Verlag, 2001.
Jaeschke, G. "On Strong Pseudoprimes to Several Bases." Math. Comput. No. 61, 915-926,
1993.
Miller, G. "Riemann's Hypothesis and Tests for Primality." J. Comp. Syst. Sci. 13, 300-317,
1976.
Monier, L. "Evaluation and Comparison of Two Efficient Probabilistic Primality Testing
Algorithms." Theor. Comput. Sci. No. 12, 97-108, 1980.
Rabin, M. O. "Probabilistic Algorithm for Testing Primality." J. Number Th. 12, 128-138, 1980.
Riesel, H. “Prime Numbers and Computer Methods for Factorization”, 2nd ed. Boston, MA:
Birkhäuser, 1994.
Ribenboim, P. "Lucas Pseudoprimes (lpsp (P . Q))." §2.X.B in The New Book of Prime Number
Records, 3rd ed. New York: Springer-Verlag, p. 129, 1996.
Wagon, S. "Primality Testing." Math. Intell. 8, No. 3, 58-61, 1986.
Wagon, S. “Mathematica in Action”. New York: W. H. Freeman, pp. 15-17, 1991.
Weisstein, Eric W. "Rabin-Miller Strong Pseudoprime Test." From MathWorld – A Wolfram Web
Resource.
Weisstein, E. W. "Primality Testing Is Easy." MathWorld Headline News, Aug. 7, 2002.
Williams, H. C. Eduard “Lucas and Primality Testing.” New York: Wiley, 1998.