Search Heuristics and Constructive Algorithms for Maximally Idempotent Integers

: Previous work established the set of square-free integers n with at least one factorization n = ¯ p ¯ q for which ¯ p and ¯ q are valid RSA keys, whether they are prime or composite. These integers are exactly those with the property λ ( n ) ∣ ( ¯ p − 1 )( ¯ q − 1 ) , where λ is the Carmichael totient function. We refer to these integers as idempotent , because ∀ a ∈ Z n , a k ( ¯ p − 1 )( ¯ q − 1 ) + 1 ≡ n a for any positive integer k . This set was initially known to contain only the semiprimes, and later expanded to include some of the Carmichael numbers. Recent work by the author gave the explicit formulation for the set, showing that the set includes numbers that are neither semiprimes nor Carmichael numbers. Numbers in this last category had not been previously analyzed in the literature. While only the semiprimes have useful cryptographic properties, idempotent integers are deserving of study in their own right as they lie at the border of hard problems in number theory and computer science. Some idempotent integers, the maximally idempotent integers, have the property that all their factorizations are idempotent. We discuss their structure here, heuristics to assist in ﬁnding them, and algorithms from graph theory that can be used to construct examples of arbitrary size.


Introduction
Take two integersp andq, let n =pq. Let φ ′ (n) = (p − 1)(q − 1). Find two integers d and e such that de ≡ Readers will recognize this as the RSA protocol [1], with the required conditions constraining encryption and decryption to "work": Encrypting and decrypting in this manner will recover the original message. Ref. [1] showed that choosingp andq as prime numbers will not only meet this required condition, but also provides the valuable property of making n empirically difficult to factor (whenp andq are sufficiently large). This in turn leads to the security of RSA.
While choosing n as a semiprime provides the necessary security properties, and reduces φ ′ to Euler's totient function, semiprimes are not the only integers for which the correctness of this protocol is preserved. Ten years after [1,2] implicitly showed, without explicitly stating, that the set of these integers also includes some of the Carmichael numbers. Whether there were other possible values of n =pq that were neither semiprimes nor Carmichael numbers remained unknown.
In [3], we introduced the notion of idempotent integers, the set of square-free integers n that can be factored into two positive integersp andq such that λ(n) | (p − 1)(q − 1), where λ is the Carmichael totient function. We refer to these integers as idempotent because ∀a ∈ Z n , a k(p−1)(q−1)+1 ≡ n a for any positive integer k. These integers are exactly those for whichp andq generate valid keys in the 2-prime RSA protocol, regardless of whether they are prime or composite [3].
While only the semiprimes have useful cryptographic properties [4], idempotent integers are deserving of study in their own right, as they lie at the border of hard problems in number theory and computer science. Some idempotent integers, the maximally idempotent integers, have the property that all their factorizations are idempotent. We discuss their structure here, heuristics to assist in finding them, and algorithms from graph theory that can be used to construct examples of arbitrary size. We discuss what is currently known, present new results since [3], and discuss open problems.

Definitions
Let n = p 1 p 2 . . . p m be a square-free integer, where p 1 < p 2 < . . . < p m are primes. Let a i = p i − 1 ∶ i = 1 . . . m. We will call a i the predecessor of p i and p i the successor of a i . It is a known property of the function λ that λ(n) = lcm(a 1 , a 2 , . . . , a m ), where lcm denotes the least common multiple. We will write λ instead of λ(n) when the meaning is clear. We p where A and B partition P. An idempotent factorization is a factorization n =pq for which λ(n) | (p − 1)(q − 1). We will refer to an integer n that has an idempotent factorization as idempotent when the meaning is clear.
Let p, q be prime, consider a semiprime n = pq. It is a known property of λ that λ(n) | φ(n). Since φ(n) = (p − 1)(q − 1), all semiprimes are trivially idempotent. We do not consider them further here.
Any square-free integer with m factors has m 1 = m factorizations of the form p = p i ,q = ∏ j≠i p j , m 2 factorizations of the formp = p i p j ,q = ∏ k≠i,j p k , and so forth. Each factorization corresponds to a single equation in n,p andq that represents a possible idempotent factorization. We refer to these as single-factor equations/factorizations, double-factor, etc. We call idempotent single-factor factorizations semi-composite factorizations of n, becausep is prime whileq is composite. All other factorizations are fully composite. The first eight square-free n with three or more factors and fully composite idempotent factorizations are shown in Table 1 [3]. The smallest integer with two fully composite idempotent factorizations is 2730, when factored into 10*273 and 21*130. The complete list of all n < 2 27 with fully composite idempotent factorizations is available at [5].

Maximally Idempotent Integers
An integer is maximally idempotent if all its factorizations are idempotent. These integers have the property that all their factorizations n =pq produce correctly functioning RSA keys.
The first 16 maximally idempotent n with 3 and 4 prime factors are shown in Table 2, along with the two 5-factor cases <2 30 [3]. Carmichael numbers are underlined. The smallest and smallest known maximally idempotent integers with m factors for 3 ≤ m ≤ 9 are shown below in Table 3:

Some Structural Properties of Maximally Idempotent Integers
A number of quantities affect whether or not an integer is maximally idempotent: The smallest prime p 1 , the largest prime p m , the number of factors m, the GCD of each distinct set of factorizations, and the least common multiple of the a i .
We begin with a universal property of maximally idempotent integers: Theorem 1. All maximally idempotent integers with at least three factors are odd.
Proof. First, we consider the case m = 3. There are three equations that must be satisfied for n to be maximally idempotent: Plugging it into the above, we obtain: Applying the first equation to the second and third, we have: For distinct a i with a 2 < a 3 , λ = lcm(a 1 , a 2 , a 3 ) = lcm(1, a 2 , a 3 ) ≥ a 3 , so the above is impossible. Now, let n = p 1 p 2 . . . p m be a maximally idempotent integer with m > 3. There are m single-factor equations that n satisfies: Assume p 1 = 2 and substitute. We have Multiplying out the second equation and substituting the first, we have Now, consider the double factor equations resulting from moving p 1 = 2 from the right side of a single-factor equation for i > 1. Since n is maximally idempotent, it satisfies these equations as well. We have: By setting all these equations equal to each other mod λ and working through the algebra, we find the mutual equivalences from the single and double factor equations imply For λ as defined previously with distinct a i , this is impossible.
The above is an example of a restriction on p 1 as a result of increasing m (since for m = 2, the result does not hold). A similar result can be obtained showing that m = 4 → p 1 > 3, omitted here due to space limitations. We offer the following: Conjecture 1. If p i is the smallest prime factor of an m-factor maximally idempotent integer, and p j is the smallest prime factor of an m + 1-factor maximally idempotent integer, then p i ≤ p j . This is consistent with all empirical results so far. Below Table 4 are the smallest p 1 , for which maximally idempotent integers are known for m = 3, . . . , 9. It is unknown if maximally idempotent integers exist for (m = 7, p 1 < 11), (m = 8, p 1 < 29) or (m = 9, p 1 < 61). We propose these and the conjecture above as open problems, waiting for proofs of nonexistence or counterexamples.

A Structure Theorem for Maximally Idempotent Integers
Let n = p 1 p 2 . . . p m be an m-factor maximally idempotent integer, . . a m ) (note we are deliberately omitting a 1 ). Let p 1 = N. Consider the first two single-factor equations, where the first term is (p i − 1), under modulo a 2 . (The equation with a left factor of p 2 − 1 is trivially true mod a 2 , so we consider the equations with left factors of (p 1 − 1) and (p 3 − 1)). We obtain . By the requirements of maximal idempotency, we have Multiplying this equation by N and then subtracting the previous result, we get Applying this to the other mod a 2 equations, and then to the other moduli a 3 , a 4 , a 5 , we obtain and that a set of distinct positive a i is a solution ⟺ ∀a i , λ/a i | C, i > 1. So any maximally idempotent integer has the property ∀a Since a m ≤ Ca 2 , there are a finite number of m-factor maximally idempotent integers with a given p 1 and p 2 .
The results above are expressed in terms of p 1 . We noted previously that for the resulting system of modular equations, a m ≤ (p 1 2 − 1)a 2 . In fact, we may fix any factor, not just p 1 . This gives a Ratio Theorem for Maximally Idempotent Integers: Theorem 2. Let n be a maximally idempotent integer with factors p 1 < p 2 ⋅ ⋅ ⋅ < p m . For any p j > p i , The Ratio Theorem means that all but one of the prime factors of maximally idempotent integers are constrained to be within a certain range of one another; there can be at most one outlier. For example, the primes [7,11,127 The Ratio Theorem also has computational implications. It means fixing any two prime factors permits the enumeration of all maximally impotent integers containing those factors.
We have not yet considered the equations corresponding to the factorization (N − 1) (p 2 . . . p m − 1), for moduli > a 1 : These also form a set of modular equations similar to the one considered above. This time the constant C is (N − 1)(p 2 . . . p m − 1), which here implies that for any solution a 2 , . . . , a m we must have λ/gcd(a 2 , . . . , a m ) | (N − 1)(p 2 . . . p m − 1).
We sum up the results of this section as a Structure Theorem for Maximally Idempotent Integers: Theorem 3. Let n = p 1 p 2 . . . p m be a maximally idempotent integer with m factors, m ≥ 4, p i prime. Let a i = p i − 1, λ(a 2 , . . . , a m ) = λ = lcm(a 2 , . . . , a m ). n must satisfy the following conditions: ( We emphasize that these are necessary conditions, but not sufficient. [5,7,13, 19] satisfies both criteria, but does not form a maximally idempotent integer.
Condition 1 imposes a crude lower limit on p 1 as a function of m, in that (p 1 2 − 1) must contain at least m − 1 divisors. These limits for small m are shown in the Table 5 below:  In some cases, tighter bounds have already been established by the work previously shown. Cases where gaps remain are offered as open problems.

The Role of Factorization Equation GCD's
Let D i (n) denote the gcd of all factorization equations of n with i factors on the left side. For example, with n = p 1 p 2 p 3 p 4 = 43*79*223*331, we have We will omit the argument n if the meaning is clear. It is easily seen that n is maximally idempotent if λ | D i for all i for which i-factor factorizations exist.
Empirically, D 1 and D 2 are almost always equal, with the probability rapidly approaching 1 as m increases, D i becomes smaller. Below Table 6 shows data for m = 4.12, based on a million random permutations of length m from the first 100,000 primes. The fact that D 1 = D 2 so often has implications for improving the efficiency of search algorithms for maximally idempotent integers.

Finding Maximally Idempotent Integers
The equations of idempotency have some redundancy. In particular, letp andq be a factorization of n. Because p k ≡ λ 1, any p k may be moved fromq top without affecting Thus, in addition to the explicit equivalence equation of a given factorization, there are implied equivalences mod a k . If equations are chosen such that a given equivalence is implied for all a k , then it holds for λ even if it is not explicitly given (recall that ∀i, a i | λ).
This has implications when testing for maximal idempotency. For example, only the single factor equations need to be tested for m = 3, 4, as they imply the three double factor ones. For m = 5, only 12 of the possible 15 equations need be tested, and so forth.
However, based on the results regarding D 1 and D 2 above, it is empirically more efficient to check the single factor equations first. If any one of them fail, n is not maximally idempotent. If they all pass, then the double factorizations can be checked, and so forth. It is also more efficient to compute D i one equation at a time. If the current value D i ever drops below λ, further testing is not required since λ can never divide it.
One way to find maximally idempotent integers is to simply iterate through a range of integers n, factor them, calculate λ for the ones that are square free, and then see if the equations for maximal idempotency are satisfied. As this requires factoring, this is computationally intensive. A more productive approach is to start with the primes in a given range and test products for m = 3, 4 . . . etc. In particular, we may fix p 1 and p m and then identify all the maximally idempotent integers with factors inclusively between those two values.
Based on the results previously discussed, we may expect maximally idempotent integers to be found only when λ is at a local minimum (a m or a small multiple thereof) and the D i 's are at a local maximum. This confirmed in the figures below, which show log 2 D 1 and log 2 λ as a function of n. Logarithmic values are used due to the differences in magnitude between λ and D 1 . Figure 1 shows this plot for p 1 = 7, m = 3, p m ≤ 97. The orange data set is the log of λ, the gray is the log of D 1 . Each data point is for a value of n = p 1 p 2 p 3 , sorted in increasing order. The values of n where λ ≤ D 1 are marked with vertical lines. The value of that ratio is read from the right vertical axis. Red lines correspond to those cases where D 1 /λ is an integer, and indicate all the maximally idempotent integers in this range. Figure 2 shows these lines alone, along with their data values. The left value in each label with a reciprocal integer ratio (indicated with a red line) is a maximally idempotent integer. Figures 3 and 4 show similar plots with m = 4. Increasing the number of factors to 4 increases the number of data points, but it also increases λ as it starts to pull away from D i . (Recall that logarithmic scales are used, making the absolute difference exponentially larger than that depicted in the figure). The overall effect is to decrease the number of integers with λ ≤ D 1 . We note, however, that the proportion of those integers which are maximally idempotent increases. We conjecture this ratio approaches 1 with increasing m.     Figure 5 increases p 1 from 7 to 11. Increasing p 1 increases the average D 1 slightly, but significantly increases λ. It also reduces the number of candidates that can satisfy the Ratio Theorem. The overall effect is a net decrease in the number of integers with λ ≤ D 1 , and therefore the number of maximally idempotent integers. No maximally idempotent integers exist in this range with p 1 ≥ 17.  Figure 6 increases p m from 97 to 199. Doubling p m increases the number of candidates in the combinatorially expected manner, which increases the probability of an maximally idempotent integer being found. On the other hand, their asymptotic density decreases. We conjecture the asymptotic density of maximally idempotent integers for a given p 1 approaches zero. It is unknown if for a given p 1 for which an maximally idempotent integer exists, there is a maximum p m beyond which no more maximally idempotent integers can be found, or if there are infinitely many. Figure 7 further increases m to 6, showing the smallest 6-factor maximally idempotent integer in the given range (indicated with a red circle). This is the entry for m = 6 in Table 2.
The black rectangle appears to indicate a second example, but that is an artifact of scale, due to both the large number of points on the x axis (approximately 750 million) and the logarithmic scales employed on the y axis. While in both of the indicated areas there are D 1 values at the maximum of 600, with log 2 (D i ) ≈ 9.2, the minimum λ in the rectangle is 760, log 2 (λ) ≈ 9.6. The apparent match in the rectangle is in fact a local minimum λ between two local maximum D 1 . Figure 8 makes this clearer.   Thus, there is only one maximally idempotent integer with m = 6 in the indicated range, the smallest one with 6-factors. There are none with m = 7, 8. We conjecture there are no other maximally idempotent integers with p i ≥ 11, p m ≤ 199 for m ≥ 6.

Improving the Odds with Divisor Sequences
More than half of the entries in Table 2 are primes in arithmetic progression, where each factor is of the form a 1 k + 1. As m increases, more and more maximally idempotent integers take this form. This is because sequences of increasing a i where all a i divide a m iff λ = a m , the minimum possible value. This is more likely to occur with primes in arithmetic progression. This not a sufficient condition, due to the influence of the D i , nor is it necessary, since λ may still be a local minimum if all the a i divide a small multiple of a m . Nonetheless, as a heuristic it is useful for finding maximally idempotent integers faster than brute force or searching arbitrary combinations of m primes.
To find an maximally idempotent integer with m factors, we begin with a desired p 1 and a number N that contains at least m divisors d i , with (N − 1) * (p 1 − 1) + 1 prime. Next, we identify those d i such that d i * (p 1 − 1) + 1 is prime, discarding the rest. The resulting subsets will have (a 1 , . . . , a max ) such that λ will be at its smallest possible value a max . These subsets can then be tested for maximal idempotency. We refer to these subsets as divisor sequences, since all of them are divisors of a max .
For example, suppose we are searching for 6-factor maximally idempotent integers with p 1 = 11. 300 has 8 divisors, but 301 is not prime. Additionally, 40 has 8 divisors and 401 is prime, but only four of them have the property that 10d i + 1 is prime. Additionally, 60 has 12 divisors, of which 7 have 10d i + 1 prime, giving the divisor sequence {10, 30, 40, 60, 100, 150, 600}. (Note that all a i divide the largest value of 600). There are seven possible subsets of size 6 to test, one of which produces the maximally idempotent integer 11*31*41*101*151*601. Note that this not the smallest 6-factor example, which has the corresponding divisor set {10, 30, 40, 60, 100, 150}. These are not all divisors of 150, so this is a case of an maximally idempotent integer where λ is not equal to a m .
The complete subset of all seven primes above is also maximally imdepotent; it is the smallest seven-factor example. All maximally idempotent integers known to the author with seven or more factors have either been found using this technique, or explicitly constructed using a technique from graph theory. We discuss that next.

Constructing Large Maximally Idempotent Integers Using k-Cliques in Congruence Graphs
Random primes in modern cryptography are hundreds of bits long, found efficiently using probabilistic algorithms [6]. Do similarly large maximally idempotent integers exist, and if so, can they be found? The answer is yes, and probabalistic techniques are not required. They can be constructed explicitly, of any size desired.
It is not difficult to show that every equation for idempotency is a linear sum of products of a i , where each term is of length ≥2. For maximal idempotency, all such sums must be ≡ λ 0. Any set of a i for which all distinct products a i a j ≡ λ 0 will have this property, and will therefore correspond to a maximally idempotent integer. This is not a necessary condition, but it is sufficient.
Such sets of a i can be constructed in the following way. (1) Choose λ 0 a highly composite number. (2) Make nodes in a graph corresponding to all divisors a i of λ 0 such that the successor of a i is prime. (3) Connect all node pairs a i , a j such that a i a j ≡ λ 0 0. We call the resulting graph a congruence graph.
For any congruence graph, λ of any subset of its nodes is their lcm, which in turn must divide λ 0 . For all pairs of nodes in a k-clique, a i a j is congruent to 0 mod λ 0 . Therefore all a i a j are congruent to zero mod the lcm of any subset of divisors of λ 0 , including the members of the clique themselves.
Thus, every a i a j ≡ λ 0, where λ is the lcm of every node in the clique. This means that every k-clique corresponds to a maximally idempotent integer with k factors. Similarly, any divisor of a maximally idempotent integer constructed in this way is also maximally idempotent. Thus, a k-clique in a congruence graph contains k m i maximally idempotent integers with 3 ≤ m i ≤ k factors, for a total of 2 k − k 2 − k 1 (we ignore the primes and semiprimes).
This graph contains six 3-cliques and one 4-clique. These correspond to seven maximally idempotent integers with λ = 36. Five of the six 3-cliques correspond to integers in Table 2. The 4-clique is the smallest maximally idempotent integer with four factors, also shown in Table 2.
In general, to construct a maximally idempotent integer with a large number of factors, choose λ 0 highly composite. The divisor graph will then have a large number of nodes, high connectivity and a greater likelihood of k-cliques for larger k.  Table 7 shows the values of λ 0 when the first cliques of size k appear using this method, along with some information about the graph and the size of the largest maximally idempotent integer it contains. Figure 10 shows the congruence graph for λ 0 = 44,100 = 2 2 3 2 5 2 7 2 , corresponding to k = 10 in Table 7.

Discussion, Conclusions, and Directions for Future Work
We define the class of idempotent integers as those n which can be factored intopq such that λ(n) | (p − 1)(q − 1). This set includes the primes, semiprimes, and Carmichael numbers, but is not unique to them. Maximally idempotent integers are those for which all factorizations are idempotent. This last category presents interesting open problems. For maximally idempotent integers as defined above, for a given p 1 and a given m is the number of maximally idempotent integers infinite? Of those n for which λ ≤ D i , does the proportion for which λ/D i = 1 approach 1 as n increases? What lower bounds on p 1 can be proven as a function of m?
Rather than regard idempotency as a discrete property of factorizations and integers, idempotency could be viewed on a continuum. Factorizations of n that are not fully idempotent may be viewed as partially idempotent, depending on the (e, d) pair chosen according to the RSA protocol [7]. In this case, the k in the definition of idempotency is replaced by ed. Some integers may then be regarded as minimally idempotent, meaning that no (e, d) pairs for any factorization are idempotent. The a i values for minimally idempotent integers are solutions to a system of nonlinear modular equations, a known NP-complete problem. The statistical properties of partial idempotency and heuristics for finding minimal idempotency are a work in progress.