2. Witnesses for Tuples
Let be as described. Let denote the order of a in . Let us call the fraction of elements of , the order of which does not divide the witness ratio of . For these elements ; they testify to the composite nature of s. Tuples with a witness ratio of zero are said to be witness-free. For RSA encryption with those values, the composite nature of s will never be detected.
Example
Consider
. We have
. The elements of
are:
The set of orders of
is:
Suppose we choose as our exponent pair. We have . The element will be encrypted correctly, because and . The element , by contrast, is a witness because and . As a check, , but .
For this combination of , the values of a = (1, 9, 11, 19, 29, 31, 39, 41, 51, 59, 61, 69) all have orders in that divide (ed − 1) = 594, which means they will encrypt and decrypt correctly. The remaining values of a = (13, 17, 23, 27, 33, 37, 43, 47, 53, 57, 67) do not. These values serve as witnesses to the composite nature of s. Since both sets are of identical cardinality, the witness ratio for is 0.5, so we might say the impostor masquerading as a prime has a 50% chance of escaping detection. This assumes only a single element is encrypted. For all that are not witness-free, the chances of an impostor s escaping detection decrease with the length of the message. Similar calculations will show that for , the witness ratio is 2/3, and for , the witness ratio is 0.99.
3. Witness-Free Tuples
Let denote the Carmichael function, the maximum order of any element in . By Lagrange’s theorem, and the fact that for integers a and b, all divisors of , we see that those tuples with the property are exactly those that are witness-free.
For example, suppose we keep from above, but now choose . We have . Recall . All elements of now divide , so is witness-free. For example, , etc.
Equivalently, is witness-free when with also posses the property . For a given with , such can always be found by computing L = and finding . Such a procedure will by construction give and , yielding an that is witness-free.
For example, consider the semiprimes
. We have:
Choosing
, we have
as a witness-free tuple. For example,
Since all the primes chosen were >256, if our RSA message consisted of ASCII text encrypted at the byte level (inefficient, but suitable for illustrative purposes), using the above values of , two-prime RSA encryption and decryption would work correctly. This is true even though neither s nor r are prime and even though e and d were chosen using the pseudo-totient.
5. Values of s That Yield Witness-Free Tuples for All Odd Primes r
Certain values of s can be constructed such that they can be paired with any odd prime r to produce correct RSA key pairs. The properties of s required by Theorem 1 will hold for all primes , i.e., . This is the definition of a Carmichael number. Thus, any pair where C is a Carmichael number and r is a prime will produce functioning RSA keys. This is a known result.
However, if we relax the requirements on s just slightly, so that only pairings with odd primes are of interest, then non-Carmichael numbers can also meet the requirements. Let s be a composite number such that Theorem 1 holds for all odd primes . We refer to all such s as strong impostors. We use the modifier strong to indicate that is witness-free for all odd primes , as opposed to one or a few specific that are witness-free.
Theorem 2. s is a strong impostor .
Proof. →: Assume s is a strong impostor. Then, by Theorem 1, for all odd primes . Since , we have . This holds for all odd primes r, including three, so . Since the Carmichael function is even for n > 2, the result follows.
←: Assume . Let r be an odd prime. We have for some positive integer k. This quantity must divide , and the result follows. ☐
7. Constructing Strong Impostors
Theorem 4 and similar results above provide insights into the structure of strong impostors that can be used to construct them. For example, it can be shown that for any even strong impostor, all its odd prime factors are congruent to three mod four. We offer the following additional results for odd primes , some without proof, but with examples to aid understanding. Proofs can be obtained by combining the specific criteria below with the definition of a strong impostor.
- (A)
- (B)
- (C)
- (D)
We have already shown Condition A to be the definition of a two-factor strong impostor; Condition B is the general definition. These are the simplest ways to find strong impostors: sift through the required number of primes until those meeting the required condition are found.
Condition C applies to prime three-tuples that are separated by multiples of . Thus, to generate a strong impostor from a prime p, if does not yield a prime (i.e., Condition A fails), keep incrementing b until a prime of the form is found. Then, do the same starting at . Once and are found, apply the indicated lcm criterion. If that fails, continue searching with increasing b and c. For example, produce , all of which are prime. and , so is a strong impostor.
Condition D describes the possible construction of a strong impostor from a Carmichael number of a specific form.
is a Carmichael number for prime
[
4]. Such a number can be multiplied by a prime of the form
to produce a non-Carmichael strong impostor if an
m meeting the indicated criteria can be found. For example,
are all prime, and therefore,
294,409 is Carmichael number.
is the smallest m that meets the criteria of Condition D, and
is prime. Therefore,
294,409 ∗ 433 = 127,479,097 is a strong impostor.
The author has tested all Carmichael numbers of the indicated form with . Approximately 85% yield strong impostors using this technique.
8. Conclusions and Open Problems
There are 2946 strong impostors below
; 2797 are odd, and 149 are even. In this range, true primes are about 2000-times more common than strong impostors. Of the strong impostors, 630 are semiprimes. The number of strong impostors in this range with one through seven factors are
, respectively. Four and eight are the only strong impostors with one prime factor. The strong impostors with seven factors are 370,851,481 = 7 ∗ 11 ∗ 13 ∗ 17 ∗ 19 ∗ 31 ∗ 37 and 2,719,940,041 = 7 ∗ 13 ∗ 17 ∗ 19 ∗ 37 ∗ 41 ∗ 61. We see by construction that the density of strong impostors is greater than that of the Carmichael numbers, but less than that of the primes. The largest strong impostor known to the author was found using the criteria of Condition D, with k = 1,044,381 and m = 2,827,177,323,983,136. This gives:
Since there is an infinite number of Carmichael numbers [
5], there is an infinite number of strong impostors. The author conjectures there is an infinite number of non-Carmichael strong impostors. This is related to well-known conjectures on prime constellations [
6]. For example, proving there is an infinite number of two-factor strong impostors would prove there is an infinite number of
prime pairs.
For a given p, we might ask if a strong impostor s exists containing p as its smallest factor. We refer to such an s as an extension of p. While extensions have been found by the author for the first 256 primes, it is an open question whether every prime has an extension. Proving this would of course prove there is an infinite number of non-Carmichael strong impostors.
Similar open questions exist for non-Carmichael strong impostors of various forms, such as prime three-tuples in arithmetic progression of the form where . Examples of strong impostors of this form for are currently unknown.
It is an open question whether an infinite number of Carmichael numbers of the form
[
7] can be extended to non-Carmichael strong impostors using the technique of Condition D.
We have seen the that largest prime factor of a strong impostor must be less than twice the product of the other prime factors. This means the computations required to determine if criteria for Conditions B and C are met for a given input will terminate if the largest prime in the tuple is specified, or if all primes except the largest are specified. For all other cases, termination is not guaranteed. This relates to the open questions above.
Modern implementations of RSA use instead of in the selection of . A similar substitution may be made in the examples here, with appropriate algebraic modifications as needed.
Finally, efficient algorithms for finding the smallest extension for a given prime p would be interesting to explore, as well as a deeper understanding of the relationships between each of a strong impostor beyond that presented here.