A 24.8-Million-Digit Monster

On December 7, 2018, Patrick Laroche—volunteering with the Great Internet Mersenne Prime Search \(GIMPS\)—discovered the largest known prime number: \(2^{82589933} - 1\). This number has 24,862,048 digits; printing it would still fill roughly 4,000 pages of text.

Nearly seven years later, no larger prime has been confirmed. That persistence says less about stagnation and more about the formidable scale of the search. What’s remarkable isn’t just the size—it’s that this number follows a pattern known since ancient Greece. It’s a Mersenne prime, a prime number of the form \(2^n - 1\). And there’s a fascinating story about why, when we search for the largest known primes, we keep finding Mersenne numbers.

The Ancient Pattern

Mersenne numbers are named after Marin Mersenne, a 17th-century French monk and mathematician who studied them extensively. But the pattern was known much earlier.

Mersenne was a true polymath. While he catalogued which numbers of the form \(2^p - 1\) appeared to be prime (famously getting some wrong—computation was hard in 1644!), his most influential work was in acoustics and music theory. In his masterpiece Harmonie universelle (1636-1637), he laid the foundations of acoustics as a science. He discovered the laws governing vibrating strings—showing that a string’s frequency is inversely proportional to its length, proportional to the square root of its tension, and inversely proportional to the square root of its mass per unit length. These laws, now bearing his name, explain why guitar strings of different thickness produce different notes, and why tightening a string raises its pitch. He was the first to measure an absolute frequency (84 Hz) and demonstrated that musical octaves correspond to a precise 1:2 frequency ratio. This marriage of mathematics and music reveals the same pursuit of mathematical patterns that drew him to prime numbers—the search for harmony in numbers, whether heard or abstract.

Around 300 BCE, Euclid noticed that whenever \(2^p - 1\) is prime, the even number \(2^{p-1}(2^p - 1)\) is perfect: it equals the sum of its proper divisors.1 Two millennia later, Leonhard Euler proved the converse—every even perfect number arises from some Mersenne prime—so perfect numbers and Mersenne primes share the same hunting ground.2

That classical story still leaves the real challenge unsolved: how do we decide which \(2^p - 1\) are prime? Prime exponents are required (if \(n = ab\) with \(a, b > 1\), then

$$ 2^n - 1 = 2^{ab} - 1 = \bigl(2^a - 1\bigr)\left(2^{a(b-1)} + 2^{a(b-2)} + \cdots + 2^a + 1\right) $$

which means any composite \(n\) forces \(2^n - 1\) to factor as well. But that condition is far from sufficient—\(2^{11} - 1 = 2047 = 23 \times 89\) is the standard counterexample. The question of efficiently certifying Mersenne primes remained open until the Lucas–Lehmer test.

This connection to perfect numbers made Mersenne numbers objects of fascination for over two millennia. But they’re not just mathematical curiosities—they turn out to be the most efficient way to find record-breaking primes.

Why So Many Records Are Mersenne Primes?

Look at the history of the largest known prime:

YearLargest Known PrimeDigitsType
1952\(2^{521} - 1\)157Mersenne
1963\(2^{11213} - 1\)3,376Mersenne
1979\(2^{44497} - 1\)13,395Mersenne
1992\(2^{756839} - 1\)227,832Mersenne
2018\(2^{82589933} - 1\)24,862,048Mersenne

Every single largest known prime since 1952 has been a Mersenne number, and the 2018 record still stands today. Why?

The answer lies in a beautiful trade-off between growth rate and testability.

The Growth Rate Advantage

Mersenne numbers grow exponentially fast. Each time \(p\) increases by 1, the Mersenne number roughly doubles:

$$2^{p+1} - 1 \approx 2 \cdot (2^p - 1)$$

This means we can reach enormous numbers quickly. A hypothetical candidate like \(2^{136279841} - 1\) (one of the current exponents under test) would be approximately \(10^{41024320}\)—a number so large that if every atom in the observable universe were a digit, you’d need \(10^{41024240}\) universes to write it down.

Compare this to linear growth like \(p\) itself, or even quadratic growth like \(p^2\). To reach similar magnitudes, you’d need astronomically larger values of \(p\).

The Testability Advantage

But fast growth alone isn’t enough. We need to be able to verify that these numbers are actually prime. For general numbers, the best algorithms have complexity roughly \(O(n^2)\) or worse, where \(n\) is the number of digits.

In practice, trial division up to (\sqrt{N}) needs roughly (10^{n/2}) attempts for an (n)-digit number—exponential in (n).3 Even the probabilistic Miller–Rabin test, when applied to arbitrary inputs, does repeated modular exponentiations that cost almost (O(n^2)) each with classical arithmetic; the fully general AKS algorithm is polynomial in (n) but far slower in practice hours.

For a 41-million-digit number, this would be computationally infeasible today.

But Mersenne numbers have a special structure that allows for remarkably efficient testing.

The Lucas-Lehmer Test: Elegance in Simplicity

In 1878, Édouard Lucas discovered a test for Mersenne primes. In 1930, Derrick Henry Lehmer proved it rigorously. The Lucas-Lehmer test is one of the most elegant algorithms in all of number theory.

The Algorithm

To test if \(M_p = 2^p - 1\) is prime (where \(p\) itself must be prime):

  1. Start with \(S_0 = 4\)
  2. Compute \(S_i = (S_{i-1}^2 - 2) \bmod M_p\) for \(i = 1, 2, \ldots, p-2\)
  3. If \(S_{p-2} = 0\), then \(M_p\) is prime. Otherwise, it’s composite.

That’s it. No trial division, no complicated factorization—just repeated squaring and subtraction.

Example: Testing \(M_5 = 2^5 - 1 = 31\)

Let’s verify that 31 is prime:

  • \(S_0 = 4\)
  • \(S_1 = (4^2 - 2) \bmod 31 = 14 \bmod 31 = 14\)
  • \(S_2 = (14^2 - 2) \bmod 31 = 194 \bmod 31 = 8\)
  • \(S_3 = (8^2 - 2) \bmod 31 = 62 \bmod 31 = 0\)

Since \(S_3 = 0\) and \(3 = 5 - 2\), we confirm 31 is prime!

Example: Testing \(M_{11} = 2^{11} - 1 = 2047\)

Is 2047 prime? Let’s check:

  • \(S_0 = 4\)
  • \(S_1 = (4^2 - 2) \bmod 2047 = 14\)
  • \(S_2 = (14^2 - 2) \bmod 2047 = 194\)
  • \(S_3 = (194^2 - 2) \bmod 2047 = 788\)
  • \(S_4 = (788^2 - 2) \bmod 2047 = 701\)
  • \(S_5 = (701^2 - 2) \bmod 2047 = 119\)
  • \(S_6 = (119^2 - 2) \bmod 2047 = 1877\)
  • \(S_7 = (1877^2 - 2) \bmod 2047 = 240\)
  • \(S_8 = (240^2 - 2) \bmod 2047 = 282\)
  • \(S_9 = (282^2 - 2) \bmod 2047 = 1736\)

Since \(S_9 \neq 0\), we conclude 2047 is composite! (In fact, \(2047 = 23 \times 89\).)

This example shows why \(p\) itself must be prime: \(2^{11} - 1\) is composite even though 11 is prime. However, if \(p\) is composite, \(2^p - 1\) is always factorable.

Generating Functions, Lucas Sequences, and the Proof

Lucas numbers are close cousins of the Fibonacci numbers—they satisfy the same characteristic polynomial \(x^2 - x - 1\) but begin with different initial conditions. Their ordinary generating function is

$$L(x) = \frac{2 - x}{1 - x - x^2},$$

while the Fibonacci generating function is \(F(x) = \frac{x}{1 - x - x^2}\). Both arise from the broader family of Lucas sequences \(U_n(P, Q)\) and \(V_n(P, Q)\), defined by

$$U_0 = 0,; U_1 = 1,; U_{n+1} = P U_n - Q U_{n-1},$$ $$V_0 = 2,; V_1 = P,; V_{n+1} = P V_n - Q V_{n-1}.$$

Their ordinary generating functions are tidy:

$$U(x) = \frac{x}{1 - Px + Qx^2}, \qquad V(x) = \frac{2 - Px}{1 - Px + Qx^2}.$$

Setting \(P = 4\) and \(Q = 1\) produces the sequence \(V_n(4, 1)\) whose first terms are 2, 4, 14, 52, 194, \ldots. Extracting the coefficients from the generating function yields the closed form

$$V_n(4, 1) = \alpha^n + \beta^n,$$

where \(\alpha = 2 + \sqrt{3}\) and \(\beta = 2 - \sqrt{3}\) are the roots of \(x^2 - 4x + 1 = 0\). Because \(\alpha \beta = 1\), sampling every power-of-two index gives

$$S_k = V_{2^k}(4, 1) = \alpha^{2^k} + \beta^{2^k} = \alpha^{2^k} + \alpha^{-2^k}.$$

This is precisely the Lucas-Lehmer sequence: the duplication identity \(\alpha^{2^{k+1}} + \alpha^{-2^{k+1}} = (\alpha^{2^k} + \alpha^{-2^k})^2 - 2\) immediately reproduces the recurrence \(S_{k+1} = S_k^2 - 2\) with \(S_0 = 4\).

The closed form turns the test into a clean field-theoretic statement.

Lucas-Lehmer Theorem. Let \(p > 2\) be prime and \(M_p = 2^p - 1\). Then \(M_p\) is prime if and only if \(S_{p-2} \equiv 0 \pmod{M_p}\).

Proof sketch.

  1. If \(M_p\) is prime. Work in the quadratic extension \((\mathbb{Z}/M_p\mathbb{Z})[\sqrt{3}]\). In characteristic \(M_p\), the Frobenius automorphism satisfies

    $$(2 + \sqrt{3})^{M_p} = 2 - \sqrt{3}.$$

    Consequently \((2 + \sqrt{3})^{M_p + 1} = 1\). Since \(M_p + 1 = 2^p\), the element \(\alpha = 2 + \sqrt{3}\) has order \(2^p\) in the multiplicative group of the extension. Put \(x = \alpha^{2^{p-2}}\). Then \(x^2 = \alpha^{2^{p-1}} = -1\), so \(x^{-1} = -x\) and

    $$S_{p-2} = x + x^{-1} \equiv x - x \equiv 0 \pmod{M_p}.$$

  2. Conversely, suppose \(S_{p-2} \equiv 0 \pmod{M_p}\). Let \(q\) be any prime factor of \(M_p\). Reducing the previous argument modulo \(q\) shows again that \(\alpha^{2^{p-1}} \equiv -1 \pmod{q}\), so the order of \(\alpha\) modulo \(q\) is \(2^p\). That order must divide \(q + 1\) \(the size of the norm-one subgroup in the quadratic extension\), forcing \(q \equiv -1 \pmod{2^p}\). The only divisor of \(2^p - 1\) with that property is \(M_p\) itself, so \(M_p\) is prime.

The Lucas-Lehmer test therefore falls straight out of the Lucas sequence \(V_n(4, 1)\): generating functions produce the closed form, and the finite-field argument translates it into a deterministic primality certificate.

Computational Complexity

The Lucas-Lehmer test requires \(p - 2\) iterations, each involving:

  1. Squaring a number with \(\sim p\) bits
  2. Taking the modulo

Using the Fast Fourier Transform \(FFT\) for multiplication, each iteration takes \(O(p \log p)\) time. Overall complexity: \(O(p^2 \log p)\).

For a candidate such as \(M_{136279841}\) (one of the largest exponents currently under test), this is about \(10^{18}\) basic operations—still massive, but tractable with modern GPUs. By comparison, testing an arbitrary 41-million-digit number for primality could take \(10^{25}\) operations or more.

This is why Mersenne numbers dominate the record books: they’re the sweet spot between explosive growth and efficient verification.

Pseudocode Implementation

Here’s the Lucas-Lehmer test in pseudocode:

def is_mersenne_prime\\(p\\):
    """Test if 2^p - 1 is prime using Lucas-Lehmer test."""
    # First check that p itself is prime
    if not is_prime\\(p\\):
        return False

    # Special case
    if p == 2:
        return True

    # Compute M_p = 2^p - 1
    M_p = \\(1 << p\\) - 1  # Bit shift: 2^p - 1

    # Initialize sequence
    S = 4

    # Iterate p - 2 times
    for _ in range\\(p - 2\\):
        S = \\(S * S - 2\\) % M_p

    # M_p is prime iff S = 0
    return S == 0

For large \(p\), the modular arithmetic and multiplication would use specialized algorithms (FFT-based multiplication, Montgomery reduction, etc.), but the structure remains the same.

Are There Even Better Candidates?

Given that Mersenne numbers are so efficient, a natural question arises: Are there other families of numbers that balance growth and testability even better?

The short answer: No, not yet.

Other Special Forms

Researchers have explored several alternatives:

Fermat numbers: \(F_n = 2^{2^n} + 1\)

  • Growth: Even faster than Mersenne numbers! \(F_5 = 2^{32} + 1 = 4{,}294{,}967{,}297\)
  • Problem: They’re almost always composite. Only five Fermat primes are known: \(F_0\) through \(F_4\).
  • Testability: Pépin’s test is efficient, but there are no primes to find.

Proth primes: \(p = k \cdot 2^n + 1\) where \(k < 2^n\)

  • Growth: Slower than Mersenne numbers
  • Testability: Proth’s test is efficient, similar to Lucas-Lehmer
  • Downside: You need to search over two parameters (\(k\) and \(n\)), making the search space larger

Generalized Fermat numbers: \(a^{2^n} + 1\)

  • Explored for various bases \(a\), but no systematic advantage over Mersenne numbers

The Trade-off Landscape

Think of it as a two-dimensional optimization:

FamilyGrowth RateTest EfficiencySearch SpaceKnown Large Primes
MersenneExponentialExcellent \(LL test\)1D (just \(p\))Many \(51 known\)
FermatSuper-exponentialGood \(Pépin\)1DVery few \(5 known\)
ProthSub-exponentialGood2DSome
GeneralVariesPoorInfiniteHard to search

Mersenne numbers sit in a unique sweet spot: exponential growth, deterministic efficient testing, and a one-dimensional search space (just test prime exponents \(p\) in sequence).

Why Not Just Test Random Large Numbers?

You might wonder: why not generate random 40-million-digit numbers and test them?

The Prime Number Theorem tells us that the density of primes near \(N\) is approximately \(1/\ln(N)\). For a 40-million-digit number (\(N \approx 10^{40000000}\)):

$$\text{Density} \approx \frac{1}{\ln(10^{40000000})} = \frac{1}{40000000 \ln(10)} \approx \frac{1}{92103404}$$

So you’d need to test about 92 million random 40-million-digit numbers to expect to find one prime. Even with probabilistic primality tests (which are faster than Lucas-Lehmer), this is computationally prohibitive.

By contrast, Mersenne numbers with prime exponents have a much higher “hit rate”—heuristics put it near \((\ln 2)/p\), still dramatically better than random search.

The Great Internet Mersenne Prime Search GIMPS

The systematic search for Mersenne primes has been a collective effort. In 1996, George Woltman founded GIMPS (Great Internet Mersenne Prime Search), a distributed computing project where volunteers contribute CPU time.

The Latest Discovery (2018) and the Road Ahead

Laroche’s 2018 find was verified independently on multiple machines running GMP-FFT and other optimized CPU code before being certified by GIMPS. It stands as the 51st known Mersenne prime, and GIMPS has discovered the last 18 in the sequence.

Although the record was set on CPUs, the project has since been experimenting with GPU-accelerated variants of the Lucas-Lehmer test. GPUs are massively parallel processors—originally designed for graphics but now used for scientific computing and machine learning—and their parallelism fits the repeated squaring at the heart of the test. Early GPU efforts focus on trial factorizations and partial Lucas-Lehmer runs, but as of 2025 no confirmed prime has yet been found entirely on GPU hardware. That frontier remains wide open.

Are There Infinitely Many?

One of the great unsolved problems in mathematics: Are there infinitely many Mersenne primes?

We strongly suspect the answer is yes, but it’s never been proved. In fact, we don’t even know if there are infinitely many Mersenne numbers \(2^p - 1\) that are composite for prime \(p\) (though we expect there are).

What we do know:

  • 51 Mersenne primes have been found
  • The gaps between exponents \(p\) giving Mersenne primes seem to grow
  • Heuristic arguments suggest infinitely many exist, but heuristics aren’t proofs

This is part of what makes the hunt exciting—every new discovery could be the last, or there could be infinitely many more.

Other Uses of Mersenne Numbers

Beyond the hunt for large primes, Mersenne numbers have practical applications in computer science.

The Mersenne Twister

The Mersenne Twister is one of the most widely used pseudorandom number generators in computational science. It’s the default random number generator in:

  • Python (random module)
  • R
  • Ruby
  • MATLAB
  • Microsoft Excel

The algorithm is named MT19937 because it has a period of \(2^{19937} - 1\), a Mersenne number (and a Mersenne prime, in fact).

Why this choice?

  1. Long period: \(2^{19937} - 1 \approx 10^{6000}\)—you can generate \(10^{6000}\) random numbers before the sequence repeats. For context, there are only about \(10^{80}\) atoms in the observable universe.

  2. Efficient arithmetic: The algorithm uses only bitwise operations (shifts, XORs, ANDs)—no multiplication or division. This makes it extremely fast.

  3. Good statistical properties: The Mersenne Twister passes stringent tests of randomness (though it’s not cryptographically secure).

The connection to Mersenne numbers isn’t deep—it’s primarily that \(2^{19937} - 1\) gives a conveniently long period and nice binary structure for the bitwise operations.

Binary Representation

Mersenne numbers have beautifully simple binary representations:

$$2^p - 1 = \underbrace{111\ldots111}_\text{p ones}$$

For example:

  • \(2^5 - 1 = 31 = 11111_2\)
  • \(2^8 - 1 = 255 = 11111111_2\)

This makes them useful in:

  • Bit masking: \(2^{32} - 1\) masks the lower 32 bits
  • Hash table sizing: Powers of 2 (and \(2^n - 1\)) enable fast modulo via bitwise AND
  • Computer graphics: \(2^8 - 1 = 255\) is the maximum value for 8-bit color channels

The Mystery of Distribution

Viewed through the lens of prime indices, the exponents that yield Mersenne primes form a surprisingly sparse sequence:

$$k = 1, 2, 3, 4, 6, 7, 8, 11, 18, 24, 31, 55, 81, 82, 100, 106, 107, 124, \newline 127, 146, 153, 180, 183, 206, 213, 220, 236, 300, 314, 316, 352, 353, 370, \newline 396, 398, 434, 480, 492, 508, 512, 575, 607, 620, 633, 647, 665, 675, 704, \ldots$$

Here \(k\) denotes the position of the prime exponent \(p_k\) in the ordered list of primes. Only at these indices does the Lucas–Lehmer test certify \(2^{p_k} - 1\) as prime. The first few entries correspond to the familiar Mersenne primes (\(k = 1\) through \(11\)), but the skips grow quickly: after \(k = 31\) one must march through two dozen additional primes before hitting \(k = 55\), and the record example \(p = 82{,}589{,}933\) sits at index \(k = 3{,}215{,}031\).

Measuring gaps in terms of \(k\) makes their size clearer. Between \(k = 353\) (yielding \(M_{994{,}009} \)) and \(k = 396\) (yielding \(M_{2{,}976{,}221} \)) we skip forty-two consecutive prime exponents. Later, the gaps span millions of prime candidates. The celebrated jump from the 2018 record \(M_{82{,}589{,}933}\) to today’s leading search target \(M_{136{,}279{,}841}\) translates into roughly 19 million intervening prime exponents that all fail Lucas–Lehmer.

Why such sparsity? Rigorous explanations remain elusive. Heuristic models—dating back to work by Wagstaff, Crandall, and others—predict that the probability \(2^p - 1\) stays prime is about \(e^{\gamma}/p\), so the expected number of successes up to exponent \(p\) grows like \(\log \log p\). On top of that, arithmetic biases seem to appear: exponents with \(p \equiv 3 \pmod{4}\) are noticeably rarer, and deeper phenomena involving quadratic residues and Galois theory appear to forbid additional primes. For now, the sparse and irregular pattern of the winning prime indices remains part of the mystery—and part of the allure.

The Future of Prime Hunting

What’s next for the search for giant primes?

GPU Acceleration

The push toward GPU acceleration opens new possibilities. GPUs can:

  • Perform thousands of operations in parallel
  • Handle the FFT multiplications needed for Lucas-Lehmer very efficiently
  • Search multiple candidates simultaneously

We might see the first fully GPU-discovered Mersenne prime in the coming years, but the milestone has not yet arrived.

Quantum Computing?

Will quantum computers help find Mersenne primes?

Interestingly, probably not much. Shor’s algorithm (the famous quantum factoring algorithm) doesn’t directly help with primality testing. The Lucas-Lehmer test is already quite efficient, and there’s no known quantum algorithm that significantly speeds it up.

Quantum computers might help with other number-theoretic problems, but prime hunting is likely to remain a classical computing domain.

Alternative Families

Researchers continue to explore other families:

  • Generalized Repunits: Numbers like \((10^p - 1)/9\) \(e.g., 11, 1111111, etc.\)
  • Cullen and Woodall numbers: \(n \cdot 2^n + 1\) and \(n \cdot 2^n - 1\)
  • Primorial primes: Primes of the form \(p\# \pm 1\), where \(p\#\) is the product of all primes ≤ \(p\)

But none have the combination of efficiency and success that Mersenne numbers enjoy.

The Million-Dollar Question

The Clay Mathematics Institute offers a $1,000,000 prize for solving the Riemann Hypothesis, which has deep connections to the distribution of primes. Solving it wouldn’t directly give us the next Mersenne prime, but it would fundamentally change our understanding of how primes are distributed.

Why We Care

You might ask: why spend computational resources hunting for ever-larger primes?

Practical reasons:

  • Cryptography: While Mersenne primes themselves aren’t used in modern cryptography (RSA uses the product of two large primes, not Mersenne primes), the algorithms developed for prime testing and large number arithmetic have direct applications.
  • Distributed computing: GIMPS pioneered techniques for coordinating volunteer computing efforts, now used in projects like Folding@home (protein folding) and SETI@home.
  • Algorithm development: Optimizing the Lucas-Lehmer test has driven improvements in FFT implementations and modular arithmetic.

Intellectual reasons:

  • Mathematical beauty: The Lucas-Lehmer test is an elegant piece of pure mathematics.
  • Exploration: We don’t know if there are infinitely many Mersenne primes. Every discovery pushes the frontier.
  • Human achievement: Discovering a 24.8-million-digit prime—and pushing toward 40-million-digit candidates—is a testament to human curiosity and collaboration.

As mathematician G.H. Hardy wrote: “A mathematician, like a painter or a poet, is a maker of patterns. If his patterns are more permanent than theirs, it is because they are made with ideas.”

The hunt for Mersenne primes is the hunt for the most beautiful patterns in the integers.

Conclusion

Mersenne primes occupy a unique place in mathematics:

  • Ancient heritage: Known since Euclid, studied for millennia
  • Modern computation: Found using cutting-edge GPU clusters and distributed computing
  • Theoretical mystery: We don’t know if there are infinitely many
  • Practical efficiency: The Lucas-Lehmer test makes them the most tractable large primes

They grow exponentially fast, yet remain testable. They appear irregularly, yet follow subtle patterns. They’re used in random number generation, yet they themselves arise from the most deterministic structure in mathematics.

The next Mersenne prime could be discovered tomorrow, or it might take decades. The exponent might be 150 million, or 200 million, or far beyond. We don’t know when, and we don’t know where.

But somewhere in the infinite expanse of integers, the next record holder waits—a string of ones in binary, a number of the form \(2^p - 1\), the next giant in humanity’s oldest numerical treasure hunt.


Further Reading


  1. Let \(M_p = 2^p - 1\) with \(p\) prime and suppose \(M_p\) is prime. The proper divisors of \(2^{p-1} M_p\) consist of the \(p\) powers \(2^k\) for \(0 \le k \le p-1\) together with those powers multiplied by \(M_p\); summing them gives \((2^p - 1) + M_p(2^{p-1} - 1) = 2^{p-1} M_p\), so the number is perfect. ↩︎

  2. Let an even perfect number be written as \(N = 2^{k-1} m\) with \(m\) odd. Summing its proper divisors yields \((2^k - 1) + (2^k - 1)m = 2^{k-1} m\), which forces \(m = 2^k - 1\). Because \(m\) must be prime, \(k\) is prime as well, and therefore \(N = 2^{p-1}(2^p - 1)\) with \(2^p - 1\) prime. ↩︎

  3. Trial division tests divisibility by each integer up to (\sqrt{N}). If (N) has (n) decimal digits, then (N pprox 10^{n-1}), so (\sqrt{N} pprox 10^{(n-1)/2}). Each trial involves an (O(n))-digit remainder computation, giving roughly (10^{(n-1)/2}) imes(O(n)) time—exponential in (n). This contrasts with the (O(n^2)) cost per modular exponentiation that appears in algorithms like Miller–Rabin when no extra structure is available. ↩︎