Deterministic methods for finding elements of large multiplicative order
David Harvey, Markus Hittmeir
TL;DR
The paper presents a deterministic algorithm that, for any $N \ge 3$ and $D < N-1$, outputs either an $\alpha \in \mathbb{Z}_N^*$ with $\operatorname{ord}_N(\alpha) > D$ or a nontrivial divisor of $N$, running in time $O\left(\dfrac{D^{1/2}}{(\log \log D)^{1/2}} \log^2 N\right)$ and without ever reporting that $N$ is prime. It builds on a refined use of babystep-giantstep order testing and a density-based analysis of $B$-smooth numbers to force progression in the order growth, ultimately removing previous lower bounds on $D$ (e.g., $N^{2/5}$ or $N^{1/6}$). A key feature is that prime $N$ no longer yields a primality certificate; instead, the algorithm always returns an element of sufficiently large order, which has implications for deterministic factoring algorithms. The work thus eliminates a significant bottleneck in deterministic factorization and enables robust construction of high-order elements even when only small $D$ is specified.
Abstract
We revisit the problem of rigorously and deterministically finding elements of large order in the multiplicative group of integers modulo a natural number $N$. Solving this problem is an essential step in several recent deterministic algorithms for factoring $N$, including the currently fastest ones. In 2018, the second author gave an algorithm that for a given target order $D \geq N^{2/5}$, finds either an element of order exceeding $D$, or a nontrivial divisor of $N$, or proves that $N$ is prime. The running time was \[ O\left(\frac{D^{1/2}}{(\log \log D)^{1/2}} \log^2 N \right) \] bit operations, asymptotically the same as the cost of computing the order of a single element using Sutherland's optimisation of the classical babystep-giantstep method. Subsequent work by several authors weakened the hypothesis $D \geq N^{2/5}$ to $D \geq N^{1/6}$. In this paper, we show that the hypothesis may be dropped altogether. Moreover, if $N$ is prime, we can guarantee returning an element of order exceeding $D$, rather than a proof that $N$ is prime.