Found a factor, sunshine? Embalm and entomb it here! (RU "Выкрасить и выбросить"))

[James Heinrich]

George just found a pretty one (#16 biggest ever):

M80309 has a 148.041-bit (45-digit) factor: 367135192227544403816033004684216729776734999 (P-1,B1=1000000000,B2=20461169718990)

[Dr Sardonicus]

Originally Posted by James Heinrich

George just found a pretty one (#16 biggest ever):

I noticed that the (last 16 hex digits of the) C-PRP residues listed for

M80309/10572519233/367135192227544403816033004684216729776734999 and

M80309/10572519233

were the same. Is there some obvious reason for this?

(My wits are presently addled by symptoms of a head cold...)

[James Heinrich]

Originally Posted by Dr Sardonicus

I noticed that the (last 16 hex digits of the) C-PRP residues listed for
M80309/10572519233/367135192227544403816033004684216729776734999 and
M80309/10572519233
were the same. Is there some obvious reason for this?

This is normal and expected. PRP residues are always the same, no matter how many known factors are included (assuming same PRP-type). I don't pretend to understand why, I just know that it is. Note that the "type" (e.g. 1, 5) of the PRP will lead to different residues, but the number of known factors (also "shift" value) do not affect the residue. Here's another small exponent with a recent factor that shows both conditions: M80471 -- three PRP-type-1 on 4 factors, of which one is shifted, then a prp-type-5 on same 4 factors, now another prp-type-5 on 5 factors.

[Dr Sardonicus]

Originally Posted by James Heinrich

This is normal and expected. PRP residues are always the same, no matter how many known factors are included (assuming same PRP-type).
<snip>

I found an earlier thread bringing up this bug feature.

The OP in that thread seems to say that when subsequent PRP-CF tests say C, the new PRP-CF residue replaces previous PRP-CF residues. This would certainly account for all reported PRP-CF residues being the same (assuming the remaining cofactor has tested composite).

Why this would be done is beyond me, but the only alternative explanation that fits the facts seems to be that, as long as the remaining CF has tested composite, the original PRP residue is simply repeated. There may be good reasons for not publishing the sequence of actual PRP residues (mod 16¹⁶) for the composite cofactors, of which I am ignorant. [I am rejecting the idea that the residues (mod 16¹⁶) from the PRP-CF tests are all actually the same.]

Of course, if the remaining CF tests as a PRP, the "all PRP residues are the same" goes out the window, and the residue is reported as PRP_PRP_PRP_PRP_ .

[axn]

As I mentioned in that other thread, the residues produced are the same. You're assuming PRP-CF does a standard Fermat test; it does NOT.

Let N=Mp/f
Instead of checking 3^(N-1)==1 (mod N) (equivalently 3^N==3 (mod N)), it computes 3^(N*f+1)=3^(Mp+1)==3^(f+1) (mod N)

Note. 3^N==3 ==> 3^Nf == 3^f ==> 3^(Nf+1) == 3^(f+1)

This gives rise to same residue, since we're always computing the same expression 3^(Mp+1).

Advantages:
1) Each run produces same residue, hence multiple runs acts as additional checks on previous runs.
2) Since the modified computation is just a series of squarings, it is now amenable to GEC and CERT.

[Dr Sardonicus]

Originally Posted by axn

<snip>
Let N=Mp/f
Instead of checking 3^(N-1)==1 (mod N) (equivalently 3^N==3 (mod N)), it computes 3^(N*f+1)=3^(Mp+1)==3^(f+1) (mod N)
<snip>

As I understand it, a PRP test on M = M_p checks 3^(M + 1) to see whether it's 9 (mod M).

I had actually thought of the possibility that subsequent tests were simply looking at 3^(M + 1) (mod N) where N is the cofactor; N divides M = M_p.

Suppose 3^(M+1) = M*q + R where 0 < R < M. Then, yes, N certainly divides 3^(M+1) - R = M*q = N*f*Q, so R may be considered to be "the residue" in that sense.

However, what I usually think of as the "residue of 3^(M+1) (mod N)" is r, where

3^(M+1) = N*Q + r, and 0 < r < N.

Clearly r is just R reduced mod N. Generally, r will be less than R.

It was not clear to me why R - r would be divisible by 2⁶⁴.

[slandrum]

Originally Posted by Dr Sardonicus

As I understand it, a PRP test on M = M_p checks 3^(M + 1) to see whether it's 9 (mod M).

I had actually thought of the possibility that subsequent tests were simply looking at 3^(M + 1) (mod N) where N is the cofactor; N divides M = M_p.

Suppose 3^(M+1) = M*q + R where 0 < R < M. Then, yes, N certainly divides 3^(M+1) - R = M*q = N*f*Q, so R may be considered to be "the residue" in that sense.

However, what I usually think of as the "residue of 3^(M+1) (mod N)" is r, where

3^(M+1) = N*Q + r, and 0 < r < N.

Clearly r is just R reduced mod N. Generally, r will be less than R.

It was not clear to me why R - r would be divisible by 2⁶⁴.

But my guess is R is probably what's reported and not r (r is R mod N).

ETA: This means that if the full residue of the PRP were saved, any time a (new) factor were found, the remaining cofactor could be checked against the original residue to see if it's PRP.

[Dr Sardonicus]

Originally Posted by axn

As I mentioned in that other thread, the residues produced are the same. You're assuming PRP-CF does a standard Fermat test; it does NOT.

Let N=Mp/f
Instead of checking 3^(N-1)==1 (mod N) (equivalently 3^N==3 (mod N)), it computes 3^(N*f+1)=3^(Mp+1)==3^(f+1) (mod N)
<snip>

OK, looks pretty good. Let's see if I have this straight: M = M_p = f*N. We have 3^(M+1) = M*q + R, q integer, 0 < R < M

Now 3^(M+1) = 3^(f*N + 1) = 3^(f*(N-1) + f + 1) = (3^(N-1))^f * 3^(f+1). So if 3^(N-1) == 1 (mod N) we have (3^(N-1))^f == 1 (mod N), and R == 3^(f+1) (mod N).

Thus, if R =/= 3^(f+1) (mod N), the cofactor N is definitely composite. Done. No standard Fermat test needed.

However, if R == 3^(f+1) (mod N) it does not follow that N is a base-3 Fermat PRP, i.e. that 3^(N-1) == 1 (mod N). Only that (3^(N-1)))^f == 1 (mod N).

I know, gcd(f, eulerphi(N)) would have to be greater than 1 in order for 3^(N-1) not to be congruent to 1 (mod N).

That seems extremely unlikely to me, and I am confident that no examples are known, but I don't know that it's impossible.

[Jwb52z]

P-1 found a factor in stage #2, B1=766000, B2=25093000.
UID: Jwb52z/Clay, M108524239 has a factor: 952615068857130427852757781191 (P-1, B1=766000, B2=25093000)

99.588 bits.

[firejuggler]

M8590991 has a 121.408-bit (37-digit) factor: 3527086255292055773928440628536263153 (P-1,B1=1560000,B2=627605550)
another big one.

[James Heinrich]

Two nice first-factor finds by anonymous:

M78301 has a 137.650-bit (42-digit) factor: 273323880097381566755770440603005212056217 (ECM,B1=3000000,B2=300000000,Sigma=1195368452843377)

M65257 has a 135.337-bit (41-digit) factor: 55022097929766288879909228921832648158913 (ECM,B1=3000000,B2=300000000,Sigma=4361375916221119)