Some Connections Between Primitive Roots and Quadratic Non-Residues Modulo a Prime

Transcription

1 Some Connections Between Primitive Roots nd Qudrtic Non-Residues Modulo Prime Sorin Iftene Dertment of Comuter Science Al. I. Cuz University Isi, Romni Emil: Abstrct In this er we resent some interesting connections between rimitive roots nd qudrtic non-residues modulo rime. Using these correltions, we roose some olynomil deterministic lgorithms for generting rimitive roots for rimes with secil forms (for exmle, for sfe rimes. Index Terms rimitive roots, Legendre-Jcobi symbol, qudrtic non-residues, squre roots. I. INTRODUCTION Generting rimitive roots modulo rime is n fundmentl roblem in number theory, with mjor lictions in crytogrhy. Diffie-Hellmn key estblishment scheme [1], ElGml ublic-key crytosystem [], Schnorr identifiction scheme [3] nd Digitl Signture Scheme [4] re only few exmles which rely on generting rimitive roots or elements of certin order. Finding qudrtic non-residues modulo rime is nother interesting roblem in number theory. Tonelli- Shnks lgorithm ( [5], [6] nd Ciol-Lehmer lgorithm ( [7], [8] for comuting squre roots modulo rime nd Goldwsser-Micli robbilistic encrytion scheme [9] re the most imortnt lictions tht rely on generting qudrtic non-residues. In this er we discuss comrtively these two issues. After resenting the existing rndomized lgorithm for generting rimitive roots, we roose some olynomil deterministic lgorithms for generting rimitive roots for rimes with secil forms. The er is structured s follows. Section is dedicted to some mthemticl reliminries on rimitive roots nd qudrtic non-residues. Section 3 resents some connections between rimitive roots nd qudrtic non-residues modulo rime. Generting rimitive roots is discussed in Section 4. The lst section concludes the er. II. MATHEMATICAL BACKGROUND In this section we resent some bsic fcts on number theory, focusing on rimitive roots nd qudrtic non-residues. For more detils, the reder is referred to [10], [11], [1], [13]. Comuttionl sects cn be found in [14]. A. The order of n element. Primitive roots Definition 1: Let m nd Z m. The order of modulo m, denoted by ord m (, is defined s ord m ( min({l N l 1 mod m} The most imortnt roerties of the order of n element re summrized in Proosition 1. Proosition 1: Let m, Z m, nd k, l some integers. 1 If k 1 mod m then ord m ( k. As rticulr cse, we obtin ord m ( φ(m, where φ denotes Euler s totient function; The reltion k l mod m is equivlent with k l mod ord m (; 3 The next reltion holds true ord m ( k mod m ord m( (ord m (, k. Definition : Let m nd α Z m. The element α is clled rimitive root modulo m if ord m (α φ(m. Remrk 1: In cse tht α is rimitive root modulo m, every element β from the set Z m cn be uniquely exressed s β α i mod m, for i Z φ(m. The vlue i will be referred to s the discrete logrithm (modulo m to the bse α of β nd we will write i log α β. While n exression of form β α i mod m cn be efficiently comuted given α, i, m (see, for exmle, [14], the roblem of finding the discrete logrithm modulo m to the bse α of β, given α, β, m is intrctble. The most imortnt roerties of the rimitive roots re resented in Proosition. Proosition : Let m, α Z m. Then 1 Z m hs rimitive roots if nd only if m {, 4, k, k }, where is n odd rime nd k 1 (Guss Theorem; If Z m hs rimitive roots, then there re exctly φ(φ(m rimitives roots modulo m; 3 If Z m hs rimitive roots, α is rimitive root modulo m if nd only if the next reltion holds: α φ(m r 1 mod m, for ny rime divisor r of φ(m. Proosition (3 does not lwys llow to efficiently generte rimitive roots modulo m becuse comuting φ(m nd fctoring φ(m re intrctble for lrge integers m. Elements of order q my be generted vi rimitive roots. More exctly, if q φ(m, α is rimitive root modulo m,

2 nd β α φ(m q Proosition 1(3, ord m (α φ(m q mod m φ(m (φ(m, φ(m q q. mod m, then ord m (β q. Indeed, by the B. Qudrtic (non-residues. Squre roots ord m(α (ord m(α, φ(m q Definition 3: Let be rime nd Z. We sy tht is qudrtic residue modulo if there exists b Z with the roerty b mod. Otherwise, is qudrtic nonresidue modulo. For the simlicity of the nottion, from this oint forwrd we will omit the modulr reduction modulo but the reder must be wre tht ll comuttions re erformed modulo if not exlicitly stted otherwise. If b then b will be referred to s squre root of. We hve to remrk tht if is qudrtic residue modulo, odd rime, then hs exctly two squre roots - if b is squre root of, then b is the other one. In rticulr, 1 hs the squre roots 1 nd ( 1 (in this cse, ( 1 will be regrded s being 1 or, equivlently, 1 ( 1 ( 1. Definition ( 4: The Legendre symbol of modulo, denoted s, is defined to be equl to ±1 deending on whether is qudrtic residue modulo. More exctly, ( { 1, if is qudrtic residue mod ; 1, otherwise. The Jcobi symbol is generliztion of the Legendre symbol to rbitrry moduli nd is defined s (the sme nottion is used: ( ( e1 ( e ( ek, n 1 k for ny odd ositive integer n, Z n, where e1 1 e e k k is the rime fctoriztion of n. The most imortnt roerties of the Legendre-Jcobi symbol re summrized in Proosition 3 (for more detils, see [1], [13]. Proosition 3: 1 (Euler s criterion For ny rime nd Z, the following reltion holds true: ( 1 1 ( ; ( 1 1, tht imlies tht ( 1 is qudrtic non-residue modulo if nd only if 3 mod 4; ( 3 ( 1 1 8, tht imlies tht is qudrtic nonresidue modulo if nd only if ±3 mod 8; 4 ( ( b n ( b n n ; 5 ( ( n b ( n if nd only if b mod n; in rticulr, ( n mod n n ; 6 (lw of qudrtic recirocity ( 1 ( 1 n 1, ( n n for ny corime odd ositive integers, n. These roerties led to the following lgorithm for comuting the Legendre-Jcobi symbol ( [1, ge 113]: LegendreJcobi (,n inut: ( n, n odd ositive integer, Z n ; outut: n ; t : 1; while 0 do while mod 0 do : div ; if n ±3 mod 8 then t : t; sw(,n; if ( 3 mod 4 nd n 3 mod 4 then t : t; : mod n; return( t Fig. 1: An lgorithm for comuting the Legendre-Jcobi symbol The comlexity of this lgorithm is O((log ((log (n. Euler s criterion lso rovides method of comuting the Legendre symbol of modulo using n exonentition modulo, whose comlexity is O((log ( 3 (see, for exmle, [14]. There re fster methods for evluting the Legendre- Jcobi symbol - see, for exmle, [15], in which re resented lgorithms of comlexity O( (log( log (log ( for comuting the Legendre-Jcobi symbol modulo. Thus, is imortnt to remrk tht the evlution of the Legendre-Jcobi symbol is much fster thn n exonentition. It is known (see, for exmle, [16][Remrk.151] tht for n odd rime, hlf of the elements in Z re qudrtic non-residues modulo. Still, no deterministic olynomil lgorithm is known for finding qudrtic non-residue modulo rime. A rndomized lgorithm for finding qudrtic non-residue modulo rime is to simly generte rndom elements in Z until one is found hving its Legendre- Jcobi symbol equl with 1. The exected number itertions before qudrtic non-residue modulo is found is two. An lgorithm for generting qudrtic residue is resented next. GenerteQudrticNonResidue( inut:, n odd rime; outut: qudrtic non-residue modulo ; if 3 mod 4 then return( 1 if 5 mod 8 then return( reet generte rndomly Z until LegendreJcobi(, 1 return( Fig. : An lgorithm for generting qudrtic non-residue modulo rime

3 Comuting squre roots modulo rime is nother fundmentl roblem in number theory, with mjor lictions s rimlity testing, fctoriztion or ellitic oint comression. According to Bch nd Shllit [1, Notes on Chter 7, ge 194] nd Lemmermeyer [13, Exercise 1.16, Pge 9], Lgrnge ws the first one who hs stted n exlicit formul for comuting squre roots in the cse 3 mod 4 in According to the sme sources ( [1, Exercise 1, ge 188] nd [13, Exercise 1.17, Pge 9], the cse 5 mod 8 hs been solved by Legendre in Atkin [17] hs lso found simle solution for the cse 5 mod 8 in 199. For the rest of the cses, Tonelli-Shnks lgorithm ( [5], [6] nd Ciol- Lehmer lgorithm ( [7], [8] cn be used, these lgorithms relying on qudrtic non-residue modulo. An lgorithm for finding the set of squre roots modulo rime, for given element Z, is sketched next. SqureRoots(, inut:, n odd rime, Z ; outut: the set of the squre roots modulo of ; if LegendreJcobi(, 1 then return( if 1 then return({1, 1} if 3 mod 4 then return({ +1 4, +1 4 } if 5 mod 8 then u : ( 5 8 ; v : u ; b u(v 1; return({b, b} end cll Tonelli-Shnks or Ciol-Lehmer Fig. 3: An lgorithm for finding the set of squre roots This lgorithm cn be recursively clled for obtining the set of the solutions of the eqution x s 1, for given s. III. PRIMITIVE ROOTS VERSUS QUADRATIC NON-RESIDUES (MODULO A PRIME In this section we discuss some interesting connections between these two toics. Some of these correltions will be exloited in the next section in order to develo deterministic lgorithms for generting rimitive roots modulo secil rimes. Proosition 4: Let be n odd rime nd α rimitive root modulo. Then α is qudrtic non-residue modulo. Proof: Using Proosition (3, we obtin tht α 1 r 1 for ny rime divisor r of ( 1. For r (( 1 is even we hve tht α 1 1 (this is equivlent with α 1 1 becuse (α 1 1 by Fermt s Theorem nd 1 hs the only squre roots 1 nd 1 modulo rime which, in dition with Euler s criterion (Pro 3(1 leds to the fct tht α is qudrtic non-residue modulo. Proosition 5: Let be n odd rime nd α qudrtic non-residue modulo. Then α is rimitive root modulo if nd only if α 1 r 1 for ny odd rime divisor r of ( 1. Proof: Directly from Proosition (3 nd Euler s criterion (Pro 3(1. Directly from Proosition 4 nd Proosition 5 we obtin: Proosition 6: Let be n odd rime such tht there is s 1 so tht 1 s nd α Z. Then α is rimitive root modulo if nd only if α is qudrtic non-residue modulo. Proosition 7: Let be n odd rime nd, α Z. The following reltions hold true: 1 If is qudrtic non-residue modulo nd k Z then k is qudrtic non-residue modulo if nd only if k is odd; If α is rimitive root modulo nd k Z then α k is rimitive root modulo if nd only if (k, 1 1. Proof: ( ( k 1 It follows directly from the roerty k ( k mod ; From Proosition 1(3 we obtin tht ord (α k ord (α (if α is rimitive root then its (ord (α,k 1 (k, 1 order is φ( 1. Thus, α k is rimitive root if nd only if ord (α k 1, or, equivlently, (k, 1 1. Proosition 8: Let be n odd rime. The following reltions hold true: 1 If nd b re qudrtic non-residues modulo then b is qudrtic residue modulo ; If is qudrtic non-residue modulo nd b is qudrtic residue modulo then b is qudrtic nonresidue modulo ; 3 If nd b re qudrtic residues modulo then b is qudrtic residue modulo ; 4 If α nd β re rimitive roots modulo then αβ is non-rimitive root modulo. Proof: (1, (, (3 follow directly from Proosition 3(4; (4 From Proosition 4 we obtin tht α nd β re qudrtic non-residues modulo which leds to the fct tht αβ is qudrtic residue modulo nd, thus, αβ is not rimitive root modulo (lso by Proosition 4; Remrk : 1 It is interesting tht result similr to the roerty resented in Proosition 8( does not hold for rimitive roots. More exctly, if α is rimitive root modulo nd β is non-rimitive root modulo then αβ my be or not rimitive root modulo. Indeed, in this cse β cn be exressed s α k, with (k, 1 1 (from Proosition 7(. We obtin tht αβ α k+1. We my hve (k+1, 1 1 (for exmle, in cse 7, k 4 nd in this cse αβ is rimitive root modulo or we my hve (k + 1, 1 1 (for exmle, in cse

4 7, k which imlies tht αβ is non-rimitive root modulo. Also, result similr to the roerty resented in Proosition 8(3 does not hold for rimitive roots. More exctly, if α is non-rimitive root modulo nd β is non-rimitive root modulo then αβ my be or not rimitive root modulo. Indeed, in this cse, if we consider γ, rimitive root modulo then α cn be exressed s γ k1, with (k 1, 1 1 nd β cn be exressed s γ k, with (k, 1 1 (from Proosition 7(. We obtin tht αβ γ k1+k. We my hve (k 1 + k, 1 1 (for exmle, in cse 7, k 1, k 3 nd in this cse αβ is rimitive root modulo or we my hve (k 1 + k, 1 1 (for exmle, in cse 7, k 1, k 4 which imlies tht αβ is non-rimitive root modulo. IV. GENERATING PRIMITIVE ROOTS MODULO A PRIME Proosition (3 from Section II gives method of generting rimitive root modulo n odd rime, knowing the rime decomosition of φ( 1, s resented in Figure 4 (which resents the clssic rndomized lgorithm for generting rimitive root modulo n odd rime. PrimitiveRoot1( inut:, n odd rime; dditionl inut: the rime fctoriztion of ( 1; generte rndomly α Z ; ok : 1; for ech rime r, r ( 1 do if α 1 r 1 then ok : 0 if ok 1 then return(α Fig. 4: The clssic lgorithm for generting rimitive root modulo n odd rime, knowing the rime fctoriztion of ( 1 The robbility of success, denoted by success, of the clssic rndomized lgorithm (which is of Ls Vegs tye resented bove is given by the rtio between the number of rimitive roots nd the totl number of elements in Z, i.e., success φ(φ( φ( (by Proosition (. Using Proosition 5 from Section III we obtin the following imroved lgorithm: PrimitiveRoot( inut:, n odd rime; dditionl inut: the rime fctoriztion of ( 1; α :GenerteQudrticNonResidue(; ok : 1; for ech odd rime r, r ( 1 do if α 1 r 1 then ok : 0 if ok 1 then return(α Fig. 5: An imroved lgorithm for generting rimitive root modulo n odd rime, knowing the rime fctoriztion of ( 1 In fct, the min difference between PrimitiveRoot1 nd PrimitiveRoot is tht the exonentition α 1 (which is the oertion with the gretest exonent mong those involved in Algorithm PrimitiveRoot1 is relced with the evlution of the Legendre-Jcobi symbol (in order to verify tht α is qudrtic non-residue modulo. The imrovement is given by the fct tht the evlution of Legendre- Jcobi symbol is much fster thn n exonentition (see, e.g., [1, ge 113] or [15]. Moreover, for rimes with certin forms, qudrtic non-residue modulo cn be generted without effectively evluting the Legendre-Jcobi symbol (see Algorithm GenerteQudrticNonResidue from Section II nd this cn led to further imrovements. The sme seedu hs been discovered by Cohen in [10]. The biggest imct of this relcement is obtined in the cse of the rimes of secil form s q + 1, where s 1 nd q is n odd rime (in this cse Algorithm PrimitiveRoot1 imlies only two exonentitions, with exonents 1 nd 1 q nd in Algorithm PrimitiveRoot the oertion with exonent 1 is relced with the evlution of the Legendre-Jcobi symbol. For such rimes, n element α Z is rimitive root if nd only if (α qudrtic non-residue modulo α s 1. We obtin the following lgorithm: PrimitiveRoot3( inut: rime, s q + 1, s 1, q odd rime; α :GenerteQudrticNonResidue(; if α s 1 then return(α Fig. 6: An lgorithm for generting rimitive root modulo rime, s q + 1, s 1, q odd rime For rime, s q + 1, s 1, q is n odd rime, we

5 obtin tht success φ(φ( φ( (s s 1 (q 1 s q q 1 q 1 Evidently, this lgorithm my be iterted until rimitive root is finlly oututted. The exected number itertions before rimitive root is found is two. A. Finding Deterministic Algorithms for Generting Primitive Roots Modulo Secil Primes In this rt of the er we try to find efficient deterministic lgorithms for generting rimitive roots modulo, s q + 1, s 1, q odd rime, for certin smll vlues of s (s {1, }. In these cses, qudrtic non-residues re known: ( 1 for s 1 (in this cse, 3 mod 4 nd for s (in this cse, 5 mod 8. The min ide is to find, with single rndom genertion, n element tht is simultneously qudrtic non-residue nd non-solution for the eqution x s 1. We my use the following tricks (see Proosition 8: 1 If α is qudrtic residue then, by multilying it with qudrtic non-residue, we will obtin qudrtic nonresidue; If α is qudrtic non-residue then, by multilying it with qudrtic residue, we will obtin qudrtic nonresidue; 3 If α is solution of the eqution x s 1 then, by multilying it with non-solution of the sme eqution, we will obtin non-solution of the sme eqution; 4 If α is non-solution of the eqution x s 1 then, by multilying it with solution of the sme eqution, we will obtin non-solution of the sme eqution. Thus, in cse tht qudrtic non-residue β is somehow rovided, we need to consider two cses: 1 If β s 1 - then α β is rimitive root modulo ; If β s 1 - then, by multilying β with non-solution of the eqution x s 1 which is simultneously qudrtic residue modulo, we will obtin rimitive root modulo - more exctly, ny trnsformtion of tye α βγ will work s long (γ s 1 (we hve to remrk tht there exist qudrtic residues tht re non-solutions for the eqution x s 1 becuse this eqution hs t most s solutions in Z wheres there re 1 s 1 q qudrtic residues modulo. The simlest otion is to choose γ (when 4 s 1, which trnsltes in multilying β with 4 modulo. We obtin the following lgorithm: PrimitiveRoot4( inut: rime, s q + 1, s 1, q odd rime; dditionl inut: β, qudrtic non-residue mod ; if β s 1 then return(β γ : ; while (γ s 1 do γ : γ + 1; α : βγ ; return(α Fig. 7: An lgorithm for generting rimitive root modulo rime, s q + 1, s 1, q odd rime, in cse tht qudrtic non-residue β is rovided A different strtegy (but less licble nd, moreover, less efficient is to strt with α s non-solution of the eqution x s 1. There re two roches for chieving this: generting rndom α nd testing if α s 1; comuting ll the solutions of the eqution x s 1 (using recursively the lgorithm SqureRoots resented in Section II nd generting α outside this set; this roch is suitble only for very smll s (s 1 or s. Then, if α is qudrtic non-residue modulo then α is rimitive root modulo ; else, by multilying α with β we will obtin rimitive root modulo roviding tht β is solution of the eqution x s 1. We will roose next some efficient deterministic lgorithms for generting rimitive roots in the cses s 1, s. 1 The Cse s 1: This is exctly the cse of sfe rimes, i.e, rimes of form q + 1, q odd rime. These rimes stisfy 3 mod 4 nd thus ( 1 is qudrtic non-residue modulo. The element ( 1 is lso solution for the eqution x 1 1. Becuse 1 nd ( 1 re the only solutions of this eqution, it is sufficient to find qudrtic non-residue in the set {, 3,..., }. The second strtegy resented bove leds to the following deterministic lgorithm: PrimitiveRootSfePrime1( inut: rime, q + 1, q odd rime; generte rndomly α {, 3,..., }; if LegendreJcobi(α, 1 then return(α else return( α Fig. 8: An initil deterministic lgorithm for generting rimitive root modulo rime, q + 1, q odd rime Indeed, if α is qudrtic residue modulo then ( α is qudrtic non-residue modulo (becuse ( 1 is qudrtic non-residue modulo. Moreover, if α {, 3,..., } then lso ( α {, 3,..., }. The comlexity of the

6 bove lgorithm is O((log ( if we use the Algorithm LegendreJcobi resented in Section II but if we use fster methods for evluting the Legendre-Jcobi symbol (see, for exmle, [15], we cn obtin n lgorithm of comlexity O( (log( log. (log ( The lgorithm PrimitiveRoot4, for rimes of form q+1, q odd rime (in this cse, we my choose β 1, reduces to the following very simle lgorithm: PrimitiveRootSfePrime( inut: rime, q + 1, q odd rime; generte rndomly γ {, 3,..., }; α : γ ; return(α Fig. 9: An lterntive deterministic lgorithm for generting rimitive root modulo rime, q + 1, q odd rime Indeed, in this cse, β 1 1 nd (γ 1 1 γ ±1. Algorithm PrimitiveRootSfePrime involves only one modulr squring modulo nd, therefore, its comlexity is O((log ( (see, for exmle, [14]. Exmle 1 illustrtes the liction of the lgorithms PrimitiveRootSfePrime1 nd PrimitiveRootSfePrime. Exmle 1: (with rtificilly smll rmeters Let 11 (q 5. In this cse is rimitive root modulo 11 becuse nd The rest of the rimitive roots cn be obtined s 3, 7, 9 (see Proosition 7( which leds to the elements 8, 7, nd, resectively, 6. PrimitiveRootSfePrime1 - suose tht α 5 is ( generted in the first ste of the lgorithm; becuse (5 4 mod 11 then ( 5 6 is returned, which is indeed rimitive root modulo 11; PrimitiveRootSfePrime - by considering ll the vlues γ {, 3, 4, 5} we my obtin ll the rimitive roots modulo 11; these re: ( 7, ( 3, ( 4 6, nd, finlly, ( 5 8. The Cse s : This is the cse of rimes q +1, q odd rime, tht stisfy 5 mod 8. Thus, is qudrtic non-residue modulo. If is lso non-solution for the eqution x 1 then is rimitive root modulo. The reltion 1 mod is equivlent with 15. Becuse is rime nd 13 (becuse q 3 then we obtin tht cnnot be solution for the eqution x 1 mod nd, thus, is rimitive root modulo. If we re interested in finding nother rimitive roots, we my rise t ny odd ower tht is not divisible by q. V. CONCLUSIONS AND FUTURE WORK In this er we hve nlysed some interesting connections between rimitive roots nd qudrtic non-residues modulo rime. Using some correltions between the mentioned toics, we hve roosed some efficient deterministic lgorithms for generting rimitive roots modulo, s q + 1, s 1, q odd rime, for certin smll vlues of s (s {1, }. Becuse in these cses, qudrtic non-residues re known, some simle lgorithms cn be develoed, s resented in Section IV-A. It is interesting to investigte more comlex cses, s s q r + 1 or even s q r1 1 qr + 1. We will consider these issues in our future work. Acknowledgements We thnk D. J. Bernstein for ointing us the fct tht relcing the exonention α 1 with the evlution of the Legendre-Jcobi symbol hs been lredy resented by Cohen in [10]. REFERENCES [1] W. Diffie nd M. E. Hellmn, New directions in crytogrhy, IEEE Trnsctions on Informtion Theory, vol. IT-, no. 6, , [] T. ElGml, A ublic key crytosystem nd signture scheme bsed on discrete logrithms, IEEE Trnsctions on Informtion Theory, vol. 31, , 1985, ( reliminry version ered in Advnces in Crytology Cryto 84, G. R. Blkley nd D. Chum, eds., Lecture Notes in Comuter Science 196 (1985, [3] C.-P. Schnorr, Efficient identifiction nd signtures for smrt crds, in Advnces in Crytology - CRYPTO 89, ser. Lecture Notes in Comuter Science, G. Brssrd, Ed., vol Sringer, 1989, [4] FIPS 186-3, Digitl Signture Stndrd, Federl Informtion Processing Stndrds Publiction 186, June 009, htt://csrc.nist.gov/ublictions/fis/fis186-3/fis df. [5] A. Tonelli, Bemerkung über die Auflösung qudrtischer Congruenzen, Göttinger Nchrichten, , [6] D. Shnks, Five number-theoretic lgorithms, in Proceedings of the second Mnitob conference on numericl mthemtics, ser. Congressus Numerntium, R. Thoms nd H. Willims, Eds., vol. 7. Utilits Mthemtic, 1973, [7] M. Cioll, Un metodo er l risolutione dell congruenz di secondo grdo, RendicontodellAccdemi Scienze Fisiche e Mtemtiche, Noli, vol. 9, , [8] D. Lehmer, Comuter technology lied to the theory of numbers, in Studies in number theory, ser. MAA Studies in Mthemtics, W. Leveque, Ed., vol. 6. Prentice-Hll, 1969, [9] S. Goldwsser nd S. Micli, Probbilistic encrytion, Journl of Comuter nd System Sciences, vol. 8, no., , [10] H. Cohen, A Course in Comuttionl Algebric Number Theory, 4th ed., ser. Grdute Texts in Mthemtics. Sringer-Verlg, 000. [11] F. L. Ţile, Algebric Foundtions of Comuter Science. Polirom, 006, (in Romnin. [1] E. Bch nd J. Shllit, Algorithmic Number Theory, Volume I: Efficient Algorithms. MIT Press, [13] F. Lemmermeyer, Recirocity Lws. From Euler to Eisenstein. Sringer- Verlg, 000. [14] F. L. Ţile, S. Iftene, C. Hriţcu, I. Goric, R. Gordân, nd E. Erbicenu, MNT: A multi-recision number theory ckge. Number-theoretic lgorithms (I, Al.I.Cuz University of Işi, Fculty of Comuter Science, Tech. Re. TR 03-0, 003, (vilble t htt:// tr/tr.l.cgi. [15] S. Eikenberry nd J. Sorenson, Efficient lgorithms for comuting the Jcobi symbol, Journl of Symbolic Comuttion, vol. 6, no. 4, , [16] A. J. Menezes, P. C. vn Oorschot, nd S. A. Vnstone, Hndbook of Alied Crytogrhy, ser. Discrete Mthemtics nd Its Alictions. CRC Press, vol. 6. [17] A. Atkin, Probbilistic rimlity testing (summry by F. Morin, INRIA, Tech. Re. 1779, 199, URL:htt://lgo.inri.fr/seminrs/sem91-9/tkin.df.