PMATH 340 Lecture Notes on Elementary Number Theory
Anton Mosunov Department of Pure Mathematics University of Waterloo
Winter, 2017 Contents
1 Introduction ...... 3 2 Divisibility. Factorization of Integers. The Fundamental Theorem of Arithmetic ...... 5 3 Greatest Common Divisor. Least Common Multiple. Bezout’s´ Lemma...... 9 4 Diophantine Equations. The Linear Diophantine Equation ax + by = c ...... 15 5 Euclidean Algorithm. Extended Euclidean Algorithm ...... 18 6 Congruences. The Double-and-Add Algorithm ...... 24 7 The Ring of Residue Classes Zn ...... 29 8 Linear Congruences ...... 31 ? 9 The Group of Units Zn ...... 33 10 Euler’s Theorem and Fermat’s Little Theorem ...... 36 11 The Chinese Remainder Theorem ...... 38 12 Polynomial Congruences ...... 41 13 The Discrete Logarithm Problem. ? The Order of Elements in Zn ...... 45 14 The Primitive Root Theorem ...... 50 15 Big-O Notation ...... 53 16 Primality Testing ...... 56 16.1 Trial Division ...... 57 16.2 Fermat’s Primality Test ...... 58 16.3 Miller-Rabin Primality Test ...... 61 17 Public Key Cryptosystems. The RSA Cryptosystem ...... 62 18 The Diffie-Hellman Key Exchange Protocol ...... 67 19 Integer Factorization ...... 69
1 19.1 Fermat’s Factorization Method ...... 70 19.2 Dixon’s Factorization Method ...... 72 20 Quadratic Residues ...... 75 21 The Law of Quadratic Reciprocity ...... 81 22 Multiplicative Functions ...... 86 23 The Mobius¨ Inversion ...... 91 24 The Prime Number Theorem ...... 95 25 The Density of Squarefree Numbers ...... 96 26 Perfect Numbers ...... 101 27 Pythagorean Triples ...... 104 28 Fermat’s Infinite Descent. Fermat’s Last Theorem ...... 105 29 Gaussian Integers ...... 110 30 Fermat’s Theorem on Sums of Two Squares ...... 120 31 Continued Fractions ...... 124 32 The Pell’s Equation ...... 135 33 Algebraic and Transcendental Numbers. Liouville’s Approximation Theorem ...... 137 34 Elliptic Curves ...... 140
2 1 Introduction
This is a course on number theory, undoubtedly the oldest mathematical discipline known to the world. Number theory studies the properties of numbers. These may be integers, like√ −2,0 or 7, or rational numbers like 1/3 or −7/9, or algebraic numbers like 2 or i, or transcendental numbers like e or π. Though most of the course will be dedicated to Elementary Number Theory, which studies con- gruences and various divisibility properties of the integers, we will also dedicate several lectures to Analytic Number Theory, Algebraic Number Theory, and other subareas of number theory. There are many interesting questions that one might ask about numbers. In search for answers to these questions mathematicians unravel fascinating proper- ties of numbers, some of which are quite profound. Here are several curious facts about prime numbers:
1. Every odd number exceeding 5 can be expressed as a sum of three primes (Helfgott-Vinogardov Theorem, 2013. In 1954, Vinogardov proved the re- sult for all odd n > B for some B, and in 2013 Helfgott demonstrated that one can take B = 5);
2. There are infinitely many prime numbers p and q such that |p − q| ≤ 246 (Zhang’s Theorem, 2013. Zhang proved the result for 7 · 107, and in 2014 the constant was reduced to 246 by Maynard, Tao, Konyagin and Ford);
3. For all n ≥ exp(exp(33.217)) there always exists a prime between n3 and (n + 1)3 (Ingham’s Theorem, 1937. Ingham proved the result for all n ≥ B for some B, and in 2014 Dudek demonstrated that one can take B as above);
4. There are infinitely many primes of the form x2 + y4 (Friedlander-Iwaniec Theorem, 1997);
5. Up to x > 1, there are “approximately” x/logx prime numbers (Prime Num- ber Theorem, 1896);
6. Given a positive integer d, there exist distinct prime numbers p1, p2,..., pd which form an arithmetic progression (Green-Tao Theorem, 2004).
Despite the simplicity of their formulations, all of these results are highly non- trivial and their proofs reside on some deep theories. For example, the Green-Tao
3 Theorem resides on Szemeredi’s´ Theorem, which in turn uses the theory of ran- dom graphs. There are many number theoretical problems out there that are still open. At the 1912 International Congress of Mathematicians, the German mathematician Edmund Landau listed the following four basic problems about primes that still remain unresolved:
1. Can every even integer greater than 2 be written as a sum of two primes? (Goldbach’s Conjecture, 1742);
2. Are there infinitely many prime numbers p and q such that |p − q| = 2? (Twin Prime Conjecture, 1849);
3. Does there always exist a prime between two consecutive perfect squares? (Legendre’s Conjecture, circa 1800);
4. Are there infinitely many primes of the form n2 + 1? (see Bunyakovsky’s Conjecture, 1857).
It is widely believed that the answer to each of the questions above is “yes”. There is a lot of computational evidence towards each of them, and for some of them conjectural asymptotic formulas were established. However, none of them are proved. Aside from being an interesting theoretical subject, number theory also has many practical applications. It is widely used in cryptographic protocols, such as RSA (Rivest-Shamir-Adleman, 1977), the Diffie-Hellman protocol (1976), and ECIES (Elliptic Curve Integrated Encryption Scheme). These protocols rely on certain fundamental properties of finite fields (RSA, D-H) and elliptic curves de- fined over them (ECIES). For example, consider the Discrete Logarithm Problem: given a prime p and integers c,m, one may ask whether there exists an integer d such that cd − m is divisible by p, and if so, what is its value. We may write this in the form of a congruence
cd ≡ m (mod p).
When p is extremely large (hundreds of digits) and c,m are chosen properly, this problem is widely believed to be intractable; that is, no modern computer can solve it in a reasonable amount of time (the computation would require billions of
4 years). This property is used in many cryptosystems, including the first two men- tioned above. Many cryptosystems, like RSA, can be broken by quantum comput- ers. The construction of protocols infeasible to attacks by quantum computers is a subject of Post Quantum Cryptography and number theory plays a crucial role there (see the Lattice-Based or Isogeny-Based Cryptography).
2 Divisibility. Factorization of Integers. The Fundamental Theorem of Arithmetic
Before we proceed, let us invoke a little bit of notation:
N = {1,2,3,...} — the natural numbers; Z = {0,±1,±2,...} — the ring of integers; m Q = n : m ∈ Z,n ∈ N — the field of fractions; R — the field of real numbers; C = {a + bi: a,b ∈ R,i2 = −1} — the field of complex numbers.
We call Z a ring because 0,1 ∈ Z and a,b ∈ Z implies a±b ∈ Z and a · b ∈ Z. In other words, Z is closed under addition, subtraction and multiplication. Note, however, that a,b ∈ Z with b 6= 0 does not imply that a/b ∈ Z, so it is not closed under division. A collection that is closed under addition, subtraction, multipli- cation and division by a non-zero element is called a field. According to this definition, every field is also a ring.
Exercise 2.1. Demonstrate the proper inclusions in N(Z(Q(R(C. No proofs are required.
Definition 2.2. Let a,b ∈ Z. We say that a divides b, or that a is a factor of b, when b = ak for some k ∈ Z. We write a | b if this is the case, and a - b otherwise.
Example 2.3. 3 | 12 because 12 = 3 · 4; 3 - 13; −1 | 7 because 7 = (−1) · (−7); 0 - 3.
Proposition 2.4. 1 Let a,b,c,x,y ∈ Z.
1. If a | b and b | c, then a | c;
1Proposition 1.2 in Frank Zorzitto, A Taste of Number Theory.
5 2. If c | a and c | b, then c | ax ± by;
3. If c | a and c - b, then c - a ± b; 4. If a | b and b 6= 0, then |a| ≤ |b|;
5. If a | b and b | a, then a = ±b;
6. If a | b, then ±a | ±b;
7. 1 | a for all a ∈ Z;
8.a | 0 for all a ∈ Z; 9. 0 | a if and only if a = 0.
Proof. Exercise.
Definition 2.5. Let p ≥ 2 be a natural number. Then p is called prime if the only positive integers that divide p are 1 and p itself. It is called composite otherwise.
We remark that 1 is neither prime nor composite. We will also use the above terminology only with respect to integers exceeding 1 (so according to this con- vention −3 is not prime and −6 is not composite).
Exercise 2.6. Among the collection −5,1,5,6, which numbers are prime?
Theorem 2.7. For each integer n ≥ 2 there exists a prime p such that p | n.
Proof. We will prove this result using strong induction on n. Base case. For n = 2 we have 2 | n. Since 2 is prime, the theorem holds. Induction hypothesis. Suppose that the theorem is true for n = 2,3,...,k. Induction step. We will show that the theorem is true for n = k + 1. If n is prime the result holds. Otherwise there exists a positive integer d such that d | n, d 6= 1 and d 6= n. By property 4 of Proposition 2.4 we have d ≤ n, and since d 6= 1 and d 6= n we conclude that 2 ≤ d ≤ n − 1 = k. Thus d satisfies the induction hypothesis, so there exists a prime p such that p | d. Since p | d and d | n, by property 1 of Proposition 2.4 we conclude that p | n.
Theorem 2.8. (Euclid’s Theorem, circa 300BC) There are infinitely many prime numbers.
6 Proof. Suppose not, and there are only finitely many prime numbers, say p1, p2,..., pk. Consider the number q = p1 p2 ··· pk + 1.
Since q ≥ 2, by Theorem 2.7 there exists some prime, say pi, which divides q. On the other hand, since pi | p1 p2 ··· pk and pi - 1, by property 3 of Proposition 2.4 it is the case that pi - q. This leads us to a contradiction. Hence there are infinitely many prime numbers. There are many alternative proofs of this fact, suggested by Euler, Erdos,˝ Furstenberg, and other mathematicians (see the wikipedia page for Euclid’s The- orem). At the end of this section, we will see the proof given by Euler. We will now turn our attention to the Fundamental Theorem of Arithmetic, which states that any integer greater than 1 can be written uniquely (up to reorder- ing) as the product of primes.
Example 2.9. Number 60 can be written as 60 = 22 · 3 · 5.
In order to prove the theorem, we will utilize the following tools:
1. Well-Ordering Principle. Let S be a non-empty subset of the natural num- bers N. Then S contains the smallest element. To spell it out, there exists x ∈ S such that the inequality x ≤ y holds for any y ∈ S.
2 2. Generalized Euclid’s Lemma. Let p be a prime number and a1,a2,...,ak be integers. If p | a1a2 ···ak, then there exists an index i, 1 ≤ i ≤ k, such that p | ai.
Theorem 2.10. (The Fundamental Theorem of Arithmetic) Any integer greater than 1 can be written uniquely (up to reordering) as the product of primes.
Proof. We will start by proving that every positive integer greater than 1 can be written as a product of primes. Let S denote the collection of all positive integers greater than 1 that cannot be written as a product of primes. Suppose that S is not empty. Since S (N and N is well-ordered, we conclude that S contains the smallest element, say n. Clearly, n is not a prime. Thus there exists a positive integer d such that d | n, d 6= 1 and d 6= n. Thus both d and n/d are strictly less than n and greater than 1. Furthermore, either d or n/d cannot be written as a product
2We will prove this result in Corollary 3.15 once we will introduce the notion of a greatest common divisor.
7 of primes, for the converse would imply that n is a product of primes. Thus either d or n/d is in S, which contradicts the fact that n is the smallest element in S. This means that S is empty, so every integer greater than 1 is a product of primes. To prove uniqueness, consider two prime power decompositions
a1 a2 ak b1 b2 b` n = p1 p2 ··· pk = q1 q2 ···q` . We will show that they are in fact the same.3 Without loss of generality, we may assume that p1 < p2 < ... < pk and q1 < q2 < ... < q`. Pick some index i such b1 b2 b` that 1 ≤ i ≤ k. Since pi | n = q1 q2 ···q` , by Generalized Euclid’s Lemma there exists some index j(i), 1 ≤ j(i) ≤ `, such that
b j(i) pi | q j(i) .
Now apply Generalized Euclid’s Lemma once again to deduce that pi | q j(i). Since q j(i) is prime, its only divisors are 1 and q j(i), which means that pi = q j(i). Since p1 < p2 < ... < pk, we see that j(i1) 6= j(i2) whenever i1 6= i2. From above we conclude that for each i such that 1 ≤ i ≤ k we can put in correspondence some element j(i) — and each j(i) arises from unique i — such that 1 ≤ j(i) ≤ `, which means that there are at least as many j’s as there are i’s, so k ≤ `. Apply Generalized Euclid’s Lemma once again, but with the roles of pi and q j reversed, thus observing that for each j such that 1 ≤ j ≤ ` we can put in correspondence some element i( j) — and each i( j) arises from unique j — such that 1 ≤ i( j) ≤ `, so ` ≤ k. Since k ≤ ` and ` ≤ k, it is the case that k = `. ai bi bi ai From here we deduce that pi | qi and qi | pi . By property 5 of Proposition ai bi 2.4, we have pi = qi . Since pi = qi, it is the case that ai = bi. The fact that the prime factorization is unique was utilized by Euler to provide an alternative proof of Euclid’s Theorem. Theorem 2.9. (Euclid’s Theorem, circa 300BC) There are infinitely many prime numbers. Proof. (Euler’s proof, 1700’s) Consider the harmonic series ∞ 1 1 1 ∑ = 1 + + + .... n=1 n 2 3
3Note that this is not the proof by contradiction, for we do not assume that these prime power decompositions are distinct.
8 It is widely known that this series is divergent. Now let p > 1 and recall the formula for the infinite geometric series: ∞ 1 1 1 1 ∑ k = 1 + + 2 + ... = . k=0 p p p 1 − 1/p Using this formula, we observe that 1 1 1 ∞ 1 ∏ = ∏ 1 + + 2 + ... = ∑ , p prime 1 − 1/p p prime p p n=1 n where the last equality holds by the Fundamental Theorem of Arithmetic. If there would be only finitely many primes, the product on the left hand side would be finite, which contradicts the fact that the series on the right hand side is divergent.
3 Greatest Common Divisor. Least Common Multi- ple. Bezout’s´ Lemma.
When divisibility fails, we speak of quotients and remainders. Theorem 3.1. (The Remainder Theorem)4 Let a,b be integers, a > 0. Then there exist unique integers q and r such that
b = aq + r, where 0 ≤ r < a. Proof. Recall that every real number x “sits” in between two consecutive integers; that is, there exists some unique integer q such that
q ≤ x < q + 1.
Now set x = b/a. Then from above inequality it follows that
aq ≤ b < aq + a.
But then 0 ≤ b − aq < a.
4Proposition 1.3 in Frank Zorzitto, A Taste of Number Theory.
9 If we now put r = b − aq, then
b = aq + r and r satisfies 0 ≤ r < a. From the above construction it is also evident that q and r are unique, so the result follows. Definition 3.2. Let a,b be integers, a > 0. Write b = aq + r, where 0 ≤ r < a. Then a is called the modulus, b is called the dividend, q is called the quotient and r is called the remainder. Note that for a > 0 the expression a | b simply means that in b = aq + r the remainder r is equal to zero. Given a and b, one can easily compute q and r using the calculator. First, compute a/b, and the integer part of this expression is precisely your q. Then compute r with the formula r = b − aq. Definition 3.3. Let a and b be integers. An integer d such that d | a and d | b is called a common divisor of a and b. When at least one of a and b is not zero, the largest integer with such a property is called the greatest common divisor of a and b and is denoted by gcd(a,b). When a = b = 0, we define gcd(a,b) := 0. The greatest common divisor of a and b possesses many interesting properties. Let us demonstrate several of them. Proposition 3.4. Let
e1 e2 ek f1 f2 fk a = p1 p2 ··· pk and b = p1 p2 ··· pk , where p1, p2,..., pk are distinct prime numbers and e1,e2,...,ek, f1, f2,..., fk are integers ≥ 0. Then
min{e1, f1} min{e2, f2} min{ek, fk} gcd(a,b) = p1 p2 ··· pk . (1) Further, any common divisor c of a and b must also divide gcd(a,b). Proof. Note that
min{e1, f1} min{e2, f2} min{ek, fk} g = p1 p2 ··· pk divides both a and b. Also, any integer
g1 g2 gk c = p1 p2 ··· pk
10 such that gi > min{ai,bi} for some i fails to divide either a or b. Hence any common divisor c satisfies gi ≤ min{ai,bi} for all i, 1 ≤ i ≤ k. Hence c divides g. Maximizing the inequality for each index we get that g is in fact the greatest common divisor. Note that Proposition 3.4 suggests one formula for the computation of gcd(a,b). First, one has to factor a and b by writing them in the form
e1 e2 ek f1 f2 fk a = p1 p2 ··· pk and b = p1 p2 ··· pk , where the indices ei and f j are allowed to be 0 (convince yourself that any two numbers can be written in this form). Then one might simply utilize the formula (1). This approach works fine when the numbers are small and easily factorable, but unfortunately as the numbers get really large the efficient factorization is in- feasible for modern electronic computers (but feasible for quantum computers, see Shor’s Algorithm). In fact, the security of the RSA public key cryptosystem is based on the difficulty of factorization.
Example 3.5. Let us compute the greatest common divisor of 440 and 300. The prime factorizations are 440 = 23 · 5 · 11 and 300 = 22 · 3 · 52. We see that
440 = 23 · 30 · 51 · 111 and 300 = 22 · 31 · 52 · 110.
Thus gcd(440,300) = 2min{3,2} · 3min{0,1} · 5min{1,2} · 11min{1,0} = 22 · 30 · 51 · 110 = 20.
Exercise 3.6. Let a and b be integers. An integer ` is called a common multiple of a and b if it satisfies a | ` and b | `. The smallest non-negative integer with such a property is called the least common multiple of a and b and is denoted by lcm(a,b). Given the statement as in Proposition 3.4, prove that
max{e1, f1} max{e2, f2} max{ek, fk} lcm(a,b) = p1 p2 ··· pk (2) and that every common multiple c of a and b is divisible by lcm(a,b). That is, if a | c and b | c, then lcm(a,b) | c.
Exercise 3.7. Let a and b be non-negative integers. Prove that
ab = gcd(a,b)lcm(a,b). (3)
11 Exercise 3.8. Compute lcm(440,300) using formulas (2) and (3). We will now address the following question: which integers c can be written in the form ax + by, where x and y are integers? Speaking in fancy mathematical language, the identity c = ax + by means that c is an integer (linear) combination of a and b. Let us play around a little bit with the quantity ax + by. Clearly, a can be written in this form, since a = a·1+b·0. Same applies to b, since b = a·0+b·1. The number 0 can always be represented in this form, since 0 = a · 0 + b · 0. Note that, when at least one of a and b is not zero, ax+by will always represent at least one positive integer, because a · a + b · b > 0. It turns out that the least positive integer d represented by ax+by is precisely the greatest common divisor of a and b. Example 3.9. Consider a = 7 and b = 15. Then the equation
7x + 15y = 1 has a solution (x,y) = (−2,1). In fact, it has infinitely many solutions, as any solution of the form (x,y) = (−2 + 15n,1 − 7n) for n ∈ Z is a solution, too. However, when a = 7 and b = 14 the equation
7x + 14y = 1 has no solutions, as the left hand side will always be divisible by 7, while this is not the case for the right hand side. So number 1 cannot be represented as an integer linear combination of 7 and 14. Hence the question: which numbers can be represented in this form? Theorem 3.10. (Bezout’s´ lemma)5 Let a,b be integers such that a 6= 0 or b 6= 0. If d is the least positive integer combination of a and b, then d divides every combination of a and b. Furthermore, d = gcd(a,b). Proof. We know that ax + by = d > 0. Now consider some integer combination
c = as + bt, where s,t ∈ Z. We want to show that d | c. Recall that c = dq + r
5Proposition 1.4 in Frank Zorzitto, A Taste of Number Theory.
12 for some q,r ∈ Z, where 0 ≤ r < d. Thus
0 ≤ r = c − dq = as + bt − (ax + by)q = a(s − xq) + b(t − yq) < d.
We see that r is an integer combination of a and b, which is less than d, and non- negative. Because d is the least positive integer combination of a and b, the only option is that r = 0. Hence d | c. In particular, d | a and d | b, because a,b are integer combinations of a and b. We will now show that d = gcd(a,b). On one hand, we know that d | a and d | b, so d is a common divisor of a and b. By Proposition 3.4, d must divide the greatest common divisor of a and b, i.e. d | gcd(a,b). On the other hand, since d = ax+by = gcd(a,b)(a1x+b1y) for some x,y,a1,b1 ∈ Z, we have gcd(a,b) | d. Since d | gcd(a,b) and gcd(a,b) | d, by property 5 of Proposition 2.4 we conclude that d = gcd(a,b). With the help of Theorem 3.10 we can answer the question which numbers can be represented in the form ax + by. Since
gcd(a,b) = ax + by for some x,y ∈ Z and gcd(a,b) is the smallest positive integer representable in this form, we see that any integer c divisible by gcd(a,b) can be written in such a way, since for some k ∈ Z it is the case that
c = k · gcd(a,b) = k(ax + by) = a(kx) + b(ky).
On the other hand, if gcd(a,b) - c, then c cannot be written as an integer combina- tion of a and b. We will now use Bezout’s´ lemma to establish a few more properties of prime numbers. In particular, we will prove Euclid’s lemma, which we already saw in Section 2.
Definition 3.11. Let a and b be integers. We say that a and b are coprime if gcd(a,b) = 1.
13 Proposition 3.12. Let a,b,c be integers with a,b coprime. If a | c and b | c, then ab | c.
Proof. Since a and b are coprime, by Bezout’s´ lemma there exist integers x and y such that ax + by = 1. Thus a(cx) + b(cy) = c. After dividing both sides of the above equality by ab we obtain c c c · x + · y = . b a ab Since a | c and b | c, the quantity on the left hand side of the above equality is an integer. Hence the same applies to the quantity on the right hand side, so c/(ab) is an integer.
Proposition 3.13. Let a,b,c be integers with a,b coprime. If a | bc, then a | c.
Proof. Since a and b are coprime, by Bezout’s´ lemma there exist integers x and y such that ax + by = 1. Thus a(cx) + b(cy) = c. After dividing both sides of the above equality by a we obtain bc c c · x + · y = . a a Since a | bc, the quantity on the left hand side of the above equality is an integer. Hence the same applies to the quantity on the right hand side, so c/a is an integer.
Proposition 3.14. (Euclid’s lemma) If p is prime and p | ab for some integers a, b, then p | a or p | b.6 6The proof is from Frank Zorzitto’s “A Taste of Number Theory” (see Proposition 2.4 on page 31).
14 Proof. Say p - a. Let d = gcd(p,a). Since d | p, the definition of primes forces d = 1 or d = p, and since p - a, it must be that d = 1, so p and a are coprime. From Proposition 3.13 it follows that p | b.
Corollary 3.15. (Generalized Euclid’s lemma) Let p be a prime number and a1,a2,...,ak be integers. If p | a1a2 ···ak, then there exists an index i, 1 ≤ i ≤ k, such that p | ai.
Proof. The result clearly holds for k = 1, so assume that k ≥ 2. If p | a1, we are done. If not, then p and a1 are coprime, so by Proposition 3.13 it must be the case that p | a2a3 ···ak. If p | a2 we are done. If not, then p and a2 are coprime, so by Proposition 3.13 it must be the case that p | a3a4 ···ak. Proceeding in the same fashion, we eventually reach p | ak−1ak, where we may apply Euclid’s lemma to draw the desired conclusion.
Exercise 3.16. Show that one cannot remove the coprimality condition neither from Proposition 3.12 nor from Proposition 3.13.
4 Diophantine Equations. The Linear Diophantine Equation ax + by = c
An equation is called Diophantine if we are only concerned with its integer so- lutions. Any equation can be converted into its Diophantine form. For example, instead of looking at x2 + y2 = 1 for (x,y) ∈ R2 we may restrict our attention to (x,y) ∈ Z2. Note that in the former case there are infinitely many solutions (in fact, there are uncountably many of them). These are all the points lying on the circle centered at the origin with the radius equal to 1. However, if we look at (x,y) ∈ Z2 then there are only four solutions, namely (±1,0) and (0,±1). (Do you see why?) Sometimes, converting an equation into its Diophantine form is not very in- 2 2 teresting. This√ is the case for the equation x + y = 1. Another example is the equation y =√x 2, which has no integer solutions aside from (0,0) due to irra- tionality of 2. But sometimes understanding integer solutions can get difficult, even extremely difficult. The reason is that, when considering an equation over the real numbers R or — even better! — over the complex numbers C, there are many analytical tools that we can utilize. Say, if we are looking at equation f (x) = 0 for x ∈ R, we might utilize the fact that f (x) is continuous, or differentiable, or
15 maybe even smooth. Another reason why it might be easier to analyze equations not only over R or C, but also over Q, is because all of them are fields. Quite often we can say many things about the Diophantine equation by “lift- ing” it and considering it, for example, over Q, for if there are only finitely many solutions over Q, then there are only finitely many solutions over Z. Such a tech- nique applies to hyperelliptic equations, like y2 = x5 + 2 (see Faltings’ Theorem). However, sometimes there are infinitely many solutions over Q, but only finitely many — or even none! — over Z. The fact that Q is a field can be utilized to prove that there are infinitely many rational solutions to elliptic equations
y2 = x3 + 46, y2 = x3 − 2.
Note that the first equation has a solution (−7/4,51/8), while the second equation has a solution (129/100,383/1000). Unlike Q,R or C, the ring of integers Z is not closed under division by a non-zero element, so we need to use different techniques to study it. For example, the equation y2 = x3 + 46 has no solutions in integers, while the equation y2 = x3 − 2 has two solutions (3,±5).
Example 4.1. Let a,b,c,n be fixed integers, n ≥ 3, and x,y,z be integer variables. Here are several examples of Diophantine equations:
ax + by = c — Linear Diophantine equation in two variables; x2 + y2 = z2 — Pythagorean equation; x2 − dy2 = ±1 — Pell equation; y2 = x3 + ax + b — Weierstrass equation; axn + byn = c — Thue equation; axn + byn = czn — Fermat type equation; x2 + 7 = 2y — Ramanujan-Nagell equation.
When analyzing equations, we would like to answer the following questions:
1. Do solutions exist?
2. If solutions exist, how many of them are there? (finitely many, countably many, uncountably many)
3. What are the solutions?
4. Are there algorithms which can generate solutions?
16 We address the same questions when analyzing Diophantine equations. Of course, in this case the number of solutions will be at most countable. We will now turn our attention to the linear Diophantine equation in two vari- ables ax + by = c. Here a,b,c are fixed integers and x,y are integer variables. We will fully classify the solutions to this equation. The question of existence of a solution was fully resolved at the end of Section 3, where we established that solutions exist if and only if gcd(a,b) | c. To this end, the only thing that is left for us to do is to find all the solutions when they exist, and come up with a procedure for their computation. As the following Proposition shows, by knowing one solution to ax+by = c we can deduce all of the solutions. Proposition 4.2. Let a,b,c be integers. Let (x,y) be a pair of integers such that ax + by = c. Then any pair of integers (x0,y0) such that c = ax0 + by0 must be of the form b a (x0,y0) = x − n,y + n , gcd(a,b) gcd(a,b) where n ranges over the integers. Proof. Suppose that (x,y) and (x0,y0) are integer pairs such that c = ax + by = ax0 + by0. Then a(x − x0) = b(y0 − y). This means that a | b(y0 − y), and further a | (y0 − y). gcd(a,b) This means that a y0 = y + n gcd(a,b) 0 0 for some n ∈ Z. Substituting this relation into the equation a(x − x ) = b(y − y), we see that ab a(x − x0) = n , gcd(a,b) which means that b x0 = x − n . gcd(a,b)
17 Thus we see that from one solution to ax+by = c (if it exists) we may produce all solutions once we compute gcd(a,b). In order to determine one solution to this equation, we use the Extended Euclidean Algorithm. This algorithm allows one to compute a pair of integers (x,y) such that
ax + by = gcd(a,b).
This allows us to produce a solution to ax+by = c, as then it must be the case that gcd(a,b) | c, so for some integer k we have
c = kgcd(a,b) = k(ax + by) = a(kx) + b(ky).
We may then use Proposition 4.2 to compute all solutions to the linear Diophantine equation ax + by = c. We will learn about the Extended Euclidean Algorithm in the following section.
Exercise 4.3. Let a1,a2,...,ak be integers at least one of which is not 0. The largest integer d such that d | ai for all i, 1 ≤ i ≤ k, is called the greatest common di- visor of a1,a2,...,ak. It is denoted by gcd(a1,a2,...,ak). When a1 = a2 = ... = ak = 0, we define gcd(a1,a2,...,ak) := 0. Determine the formulas for gcd(a1,a2,...,ak) and lcm(a1,a2,...,ak) that are analogous to (1) and (2). Does a formula similar to (3) hold? Explain why or why not.
Exercise 4.4. Let a1,a2,...,ak be integers. We say that c ∈ Z can be represented as an integer linear combination of a1,a2,...,ak if there exist x1,x2,...,xk ∈ Z such that c = a1x1 + a2x2 + ... + akxk.
Given integers a1,a2,...,ak, which integers can be written as an integer combina- tion of a1,a2,...,ak?
5 Euclidean Algorithm. Extended Euclidean Algo- rithm
Let a,b be integers at least one of which is not 0. In the previous section, we found one formula for the computation of gcd(a,b), namely (1). Though being useful, it is not very efficient, as the algorithm for fast integer factorization is
18 unknown.7 However, there exists a much more efficient algorithm to compute gcd(a,b), developed by Euclid in his fundamental work Elements. It is called the Euclidean Algorithm. We begin our explorations by first showing yet another interesting property of the greatest common divisor. In particular, if a,b are integers at least one of which is not zero, then gcd(a,b) does not change if we replace b with b + ak, where k is an arbitrary integer. Proposition 5.1. Suppose a,b are two integers. Then for any integer k it is the case that gcd(a,b) = gcd(a,b + ak).
Proof. Let d1 = gcd(a,b) and d2 = gcd(a,b + ak). We will show that d1 | d2 and d2 | d1. Since d1 | a and d1 | b, it is the case that d1 | (b + ak). Since d1 is a common divisor of a and b + ak, by Proposition 3.4 it must divide their greatest common divisor d2. Thus d1 | d2. Now observe that d2 | a and d2 | b + ak. Thus a = d2r1 and b + ak = d2r2 for some r1,r2 ∈ Z. But then
b = d2r2 − ak = d2r2 − d2r1k = d2(r2 − r1k).
Hence d2 | b, which means that d2 is a common divisor of a and b. By Proposition 3.4 it must divide their greatest common divisor d1. Thus d2 | d1. Since d1 | d2 and d2 | d1, we conclude that d1 = d2. We will now describe the Euclidean Algorithm. Let a,b be positive integers such that ab 6= 0, since when ab = 0 it is easy to compute gcd(a,b). Without loss of generality, we suppose that a > b (if a < b we may interchange a and b, and if a = b then gcd(a,b) = a). We define the finite sequence of integers a1,a2,... as follows. Set r1 = a, r2 = b, and write
r1 = q1r2 + r3.
Note that the remainder r3 satisfies 0 ≤ r3 < r2 = b. Then compute
r2 = q2r3 + r4,
r3 = q3r4 + r5, 7By “fast” we mean “polynomial time”.
19 and so on. Since the sequence of integers r1 > r2 > ... is bounded below by 0, in n steps this sequence eventually reaches some smallest positive number rn. We will show that this smallest positive integer rn is precisely gcd(a,b). Why does this process allow one to compute gcd(a,b)? By Proposition 5.1,
gcd(r1,r2) = gcd(r1 − q1r2,r2) = gcd(r3,r2).
Let us compute one more step:
gcd(r3,r2) = gcd(r3,r2 − q2r3) = gcd(r3,r4).
Proceeding in the same fashion, we see that
gcd(a,b) = gcd(r1,r2) = gcd(r2,r3) = ... = gcd(ri,ri+1) for all i such that 1 ≤ i ≤ n − 1. We see that the calculations get easier with each step, and in the end we obtain
gcd(a,b) = gcd(r1,r2) = ... = gcd(rn−1,rn) = gcd(rn,0) = rn.
Theorem 5.2. Let a,b be positive integers with a > b. Let r1 > r2 > ... be the finite sequence as defined above. Let rn be the smallest positive integer in this sequence. Then rn = gcd(a,b).
Proof. Recall that d = gcd(a,b) = gcd(ri,ri+1) for i = 1,2,...,n − 1. Now con- sider the last equation rn−2 = qn−2rn−1 + rn. The remainder in the expression
rn−1 = qn−1rn + rn+1 satisfies 0 ≤ rn+1 < rn. Since rn is the smallest positive integer in this sequence and the sequence is strictly decreasing, the only possibility is that rn+1 = 0, which means that rn divides rn−1. But then
rn = gcd(rn−1,rn) = gcd(rn−2,rn−1) = ... = gcd(r1,r2) = gcd(a,b).
Consider several examples.
20 Example 5.3. Let us compute gcd(440,300) using the Euclidean Algorithm. We have 440 = 1 · 300 + 140 300 = 2 · 140 + 20 140 = 7 · 20 + 0. Thus gcd(440,300) = 20. Example 5.4. Let us compute gcd(233,144) using the Euclidean Algorithm. We have 233 = 1 · 144 + 89 144 = 1 · 89 + 55 89 = 1 · 55 + 34 55 = 1 · 34 + 21 34 = 1 · 21 + 13 21 = 1 · 13 + 8 13 = 1 · 8 + 5 8 = 1 · 5 + 3 5 = 1 · 3 + 2 3 = 1 · 2 + 1 2 = 2 · 1 + 0. Thus gcd(233,144) = 1. Note that both numbers in Example 5.4 are smaller than in Example 5.3. Nev- ertheless, in Example 5.4 the Euclidean Algorithm terminated in 12 steps, while in Example 5.3 it terminated in 3 steps. This is because in Example 5.4 we chose our integers to be the 13th and the 12th Fibonacci numbers. Recall that Fibonacci numbers are the numbers defined recursively by F1 = 1, F2 = 2 and Fn = Fn−1 + Fn−2 for n ≥ 3. It turns out that the slowest performance of the Eu- clidean Algorithm is achieved for consecutive Fibonacci numbers. Nevertheless, the algorithm does work in polynomial time. In 1844, Gabriel Lame´ proved that the number of steps required for the completion of the Euclidean Algorithm is at most 5log10(min{a,b}), so we see that the algorithm works in polynomial time.
Exercise 5.5. Let F1 = 1, F2 = 2, and for an integer n ≥ 3 define Fn = Fn−1 + Fn−2. The number Fn is called the n-th Fibonacci number. Prove that the computation of gcd(Fn+1,Fn) with the Euclidean Algorithm requires n steps. Above we managed to compute gcd(a,b). Still, we do not know how to pro- duce integer solutions (x,y) to the Diophantine equation ax + by = gcd(a,b).
21 This can be achieved with the help of the Extended Euclidean Algorithm. It is essentially the same as the Euclidean Algorithm, but along with the sequence r1,r2,... we will also keep track of two additional sequences s1,s2,... and t1,t2,.... The algorithm is as follows. Set
r1 = a, r2 = b; s1 = 1, s2 = 0; t1 = 0, t2 = 1. For i ≥ 3, we proceed by computing
ri+1 = ri−1 − qi−1ri; si+1 = si−1 − qi−1si; ti+1 = ti−1 − qi−1ti. Note that, out of the three lines above, the Euclidean Algorithm computes only the first one. We claim that, if the Euclidean Algorithm terminates in n + 1 steps, then integers sn and tn satisfy asn + btn = gcd(a,b).
Theorem 5.6. Let a,b be positive integers with a > b. Let r1 > r2 > ... > rn > 0, s1,s2,...,sn and t1,t2,...,tn be sequences as defined above. Then
asn + btn = gcd(a,b). Proof. We claim that the equation
asi + bti = ri is satisfied for all i = 1,2,...,n. Since Theorem 5.2 asserts that rn = gcd(a,b), this would imply the result. To prove this statement, we proceed using induction on n. Base case. According to our setup, r1 = a, r2 = b, s2 = t1 = 0 and s1 = t2 = 1. Thus as1 + bt1 = r1 and as2 + bt2 = r2, so the base case holds for i = 1,2. Induction hypothesis. Assume that asi + bti = ri for i = k − 1,k. Induction step. We will demonstrate that the result holds for i = k + 1:
rk+1 = rk−1 − rkqk = (ask−1 + btk−1) − (ask + btk)q = (ask−1 − askqk) + (btk−1 − btkqk) = ask+1 + btk+1.
We conclude that asi + bti = ri for all i = 1,2,...,n, as claimed.
22 Using Extended Euclidean Algorithm, we can finally solve the Diophantine equation ax + by = c. Example 5.7. Let us determine all solutions to the Diophantine equation
440x + 300y = 80 using the Extended Euclidean Algorithm. Set
r1 = 440, r2 = 300; s1 = 1, s2 = 0; t1 = 0, t2 = 1.
Step 1. 440 = 1 · 300 + 140, so q1 = 1 and r3 = 140. Thus
s3 = s1 − q1s2 = 1 − 1 · 0 = 1; t3 = t1 − q1t2 = 0 − 1 · 1 = −1.
Step 2. 300 = 2 · 140 + 20, so q2 = 2 and r4 = 20. Thus
s4 = s2 − q2s3 = 0 − 2 · 1 = −2; t4 = t2 − q2t3 = 1 − 2 · (−1) = 3.
Step 3. Since 20 | 140, the algorithm terminates. We conclude that 440 · (−2) + 300 · 3 = 20. After multiplying both sides of the above equality by 4, we obtain a solution (x,y) = (−8,12) to the Diophantine equation 440x + 300y = 80. By Proposition 4.2, if a = 440 and b = 300 then all solutions to this Diophantine equation must be of the form b a x − n,y + n = (−8 − 15n,12 + 22n), gcd(a,b) gcd(a,b) where n ranges over the integers. Exercise 5.8. (a) Let a,b,c be integers such that a 6= 0 or b 6= 0, and gcd(a,b) | c. Consider the Diophantine equation ax + by = c. Prove that there exists the unique solution (x,y) such that 0 ≤ x < b/gcd(a,b) and the unique solution (x0,y0) such that 0 ≤ y0 < a/gcd(a,b);
23 p (b) For (x,y) ∈ R2, let k(x,y)k := x2 + y2 denote the Euclidean norm. Let a,b,c be integers such that c 6= 0 and gcd(a,b) = 1, and consider the linear Diophan- tine equation ax + by = c. Prove that the solution (x,y) ∈ Z2 of the above equation that corresponds to the smallest value of k(x,y)k satisfies
|c| |c| k(a,b)k ≤ k(x,y)k ≤ + . k(a,b)k k(a,b)k 2
6 Congruences. The Double-and-Add Algorithm
Throughout this section, we fix a positive integer n, which we call the modulus.
Definition 6.1. We say that integers a and b are congruent modulo n if n divides a − b. We denote this by a ≡ b (mod n).
To say that a and b are congruent modulo n is the same as to say that their remainders after division by n are the same. That is, if
a = q1n + r1 and b = q2n + r2, where 0 ≤ r1,r2 < n, then r1 = r2. A rather surprising fact is that the congruence relation ≡ behaves much like the equality relation =.
Proposition 6.2. The congruence relation ≡ is an equivalence relation. That is, it satisfies the following three axioms:
(a) Reflexivity. If a is any integer, then a ≡ a (mod n);
(b) Symmetry. If a ≡ b (mod n), then b ≡ a (mod n);
(c) Transitivity. If a ≡ b and b ≡ c (mod n), then a ≡ c (mod n).
Proof. Exercise.
24 Example 6.3. Let n = 5. Then the numbers 7 and 27 are congruent to each other modulo 5, because 5 | (27 − 7). Also note that both 7 and 27 have the same remainder after division by 5:
7 = 1 · 5 + 2 and 27 = 4 · 5 + 2.
In fact, it is easy to notice that there are infinitely many numbers congruent to 7 modulo 5. Convince yourself that all of them belong to the set
{5q + 2: q ∈ Z} = ...,−8,−3,2,7,12,.... Proposition 6.4. 8 Let n be a modulus, and suppose that
a ≡ a1 (mod n), b ≡ b1 (mod n). Then a ± b ≡ a1 ± b1 (mod n), ab ≡ a1b1 (mod n).
Proof. Let us first show that a + b ≡ a1 + b1 (mod n). Note that n | (a − a1) and n | (b − b1). By property 2 of Proposition 2.4,
n | (a − a1) + (b − b1) = (a + b) − (a1 + b1), so by definition we see that a + b ≡ a1 + b1 (mod n). An analogous proof holds if we replace the plus sign with the minus sign. To see that ab ≡ a1b1 (mod n), observe that
ab − a1b1 = ab − a1b + a1b − a1b1 = (a − a1)b + a1(b − b1).
Since n | (a − a1) and n | (b − b1), once again, by property 2 of Proposition 2.4 it is the case that n | (a − a1)b + a1(b − b1) = ab − a1b1, and by definition this means that ab ≡ a1b1 (mod n). If we now combine Propositions 6.2 and 6.4, it becomes clear that in any con- gruence, which involves only addition, subtraction and multiplication of integers, we can easily replace a with a1 whenever a ≡ a1 (mod n). This is known as the replacement principle.
8Proposition 3.3 in Frank Zorzitto, A Taste of Number Theory.
25 Example 6.5. Let f (x) = x5 − 10x + 7. We can compute the remainder of f (27) divided by 5 as follows: note that 27 ≡ 2 (mod 5). Since f (x) involves only addition, subtraction and multiplication of integers, by the replacement principle we can compute f (2) instead of f (27), because f (27) ≡ f (2) (mod 5). Also, since 10 ≡ 0 (mod 5) and 7 ≡ 2 (mod 5), we see that
f (27) ≡ f (2) ≡ 25 − 10 · 2 + 7 ≡ 25 − 0 · 2 + 2 ≡ 34 ≡ 4 (mod 5).
Since 0 ≤ 4 < 5, we conclude that 4 is the remainder of f (27) divided by 5. Example 6.6. Let us compute the last decimal digit of 30799. Note that this is the same as finding the remainder of 30799 divided by 10. By the replacement principle, reading from left to right and top to bottom, we have
30799 ≡ 799 ≡ (73)33 ≡ 34333 ≡ 333 ≡ (33)11 ≡ (27)11 ≡ 711 ≡ 72 · (73)3 ≡ 49 · 33 ≡ 9 · 27 ≡ 9 · 7 ≡ 63 ≡ 3 (mod 10).
Thus 3 is the last decimal digit of 30799. Analogously, we can determine the last k decimal digits of any number by applying the replacement principle modulo 10k instead of 10. However, as the modulus grows, the computations become more and more challenging. In practice, in order to compute a` (mod n) for some large power `, we utilize the so called Double-and-Add Algorithm. The algorithm is as follows: first, write the integer ` in its binary expansion, i.e.
k i k k−1 ` = ∑ ci2 = ck2 + ck−12 + ... + c1 · 2 + c0, i=0 where ci ∈ {0,1}. Then
k k−1 a` ≡ ack2 +ck−12 +...+c1·2+c0, k ck k−1 ck−1 c ≡ a2 · a2 ··· a2 1 · ac0 (mod n).
26 j But then note that, for j such that 2 ≤ j ≤ k, we can deduce the value of a2 from j−1 a2 modulo n as follows:
j j−1 2 a2 ≡ a2 (mod n).
2 k Therefore we can compute a2,a2 ,...,a2 in k − 1 steps.
Example 6.7. Let us compute n ≡ 7114 (mod 23) such that 0 ≤ n < 23. Note that
114 = 64 + 32 + 16 + 2 = 26 + 25 + 24 + 2.
Then 72 ≡ 49 ≡ 3 (mod 23); 74 ≡ (72)2 ≡ 32 ≡ 9 (mod 23); 78 ≡ (74)2 ≡ 92 ≡ 81 ≡ 12 (mod 23); 716 ≡ (78)2 ≡ 122 ≡ 144 ≡ 6 (mod 23); 732 ≡ (716)2 ≡ 62 ≡ 36 ≡ 13 (mod 23); 764 ≡ (732)2 ≡ 132 ≡ 169 ≡ 8 (mod 23). We can utilize the table above in our calculations:
7114 ≡ 764+32+16+2 ≡ 764 · 732 · 716 · 72 ≡ 8 · 13 · 6 · 3 ≡ 1872 ≡ 9 (mod 23).
We will now take a look at some interesting applications of modular arith- metic. For example, it can be used to demonstrate that certain Diophantine equa- tions have no solutions.
Example 6.8. Let us show that the Diophantine equation
x2 + y2 = 4z + 3 has no solutions. This is the same as solving the congruence
x2 + y2 ≡ 3 (mod 4)
27 in integers x and y. Since every integer is congruent to either 0,1,2 or 3 modulo 4, there are essentially 16 possible combinations of x and y that we can check. However, the problem becomes even simpler if we note that
02 ≡ 0, 12 ≡ 1, 22 ≡ 0, 32 ≡ 1 (mod 4).
Thus every perfect square is congruent to either 0 or 1 modulo 4. Since we are dealing with the sum of two perfect squares, there are now only three options left to check, namely
0 + 0 ≡ 0, 0 + 1 ≡ 1, 1 + 1 ≡ 2 (mod 4).
As we can see, none of them add up to 3, which means that x2 + y2 ≡ 3 (mod 4) has no solutions in integers x and y. Therefore there are no solutions to the Dio- phantine equation x2 + y2 = 4z + 3.
Exercise 6.9. (a) Show that the Diophantine equation x2 + y2 + z2 = 8t + 7 has no solutions for x,y,z,t ∈ Z; √ √ (b) Let Z[ 2] := {a + b 2: a,b ∈ Z}√. Show that there exists a solution to x2 + y2 + z2 = 8t + 7 for x,y,z,t ∈ Z[ 2]; (c) Show that integers x,y,z,t satisfy x2 + y2 + z2 = 8t + 3 if and only if x, y and z are odd.
In school, you probably heard of divisibility rules for various integers. For example, in order to check that some integer is divisible by 3, one just has to add up all of its decimal digits together and verify that the resulting number is divisible by 3. To verify that some integer n is divisible by 4, one just has to ensure that the number representable by the last two decimal digits of n is divisible by 4. These divisibility rules are the consequences of modular arithmetic.
Example 6.10. Let us prove the following divisibility rule for 3 and 9. Let n be a positive integer, and let m be the sum of the decimal digits of n. Then 3 | n if and only if 3 | m, and 9 | n if and only if 9 | m. Let us prove the divisibility rule for 3, as the divisibility rule for 9 is analogous to it. We write the number n in base 10:
k i n = ∑ ai10 , i=0
28 where ai ∈ {0,1,...,9}. Then, by definition,
m = ak + ak−1 + ... + a1 + a0.
Since 10 ≡ 1 (mod 3),
k k−1 n ≡ ak10 + ak−110 + ... + a1 · 10 + a0 k k−1 ≡ ak · 1 + ak−1 · 1 + ... + a1 · 1 + a0 ≡ ak + ak−1 + ... + a1 + a0 ≡ m (mod 3).
We conclude that 3 | (n − m), so there exists an integer k1 such that n − m = 3k1. Now assume that 3 | m. Then there exists an integer k2 such that m = 3k2. But then 3k1 = n − m = n − 3k2 implies n = 3(k1 + k2), which means that 3 | n. Analogously, we can show that if 3 | n, then 3 | m. If we replace the modulus 3 with the modulus 9, the proof will remain the same. Exercise 6.11. Prove the following divisibility rule for 11. Let n be an integer. Let m be the sum of the digits of n in blocks of two from right to left. Then 11 | n if and only if 11 | m. Example: If n = 3928881, then m = 3 + 92 + 88 + 81 = 264 is divisible by 11. Thus 3928881 is divisible by 11 as well.
7 The Ring of Residue Classes Zn
Recall that, according to our terminology, the set of all integers Z forms a ring, if 0,1 ∈ Z and for all a and b in Z we have a ± b ∈ Z and a · b ∈ Z. Now let n be a modulus. In this section, we will introduce the first example of a finite ring Zn and study its properties. As the name suggests, this ring will have only finitely many elements. Just like the ring of integers Z, it will contain its own analogues of 0 and 1, and we will also endow it with the operations of addition, subtraction and multiplication, which will be very much similar to the operations in Z. Definition 7.1. Let a be an integer. The set
[a] := {nq + a: q ∈ Z}
29 is called the residue class of a modulo n. The integer a is called a representative of the residue class [a].
Note that [a] = [b] if and only if a ≡ b (mod n). Also, each residue class contains an integer r such that 0 ≤ r < n. It is conventional to pick such integers as representatives. For example, if n = 5, even though one can denote the set of all integers congruent to 17 modulo 5 by [17], we would rather prefer to use [2] instead, since 17 ≡ 2 (mod 5) and 0 ≤ 2 < 5. Since there are only n possible numbers between 0 and n (exclusive), namely
0,1,2,...,n − 1, and each integer is congruent modulo n to exactly one of these numbers, we see that there are exactly n residue classes modulo n.
Exercise 7.2. Let n be a positive integer. Prove that the residue classes [0],[1], ..., [n − 1] modulo n partition the integers. That is,
[0] ∪ [1] ∪ ... ∪ [n − 1] = Z, and also [a] ∩ [b] 6= ∅ implies [a] = [b]. Hint: use Proposition 6.2. 9 We denote the collection of residues modulo n by Z/nZ or Zn. Since the notation Zn is utilized in your course notes, we will stick with it in these lecture notes.
Proposition 7.3. Let n be a positive integer and consider the collection Zn of all residues modulo n. Define the binary operations +, − and · as follows:
[a] ± [b] := [a ± b] and [a] · [b] := [a · b].
Then, under these binary operations, Zn forms a ring. Proof. Exercise. Hint: use Proposition 6.4.
Note that Zn is a finite ring. When we carry out operations in Zn, we are doing modular arithmetic. To do modular arithmetic, just carry out the regular arithmetic and then replace the result with any other integer modulo n (once again, conventionally we pick a representative r such that 0 ≤ r < n).
9 The latter notation might be ambiguous, as when p is prime the symbol Zp is used to represent the ring of p-adic integers.
30 Example 7.4. Here are two examples of a modular arithmetic in Z17:
[33] + [12] = [16] + [12] = [28] = [11].
[11] · [19] = [11] · [2] = [22] = [5]. Note that, in the case of addition, one could slightly simplify the computations by noting that 33 ≡ −1 (mod 17):
[33] + [12] = [−1] + [12] = [11].
After all, dealing with −1 is much simpler than with 16.
Despite the fact that Zn behaves much like Z, some of its properties might be rather unpleasant. For example, Z has no zero divisors apart from 0. In other words, the identity ab = 0 implies that either a = 0 or b = 0. In general, this is not true for Zn.
Example 7.5. To see that Z6 contains zero divisors that are 6= [0], note that
[2] · [3] = [6] = [0] = [2] · [0].
Thus we see that [2] · [3] = [0] in Z6, even though [2] 6= [0] and [3] 6= [0]. The same is true for Z15:
[3] · [5] = [15] = [0] = [3] · [0].
Thus we see another major difference between Z and Zn: in Z, the expression ab = ac with a 6= 0 implied b = c. However, in general, this is no longer true for Zn. It is not difficult to show that, in fact, Zn has no non-trivial zero divisors if and only if n is prime or n = 1.
8 Linear Congruences
Let n be a modulus. We will now turn our attention to equations in Zn. Let a,b be integers, and consider the linear equation
[a][x] = [b], where x is an unknown integer.
31 Example 8.1. The linear equation [7][x] = [3] has only one solution in Z13, namely [x] = [6]. As there are only finitely many possibilities, we may check all of them, from [0] to [12], in order to find a solution. Even though there is only one solution in Z13, there are actually infinitely many solutions in Z. This is because any integer y ∈ [6], — that is, any integer of the form y = 13q + 6, — satisfies 7y ≡ 3 (mod 13). The linear equation [3][x] = [6] has two solutions in Z9, namely [x] = [2] and [x] = [5]. Here we see the principal difference between the linear equation in Zn and the linear equation cx = d in Z: the only way cx = d can have more than one solution is if c = d = 0. Finally, the equation [3][x] = [7] has no solutions in Z9. Once again, we can easily verify this by plugging in all the possible values of [x] = [0],[1],...,[8]. It turns out that the tools that we have in our hands right now can help us to solve the linear congruence easily. Observe that [a][x] = [ax] = [b], and this is the same as solving the congruence ax ≡ b (mod n). Now by definition, n has to divide ax − b, so there exists an integer y such that ax − b = n(−y). In other words, the linear congruence [a][x] = [b] has a solution if and only if the Diophantine equation ax + ny = b has a solution in integers x and y. From what we have learned in Section 3, it im- mediately follows that the linear equation [a][x] = [b] has no solutions if and only if gcd(a,n) - b (verify that this is the case for the last two equations in Example 8.1). When the solutions exist, we can use the Extended Euclidean Algorithm to find them.
32 Example 8.2. Let us consider the linear equation [440][x] = [80] in Z300. From Example 5.7 we know that the solutions to
440x + 300y = 80 in integers x and y are of the form
x = −8 + 15n and y = 12 − 22n, where n is an integer. Thus [440][−8+15n] = [80] in Z300. By evaluating −8 + 15n at n = 1,2, . . . , 20 we obtain 20 distinct solutions in Z300, namely
[7],[22],[37],...,[292].
Note that gcd(440,300) = 20 and there are 20 distinct solutions. In Exercise 8.3, you are asked to prove that this phenomenon holds in general.
Exercise 8.3. Let n ≥ 1 be a modulus, a,b be integers such that a 6= 0. Prove that, if gcd(a,n) | b, then the total number of distinct residue classes satisfying [a][x] = [b] is equal to gcd(a,n).
? 9 The Group of Units Zn
Let n be a modulus and consider the finite ring Zn of residues modulo n. Recall that, in general, the ring Zn does not enjoy the property that if [a][b] = [a][c] and [a] 6= 0 then [b] = [c] (see Example 7.5). However, for special values of [a] called units this cancellation law actually holds.
Definition 9.1. The residue class [a] in Zn is called a unit if there exists a solution to [a][x] = [1] in Zn. If [a] is a unit, we say that any integer b ∈ [a] is invertible modulo n.
Proposition 9.2. The following statements are equivalent:
1. [a] is a unit;
2. For all integers b and c, [a][b] = [a][c] implies [b] = [c];
3. a and n are coprime.
33 Proof. Let us prove that 1 implies 2. Since [a] is a unit, there exists an integer x such that [a][x] = [1]. Now suppose that [a][b] = [a][c] for some integers b and c. Then [x][a][b] = [x][a][c].
Since Zn is a commutative ring, we see that [x][a] = [a][x] = [1]. Thus the above equality simplifies to [1][b] = [1][c], and this implies [b] = [c]. To prove that 2 implies 3, suppose that the statement is false and a and n are not coprime. WIthout loss of generality, we may assume that 0 ≤ a < n. Then there exists an integer p > 1 such that a = pk1 and n = pk2 for some integers k1 and k2. Since p > 1, we conclude that 1 ≤ k2 < n, which in turn implies
k1 6≡ 0 (mod n).
But then ak2 = pk1k2 = pk2k1 = nk1 ≡ 0 ≡ a · 0 (mod n).
Thus we see that [a][k2] = [a][0], even though [k2] 6= [0]. This contradicts our assumption, so a and n are coprime. Finally, let us demonstrate that 3 implies 1. Since a and n are coprime, by Bezout’s´ lemma there exist integers x and y such that ax+ny = 1. This means that [a][x] = [1], so by Definition 9.1 the residue class [a] is a unit.
Corollary 9.3. Let [a] be a unit in Zn. Then for any integer b the equation [a][x] = [b] has a unique solution.
Proof. Suppose that there are two solutions [x] and [y], so
[a][x] = [b] = [a][y].
By property 2 of Proposition 9.2, the identity [a][x] = [a][y] implies [x] = [y]. Note that the statements of Proposition 9.2 and Corollary 9.3 can be translated from the language of residue classes to the language of congruences. For example, property 1 simply states that ax ≡ 1 (mod n), while property 2 states that ab ≡ ac (mod n) implies b ≡ c (mod n). Finally, Corollary 9.3 implies that the congruence ax ≡ b (mod n) has a unique solution such that 0 ≤ x < n, and all integer solutions to this congruence must be of the form x + nq for q ∈ Z.
34 Proposition 9.4. If p is prime and [a] 6= [0] in Zp, then [a] is a unit. Furthermore, Zp has no zero divisors apart from [0] itself. Proof. Since [a] 6= [0], without loss of generality we may assume that 1 ≤ a < p. Note that this implies that a and p are coprime, for otherwise gcd(a, p) = d > 1 would imply d = p. But then p = d < a and a < p at the same time, a contradic- tion. Since gcd(a, p) = 1, by Bezout’s´ lemma there exist integers x and y such that ax + by = 1. But then [a][x] = [1], so by Definition 9.1 the residue class [a] must be a unit in Zp. Since every unit obeys the cancellation law stated in property 2 of Proposition 9.2, it follows that Zp has no zero divisors apart from [0] itself.
Definition 9.5. Let [a] be a unit in Zn. The element [x] satisfying [a][x] = [1] is −1 called an inverse of Zn and is denoted by [a] . When translated to the language of congruences, the fact that a is invertible modulo n implies the existence of an integer which we denote by a−1 such that
a · a−1 ≡ 1 (mod n).
Definition 9.6. The set of all units of Zn is called the group of units of Zn and is ? denoted by Zn.
Proposition 9.7. The set of all units of Zn forms a group under the operation of multiplication. That is, it satisfies the following four group axioms:
? ? 1. Closure. For all [a],[b] ∈ Zn, [a] · [b] ∈ Zn; 2. Associativity. ([a] · [b]) · [c] = [a] · ([b] · [c]);
? 3. Identity element. For all [a] in Zn, the element [1] satisfies
[a] · [1] = [1] · [a] = [a];
? −1 ? 4. Inverse element. For each [a] in Zn there exists an element [a] in Zn such that [a] · [a]−1 = [a]−1 · [a] = [1].
? 10 Furthermore, the group of units Zn is finite and Abelian: 10In the context of groups, it is conventional to use the word “Abelian” instead of “commuta- tive”.
35 ? 5. Abelianness. For all [a],[b] ∈ Zn, [a] · [b] = [b] · [a]; ? 6. Finiteness. There are only finitely many elements in Zn. Proof. Exercise.
? Example 9.8. Let us compute Z10. By Proposition 9.2, it suffices to find all ? integers m, 0 ≤ m < 10, that are coprime to 10. Thus Zn = {1,3,7,9}. To convince ? ourselves that Z10 is closed under the operation of multiplication, let us construct the multiplication table:
· 1 3 7 9 1 1 3 7 9 3 3 9 1 7 7 7 1 9 3 9 9 7 3 1
We can see that all of the elements in the multiplication table are indeed in ? Z10. Furthermore, we see that each row, as well as each column in this table is just a result of permutation of 1,3,7 and 9. In the future, we will see that this is not a coincidence.
10 Euler’s Theorem and Fermat’s Little Theorem
We will now prove our first non-trivial result — the Euler’s Theorem.
Definition 10.1. Let ϕ(n) denote the number of integers m such that 0 ≤ m < n and gcd(m,n) = 1. The function ϕ is called the Euler’s totient function.
Exercise 10.2. Let #X denote the cardinality of a set X. Let n be a modulus. Prove ? that ϕ(n) = #Zn. ? ϕ(n) Theorem 10.3. (Euler’s Theorem) If [a] ∈ Zn, then [a] = [1]. Proof. 11 Let k = ϕ(n). Let
[1] = [u1],[u2],...,[uk]
11Theorem 3.16 in Frank Zorzitto, A Taste of Number Theory.
36 ? ? be the complete list of residues of Zn. Since Zn is a group, all the elements
[a] · [u1],[a] · [u2],...,[a] · [uk]
? are in Zn. Furthermore, no element appears in this list twice, for if [a] · [ui] = [a] · [u j] for some i 6= j, then [ui] = [u j] by property 2 of Proposition 9.2. Hence the second list is just a permutation of [u1],[u2],...,[uk]. Thus
[u1] · [u2]···[uk] = ([a] · [u1]) · ([a] · [u2])···([a] · [uk]).
? Since Zn is an Abelian group, we can rearrange the order of multiplication in order to obtain k [u1] · [u2]···[uk] = [a] · [u1] · [u2]···[uk].
Finally, we refer to property 2 of Proposition 9.2 to cancel the unit [u1]·[u2]···[uk], and conclude that [a]k = [1]. In the language of congruences, Euler’s Theorem translates to
aϕ(n) ≡ 1 (mod n) for every integer that is invertible modulo n.
Example 10.4. Let us prove that 1223 divides 6231222 − 1. This become evident once we note that ϕ(1223) = 1222 and gcd(1223,623) = 1 (so [623] is a unit in Z1223). By Euler’s Theorem, 6231222 ≡ 1 (mod 1223), which means that 1223 divides 6231222 − 1.
Corollary 10.5. (Fermat’s Little Theorem) Let p be prime. Then for any integer p− a such that p - a it is the case that [a] 1 = [1]. In other words, ap−1 ≡ 1 (mod p).
Proof. Note that for any integer a such that 1 ≤ a < p it is the case that gcd(a, p) = 1. ? Thus [a] is a unit in Zp and ϕ(p) = p − 1. The result then follows from Euler’s Theorem. The theorems of Euler and Fermat give us a useful tool for raising integers to high powers modulo n.
37 Proposition 10.6. 12 If n is a modulus, a is coprime to n, and k, ` are non-negative integers such that k ≡ ` (mod ϕ(n)), then ak ≡ a` (mod n).
Proof. Say k ≤ `. We are given that ` = qϕ(n) + k for some q ≥ 0. Then, by Euler’s Theorem, q a` = aqϕ(n)+k = aϕ(n) ak ≡ 1qak = ak (mod n).
155 Example 10.7. Let us compute 177 modulo 33. Note that ϕ(33) = 20. Since gcd(17,33) = 1, by Euler’s theorem it first makes sense to reduce 7155 modulo 20. We can apply Euler’s Theorem again here. Note that ϕ(20) = 8, and since gcd(7,8) = 1 we can see that 78 ≡ 1 (mod 20). But then, by Proposition 10.6,
7155 = 719·8+3 ≡ 73 ≡ 343 ≡ 3 (mod 20).
Thus 155 177 ≡ 173 ≡ 4913 ≡ 33 (mod 33).
Exercise 10.8. Compute the integer n, 0 ≤ n < 55, such that
2134 n ≡ 813 (mod 55).
11 The Chinese Remainder Theorem
Now that we know how to solve linear congruences, let us try to understand how to work with systems of congruences. Since the congruence relation ≡ behaves much like the equality relation =, solving a system of linear congruences with a single modulus would be very similar to solving a system of linear equations, which we already know how to handle through the methods of linear algebra.
12Proposition 3.20 in Frank Zorzitto, A Taste of Number Theory.
38 On the other hand, if we consider different systems of different moduli, things might get interesting. We will merely consider the most simple example of such systems, namely x ≡ a1 (mod n1), x ≡ a2 (mod n2), ... x ≡ ak (mod nk), where a1,a2,...,ak are integers and n1,n2,...,nk are positive integers greater than 1 that are pairwise coprime. Our goal here is to determine x, which satisfies all of the k congruences above. The existence of such an x is asserted by the Chinese Remainder Theorem. Before proceeding to its statement, let us recall Proposition 3.12 and the following consequence of it.
Proposition 11.1. Let m and n be integers greater than 1 that are coprime. Then the congruence a ≡ b (mod mn) is true if and only if both of the congruences
a ≡ b (mod m), a ≡ b (mod n) are true.
Proof. Suppose that a ≡ b (mod mn). Then mn | (a − b). But then m | (a − b) and n | (a − b) so, by definition, a ≡ b (mod m) and a ≡ b (mod n). To prove the converse, suppose that a ≡ b (mod m) and a ≡ b (mod n). Then m | (a − b) and n | (a − b). Since gcd(m,n) = 1, we may apply Proposition 3.12 to conclude that mn | (a − b). Thus a ≡ b (mod mn).
Theorem 11.2. (The Chinese Remainder Theorem)13 If m, n are coprime moduli and a, b are any integers, then the congruences
x ≡ a (mod m), x ≡ b (mod n) have a common solution x. Furthermore, any two solutions x,y to this pair of congruences must be such that x ≡ y (mod mn). 13Theorem 4.2 in Frank Zorzitto, A Taste of Number Theory.
39 Proof. Since m and n are coprime, by Bezout’s´ lemma the equation
mt − ns = b − a can be solved integers s and t. Thus mt +a = ns+b = x. Note that x ≡ a (mod m) and x ≡ b (mod n), which makes it a solution to both congruences. If y is another solution to the system of congruences, then
x ≡ y (mod m), x ≡ y (mod n).
By Proposition 11.1, we conclude that x ≡ y (mod mn). We can easily generalize this result to arbitrary number of coprime moduli.
14 Theorem 11.3. (Generalized Chinese Remainder Theorem) Suppose n1,n2,...,nk are moduli that are pairwise coprime. That is, ni and n j are coprime when i 6= j. If a1,a2,...,ak are integers, then there exists an integer x such that x ≡ a1 (mod n1), x ≡ a2 (mod n2), ... x ≡ ak (mod nk).
Furthermore, if x0 is such a solution of these congruences, then the complete solution is given by all
x ≡ x0 (mod n1n2 ···nk).
Example 11.4. Let us solve the system of congruences ( x ≡ 3 (mod 6), x ≡ 7 (mod 13).
Since 6 and 13 are coprime, by Bezout’s´ lemma there exist integers x and y such that 6x + 13y = 1.
14Theorem 4.3 in Frank Zorzitto, A Taste of Number Theory.
40 Note that x = −2 and y = 1 give us an answer. We can multiply both sides of the above equality by 7 − 3 = 4 to obtain a solution to
6x0 + 13y0 = 7 − 3.
Such a solution is given by x0 = 4·(−2) = −8 and y0 = 1·4 = 4. After rearranging, we get 3 + 6x0 = 7 − 13y0 = −45. Note that −45 ≡ 3 (mod 6) and −45 ≡ 7 (mod 13). Since 6 and 13 are coprime, by the Chinese Remainder Theorem the congruence x ≡ −45 ≡ 33 (mod 78) captures all integer solutions to the original system of congruences.
Exercise 11.5. Solve the system of congruences x ≡ 3 (mod 5), x ≡ 5 (mod 7), x ≡ 7 (mod 11).
12 Polynomial Congruences
The Chinese Remainder Theorem can also be utilized to solve polynomial con- gruences. Let d be a positive integer and consider a polynomial
d d−1 f (x) = cdx + cd−1x + ... + c1x + c0 with integer coefficients c0,c1,c2,...,cd. Then the congruence of the form
f (x) ≡ 0 (mod n) (4) is called a polynomial congruence. We would like to find all integers x, which satisfy such a congruence. Note that, if we replace the coefficients ci of f (x) with their residue classes [ci], thus “reducing” our polynomial from Z to Zn, solving the congruence (4) is equivalent to solving the equation
f ([x]) = [0] in Zn. If such an equation is satisfied by some residue class [x0], we say that [x0] is a root of f (x) in Zn.
41 Let e1 e2 ek n = p1 p2 ··· pk be the prime factorization of n. Then, as it turns out, there is a one-to-one corre- spondence between solutions to the congruence (4) and solutions to the system of congruences f (x) ≡ ( pe1 ) 0 mod 1 ; e2 f (x) ≡ 0 (mod p2 ); ... ek f (x) ≡ 0 (mod pk ). This result follows from the next proposition, which is very similar to Proposition 11.1.
Proposition 12.1. Let f (x) ∈ Z[x] be a polynomial. Let m and n be coprime moduli. Then f (x) ≡ 0 (mod mn) if and only if ( f (x) ≡ 0 (mod m); f (x) ≡ 0 (mod n).
Proof. Suppose that f (x) ≡ 0 (mod mn). Then mn | f (x), which means that m | f (x) and n | f (x). Suppose that f (x) ≡ 0 (mod m) and f (x) ≡ 0 (mod n). Then m | f (x) and n | f (x). Since m and n are coprime, it follows from Proposition 3.12 that mn | f (x).
e1 e2 ek Coming back to our previous notation, if n = p1 p2 ··· pk is the prime factor- ization of n, and integers x1,x2,...,xk satisfy
ei f (xi) ≡ 0 (mod pi )
ei for i = 1,2,...,k, then we can find x such that x ≡ xi (mod pi ) for all i using the Generalized Chinese Remainder Theorem. But then such an x would satisfy ei f (x) ≡ 0 (mod pi ) for all i, and therefore f (x) ≡ 0 (mod n). From here it follows ei that, if each congruence f (x) ≡ 0 (mod pi ) has si solutions, then the congruence f (x) ≡ 0 (mod n) has s1s2 ···sk solutions. Now we would like to determine how many solutions does a polynomial con- gruence f (x) ≡ 0 (mod pe) have. Due to the time limitations, we will answer this
42 question only in the case e = 1, and show that there are at most d solutions, where d is the degree of f (x). We remark that, in general, there are at most d solutions when p is an odd prime, and at most 2d solutions when p = 2. The most accurate estimates on the number of solutions of polynomial congruences was established in 1991 by the Canadian mathematician Cameron L. Stewart, who is currently a professor at the University of Waterloo. Proposition 12.2. 15 If p is prime and f (x) is a polynomial of degree d with coefficients in Zp, then f (x) has at most d roots in Zp. Proof. We will prove this result by induction on the degree d of a polynomial f (x). Base case. Let d = 0. Then f (x) = α0 for some non-zero α0 in Zp. Clearly, this polynomial has 0 ≤ d = 0 roots, so the result holds. Induction hypothesis. Suppose that the result is true for all polynomials of degrees k = 1,2,...,d − 1. Induction step. We will show that the result holds for every polynomial of degree k = d. Let
d d−1 f (x) = αdx + αd−1x + ... + α1x + α0, where αd 6= 0. If f (x) has no roots, then surely 0 ≤ n. Otherwise f (x) has a root, say β. Then
f (x) = f (x) − 0 = f (x) − f (β) d d d−1 d−1 = αd(x − β ) + αd−1(x − β ) + ... + α1(x − β). Now recall that, for any positive integer j ≥ 2 it is the case that
x j − β j = (x − β)(x j−1 + x j−2β + x j−3β 2 + ... + xβ j−2 + β j−1).
Now we see that we can factor out (x−β) in the expression for f (x) given above, which means that f (x) = (x − β)g(x) for some polynomial g(x) with coefficients in Zp. Clearly, the degree of g(x) does not exceed d − 1, so we can apply the inductive hypothesis to conclude that g(x) as at most d − 1 roots. 15Proposition 5.14 in Frank Zorzitto, A Taste of Number Theory.
43 Let γ 6= β be some root of f (x). Then 0 = f (γ) = (γ − β)g(γ). We claim that g(γ) = 0. For assume otherwise, so that g(γ) 6= 0 and γ −β 6= 0. But then both γ − β and g(γ) are non-trivial zero divisors in Zp, and this contradicts Proposition 9.4, which asserts that there are no non-trivial zero divisors in Zp whenever p is prime. We conclude that g(γ) = 0. Since every root of f (x) is either equal to β or one of at most d − 1 roots of g(x), we conclude that there are at most d roots of f (x). Example 12.3. Let us solve the polynomial congruence x49 + 2x33 + 24 ≡ 0 (mod 119). Note that 119 = 7 · 17. By Proposition 12.1, there is a one-to-one correspondence between the roots to the above congruence and the roots to the system of congru- ences ( x49 + 2x33 + 24 ≡ 0 (mod 7); x49 + 2x33 + 24 ≡ 0 (mod 17). Let us solve each of these congruences separately. Consider the case n = 7 with ϕ(7) = 6. Note that x ≡ 0 (mod 7) is not a solution. This means that gcd(x,7) = 1, so we may apply Euler’s Theorem: x49 + 2x33 + 24 ≡ x8·6+1 + 2x5·6+3 + 24 ≡ x + 2x3 + 24 ≡ 2x3 + x + 3 (mod 7). Thus we need to solve the congruence 2x3 + x + 3 ≡ 0 (mod 7). After evaluating the left hand side at x = 1,2,3,4,5,6, we can convince ourselves that there are only two solutions, namely x ≡ 2 (mod 7) and x ≡ 6 (mod 7). Consider the case n = 17 with ϕ(17) = 16. Note that x ≡ 0 (mod 17) is not a solution. This means that gcd(x,17) = 1, so we may apply Euler’s Theorem: x49 + 2x33 + 24 ≡ x3·16+1 + 2x2·16+1 + 24 ≡ x + 2x + 24 ≡ 3x + 24 (mod 17).
44 Thus we need to solve the congruence
3x + 24 ≡ 0 (mod 17).
We see that x ≡ −8 ≡ 9 (mod 17) is a solution. Since 17 is prime, it follows from Proposition 12.2 that this is the only solution. Since there are two solutions modulo 7 and only one solution modulo 17, we conclude that there are 2 · 1 = 2 solutions modulo 7 · 17 = 119. These solutions correspond to two systems of equations: ( ( x ≡ 2 (mod 7), x ≡ 6 (mod 7), and x ≡ 9 (mod 17); x ≡ 9 (mod 17).
We can compute solutions modulo 119 using the Extended Euclidean Algorithm. Consider the first system of congruences. Since 7 and 17 are coprime, by Bezout’s´ lemma there exists a solution to
7x + 17y = 1.
For example, x = 5 and y = −2. By multiplying both sides of the above equality by 9 − 2 = 7, we can find a solution to
7x0 + 17y0 = 9 − 2 = 7, namely x0 = 7 · x = 35 and y0 = 7 · (−2) = −14. But then
0 0 x1 = 2 + 7x = 9 − 17y = 247 satisfies x1 ≡ 2 (mod 7) and x1 ≡ 9 (mod 17). Therefore x1 ≡ 247 ≡ 9 (mod 119) is a solution. The second system of congruences can be solved analogously and gives us a solution x2 ≡ 111 (mod 119).
Exercise 12.4. Give examples of polynomials with coefficients in Z8 and Z15 for which the conclusion of Proposition 12.2 does not hold.
13 The Discrete Logarithm Problem. ? The Order of Elements in Zn
Let n be a modulus. We already looked at certain kinds of equations in Zn. For ex- 2 2 2 2 2 ample, in Section 6, we learned that neither [x] +[y] = 3 in Z4 nor [x] + [y] + [z] = 7
45 in Z8 have solutions. In Section 8, we studied the equation [a][x] = [b] in Zn and saw that the usual application of the Extended Euclidean Algorithm allows us to produce all of its solutions. ? Now we want to understand how to handle exponential equations in Zn. In ? these kinds of equations, we are given residue classes [a] and [b] from Zn, and we want to determine all integer solutions x to the equation [a]x = [b]. This is essentially the same as solving the congruence
ax ≡ b (mod n).
The problem of finding solutions to these exponential equations is known as the discrete logarithm problem, or DLP. Example 13.1. In Section 10, we already saw an example of an exponential equa- ? tion in Zn, namely ax ≡ 1 (mod n). According to Euler’s Theorem, this equation always has a non-zero solution when- ever a and n are coprime. In particular, any x ≡ 0 (mod ϕ(n)) satisfies the above congruence, for if x = ϕ(n)k for some integer k, then
ax ≡ aϕ(n)k ≡ (aϕ(n))k ≡ 1k ≡ 1 (mod n).
However, we do not know whether there are no other solutions to this equation. Depending on the choice of a, there might exist other solutions as well. In general, the discrete logarithm problem is hard to solve. This problem lies in the foundation of certain cryptosystems, which we will study in the fu- ture. Examples include the ElGamal encryption scheme and the Diffie-Hellman key exhchange. There are algorithms for solving the discrete logarithm problem, such as Shanks’s baby-step giant-step algorithm, or the number field sieve. None of these algorithms run in polynomial time. However, just like for the problem of integer factorization, there are quantum algorithms which compute solve the discrete logarithm problem in polynomial time. In these notes, when solving the discrete logarithm problem, we will use brute force or apply Euler’s Theorem. In order to understand how solutions to ax ≡ b (mod n) look like, we need to ? understand certain fundamental properties of the group of units Zn. ? Definition 13.2. If α ∈ Zn, the order of α is the smallest exponent k ≥ 1 such that αk = 1. The order is denoted by k = ord(α) or, if α = [a] for some integer a, by k = ord(a).
46 ? From Euler’s Theorem, it follows that for all α ∈ Zn it is the case that ord(α) ≤ ϕ(n). In fact, a much stronger result holds. 16 ? m Proposition 13.3. Let α ∈ Zn. A positive integer m satisfies α = 1 if and only if ord(α) | m. Consequently, ord(α) | ϕ(n). Proof. Let k = ord(α). We apply the Remainder Theorem and write m = kq + r, where 0 ≤ r < k. Then, since αk = 1, we obtain 1 = αm = αkq+r = (αk)qαr = 1qαr = αr. Since k is the smallest positive integer satisfying αk = 1, it must be the case that r = 0, so k | m. For the converse, let m = kq. Then αm = αkq = (αk)q = 1q = 1. Finally, according to Euler’s Theorem it is the case that αϕ(n) = 1. But then it follows from what we proved above that ord(α) | ϕ(n). ? Example 13.4. Let us determine ord(α) in Zn for n = 17 and α = [3]. We have ϕ(n) = 16. Note that D = {1,2,4,8,16} is the complete list of positive divisors of ϕ(n). It follows from Proposition 13.3 that ord(α) ∈ D. Thus, in order to find the order of α, we just need to iterate over all elements in D. The smallest element d satisfying [3]d = [1] is the order. We have 31 ≡ 3 (mod 17), 32 ≡ 9 (mod 17), 34 ≡ (32)2 ≡ 92 ≡ 81 ≡ −4 (mod 17), 38 ≡ (34)2 ≡ (−4)2 ≡ 16 ≡ −1 (mod 17), 316 ≡ (38)2 ≡ (−1)2 ≡ 1 (mod 17). Thus we see that ord(α) = 16, which is the largest possible order that the element ? 16 of Z17 can attain. Note that there was no need for us to compute 3 modulo 17, because we know the result from Euler’s Theorem. ? In contrast, consider the element β = [9] in Z17. We have 1 ≡ 316 ≡ (32)8 ≡ 98 (mod 17), which means that ord(β) ≤ 8. Convince yourself that, in fact, ord(β) = 8.
16Propositon 5.5 in Frank Zorzitto, A Taste of Number Theory.
47 Proposition 13.3 allows us to classify all solutions to the exponential equation [a]x = [b].
? Proposition 13.5. Let [a],[b] be the elements of Zn. If x satisfies the equation [a]x = [b], then all solutions x0 to this equation satisfy
x0 ≡ x (mod ord(a)).
Proof. Let x be a solution to ax ≡ b (mod n) and let k = ord(a). By the Remainder Theorem, we can write x = kq + r, where 0 ≤ r < k. But then
ax ≡ akq+r ≡ (ak)q · ar ≡ 1 · ar ≡ ar (mod n).
Thus, without loss of generality, we may assume that 0 ≤ x < k. Now suppose 0 that there exists some other x0 such that ax ≡ b (mod n). Once again, without loss of generality we may assume that 0 ≤ x ≤ x0 < k. But then
0 ax ≡ b ≡ ax (mod n) implies 0 ax −x ≡ 1 (mod n). Since 0 ≤ x0 − x < k, it must be the case that x = x0, for otherwise we would get a contradiction to the fact that k is the smallest positive integer satisfying ak ≡ 1 (mod n). Therefore all solutions to [a]x = [b] are of the form x0 ≡ x (mod ord(a)).
Example 13.6. Let us compare the solutions to exponential equations
3x ≡ 1 (mod 17) and 9y ≡ 1 (mod 17).
In the first case, we see that the congruence x ≡ 0 (mod 16) captures all solutions. However, in the second case, even though y ≡ 0 (mod 16) does provide solutions, it clearly does not cover all of the possibilities because, for example, y = 8 also satisfies 9y ≡ 1 (mod 17). In fact, Proposition 13.5 implies that the solutions are of the form y ≡ 0 (mod 8). We conclude this section with several general observations about orders of ? elements of Zn.
48 17 ? Proposition 13.7. If α ∈ Zn and k = ord(α), then the list α,α2,α3,...,αk = 1 does not repeat itself. Proof. Suppose that we have a repetition αi = α j, where 1 ≤ i < j ≤ k. Thus α j−i = 1. Since 1 ≤ j − i < k, this contradicts the minimality of k as the order of α. 18 ? Proposition 13.8. If α ∈ Zn and k = ord(α), then k ord(α j) = . gcd( j,k)
Proof. Let ord(α j) = `. We will show that ` = k/gcd( j,k). Note that
α j` = (α j)` = 1.
It follows from Proposition 13.3 that k | j`. That is, j` = ku for some integer u. But then j k ` = u, gcd( j,k) gcd( j,k) and since j/gcd( j,k) and k/gcd( j,k) are coprime, it follows from Proposition 3.13 that k/gcd( j,k) divides `. On the other hand, since k is the order of α,
(α j)k/gcd( j,k) = (αk) j/gcd( j,k) = 1 j/gcd( j,k) = 1.
By Proposition 13.3 applied to the order of α j, we obtain that ` | k/gcd( j,k). Since k/gcd( j,k) | ` and ` | k/gcd( j,k), we conclude that ` = k/gcd( j,k).
19 ? j Corollary 13.9. Let α be an element of Zn. Then ord(α ) = ord(α) if and only if gcd( j,ord(α)) = 1. 20 ? Proposition 13.10. Let α, β in Zn have orders k and `, respectively. If k and ` are coprime then ord(αβ) = k`. 17Proposition 5.6 in Frank Zorzitto, A Taste of Number Theory. 18Proposition 5.7 in Frank Zorzitto, A Taste of Number Theory. 19Proposition 5.9 in Frank Zorzitto, A Taste of Number Theory. 20Proposition 5.16 in Frank Zorzitto, A Taste of Number Theory.
49 Proof. Let m = ord(αβ). Since
(αβ)k` = αk`β k` = (αk)`(β `)k = 1`1k = 1, we see from Proposition 13.3 that m | k`. We will now show that k` | m. Since gcd(k,`) = 1, it follows from Proposition 3.12 that we only need to demonstrate k | m and ` | m. On one hand,
(αm)k = αmk = (αk)m = 1m = 1 and (β m)` = β m` = (β `)m = 1m = 1. On the other hand,
(αm)` = (αm)` · 1 = (αm)`(β m)` = (αmβ m)` = ((αβ)m)` = 1` = 1.
It follows from above calculations, as well as from Proposition 13.3, that k | m`. Since k and ` are coprime, Proposition 3.13 allows us to conclude that k | m. We can carry out an analogous calculation to show that (β m)k = 1, which would imply ` | m. But then k` | m, and since we already demonstrated that m | k`, it must be the case that m = k`.
14 The Primitive Root Theorem
? Let n be a modulus. The elements α ∈ Zn whose order is equal to ϕ(n) deserve a special attention. According to Proposition 13.7, they generate the whole group ? 2 ϕ(n) Zn simply by computing the exponents α,α ,...,α = 1. Such elements are called primitive roots and in this section we address the question of their existence ? in Zn. We will answer this question only partially by proving the Primitive Root Theorem.
? Definition 14.1. An element α ∈ Zn is called a primitive root if ord(α) = ϕ(n).
50 ? Example 14.2. Let us demonstrate that Z17 contains a primitive root. If we reduce the elements in the list {3,32,33,...,316} modulo 17, then the resulting list is
{3,9,10,13,5,15,11,16,14,8,7,4,12,2,6,1}.
? Note that all 16 elements are distinct and they constitute the whole Z17. ? Not every element in Z17 is a primitive root. For example, the observation made above does not hold for the list {9,92,93,...,916} reduced modulo 17:
{9,13,15,16,8,4,2,1,9,13,15,16,8,4,2,1}.
The first 8 elements are distinct, and starting from the 9th element the pattern 2 ϕ(n) ? repeats. Hence 9,9 ,...,9 = 1 do not produce Z17, which is not a surprise, because from Example 13.4 we know that ord(9) = 8. There are groups which have no primitive roots at all. For example, there ? are no primitive roots in Zn whenever n has at least two distinct prime divisors. ? ? ? Examples include Z6,Z10 or Z15, and we leave it as an exercise to the reader to verify that each of these three groups have no primitive roots. Before jumping into the proof of the Primitive Root Theorem, let us determine ? how many primitive roots are there in Zn. 21 ? Proposition 14.3. If Zn has a primitive root, then the total number of primitive ? roots in Zn is ϕ(ϕ(n)). Proof. Let α be a primitive root, so that ord(α) = ϕ(n) and
α,α2,...,αϕ(n) = 1
? j cover all Zn without repetition. The other primitive roots are those powers α in the list for which ord(α j) = ϕ(n) = ord(α). According to Corollary 13.9, these are the powers α j where j from 1 to ϕ(n) is coprime to ϕ(n), and there are precisely ϕ(ϕ(n)) such j’s. We are now ready to state the Primitive Root Theorem.
22 ? Theorem 14.4. (The Primitive Root Theorem) Let p be prime. Then Zp con- tains a primitive element.
21Proposition 5.10 in Frank Zorzitto, A Taste of Number Theory. 22Theorem 5.17 in Frank Zorzitto, A Taste of Number Theory.
51 If you are familiar with the basics of group theory, then you can translate the statement of the theorem into group theoretical language by saying that the group ? Zp is cyclic whenever p is prime. In order to prove this result, we need to prove one lemma.
23 ? Lemma 14.5. Let p be prime. If α is an element of Zp of order k, then
α,α2,...,αk−1,αk = 1
? k is the complete, non-repeating list of all β in Zp such that β = 1. Proof. According to Proposition 13.7, the list α,α2,...,αk contains no repeti- tions. Every α j in the list satisfies
(α j)k = (αk) j = 1 j = 1.
Hence every element in the list is a root of the polynomial xk − 1. Since we found k distinct roots of the polynomial xk − 1 whose degree is k, it follows from Proposition 12.2 that there are no other roots.
? Proof. (of Theorem 14.4) Let α be an element of Zp. If ord(α) = p − 1, then α is a primitive root, so we are done. Thus we may assume that k = ord(α) < p−1. According to Lemma 14.5, the list α,α2,...,αk = 1 picks up all roots of xk −1 ? ? in Zp. Since k < p − 1, there is some γ in Zp, which is not on this list. Hence γk 6= 1. k ` k/` Let ` = ord(γ). Notice that ` - k, for otherwise we would have γ = (γ ) = 1k/` = 1. This means that in the unique factorizations of k and `, there is a prime number q that appears more often in ` than it does in k. Therefore
d e k = q k1 and ` = q `1, where 0 ≤ d < e and q - k1, q - `1. d Let β = αq γ`1 . Then, according to Proposition 13.8,
d k k ord(αq ) = = = k , gcd(k,qd) qd 1 ` ` ord(γ`1 ) = = = qe. gcd(`,`1) `1
23Proposition 5.15 in Frank Zorzitto, A Taste of Number Theory.
52 e Since k1 and q are coprime, it follows from Proposition 13.10 that
d q `1 qd `1 e d ord(β) = ord(α γ ) = ord(α )ord(α ) = q k1 > q k1 = k = ord(α).
? In this way, new elements of strictly increasing order can be found in Zp, until we reach some element of the largest possible order ϕ(p) = p − 1. By definition, this element is a primitive root. In conclusion, we provide a statement of the Generalized Primitive Root The- ? orem, which provides a full classification of moduli n such that Zn contains a primitive root. Due to the time limitations, we will refrain from proving this re- sult. ? Theorem 14.6. (Generalized Primitive Root Theorem) The group of units Zn con- tains a primitive root if and only if n = 2, 4, an odd prime power, or an odd prime power multiplied by two.
15 Big-O Notation
Before we proceed to the discussion of primality tests and integer factorization algorithms, let us introduce several important definitions. When analyzing the performance of algorithms, we will often be using the big-O notation and the no- tion of a polynomial time (or subexponential time or exponential time) algorithm. Definition 15.1. Let f (n) and g(n) be two functions of n. We say that f (n) = O(g(n)) if there exists a positive real number M such that | f (n)| ≤ M|g(n)| for all sufficiently large n. Example 15.2. Let f (n) = n2 + 4n + 7 and g(n) = n3. Note that
12 = f (1) > g(1) = 1, 19 = f (2) > g(2) = 8, 28 = f (3) > g(3) = 27, 39 = f (4) < g(4) = 64, 52 = f (5) < g(5) = 125, ... so we see that, even though f (n) dominates g(n) for n = 1,2,3, the pattern changes for n = 4,5, and in fact it so happens that f (n) < g(n) for all n ≥ 4. Thus f (n) = O(g(n)). Note, however, that g(n) 6= O( f (n)).
53 Another example is f (n) = en and g(n) = 5en + en/2. Evidently, f (n) ≤ g(n), so f (n) = O(g(n)). However, one may also notice that g(n) = O( f (n)), because en/2 ≤ en, and this implies that
g(n) = 5en + en/2 ≤ 5en + en = 6en = 6 f (n), which means that g(n) = O( f (n)). In this case, we say that f (n) and g(n) have the same asymptotic behaviour as n approaches infinity.
The big-O notation is used in order to simplify f (n) whenever we are inter- ested not in its precise form, but rather in its behaviour for very large n. For example, a function f (n) = n5 + 2en + 3log(n) simplifies to f (n) = O(en), because 2en dominates all other summands present above (note that 3log(n) < n5 < 2en for sufficiently large n). Also, according to our definition, we may ignore the constant 2 in front of 2en, because it is present implicitly in the expression f (n) = O(en). Thus, when writing a certain expression in its big-O form, all that we need to do is to identify some “simple” function that dominates f (n), and we want to pick this function in the best way possible. Say, in the example above we could have written f (n) = O(e2n), but this is a less sharp estimate than f (n) = O(en), because e2n grows much faster than en. Thus the expression f (n) = O(en) tells us more information about the function f (n) than the expression f (n) = O(e2n). The most common types of functions that we will encounter are
O(1) at most constant growth; O(logn) at most logarithmic growth; O(nk) at most polynomial growth (k > 0); O exp cn1/k at most subexponential growth (c > 0,k > 1); O(exp(cn)) at most exponential growth (c > 0).
When analyzing the performance of algorithms, the function f (n) will rep- resent the number of steps required for the algorithm to terminate given the in- put n. For example, it was proved by Gabriel Lame´ that the computation of gcd(a,b) with the Euclidean algorithm requires at most 5log10(min{a,b}) steps, and this allows us to conclude that the performance of the Euclidean algorithm is O(log(min{a,b})). So the number of steps required for the algorithm to termi- nate grows logarithmically as min{a,b} approaches infinity.
54 Definition 15.3. Suppose that an algorithm takes a positive integer n as its input. We say that an algorithm works in polynomial time if there exists a positive real number k such that the number of steps required for it to compute is O (logn)k.
Once again, consider the Euclidean Algorithm. As the number of steps re- quired to compute gcd(a,b) is equal to O(log(min{a,b})), we see that we may take k = 1 in order to conclude that the algorithm works in polynomial time. This may seem a bit strange, because (logn)k is not a polynomial function (compare it to, say, n2 or n3 + n + 7, which are polynomials). But when talking about an algorithm, we are interested in its performance not with respect to an input n, but rather with respect to the size of an input. You may think of the size of n as the number of decimal digits of n. This number never exceeds blog10 nc + 1, so it is logarithmic in terms of n. So, if we provide n = 1000000 as an input to some algorithm, roughly speaking we would consider it efficient if it terminates in 7k steps for some positive integer k (note that 7 is the number of decimal digits of n) rather than in 1000000k steps. From this perspective, any algorithm which works in O(n) = O(elogn) would actually be considered as an algorithm which works in exponential time. Such algorithms can be used to compute values only for relatively small values of n.
Example 15.4. Here are some examples of famous algorithms and their asymp- totic running time.
• The fastest algorithm for integer multiplication known to date is the Toom- Cook Multiplication Algorithm, which was invented in 1963. Given two positive integers a and b, for d = log(max{a,b}) this algorithm requires O(d1.585) steps to compute, so it works in polynomial time;
• Shanks’s Baby-Step Giant-Step Algorithm, which was invented in 1971, al- lows one to compute discrete logarithms√ modulo n. If d = logn, then the running time of the algorithm is O( n) = O(ed/2), so it works in exponen- tial time;
• General number field sieve is the fastest algorithm which factors large in- tegers that is known to date. If n is an integer and d = logn, the algorithm 1/3 2/3 works in O(e2d (logd) ). The constant 2 in this expression is not optimal. We see that this algorithm is neither polynomial, nor exponential. These types of algorithms are called subexponential.
55 16 Primality Testing
For more details, please refer to the monograph by R. Crandall, C. Pomerance, Prime Numbers: A Computational Perspective, 2001. As it was mentioned in the introduction, number theory is heavily used in cryp- tography. In the upcoming sections, we will look at several cryptographic proto- cols, all of which, in one way or the other, involve primality testing. For example, in order to ensure that the communication provided by the RSA cryptosystem is secure, one has to be able to generate a pair of very large prime numbers (several thousands of bits). But how do we ensure that some given number n is prime, when we know that the problem of factorization of large integers is infeasible to electronic computers? It turns out that there are several alternative ways to verify that n is prime, which do not require the factorization of n. There are three kinds of primality tests out there, namely
1. Heuristic tests — tests that work well in practice, but reside on a heuristic explanation rather than on a proof (Fermat’s Primality Test);
2. Probabilistic tests — given n, these tests verify whether a number n is a pseudoprime, i.e., it is a prime with a very large probability (Miller-Rabin Primality Test);
3. Deterministic tests — given n, these tests guarantee the primality or the compositeness of n (trial division, AKS Primality Test, Elliptic Curve Pri- mality Test).
In this section, we will study the trial division method, the Fermat’s Primality Test and the Miller-Rabin Primality Test. We remark that the best known primal- ity test, the AKS Primality Test, was invented by Indian mathematicians Manindra Agrawal, Neeraj Kayal and Nitin Saxena in 2002. To this day, it is the only deter- ministic unconditional polynomial time algorithm for primality testing. In 2005, its asymptotic running time got improved by C. Pomerance and H. W. Lenstra, Jr. to O˜((logn)6). Despite all of its benefits, the probabilistic Miller-Rabin Primality Test is used in practice more often. If k denotes the number of times the algorithm has to run before we conclude that n is a pseudoprime, the asymptotic running time of the Miller-Rabin Primality Test is O(k(logn)3).
56 16.1 Trial Division What is the most obvious way for determining whether a given integer n ≥ 2 is composite? Well, one just has to find one of its non-trivial factors! That is, if we can show that there exists some integer d such that d | n and 1 < d < n, then n is composite. For example, if n = 35, we just have to check that 2 - 35, 3 - 35, 4 - 35, until we find out that 5 | 35. Therefore, 35 is a composite number. Of course, if we would consider n = 37, the problem arises, as now we have to check 2 - 37, 3 - 37, . . . , 36 - 37, until we find out that n is prime. Fortunately, as the following proposition suggests, there is no need to check all n − 2 numbers in between 1 and n to be certain that n is prime.
Proposition 16.1.√ For any composite integer n ≥ 2 there exists a divisor d such that 1 < d ≤ n. Furthermore, we may assume that d is prime.
Proof. Let n =√dk for some√ non-trivial divisors d and k. If we now suppose that both√d > n and k√> n, then dk > n, a contradiction. Therefore either 1 < d ≤ n or 1 < k ≤ n hold. Without loss of generality, assume the√ former. Since Theorem 2.7 asserts√ the existence of a prime p dividing d and d ≤ n, we see that 1 < p ≤ d ≤ n. Now we may adjust our primality test as follows. Let bxc denote the largest integer ≤ x. According to Proposition 16.1, in order to verify that n is prime, we just have to ensure that √ 2 - n,3 - n,...,b nc - n. √ For example, in the case of n = 37, we have b 37c = b6.083c = 6, and 2 - 37, 3 - 37, . . . , 6 - 37. Therefore 37 is prime. Thus√ we were able to reduce the number of steps in our primality test from n − 2 to b nc − 1. Quite a significant improve- ment! We can actually do slightly better. According to Proposition 16.1, we can limit ourselves only to prime divisors of n. So, in the case of n = 37, there was no need to check its divisibility by 4 or 6, since these numbers are composite. So we could achieve the same conclusion simply by testing 2 - 37, 3 - 37 and 5 - 37. In order√ to make this further improvement, we need to know all prime num- bers ≤ n. Fortunately, there is a rather simple method called the Sieve or Eratos- thenes, which allows us to produce all prime numbers up to X in O(X loglogX) steps (see Assignment 3). The method was discovered by the Greek mathemati- cian Eratosthenes of Cyrene (≈ 250BC), and goes as follows:
57 1. Initialize a table A of X elements by setting A[1] = 1 and A[i] = 0 for all 2 ≤ i ≤ X;
2. Let p = 2;
3. Set A[2p] = 1, A[4p] = 1, A[6p] = 1, and so on, for all multiples of p in the table A; √ 4. Change p to the smallest index k > p such that A[k] = 0. If p > X, terminate. Otherwise, return back to step 3.
In the end, all elements i such that A[i] = 0 will correspond to prime numbers. It follows from Merten’s Second Theorem that the asymptotic running time of the Sieve of Eratosthenes is O(X loglogX) (see Assignment 3). This can be further improved to O(X) if we start eliminating not from 2p (i.e. 2p, 4p, 6p, and so on), but from p2, thus crossing out p2,(p + 1)p,(p + 2)p, etc. The improvement becomes evident once we note that by the time the algorithm reaches prime p, the numbers 2p,3p,..., (p − 1)p already got eliminated by some prime√ less than p. Of course, it is impractical to run the Sieve of Eratosthenes up to n√each time we try to factor n, as then the asymptotic running time will always be O( n). This is why in practice one usually runs the Sieve of Eratosthenes up to some large bound first, then stores all prime numbers in the table, and later uses this table to factor integers. It follows from the Prime Number Theorem that the number of√ primes ≤ X is O(X/logX). So, assuming that the table of prime√ numbers up to n is given√ to us a priori, the trial division will now take O( n/logn) steps instead of O( n). Note the power of this method: for example, given a number n ≤ 1012, we just have to check p | n for all primes p ≤ 106. Given the table containing 78498 prime numbers less than a million, this verification can be done by the computer almost immediately. In fact this method should work quite fast for all numbers with at most 18 decimal digits. However, when the number of digits of n exceeds 18, things start to get more complicated: there are too many prime numbers to check, and it is difficult to fit all of them into memory at once.
16.2 Fermat’s Primality Test Another interesting way of demonstrating that a number n is composite is to use the Fermat’s Little Theorem, which states that, if n is prime and a is coprime to n,
58 then an ≡ a (mod n). Therefore all that we have to do to prove that n is composite is to find a such that an 6≡ a (mod n). If a satisfies such a property, we call it a witness for the non- primality of n. In practice, the computation of an (mod n) can be done relatively fast using the Double-and-Add Algorithm. Example 16.2. Let us use Fermat’s Primality Test to prove that n = 323 is not prime. Note that 323 = 28 + 26 + 2 + 1 = 256 + 64 + 2 + 1. Now pick a random a such that 1 < a < 323, say a = 5. If n is prime, then Fermat’s Little Theorem should hold for a. We use the Double-and-Add Algorithm to check whether this is the case: 52 ≡ 25, 532 ≡ (516)2 ≡ 256 54 ≡ (52)2 ≡ 302, 564 ≡ (532)2 ≡ 290 58 ≡ (54)2 ≡ 118, 5128 ≡ (564)2 ≡ 120 516 ≡ (58)2 ≡ 35, 5256 ≡ (5128)2 ≡ 188 (mod 323). Thus 5323 ≡ 5256 · 564 · 52 · 5 ≡ 188 · 290 · 25 · 5 ≡ 256 · 125 ≡ 23 6≡ 5 (mod 323). This result allows us to conclude that 323 is not prime. Note, however, that if we would randomly pick a = 18,152,170 or any other number for which a323 ≡ a (mod 323) actually holds, we would not be able to draw any conclusion about n. Fortunately, for 323 there are only 7 possible a’s between 1 and 323 such that a323 ≡ a (mod 323), so the probability of this happening is relatively small. And even if this happens, we could just pick yet another random value of a, for which a323 6≡ a (mod 323) might be true. From Example 16.2, the algorithm becomes clear. Let n be an integer, and let k ≥ 1 be the maximal number of times that we are going to choose a at random. Then do the following:
59 1. Set i = 0;
2. If i = k, conclude that n is a pseudoprime. Otherwise pick a random integer a such that 1 < a < n;
3. Compute an (mod n) using the Double-and-Add Algorithm;
4. If an 6≡ a (mod n), conclude that n is composite. Otherwise increment i and go back to step 2.
According to this algorithm, we conclude that n is a pseudoprime whenever k random choices of a result in an ≡ a (mod n). In practice, this algorithm works quite well, even though it is purely heuristic. However, there are some special composite numbers which do not admit witnesses of their non-primality at all.
Definition 16.3. A composite integer n is called a Carmichael number whenever
an ≡ a (mod n) for all integers a.
There exist infinitely many Carmichael numbers, and the first 10 of them are
561,1105,1729,2465,2821,6601,8911,10585,15841,29341.
They were discovered by the American mathematician Robert Carmichael. What is interesting is that the criterion for determining Carmichael numbers was found by the German mathematician Alwin Korselt in 1899, even before Carmichael numbers were discovered.
Theorem 16.4. 24 An integer n is a Carmichael number if and only if
1.n = p1 · p2 ··· pk, where k > 1 and p j are primes without repetition;
2. every p j − 1 divides n − 1.
Therefore every Carmichael number will always be regarded as a pseudoprime by the Fermat’s Primality Test and this is unavoidable.
24Theorem 5.21 in Frank Zorzitto, A Taste of Number Theory.
60 16.3 Miller-Rabin Primality Test This test was originally developed by Gary Miller in 1976 and it was deterministic, but its determinism relied on a reasonable but unproved conjecture, called the Extended Riemann Hypothesis. In 1980, Michael Rabin converted this algorithm into unconditional, but probabilistic algorithm. This is the algorithm that we are going to learn about. To understand the idea behind the Miller-Rabin primality test, recall that the congruence x2 ≡ 1 (mod p) has exactly two solutions, namely x ≡ ±1 (mod p), whenever p is prime. This simply follows from Proposition 12.2 applied to the quadratic polynomial x2 − 1 with coefficients in Zp. Now let n > 2 be prime. Then n − 1 = 2sd for some positive integers s and d, where d is odd. According to Fermat’s Little Theorem,
s s−1 2 an−1 ≡ a2 d ≡ a2 d ≡ 1 (mod n).
s−1 s−1 Thus we see that a2 d is a root of x2 −1 modulo n. Since n is prime, a2 d ≡ ±1 s−1 (mod n). If a2 d ≡ −1 (mod n), we stop. Otherwise, we can extract the square s−2 root one more time, so that a2 d ≡ ±1 (mod n), and so on, until we either reach r a2 d ≡ −1 (mod n) for some r or ad ≡ 1 (mod n). We conclude that, if n is prime, then
• either ad ≡ 1 (mod n); or
r • a2 d ≡ −1 (mod n) for some r such that 0 ≤ r ≤ s − 1.
Thus, if we could show that
ad 6≡ 1 (mod n) and r a2 d 6≡ −1 (mod n) for all r such that 0 ≤ r ≤ s − 1, then n has to be composite. Note that with the s Fermat’s Primality Test we would only check for a2 d ≡ 1 (mod n), whereas in the s−1 Miller-Rabin primality test we perform s checks for ad,a2d,...,a2 d (mod n). As it turns out, this is more than enough to fix many problems that we saw with
61 Fermat’s Primality Test. For example, Catalan numbers can be recognized as composite numbers. Furthermore, one can prove that at least 3/4 of a’s coprime to an odd composite number n are witnesses of n’s compositeness. Therefore, the probability that the Miller-Rabin Test would fail is at most 1/4, which means that after k verifications the probability that n is composite while it is reported as pseudoprime is at most 1/4k. Unfortunately, one cannot do better than that, and predict the location of wit- nesses in Z/nZ. Their distribution can be very different, and this is why choosing a at random is better than to use a = 2,3,5,... iteratively. For example, Arnaut found a 397-digit composite number for which all bases a < 307 are not witnesses. This number was reported to be prime by the Maple isprime() function, because it picked prime bases a = 2,3,5,... iteratively, rather than randomly.
Example 16.5. Let us show that n = 323 is a pseudoprime using Miller-Rabin Primality Test and base a = 18. Note that a323 ≡ a (mod n), so if we would use Fermat’s Primality Test on n only once, it would report n as a pseudoprime. However, 322 = 2 · 161, and we note that
18161 ≡ 18 6≡ ±1 (mod 323), so n = 323 would be reported as composite by the Miller-Rabin Primality Test.
17 Public Key Cryptosystems. The RSA Cryptosystem
For more details, please refer to the monograph by W. Trappe, L. C. Washington, Introduction to Cryptography with Coding Theory, 2nd edition, 2006. Suppose that Alice wants to send a secret message to Bob, and because they are too far away from each other and personal communication is impossible, she needs to send this message over the internet. The channel between Alice’s com- puter and Bob’s computer is unprotected. While travelling from one computer to the other, the message passes many times through many different routers, and it is possible to intercept it by listening on the channel. For example, this can be done with packet analyzers like WireShark. Though interception of the message is hardly avoidable, it is possible to protect the information itself through encryption. Since the antiquity, the humanity was using what we now call private key cryptosystems. Perhaps, the most famous example of a private key encryption
62 is the so-called Caesar cypher. According to Suetonius, Julius Caesar used this cypher in order to encrypt messages of military significance. The cypher shifts the message by 3 letters to the left: A → X, B → Y, C → Z, D → A,..., Y → T, Z → V (note that we used Latin alphabet instead of English alphabet). For example, the phrase DEVS EX MACHINA can be encrypted using Caesar’s cypher as follows: ABRP BS IXZEFKX Now this cypher is not terribly sophisticated, but back in Caesar’s time it was considered quite complex, and surely the receiver would have to know the magical number 3 in order to decrypt it by shifting letters three times to the right. So, as we can see, both the sender and the receiver, along with the encryption/decryption procedure, must agree on some private key, which in this case is equal to 3. Many ciphers, such as the Vigenere` cipher, the renowned Enigma cipher, or modern ciphers such as the Digital Encryption Standard (DES) or Rijndael (AES), work according to this principle: once the sender and the receiver agree on some secret key, they both can encrypt and decrypt messages, thus being able to communicate securely. But what if the sender and the receiver are too far away from each other? If Alice is in Australia, Bob is in Bulgaria, then how can they agree on a secret key? One answer to this problem would be public key cryptography. Key insight: Alice and Bob don’t even have to agree on a private key in order to send encrypted messages to each other! The RSA cryptosystem was invented in 1977 by Ron Rivest, Adi Shamir and Leonard Adleman. It was the first practical widely deployed public key cryp- tosystem. This is how RSA works. Bob generates two really large distinct prime numbers p and q, computes n = pq, as well as ϕ(n) = (p − 1)(q − 1). Then he chooses an encryption exponent e such that gcd(e,ϕ(n)) = 1, and solves the congruence de ≡ 1 (mod ϕ(n)) for d. Then he sends the public key (n,e) to Alice. Alternatively, he can publish (n,e) on his webpage, thus making this key publicly available to everyone. How- ever, he does not release the private key (p,q,d). No one knows the values of p, q and d except for Bob.
63 Now Alice can use Bob’s public key (n,e) to send messages to Bob securely. Suppose that Alice wants to send a message written in English. First, she converts this message into a number m. For example, this can be done using the ASCII table. According to the ASCII table, every upper or lower case letter of English alphabet, digit, and some special characters like * $ ! or %, correspond to some number between 0 and 127. For example, in the message
Hello! the letter ‘H’ corresponds to 72, letter ‘e’ corresponds to 101, and so on: Character Base 10 Base 2 H 72 010010002 e 101 011001012 l 108 011011002 o 111 011011112 ! 33 001000012 We concatenate base 2 representations of ASCII numbers corresponding to our characters together, thus obtaining a bigger number m:
m = 0100100001100101011011000110110001101111001000012 . | {z }| {z }| {z }| {z }| {z }| {z } H e l l o ! Note that each character fits into 1 byte = 8 bits. Since there are 6 characters in our message, the resulting number m satisfies 0 ≤ m < 26·8 = 248. Now, if Bob will receive this number m, he can easily decode the message by reading off 8 bits at a time and matching them to a corresponding character in the ASCII table. Before encrypting the message, Alice needs to verify that 0 ≤ m < n so that the information will not get lost during the transmission. If it so happens that m ≥ n, she breaks the message into k = bm/nc+1 pieces m1, m2,..., mk such that 0 ≤ mi < n for all i, 1 ≤ i ≤ k, and then sends m1, m2,..., mk to Bob consecutively. Suppose that 0 ≤ m < n. Now Alice uses Bob’s public key (n,e) and computes the integer c, 0 ≤ c < n, such that
c ≡ me (mod n).
This number c is the result of RSA encryption, and Alice sends this encrypted message to Bob over the unprotected channel.
64 When Bob receives the encrypted message c, he can decrypt it and obtain the original message m using the private key d:
cd ≡ (me)d ≡ mde ≡ m (mod n).
Note that above we utilized the fact that de ≡ 1 (mod ϕ(n)). Example 17.1. Suppose that Bob chose p = 1597 and q = 4139. Then
n = pq = 1597 · 4139 = 6609983,
ϕ(n) = (p − 1)(q − 1) = 1596 · 4138 = 6604248. Bob chooses the encryption exponent e = 3263993 and then computes
d ≡ e−1 ≡ 3263993−1 ≡ 2051801 (mod 6604248).
Now he keeps p,q and d in secret, and makes (n,e) publicly available. Now, in order to send the message “Hi!” to Bob, Alice converts it into an integer m using the ASCII table:
m = 0100100001101001001000012 = 4745505. | {z }| {z }| {z } H i ! Alice verifies that 0 ≤ m < n, and then computes the encrypted message c with the Double-and-Add Algorithm using Bob’s encryption exponent e:
c ≡ me ≡ 47455053263993 ≡ 673426 (mod 6609983).
Then Alice sends c = 673426 to Bob. When Bob receives c, he computes m with the Double-and-Add Algorithm using his private key d:
m ≡ cd ≡ 6734262051801 ≡ 4745505 (mod 6609983).
After that, Bob converts the 3 byte number m into a three character message “Hi!” which Alice sent to him using the ASCII table. Now why this method of communication is secure? Suppose that some mali- cious adversary Eve managed to eavesdrop on the unprotected channel and inter- cept the message c. Since Bob’s public key (n,e) is available to everyone, Eve also knows both n and e. Therefore Eve’s goal is, by knowing (n,e) and c, to obtain
65 m. The most obvious way to solve this problem is to find an integer d such that de ≡ 1 (mod ϕ(n)). In order to do so, Eve has to compute ϕ(n) = (p − 1)(q − 1) by knowing n. Unfortunately for Eve, the problem of computing ϕ(n) from n when n is a composite number is difficult, and requires a factorization of n. To this day, we do not know any polynomial time factorization algorithms. The best ones, namely the Quadratic Sieve and the Generalized Number Field Sieve, are subexponential. Thus, if we choose n large enough, — and the National Institute of Standards and Technology (NIST) recommends to choose n > 21024, — the factorization of n would become infeasible to modern electronic computers, even if the work load would be distributed among several supercomputers. Of course, the numbers p, q and e should be chosen by Bob very carefully. For example, if either p or q are really small, then they can be located using trial √ √ √ division. If either p or q are really close to n = pq, say |p − n| ≤ 2n1/4, then the number n can be factored using the Fermat’s Factorization Method. If the prime divisors of either p − 1 or q − 1 are really small, then the number n can be factored using Pollard’s p − 1 Algorithm (see Assignment 3). If e is chosen so that d is really small, say d < 3−1n1/4, then it can be calculated in polynomial time O(logn) (see Section 6.2.1 in Trappe and Washington). When sending the message, Alice has to be really cautious as well. For ex- ample, if the number m is relatively small in comparison to n, then even without the knowledge of d or the factorization of n Eve can decrypt the message using the Short Plaintext Attack (see Section 6.2.2 in Trappe and Washington). To solve this problem, Alice can pad her message with some random characters either at the beginning or at the end. So as you can see, there are many things that both Alice and Bob have to check before establishing a secure communication. The RSA cryptosystem can be utilized not only for secure communication, but also for authentication purposes. Imagine a situation when Alice sends a message m to Bob, and Bob cares not so much about the privacy of their communication, but rather about the authenticity of the sender. That is, he wants to be absolutely sure that the message m was sent to him by Alice and no one else. The way this can be done using RSA is as follows: Alice puts a digital signature s on the message m using her private key d: s ≡ md (mod n). Then she sends (m,s) to Bob. When Bob receives the message with Alice’s signa- ture, he can verify that it belongs to Alice by using her public key e and checking that m ≡ se (mod n).
66 Exercise 17.2. Use your favourite computer algebra system to encrypt the mes- sage m = 12345 with RSA using the public key (n,e) = (786073,221891). Then break the system by factoring n = pq, determining the private key d, and then decrypting the message c = 547988. Exercise 17.3. Use your favourite computer algebra system to verify that the message (m,s) = (100,1580073) belongs to the owner of the public key (n,e) = (5988889,4324055). Then break the system and put a fake digital signature s0 on the message m0 = 1000000, so that (m0,s0) passes the verification with the public key (n,e). Exercise 17.4. (Exercise 7 in Trappe and Washington) Naive Nelson uses RSA to receive a single ciphertext c, corresponding to the message m. His public modulus is n and his public encryption exponent is e. Since he feels guilty that his system was used only once, he agrees to decrypt any ciphertext that someone sends him, as long as it is not c, and return the answer to that person. Eve sends him the ciphertext 2ec (mod n). Show how this allows Eve to find m. Exercise 17.5. (Exercise 8 in Trappe and Washington) In order to increase secu- rity, Bob chooses n and two encryption exponents e1, e2. He asks Alice to encrypt e her message m to him by first computing c1 ≡ m 1 (mod n), then encrypting c1 to e2 get c2 ≡ c1 (mod n). Alice then sends c2 to Bob. Does this double encryption increase security over single encryption? Why or why not? Exercise 17.6. (Exercise 10 in Trappe and Washington) The exponents e = 1 and e = 2 should not be used in RSA. Why?
18 The Diffie-Hellman Key Exchange Protocol
There are many benefits to using RSA, but there is one big problem: despite the fact that it works in polynomial time, it is quite slow. For suppose that we want to compute c ≡ me (mod n). The Double-and-Add Algorithm requires at most loge squarings and at most loge multiplications, thus resulting in at most 2loge ≤ 2logn arithmetic operations in total. Each multiplication involves numbers of size at most logn. The best known multiplication algorithm, the Toom-Cook Algorithm, requires O((logn)1.465) steps to multiply two integers of size at most logn. Since there are at most 2logn multi- plications, the encryption and decryption require O((logn)2.465) steps to compute.
67 Roughly speaking, this means that if n is a 2048 bit number, then one can encrypt or decrypt messages in 20482.465 ≈ 1.45 · 108 steps. Private key cryptosystems (also referred to as symmetric ciphers or block ci- phers) are much much faster, because their execution does not involve any com- plex mathematical computations. Instead, in order to encrypt the message they use logical operations, such as AND, OR, NOT and XOR, as well as bit shifts and bit permutations. Caesar cipher is an example of a cipher which uses only shifts, but on letters of the alphabet rather than on bits. Anagrams, like “eHll!o”, are examples of permutations on letters. These operations are very simple and in fact require only O(1) steps to compute (compare it to multiplication, which requires O((logn)1.465)). In the end, both encryption and decryption for these ci- phers require O(logn) steps. The most widely deployed symmetric ciphers are 3-DES (Triple Data Encryption Standard) and AES (Advanced Encryption Stan- dard), which is also commonly referred to as Rijndael. As it was mentioned in Section 17, in order to use private key cryptosystems two parties must agree on a secret key. So how can this be done when Alice and Bob are too far away from each other? Here is one way: Alice generates a secret key K, encrypts it using RSA with Bob’s public key, and then sends the encrypted message to Bob. Bob decrypts the message, and so now Alice and Bob share a secret K in common. Then they may use whichever symmetric algorithm they want, such as 3-DES or AES. But there is another way for Alice and Bob to agree on a common key. This procedure, called The Diffie-Hellman Key Exchange Protocol, was patented by Whitfield Diffie and Martin Hellman in 1977. Its security is based on the Discrete Logarithm Problem, and it works as follows. Alice generates a large prime number p, an integer g such that 0 ≤ g < p, and an integer x such that 1 ≤ x ≤ p − 2. She computes gx (mod p), and then sends p, g and gx (mod p) to Bob. When Bob receives p, g and gx (mod p), he generates an integer y such that 1 ≤ y ≤ p − 2, computes gy (mod p), and then sends it back to Alice. Finally, since Alice knows x and gy (mod p), she can compute
gxy ≡ (gy)x (mod p), and since Bob knows y and gx (mod p), he can compute
gxy ≡ (gx)y (mod p).
So in the end both Alice and Bob share a secret in common, namely gxy (mod p).
68 Why is this secure? If a malicious adversary Eve would listen on the com- munication between Alice and Bob, she could intercept p, g, gx (mod p) and gy (mod p), and by knowing this information she would have to compute gxy (mod p). This problem is called the Diffie-Hellman Problem, and it is at least as hard as the Discrete Logarithm Problem. That is, if Eve would know how to solve the Discrete Logarithm Problem, she would be able to solve the Diffie-Hellman Problem (see Assignment 3). However, it is not known whether these two prob- lems are equivalent. We do not know any polynomial time algorithm for com- puting discrete logarithms. The best known subexponential algorithm is due to Adleman and it utilizes index calculus. The discrete logarithm can be computed quite fast in some special cases, but if the parameters p, g, x and y are chosen properly, the problem becomes intractable to modern electronic computers. There are many things that need to be verified in order to ensure that the communication is secure, but we will just mention that the parameter g should be chosen so that ? ord(g) in Zp is sufficiently large. As a final remark, we would like to mention that there exists an efficient quan- tum algorithm for computing discrete logarithms, which was invented by Peter Shor in 1997.
19 Integer Factorization
The next computational problem that we address is the integer factorization prob- lem. That is, given a composite integer n, we would like to find a non-trivial divisor of n. Unlike for primality testing, we do not know any polynomial time algorithm for integer factorization. Many mathematicians believe that the integer factorization problem is hard, and several cryptographic protocols, such as RSA, reside on this assumption. If you want to become a famous mathematician, try inventing a polynomial time algorithm for integer factorization. Note, however, that there exists an efficient quantum algorithm for integer factorization, which was invented by Peter Shor in 1994. There are many algorithms for integer factorization. The most obvious one, trial division, we studied√ in Section 16. Of course, this algorithm allows us to factor an integer n in O( n) = O(elogn/2) steps, so this algorithm is exponential and is no good for factoring large integers. In this section, we will study two factorization algorithms, namely the Fer- mat’s Algorithm and its optimized variant, called the Dixon’s Algorithm. The former is an exponential algorithm and the latter is a subexponential algorithm.
69 You will also learn about Euler’s Factorization Method in Assignment 3.
19.1 Fermat’s Factorization Method Fermat’s Factorization Method was suggested by the French mathematician Pierre de Fermat back in XVII century. The idea is simple: given an integer n, the goal is to find integers x and y such that
n = x2 − y2.
Then n = (x − y)(x + y), and if neither x−y nor x+y are equal to 1, this results in a non-trivial factorization of n. Note that even numbers cannot be represented in this form, but we may easily disregard them from consideration, since every even number greater than 2 always has a non-trivial divisor equal to 2. Unlike even integers, odd integers can be represented as a difference of two perfect squares, for if n = k`, then
k + `2 k − `2 n = − . 2 2
Since n is odd, then so are k and `, which means that both (k +`)/2 and (k −`)/2 are integers, too. If n = k` is a multiple of 4, such a representation is also possible once we assume that both k and ` are even. From the formula above it is also evident that there can be many representations of an integer as a difference of two perfect squares. Let dxe denote the smallest integer ≥ x. We will now convert the observations made above into an algorithm: √ 1. Put x := d ne and then set y := x2 − n; √ 2. If y is a perfect square, return x − y; otherwise proceed to Step 3;
3. Increase x by 1 and then set y := x2 − n;
4. Go back to Step 2.
Note that the algorithm always terminates. Furthermore, if the algorithm re- turns 1, then the number n must be prime.
70 √Example 19.1. Let us use Fermat’s Algorithm to factorize n = 8023. Note that n ≈ 89.57, so we begin with x = 90 and y = x2 − n = 902 − 8023 = 77. We see that x y y = ? 90 77 no 91 258 no 92 441 yes √ Since 441 = 21, we see that
8023 = 922 − 212 = (92 − 21)(92 + 21) = 73 · 113.
Thus Fermat’s Factorization Algorithm terminated in just three steps, resulting in √ a non-trivial factor x − y = 92 − 21 = 73. Exercise 19.2. Use Fermat’s Algorithm to factor integers 4747 and 7303. Now let us analyze the performance of the algorithm above. We will count a single computation√ of x and y as one step. If n = k` and k is the largest divisor of n such that k ≤ n, then Fermat’s Algorithm will return k as a result. In this case, y = (k +`)/2, which means that the number of steps required for the computation is equal to k + ` √ − d Ne. 2 We can bound this quantity from above as follows: k + ` √ k + ` √ − d Ne ≤ − N 2 √2 √ ( k − `)2 = √ 2 ( n − k)2 = . 2k We see that, if n is prime, then k = 1 and the algorithm requires O(n) steps to compute. Therefore, in its worst case, the algorithm is exponential. Note√ that it is even worse than trial division, because the trial division requires O( n) steps to compute. Why do we care then about Fermat’s Factorization Method? First of all, in some special cases it performs really well. For suppose that k satisfies √ n − k ≤ 2n1/4,
71 √ so it is relatively close to n. Then for all n > 64 it is the case that √ √ ( n − k)2 4 n ≤ √ 2k 2( n − 2n1/4) 2 ≤ 1 − 2n−1/4 < 3, which means that Fermat’s Algorithm terminates in two steps! Of course, this is much faster than if we would use trial division. This is why Fermat’s Factoriza- tion Method is usually used in√ combination with the Trial Division Method. First one chooses a constant√ c > n and then Fermat’s Algorithm is used to look for divisors between n and c. After that, one√ only has to check√ prime divisors of n with the trial division method up to c − c2 − n instead of n. Even though this observation does not allow us to push the bound below O(n1/2), it helps to decrease the constant implicit in the big-O notation significantly. Further improve- ments can be done through sieving, and in 1974 Lehman managed to combine all of the improvements and invented a factorization algorithm based on Fermat’s Factorization Method and trial division with asymptotic running time O(n1/3). Though Fermat’s Algorithm can be quite slow in its worst case, it lies in the foundation of the best factorization algorithms known to date, namely the quadratic sieve and the generalized number field sieve, which have subexponential asymptotic running time. Both of these algorithms evolved from the factorization method due to Dixon.
19.2 Dixon’s Factorization Method Dixon’s Factorization Method was proposed in 1971 by the Canadian mathemati- cian John D. Dixon, who is a professor emeritus at Carleton University, Ottawa. Recall that in Fermat’s Factorization Method we were choosing an integer x be- tween 0 and n and then evaluating x2 (mod n), hoping that the result would be a perfect square; that is, x2 ≡ y2 (mod n). √ Unfortunately, up to n, there are only b nc perfect squares, and so for very large n the total proportion of perfect squares less than n tends to zero: √ √ b nc n 1 ≤ = √ −→ 0. n n n
72 Dixon’s method suggests that, instead of looking for a perfect square we can ac- tually construct it from many random samples. The idea is as follows: by picking distinct x1,x2,... between 0 and n at random, we obtain relations of the form
2 x1 ≡ z1 (mod n), 2 x2 ≡ z2 (mod n), ... where z1,z2,... are integers between 0 and n. One would then hope to select 2 relations i1,i2,...,ir so that the number zi1 zi2 ···zir = y is a perfect square. But then 2 2 (xi1 xi2 ···xir ) ≡ y (mod n), which means that one can compute a divisor d of n by evaluating
d = gcd(xi1 xi2 ···xir − y,n). If it so happens that d = 1 or d = n, we construct a new set of random samples, or select a different k-tuple i1,i2,...,ir with the property described above. 2 Now the main question is, how do we construct congruences xi ≡ zi (mod n), from which we can produce a non-trivial perfect square? The main idea here is to pick only those xi’s, for which the resulting values of zi’s are so-called B-smooth numbers.
Definition 19.3. Let B ≥ 2 be a real number. An integer n is called B-smooth if for any prime p | n it is the case that p ≤ B.
Example 19.4. For example, numbers 2,3,4,5,6,8,9,10,12 are all 5-smooth. The reason is that every prime p dividing an integer from that list satisfies p ≤ 5. The numbers 7 and 11, however, are not 5-smooth, but they are both 11-smooth.
Now every time we choose a random x and then evaluate z ≡ x2 (mod n) such that 0 ≤ z < n, we need to verify that z is B-smooth. One can check that a given number z is B-smooth in just O(B) steps using trial division. Note that, if p1 < p2 < ... < pk are all prime numbers ≤ B, then every B-smooth number can be written in the form e1 e2 ek z = p1 p2 ··· pk , where e1,e2,...,ek are non-negative integers. Thus we obtain a vector v = (e1,e2,...,ek) k in Z . Further, we can reduce the elements of this vector modulo 2, thus obtaining k a vectorv ˜ = (e˜1,e˜2,...,e˜k) in Z2 withe ˜1,e˜2,...,e˜k ∈ {0,1}. Because Z2 forms a
73 k field (that is, division by a non-zero element is always allowed), the set Z2 con- stitutes a k-dimensional vector space over Z2, which means that we can analyze it from the perspective of linear algebra. In particular, any collection of k+1 vectors k in Z2 will always be linearly dependent. Now suppose that for distinct values x1,x2,...,xk+1 we managed to compute B-smooth values z1,z2,...,zk+1, which correspond to vectorsv ˜1,v˜2,...,vk˜+1 in k k Z2. Since Z2 has dimension k, it must be the case that vectorsv ˜1,v˜2,...,vk˜+1 are k linearly dependent in Z2. But then there must exist indices i1,i2,...,ir for some r ≤ k + 1 such that
vi1 + vi2 + ... + vir ≡ 0 (mod 2), which means that zi1 zi2 ···zir is a perfect square. In order to find such linearly k dependent vectorsv ˜i1 ,v˜i2 ,...,v˜ir in Z2, we row reduce the (k+1)×(k+1) matrix T M = [v˜1,v˜2,...,vk˜+1] , 3 whose coefficients belong to Z2. Note that the row reduction requires O(k ) = O(B3) steps. At this point, we can compute the value
d = gcd(xi1 xi2 ···xir − zi1 zi2 ···zir ,n) and, in case if d = 1 or d = n, repeat the procedure of choosing distinct random values x1,x2,...,xk+1 once again. The only thing that is left for us to establish√ is the value of B. As it turns out, the most optimal choice for B is B = eO( lognloglogn), so the asymptotic running time of Dixon’s algorithm is subexponential. Exercise 19.5. In this exercise, we will use Dixon’s method to find a non-trivial factor of 34081. (a) Factorize integers 15, 486, 24010 to ensure that they are all 7-smooth; (b) Suppose that the execution of Dixon’s Factorization Algorithm allowed us to locate the congruences 8052 ≡ 486 (mod 34081); 8462 ≡ 15 (mod 34081); 9542 ≡ 24010 (mod 34081). Using the above congruences, as well as the factorizations obtained in Part (a), find integers x and y such that x2 ≡ y2 (mod 34081), and then use these x and y to compute a non-trivial factor of 34081.
74 20 Quadratic Residues
Let n ≥ 3 be a modulus and a,b,c be arbitrary integers. We will now turn our attention to quadratic congruences
ax2 + bx + c ≡ 0 (mod n).
We require that n - a, for otherwise the above congruence would reduce to the linear congruence bx +c ≡ 0 (mod n). Also, if n = 2, by Fermat’s Little Theorem x2 ≡ x (mod 2) regardless of x. Thus
ax2 + bx + c ≡ (a + b)x + c (mod 2), so once again we obtain a linear congruence. Thus it is reasonable to assume that n ≥ 3. Finally, for the simplicity of exposition, we will assume that n is an odd prime, and we will indicate that by writing p instead of n. Note that the integer p−1 2 is even. In this section, we will not aim to solve quadratic congruences. Instead, we will investigate when solutions exist. Note that it follows from Propositon 12.2 2 that the polynomial [a][x] + [b][x] + [c] has at most 2 roots in Zp.
Proposition 20.1. 25 Let p be an odd prime, and a, b, c be integers where p - a. The quadratic congruence
ax2 + bx + c ≡ 0 (mod n) has a solution x if and only if the congruence
y2 ≡ b2 − 4ac (mod p) has a solution y. In that case, y ≡ 2ax + b (mod p).
Proof. Multiply both sides of the quadratic congruence by 4a to get
4a2x2 + 4abx + 4ac ≡ 0 (mod p).
This can be rewritten as
(2ax + b)2 − b2 + 4ac ≡ 0 (mod p),
25Proposition 6.1 in Frank Zorzitto, A Taste of Number Theory.
75 which is the same as
(2ax + b)2 ≡ b2 − 4ac (mod p).
Conversely, suppose that y is a solution to y2 ≡ b2 − 4ac (mod p). Note that we can solve the linear congruence 2ax + b ≡ y (mod p) for x, because [2a] is a unit in Zp. Thus
(2ax + b)2 ≡ y2 ≡ b2 − 4ac (mod p), which is the same as
4a2x2 + 4abx + 4ac ≡ 0 (mod p).
Since [4a] is a unit in Zp, we can multiply both sides of the above congruence by (4a)−1 (mod p) in order to obtain
ax2 + bx + c ≡ 0 (mod p).
Therefore x which satisfies 2ax + b ≡ y (mod p) is a solution to the original quadratic congruence. Proposition 20.1 tells us that solving the quadratic congruence
ax2 + bx + c ≡ 0 (mod p) is equivalent to solving a simplified quadratic congruence
x2 ≡ d (mod p), where d = b2 − 4ac. The integer d is called the discriminant of the quadratic polynomial aX2 + bX + c. Thus, in order to find solutions to x2 ≡ d (mod p), we need to understand which residue classes of Zp are squares. ? Definition 20.2. A residue α in Zp is called a quadratic residue when α ∈ Zp and 2 ? α = β for some other residue β in Zp. If such β does not exist, then α is called a quadratic nonresidue.
When translated to the language of congruences, we say that an integer a has a quadratic residue modulo an odd prime p if p - a and a ≡ x2 (mod p) for some integer x.
76 ? Example 20.3. Let us find all quadratic residues in Z13. We note that [1]2 = [1][7]2 = [10] [2]2 = [4][8]2 = [12] [3]2 = [9][9]2 = [3] [4]2 = [3][10]2 = [9] [5]2 = [12][11]2 = [4] [6]2 = [10][12]2 = [1]
Thus the quadratic residues are [1],[3],[4],[9],[10],[12]. ? ? ? Exercise 20.4. Determine all quadratic residues in Z17, Z19 and Z23. ? Proposition 20.5. Let p be an odd prime. Then the group of units Zp has exactly (p − 1)/2 quadratic residues and exactly (p − 1)/2 quadratic nonresidues. ? 2 2 Proof. Note that, for any [a] in Zp, it is the case that [a] = (−[a]) . Thus it is sufficient to look at a’s such that 1 ≤ a ≤ (p − 1)/2. We now claim that all the elements in the collection p − 12 [1]2,[2]2,..., 2 are distinct. Suppose not, and [a]2 = [b]2 = [c] for some residue [c]. Then both 2 [a] and [b] are the roots of the polynomial X − [c] in Zp. By Proposition 12.2, such a polynomial has at most 2 roots in Zp. However, we see that it has at least 4 distinct roots, namely ±[a] and ±[b]. Thus we obtain a contradiction. Therefore ? the above collection has no repetitions, so Zp contains (p − 1)/2 residues. Since ? every element of Zp which is not a residue is a nonresidue, we conclude that there are exactly (p − 1)/2 nonresidues. Definition 20.6. For an odd prime p and an integer a coprime with p, we let ( a +1 if a has a quadratic residue modulo p; := p −1 if a does not have a quadratic residue modulo p.