Related question: Determine N primality knowing ALL factors of (n-1). But note that, unlike that question, I'm not searching for primes. I'm verifying a claim from a possibly mischievous source. I do care about the worst case.
So, let's say someone presents a claimed prime $p$ and the prime factorization of $p-1$. We have checked (recursively) that the factors are indeed prime, and now we check the claim that $p$ is prime.
Plan A (not serious, just to clarify what comes after): Lucas primality test:
Pick $w$ at random.
Check that $w^{p-1} \equiv 1 \pmod p$, if not, then $p$ is composite, so reject.
For each prime $q_i | (p-1)$, check that $w^{(p-1)/q_i} \not\equiv 1 \pmod p$, if so, then $p$ is prime, so accept.
Otherwise, try another $w$.
This is a non-deterministic algorithm. But if it terminates, it always gives the right answer; and, for any $p$, with probability 1, it eventually terminates.
Now, if $p$ is actually prime, I figure the number of Lucas witnesses is $\phi(p-1)$ so the expected number of attempts would be $$E = \frac{p-1}{\phi(p-1)}$$ Wikipedia tells me that $$ \frac{N}{\phi(N)} < e^\gamma \log \log N + \frac{3}{\log \log N} $$ for $N>2$, where $\gamma$ is Euler's constant. More concretely, I figure the worst cases are when $p-1$ is the product of the first $M$ primes. For example, I found that for $M=457$, we have a prime number $p_{457}$ with 4500 or so bits, for which the expected number of attempts is $$E \approx 14.5$$
Now, what if $p$ is not actually prime? Some comedian could give us a Carmichael number with 3 large prime factors. If we persist we will eventually stumble upon a number not coprime to $p$ and reject, but the expected number of attempts is going to be astronomical, $O(2^{n/3})$. In that sense this test can be 'stumped', even if it can't be 'fooled'.
Plan B: somewhat generalized Pocklington test:
Pick $w$ at random;
If $w^{p-1} \not\equiv 1 \pmod p$ then $p$ is composite.
Otherwise for each prime $q_i | (p-1)$
calculate $g_i = \gcd(w^{(p-1)/q_i} - 1, p)$
<p>If $g_i=1$, then cross $q_i$ off the list of prime factors.</p> <p>If $g_i\not\in\{1,p\}$, then it is a non-trivial divisor of $p$, so $p$ is composite.</p>If we've crossed out all prime factors $q_i$, then $p$ is prime.
Otherwise try another $w$ (but only retest the $q_i$ that survived the previous attempt).
So the expected number of attempts for any prime factor is $q_i/(q_i-1)$, they're being checked in parallel, and subsequent attempts require fewer modular exponentiations. I actually verified $p_{457}$ this way, it took 462 modular exponentiations. I figure the expected number of modular exponentiations is $$E \le 2(k+1)$$ where $k$ is the number of distinct prime factors of $p-1$, and with equality for a Fermat prime (where $k=1$, it reduces to Plan A).
Main Question: What happens in Plan B if $p$ is composite? Are there still numbers a comedian could use to make it take an unreasonably long time? (I tried some Carmichael numbers with three large prime factors, and it seems to find non-trivial divisors rather promptly.)
Bonus Question: if there are no "comedic" numbers, does anyone know what are the worst-case composite numbers?
