The golden ratio is the larger root of the equation

φ² – φ – 1 = 0.

By analogy, **golden ratio primes** are prime numbers of the form

*p* = φ² – φ – 1

where φ is an integer. To put it another way, instead of solving the equation

φ² – φ – 1 = 0

over the real numbers, we’re looking for prime numbers *p* where the equation can be solved in the integers mod *p*. [1]

## Application

When φ is a large power of 2, these prime numbers are useful in cryptography because their special form makes modular multiplication more efficient. (See the previous post on Ed448.) We could look for such primes with the following Python code.

from sympy import isprime for n in range(1000): phi = 2**n q = phi**2 - phi - 1 if isprime(q): print(n)

This prints 19 results, including *n* = 224, corresponding to the golden ratio prime in the previous post. This is the only output where *n* is a multiple of 32, which was useful in the design of Ed448.

## Golden ratio primes in general

Of course you could look for golden ratio primes where φ is not a power of 2. It’s just that powers of 2 are the application where I first encountered them.

A prime number *p* is a golden ratio prime if there exists an integer φ such that

*p* = φ² – φ – 1

which, by the quadratic theorem, is equivalent to requiring that *m* = 4*p* + 5 is a square. In that case

φ = (1 + √*m*)/2.

Here’s some code for seeing which primes less than 1000 are golden ratio primes.

from sympy import primerange def issquare(m): return int(m**0.5)**2 == m for p in primerange(2, 1000): m = 4*p + 5 if issquare(m): phi = (int(m**0.5) + 1) // 2 assert(p == phi**2 - phi - 1) print(p)

By the way, there are faster ways to determine whether an integer is a square. See this post for algorithms.

(Update: Aaron Meurer pointed out in the comments that SymPy has an efficient function `sympy.ntheory.primetest.is_square`

for testing whether a number is a square.)

Instead of looping over primes and testing whether it’s possible to solve for φ, we could loop over φ and test whether φ leads to a prime number.

for phi in range(1000): p = phi**2 - phi - 1 if isprime(p): print(phi, p)

## Examples

The smallest golden ratio prime is *p* = 5, with φ = 3.

Here’s a cute one: the pi prime 314159 is a golden ratio prime, with φ = 561.

The golden ratio prime that started this rabbit trail was the one with φ = 2^{224}, which Mike Hamburg calls the Goldilocks prime in his design of Ed448.

## Related posts

[1] If *p* = φ² – φ – 1 for some integer φ, then φ² – φ – 1 = 0 (mod *p*). But the congruence can have a solution when *p* is not a golden ratio prime. The following code shows that the smallest example is *p* = 31 and φ = 13.

from sympy import primerange from sympy.ntheory.primetest import is_square for p in primerange(2, 100): m = 4*p + 5 if not is_square(m): for x in range(p): if (x**2 - x - 1) % p == 0: print(p, x) exit()

SymPy has sympy.ntheory.primetest.is_square that performs those faster algorithms.

John, in your opening paragraph you seem to be tacitly saying that every prime that *divides* a number of the form n^2-n-1 can actually be *written* in the form k^2-k-1 (since the former condition is equivalent to the mod-p solvability of the equation). Is there an easy way to see that this fact is true? Or are you not claiming this?

Cf https://oeis.org/A002328