Primality Testing versus Factoring

Executive summary

Deciding primality is easy; producing the factors is not

Primality testing is in polynomial time; no polynomial-time factoring algorithm is known. The gap is not a matter of degree — it is the foundation of public-key cryptography. Within primality work there is a further distinction that must never be blurred: a compositeness test can prove a number composite but never prove it prime, while a primality proof produces a verifiable certificate. Fast probabilistic tests do the first; slower algorithms do the second.

Learning objectives

Distinguish compositeness tests, probable primes and primality proofs.
Explain why a witness to compositeness is not a factor.
Select a testing strategy appropriate to the application.
Interpret a primality certificate and its verification cost.
State the status of AKS and why it is not used in practice.

Section 01The asymmetry

PrimalityPolynomial time

AKS settled this unconditionally in 2002. In practice a Miller–Rabin screen followed by ECPP proves primality for thousands of digits routinely.

FactoringSub-exponential at best

The number field sieve runs in L[1/3]. No polynomial-time classical algorithm is known, and the presumed hardness underpins RSA.

A compositeness witness is not a factor

Miller–Rabin can certify that a 2048-bit number is composite in milliseconds while giving no information whatsoever about its factors. The test detects a structural failure of a property that primes have; it does not decompose anything. Conflating the two is the single most common misunderstanding in this area.

Section 02Three levels of assurance

What each kind of test establishes
Level	Output	Guarantee	Cost
Compositeness test	Composite, or no conclusion	Composite is certain; the other outcome proves nothing	One modular exponentiation per round
Probable prime	Passed k independent rounds	Error probability below 4^−k for random bases	k modular exponentiations
Primality proof	Prime, with a certificate	Certain, and independently verifiable	Substantially higher — but verification is cheap

A pseudoprime is a composite that passes a given test for a given base. Carmichael numbers pass the Fermat test for every base coprime to them, which is why Fermat alone is inadequate; the strong test of Miller–Rabin has no such universal counterexamples.

Where probable primes are not good enough

For cryptographic key generation, probable primality at a suitable round count is standard and accepted. For a published mathematical claim, for a record computation, or wherever a third party must be able to check the result, a certificate is required. The distinction should be recorded with the number, not left implicit.

Section 03Strategy

Stage 01Cheap rejectionTrial division by small primes removes the great majority of composites almost for free.
Stage 02Strong probable prime testA few Miller–Rabin rounds, or a Baillie–PSW combination, eliminate essentially everything else.
Stage 03Decide the requirementIf probable primality suffices, stop here. If proof is needed, continue.
Stage 04ProvePocklington if the factorisation of n−1 is partly known; otherwise ECPP, or the Jacobi sum test for numbers up to a few thousand digits.

What is the number for?
- Cryptographic key Strong probable prime — standard practice, with the round count set by the applicable standard.
- Published result ECPP certificate — independently verifiable by a third party.
- Special form, e.g. 2^p−1 Lucas–Lehmer — a specialised deterministic test, far faster than any general method.
- Small, under 64 bits Deterministic Miller–Rabin — verified base sets make the test deterministic in this range.

Section 04AKS and its place

The AKS algorithm decides primality in deterministic polynomial time without any unproven hypothesis — a landmark theoretical result that resolved a long-standing open question.

Theoretically decisive, practically unused

Even with substantial improvements the exponent remains high enough that AKS is far slower than ECPP or the Jacobi sum test on numbers of any practical size. Its importance is that it settled the complexity of the problem; it did not change how primality is established in practice.

1976MillerA deterministic polynomial-time test, conditional on the extended Riemann hypothesis.
1980RabinThe randomised strong probable prime test — still the workhorse of every implementation.
1983Adleman, Pomerance and RumelyThe Jacobi sum test, with a running time barely superpolynomial; the first practical general proving method.
1986Goldwasser–Kilian, then Atkin–MorainElliptic curve primality proving, producing short certificates that verify quickly.
2002Agrawal, Kayal and SaxenaAKS: deterministic, unconditional, polynomial time.

ReferenceFrequently asked questions

Why can a compositeness test never prove primality?

Because it checks a property that all primes have but that some composites also have. Failing the check proves compositeness; passing it merely places the number in a set containing all primes and some composites.

How many Miller-Rabin rounds are enough?

For random candidates the error probability falls much faster than the worst-case 4^(-k) bound suggests, and standards typically specify between 20 and 64 rounds depending on size and application. For adversarially chosen inputs the worst-case bound is what applies, so random base selection is essential.

What is a primality certificate?

A short piece of data allowing anyone to verify primality far more cheaply than discovering it. For Pocklington it is a partial factorisation of n−1 with a suitable base; for ECPP it is a chain of curves and points that reduces primality of n to primality of a smaller number.

NavigateContinue in this stream

Curated next steps from this page. The site also surfaces algorithmically related reading below.

ProvenanceSources and further reading

This page is an original KEVOS explanatory article. It presents the underlying mathematics — definitions, algorithms, complexity results and selection criteria — in KEVOS editorial voice. No text is reproduced from any copyrighted source. Where numerical tables are relevant, KEVOS links to live authoritative databases rather than republishing static values.

Handbook application: from concept to controlled practice

Purpose. This expanded section turns the original page into a practical handbook. It preserves the supplied material and adds a repeatable way to apply, check and review Primality Testing versus Factoring. It does not replace a contract, legislation, a controlled standard, competent engineering judgement or specialist advice.

The operating aim is to turn a compact mathematical statement into a usable chain of definitions, claims, examples and checks. Read the original explanation first, then use the workflow and checks below to convert knowledge into evidence.

Treat Primality Testing versus Factoring as a network of definitions and implications, not as a list of formulas. The working vocabulary on this page—primality, testing, section, factoring, versus—should be made explicit before any proof or computation begins. Record the ambient set or structure, the permitted operations and the equality or equivalence relation in use. A compact theorem often changes meaning when the base field, finiteness condition, commutativity assumption or direction of an action changes.

For a proof, write the hypotheses as a checklist and mark the line at which each one is used. For a computation, state the representation of the input, the arithmetic model, the termination condition and the output invariant. For a classification problem, distinguish existence from uniqueness and distinguish an object from its representation. These separations prevent a correct local calculation from being mistaken for the general result.

A useful worked example should be small enough to inspect completely but rich enough to exercise the main mechanism. Compute the result in two ways where practical: symbolically and by substitution, structurally and numerically, or directly and through a normal form. Then include one near-miss example in which a hypothesis fails. The contrast explains why the theorem is shaped as it is and gives the reader a diagnostic pattern for later problems.

Verification is part of the mathematics. Check domains and codomains, substitute proposed solutions, test identity and zero cases, compare dimensions or cardinalities, and confirm that maps respect the required operations. In numerical work, report precision, conditioning and a residual rather than digits alone. In algorithmic work, separate mathematical correctness from implementation complexity and resource limits.

Step-by-step operating method

Fix the setting. State the objects, ambient structure, notation and assumptions before manipulating symbols.
Separate claims. Distinguish definitions, hypotheses, conclusions, equivalent conditions and consequences.
Choose a method. Select proof, construction, calculation or algorithm according to the question actually asked.
Work a small case. Use the smallest non-trivial example to expose the mechanism and test edge behaviour.
Verify independently. Substitute back, check invariants, test boundary cases or use an alternative derivation.

Worked-example protocol

Illustrative method—not a source theorem. Start with a small admissible input and list the definitions it must satisfy. Carry out each transformation on a separate line, citing the property that permits it. Preserve exact values until approximation is necessary. At the end, verify the output against the original definition and one invariant such as dimension, degree, determinant, order, norm or residual. Then alter one hypothesis and observe which step ceases to be valid. This protocol creates a reusable example without inventing a theorem-specific numerical answer.

Stage	Record	Quality check
Input	Objects, domain, notation, assumptions	Every symbol is defined
Method	Permitted operation or cited result at each step	All hypotheses hold
Output	Exact result and representation	Correct type, domain and form
Verification	Substitution, invariant or alternative derivation	Independent agreement
Boundary test	Zero, identity, degenerate or failed hypothesis	Scope is understood

Common failure modes and recovery actions

1. Watch for

Using a theorem without checking every hypothesis.

Recovery: Return to the governing definition or requirement and restate the decision in one sentence.

2. Watch for

Treating a suggestive example as a proof of the general case.

Recovery: Separate evidence from assumption, assign an owner and set a date for validation.

3. Watch for

Changing notation or conventions part-way through an argument.

Recovery: Run a small counterexample, boundary test, pilot or independent check before proceeding.

4. Watch for

Hiding a division-by-zero, convergence, finiteness or commutativity assumption.

Recovery: Record the consequence, decision and rationale, then update the controlled baseline.

5. Watch for

Reporting a computed result without a residual, substitution or structural check.

Recovery: Escalate when the issue affects safety, compliance, acceptance, material value or an agreed tolerance.

Review checklist

Can every symbol be traced to a definition or prior result?
Which hypothesis does each major step use?
Does the method cover zero, identity, degenerate and boundary cases?
Can the conclusion be checked by a second representation or calculation?
Are mandatory requirements distinguished from recommendations and illustrative values?
Are sources, assumptions, units, dates and versions recorded closely enough to reproduce the decision?
Have safety, legal, ethical, stakeholder and operational consequences been considered at the appropriate level?
Is there a named owner and a trigger for review, escalation, change or retirement?

Questions for deeper application

What is the most important distinction a practitioner must preserve when applying Primality Testing versus Factoring?