Math 706, Theory of Numbers Kansas State University Spring 2019
Todd Cochrane Department of Mathematics Kansas State University Contents
Notation3
Chapter 1. Axioms for the set of Integers Z 5 1.1. Ring Properties of Z 5 1.2. Order Properties of Z 5 1.3. Discreteness Axioms.6 1.4. Additional Properties of Z.7 Chapter 2. Divisibility and Unique Factorization9 2.1. Divisibility and Greatest Common Divisors9 2.2. Division Algorithms 10 2.3. Euclidean Algorithm 10 2.4. Euclidean Domains 11 2.5. Linear Combinations and GCDLC Theorem 13 2.6. Solving the equation ax + by = d, with d = (a, b) 13 2.7. The linear equation ax + by = c 15 2.8. Primes and Euclid’s Lemma 16 2.9. Unique Factorization in Z 16 2.10. Properties of GCDs and LCMs 17 2.11. Units, Primes and Irreducibles 18 2.12. UFDs, PIDs and Euclidean Domains 19 2.13. Gaussian Integers 20 2.14. The Set of Primes 21
Chapter 3. Modular Arithmetic 25 3.1. Basic properties of congruences 25 3.2. The ring of integers (mod m), Zm 26 3.3. Congruences in general rings 27 3.4. Multiplicative inverses and Cancelation Laws 27 3.5. The Group of units (mod m) and the Euler phi-function 28 3.6. A few results from Group Theory 29 3.7. Fermat’s Little Theorem, Euler’s Theorem and Wilson’s Theorem 29 3.8. Chinese Remainder Theorem 30 3.9. Group of units modulo a prime, G(p) 32 3.10. Group of units G(pe) 34 3.11. Group of units G(m) for arbitrary m 35
Chapter 4. Polynomial Congruences 37 4.1. Linear Congruences 37 4.2. Power Congruences, xn ≡ a (mod m) 37
3 4 CONTENTS
4.3. A general quadratic congruence 39 4.4. General Polynomial Congruences: Lifting Solutions 39 4.5. Counting Solutions of Polynomial Congruences 42
Chapter 5. Quadratic Residues and Quadratic Reciprocity 43 5.1. Introduction 43 5.2. Properties of the Legendre Symbol 43 5.3. Proof of the Law of Quadratic Reciprocity 45 5.4. The Jacobi Symbol 47 5.5. Local solvability implies global solvability 50 5.6. Sums of two Squares 51
Chapter 6. Primality Testing, Mersenne Primes and Fermat Primes 55 6.1. Basic Primality Test 55 6.2. Pseudoprimes and Carmichael Numbers 55 6.3. Mersenne Primes and Fermat Primes 57
Chapter 7. Arithmetic Functions 59 7.1. Properties of Greatest Integer Function and Binomial Coefficients 59 7.2. The Divisor function and Sigma function 60 7.3. Multiplicative Function 60 7.4. Perfect Numbers 62 7.5. The M¨obiusFunction 63 7.6. Estimating Arithmetic Sums 63 7.7. M¨obiusInversion Formula 65 7.8. Estimates for τ(n), σ(n) and φ(n) 66
Chapter 8. Recurrence Sequences 69 8.1. The Fibonacci Sequence 69 8.2. Second order linear recurrences 70 8.3. A Matrix view of the Fibonacci Sequence 70 8.4. Congruence and Divisibility Properties of the Fibonacci Sequence 71 8.5. Periodicity of the Fibonacci sequence (mod m) 72 8.6. Further Properties of the Fibonacci Sequence 74
Chapter 9. Diophantine Equations 77 9.1. Preliminaries 77 9.2. Systems of Linear Equations 77 9.3. Pythagorean Triples 81 9.4. Rational Points on Conics 82 9.5. The Equations x4 + y4 = z2 and x2 + 4y4 = z4 83 9.6. Cubic Curves 84
Chapter 10. Elliptic Curves 87 10.1. Definition of an Elliptic Curve 87 10.2. Addition of Points on an Elliptic Curve 87 10.3. The Projective Plane 89 10.4. Elliptic curves in the projective plane 90 10.5. The Elliptic Curve as an abelian Group 90 10.6. The Pollard (p − 1)-method of Factorization 93 CONTENTS 5
10.7. Elliptic Curve Method of Factorization 94
Chapter 11. Prime Number Theory 97 11.1. Euler-Maclaurin Summation Formula and Estimating Factorials 97 11.2. Chebyshev Estimate for π(x) 98 11.3. Bertrand’s Postulate 100 11.4. The von Mangoldt function and the ψ function 101 11.5. The sum of reciprical primes 103
Chapter 12. Binary Quadratic Forms 105 12.1. Matrix representation of quadratic form 105 12.2. Equivalent Forms and Reduced Forms 106 12.3. Representation by Positive Definite Binary Quadratic Forms 108 12.4. Class Number 109 12.5. Congruence test for Representation 109 12.6. Tree diagram of Values Represented by a Binary Quadratic Form 111
Chapter 13. Geometry of Numbers 113 13.1. Lattices and Bases 113 13.2. Discrete Subgroups of Rn 113 13.3. Minkowski’s Fundamental Theorem 114 13.4. Canonical Basis Theorem and Sublattices 115 13.5. Lagrange’s 4-squares Theorem 116 13.6. Sums of Three Squares 118 13.7. The Legendre Equation 118 13.8. The Catalan Equation 119
Chapter 14. Best Rational Approximations and Continued Fractions 121 14.1. Approximating real numbers by rationals 121 14.2. Continued Fractions 122 14.3. Convergents to Continued Fractions 123 14.4. Infinite Continued Fraction Expansions 125 14.5. Best Rational Approximations to Irrationals 126 14.6. Hurwitz’s Theorem 128 14.7. The set of all best rational approximations 129 14.8. Quadratic Irrationals and Periodic Continued Fractions 130 14.9. Pell Equations 133 14.10. Liouville’s Theorem 136
Chapter 15. Dirichlet Series 139 15.1. Definition and Convergence of a Dirichlet series 139 15.2. Important examples of Dirchlet Series 140 15.3. Another Proof of the M¨obiusInversion Formula 141 15.4. Product Formula for Dirichlet Series 142 15.5. Analytic properties of Dirichlet series 142 15.6. The Riemann Zeta Function and the Riemann Hypothesis 145 15.7. More on the zeta function 146
Appendix A. Preliminaries 149
Appendix B. Proof of Additional Properties of Z 153 6 CONTENTS
Appendix C. Discreteness Axioms for Z 157 C.1. Equivalence of the Discreteness Axioms 157 C.2. Proof of Additional Discreteness Properties 158 C.3. Proof by Induction 158 Appendix D. Review of Groups, Rings and Fields 163 D.1. Definition of a Ring 163 D.2. Basic properties of Rings 164 D.3. Units and Zero Divisors 164 D.4. Integral Domains and Fields 165 D.5. Polynomial Rings 165 D.6. Ring homomorphisms and Ideals 168 D.7. Group Theory 170 D.8. Lagrange’s Theorem 172 D.9. Normal Subgroups and Group Homomorphisms 173 Appendix. Bibliography 175 Notation
N = {1, 2, 3, 4, 5,... } = Natural numbers Z = {0, ±1, ±, 2, ±3,... } = Integers E = {0, ±2, ±4, ±6,... } = Even integers O = {±1, ±3, ±5,... } = Odd integers Q = {a/b : a, b ∈ Z, b 6= 0} = Rational numbers R = Real numbers C = Complex numbers Z[i] = {a + bi : a, b ∈ Z} = Gaussian Integers Zm = Ring of integers mod m [a]m = {a + mx : x ∈ Z} = Residue class of a mod m Um = Multiplicative group of units mod m a−1 (mod m) = “multiplicative inverse of a (mod m)” φ(m) = Euler phi-function (a, b) = gcd(a, b) = greatest common divisor of a and b [a, b] = lcm[a, b] = least common multiple of a and b a|b = “a divides b”
M2,2(R) = Ring of 2 × 2 matrices over a given ring R R[x] = Ring of polynomials over R |S| = order or cardinality of a set S
Sn = n-th symmetric group log(x) = natural logarithm of x
∩ intersection ∪ union ∅ empty set ⊆ subset ∃ there exists ∃! there exists a unique ∀ for all ⇒ implies ⇔ equivalent to iff if and only if ∈ element of ≡ congruent to
7
CHAPTER 1
Axioms for the set of Integers Z
1.1. Ring Properties of Z We shall assume the following properties as axioms for the set of integers.
1.1.1. Addition Properties. There is a binary operation + on Z, called addition, satisfying a) Addition is well defined, that is, given any two integers a, b, a+b is a uniquely defined integer. b) Substitution Law for addition: If a = b and c = d then a + c = b + d. c) The set of integers is closed under addition. For any a, b ∈ Z, a + b ∈ Z. d) Addition is commutative. For any a, b ∈ Z, a + b = b + a. e) Addition is associative. For any a, b, c ∈ Z,(a + b) + c = a + (b + c). f) There is a zero element 0 ∈ Z (also called the additive identity), satisfying 0 + a = a = a + 0 for any a ∈ Z. g) For any a ∈ Z, there exists an additive inverse −a ∈ Z satisfying a + (−a) = 0 = (−a) + a. Note 1.1.1. Properties a),b), and c) above are implicit in the definition of a binary operation on Z. Definition 1.1.1. Subtraction is defined by a − b = a + (−b) for a, b ∈ Z. 1.1.2. Multiplication Properties. There is an operation · (or ×) on Z called multiplication, satisfying, a) Multiplication is well defined, that is, given any two integers a, b, a · b is a uniquely defined integer. b) Substitution Law for multiplication: If a = b and c = d then ac = bd. c) Z is closed under multiplication. For any a, b ∈ Z, a · b ∈ Z. d) Multiplication is commutative. For any a, b ∈ Z, ab = ba. e) Multiplication is associative. For any a, b, c ∈ Z,(ab)c = a(bc). f) There is an identity element 1 ∈ Z satisfying 1 · a = a = a · 1 for any a ∈ Z. 1.1.3. Distributive law. This is the one property that combines both ad- dition and multiplication. For any a, b, c ∈ Z, a(b + c) = ab + ac. One can de- duce (from the given axioms) the additional distributive laws, (a + b)c = ac + bc, a(b − c) = ab − ac and (a − b)c = ac − bc.
1.2. Order Properties of Z 1.2.1. Trichotomy Principle. The set of integers can be partitioned into a union of three disjoint sets, Z = −N ∪ {0} ∪ N, where N is called the set of positive integers or natural numbers, and −N := {−x : x ∈ N} the set of negative integers.
9 10 1. AXIOMS FOR THE SET OF INTEGERS Z
The inequalities > (greater than) and < (less than) are defined as follows: a > b if a−b ∈ N; a < b if a−b ∈ −N. Thus the Trichotomy Principle is equivalent to the Law of Trichotomy, which states that for any two integers a, b exactly one of the following holds: a < b, a = b or a > b, (that is a − b ∈ −N, a − b = 0 or a − b ∈ N.) 1.2.2. Positivity Axioms. a) The sum of two positive integers is a positive integer. b) The product of two positive integers is a positive integer.
An important consequence of the second positivity axiom is that 1 is a positive integer. Indeed, if 1 was negative, then by trichotomy, −1 is positive, and so (−1)(−1) is positive by the positivity axiom. But, by one of the properties of negatives (see below), (−1)(−1) = 1, implying that 1 is positive, a contradiction.
1.3. Discreteness Axioms.
The following four axioms are equivalent, that is, in defining Z we may start with any one of these axioms, and then deduce the others from that one. See AppendixC for a proof and further discussion. a) Well Ordering Property of N. Any nonempty subset of N has a smallest element. b) Axiom of Induction. Let S be a subset of N such that (i) 1 ∈ S and (ii) n ∈ S ⇒ n + 1 ∈ S. Then S = N. c) Maximum Element Principle. Any nonempty subset of Z, bounded above has a largest element. (Recall, a set S is bounded above if there exists an integer M such that for all x ∈ S, x ≤ M.) d) Minimum Element Principle. Any nonempty subset of integers bounded below has a minimum element. (Recall, a set S is bounded below if there exists an integer M such that for all x ∈ S, x ≥ M.) Other important consequences of the discreteness axioms are the following. 1) Minimality of 1. 1 is the smallest positive integer, that is, there is no integer between 0 and 1. This simple fact turns out to be a powerful tool in many proofs in number theory. 2) Natural Numbers are sums of 1’s. Every positive integer is a (finite) sum of 1’s. That is, N = {1, 2, 3,... }, where as usual, 2 := 1 + 1, 3 := 1 + 1 + 1, and so on. 3) Strong Form of Induction. Let S be a subset of N such that (i) 1 ∈ S and (ii) If {1, 2, . . . , n} ⊆ S then n + 1 ∈ S. Then S = N. See Appendix C.3 for examples of induction proofs. 1.4. ADDITIONAL PROPERTIES OF Z. 11
1.4. Additional Properties of Z. The properties below can all be deduced from the axioms above. You may freely use them in your homework for this class. See AppendixB for proofs. 1] Subtraction-Equality principle. x = y if and only if x − y = 0. 2] Cancelation law for addition: If a + x = a + y then x = y. 3] Additive inverses are unique, that is, if a, b, c are integers such that a + b = 0 and a + c = 0 then b = c.
4] Zero multiplication property: a · 0 = 0 for any a ∈ Z. 5] Properties of negatives: −(−a) = a,(−a)b = −(ab) = a(−b), (−a)(−b) = ab, (−1)a = −a. 6] Basic consequence of Trichotomy: If a > 0 then −a < 0 and if a < 0 then −a > 0. 7] Products of Positives and Negatives: If a > 0 and b < 0 then ab < 0. If a < 0 and b < 0, then ab > 0. 8] Zero divisor property, or integral domain property: If ab = 0 then a = 0 or b = 0. 9] Cancelation law for multiplication: If ax = ay and a 6= 0 then x = y. 10] General Associative-Commutative Law: a) Addition: When adding a collection of n integers a1 + a2 + ··· + an, the numbers may be grouped in any way and added in any order. In particular, the sum a1 +a2 +···+an is well defined, that is, no parentheses are necessary to specify the order of operations. b) Multiplication: When multiplying a collection of n integers a1a2 ··· an, the numbers may be grouped in any way and multiplied in any order. In particular, the product a1a2 ··· an is well defined, that is, no parentheses are necessary to specify the order of operations. 11] General Distributive Laws such as (a + b)(c + d) = ac + ad + bc + bd, or Pn Pm Pn Pm ( i=1 ai) j=1 bj = i=1 j=1 aibj. 12] Binomial Expansion Formula: For any integers a, b and positive integer n we have n Pn n k n−k n n n−1 n n−2 2 n (a + b) = k=0 k a b = a + 1 a b + 2 a b + ··· + b . In particular, (a + b)2 = a2 + 2ab + b2 (a + b)3 = a3 + 3a2b + 3ab2 + b3.
CHAPTER 2
Divisibility and Unique Factorization
2.1. Divisibility and Greatest Common Divisors
Definition 2.1.1. Let a, b ∈ Z, a 6= 0. We say that a divides b and write a|b if b = ax for some integer x. In this case, we also say that a is a divisor of b, b is divisible by a and that b is a multiple of a. Note 2.1.1. i) The divisors of an integer can be positive or negative. Thus the divisors of 6 are 1, −1, 2, −2, 3, −3, 6, −6. ii) Every nonzero integer is a divisor of 0. Why? iii) Since 0 · 0 = 0, it is reasonable to say that 0 divides 0, but we rule this language out for technical reasons. For instance, we want to be able to say that if a divides b then b/a is an integer. It is for this reason that we put a 6= 0 in the definition of divisibility. Theorem 2.1.1. Sum and difference properties for divisibility. i) For any a, b, d ∈ Z, if d|a and d|b then d|(a + b) and d|(a − b). ii) For any a, b, d, x, y ∈ Z, if d|a and d|b then d|(ax + by). Proof. i) is just a special case of ii), putting x = y = 1, x = 1, y = −1 respectively. Thus it suffices to prove ii). ii) Let x, y ∈ Z and suppose that d|a and d|b. Then a = du, b = dv for some u, v ∈ Z. Thus ax + by = (du)x + (dv)y = d(ux) + d(vy) = d(ux + vy), and so d|(ax + by) since ux + vy ∈ Z. Theorem 2.1.2. Transitive property of divisibility. If d|a and a|b then d|b. Proof. Suppose that d|a and a|b. Then a = dx, b = ay, for some x, y ∈ Z. Thus, b = ay = (dx)y = d(xy), and so d|b since xy ∈ Z. Definition 2.1.2. i) Let a, b ∈ Z, not both zero. The greatest common divisor of a and b, written (a, b) or gcd(a, b), is the largest positive integer dividing both a and b. ii) If (a, b) = 1 we say that a and b are relatively prime. Note 2.1.2. i) (0,0) is not defined. Why? ii) If d|b and b 6= 0 then |d| ≤ |b| .
Proof. We may assume that b and d are positive. Say b = dq for some q ∈ Z. Note, q ≥ 1 since b > 0. Thus b − d = dq − d = d(q − 1) ≥ 0 and so b ≥ d. iii) (0, m) = |m| for any nonzero integer m. Why? iv) If a, b are not both 0 then (a, b) is defined. Proof. Let S be the set of common divisors of a and b. Plainly 1 ∈ S (and so S is nonempty) and, by note ii), S is bounded above by |b|. Thus, by the maximum element principle, S has a maximum element.
13 14 2. DIVISIBILITY AND UNIQUE FACTORIZATION
Lemma 2.1.1. The GCD Invariance Property. For any integers a, b, q with a and b not both zero, we have (a − qb, b) = (a, b). Proof. Let S be the set of common divisors of a and b, and T the set of common divisors of a − qb and b. We claim that S = T , and so S and T have the same maximal element, that is, gcd(a, b) = gcd(a − qb, b). To show S = T it suffices to show S ⊆ T and T ⊆ S. Suppose that d ∈ S, that is, d|a and d|b. Then by the sum and difference property of divisibility, d|a − qb. Therefore, d ∈ T . Similarly, if d ∈ T , that is, d|b and d|a − qb, then d|[(a − qb) + qb], that is, d|a. Therefore, d ∈ S. Note 2.1.3. i) The concept of gcd extends easily to any number of integers: For a1, . . . , ak ∈ Z, not all zero we define (a1, . . . , ak) to be the greatest common divisor of a1, . . . , ak. ii) We have a generalization of the gcd invariance property: For any integer q, (a1, . . . , an) = (a1 − qai, a2 . . . , an). iii) The concept of divisibility can be defined identically as above for any com- mutative ring. For noncommutative rings, one can define left and right divisibility, but we shall not pursue this here.
2.2. Division Algorithms Theorem 2.2.1. The Division Algorithm. For any integers a, b with b 6= 0 there exist unique integers q, r such that a = qb + r, and 0 ≤ r < |b|. (Here, q is called the quotient and r the remainder in dividing a by b.) Proof. We’ll prove the case where b > 0 and leave b < 0 as an exercise for the reader. Existence: If a = 0 we take q = r = 0. Suppose that a 6= 0. Let S = {x ∈ Z : xb ≤ a}. Since b > 0, S is bounded above by |a|, and thus it has a maximal element, say q. Thus qb ≤ a < (q + 1)b. Put r = a − qb. Then 0 ≤ r < b and a = qb + r. Uniqueness: Suppose that q1b + r1 = q2b + r2 with 0 ≤ r1, r2 < b. Then |q1 − q2|b = |r2 − r1| < b, and so |q1 − q2| < 1. Thus, since there is no integer between 0 and 1, q1 − q2 = 0. Therefore q1 = q2 and consequently r1 = r2. Theorem 2.2.2. Minimal Remainder Division Algorithm. Let a, b be integers with b > 0. Then there exist integers q, r such that a = qb + r with |r| ≤ b/2.
Proof. Start with the ordinary division algorithm to produce q0, r0 ∈ Z with a = q0b + r0, 0 ≤ r0 < b. If r0 ≤ b/2 we are done, that is, we can take q = q0, r = r0. Assume next that r0 > b/2. Then a = (q0 + 1)b + r0 − b and |r0 − b| < b/2. Thus we 0 0 take q := q + 1 and r = r − b. Example 2.2.1. Consider 29 ÷ 5. Using the ordinary division algorithm we would write 29 = 5 · 5 + 4. Using the minimal remainder division algorithm we would write 29 = 6 · 5 − 1.
2.3. Euclidean Algorithm The Euclidean Algorithm provides a simple procedure for calculating the great- est common divisor of any two integers. There are two versions of it, the traditional 2.4. EUCLIDEAN DOMAINS 15 algorithm in which a positive remainder is used at each step, and the Fast Euclidean Algorithm in which the least remainder is chosen at each step. The Traditional Euclidean Algorithm. Let a ≥ b > 0 be positive integers. Then, by the Division Algorithm and GCD Invariance Property, Lemma 2.1.1, we have
a = bq1 + r1, 0 ≤ r1 < b, (a, b) = (r1, b)
b = r1q2 + r2, 0 ≤ r2 < r1, (a, b) = (r1, r2)
r1 = r2q3 + r3, 0 ≤ r3 < r2, (a, b) = (r3, r2) ...
rk−3 = rk−2qk−1 + rk−1, 0 ≤ rk−1 < rk−2, (a, b) = (rk−1, rk−2)
rk−2 = rk−1qk, (a, b) = rk−1.
Since r1 > r2 > ··· > rk−1 we are guaranteed that this process will stop in a finite number of steps. Note 2.3.1. i) In the Fast Euclidean Algorithm, one chooses the least remainder at each step (allowing for positive or negative remainders), and thus we would have |rj| ≤ |rj−1/2| at each step. Thus |r1| ≤ b/2, |r2| ≤ b/4, and (by j induction) |rj| ≤ b/2 for any j. The algorithm stops if |rj| < 1. It follows that the number of steps k is at most log2 b + 1. (The extra +1 is needed for trivial cases such as (3, 2).) Thus the algorithm is extremely efficient for calculating gcds of large numbers. ii) In the Traditional Euclidean Algorithm, it can be shown that the running time is slowest for calculating gcds of consecutive Fibonacci numbers. Indeed, the calculation of (Fn,Fn+1), requires n − 1 steps. (Ex. (F6,F7) := (8, 13) = (8, 5) = (3, 5) = (3, 2) = (1, 2) = (1, 0).) It follows that the number of steps for calculating (a, b) for any integers a, b with a ≥ b > 0 is at most log b, where √ ϕ 1+ 5 ϕ = 2 = 1.618..., the golden ratio. 2.4. Euclidean Domains The Euclidean algorithm can be applied to many integral domains other than the integers. Such integral domains are called Euclidean domains. Definition 2.4.1. Let D be an integral domain and D∗ the set of nonzero elements in D. Then D is called a Euclidean domain if there exists a mapping δ : D∗ → N ∪ {0}, such that i) δ(a) ≤ δ(ab) for all nonzero a, b ∈ D. ii) For any a, b ∈ D, b 6= 0, there exist elements q, r ∈ D with a = qb + r, and r = 0 or δ(r) < δ(b). We note that there are many slight variations in the definition of a Euclidean domain in the literature, but we will not concern ourselves with this subtlety here. Note 2.4.1. i) In any Euclidean domain the concept of divisibility and greatest common divisor can be defined as for the case of Z, the only difference being in the meaning of the word “greatest”. Here, “greatest” means with respect to the mapping δ. ii) By property i) it follows that if a is nonzero and d|a then δ(d) ≤ δ(a). Thus if a|b and b|a, that is, a and b differ by a unit multiple, then δ(a) = δ(b). 16 2. DIVISIBILITY AND UNIQUE FACTORIZATION
iii) The greatest common divisor of two elements of a Euclidean domain, not both zero, is defined, but is not unique. Indeed, by note ii) and the fact that any common divisor of two elements a, b is a divisor of the greatest common divisor (see next section), it follows that (a, b) is unique up to unit multiples. Thus in Z we could say ±3 is the greatest common divisor of 6, 9 in this context, but we will maintain the convention that for Z, greatest common divisors are always positive. iv) The Euclidean algorithm can be applied as in the previous section to find the greatest common divisor of any two nonzero elements of a Euclidean domain. In this case instead of r1 > r2 > ··· > rk−1 we would have δ(r1) > δ(r2) > ··· > δ(rk−1).
Theorem 2.4.1. The set of integers Z is a Euclidean domain with respect to the mapping δ(n) = |n|.
Proof. We trivially have |a| ≤ |ab| for all nonzero integers a, b, and the Divi- sion Algorithm, Theorem 2.2.1, gives us property ii) in the definition.
Another standard example of a Euclidean domain is any polynomial ring over a field. We will be particularly interested in this result for the case of the finite fields Zp, with p a prime. Theorem 2.4.2. Division Algorithm for Polynomials. Let F be a field and f(x), g(x) ∈ F [x] with g(x) 6= 0. Then there exist polynomials q(x), r(x) over F such that
f(x) = q(x)g(x) + r(x), with r(x) = 0 or deg(r(x)) < deg(g(x)).
The polynomial q(x) is called the quotient and r(x) the remainder.
A proof is provided in the appendix.
Corollary 2.4.1. Any polynomial ring over a field is a Euclidean domain with respect to the mapping δ(f(x)) = deg(f(x)).
Proof. It is easy to prove that for any nonzero polynomials f(x), g(x) over any integral domain, deg(f(x)g(x)) = deg(f(x)) + deg(g(x)), and thus property i) holds. The division algorithm of the preceding theorem yields property ii).
Note 2.4.2. The units in a polynomial ring over a field are just the nonzero constant polynomials. Thus the greatest common divisor of two polynomials is unique up to constant multiples. In this case one can adopt the convention of taking the gcd to be a monic polynomial, that is, a polynomial with leading coefficient 1.
Another important example of a Euclidean domain that we shall occasionally make reference to is the ring of Gaussian integers in C,
Z[i] = {a + bi : a, b ∈ Z}. We leave the following as an exercise for the reader.
Homework 2.4.1. Prove that the ring of Gaussian integers is a Euclidean domain with respect to the mapping δ(a + bi) = a2 + b2 = |a + bi|2. 2.6. SOLVING THE EQUATION ax + by = d, WITH d = (a, b) 17
2.5. Linear Combinations and GCDLC Theorem Definition 2.5.1. A linear combination of two integers a, b (with integer coefficients) is an integer of the form ax + by with x, y ∈ Z. Such a combination is also called an integral linear combination.
Theorem 2.5.1. Greatest Common Divisor Linear Combination (GCDLC) Theorem. For any integers a, b, not both zero, the greatest common divisor d of a, b can be expressed as a linear combination of a, b with integer coefficients. In particular, d is the smallest positive linear combination a, b.
This theorem is also referred to as B´ezout’sLemma. A constructive proof of the the- orem can be given by following the Euclidean Algorithm together with the method of back substitution as we illustrate in Example 2.6.1. We will present here a non-constructive proof based on the following lemma.
Lemma 2.5.1. Every additive subgroup of Z is of the form (d) := {dx : x ∈ Z}, for some nonnegative integer d.
Proof. Let H be an additive subgroup of Z. If H = (0), then we simply take d = 0. Otherwise H contains some nonzero element h. By taking the additive inverse of h if necessary, we see that H ∩N is nonempty. Thus, by the Well Ordering Axiom, H ∩ N has a minimum element d. We claim that H = (d). Certainly, (d) ⊆ H since H is closed under addition and subtraction. Next, lets show that H ⊆ (d). Let h ∈ H. Then h = qd + r for some integers q, r with 0 ≤ r < d. Now r = h−qd ∈ H, and thus by the minimality of d we must have r = 0. Consequently h = qd ∈ (d).
Proof of Theorem 2.5.1. Let H = (a) + (b) = {ax + by : x, y ∈ Z}, the set of all linear combinations of a and b. Plainly H is an additive subgroup of Z, since it is closed under subtraction. Thus, by the preceding lemma, H = (d) for some nonnegative integer d, and since a, b are not both zero, we must have d > 0, and that d is the smallest positive linear combination of a and b. Say , d = ax0 + by0 for some x0, y0 ∈ Z. We claim that d = (a, b). Since a, b ∈ H we have d|a and d|b. Next, suppose that e is any common divisor of a, b. Then, e is also a divisor of the linear combination ax0 + by0, that is, e|d, and therefore e ≤ d.
2.6. Solving the equation ax + by = d, with d = (a, b) The Euclidean algorithm provides us with an algorithm for solving the equation
ax + by = d, where d = (a, b). We shall present two variations of the algorithm the first being the method of Back Substitution and the second, the Array Method. Back Substitution: We start by finding (a, b) using either the traditional or fast Euclidean algorithm, and then work our way backwards through the equations to find x and y. 18 2. DIVISIBILITY AND UNIQUE FACTORIZATION
Example 2.6.1. Find d = gcd(126, 49) and express it as a linear combination of 49 and 126. (1) 126 = 2 · 49 + 28, d = gcd(28, 49) (2) 49 = 28 + 21, d = gcd(28, 21) (3) 28 = 21 + 7, d = gcd(7, 21) (4) 21 = 3 · 7, d = gcd(7, 0) = 7,STOP Next we use back substitution. Start with equation (3): 7 = 28 − 21. By (2) we have 21 = 49 − 28. Substituting this into previous yields 7 = 28 − (49 − 28) = 2 · 28 − 49. By (1) we have 28 = 126 − 2 · 49. Substituting this into previous yields 7 = 2 · (126 − 2 · 49) − 49 = 2 · 126 − 5 · 49. Array Method. Example 2.6.2. We shall redo the previous example using the array method. To begin, set up an array with the first three columns initialized as shown below. For a given choice of x and y the linear combination 126x + 49y is given in the first row. Now, perform the Euclidean Algorithm on the numbers in top row, but do the corresponding column operations on the entire array. Let C1 be the column with top entry 126, C2 the column with top entry 49, etc.. The first step in the Euclidean algorithm is to subtract 2 times 49 from 126, so we let the next column C3 be given by C3 = C1 − 2C2. Then C4 = C2 − C3, C5 = C3 − C4. 126x + 49y 126 49 28 21 7 x 1 0 1 −1 2 y 0 1 −2 3 −5 Thus, 7 = 2 · 126 − 5 · 49. Example 2.6.3. Use the array method to find gcd(83, 17) and express it as a linear combination of 83 and 17. 83x + 17y 83 17 15 2 1 x 1 0 1 −1 8 y 0 1 −4 5 −39 Thus (83, 17) = 1 and 1 = 8 · 83 − 39 · 17. Note 2.6.1. From a programming point of view, the array method is more efficient than the method of back substitution. In particular, there is no need to store the values qi, ri in memory as would be required for the method of back substitution. Homework 2.6.1. Use the array method to find x, y such that 423x + 198y = (423, 198). Note 2.6.2. The GCDLC theorem generalizes to more than two integers: For any integers a1, . . . , ak not all zero, there exist integers x1, x2, . . . , xn such that a1x1 + ··· + anxn = (a1, . . . , an), and the GCD is the smallest positive such linear combination of a1, . . . , ak. Homework 2.6.2. i) Use the array method to find gcd(90, 126, 210), and ex- press it as a linear combination of 90, 126 and 210. ii) Use the array method to find gcd(30, 42, 105), and express it as a linear combination of 30,42 and 105. 2.7. THE LINEAR EQUATION ax + by = c 19
2.7. The linear equation ax + by = c Consider the linear equation (2.1) ax + by = c, where a, b, c ∈ Z, and the companion homogeneous equation (2.2) ax + by = 0. Lemma 2.7.1. An integer pair (x, y) is a solution of (2.2) if and only if −b a (x, y) = λ , , d d for some λ ∈ Z, where d = gcd(a, b). −b a Proof. It is trivial to check that any point of the form λ d , d is a solution a b of (2.2). Conversely, if (x, y) is a solution of (2.2), then ax = −by, d x = − d y, a a and so by Euclid’s Lemma, d |y. Say y = λ d for some λ ∈ Z. Then we also have b b x = − d y = λ d . Lemma 2.7.2. Let a, b, c ∈ Z, d = gcd(a, b). Then (2.1) has an integer solution if and only if d|c. Proof. If (2.1) has an integer solution then c = ax + by for some x, y ∈ Z. Since d|a and d|b it follows that d|c. Conversely, suppose that c = dk for some k ∈ Z. By Theorem 2.5.1, we have d = ax0 + by0 for some x0, y0 ∈ Z. Thus c = dk = a(x0k) + b(y0k) and so (2.1) is solvable.
Suppose now that (x0, y0) is any particular solution of (2.1). By linearity, it follows that every solution of (2.1) is of the form
(x, y) = (x0, y0) + (x1, y1), where (x1, y1) is a solution of (2.2). Thus we obtain the following theorem. Theorem 2.7.1. Let d = gcd(a, b). Then (2.1) is solvable if and only if d|c, in which case the general solution of (2.1) is given by −b a (x, y) = (x , y ) + λ , , 0 0 d d where λ ∈ Z and (x0, y0) is any particular solution of (2.1). Geometric interpretation: Solving (2.1) is equivalent to finding all integer points on the line ax + by = c. The theorem tells us that if there exists an integer point on the line, then all integer points are obtained by starting at a fixed integer point −b a (x0, y0) on the line and adding integer multiples of the direction vector ( d , d ). Homework 2.7.1. Assume that a, b and c are all positive. Suppose that we wish to find integer points on the line in the first quadrant (x > 0, y > 0). Show that if ba ≤ cd then there exists at least one solution in the quadrant, and that the total number of solutions in the first quadrant is [cd/ab] or [cd/ab] + 1. Homework 2.7.2. Baseball schedule. Say we have two leagues with 7 teams each. Each team plays each team in the other league y games and each team in their own league x games. If there are 162 games in the season, find the best choice for x and y, that is, the “optimal” integer solution of the equation 6x + 7y = 162 with x, y both positive. 20 2. DIVISIBILITY AND UNIQUE FACTORIZATION
2.8. Primes and Euclid’s Lemma Definition 2.8.1. i) A positive integer p > 1 is called a prime if its only positive factors are 1 and itself. ii) A positive integer n > 1 is called a composite if it is not a prime, that is, n = ab for some positive integers a, b with a > 1 and b > 1. Note 2.8.1. 1 is not a prime or a composite. There are a couple reasons why 1 is not called a prime. The most important reason is that if 1 is a prime then we would not have unique factorization. For example, 6 = 2 · 3 = 1 · 2 · 3 = 1 · 1 · 2 · 3, etc. would all be different factorizations of 6. Another reason is that 1 just has a single positive factor, whereas every prime has two distinct positive factors. Lemma 2.8.1. Euclid’s Lemma. If a|bc and (a, b) = 1 then a|c. Proof. By the GCDLC theorem, since (a, b) = 1, ax + by = 1 for some x, y ∈ Z. Thus c = c(ax + by) = cax + cby = c(ax) + y(bc). Since a|ax and a|bc it follows that a|c(ax) + y(bc), that is, a|c. In general it is a false statement to say that if a|bc then a|b or a|c, but for the case of prime divisors a, the statement is true. Lemma 2.8.2. a) Let p be a prime such that p|ab. Then p|a or p|b. b) Let p be a prime such that p|a1a2 . . . an where ai are integers. Then p|ai for some i.
Proof. a) Suppose that p|ab. If p|a we are done. Otherwise p - a. But in this case gcd(p, a) = 1 because the only positive divisors of p are 1 and p, and only 1 is a common divisor of both p and a (since p - a.) Thus, by Euclid’s lemma we must have p|b. b) We prove part b) by induction on n, the base case n = 1 being trivial. Suppose the statement is true for a given n, and now consider the case n + 1. Suppose that p|a1 ··· anan+1. Then p|(a1 ··· an)an+1. Viewing the latter quantity as a product of two integers, we see by the case n = 2 proven above, that either p|a1 ··· an or p|an+1. In the former case we have p|ai for some i ≤ n by the induction hypothesis. Thus, in both cases p|ai for some i.
2.9. Unique Factorization in Z Theorem 2.9.1. Fundamental Theorem of Arithmetic, FTA. Any positive in- teger n > 1 can be expressed as a product of primes, and this expression is unique up to the order of the primes. Note 2.9.1. i) 12 = 2 · 2 · 3 = 2 · 3 · 2 = 3 · 2 · 2, are all considered the same factorization. ii) We say that a prime p has a trivial factorization as a product of primes. Proof. Existence. The proof is by the strong form of induction. Let P (n) be the statement that n has a factorization as a product of primes. P (2) is trivially true since 2 is a prime. Suppose now that P (k) is true for all values of k smaller than a given n and consider P (n). If n is prime we are done. Otherwise n = ab for some integers a, b with 1 < a < n, 1 < b < n. By the induction assumption, a and b can be expressed as products of primes, say a = p1 ··· pk, b = q1 ··· q`. Then ab = p1 ··· pkq1 ··· q`, a product of primes. QED 2.10. PROPERTIES OF GCDS AND LCMS 21
Uniqueness. Suppose that n is a positive integer with two representations as a product of primes, say,
(2.3) n = p1 ··· pk = q1 ··· qr for some primes pi, qj, 1 ≤ i ≤ k, 1 ≤ j ≤ r. We may assume WLOG (without loss of generality) that k ≤ r. Then p1|q1 . . . qr, so by the preceding lemma, p1|qi1 for some i1 ∈ {1, 2, . . . , r}. Since p1 and qi1 are primes, we must have p1 = qi1 . Canceling p1 in (2.3) yields
(2.4) p2p3 ··· pk = q1 ··· qˆi1 ··· qr, whereq ˆi1 indicates that this factor has been removed. We can then repeat the argument with p2 in place of p1, and conclude that p2 = qi2 for some i2 6= i1. After repeating this process k times we have that
(2.5) p1 = qi1 , p2 = qi2 , . . . , pk = qik for some distinct integers i1, i2, . . . , ik ∈ {1, 2, . . . , r}. Moreover, after canceling each of the pi from (2.3) we are left with 1 on the left-hand side. If r > k then (2.3) would say that 1 is a product of primes, a contradiction. Therefore r = k, and so by (2.5), the primes pi are just a permutation of the primes qi. Definition 2.9.1. Suppose that p is a prime. We write peka if pe|a and pe+1 - a. e is called the multiplicity of p dividing a. (This value is well defined by unique factorization.) The Fundamental Theorem of Arithmetic can be restated as follows: Theorem 2.9.2. Every positive integer n > 1 can be uniquely expressed as a e1 e2 ek product of distinct prime powers, n = p1 p2 . . . pk . (Here, ei is the multiplicity of pi dividing n.) 2.10. Properties of GCDs and LCMs
Lemma 2.10.1. Let a, b, c ∈ Z with a, b not both zero. i) Every common divisor of a, b divides (a, b). ii) If a|c, b|c and (a, b) = 1, then ab|c. Proof. i) If e|a and e|b then for any x, y ∈ Z, e|(ax + by). In particular, by GCDLC theorem e|(a, b). ii) We’ll leave as homework. Definition 2.10.1. The least common multiple, LCM of two nonzero integers a, b denoted [a, b] is the smallest positive integer divisible by both a and b. Note 2.10.1. [a, b] exists and is unique for any nonzero a, b. Theorem 2.10.1. Let a, b be nonzero integers. Then i) [a, b](a, b) = |ab|. ii) Every common multiple of a, b is a multiple of [a, b]. Proof. We prove both parts simultaneously. Set R = ab/(a, b). Note R = a b (a,b) b = (a,b) a ∈ Z, and is a common multiple of a and b. Suppose now that m is any common multiple of a and b, say m = as, m = bt for some s, t ∈ Z. Now, by GCDLC theorem, ax+by = (a, b) for some x, y ∈ Z. Thus, m(a, b) = max+mby = ab(tx + sy) and so m = R(tx + sy), a multiple of R. In particular |m| ≥ |R|. Thus we see that |R| is the least common multiple of a and b, and that every other common multiple is a multiple of |R|. 22 2. DIVISIBILITY AND UNIQUE FACTORIZATION
A second proof of the theorem can be given using prime power factorizations. First we note the following.
Lemma 2.10.2. Suppose that p is a prime and that d, a ∈ Z with d|a. If pekd and pf ka, then e ≤ f. Proof. Since pe|d and d|a we have pe|a. Therefore e ≤ f, by definition of f. One readily deduces from this lemma the following theorem. Theorem 2.10.2. Suppose that a, b are positive integers with factorizations e1 ek f1 fk a = p1 ··· pk , b = p1 ··· pk , (allowing zero exponents if necessary). Then
min(e1,f1) min(ek,fk) (a, b) = p1 ··· pk , and max(e1,f1) max(e1,f1) [a, b] = p1 ··· pk . Note 2.10.2. As a corollary of this theorem we obtain another proof of the multiplication formula (a, b)[a, b] = |ab|, seen in Theorem 2.10.1.
Proof. It suffices to prove the property for positive a, b. It follows immedi- ately from the identities in the preceding theorem and the fact that max(e, f) + min(e, f) = e + f.
2.11. Units, Primes and Irreducibles Definition 2.11.1. Let D be an integral domain and a 6= 0 ∈ D. Then i) a is a unit if a has a multiplicative inverse in D. ii) a is composite if it can be expressed as a product a = bc with b and c nonunits. iii) a is irreducible if a is not a unit and not composite. iv) a is a prime if a is not a unit and whenever a|bc with b, c ∈ D then a|b or a|c. Note: Every nonzero element in D is either a unit, composite or irreducible.
Example 2.11.1. i) The units in Z are ±1. The units in Z[i] are {1, −1, i, −i}. The units in R[x] where R is an integral domain are just the units in R. ii) The irreducibles in Z are {±2, ±3, ±5, ...}. Lemma 2.11.1. In any integral domain, the set of units is a multiplicative group.
−1 −1 −1 Proof. Elementary. We just observe that (ab) = b a . Lemma 2.11.2. In any integral domain the primes are irreducible. Proof. Suppose p is a prime in an integral domain D and that p = ab for some a, b ∈ D. Then p|ab and so p|a or p|b by the definition of prime. Without loss of generality say p|a, that is pk = a for some k ∈ Z. Then, by substitution, p = (pk)b and so bk = 1, implying that b is a unit. Therefore p is irreducible. 2.12. UFDS, PIDS AND EUCLIDEAN DOMAINS 23
Note 2.11.1. i) The converse√ of the lemma is false as the√ following√ example shows.√ Consider the ring Z[ −6]. Note 2 is irreducible, 2|(2 + −6)(2 − −6) and 2 - 2 ± −6. The details are left for homework. ii) In any principal ideal domain, prime and irreducible mean the same thing. In particular, such is the case for Z. iii) It is generally a convention in Number Theory for the word prime to mean positive prime, although this differs slightly from the algebraic definition of prime given in this section. iv) The set of irreducibles in Z are ±2, ±3, ±5, .... Definition 2.11.2. Two elements a, b in an integral domain are called asso- ciates, written a ∼ b if a = ub for some unit u. Lemma 2.11.3. i) If a|u and u is a unit, then a is a unit. ii) If p, q are irreducibles and p|q then p ∼ q.
2.12. UFDs, PIDs and Euclidean Domains Definition 2.12.1. An integral domain D is called a Unique Factorization Domain UFD if every nonzero element a of D has an essentially unique factor- ization into a product of irreducibles,
a = up1p2 . . . pk, where u is a unit, and p1, ... , pk are irreducible elements. By essentially unique we 0 0 0 mean that if a has a second such factorization, say a = u p1 . . . p`, then ` = k and 0 there exists a permutation σ of {1, . . . , k} such that pi = uipσ(i) for some units ui. In this language we can restate the Fundamental Theorem of Arithmetic as follows.
Theorem 2.12.1. The Fundamental Theorem of Arithmetic. Z is a Unique Factorization Domain. The astute reader will have noted that the ingredients we needed to prove the Fundamental Theorem of Arithmetic belong to any Euclidean Domain. For the existence part of the factorization one can induct on the value of δ(a). For the uniqueness part, one can prove in an identical manner the analogue of Euclid’s Lemma, since in any Euclidean Domain the greatest common divisor of two elements can be expressed as a linear combination of them. Thus we have Theorem 2.12.2. Any Euclidean Domain is a Unique Factorization Domain. Homework 2.12.1. Let S = {1, 2, 4, 6, 8, 10,... }, a monoid under multiplica- tion. (i) Describe the irreducible elements of S. (Note, although S is not an integral domain, we can define the concept of irreducible and prime in the same manner.) (ii) Show that every element of S can be factored into a product of irreducibles. (iii) Find an irreducible element in S that is not a prime. (iv) Show that factorization is not unique. 2.12.1. Principal Ideal Domains. A more general example of Unique Fac- torization Domains are the Principal Ideal Domains. Definition 2.12.2. A Principal Ideal Domain, PID is an integral domain D in which every ideal is principal, that is, of the form (a) = {xa : x ∈ D}. 24 2. DIVISIBILITY AND UNIQUE FACTORIZATION
Homework 2.12.2. For any integers a, b not both zero, prove that (a) + (b) = ((a, b)), and (a) ∩ (b) = ([a, b]). Theorem 2.12.3. If D is a Euclidean domain then D is a PID. Proof. Let D be a Euclidean domain with respect to the mapping δ. Let I be a nonzero ideal in D and let a ∈ I be such that δ(a) is minimal. Then for any b ∈ I we have b = qa + r with either r = 0 or δ(r) < δ(a). Now r = b − qa ∈ I, and so by minimality of δ(a), we must have r = 0. Therefore a|b, that is b ∈ (a). Thus I = (a). Example 2.12.1. Z, Z[i] and F [x] for any field F , are all PIDs. Theorem 2.12.4. If D is a Principal Ideal Domain, then D is a Unique Fac- torization Domain. Proof. We only give a rough sketch here. See for example Jacobson’s Basic Algebra I for details. One starts by generalizing our proof above for Z to show that in a PID, any irreducible is a prime. Existence: First note that any ascending chain of ideals is stationary, since the union of the ideals in the chain is again a principal ideal. Next, suppose that a is a nonzero element of D having no factorization into a product of primes. Then one can construct an infinite sequence of elements {an} in D with (a1) ( (a2) ( (a3) ( ... , a contradiction. Uniqueness: Since primes and irreducibles are the same thing in a UFD we again have the lemma that says if p is irreducible and p|a1 ··· ak, then p|ai for some i. Thus we can repeat the proof we gave for Z. Of course, Theorem 2.12.3 and Theorem 2.12.4 together yield another proof that any Euclidean Domain is a UFD, Theorem 2.12.2. One further example of a UFD’s is the following. Theorem 2.12.5. If D is a UFD then so is the polynomial ring D[x].
Proof. See Jacobson Basic Algebra I. Example 2.12.2. Z[x] is a UFD although not a PID. The ideal < 5, x > is not principal. By induction one then gets that Z[x1, x2, . . . , xn] is a UFD.
2.13. Gaussian Integers
In your homework, you established that the ring of Gaussian Integers Z[i] was a Euclidean domain with respect to the mapping δ(a + bi) = a2 + b2. Thus we have by Theorem 2.12.2 the following. Theorem 2.13.1. The Gaussian integers are a Unique Factorization Domain.
Homework 2.13.1. Let p be a prime in Z. Show that p is reducible in Z[i] if and only if p is a sum of two squares, that is, p = a2 + b2 for some integers a, b. Make use of the fact that the mapping δ is multiplicative, that is, for any w, z ∈ Z[i] we have δ(wz) = δ(w)δ(z), or equivalently, |wz|2 = |w|2|z|2. (We will see later that such is the case if and only if p = 2 or p ≡ 1 (mod 4).) 2.14. THE SET OF PRIMES 25 √ Homework 2.13.2. Show that Z[ −6] is not a UFD, and give an example of an element having two different factorizations. Make use of the homework problem above showing that 2 is irreducible but not a prime.
We√ note that it is an open problem to determine the set of positive m such that Z[ m] is a UFD. For negative m, the answer is known. 2.14. The Set of Primes
Theorem 2.14.1. There exist infinitely many primes in N. Proof. There are many proofs of this result, dating back to Euclid, who pre- sented the following proof. Suppose that p1, . . . , pk are the only primes. Consider the integer p1p2 ··· pk + 1. It is not divisible by any of the pi and thus cannot be expressed as a product of primes, a contradiction. Here is a proof due to Euler: Suppose again that p1, . . . , pk are the only primes. −1 Then Qk 1 − 1 is a finite value, but since every positive integer has a unique i=1 pi factorization into a product of primes we have k −1 k ∞ Y 1 Y 1 1 X 1 1 − = 1 + + + ··· = , p p p2 n i=1 i i=1 i i n=1 but the latter sum diverges, a contradiction. The next theorem is a stronger statement about the set of primes.
Theorem 2.14.2. For any n ∈ N, X 1 > log log(n + 1) − 1. p p≤n p prime Proof. First note that x2 x3 1 1 1 (2.6) − log(1 − x) = x + + + ··· = x + x2( + x + x2 + ... ) < x + x2 2 3 2 3 4 1 for 0 ≤ x ≤ 2 . Also −1 Y 1 Y 1 1 1 − = 1 + + + ··· p p p2 p≤n p≤n p prime p prime n n X 1 X Z k+1 1 (2.7) ≥ ≥ dx = log(n + 1). k x k=1 k=1 k Taking log of both sides one gets X 1 − log 1 − > log log(n + 1), p p≤n p prime and so by (2.6), X 1 X 1 > log log(n + 1) − . p p2 p≤n p≤n p prime The latter sum can be easily estimated to be less than 1. 26 2. DIVISIBILITY AND UNIQUE FACTORIZATION
In fact, a theorem of Merten states that X 1 lim − log log(n) = M, n→∞ p p≤n p prime where M = .261497... is the Meissel-Merten constant. 2.14.1. Gaps between primes: 2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61... Theorem 2.14.3. There exist arbitrarily large gaps between consecutive primes. Equivalently, there exist arbitrarily large sequences of consecutive composite num- bers. Proof. For any natural number n ≥ 2, n! + 2, n! + 3, . . . , n! + n are all com- posite. 2.14.2. Twin Primes. Twin primes are primes that are two units apart, such as (3, 5), (5, 7), (11, 13), (17, 19), (29, 31).
Twin Prime Conjecture: There exist infinitely many twin primes.
In 2013, Zhang [16] proved that there are infinitely many consecutive primes pn, pn+1 with pn+1 − pn less than a fixed constant that we will call the “gap size”. The gap size has been whittled away since Zhang’s proof first came out, as indicated in the following table. Date Author Gap size May 14, 2013 Zhang 700000000 June 2, 2013 Morrison 5000000 June 5, 2013 Sutherland 400000 June 19, 2013 Sutherland 50000 October 11, 2013 Engelsma 4400 October 23, 2013 Maynard 700 February 17, 2014 Clark and Jarvis 252 April 14, 2014 Tao and Nielsen 246 To prove the Twin Prime Conjecture one must reduce the gap size to 2.
A More General Gap Conjecture: For any even number n there exist infinitely many consecutive primes pk, pk+1 with pk+1 − pk = n.
How big do the gaps grow between consecutive primes? From 1 − 104, the maximum gap is 36. From 104 − 106 the maximum gap is 114. From 106 − 1014 the maximum gap is 804, while from 1014 − 1018 the maximum gap is 1442. Thus we see that the gap size grows very slowly. In fact heuristic arguments and numerical evidence suggest the following conjecture to be true.
Cramer’s Conjecture: Let pn denote the n-th prime. pn+1 − pn lim sup 2 = 1. n→∞ log (n) 2.14. THE SET OF PRIMES 27
2.14.3. Number of primes up to x. How many primes are there up to a given value x? Let π(x) denote this number. Gauss observed a striking similarity R x dt between the value of π(x) and the value of the logarithmic integral li(x) := 2 log t .
R x dt x π(x) li(x) = 2 log t 103 168 178 104 1229 1246 105 9592 9630 106 78498 78628 107 664579 664918 108 5761455 5762209 109 50847534 50849235 1010 455052512 455055614 Integrating by parts, we see that x 2 Z x dt li(x) = − + 2 . log x log 2 2 log t x Since the latter integral is smaller order of magnitude than log x , we see that li(x) ∼ x x log x as x → ∞, that is, li(x) is asymptotic to log x . Recall, we say two functions are asymptotic as x → ∞ if the ratio approaches 1 as x → ∞. Thus, Gauss conjectured x that π(x) ∼ log x . This was finally proven in 1896 by Poussin and Hadamard, and is now called the Prime Number Theorem.
x Theorem 2.14.4. The Prime Number Theorem. π(x) ∼ log x . The proof of this theorem is beyond the scope of this class. The easiest approach to proving the theorem requires complex analysis. One might ask why it was reasonable for Gauss to consider the logarithmic integral in the estimation of π(x). Consider√ the following probabilistic argument. Pick a positive integer n at random from x to x. Lets estimate√ the probability P that n is a prime? Let p1, . . . , pk be the primes up to x. For any prime pi ∈ {p1, . . . , pk}, we let Pi denote the probability that n is not divisible by pi. 1 Since one out of every pi numbers is divisible by pi we have Pi ≈ 1 − . Now, n is pi a prime if and only if n is not divisible by any of the pi. Thus, assuming the events “divisible by pi” are independent (which is not exactly the case), we have
k Y 1 Y 1 P ≈ 1 − = 1 − . pi √ p i=1 p< x Now −1 Y 1 √ 1 P −1 = 1 − ≥ log( x) = log x, √ p 2 p< x by (2.7). It can also be shown in an elementary manner (see ) that P −1 ≤ 2 log x. 1 √ Thus P ≈ log x , that is, the probability that a prime chosen between x and x is 1 a prime is on the order of magnitude log x . To be precise, the probability density 1 function for the distribution of primes is of order log x , and therefore the number of primes up to x is of order li(x). 28 2. DIVISIBILITY AND UNIQUE FACTORIZATION
2.14.4. Primes in Arithmetic Progressions. Euclid’s Theorem on the in- finitude of set of primes generalizes to arithmetic progressions. Theorem 2.14.5. Dirichlet’s Theorem on Primes in Arithmetic Progressions. Let a, b be relatively prime positive integers. Then the arithmetic progression {a + kb : k ∈ Z} contains infinitely many primes. The proof goes beyond the scope of this course, although we shall see special cases of it.
Homework 2.14.1. Show that the arithmetic progression 3 + 4Z contains in- finitely many primes. 2.14.5. Goldbach Conjecture. Any even number larger than two is the sum of two primes. In 2013 Helfgott [6], [7] proved that every odd number greater than 5 can be expressed as a sum of three primes! CHAPTER 3
Modular Arithmetic
3.1. Basic properties of congruences
Definition 3.1.1. Let m be any positive integer. For a, b ∈ Z we say that a and b are congruent modulo m and write a ≡ b (mod m) if m|(a − b).
Terminology: Let a ∈ Z. The smallest nonnegative integer that a is congruent to (mod m) is called the least residue of a (mod m). It is easy to see that the least residue of a (mod m) is just the remainder in dividing a by m. Lemma 3.1.1. Basic properties of congruences. (i) If a ≡ b (mod m) and c ≡ d (mod m) then a ± c ≡ b ± d (mod m). (ii) If a ≡ b (mod m) and c ≡ d (mod m) then ac ≡ bd (mod m). (iii) If a ≡ b (mod m), then for any positive integer n, an ≡ bn (mod m). (iv) If a ≡ b (mod m) and d|m then a ≡ b (mod d). Proof. (i) a ≡ b (mod m) ⇒ m|(a − b). c ≡ d (mod m) ⇒ m|(c − d). Thus, by a basic divisibility property, m|[(a − b) + (c − d], and so, m|[(a + c) − (b + d)], that is, a + c ≡ b + d (mod m). The same proof holds for a − c ≡ b − d (mod m). (ii) We’ll do this one in a different style. a ≡ b (mod m) ⇒ a = b + mk for some k ∈ Z. c ≡ d (mod m) ⇒ c = d + ml for some l ∈ Z. Thus ac = (b + mk)(d + ml) = bd + mkd + bml + mkml = bd + m(kd + bl + kml), and so ac ≡ bd (mod m). (iii) The proof is by induction on n. For n = 1 the statement is trivially true. Suppose the statement is true for n, and now consider n + 1. We have a ≡ b (mod m) by assumption, and an ≡ bn (mod m), by the induction hypothesis. Thus by property (ii), a · an ≡ b · bn (mod m), that is, an+1 ≡ bn+1 (mod m). (iv) We’ll leave as an exercise. It is useful to think of these basic properties as being substitution laws for congruences, for they tell us that in doing modular arithmetic we may replace an integer with any integer congruent to it.
n Theorem 3.1.1. Let f(x) = cnx + ··· + c1x + c0 be a polynomial with integer coefficients. Then for any m > 0 and integers a, b with a ≡ b (mod m), we have f(a) ≡ f(b) (mod m).
k k Proof. First note that by Theorem 3.2.1 (ii), cka ≡ ckb (mod m) for k = 0, 1, ..., n. Then by property (i), f(a) ≡ f(b) (mod m). Example 3.1.1. i) Find 4750 (mod 5). First note that 47 ≡ 2 (mod 5), then compute 21, 22, 23, ··· = 2, 4, 3, 1,... to see that 24 ≡ 1 (mod 5). Thus 4750 ≡ 250 ≡ (24)1222 ≡ 22 ≡ 4 (mod 5).
29 30 3. MODULAR ARITHMETIC
ii) Find 2100 (mod 7). This time we note that 23 ≡ 8 ≡ 1 (mod 7) and so 2100 ≡ (23)332 ≡ 2 (mod 7). iii) Find 2100 (mod 17). This time we observe that 24 ≡ −1 (mod 17) and so 2100 ≡ (24)25 ≡ (−1)25 ≡ −1 ≡ 16 (mod 17). Example 3.1.2. What is the remainder in dividing 21000 by 7? Since 23 ≡ 1 (mod 7), we have 2999 = (23)333 ≡ 1 (mod 7). Thus 21000 ≡ 2 (mod 7), and so the remainder is 2. Homework 3.1.1. Divisibility criterion. Let n be a number with base ten representation k n = ak10 + ··· + a110 + a0.
Show that (i) 9|n if and only if 9|(ak + ··· + a1 + a0). k (ii) 11|n if and only if 11|(ak − ak−1 + ak−2 − · · · + (−1) a0).
3.2. The ring of integers (mod m), Zm It is easy to see that congruence (mod m) is an equivalence relation on Z. Theorem 3.2.1. Congruence (mod m) is an equivalence relation, that is, it satisfies the following three properties. (i) Reflexive: For any a ∈ Z, a ≡ a (mod m). (ii) Symmetric: If a ≡ b (mod m) then b ≡ a (mod m). (iii) Transitive: If a ≡ b (mod m) and b ≡ c (mod m), then a ≡ c (mod m). Proof. We’ll be brief. The reader can fill in details. (i) m|0. (ii) If m|(a − b) then m|(b − a). (iii) If m|(a − b) and m|(b − c) then by a basic divisibility property m|(a − b) + (b − c), that is m|a − c. Thus congruence (mod m) partitions Z into equivalence classes of the form
[a]m = a + (m) = {a + km : k ∈ Z}, called residue classes or congruence classes (mod m). Each residue class (mod m) is a double arithmetic progression of integers, extending to infinity in both the positive and negative directions.
Definition 3.2.1. The ring of integers (mod m) is the set Zm of congruence classes (mod m),
Zm := {[0]m, [1]m, [2]m,..., [m − 1]m}, together with addition and multiplication laws defined by
(3.1) [a]m + [b]m = [a + b]m, [a]m[b]m = [ab]m. Note 3.2.1. i) By Theorem 3.2.1, addition and multiplication are well defined on Zm. ii) Zm is a ring with respect to the given addition and multiplication laws with zero element [0]m, and unity element [1]m. In fact Zm is a commutative ring with unity. We leave it as an exercise for the reader to verify the properties of a ring. They follow easily from the corresponding axioms for Z. iii) a ≡ b (mod m) ⇔ [a]m = [b]m in Zm. Thus in doing modular arithmetic their are two points of view one may take. One can either think in terms of con- gruences involving integers, or in terms of working in the ring Zm. 3.4. MULTIPLICATIVE INVERSES AND CANCELATION LAWS 31
Simplified Notation for Zm: If it is understood that we are working in a particular ring Zm, we may replace the cumbersome notation [a]m with the simpler notation a, or with just the representative a. In the first case we would write Zm = {0, 1,..., m − 1}, and in the second case, Zm = {0, 1, 2, . . . , m − 1}.
Example 3.2.1. Make an addition table and multiplication table for Z4 using the simplified notation Z4 = {0, 1, 2, 3}. + 0 1 2 3 · 0 1 2 3 0 0 1 2 3 0 0 0 0 0 1 1 2 3 0 1 0 1 2 3 2 2 3 0 1 2 0 2 0 2 3 3 0 1 2 3 0 3 2 1 Another point of view we may take is that Z4 is the set of integers {0, 1, 2, 3}, together with a new addition and multiplication law given explicitly by the tables above. If we had started with this definition of Z4, we would then be left with the cumbersome task of proving that all of the properties of a ring are satisfied.
3.3. Congruences in general rings The notion of congruence (mod m) generalizes in a natural way to congruence modulo an ideal in any ring. Definition 3.3.1. Let R be a ring and I be an ideal in R. (i) Two elements a, b ∈ R are said to be congruent modulo I if a − b ∈ I. (ii) The quotient ring of R with respect to I, denoted R/I is the set of cosets of the form a = a + I, a ∈ R, together with addition and multiplication laws given by Addition: a + b = a + b, for any a, b ∈ R. Multiplication: ab = ab, for any a, b ∈ R. Note 3.3.1. i) The addition and multiplication laws for R/I are well defined; follows from defining properties of ideals. ii) For any a, b ∈ R, we have a = b if and only if a − b ∈ I. In Z, as we noted above, all ideals are principal, that is of the form (m) for some integer m. In this case Zm = Z/(m), and congruence modulo m is the same thing as congruence modulo the ideal (m).
3.4. Multiplicative inverses and Cancelation Laws
Definition 3.4.1. i) Let a, m ∈ Z, m > 0. An integer b is called a multiplica- tive inverse of a (mod m), denoted a−1 (mod m), if ab ≡ 1 (mod m). ii) An elementa ¯ ∈ Zm is called a unit if it has a multiplicative inverse, that is, ¯ ¯ ¯ there exists a b ∈ Zm witha ¯b = 1. Note 3.4.1. i) The two concepts of multiplicative inverse are equivalent, that is, a has a multiplicative inverse (mod m) if and only ifa ¯ is a unit in Zm. ii) Multiplicative inverses (in both senses) are unique. iii) Not all elements have multiplicative inverses. Lemma 3.4.1. Let a, m ∈ Z with m > 0. Then a has a multiplicative inverse (mod m) if and only if (a, m) = 1. Equivalently, a is a unit in Zm if and only if (a, m) = 1. 32 3. MODULAR ARITHMETIC
Proof. Suppose that (a, m) = 1. Then by the GCDLC Theorem there ex- ist integers x, y such that ax + my = 1. Thus, ax ≡ 1 (mod m) and so x is a multiplicative inverse of a (mod m). Conversely, suppose that a has a multiplicative inverse x (mod m). Then ax = 1 + km for some k ∈ Z, and so ax ≡ 1 (mod m). Therefore a has a multiplicative inverse.
Lemma 3.4.2. Cancelation Laws. Let a, x, y be integers with ax ≡ ay (mod m). i) If a and m are relatively prime, then x ≡ y (mod m). ii) More generally, if d = (a, m), then x ≡ y (mod m/d).
Proof. (i) If (a, m) = 1 then a has a multiplicative inverse a−1 (mod m), and so multiplying both sides of the given congruence by a−1 gives the result. (ii) Suppose that ax ≡ ay (mod m), that is, ax = ay + km for some k ∈ Z. Then a a m a a m a m d x = d y + k d , that is, d x ≡ d y (mod d ). Since ( d , d ) = 1 we can apply (i) to get the desired conclusion.
3.5. The Group of units (mod m) and the Euler phi-function Definition 3.5.1. For any positive integer m, we let G(m) denote the set of units in Zm. It is easy to see that G(m) is a multiplicative group. In fact, we have the following, the proof of which is an exercise for the reader.
Lemma 3.5.1. In any commutative ring with unity, the set of units is an abelian group under multiplication.
Our goal is to describe the group structure of G(m).
Definition 3.5.2. For any positive integer m, we define φ(m) to be the number of positive integers less than or equal to m that are relatively prime to m. We call φ the Euler phi function or Euler’s totient function.
Lemma 3.5.2. For any positive integer m, the group of units G(m) is an abelian group of order φ(m).
Proof. We have Z/(m) = {0,..., m − 1}. Now, by Lemma 3.4.1 exactly φ(m) of these elements are units.
Lemma 3.5.3. If p is a prime, then every nonzero element of Zp is a unit. Thus Zp is a finite field with p elements. Proof. If p is a prime, then every nonzero element is a unit since (a, p) = 1 for 1 ≤ a ≤ p − 1.
Definition 3.5.3. (i) A set of integers {a1, . . . , am} is called a complete residue system (mod m) if the values are distinct (mod m), that is, Zm = {a1,..., am}. (ii) A set of integers {a1, . . . , aφ(m)} is called a reduced residue system (mod m) if G(m) = {a1,..., aφ(m)}. 3.7. FERMAT’S LITTLE THEOREM, EULER’S THEOREM AND WILSON’S THEOREM 33
3.6. A few results from Group Theory Definition 3.6.1. (i) Let (G, ·) be a group and let g ∈ G. Then the order of n g denoted ord(g) = ordG(g), is the smallest positive integer n such that g = 1, (if such an n exists). (ii) In the group G(m) we write ordm(a) for the order of an element (mod m). n Thus if (a, m) = 1, then ordm(a) is the minimal positive integer n such that a ≡ 1 (mod m). (iii) G is called a cyclic group if there exists an element g ∈ G such that G =< g >= {gn : n ∈ Z}. Notation: |H| denotes the cardinality of the set H. It is also called the order of the set H. Suppose G is a finite group and that H is a subgroup of G. Then we can write
G = Hx1 ∪ Hx2 · · · ∪ Hxk, for some cosets Hxi of H in G. Moreover, the cosets are disjoint from one another. [G : H], called the index of H in G denotes the number of cosets of H in G. Thus |G| = |Hx1| + |Hx2| + ··· + |Hxk| = |H|[G : H], and we have established the following theorem. Theorem 3.6.1. Lagrange. If G is a finite group and H is a subgroup of G then |H|||G|. Indeed, we have |G| = |H|[G : H]. Theorem 3.6.2. i) If G is a finite group and g ∈ G then g has finite order and ordG(g)||G|. ii) If g is an element of finite order in an arbitrary group G and m ∈ Z, then m g = 1 if and only if ordG(g)|m. iii) If G is a finite group and g ∈ G then g|G| = 1. Proof. i) Let H :=< g >= {e, g, g2, g3,... }. Since H ⊆ G, H is a finite set and therefore gj = gk for some j < k. Thus gk−j = e and so g has finite order. Let 2 k−1 k = ordG(g). Then it is easy to see that H = {e, g, g , . . . , g } and thus |H| = k. By Lagrange’s Theorem it follows that k divides |G|. ii) Let k = ord(g) and suppose that m is such that gm = 1. By the division algorithm there exist integers q, r such that m = qk + r and 0 ≤ r < k. Since gm = gk = e it follows that gr = 1. Since r < k, then by the minimality of k, r = 0, and therefore k|m. The other direction is trivial. iii) Part iii) follows immediately from i) and ii).
3.7. Fermat’s Little Theorem, Euler’s Theorem and Wilson’s Theorem Theorem 3.7.1. A few classical results in Number Theory. i) Fermat’s Little Theorem: For any prime p and integer a with (a, p) = 1, ap−1 ≡ 1 (mod p). ii) Euler’s Theorem: For any modulus m and integer a with (a, m) = 1, aφ(m) ≡ 1 (mod m). (ii) Wilson’s Theorem: For any prime p, (p − 1)! ≡ −1 (mod p). Proof. Note that i) is just a special case of ii). ii) G(m) is a group of order φ(m) and so by Theorem 3.6.2 (iii) , for any integer a with (a, m) = 1, aφ(m) = 1, that is aφ(m) ≡ 1 (mod m). 34 3. MODULAR ARITHMETIC
(iii) We first note that the only elements of G(p) which are inverses of themselves are 1 and −1. (why? x ≡ x−1 (mod p) ⇔ p|(x2 − 1) ⇔ p|(x − 1) or p|(x + 1) ≡ x = ±1.) Thus pairing each element of G(p) with its multiplicative inverses, we see that the product of the elements of G(p) is −1. 3.7.1. Useful identities with prime moduli. Lemma 3.7.1. Useful identities for prime moduli. Let p be a prime. i) If x, y are variable symbols then (x + y)p ≡ xp + yp (mod p), that is, all of the corresponding coefficients are congruent (mod p). ii) For any integers a1, . . . , an we have p p p p (a1 + a2 + ··· + an) ≡ a1 + a2 + ··· + an (mod p). iii) If a ≡ b (mod p), then for any positive integer k,
k k ap ≡ bp (mod pk+1). The proof of the lemma hinges on the following fact about binomial coefficients. Lemma 3.7.2. If p is a prime and k is a positive integer with 1 ≤ k < p, then p p| k . p p p−1 p−1 p p Proof. We have k = k k−1 , that is, p k−1 = k k . Thus p|k k , but p plainly p - k, and so p| k . Proof of Lemma 3.7.1. i) This is an immediate consequence of the binomial expansion formula and the preceding lemma. ii) Part ii) follows by induction from part i). iii) The proof is by induction on k the case k = 0 being trivial. Suppose the k k statement has been established for a given k. Then ap = bp + tpk+1 for some integer t. Raising both sides to the p-th power yields k+1 k+1 p k p k k+1 k ap = bp + bp (p−1)tpk+1+ bp (p−2)t2p2k+2+··· = bp +bp (p−1)tpk+2+··· . 1 2 Plainly pk+2 divides every term on the righthand side except for the first term, and pk+1 pk+1 k+2 so we get a ≡ b (mod p ). Note 3.7.1. Part ii) of the lemma yields another proof of Fermat’s Little Theo- p p p p rem. Indeed setting ai = 1, 1 ≤ i ≤ n, we see that (1+1+···+1) ≡ 1 +1 +···+1 (mod p), that is, np ≡ n (mod p).
3.8. Chinese Remainder Theorem We start by recalling a couple notions from ring theory. Definition 3.8.1. Let R,S be rings. (i) A mapping η : R → S is a ring homomorphism if η(ab) = η(a)η(b), η(a + b) = η(a) + η(b), for all a, b ∈ R. (ii) If in addition η is 1-to-1 and onto it is called an isomorphism, and the rings R,S are called isomorphic, written R ' S. (iii) The kernel of η is given by ker(η) = {x ∈ R : η(x) = 0}. Note 3.8.1. ker(η) is an ideal in R, and thus we can form the quotient ring R/ker(η). 3.8. CHINESE REMAINDER THEOREM 35
Theorem 3.8.1. First Isomorphism Theorem If η : R → S is a ring homomor- phism, then R/ker(η) ' η(R). We will state two versions of the Chinese Remainder Theorem, the first an algebraic version, and the second, the classical version.
Theorem 3.8.2. Chinese Remainder Theorem. Algebraic Version. Let m1, . . . , mk be pairwise relatively prime integers (that is (mi, mj) = 1 for all i 6= j), and let m = m1m2 ··· mk. Then we have the ring isomorphism,
Zm ' Zm1 × · · · × Zmk .
Proof. Let η : Z → Zm1 × · · · × Zmk , be defined by
η(n) = ([n]m1 , [n]m2 ,..., [n]mk ). Then by Lemma 2.10.1, we plainly have ker(η) = (m), and so by the First Isomor- phism Theorem, Z/(m) ' η(Z). In particular |η(Z)| = m = |Zm1 × · · · × Zmk |, and thus η is an onto mapping.
The onto property of η means the following: Given any integers ai, 1 ≤ i ≤ k, there exists an integer n such that η(n) = ([a1]m1 ,..., [ak]mk ), that is, [n]mi =
[ai]mi , 1 ≤ i ≤ k. In other words, n ≡ ai (mod mi), 1 ≤ i ≤ k. This is the content of the classical Chinese Remainder Theorem. Theorem 3.8.3. Chinese Remainder Theorem. Classical Version. Suppose that m1, . . . , mk are pairwise relatively prime integers, and that a1, . . . , ak are ar- bitrary integers. Then there exists an integer n such that
(3.2) n ≡ ai (mod mi), 1 ≤ i < k, that is, ai is the remainder on dividing n by mi. Moreover, the set of all solutions of (3.2) is a single residue class (mod m1 ··· mk). Example 3.8.1. Find all integers x such that x ≡ 1 (mod 6), x ≡ 2 (mod 37). Say x = 2 + 37t. Then 2 + 37t ≡ 1 (mod 6) ⇔ 2 + t ≡ 1 (mod 6) ⇔ t ≡ −1 (mod 6) . Thus x ≡ 187 (mod 222). From a computational point of view, when solving the system of congruences (3.2), it is better to start with the largest modulus (as we did in the previous example) and then substitute this into the next largest modulus. We illustrate this again in the next example. Example 3.8.2. Solve. x ≡ 5 (mod 11), x ≡ 2 (mod 35), x ≡ 1 (mod 3). The largest modulus is 35, so we write x = 2+35t and substitute into the second largest modulus to get 2 + 35t ≡ 5 (mod 11), that is, 2t ≡ 3 (mod 11), t ≡ 7 (mod 11). Thus x ≡ 2 + 35 · 7 ≡ 247 (mod 385). Finally, writing x = 247 + 385s we get 247 + 385s ≡ 1 (mod 3), s ≡ 0 (mod 3), and x ≡ 247 (mod 1155). Theorem 3.8.4. Structure Theorem for G(m) (Part I). Let m be a positive e1 ek integer with prime factorization m = p1 ··· pk . Then e1 e2 ek G(m) ' G(p1 ) × G(p2 ) × · · · × G(pk ), as multiplicative groups. We will see a second part to this structure theorem in Section ??, Theorem ??. 36 3. MODULAR ARITHMETIC
Proof. By the Chinese Remainder Theorem we have m ' e1 × · · · × ek . Z Zp1 Zpk The result now follows from two elementary results from algebra. i) If R1 ' R2 as rings and U1,U2 are the groups of units in R1 and R2 then U1 ' U2 as groups. ii) If R1,...,Rk are rings with groups of units U1,...,Uk, then the group of units in the cartesian product R1 × · · · × Rk is just U1 × · · · × Uk. We leave the proofs of these facts to the reader. Corollary 3.8.1. Properties of the Euler Phi Function. i) φ is multiplicative, that is, if a, b are positive integers with (a, b) = 1, then φ(ab) = φ(a)φ(b). ii) If m = Qk pei then φ(m) = Qk (pei − pei−1) = m Qk 1 − 1 . i=1 i i=1 i i i=1 pi
Proof. i) By the Chinese Remainder Theorem we have Zab ' Za × Zb, and thus G(ab) ' G(a) × G(b), as in the proof of the previous theorem. In particular, |G(ab)| = |G(a)||G(b)|, that is, φ(ab) = φ(a)φ(b). ii) For any prime power pe it is plain that φ(pe) = pe −pe−1 since the only values not relatively prime to pe are the pe−1 multiplies of p. Since φ is multiplicative we have k k Y ei Y ei ei−1 φ(m) = φ(pi ) = (pi − pi ). i=1 i=1 ei We simply factor out the quantity pi to obtain the final identity.
3.9. Group of units modulo a prime, G(p) In this section we will prove that the group of units G(p) is a cyclic group for any prime p. We use the notation Fp = Zp, in order to emphasize that Zp is a finite field. We saw earlier that the polynomial ring Fp[x] is a Unique Factorization Domain, indeed, it is a Euclidean domain. The following lemma is valid for factoring polynomials over any field.
Lemma 3.9.1. The Factor Theorem. Let f(x) ∈ Fp[x], a ∈ Fp. Then f(a) = 0 if and only if (x − a)|f(x). Proof. If (x − a)|f(x) then trivially f(a) = 0. Conversely, suppose that f(a) = 0. By the division algorithm there exist polynomials q(x), r(x) ∈ Fp[x] such that f(x) = q(x)(x − a) + r(x), with r(x) = 0 or deg r(x) < deg(x − a). In either case we see that r(x) is a constant polynomial, say r(x) = r0, and we have f(x) = q(x)(x − a) + r0. Inserting x = a yields r0 = 0 and consequently f(x) = q(x)(x − a), that is (x − a)|f(x). Theorem 3.9.1. For any prime p the polynomial xp − x factors over the finite field Fp in the manner, xp − x = x(x − 1)(x − 2)(x − 3) ··· (x − (p − 1)). Proof. By Fermat’s Little Theorem, each of the values 0, 1, . . . , p − 1 is a zero of xp −x. Thus, by the factor theorem, x, (x−1),..., (x−(p−1)) are each factors of p x − x. Moreover, they are distinct irreducible factors and so x(x1) ··· (x − (p − 1)) is a divisor of xp − x. But this product is a monic polynomial of degree p, and so p it must in fact equal x − x. 3.9. GROUP OF UNITS MODULO A PRIME, G(p) 37
Note 3.9.1. Matching the x coefficients of the two sides of the identity in Theorem 3.9.1 yields another proof of Wilson’s Theorem. Lemma 3.9.2. If p is a prime and d a positive integer with d|(p − 1), then the d polynomial x − 1 has d distinct zeros in Fp. Proof. Say de = p − 1 for some integer e, and write x(p−1) − 1 = xde − 1 = (xd)e − 1 = (xd − 1)g(x) d p−1 for some polynomial g(x) over Fp. Thus we see that (x − 1)|(x − 1), and so by d Theorem 3.9.1( x − 1) is a product of d distinct linear factors over Fp. Therefore d x − 1 has d distinct zeros in Fp. Lets recall another elementary result about groups.
j Lemma 3.9.3. i) If a is an element of finite order n in a group G then ordG(a ) = n/(n, j). ii) If a, b are elements of an abelian group G of orders m, n respectively with (m, n) = 1 then ordG(ab) = mn. Proof. i) Let e denote the identity in G and a ∈ G with ord(a) = n. Then j k jk n (a ) = e ⇔ a = 1 ⇔ n|jk ⇔ (n,j) |k, and so the minimal such k is n/(n, j). ii) Since < a > ∩ < b > is a subgroup of < a >, its order divides m, and since it is also a subgroup of < b >, its order divides n. Since (m, n) = 1 it follows that the order is 1, that is, < a > ∩ < b >= {e}. Now, since G is abelian, (ab)k = e implies that ak = b−k, and so ak, bk ∈< a > ∩ < b >. Thus ak = bk = e and so m|k and n|k. Since (m, n) = 1 it follows that mn|k. Conversely, it is easy to see that (ab)mn = amnbmn = e. Thus mn is the minimal exponent k satisfying k (ab) = e.
Corollary 3.9.1. If Cn is a cyclic group of order n, then Cn has φ(n) gen- erators.
Proof. Say Cn =< a > with ord(a) = n. Then for 0 ≤ j < n we have ord(aj) = n/(n, j) and so ord(aj) = n iff (n, j) = 1. Thus the number of choices for j is φ(n). Theorem 3.9.2. For any prime p, the group of units G(p) is a cyclic group.
e1 ek Proof. We may assume p is odd. Say p − 1 = p1 . . . pk is the prime factor- ization of p − 1. We will obtain an element of order p − 1 in G(p). Fix i, with 1 ≤ i ≤ k. Let pei Si = {x ∈ G(p): x i = 1}.
ei j By Lemma 3.9.2, |Si| = pi . Now every element in Si is of order pi for some j ≤ ei ei−1 ei and there are just pi elements of order less than pi , since any such element is a ei−1 e pi i zero of the polynomial x − 1. Thus Si contains an element ai of order pi . By Lemma 3.9.3 it follows that ord(a1 ··· ak) = (p − 1). Note 3.9.2. The same proof shows in fact that any finite multiplicative sub- group of a field is a cyclic group. 38 3. MODULAR ARITHMETIC
Definition 3.9.1. If m is a positive integer such that G(m) is cyclic, and a is a generator of G(m), then a is called a primitive root (mod m).
Note 3.9.3. If G(m) is cyclic, then there exist φ(φ(m)) distinct primitive roots (mod m), by Corollary 3.9.1.
What is the smallest primitive root for a given prime? This is a famous open problem in number theory. It is known that there is always a primitive root p1/4+ ; numerical evidence suggests that one always exists of size log3(p). Artin’s Conjecture: Given a positive integer a (not a perfect square), a is a primitive root for infinitely many primes p. Although the conjecture is still not proved, Heath-Brown (1985) established that if q, r, s are any three multiplicatively independent integers (qerf sg = 1 ⇒ e = f = g = 0) and none of q, r, s, −3qr, −3qs, −3rs, qrs is a square, then Artin’s conjecture holds for one of the numbers q, r, s. In particular, if q, r, s are distinct primes then one of them will be a primitive root for infinitely many primes. Artin’s conjecture is known to be true under the assumption of the Grand Riemann Hypothesis. There is a stronger conjecture asserting that if a 6= −1 is an integer with a = bc2 with b square-free and a 6≡ −1 (mod 4), then the fraction of primes p for which a Q 1 is a primitive root (mod p), is p prime 1 − p(p−1) = .3739..., the average value of φ(p − 1)/(p − 1) (the latter ratio being the fraction of primitive roots (mod p).)
Homework 3.9.1. For any prime p 6= 2, 5 show that ordp(10) is the length of the repeating cycle of the decimal expansion of 1/p.
3.10. Group of units G(pe) Theorem 3.10.1. i) For any odd prime p and positive integer e, G(pe) and G(2pe) are cyclic groups. ii) G(2e) is cyclic if and only if e = 1, 2. If e ≥ 3 then G(2e) '< −1 > × < 5 >.
Proof. i) We already know G(p) is cyclic. Let a be a primitive root (mod p). Say
(3.3) a(p−1) = 1 + kp, for some k ∈ Z. If p|k then a cannot be a primitive root (mod p2), for in this case ordp2 (a) ≤ p − 1. However, replacing a by a + p yields a new primitive root (mod p) with associated k-value not divisible by p, as we demonstrate: p − 1 p − 2 (a + p)p−1 = ap−1 + pap−2 + p2ap−3 + ... 1 2
= 1 + p[k + (p − 1)ap−2 + p(stuff)] = 1 + pk0, with (p, k0) = 1.
Claim: If p - k in (3.3) then a is a primitive root (mod pe) for all e ∈ N. We shall prove by induction that for any j ≥ 1
(p−1)pj−1 j (3.4) a = 1 + p kj 3.11. GROUP OF UNITS G(m) FOR ARBITRARY m 39 for some kj ∈ Z with (kj, p) = 1. By assumption (3.4) holds when j = 1. Suppose the statement is true for a given j. Then j−1 p (a(p−1)p )p = (1 + pjk )p = 1 + pj+1k + (pjk )2 + ... j j 2 j j+1 j+1 = 1 + p (kj + p(stuff)) = 1 + p kj+1, with (kj+1, p) = 1. This establishes (3.4). Let e be any positive integer, and t put t = ordpe (a). Then a ≡ 1 (mod p) and so (p − 1)|t. On the other hand t||G(pe)| = φ(pe) = (p − 1)pe−1, and so we can write t = (p − 1)pr for some nonnegative integer r ≤ e − 1. We wish to show r = e − 1. Now by (3.4) r 1 + pr+1k = ap (p−1) ≡ 1 (mod pe), for some integer k with (k, p) = 1. Thus, pe|pr+1, that is, e ≤ r + 1. Therefore r = e − 1. Finally we observe that for any odd p, G(2pe) ' G(2) × G(pe) ' G(pe), and thus G(2pe) is also cyclic. e−2 ii) Suppose that e ≥ 3. We show first that ord2e (5) = 2 . This follows from the claim that for n ≥ 2 2n−2 n 5 = 1 + kn2 , for some odd integer kn, which can be established by induction in the same manner e−2 as (3.4). The claim implies that for a given e ≥ 3 , 52 ≡ 1 (mod 2e) but 2e−3 e e−2 e e−1 5 6≡ 1 (mod 2 ), and thus ord2e (5) = 2 . Note φ(2 ) = 2 . We claim e−2 that G(2e) = {±1, ±5,..., ±52 −1}. It suffices to show that these elements are distinct, but this is immediate since (mod 4) it is clear that no positive element in this set is congruent to a negative element. In particular, G(2e) is not cyclic since e−2 every element has order ≤ 2 . Example 3.10.1. Find a primitive root (mod 625). Start with 5. Clearly 2 is a primitive element (mod 5). Now 24 = 16 = 3 · 5 + 1. Since 5 - 3 we see that 2 is a primitive element (mod 5e) for any e. In particular G(625) =< 2 >, a cyclic group of order φ(625) = 500.
Example 3.10.2. G(8) = {±1, ±5}' K4, the Klein-4 group. Homework 3.10.1. Find a primitive root of (mod 3500)) and (mod 98).
3.11. Group of units G(m) for arbitrary m
Lemma 3.11.1. A direct product G1 × · · · × Gk of finite groups is cyclic if and only if each group Gi is cyclic and (|Gi|, |Gj|) = 1 for all i 6= j.
Proof. Let G = G1 × · · · × Gk and x = (x1, . . . , xk) ∈ G. Then
ordG(x) = [ordG1 (x1),..., ordGk (xk)]. n n (Why? x = 1 iff xi = 1 for all i iff ordGi (xi)|n for all i.) Now k k ordG(x) = [ordG1 (x1),..., ordGk (xk)] ≤∗ Πi=1ordGi (xi) ≤∗∗ Πi=1|Gi| = |G|, with strict inequality in (*) unless (ordGi (xi), ordGj (xj)) = 1 for i 6= j, and strict inequality in (**) unless ordGi (xi) = |Gi| for all i. If G is cyclic then there is an x ∈ G such that equality holds in both (*) and (**), whence each Gi is cyclic and the orders are relatively prime. Conversely, suppose that each Gi is cyclic with generator xi and that the orders are pairwise relatively prime. Then we have 40 3. MODULAR ARITHMETIC equality in both (*) and (**) and so x = (x1, . . . , xk) is a generator element for G.
e e1 ek Theorem 3.11.1. Structure Theorem for G(m). Let m = 2 p1 . . . pk . Then e e1 ek G(m) ' G(2 ) × G(p1 ) × · · · × G(pk ), and G(m) is cyclic if and only if m = 1, 2, 4, pe or 2pe for some odd prime p and positive integer e. Proof. We established the isomorphism in Theorem 3.8.4. By Lemma 3.11.1, e e1 ek G(m) is cyclic if and only if G(2 ),G(p1 ),...,G(pk ) are all cyclic and their orders are relatively prime. Thus we must have e = 0, 1 or 2. For odd pi we have already ei seen that G(pi ) is cyclic. Now |G(4)| = 2, |G(2)| = 1, and for any odd pi, ei ei−1 |G(pi | = pi (pi − 1). The latter value is always even. Thus, in order for the orders to be relatively prime we must have either no odd prime or exactly one odd prime (k = 1) together with e = 0 or 1. Example 3.11.1. 3 3 G(7000) ' G(2 ) × G(5 ) × G(7) ' C2 × C2 × C100 × C6
' C2 × C2 × C4 × C25 × C2 × C3 ' C2 × C2 × C2 × C3 × C4 × C25. Theorem 3.11.2. Let G be a cyclic group of order n. Then for any positive divisor d of n there exist φ(d) elements in G of order d. In particular, the group G has φ(n) generators. Proof. Say G =< a >. By Lemma 2.18 ord(aj) = d iff n/(n, j) = d iff n (n, j) = n/d. Thus j = d ` with 1 ≤ ` ≤ d,(`, d) = 1. Hence there are φ(d) choices for j. Corollary 3.11.1. If G(m) is cyclic then G(m) has φ(φ(m)) generators (prim- itive roots). P Theorem 3.11.3. For any positive integer n, d|n φ(d) = n.
Proof. Let G be a cyclic group of order n. For d|n put Sd := {x ∈ G : P ord(x) = d}. Then G is a disjoint union of the Sd and so |G| = d|n |Sd| = P d|n φ(d). CHAPTER 4
Polynomial Congruences
Let f(x) be a polynomial with integer coefficients, and m be a positive integer. We wish to solve the congruence (4.1) f(x) ≡ 0 (mod m). We first look at linear congruences, then consider the power congruence xn ≡ a (mod m), and finally deal with a general polynomial.
4.1. Linear Congruences Theorem 4.1.1. For any integers a, b, m, m > 0, the linear congruence ax ≡ b (mod m) has a solution if and only if (a, m)|b in which case there are (a, m) distinct solutions (mod m). Proof. Set d = (a, m). The congruence ax ≡ b (mod m) is solvable if and only if there exist x, y ∈ Z, with ax − my = b. We saw earlier that this linear equation is solvable if and only if d|b in which case the general solution is of the m a m form x = x0 + t d , y = y0 + t d , for some x0, y0, t ∈ Z. Thus x ≡ x0 + t d (mod m), 0 ≤ t < d − 1. Homework 4.1.1. Verify that 65x ≡ 85 (mod 105) is solvable using the the- orem above, and then solve it two ways. i) Use the array method to solve the associated linear equation. ii) Use the Chinese Remainder Theorem.
4.2. Power Congruences, xn ≡ a (mod m) We start with the quadratic congruence x2 ≡ a (mod p), with p a prime. The congruence is solvable if and only if a is a square (mod p). Plainly, if a is a square, say a ≡ α2 (mod p), then the complete solution set is x ≡ ±α (mod p). Euler’s Criterion gives us a test for determining when a given a is a square (mod p).
Theorem 4.2.1. Euler’s Criterion. If p is an odd prime with p - a, then a is a p−1 square (mod p) if and only if a 2 ≡ 1 (mod p). Proof. This theorem is just a special case of Theorem 4.2.2 below, but we’ll give a proof here that doesn’t require knowing that G(p) is a cyclic group. We p−1 first note that for any a not divisible by p, a 2 ≡ ±1 (mod p), since the square of this value is 1 (mod p) by Fermat’s Little Theorem, and the only solutions of the congruence x2 ≡ 1 (mod p) are x ≡ ±1 (mod p). If a is a square (mod p), then there exists an x ∈ Z with x2 ≡ a (mod p), and by Fermat’s Little Theorem we p−1 p−1 2 get a ≡ 1 (mod p). Since there are 2 squares (mod p) and the congruence
41 42 4. POLYNOMIAL CONGRUENCES
(p−1)/2 p−1 x ≡ 1 (mod p) has at most 2 solutions, the solutions to this congruence are precisely the squares. Corollary 4.2.1. If p is an odd prime, then −1 is a square (mod p) if and only if p ≡ 1 (mod 4).
Proof. Immediate. Euler’s Criterion is just a special case of the following more general criterion for an element of a cyclic group to be an n-th power.
Theorem 4.2.2. Let G be a cyclic group of order n, k ∈ N and a ∈ G. Then a is a k-th power if and only if an/(k,n) = 1, (where 1 is the identity element). If the latter holds, then the equation xk = a has (k, n) solutions in G. The theorem is an easy consequence of the following lemma. Lemma 4.2.1. Let G be a cyclic group on order n (with identity 1) and H a subgroup of G of order d. Let x ∈ G. Then x ∈ H if and only if xd = 1, that is, if and only if ordG(x)|d. Proof. Say G =< g >. Then H =< gn/d >. Let x ∈ G, say x = gj. Then d j d n j x = 1 iff (g ) = 1 iff ord(g)|jd iff n|jd iff d |j iff g ∈ H. Proof of Theorem 4.2.2. Let H be the subgroup of k-th powers in G. Then |H| = n/(k, n), and so the first part of the theorem follows from the preceding lemma. Next, consider the homomorphism x → xk on G. The image is H and thus the mapping is a (k, n) to one mapping. Corollary 4.2.2. General Euler Criterion. Suppose that m is a positive in- teger such that G(m) is cyclic, and that n is any positive integer. Let a be any integer relatively prime to m. Then the congruence (4.2) xn ≡ a (mod m) has a solution if and only if (4.3) aφ(m)/(φ(m),n) ≡ 1 (mod m). If a solution exists then there are exactly (φ(m), n) solutions modulo m.
Proof. We simply apply the previous theorem to the group G(m). Example 4.2.1. If (n, φ(m)) = 1, then every a ∈ G(m) is an n-th power. Indeed the mapping x → xn on G(m) is a one-to-one mapping in this case.
Definition 4.2.1. Let a, m ∈ Z with (a, m) = 1. Then a is called a quadratic residue (mod m) if there exists an x ∈ Z such that x2 ≡ a (mod m). If no such x exists then a is called a quadratic non-residue (mod m). Note 4.2.1. 1. If p is a prime and a is a quadratic residue (mod p) then the congruence x2 ≡ a (mod p) has exactly 2 solutions. 2. If m has k distinct odd prime factors and a is a quadratic residue (mod m), then the congruence x2 ≡ a (mod m) has 2k distinct solutions (mod m), by the Chinese Remainder Theorem. 3. If m = pe is an odd prime power, then a is a quadratic residue mod pe if and only if a(p−1)/2 ≡ 1 (mod p), that is, a is a quadratic residue (mod p). 4.4. GENERAL POLYNOMIAL CONGRUENCES: LIFTING SOLUTIONS 43
Proof. We know G(pe) is a cyclic group of order pe−1(p − 1) and thus by e−1 e p (p−1) the general Euler Criterion, a is a square (mod p ) if and only if a 2 ≡ 1 (mod pe). But the latter condition is equivalent to a(p−1) ≡ 1 (mod p) by Lemma 3.7.1. Euler’s Criterion yields an easy way of testing whether a given a is a quadratic residue (mod p), but there remains the problem of determining the square-roots of a when it has one. In the following special cases the task is straightforward. Homework 4.2.1. i) Let p be a prime of the form p = 4k + 3 and a be a quadratic residue (mod p). Then, then the congruence x2 ≡ a (mod p) has solutions x ≡ ±ak+1 (mod p). ii) Suppose that p is a prime of the form p = 8k +5 and a is a quadratic residue k+1 1 k+1 2 (mod p). Then x ≡ ±a or 2 (4a) (mod p) satisfies x ≡ a (mod p) according as a2k+1 ≡ 1 or −1 (mod p). There remains the hard case where p ≡ 1 (mod 8). In this case one can use an iterative algorithm, called Shanks algorithm for calculating square roots. In the next chapter, we will see how Quadratic Reciprocity can be used to give a more efficient way of determining when a is a quadratic residue, than the Euler Criterion.
4.3. A general quadratic congruence Let p be an odd prime and consider the quadratic congruence ax2 + bx + c ≡ 0 (mod p), with a nonzero (mod p). The congruence is equivalent to 4a2x2 + 4abx ≡ −4ac (mod p) (2ax + b)2 ≡ b2 − 4ac (mod p). Thus, the quadratic congruence is solvable iff b2 − 4ac is a quadratic residue (mod p). Letting α2 ≡ b2 − 4ac (mod p), with α ∈ Z, we see that the solutions are just x = (−b ± α)(2a)−1 (mod p).
4.4. General Polynomial Congruences: Lifting Solutions
Let f(x) be a polynomial over Z and p a prime. Consider the congruence f(x) ≡ 0 (mod pn), First note that any solution must already be a solution (mod p), so we start by solving the congruence (mod p), and then proceed to (mod p2), (mod p3), and so on. Let x1 be an integer solution of the congruence f(x) ≡ 0 (mod p).
2 We shall attempt to lift the solution x1 to a solution (mod p ), that is, find a point x2 such that, 2 (4.4) x2 ≡ x1 (mod p) and f(x2) ≡ 0 (mod p ). 44 4. POLYNOMIAL CONGRUENCES
Say x2 = x1 + tp for some t ∈ Z. We wish to find t so that x2 is a solution (mod p2). Now, f 00(x ) (4.5) f(x + tp) = f(x ) + f 0(x )tp + 1 (tp)2 + ... 1 1 1 2 Note: Since the polynomial on the left clearly has integer coefficients, each of the (k) f (x1) values k! is an integer. Thus we obtain
0 2 f(x1 + tp) ≡ f(x1) + f (x1)tp (mod p ), and so we need to solve the congruence f(x ) (4.6) f 0(x )t ≡ − 1 (mod p), 1 p called the Lifting Congruence.
The three options going from (mod p) to (mod p2). 0 (i) If p - f (x1), then there is a unique solution t of (4.6) and hence a unique 2 solution x2 of (4.4) (mod p ). 0 2 (ii) If p|f (x1) and p - f(x1) then there is no solution of (4.6) and hence no solution of (4.4). 0 2 (iii) If p|f (x1) and p |f(x1), then any value of t is a solution of (4.6), and hence there are p distinct solutions of (4.4) (mod p2).
Suppose now that we have constructed by induction a sequence of integers x1, x2, . . . xn such that i i xi+1 ≡ xi (mod p ) and f(xi) ≡ 0 (mod p ), n for i = 1, 2 . . . , n. To continue we wish to find an xn+1 = xn + p t such that n n+1 f(xn + p t) ≡ 0 (mod p ). After expanding, this amounts to solving 0 n n+1 f(xn) + f (xn)p t ≡ 0 (mod p ), 0 0 or equivalently (noting that f (x1) ≡ f (xn) (mod p)) f(x ) (4.7) f 0(x )t ≡ − n . (mod p) 1 pn and so again we have three options.
The three options going from (mod pn) to (mod pn+1). 0 (i) If p - f (x1), then there is a unique solution t of (4.7) and hence a unique solution xn+1 satisfying n n+1 (4.8) xn+1 ≡ xn (mod p ), f(xn+1) ≡ 0 (mod p ). 0 n+1 (ii) If p|f (x1) and p - f(xn) then there is no solution of (4.7) and hence no solution of (4.8). 0 n+1 (iii) If p|f (x1) and p |f(xn), then any value of t is a solution of (4.7), and hence there are p distinct solutions of (4.8) (mod pn+1).
Definition 4.4.1. A solution x1 of the congruence f(x) ≡ 0 (mod p) is called 0 0 nonsingular if f (x1) 6≡ 0 (mod p) and singular if f (x1) ≡ 0 (mod p). 4.4. GENERAL POLYNOMIAL CONGRUENCES: LIFTING SOLUTIONS 45
Theorem 4.4.1. If x1 is a nonsingular solution of the congruence f(x) ≡ 0 n (mod p) then for any positive integer n there is a unique solution xn (mod p ) of n the congruence f(x) ≡ 0 (mod p ) such that xn ≡ x1 (mod p). Proof. At each step of the lifting process there is a unique solution and so the theorem follows easily by induction on n. Example 4.4.1. Solve the congruence x2 ≡ −1 (mod 125). Start with x2 ≡ −1 (mod 5) which has solutions ±2. First lets lift 2. Set x = 2 + 5t. f(x) = x2 + 1, f(2) = 5, f 0(2) = 4, and so Lifting Congruence is 4t ≡ −1 (mod 5), which gives t ≡ 1 (mod 5), x ≡ 7 (mod 25). Next lift 7. Set x = 7+25t. f(7) = 50. The Lifting Congruence is 4t ≡ −50/25 (mod 5), so t ≡ 2 (mod 5) and x ≡ 57 (mod 125). Clearly, the second solution (obtained by lifting −2) is x ≡ −57 (mod 125). Example 4.4.2. Solve x3 + x2 + 23 ≡ 0 (mod 53). Start with the same con- gruence (mod 5). By trial and error we see that x ≡ 1 or 2 (mod 5). 0 (i) Take x1 = 1. Put x = 1 + 5t. Note that f (1) = 5 ≡ 0 (mod p), that is 1 is a singular solution, while f(1)/5 = 5 ≡ 0 (mod 5). Thus we have have option (iii), that is, the lifting congruence is 0t ≡ 0 (mod 5), so t is arbitrary and 2 we get x2 = 1 + 5t = 1, 6, 11, 16, 21. Now f(1 + 5t)/25 = 4t + t + 1, and we see f(1 + 5t)/25 ≡ 0 (mod 5) iff t = 3. Thus for x2 = 16 we have option (iii) and get five liftings to solution (mod 125), namely x ≡ 16, 41, 66, 91, 116 (mod 125). If one continues this to (mod 54) one discovers that all of the solutions 3 (mod 5 ) lift. Thus there are 25 solutions (mod 625) all living above x1 = 1.
1 (mod 5)
2 (mod 5 ) 1 6 11 16 21
3 (mod 5 ) 16 41 66 91 116
(mod 54)16+125t 41+125t 66+125t 91+125t 116+125t
(ii) Since x1 = 2 is a nonsingular solution, there is a unique lifting each time. We obtain x2 ≡ 17 (mod 25) and x3 ≡ 42 (mod 125), and (if we continue one more level) x4 ≡ 417 (mod 625). This information can be displayed in a tree graph with vertices 1 and 2 at the top and branches below for the (mod 25), (mod 125), (mod 625) liftings. 46 4. POLYNOMIAL CONGRUENCES
Homework 4.4.1. i) Solve the congruence f(x) = x3 +7x2 +x = x(x−1)2 ≡ 0 (mod 32). ii) Solve the congruence x3 + x + 1 ≡ 0 (mod 312). Hint: Note that 3 is a solution (mod 31). Use factor theorem and quadratic formula to obtain others. iii) Solve the congruence x495 −2x24 +8 ≡ 0 (mod 7). Hint: Use Fermats Little Theorem to make life easier.
4.5. Counting Solutions of Polynomial Congruences Theorem 4.5.1. Let f(x) be a polynomial with integer coefficients and m a e1 ek positive integer with factorization m = p1 ··· pk . Then i) x is a solution of the congruence (4.9) f(x) ≡ 0 (mod m) if and only if x satisfies the system of congruences
ei (4.10) f(x) ≡ 0 (mod pi ), 1 ≤ i ≤ k. ei ii) Letting N(m) denote the number of solutions of (4.9) (mod m) and N(pi ) k ei denote the number of solutions of (4.10), we have N(m) = Πi=1N(pi ).
ei Proof. i) m|f(x) ⇔ pi |f(x), 1 ≤ i ≤ k. ii) We claim that the CRT gives us a one-to-one correspondence between the k−tuples (x1, . . . , xk) ∈ e1 × · · · × ek with xi a solution of (2.66) for 1 ≤ i ≤ k Zp1 Zpk and the solutions x of (2.65). Indeed, suppose that xi is a solution of (2.66) for ei 1 ≤ i ≤ k, and let x (mod m) be the unique value with x ≡ xi (mod pi ), ei 1 ≤ i ≤ k. Such an x satisfies f(x) ≡ f(xi) ≡ 0 (mod pi ) for all i, and so f(x) ≡ 0 (mod m). CHAPTER 5
Quadratic Residues and Quadratic Reciprocity
5.1. Introduction Consider the two congruences x2 ≡ 3 (mod 1009) and x2 ≡ 1009 (mod 3). Which one is easier to solve? Since 1009 ≡ 1 (mod 3), the second congruence simplifies to x2 ≡ 1 (mod 3) which has solutions x ≡ ±1 (mod 3). The first con- gruence does not simplify, and cannot be solved easily by trial and error. Is there any relationship between these two congruences? In the first one we are working over the field Z1009 (noting that 1009 is a prime), while in the second one, we are working in the field Z3. To address this relationship, we introduce the Legendre symbol. Recall that an integer a, not divisible by a prime p, is called a quadratic residue (mod p) if a is a square (mod p), that is, the congruence x2 ≡ a (mod p) is solvable.
Definition 5.1.1. Let p be an odd prime and a ∈ Z with p - a. The Legendre a symbol p is defined to be 1 if a is a quadratic residue (mod p), and -1 if a is a quadratic nonresidue (mod p). Thus to address the solvability of the congruence, x2 ≡ 3 (mod 1009), we 3 1009 must calculate 1009 . We’ve already shown that 3 = 1, but does this reveal 3 any information about 1009 . Euler and Legendre, in the late 1700’s, observed a beautiful relationship between these two quantities, called the law of quadratic p q reciprocity. It says that if p and q are distinct odd primes then q = p unless p q p ≡ q ≡ 3 (mod 4), in which case q = − p . Thus, for our example above, 3 1009 since 1009 ≡ 1 (mod 4) we conclude that 1009 = 3 = 1, that is, 3 is a quadratic residue (mod 1009). Although conjectured by Euler and Legendre, it was Gauss who first proved the law.
5.2. Properties of the Legendre Symbol Before proving the law of quadratic reciprocity lets state some basic properties of the Legendre symbol.
Theorem 5.2.1. Let p be an odd prime and a, b ∈ Z with p - ab. Then a (p−1)/2 i) p ≡ a (mod p). ab a b ii) p = p p . a b iii) If a ≡ b (mod p) then p = p . a2 iv) p = 1.
47 48 5. QUADRATIC RESIDUES AND QUADRATIC RECIPROCITY
p−1 Proof. (i) Note that for any a with (a, p) = 1, a 2 ≡ ±1 (mod p), since p−1 2 by Fermat’s Little Theorem a 2 is a solution of the congruence x ≡ 1 (mod p), which has solutions ±1 (mod p). By Euler’s criterion, Theorem ??, a is a quadratic p−1 2 a residue (mod p) if and only if a ≡ 1 (mod p). Thus p = 1 if and only if p−1 p−1 2 a 2 a ≡ 1 (mod p). Otherwise we must have p = −1 and a ≡ −1 (mod p). p−1 a 2 Thus in both cases p ≡ a (mod p). (ii) is immediate from part (i). (iii) and (iv) follow immediately from the definition of the Legendre symbol. Corollary 5.2.1. For any odd prime p, ( −1 p−1 1, if p ≡ 1 (mod 4); = (−1) 2 = p −1, if p ≡ 3 (mod 4).
Proof. Immediate from part (i) of the preceding theorem.