Skip to content

math/big: ProbablyPrime panics when the Lucas parameter search exceeds its bound #81487

Open

Description

@filippo-agent

(*Int).ProbablyPrime can panic on a positive integer because the Lucas test assumes it will find a suitable parameter by $P = 10000$. This input exhausts that search, including with a round count of zero:

n := big.NewInt(8 * 655)
for q := int64(3); q <= 10002; q += 2 {
    if big.NewInt(q).ProbablyPrime(0) {
        n.Mul(n, big.NewInt(q))
    }
}
n.Add(n, big.NewInt(1))
n.ProbablyPrime(0) // panic: math/big: internal error: cannot find (D/n) = -1 for ...

The search should continue beyond the bound or use another non-panicking fallback. Exhausting the bound is not evidence of compositeness, so returning false at that point could reject primes.

Lucas parameter search and input construction

The input is the 4,302-digit integer

$$
M = 8 \prod_{\substack{q \le 10002 \ q\text{ odd prime}}} q, \qquad N = 655M + 1.
$$

In src/math/big/prime.go, ProbablyPrime runs Miller–Rabin before probablyPrimeLucas. This $N$ passes the Miller–Rabin gate for ProbablyPrime(0), ProbablyPrime(1), and ProbablyPrime(20), but all three calls panic in the Lucas parameter search.

The search tries discriminants

$$
D = P^2 - 4 = (P - 2)(P + 2), \qquad 3 \le P \le 10000,
$$

looking for a Jacobi symbol of $-1$. Every prime factor of such a $D$ is at most $10002$. By construction,

$$
N \equiv 1 \pmod{8}, \qquad N \equiv 1 \pmod{q}
\quad\text{for every odd prime }q \le 10002.
$$

For each of these odd primes, quadratic reciprocity gives

$$
\left(\frac{q}{N}\right) = \left(\frac{N}{q}\right) = 1,
$$

since $N \equiv 1 \pmod{4}$. The supplementary law also gives $\left(\frac{2}{N}\right) = 1$. Multiplicativity therefore yields

$$
\left(\frac{P^2 - 4}{N}\right) = 1
\quad\text{for every }3 \le P \le 10000.
$$

Neither the j == -1 success branch nor the j == 0 factor branch is taken. The loop reaches p > 10000 and panics, printing the full input. A regression test can construct $N$ as above rather than embed its decimal expansion.

This issue was found by zkao and was triaged by @FiloSottile as a valid bug but not a vulnerability. /cc @golang/security

Activity

  1. cherrymui commented on Sep 18, 2026

    @cherrymui
    Member

    cc @griesemer @thatnealpatel @golang/security

  2. added
    NeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.
    on Sep 18, 2026
  3. added this to the Go1.28 milestone on Sep 18, 2026
  4. gopherbot commented on Sep 23, 2026

    @gopherbot
    Contributor

    Change https://go.dev/cl/837365 mentions this issue: math/big: continue Lucas parameter search past P = 10000

  5. added a commit that references this issue on Sep 27, 2026
    050abd7
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    NeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.

    Type

    No type

    Projects

    No projects

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions