Agrawal–Kayal–Saxena primality test

Concepts

The AKS primality test is based upon the following theorem: Given an integer ${\displaystyle n\ge 2}$ and integer ${\displaystyle a}$ coprime to ${\displaystyle n}$, ${\displaystyle n}$ is prime if and only if the polynomial congruence relation

holds within the polynomial ring ${\displaystyle (\mathbb{Z}/n\mathbb{Z})[X]}$. Note that ${\displaystyle X}$ denotes the indeterminate which generates this polynomial ring.

This theorem is a generalization to polynomials of Fermat's little theorem. In one direction it can easily be proved using the binomial theorem together with the following property of the binomial coefficient:

${\displaystyle (\genfrac{}{}{0ex}{}{n}{k})\equiv 0(\mathrm{mod}n)}$ for all ${\displaystyle 0<k<n}$ if ${\displaystyle n}$ is prime.

While the relation (1) constitutes a primality test in itself, verifying it takes exponential time: the brute force approach would require the expansion of the ${\displaystyle (X+a{)}^n}$ polynomial and a reduction ${\displaystyle \mathrm{mod}n}$ of the resulting ${\displaystyle n+1}$ coefficients.

The congruence is an equality in the polynomial ring ${\displaystyle (\mathbb{Z}/n\mathbb{Z})[X]}$. Evaluating in a quotient ring of ${\displaystyle (\mathbb{Z}/n\mathbb{Z})[X]}$ creates an upper bound for the degree of the polynomials involved. The AKS evaluates the equality in ${\displaystyle (\mathbb{Z}/n\mathbb{Z})[X]/(X^r-1)}$, making the computational complexity dependent on the size of ${\displaystyle r}$. For clarity, this is expressed as the congruence

which is the same as:

for some polynomials ${\displaystyle f}$ and ${\displaystyle g}$.

Note that all primes satisfy this relation (choosing ${\displaystyle g=0}$ in (3) gives (1), which holds for ${\displaystyle n}$ prime). This congruence can be checked in polynomial time when ${\displaystyle r}$ is polynomial to the digits of ${\displaystyle n}$. The AKS algorithm evaluates this congruence for a large set of ${\displaystyle a}$ values, whose size is polynomial to the digits of ${\displaystyle n}$. The proof of validity of the AKS algorithm shows that one can find an ${\displaystyle r}$ and a set of ${\displaystyle a}$ values with the above properties such that if the congruences hold then ${\displaystyle n}$ is a power of a prime.

History and running time

In the first version of the above-cited paper, the authors proved the asymptotic time complexity of the algorithm to be ${\displaystyle \tilde{O}(\log (n{)}^{12})}$ (using Õ from big O notation)—the twelfth power of the number of digits in n times a factor that is polylogarithmic in the number of digits. However, this upper bound was rather loose; a widely-held conjecture about the distribution of the Sophie Germain primes would, if true, immediately cut the worst case down to ${\displaystyle \tilde{O}(\log (n{)}^6)}$.

In the months following the discovery, new variants appeared (Lenstra 2002, Pomerance 2002, Berrizbeitia 2002, Cheng 2003, Bernstein 2003a/b, Lenstra and Pomerance 2003), which improved the speed of computation greatly. Owing to the existence of the many variants, Crandall and Papadopoulos refer to the "AKS-class" of algorithms in their scientific paper "On the implementation of AKS-class primality tests", published in March 2003.

In response to some of these variants, and to other feedback, the paper "PRIMES is in P" was updated with a new formulation of the AKS algorithm and of its proof of correctness. (This version was eventually published in Annals of Mathematics.) While the basic idea remained the same, r was chosen in a new manner, and the proof of correctness was more coherently organized. The new proof relied almost exclusively on the behavior of cyclotomic polynomials over finite fields. The new upper bound on time complexity was ${\displaystyle \tilde{O}(\log (n{)}^{10.5})}$, later reduced using additional results from sieve theory to ${\displaystyle \tilde{O}(\log (n{)}^{7.5})}$.

In 2005, Pomerance and Lenstra demonstrated a variant of AKS that runs in ${\displaystyle \tilde{O}(\log (n{)}^6)}$ operations, leading to another updated version of the paper. Agrawal, Kayal and Saxena proposed a variant which would run in ${\displaystyle \tilde{O}(\log (n{)}^3)}$ if Agrawal's conjecture were true; however, a heuristic argument by Pomerance and Lenstra suggested that it is probably false.

The algorithm

The algorithm is as follows:

Input: integer ${\displaystyle n>1}$.

1. Check if ${\displaystyle n}$ is a perfect power: if ${\displaystyle n=a^b}$ for integers ${\displaystyle a>1}$ and ${\displaystyle b>1}$, then output composite.
2. Find the smallest ${\displaystyle r}$ such that ${\displaystyle {\mathrm{ord}}_r(n)>({\log }_{2}n{)}^2}$. If ${\displaystyle r}$ and ${\displaystyle n}$ are not coprime, then output composite.
3. For all ${\displaystyle 2\le a\le min(r,n-1)}$, check that ${\displaystyle a}$ does not divide ${\displaystyle n}$: If ${\displaystyle a\mid n}$ for some ${\displaystyle 2\le a\le min(r,n-1)}$, then output composite.
4. If ${\displaystyle n\le r}$, then output prime.
5. For ${\displaystyle a=1}$ to ${\displaystyle \lfloor \sqrt{\phi (r)}{\log }_2(n)\rfloor }$ do

   if ${\displaystyle (X+a{)}^n\not\equiv X^n+a(\mathrm{mod}{X}^r-1,n)}$, then output composite;

6. Output prime.

Here ${\displaystyle {\mathrm{ord}}_r(n)}$ is the multiplicative order of ${\displaystyle n}$ modulo ${\displaystyle r}$, ${\displaystyle {\log }_2}$ is the binary logarithm, and ${\displaystyle \phi (r)}$ is Euler's totient function of ${\displaystyle r}$.

Step 3 is shown in the paper as checking ${\displaystyle 1<gcd(a,n)<n}$ for all ${\displaystyle a\le r}$. It can be seen this is equivalent to trial division up to ${\displaystyle r}$ which can be done very efficiently without using gcd. Similarly the comparison in step 4 can be replaced by having the trial division return prime once it has checked all values up to and including ${\displaystyle \lfloor \sqrt{n}\rfloor .}$

Once beyond very small inputs, step 5 dominates the time taken. The essential reduction in complexity (from exponential to polynomial) is achieved by performing all calculations in the finite ring

${\displaystyle R=(\mathbb{Z}/n\mathbb{Z})[X]/(X^r-1)}$

consisting of ${\displaystyle n^r}$ elements. This ring contains only the ${\displaystyle r}$ monomials ${\displaystyle \{X^0,X^1,\dots ,X^{r-1}\}}$, and the coefficients are in ${\displaystyle \mathbb{Z}/n\mathbb{Z}}$ which has ${\displaystyle n}$ elements, all of them codable within ${\displaystyle {\log }_2(n)}$ bits.

Most later improvements made to the algorithm have concentrated on reducing the size of ${\displaystyle r}$, which makes the core operation in step 5 faster, and in reducing the size of ${\displaystyle s}$ the number of loops performed in step 5. Typically these changes do not change the computational complexity, but can lead to many orders of magnitude less time taken; for example, Bernstein's final version has a theoretical speedup by a factor of over 2 million.

Proof of validity outline

For the algorithm to be correct, all steps that identify ${\displaystyle n}$ must be correct. Steps 1, 3, and 4 are trivially correct, since they are based on direct tests of the divisibility of ${\displaystyle n}$. Step 5 is also correct: since (2) is true for any choice of ${\displaystyle a}$ coprime to ${\displaystyle n}$ and ${\displaystyle r}$ if ${\displaystyle n}$ is prime, an inequality means that ${\displaystyle n}$ must be composite.

The difficult part of the proof is showing that step 6 is true. Its proof of correctness is based on the upper and lower bounds of a multiplicative group in ${\displaystyle {\mathbb{Z}}_n[x]}$ constructed from the ${\displaystyle (X+a)}$ binomials that are tested in step 5. Step 4 guarantees that these binomials are ${\displaystyle \lfloor \sqrt{\phi (r)}{\log }_2(n)\rfloor }$ distinct elements of ${\displaystyle {\mathbb{Z}}_n[x]}$. For the particular choice of ${\displaystyle r}$, the bounds produce a contradiction unless ${\displaystyle n}$ is prime or a power of a prime. Together with the test of step 1, this implies that ${\displaystyle n}$ is always prime at step 6.

Example 1: n = 31 is prime

<b id="mwARE">Input</b>: integer <i id="mwARI">n</i> = 31 > 1. <u id="mwARM">(* Step 1 *)</u> <b id="mwARQ">If</b> (<i id="mwARU">n</i> = <i id="mwARY">a</i><sup id="mwARc"><i id="mwARg">b</i></sup> for integers <i id="mwARk">a</i> > 1 and <i id="mwARo">b</i> > 1), <b id="mwARs">output</b> <i id="mwARw">composite</i>. <b id="mwAR0">For</b> ( b = 2; b <= log<sub id="mwAR4">2</sub>(n); b++) { a = n<sup id="mwAR8">1/b</sup>; <b id="mwASA">If</b> (a is integer), <b id="mwASE">Return</b>[Composite] } a = n<sup id="mwASI">1/2</sup>...n<sup id="mwASM">1/4</sup> = {5.568, 3.141, 2.360} <u id="mwASQ">(* Step 2 *)</u> Find the smallest <i id="mwASU">r</i> such that <i id="mwASY">O</i><sub id="mwASc"><i id="mwASg">r</i></sub>(<i id="mwASk">n</i>) > (log<sub id="mwASo"><i id="mwASs">2</i></sub> <i id="mwASw">n</i>)<sup id="mwAS0">2</sup>. maxk = ⌊(log<sub id="mwAS4"><i id="mwAS8">2</i></sub> n)<sup id="mwATA">2</sup>⌋; maxr = Max[3, ⌈(Log<sub id="mwATE"><i id="mwATI">2</i></sub> n)<sup id="mwATM">5</sup>⌉]; <u id="mwATQ">(* maxr really isn't needed *)</u> nextR = True; <b id="mwATU">For</b> (r = 2; nextR && r < maxr; r++) { nextR = False; <b id="mwATY">For</b> (k = 1; (!nextR) && k <span typeof="mw:Entity" id="mwATc">≤</span> maxk; k++) { nextR = (Mod[n<sup id="mwATg">k</sup>, r] == 1 || Mod[n<sup id="mwATk">k</sup>, r]==0) } } r--; <u id="mwATo">(*the loop over increments by one*)</u> r = 29 <u id="mwATs">(* Step 3 *)</u> <b id="mwATw">If</b> (1 < <a rel="mw:WikiLink" href="./Greatest_common_divisor" title="Greatest common divisor" id="mwAT0">gcd</a>(<i id="mwAT4">a</i>,<i id="mwAT8">n</i>) < <i id="mwAUA">n</i> for some <i id="mwAUE">a</i> ≤ <i id="mwAUI">r</i>), <b id="mwAUM">output</b> <i id="mwAUQ">composite</i>. <b id="mwAUU">For</b> (a = r; a <span typeof="mw:Entity" id="mwAUY">></span> 1; a--) { <b id="mwAUc">If</b> ((gcd = GCD[a,n]) <span typeof="mw:Entity" id="mwAUg">></span> 1 && gcd < n), <b id="mwAUk">Return</b>[Composite] } gcd = {GCD(29,31)=1, GCD(28,31)=1, ..., GCD(2,31)=1} ≯ 1 <u id="mwAUo">(* Step 4 *)</u> <b id="mwAUs">If</b> (<i id="mwAUw">n</i> ≤ <i id="mwAU0">r</i>), <b id="mwAU4">output</b> <i id="mwAU8">prime</i>. <b id="mwAVA">If</b> (n <span typeof="mw:Entity" id="mwAVE">≤</span> r), <b id="mwAVI">Return</b>[Prime] <u id="mwAVM">(* this step may be omitted if n <span typeof="mw:Entity" id="mwAVQ">></span> 5690034 *)</u> 31 <span typeof="mw:Entity" id="mwAVU">></span> 29 <u id="mwAVY">(* Step 5 *)</u> <b id="mwAVc">For</b> <i id="mwAVg">a</i> = 1 <b id="mwAVk">to</b> <span class="mwe-math-element mwe-math-element-inline" typeof="mw:Extension/math" about="#mwt115" data-mw='{"name":"math","attrs":{},"body":{"extsrc":"\\left\\lfloor\\sqrt{\\varphi(r)}\\log_2(n)\\right\\rfloor"}}' id="mwAVo"><span class="mwe-math-mathml-a11y" style="display: none;" id="mwAVs"><math xmlns="http://www.w3.org/1998/Math/MathML" class="mathjax_ignore" alttext="{\displaystyle \left\lfloor {\sqrt {\varphi (r)}}\log _{2}(n)\right\rfloor }" id="mwAVw"> <semantics id="mwAV0"> <mrow class="MJX-TeXAtom-ORD" id="mwAV4"> <mstyle displaystyle="true" scriptlevel="0" id="mwAV8"> <mrow id="mwAWA"> <mo id="mwAWE">⌊</mo> <mrow id="mwAWI"> <mrow class="MJX-TeXAtom-ORD" id="mwAWM"> <msqrt id="mwAWQ"> <mi id="mwAWU">φ<!-- φ --></mi> <mo stretchy="false" id="mwAWY">(</mo> <mi id="mwAWc">r</mi> <mo stretchy="false" id="mwAWg">)</mo> </msqrt> </mrow> <msub id="mwAWk"> <mi id="mwAWo">log</mi> <mrow class="MJX-TeXAtom-ORD" id="mwAWs"> <mn id="mwAWw">2</mn> </mrow> </msub> <mo id="mwAW0">⁡<!-- ⁡ --></mo> <mo stretchy="false" id="mwAW4">(</mo> <mi id="mwAW8">n</mi> <mo stretchy="false" id="mwAXA">)</mo> </mrow> <mo id="mwAXE">⌋</mo> </mrow> </mstyle> </mrow> <annotation encoding="application/x-tex" id="mwAXI">{\displaystyle \left\lfloor {\sqrt {\varphi (r)}}\log _{2}(n)\right\rfloor }</annotation> </semantics> </math></span><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/66e8f8e1f842f93eeafb29da46bd297fd6accdbc" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -1.838ex; width:16.774ex; height:4.843ex;" alt="{\displaystyle \left\lfloor {\sqrt {\varphi (r)}}\log _{2}(n)\right\rfloor }" id="mwAXM"/></span> <b id="mwAXQ">do</b> <b id="mwAXU">If</b> ((<i id="mwAXY">X</i>+<i id="mwAXc">a</i>)<sup id="mwAXg"><i id="mwAXk">n</i></sup> ≠ <i id="mwAXo">X</i><sup id="mwAXs"><i id="mwAXw">n</i></sup> + <i id="mwAX0">a</i> (mod <i id="mwAX4">X</i><sup id="mwAX8"><i id="mwAYA">r</i></sup> − 1,<i id="mwAYE">n</i>)), <b id="mwAYI">output</b> <i id="mwAYM">composite</i>; φ[x_] := EulerPhi[x]; PolyModulo[f_] := PolynomialMod[<a rel="mw:WikiLink" href="./Polynomial_remainder" title="Polynomial remainder" class="mw-redirect" id="mwAYQ">PolynomialRemainder</a>[f, x<sup id="mwAYU">r</sup>-1, x], n]; max = Floor[Log[2, n]<span class="nowrap" id="mwAYY"><span typeof="mw:Entity" id="mwAYc">√</span><span style="border-top:1px solid; padding:0 0.1em;" id="mwAYg">φ[r]</span></span>]; <b id="mwAYk">For</b> (a = 1; a ≤ max; a++) { <b id="mwAYo">If</b> (PolyModulo[(x+a)<sup id="mwAYs">n</sup> - PolynomialRemainder[x<sup id="mwAYw">n</sup>+a, x<sup id="mwAY0">r</sup>-1, x]] ≠ 0) { <b id="mwAY4">Return</b>[Composite] { } (x+a)<sup id="mwAY8">31</sup> = a<sup id="mwAZA">31</sup> +31a<sup id="mwAZE">30</sup>x +465a<sup id="mwAZI">29</sup>x<sup id="mwAZM">2</sup> +4495a<sup id="mwAZQ">28</sup>x<sup id="mwAZU">3</sup> +31465a<sup id="mwAZY">27</sup>x<sup id="mwAZc">4</sup> +169911a<sup id="mwAZg">26</sup>x<sup id="mwAZk">5</sup> +736281a<sup id="mwAZo">25</sup>x<sup id="mwAZs">6</sup> +2629575a<sup id="mwAZw">24</sup>x<sup id="mwAZ0">7</sup> +7888725a<sup id="mwAZ4">23</sup>x<sup id="mwAZ8">8</sup> +20160075a<sup id="mwAaA">22</sup>x<sup id="mwAaE">9</sup> +44352165a<sup id="mwAaI">21</sup>x<sup id="mwAaM">10</sup> +84672315a<sup id="mwAaQ">20</sup>x<sup id="mwAaU">11</sup> +141120525a<sup id="mwAaY">19</sup>x<sup id="mwAac">12</sup> +206253075a<sup id="mwAag">18</sup>x<sup id="mwAak">13</sup> +265182525a<sup id="mwAao">17</sup>x<sup id="mwAas">14</sup> +300540195a<sup id="mwAaw">16</sup>x<sup id="mwAa0">15</sup> +300540195a<sup id="mwAa4">15</sup>x<sup id="mwAa8">16</sup> +265182525a<sup id="mwAbA">14</sup>x<sup id="mwAbE">17</sup> +206253075a<sup id="mwAbI">13</sup>x<sup id="mwAbM">18</sup> +141120525a<sup id="mwAbQ">12</sup>x<sup id="mwAbU">19</sup> +84672315a<sup id="mwAbY">11</sup>x<sup id="mwAbc">20</sup> +44352165a<sup id="mwAbg">10</sup>x<sup id="mwAbk">21</sup> +20160075a<sup id="mwAbo">9</sup>x<sup id="mwAbs">22</sup> +7888725a<sup id="mwAbw">8</sup>x<sup id="mwAb0">23</sup> +2629575a<sup id="mwAb4">7</sup>x<sup id="mwAb8">24</sup> +736281a<sup id="mwAcA">6</sup>x<sup id="mwAcE">25</sup> +169911a<sup id="mwAcI">5</sup>x<sup id="mwAcM">26</sup> +31465a<sup id="mwAcQ">4</sup>x<sup id="mwAcU">27</sup> +4495a<sup id="mwAcY">3</sup>x<sup id="mwAcc">28</sup> +465a<sup id="mwAcg">2</sup>x<sup id="mwAck">29</sup> +31ax<sup id="mwAco">30</sup> +x<sup id="mwAcs">31</sup> PolynomialRemainder [(x+a)<sup id="mwAcw">31</sup>, x<sup id="mwAc0">29</sup>-1] = 465a<sup id="mwAc4">2</sup> +a<sup id="mwAc8">31</sup> +(31a+31a<sup id="mwAdA">30</sup>)x +(1+465a<sup id="mwAdE">29</sup>)x<sup id="mwAdI">2</sup> +4495a<sup id="mwAdM">28</sup>x<sup id="mwAdQ">3</sup> +31465a<sup id="mwAdU">27</sup>x<sup id="mwAdY">4</sup> +169911a<sup id="mwAdc">26</sup>x<sup id="mwAdg">5</sup> +736281a<sup id="mwAdk">25</sup>x<sup id="mwAdo">6</sup> +2629575a<sup id="mwAds">24</sup>x<sup id="mwAdw">7</sup> +7888725a<sup id="mwAd0">23</sup>x<sup id="mwAd4">8</sup> +20160075a<sup id="mwAd8">22</sup>x<sup id="mwAeA">9</sup> +44352165a<sup id="mwAeE">21</sup>x<sup id="mwAeI">10</sup> +84672315a<sup id="mwAeM">20</sup>x<sup id="mwAeQ">11</sup> +141120525a<sup id="mwAeU">19</sup>x<sup id="mwAeY">12</sup> +206253075a<sup id="mwAec">18</sup>x<sup id="mwAeg">13</sup> +265182525a<sup id="mwAek">17</sup>x<sup id="mwAeo">14</sup> +300540195a<sup id="mwAes">16</sup>x<sup id="mwAew">15</sup> +300540195a<sup id="mwAe0">15</sup>x<sup id="mwAe4">16</sup> +265182525a<sup id="mwAe8">14</sup>x<sup id="mwAfA">17</sup> +206253075a<sup id="mwAfE">13</sup>x<sup id="mwAfI">18</sup> +141120525a<sup id="mwAfM">12</sup>x<sup id="mwAfQ">19</sup> +84672315a<sup id="mwAfU">11</sup>x<sup id="mwAfY">20</sup> +44352165a<sup id="mwAfc">10</sup>x<sup id="mwAfg">21</sup> +20160075a<sup id="mwAfk">9</sup>x<sup id="mwAfo">22</sup> +7888725a<sup id="mwAfs">8</sup>x<sup id="mwAfw">23</sup> +2629575a<sup id="mwAf0">7</sup>x<sup id="mwAf4">24</sup> +736281a<sup id="mwAf8">6</sup>x<sup id="mwAgA">25</sup> +169911a<sup id="mwAgE">5</sup>x<sup id="mwAgI">26</sup> +31465a<sup id="mwAgM">4</sup>x<sup id="mwAgQ">27</sup> +4495a<sup id="mwAgU">3</sup>x<sup id="mwAgY">28</sup> (<span id="math_A" class="reference nourlexpansion" style="font-weight:bold;">A</span>) PolynomialMod [PolynomialRemainder [(x+a)<sup id="mwAgc">31</sup>, x<sup id="mwAgg">29</sup>-1], 31] = a<sup id="mwAgk">31</sup>+x<sup id="mwAgo">2</sup> (<span id="math_B" class="reference nourlexpansion" style="font-weight:bold;">B</span>) PolynomialRemainder [x<sup id="mwAgs">31</sup>+a, x<sup id="mwAgw">29</sup>-1] = a+x<sup id="mwAg0">2</sup> (<b id="mwAg4"><a rel="mw:WikiLink" href="./Agrawal–Kayal–Saxena_primality_test#math_A" class="mw-selflink-fragment" id="mwAg8">A</a></b>) - (<b id="mwAhA"><a rel="mw:WikiLink" href="./Agrawal–Kayal–Saxena_primality_test#math_B" class="mw-selflink-fragment" id="mwAhE">B</a></b>) = a<sup id="mwAhI">31</sup>+x<sup id="mwAhM">2</sup> - (a+x<sup id="mwAhQ">2</sup>) = a<sup id="mwAhU">31</sup>-a <span class="mwe-math-element mwe-math-element-inline" typeof="mw:Extension/math" about="#mwt116" data-mw='{"name":"math","attrs":{},"body":{"extsrc":"\\max = \\left\\lfloor\\log_2 (31) \\sqrt{\\varphi(29)} \\right\\rfloor = 26"}}' id="mwAhY"><span class="mwe-math-mathml-a11y" style="display: none;" id="mwAhc"><math xmlns="http://www.w3.org/1998/Math/MathML" class="mathjax_ignore" alttext="{\displaystyle \max =\left\lfloor \log _{2}(31){\sqrt {\varphi (29)}}\right\rfloor =26}" id="mwAhg"> <semantics id="mwAhk"> <mrow class="MJX-TeXAtom-ORD" id="mwAho"> <mstyle displaystyle="true" scriptlevel="0" id="mwAhs"> <mo movablelimits="true" form="prefix" id="mwAhw">max</mo> <mo id="mwAh0">=</mo> <mrow id="mwAh4"> <mo id="mwAh8">⌊</mo> <mrow id="mwAiA"> <msub id="mwAiE"> <mi id="mwAiI">log</mi> <mrow class="MJX-TeXAtom-ORD" id="mwAiM"> <mn id="mwAiQ">2</mn> </mrow> </msub> <mo id="mwAiU">⁡<!-- ⁡ --></mo> <mo stretchy="false" id="mwAiY">(</mo> <mn id="mwAic">31</mn> <mo stretchy="false" id="mwAig">)</mo> <mrow class="MJX-TeXAtom-ORD" id="mwAik"> <msqrt id="mwAio"> <mi id="mwAis">φ<!-- φ --></mi> <mo stretchy="false" id="mwAiw">(</mo> <mn id="mwAi0">29</mn> <mo stretchy="false" id="mwAi4">)</mo> </msqrt> </mrow> </mrow> <mo id="mwAi8">⌋</mo> </mrow> <mo id="mwAjA">=</mo> <mn id="mwAjE">26</mn> </mstyle> </mrow> <annotation encoding="application/x-tex" id="mwAjI">{\displaystyle \max =\left\lfloor \log _{2}(31){\sqrt {\varphi (29)}}\right\rfloor =26}</annotation> </semantics> </math></span><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/5288562d460227c1e22bb4c65e0e7a55ade4aeec" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -1.838ex; width:31.441ex; height:4.843ex;" alt="{\displaystyle \max =\left\lfloor \log _{2}(31){\sqrt {\varphi (29)}}\right\rfloor =26}" id="mwAjM"/></span> {1<sup id="mwAjQ">31</sup>-1 = 0 (mod 31), 2<sup id="mwAjU">31</sup>-2 = 0 (mod 31), 3<sup id="mwAjY">31</sup>-3 = 0 (mod 31), ..., 26<sup id="mwAjc">31</sup>-26 = 0 (mod 31)} <u id="mwAjg">(* Step 6 *)</u> <b id="mwAjk">Output</b> <i id="mwAjo">prime</i>. <samp style="padding-left:0.4em; padding-right:0.4em; color:var( --color-subtle, #666666); " id="mwAjs">31 Must be Prime</samp>

Where PolynomialMod is a term-wise modulo reduction of the polynomial. e.g. PolynomialMod[x+2x²+3x³, 3] = x+2x²+0x³