Need help implementing a Lucas Pseudoprimality test - primes

Question

I am trying to write a function that determines if a number n is prime or composite using the Lucas pseudoprime test; at the moment, I am working with the standard test, but once I get that working I will then write the strong test. I am reading the paper by Baillie and Wagstaff, and following the implementation by Thomas Nicely in the trn.c file.
I understand that the full test involves several steps: trial division by small primes, checking that n is not a square, performing a strong pseudoprimality test to base 2, then finally the Lucas pseudoprime test. I can handle all the other pieces, but I am having trouble with the Lucas pseudoprime test. Here is my implementation, in Python:
def gcd(a, b):
while b != 0:
a, b = b, a % b
return a
def jacobi(a, m):
a = a % m; t = 1
while a != 0:
while a % 2 == 0:
a = a / 2
if m % 8 == 3 or m % 8 == 5:
t = -1 * t
a, m = m, a # swap a and m
if a % 4 == 3 and m % 4 == 3:
t = -1 * t
a = a % m
if m == 1:
return t
return 0
def isLucasPrime(n):
dAbs, sign, d = 5, 1, 5
while 1:
if 1 < gcd(d, n) > n:
return False
if jacobi(d, n) == -1:
break
dAbs, sign = dAbs + 2, sign * -1
d = dAbs * sign
p, q = 1, (1 - d) / 4
print "p, q, d =", p, q, d
u, v, u2, v2, q, q2 = 0, 2, 1, p, q, 2 * q
bits = []
t = (n + 1) / 2
while t > 0:
bits.append(t % 2)
t = t // 2
h = -1
while -1 * len(bits) <= h:
print "u, u2, v, v2, q, q2, bits, bits[h] = ",\
u, u2, v, v2, q, q2, bits, bits[h]
u2 = (u2 * v2) % n
v2 = (v2 * v2 - q2) % n
if bits[h] == 1:
u = u2 * v + u * v2
u = u if u % 2 == 0 else u + n
u = (u / 2) % n
v = (v2 * v) + (u2 * u * d)
v = v if v % 2 == 0 else v + n
v = (v / 2) % n
if -1 * len(bits) < h:
q = (q * q) % n
q2 = q + q
h = h - 1
return u == 0
When I run this, isLucasPrime returns False for such primes as 83 and 89, which is incorrect. It also returns False for the composite 111, which is correct. And it returns False for the composite 323, which I know is a Lucas pseudoprime for which isLucasPrime should return True. In fact, isLucasPseudoprime returns False for every n on which I have tested it.
I have several questions:
1) I'm not expert with C/GMP, but it seems to me that Nicely runs through the bits of (n+1)/2 from right-to-left (least significant to most significant) where other authors run through the bits left-to-right. My code shown above runs through the bits left-to-right, but I have also tried running through the bits right-to-left, with the same result. Which order is correct?
2) It looks odd to me that Nicely only updates the u and v variables for a 1-bit. Is this correct? I expected to update all four of the Lucas-chain variables each time through the loop, since the indexes of the chain increase at each step.
3) What have I done wrong?

Answer 1

1) I'm not expert with C/GMP, but it seems to me that Nicely runs through the bits of (n+1)/2 from right-to-left (least significant to most significant) where other authors run through the bits left-to-right. My code shown above runs through the bits left-to-right, but I have also tried running through the bits right-to-left, with the same result. Which order is correct?
Indeed, Nicely goes from least significant to most significant bit. He computes U(2^k) and V(2^k) (and Q^(2^k); all modulo N of course), in the mpzU2m and mpzV2m variables, and has U((N+1) % 2^k) resp V((N+1) % 2^k) stored in mpzU and mpzV. When a 1-bit is encountered, the remainder (N+1) % 2^k changes, and mpzU and mpzV are updated accordingly.
The other way is to compute U(p), U(p+1), V(p) and (optionally) V(p+1) for a prefix p of N+1 and combine those to compute U(2*p+1) and either U(2*p) or U(2*p+2) [ditto for V] depending on whether the next bit after the prefix p is 0 or 1.
Both methods are correct, like you can compute the power x^N going from left to right, having x^p and x^(p+1) as state, or from right to left having x^(2^k) and x^(N % 2^k) as state [and, computing U(n) and U(n+1) is basically computing ζ^n where ζ = (1 + sqrt(D))/2].
I - and others, apparently - find the left-to-right order simpler. I haven't done or read an analysis, it might be that right-to-left is computationally less expensive on average and Nicely chose right-to-left because of that.
2) It looks odd to me that Nicely only updates the u and v variables for a 1-bit. Is this correct? I expected to update all four of the Lucas-chain variables each time through the loop, since the indexes of the chain increase at each step.
Yes, that is correct, because the remainder (N+1) % 2^k == (N+1) % 2^(k-1) if the 2^k bit is 0.
3) What have I done wrong?
A small typo first:
if 1 < gcd(d, n) > n:
should be
if 1 < gcd(d, n) < n:
of course.
More substantially, you use the updates for Nicely's traversal order (right-to-left), but traverse in the other direction. That of course produces wrong results.
Further, when updating v
if bits[h] == 1:
u = u2 * v + u * v2
u = u if u % 2 == 0 else u + n
u = (u / 2) % n
v = (v2 * v) + (u2 * u * d)
v = v if v % 2 == 0 else v + n
v = (v / 2) % n
you use the new value of u, but you ought to use the old value.
def isLucasPrime(n):
dAbs, sign, d = 5, 1, 5
while 1:
if 1 < gcd(d, n) < n:
return False
if jacobi(d, n) == -1:
break
dAbs, sign = dAbs + 2, sign * -1
d = dAbs * sign
p, q = 1, (1 - d) // 4
u, v, u2, v2, q, q2 = 0, 2, 1, p, q, 2 * q
bits = []
t = (n + 1) // 2
while t > 0:
bits.append(t % 2)
t = t // 2
h = 0
while h < len(bits):
u2 = (u2 * v2) % n
v2 = (v2 * v2 - q2) % n
if bits[h] == 1:
uold = u
u = u2 * v + u * v2
u = u if u % 2 == 0 else u + n
u = (u // 2) % n
v = (v2 * v) + (u2 * uold * d)
v = v if v % 2 == 0 else v + n
v = (v // 2) % n
if h < len(bits) - 1:
q = (q * q) % n
q2 = q + q
h = h + 1
return u == 0
works (no guarantees, but I think it is correct, and have done some tests, all of which it passed).