Number Theory Stuff Prime Numbers * There are an infinite number of primes (Euclid) Proof: Suppose there were a finite number. Let n be the number we get by multiplying them all together. n + 1 is then not divisible by any of these primes By unique factorization n + 1 must thus either be a prime itself or have a prime factor which is not in the proposed list. Thus by contradiction the list of primes cannot be finite. * Pi(x) is the number of primes <= x. * Prime number theorem: Pi(x) ~ x / ln(x) Proof: Difficult. Not done until about 1896 Implication: There are LOTS of primes. The density decreases as 1/n where n is the number of digits. This means it is practical to find large primes (of several hundred digits) just by testing random numbers, if there is an efficient test (even a probabilistic one). Example: ln(10^100) = 230, so even for 100 digit numbers, there is a prime for every few hundred instances. * Some results about the error term are also known, e.g. Pi(x) = x / ln(x) + O(x / (ln^2(x)) * Fermat's little theorem (around 1650) If p is prime, then x^p == x mod p for all integers x. Proof: Note that binomial coefficients are integers, and have form p! / (i!(p-i)!). Thus all the non-trivial binomial coefficients are divisible by p for p prime. (not necessarily true for non-primes - consider 4 choose 2 = 6.) Prove by induction: Clearly true for x = 1. Suppose we know that x^p = x mod p for some x. Then (x+1)^p = sum (0 to p) (p choose i) x^i 1^(p-i) = x^p + sum (1 to p-1)(p choose i)x^i + 1 = x + 1 mod p. (since all those non-trivial binomial coefficients are 0 mod p) * Implications 1. If x and p are relatively prime, x^(p-1) = 1 mod p; and x^(p-2) = x^(-1) mod p. 2. Easy exponentiation in some cases 2^1000 % 17 = 2^8 * 2 ^ (16 * 62) % 17 = 2^8 % 17 = 1 ----------------------------- * Little lemma: gcd(b^m - 1, b^n - 1) = b^(gcd(m,n)) - 1 Corollary: Note that this directly implies that for numbers of the form b^n, if n is composite, then for all factors d of n, b^n - 1 and b^d - 1 have a factor in common which is, in fact b^d - 1. In conjunction with Fermat's little theorem, we get that if n is prime, then any prime factor p of b^n - 1 satisfies p == 1 mod n, and in fact, if n > 2, p == 1 mod 2n. This is useful for factoring certain special forms, including "Mersenne numbers" which have the form 2^n - 1. Note that it implies that only Mersenne numbers of the form 2^p for p prime can themselves be prime. * Fast expontiation: To evaluate b^e %m we represent e as a binary number e = e0 + e1 * 2 + e2 * 2^2 ... Then b^e = e0 * b * e1 * b^2 * e2 * b^2^2 ... %m where we evaluate the expression by repeated squaring, and perform the reduction after every multiplication. Algorithm: Start with triple (X, E, Y) = (b, e, 1) if E is odd, replace Y with X * Y % m, E with E - 1 if E is even, replace X with X * X % m, E with E/2 When E is 0, we are done and Y is the desired result b^e % m This takes at most 2 log2 e steps, and hence is proportional to the number of digits in e. And for reduction mod m, the numbers never get larger than m^2. * Square roots mod p prime Some integers y = x^2 are perfect squares, and certainly this property is retained under reduction modulo m. Given a reduced value and a modulus, however, it is not clear how to determine the square root of the value other than exhaustive trial. It is also not clear that an element of Z/m might not have more than 2 square roots. In fact, we can easily construct cases with more. 4^2 = 16, 6^2 = 36, so mod 36 - 16 = 20, 16 % 20 = 36 % 20 = 16, and hence 16 has (at least) square roots +- 4 = 4, 16, +- 6 = 6, 14. However, if the modulus is prime, then at most two roots, +- x, exist. To see this, note that if we have 2 roots mod p of y, say a, and b, then a^2 - b^2 = n*p. The difference of squares can be factored to give (a+b)(a-b) = n*p, and by unique factorization and the fact that p is a prime, we have either a-b = m*p, which implies that a and b are the same root (mod p), or a+b = m*p which implies that a%p + b%p = p, and hence a = -b mod p. So two roots must either be the same or negatives of each other, which implies there are at most two. - It turns out that in the special case p = 3 mod 4, there is a formula for a square root of y for any y which is a square mod p x = y^((p+1)/4) mod p Note that if p is not 3 mod 4, then the formula does not have integral powers, and thus does not represent something we know how to evaluate. If y is not a square, the result is not a square root. Proof: The result is easily shown by direct substitution and Fermat's little theorem. Suppose that y = x^2 mod p for some x. Then (y^((p+1)/4))^2 = y^((p+1)/2) = (x^2)^((p+1)/2) = x^(p+1) = x^p * x which by Fermat's little theorem is x * x = y mod p. Note that the result of the formula is itself a square, so we could play games with circular chains of squares if we wanted to... The importance of this result is that an ability to rapidly find square roots can provide leverage in a factoring attack, so primes = 3 mod 4 are avoided in cryptosystems based on the presumed difficulty of factoring products of large primes. - And there are similar formulas for higher order roots. For example if n is relatively prime to p-1 for some prime p, then every integer y has an nth root mod p given by the formula y^r % p where r is a multiplicative inverse of n mod p-1. --------------------------------------- * A basic tool for obtaining results about root mod composites is "Sun Ze's theorem" also known as the Chinese remainder theorem. Known since about 450 AD, and in more general form since 1250. Basic result: Let m1, m2, ... mn be relatively prime integers, and let M = m1*m2*...*mn. Then the function f: Z/M -> Z/m1 x Z/m2 x ... s Z/mn given by f(x%M) = (x%m1, x%m2, ..., x%m3) is 1 to 1 and onto (a bijection). This is proved by induction from the two modulus case. Call these relatively prime moduli m and n. Suppose we have x and y such that x%m = y%m and x%n = y%n (they both map to the same point). Then x==y mod m and x==y mod n. Thus m|(x-y) and n|(x-y). Since m and n are relatively prime, mn|(x-y), so x==y mod mn. Thus the function is 1 to 1. The two finite sets have the same number of elements, so the function must also be onto. It is interesting to look at the "onto" aspect a little more closely. Since m and n are relatively prime, there exist s and t such that sm + tn = 1. Then for any integers a,b we have f((bsm + atn)%mn) = (a%m, b%n), which effectively gives us the inverse. This is because bsm + atn == bsm + a(1-sm) = a mod m, and similarly for n. These results can be extended to the multi-modulus case by essentially using the 2 modulus case repeatedly, and building up functions by composition. graphical representation on a torus, e.g. 3x5 x%5 | 0 1 2 3 4 ---|--------------- 0 |00 06 12 03 09 x%3 1 |10 01 07 13 04 2 |05 11 02 08 14 * Sun Ze's theorem is useful in solving simultaneous congruences e.g. x == a mod m == b mod n. In particular, forms of this sort come up in trying to find roots modulo composites. Suppose we want x such that x^2 = y mod p1*p2. Clearly such an x must also satisfy x^2 = y mod p1 and x^2 = y mod p2. Sun Ze's theorem tells us, given y1 in Z/p1 and y2 in Z/p2, how to find the unique y in Z/p1*p2 that satisfies y % p1 = y1 and y % p2 = y2 For example, suppose we want to find x^2 = -1 mod 13 * 17 = 221 The square roots of -1 mod 13 are 5 and 8, and the square roots of -1 mod 17 are 4 and 13. We also can find that 1 = 4 * 13 - 3 * 17. Taking m = 13, n = 17, and one pair of roots, a = 5 and b = 4, and plugging into the above formula, we get x = 4 * 4 * 13 + 5 * (-3) * 17 = 208 - 255 = -47 == 174 mod 221. 174^2 = 30276 == 220 == -1 mod 221. We could find 3 other roots by plugging in the other combinations, and in general we could find up to 2^n roots where n is the number of distinct prime factors.