\documentclass{report}
\bibliographystyle{amsalpha}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% 
%%  FILE:  ent.tex 
%%          -- Elementary Number Theory and Elliptic Curves
%% 
%%  (c) 2004 -- , William Stein (was@math.harvard.edu)
%% 
%%  Under contract to publish with Springer-Verlag. 
%%  
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\usepackage{svsing2e}
\usepackage{amsfonts}
\usepackage{amsmath}
\usepackage{amssymb} 
\usepackage{amsopn}
\usepackage{amsthm}
\usepackage{fancybox}
\usepackage{makeidx}  
\usepackage{graphicx}
\usepackage{psfrag}
\usepackage{pstricks}
\usepackage{python}
\usepackage[hypertex]{hyperref}
%\usepackage[hyperindex,pdfmark]{hyperref}

\newcommand{\edit}[1]{}

\numberwithin{section}{chapter}
\numberwithin{equation}{section}
\newcommand{\todo}[1]{{[[{\bf #1}]]}}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% Operators and macros
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\DeclareMathOperator{\Div}{Div}
\DeclareMathOperator{\Li}{Li}
\DeclareMathOperator{\SL}{SL}
\DeclareMathOperator{\ind}{ind}
\DeclareMathOperator{\lcm}{lcm}
\DeclareMathOperator{\new}{new}
\DeclareMathOperator{\ord}{ord}
\DeclareMathOperator{\tor}{tor}
\DeclareMathOperator{\ur}{ur}
\renewcommand{\i}[1]{\index{#1}}
\newcommand{\ii}[1]{#1\index{#1}}
\newcommand{\defn}[1]{{\em #1}\index{#1|nn}}
\newcommand{\ithm}[1]{\index{theorem!#1}\index{#1 theorem}}
\newcommand{\iprop}[1]{\index{proposition!#1}\index{#1 proposition}}
\newcommand{\icor}[1]{\index{corollary!#1}\index{#1 corollary}}
\newcommand{\C}{\mathbb{C}}
\newcommand{\D}{{\mathbb D}}
\newcommand{\F}{\mathbb{F}}
\newcommand{\Gam}{\Gamma}
\newcommand{\N}{\mathbb{N}}
\newcommand{\Q}{\mathbb{Q}}
\newcommand{\R}{\mathbb{R}}
\newcommand{\Z}{\mathbb{Z}}
\newcommand{\abcd}[4]{%
      \left(\begin{smallmatrix}#1&#2\\#3&#4%
            \end{smallmatrix}\right)}
\newcommand{\abs}[1]{\left|#1\right|}
\newcommand{\alp}{\alpha}
%\newcommand{\assign}{\leftarrow}
\newcommand{\assign}{=}
\newcommand{\con}{\equiv}
\newcommand{\cross}{\times}
\newcommand{\da}{\downarrow}
\newcommand{\ds}{\displaystyle}
\newcommand{\eps}{\varepsilon}
\newcommand{\exref}[2]{Exercise~\ref{#1}.\ref{#2}}
\newcommand{\e}{\mathbf{e}}
\newcommand{\hd}[1]{\vspace{1ex}\noindent{\bf #1} }
\newcommand{\hra}{\hookrightarrow}
\newcommand{\h}{\mathfrak{h}}
\newcommand{\intersect}{\cap}
\newcommand{\isom}{\cong}
\newcommand{\kr}[2]{\left(\frac{#1}{#2}\right)}
\newcommand{\la}{\leftarrow}
\newcommand{\lra}{\longrightarrow}
\newcommand{\m}{\mathfrak{m}}
\newcommand{\ncisom}{\approx}
\newcommand{\p}{\mathfrak{p}}
\newcommand{\q}{\mathbf{q}}
\newcommand{\ra}{\rightarrow}
\newcommand{\set}[1]{\{#1\}}
\newcommand{\ul}[1]{\underline{#1}}
\newcommand{\union}{\cup}
\newcommand{\vphi}{\varphi}
\newcommand{\zmod}[1]{\Z/#1\Z{}}
\renewcommand{\L}{\mathcal{L}}
\renewcommand{\O}{\mathcal{O}}
\renewcommand{\P}{\mathbb{P}}
\renewcommand{\Re}{\mbox{\rm Re}}
\renewcommand{\a}{\mathfrak{a}}
\renewcommand{\l}{\ell}
\renewcommand{\mathbb}{\mathbf}
\renewcommand{\t}{\tau}
\newcommand{\nn}[1]{{\bf #1}} % used for primary ref in index


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% Theorem styles
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\theoremstyle{plain}
\newtheorem{theorem}{Theorem}[section]
\newtheorem{joke}[theorem]{Joke}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{corollary}[theorem]{Corollary}
\newtheorem{claim}[theorem]{Claim}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{conjecture}[theorem]{Conjecture}
\newtheorem{openproblem}[theorem]{Open Problem}

\theoremstyle{definition}
\newtheorem{alg}[theorem]{Algorithm}
\newtheorem{listing}[theorem]{Listing}
\newtheorem{definition}[theorem]{Definition}
\newtheorem{question}[theorem]{Question}
\newtheorem{problem}[theorem]{Problem}

\theoremstyle{remark}
\newtheorem{goal}[theorem]{Goal}
\newtheorem{remark}[theorem]{Remark}
\newtheorem{example}[theorem]{Example}
\newtheorem{exercise}[theorem]{Exercise}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% Environments
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\newenvironment{algorithm}[1]{%
\begin{alg}[#1]\index{algorithm!#1}\sf
}%
{\end{alg}}
\newenvironment{steps}%
{\begin{enumerate}\setlength{\itemsep}{0.1ex}}{\end{enumerate}}

\newenvironment{exercises}
{\section{Exercises}
 \renewcommand{\labelenumi}{\thechapter.\theenumi}
  \begin{enumerate}
}{\end{enumerate}}

\newenvironment{solutions}[2]
{\section*{Chapter~\ref{#1}}\newcommand{\chap}{#2}
  %\renewcommand{\labelenumi}
  \begin{enumerate}
}{\end{enumerate}}


\author{William Stein}
\title{Elementary Number Theory}
\date{October 2005}
\makeindex    

\setcounter{tocdepth}{1}

\begin{document}
\maketitle
\newpage
\mbox{}
\vspace{2in}
\begin{center}
To my students and my wife, Clarita Lefthand.
\end{center}
\newpage
\tableofcontents
\pagenumbering{arabic}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%  
%% Chapter: Preface
%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\chapter*{Preface}
\addcontentsline{toc}{chapter}{\numberline{}Preface}

This is a textbook about prime
numbers, congruences, basic public-key cryptography, quadratic
reciprocity, continued fractions, elliptic curves, and number
theory algorithms.  We assume the
reader has some familiarity with groups, rings, and fields, and
for Chapter~\ref{ch:computing} some programming experience.
This book grew out of an undergraduate course that the
author taught at Harvard University in 2001 and 2002.



\vspace{1.5ex}\noindent{}{\bf Notation and Conventions.}
We let $\N=\{1,2,3,\ldots\}$ denote the natural numbers, and use the
standard notation $\Z$, $\Q$, $\R$, and $\C$ for the rings of integer,
rational, real, and complex numbers, respectively.\index{notation} In
this book we will use the words proposition, theorem, lemma, and
corollary as follows.  Usually a proposition is a less important or
less fundamental assertion, a theorem a deeper culmination of ideas, a
lemma something that we will use later in this book to prove a
proposition or theorem, and a corollary an easy consequence of a
proposition, theorem, or lemma. 

\vspace{1.5ex}\noindent{}{\bf Acknowledgements.} Brian Conrad and Ken
Ribet made a large number of clarifying comments and suggestions
throughout the book.  Baurzhan Bektemirov, Lawrence Cabusora, and
Keith Conrad read drafts of this book and made many comments.
Frank Calegari used the course when teaching Math 124 at Harvard,
and he and his students provided much feedback.
Noam Elkies made comments and suggested
\exref{ch:reciprocity}{ex:rec8}.  Seth Kleinerman wrote a version of
Section~\ref{sec:contfrac_e} as a class project.
%Hendrik Lenstra made
%helpful remarks about how to present his factorization algorithm.
Samit Dasgupta, George Stephanides, 
Kevin Stern, and Heidi
Williams all suggested corrections.  I also benefited from
conversations with Henry Cohn and David Savitt.
I used Emacs, \LaTeX, and Python in the preparation of this book.

% Stephanides of University of Macedonia
%Heidi.L.Williams@Dartmouth.EDU 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%  
%% Chapter: Prime Numbers
%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\chapter{Prime Numbers}   
\label{ch:primes}


In Section~\ref{sec:fundamental_thm} we describe how the integers are
built out of the prime numbers $2, 3, 5, 7, 11,\ldots$.  In
Section~\ref{sec:primeseq} we discuss theorems about the set of primes
numbers\index{primes}, starting with Euclid's\index{Euclid} proof that
this set is infinite, then explore the distribution of primes via the
prime number theorem and the Riemann Hypothesis (without proofs).

\section{Prime Factorization}
\label{sec:fundamental_thm}
\subsection{Primes}\label{sec:primes}
The set of {\em natural numbers}\index{natural numbers} is
$$
  \N = \{1,2,3,4,\ldots\},
$$
and the set of {\em integers}\index{integers} is
$$
  \Z = \{\ldots, -2, -1, 0, 1,2,\ldots\}.
$$
% \begin{remark}
% One reason the integers are denoted by~$\Z$ is because the German word
% for the integers is Zahlen\index{Zahlen}.  
% \end{remark}

% The integers~$\Z$ are an example of a structure called a commutative ring.  
% \begin{definition}[Commutative Ring]\label{defn:ring}
% A \defn{commutative ring} is a set~$R$ equipped with binary operations
% $+:R\times R \to R$ and $\times:R\times R \to R$ such that 
% $(R,+)$ is an abelian group, $\times$ is associative and commutative,
% and for any $x,y,z\in R$ we have $x\times (y+z)=x\times y+x \times z$.
% We assume that $R$ contains an element $1$ such that $1x=x$ for
% all $x\in R$.
% \end{definition}
% The rational numbers, the real numbers, and the complex numbers are
% all also rings, but the set of natural numbers is not a ring, since
% $(\N,+)$ is not a group, e.g., because~$2$ does not have an additive
% inverse.

% We will not consider any non-commutative rings in this
% book, so the phrase ``let~$R$ be a ring'' will always mean that~$R$ is
% a commutative ring as defined above.


\begin{definition}[Divides]
If $a, b\in \Z$ we say that~$a$ 
\defn{divides}~$b$, written $a\mid b$, if $ac=b$ for some
$c\in \Z$.  In this case we say~$a$ is a \defn{divisor} of~$b$.  We say
that~$a$ \defn{does not divide}~$b$, written $a\nmid b$, if there is no
$c\in \Z$ such that $ac=b$.
\end{definition}
For example, we have $2 \mid 6$ and $-3\mid 15$.
Also, all integers divide\index{divides}~$0$, and~$0$ divides
only~$0$.  However, $3$ does not divide $7$ in $\Z$.  

\begin{remark}
  The notation $b \overset{\ds .}{:}\! a$ for ``$b$ is divisible by
  $a$'' is common in Russian literature on number theory.   
\end{remark}

% In order to formulate the definition of prime numbers, it will
% be useful to have the notion of unit.
% \begin{definition}[Unit]\label{defn:unit}
% A \defn{unit} is$
% that has a multiplicative inverse, i.e., for which there exists
% $y\in R$ such that $xy=1$.
% \end{definition}
% The units of the ring~$\Z$ of integers are $\pm 1$, since
% the inverses of all other (nonzero) integers are in $\Q$ and not in
% $\Z$.

% \begin{definition}[Irreducible]\label{defn:irred}
%   Let $R$ be a ring and suppose $x\in R$ is not a unit.  Then~$x$ is
%   \defn{irreducible} if whenever $x=yz$ with $y,z\in R$, then~$y$
%   or~$z$ is a unit.
% \end{definition}
% For example, the integer $2\in \Z$ is irreducible, because if $2=xy$,
% with $x,y\in\Z$, then one of $x$ or $y$ must be $\pm 1$ (there are
% just a few possibilities to check, since if $|x|>2$ or $|y|>2$, then
% $|xy| > 2$).  The integer~$6$ is not irreducible because $6=2\cdot 3$,
% and neither~$2$ nor~$3$ is a unit.

% We introduce notion of ideal in order to define primality 
% for elements of a ring.
% \begin{definition}[Ideal]\label{defn:ideal}
% A subset $I$ of a ring~$R$ is an \defn{ideal}
% if $I$ is closed under addition and if whenever
% $x\in R$ and $y\in I$, then $xy\in I$.
% \end{definition}
% For example, if $x$ is any element of $R$ then 
% $$
%  xR = (x) = \{xy: y \in R\}
% $$
% is easily seen to be an ideal because~$R$ is commutative. 
% We call it the \defn{ideal generated by}~$x$.  
% The sets $\{0\}$ and $R$ are also ideals of $R$,
% called the \defn{zero ideal} and \defn{unit ideal}, respectively.

% \begin{definition}[Prime Ideal]
% An ideal~$I\neq R$ of a ring $R$ is a \defn{prime ideal} if 
% whenever $xy\in I$ then either $x\in I$ or $y\in I$.
% \end{definition}

% \begin{definition}[Prime Element]\label{defn:prime}
% An element~$x$ of a ring~$R$ is \defn{prime} if the ideal $xR$
% generated by~$x$ is prime.
% \end{definition}
% Unwinding the definitions, we see that an element $x\in R$ is prime if
% whenever $a, b\in R$ and $x\mid ab$, then $x\mid a$ or $x\mid b$.

\begin{definition}[Prime and Composite]\label{defn:prime_composite}
An integer $n>1$ is \defn{prime} if it the only positive 
divisors of $n$ are $1$ and~$n$.
We call~$n$ \defn{composite} if~$n$ is not prime.  
\end{definition}

% Suppose $n>1$ is a natural number.
% Theorem~\ref{thm:euclid} below asserts that~$n$ is prime if and only
% if~$n$ is irreducible; equivalently,~$n$ is prime if and only if~$1$
% and~$n$ are the only positive divisors of~$n$.

The number~$1$ is neither prime nor composite.  The first few
primes of~$\N$ are $$
2,3,5,7,11, 13, 17, 19, 23, 29, 31, 37, 41, 43,
47, 53, 59, 61, 67, 71, 73, 79, \ldots, $$
and the first few
composites are $$
4,6,8,9,10,12, 14, 15, 16, 18, 20, 21, 22, 24, 25,
26, 27, 28, 30, 32, 33, 34, \ldots.  $$

\begin{remark}
  J.\thinspace{}H. Conway argues in \cite[viii]{conway:sensual} that
  $-1$ should be considered a prime, and in the 1914 table
  \cite{lehmer:primetable}, Lehmer considers~$1$ to be a prime.
In this book we consider neither $-1$ nor $1$ to be prime.
\end{remark}

Every natural number is built, in a unique way, out of prime numbers:
\begin{theorem}[Fundamental Theorem of Arithmetic]\label{thm:fundamental}%
\index{fundamental theorem of arithmetic}%
\index{integers!factor uniquely}%
\ithm{unique factorization}%
Every natural number can be written as a product of primes
uniquely up to order.
\end{theorem}
Note that primes are the products with only one factor and~$1$ is the
empty product.  

\begin{remark}
Theorem~\ref{thm:fundamental}, which we will prove in
Section~\ref{sec:proof_fundamental}, is trickier to prove than you
might first think.  For example, unique factorization\index{unique
factorization} fails in the ring
$$
 \Z[\sqrt{-5}] = \{a + b\sqrt{-5} : a, b\in\Z\} \subset \C,
$$ 
where~$6$ factors into irreducible elements in two different ways:
$$ 
 2\cdot 3 = 6 = (1+\sqrt{-5})\cdot (1-\sqrt{-5}).
$$
\end{remark}

\subsection{The Greatest Common Divisor}\index{greatest common divisor}
\index{gcd}
We will use the notion of greatest common divisor of two integers to
prove that if~$p$ is a prime and $p\mid ab$, then $p\mid a$ or $p\mid
b$.  Proving this is the key step in our proof of
Theorem~\ref{thm:fundamental}.  

\begin{definition}[Greatest Common Divisor]
Let
$$
  \gcd(a,b)=\max\left\{d\in \Z : d \mid a\text{ and } d\mid b\right\},
$$
unless both~$a$ and~$b$ are~$0$ in which case
$\gcd(0,0)=0$.
\end{definition}
For example,
$\gcd(1,2)=1$, 
$\gcd(6,27)=3$, and
for any~$a$, 
$\gcd(0,a)=\gcd(a,0)=a$.

If $a\neq 0$, the greatest common divisor exists because if $d\mid a$
then $d\leq a$, and there are only $a$ positive integers $\leq a$.
Similarly, the $\gcd$ exists when $b\neq 0$.

\begin{lemma}\label{lem:gcdprops}
For any integers $a$ and $b$ we have
$$
   \gcd(a,b)= \gcd(b,a) = \gcd(\pm a, \pm b) = \gcd(a,b-a) = \gcd(a,b+a).
$$
\end{lemma}
\begin{proof}
  We only prove that $\gcd(a,b) = \gcd(a,b-a)$, since the other cases
are proved in a similar way. Suppose $d\mid a$ and
  $d\mid b$, so there exist integers $c_1$ and $c_2$ such that $dc_1 =
  a$ and $dc_2 = b$.  Then $b - a = dc_2 - dc_1 = d(c_2-c_1)$, so
  $d\mid b-a$.  Thus $\gcd(a,b)\leq \gcd(a,b-a)$, since the set over
  which we are taking the max for $\gcd(a,b)$ is a subset of the set
  for $\gcd(a,b-a)$.  The same argument with $a$ replaced by $-a$
  and $b$ replaced by $b-a$, shows that $\gcd(a,b-a)=\gcd(-a,b-a)\leq
  \gcd(-a,b)=\gcd(a,b)$, which proves that $\gcd(a,b)=\gcd(a,b-a)$.
\end{proof}

\begin{lemma}\label{lem:gcdprops2}
Suppose $a,b,n\in\Z$.  Then
$\gcd(a,b) = \gcd(a,b-an)$.
\end{lemma}
\begin{proof}
By repeated application of Lemma~\ref{lem:gcdprops}, we have
$$
  \gcd(a,b) = \gcd(a,b-a) = \gcd(a,b-2a) = \cdots = \gcd(a,b-2n).
$$
\end{proof}

Assume for the moment that we have already proved
Theorem~\ref{thm:fundamental}.  A natural (and naive!)  way to compute
$\gcd(a,b)$ is to factor~$a$ and~$b$ as a product of primes using
Theorem~\ref{thm:fundamental}; then the prime factorization of
$\gcd(a,b)$ can read off from that of $a$ and $b$.  For example, if
$a=2261$ and $b=1275$, then $a=7\cdot {\bf 17}\cdot 19$ and $b=3\cdot
5^2\cdot {\bf 17}$, so $\gcd(a,b) = 17$.  It turns out that the
greatest common divisor of two integers, even huge numbers (millions
of digits), is surprisingly easy to compute using
Algorithm~\ref{alg:gcd} below, which computes $\gcd(a,b)$ without
factoring~$a$ or~$b$.  \index{compute!greatest common divisor}

To motivate Algorithm~\ref{alg:gcd}, we compute $\gcd(2261,1275)$ in
a different way.  First, we recall a helpful fact.
\begin{proposition}\label{prop:division}\iprop{long division}
  Suppose that~$a$ and~$b$ are integers with $b\neq 0$.  Then there
  exists unique integers~$q$ and~$r$ such that $0\leq r< |b|$ and $a =
  bq + r$.
\end{proposition}
\begin{proof}
  For simplicity, assume that both~$a$ and~$b$ are positive (we leave
  the general case to the reader). Let $Q$ be the set of all
  nonnegative integers $n$ such that $a-bn$ is nonnegative.  Then $Q$
  is nonempty because $0\in Q$ and $Q$ is bounded because $a-bn<0$ for
  all $n>a/b$.  Let $q$ be the largest element of~$Q$.  Then $r=a-bq <
  b$, otherwise $q+1$ would also be in~$Q$.  Thus~$q$ and~$r$ satisfy
  the existence conclusion.
  
  To prove uniqueness, suppose for the sake of contradiction that $q'$
  and $r'=a-bq'$ also satisfy the conclusion but that $q'\neq q$. Then
  $q'\in Q$ since $r'=a-bq'\geq 0$, so $q'<q$ and we can write
  $q'=q-m$ for some $m>0$.  But then $r' = a-bq' = a-b(q-m) = a-bq +
  bm = r + bm > b$ since $r\geq 0$, a contradiction.
\end{proof}

For us an \defn{algorithm} is a finite sequence of instructions that
can be followed to perform a specific task, such as a sequence of
instructions in a computer program, which must terminate on
any valid input.  The word ``algorithm'' is sometimes used more
loosely (and sometimes more precisely) than defined here, but this
definition will suffice for us.

\begin{algorithm}{Division Algorithm}\label{alg:division}%
\index{division algorithm}
  Suppose $a$ and $b$ are integers with $b\neq 0$. This algorithm
computes integers $q$ and $r$ such that $0\leq r<|b|$ and 
$a=bq+r$.   We will not describe the actual steps of this algorithm,
since it is just the familiar long division algorithm.
\end{algorithm}

We use the division algorithm repeatedly to compute
$\gcd(2261,1275)$.  Dividing $2261$ by $1275$ we find that
$$
  2261 = 1\cdot 1275 + 986,
$$
so $q=1$ and $r=986$.
Notice that if a natural number~$d$ divides both $2261$ and $1275$,
then~$d$ divides their difference $986$ and~$d$ still divides $1275$.
On the other hand, if~$d$ divides both $1275$ and $986$, then it has
to divide their sum $2261$ as well!  We have made progress:
$$\gcd(2261,1275) = \gcd(1275,986).$$
This equality also follows by repeated application of
Lemma~\ref{lem:gcdprops}.
Repeating, we have
$$1275 = 1\cdot 986 + 289,$$
so $\gcd(1275,986)=\gcd(986,289)$.
Keep going:
\begin{align*}
986&=3\cdot 289 + 119\\
289&=2\cdot 119 + 51\\
119&=2\cdot 51 + 17.
\end{align*}
Thus $\gcd(2261,1275)=\cdots=\gcd(51,17)$, which is $17$ 
because $17\mid 51$.  Thus
$$\gcd(2261,1275)=17.$$
Aside from some tedious arithmetic, that computation was systematic,
and it was not necessary to factor any integers (which
is something we do not know how to do quickly if the numbers
involved have hundreds of digits).
\begin{algorithm}{Greatest Common Division}
\label{alg:gcd}\index{gcd algorithm}
\index{compute!gcd}
Given integers $a, b$, this algorithm computes $\gcd(a,b)$.
\begin{steps}
\item{} [Assume $a>b\geq 0$] We have 
$\gcd(a,b) = \gcd(|a|,|b|) = \gcd(|b|,|a|)$,
so we may replace $a$ and $b$ by their absolute value and hence
assume $a, b \geq 0$.  If $a=b$ output $a$ and
terminate.  Swapping if necessary we assume $a>b$.  
\item{} [Quotient and Remainder] \label{alg:gcd_usediv} Using Algorithm~\ref{alg:division},
  write $a=bq+r$, with $0\leq r<b$ and $q\in\Z$.  
\item{} [Finished?] If $r=0$ then $b\mid a$, so we output $b$ and terminate.
\item{} [Shift and Repeat] \label{alg:gcd_shift} Set $a\la b$ and $b \la r$, then go to 
step \ref{alg:gcd_usediv}.
\end{steps}
\end{algorithm}
\begin{proof}
Lemmas~\ref{lem:gcdprops}--\ref{lem:gcdprops2}
imply that $\gcd(a,b) = \gcd(b,r)$ so the gcd does not
change in step \ref{alg:gcd_shift}.  
Since the remainders form a decreasing sequence of nonnegative
integers, the algorithm terminates.
\end{proof}
See Section~\ref{sec:comp_gcd} for an implementation of 
Algorithm~\ref{alg:gcd}.

\begin{example}
Set $a=15$ and $b=6$.
\begin{eqnarray*}
  15 &=& 6\cdot 2 + 3 \qquad\gcd(15,6)=\gcd(6,3)\\
   6 &=& 3\cdot 2 + 0 \qquad\gcd(6,3) =\gcd(3,0)=3
\end{eqnarray*}
\end{example}
\noindent{}Note that 
we can just as easily do an example that is ten times 
as big, an observation that will be important in the
proof of Theorem~\ref{thm:euclid} below.
\begin{example}\label{ex:gcd10}
Set $a=150$ and $b=60$.
\begin{eqnarray*}
  150 &=& 60\cdot 2 + 30 \qquad\gcd(150,60)=\gcd(60,30)\\
   60 &=& 30\cdot 2 + 0 \qquad\,\,\,\gcd(60,30) =\gcd(30,0)=30
\end{eqnarray*}
\end{example}
\begin{lemma}\label{lem:gcdmul}
For any integers $a,b,n$, we have
$$\gcd(an,bn) = \gcd(a,b)\cdot n.$$
\end{lemma}
\begin{proof}
  The idea is to follow Example~\ref{ex:gcd10}; we step through
  Euclid's algorithm for $\gcd(an,bn)$ and note that at every step the
  equation is the equation from Euclid's algorithm for $\gcd(a,b)$ but
  multiplied through by~$n$.  For simplicity, assume that both~$a$
  and~$b$ are positive.  We will prove the lemma by induction on
  $a+b$. The statement is true in the base case when $a+b=2$,
  since then $a=b=1$.  Now assume $a,b$ are arbitrary with $a\leq b$.
  Let~$q$ and~$r$ be such that $a = bq + r$ and $0\leq r <b$.  Then by
  Lemmas~\ref{lem:gcdprops}--\ref{lem:gcdprops2}, we have $\gcd(a,b) =
  \gcd(b,r)$.  Multiplying $a=bq+r$ by~$n$ we see that $an = bnq +
  rn$, so $\gcd(an,bn) = \gcd(bn,rn)$.  Then
  $$
  b+r  = b + (a-bq)= a-b(q-1) \leq a < a+b,
  $$ 
  so by induction
  $\gcd(bn,rn) = \gcd(b,r)\cdot n$.  Since $\gcd(a,b)=\gcd(b,r)$,
  this proves the lemma.
\end{proof}

\begin{lemma}\label{lem:gcd2}
  Suppose $a,b,n\in\Z$ are such that $n\mid a$ and $n\mid b$.  Then
  $n\mid \gcd(a,b)$.
\end{lemma}
\begin{proof}
Since $n\mid a$ and $n\mid b$, there are integers
$c_1$ and $c_2$, such that $a=n c_1$ and $b=n c_2$.
By Lemma~\ref{lem:gcdmul},
$\gcd(a,b) = \gcd(n c_1, nc_2) = n\gcd(c_1, c_2)$,
so $n$ divides $\gcd(a,b)$.
\end{proof}

At this point it would be natural to formally analyze the complexity
of Algorithm~\ref{alg:gcd}.  We will not do this, because the main
reason we introduced Algorithm~\ref{alg:gcd} is that it will allow us
to prove Theorem~\ref{thm:fundamental}, and we have not chosen to
formally analyze the complexity of the other algorithms in this book.
For an extensive analysis of the complexity of
Algorithm~\ref{alg:gcd}, see \cite[\S4.5.3]{knuth2}.

With Algorithm~\ref{alg:gcd}, we can prove that if a prime divides the
product of two numbers, then it has got to divide one of them.  This
result is the key to proving that prime factorization
is unique.
\begin{theorem}[Euclid]\label{thm:euclid}%
\index{Euclid's theorem!on divisibility}%
\ithm{Euclid}
Let~$p$ be a prime and $a, b\in \N$.
If $p\mid ab$ then $p\mid a$ or $p\mid b$.  
\end{theorem}
You might think this theorem is ``intuitively obvious'', but
that might be
because the fundamental theorem of arithmetic\index{fundamental
  theorem of arithmetic} (Theorem~\ref{thm:fundamental}) is deeply
ingrained in your intuition.  Yet Theorem~\ref{thm:euclid} will be
needed in our proof of the fundamental theorem of arithmetic.

\begin{proof}[Proof of Theorem~\ref{thm:euclid}]
  If $p\mid a$ we are done.  If $p\nmid a$ then $\gcd(p,a)=1$, since
  only~$1$ and~$p$ divide~$p$.  By Lemma~\ref{lem:gcdmul},
  $\gcd(pb,ab) = b$. Since $p\mid pb$ and, by hypothesis, $p\mid ab$,
  it follows from Lemma~\ref{lem:gcdmul} that
  $$p\mid \gcd(pb,ab) = b.$$
\end{proof}

\subsection{Numbers Factor as Products of Primes}\label{sec:numfact}
\index{integers!factor}
In this section, we prove that every natural number factors as a
product of primes. 
Then we discuss the difficulty of finding such a decomposition
in practice.  We will wait until Section~\ref{sec:proof_fundamental} 
to prove that factorization is unique.

As a first example, let $n=1275$.  The sum of the digits
of $n$ is divisible by $3$, so $n$ is divisible by $3$ (see
Proposition~\ref{prop:div3}), and we have $n=3\cdot 425$.
The number $425$ is divisible by $5$, since its last digit
is $5$, and we have $1275 = 3\cdot 5 \cdot 85$.  Again,
dividing $85$ by $5$, we have $1275 = 3\cdot 5^2 \cdot 17$,
which is the prime factorization of $1275$.
%Since $17\mid 1275$,~$n$ is
%definitely composite, $n=17 \cdot 75$.  Next, $75$ is $5\cdot
%15=5\cdot 5\cdot 3$, and we find that $1275 = 3\cdot 5\cdot 5\cdot
%17$.  
Generalizing this process proves the following proposition:
\begin{proposition}\label{prop:numbers_factor}\iprop{prime factorization}
Every natural number is a product of primes.
\end{proposition}
\begin{proof}
Let~$n$ be a natural number.  If $n=1$, then~$n$ is the empty
product of primes.  
If $n$ is prime, we are done.
If $n$ is composite, then $n=ab$ with $a,b<n$. By induction,~$a$ 
and~$b$ are products of primes, so~$n$ is also a product of primes.
\end{proof}

Two questions immediately arise: (1) is this factorization unique, and
(2) how quickly can we find such a factorization?  Addressing (1),
what if we had done something differently when breaking apart $1275$
as a product of primes?  Could the primes that show up be different?
Let's try: we have $1275 = 5\cdot 255$.  Now $255=5\cdot 51$ and
$51=17\cdot 3$, and again the factorization is the same, as asserted
by Theorem~\ref{thm:fundamental} above.  We will prove uniqueness
of the prime factorization of 
any integer in Section~\ref{sec:proof_fundamental}.

Regarding (2), there are algorithms for integer factorization; e.g., in
Sections~\ref{sec:ecm} and \ref{sec:alg_intfac} we will study and
implement some of them.  It is a major open problem to decide
how fast integer factorization algorithms can be.
\begin{openproblem}\index{open problem!fast integer factorization}
\index{factorization!difficulty of}
Is there an algorithm which can factor any 
integer~$n$ in polynomial time?  (See below
for the meaning of polynomial time.)
\end{openproblem}
By \defn{polynomial time} we mean that there is a
polynomial $f(x)$ such that for any~$n$ the number of steps needed by
the algorithm to factor~$n$ is less than $f(\log_{10}(n))$.  Note
that $\log_{10}(n)$ is an approximation for the number of digits
of the input~$n$ to the algorithm.

Peter Shor \cite{shor}\index{Shor} devised a polynomial time algorithm
for factoring integers on quantum computers\index{quantum
computer}\index{factorization!quantum}. We will not discuss his
algorithm further, except to note that in 2001 IBM researchers 
built a quantum computer that used Shor's algorithm to factor $15$ (see
\cite{quantum15, ibm:shor15}).

You can earn money by factoring certain large integers.  Many
cryptosystems would be easily broken if factoring certain large
integers were easy.  Since nobody has proven that factoring integers
is difficult, one way to increase confidence that factoring is
difficult is to offer cash prizes for factoring certain integers.  For
example, until recently there was a \$10000 bounty on factoring the
following $174$-digit integer (see \cite{rsa:challenge}):
$$
\begin{array}{l}
1881988129206079638386972394616504398071635633794173827007\\
6335642298885971523466548531906060650474304531738801130339\\
6716199692321205734031879550656996221305168759307650257059
\end{array}
$$
This number is known as RSA-576\index{RSA-576} since it has 576
digits when written in binary (see Section~\ref{sec:compute_powers}
for more on binary numbers).  It was factored at the German
Federal Agency for Information Technology Security in December 
2003 (see \cite{factor576}):
$$
\begin{array}{l}
  398075086424064937397125500550386491199064362342526708406\\
  \hspace{1ex}385189575946388957261768583317\\
    \times\\
  472772146107435302536223071973048224632914695302097116459\\
    \hspace{1ex}852171130520711256363590397527
  \end{array}
$$
The previous RSA challenge was the $155$-digit number
$$
\begin{array}{l}
1094173864157052742180970732204035761200373294544920599091\\
3842131476349984288934784717997257891267332497625752899781\\
833797076537244027146743531593354333897.
\end{array}$$
It was factored on 22 August 1999 by a group of sixteen researchers
in four months on a cluster of 292 computers (see \cite{rsa155}).
They found that RSA-155\index{RSA-155} is the product of the following two
$78$-digit primes:
\begin{align*}
p &= 10263959282974110577205419657399167590071656780803806\\
  &\hspace{4ex} 6803341933521790711307779\\
q &= 10660348838016845482092722036001287867920795857598929\\
  &\hspace{4ex} 1522270608237193062808643.
\end{align*}
The next RSA challenge is RSA-640:
$$
\begin{array}{l}
31074182404900437213507500358885679300373460228427275457201619\\
48823206440518081504556346829671723286782437916272838033415471\\
07310850191954852900733772482278352574238645401469173660247765\\
2346609,
\end{array}
$$
and its factorization is worth \$20000.

These RSA numbers were factored using an algorithm called the number
field sieve (see \cite{lenstras:nfs}), which is the best-known general
purpose factorization algorithm.  A description of how the number
field sieve works is beyond the scope of this book.  However, the
number field sieve makes extensive use of the elliptic curve
factorization method, which we will describe in Section~\ref{sec:ecm}.

\subsection{The Fundamental Theorem of Arithmetic}%
\label{sec:proof_fundamental}\index{fundamental theorem of arithmetic}
\index{integers!factor uniquely}
We are ready to prove Theorem~\ref{thm:fundamental}
using the following idea.
Suppose we have two factorizations of~$n$. Using 
Theorem~\ref{thm:euclid} we cancel common primes from each factorization, 
one prime at a time.  At the end,
we discover that the factorizations must 
consist of exactly the same primes.  The 
technical details are given below.
\begin{proof}
  If $n=1$, then the only factorization is the empty
  product of primes, so suppose $n>1$.
  
  By Proposition~\ref{prop:numbers_factor}, there exist primes
  $p_1,\ldots, p_d$ such that
$$
  n = p_1 p_2 \cdots p_d.
$$
Suppose that
$$n = q_1 q_2 \cdots q_m$$
is another expression of~$n$ as a product of primes.
Since 
$$p_1 \mid n = q_1 (q_2 \cdots q_m),$$
Euclid's theorem implies that $p_1 = q_1$ or 
$p_1 \mid q_2\cdots q_m$.  By induction, we see that $p_1 = q_i$ for some~$i$.

Now cancel $p_1$ and $q_i$, and repeat the above argument.  Eventually,
we find that, up to order, the two factorizations are the same.
\end{proof}



\section{The Sequence of Prime Numbers}
\label{sec:primeseq}\index{primes!sequence of}
This section is concerned with three questions:
\begin{enumerate}
\item Are there infinitely many primes?  
\item Given $a,b\in\Z$,
are there infinitely many primes of the form $ax+b$?
\item How are the primes spaced along the number line?
\end{enumerate}
We first show that there are infinitely
many primes, then state Dirichlet's theorem
\index{theorem!of Dirichlet} that if $\gcd(a,b)=1$,
then $ax+b$ is a prime for infinitely many values of~$x$. Finally, we
discuss the Prime Number Theorem\index{prime number theorem} 
which asserts that there are
asymptotically $x/\log(x)$ primes less than~$x$,
and we make a connection between this asymptotic formula
and the Riemann Hypothesis\index{Riemann Hypothesis}. 
% For some other famous questions
% about the sequence of primes, see Section~\ref{sec:primeassert}.

\subsection{There Are Infinitely Many Primes}\label{sec:inf_primes}
\index{primes!infinitely many}
Each number on the left in the following table is prime.
We will see soon that this pattern does not continue
indefinitely, but something similar works.
\begin{align*}
3 &= 2+1\\
7 &= 2\cdot 3 + 1\\
31 &= 2\cdot 3 \cdot 5 + 1\\
211 &= 2\cdot 3 \cdot 5 \cdot 7 + 1\\
2311 &= 2\cdot 3 \cdot 5 \cdot 7 \cdot 11 + 1
\end{align*}

\begin{theorem}[Euclid]\label{thm:euclid_primes}
There are infinitely many primes.\ithm{infinitely many primes}
\end{theorem}
\begin{proof}
Suppose that $p_1, p_2, \ldots, p_n$ are~$n$ distinct primes.  
We construct a prime $p_{n+1}$ not equal to any of $p_1,\ldots, p_n$
as follows.  If
\begin{equation}\label{eqn:infprime}
    N=p_1 p_2 p_3 \cdots  p_n + 1,
  \end{equation}
then by Proposition~\ref{prop:numbers_factor} there is a factorization
$$
  N = q_1 q_2 \cdots q_m
$$
with each~$q_i$ prime and $m\geq 1$.
If $q_1 = p_i$ for some~$i$, then $p_i\mid{}N$.
Because of (\ref{eqn:infprime}), we also have
$p_i\mid{}N-1$, so $p_i\mid{} 1=N-(N-1)$, which
is a contradiction.
Thus the prime $p_{n+1} = q_1$ is not in the list $p_1,\ldots, p_n$,
and we have constructed our new prime.
\end{proof}

For example, 
$$
 2\cdot 3 \cdot 5 \cdot 7\cdot 11\cdot 13 + 1 = 30031 = 59\cdot 509.
$$
Multiplying together the first~$6$ primes and adding~$1$ doesn't
produce a prime, but it produces an integer that is merely 
divisible by a new prime.

\begin{joke}[Hendrik Lenstra]\index{Lenstra}\index{joke}
  There are infinitely many composite numbers.  Proof. {\em To obtain
    a new composite number, multiply together the first~$n$ composite
    numbers and don't add $1$.}
\end{joke}



\subsection{Enumerating Primes}\label{sec:enum_primes}
The Sieve of Eratosthenes is an efficient way to enumerate all 
primes up to~$n$.  The sieve works by first writing down all
numbers up to $n$, noting that~$2$ is prime, and crossing off all
multiples of~$2$.  Next, note that the first number not crossed off is~$3$, 
which is prime, and cross off all multiples of~$3$, etc.  
Repeating this process, we obtain a list of the primes up to~$n$.
Formally, the algorithm is as follows:
\begin{algorithm}{Sieve of Eratosthenes}\label{alg:sieve}
Given a positive integer $n$, this algorithm computes a list of the 
primes up to $n$.
\begin{steps}
\item{}[Initialize] Let $X\assign [3,5,\ldots]$ be the list
of all odd integers between $3$ and $n$.  Let $P\assign [2]$ be the list
of primes found so far.  
\item{}[Finished?]\label{alg:sieve_2}  
Let $p$ to be the first element of $X$.
If $p\geq \sqrt{n}$, append each element of~$X$
to~$P$ and terminate.   Otherwise append $p$ to $P$.
\item{}[Cross Off]
Set~$X$ equal to the sublist of elements in~$X$ that
are not divisible by~$p$.  
Go to step \ref{alg:sieve_2}.
\end{steps}
\end{algorithm}
For example, to list the primes $\leq 40$ using the sieve, we
proceed as follows.  First $P=[2]$ and 
$$X = [3,5,7,11,13,15,17,19,21,23,25,27,29,31,33,35,37,39].$$
We append $3$ to $P$ and cross off all multiples of $3$ to obtain
the new list
$$X = [5,7,11,13,17,19,23,25,29,31,35,37].$$
Next we append $5$ to $P$, obtaining $P=[2,3,5]$, and cross off
the multiples of $5$, to obtain $X = [7,11,13,17,19,23,29,31,37].$
Because $7^2\geq 40$, we append $X$ to $P$ and find that the
primes less than $40$ are
$$
  2,3,5, 7,11,13,17,19,23,29,31,37.
$$
\begin{proof}[Proof of Algorithm~\ref{alg:sieve}]
The part of the algorithm that is not clear is that
when the first element $a$ of $X$ satisfies $a\geq \sqrt{n}$, 
then each element of $X$ is prime.  
To see this, suppose $m$ is in $X$, so 
$\sqrt{n} \leq m\leq n$ and that~$m$ is divisible by
no prime that is $\leq \sqrt{n}$.  Write $m=\prod p_i^{e_i}$ with
the $p_i$ distinct primes and $p_1<p_2<\ldots$.  If $p_i>\sqrt{n}$
for each~$i$ and there is more than one~$p_i$, then $m>n$,
a contradiction.  Thus some~$p_i$ is less than $\sqrt{n}$,
which also contradicts out assumptions on~$m$.
\end{proof}
See Section~\ref{sec:comp_enum_primes} for an implementation of
Algorithm~\ref{alg:sieve}.


\subsection{The Largest Known Prime}\index{primes!largest known}
\index{largest known!prime}
Though Theorem~\ref{thm:euclid_primes} implies that there are infinitely
many primes, it still makes sense to ask the question
``What is the largest {\em known} prime?''

A \defn{Mersenne prime} is a prime of the form $2^q-1$.
According to \cite{caldwell:largestprime} the largest known prime
as of July 2004 is the Mersenne prime\index{primes!Mersenne}
$$
  p = 2^{24036583}-1,
$$
which has $7235733$ decimal digits, so writing it out would fill
over $10$ books the size if this book.
Euclid's theorem implies that there definitely is a prime bigger than
this 7.2 million digit~$p$.   Deciding whether or not a number
is prime is interesting, both as a motivating problem and
for applications to cryptography\index{cryptography}, as we will see in
Section~\ref{sec:prob_prime_test} and Chapter~\ref{ch:crypto}.

\subsection{Primes of the Form $ax+b$}
\index{primes!of form $ax+b$}
Next we turn to primes of the form $ax+b$, where~$a$ and~$b$ are 
fixed integers with $a>1$ and~$x$ varies over the natural numbers $\N$.
We assume that $\gcd(a,b)=1$, because otherwise there is no
hope that $ax+b$ is prime infinitely often.  
For example, $2x+2=2(x+1)$ is only prime if $x=0$, and is
not prime for any other $x\in\N$.

\begin{proposition}\index{primes!of form $4x-1$}\label{prop:4x-1}
\iprop{infinitely many primes}
There are infinitely many primes of the form $4x-1$.
\end{proposition}
Why might this be true?   We list numbers of the form $4x-1$ and underline
those that are prime:
$$\ul{3},\, \ul{7},\, \ul{11},\, 15,\, \ul{19},\, \ul{23},\, 27,\, \ul{31},\, 35,\, 39,\,
   \ul{43},\, \ul{47},\, \ldots$$
It is plausible that underlined numbers would continue to appear
indefinitely.

\begin{proof}
Suppose $p_1, p_2,\ldots, p_n$ are distinct primes of the form $4x-1$.  Consider
the number
$$
      N = 4p_1 p_2  \cdots  p_n - 1.
$$
Then $p_i \nmid N$ for any~$i$.  Moreover, not every prime $p\mid N$
is of the form $4x+1$; if they all were, then $N$ would be of the form
$4x+1$.  Thus there is a $p\mid N$ that is of the form $4x-1$.  Since
$p\not= p_i$ for any~$i$, we have found a new prime of the form
$4x-1$.  We can repeat this process indefinitely, so the set of primes
of the form $4x-1$ cannot be finite.  
\end{proof}
Note that this proof does not work if $4x-1$ is replaced by $4x+1$,
since a product of primes of the form $4x-1$ can be of the form
$4x+1$.  


\begin{example}\label{ex:inf_prime_form}
Set $p_1=3$, $p_2=7$.   Then
$$
    N = 4\cdot 3 \cdot 7 - 1 = \ul{83}
$$
is a prime of the form $4x-1$.  Next 
$$
    N = 4\cdot 3 \cdot 7\cdot 83 - 1 = \ul{6971},
$$
which is again a prime of the form $4x-1$.
Again:
$$
    N = 4\cdot 3 \cdot 7\cdot 83\cdot 6971 - 1 = 48601811 = 61 \cdot \ul{796751}.
$$
This time $61$ is a prime, but it is of the form $4x+1 = 4\cdot 15+1$.
However, $796751$ is prime and 
$796751 = 4\cdot 199188 - 1$.
We are unstoppable:
$$
    N = 4\cdot 3 \cdot 7\cdot 83\cdot 6971 \cdot 796751 - 1 = \ul{5591}\cdot 6926049421.
$$
This time the small prime, $5591$, is of the form $4x-1$ and the large
one is of the form $4x+1$.
\end{example}

\begin{theorem}[Dirichlet]\label{thm:dirichlet}
\ithm{Dirichlet}
Let~$a$ and~$b$ be integers with $\gcd(a,b)=1$.
Then there are infinitely many primes of the form
$ax+b$.  
\end{theorem}
Proofs of this theorem typically use tools from advanced number
theory, and are beyond the scope of this book (see e.g.,
\cite[\S VIII.4]{frohlichtaylor}).


\subsection{How Many Primes are There?}\index{primes!density of}
\index{density of primes}
We saw in Section~\ref{sec:inf_primes}
that there are infinitely many primes.
In order to get a sense for just how many primes there are,
we consider a few warm-up questions.
Then we consider some numerical evidence and state
the prime number theorem, which gives an asymptotic answer
to our question, and connect this theorem with a form
of the Riemann Hypothesis.\index{Riemann Hypothesis}  
Our discussion of counting primes in this section is very cursory;
for more details, read Crandall and Pomerance's excellent 
book \cite[\S1.1.5]{primenumbers}.

The following vague discussion is meant to motivate a precise way to
measure the number of primes. How many natural numbers are even?
Answer: Half of them.  How many natural numbers are of the form
$4x-1$?  Answer: One fourth of them.  How many natural numbers are
perfect squares?  Answer: Zero percent of all natural numbers, in the
sense that the limit of the proportion of perfect squares to all
natural numbers converges to~$0$. More precisely,
$$
  \lim_{x\ra \infty} 
   \frac{\# \{n\in\N : 
         n \leq x \text{ and $n$ is a perfect square}\}}{x} = 0,
$$
since the numerator is roughly $\sqrt{x}$ and 
$\lim_{x\ra\infty}\frac{\sqrt{x}}{x} = 0$.
Likewise, it is an easy consequence of Theorem~\ref{thm:primenumber}
below that zero percent of all natural numbers are prime
(see \exref{ch:primes}{ex:fewprimes}).

We are thus led to ask another question: How many positive integers
$\leq x$ are perfect squares?  Answer: roughly $\sqrt{x}$.  In the
context of primes, we ask,
\begin{question}
How many natural numbers $\leq x$ are prime?
\end{question}

Let 
$$
   \pi(x) = \#\{p\in \N : p \leq x \text{ is a prime}\}.
$$
For example, 
$$
 \pi(6) =\#\{2,3,5\} = 3.
$$
Some values of $\pi(x)$ are given in Table~\ref{tab:primes}, 
and Figures~\ref{fig:pix} and \ref{fig:pix2} contain graphs of $\pi(x)$.
These graphs look like straight lines, which maybe bend down slightly.
\begin{table}\index{table!values of $\pi(x)$}
\caption{Values of $\pi(x)$\label{tab:primes}}\vspace{1ex}
\begin{center}
\begin{tabular}{|c|c|c|c|c|c|c|c|c|c|c|c|c|}\hline
$x$ & 100 & 200 & 300 & 400 & 500 & 600 & 700 & 800 & 900 &1000\\\hline
$\pi(x)$ & 25&46&62&78&95&109&125&139&154&168\\\hline
\end{tabular}
\end{center}
\end{table}

\begin{figure}
\psset{unit=0.0042in}
\pspicture(-1,1)(1000,200)
%\psgrid[gridcolor=lightgray]
\psline[linewidth=0.03]{->}(-2,0)(1000,0)\rput(1015,0){$x$}
\psline[linewidth=0.03]{->}(0,-5)(0,200)\rput(0,215){$y$}
\pscircle*[linecolor=red](100,25){5}\rput(100,50){\mbox{\tiny$(100,25)$}}
\pscircle*[linecolor=red](200,46){5}\rput(200,70){\mbox{\tiny$(200,46)$}}
\pscircle*[linecolor=red](900,154){5}\rput(900,175){\mbox{\tiny$(900,154)$}}
\pscircle*[linecolor=red](1000,168){5}\rput(1005,180){\mbox{\tiny$(1000,168)$}}
\rput(-30,180){{\small $180$}}
\rput(-30,100){{\small $100$}}
\rput(900,-30){{\small $900$}}
\rput(100,-30){{\small $100$}}
\rput(200,150){Graph of $\pi(x)$}
\psline[linewidth=0.02](-5,180)(7,180)
\psline[linewidth=0.02](900,-5)(900,7)
\psline[linewidth=0.02](-5,100)(7,100)
\psline[linewidth=0.02](100,-5)(100,7)
\psline[linecolor=blue]
(10,4)
(20,8)
(30,10)
(40,12)
(50,15)
(60,17)
(70,19)
(80,22)
(90,24)
(100,25)
(110,29)
(120,30)
(130,31)
(140,34)
(150,35)
(160,37)
(170,39)
(180,41)
(190,42)
(200,46)
(210,46)
(220,47)
(230,50)
(240,52)
(250,53)
(260,55)
(270,57)
(280,59)
(290,61)
(300,62)
(310,63)
(320,66)
(330,66)
(340,68)
(350,70)
(360,72)
(370,73)
(380,75)
(390,77)
(400,78)
(410,80)
(420,81)
(430,82)
(440,85)
(450,87)
(460,88)
(470,91)
(480,92)
(490,93)
(500,95)
(510,97)
(520,97)
(530,99)
(540,99)
(550,101)
(560,102)
(570,104)
(580,106)
(590,107)
(600,109)
(610,111)
(620,114)
(630,114)
(640,115)
(650,118)
(660,120)
(670,121)
(680,123)
(690,124)
(700,125)
(710,127)
(720,128)
(730,129)
(740,131)
(750,132)
(760,134)
(770,136)
(780,137)
(790,138)
(800,139)
(810,140)
(820,141)
(830,145)
(840,146)
(850,146)
(860,149)
(870,150)
(880,151)
(890,154)
(900,154)
(910,155)
(920,157)
(930,158)
(940,159)
(950,161)
(960,162)
(970,163)
(980,165)
(990,166)
(1000,168)
\endpspicture
\caption{Graph of $\pi(x)$ for $x<1000$}\label{fig:pix}
\end{figure}


Gauss\index{Gauss} had a lifelong love of enumerating primes.
Eventually he computed $\pi(3000000)$, though the author doesn't know
whether or not Gauss got the right answer, which is $216816$.  Gauss
conjectured the following asymptotic formula for $\pi(x)$, which was
later proved independently by Hadamard\index{Hadamard} and Vall\'ee
Poussin\index{Vall\'ee Poussin} in 1896 (but will not be proved in
this book):
\begin{theorem}[Prime Number Theorem]\label{thm:primenumber}
\ithm{prime number}
The function $\pi(x)$ is asymptotic to $x/\log(x)$, in the sense that
   $$\lim_{x\ra \infty}  \frac{\pi(x)}{ x/\log(x)} = 1.$$
\end{theorem}
We do nothing more here than motivate this deep theorem with
a few further numerical observations.

The theorem implies that
$$\lim_{x\ra \infty} \pi(x)/x  = \lim_{x\ra \infty} 1/\log(x)=0,$$
so for any~$a$, 
$$\lim_{x\ra\infty} \frac{\pi(x)}{x/(\log(x)-a)} =
    \lim_{x\ra\infty} \frac{\pi(x)}{x/\log(x)} - \frac{a\pi(x)}{x}     
          = 1.$$
Thus $x/(\log(x)-a)$ is also asymptotic to $\pi(x)$ for
any~$a$.  See \cite[\S1.1.5]{primenumbers} for a discussion of why
$a=1$ is the best choice.  Table~\ref{tab:pnt} compares
$\pi(x)$ and $x/(\log(x)-1)$ for several $x<10000$.

\begin{table}\index{table!comparing $\pi(x)$ to $x/(\log(x)-1)$}
%? pi(x, c=0) = forprime(p=2,x,c++); c; 
%? for(n=1,10,print(n*1000,"\t",pi(n*1000),"\t",n*1000/(log(n*1000)-1)))
\caption{Comparison of $\pi(x)$ and $x/(\log(x)-1)$\label{tab:pnt}}\vspace{1ex}

\begin{center}
\begin{tabular}{|l|l|l|}\hline
$\quad{}\!x$& $\pi(x)$ & $x/(\log(x)-1)$ (approx)\\\hline
1000&   168&    169.2690290604408165186256278\\
2000&   303&    302.9888734545463878029800994\\
3000&   430&    428.1819317975237043747385740\\
4000&   550&    548.3922097278253264133400985\\
5000&   669&    665.1418784486502172369455815\\
6000&   783&    779.2698885854778626863677374\\
7000&   900&    891.3035657223339974352567759\\
8000&   1007&   1001.602962794770080754784281\\
9000&   1117&   1110.428422963188172310675011\\
10000&  1229&   1217.976301461550279200775705\\\hline
\end{tabular}
\end{center}
\end{table}

\begin{figure}
\begin{center}
\vspace{2ex}
\input{graphics/pi_x_10000}
\vspace{4ex}
\input{graphics/pi_x_100000}
\caption{Graphs of $\pi(x)$ for $x<10000$ and $x<100000$\label{fig:pix2}}
\end{center}
\end{figure}

As of 2004, the record for counting primes appears\index{largest known!value of $\pi(x)$} to be 
$$
  \pi(4\cdot 10^{22}) = 783964159847056303858.
  $$
  The computation of $\pi(4\cdot 10^{22})$ reportedly took ten
  months on a 350 Mhz Pentium II (see \cite{pixproject} for more
  details).
  
  For the reader familiar with complex analysis, we mention a
  connection between $\pi(x)$ and the Riemann Hypothesis.  The
  Riemann zeta function $\zeta(s)$ is a complex analytic function on
  $\C\setminus \{1\}$ that extends the function defined on a right
  half plane by $\sum_{n=1}^{\infty} n^{-s}$.  The Riemann
  Hypothesis\index{Riemann Hypothesis} is the conjecture that the
  zeros in $\C$ of $\zeta(s)$ with positive real part lie on the line
  ${\rm Re}(s)=1/2$. This conjecture is one of the Clay Math Institute
  million dollar millennium prize problems \cite{cmi}.
 
  According to \cite[\S1.4.1]{primenumbers}, the Riemann Hypothesis is
  equivalent to the conjecture that
$$
  \Li(x) = \int_{2}^{x} \frac{1}{\log(t)} dt
$$
is a ``good'' approximation to $\pi(x)$, in the following 
precise sense:
\begin{conjecture}[Equivalent to the Riemann Hypothesis]
\index{Riemann Hypothesis!bound on $\pi(x)$}
\mbox{}\newline{}For all  $x\geq 2.01$, 
$$
 |\pi(x)-\Li(x)| \leq \sqrt{x}\log(x).
$$
\end{conjecture}
If $x=2$, then $\pi(2)=1$ and $\Li(2)=0$,
but $\sqrt{2}\log(2) = 0.9802\ldots$, so the inequality
is not true for $x\geq 2$, but $2.01$ is big enough.
We will do nothing more to explain this conjecture,
and settle for one numerical example.
\begin{example}
Let $x=4\cdot 10^{22}$.  Then
\begin{align*}
  \pi(x) &= 783964159847056303858,\\
  \Li(x) &= 783964159852157952242.7155276025801473\ldots, \\
  |\pi(x) - \Li(x)| &= 5101648384.71552760258014\ldots, \\
  \sqrt{x}\log(x) &=  10408633281397.77913344605\ldots, \\
  x/(\log(x)-1)  &=  783650443647303761503.5237113087392967\ldots.
\end{align*}
\end{example}


One of the best popular article on the prime number theorem and
the Riemann hypothesis is \cite{zagier:primes50}.

\begin{exercises}

\item Compute the greatest common divisor $\gcd(455,1235)$ by hand.

\item\label{ex:handsieve} Use the Sieve of Eratosthenes 
to make a list of all primes up to $100$.

\item\label{ex:primesform} Prove that there are infinitely 
many primes of the form $6x-1$.\index{primes!of the form $6x-1$}

\item \label{ex:fewprimes}
Use Theorem~\ref{thm:primenumber} to deduce that 
$\ds \lim_{x\to\infty} \frac{\pi(x)}{x} = 0$.

\end{exercises}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%  
%% Chapter: Integers Modulo n
%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\chapter{The Ring of Integers Modulo $n$}\label{ch:cong}

This chapter is about the ring $\zmod{n}$ of integers 
modulo~$n$.\index{$\zmod{n}$}
First we discuss when linear equations modulo~$n$ have a solution,
then introduce the Euler~$\vphi$ function and prove Fermat's Little
Theorem and Wilson's theorem.  Next we prove the Chinese Remainer
Theorem, which addresses simultaneous solubility of several linear
equations modulo coprime moduli.  With these theoretical foundations
in place, in Section~\ref{sec:arith_mod_n} we introduce algorithms for
doing interesting computations modulo~$n$, including computing large
powers quickly, and solving linear equations.  We finish with a very
brief discussion of finding prime numbers using arithmetic modulo~$n$.

% We assume the reader has read Chapter~\ref{ch:primes}, and knows what
% it means to take the quotient of the ring $\Z$ by an ideal $n\Z$.

\section{Congruences Modulo $n$}\index{congruences}
\index{equivalence relation!congruence modulo~$n$}
\index{integers!modulo~$n$}
\label{sec:congruences}
In this section we define the ring $\zmod{n}$ of integers modulo~$n$,
introduce the Euler $\vphi$-function,\index{Euler!phi function}
\index{phi@$\vphi$ function} and relate it to the
multiplicative order\index{multiplicative!order} 
of certain elements of $\zmod{n}$.

If $a,b\in\Z$ and $n\in\N$, we say that $a$ is {\em congruent
    to~$b$ modulo~$n$} if $n\mid a-b$, and write $a\con b\pmod{n}$.
Let $n\Z=(n)$ be the ideal of $\Z$ generated by~$n$.
\begin{definition}[Integers Modulo $n$]
The \defn{ring of integers modulo~$n$}
is the quotient ring $\zmod{n}$ of equivalence classes of integers
modulo~$n$.  It is equipped with its natural ring structure:
$$
  (a + n\Z) + (b + n\Z) = (a+b) + n\Z
$$
$$
  (a + n\Z) \cdot (b + n\Z) = (a\cdot b) + n\Z.
$$
\end{definition}


\begin{example}
For example,
$$
  \zmod{3} = \{ \{\ldots, -3, 0, 3, \ldots\}, 
              \{\ldots, -2, 1, 4, \ldots\},
              \{\ldots, -1, 2, 5, \ldots\}\}
$$
\end{example}

\label{page:znring}
We use the notation $\zmod{n}$ because $\zmod{n}$ is the quotient of
the ring~$\Z$ by the ideal $n\Z$ of multiples of~$n$.  Because
$\zmod{n}$ is the quotient of a ring by an ideal, the ring structure
on~$\Z$ induces a ring structure on $\zmod{n}$.  We often let~$a$
or $a\pmod{n}$
denote the equivalence class $a+n\Z$ of~$a$.  If~$p$ is a prime, then
$\zmod{p}$ is a field\index{field!of integers modulo $p$} (see
\exref{ch:cong}{ex:zpfield}).\index{finite field}

We call the natural reduction map $\Z \to \zmod{n}$, which sends $a$ to 
$a+n\Z$, \defn{reduction modulo~$n$}.  We also say that $a$ is a 
\defn{lift} of $a+n\Z$.  Thus, e.g., $7$ is a lift of $1$ mod $3$,
since $7+3\Z = 1+3\Z$.

We can use that arithmetic in $\zmod{n}$ is well defined is to
derive tests for divisibility\index{divisibility tests} by $n$ (see
\exref{ch:cong}{ex:divrules}).
\begin{proposition}\label{prop:div3}\iprop{divisibility by 3}
A number $n\in\Z$ is divisible by~$3$ if and only if
the sum of the digits of~$n$ is divisible by~$3$.
\end{proposition}
\begin{proof}
Write 
 $$n=a+10b+100c+\cdots,$$
where the digits of~$n$ are $a$, $b$, $c$, etc.
Since $10\con 1\pmod{3}$,
$$
  n = a + 10b + 100c+\cdots \con a + b + c+\cdots \pmod{3},
$$
from which the proposition follows.
\end{proof}


\subsection{Linear Equations Modulo~$n$}\label{sec:lineq}\index{linear equations modulo $n$}%
\index{modular arithmetic!and linear equations} In this section, we
are concerned with how to decide whether or not a linear equation of
the form $ax\con b \pmod{n}$ has a solution modulo~$n$.  
Algorithms for {\em computing} solutions to $ax\con
b\pmod{n}$ are the topic of Section~\ref{sec:arith_mod_n}.

First we prove a proposition that gives a criterion under
which one can cancel a quantity from both sides of a congruence.
\begin{proposition}[Cancellation]\label{prop:cancel}\iprop{cancellation}
If $\gcd(c,n)=1$ and
$$
   ac\con bc\pmod{n},
$$
then $a \con b\pmod{n}$.
\end{proposition}
\begin{proof}
By definition
$$
  n \mid ac - bc = (a-b)c.
$$
Since $\gcd(n,c)=1$, it follows
from Theorem~\ref{thm:fundamental} that $n\mid a-b$, so
$$
   a \con b\pmod{n},
$$
as claimed.
\end{proof}



When~$a$ has a multiplicative inverse $a'$ in $\zmod{n}$ (i.e.,
$aa'\con 1\pmod{n}$) then the equation $ax\con b\pmod{n}$ has a unique
solution $x\con a'b\pmod{n}$ modulo~$n$.  Thus, it is of interest to
determine the units in $\zmod{n}$, i.e., the elements which have a
multiplicative inverse.

We will use complete sets of residues\index{complete set of residues}
to prove that the units in $\zmod{n}$ are exactly the~$a\in\zmod{n}$
such that $\gcd(\tilde{a},n)=1$ for any lift $\tilde{a}$ of~$a$
to~$\Z$ (it doesn't matter which lift).

\begin{definition}[Complete Set of Residues]
We call a subset $R\subset\Z$ of size~$n$ whose reductions modulo~$n$ are
pairwise distinct a \defn{complete set of residues}
modulo~$n$.  In other words, a complete set of residues is a choice of
representative for each equivalence class in $\zmod{n}$.
\end{definition}
For example,
$$
   R=\{0,1,2,\ldots,n-1\}
$$
is a complete set of residues modulo~$n$.
When $n=5$, 
$R = \{0,1,-1,2,-2\}$
is a complete set of residues.

\begin{lemma}\label{lem:residues}
If~$R$ is a complete set of residues modulo~$n$ and $a\in\Z$ with
$\gcd(a,n)=1$, then $aR = \{ax : x \in R\}$
is also a complete set of residues modulo~$n$.
\end{lemma}
\begin{proof}
If $ax\con ax'\pmod{n}$ with $x, x'\in R$, then 
Proposition~\ref{prop:cancel} implies that $x\con{}x'\pmod{n}$.
Because $R$ is a complete set of residues, this implies
that $x=x'$.  Thus the elements of
$aR$ have distinct reductions modulo~$n$.
It follows, since $\#aR=n$, that $aR$ is a 
complete set of residues modulo~$n$.
\end{proof}

\begin{proposition}[Units]\label{prop:unitsmodn}\iprop{units}
If $\gcd(a,n)=1$, then the equation
$
 ax\con b\pmod{n}
$
has a solution, and that solution is unique modulo~$n$.
\end{proposition}
\begin{proof}
Let~$R$ be a complete set of residues modulo~$n$, so there
is a unique element of~$R$ that is congruent to~$b$ modulo~$n$.
By Lemma~\ref{lem:residues},  
$aR$ is also a complete set of residues modulo~$n$, so
there is a unique element $ax\in aR$ that is congruent
to~$b$ modulo~$n$, and we have $ax\con b\pmod{n}$.
\end{proof}
Algebraically, this proposition asserts that if $\gcd(a,n)=1$, then
the map $\zmod{n}\ra \zmod{n}$ given by left multiplication by~$a$ is
a bijection.

\begin{example}
Consider the equation $2x\con 3\pmod{7}$,
and the complete set $R = \{0,1,2,3,4,5,6\}$
of coset representatives.  We have
$$
  2R = \{0,2,4,6,8\con 1, 10\con 3, 12\con 5\},
$$
so $2\cdot 5\con 3\pmod{7}$.
\end{example}

When $\gcd(a,n)\neq 1$, then the equation $ax\con b\pmod{n}$ may or
may not have a solution.  For example, $2x\con 1\pmod{4}$ has no
solution, but $2x\con 2\pmod{4}$ does, and in fact it has more than
one mod~$4$ ($x=1$ and $x=3$).  Generalizing
Proposition~\ref{prop:unitsmodn}, we obtain the following more general
criterion for solvability.
\begin{proposition}[Solvability]\label{prop:cancel2}\iprop{solvability}
The equation $ax\con b\pmod{n}$ has a solution
if and only if $\gcd(a,n)$ divides~$b$.
\end{proposition}
\begin{proof}
  Let $g=\gcd(a,n)$.  If there is a solution~$x$ to the equation
  $ax\con b\pmod{n}$, then $n\mid (ax-b)$.  Since $g\mid n$ and $g\mid
  a$, it follows that $g\mid b$.

  Conversely, suppose that $g\mid b$.  Then $n\mid (ax-b)$ if and only
  if $$
  \frac{n}{g} \mid \left(\frac{a}{g} x - \frac{b}{g}\right).  $$
  Thus $ax\con b\pmod{n}$ has a solution if and only if $\frac{a}{g}x
  \con \frac{b}{g}\pmod{\frac{n}{g}}$ has a solution.  Since
  $\gcd(a/g, n/g)=1$, Proposition~\ref{prop:unitsmodn} implies this
  latter equation does have a solution.
\end{proof}

In Chapter~\ref{ch:reciprocity} we will study quadratic reciprocity,
which gives a nice criterion for whether or not a quadratic equation
modulo~$n$ has a solution.  

\subsection{Fermat's Little Theorem}
\index{Fermat's little theorem}%
\label{sec:flittle}%
\index{theorem!Fermat's little}%
The group of units $(\zmod{n})^*$ of the ring $\zmod{n}$ will
be of great interest to us.  Each element of
this group has an order, and Lagrange's theorem from group theory
implies that each element of $(\zmod{n})^*$ has order that divides
the order of $(\zmod{n})^*$.  In elementary number theory this
fact goes by the monicker ``Fermat's Little Theorem'', and we
reprove it from basic principles in this section.

\begin{definition}[Order of an Element]\index{order!of element}%
\index{modular arithmetic!order of element}\label{defn:order}
Let $n\in\N$ and $x\in\Z$ and suppose that $\gcd(x,n)=1$.
The \defn{order} of $x$ modulo~$n$ is the smallest $m\in\N$
such that 
$$
  x^m \con 1\pmod{n}.
$$
\end{definition}
To show that the definition makes sense, we verify
that such an~$m$ exists.  Consider $x, x^2, x^3, \ldots$ modulo~$n$.
There are only finitely many residue classes modulo~$n$, so we must
eventually find two integers $i, j$ with $i<j$ such that
$$
  x^j\con x^i\pmod{n}.
$$
Since $\gcd(x,n)=1$, Proposition~\ref{prop:cancel} implies that 
we can cancel~$x$'s and conclude that
$$
  x^{j-i}\con 1\pmod{n}.
$$


\begin{definition}[Euler's phi-function]\label{def:phi}\index{Euler!phi function}
For $n\in\N$, let
$$
 \vphi(n) = \#\{a \in \N : a \leq n \text{ and } \gcd(a,n)=1\}.
$$
\end{definition}
For example,
\begin{align*}
 \vphi(1) &= \#\{1\} = 1,\\
 \vphi(2) &= \#\{1\} = 1,\\
 \vphi(5) &= \#\{1,2,3,4\} = 4,\\
 \vphi(12) &= \#\{1,5,7,11\} = 4.\\
\end{align*}
Also, if~$p$ is any prime number then
$$
   \vphi(p) = \#\{1,2,\ldots,p-1\} = p-1.
$$
In Section~\ref{sec:multi_funcs}, we will prove that~$\vphi$ is a
multiplicative function.  This will yield an easy way to compute
$\vphi(n)$ in terms of the prime factorization of~$n$.

\begin{theorem}[Fermat's Little Theorem]\label{thm:fermatlittle}
\ithm{Fermat's little}
If $\gcd(x,n)=1$, then
$$
   x^{\vphi(n)} \con 1\pmod{n}.
$$
\end{theorem}
\begin{proof}
As mentioned above, Fermat's Little Theorem has the following group-theoretic
\index{Fermat's little theorem!group-theoretic interpretation}
interpretation.  The set of units in $\zmod{n}$ is a group
\index{group!$(\zmod{m})^*$}
$$
(\zmod{n})^*
= \{ a \in \zmod{n} : \gcd(a,n) = 1\}.
$$
which has order~$\vphi(n)$.  The theorem then asserts
that the order of an element of $(\zmod{n})^*$ divides the order
$\vphi(n)$ of $(\zmod{n})^*$.  This is a special case of the more
general fact (Lagrange's theorem) that if~$G$ is a finite group and
$g\in G$, then the order of~$g$ divides the cardinality of~$G$.

We now give an elementary proof of the theorem.  Let 
$$
  P = \{ a : 1\leq a \leq n \text{ and } \gcd(a,n) = 1\}.
$$
In the same way that we proved Lemma~\ref{lem:residues},
we see that the reductions modulo~$n$ of the elements of $xP$ 
are the same as the reductions of the elements of $P$.
Thus
$$
 \prod_{a\in P} (xa) \con \prod_{a \in P} a \pmod{n},
$$
since the products are over the same numbers modulo~$n$.
Now cancel the $a$'s on both sides to get
$$x^{\#P} \con 1\pmod{n},$$
as claimed.
\end{proof}



\subsection{Wilson's Theorem}\index{Wilson's theorem}\index{theorem!of Wilson}
The following characterization of prime numbers, from the 1770s, is
called ``Wilson's Theorem'', though it was first proved by
Lagrange\index{Lagrange}.
\begin{proposition}[Wilson's Theorem]\label{prop:wilson}\iprop{Wilson}
An integer $p>1$ is prime if and only if
$(p-1)! \con -1 \pmod{p}.$
\end{proposition}
For example,
if $p=3$, then $(p-1)! = 2\con -1\pmod{3}$.
If $p=17$, then 
$$(p-1)! = 20922789888000 \con -1\pmod{17}.$$
But if $p=15$, then 
$$(p-1)! = 87178291200 \con 0 \pmod{15},$$
so $15$ is composite.  Thus Wilson's theorem could be viewed
as a primality test, though, from a computational point of view, 
it is probably the {\em least efficient} 
primality test since computing $(n-1)!$ takes so many steps.
\begin{proof}
The statement is clear when $p=2$, so henceforth we assume
that $p>2$.
We first assume that~$p$ is prime and prove that 
$(p-1)! \con -1\pmod{p}$.  If $a\in\{1,2,\ldots,p-1\}$ then
the equation 
$$
  ax\con 1\pmod{p}
$$
has a unique solution $a'\in\{1,2,\ldots,p-1\}$.
If $a=a'$, then $a^2\con 1\pmod{p}$, so 
$p\mid a^2-1 = (a-1)(a+1)$, so 
$p\mid (a-1)$ or $p\mid (a+1)$, so $a\in\{1,p-1\}$.  
We can thus pair off the elements of 
$\{2,3,\ldots,p-2\}$,
each with their inverse. 
Thus
$$
  2\cdot 3 \cdot \cdots \cdot (p-2) \con 1\pmod{p}.
$$
Multiplying both sides by $p-1$ proves that
$(p-1)! \con -1\pmod{p}$.

Next we assume that $(p-1)! \con -1\pmod{p}$ and
prove that~$p$ must be prime.  Suppose not, so that~$p\geq 4$ 
is a composite number.  Let~$\ell$ be a prime divisor
of~$p$.  Then $\ell<p$, so $\ell\mid (p-1)!$.  Also,
by assumption,
$$
  \ell \mid p \mid ((p-1)! + 1).
$$
This is a contradiction, because a prime can not divide a number~$a$ and
also divide $a+1$, since it would then have to divide $(a+1) - a=1$.
\end{proof}

\begin{example}
We illustrate the key step in the above proof in the case $p=17$.
We have
$$
2\cdot 3 \cdots  15
  = (2\cdot 9)\cdot(3\cdot 6)\cdot(4\cdot 13)\cdot
    (5\cdot 7)\cdot(8\cdot 15)\cdot(10\cdot 12)\cdot(14\cdot 11)
  \con 1\pmod{17},$$
where we have paired up the numbers $a, b$ for 
which $ab\con 1\pmod{17}$.
\end{example}

\section{The Chinese Remainder Theorem}\label{sec:chinese}%
\index{Chinese remainder theorem}
In this section we prove the Chinese Remainder Theorem, which gives
conditions under which a system of linear equations is guaranteed to
have a solution.
In the 4th century a Chinese mathematician asked the following:
\begin{question}\label{q:chinese}
There is a quantity whose number is unknown. Repeatedly divided
by 3, the remainder is 2; by 5 the remainder is 3; and by 7 the
remainder is 2. What is the quantity?
\end{question}
In modern notation, Question~\ref{q:chinese}  asks us to 
find a positive integer solution to the following system of 
three equations:
\begin{align*}
x &\con 2 \pmod{3}\\
x &\con 3 \pmod{5}\\
x &\con 2 \pmod{7}
\end{align*}
The Chinese Remainder Theorem asserts that a solution  
exists, and the proof gives a method to find one.
(See Section~\ref{sec:arith_mod_n} for the necessary algorithms.)


\begin{theorem}[Chinese Remainder Theorem]\label{thm:crt}%
\ithm{Chinese remainder}
Let $a, b\in\Z$ and $n,m\in\N$ such that
$\gcd(n,m)=1$.  Then there exists $x\in\Z$ such that
\begin{align*}
x&\con a\pmod{m},\\
x&\con b\pmod{n}.
\end{align*}
Moreover~$x$ is unique modulo~$mn$.
\end{theorem}
\begin{proof}
If we can solve for~$t$ in the equation 
$$
   a+tm \con b \pmod{n},
$$
then $x=a+tm$ will satisfy both congruences.
To see that we can solve, subtract~$a$ from 
both sides and use Proposition~\ref{prop:unitsmodn}
together with our assumption that $\gcd(n,m)=1$  to see that 
there is a solution.

For uniqueness, suppose that $x$ and $y$ solve both congruences.  Then
$z=x-y$ satisfies $z\con 0\pmod{m}$ and $z\con 0\pmod{n}$, so $m\mid
z$ and $n\mid z$.  Since $\gcd(n,m)=1$, it follows that $nm\mid z$, so
$x\con y\pmod{nm}$.
\end{proof}

% An alternative approach to proving Theorem~\ref{thm:crt} is to prove
% the result for the special cases $a=1,b=0$ and for $a=0,b=1$, then
% take a suitable linear combination of those two solutions.  This is
% geometrically appealing, since it is like writing a vector in terms of
% a basis.

\begin{algorithm}{Chinese Remainder Theorem}\label{alg:crt}
Given coprime integers $m$ and $n$ and integers $a$ and $b$,
this algorithm find an integer $x$ such that $x\con a\pmod{m}$
and $x\con b\pmod{n}$.
\begin{steps}
\item{}[Extended GCD] Use Algorithm~\ref{alg:xgcd} below 
to find integers $c,d$ such that $cm+dn=1$.
\item{}[Answer] Output $x =a + (b-a)cm$ and terminate.
\end{steps}
\end{algorithm}
\begin{proof}
Since $c\in\Z$, we have $x\con a\pmod{m}$,
and using that $cm+dn=1$,  we have 
$a + (b-a)cm \con a + (b-a) \con b\pmod{n}$.
\end{proof}

Now we can answer Question~\ref{q:chinese}.  
First, we use Theorem~\ref{thm:crt}
to find a solution to the pair of equations
\begin{align*}
x &\con 2 \pmod{3},\\
x &\con 3 \pmod{5}.
\end{align*}
Set $a=2$, $b=3$, $m=3$, $n=5$.
Step 1 is to find a solution to $t\cdot 3 \con 3-2\pmod{5}$.
A solution is $t=2$.  Then $x=a+tm=2+2\cdot 3 = 8$.
Since any~$x'$ with $x'\con x\pmod{15}$ is also a solution to
those two equations, we can solve all three equations by
finding a solution to the pair of equations
\begin{align*}
x &\con 8 \pmod{15}\\
x &\con 2 \pmod{7}.
\end{align*}
Again, we find a solution to $t\cdot 15 \con 2-8\pmod{7}$.
A solution is $t = 1$, so 
$$x=a+tm=8+15=23.$$
Note that there are other solutions.  Any $x'\con x\pmod{3\cdot 5\cdot 7}$
is also a solution; e.g., $23+3\cdot 5\cdot 7 = 128$.

\subsection{Multiplicative Functions}\index{multiplicative!functions}%
\label{sec:multi_funcs}%
\begin{definition}[Multiplicative Function]
A function $f:\N\ra \Z$ is 
\defn{multiplicative} if, whenever $m, n\in\N$ and $\gcd(m,n)=1$, we have
$$
   f(mn) = f(m)\cdot f(n).
$$
\end{definition}
Recall from Definition~\ref{def:phi}
that the \defn{Euler $\vphi$-function}\index{Euler!phi function} is
$$
  \vphi(n) = \#\{a : 1\leq a \leq n\text{ and }\gcd(a,n)=1\}.
$$

\begin{lemma}\label{lem:units_map}
Suppose that $m,n\in\N$ and $\gcd(m,n)=1$.
Then the map
\begin{equation}\label{eqn:crtprod}
\psi: (\zmod{mn})^* \ra (\zmod{m})^* \cross (\zmod{n})^*.
\end{equation}
defined by 
$$
 \psi(c) = (c\text{ mod } m, \,\,c \text{ mod }n)
$$
is a bijection.
\end{lemma}
\begin{proof}
We first show that~$\psi$ is injective.  If $\psi(c)=\psi(c')$, then
$m\mid c-c'$ and $n\mid c-c'$, so $nm\mid c-c'$ because $\gcd(n,m)=1$.
Thus $c=c'$ as elements of $(\zmod{mn})^*$.

Next we show that~$\psi$ is surjective. Given~$a$ and~$b$ 
with $\gcd(a,m)=1$ and
$\gcd(b,n)=1$, Theorem~\ref{thm:crt} implies that there
exists~$c$ with $c\con a\pmod{m}$ and $c\con b\pmod{n}$.  We
may assume that $1\leq c\leq nm$, and since $\gcd(a,m)=1$ and
$\gcd(b,n)=1$, we must have $\gcd(c,nm)=1$. Thus $\psi(c)=(a,b)$.
\end{proof}

\begin{proposition}[Multiplicativity of $\vphi$]\label{prop:phimult}\iprop{multiplicative of Euler's function}
The function $\vphi$ is multiplicative.
\index{phi function!is multiplicative}\index{Euler!phi function!is multiplicative}
\end{proposition}
\begin{proof}
  The map~$\psi$ of Lemma~\ref{lem:units_map} is a bijection, so the
  set on the left in (\ref{eqn:crtprod}) has the same size as the
  product set on the right in (\ref{eqn:crtprod}).  Thus
  $$
  \vphi(mn) = \vphi(m)\cdot \vphi(n).
  $$
\end{proof}
% See \exref{ch:cong}{ex:multproof2} for an alternative proof of
% Proposition~\ref{prop:phimult} that uses the natural isomorphism
% $\zmod{mn} \ra \zmod{m} \cross \zmod{n}$.


The proposition is helpful in computing $\vphi(n)$, at least
if we assume we can compute the factorization of~$n$ (see
Section~\ref{sec:phin} for a connection between factoring $n$
and computing $\vphi(n)$).
For example,
$$
   \vphi(12) = \vphi(2^2)\cdot \vphi(3) = 2\cdot 2 = 4.
$$
Also, for $n\geq 1$, we have
\begin{equation}\label{eqn:phipower}
   \vphi(p^n) = p^n - \frac{p^n}{p} = p^n - p^{n-1} = p^{n-1}(p-1),
 \end{equation}
 since $\vphi(p^n)$ is the number of numbers less than $p^n$
minus the number of those that are divisible by $p$.
Thus, e.g.,
$$
   \vphi(389\cdot 11^2) = 388 \cdot (11^2 - 11) = 388\cdot 110 = 42680.
$$

\section{Quickly Computing Inverses and Huge Powers}\index{compute!inverse modulo $n$}\index{compute!powers modulo $n$}
\label{sec:arith_mod_n}
This section is about how to solve the equation $ax\con 1\pmod{n}$
when we know it has a solution, and how to efficiently compute
$a^m\pmod{n}$.  We also discuss a simple probabilistic primality
test\index{primality test!probabilistic} that relies on our ability to
compute $a^m\pmod{n}$ quickly.  All three of these algorithms are of
fundamental importance to the cryptography algorithms of
Chapter~\ref{ch:crypto}.


\subsection{How to Solve $ax\con 1\pmod{n}$}
Suppose $a, n\in\N$ with $\gcd(a,n)=1$.  Then
by Proposition~\ref{prop:unitsmodn}
the equation $ax\con 1\pmod{n}$ has a unique solution.
How can we find it?

\begin{proposition}[Extended Euclidean representation]
\label{prop:xgcd}\iprop{extended Euclidean}
Suppose $a,b\in\Z$ and let $g=\gcd(a,b)$. Then
there exists $x,y\in\Z$ such that 
$$
   ax + by = g.
$$
\end{proposition}
\begin{remark}
If $e=cg$ is a multiple of~$g$, then 
$cax + cby = cg = e,$ so $e = (cx)a+(cy)b$ can
also be written in terms of~$a$ and~$b$.
\end{remark}

\begin{proof}[Proof of Proposition~\ref{prop:xgcd}]
  Let $g=\gcd(a,b)$.  Then
  $\gcd(a/d,b/d)=1$, so by Proposition~\ref{prop:cancel2} the equation
\begin{equation}\label{eqn:xgcd}
\frac{a}{g}\cdot x\con 1\left({\rm mod} \hspace{1ex}\frac{b}{g}\right)
\end{equation}
has a solution $x\in\Z$.  Multiplying (\ref{eqn:xgcd}) through by~$g$ 
yields $ax \con g \pmod{b}$, so there exists~$y$ such that
  $b\cdot (-y) = ax-g$.   Then $ax+by = g$, as required.
\end{proof}

Given $a,b$ and $g=\gcd(a,b)$, our proof of
Proposition~\ref{prop:xgcd} gives a way to explicitly find $x,y$ such
that $ax+by=g$, assuming one knows an algorithm to solve linear
equations modulo~$n$. Since we do not know such an algorithm, we now
discuss a way to explicitly find~$x$ and~$y$.  This algorithm
will in fact enable us to solve linear equations modulo $n$---to solve
$ax\con 1\pmod{n}$ when $\gcd(a,n)=1$, use the algorithm below to
find~$x$ and~$y$ such that $ax+ny = 1$.  Then $ax\con 1\pmod{n}.$

Suppose $a=5$ and $b=7$.  The steps of Algorithm~\ref{alg:gcd} to
compute $\gcd(5,7)$ are, as follows.  Here we underlying, because it
clarifies the subsequent back substitution we will use to find~$x$
and~$y$.
\begin{align*}
 \ul{7}&=1\cdot \ul{5} + \underline{2} & \text{so } \ul{2} &= \ul{7} - \ul{5}\hfill\\
 \ul{5}&=2\cdot \ul{2} + \ul{1}    & \text{so }     \ul{1}&= \ul{5} - 2\cdot \ul{2} = \ul{5} - 2(\ul{7}-\ul{5}) = 3\cdot\ul{5}-2\cdot\ul{7}\hfill
\end{align*}
On the right, we have back-substituted in order to write each partial
remainder as a linear combination of~$a$ and~$b$.  In the last step,
we obtain $\gcd(a,b)$ as a linear combination of~$a$ and~$b$, as
desired.

That example was not too complicated, so we try another one.
Let $a=130$ and $b=61$.  We have
\begin{align*}
\ul{130} &= 2\cdot \ul{61} + \ul{8} &  \ul{8} &= \ul{130}-2\cdot\ul{61}\\
 \ul{61} &= 7\cdot \ul{8} + \ul{5}   & \ul{5} &= -7\cdot\ul{130}+15\cdot\ul{61}\\
  \ul{8} &= 1\cdot \ul{5} + \ul{3}    & \ul{3} &= 8\cdot\ul{130}-17\cdot\ul{61}\\
  \ul{5} &= 1\cdot \ul{3} + \ul{2}    & \ul{2} &=-15\cdot\ul{130}+32\cdot\ul{61}\\
  \ul{3} &= 1\cdot \ul{2} + \ul{1}&  \ul{1} &= 23\cdot\ul{130}-49\cdot\ul{61}
\end{align*}
Thus $x=23$ and $y=-49$ is a solution to $130 x + 61 y = 1$.

\begin{algorithm}{Extended Euclidean Algorithm}\label{alg:xgcd}
\index{extended Euclidean algorithm}
Suppose $a$ and $b$ are integers and let $g=\gcd(a,b)$.
This algorithm finds~$d$, $x$ and $y$ such that $ax+by = g$.
We describe only the steps when $a>b\geq 0$, since one
can easily reduce to this case.
\begin{steps}
\item{} [Initialize] Set $x\assign 1$, $y\assign 0$, $r \assign 0$, $s \assign 1$.
\item{} [Finished?] \label{alg:xgcd_2} If $b=0$, set $g\assign a$ and terminate.
\item{} [Quotient and Remainder] 
Use Algorithm~\ref{alg:division} to write $a = qb + c$ with $0\leq c<b$.
\item{} [Shift]
Set $(a, b, r, s, x, y) \assign (b, c, x-qr, y-qs, r, s)$
and go to step~\ref{alg:xgcd_2}.
\end{steps}
\end{algorithm}
\begin{proof}
This algorithm is the same as Algorithm~\ref{alg:gcd}, except that we
keep track of extra variables $x,y,r,s$, so it terminates and when
it terminates $d=\gcd(a,b)$.
We omit the rest of the inductive proof that the algorithm
is correct, and instead refer the  reader to 
\cite[\S1.2.1]{knuth1} which contains a detailed proof
in the context of a discussion of how one
writes mathematical proofs.
\end{proof}

\begin{algorithm}{Inverse Modulo $n$}\label{alg:inversemod}
Suppose $a$ and $n$ are integers and $\gcd(a,n)=1$.
This algorithm finds an~$x$ such that $ax\con 1\pmod{n}$.
\begin{steps}
\item{} [Compute Extended GCD] Use Algorithm~\ref{alg:xgcd} to compute 
integers $x,y$ such that $ax+ny=\gcd(a,n)=1$.
\item{} [Finished] Output $x$.
\end{steps}
\end{algorithm}
\begin{proof}
Reduce $ax+ny=1$ modulo~$n$ to see that $x$
satisfies $ax\con 1\pmod{n}$.
\end{proof}
See Section~\ref{sec:comp_lin_eq} for implementations
of Algorithms~\ref{alg:xgcd} and \ref{alg:inversemod}.

\begin{example}
Solve $17x \con 1\pmod{61}$.
First, we use Algorithm~\ref{alg:xgcd} to find $x, y$ such that
$17x+61y=1$:
\begin{align*}
\ul{61}&=3\cdot\ul{17}+\ul{10} & \ul{10} &=\ul{61} - 3\cdot\ul{17}\\
\ul{17}&=1\cdot\ul{10}+\ul{7}  & \ul{7}  &=-\ul{61} + 4\cdot\ul{17}\\
\ul{10}&=1\cdot \ul{7}+\ul{3}  & \ul{3}  &=2\cdot\ul{61} - 7\cdot\ul{17}\\
\ul{3} &=2\cdot\ul{3} +\ul{1}  & \ul{1}  &=-5\cdot\ul{61}+18\cdot\ul{17}
\end{align*}
Thus $17\cdot 18 + 61\cdot (-5) = 1$ so $x=18$ 
is a solution to $17x \con 1\pmod{61}$.
\end{example}



\subsection{How to Compute $a^m\pmod{n}$}\index{compute!powers modulo $n$|nn}
\label{sec:compute_powers}\index{powering algorithm|nn}
Let~$a$ and~$n$ be integers, and~$m$ a nonnegative integer.
In this section we describe an efficient algorithm to compute
$a^m\pmod{n}$.  For the cryptography 
applications in Chapter~\ref{ch:crypto},~$m$ will have 
hundreds of digits.

The naive approach to computing $a^m\pmod{n}$ is to simply compute
$a^m = a\cdot a \cdots a\pmod{n}$ by repeatedly multiplying by~$a$ and
reducing modulo~$m$. Note that after each arithmetic operation is
completed, we reduce the result modulo~$n$ so that the sizes of the
numbers involved do not get too large.  Nonetheless, this algorithm is
horribly inefficient because it takes $m-1$ multiplications, which 
is huge if~$m$ has hundreds of digits.

A much more efficient algorithm for computing $a^m\pmod{n}$ involves
writing~$m$ in binary, then expressing $a^m$ as a product of
expressions $a^{2^i}$, for various~$i$.  These latter expressions can
be computed by repeatedly squaring $a^{2^i}$.  This more clever algorithm
is not ``simpler'', but it is vastly more efficient since the number
of operations needed grows with the number of binary digits of~$m$, whereas
with the naive algorithm above the number of operations is $m-1$.

\begin{algorithm}{Write a number in binary}\label{alg:binary}%
\index{binary, writing number in}
Let $m$ be a nonnegative integer.  This algorithm writes~$m$ in
binary, so it finds $\eps_i\in\{0,1\}$ such that
$m=\sum_{i=0}^r \eps_i 2^i$ with each $\eps_i\in\{0,1\}$.
\begin{steps}
\item{}[Initialize] Set $i\assign 0$.
\item{}[Finished?]\label{alg:binary_2} If $m=0$, terminate.
\item{}[Digit]
If~$m$ is odd, set $\eps_i\assign 1$, otherwise $\eps_i\assign 0$.
Increment~$i$.
\item{}[Divide by $2$]  
Set~$m \assign \left\lfloor\frac{m}{2}\right\rfloor$, the
greatest integer $\leq m/2$.  Goto step \ref{alg:binary_2}.
\end{steps}
\end{algorithm}

\begin{algorithm}{Compute Power}\label{alg:power}
Let~$a$ and~$n$ be integers and~$m$ a nonnegative integer.
This algorithm computes $a^m$ modulo~$n$.
\begin{steps}
\item{}[Write in Binary] Write~$m$ in binary using Algorithm~\ref{alg:binary}, so
$
   a^m  = \prod_{\eps_i = 1} a^{2^i}\pmod{n}.
$
\item{}[Compute Powers] Compute~$a$,  $a^2$, $a^{2^2} = (a^2)^2$, 
$a^{2^3} = (a^{2^2})^2$, etc., up
to $a^{2^r}$, where $r+1$ is the number of binary
digits of~$m$. 
\item{}[Multiply Powers] Multiply together the
$a^{2^i}$ such that $\eps_i=1$, 
always working modulo~$n$.
\end{steps}
\end{algorithm}
See Section~\ref{sec:comp_powermod} for 
an implementation of Algorithms~\ref{alg:binary} and \ref{alg:power}.



We can compute the last~$2$ digits of $6^{91}$, by
finding $6^{91}\pmod{100}$. Make a table whose first column, labeled~$i$,
contains~$0$,~$1$,~$2$, etc.  The second column, labeled~$m$, is got
by dividing the entry above it by~$2$ and taking the integer part of
the result.  The third column, labeled $\eps_i$, records whether or
not the second column is odd.  The fourth column is computed by
squaring, modulo $n=100$, the entry above it.

\begin{center}
\begin{tabular}{|c|c|c|c|}\hline
\quad$i$\quad\quad  & \quad $m$\quad\quad  
     & \quad $\eps_i$\quad \quad  & \quad $6^{2^i}$ \text{mod} 100\\\hline\hline
0   & 91 & 1 &  6 \\\hline
1   & 45 & 1  & 36\\\hline
2   & 22 & 0 &  96\\\hline
3   & 11 & 1 &  16\\\hline
4   & 5 & 1 &   56\\\hline
5   & 2 & 0 &   36\\\hline
6   & 1 & 1 &   96\\\hline
\end{tabular}
\end{center}
We have
$$
  6^{91} \con 6^{2^6}\cdot 6^{2^4} \cdot 6^{2^3}\cdot 6^2 \cdot 6
         \con 96 \cdot 56 \cdot 16 \cdot 36 \cdot 6
         \con 56\pmod{100}.
$$
That is easier than multiplying~$6$ by itself $91$ times.

\begin{remark}
Alternatively, we could simplify the computation using
Theorem~\ref{thm:fermatlittle}.  By that theorem, 
$6^{\vphi(100)} \con 1\pmod{100}$, so since
$\vphi(100) = \vphi(2^2\cdot 5^2) = (2^2-2)\cdot(5^2-5)=40$,
we have $6^{91} \con 6^{11} \pmod{100}$.  
\end{remark}

\section{Finding Primes}
\label{sec:prob_prime_test}\index{primes!testing for}

\begin{theorem}[Pseudoprimality]\index{primality test!pseudoprime}
\ithm{Pseudoprimality}
An integer~$p>1$ is prime if and only if
for {\em every} $a\not\con 0\pmod{p}$,
$$
      a^{p-1}\con 1\pmod{p}.
$$
\end{theorem}
\begin{proof}
If~$p$ is prime, then the statement follows from 
Proposition~\ref{prop:wilson}.  If~$p$ is composite,
then there is a divisor~$a$ of~$p$ with $a\neq 1,p$.
If $a^{p-1}\con 1\pmod{p}$, then $p\mid a^{p-1} -1$.
Since $a\mid p$,  we have $a \mid a^{p-1} -1$ hence 
$a\mid 1$, a contradiction.
\end{proof}
Suppose $n\in\N$.  Using this theorem and Algorithm~\ref{alg:power}, we
can either quickly prove that~$n$ is not prime, or convince ourselves
that~$n$ is likely prime (but not quickly prove that~$n$ is prime).
For example, if $2^{n-1}\not\con 1\pmod{n}$, then we have proved
that~$n$ is not prime.  On the other hand, if $a^{n-1}\con 1\pmod{n}$
for a few~$a$, it ``seems likely'' that~$n$ is prime, and we loosely
refer to such a number that seems prime for several bases as a
\defn{pseudoprime}.  

There are composite numbers~$n$ (called \defn{Carmichael numbers}) 
with the amazing property that
$a^{n-1}\con 1\pmod{n}$ for {\em all} $a$ with $\gcd(a,n)=1$.  The
first Carmichael number is $561$, and it is a theorem that there
are infinitely many such numbers (\cite{carmichael}).

\begin{example}
Is~$p=323$ prime?
We compute $2^{322}\pmod{323}$.  
Making a table as above, we have
\begin{center}
\begin{tabular}{|cccc|}\hline
\quad$i$\quad\quad  & \quad $m$\quad\quad  
     & \quad $\eps_i$\quad \quad  & \quad $2^{2^i}$ \text{mod} 323\\\hline
0   & 322 & 0 &  2 \\\hline
1   & 161 & 1 &  4 \\\hline
2   & 80  & 0 & 16 \\\hline
3   & 40  & 0 & 256 \\\hline
4   & 20  & 0 & 290 \\\hline
5   & 10  & 0 & 120 \\\hline
6   & 5   & 1 & 188 \\\hline
7   & 2   & 0 & 137 \\\hline
8   & 1   & 1 & 35  \\\hline
\end{tabular}
\end{center}
Thus 
  $$2^{322} \con 4\cdot 188\cdot 35 \con 157\pmod{323},$$
so $323$ is not prime, though this computation gives no information
about $323$ factors as a product of primes. 
In fact, one finds that $323 = 17\cdot 19$.
\end{example}

It's possible to easily prove that a large number is composite, but the
proof does not easily yield a factorization.  For example if
$$
  n = 95468093486093450983409583409850934850938459083,
$$
then $2^{n-1}\not\con 1\pmod{n}$, so~$n$ is composite.

Another practical primality test is the Miller-Rabin test,\index{primality test!Miller-Rabin} which has
the property that each time it is run on a number~$n$ it either
correctly asserts that the number is definitely not prime, or that it is
probably prime, and the probability of correctness goes up with each
successive call.  For a precise statement and implementation 
of Miller-Rabin, along with proof of correctness, see
Section~\ref{sec:comp_primality}. 
If Miller-Rabin is called~$m$ times on~$n$ and in
each case claims that~$n$ is probably prime, then 
one can in a precise sense bound the probability 
that~$n$ is composite in terms of~$m$.
For an implementation of Miller-Rabin, see Listing~\ref{listing:Miller-Rabin
  Primality Test} in Chapter~\ref{ch:computing}.   

%\subsection{A Polynomial Time Deterministic Primality Test}
\index{primality test!deterministic} \index{deterministic primality
  test} 
%Though the practical methods for deciding primality with high
%probability discussed above is efficient in practice, 
Until recently it was an open problem to give an algorithm (with proof) 
that decides whether or not any integer is prime in time bounded by a
polynomial in the number of digits of the integer.  Agrawal, Kayal,
and Saxena recently found the first polynomial-time primality test
(see \cite{agrawal:primes}).  We will not discuss their algorithm
further, because for our applications to cryptography Miller-Rabin
or pseudoprimality tests will be sufficient.


\section{The Structure of $(\zmod{p})^*$}   
\label{sec:primitive}
This section is about the structure of the group $(\zmod{p})^*$ of
units modulo a prime number~$p$.\index{units!of $\zmod{p}$ are cyclic|nn}
The main result is that this group is always cyclic.  
We will use this result later in Chapter~\ref{ch:reciprocity} 
in our proof of quadratic reciprocity.

\begin{definition}[Primitive root]\label{defn:primroot}
A \defn{primitive root} modulo an integer~$n$ is an element of 
$(\zmod{n})^*$ of order $\vphi(n)$.
\end{definition}
We will prove that there is a primitive root modulo every
prime~$p$.  Since the unit group 
$(\zmod{p})^*$ has order $p-1$, this implies that
$(\zmod{p})^*$ is a cyclic group, a fact this will be extremely useful,
since it completely determines the structure of $(\zmod{p})^*$ as an
abelian group. 

If~$n$ is an odd prime power, then there is a primitive root
modulo~$n$ (see \exref{ch:cong}{ex:prim2}), but there is no primitive root
modulo the prime power~$2^3$, and hence none mod $2^n$ for
$n\geq 3$ (see \exref{ch:cong}{ex:prim1}).
\index{primitive root!mod power of two}

Section~\ref{sec:polys_zp} is the key input to our proof that
$(\zmod{p})^*$ is cyclic; here we show that for every divisor~$d$ of $p-1$
there are exactly~$d$ elements of $(\zmod{p})^*$ whose order divides~$d$.
We then use this result in Section~\ref{sec:struc_zp} to produce an
element of $(\zmod{p})^*$ of order~$q^r$ when~$q^r$ is a prime power that
exactly divides $p-1$ (i.e., $q^r$ divides $p-1$, but $q^{r+1}$ does not
divide $p-1$), and multiply together these elements to obtain an element
of $(\zmod{p})^*$ of order $p-1$.

\subsection{Polynomials over $\zmod{p}$}\label{sec:polys_zp}
\index{polynomials!over $\zmod{p}$}

The polynomials $x^2-1$ has four roots in $\zmod{8}$, namely
$1$, $3$, $5$, and $7$.   In contrast, the following proposition
shows that a polynomial of degree~$d$ over a field,
such as $\zmod{p}$, can have at most $d$ roots.
\begin{proposition}[Root Bound]\label{prop:atmost}
\iprop{root bound}
Let $f\in k[x]$ be a nonzero polynomial
over a field $k$.  Then there are at most
$\deg(f)$ elements $\alpha\in k$ such that $f(\alpha)=0$.
\end{proposition}
\begin{proof}
We prove the proposition by induction on $\deg(f)$.  The cases in
which
$\deg(f)\leq 1$ are clear.  Write
$f = a_n x^n + \cdots a_1 x + a_0$.  If
$f(\alpha)=0$ then 
\begin{align*}
 f(x) &= f(x) - f(\alpha)\\
      &= a_n(x^n-\alpha^n) + \cdots a_1(x-\alpha) + a_0(1-1)\\
      &= (x-\alpha)(a_n(x^{n-1}+\cdots + \alpha^{n-1}) + \cdots + a_2(x+\alpha) + a_1)\\
      &= (x-\alpha)g(x),
\end{align*}
for some polynomial $g(x)\in k[x]$.
Next suppose that $f(\beta)=0$ with $\beta\neq \alpha$.  Then
$(\beta-\alpha) g(\beta) = 0$, so, since $\beta-\alpha\neq 0$, 
we have $g(\beta)=0$.
By our inductive hypothesis,~$g$ has at most $n-1$ roots, so
there are at most $n-1$ possibilities for~$\beta$.
It follows that~$f$ has at most~$n$ roots.
\end{proof}

\begin{proposition}\label{prop:dsols}
Let~$p$ be a prime number and let~$d$ be a divisor
of $p-1$.  Then $f = x^d-1\in(\zmod{p})[x]$ has
exactly~$d$ roots in $\zmod{p}$.
\end{proposition}
\begin{proof}
Let $e=(p-1)/d$. We have
\begin{align*}
x^{p-1} - 1 &= (x^d)^e - 1\\
   &= (x^d - 1)((x^d)^{e-1} + (x^d)^{e-2} + \cdots + 1)\\
   &= (x^d - 1)g(x),
\end{align*}
where $g\in (\zmod{p})[x]$ and 
$\deg(g) = de-d = p-1-d$.
Theorem~\ref{thm:fermatlittle}
implies that $x^{p-1}-1$ has 
exactly $p-1$ roots in $\zmod{p}$, since every nonzero element of
$\zmod{p}$ is a root!  By Proposition~\ref{prop:atmost},~$g$ 
has {\em at most} $p-1-d$ roots and $x^d-1$ has at most~$d$ roots.
Since a root of $(x^d-1)g(x)$ is a root of either $x^d-1$ or $g(x)$
and $x^{p-1}-1$ has $p-1$ roots,~$g$ must have exactly $p-1-d$ roots
and $x^d-1$ must have exactly~$d$ roots, as claimed.
\end{proof}

We pause to reemphasize that the analogue of
Proposition~\ref{prop:dsols} is false when~$p$ is replaced by a
composite integer~$n$, since a root mod~$n$ of a product of two
polynomials need not be a root of either factor.  
For example, $f = x^2-1\in \zmod{15}[x]$ has
the four roots $1$, $4$, $11$, and $14$.


\subsection{Existence of Primitive Roots}\label{sec:struc_zp}%
\index{primitive root!existence} 
Recall from Section~\ref{sec:flittle} that the \defn{order} of an
element $x$ in a finite group is the smallest~$m\geq 1$ such that
$x^m=1$.  In this section, we prove that $(\zmod{p})^*$ is cyclic by
using the results of Section~\ref{sec:polys_zp} to produce an element
of $(\zmod{p})^*$ of order~$d$ for each prime power divisor~$d$ of
$p-1$, and then we multiply these together to obtain an element of
order $p-1$.

We will use the following lemma to assemble elements of
each order dividing $p-1$ to produce an
element of order $p-1$.
\begin{lemma}\label{lem:ordmult}
  Suppose $a,b\in(\zmod{n})^*$ have orders~$r$ and~$s$, respectively,
  and that $\gcd(r,s)=1$.  Then $ab$ has order $rs$.
\end{lemma}
\begin{proof}
This is a general fact about commuting elements of any group; our proof
only uses that $ab=ba$ and nothing special about $(\zmod{n})^*$.  Since
$$
  (ab)^{rs} = a^{rs}b^{rs}=1,
$$
the order of $ab$ is a divisor of $rs$.
Write this divisor as $r_1 s_1$ where $r_1\mid r$ 
and $s_1\mid s$.
Raise both sides of the equation
$$
  a^{r_1 s_1}b^{r_1 s_1} = (ab)^{r_1 s_1} = 1.
$$
to the power $r_2 = r/r_1$ to obtain
$$
   a^{r_1 r_2 s_1} b^{r_1 r_2 s_1} = 1.
$$
Since $a^{r_1 r_2 s_1} = (a^{r_1 r_2})^{s_1} = 1$,  we have
$$
  b^{r_1 r_2 s_1} = 1,
$$
so $s\mid r_1 r_2 s_1$.
Since $\gcd(s,r_1 r_2)=\gcd(s,r) = 1$, it follows that $s=s_1$.
Similarly $r=r_1$, so the order of $ab$ is $rs$.
\end{proof}


\begin{theorem}[Primitive Roots]\label{thm:primroot}\ithm{primitive root}
There is a primitive root modulo any prime~$p$.  In particular,
the group $(\zmod{p})^*$ is cyclic.
\end{theorem}
\begin{proof}
The theorem is true if $p=2$, since $1$ is a primitive root, so  we may assume
$p>2$.
Write $p-1$ as a product of distinct prime powers $q_i^{n_i}$:
$$
  p-1 = q_1^{n_1}q_2^{n_2}\cdots q_r^{n_r}.
$$
By Proposition~\ref{prop:dsols},
the polynomial $x^{q_i^{n_i}}-1$ has exactly
$q_i^{n_i}$ roots, and the polynomial 
$x^{q_i^{n_i-1}}-1$ has exactly 
$q_i^{n_i-1}$ roots.  
There are $q_i^{n_i} - q_i^{n_i-1}=q_i^{n_i-1}(q_i-1)$ elements
$a\in\zmod{p}$ such
that $a^{q_i^{n_i}}=1$ but $a^{q_i^{n_i-1}}\neq 1$;
each of these elements has order $q_i^{n_i}$.
Thus for each $i=1,\ldots, r$, we can choose an $a_i$ of order $q_i^{n_i}$.
Then, using Lemma~\ref{lem:ordmult} repeatedly, we see that
$$
   a = a_1 a_2 \cdots a_r
$$
has order 
   $q_1^{n_1}\cdots q_r^{n_r} = p-1$,
so~$a$ is a primitive root modulo~$p$.
\end{proof}


\begin{example}
We illustrate the proof of Theorem~\ref{thm:primroot} when $p=13$.   We have
$$  
  p-1 = 12 = 2^2\cdot 3.
$$
The polynomial $x^4 - 1$ has roots $\{1,5,8,12\}$ and 
$x^2-1$ has roots $\{1,12\}$, so we may take $a_1=5$.
The polynomial $x^3-1$ has roots $\{1,3,9\}$, and we set $a_2=3$.  
Then $a=5\cdot 3=15\con 2$ is a primitive root.  
To verify this, note that
the successive powers of~$2\pmod{13}$ are
$$
  2,\, 4,\, 8,\,  3,\,  6,\,  12,\,  11,\,  9,\,  5,\,  10,\,  7,\,  1.
$$
\end{example}

\begin{example}
Theorem~\ref{thm:primroot} is false if, e.g.,~$p$ is replaced by a
power of~$2$ bigger than~$4$.  For example, the four elements of
$(\zmod{8})^*$ each have order dividing~$2$, but $\vphi(8)=4$.
\end{example}

\begin{theorem}[Primitive Roots mod $p^n$]\label{theorem:cyclic}
\ithm{primitive root mod prime powers}
Let~$p^n$ be a power of an odd prime.  Then there
is a primitive root modulo~$p^n$. 
\end{theorem}
The proof is left as \exref{ch:cong}{ex:prim2}.

\begin{proposition}[Number of primitive roots]\iprop{number of primitive roots}
If there is a primitive root modulo~$n$,
then there are exactly $\vphi(\vphi(n))$ primitive roots modulo~$n$.
\end{proposition}
\begin{proof}
The primitive roots modulo~$n$ are the generators of 
$(\zmod{n})^*$, which by assumption is cyclic of order~$\vphi(n)$.  
Thus they are in bijection with the generators of any cyclic group 
of order $\vphi(n)$.  In particular, the number of primitive roots 
modulo~$n$ is the same as the number of elements of $\zmod{\vphi(n)}$ 
with additive order $\vphi(n)$.  An element of $\zmod{\vphi(n)}$ has additive 
order $\vphi(n)$ if and only if it is coprime to $\vphi(n)$.  There 
are $\vphi(\vphi(n))$ such elements, as claimed.
\end{proof}

\begin{example}\label{example:primitive}
For example, there are $\vphi(\vphi(17)) = \vphi(16)=2^4-2^3=8$
primitive roots mod $17$, namely $3, 5, 6, 7, 10, 11, 12, 14$.  The
$\vphi(\vphi(9)) = \vphi(6) = 2$ primitive roots modulo~$9$ are $2$
and $5$.  There are no primitive roots modulo~$8$, even though
$\vphi(\vphi(8)) = \vphi(4) = 2>0$.
\end{example}


\subsection{Artin's Conjecture}\index{conjecture!Artin|nn}\index{Artin}%
\index{Artin's conjecture|nn}
\begin{conjecture}[Emil Artin]\label{conj:artin}
Suppose $a\in\Z$ is not $-1$ or a perfect square.  Then there are
infinitely many primes~$p$ such that~$a$ is a primitive root
modulo~$p$.
\end{conjecture}
There is no single integer~$a$ such that Artin's conjecture is known
to be true.  For any given~$a$, Pieter
\cite{pieter:artin}\index{Pieter} proved that there are infinitely
many~$p$ such that the order of~$a$ is divisible by the largest prime
factor of $p-1$.  Hooley \cite{hooley:artin}\index{Hooley} proved that
something called the Generalized Riemann Hypothesis\index{Generalized Riemann
Hypothesis|nn} implies Conjecture~\ref{conj:artin}.  

\begin{remark}
Artin conjectured more precisely that if $N(x,a)$ is the number of
primes $p\leq x$ such that~$a$ is a primitive root modulo~$p$, then
$N(x,a)$ is asymptotic to $C(a)\pi(x)$, where $C(a)$ is a positive
constant that depends only on~$a$ and $\pi(x)$ is the number of primes
up to~$x$.
\end{remark}

\subsection{Computing Primitive Roots}
Theorem~\ref{thm:primroot} does not suggest an efficient algorithm
for finding primitive roots.  To actually find a primitive root mod~$p$
in practice, we try $a=2$, then $a=3$, etc., until we find an~$a$
that has order $p-1$.  Computing the order of an element of $(\zmod{p})^*$
requires factoring $p-1$, which we do not know how to do quickly in
general, so finding a primitive root modulo~$p$ for large~$p$ seems to 
be a difficult problem.

See Section~\ref{sec:algprim} for an implementation
of this algorithm for finding a primitive root.
\begin{algorithm}{Primitive Root}\label{alg:primitive_root}
Given a prime $p$ this algorithm computes the smallest positive
integer~$a$ that generates $(\zmod{p})^*$.
\begin{steps}
\item{}[$p=2$?] If $p=2$ output $1$ and terminate.  
Otherwise set $a\assign 2$.
\item{}[Prime Divisors] Compute the prime divisors $p_1, \ldots, p_r$ 
of $p-1$ (see Section~\ref{sec:alg_intfac}).
\item{}[Generator?] \label{alg:primroot_3}
If for every $p_i$, we have $a^{(p-1)/p_i} \not\con 1\pmod{p}$,
then $a$ is a generator of $(\zmod{p})^*$, so output $a$ and terminate.
\item{}[Try next] Set $a\assign a+1$ and go to step~\ref{alg:primroot_3}.
\end{steps}
\end{algorithm}
\begin{proof}
Let $a\in (\zmod{p})^*$.
The order of~$a$ is a divisor~$d$ of 
the order $p-1$ of the group $(\zmod{p})^*$.   
Write $d =(p-1)/n$, for some divisor $n$ of $p-1$.
If $a$ is not a generator of $(\zmod{p})^*$, then
since $n\mid (p-1)$,  there is a prime divisor 
$p_i$ of $p-1$ such that $p_i\mid n$.
Then $$a^{(p-1)/p_i} = (a^{(p-1)/n})^{n/p_i} \con 1\pmod{p}.$$
Conversely, if $a$ is a generator, then $a^{(p-1)/p_i}\not\con 1\pmod{p}$
for any $p_i$.  Thus the algorithm terminates with step~\ref{alg:primroot_3}
if and only if the $a$ under consideration is a primitive root.
By Theorem~\ref{thm:primroot} there is at least one primitive
root, so the algorithm terminates. 
\end{proof}
We implement Algorithm~\ref{alg:primitive_root} 
in Section~\ref{sec:algprim}.

\begin{exercises}
\item\label{ex:gcds} Compute the following gcd's using 
Algorithm~\ref{alg:gcd}:
$$
  \gcd(15,35),\quad
  \gcd(247,299),\quad
  \gcd(51,897), \quad 
  \gcd(136,304)
 $$


\item\label{ex:gcdrep} 
Use Algorithm~\ref{alg:xgcd} to find $x,\, y\in\Z$
such that $2261x + 1275y = 17$.

\item  \label{ex:binomdiv} 
Prove that if $a$ and $b$ are integers and $p$ is a prime,
then $(a+b)^p \con a^p + b^p\pmod{p}$.  You may assume
that the binomial coefficient
$$
   \frac{p!}{r!(p-r)!}
$$
is an integer.


\item\label{ex:allsoln} 
\begin{enumerate}
\item Prove that if $x, y$ is a solution to 
$ax + by = d$,
then for all $c\in\Z$, 
\begin{equation}\label{eqn:allsoln}
   x' = x+ c\cdot\frac{b}{d}, \qquad
   y' = y - c\cdot\frac{a}{d}
\end{equation}
is also a solution to $ax+by=d$.
\item Find two distinct solutions to $2261x + 1275y = 17$.
\item Prove that all solutions are of the form (\ref{eqn:allsoln}) 
for some~$c$.
\end{enumerate}

\item\label{ex:polrepconj}
 Let $f(x)=x^2+ax+b \in\Z[x]$ be a quadratic 
polynomial with integer coefficients
and positive leading coefficients, e.g., $f(x)=x^2+x+6$.
Formulate a conjecture about when the set
$\{ f(n) : n\in \Z \text{ and $f(n)$ is prime}\}$
is infinite.  Give numerical evidence 
that supports your conjecture.

\item\label{ex:residues} 
Find four complete sets of residues modulo~$7$, where the
$i$th set satisfies the $i$th condition:
 (1) nonnegative, (2) odd, (3) even, (4) prime.
 
\item\label{ex:divrules} 
  Find rules in the spirit of
  Proposition~\ref{prop:div3} for divisibility of an integer
  by~$5$,~$9$, and~$11$, and prove each of these rules using
  arithmetic modulo a suitable~$n$.

% BAER
\item (*)\label{ex:putnam98}
The following problem is from the 1998 Putnam Competition.  Define a
sequence of decimal integers $a_n$ as follows: $a_1 = 0$, $a_2 = 1$, and
$a_{n+2}$ is obtained by writing the digits of $a_{n+1}$ immediately
followed by those of $a_n$.  For example, $a_3 = 10$, $a_4 = 101$,
and $a_5 = 10110$.
Determine the~$n$ such that $a_n$ a multiple of $11$, as follows:
\begin{enumerate}
\item Find the smallest integer $n>1$ such that $a_n$ is divisible by
$11$. 
\item Prove that $a_n$ is divisible by $11$ if and only if
$n\con 1\pmod{6}$.
\end{enumerate}

\item\label{ex:invmod} Find an integer~$x$ such that $37x \con 1\pmod{101}$.

\item\label{ex:ordmod} What is the order of~$2$ modulo $17$?

% \item\label{ex:facphi} 
% Let $n=\vphi(20!)=416084687585280000$.  
% Compute the prime factorization of~$n$ using the multiplicative
% property of~$\vphi$.

\item\label{ex:zpfield}\index{field!of integers modulo $p$}
Let~$p$ be a prime.  Prove that $\zmod{p}$ is a field.

\item\label{ex:crt} Find an $x\in\Z$ such that
$x \con -4 \pmod{17}$ and $x\con 3\pmod{23}$.



\item\label{ex:wilson2} Prove that if $n>4$ is composite then 
$$
   (n-1)! \con 0 \pmod{n}.
$$

\item\label{ex:phiodd} For what values of~$n$ is $\vphi(n)$ odd?

\item\label{ex:multproof2}
\begin{enumerate}
\item Prove that $\vphi$ is multiplicative as follows.  Suppose $m,n$ are
positive integers and $\gcd(m,n)=1$.  Show that 
the natural map $\psi:\zmod{mn} \ra \zmod{m} \cross \zmod{n}$ is
an injective homomorphism of rings, hence bijective by counting, then
look at unit groups.
\item Prove conversely that if $\gcd(m,n)>1$ then
the natural map $\psi:\zmod{mn} \ra \zmod{m} \cross \zmod{n}$ 
is not an isomorphism.
\end{enumerate}



\item\label{ex:thieves} Seven competitive math students try to
  share a huge hoard of stolen math books equally between themselves.
  Unfortunately, six books are left over, and in the fight over them,
  one math student is expelled.  The remaining six math students,
  still unable to share the math books equally since two are left
  over, again fight, and another is expelled.  When the remaining five
  share the books, one book is left over, and it is only after yet
  another math student is expelled that an equal sharing is possible.
  What is the minimum number of books which allow this to happen?



% Baer
\item\label{ex:pcube} Show that if $p$ is a positive integer such that both~$p$ 
and $p^2+2$ are prime, then $p=3$.
% \begin{enumerate}
% \item Prove that there are only finitely many such $p$.
% \item Show that $p^3 + 2$ must also be prime.
% \end{enumerate}


\item\label{ex:phimult} Let $\vphi:\N\ra\N$ be the 
Euler~$\vphi$ function.  
\begin{enumerate}
   \item Find all natural numbers~$n$ such that $\vphi(n)=1$.
   \item Do there exist natural numbers~$m$ and~$n$ such that
     $\vphi(mn)\neq \vphi(m)\cdot \vphi(n)$?
      \end{enumerate}

%Baer
\item\label{ex:phiformula} Find a formula for $\vphi(n)$ directly in terms
of the prime factorization of~$n$.

\item\label{ex:solnsqrtmod35} Find all {\em four} solutions to the equation
$$
  x^2 - 1\con 0 \pmod{35}.
$$

\item\label{ex:reducedfraction} 
Prove that for any positive integer~$n$ the fraction
  $(12n+1)/(30n+2)$ is in reduced form.

% \item For any positive integer~$n$, prove that 
%       one of $n^2\pm 1$ is divisible by $17$.

\item\label{ex:gcd2} Suppose $a$ and $b$ are positive integers.  
\begin{enumerate}
\item Prove that
$\gcd(2^a-1,\,\, 2^b-1) = 2^{\gcd(a,b)}-1.$
\item Does it matter if $2$ is replaced by an arbitrary prime~$p$?
\item What if $2$ is replaced by an arbitrary positive integer $n$?
\end{enumerate}

\item
For every positive integer $b$, show that there exists a positive
integer $n$ such that the polynomial $x^2-1\in(\zmod{n})[x]$
has at least $b$ roots.

\item\label{ex:prim1}
\begin{enumerate}
\item Prove that there is no primitive root
modulo~$2^n$ for any $n\geq 3$.
%(Hint: Relate the statement for $n=3$ to the statement for $n>3$.)
\item (*) Prove that $(\zmod{2^n})^*$ is generated by $-1$ and $5$.
\end{enumerate}

\item\label{ex:prim2}
Let~$p$ be an odd prime.
\begin{enumerate}
\item (*) Prove that there is a primitive root modulo~$p^2$.
(Hint: Use that if $a, b$
      have orders $n, m$, with $\gcd(n,m)=1$, then $ab$ has order $nm$.)
\item Prove that for any~$n$, there is a primitive root modulo~$p^n$.
\item Explicitly find a primitive root modulo $125$.
\end{enumerate}

 \item \label{ex:prim_fac}(*)
 In terms of the prime factorization of~$n$, characterize the
 integers~$n$ such that there is a primitive root modulo~$n$.


\end{exercises}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%  
%% Chapter: Public-Key Cryptography
%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\chapter{Public-Key Cryptography}\label{ch:crypto}

\begin{tabular}{ll}
\includegraphics{graphics/nikita.eps}&
\begin{minipage}{0.63\textwidth}
\vspace{-12em}The author recently watched a TV show (not movie!) 
called La Femme Nikita about a woman
named Nikita who is forced to be an agent for a shady
anti-terrorist organization
called Section One.  Nikita has strong feelings for fellow agent
Michael, and she most trusts Walter, Section One's
ex-biker gadgets and explosives expert.  Often Nikita's worst enemies
are her superiors and coworkers at Section One.
\end{minipage}
\end{tabular}

\hspace{1em}
A synopsis for a season three episode is as follows:

\begin{quote}
PLAYING WITH FIRE

On a mission to secure detonation chips from a terrorist
organization's heavily armed base camp, Nikita is captured as a
hostage by the enemy.  Or so it is made to look.  Michael and Nikita
have actually created the scenario in order to secretly rendezvous
with each other. The ruse works, but when Birkoff [Section One's
master hacker] accidentally discovers encrypted messages between
Michael and Nikita sent with Walter's help, Birkoff is forced to tell
Madeline.  Suspecting that Michael and Nikita may be planning a coup
d'\'etat, Operations and Madeline use a second team of operatives to
track Michael and Nikita's next secret rendezvous... killing them if
necessary.
\end{quote}


What sort of encryption might Walter have helped them to use? I let my
imagination run free, and this is what I came up with.  After being
captured at the base camp, Nikita is given a phone by her captors, in
hopes that she'll use it and they'll be able to figure out what she is
really up to.  Everyone is eagerly listening in on her calls.

\begin{remark}
  In this book we will assume available a method for producing random
  integers.  Methods for generating random integers are involved and
  interesting, but we will not discuss them in this book.  For an in
  depth treatment of random numbers, see \cite[Ch.~3]{knuth2}.
\end{remark}

Nikita remembers a conversation with Walter about a public-key 
cryptosystem called the ``Diffie-Hellman key exchange''.  She
remembers that it allows two people to agree on a secret key in the
presence of eavesdroppers.  Moreover, Walter mentioned that though
Diffie-Hellman\index{Diffie-Hellman cryptosystem}\index{cryptosystem!Diffie-Hellman}
was the first ever public-key exchange system, it is still in
common use today (e.g., in OpenSSH protocol version 2, 
see \url{http://www.openssh.com/}).

\begin{figure}
\begin{center}
\includegraphics[width=10em]{graphics/diffie.eps}
$\qquad$
\includegraphics[width=10em]{graphics/hellman.eps}
\end{center}
\caption{Diffie and Hellman (photos from
\cite{singh:crypto})} 
\end{figure}



Nikita pulls out her handheld computer and phone, 
calls up Michael, and they do the following, which
is {\em wrong} (try to figure out what is wrong as
you read it).
\begin{enumerate}
\item Together they choose a big prime number~$p$ and a number~$g$ with 
$1<g<p$.
\item Nikita {\em secretly} chooses an integer~$n$.
\item Michael {\em secretly} chooses an integer~$m$.
\item Nikita tells Michael $ng \pmod{p}$.
\item Michael tells $mg\pmod{p}$ to Nikita.
\item The ``secret key'' is 
$s=nmg\pmod{p}$,
which both Nikita and Michael can easily compute.
\end{enumerate}

\begin{center}
\includegraphics[width=\textwidth]{graphics/nm_comm.eps}
\end{center}

Here's a very simple example with small numbers that illustrates what
Michael and Nikita do.  (They really used much larger numbers.)
\begin{center}
\shadowbox{
\begin{minipage}{.5\textwidth}
\begin{enumerate}
\item $p=97$, $g=5$
\item $n=31$
\item $m=95$
\item $ng\con 58\pmod{97}$
\item $mg \con 87\pmod{97}$
\item $s = nmg = 78\pmod{97}$
\end{enumerate}
\end{minipage}}
\end{center}

Nikita and Michael are foiled because everyone easily figures
out~$s$:
\begin{enumerate}
\item Everyone knows $p$, $g$, $ng\pmod{p}$, and $mg\pmod{p}$.
\item Using Algorithm~\ref{alg:xgcd}, anyone can
easily find $a,b\in\Z$
such that $ag + bp = 1$, which exist because 
$\gcd(g,p)=1$.
\item Then $ang \con n\pmod{p}$, so everyone knows Nikita's
secret key~$n$, and hence can easily compute the shared
secret~$s$.
\end{enumerate}

To taunt her, Nikita's captors give her a paragraph from a review of Diffie
and Hellman's 1976 paper ``New Directions in Cryptography'' \cite{dh76}:
\begin{quote}
``The authors discuss some recent results in communications theory
[...]  The first [method] has the feature that an unauthorized
`eavesdropper' will find it computationally infeasible to decipher
the message [...] They propose a couple of techniques for implementing
the system, but the reviewer was unconvinced.''
\end{quote}

\section{The Diffie-Hellman Key Exchange}\label{sec:diffie}
\index{Diffie-Hellman cryptosystem|nn}\index{cryptosystem!Diffie-Hellman|nn}
As night darkens Nikita's cell, she reflects on what has happened.
Upon realizing that she mis-remembered how the system works, she phones
Michael and they do the following:
\begin{enumerate}
\item Together Michael and Nikita choose a 200-digit integer~$p$ that
  is likely to be prime (see Section~\ref{sec:prob_prime_test}), and
  choose a number~$g$ with $1<g<p$.
\item Nikita {\em secretly} chooses an integer~$n$.
\item Michael {\em secretly} chooses an integer~$m$.
\item Nikita computes $g^n\pmod{p}$ on her handheld computer and tells
Michael the resulting number over the phone.  
\item Michael tells Nikita $g^m\pmod{p}$.
\item The shared secret key is then 
   $$
      s\con (g^n)^m \con (g^m)^n \con g^{nm}\pmod{p},
   $$
which both Nikita and Michael can compute.
\end{enumerate}

Here is a simplified example that illustrates what they did, that
involves only relatively simple arithmetic.
\begin{center}
\shadowbox{
\begin{minipage}{.5\textwidth}
\begin{enumerate}
\item $p = 97$, $g=5$
\item $n = 31$
\item $m = 95$
\item $g^n \con 7 \pmod{p}$
\item $g^m\con 39\pmod{p}$
\item $s \con (g^n)^m \con 14\pmod{p}$
\end{enumerate}
\end{minipage}}
\end{center}


\subsection{The Discrete Log Problem}\label{sec:dlog}
\index{discrete log problem}
Nikita communicates with Michael by encrypting everything using their
agreed upon secret key.  In order to understand
the conversation, the eavesdropper needs~$s$, but it takes a long time to
compute~$s$ given only~$p$,~$g$, $g^n$, and $g^m$.  One way would be to
compute~$n$ from knowledge of~$g$ and $g^n$; this is possible, but
appears to be ``computationally infeasible'', in the sense that it
would take too long to be practical.

Let~$a$,~$b$, and~$n$ be real numbers with
$a,b>0$ and $n\geq 0$.
Recall that the ``log to the base $b$'' function 
characterized by
$$
  \log_b(a) = n \text{ if and only if } a=b^n.
$$
We use the $\log_b$ function 
in algebra to solve
the following problem:
Given a base~$b$ and a power~$a$ of~$b$,
find an exponent~$n$ such that 
$$
   a = b^n.
$$
That is, given $a=b^n$ and~$b$, find~$n$.
\begin{example}
The number $a = 19683$ is the
$n$th power of $b=3$ for some~$n$. With a calculator we quickly find
that
$$
  n = \log_3(19683) = \log(19683) / \log(3) = 9.
$$

A calculator can quickly compute an approximation for $\log(x)$ by
computing a partial sum of an appropriate rapidly-converging infinite
series (at least for $x$ in a certain range).

\end{example}
The discrete log problem is the analogue of this problem but
in a finite group:
\begin{problem}[Discrete Log Problem]\label{prob:log}\index{discrete log problem}
Let~$G$ be a finite abelian group, e.g., $G=(\zmod{p})^*$.  Given $b\in G$ and
a power~$a$ of~$b$, find a positive integer~$n$ such that
$b^n=a$.  
\end{problem}

As far as we know, finding discrete logarithms when $p$ is large is
difficult in practice.  Over the years, many people have been very
motivated to try.  For example, if Nikita's captors could efficiently
solve Problem~\ref{prob:log}, then they could read the messages she
exchanges with Michael.  Unfortunately, we have no formal proof that
computing discrete logarithms on a classical computer is difficult.
\index{discrete log problem!difficulty of} Also, Peter Shor
\cite{shor}\index{Shor} showed that if one could build a sufficiently
complicated quantum computer,\index{quantum computer} it could solve
the discrete logarithm problem in time bounded by a polynomial
function of the number of digits of $\#G$.   

It is easy to give an inefficient algorithm that solves the discrete
log problem.  Simply try $b^1$, $b^2$, $b^3$, etc., until we find an
exponent~$n$ such that $b^n=a$.  For example, suppose $a = 18$, $b=5$,
and $p=23$.  Working modulo $23$ we have
$$b^1 = 5,\, b^2 = 2,\, b^3 = 10,\, \ldots,\, b^{12} = 18,$$
so $n=12$.
When~$p$ is large, computing the discrete log this way soon becomes
impractical, because increasing the number of digits of the modulus
makes the computation take vastly longer.


Perhaps part of the reason that computing discrete logarithms is
difficult, is that the logarithm in the real numbers is continuous,
but the (minimum) logarithm of a number mod $n$ bounces around at
random.  We illustrate this exotic behavior in Figure~\ref{fig:logs}.

\begin{figure}
\begin{center}
\input{graphics/log}
\vspace{5ex}

\input{graphics/dlog}
\vspace{1em}
\caption{Graphs of the continuous log and of the discrete log modulo $97$.\label{fig:logs}  Which looks easier to compute?}
\end{center}
\end{figure}


\subsection{Realistic Diffie-Hellman Example}
In this section we present an example that uses bigger numbers.   
 First we prove a proposition that we can use to
choose a prime~$p$ in such a way that it is easy to find a
$g\in(\zmod{p})^*$ with order $p-1$.  We have already seen
in Section~\ref{sec:primitive} that for every prime~$p$ there 
exists an element~$g$ of order $p-1$, and we gave
Algorithm~\ref{alg:primitive_root} for finding a primitive
root for any prime.  The significance of the proposition
below is that it suggests an algorithm for finding
a primitive root that is easier to use in practice when~$p$
is large, because it does not require factoring $p-1$.
Of course, one could also just use a random~$g$
for Diffie-Hellman; it is not essential that~$g$ 
generates $(\zmod{p})^*$.

\begin{proposition}
Suppose~$p$ is a prime such that $(p-1)/2$ is also prime.
Then the elements of $(\zmod{p})^*$ have order either~$1$,~$2$, 
$(p-1)/2$, or $p-1$.
\end{proposition}
\begin{proof}
Since~$p$ is prime, the group $(\zmod{p})^*$ has order
$p-1$.  By assumption, the prime
factorization of $p-1$ is $2\cdot ((p-1)/2)$.  Let $a \in
(\zmod{p})^*$.  Then by Theorem~\ref{thm:fermatlittle}, $a^{p-1}=1$,
so the order of~$a$ is a divisor of $p-1$, which proves the
proposition.
\end{proof}

Given a prime~$p$ with $(p-1)/2$ prime, find an element of
order $p-1$ as follows.  If $2$ has order $p-1$ we are done.
If not, $2$ has order $(p-1)/2$ since $2$ doesn't have order
either $1$ or $2$.  Then $-2$ has order $p-1$.

Let $p=93450983094850938450983409611$.  
Then~$p$ is prime,
but $(p-1)/2$ is not.  So we keep adding~$2$ to~$p$ and
testing pseudoprimality using Section~\ref{sec:prob_prime_test} 
until we find that the next pseudoprime after~$p$
is 
$$
q=93450983094850938450983409623.
$$
It turns out that~$q$ pseudoprime and $(q-1)/2$ is also pseudoprime.
We find that $2$ has order $(q-1)/2$, so $g=-2$ has
order $q-1$ and is hence a generator of $(\zmod{q})^*$,
at least assuming that~$q$ is really prime.  

The secret
random numbers generated by Nikita and Michael are
$$
  n = 18319922375531859171613379181
$$
and
$$
  m = 82335836243866695680141440300.
$$
Nikita sends 
$$
  g^n = 45416776270485369791375944998 \in (\zmod{p})^*
$$
to Michael, and Michael sends
$$
  g^m = 15048074151770884271824225393\in (\zmod{p})^*
$$
to Nikita. They agree on the secret key
$$
 g^{nm} = 85771409470770521212346739540\in (\zmod{p})^*.
$$

\begin{remark}
See
Section~\ref{sec:comp_DH} for a computer implementation of
the  Diffie-Hellman key exchange.
\end{remark}

\subsection{The Man in the Middle Attack}\index{man in the middle attack|nn}
\label{sec:man_in_middle}
After their first system was broken, instead of talking on the phone,
Michael and Nikita can now only communicate via text messages.  One of
her captors, The Man\index{The Man}, is watching each of the
transmissions; moreover, he can intercept messages and send false
messages.  When Nikita sends a message to Michael announcing
$g^n\pmod{p}$, The Man intercepts this message, and sends his own
number $g^t\pmod{p}$ to Michael.  Eventually, Michael and The Man
agree on the secret key $g^{tm}\pmod{p}$, and Nikita and The Man agree
on the key $g^{tn}\pmod{p}$.  When Nikita sends a message to Michael
she unwittingly uses the secret key $g^{tn}\pmod{p}$; The Man then
intercepts it, decrypts it, changes it, and re-encrypts it using the
key $g^{tm}\pmod{p}$, and sends it on to Michael\index{Michael|)}.
This is bad because now The Man can read every message sent between
Michael and Nikita, and moreover, he can change them in transmission
in subtle ways.
\begin{figure}
\begin{center}
\psfrag{1}{$g^{nt}\pmod{p}$}
\psfrag{2}{$g^{nt}\pmod{p}$}
\psfrag{3}{$g^{mt}\pmod{p}$}
\psfrag{4}{$g^{mt}\pmod{p}$}
\includegraphics[width=\textwidth]{graphics/man.eps}
\caption{The Man in the Middle Attack}
\end{center}
\end{figure}

One way to get around this attack is to use a digital signature scheme
based on the RSA cryptosystem.  We will not discuss digital signatures
further \index{digital signatures} in this book, but will discuss RSA in the
next section.


\section{The RSA Cryptosystem}\index{RSA cryptosystem|(}\index{cryptosystem!RSA|(}
\label{sec:RSA}\label{sec:rsa}

The Diffie-Hellman key exchange has drawbacks.  As discussed in
Section \ref{sec:man_in_middle}, it is susceptible to the man in the
middle attack. This section is about the RSA public-key cryptosystem of
Rivest, Shamir, and Adleman \cite{rsa:origin}, which is an alternative
to Diffie-Hellman that is more flexible in some ways.

We first describe the RSA cryptosystem, then discuss several ways to
attack it.  It is important to be aware of such weaknesses, in order
to avoid foolish mistakes when implementing RSA.  We barely scratched
the surface here of the many possible attacks on specific
implementations of RSA or other cryptosystems.

\subsection{How RSA works}
The fundamental idea behind RSA is to try to construct 
a trap-door or one-way function on a set~$X$, 
that is, an invertible function\index{one-way function|nn}
$$
     E : X \ra X
$$
such that it is easy for Nikita to compute $E^{-1}$, but extremely
difficult for anybody else to do so.



Here is how Nikita makes a one-way function~$E$
on the set of integers modulo~$n$.
\begin{enumerate}
\item Using a method hinted at in Section~\ref{sec:prob_prime_test}, 
Nikita picks two large primes~$p$ and~$q$, and lets $n=pq$.
\item It is then easy for Nikita to compute
$$
   \vphi(n) = \vphi(p)\cdot \vphi(q) = (p-1)\cdot (q-1).
$$
\item Nikita next chooses a random integer~$e$ with
 $$
 1<e<\vphi(n)\text{ and } \gcd(e,\vphi(n))=1.
 $$

\item Nikita uses the algorithm from Section~\ref{sec:compute_powers} 
to find a solution~$x=d$ to the equation 
$$
   ex \con 1\pmod{\vphi(n)}.
$$

\item Finally, Nikita defines a function $E:\zmod{n} \ra \zmod{n}$ by
$$
   E(x) = x^e \in \zmod{n}.
$$
Anybody can compute~$E$ fairly quickly using the repeated-squaring
algorithm from  Section~\ref{sec:compute_powers}.
\end{enumerate}

Nikita's \defn{public key} is the pair of integers $(n,e)$, which is
just enough information for people to easily compute~$E$. 
Nikita knows a number~$d$ such that $ed\con 1\pmod{\vphi(n)}$, 
so, as we will see, she can quickly compute $E^{-1}$.

To send Nikita a message, proceed as follows.
Encode your message, in some way, as a sequence 
of numbers modulo~$n$ (see Section~\ref{sec:encode})
$$
  m_1, \ldots, m_r \in \zmod{n},
$$
then send
$$
  E(m_1), \ldots, E(m_r)
$$
to Nikita.   (Recall that $E(m) = m^e$ for $m\in \zmod{n}$.)

When Nikita receives $E(m_i)$, she finds each~$m_i$ by
using that 
$
 E^{-1}(m) = m^d,
$ 
a fact that follows from the following proposition.   
\begin{proposition}[Decryption key]\iprop{decryption key}
Let~$n$ be an integer that is a product of distinct primes 
and let $d,e\in\N$ be such that $p-1\mid de-1$ for each prime $p\mid n$.  Then
$a^{de} \con a\pmod{n}$ for all $a\in\Z$.
\end{proposition}
\begin{proof}
Since $n\mid a^{de}-a$ if and only if $p\mid a^{de}-a$ for each prime
divisor~$p$ of~$n$, it suffices to prove that $a^{de}\con a\pmod{p}$ for
each prime divisor $p$ of~$n$.  If $\gcd(a,p)\neq 0$, then
$a\con 0\pmod{p}$, so $a^{de} \con a\pmod{p}$.  
If $\gcd(a,p)=1$, then Theorem~\ref{thm:fermatlittle} 
asserts that $a^{p-1}\con 1\pmod{p}$.  
Since $p-1\mid de-1$, we have $a^{de-1} \con 1\pmod{p}$
as well.  Multiplying both sides
by~$a$ shows that $a^{de}\con a\pmod{p}$.  
\end{proof}
Thus to decrypt $E(m_i)$ Nikita computes
$$
  E(m_i)^d = (m_i^{e})^{d}=m_i.
$$
For an implementation of RSA see Section~\ref{sec:comp_rsa}.

\subsection{Encoding a Phrase in a Number}\label{sec:encode}
In order to use the RSA cryptosystem to encrypt messages, it is
necessary to encode them as a sequence of numbers of size less than
$n=pq$.  We now describe a simple way to do this.  For an
implementation of a slightly more general encoding that includes
extra randomness so that plain text encodes differently each
time, see Section~\ref{sec:encode_strings}.

Suppose $s$ is a sequence of capital letters and spaces, and that~$s$
does not begin with a space.  We encode $s$ as a number in base~$27$
as follows: a single space corresponds to $0$, the letter $A$ to $1$,
$B$ to $2$, $\ldots$, $Z$ to $26$.  Thus ``RUN NIKITA'' is a number
written in base $27$:
\begin{align*}
\text{RUN NIKITA}\quad\leftrightarrow \quad&
   27^9\cdot 18
+   27^8\cdot 21
+   27^7\cdot 14
+   27^6\cdot 0
+   27^5\cdot 14\\
& +   27^4\cdot 9
+   27^3\cdot 11
+   27^2\cdot 9
+   27\cdot 20
+   1 \\
   &= 143338425831991 \text{ (in decimal)}.
\end{align*}
To recover the letters from the decimal number,
repeatedly divide by $27$ and
read off the letter corresponding to each remainder:
$$
\begin{array}{rcrcrr}
143338425831991 &=& 5308830586370\cdot 27 &+& 1 & \qquad\text{``A''}\\
5308830586370 &=& 196623355050\cdot 27 &+& 20 & \qquad\text{``T''}\\
196623355050 &=& 7282346483 \cdot 27 &+& 9 & \quad\text{``I''}\\
7282346483 &=& 269716536 \cdot 27 &+& 11 & \quad\text{``K''}\\
269716536 &=& 9989501 \cdot 27 &+& 9 & \quad\text{``I''}\\
9989501 &=& 369981 \cdot 27 &+& 14 & \quad\text{``N''}\\
369981 &=& 13703 \cdot 27 &+& 0 & \quad\text{`` ''}\\
13703 &=& 507 \cdot 27 &+& 14 & \quad\text{``N''}\\
507 &=& 18 \cdot 27 &+& 21 & \quad\text{``U''}\\
18 &=& 0 \cdot 27 &+& 18 & \quad\text{``R''}
\end{array}
$$

If $27^k\leq n$, then any sequence of~$k$ letters can be encoded as above
using a positive integer $\leq n$.  Thus if we use can encrypt integers
of size at most~$n$, then we must break our message up into blocks
of size at most~$\log_{27}(n)$.

\subsection{Examples}
So the arithmetic is easy to follow, we use small primes~$p$
and~$q$ and encrypt the single letter ``X'' using the RSA cryptosystem.

\begin{enumerate}
\item Choose $p$ and $q$: Let $p=17$, $q=19$, so $n=pq = 323$.
\item Compute $\vphi(n)$:
\begin{align*}
\vphi(n) &= \vphi(p\cdot q) =\vphi(p)\cdot\vphi(q) = (p-1)(q-1)\\ 
         &= pq-p-q+1 = 323-17-19+1 = 288.
\end{align*}
\item Randomly choose an $e<288$: We choose $e=95$.
\item Solve
$$
  95x \con 1\pmod{288}.
$$
Using the GCD algorithm, we find that $d=191$ solves 
the equation.
\end{enumerate}

The public key is $(323,95)$, so the encryption
function is %%%$E:\zmod{323}\ra \zmod{323}$ is defined by
$$
   E(x) = x^{95},
$$
and the decryption function is $D(x) = x^{191}$.

Next, we encrypt the letter ``X''.  It is encoded as the number
$24$, since~X is the $24$th letter of the alphabet.
We have
$$
  E(24) = 24^{95} = 294 \in \zmod{323}.
$$

To decrypt, we compute $E^{-1}$:
$$
  E^{-1}(294) = 294^{191} = 24 \in \zmod{323}.
$$

This next example illustrates RSA but with bigger numbers.
Let 
$$
 p=738873402423833494183027176953, \, q=3787776806865662882378273.
$$
Then
$$
 n=p\cdot q = 2798687536910915970127263606347911460948554197853542169
$$
and
\begin{align*}
\vphi(n)&=(p-1)(q-1)\\
&=
 2798687536910915970127262867470721260308194351943986944.
\end{align*}
Using a pseudo-random number generator on a computer, the
author randomly chose the integer
$$
  e=1483959194866204179348536010284716655442139024915720699.
$$
Then
$$ 
  d = 2113367928496305469541348387088632973457802358781610803
$$

Since $\log_{27}(n) \approx 38.04$, we can encode then
encrypt single blocks of up to 38 letters.  Let's encrypt ``RUN NIKITA'',
which encodes as $m=143338425831991$.  We have
\begin{align*}
  E(m) &= m^e \\
& = 1504554432996568133393088878600948101773726800878873990.
\end{align*}
\begin{remark}
In practice one usually choses $e$ to be small, since that
does not seem to reduce the security of RSA, and makes the
key size smaller.  For example, in the OpenSSL documentation
(see \url{http://www.openssl.org/}) 
about their implementation of RSA it states that 
``The exponent is an odd number, typically 3, 17 or 65537.''
\end{remark}

\section{Attacking RSA}
Suppose Nikita's\index{Nikita|)} public key is $(n,e)$ and her
decryption key is~$d$, so $ed\con 1\pmod{\vphi(n)}$.  If somehow we
compute the factorization $n=pq$, then we can compute
$\vphi(n)=(p-1)(q-1)$ and hence compute~$d$.  Thus if we can factor~$n$
then we can break the corresponding RSA public-key cryptosystem.

\subsection{Factoring $n$ Given $\vphi(n)$}\label{sec:phin}
\index{factorization!and breaking RSA}
Suppose $n=pq$.  Given $\vphi(n)$, it is very easy to
compute $p$ and $q$.  We have 
$$
  \vphi(n) = (p-1)(q-1) = pq-(p+q)+1,
$$
so we know both $pq=n$ and $p+q = n+1 - \vphi(n)$.
Thus we know the polynomial 
$$
   x^2 - (p+q)x + pq = (x-p)(x-q)
$$
whose roots are~$p$ and~$q$.
These roots can be found using the quadratic formula.

\begin{example}
The number $n=pq=31615577110997599711$ is a product of two primes, 
and $\vphi(n)= 31615577098574867424$.  We have
\begin{align*}
  f &= x^2 - (n+1-\vphi(n))x + n \\
    &= x^2 - 12422732288x + 31615577110997599711\\
    &= (x-3572144239)(x-8850588049),
\end{align*}
where the factorization 
step is easily accomplished using the quadratic formula:
\begin{align*}
 & \frac{-b +\sqrt{b^2 - 4ac}}{2a} \\
 &\qquad=
   \frac{ 12422732288 + \sqrt{12422732288^2 - 4\cdot 31615577110997599711}}{2}\\
   &\qquad= 8850588049.
\end{align*}
We conclude that $n = 3572144239\cdot 8850588049$.
\end{example}

\subsection{When~$p$ and~$q$ are Close}
\label{sec:fermatcrack}
Suppose that~$p$ and~$q$ are ``close'' to each other.  Then
it is easy to factor~$n$ using a factorization
method of Fermat.

Suppose $n=pq$ with $p>q$, say.  Then
$$n = \left(\frac{p+q}{2}\right)^2 -
      \left(\frac{p-q}{2}\right)^2.$$
Since $p$ and $q$ are ``close'',
$$
  s = \frac{p-q}{2}
$$
is small,
$$
  t = \frac{p+q}{2}
$$
is only slightly larger than $\sqrt{n}$, 
and $t^2-n=s^2$ is a perfect square.
So we just try 
$$
  t = \lceil\sqrt{n}\rceil, \quad t=\lceil\sqrt{n}\rceil+1, 
      \quad t=\lceil\sqrt{n}\rceil+2, \ldots
$$
until $t^2-n$ is a perfect square $s^2$.  (Here $\lceil x\rceil$
denotes\index{$\lceil x \rceil$} the least integer $n\geq x$.)
Then 
$$
   p = t+s,\qquad q=t-s.
$$
\begin{example}
Suppose $n=23360947609$.
Then 
$$\sqrt{n} = 152842.88\ldots.$$

If $t=152843$, then $\sqrt{t^2-n} = 187.18\ldots$.

If $t=152844$, then $\sqrt{t^2-n} = 583.71\ldots$.

If $t=152845$, then $\sqrt{t^2-n} = 804\in\Z$.

Thus $s=804$.  We find that $p=t+s=153649$ and $q=t-s=152041$.
\end{example}

\subsection{Factoring~$n$ Given~$d$}
\index{factorization!and breaking RSA}
\label{sec:probcrack}
In this section, we show that finding the decryption key $d$ for an
RSA cryptosystem is, in practice, at least as difficult as factoring~$n$.
We give a probabilistic algorithm that given a decryption key
determines the factorization of~$n$.


Consider an RSA cryptosystem with modulus~$n$ and
encryption key~$e$.  Suppose we somehow finding an integer~$d$ such 
that 
$$
  a^{ed} \con a\pmod{n}
$$ 
for all~$a$.  Then~$m=ed-1$ satisfies $a^m\con 1\pmod{n}$ for all~$a$
that are coprime to~$n$.  As we saw in Section~\ref{sec:phin}, knowing
$\vphi(n)$ leads directly to a factorization of~$n$.  Unfortunately,
knowing~$d$ does not seem to lead easily to a factorization of~$n$.
However, there is a probabilistic procedure that, given an~$m$ such
that $a^m\con 1\pmod{n}$, will find a factorization of~$n$ with ``high
probability'' (we will not analyze the probability here).

\begin{algorithm}{Probabilistic Algorithm to Factor~$n$}\label{alg:factor_n}
  Let $n=pq$ be the product of two distinct odd primes, and suppose
  $m$ is an integer such that $a^m\con 1\pmod{n}$ for all~$a$ coprime
  to $n$.  This probabilistic algorithm factors~$n$ with ``high
  probability''.  In the steps below,~$a$ always denotes an integer
  coprime to~$n=pq$.
\begin{steps}
\item{}[Divide out powers of 2] 
\label{alg:factor_n_1} If $a^{m/2}\con 1\pmod{n}$ for several
randomly chosen~$a$, set $m\assign m/2$, and go to 
step~\ref{alg:factor_n_1}, otherwise let~$a$ be such that
$a^{m/2}\not \con 1\pmod{n}$.
\item{}\label{alg:factor_n_2} 
 [Compute GCD's]
Compute $g\assign \gcd(a^{m/2}-1,n)$.
\item{} [Terminate?] If $g$ is a proper divisor of $n$, output $g$
and terminate.  Otherwise go to step~\ref{alg:factor_n_1} and
choose a different $a$.
\end{steps}
\end{algorithm}

In step \ref{alg:factor_n_1}, note that~$m$ is even since $(-1)^m\con
1\pmod{n}$, so it makes sense to consider $m/2$.  It is not practical
to determine whether or not $a^{m/2}\con 1\pmod{n}$ for all~$a$,
because it would require doing a computation for too many~$a$.
Instead, we try a few random~$a$; if $a^{m/2}\con 1\pmod{n}$ for
the~$a$ we check, we divide~$m$ by~$2$.  Also note that if there
exists even a single~$a$ such that $a^{m/2}\not\con 1\pmod{n}$, then
half the~$a$ have this property, since then $a\mapsto a^{m/2}$ is
a surjective homomorphism $(\zmod{n})^*\ra \{\pm 1\}$ and the kernel
has index~$2$.

Proposition~\ref{prop:atmost} implies that if $x^2\con 1\pmod{p}$ then
$x=\pm 1\pmod{p}$.  In step \ref{alg:factor_n_2}, since $(a^{m/2})^2
\con 1\pmod{n}$, we also have $(a^{m/2})^2 \con 1\pmod{p}$ and
$(a^{m/2})^2 \con 1\pmod{q}$, so $a^{m/2}\con \pm 1\pmod{p}$ and
$a^{m/2}\con \pm 1\pmod{q}$.  Since $a^{m/2}\not\con 1\pmod{n}$, there
are three possibilities for these signs, so with probability $2/3$, 
one of the following two possibilities occurs:
\begin{enumerate}
\item
\quad$\ds
a^{m/2}\con+1\pmod{p}\qquad\text{and}\qquad a^{m/2}\con -1\pmod{q} 
$
\item 
\quad$\ds
a^{m/2}\con -1\pmod{p}\qquad\text{and}\qquad a^{m/2}\con
+1\pmod{q}.  $
\end{enumerate}
The only other possibility is that both signs are
$-1$.  In the first case, $$p\mid a^{m/2}-1 \qquad\text{but}\qquad
q\nmid a^{m/2}-1,$$
so $ \gcd(a^{m/2}-1,pq) = p, $ and we have
factored~$n$.  Similarly, in the second case, $ \gcd(a^{m/2}-1,pq) =
q, $ and we again factor~$n$.


\begin{example}
Somehow we discover that the RSA cryptosystem with
$$
n=32295194023343\qquad\text{and}\qquad e=29468811804857
$$ 
has decryption
key $d= 11127763319273$.  We use this information and
Algorithm~\ref{alg:factor_n} to factor~$n$.
If
$$m = ed-1 = 327921963064646896263108960,$$
then $\vphi(pq)\mid m$, so $a^m\con 1\pmod{n}$
for all $a$ coprime to $n$.
For each $a\leq 20$ we find that
$a^{m/2}\con 1\pmod{n}$, so we replace~$m$ by 
$$\frac{m}{2}= 163960981532323448131554480.$$
Again, we find with this new~$m$ that 
for each $a\leq 20$, 
$a^{m/2}\con 1\pmod{n}$, so we replace~$m$ by
$81980490766161724065777240$.
Yet again, for each $a\leq 20$, 
$a^{m/2}\con 1\pmod{n}$, so we replace~$m$
by $40990245383080862032888620$.
This is enough, since 
$2^{m/2} \con 4015382800099\pmod{n}$.
Then 
$$
  \gcd(2^{m/2}-1,n) = \gcd(4015382800098,32295194023343) = 737531,
$$
and we have found a factor of~$n$.  Dividing, we find that 
$$
  n = 737531 \cdot 43788253.
$$
\end{example}
\index{RSA cryptosystem|)}\index{cryptosystem!RSA|)}

\subsection{Further Remarks}
If one were to implement an actual RSA cryptosystem, there are many
additional tricks and ideas to keep in mind.  For example, one can add
some extra random letters to each block of text, so that a given
string will encrypt differently each time it is encrypted.  This makes
it more difficult for an attacker who knows the encrypted and
plaintext versions of one message to gain information about subsequent
encrypted messages.   For an example implementation that incorporates
this randomness, see Listing~\ref{listing:String to Number List}.  
In any particular implementation, there might be
attacks that would be devastating in practice, but which wouldn't
require factoring the RSA modulus.

RSA is in common use, e.g., it is used 
in OpenSSH protocol version 1 (see \url{http://www.openssh.com/}).

We will consider the ElGamal cryptosystem in
Sections~\ref{sec:elgamal}.  It has a similar
flavor to RSA, but is more flexible in some ways.

\begin{exercises}

\item\label{ex:crypto2}  This problem concerns encoding phrases 
using numbers using the encoding of Section~\ref{sec:encode}.
What is the longest that an arbitrary sequence of letters (no spaces) 
can be if it must fit in a number that is less than $10^{20}$?

\item \label{ex:crypto6}
Suppose Michael creates an RSA cryptosystem with a very large 
modulus~$n$ for which the factorization of~$n$ cannot be found 
in a reasonable amount of time. Suppose that Nikita sends  
messages to Michael by representing each alphabetic character 
as an integer between~$0$ and~$26$ (\verb*|A| corresponds 
to $1$, \verb*|B| to~$2$, etc., and a space \verb*| | to~$0$), 
then encrypts each number {\em separately} 
using Michael's RSA cryptosystem.  Is this method secure? 
Explain your answer.



\item\label{ex:crack3} 
   For any $n\in\N$, let $\sigma(n)$ be the
  sum of the divisors of~$n$; for example, $\sigma(6) = 1+2+3+6=12$ and
  $\sigma(10)=1+2+5+10=18$.  
  Suppose that $n=pqr$ with $p$, $q$, and $r$ distinct primes.  Devise
  an ``efficient'' algorithm that given $n$, $\vphi(n)$ and
  $\sigma(n)$, computes the factorization of~$n$.  For example, if
  $n=105$, then $p=3$, $q=5$, and $r=7$, so the input to the algorithm
  would be
  $$
    n = 105,\qquad \vphi(n) = 48, \qquad \text{and}\quad \sigma(n)=192,
  $$
  and the output would be $3$, $5$, and $7$.
%   \item Use your algorithm to factor $n=60071026003$ given that
%     $\vphi(n) = 60024000000$ and $\sigma(n) = 60118076016$.


\end{exercises}

For computational exercises about cryptosystems, 
see the exercises for Chapter~\ref{ch:computing}.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%  
%% Chapter: Quadratic Reciprocity
%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\chapter{Quadratic Reciprocity}\label{ch:reciprocity}
\index{quadratic reciprocity|(} 

The linear equation
$$
 ax\con b\pmod{n}
$$
has a solution if and only if $\gcd(a,n)$ divides~$b$ 
(see Proposition~\ref{prop:cancel2}).
This chapter is about some amazing mathematics motivated by
the search for a criterion for whether or not a quadratic
equation
$$
ax^2 + bx + c \con 0\pmod{n}
$$
has a solution.  In many cases, the Chinese Remainder Theorem and
the quadratic formula reduce this question to the key question of
whether a given integer $a$ is a perfect square modulo a prime~$p$.

The quadratic reciprocity law of Gauss\index{Gauss} provides a
precise answer to the following question: For which
primes~$p$ is the image of~$a$ in $(\zmod{p})^*$ a perfect square?
Amazingly, the answer depends only on the reduction of~$p$ modulo
$4a$.

There are over a hundred proofs of the quadratic reciprocity law (see
\cite{qrlist} for a long list).  We give two proofs.  The first,
which we give in Section~\ref{sec:qr1}, 
is completely elementary and involves keeping track of integer points in
intervals.  It is satisfying because one can understand every
detail without much abstraction, but it is unsatisfying because
it is difficult to conceptualize what is going on.
In sharp contrast, our second proof, which we we give in
Section~\ref{sec:qr2}, in more abstract and uses a conceptual 
development of properties of Gauss sums.  You should
read Sections~\ref{sec:statement} and \ref{sec:euler}, then at least
one of Section~\ref{sec:qr1} or Section~\ref{sec:qr2}, depending on
your taste and how much abstract algebra you know.
% (Section~\ref{sec:qr2} is more demanding, but can be safely
% skipped.)

In Section~\ref{sec:findingsqrt}, we return to the computational
question of actually finding square roots and solving quadratic
equations in practice.


\section{Statement of the Quadratic Reciprocity Law}\label{sec:statement}
In this section we state the quadratic reciprocity law.

\begin{definition}[Quadratic Residue]\index{quadratic residue|nn}
Fix a prime $p$.  An integer~$a$ not divisible by~$p$ is
\defn{quadratic residue} modulo~$p$ if~$a$ is a square modulo~$p$;
otherwise,~$a$ is a \defn{quadratic nonresidue}.
\end{definition}
The quadratic reciprocity theorem connects the question of whether or
not~$a$ is a quadratic residue modulo~$p$ to the question of
whether~$p$ is a quadratic residue modulo each of the prime divisors
of~$a$.  To express it precisely, we introduce some new notation.
\begin{definition}[Legendre Symbol]
Let~$p$ be an odd prime and let~$a$ be an integer coprime to~$p$.  
Set\index{a@$\kr{a}{p}$|nn}
$$
\kr{a}{p} =
\begin{cases}
        +1 & \text{if $a$ is a quadratic residue, and}\\
        -1 & \text{otherwise}.
\end{cases}
$$
We call this symbol the \defn{Legendre Symbol}.
\end{definition}

This notation is well entrenched in the literature, even though it
is also the notation for ``$a$ divided by~$p$''; be careful
not to confuse the two.  

Since $\kr{a}{p}$ only depends on $a\pmod{p}$, it makes sense
to define $\kr{a}{p}$ for $a\in \zmod{p}$ to be $\kr{\tilde{a}}{p}$ for
any lift $\tilde{a}$ of~$a$ to~$\Z$.
      
\begin{lemma}\label{lem:qrhom}
  The map $\psi:(\zmod{p})^*\to \{\pm 1\}$ given by 
$\psi(a) = \kr{a}{p}$ is a surjective group homomorphism.
\end{lemma}
\begin{proof}
  By Theorem~\ref{thm:primroot}, $G=(\zmod{p})^*$ is a cyclic group of order $p-1$.
  Because~$p$ is odd,~$G$ has even order, so the subgroup~$H$ of
  squares of elements of $G$ has index~$2$ in~$G$.  Since
  $\kr{a}{p}=1$ if and only if $a\in H$, we see that $\psi$
  is the composition $G\to G/H\isom \{\pm 1\}$,
  where we identify the nontrivial element of $G/H$ with $-1$.
\end{proof}
\begin{remark}
  We could also prove that $\psi$ is surjective without using that
  $(\zmod{p})^*$ is cyclic, as follows.  If $a\in(\zmod{p})^*$ is a
  square, say $a\con b^2\pmod{p}$, then $a^{(p-1)/2} = b^{p-1}\con
  1\pmod{p}$, so $a$ is a root of $f=x^{(p-1)/2}-1$.  By
  Proposition~\ref{prop:atmost}, the polynomial~$f$ has at most
  $(p-1)/2$ roots.  Thus there must be an $a\in(\zmod{p})^*$ that is
  not a root of~$f$, and for that $a$, we have $\psi(a)=\kr{a}{p}=-1$,
  and trivially $\psi(1)=1$, so the map $\psi$ is surjective.  Note
  that this argument does not prove that $\psi$ is a homomorphism,
  though it can be extended to one that does. 
\end{remark}

      
The symbol $\kr{a}{p}$ only depends on the residue class of~$a$
modulo~$p$, so making a table of values $\kr{a}{5}$ for many values
of~$a$ would be easy.  Would it be easy to make a table of $\kr{5}{p}$
for many~$p$?  Probably, since there is a simple pattern in
Table~\ref{tbl:5square}.
\begin{table}\index{table!when $5$ a square mod $p$}
\caption{When is $5$ a square modulo~$p$?\label{tbl:5square}}
\begin{center}
\vspace{1ex}
\begin{tabular}{|c|r|c|}\hline
$p$ & $\kr{5}{p}$ & $p$ mod 5\\\hline
7 & $-1 $& 2\\
11 &$ 1 $& 1\\
13 &$ -1$& 3\\
17 &$ -1$& 2\\
19 &$ 1 $& 4\\
23 &$ -1$& 3\\\hline
\end{tabular}\qquad
\begin{tabular}{|c|r|c|}\hline
$p$ & $\kr{5}{p}$ & $p$ mod 5\\\hline
29 &$ 1 $& 4\\
31 &$ 1 $& 1\\
37 &$ -1$& 2\\
41 &$ 1 $& 1\\
43 &$ -1$& 3\\
47 &$ -1$& 2\\\hline
\end{tabular}
\end{center}
\end{table}
It appears that $\kr{5}{p}$ depends only on the congruence class
of~$p$ modulo~$5$.  More precisely, $\kr{5}{p}=1$ if and only if
$p\con 1,4\pmod{5}$, i.e., $\kr{5}{p}=1$ if and only if~$p$ is a
square modulo~$5$.  
%We might try to prove this using
%Proposition~\ref{prop:euler} below; however, the author sees no simple
%reason that knowing that $p\con 1,4 \pmod{5}$ helps us to evaluate
%$5^{(p-1)/2} \pmod{p}$.  
%See \exref{ch:reciprocity}{ex:rec6} for a
%further discussion about proving our observation directly.


Based on similar observations, in the 18th century various
mathematicians found a conjectural explanation for the mystery
suggested by Table~\ref{tbl:5square}. Finally, on April~8, 1796, at
the age of 19, Gauss\index{Gauss} proved the following theorem.
\begin{theorem}[Gauss's Quadratic Reciprocity Law]\label{thm:recip}%
\ithm{quadratic reciprocity}
Suppose~$p$ and~$q$ are distinct odd primes.  Then
$$  
\kr{p}{q} = (-1)^{\frac{p-1}{2}\cdot \frac{q-1}{2}}\kr{q}{p}.
$$
Also
$$
  \kr{-1}{p} = (-1)^{(p-1)/2}\qquad\text{\rm and}\qquad
  \kr{2}{p}  = \begin{cases} \hfill1 & \text{\rm if } p\con \pm 1\pmod{8}\\
    -1 & \text{\rm if } p \con \pm 3\pmod{8}.
            \end{cases}
$$
\end{theorem}

We will give two proofs of Gauss's\index{Gauss} formula relating
$\kr{p}{q}$ to $\kr{q}{p}$.  The first elementary proof is in
Section~\ref{sec:qr1}, and the second more algebraic proof is in
Section~\ref{sec:qr2}.

In our example Gauss's\index{Gauss} theorem implies that
$$
\kr{5}{p} = (-1)^{2\cdot \frac{p-1}{2}} \kr{p}{5} =\kr{p}{5}
= \begin{cases} +1 & \text{ if }p\con 1, 4\pmod{5}\\
  -1 & \text{ if }p\con 2, 3\pmod{5}.
\end{cases}
$$


As an application, the following example illustrates how to answer
questions like ``is~$a$ a square modulo~$b$'' using
Theorem~\ref{thm:recip}.
\begin{example}\label{ex:69}
  Is~$69$ a square
  modulo the prime~$389$?  We have
  $$\kr{69}{389} = \kr{3\cdot 23}{389} =\kr{3}{389}\cdot \kr{23}{389}
  = (-1)\cdot(-1)= 1.$$
  Here  
  $$
  \kr{3}{389} = \kr{389}{3} = \kr{2}{3}=-1,
  $$
  and
\begin{align*}
  \kr{23}{389} &= \kr{389}{23} = \kr{21}{23}= \kr{-2}{23} \\
  &= \kr{-1}{23}\kr{2}{23} =(-1)^{\frac{23-1}{2}}\cdot 1 = -1.
\end{align*}
Thus $69$ is a square modulo~$389$.  

Though we know that~$69$ is a square modulo~$389$, we don't know an
explicit~$x$ such that $x^2\con 69\pmod{389}$!  This is reminiscent
of how we could prove using Theorem~\ref{thm:fermatlittle} that
certain numbers are composite without knowing a factorization.
\end{example}

\begin{remark}
The Jacobi symbol is an extension of the Legendre symbol 
to  composite moduli.  For more details, see 
\exref{ch:reciprocity}{ex:rec13}.
\end{remark}

\section{Euler's Criterion}%
\label{sec:euler}
Let~$p$ be an odd prime and~$a$ an integer not divisible by~$p$.  
Euler\index{Euler} 
used the existence of primitive roots to show that $\kr{a}{p}$
is congruent to $a^{(p-1)/2}$ modulo~$p$.  We will use this fact
repeatedly below in both proofs of Theorem~\ref{thm:recip}.

\begin{proposition}[Euler's Criterion]\label{prop:euler}
\iprop{Euler's criterion}
We have $\kr{a}{p}=1$ if and only if
$$
a^{(p-1)/2}\con 1\pmod{p}.
$$
\end{proposition}
\begin{proof}
  The map $\vphi:(\zmod{p})^*\to (\zmod{p})^*$ given by $\vphi(a)=
  a^{(p-1)/2}$ is a group homomorphism, since powering is a group
  homomorphism of any abelian group.  Let $\psi:(\zmod{p})^*\to \{\pm
  1\}$ be the homomorphism $\psi(a) = \kr{a}{p}$ of
  Lemma~\ref{lem:qrhom}.  If $a\in \ker(\psi)$, then $a=b^2$ for some
  $b\in\zmod{p}$, so
  $$
  \vphi(a)=a^{(p-1)/2} = (b^2)^{(p-1)/2} = b^{p-1} = 1.
  $$
  Thus $\ker(\psi)\subset \ker(\vphi)$.  By Lemma~\ref{lem:qrhom}, 
  $\ker(\psi)$ has index~$2$ in $(\zmod{p})^*$, so
  either $\ker(\vphi)=\ker(\psi)$ or $\vphi=1$.  If $\vphi=1$,
  the polynomial $x^{(p-1)/2}-1$ has $p-1$ roots in the field $\zmod{p}$,
  which contradicts Proposition~\ref{prop:atmost}, so
  $\ker(\vphi)=\ker(\psi)$, which proves the proposition.
\end{proof}

From a computational point of view, Corollary~\ref{cor:euler}
provides a convenient way to compute $\kr{a}{p}$.  See
Section~\ref{sec:comp_legendre} for an implementation.


\begin{corollary}\label{cor:euler}
The equation $x^2\con a\pmod{p}$ has no solution if and 
only if $a^{(p-1)/2}\con -1\pmod{p}$.  
Thus $\kr{a}{p} \con a^{(p-1)/2}\pmod{p}$.
\end{corollary}
\begin{proof}
This follows from Proposition~\ref{prop:euler} and the
 fact that the polynomial $x^2-1$ has no roots 
besides $+1$ and $-1$ (which follows from 
Proposition~\ref{prop:dsols}).
\end{proof}

As additional computational motivation for the value of
Corollary~\ref{cor:euler}, note that to evaluate $\kr{a}{p}$ using
Theorem~\ref{thm:recip} would not be practical if~$a$ and~$p$ both
very large, because it would require factoring~$a$.  However,
Corollary~\ref{cor:euler} provides a method for evaluating $\kr{a}{p}$
without factoring~$a$.

\begin{example}
Suppose $p=11$.  By squaring each element of $(\zmod{11})^*$, we see 
that the squares modulo~$11$ are $\{1,3,4,5,9\}$.
We compute $a^{(p-1)/2}=a^{5}$ for each $a\in (\zmod{11})^*$ and get
\begin{align*}
 1^{5} &= 1,\, 2^{5} = -1,\, 3^{5} = 1,\, 4^{5} = 1,\, 5^{5} = 1,\, \\
 6^{5} &= -1,\, 7^{5} = -1,\, 8^{5} = -1,\, 9^{5} = 1,\, 10^{5} = -1.
\end{align*}
Thus the~$a$ with $a^5=1$ are $\{1, 3, 4, 5, 9\}$, 
just as Proposition~\ref{prop:euler} predicts.
\end{example}



\begin{example}
We determine whether or not~$3$ is a square modulo the prime $p=726377359$.  
Using a computer we find that
$$
3^{(p-1)/2}\con -1\pmod{726377359}.
$$
Thus~$3$ is not a square modulo~$p$.  This computation wasn't difficult, but 
it would have been tedious by hand.  The law of quadratic reciprocity 
provides a way to answer this question, which could easily be carried 
out by hand:
\begin{align*}
 \kr{3}{726377359}
  &= (-1)^{(3-1)/2\cdot (726377359-1)/2} \kr{726377359}{3}\\
  &= (-1) \cdot \kr{1}{3} = -1.
\end{align*}
\end{example}


\section{First Proof of Quadratic Reciprocity}\label{sec:qr1}
\index{quadratic reciprocity!elementary proof|(}

Our first proof of quadratic reciprocity is elementary.  The proof
involves keeping track of integer points in intervals.  Proving
Gauss's\index{Gauss} lemma is the first step; this lemma computes
$\kr{a}{p}$ in terms of the number of integers of a certain type that
lie in a certain interval.  Next we prove Lemma~\ref{lem:even}, which
controls how the parity of the number of integer points in an interval
changes when an endpoint of the interval is changed.  Then we prove
that $\kr{a}{p}$ depends only on~$p$ modulo~$4a$ by applying
Gauss's\index{Gauss} lemma and keeping careful track of intervals as
they are rescaled and their endpoints are changed.  Finally, in
Section~\ref{sec:qr_proof_q} we use some basic algebra to deduce the
quadratic reciprocity law using the tools we've just developed.
Our proof follows the one given in \cite{davenport} closely.

\begin{lemma}[Gauss's Lemma]\label{lem:gauss}\index{Gauss's lemma}
Let~$p$ be an odd prime and let~$a$ be an integer $\not\con 0\pmod{p}$. 
 Form the numbers
$$
a,\, 2a,\, 3a,\, \ldots,\, \frac{p-1}{2} a
$$
and reduce them modulo~$p$ to lie in the interval $(-\frac{p}{2},\,\, \frac{p}{2})$.  Let $\nu$ be the number of negative numbers in the resulting set.  Then
$$
\kr{a}{p} = (-1)^{\nu}.
$$
\end{lemma}
\begin{proof}
In defining $\nu$, we expressed each number in
$$
S = \left\{a, 2a, \ldots, \frac{p-1}{2} a\right\}
$$
as congruent to a number in the set
$$
\left\{ 1, -1, 2, -2, \ldots, \frac{p-1}{2}, -\frac{p-1}{2}\right\}.
$$
No number $1, 2, \ldots, \frac{p-1}{2}$ appears more than once, with either choice of sign, because if it did then either two elements of~$S$ are congruent modulo~$p$ or $0$ is the sum of two elements of~$S$, and both events are impossible.  Thus the resulting set must be of the form
$$T = \left\{\eps_1\cdot 1, \eps_2 \cdot 2, \ldots, \eps_{(p-1)/2}\cdot \frac{p-1}{2} \right\},$$
where each $\eps_i$ is either $+1$ or $-1$.  Multiplying together the elements of~$S$ and of~$T$, we see that
\begin{align*}
   (1a) \cdot (2a)\cdot(3a) \cdots \left(\frac{p-1}{2} a\right)
        \con \\
   (\eps_1\cdot 1)\cdot (\eps_2 \cdot 2) \cdots & \left(\eps_{(p-1)/2} \cdot \frac{p-1}{2}\right)\pmod{p},
\end{align*}
so
$$
a^{(p-1)/2} \con \eps_1\cdot \eps_2 \cdots \eps_{(p-1)/2}\pmod{p}.
$$
The lemma then follows from Proposition~\ref{prop:euler}, since $\kr{a}{p} = a^{(p-1)/2}$.
\end{proof}


\subsection{Euler's Proposition}\index{Euler's proposition}
For rational numbers $a,b\in\Q$, let
$$
(a,b)\intersect\Z = \{x \in \Z : a\leq x \leq b\}
$$
be the set of integers between~$a$ and~$b$.  The following 
lemma will help us to keep track of how many integers lie in 
certain intervals.
\begin{lemma}\label{lem:even}
Let $a, b\in\Q$.  Then for any integer~$n$,
$$\#\left((a,b)\intersect \Z\right) \con \#\left((a,b+2n)\intersect \Z\right) \pmod{2}$$
and
$$
\#\left((a,b)\intersect \Z\right) \con \#\left((a-2n,b)\intersect \Z\right) \pmod{2},
$$
provided that each interval involved in the congruence is nonempty.
\end{lemma}
%The statement is illustrated in Figure~\ref{fig:intervals}.  
Note 
that if one of the intervals is empty, then the statement may be false; 
e.g., if $(a,b)=(-1/2,1/2)$ and $n=-1$ then $\#((a,b)\intersect\Z) = 1$ 
but $\#(a,b-2)\intersect\Z = 0$.
\begin{proof}
Let $\lceil x\rceil$ denotes 
the least integer $\geq x$. 
Since $n>0$,
$$(a,b+2n) = (a,b) \union [b,b+2n),$$
where the union is disjoint.  There are $2n$ integers,
$$
\lceil b\rceil, \lceil b\rceil+1, \ldots, \lceil b\rceil +2n-1,
$$
in the interval $[b,b+2n)$, so the first congruence of the lemma 
is true in this case.  We also have
$$
(a,b-2n) = (a,b)\text{ minus } [b-2n,b)
$$
and $[b-2n,b)$ contains exactly $2n$ integers, so the lemma is 
also true when~$n$ is negative.  The statement about 
$\#\left((a-2n,b)\intersect \Z\right)$ is proved in a similar manner.
\end{proof}

Once we have proved the following
proposition, it will be easy to deduce the quadratic reciprocity law.
\begin{proposition}[Euler]\label{prop:euler_prop}\iprop{Euler}
Let~$p$ be an odd prime and let~$a$ be a positive integer with $p\nmid a$.
If $q$ is a prime with $q\con \pm p\pmod{4a}$, then 
$\kr{a}{p} = \kr{a}{q}$.
\end{proposition}
\begin{proof}
We will apply Lemma~\ref{lem:gauss} to compute $\kr{a}{p}$.  Let
$$
S = \left\{a, 2a, 3a, \ldots, \frac{p-1}{2}a\right\}
$$
and
$$
I = \left(\frac{1}{2}p,p\right) \union \left(\frac{3}{2}p, 2p\right) 
  \union \cdots \union \left(\left(b-\frac{1}{2}\right)p,bp\right),
$$
where $b=\frac{1}{2}a$ or $\frac{1}{2}(a-1)$, whichever is an integer.
We check that every element of~$S$ that reduces to something in the
interval $(-\frac{p}{2},0)$ lies in~$I$.  This is clear if
$b=\frac{1}{2}a < \frac{p-1}{2}a$.  If $b=\frac{1}{2}(a-1)$, then
$bp+\frac{p}{2} > \frac{p-1}{2}a$, so $((b-\frac{1}{2})p,bp)$ is the
last interval that could contain an element of $S$ that reduces to
$(-\frac{p}{2},0)$.  Note that the integer endpoints of~$I$ are not
in~$S$, since those endpoints are divisible by~$p$, but no element
of~$S$ is divisible by~$p$.  Thus, by Lemma~\ref{lem:gauss},
$$\kr{a}{p} = (-1)^{\# (S\intersect I)}.$$

To compute $\#(S\intersect I)$, first rescale by~$a$ to see that
$$
\#(S\intersect I) = \#\left(\Z \intersect \frac{1}{a}I\right),
$$
where
$$\frac{1}{a} I = \left(\left(\frac{p}{2a},\frac{p}{a}\right) \union \left(\frac{3p}{2a},\frac{2p}{a}\right) \union \cdots \union \left(\frac{(2b-1)p}{2a},\frac{bp}{a}\right) \right).$$

Write $p=4ac+r$, and let
$$
J = \left(\left(\frac{r}{2a},\frac{r}{a}\right) \union \left(\frac{3r}{2a},\frac{2r}{a}\right) \union \cdots \union \left(\frac{(2b-1)r}{2a},\frac{br}{a}\right) \right).
$$
The only difference between~$I$ and~$J$ is that the endpoints of
intervals are changed by addition of an even integer.  By
Lemma~\ref{lem:even},
$$
  \nu=\#\left(\Z \intersect \frac{1}{a}I\right) \con \#(\Z\intersect J)\pmod{2}.
$$
Thus $\kr{a}{p}=(-1)^\nu$ depends only on~$r$, i.e., only on~$p$ modulo~$4a$.
Thus if $q\con p\pmod{4a}$, then $\kr{a}{p}=\kr{a}{q}$.

If $q\con -p\pmod{4a}$, then the only change in the above computation
is that~$r$ is replaced by~$4a-r$.  This changes $\frac{1}{a}I$ into
\begin{align*}
  K = \left(2-\frac{r}{2a},4-\frac{r}{a}\right) &\union
  \left(6-\frac{3r}{2a},8-\frac{2r}{a}\right) \union
  \cdots\\
  &\union \left(4b-2-\frac{(2b-1)r}{2a},4b-\frac{br}{a}\right).
\end{align*}
Thus $K$ is the same as $-\frac{1}{a}I$, except even integers have
been added to the endpoints.  By Lemma~\ref{lem:even},
$$\#(K\intersect \Z)\con
\#\left(\left(\frac{1}{a}I\right)\intersect\Z\right)\pmod{2},$$
so
$\kr{a}{p} = \kr{a}{q}$, which completes the proof.
\end{proof}

The following more careful analysis in the special case when $a=2$
helps illustrate the proof of the above lemma, and the result is
frequently useful in computations.  For an alternative proof
of the proposition, see \exref{ch:reciprocity}{ex:rec8}.
\begin{proposition}[Legendre symbol of $2$]%
\label{prop:p2}\iprop{Legendre symbol of 2}
Let~$p$ be an odd prime.  Then
$$
\kr{2}{p} = \begin{cases} \hfill1 & \text{ if } p\con \pm 1\pmod{8}\\
                         -1 & \text{ if } p\con \pm 3\pmod{8}.  \end{cases}
$$
\end{proposition}
\begin{proof}
When $a=2$, the set $S = \{a,2a,\ldots,2\cdot\frac{p-1}{2}\}$ is
$$
\{ 2, 4, 6, \ldots, p-1 \}.
$$
We must count the parity of the number of elements of~$S$ that lie
in the interval $I=(\frac{p}{2}, p)$.  Writing $p=8c+r$, we have
\begin{align*}
\#\left(I\intersect S\right) &=\#\left(\frac{1}{2}I \intersect \Z\right)
=\#\left(\left(\frac{p}{4},\frac{p}{2}\right)\intersect \Z\right)\\
&=\#\left(\left(2c+\frac{r}{4}, 4c+\frac{r}{2}\right)\intersect \Z\right) \con \#\left(\left(\frac{r}{4}, \frac{r}{2}\right)\intersect \Z\right) \pmod{2},
\end{align*}
where the last equality comes from Lemma~\ref{lem:even}.  The possibilities for~$r$ are $1,3,5,7$.  When $r=1$, the cardinality is~$0$, when $r=3, 5$ it is $1$, and when $r=7$ it is $2$.
\end{proof}


\subsection{Proof of Quadratic Reciprocity}\label{sec:qr_proof_q}
It is now straightforward to deduce the quadratic reciprocity law.
\begin{proof}[First Proof of Theorem~\ref{thm:recip}]
  First suppose that $p\con q\pmod{4}$.  By swapping~$p$ and~$q$ if
  necessary, we may assume that $p>q$, and write $p-q=4a$.  Since
  $p=4a+q$,
  $$\kr{p}{q} = \kr{4a+q}{q} = \kr{4a}{q} = \kr{4}{q} \kr{a}{q} =
  \kr{a}{q},$$
  and
  $$\kr{q}{p} = \kr{p-4a}{p} = \kr{-4a}{p} = \kr{-1}{p}\cdot
  \kr{a}{p}.$$
  Proposition~\ref{prop:euler_prop} implies that
  $\kr{a}{q} = \kr{a}{p}$, since $p\con q\pmod{4a}$.  Thus
  $$\kr{p}{q}\cdot\kr{q}{p} = \kr{-1}{p} = (-1)^{\frac{p-1}{2}} =
  (-1)^{\frac{p-1}{2}\cdot \frac{q-1}{2}},$$
  where the last equality
  is because $\frac{p-1}{2}$ is even if and only if $\frac{q-1}{2}$ is
  even.
  
  Next suppose that $p\not\con q\pmod{4}$, so $p\con -q\pmod{4}$.
  Write $p+q=4a$.  We have
  $$\kr{p}{q} = \kr{4a-q}{q} = \kr{a}{q}, \quad\text{ and }\quad
  \kr{q}{p} = \kr{4a-p}{p} = \kr{a}{p}.$$
  Since $p\con -q\pmod{4a}$,
  Proposition~\ref{prop:euler_prop} implies that
  $\kr{p}{q}=\kr{q}{p}$.  Since $(-1)^{\frac{p-1}{2}\cdot
    \frac{q-1}{2}}=1$, the proof is complete.
\end{proof}
\index{quadratic reciprocity!elementary proof|)}

\section{A Proof of Quadratic Reciprocity Using Gauss Sums}
\index{quadratic reciprocity!Gauss sums proof|(}
\label{sec:qr2}


In this section we present a beautiful proof of
Theorem~\ref{thm:recip} using algebraic identities satisfied by sums
of ``roots of unity''.  The objects we introduce in the proof are of
independent interest, and provide a powerful tool to prove
higher-degree analogues of quadratic reciprocity.  (For more on higher
reciprocity see \cite{ireland-rosen}.  See also Section~6 of
\cite{ireland-rosen} on which the proof below is modeled.)


\begin{definition}[Root of Unity]\index{root of unity|nn}
  \index{units!roots of unity|nn} An $n$th \defn{root of unity} is a
  complex number~$\zeta$ such that $\zeta^n=1$.  A root of
  unity~$\zeta$ is a \defn{primitive} $n$th\index{primitive root of
    unity|nn}\index{root of unity!primitive|nn} root of unity if~$n$
  is the smallest positive integer such that $\zeta^n=1$.
\end{definition}
For example, $-1$ is a primitive second root of unity, and
$\zeta = \frac{\sqrt{-3}-1}{2}$ is a primitive cube root of
unity.
More generally, for any $n\in\N$  the complex number
$$
\zeta_n =\cos(2\pi{} /n) + i \sin(2\pi{}/n)
$$
is a primitive $n$th root of unity (this follows from the identity
$e^{i\theta} = \cos(\theta) + i\sin(\theta)$).  For the rest of this
section, we fix an odd prime~$p$ and the primitive $p$th
root~$\zeta=\zeta_p$ of unity.

\begin{definition}[Gauss Sum]
Fix an odd prime $p$.  The \defn{Gauss sum} associated to an integer~$a$ is
$$
g_a = \sum_{n=0}^{p-1} \kr{n}{p} \zeta^{an},
$$
where $\zeta=\zeta_p = \cos(2\pi{} /p) + i \sin(2\pi{}/p)$.
\end{definition}
Note that~$p$ is implicit in the definition of~$g_a$.  If we were to
change~$p$, then the Gauss sum $g_a$ associated to~$a$ would be
different.  The definition of $g_a$ also depends on our choice
of $\zeta$; we've chosen $\zeta=\zeta_p$, but could have chosen
a different $\zeta$ and then $g_a$ could be different. 

\begin{figure}
\psfrag{s1}{$-1$} 
\psfrag{s2}{$+1$} 
\psfrag{s3}{$+1$} 
\psfrag{s4}{$-1$} 
\psfrag{zeta}{$\zeta=e^{2\pi i/5}$} 
\psfrag{zeta2}{$\zeta^2$} 
\psfrag{zeta3}{$\zeta^3$} 
\psfrag{zeta4}{$\zeta^4$} 
\psfrag{left dot}{$g_2=\kr{0}{5} + \kr{1}{5}\zeta^2 + \kr{2}{5}\zeta^4 + \kr{3}{5}\zeta + \kr{4}{5}\zeta^3 = -\sqrt{5}$} 
\psfrag{right dot}{$g_2^2 = 5$}
\psfrag{1}{$1$} 
\psfrag{2}{$2$} 
\psfrag{3}{$3$} 
\psfrag{4}{$4$} 
\psfrag{5}{$5$} 
\psfrag{-3}{$-3$} 
\psfrag{-2}{$-2$} 
\includegraphics[width=\textwidth]{graphics/gauss_sum.eps}
\caption{Gauss sum $g_2$ for $p=5$\label{fig:gauss_sum}}
\end{figure}

Figure~\ref{fig:gauss_sum} illustrates the Gauss sum $g_2$ for $p=5$.
The Gauss sum is obtained by adding the points on the unit circle,
with signs as indicated, to obtain the real number $-\sqrt{5}$.  This
suggests the following proposition, whose proof will require some
work.

\begin{proposition}[Gauss sum]\label{prop:gauss_sum1}\iprop{Gauss sum}
For any~$a$ not divisible by~$p$,
$$
\ds g_a^2 = (-1)^{(p-1)/2}p.
$$
\end{proposition}

In order to prove the proposition, we introduce a few lemmas.

\begin{lemma}\label{lem:gauss_sum1}
For any integer~$a$,
$$
\sum_{n=0}^{p-1} \zeta^{an} = \begin{cases}
        p & \text{\rm if $a \con 0\pmod{p}$,}\\
        0 & \text{\rm otherwise.}  \end{cases}
$$
\end{lemma}
\begin{proof}
If $a\con 0\pmod{p}$, then $\zeta^a=1$, so the sum equals the number of summands, 
which is~$p$.  If $a\not\con 0\pmod{p}$, then we use then
identity $$x^p - 1 = (x-1)(x^{p-1} + \cdots + x + 1)$$ with $x = \zeta^a$. We have
 $\zeta^a\neq 1$, so $\zeta^a - 1 \neq 0$ and
$$
\sum_{n=0}^{p-1} \zeta^{an} = \frac{\zeta^{ap}-1}{\zeta^a-1} = 
\frac{1-1}{\zeta^a-1} = 0.
$$
\end{proof}

\begin{lemma}\label{lem:gauss_sum2}
If $x$ and $y$ are arbitrary integers, then
$$
\sum_{n=0}^{p-1} \zeta^{(x-y)n} = 
\begin{cases} 
p & \text{\rm if $x\con y\pmod{p}$},\\
0 & \text{\rm otherwise}.
\end{cases}
$$
\end{lemma}
\begin{proof}
This follows from Lemma~\ref{lem:gauss_sum1} by
setting $a=x-y$.
\end{proof}


\begin{lemma}\label{lem:gauss_sum3}
We have $g_0=0$.
\end{lemma}
\begin{proof}
By definition
\begin{equation}\label{eqn:lem_gauss_3}
g_0 = \sum_{n=0}^{p-1} \kr{n}{p}.
\end{equation}
By Lemma~\ref{lem:qrhom}, the map
$$
\kr{\cdot}{p} : (\zmod{p})^* \ra \{\pm 1\}
$$
is a surjective homomorphism of groups.  Thus  half the
elements of $(\zmod{p})^*$ map to $+1$ and half map to $-1$ (the
subgroup that maps to $+1$ has index $2$).  Since $\kr{0}{p}=0$, the
sum (\ref{eqn:lem_gauss_3}) is~$0$.
\end{proof}

\begin{lemma}\label{lem:gauss_sum4}
For any integer $a$,
$$ 
 g_a = \kr{a}{p}g_1.
$$
\end{lemma}
\begin{proof}
When $a\con 0\pmod{p}$ the lemma follows from
Lemma~\ref{lem:gauss_sum3}, so suppose that $a\not\con 0\pmod{p}$.  Then
$$
\kr{a}{p} g_a = \kr{a}{p} \sum_{n=0}^{p-1} \kr{n}{p} \zeta^{an} = \sum_{n=0}^{p-1}\kr{an}{p} \zeta^{an} = \sum_{m=0}^{p-1}\kr{m}{p}\zeta^{m} = g_1.
$$
Here we use that multiplication by $a$ is
an automorphism of $\zmod{p}$.  Finally, multiply both sides by
$\kr{a}{p}$ and use that $\kr{a}{p}^2=1$.
\end{proof}

We have enough lemmas to 
prove Proposition~\ref{prop:gauss_sum1}.
\begin{proof}[Proof of Proposition~\ref{prop:gauss_sum1}]
We evaluate the sum $\sum_{a=0}^{p-1} g_a g_{-a}$ in two different ways.  By 
Lemma~\ref{lem:gauss_sum4}, since $a\not\con 0\pmod{p}$ we have
$$
g_a g_{-a} = \kr{a}{p}g_1\kr{-a}{p}g_1 = \kr{-1}{p}\kr{a}{p}^2 g_1^2 = (-1)^{(p-1)/2} g_1^2,
$$
where the last step follows from Proposition~\ref{prop:euler} 
and that $\kr{a}{p}\in\{\pm 1\}$.  Thus
\begin{equation}\label{eq:gauss_sum1_1}
 \sum_{a=0}^{p-1} g_a g_{-a} = (p-1)(-1)^{(p-1)/2}g_1^2.
\end{equation}
On the other hand, by definition
\begin{align*}
  g_a g_{-a} &= \sum_{n=0}^{p-1} \kr{n}{p}\zeta^{an} \cdot \sum_{m=0}^{p-1}\kr{m}{p}\zeta^{-am}\\
             &= \sum_{n=0}^{p-1}\sum_{m=0}^{p-1} \kr{n}{p}\kr{m}{p}\zeta^{an}\zeta^{-am}\\
             &= \sum_{n=0}^{p-1}\sum_{m=0}^{p-1} \kr{n}{p}\kr{m}{p}\zeta^{an-am}.
\end{align*}
Let $\delta(n,m)=1$ if $n\con m\pmod{p}$ and $0$ otherwise.
By Lemma~\ref{lem:gauss_sum2},
\begin{align*}
 \sum_{a=0}^{p-1} g_a g_{-a} &= \sum_{a=0}^{p-1}\sum_{n=0}^{p-1}\sum_{m=0}^{p-1} \kr{n}{p}\kr{m}{p}\zeta^{an-am}\\
            &= \sum_{n=0}^{p-1}\sum_{m=0}^{p-1} \kr{n}{p}\kr{m}{p}\sum_{a=0}^{p-1}\zeta^{an-am}\\
            &= \sum_{n=0}^{p-1}\sum_{m=0}^{p-1} \kr{n}{p}\kr{m}{p}p\delta(n,m)\\
            &= \sum_{n=0}^{p-1}\kr{n}{p}^2 p \\
            &= p(p-1).
\end{align*}
Equate (\ref{eq:gauss_sum1_1}) and the above equality,
then cancel $(p-1)$ to see that
$$
g_1^2 =(-1)^{(p-1)/2} p.
$$
Since $a\not\con 0\pmod{p}$, we have $\kr{a}{p}^2=1$, so by Lemma~\ref{lem:gauss_sum4},
$$
g_a^2 = \kr{a}{p}^2 g_1^2 = g_1^2,
$$
and the proposition is proved.
\end{proof}

\subsection{Proof of Quadratic Reciprocity}
We are now ready to prove Theorem~\ref{thm:recip} using 
Gauss sums.
\begin{proof}
  Let~$q$ be an odd prime with $q\neq p$.  Set $p^* = (-1)^{(p-1)/2}p$
  and recall that Proposition~\ref{prop:gauss_sum1} asserts that $p^*
  = g^2$, 
  where $g = g_1 = \sum_{n=0}^{p-1} \kr{n}{p}\zeta^n$.
  
  Proposition~\ref{prop:euler} implies that
  $$
  (p^*)^{(q-1)/2} \con \kr{p^*}{q} \pmod{q}.
  $$
  We have $g^{q-1} = (g^2)^{(q-1)/2} = (p^*)^{(q-1)/2}$, so
  multiplying both sides of the displayed equation by~$g$ yields a
  congruence
\begin{equation}\label{eqn:recip1}
  g^q \con g \kr{p^*}{q} \pmod{q}.
\end{equation}

But wait, what does this congruence mean, given that $g^q$ is not an
integer?  It means that the difference
$g^q - g \kr{p^*}{q}$ lies in the ideal $(q)$ in the ring 
$\Z[\zeta]$ of all polynomials in $\zeta$ with coefficients
in~$\Z$.


The ring $\Z[\zeta]/(q)$ has characteristic $q$, so
if~$x, y\in\Z[\zeta]$, then $(x+y)^q \con x^q + y^q \pmod{q}$.  
Applying this to (\ref{eqn:recip1}), we see that
$$
g^q = \left(\sum_{n=0}^{p-1} \kr{n}{p}\zeta^n \right)^q \con \sum_{n=0}^{p-1} \kr{n}{p}^q \zeta^{nq} \con \sum_{n=0}^{p-1} \kr{n}{p} \zeta^{nq} \con g_q\pmod{q}.
$$
By Lemma~\ref{lem:gauss_sum4},
$$
g^q \con g_q \con \kr{q}{p} g\pmod{q}.
$$
Combining this with (\ref{eqn:recip1}) yields
$$
\kr{q}{p} g \con \kr{p^*}{q}g \pmod{q}.
$$
Since $g^2 = p^*$ and $p\neq q$, we can cancel~$g$ from both sides
to find that $\kr{q}{p} \con \kr{p^*}{q} \pmod{q}$.  Since both
residue symbols are $\pm 1$ and~$q$ is odd, it follows that $\kr{q}{p}
= \kr{p^*}{q}$.  
Finally, we note using Proposition~\ref{prop:euler}
that
\begin{align*}
\kr{p^*}{q} &= \kr{(-1)^{(p-1)/2}p}{q}
        = \kr{-1}{q}^{(p-1)/2} \kr{p}{q} 
        = \left(-1\right)^{\frac{q-1}{2}\cdot \frac{p-1}{2}} \cdot \kr{p}{q}.
\end{align*}
\end{proof}

\section{Finding Square Roots}\label{sec:findingsqrt}
\index{square roots!how to find mod $p$|(}\index{compute!square roots mod $p$|(}
\todo{something about schoof polynomial time algo!!!}
We return in this section to the question of computing square roots.
If $K$ is a field in which $2\neq 0$, and $a,b,c\in K$, with $a\neq 0$, 
then
the solutions to the quadratic equation $ax^2+bx+c=0$ are
$$
x = \frac{-b\pm \sqrt{b^2-4ac}}{2a}.
$$
Now assume $K=\zmod{p}$, with~$p$ an odd prime.  Using
Theorem~\ref{thm:recip}, we can decide whether or not $b^2-4ac$ is a
perfect square in $\zmod{p}$, and hence whether or not $ax^2 + bx+c=0$
has a solution in $\zmod{p}$.  However
Theorem~\ref{thm:recip} says nothing about how to actually find 
a solution when there is one. 
Also, note that for this problem we do {\em not} need the
full quadratic reciprocity law; in practice to 
decide whether an element of $\zmod{p}$ is
a perfect square Proposition~\ref{prop:euler} is quite fast, 
in view of Section~\ref{sec:arith_mod_n}.

Suppose $a\in \zmod{p}$ is a nonzero quadratic residue.
If $p\con 3 \pmod{4}$ then $b=a^{\frac{p+1}{4}}$
is a square root of~$a$ because
$$
  b^2 = a^{\frac{p+1}{2}} = a^{\frac{p-1}{2} + 1} 
     = a^{\frac{p-1}{2}} \cdot a
          = \kr{a}{p} \cdot a = a.
$$
We can compute~$b$ in time polynomial in the number of digits of~$p$
using the powering algorithm of Section~\ref{sec:arith_mod_n}.


We do not know a deterministic polynomial-time
algorithm to compute a square root of~$a$ when $p\con 1\pmod{4}$.  The
following is a standard probabilistic algorithm to
compute a square root of~$a$, which works well in practice.  
Consider the quotient ring
$$R = (\zmod{p})[x]/(x^2 - a),$$ 
by which we mean the following.
We have
$$
R = \{ u + v \alpha : u, v \in \zmod{p}\}
$$
with multiplication defined by
$$
(u+v\alpha)(z+w\alpha) = (uz + awv) + (uw+vz)\alpha.
$$ 
Here $\alpha$ corresponds to the class of $x$ in the quotient ring.
Let $b$ and~$c$ be the square roots of~$a$ in $\zmod{p}$
(though we cannot easily
compute~$b$ and~$c$ yet, we can consider them in order
to deduce an algorithm to find them).
We have ring homomorphisms
$f:R\to \zmod{p}$ and $g:R\to \zmod{p}$
given by $f(u+v\alpha) = u+vb$ and $g(u+v\alpha) = u + vc$.
Together these define a ring isomorphism
$$
  \vphi : R \lra \zmod{p} \cross \zmod{p}
$$
given by $\vphi(u+v\alpha) = (u+vb,u+vc)$.
Choose in some way a random element~$z$ of $(\zmod{p})^*$, and
define $u,v\in\zmod{p}$ by
$$
u+v\alpha = (1+z\alpha)^{\frac{p-1}{2}},
$$
where we compute $(1+z\alpha)^{\frac{p-1}{2}}$ quickly
using an analogue of the 
binary powering algorithm of Section~\ref{sec:compute_powers}.
If $v=0$ we try again with another random~$z$.  If $v\neq 0$ we can
quickly find the desired square roots~$b$ and~$c$ as follows.  The
quantity $u+vb$ is a $(p-1)/2$ power in $\zmod{p}$, so it equals
either $0$, $1$, or $-1$, so $b = -u/v$, $(1-u)/v$, or $(-1-u)/v$,
respectively.  Since we know~$u$ and~$v$ we can try each of $-u/v$,
$(1-u)/v$, and $(-1-u)/v$ and see which is a square root of~$a$.

We implement this algorithm in Section~\ref{sec:comp_sqrt}.

\begin{example}\label{ex:69sqrt}
Continuing Example~\ref{ex:69}, 
we find a square root of~$69$ modulo~$389$.
We apply the algorithm described above in the case $p\con 1\pmod{4}$.
We first choose the random $z=24$ and find that
$
 (1+24\alpha)^{194} = -1.
$
The coefficient of~$\alpha$ in the power is~$0$, and we try again with
$z=51$.
This time we have $(1+51\alpha)^{194} = 239\alpha = u +v\alpha$.
The inverse of $239$ in $\zmod{389}$ is $153$, so we consider the
following three possibilities for a square root of~$69$:
$$
  -\frac{u}{v} = 0 \qquad
  \frac{1-u}{v} = 153\qquad
  -\frac{1-u}{v} = -153.
$$
Thus $153$ and $-153$ are the square roots of $69$ in $\zmod{389}$.
\end{example}

\index{square roots!how to find mod $p$|)}\index{compute!square roots mod $p$|)}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%




\begin{exercises}
\item\label{ex:rec1} Calculate the following by hand:
  $\kr{3}{97}$, $\kr{3}{389}$, $\kr{22}{11}$, and $\kr{5!}{7}$.
  
\item\label{ex:rec2} Use Theorem~\ref{thm:recip} 
to show that for $p\geq 5$ prime,
  $$ \kr{3}{p} = \begin{cases} \hfill 1 & \text{ if }p\con 1, 11\pmod{12},\\
    -1 & \text{ if }p\con 5, 7\pmod{12}.  \end{cases}$$
  
\item\label{ex:rec5}(*) Use that $(\zmod{p})^*$ is cyclic to give a
  direct proof that $\kr{-3}{p}=1$ when $p\con 1\pmod{3}$. (Hint:
  There is an $c\in (\zmod{p})^*$ of order~$3$.  Show that
  $(2c+1)^2=-3$.)
  
\item\label{ex:rec6}(*) If $p\con 1\pmod{5}$, show directly that
  $\kr{5}{p}=1$ by the method of \exref{ch:reciprocity}{ex:rec5}.
  (Hint: Let $c\in(\zmod{p})^*$ be an element of order~$5$.  Show that
  $(c+c^4)^2+(c+c^4)-1=0$, etc.)
  
%\item\label{ex:rec7} For which odd primes~$p$ is $\ds \sum_{a=1}^{p-1}
%  \kr{a}{p}=0$?
  
\item\label{ex:rec8} (*) Let $p$ be an odd prime. In this exercise you
  will prove that $\kr{2}{p}=1$ if and only if $p\con
  \pm 1\pmod{8}$.
\begin{enumerate}
\item Prove that 
$$
  x = \frac{1-t^2}{1+t^2}, \qquad y = \frac{2t}{1+t^2}
$$
is a parameterization of the set of solutions to $x^2+y^2\con 1\pmod{p}$,
in the sense that the solutions $(x,y)\in\zmod{p}$ are in 
bijection with the $t\in \zmod{p} \union\{\infty\}$ such that $1+t^2\not\con 0\pmod{p}$.
Here $t=\infty$ corresponds to the point $(-1,0)$.
(Hint: if $(x_1,y_1)$ is a solution, consider the line $y=t(x+1)$
through $(x_1,y_1)$ and $(-1,0)$, and solve for $x_1, y_1$ in terms
of $t$.)
\item Prove that the number of solutions to $x^2+y^2\con 1\pmod{p}$
is $p+1$ if $p\con 3\pmod{4}$ and $p-1$ if $p\con 1\pmod{4}$.
\item Consider the set $S$ of pairs $(a,b)\in (\zmod{p})^*\times (\zmod{p})^*$ such
that $a+b=1$ and $\kr{a}{p}=\kr{b}{p}=1$.  Prove that
$\#S=(p+1-4)/4$ if $p\con 3\pmod{4}$ and $\#S = (p-1-4)/4$
if $p\con 1\pmod{4}$.  Conclude that $\#S$ is odd if and only if
$p\con \pm 1\pmod{8}$
\item The map $\sigma(a,b)=(b,a)$ that swaps coordinates is a
  bijection of the set $S$. It has exactly one fixed point if and
  only if there is an $a\in\zmod{p}$ such that $2a=1$ and $\kr{a}{p}=1$.
  Also, prove that $2a=1$ has a solution $a\in\zmod{p}$ with $\kr{a}{p}=1$
if and only if $\kr{2}{p}=1$.
\item Finish by showing that $\sigma$ has exactly one fixed point
if and only if $\#S$ is odd, i.e., if and only if
$p\con \pm 1\pmod{8}$.
\end{enumerate}
Remark: The method of proof of this exercise can be generalized to give a
proof of the full quadratic reciprocity law.

\item\label{ex:rec9} How many natural numbers $x < 2^{13}$ satisfy the
  equation
  $$
  x^2\con 5\pmod{2^{13}-1}? $$
  You may assume that $2^{13}-1$ is prime.
  
\item\label{ex:rec10} Find the natural number $x<97$ such that $x\con
  4^{48}\pmod{97}$.  Note that $97$ is prime.


\item\label{ex:rec13} In this problem we will formulate an analogue of
  quadratic reciprocity for a symbol like $\kr{a}{q}$, but without the
  restriction that~$q$ be a prime.  Suppose $n$ is a positive integer,
  which we factor as $\prod_{i=1}^k p_i^{e_i}$.  We
  define the Jacobi symbol $\kr{a}{n}$ as follows:
  $$
  \kr{a}{n} = \prod_{i=1}^k \kr{a}{p_i}^{e_i}.
  $$
\begin{enumerate}
\item Give an example to show that $\kr{a}{n}=1$ need not imply that
  $a$ is a perfect square modulo $n$.
\item (*) Let $n$ be odd and $a$ and $b$ be integers.  Prove that the
  following holds:
\begin{enumerate}
\item $\kr{a}{n}\kr{b}{n} = \kr{ab}{n}$. (Thus $a\mapsto \kr{a}{n}$
  induces a homomorphism from $(\zmod{n})^*$ to $\{\pm 1\}$.)
\item $\kr{-1}{n} \con n \pmod{4}$.
\item $\kr{2}{n}=1$ if $n\con \pm 1\pmod{8}$ and $-1$ otherwise.
\item $\kr{a}{n} = (-1)^{\frac{a-1}{2} \cdot \frac{n-1}{2}}
  \kr{n}{a}$
\end{enumerate}
\end{enumerate}

\item\label{ex:rec14}(*) Prove that for any $n\in\Z$ the integer
  $n^2+n+1$ does not have any divisors of the form $6k-1$.  

\end{exercises}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%  
%% Chapter: Continued Fractions
%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\chapter{Continued Fractions}\label{ch:contfrac}
A \defn{continued fraction}\index{continued fraction|(}
is an expression of the form
$$
  a_0 + \frac{1}{\ds a_1+\frac{1}{\ds a_2+\frac{1}{\ds a_3+\cdots.}}}
$$

In this book we will assume that the $a_i$ are real numbers and
$a_i>0$ for $i\geq 1$, and the expression may or may not go on
indefinitely.  More general notions of continued fractions have been
extensively studied, but they are beyond the scope of this book.  
We will be most interested in the case when the $a_i$ are all
integers.   

We denote the continued fraction displayed above by
$$
  [a_0,a_1,a_2,\ldots].
$$
For example,
$$[1,2] = 1+\frac{1}{2} = \frac{3}{2},$$
\begin{align*}
[3, 7, 15, 1, 292 ] &= 3 + \frac{1}{\ds 7+ \frac{1}{\ds 15+\frac{1}{\ds 1+\frac{1}{292}}}}\\
 &= \frac{103993}{33102}=3.14159265301190260407\ldots,
\end{align*}
and
\begin{align*}
[2, 1, 2, 1, 1, 4, 1, 1, 6] &= 
  2 + \frac{1}{\ds 1 +\frac{1}{\ds 2 +\frac{1}{\ds 1 + \frac{1}{\ds 1 + \frac{1}{\ds 4 + \frac{1}{\ds 1 + \frac{1}{\ds 1 + \frac{1}{\ds 6}}}}}}}} \\
  &= \frac{1264}{465} \\
  &= 2.7182795698924731182795698\ldots
\end{align*}
The second two examples were chosen to foreshadow that continued
fractions can be used to obtain good rational approximations to
irrational numbers.  Note that the first approximates~$\pi$ and the second~$e$.

Continued fractions have many applications.  For example, they 
 provide an algorithmic way to recognize a decimal
approximation to a rational number.  Continued fractions also suggest
a sense in which~$e$ might be ``less complicated'' than~$\pi$ (see
Example~\ref{ex:e_and_pi} and Section~\ref{sec:contfrac_e}).

In Section~\ref{sec:finitecontfrac} we study continued fractions
$[a_0,a_1,\ldots,a_n]$ of finite length and lay the foundations for
our later investigations.  In Section~\ref{sec:cfinfty} we give the
continued fraction procedure, which associates to a real number~$x$ a
sequence $a_0,a_1,\ldots$ of integers such that $x = \lim_{n\ra\infty}
[a_0,a_1,\ldots,a_n]$.  We also prove that if $a_0,a_1,\ldots$ is any
infinite sequence of positive integers, then the sequence
$c_n=[a_0,a_1,\ldots,a_n]$ converges; more generally, we prove that if
the $a_n$ are arbitrary positive real numbers and $\sum_{n=0}^{\infty}
a_n$ diverges then $(c_n)$ converges.  In Section~\ref{sec:cfqi}, we
prove that a continued fraction with $a_i\in\N$ is (eventually)
periodic if and only if its value is a non-rational root of a
quadratic polynomial, then discuss open questions concerning continued
fractions of roots of irreducible polynomials of degree greater
than~$2$.  We conclude the chapter with applications of continued
fractions to recognizing approximations to rational numbers
(Section~\ref{sec:cf_rat}) and writing integers as sums
of two squares (Section~\ref{sec:sumsqr}).

The reader is encouraged to read more about continued fractions
in \cite[Ch.~X]{hardywright}, \cite{khintchine}, 
\cite[\S13.3]{burton}, and \cite[Ch.~7]{niven-zuckerman-montgomery}.


\section{Finite Continued Fractions}\label{sec:finitecontfrac}
This section is about continued fractions of
the form $[a_0,a_1,\ldots, a_m]$ for some $m\geq 0$.
We give an inductive definition of numbers $p_n$ and $q_n$ 
such that for all $n\leq m$
\begin{equation}\label{eqn:quocontfrac}
  [a_0,a_1,\ldots,a_n] = \frac{p_n}{q_n}.
\end{equation}
We then give related formulas for 
the determinants of the $2\times 2$
matrices $\abcd{p_n}{p_{n-1}}{q_n}{q_{n-1}}$ and
$\abcd{p_n}{p_{n-2}}{q_n}{q_{n-2}}$.  which we will repeatedly use to
deduce properties of the sequence of partial convergents
$[a_0,\ldots,a_k]$.  
We will use Algorithm~\ref{alg:gcd} to prove that every
rational number is represented by a continued fraction, as in
(\ref{eqn:quocontfrac}).

\begin{definition}[Finite Continued Fraction]
\index{continued fraction!of finite length|nn}\index{finite continued fraction|nn}
A \defn{finite continued fraction} is an expression
$$ 
    a_0 + \frac{1}{\ds a_1+\frac{1}{\ds a_2 + 
         \ds \frac{1}{ \cdots +\frac{1}{a_n}}}},
$$
where each $a_m$ is a real number and $a_m>0$ for all $m\geq 1$.
\end{definition}

\begin{definition}[Simple Continued Fraction]
A \defn{simple continued fraction} is a finite or infinite continued
fraction in which the $a_i$ are all integers.
\end{definition}

To get a feeling for continued fractions, observe that 
\begin{align*}
[a_0] &= a_0,\\
[a_0, a_1] &= a_0 + \frac{1}{a_1} = \frac{a_0 a_1 + 1}{a_1},\\
[a_0, a_1, a_2] &= a_0 + \frac{1}{a_1 +\ds \frac{1}{a_2}}
            = \frac{a_0 a_1 a_2 + a_0 + a_2}{a_1 a_2 + 1}.
\end{align*}
Also, 
\begin{align*}
  [a_0, a_1, \ldots ,a_{n-1}, a_n] &= 
          \left[a_0, a_1, \ldots, a_{n-2}, a_{n-1} + \frac{1}{a_n}\right]\\
        &= a_0 + \frac{1}{[a_1,\ldots, a_n]} \\
        &= [a_0, [a_1,\ldots, a_n]].
\end{align*}
\subsection{Partial Convergents}\label{sec:partconv}
\index{partial convergents|nn}\index{continued fraction!partial convergents of|nn}%
Fix a finite continued fraction $[a_0,\ldots,a_m]$.  We do not assume
at this point that the $a_i$ are integers.

\begin{definition}[Partial convergents]
For $0\leq n\leq m$, the $n$th \defn{convergent} of the 
continued fraction $[a_0,\ldots,a_m]$
is $[a_0,\ldots, a_n]$.  These convergents for $n<m$ are
also called \defn{partial convergents}.
\end{definition}

For each $n$ with $-2\leq n\leq m$, 
define real numbers $p_n$ and $q_n$ as follows:
$$\begin{array}{lllcl}
  p_{-2}=0, & \quad p_{-1} = 1, & \quad  p_0 = a_0,\quad
                &\cdots &\,\,p_n = a_n p_{n-1} + p_{n-2} \quad \cdots,\\
  q_{-2}=1, & \quad q_{-1} = 0, &\quad q_0 = 1, \quad 
                &\cdots &\,\,q_n = a_n q_{n-1} + q_{n-2} \quad \cdots.
\end{array}
$$

\begin{proposition}[Partial Convergents]\label{prop:convergents}%
\iprop{partial convergents}
For $n\geq 0$ we have $$ [a_0, \ldots, a_n] = \frac{p_n}{q_n}.$$
\end{proposition}
\begin{proof}
We use induction.  The assertion is obvious when $n=0,1$.  Suppose the
proposition is true for all continued fractions of length $n-1$.  Then
\begin{align*}
[a_0,\ldots, a_n]
 &= [a_0,\ldots,a_{n-2}, a_{n-1} + \frac{1}{a_n}]\\
 &= \frac{\left( a_{n-1} + \frac{1}{a_n}\right) p_{n-2} + p_{n-3}}
         {\left( a_{n-1} + \frac{1}{a_n}\right) q_{n-2} + q_{n-3}}\\
 &= \frac{(a_{n-1}a_n +1)p_{n-2} + a_n p_{n-3}}
         {(a_{n-1}a_n +1)q_{n-2} + a_n q_{n-3}}\\
 &= \frac{a_n(a_{n-1}p_{n-2} + p_{n-3}) + p_{n-2}}
         {a_n(a_{n-1}q_{n-2} + q_{n-3}) + q_{n-2}}\\
 &= \frac{a_n p_{n-1} + p_{n-2}}{a_n q_{n-1} + q_{n-2}}\\
 &= \frac{p_n}{q_n}.
\end{align*}
\end{proof}

\begin{proposition}\label{prop:dets}
For $n\geq 0$ we have
\begin{equation}\label{eqn:detsign}
p_n q_{n-1} - q_n p_{n-1} = (-1)^{n-1}
\end{equation}
and 
\begin{equation}\label{eqn:detsignan}
p_nq_{n-2} - q_n p_{n-2} = (-1)^n a_n.
\end{equation}
Equivalently,
$$\frac{p_n}{q_n} - \frac{p_{n-1}}{q_{n-1}} = 
                  (-1)^{n-1}\cdot\frac{1}{q_n q_{n-1}}$$
and 
$$\frac{p_n}{q_n} - \frac{p_{n-2}}{q_{n-2}} = 
                  (-1)^{n}\cdot\frac{a_n}{q_n q_{n-2}}.$$
\end{proposition}
\begin{proof}
The case for $n=0$ is obvious from the definitions.
Now suppose $n>0$ and the statement is true for $n-1$.  Then 
\begin{align*}
p_{n}q_{n-1} - q_n p_{n-1} &= 
     (a_n p_{n-1} + p_{n-2}) q_{n-1} - (a_n q_{n-1} + q_{n-2}) p_{n-1}\\
  &= p_{n-2}q_{n-1} - q_{n-2} p_{n-1} \\
   &= 
       -(p_{n-1}q_{n-2} - p_{n-2} q_{n-1})\\
  &= -(-1)^{n-2} = (-1)^{n-1}.
\end{align*}
This completes the proof of (\ref{eqn:detsign}).  For 
(\ref{eqn:detsignan}), we have
\begin{align*}
p_n q_{n-2} - p_{n-2} q_n &=  
        (a_n p_{n-1} + p_{n-2})q_{n-2} - p_{n-2}(a_n q_{n-1} + q_{n-2}) \\
       &= a_n(p_{n-1}q_{n-2} - p_{n-2}q_{n-1}) \\
       &= (-1)^n a_n.
\end{align*}
\end{proof}

\begin{remark}
Expressed in terms of matrices, the proposition asserts that the determinant 
of  $\abcd{p_n}{p_{n-1}}{q_n}{q_{n-1}}$ is 
$(-1)^{n-1}$, and of 
$\abcd{p_n}{p_{n-2}}{q_n}{q_{n-2}}$ is  $(-1)^{n}a_n$.
\end{remark}

\begin{corollary}[Convergents in lowest terms]\icor{convergents in lowest terms}
If $[a_0,a_1,\ldots,a_m]$ is a simple continued fraction,
so each $a_i$ is an integer, 
then the $p_n$ and $q_n$ are integers and 
the fraction $p_n/q_n$ is in lowest terms.
\end{corollary}
\begin{proof}
  It is clear that the $p_n$ and $q_n$ are integers, from the formula
  that defines them.  If~$d$ is a positive divisor of both $p_n$ and
  $q_n$, then $d\mid (-1)^{n-1}$, so $d=1$.  
\end{proof}

\subsection{The Sequence of Partial Convergents}\index{convergents!partial}
\index{continued fraction!convergents}
Let $[a_0,\ldots, a_m]$ be a continued fraction and for
$n\leq m$ let 
$$
  c_n = [a_0, \ldots, a_n] = \frac{p_n}{q_n}
$$
denote the $n$th convergent.  Recall that by definition of continued
fraction, $a_n>0$ for $n>0$, which gives the partial convergents of a
continued fraction additional structure.  For example, the partial
convergents of $[2, 1, 2, 1, 1, 4, 1, 1, 6]$ are
$$
2, 3, 8/3, 11/4, 19/7, 87/32, 106/39, 193/71, 1264/465.
$$
To make the size of these numbers clearer, we approximate
them using decimals.  We also underline every other number,
to illustrate some extra structure.
$$
 \underline{2}, 3,  \underline{2.66667}, 2.75000,  \underline{2.71429}, 
2.71875,  \underline{2.71795}, 2.71831,  \underline{2.71828}
$$
The underlined numbers are smaller than all of the
non-underlined numbers, and the sequence of underlined numbers is
strictly increasing, whereas the non-underlined numbers strictly
decrease.  We next prove that this extra structure is a general
phenomenon.

\begin{proposition}[How convergents converge]\label{prop:conv_incdec}%
\iprop{how convergents converge}%
The even indexed convergents $c_{2n}$ increase strictly with~$n$, and the
odd indexed convergents $c_{2n+1}$ decrease strictly with~$n$.  Also,
the odd indexed convergents $c_{2n+1}$ are greater than all of the
even indexed convergents $c_{2m}$.
\end{proposition}
\begin{proof}
The $a_n$ are positive for $n\geq 1$, so the $q_n$ are positive.
By Proposition~\ref{prop:dets}, for $n\geq 2$, 
$$c_n - c_{n-2} = (-1)^n \cdot \frac{a_n}{q_n q_{n-2} },$$
which proves the first claim.

Suppose for the sake of contradiction that there exist
integers $r, m$ such that $c_{2m+1} < c_{2r}$.
Proposition~\ref{prop:dets} implies that for $n\geq 1$,
$$
c_n - c_{n-1} = (-1)^{n-1}\cdot \frac{1}{q_n q_{n-1}}
$$
has sign $(-1)^{n-1}$, so for all $s\geq 0$ we have $c_{2s+1} >
c_{2s}$.  Thus it is impossible that $r= m$.  If $r<m$, then by
what we proved in the first paragraph,
$c_{2m+1} < c_{2r} < c_{2m}$, a contradiction (with $s=m$).  If $r>m$, then
$c_{2r+1} < c_{2m+1} < c_{2r}$, which is also a contradiction (with $s=r$).
\end{proof}


\subsection{Every Rational Number is Represented}
\index{continued fraction!every rational number has}
\begin{proposition}[Rational continued fractions]%
\label{prop:ratcf}\iprop{rational continued fractions}%
  Every nonzero rational number can be represented by a simple
  continued fraction.  
\end{proposition}
\begin{proof}
Without loss of generality we may assume that the rational
number is $a/b$, with $b\geq 1$ and $\gcd(a,b)=1$.  
Algorithm~\ref{alg:gcd} gives:
\begin{align*}
a &= b\cdot a_0 + r_1, & 0<r_1<b\\
b &= r_1\cdot a_1 + r_2, & 0<r_2<r_1\\
 &\cdots &\\
r_{n-2} &= r_{n-1}\cdot a_{n-1} + r_n, & 0<r_n < r_{n-1}\\
r_{n-1} &= r_n\cdot a_n + 0.
\end{align*}
Note that $a_i>0$ for $i>0$ (also $r_n=1$ since $\gcd(a,b)=1$).
Rewrite the equations as follows:
\begin{align*}
a/b &= a_0 + r_1/b = a_0 + 1/(b/r_1),\\
b/r_1 &= a_1 + r_2 / r_1 = a_1 + 1/(r_1/r_2),\\
r_1/r_2 &= a_2 + r_3 / r_2 = a_2 + 1/(r_2/r_3),\\
\cdots\\
r_{n-1}/r_n &= a_n.
\end{align*}
It follows that 
$$
   \frac{a}{b} = [a_0,a_1,\ldots, a_n].
$$
\end{proof}

The proof of Proposition~\ref{prop:ratcf} leads to an algorithm
for computing the continued fraction of a rational number.
See Section~\ref{sec:comp_contfrac} for an implementation.

A nonzero rational number can be represented in exactly two ways;
for example, $2=[1,1] = [2]$ (see \exref{ch:contfrac}{ex:cf3b}).


\section{Infinite Continued Fractions}\label{sec:cfinfty}
\index{compute!continued fraction}
This section begins with the continued fraction procedure, which associates
to a real number~$x$ a sequence $a_0,a_1,\ldots$ of integers.  After
giving several examples, we prove that $x = \lim_{n\ra\infty}
[a_0,a_1,\ldots,a_n]$ by proving that the odd and even partial
convergents become arbitrarily close to each other.
We also show that if $a_0,a_1,\ldots$ is any infinite
sequence of positive integers, then the sequence of 
$c_n=[a_0,a_1,\ldots,a_n]$
converges, and, more generally, if $a_n$ is an arbitrary sequence
of positive reals 
such that $\sum_{n=0}^{\infty} a_n$ diverges then $(c_n)$ converges.

\subsection{The Continued Fraction Procedure}
\index{continued fraction!algorithm}\label{sec:cfalg}
Let $x\in\R$ and write
  $$x = a_0 + t_0$$
with $a_0\in\Z$ and $0\leq t_0 < 1$.  
We call the number $a_0$ the \defn{floor} of~$x$, and
we also sometimes write $a_0 = \lfloor x \rfloor$.
If $t_0\neq 0$, write
$$\frac{1}{t_0} = a_1 + t_1$$ with $a_1\in\N$ and $0\leq t_1 < 1$.
Thus $t_0 = \frac{1}{a_1 + t_1}=[0,a_1+t_1]$, which is a (non-simple)
continued fraction expansion of $t_0$.  Continue in this manner
so long as $t_n\neq 0$ writing
$$\frac{1}{t_n} = a_{n+1} + t_{n+1}$$
with $a_{n+1}\in\N$ and $0\leq t_{n+1}<1$.
We call this procedure, which associates to a real number~$x$ the sequence
of integers $a_0, a_1, a_2, \ldots $, the
\defn{continued fraction process}.
We implement it in on a computer in Section~\ref{sec:comp_contfrac}.

\begin{example}
Let $x=\frac{8}{3}$.  Then $x=2+\frac{2}{3}$, so 
$a_0=2$ and $t_0=\frac{2}{3}$.  Then
$\frac{1}{t_0}=\frac{3}{2} = 1+\frac{1}{2}$, so $a_1=1$ and $t_1=\frac{1}{2}$.
Then $\frac{1}{t_1} = 2$, so $a_2=2$, $t_2=0$, and the sequence terminates.
Notice that 
$$ \frac{8}{3} = [2,1,2],$$
so the continued fraction procedure produces the
continued fraction of $\frac{8}{3}$.
\end{example}



\begin{example}
Let $x = \frac{1+\sqrt{5}}{2}.$  Then 
$$
   x = 1 + \frac{-1 + \sqrt{5}}{2},
$$
so $a_0 = 1$ and $t_0 = \frac{-1+\sqrt{5}}{2}$.
We have
$$
  \frac{1}{t_0} = \frac{2}{-1+\sqrt{5}} = \frac{-2-2\sqrt{5}}{-4}
        = \frac{1+\sqrt{5}}{2}
$$
so again $a_1 = 1$ and $t_1 =  \frac{-1+\sqrt{5}}{2}$.
Likewise, $a_n = 1$ for all~$n$.
As we will see below, the following exciting
equality makes sense.
$$\frac{1+\sqrt{5}}{2} = 
1 + \frac{1}{\ds 1 + \frac{1}{\ds 1 + \frac{1}{\ds 1 + \frac{1}{\ds 1 + \frac{1}{\ds 1 + \cdots}}}}}
$$
\end{example}

\begin{example}\label{ex:e_and_pi}\index{continued fraction!of $e$}
Suppose $x = e = 2.71828182\ldots$.  Using the continued
fraction procedure, we find that
$$
 a_0, a_1, a_2, \ldots = 2,1,2,1,1,4,1,1,6,1,1,8,1,1,10,\ldots
$$
For example, 
$a_0=2$ is the floor of $2$.  Subtracting $2$ and inverting,
we obtain
$1/0.718\ldots  = 1.3922\ldots$, so $a_1=1$.  Subtracting $1$
and inverting yields $1/0.3922\ldots = 2.5496\ldots$, so 
$a_2=2$.  We will prove in Section~\ref{sec:contfrac_e} that the 
continued fraction of~$e$ obeys a simple pattern.

The $5$th partial convergent of the continued fraction of~$e$ is 
$$
[a_0,a_1,a_2,a_3,a_4,a_5] = \frac{87}{32} = 2.71875,
$$
which is a good rational approximation to~$e$, in the
sense that $$\abs{\frac{87}{32} - e} = 0.000468\ldots.$$
Note that $0.000468\ldots < 1/32^2 = 0.000976\ldots$, which illustrates
the bound in Corollary~\ref{cor:cfconv} below.

Let's do the same thing with $\pi=3.14159265358979\ldots$:
Applying the continued fraction procedure, we find that
the continued fraction of $\pi$ is 
$$
 a_0, a_1, a_2, \ldots  = 3, 7, 15, 1, 292, 1, 1, 1, 2, 1, 
3, 1, 14,\ldots$$
The first few partial convergents are
$$
3, \frac{22}{7}, \frac{333}{106}, \frac{355}{113}, 
  \frac{103993}{33102}, \cdots
$$
These are good
rational approximations to $\pi$; for example, 
$$
 \frac{103993}{33102} = 3.14159265301\ldots.
$$

Notice that the continued fraction of~$e$ exhibits a nice pattern (see
Section~\ref{sec:contfrac_e} for a proof), whereas the continued
fraction of~$\pi$ exhibits no pattern that is obvious to the author.
The continued fraction of $\pi$ has been extensively studied, and over
20 million terms have been computed.  The data suggests that every
integers appears infinitely often as a partial convergent.  For much
more about the continued fraction of~$\pi$ or of any other sequence
in this book, type the first few terms of the sequence  
into~\cite{sloane}.
\end{example}


\subsection{Convergence of Infinite Continued Fractions}

\begin{lemma}\label{lem:cf1}
For every $n$ such that $a_n$ is defined, we have
$$x = [a_0, a_1, \ldots, a_{n}+t_n],$$
and if $t_{n}\neq 0$ then
$
  x = [a_0, a_1, \ldots, a_{n}, \frac{1}{t_n}].
$
\end{lemma}
\begin{proof}
We use induction.  The statements are both true when $n=0$.
If the second statement is true for $n-1$, then
\begin{align*}
x &= \left[a_0,a_1, \ldots, a_{n-1},\frac{1}{t_{n-1}}\right]\\
  &=\left[a_0,a_1, \ldots, a_{n-1},a_n + t_n\right]\\
  &=\left[a_0,a_1, \ldots, a_{n-1},a_n, \frac{1}{t_n}\right].
\end{align*}
Similarly, the first statement is true for~$n$ if 
it is true for $n-1$.
\end{proof}


\begin{theorem}[Continued Fraction Limit]
\label{thm:contfraclimexists}\ithm{continued fraction limit}
Let $a_0, a_1, \ldots $ be a sequence of integers 
such that $a_n > 0$ for all $n\geq 1$,
and for each $n\geq 0$, set
$c_n = [a_0, a_1, \ldots a_n].$
Then $\ds\lim_{n\ra \infty} c_n$ exists.
\end{theorem}
\begin{proof}
  For any $m\geq n$, the number $c_n$ is a partial convergent of
  $[a_0, \ldots, a_m]$.  By Proposition~\ref{prop:conv_incdec} the
  even convergents $c_{2n}$ form a strictly {\em increasing} sequence
  and the odd convergents $c_{2n+1}$ form a strictly {\em decreasing}
  sequence. Moreover, the even convergents are all $\leq c_1$ and the
  odd convergents are all $\geq c_0$.  Hence $\alpha_0 = \lim_{n\ra
    \infty} c_{2n}$ and $\alpha_1 = \lim_{n\ra \infty} c_{2n+1}$ both
  exist and $\alpha_0\leq \alpha_1$.  Finally, by
  Proposition~\ref{prop:dets}
  $$
  |c_{2n} - c_{2n-1}| = \frac{1}{q_{2n}\cdot q_{2n-1}} \leq
  \frac{1}{2n(2n-1)} \ra 0,
   $$
   so $\alpha_0 = \alpha_1$.
\end{proof}

We define
$$
[a_0, a_1, \ldots ] = \lim_{n\ra \infty} c_n.
$$

\begin{example}
We illustrate the theorem with $x=\pi$.
As in the proof of Theorem~\ref{thm:contfraclimexists},
let $c_n$ be the $n$th partial convergent
to~$\pi$. The $c_n$ with~$n$ odd converge down to $\pi$
$$ c_1 = 3.1428571\ldots, \,c_3 = 3.1415929\ldots, \,c_5=3.1415926\ldots$$
whereas the $c_n$ with~$n$ even converge up to $\pi$
$$ c_2 = 3.1415094\ldots, \,c_4 = 3.1415926\ldots,\, c_6=3.1415926\ldots.$$
\end{example}

\begin{theorem}\label{thm:sumconv}\ithm{continued fraction convergence}
Let $a_0, a_1, a_2, \ldots $ be a sequence of real numbers 
such that $a_n > 0$ for all $n\geq 1$, and for each $n\geq 0$, set
$c_n = [a_0, a_1, \ldots a_n].$
Then $\ds\lim_{n\ra \infty} c_n$ exists if and only if the sum
$\sum_{n=0}^{\infty} a_n$ diverges.
\end{theorem}
\begin{proof}
  We only prove that if $\sum a_n$ diverges then $\lim_{n\ra\infty}
  c_n$ exists.  A proof of the converse can be found in
  \cite[Ch.~2, Thm.~6.1]{wall}.

Let $q_n$ be the sequence of ``denominators'' 
of the partial convergents, as defined in Section~\ref{sec:partconv},
so $q_{-2}=1$, $q_{-1}=0$, and for $n\geq 0$, 
$$
  q_n = a_n q_{n-1} + q_{n-2}.
$$
As we saw in the proof of Theorem~\ref{thm:contfraclimexists}, 
the limit $\lim_{n\ra\infty} c_n$ exists provided that 
the sequence $\{q_nq_{n-1}\}$ diverges to positive infinity.

For~$n$ even,
\begin{align*}
q_n &= a_n q_{n-1} + q_{n-2}\\
    &= a_n q_{n-1} + a_{n-2}q_{n-3} + q_{n-4}\\
    &= a_n q_{n-1} + a_{n-2}q_{n-3} + a_{n-4}q_{n-5} + q_{n-6} \\
    &= a_n q_{n-1} + a_{n-2}q_{n-3} + \cdots + a_2 q_{1} + q_0\\
\end{align*}
and for~$n$ odd,
$$
q_n =  a_n q_{n-1} + a_{n-2}q_{n-3} + \cdots + a_1 q_{0} + q_{-1}.
$$
Since $a_n>0$ for $n>0$, the sequence $\{q_n\}$ is increasing, so 
$q_i\geq 1$ for all $i\geq 0$.
Applying this fact to the above expressions for $q_n$, we see that 
for~$n$ even 
$$
 q_n \geq a_n + a_{n-2} + \cdots + a_2,
$$
and for~$n$ odd
$$
 q_n \geq a_n + a_{n-2} + \cdots + a_1.
$$

If $\sum a_n$ diverges, then at least one of 
$\sum a_{2n}$ or $\sum a_{2n+1}$ must diverge.  The
above inequalities then imply that  
at least one of the sequences 
$\{q_{2n}\}$ or $\{q_{2n+1}\}$ diverge to infinity.
Since $\{q_n\}$ is an increasing sequence, it follows
that $\{q_{n} q_{n-1}\}$ diverges to infinity.
\end{proof}

\begin{example}
  Let $a_n = \frac{1}{n\log(n)}$ for $n\geq 2$ and $a_0=a_1=0$.  By the
  integral test, $\sum a_n$ diverges, so by Theorem~\ref{thm:sumconv}
  the continued fraction $[a_0,a_1,a_2,\ldots]$ converges.
  This convergence is very slow, since, e.g.
  $$[a_0, a_1, \ldots, a_{9999}] = 0.5750039671012225425930\ldots$$
  yet
  $$[a_0, a_1, \ldots, a_{10000}] = 0.7169153932917378550424\ldots.$$
\end{example}


\begin{theorem}\label{thm:contfracdoesconv}
\ithm{continued fraction existence}
Let $x\in\R$ be a real number.  Then $x$ is the value
of the (possibly infinite) simple continued fraction
$
  [a_0, a_1, a_2, \ldots]
$
produced by the continued fraction procedure.
\end{theorem}
\begin{proof}
If the sequence is finite then some $t_n=0$ and the
result follows by Lemma~\ref{lem:cf1}.
Suppose the sequence is infinite. 
By Lemma~\ref{lem:cf1},
$$
  x = [a_0, a_1, \ldots, a_n, \frac{1}{t_n}].
$$
By Proposition~\ref{prop:convergents} (which we apply in a case when
the partial quotients of the continued fraction are not integers!),
we have
$$
  x = \frac{\ds\frac{1}{t_n} \cdot p_n + p_{n-1}}{\ds\frac{1}{t_n}\cdot q_n + q_{n-1}}.
$$
Thus if $c_n = [a_0, a_1, \ldots, a_n]$, then
\begin{align*}
x - c_n &= x - \frac{p_n}{q_n}\\
      &=\frac{\frac{1}{t_n} p_n q_n + p_{n-1} q_n - \frac{1}{t_n} p_n q_n - p_n q_{n-1}}
        {q_n \left(\frac{1}{t_n} q_n + q_{n-1}\right)}.\\
      &= \frac{p_{n-1} q_n - p_{n}q_{n-1}}{q_n\left(\frac{1}{t_n} q_n + q_{n-1}\right)} \\
      &= \frac{(-1)^n}{q_n\left(\frac{1}{t_n} q_n + q_{n-1}\right)}.
\end{align*}
Thus 
\begin{align*}
 |x - c_n| &= \frac{1}{q_n\left(\frac{1}{t_n} q_n + q_{n-1}\right)} \\
           &< \frac{1}{q_n(a_{n+1} q_n + q_{n-1})} \\
           &= \frac{1}{q_n \cdot q_{n+1}} \leq \frac{1}{n(n+1)} \ra 0.
\end{align*}
In the inequality we use that $a_{n+1}$ is the integer part of
$\frac{1}{t_n}$, and is hence $\leq \frac{1}{t_n}<1$, since $t_n<1$.
\end{proof}

This corollary follows from the proof of the above theorem.
\begin{corollary}[Convergence of continued fraction]\label{cor:cfconv}%
\iprop{convergence of continued fraction}%
Let $a_0,a_1,\ldots$ define a simple continued
fraction, and let $x=[a_0,a_1,\ldots]\in\R$ be its value.
Then for all~$m$,
$$
  \left| x - \frac{p_m}{q_m}\right|
  < \frac{1}{q_m \cdot q_{m+1}}.
$$
\end{corollary}

\begin{proposition}\label{prop:cfterm}
If~$x$ is a rational number then the sequence 
$a_0, a_1, \ldots $
produced by the continued fraction procedure\index{continued fraction
procedure} terminates.
\end{proposition}
\begin{proof}
Let $[b_0,b_1,\ldots, b_m]$ be the continued fraction representation
of~$x$ that we obtain using Algorithm~\ref{alg:gcd}, so the $b_i$
are the partial quotients at each step.
If $m=0$, then $x$ is an integer, so we may assume $m>0$.
Then 
$$
  x = b_0 + 1/[b_1,\ldots,b_m].
$$  
If $[b_1,\ldots,b_m]=1$ then $m=1$ and $b_1=1$,
which will not happen using Algorithm~\ref{alg:gcd}, since
it would give $[b_0+1]$ for the continued fraction of 
the integer $b_0+1$.
Thus $[b_1,\ldots,b_m]>1$, so in the continued fraction
algorithm we choose $a_0 = b_0$ and $t_0 = 1/[b_1, \ldots, b_m]$.
Repeating this argument enough times proves the claim.
\end{proof}


%%%%%%%%%%%%%%%%%%%%%% begin contfrac_e %%%%%%%%%%%%%%%%%%%%
\section{The Continued Fraction of $e$}\label{sec:contfrac_e}
\index{continued fraction!of $e$|nn} 

The continued fraction expansion of $e$ begins $[2, 1, 2, 1, 1, 4, 1,
1, 6, \ldots]$.  The obvious pattern in fact does continue, as
Euler\index{Euler} proved in 1737 (see \cite{euler:contfrac}), and we
will prove in this section.  As an application, Euler gave a proof
that~$e$ is irrational by noting that its continued fraction is
infinite.

The proof we give below draws heavily on the proof in
\cite{cohn:contfrac}, which describes a slight variant of a proof of
Hermite (see \cite{olds:contfrac}).  The continued fraction
representation of~$e$ is also treated in the German book
\cite{perron}, but the proof requires substantial background from
elsewhere in that text.

\subsection{Preliminaries}
First, we write the continued fraction of~$e$ in a slightly different
form. Instead of
$[2,1,2,1,1,4,\ldots],$ we can start the sequence of
coefficients $$
[1,0,1,1,2,1,1,4,\ldots]
$$
to make the pattern the same throughout. (Everywhere else in
this chapter we assume that the partial quotients $a_n$ for $n\geq 1$
are positive, but temporarily relax that
condition here and allow $a_1=0$.) The numerators and
denominators of the convergents given by this new sequence satisfy a
simple recurrence. Using $r_i$ as a stand-in for $p_i$ or $q_i$, we
have
\begin{align*}
r_{3n}&=r_{3n-1}+r_{3n-2}\\
r_{3n-1}&=r_{3n-2}+r_{3n-3}\\
r_{3n-2}&=2(n-1)r_{3n-3}+r_{3n-4}.
\end{align*}

Our first goal is to collapse these three recurrences into one
recurrence that only makes mention of $r_{3n}$, $r_{3n-3}$, and
$r_{3n-6}$. We have
\begin{align*}
r_{3n}&=r_{3n-1}+r_{3n-2}\\
&=(r_{3n-2}+r_{3n-3})+(2(n-1)r_{3n-3}+r_{3n-4})\\
&=(4n-3)r_{3n-3}+2r_{3n-4}.
\end{align*}
This same method of simplification also shows us that
$$ 
  r_{3n-3}=2r_{3n-7}+(4n-7)r_{3n-6}.
$$ 
To get rid of $2r_{3n-4}$ in the first equation, we make the
substitutions
\begin{align*}
2r_{3n-4}&=2(r_{3n-5}+r_{3n-6})\\
&=2((2(n-2)r_{3n-6}+r_{3n-7})+r_{3n-6})\\
&=(4n-6)r_{3n-6}+2r_{3n-7}.
\end{align*}
Substituting for $2r_{3n-4}$ and then $2r_{3n-7}$, we finally have the
needed collapsed recurrence,
$$
  r_{3n}=2(2n-1)r_{3n-3}+r_{3n-6}.
$$

\subsection{Two Integral Sequences}
We define the sequences $x_n=p_{3n}$, $y_n=q_{3n}$. Since the
$3n$-convergents will converge to the same real number that the
$n$-convergents do, $x_n/y_n$ also converges to the limit of the
continued fraction. Each sequence $\{x_n\}$, $\{y_n\}$ will obey the
recurrence relation derived in the previous section (where $z_n$ is a
stand-in for $x_n$ or $y_n$):
\begin{align}\label{relation}
   z_n=2(2n-1)z_{n-1}+z_{n-2} \text{, for all }n\geq2.
\end{align}

The two sequences can be found in Table~\ref{tab}. (The initial
conditions $x_0=1$, $x_1=3$, $y_0=y_1=1$ are taken straight from the
first few convergents of the original continued fraction.) Notice that
since we are skipping several convergents at each step, the ratio
$x_n/y_n$ converges to $e$ very quickly.
\begin{table}
\caption{Convergents\label{tab}}
\begin{center}
\begin{tabular}{|c|c|c|c|c|c|c|}\hline
\cline{2-7}
$n$&0&1&2&3&4&$\cdots$\\
\cline{2-7}
$x_n$&1&3&19&193&2721&$\cdots$\\
\cline{2-7}
$y_n$&1&1&7&71&1001&$\cdots$\\
\hline\hline
$x_n/y_n$&1&3&$2.714\ldots$&$2.71830\ldots$&$2.7182817\ldots$&$\cdots$\\
\cline{2-7}\hline
\end{tabular}
\end{center}
\end{table}

\subsection{A Related Sequence of Integrals}
Now, we define a sequence of real numbers $T_0, T_1, T_2, \ldots$ by the following integrals:

$$T_n=\int_{0}^{1}\frac{t^{n}(t-1)^{n}}{n!}\phantom{1} e^tdt.$$

Below, we compute the first two terms of this sequence
explicitly. (When we compute $T_1$, we are doing the integration by
parts $u=t(t-1)$, $dv=e^tdt$. Since the integral runs from 0 to 1, the
boundary condition is 0 when evaluated at each of the endpoints. This
vanishing will be helpful when we do the integral in the general
case.)
\begin{align*}
T_0&=\int_{0}^{1}e^tdt=e-1,\\
T_1&=\int_{0}^{1}t(t-1)e^tdt\\
&=-\int_{0}^{1}((t-1)+t)e^tdt\\
&=-(t-1)e^t\Bigg|_0^{1}-te^t\Bigg|_0^{1}+2\int_{0}^{1}e^tdt\\
&=1-e+2(e-1)=e-3.
\end{align*}

The reason that we defined this series now becomes apparent:
$T_0=y_0e-x_0$ and that $T_1=y_1e-x_1$. In general, it will be true
that $T_n=y_ne-x_n$. We will now prove this fact.

It is clear that if the $T_n$ were to satisfy the same recurrence that
the $x_i$ and $y_i$ do, in equation (\ref{relation}), then the above
statement holds by induction. (The initial conditions are correct, as
needed.) So we simplify $T_n$ by integrating by parts twice in
succession:
\begin{align*}
T_n&=\int_{0}^{1}\frac{t^{n}(t-1)^{n}}{n!}\phantom{1} e^tdt\\
&=-\int_{0}^{1}\frac{t^{n-1}(t-1)^{n}+t^{n}(t-1)^{n-1}}{(n-1)!}\phantom{1} e^tdt\\
&=\int_{0}^{1}\Bigl(\frac{t^{n-2}(t-1)^{n}}{(n-2)!}+n\frac{t^{n-1}(t-1)^{n-1}}{(n-1)!}\\
  & \qquad\qquad\qquad +  n\frac{t^{n-1}(t-1)^{n-1}}{(n-1)!}+\frac{t^{n}(t-1)^{n-2}}{(n-2)!}\Bigr)e^tdt\\
&=2nT_{n-1}+\int_{0}^{1}\frac{t^{n-2}(t-1)^{n-2}}{n-2!}(2t^2-2t+1)\phantom{1} e^tdt\\
&=2nT_{n-1}+2\int_{0}^{1}\frac{t^{n-1}(t-1)^{n-1}}{n-2!}\phantom{1} e^tdt+\int_{0}^{1}\frac{t^{n-2}(t-1)^{n-2}}{n-2!}\phantom{1} e^tdt\\
&=2nT_{n-1}+2(n-1)T_{n-1}+T_{n-2}\\
&=2(2n-1)T_{n-1}+T_{n-2},
\end{align*}
which is the desired recurrence.

Therefore $T_n=y_ne-x_n$. To conclude the proof, we consider the limit
as $n$ approaches infinity:
$$
  \lim_{n \to \infty}\int_{0}^{1}\frac{t^{n}(t-1)^{n}}{n!}\phantom{1} e^tdt=0,
$$
by inspection, and therefore
$$
  \lim_{n \to \infty}\frac{x_n}{y_n}=\lim_{n \to \infty}(e-\frac{T_n}{y_n})=e.
$$ 
Therefore, the ratio $x_n/y_n$ approaches $e$, and the continued
fraction expansion $[2,1,2,1,1,4,1,1,\ldots]$ does in fact converge to
$e$.

\subsection{Extensions of the Argument}
The method of proof of this section generalizes to show that
the continued fraction expansion of $e^{1/n}$ is
$$
  [1,\,(n-1),\,1,\,1,\,(3n-1),\,1,\,1,\,(5n-1),\,1,\,1,\,(7n-1),\ldots]
$$
for all $n \in \mathbb{N}$ (see \exref{ch:contfrac}{ex:contfrac_epow}).


%%%%%%%%%%%%%%%%%%%%%% end contfrac_e %%%%%%%%%%%%%%%%%%%%

\section{Quadratic Irrationals}\label{sec:cfqi}
\index{continued fraction!of quadratic irrational}
\index{quadratic irrational!continued fraction of}
The main result of this section is that the continued fraction
expansion of a number is eventually repeating if and only if the
number is a quadratic irrational.  This can be viewed as an analogue
for continued fractions of the familiar fact that the decimal
expansion of~$x$ is eventually repeating if and only if~$x$ is
rational.  The proof that continued fractions of quadratic irrationals
eventually repeats is surprisingly difficult and involves an
interesting finiteness argument.  
Section~\ref{sec:cf_deg} emphasizes our striking ignorance about
continued fractions of real roots of irreducible polynomials over~$\Q$
of degree bigger than~$2$.

\begin{definition}[Quadratic Irrational]
A real number $\alpha\in\R$ is a \defn{quadratic irrational} 
if it is irrational and satisfies a quadratic polynomial 
with coefficients in~$\Q$.
\end{definition}
Thus, e.g., $(1+\sqrt{5})/2$ is a quadratic irrational.
Recall that
$$
  \frac{1+\sqrt{5}}{2} = [1,1,1,\ldots].
$$
The continued fraction of $\sqrt{2}$\index{continued fraction!of $\sqrt{2}$} 
is $[1,2,2,2,2,2,\ldots]$, and
the continued fraction of $\sqrt{389}$ is
$$
   [19,1,2,1, 1, 1, 1, 2, 1, 38, 1, 2, 1, 1, 1, 1, 2, 1, 38,\ldots].$$
Does the $[1,2,1, 1, 1, 1, 2, 1, 38]$ pattern repeat over and over again?

\subsection{Periodic Continued Fractions}\index{continued fraction!periodic|nn}
\index{periodic continued fraction|nn}
\begin{definition}[Periodic Continued Fraction]
A \defn{periodic continued fraction} is a continued
fraction $[a_0, a_1, \ldots, a_n, \ldots]$ such that
$$
  a_n = a_{n+h}
$$
for some fixed positive integer~$h$ and all sufficiently large~$n$.
We call the minimal such~$h$ the \defn{period of the continued fraction}.
\end{definition}

\begin{example}\label{ex:cfrat}
Consider the periodic continued fraction $[1,2,1,2,\ldots] = [\overline{1,2}]$.
 What does it converge to?  We have
$$[\overline{1,2}] = 1+\frac{1}{\ds 2+\frac{1}{\ds 1+\frac{1}{\ds 2+ \frac{1}{\ds 1+\cdots}}}},$$
so if $\alpha=[\overline{1,2}]$ then 
$$
  \alpha = 1 + \frac{1}{2+\ds\frac{1}{\alpha}}
   = 1 + \frac{1}{\ds\frac{2\alpha+1}{\alpha}}
   = 1 + \frac{\alpha}{2\alpha+1}
   = \frac{3\alpha+1}{2\alpha+1}.
$$
Thus $2\alpha^2 -2\alpha-1 = 0$, so 
$$
\alpha = \frac{1+\sqrt{3}}{2}.
$$
\end{example}

\begin{theorem}[Periodic Characterization]\ithm{period continued fraction}
An infinite simple continued fraction is periodic if and only if
it represents a quadratic irrational.
\end{theorem}
\begin{proof}
\par\noindent($\Longrightarrow$) First suppose that 
$$[a_0, a_1, \ldots, a_n, \overline{a_{n+1},\ldots, a_{n+h}}]$$
is a periodic continued fraction.  Set
 $\alpha=[a_{n+1},a_{n+2}, \ldots]$.  Then
$$
  \alpha = [a_{n+1},\ldots, a_{n+h}, \alpha],
$$
so by Proposition~\ref{prop:convergents}
$$
  \alpha = \frac{\alpha p_{n+h} + p_{n+h-1}}{\alpha q_{n+h} + q_{n+h-1}}.
$$
Here we use that~$\alpha$ is the last partial quotient.
Thus, $\alpha$ satisfies a quadratic equation with coefficients
in~$\Q$.  Computing as in Example~\ref{ex:cfrat} and rationalizing
the denominators, and using that the $a_i$ are 
all integers, shows that
\begin{align*}
 [a_0, a_1, \ldots ] &= [a_0, a_1, \ldots, a_n, \alpha]\\
     &= a_0 + \frac{1}{\ds a_1 + \frac{1}{\ds a_2 + \cdots + \frac{1}{\alpha}}}
\end{align*}
is of the form $c+d\alpha$, with $c,d\in\Q$,
so $[a_0, a_1, \ldots]$ also satisfies a quadratic polynomial 
over~$\Q$.

The continued fraction procedure
applied to the value of an infinite simple continued fraction
yields that continued fraction back, so 
by Proposition~\ref{prop:cfterm}, $\alpha\not\in\Q$ because it is the
value of an infinite continued fraction.
\vspace{2ex}

\par\noindent($\Longleftarrow$) 
Suppose $\alpha\in\R$ is an irrational number that satisfies a quadratic equation
\begin{equation}\label{eqn:quad_contfrac}
a \alpha^2 + b\alpha + c = 0
\end{equation}
with $a, b, c\in\Z$ and $a\neq 0$.
Let $[a_0, a_1, \ldots]$ be the continued fraction
expansion of~$\alpha$.  For each~$n$, let
$$
  r_n = [a_n, a_{n+1}, \ldots],
$$
so
$$
   \alpha = [a_0, a_1, \ldots, a_{n-1}, r_n].
$$
We will prove periodicity by showing that the set of $r_n$'s is
finite.  If we have shown finiteness, then there exists $n, h>0$
such that $r_n = r_{n+h}$, so
\begin{align*}
[a_0, \ldots, a_{n-1}, r_n] &= 
   [a_0, \ldots, a_{n-1}, a_n, \ldots, a_{n+h-1}, r_{n+h}] \\
         &= [a_0, \ldots, a_{n-1}, a_n, \ldots, a_{n+h-1}, r_{n}]\\
         &= [a_0, \ldots, a_{n-1}, a_n, \ldots, a_{n+h-1}, a_n, \ldots, a_{n+h-1}, r_{n+h}]\\
         &= [a_0, \ldots, a_{n-1}, \overline{a_n, \ldots, a_{n+h-1}}].
\end{align*}
       
It remains to show there are only finitely many distinct $r_n$.  We
have
$$
  \alpha = \frac{p_n}{q_n} = 
     \frac{r_n p_{n-1} + p_{n-2}}{r_n q_{n-1} + q_{n-2}}.
$$
Substituting this expression for~$\alpha$ into the 
quadratic equation (\ref{eqn:quad_contfrac}),  we see that
$$A_n r_n^2 + B_n r_n + C_n = 0,$$
where
\begin{align*}
 A_n &= a p_{n-1}^2 + b p_{n-1} q_{n-1} + c q_{n-1}^2,\\
 B_n &= 2a p_{n-1} p_{n-2} + b(p_{n-1} q_{n-2} + p_{n-2} q_{n-1}) + 2c q_{n-1} q_{n-2}, \text{ and }\\
 C_n &= a p_{n-2}^2 + b p_{n-2} q_{n-2} + c p_{n-2}^2.
\end{align*}
%%\conrad{$A_n\neq0$ therefore $aT^2+bT+c$ has no $\Q$-roots.}
Note that $A_n, B_n, C_n\in\Z$, that $C_n = A_{n-1}$, and that
$$
  B^2 - 4A_n C_n = (b^2- 4ac)(p_{n-1}q_{n-2} - q_{n-1}p_{n-2})^2 = b^2 - 4ac.
$$

Recall from the proof of Theorem~\ref{thm:contfracdoesconv} that
$$
  \left| \alpha - \frac{p_{n-1}}{q_{n-1}}\right|
  < \frac{1}{q_n q_{n-1}}.
$$
Thus
$$
  \left| \alpha q_{n-1} - p_{n-1}\right| < \frac{1}{q_n} < \frac{1}{q_{n-1}},
$$
so 
$$
  p_{n-1} = \alpha q_{n-1} + \frac{\delta}{q_{n-1}}
\qquad\text{with }|\delta| < 1.
$$
Hence
%%\conrad{Are you copying Hardy and Wright here?  They also 
%%use $\delta$.  Be careful about plagiarism.}
\begin{align*}
  A_n &= a\left(\alpha q_{n-1} + \frac{\delta}{q_{n-1}}\right)^2
        +b\left(\alpha q_{n-1} + \frac{\delta}{q_{n-1}}\right)q_{n-1}
        +c q_{n-1}^2\\
      &= (a\alpha^2 + b\alpha + c)q_{n-1}^2 + 2a\alpha\delta + 
           a\frac{\delta^2}{q_{n-1}^2} + b\delta\\
      &= 2a\alpha\delta + a\frac{\delta^2}{q_{n-1}^2} + b\delta.
\end{align*}
Thus 
$$
  |A_n| = \left|2a\alpha\delta + a\frac{\delta^2}{q_{n-1}^2} + b\delta\right|
       < 2|a\alpha| + |a| + |b|.
$$
Thus there are only finitely many possibilities for the integer $A_n$.
Also, 
$$
  |C_n| = |A_{n-1}|
  \quad\text{ and }\quad
  |B_n| = \sqrt{b^2 - 4(ac-A_n C_n)},
$$
so there are only finitely many triples $(A_n, B_n, C_n)$,
and hence only finitely many possibilities for $r_n$ as~$n$ 
varies, which completes the proof. 
(The proof above closely follows \cite[Thm.~177, pg.144--145]{hardywright}.)
\end{proof}

\subsection{Continued Fractions of Algebraic Numbers of Higher Degree}\label{sec:cf_deg}\index{continued fraction!of higher degree number}
\begin{definition}[Algebraic Number]
An \defn{algebraic number} is a root of a polynomial $f\in\Q[x]$.
\end{definition}
\begin{openproblem}
Give a simple description of
the complete continued fractions 
expansion of the algebraic number $\sqrt[3]{2}$.\index{continued fraction!of $\sqrt[3]{2}$}
It begins
\begin{align*}
[&1, 3, 1, 5, 1, 1, 4, 1, 1, 8, 1, 14, 1, 10, 2, 1, 4, 12, 2, 3,
 2, 1, 3, 4, 1, 1, 2, 14, \\
&3, 12, 1, 15, 3, 1, 4, 534, 1, 1, 5, 1, 1, \ldots]
\end{align*}
\end{openproblem}
The author does not see a pattern, and the $534$ reduces his
confidence that he will.  Lang\index{Lang} and Trotter\index{Trotter}
(see \cite{langtrotter1}) analyzed many terms of the continued
fraction of $\sqrt[3]{2}$ statistically, and their work suggests that
$\sqrt[3]{2}$ has an ``unusual'' continued fraction; later work in
\cite{langtrotter2} suggests that maybe it does not.

\hd{Khintchine (see~\cite[pg.~59]{khintchine})}
\begin{quote}
No properties of the representing continued fractions,
analogous to those which have just been proved, are known\index{continued fraction!of algebraic number}
for algebraic numbers of higher degree [as of $1963$].  [...] It is of
interest to point out that up till the present time {\em no
continued fraction development of an algebraic
number of higher degree than the second is known} [emphasis added].
It is not even known if such a development  has bounded
elements.  Generally speaking the problems associated with
the continued fraction expansion of algebraic numbers of degree
higher than the second are extremely difficult and virtually
unstudied.
\end{quote}

\vspace{1ex}
\hd{Richard Guy (see~\cite[pg.~260]{guy:unsolved})}
\begin{quote}
  Is there an algebraic number of degree greater than two whose simple
  continued fraction has unbounded partial quotients?  Does 
    every such number have unbounded partial quotients?
\end{quote}

Baum and Sweet \cite{baum_sweet} answered the analogue of Richard
Guy's question but with algebraic numbers replaced by elements of a
field $K$ other than~$\Q$.  (The field $K$ is $\F_2((1/x))$, the field
of Laurent series in the variable $1/x$ over the finite field with two
elements.  An element of~$K$ is a polynomial in $x$ plus a formal
power series in $1/x$.)  They found an~$\alpha$ of degree three
over~$K$ whose continued fraction has all terms of bounded degree, and
other elements of various degrees greater than~$2$ over~$K$ whose
continued fractions have terms of unbounded degree.


\section{Recognizing Rational Numbers}\index{recognizing rational numbers|nn}
\index{continued fraction!recognizing rational numbers|nn}
\label{sec:cf_rat}

 Suppose
that somehow you can compute approximations to some rational number,
and want to figure what the rational number probably is.  Computing
the approximation to high enough precision to find a period in the
decimal expansion is not a good approach, because the period can be
huge (see below).  A much better approach is to compute the simple
continued fraction of the approximation, and truncate it before a
large partial quotient $a_n$, then compute the value of the truncated
continued fraction.  This results in a rational number that has
relatively small numerator and denominator, and is close to the
approximation of the rational number, since the tail end of the
continued fraction is at most $1/a_n$.

We begin with a contrived example, which illustrates how to recognize
a rational number.  Let
$$
  x=9495/3847 = 2.46815700545879906420587470756433584611385\ldots.
$$
The continued fraction of the truncation
$2.468157005458799064$ is
$$
  [2, 2, 7, 2, 1, 5, 1, 1, 1, 1, 1, 1, 328210621945, 2, 1, 1, 1, \ldots ]
$$
We have
$$
[2, 2, 7, 2, 1, 5, 1, 1, 1, 1, 1, 1] = \frac{9495}{3847}.
$$
Notice that no repetition is evident in the digits of~$x$ given
above, though we know that the decimal expansion of~$x$ must be
eventually periodic, since all decimal expansions of rational numbers are
eventually periodic.  In fact, the length of the period of the decimal
expansion of $1/3847$ is $3846$, which is the order of $10$ modulo $3847$ 
(see \exref{ch:contfrac}{ex:decexpord}).

For a slightly less contrived application of this idea, suppose
$f(x)\in\Z[x]$ is a polynomial with integer coefficients, and we know
for some reason that one root of~$f$ is a rational number.  Then we
can find that rational number by using Newton's method to approximate
each root, and continued fractions to decide whether each root is a
rational number (we can substitute the value of the continued fraction
approximation into $f$ to see if it is actually a root).  One could
also use the well-known rational root theorem, which asserts that any
rational root $n/d$ of~$f$, with $n,d\in\Z$ coprime, has the property
that~$n$ divides the constant term of~$f$ and~$d$ the leading
coefficient of~$f$.  However, using that theorem to find $n/d$ would
require factoring the constant and leading terms of $f$, which could
be completely impractical if they have a few hundred digits
(see Section~\ref{sec:numfact}).  In contrast, Newton's method and continued
fractions should quickly find $n/d$, assuming the degree of~$f$ isn't
too large.

For example, suppose $f=3847x^2 - 14808904x + 36527265$.  To apply
Newton's method, let $x_0$ be a guess for a root of $f$.  Then iterate
using the recurrence
$$
 x_{n+1} = x_n - \frac{f(x_n)}{f'(x_n)}.
$$
Choosing $x_0 = 0$, approximations of first two iterates are 
$$
x_1 = 2.466574501394566404103909378, 
$$
and 
$$
x_2 = 2.468157004807401923043166846.
$$
The continued fraction of the approximations $x_1$ and $x_2$ are 
$$
 [2, 2, 6, 1, 47, 2, 1, 4, 3, 1, 5, 8, 2, 3]
$$
and
$$
 [2, 2, 7, 2, 1, 5, 1, 1, 1, 1, 1, 1, 103, 8, 1, 2, 3, \ldots].
$$
Truncating the continued fraction of $x_2$ before $103$ gives $$[2, 2,
7, 2, 1, 5, 1, 1, 1, 1, 1, 1],$$ which evaluates to $9495/3847$, which
is a rational root of~$f$.

Another computational application of continued fractions, which we can
only hint at, is that there are functions in certain parts of advanced
number theory (that are beyond the scope of this book) that take
rational values at certain points, and which can only be computed
efficiently via approximations; using continued fractions as
illustrated above to evaluate such functions is crucial.



\section{Sums of Two Squares}\label{sec:sumsqr}\index{sums of two squares}
\index{squares!sum of two}
In this section we apply continued fractions to prove
the following theorem.
\begin{theorem}\label{thm:sumsquare}\ithm{sum of two squares}
  A positive integer~$n$ is a sum of two squares if and only if all
  prime factors of~$p\mid n$ such that $p\con 3\pmod{4}$ have even
  exponent in the prime factorization of~$n$.
\end{theorem}
We first consider some examples.  Notice that $5 = 1^2 + 2^2$ is a sum
of two squares, but~$7$ is not a sum of two squares.  Since $2001$ is
divisible by $3$ (because $2+1$), but not by $9$ (since $2+1$ is not),
Theorem~\ref{thm:sumsquare} implies that $2001$ is not a sum of two
squares.  The theorem also implies that $2\cdot 3^4\cdot 5\cdot 7^2\cdot
13$ is a sum of two squares. 


\begin{definition}[Primitive]
A representation $n=x^2 + y^2$ is \defn{primitive}\index{primitive!representation} 
if~$x$ and~$y$ are coprime.
\end{definition}

\begin{lemma}\label{lem:primitive}
If~$n$ is divisible by a prime~$p\con 3\pmod{4}$, then~$n$
has no primitive representations.
\end{lemma}
\begin{proof}
Suppose $n$ has a primitive representation, $n=x^2 + y^2$, and
let~$p$ be any prime factor of~$n$.  Then
$$
   p \mid x^2 + y^2\quad \text{ and }\quad \gcd(x,y)=1,
$$
so $p\nmid x$ and $p\nmid y$.  
Since $\zmod{p}$ is a field we may divide by $y^2$ in the equation
$x^2 + y^2 \con 0\pmod{p}$ to see that
$
  (x/y)^2 \con -1\pmod{p}.
$
Thus the quadratic residue symbol $\kr{-1}{p}$ equals $+1$.
However, by Proposition~\ref{prop:euler},
$$
   \kr{-1}{p} = (-1)^{(p-1)/2}
$$
so $\kr{-1}{p}=1$ if and only if $(p-1)/2$ is even, which is 
to say $p\con 1\pmod{4}$.
\end{proof}

\begin{proof}[Proof of Theorem~\ref{thm:sumsquare}
  $\left(\Longrightarrow\right)$]
  Suppose that $p\con 3\pmod{4}$ is a prime, that 
  $p^r\mid n$ but $p^{r+1}\nmid n$ with~$r$ odd, and that
  $n=x^2+y^2$.  Letting $d=\gcd(x,y)$, we have
  $$
  x = dx', \quad y = dy', \quad\text{ and }\quad n = d^2 n'
  $$
  with $\gcd(x',y')=1$ and
  $$
  (x')^2 + (y')^2 = n'.
  $$
  Because~$r$ is odd, $p\mid n'$, so Lemma~\ref{lem:primitive}
  implies that $\gcd(x',y')>1$, a contradiction.  
\end{proof}

To prepare for our proof of $\left(\Longleftarrow\right)$, we reduce
the problem to the case when~$n$ is prime.  Write $n=n_1^2 n_2$ where
$n_2$ has no prime factors $p\con 3\pmod{4}$.  It suffices to show
that~$n_2$ is a sum of two squares, since
\begin{equation}\label{eqn:ssnormprod}
  (x_1^2 + y_1^2)(x_2^2+y_2^2) = (x_1x_2-y_1y_2)^2 + (x_1y_2+x_2y_1)^2,
\end{equation}
so a product of two numbers that are sums of two squares is also
a sum of two squares.  
Since~$2=1^2+1^2$ is a sum of two squares, it suffices to show
that any prime $p\con 1\pmod{4}$ is a sum of two squares.

\begin{lemma}\label{lem:approx}
If $x\in\R$ and $n\in\N$, then there is a fraction $\ds\frac{a}{b}$
in lowest terms such that $0<b\leq n$ and
$$\left| x - \frac{a}{b} \right| \leq \frac{1}{b(n+1)}.$$
\end{lemma}
\begin{proof}
Consider the continued fraction\index{continued fraction}
$[a_0,a_1,\ldots]$ of~$x$.
By Corollary~\ref{cor:cfconv}, for each~$m$
$$
 \left| x - \frac{p_m}{q_m}\right|
  < \frac{1}{q_m \cdot q_{m+1}}.
$$
Since $q_{m+1}\geq q_m + 1$ and $q_0=1$, 
either there exists an~$m$ such that $q_m\leq n < q_{m+1}$, or the
continued fraction\index{continued fraction} expansion of~$x$ is finite and $n$ is larger
than the denominator of the rational number~$x$, in which case
we take $\frac{a}{b}=x$ and are done.  In the first
case,
$$
  \left| x - \frac{p_m}{q_m}\right|
   < \frac{1}{q_m \cdot q_{m+1}}
      \leq \frac{1}{q_m \cdot (n+1)},$$
so $\ds\frac{a}{b} = \frac{p_m}{q_m}$ satisfies the conclusion of
the lemma. 
\end{proof}

\begin{proof}[Proof of Theorem~\ref{thm:sumsquare} $\left(\Longleftarrow\right)$]
As discussed above, it suffices to prove that any prime 
$p\con 1\pmod{4}$ is a sum of two squares. Since $p\con 1\pmod{4}$,
$$
  (-1)^{(p-1)/2} = 1,
$$
so Proposition~\ref{prop:euler} implies that
$-1$ is a square modulo~$p$; i.e., there exists~$r\in\Z$ such
that $r^2\con -1\pmod{p}$.  
Lemma~\ref{lem:approx}, with $n=\lfloor \sqrt{p}\rfloor$ 
and $x=-\frac{r}{p}$,
implies that there are integers $a, b$ such that
$0<b<\sqrt{p}$ and 
$$
 \left| -\frac{r}{p} - \frac{a}{b}\right| \leq\frac{1}{b(n+1)} < \frac{1}{b\sqrt{p}}.
$$
Letting $c = rb + pa$, we have that
$$
  |c| < \frac{pb}{b\sqrt{p}} = \frac{p}{\sqrt{p}} = \sqrt{p}
$$
so
$$
   0 < b^2 + c^2 < 2p.
$$
But $c \con rb\pmod{p}$, so 
$$
  b^2 + c^2 \con b^2 + r^2 b^2 \con b^2(1+r^2) \con 0\pmod{p}.
$$
Thus $b^2 + c^2 = p$.
\end{proof}

\begin{remark}
Our proof of Theorem~\ref{thm:sumsquare} leads to an efficient
algorithm to compute a representation of any $p\con 1\pmod{4}$ 
as a sum of two squares.   See 
Listing~\ref{listing:Write Prime as Sum of Two Squares}
for an implementation.
\end{remark}


\begin{exercises}

\item\label{ex:cf2}
If $c_n=p_n/q_n$ is the $n$th convergent of 
$[a_0,a_1,\ldots,a_n]$ and $a_0>0$, show that
$$
  [a_n,a_{n-1},\ldots, a_1, a_0] = \frac{p_n}{p_{n-1}}
$$
and
$$
   [a_n,a_{n-1},\ldots, a_2, a_1] = \frac{q_n}{q_{n-1}}.
$$
(Hint: In the first case, notice that
$\ds \frac{p_n}{p_{n-1}} = a_n + \frac{p_{n-2}}{p_{n-1}} 
          = a_n + \frac{1}{\frac{p_{n-1}}{p_{n-2}}}.$)

\item\label{ex:cf3b}
Show that every nonzero rational number can be represented in
exactly two ways be a finite simple continued fraction.  (For
example, $2$ can be represented by $[1,1]$ and $[2]$, and $1/3$
by $[0,3]$ and $[0,2,1]$.)

\item\label{ex:cf4}
Evaluate the infinite continued fraction $[2,\overline{1,2,1}]$.

\item\label{ex:cf5}
Determine the infinite continued fraction of $\frac{1+\sqrt{13}}{2}$.

\item Let $a_0\in\R$ and $a_1,\ldots,a_n$ and~$b$ be positive
real numbers.  Prove that 
$$
  [a_0,a_1,\ldots,a_n+b] < [a_0,a_1,\ldots,a_n]
$$
if and only if~$n$ is odd.



\item (*) \label{ex:contfrac_epow} Extend the method presented in the text
to show that the continued fraction expansion of $e^{1/k}$ is
$$
  [1,\,(k-1),\,1,\,1,\,(3k-1),\,1,\,1,\,(5k-1),\,1,\,1,\,(7k-1),\ldots]
$$
for all $k \in
\mathbb{N}$.

\begin{enumerate}
\item
Compute $p_0$, $p_3$, $q_0$, and $q_3$ for the above continued fraction. Your answers should be in terms of $k$.

\item\label{condense}
Condense three steps of the recurrence for the numerators and denominators of the above continued fraction. That is, produce a simple recurrence for $r_{3n}$ in terms of $r_{3n-3}$ and $r_{3n-6}$ whose coefficients are polynomials in $n$ and $k$.

\item
Define a sequence of real numbers by
$$T_n(k)=\frac{1}{k^n}\int_{0}^{1/k}\frac{(kt)^{n}(kt-1)^{n}}{n!}\phantom{1} e^tdt.$$

\begin{enumerate}
\item
Compute $T_0(k)$, and verify that it equals $q_0e^{1/k}-p_0$.
\item
Compute $T_1(k)$, and verify that it equals $q_3e^{1/k}-p_3$.
\item
Integrate $T_n(k)$ by parts twice in succession, as in 
Section~\ref{sec:contfrac_e}, and verify that $T_n(k)$, $T_{n-1}(k)$, and $T_{n-2}(k)$ satisfy the recurrence produced in part \ref{condense}, for $n\geq2$.
\end{enumerate}

\item
Conclude that the continued fraction 
$$
  [1,\,(k-1),\,1,\,1,\,(3k-1),\,1,\,1,\,(5k-1),\,1,\,1,\,(7k-1),\ldots]
$$
 represents $e^{1/k}$.
\end{enumerate}


\item \label{ex:decexpord}
Let~$d$ be an integer that is coprime to~$10$.
Prove that the decimal expansion of $\frac{1}{d}$ has period
equal to the order of~$10$ modulo~$d$.
(Hint: For every positive integer~$r$,  we have
$
  \frac{1}{1-10^r} = \sum_{n\geq 1} 10^{-rn}.
$)


\item\label{ex:qf3} Find a positive integer that has at least three
  different representations as the sum of two squares, disregarding
  signs and the order of the summands.
  
\item\label{ex:qf4} Show that if a natural number~$n$ is the sum of two
  two rational squares it is also the sum of two integer squares.

\item\label{ex:qf5}(*) Let $p$ be an odd prime.  Show that $p\con
  1,3\pmod{8}$ if and only if~$p$ can be written as $p=x^2 + 2y^2$ for
  some choice of integers~$x$ and~$y$.
  
\item\label{ex:qf7} Prove that of any four consecutive integers, at
  least one is not representable as a sum of two squares.

\end{exercises}
\index{continued fraction|)}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%  
%% Chapter: Elliptic Curves
%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\chapter{Elliptic Curves}\label{ch:ec}


We introduce elliptic curves and describe how to put a group structure
on the set of points on an elliptic curve.  We then apply elliptic
curves to two cryptographic problems---factoring integers and
constructing public-key cryptosystems.  Elliptic curves are believed
to provide good security with smaller key sizes, something that is
very useful in many applications, e.g., if we are going to print an
encryption key on a postage stamp, it is helpful if the key is short!
Finally, we consider elliptic curves over the rational numbers, and
briefly survey some of the key ways in which they arise in number
theory.  \vspace{4ex}

\begin{figure}[ht]
\begin{center}
\psset{unit=0.35in}
\pspicture(0,0)(6,6)
\psgrid[gridcolor=lightgray, subgriddiv=1, gridlabels=10pt]
\psline[linewidth=0.03]{->}(0,0)(6,0)\psline[linewidth=0.03]{->}(0,0)(0,6)
\pscircle*[linecolor=blue](1,3){0.2}
\pscircle*[linecolor=blue](1,4){0.2}
\pscircle*[linecolor=blue](3,3){0.2}
\pscircle*[linecolor=blue](3,4){0.2}
\pscircle*[linecolor=blue](0,0){0.2}
\pscircle*[linecolor=blue](5,2){0.2}
\pscircle*[linecolor=blue](5,5){0.2}
\pscircle*[linecolor=blue](2,7){0.2}
\put(2.4,7){$\infty$}
\endpspicture{}\vspace{2ex}
\caption{The Elliptic Curve $y^2 = x^3 + x$ over $\zmod{7}$\label{fig:ecf7}}

\end{center}
\end{figure}


\section{The Definition}

\begin{definition}[Elliptic Curve]\label{defn:ec}
An \defn{elliptic curve} over a field~$K$ is a curve defined by
an equation of the form
$$
 y^2 = x^3 + ax+b,
$$
where~$a, b\in{}K$ and $-16(4a^3+27b^2)\neq 0$.
\end{definition}

The condition that $-16(4a^3+27b^2)\neq 0$ implies that
the curve has no ``singular points'', which will be
essential for the applications we have in mind (see 
\exref{ch:ec}{ex:singgrp}).  

In Section~\ref{sec:ellgrp} we will put  a natural abelian
group structure on the set
$$
E(K) = \{ (x,y)\in K\cross K : y^2 = x^3 + ax +b \} \union \{\O\}
$$
of $K$-rational points on an elliptic curve~$E$ over~$K$.  Here~$\O$
may be thought of as a point on~$E$ ``at infinity''.  In
Figure~\ref{fig:ecf7} we graph $y^2=x^3+x$ over the finite field
$\zmod{7}$, and in Figure~\ref{fig:ecQ} we graph $y^2=x^3+x$ over the
field $K=\R$ of real numbers.

 %In Sections~\ref{sec:ecm}--\ref{sec:ec_crypto} we see how elliptic
% curves play a role in integer factorization algorithms, and how
% elliptic curves over finite fields provide cryptosystems that may in
% some ways to be much better than the cryptosystems from
% Chapter~\ref{ch:crypto}. 
%In
% Section~\ref{sec:ellrat} we survey some results and conjectures about
% the groups $E(\Q)$ for elliptic curves $E$ over~$\Q$.

\begin{remark}
  If $K$ has characteristic $2$ (e.g., $K=\zmod{2}$), then for any
  choice of $a,b$, the quantity $-16(4a^3+27b^2)\in K$ is $0$, so
  according to Definition~\ref{defn:ec} there are no elliptic curves
  over $K$.  There is a similar problem in characteristic $3$.  
If we instead consider equations of the form
$$
  y^2 + a_1 xy + a_3 y = x^3 + a_2 x^2 + a_4 x + a_6,
$$
we obtain a more general definition of elliptic curves, which
  correctly allows for elliptic curves in characteristic $2$ and $3$;
  these elliptic curves are popular in cryptography because arithmetic
  on them is often easier to efficiently implement on a computer.
\end{remark}



\begin{figure}[ht]
\begin{center}
\psset{unit=2}
\pspicture(-1.0000,-2.0000)(2.0000,2.0000)
\psgrid[gridcolor=lightgray, subgriddiv=4]
\psline[linewidth=0.02]{<->}(-1.0000,0)(2.0000,0)    \rput(2.0800,0){$x$}
\psline[linewidth=0.02]{<->}(0,-2.0000)(0,2.0000)    \rput(0,2.0800){$y$}
\pscurve[linecolor=blue]
(1.3400,1.9354)
(1.2800,1.8377)
(1.2200,1.7423)
(1.1600,1.6495)
(1.1000,1.5591)
(1.0400,1.4713)
(0.98000,1.3860)
(0.92000,1.3033)
(0.86000,1.2231)
(0.80000,1.1454)
(0.74000,1.0701)
(0.68000,0.99721)
(0.62000,0.92646)
(0.56000,0.85768)
(0.50000,0.79057)
(0.44000,0.72469)
(0.38000,0.65944)
(0.32000,0.59394)
(0.26000,0.52685)
(0.20000,0.45607)
(0.14000,0.37781)
(0.080000,0.28374)
(0.020000,0.14144)
(0.020000,-0.14145)
(0.080000,-0.28374)
(0.14000,-0.37781)
(0.20000,-0.45607)
(0.26000,-0.52685)
(0.32000,-0.59394)
(0.38000,-0.65945)
(0.44000,-0.72469)
(0.50000,-0.79057)
(0.56000,-0.85768)
(0.62000,-0.92646)
(0.68000,-0.99721)
(0.74000,-1.0701)
(0.80000,-1.1454)
(0.86000,-1.2231)
(0.92000,-1.3033)
(0.98000,-1.3860)
(1.0400,-1.4713)
(1.1000,-1.5591)
(1.1600,-1.6495)
(1.2200,-1.7423)
(1.2800,-1.8377)
(1.3400,-1.9354)
%\pscircle*[linecolor=red](0,0){0.05}\rput(0.18,0.09){$(0,0)$}
%\pscircle*[linecolor=red](0.2,2.3){0.05}\rput(1.1,2.3){Point $\mathcal{O}$ at infinity}
\endpspicture
\end{center}
\caption{The Elliptic Curve $y^2 = x^3 + x$ over $\R$\label{fig:ecQ}}
\end{figure}

\section{The Group Structure on an Elliptic Curve}\label{sec:ellgrp}\index{group!structure
of elliptic curve|nn}\index{elliptic curve!group structure|nn}


Let $E$ be an elliptic curve over a field  $K$,
given by an equation $y^2=x^3+ax+b$.
We begin by defining a binary operation $+$ on $E(K)$.
\begin{algorithm}{Elliptic Curve Group Law}\label{alg:grouplaw}
Given $P_1, P_2\in E(K)$, 
this algorithm computes a third point $R=P_1+P_2 \in E(K)$.
\begin{steps}
\item{}[Is $P_i=\O$?] If $P_1=\O$ set $R=P_2$ or if $P_2=\O$ set $R=P_1$
and terminate.  Otherwise write $(x_i,y_i)=P_i$.
\item{}[Negatives]  If $x_1 = x_2$ and $y_1 = -y_2$, set $R=\O$ and terminate.
\item{}[Compute $\lambda$]\label{alg:grouplaw_3}
Set $\ds \lambda = \begin{cases}
 (3x_1^2+a)/(2y_1) & \text{if }P_1 = P_2,\\
(y_1-y_2)/(x_1-x_2) & \text{otherwise.}
\end{cases}$\\
\item{}[Compute Sum]\label{alg:grouplaw_4}  Then 
$R = \ds \left(\lambda^2 -x_1 - x_2, -\lambda x_3 - \nu\right)$,
where $\nu = y_1 - \lambda x_1$ and  $x_3=\lambda^2 -x_1 - x_2$
is the $x$-coordinate of $R$.
\end{steps}
\end{algorithm}
Note that in Step~\ref{alg:grouplaw_3} if $P_1=P_2$, then $y_1\neq 0$;
otherwise, we would have terminated in the previous step.

We implement this algorithm in Section~\ref{sec:comp_ellcurve_arith}.

\begin{theorem}\label{thm:grouplaw}\ithm{elliptic curve group law}
  The binary operation $+$ defined above endows the set $E(K)$ with an
  abelian group structure, in which $\O$ is the identity element.
\end{theorem}

Before discussing why the theorem is true, we reinterpret $+$
geometrically, so that it will be easier for us to visualize.  
We obtain the
sum $P_1+P_2$  by finding the third point $P_3$ of
intersection between~$E$ and the line~$L$ determined by $P_1$ and
$P_2$, then reflecting $P_3$ about the $x$-axis. 
(This description requires suitable interpretation in 
cases 1 and 2, and when $P_1=P_2$.) This is illustrated
in Figure~\ref{fig:geomgrouplaw}, in which $(0,2)+(1,0) = (3,4)$ on
$y^2=x^3-5x+4$.  To further clarify this geometric interpretation, we
prove the following proposition.
\begin{proposition}[Geometric group law]\label{prop:geom_grouplaw}%
\iprop{geometric group law}
Suppose $P_i=(x_i,y_i)$, $i=1,2$ are distinct point on an elliptic
curve $y^2=x^3+ax+b$, and that $x_1\neq x_2$.  Let $L$ be
the unique line through $P_1$ and $P_2$.   Then $L$
intersects the graph of~$E$ at exactly one other point
$$
  Q = \left(\lambda^2 -x_1 - x_2,\quad \lambda x_3 + \nu\right),
$$
where $\lambda = (y_1-y_2)/(x_1-x_2)$ and $\nu = y_1 - \lambda x_1$.
\end{proposition}
\begin{proof}
  The line $L$ through $P_1$, $P_2$ is $y = y_1 + (x-x_1)\lambda$.
  Substituting this into $y^2=x^3+ax+b$ we get
  $$
  (y_1+(x-x_1)\lambda)^2 = x^3 + ax + b.
  $$
  Simplifying we get $f(x) = x^3 - \lambda^2 x^2 + \cdots = 0$, where we
  omit the coefficients of $x$ and the constant term since they will
not be needed.
  Since $P_1$ and $P_2$ are in $L\cap E$, the polynomial $f$
  has $x_1$ and $x_2$ as roots.  By Proposition~\ref{prop:atmost},
the polynomial~$f$ 
  can have at most three roots.   Writing $f=\prod(x-x_i)$
and equating terms, we see that 
 $x_1+x_2 + x_3 = \lambda^2$.  Thus $x_3 = \lambda^2 - x_1-x_2$,
as claimed.  Also, from the equation for~$L$ we see that
$y_3 = y_1 + (x_3 - x_1)\lambda = \lambda x_3 + \nu$, which
completes the proof.
\end{proof}

\begin{figure}
\begin{center}\index{group law!illustrated}\index{graph!of group law}
\psset{unit=0.8}
\pspicture(-3.4300,-5)(4.0000,5)
\psgrid[gridcolor=lightgray, subgriddiv=1]
\psline[linewidth=0.03]{->}(-3.4300,0)(4.0000,0)\rput(4.4120,0){$x$}
\psline[linewidth=0.03]{->}(0,-5.0000)(0,5.0000)\rput(0,5.4){$y$}
\pscurve[linecolor=blue, linewidth=0.05]
(3.3560,5.0019)
(3.3313,4.9308)
(3.3065,4.8598)
(3.2817,4.7891)
(3.2570,4.7186)
(3.2322,4.6483)
(3.2074,4.5782)
(3.1827,4.5084)
(3.1579,4.4388)
(3.1331,4.3693)
(3.1084,4.3002)
(3.0836,4.2312)
(3.0588,4.1625)
(3.0341,4.0939)
(3.0093,4.0256)
(2.9845,3.9576)
(2.9598,3.8897)
(2.9350,3.8220)
(2.9102,3.7546)
(2.8855,3.6874)
(2.8607,3.6204)
(2.8359,3.5537)
(2.8112,3.4871)
(2.7864,3.4208)
(2.7616,3.3547)
(2.7369,3.2888)
(2.7121,3.2231)
(2.6873,3.1577)
(2.6626,3.0924)
(2.6378,3.0274)
(2.6130,2.9625)
(2.5883,2.8979)
(2.5635,2.8335)
(2.5387,2.7693)
(2.5140,2.7053)
(2.4892,2.6415)
(2.4644,2.5779)
(2.4397,2.5145)
(2.4149,2.4513)
(2.3901,2.3882)
(2.3654,2.3254)
(2.3406,2.2627)
(2.3158,2.2002)
(2.2911,2.1379)
(2.2663,2.0757)
(2.2415,2.0137)
(2.2167,1.9518)
(2.1920,1.8901)
(2.1672,1.8284)
(2.1424,1.7669)
(2.1177,1.7055)
(2.0929,1.6442)
(2.0681,1.5829)
(2.0434,1.5216)
(2.0186,1.4603)
(1.9938,1.3991)
(1.9691,1.3377)
(1.9443,1.2762)
(1.9195,1.2146)
(1.8948,1.1528)
(1.8700,1.0906)
(1.8452,1.0280)
(1.8205,0.96497)
(1.7957,0.90116)
(1.7709,0.83642)
(1.7462,0.77049)
(1.7214,0.70293)
(1.6966,0.63318)
(1.6719,0.56033)
(1.6471,0.48287)
(1.6223,0.39803)
(1.5976,0.29944)
(1.5728,0.16365)
(1.5728,-0.16365)
(1.5976,-0.29944)
(1.6223,-0.39803)
(1.6471,-0.48288)
(1.6719,-0.56033)
(1.6966,-0.63318)
(1.7214,-0.70293)
(1.7462,-0.77049)
(1.7709,-0.83643)
(1.7957,-0.90116)
(1.8205,-0.96497)
(1.8452,-1.0280)
(1.8700,-1.0906)
(1.8948,-1.1528)
(1.9195,-1.2146)
(1.9443,-1.2763)
(1.9691,-1.3377)
(1.9938,-1.3991)
(2.0186,-1.4603)
(2.0434,-1.5216)
(2.0681,-1.5829)
(2.0929,-1.6442)
(2.1177,-1.7055)
(2.1424,-1.7669)
(2.1672,-1.8284)
(2.1920,-1.8901)
(2.2167,-1.9518)
(2.2415,-2.0137)
(2.2663,-2.0757)
(2.2911,-2.1379)
(2.3158,-2.2002)
(2.3406,-2.2627)
(2.3654,-2.3254)
(2.3901,-2.3882)
(2.4149,-2.4513)
(2.4397,-2.5145)
(2.4644,-2.5779)
(2.4892,-2.6415)
(2.5140,-2.7053)
(2.5387,-2.7693)
(2.5635,-2.8335)
(2.5883,-2.8979)
(2.6130,-2.9626)
(2.6378,-3.0274)
(2.6626,-3.0924)
(2.6873,-3.1577)
(2.7121,-3.2231)
(2.7369,-3.2888)
(2.7616,-3.3547)
(2.7864,-3.4208)
(2.8112,-3.4871)
(2.8359,-3.5537)
(2.8607,-3.6205)
(2.8855,-3.6874)
(2.9102,-3.7546)
(2.9350,-3.8221)
(2.9598,-3.8897)
(2.9845,-3.9576)
(3.0093,-4.0256)
(3.0341,-4.0939)
(3.0588,-4.1625)
(3.0836,-4.2312)
(3.1084,-4.3002)
(3.1331,-4.3694)
(3.1579,-4.4388)
(3.1827,-4.5084)
(3.2074,-4.5782)
(3.2322,-4.6483)
(3.2570,-4.7186)
(3.2817,-4.7891)
(3.3065,-4.8598)
(3.3313,-4.9308)
(3.3560,-5.0019)

\psccurve[linecolor=blue, linewidth=0.05]
(0.97846,0.21086)
(0.95369,0.31456)
(0.92892,0.39616)
(0.90416,0.46728)
(0.87939,0.53207)
(0.85462,0.59251)
(0.82986,0.64977)
(0.80509,0.70454)
(0.78032,0.75731)
(0.75555,0.80841)
(0.73079,0.85809)
(0.70602,0.90653)
(0.68125,0.95388)
(0.65649,1.0002)
(0.63172,1.0456)
(0.60695,1.0903)
(0.58219,1.1341)
(0.55742,1.1773)
(0.53265,1.2197)
(0.50789,1.2615)
(0.48312,1.3027)
(0.45835,1.3433)
(0.43359,1.3833)
(0.40882,1.4227)
(0.38405,1.4616)
(0.35929,1.4999)
(0.33452,1.5377)
(0.30975,1.5751)
(0.28499,1.6118)
(0.26022,1.6481)
(0.23545,1.6839)
(0.21069,1.7192)
(0.18592,1.7540)
(0.16115,1.7884)
(0.13639,1.8222)
(0.11162,1.8556)
(0.086857,1.8884)
(0.062090,1.9208)
(0.037323,1.9528)
(0.012556,1.9842)
(-0.012210,2.0152)
(-0.036976,2.0456)
(-0.061743,2.0756)
(-0.086510,2.1052)
(-0.11127,2.1342)
(-0.13604,2.1628)
(-0.16081,2.1908)
(-0.18557,2.2184)
(-0.21034,2.2455)
(-0.23511,2.2721)
(-0.25987,2.2982)
(-0.28464,2.3238)
(-0.30941,2.3489)
(-0.33417,2.3735)
(-0.35894,2.3976)
(-0.38371,2.4211)
(-0.40847,2.4442)
(-0.43324,2.4667)
(-0.45801,2.4887)
(-0.48277,2.5102)
(-0.50754,2.5312)
(-0.53231,2.5516)
(-0.55708,2.5714)
(-0.58184,2.5908)
(-0.60661,2.6095)
(-0.63138,2.6277)
(-0.65614,2.6454)
(-0.68091,2.6624)
(-0.70568,2.6789)
(-0.73044,2.6949)
(-0.75521,2.7102)
(-0.77998,2.7249)
(-0.80474,2.7390)
(-0.82951,2.7526)
(-0.85428,2.7654)
(-0.87904,2.7777)
(-0.90381,2.7894)
(-0.92858,2.8004)
(-0.95334,2.8107)
(-0.97811,2.8204)
(-1.0028,2.8294)
(-1.0276,2.8377)
(-1.0524,2.8454)
(-1.0771,2.8523)
(-1.1019,2.8586)
(-1.1267,2.8641)
(-1.1514,2.8689)
(-1.1762,2.8729)
(-1.2010,2.8762)
(-1.2257,2.8787)
(-1.2505,2.8804)
(-1.2753,2.8813)
(-1.3000,2.8814)
(-1.3248,2.8807)
(-1.3496,2.8792)
(-1.3743,2.8767)
(-1.3991,2.8734)
(-1.4239,2.8692)
(-1.4486,2.8641)
(-1.4734,2.8580)
(-1.4982,2.8509)
(-1.5229,2.8429)
(-1.5477,2.8339)
(-1.5725,2.8238)
(-1.5972,2.8127)
(-1.6220,2.8004)
(-1.6468,2.7871)
(-1.6715,2.7725)
(-1.6963,2.7568)
(-1.7211,2.7399)
(-1.7458,2.7217)
(-1.7706,2.7022)
(-1.7954,2.6813)
(-1.8201,2.6590)
(-1.8449,2.6353)
(-1.8697,2.6100)
(-1.8944,2.5832)
(-1.9192,2.5547)
(-1.9440,2.5245)
(-1.9687,2.4925)
(-1.9935,2.4586)
(-2.0183,2.4227)
(-2.0430,2.3847)
(-2.0678,2.3445)
(-2.0926,2.3020)
(-2.1173,2.2570)
(-2.1421,2.2092)
(-2.1669,2.1586)
(-2.1916,2.1049)
(-2.2164,2.0478)
(-2.2412,1.9870)
(-2.2659,1.9221)
(-2.2907,1.8528)
(-2.3155,1.7783)
(-2.3402,1.6981)
(-2.3650,1.6113)
(-2.3898,1.5166)
(-2.4145,1.4125)
(-2.4393,1.2967)
(-2.4641,1.1656)
(-2.4888,1.0133)
(-2.5136,0.82820)
(-2.5384,0.57935)
(-2.5384,-0.57935)
(-2.5136,-0.82820)
(-2.4888,-1.0133)
(-2.4641,-1.1656)
(-2.4393,-1.2967)
(-2.4145,-1.4125)
(-2.3898,-1.5166)
(-2.3650,-1.6113)
(-2.3402,-1.6982)
(-2.3155,-1.7783)
(-2.2907,-1.8528)
(-2.2659,-1.9222)
(-2.2412,-1.9870)
(-2.2164,-2.0478)
(-2.1916,-2.1049)
(-2.1669,-2.1586)
(-2.1421,-2.2092)
(-2.1173,-2.2570)
(-2.0926,-2.3020)
(-2.0678,-2.3446)
(-2.0430,-2.3847)
(-2.0183,-2.4227)
(-1.9935,-2.4586)
(-1.9687,-2.4925)
(-1.9440,-2.5245)
(-1.9192,-2.5547)
(-1.8944,-2.5832)
(-1.8697,-2.6100)
(-1.8449,-2.6353)
(-1.8201,-2.6590)
(-1.7954,-2.6813)
(-1.7706,-2.7022)
(-1.7458,-2.7217)
(-1.7211,-2.7399)
(-1.6963,-2.7568)
(-1.6715,-2.7725)
(-1.6468,-2.7871)
(-1.6220,-2.8004)
(-1.5972,-2.8127)
(-1.5725,-2.8238)
(-1.5477,-2.8339)
(-1.5229,-2.8429)
(-1.4982,-2.8509)
(-1.4734,-2.8580)
(-1.4486,-2.8641)
(-1.4239,-2.8692)
(-1.3991,-2.8734)
(-1.3743,-2.8767)
(-1.3496,-2.8792)
(-1.3248,-2.8807)
(-1.3000,-2.8815)
(-1.2753,-2.8813)
(-1.2505,-2.8804)
(-1.2257,-2.8787)
(-1.2010,-2.8762)
(-1.1762,-2.8729)
(-1.1514,-2.8689)
(-1.1267,-2.8641)
(-1.1019,-2.8586)
(-1.0771,-2.8523)
(-1.0524,-2.8454)
(-1.0276,-2.8377)
(-1.0028,-2.8294)
(-0.97811,-2.8204)
(-0.95334,-2.8107)
(-0.92858,-2.8004)
(-0.90381,-2.7894)
(-0.87904,-2.7777)
(-0.85428,-2.7655)
(-0.82951,-2.7526)
(-0.80474,-2.7390)
(-0.77998,-2.7249)
(-0.75521,-2.7102)
(-0.73044,-2.6949)
(-0.70568,-2.6789)
(-0.68091,-2.6625)
(-0.65614,-2.6454)
(-0.63138,-2.6277)
(-0.60661,-2.6095)
(-0.58184,-2.5908)
(-0.55708,-2.5714)
(-0.53231,-2.5516)
(-0.50754,-2.5312)
(-0.48277,-2.5102)
(-0.45801,-2.4887)
(-0.43324,-2.4667)
(-0.40847,-2.4442)
(-0.38371,-2.4211)
(-0.35894,-2.3976)
(-0.33417,-2.3735)
(-0.30941,-2.3489)
(-0.28464,-2.3238)
(-0.25987,-2.2982)
(-0.23511,-2.2721)
(-0.21034,-2.2455)
(-0.18557,-2.2184)
(-0.16081,-2.1908)
(-0.13604,-2.1628)
(-0.11127,-2.1342)
(-0.086510,-2.1052)
(-0.061743,-2.0756)
(-0.036976,-2.0456)
(-0.012210,-2.0152)
(0.012556,-1.9842)
(0.037323,-1.9528)
(0.062090,-1.9208)
(0.086857,-1.8884)
(0.11162,-1.8556)
(0.13639,-1.8222)
(0.16115,-1.7884)
(0.18592,-1.7540)
(0.21069,-1.7192)
(0.23545,-1.6839)
(0.26022,-1.6481)
(0.28499,-1.6118)
(0.30975,-1.5751)
(0.33452,-1.5378)
(0.35929,-1.4999)
(0.38405,-1.4616)
(0.40882,-1.4227)
(0.43359,-1.3833)
(0.45835,-1.3433)
(0.48312,-1.3027)
(0.50789,-1.2615)
(0.53265,-1.2197)
(0.55742,-1.1773)
(0.58219,-1.1341)
(0.60695,-1.0903)
(0.63172,-1.0457)
(0.65649,-1.0002)
(0.68125,-0.95388)
(0.70602,-0.90653)
(0.73079,-0.85809)
(0.75555,-0.80841)
(0.78032,-0.75731)
(0.80509,-0.70454)
(0.82986,-0.64977)
(0.85462,-0.59252)
(0.87939,-0.53207)
(0.90416,-0.46729)
(0.92892,-0.39616)
(0.95369,-0.31456)
(0.97846,-0.21086)
\psline[linewidth=0.08,linecolor=red](-1.5,5)(3.5,-5)
\rput(-0.7,4.1){$L$}
\psline[linewidth=0.08,linecolor=red](3,5)(3,-5)
\rput(3.4,-2.8){$L'$}
\pscircle*[linecolor=black](1,0){0.084800}\rput(0.5,-0.2){$(1,0)$}
\pscircle*[linecolor=black](0,2){0.084800}\rput(0.5,2.3){$(0,2)$}
\pscircle*[linecolor=black](3,-4){0.084800}\rput(3.7,-3.7){$(3,-4)$}
\pscircle*[linecolor=black](3,4){0.084800}\rput(3.6,3.7){$(3,4)$}
\endpspicture
\vspace{2ex}
\caption{The Group Law: $(1,0)+(0,2)=(3,4)$ on $y^2=x^3-5x+4$}
\label{fig:geomgrouplaw}
\end{center}
\end{figure}

To prove Theorem~\ref{thm:grouplaw} means to show that $+$ satisfies
the three axioms of an abelian group with $\O$ as identity element:
existence of inverses, commutativity, and associativity.  The
existence of inverses follows immediately from the definition, since
$(x,y)+(x,-y)=\O$.  Commutativity is also clear from the definition of
group law, since in parts 1--3, the recipe is unchanged if we
swap~$P_1$ and~$P_2$; in part 4 swapping~$P_1$ and~$P_2$ does not
change the line determined by~$P_1$ and~$P_2$, so by
Proposition~\ref{prop:geom_grouplaw} it does not change the sum
$P_1+P_2$.

It is more difficult to prove that $+$ satisfies the associative
axiom, i.e., that $(P_1+P_2)+P_3 = P_1 + (P_2 + P_3)$.  This fact can
be understood from at least three points of view.  One is to
reinterpret the group law geometrically (extending
Proposition~\ref{prop:geom_grouplaw} to all cases), and thus transfer
the problem to a question in plane geometry.  This approach is
beautifully explained with exactly the right level of detail in
\cite[\S I.2]{silvermantate}. Another approach is to use the formulas
that define $+$ to reduce associativity to checking specific algebraic
identities; this is something that would be extremely tedious to do by
hand, but can be done using a computer (also tedious).
%We give part of such a computer proof
%in Section~\ref{sec:grouplawproof} below.  
A third approach (see e.g.~\cite{silverman:aec} or
\cite{hartshorne}) is to develop a general theory of ``divisors on
algebraic curves'', from which associativity of the group law falls
out as a natural corollary.  The third approach is the best, because
it opens up many new vistas; however we will not pursue it further
because it is beyond the scope of this book.


\section{Integer Factorization Using Elliptic Curves}\index{factorization!using elliptic curves}
\index{elliptic curve!factorization}
\label{sec:ecm}
In 1987, Hendrik Lenstra\index{Lenstra|(}\index{ECM|(}
published the landmark paper 
\cite{lenstra:factorell} that introduces and analyzes
the Elliptic Curve Method (ECM)\index{ECM}, which is
a powerful algorithm for factoring integers
using elliptic curves.  Lenstra's method is also described in 
\cite[\S IV.4]{silvermantate}, 
\cite[\S VIII.5]{davenport},  and 
\cite[\S 10.3]{cohen:ant}.

\vspace{3ex}
\noindent\begin{minipage}[b]{.67\linewidth}
  Lenstra's algorithm is well suited for finding ``medium sized''
  factors of an integer~$N$, which today means~$10$ to~$20$ decimal
  digits.  The ECM method is not {\em directly} used for factoring
  RSA challenge numbers (see Section~\ref{sec:numfact}), but it is
  used on auxiliary numbers as a crucial step in the ``number field
  sieve'', which is the best known algorithm for hunting for such
  factorizations.  Also, implementation of ECM typically requires little
  memory.
\end{minipage}\hspace{.05\linewidth}
\begin{minipage}[b]{.25\linewidth}
\noindent\includegraphics[width=\textwidth]{graphics/lenstra.eps}
\vspace{-3ex}
\begin{center}
Lenstra
\end{center}
\end{minipage}
\vspace{-2ex}


\subsection{Pollard's $(p-1)$-Method}\label{sec:pollard}
\index{Pollard's $(p-1)$-method|(}\index{factorization!Pollard's $(p-1)$-method|(}
Lenstra's discovery of ECM was inspired by
Pollard's $(p-1)$-method, which we describe in this section.
\begin{definition}[Power smooth]%
  \index{power smooth|nn}\index{smooth|nn} Let~$B$ be a positive
  integer. If~$n$ is a positive integer with prime factorization
  $n=\prod p_i^{e_i}$, then $n$ is \defn{$B$-power smooth} if
  $p_i^{e_i}\leq B$ for all $i$.
\end{definition}
Thus $30=2\cdot 3\cdot 5$ is $B$ power smooth for $B=5, 7$, but
$150=2\cdot 3 \cdot 5^2$ is not $5$-power smooth (it is $B=25$-power
smooth).

We will use the following algorithm in both the Pollard $p-1$
and elliptic curve factorization methods.
\begin{algorithm}{Least Common Multiple of First $B$ Integers}
\label{alg:lcmupto}
Given a positive integer $B$, this algorithm computes the least
common multiple of the positive integers up to $B$.
\begin{steps}
\item{}[Sieve] Using, e.g., the Sieve of Eratosthenes
  (Algorithm~\ref{alg:sieve}), compute a list~$P$ of all primes $p\leq
  B$.
\item{}[Multiply]  
Compute and output the product $\prod_{p\in P} p^{\lfloor \log_p(B) \rfloor}$.
\end{steps}
\end{algorithm}
\begin{proof}
Let $m=\lcm(1,2,\ldots, B)$.  Then 
$$\ord_p(m) = \max(\{\ord_p(n) : 1 \leq n \leq B\}) = \ord_p(p^r),$$
where $p^r$ is the largest power of $p$ that satisfies $p^r\leq B$.
Since $p^r\leq B < p^{r+1}$, we have $r=\lfloor \log_p(B) \rfloor$.
\end{proof}
We implement Algorithm~\ref{alg:lcmupto} in 
Section~\ref{sec:comp_ecm_factor}.

Let~$N$ be a positive integer that we wish to factor.  We use the
Pollard $(p-1)$-method to look for a nontrivial factor of~$N$ as
follows.  First we choose a positive integer~$B$, usually with at most
six digits.  Suppose that there is a prime divisor~$p$
of~$N$ such that $p-1$ is $B$-power smooth.  We try to find~$p$
using the following strategy.  If $a>1$ is an integer
not divisible by~$p$ then by Theorem~\ref{thm:fermatlittle},
$$a^{p-1}\con 1\pmod{p}.$$ 
Let $m=\lcm(1,2,3,\ldots, B)$, and observe that our assumption that
$p-1$ is $B$-power smooth implies that $p-1\mid m$, so
$$
  a^m \con 1 \pmod{p}.
$$
Thus 
$$
  p\mid \gcd(a^m-1,N) > 1.
$$
If $\gcd(a^m-1,N)<N$ also then $\gcd(a^m-1,N)$ is a nontrivial factor
of~$N$. 
If $\gcd(a^m-1,N)=N$, then $a^m\con 1\pmod{q^r}$ for every prime power
divisor $q^r$ of~$N$.  In this case, repeat the above steps but with a
smaller choice of~$B$ or possibly a different choice of~$a$.  
Also, it is a good idea to check from the
start whether or not~$N$ is not a perfect power $M^r$, and if so
replace~$N$ by~$M$. We formalize the algorithm as follows:

\begin{algorithm}{Pollard $p-1$ Method}\label{alg:pollard}
  Given a positive integer $N$ and a bound $B$, this algorithm
  attempts to find a nontrivial factor $m$ of $N$.  (Each prime $p\mid
  m$ is likely to have the property that $p-1$ is $B$-power smooth.)
\begin{steps}
\item{}[Compute lcm] 
Use Algorithm~\ref{alg:lcmupto} to compute $m=\lcm(1,2,\ldots, B)$.
\item{}[Initialize] Set $a\assign 2$.
\item{}[Power and gcd]\label{alg:pollard_3} 
Compute $x \assign a^m - 1\pmod{N}$
and $g=\gcd(x,N)$.
\item{}[Finished?]
If $g\neq 1$ or $N$, output $g$ and terminate.  
\item{}[Try Again?] If $a<10$ (say), replace $a$ by $a+1$ and go to step
  \ref{alg:pollard_3}.  Otherwise terminate.
\end{steps}
\end{algorithm}
We implement Algorithm~\ref{alg:pollard} in 
Section~\ref{sec:comp_ecm_factor}.


For fixed~$B$, Algorithm~\ref{alg:pollard} 
often splits~$N$ when~$N$ is divisible
by a prime~$p$ such that $p-1$ is $B$-power smooth. 
Approximately
15\% of primes~$p$ in the interval from $10^{15}$ and $10^{15}+10000$
are such that $p-1$ is $10^6$ power-smooth, so the Pollard method with
$B=10^6$ already fails nearly 85\% of the time at finding~$15$-digit
primes in this range (see also \exref{ch:computing}{ex:bpowersmooth}).  We
will not analyze Pollard's method further, since it was mentioned here
only to set the stage for the elliptic curve factorization method.

The following examples illustrate the Pollard $(p-1)$-method.
\begin{example}
In this example, Pollard works perfectly.
Let $N=5917$.  We try to use the Pollard $p-1$ method with
$B=5$ to split~$N$.  We have 
$m = \lcm(1,2,3,4,5)=60$; taking $a=2$ we have
$$
  2^{60} - 1 \con 3416\pmod{5917}
$$
and
$$
 \gcd(2^{60}-1,5917) = \gcd(3416,5917) = 61,
$$
so $61$ is a factor of~$5917$.
\end{example}

\begin{example}
In this example, we replace~$B$ by larger integer.
Let $N=779167$.  With $B=5$ and $a=2$ we have
$$
   2^{60}-1 \con 710980\pmod{779167},
$$
and $\gcd(2^{60}-1,779167) = 1.$
With $B=15$, we have $$m=\lcm(1,2,\ldots,15)=360360,$$
$$
  2^{360360}-1 \con 584876\pmod{779167},
$$
and
$$\gcd(2^{360360}-1 , N) = 2003,$$
so $2003$ is a nontrivial factor of~$779167$.
\end{example}


\begin{example}
In this example, we replace~$B$ by a smaller integer.
Let $N=4331$. Suppose  $B=7$, so $m=\lcm(1,2,\ldots,7)=420$, 
$$
  2^{420} - 1 \con 0 \pmod{4331},
$$
and $\gcd(2^{420} - 1, 4331) = 4331$,
so we do not obtain a factor of~$4331$.
If we replace~$B$ by $5$, Pollard's method works:
$$
  2^{60} - 1\con 1464\pmod{4331},
$$
and $\gcd(2^{60}-1,4331) = 61$, 
so we split~$4331$.
\end{example}

\begin{example}
In this example, $a=2$ does not work, but $a=3$ does.
Let $N=187$. Suppose  $B=15$, so $m=\lcm(1,2,\ldots,15)=360360$, 
$$
  2^{360360} - 1 \con 0 \pmod{187},
$$
and $\gcd(2^{360360} - 1, 187) = 187$,
so we do not obtain a factor of~$187$.
If we replace $a=2$ by $a=3$, then Pollard's method works:
$$
  3^{360360} - 1\con 66\pmod{187},
$$
and $\gcd(3^{360360}-1,187) = 11$.  Thus $187 = 11\cdot 17$.
\end{example}
\index{Pollard's $(p-1)$-method|)}\index{factorization!Pollard's $(p-1)$-method|)}

\subsection{Motivation for the Elliptic Curve Method}
Fix a positive integer~$B$.  If $N=pq$ with $p$ and $q$ prime and
$p-1$ and $q-1$ are not $B$-power smooth, then  
the Pollard $(p-1)$-method is unlikely to work.  
For example, let $B=20$ and 
suppose that $N=59\cdot 101 = 5959$.  Note that
neither~$59-1=2\cdot29$ nor $101-1=4\cdot 25$ is $B$-power smooth.
With $m=\lcm(1,2,3,\ldots,20)=232792560$, we have
$$2^m - 1 \con 5944\pmod{N},$$
and $\gcd(2^m-1,N)=1$, so we do not find a factor of~$N$. 

As remarked above, the problem is that $p-1$ is not $20$-power smooth for
either $p=59$ or $p=101$.  However, notice that $p-2=3\cdot 19$ is
$20$-power smooth.  Lenstra's\index{Lenstra|)} ECM  replaces 
$(\zmod{p})^*$, which has order $p-1$, by the group of points
on an elliptic curve~$E$ over $\zmod{p}$.
It is a theorem that
$$
 \#E(\zmod{p}) =p+1\pm s
$$ 
for some nonnegative integer $s<2\sqrt{p}$
(see e.g., \cite[\S V.1]{silverman:aec} for a proof).
(Also every value of~$s$ subject to this 
bound occurs, as one can see using ``complex multiplication
theory''.) For example, if~$E$ is the elliptic curve
\[
   y^2 = x^3 + x + 54
\] 
over $\zmod{59}$ then by enumerating points one sees that
$E(\zmod{59})$ is cyclic of order~$57$.  The set of numbers $59+1\pm
s$ for $s\leq 15$ contains~$14$ numbers that are $B$-power smooth
for~$B=20$ (see \exref{ch:computing}{ex:bpowersmooth}).
% (I determined this by using a computer to list all integers
%of the form $59+1\pm s$, factor them, and determine whether they are
%$B$-power smooth.) 
Thus working with an elliptic curve gives us more flexibility.
For example, $60=59+1+0$ is $5$-power smooth and $70 = 59+1+10$ is
$7$-power smooth.

\edit{Don't brush over that $\Z/N\Z$ is not a field.  -- Joe Wetherell.}

\subsection{Lenstra's Elliptic Curve Factorization Method}\label{sec:ecm_describe}
\index{elliptic curve!factorization|nn}

\begin{figure}
\begin{center}
\includegraphics[width=0.8in]{graphics/lenstra_ober.eps}
\end{center}
\caption{Hendrik Lenstra}
\end{figure}

\begin{algorithm}{Elliptic Curve Factorization Method}\label{alg:ecm}
Given a positive integer~$N$ and a bound~$B$, this algorithm 
attempts to find a nontrivial factor~$m$ of~$N$.
Carry out the following steps:
\begin{steps}
\item{}[Compute lcm] 
Use Algorithm~\ref{alg:lcmupto} to compute $m=\lcm(1,2,\ldots, B)$.
\item{}[Choose Random Elliptic Curve] 
Choose a random $a\in \zmod{N}$ such that $4a^3+27\in(\zmod{N})^*$.
Then $P=(0,1)$ is a point on the elliptic curve $y^2=x^3+ax+1$
over $\zmod{N}$.
\item{}[Compute Multiple] Attempt to compute $m P$ using an
elliptic curve analogue of Algorithm~\ref{alg:power}.
If at some point we cannot compute a sum of points
because some denominator in step~\ref{alg:grouplaw_3} of 
Algorithm~\ref{alg:grouplaw} is not coprime to~$N$, we
compute the $\gcd$ of this denominator with~$N$.  If this
$\gcd$ is a nontrivial divisor, output it.  If every
denominator is coprime to~$N$, output ``Fail''.
\end{steps}
\end{algorithm}
We implement Algorithm~\ref{alg:ecm} in Section~\ref{sec:comp_ecm_factor}.

If Algorithm~\ref{alg:ecm} fails for one random elliptic curve, there
is an option that is unavailable with Pollard's $(p-1)$-method---we
may repeat the above algorithm with a different elliptic curve.  With
Pollard's method we always work with the group $(\zmod{N})^*$, but
here we can try many groups $E(\zmod{N})$ for many curves $E$.  As
mentioned above, the number of points on~$E$ over $\zmod{p}$ is of the
form $p+1-t$ for some~$t$ with $|t|<2\sqrt{p}$;
Algorithm~\ref{alg:ecm} thus has a chance if $p+1-t$ is
$B$-power-smooth for some $t$ with $|t|<2\sqrt{p}$.

\subsection{Examples}\label{sec:ecm_examples}
For simplicity, we use an elliptic curve of the form
$$y^2 = x^3 + ax + 1,$$
which has the point $P=(0,1)$ already on it.

We factor $N=5959$ using the elliptic curve method.
Let 
$$
  m=\lcm(1,2,\ldots,20) = 232792560 = 1101111000000010000111110000_2,
$$
where $x_2$ means~$x$ is written in binary.
First we choose $a=1201$ at random and consider
$y^2 = x^3 + 1201x + 1$ over $\zmod{5959}$.
%% \conrad{Aarg, maybe not
%% a field, so why can we make sense of elliptic curve, group law,
%% etc.?}  
Using the formula for $P+P$ from
Algorithm~\ref{alg:grouplaw}
implemented on a computer (see Section~\ref{sec:comp_elliptic_curves}) 
we compute 
$2^i\cdot P = 2^i\cdot (0,1)$ 
for $i\in B=\{4, 5, 6, 7, 8, 13, 21, 22, 23, 24, 26, 27 \}$.
Then $\sum_{i\in B} 2^i P = m P$.  It turns out that during no
step of this computation does a number not coprime to
$5959$ appear in any denominator, so we do not split~$N$ 
using $a=1201$.  Next we try $a=389$ and at some stage
in the computation we add 
$P=(2051,5273)$ and $Q=(637,1292)$.
When computing the group law explicitly we try
to compute $\lambda = (y_1-y_2)/(x_1-x_2)$ in $(\Z/5959\Z)^*$,
but fail since $x_1-x_2 = 1414$ and $\gcd(1414,5959)=101$.
We thus find a nontrivial factor $101$ of $5959$.

For bigger examples and an implementation of the algorithm, see
Section~\ref{sec:comp_ecm_factor}.

\subsection{A Heuristic Explanation}\label{sec:methods}
Let $N$ be a positive integer and for simplicity of exposition
assume that $N=p_1\cdots p_r$ with the $p_i$ distinct primes.
It follows from Lemma~\ref{lem:units_map} that there is a
natural isomorphism
$$
f : (\Z/N\Z)^* \lra (\Z/p_1\Z)^* \cross \cdots \cross (\Z/p_r\Z)^*.
$$
When using Pollard's method, we choose an $a\in (\Z/N\Z)^*$,
compute $a^m$, then compute $\gcd(a^m-1,N)$.  This $\gcd$ is divisible
exactly by the primes~$p_i$ such that $a^m \con 1\pmod{p_i}$.  To
reinterpret Pollard's method using the above isomorphism, let
$(a_1,\ldots,a_r) = f(a)$.  Then $(a_1^m,\ldots,a_r^m) = f(a^m)$, and
the $p_i$ that divide $\gcd(a^m-1,N)$ are exactly the $p_i$ such that
$a_i^m=1$.  By Theorem~\ref{thm:fermatlittle}, these $p_i$ include the
primes~$p_j$ such that $p_j-1$ is $B$-power smooth, where
$m=\lcm(1,\ldots,m)$.
 
We will not define $E(\zmod{N})$ when~$N$ is composite, since this is
not needed for the algorithm (where we assume that~$N$ is prime and
hope for a contradiction).  However, for the remainder of this
paragraph, we pretend that $E(\zmod{N})$ is meaningful and describe a
heuristic connection between Lenstra and Pollard's methods.  The
significant difference between Pollard's method and the elliptic curve
method is that the isomorphism~$f$ is replaced by an isomorphism (in quotes)
$$
``g : E(\zmod{N}) \ra E(\zmod{p_1}) \cross \cdots \cross
E(\zmod{p_r})\mbox{\rm ''}
$$
where $E$ is $y^2=x^3+ax+1$, and the~$a$ of Pollard's method is
replaced by $P=(0,1)$.  We put the isomorphism in quotes to emphasize
that we have not defined $E(\zmod{N})$.  When carrying out the
elliptic curve factorization algorithm, we attempt to compute $mP$ and
if some components of $f(Q)$ are $\O$, for some point~$Q$ that appears
during the computation, but others are nonzero, we find a nontrivial
factor of~$N$.


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Elliptic Curve Cryptography}\index{elliptic curve!cryptography}
\index{cryptography!using elliptic curves}\label{sec:ec_crypto} In
this section we discuss an analogue of Diffie-Hellman that uses
an elliptic curve instead of $(\zmod{p})^*$.    The idea to use
elliptic curves in cryptography was independently proposed by Neil
Koblitz and Victor Miller in the mid 1980s.
We then discuss the ElGamal elliptic curve cryptosystem.

\subsection{Elliptic Curve Analogues of Diffie-Hellman}
\label{sec:ec_crypto_analogues}
The Diffie-Hellman\index{Diffie-Hellman cryptosystem!on elliptic curve}
\index{elliptic curve!Diffie-Hellman} 
key exchange from Section~\ref{sec:diffie}
works well on an elliptic curve
with no serious modification.
Michael\index{Michael} and Nikita\index{Nikita} 
agree on a secret key as follows:
\begin{enumerate}
\item Michael and Nikita agree on a prime~$p$, an 
elliptic curve~$E$ over $\zmod{p}$, and a point $P\in E(\zmod{p})$.
\item Michael secretly chooses a random~$m$ and sends $mP$.
\item Nikita secretly chooses a random~$n$ and sends $nP$.
\item The secret key is $nmP$, which both Michael and
Nikita can compute. 
\end{enumerate}
Presumably, an adversary can not compute
$nmP$ without solving the discrete logarithm 
problem\index{discrete log problem!on elliptic curve}
\index{elliptic curve!discrete log problem}
(see Problem~\ref{prob:log} and Section~\ref{sec:ecdl} below) 
in $E(\zmod{p})$.   For well-chosen $E$, $P$, and~$p$ experience suggests
that the discrete logarithm problem
in $E(\zmod{p})$ is much more difficult than the discrete
logarithm problem in $(\zmod{p})^*$
(see Section~\ref{sec:ecdl} for more on the elliptic
curve discrete log problem).


\subsection{The ElGamal Cryptosystem and 
  Digital Rights Management}\label{sec:elgamal} 
This section is about
the ElGamal cryptosystem\index{cryptosystem!ElGamal}, \index{ElGamal
  cryptosystem} which works well on an elliptic curves.  This section
draws on a paper by a computer hacker named Beale Screamer who
cracked a ``Digital Rights Management'' (DRM) system.

The elliptic curve used in the DRM is an elliptic curve over the
finite field $k=\zmod{p}$, where
$$
  p=785963102379428822376694789446897396207498568951.
$$
In base 16 the number $p$ is 
\begin{center}
89ABCDEF012345672718281831415926141424F7,
\end{center}
which includes counting in hexadecimal, and digits of~$e$, 
$\pi$, and $\sqrt{2}$.
The elliptic curve~$E$ is
\begin{align*}
y^2 = x^3 &+ 317689081251325503476317476413827693272746955927x \\
             &\qquad +79052896607878758718120572025718535432100651934.
\end{align*}
We have
$$\# E(k) = 785963102379428822376693024881714957612686157429,$$
and the group $E(k)$ is cyclic with generator 
\begin{align*}
B &= (771507216262649826170648268565579889907769254176, \\
&\qquad 390157510246556628525279459266514995562533196655).
\end{align*}

Our heroes Nikita\index{Nikita} and Michael\index{Michael} share
digital music when they are not out fighting terrorists.  When Nikita
installed the DRM software on her computer, it generated a private key
$$
n = 670805031139910513517527207693060456300217054473,
$$
which it hides in bits and pieces of files.  In order for Nikita to
play Juno Reactor's latest hit {\tt juno.wma}, her web browser contacts a
web site that sells music.  After Nikita sends her credit card number,
that web site allows Nikita to download a license file that allows
her audio player to unlock and play {\tt juno.wma}.

As we will see below, the license file was created using the ElGamal
public-key cryptosystem\index{ElGamal
  cryptosystem}\index{cryptosystem!ElGamal} in the group $E(k)$.
Nikita can now use her license file to unlock {\tt juno.wma}.
However, when she shares both {\tt juno.wma} and the license file with
Michael, he is frustrated because even with the license his computer
still does not play {\tt juno.wma}.  This is because Michael's computer
does not know Nikita's computer's private key (the integer~$n$ above),
so Michael's computer can not decrypt the license file.
\begin{center}
\includegraphics[width=1.9in]{graphics/juno.eps}\\
\end{center}

\index{cryptosystem!ElGamal}
We now describe the ElGamal cryptosystem, which lends itself well to
implementation in the group $E(\zmod{p})$.  To illustrate ElGamal, we
describe how Nikita would set up an ElGamal cryptosystem that anyone
could use to encrypt messages for her.  Nikita chooses a prime~$p$, an
elliptic curve~$E$ over $\zmod{p}$, and a point $B\in E(\zmod{p})$, and
publishes~$p$,~$E$, and~$B$.  She also chooses a random integer~$n$,
which she keeps secret, and publishes $nB$.  Her public key is the
four-tuple $(p,E,B, nB)$.

Suppose Michael wishes to encrypt a message for Nikita.
If the message is encoded as an element $P\in E(\zmod{p})$,
Michael computes a random integer~$r$ and the
points $rB$ and $P+r(nB)$ on $E(\zmod{p})$.  
Then~$P$ is encrypted as the pair
$(rB, P+r(nB))$. To decrypt the encrypted message,
Nikita multiplies $rB$ by her secret key~$n$
to find $n(rB) = r(nB)$, then subtracts this from
$P+r(nB)$ to obtain
  $$P = P+r(nB)-r(nB).$$
We implement this cryptosystem in Section~\ref{sec:comp_elgamal}.

\begin{remark}
  It also make sense to construct an ElGamal cryptosystem in the group
  $(\zmod{p})^*$.
\end{remark}

Returning out our story, 
Nikita's license file is an encrypted message to her.
It contains the pair of points
$(rB,P+r(nB))$, where
\begin{align*}
  rB &= (179671003218315746385026655733086044982194424660,\\
    & \qquad\quad  697834385359686368249301282675141830935176314718)
\end{align*}
and
\begin{align*}
  P+r(nB) &= (137851038548264467372645158093004000343639118915,\\
&\qquad\quad 110848589228676224057229230223580815024224875699).
\end{align*}
When Nikita's computer plays {\tt juno.wma}, it loads the secret key
$$
n = 670805031139910513517527207693060456300217054473
$$ 
into memory and computes
\begin{align*}
n(rB) &= 
  (328901393518732637577115650601768681044040715701,\\
   & \qquad 586947838087815993601350565488788846203887988162).
\end{align*}
It then subtracts this from $P+r(nB)$ to obtain
\begin{align*}
  P &= (14489646124220757767, \\
    &  \quad\qquad 669337780373284096274895136618194604469696830074).
\end{align*}

The $x$-coordinate $14489646124220757767$ is the 
key that unlocks {\tt juno.wma}.


If Nikita knew the private key~$n$ that her computer generated, she
could compute~$P$ herself and unlock {\tt juno.wma} and share her
music with Michael.  Beale Screamer found a weakness in the
implementation of this system that allows Nikita to detetermine~$n$,
which is not a huge surprise since~$n$ is stored on her computer after
all.

\subsection{The Elliptic Curve Discrete Logarithm Problem}\label{sec:ecdl}
\index{elliptic curve!discrete log problem}
\index{discrete log problem!on elliptic curve}
\begin{problem}[Elliptic Curve Discrete Log Problem]
  Suppose~$E$ is an elliptic curve over $\zmod{p}$ and~$P\in
  E(\zmod{p})$.  Given a multiple~$Q$ of~$P$, the \defn{elliptic curve
    discrete log problem} is to find $n\in\Z$ such that $nP=Q$.
\end{problem}

For example, let $E$ be the elliptic curve given by $y^2 = x^3 + x+1$
over the field $\zmod{7}$.  We have
$$
  E(\zmod{7}) = \{\O, (2, 2), (0,1), (0,6), (2,5) \}.
$$
If $P=(2,2)$ and $Q=(0,6)$, then $3P=Q$, so $n=3$
is a solution to the discrete logarithm problem.

If $E(\zmod{p})$ has order $p$ or $p\pm 1$ or is a product of
reasonably small primes, then there are some methods for attacking the
discrete log problem on~$E$, which are beyond the scope of this book.
It is thus important to be able to compute $\#E(\zmod{p})$
efficiently, in order to verify that the elliptic curve one wishes to
use for a cryptosystem doesn't have any obvious vulnerabilities.  The
naive algorithm to compute $\#E(\zmod{p})$ is to try each value of
$x\in\zmod{p}$ and count how often $x^3+ax+b$ is a perfect square
mod~$p$, but this is of no use when $p$ is large enough to be useful
for cryptography.  Fortunately, there is an algorithm due to Schoof,
Elkies, and Atkin for computing $\#E(\zmod{p})$ efficiently
(polynomial time in the number of digits of $p$), but this
algorithm is beyond the scope of this book.
%% TODO: Give reference for this algorithm.

In Section~\ref{sec:dlog} we discussed the discrete log problem in
$(\zmod{p})^*$.  There are general attacks called ``index calculus
attacks'' on the discrete log problem in $(\zmod{p})^*$ that are slow,
but still faster than the known algorithms for solving the discrete
log in a ``general'' group (one with no extra structure).  For most
elliptic curves, there is no known analogue of index calculus attacks
on the discrete log problem.  At present it appears that given~$p$ the
discrete log problem in $E(\zmod{p})$ is much harder than the discrete
log problem in the multiplicative group $(\zmod{p})^*$.  This suggests
that by using an elliptic curve-based cryptosystem instead of one
based on $(\zmod{p})^*$ one gets equivalent security with much smaller
numbers, which is one reason why building cryptosystems using elliptic
curves is attractive to some cryptographers.  For example, Certicom, 
a company that strongly supports elliptic curve cryptography, claims:
\begin{quote}
``[Elliptic curve crypto] devices require less storage, less
power, less memory, and less bandwidth than other systems. This allows
you to implement cryptography in platforms that are constrained, such
as wireless devices, handheld computers, smart cards, and
thin-clients. It also provides a big win in situations where
efficiency is important.''
\end{quote}

For an up-to-date list of elliptic curve discrete log challenge
problems that Certicom sponsors, see \cite{certicom:challenge}.  For
example, in April 2004 a specific cryptosystem was cracked that was
based on an elliptic curve over $\zmod{p}$, where~$p$ has $109$ bits.
The first unsolved challenge problem involves an elliptic curve over
$\zmod{p}$, where~$p$ has $131$ bits, and the next challenge after
that is one in which~$p$ has $163$ bits.  Certicom claims at
\cite{certicom:challenge} that the $163$-bit challenge problem is
computationally infeasible.\index{Certicom challenges}


\section{Elliptic Curves Over the Rational Numbers}
\label{sec:ellrat}\index{rational point|nn}
\index{elliptic curve!rational points on}
\begin{figure}
\begin{center}
\includegraphics[width=10em]{graphics/mordell.eps}
\end{center}
\caption{Louis J. Mordell\index{Mordell}}
\end{figure}
Let~$E$ be an elliptic curve defined over $\Q$.  The following
is a deep theorem about the group $E(\Q)$.
\begin{theorem}[Mordell]\label{thm:mordell}\ithm{Mordell}
The group $E(\Q)$ is finitely generated.
That is, there are points $P_1,\ldots, P_s \in E(\Q)$
such that every element of $E(\Q)$ is of the form $n_1 P_1 + \cdots +
n_s P_s$ for integers $n_1, \ldots n_s\in\Z$. 
\end{theorem}
Mordell's theorem implies that it makes sense to ask whether or not we
can compute $E(\Q)$, where by ``compute'' we mean find a finite set
$P_1,\ldots, P_s$ of points on~$E$ that generate $E(\Q)$ as an abelian
group.  There is a systematic approach to computing $E(\Q)$ (see e.g.,
\cite{cremona:algs, mwrank, silverman:aec}), and it is widely believed
this method always succeeds, but nobody has yet proved that it always
will.  Proving that this procedure always works is one of the central
open problem in number theory, and is closely related to the Birch and
Swinnerton-Dyer conjecture (one of the Clay Math Institute's million
dollar prize problems).

The details of the above approach to computing $E(\Q)$ are beyond
the scope of this book. In several places below we will simply assert
that $E(\Q)$ has a certain structure or is generated by certain
elements.  In each case, we computed $E(\Q)$ using a computer 
implementation of this method.

\subsection{The Torsion Subgroup of $E(\Q)$ and the Rank}
\index{elliptic curve!torsion subgroup} \index{torsion subgroup} For
any abelian group $G$, let $G_{\tor}$ be the subgroup of elements of
finite order.  If $E$ is an elliptic curve over $\Q$, then
$E(\Q)_{\tor}$ is a subgroup of $E(\Q)$, which must be finite because
of Theorem~\ref{thm:mordell} (see \exref{ch:ec}{ex:ector}).
One can also prove that $E(\Q)_{\tor}$ is finite by showing
that for all but finitely many primes $p$
there is an injective homomorphism $E(\Q)_{\tor} \hra E(\Z/p\Z)$.  For
example, if~$E$ is $y^2= x^3-5x+4$, then $ E(\Q)_{\tor} = \{\O,
(1,0)\} \isom \zmod{2}.  $

The possibilities for $E(\Q)_{\tor}$ are known.
\begin{theorem}[Mazur, 1976]\ithm{Mazur}
Let~$E$ be an elliptic curve over~$\Q$.  Then $E(\Q)_{\tor}$ is
isomorphic to one of the following 15 groups:
\begin{align*}
\zmod{n} & \qquad\text{ for } n\leq 10 \text{ or } n=12,\\
\Z/2\cross \Z/2n &\qquad \text{ for } n \leq 4.
\end{align*}
\end{theorem}


The quotient $E(\Q)/E(\Q)_{\tor}$ is a finitely generated free abelian
group, so it is isomorphism to $\Z^r$ for some integer~$r$, called the
\defn{rank}
of $E(\Q)$.
\begin{conjecture}\label{ref:rankconj}\index{rank}\index{elliptic curve!rank}
There are elliptic curves over~$\Q$ of arbitrarily large rank.
\end{conjecture}
The ``world record'' \index{largest known!elliptic curve rank}
is the following curve, whose rank is at least $24$:  
\begin{align*}
y^2 + &xy + y = x^3 - 120039822036992245303534619191166796374x\\
         &        + 504224992484910670010801799168082726759443756222911415116
\end{align*}
It was discovered
in January 2000 by Roland Martin\index{Martin} and 
William McMillen\index{McMillen} of the
National Security Agency\index{National Security Agency}. 
For several months they were not allowed to release
the actual curve to the public.  


\subsection{The Congruent Number Problem}\label{sec:congnumprob}
\index{congruent number!problem}\index{open problem!congruent numbers}
\begin{definition}[Congruent Number]
We call a nonzero rational number~$n$ a \defn{congruent number} if 
$\pm n$ is the area of a right triangle with rational
side lengths.  Equivalently,~$n$ is a \defn{congruent number} if the
system of two equations 
\begin{eqnarray*}
a^2+b^2&=&c^2\\
\frac{1}{2}ab&=&n
\end{eqnarray*}
has a solution with $a,b,c\in\Q$.  
\end{definition}
For example,~$6$ is the area of the right triangle with side lengths~$3$,~$4$, 
and~$5$, so~$6$ is a congruent number.
Less obvious is that~$5$ 
is also a congruent number; it is the area of the right triangle
with side lengths $3/2$, $20/3$,  and $41/6$.  It is nontrivial
to prove that~$1$,~$2$,~$3$, and~$4$ are not congruent numbers.  
Here is a list of the integer 
congruent numbers\index{congruent number!all $\leq 50$ are} 
up to $50$:
{
$$
5, 6, 7, 13, 14, 15, 20, 21, 22, 23, 24, 28, 29, 30, 31, 34, 37, 38, 39, 41, 45, 46, 47.
$$
}

Every congruence class modulo~$8$ except~$3$ is represented in this
list, which incorrectly suggests that if $n\con 3\pmod{8}$ then $n$ is
not a congruent number.  Though no $n\leq 218$ with $n\con 3\pmod{8}$
is a congruent number, $n=219$ is a congruent number congruent and
$219\con 3\pmod{8}$.


Deciding whether an integer~$n$ is a congruent number can be subtle
since the simplest triangle with area~$n$ can be very complicated.
For example, as Zagier\index{Zagier} pointed out, 
the number $157$ is a congruent number\index{congruent number!157 is}, and 
the ``simplest'' rational right triangle with area $157$ 
has side lengths
$$
 a = \frac{6803298487826435051217540}{411340519227716149383203}
\,\, \text{and} \,\,
 b = \frac{411340519227716149383203}{21666555693714761309610}.
$$
This solution would be difficult to find by a brute force search.

\index{congruent number!why called congruent} We call congruent
numbers ``congruent'' because of the following proposition,
which asserts that any congruent number is the common
``congruence'' between three perfect squares.
\begin{proposition}
Suppose~$n$ is the area of a right
triangle with rational side lengths $a, b, c$, with
$a\leq b<c$.
Let $A=(c/2)^2$.  Then
$$A-n, \quad A,\, \text{ and } A+n$$
are all perfect squares of rational numbers.
\end{proposition}\index{congruent number!and arithmetic progression}
\begin{proof}
We have
\begin{eqnarray*}
a^2+b^2&=&c^2\\
\frac{1}{2}ab&=&n
\end{eqnarray*}
Add or subtract $4$ times the second equation to the first to get
\begin{eqnarray*}
a^2\pm2ab +b^2&=&c^2\pm 4n\\
(a\pm b)^2 &=& c^2 \pm 4n\\
\left(\frac{a\pm b}{2}\right)^2 &=&
   \left( \frac{c}{2}\right)^2 \pm n \\
  &=& A \pm n
\end{eqnarray*}
\end{proof}

The following open problem has motivated much work on congruent numbers.
\begin{openproblem}\label{prob:cong}
\index{open problem!decide if congruent number}
Give an algorithm which, given~$n$, outputs whether or
not~$n$ is a congruent number.
\end{openproblem}

\index{elliptic curve!and congruent numbers}
\index{congruent number!and elliptic curves}
The following proposition establishes a link between elliptic curves
and the congruent number problem.
\begin{proposition}[Congruent numbers and elliptic curves]\label{prop:congbij}%
\iprop{congruent numbers and elliptic curves}
Let~$n$ be a rational number.   There is a bijection between 
$$
 A = \left\{(a,b,c) \in \Q^3 \,:\, \frac{ab}{2} = n,\, a^2 + b^2 = c^2\right\}
$$
and 
$$
 B = \left\{(x,y) \in \Q^2 \,:\, y^2 = x^3 - n^2 x, \,\,\text{\rm with } y \neq 0\right\}
$$
given explicitly by the maps
$$
  f(a,b,c) = \left(-\frac{nb}{a+c},\,\, {2n^2}{a+c}\right)
$$
and 
$$
  g(x,y) = \left(\frac{n^2-x^2}{y},\,\,
                         -\frac{2xn}{y},\,\, \frac{n^2+x^2}{y}\right).
$$
\end{proposition}
The proof of this proposition is not deep, but involves substantial
algebra and we will not prove it in this book.

For $n\neq 0$, let $E_n$ be the elliptic curve $y^2 = x^3 - n^2 x$.
\begin{proposition}[Congruent number criterion]%
\iprop{congruent number criterion}%
  The rational number~$n$ is a congruent number if and only if
there is a point $P=(x,y)\in E_n(\Q)$ with $y\neq 0$.
\end{proposition}
\begin{proof}
The number~$n$ is a congruent number if and only if the set~$A$ from
Proposition~\ref{prop:congbij} is nonempty.  By the proposition~$A$ is
nonempty if and only if~$B$ is nonempty.
\end{proof}

\begin{example}\label{ex:cong5}
Let $n=5$.  Then $E_n$ is $y^2=x^3-25x$, and we find by a 
brute force search the point $(-4,-6)\in E_n(\Q)$.  Then
$$
  g(-4,-6) = \left(\frac{25-16}{-6},-\frac{-40}{-6}, \frac{25+16}{-6}\right)
           = \left(-\frac{3}{2}, -\frac{20}{3}, -\frac{41}{6}\right).
$$
Multiplying through by~$-1$ yields the side lengths of a rational 
right triangle with area~$5$.

We can apply the map $g$ to any point in $E_n(\Q)$ with $y\neq 0$.
Using the group law we find that $2(-4,-6) = (1681/144, 62279/1728)$,
and 
$$
  g(2(-4,-6)) = \left(
-\frac{1519}{492}, -\frac{4920}{1519}, \frac{3344161}{747348}
\right).
$$
\end{example}

\begin{example}
Let $n=1$, so $E_1$ is defined by $y^2=x^3-x$.  Since~$1$ is not
a congruent number, the elliptic curve $E_1$ has no point 
with $y\neq 0$.  See \exref{ch:ec}{ex:cong1}.
\end{example}


Example~\ref{ex:cong5} foreshadows the following theorem.
\begin{theorem}[Infinitely Many Triangles]\ithm{infinitely many triangles}
If $n$ is a congruent number, then there are infinitely
many distinct right triangles with rational side lengths
and area~$n$.
\end{theorem}
We will not prove this theorem, except to note that one proves it by showing that
$E_n(\Q)_{\tor} = \{\O,(0,0),(n,0),(-n,0)\}$, so the
elements of the set $B$ in Proposition~\ref{prop:congbij} all have
infinite order, hence $B$ is infinite
so $A$ is infinite.

There is a theorem of Tunnell that combined with the conjecture of
Birch and Swinnerton-Dyer (alluded to above), which if true, would
imply the existence of an elementary way to decide whether or not an
integer~$n$ is a congruent number.  We state this elementary way in
the form of a conjecture.
\begin{conjecture}\label{conj:cong}
Let $a,b,c$ denote integers.
If~$n$ is an even square-free integer then
$n$ is a congruent number if and only if
$$
\#\left\{(a,b,c)\in\Z^3 : 4a^2 + b^2 + 8c^2 = \frac{n}{2} : c\text{\rm{} is even}\right\}$$
$$
  \qquad\qquad\qquad\qquad\qquad   =  
  \#\left\{(a,b,c) : 4a^2 + b^2 + 8c^2 = \frac{n}{2}: c\text{\rm{} is odd}\right\}.$$
If~$n$ is odd and square free then 
$n$ is a congruent number if and only if
$$\#\left\{(a,b,c) : 2a^2 + b^2 + 8c^2 = n : c\text{\rm{} is even}\right\}$$
$$  \qquad\qquad\qquad\qquad\qquad = 
    \#\left\{(a,b,c) : 2a^2 + b^2 + 8c^2 = n: c\text{\rm{} is odd}\right\}.$$
\end{conjecture}

The book \cite{koblitz:cong} is about congruent numbers and
Conjecture~\ref{conj:cong}.  The Birch and Swinnerton-Dyer conjecture
is a Clay Math Institute million dollar millennium prize problem (see
\cite{cmi, wiles:cmi}).
  


\begin{exercises}
\item\label{ex:singgrp} Write down an equation $y^2 = x^3 +ax + b$ over a field
$K$ such that $-16(4a^3+27b^2)= 0$.  Precisely what goes wrong
when trying to endow the set 
$E(K) = \{ (x,y)\in K\cross K : y^2 = x^3 + ax +b \} \union \{\O\}$
with a group structure?

\item\label{ex:ell2} One rational solution to the equation
$y^2=x^3-2$ is $(3,5)$.  Find a rational solution with $x\neq 3$ by
drawing the tangent line to $(3,5)$ and computing the second point of
intersection.

\item\label{ex:ell4} 
Let~$E$ be the elliptic curve over the finite 
field $K=\Z/5\Z$ defined by the equation 
$$
y^2 = x^3 + x +1.
$$  
\begin{enumerate}
\item List all~$9$ elements of~$E(K)$.
\item What is the structure of 
$E(K)$, as a product of cyclic groups?
\end{enumerate}

\item\label{ex:ell11} 
Let~$E$ be the elliptic curve 
defined by the equation $y^2 = x^3 +1$.  
For each prime $p\geq 5$, let $N_p$ be the cardinality of the group
$E(\zmod{p})$ of points on this curve having coordinates 
in $\zmod{p}$.  For example, we have that
$N_{5} = 6, N_{7} = 12, N_{11} = 12, N_{13} = 12, 
N_{17} = 18, N_{19} = 12, , N_{23} = 24, \text{ and }N_{29} = 30$
(you do not have to prove this).
\begin{enumerate}
\item  For the set of primes satisfying $p\con 2\pmod{3}$, can you see a
  pattern for the values of $N_p$?  Make a general conjecture for the
  value of $N_p$ when $p\con 2\pmod{3}$.
\item (*) Prove your conjecture.
\end{enumerate}

\item\label{ex:ell13} 
Let~$E$ be an elliptic curve over the real numbers~$\R$.
Prove that $E(\R)$ is not a finitely generated abelian group.

%\item 
%The Hasse bound for $p=5$ asserts that if $E$
%is an elliptic curve over $\Z/5\Z$,
%then $|\#E(\Z/5\Z) - 6| \leq 4$.

\item\label{ex:ector} (*)
Suppose $G$ is a finitely generated abelian group.
Prove that the subgroup $G_{\tor}$ of elements of finite
order in $G$ is finite.


\item \label{ex:elltrans}
 Suppose $y^2=x^3+ax+b$ with $a,b\in\Q$ defines an elliptic
curve.  Show that there is another equation $Y^2=X^3+AX+B$ with
$A,B\in\Z$ whose solutions are in bijection with the  
solutions to $y^2=x^3+ax+b$.


\item\label{ex:pythag} Suppose $a$, $b$, $c$ are relatively prime
  integers with $a^2+b^2=c^2$.  Then there exist integers $x$ and $y$
  with $x>y$ such that $c=x^2+y^2$ and either $a=x^2-y^2$, $b=2xy$ or
  $a=2xy$, $b=x^2-y^2$.


\item\label{ex:flt4}(*) Fermat's Last Theorem for exponent $4$ asserts
  that any solution to the equation $x^4+y^4=z^4$ with $x,y,z\in\Z$
  satisfies $xyz=0$.  Prove of Fermat's Last
  Theorem for exponent $4$, as follows.
\begin{enumerate}
\item Show that if the equation $x^2+y^4=z^4$ has no integer 
solutions with $xyz\neq 0$, then Fermat's Last Theorem for exponent~$4$ 
is true.
\item Prove that $x^2+y^4=z^4$ has no integer solutions with $xyz\neq 0$
as follows.
Suppose $n^2+k^4=m^4$ is a solution with $m>0$ minimal amongst
all solutions.  Show that there exists a solution with $m$ smaller 
using \exref{ch:ec}{ex:pythag} (consider two cases).
\end{enumerate}

\item\label{ex:cong1}(*) Prove that $1$ is not a congruent number by showing that
the elliptic curve $y^2=x^3-x$ has no rational solutions
except $(0,1)$ and $(0,0)$, as follows:
\begin{enumerate}
\item Write $y=\frac{p}{q}$ and $x=\frac{r}{s}$, where $p,q,r,s$ are
all positive integers and $\gcd(p,q)=\gcd(r,s)=1$.  Prove that $s\mid
q$, so $q=sk$ for some $k\in\Z$.
\item Prove that $s=k^2$, and substitute to see that
$p^2=r^3-rk^4$.
\item Prove that $r$ is a perfect square by supposing 
there is a prime~$\ell$ such that $\ord_{\ell}(r)$ is
odd and analyzing $\ord_{\ell}$ of both sides of 
$p^2=r^3-rk^4$.  
\item Write $r=m^2$, and substitute to
see that $p^2=m^6-m^2k^4$. Prove that $m\mid p$.  
\item Divide through by $m^2$ and deduce a contradiction 
to \exref{ch:ec}{ex:flt4}.
\end{enumerate}




\end{exercises}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%  
%% Chapter: Number Theory with Python
%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\chapter{Computational Number Theory}
\label{ch:computing}
In this chapter, we discuss how to use the computer language
Python\index{Python|(} to do computations with many of the mathematical
objects discussed in this book.  One reason we separate this chapter
from the other chapters is that the best order for presenting theory
is in many cases not the best order for presenting algorithms that
rely on that theory.  For example, in Section~\ref{sec:lineq} we gave
theoretical criterion for whether or not a linear equation $ax\con
b\pmod{n}$ has a solution, and it wasn't until
Section~\ref{sec:arith_mod_n} that we described an algorithm for
solving them.  Moreover, extensive asides on issues related to
implementing algorithms would obstruct the flow of the earlier
chapters.

We use Python \cite{python} because it is free and includes arbitrary
precision integer arithmetic, but does {\em not} include substantial
number theoretic functionality.  If we were to use one of the major
packages such as Mathematica, Maple, MATLAB, or MAGMA, then this
chapter would be a manual describing how to use various builtin
functions, instead of a chapter about how those functions actually
work.  Also, Python code is concise and easy to read.
A drawback to using Python is that some of the algorithms we
implemented for this book run more slowly than they would if
implemented in certain other languages.  We believe the clarity of
having complete implementations of the relevant algorithms for this
book easily available in a readable form is worth the tradeoff.

If you do not wish to use Python, you can still learn from this
chapter.  View the Python listings as pseudocode, and try to
understand the details of how the algorithms work.  In contrast, if
you would like to understand Python well, great places to start are
\url{http://docs.python.org/tut} and \url{http://diveintopython.org}.
Also, in this chapter we will describe new language feature as we
first encounter them.


Python is freely available  from \url{http://www.python.org}.
The examples in this chapter assume you are using Python version at
least 2.3.  You can download a file that contains all of the code
printed on the following pages from
\begin{center}\url{http://modular.fas.harvard.edu/ent/}.\end{center}
Put the file {\tt ent.py} in a directory, start up Python, and load
the functions from {\tt ent.py} by typing the following:
%session
\begin{verbatim}{}
>>> from ent import *
\end{verbatim}
You might also install IPython (\url{http://ipython.scipy.org}),\index{IPython}
which provides a friendly interface to Python with better support
for mathematics and documentation. 


The examples in this chapter have been automatically tested using the
default Python 2.3 shell.  Some examples contain numbers
that are obtained using randomized algorithms, so
output may be different for you.  Lines containing
such output are indicated by a comment {\tt \#rand}.


Some of the functions defined in this chapter use the Python functions
{\tt log} and {\tt sqrt}  from the Python {\tt math} library,
and the {\tt randrange} function from the {\tt random} library.    
The code below assume these three functions have been imported 
as follows:
\begin{verbatim}{}
from random import randrange
from math import log, sqrt
\end{verbatim}

In Python the notation {\tt ==} means ``equals'', 
{\tt !=} means ``not equals'', {\tt >=} means $\geq$
and {\tt <=} means $\leq$.  Another important convention
in Python is that if $n$ and $m$ are integers, then
the expression {\tt n/m} evaluates to the biggest integer $\leq n/m$, 
as the following examples illustrate:
%session
\begin{verbatim}{}
>>> 7/5
1
>>> -2/3
-1
\end{verbatim}
To obtain a floating point approximation to a rational number
use a decimal point or coerce at least
one of the integers to a {\tt float}
%session
\begin{verbatim}{}
>>> 1.0/3
0.33333333333333331
>>> float(2)/3
0.66666666666666663
\end{verbatim}

\section{Prime Numbers}
The main algorithms relevant to Chapter~\ref{ch:primes} are
Algorithm~\ref{alg:gcd} for computing greatest common divisors, 
an algorithm for integer
factorization, and Algorithm~\ref{alg:sieve} which
computes all primes up to a certain bound.
\subsection{Greatest Common Divisors}\label{sec:comp_gcd}
The following is an implementation of Algorithm~\ref{alg:gcd}.
\begin{verbatim}{Greatest Common Divisor}
def gcd(a, b):                                        # (1)
    """
    Returns the greatest commond divisor of a and b.
    Input:
        a -- an integer
        b -- an integer
    Output:
        an integer, the gcd of a and b
    Examples:
    >>> gcd(97,100)
    1
    >>> gcd(97 * 10**15, 19**20 * 97**2)              # (2)
    97L
    """
    if a < 0:  a = -a
    if b < 0:  b = -b
    if a == 0: return b
    if b == 0: return a
    while b != 0:                                     # (3)
        (a, b) = (b, a%b)                             # (4)
    return a
\end{verbatim}
In line (1) we declare the name of the function and the two input arguments
{\tt a} and {\tt b}.
Notice how the rest of the function is indented.
In Python indentation has meaning, e.g., it determines
the scope of the definition of the {\tt gcd} function and
the {\tt while} loop in lines (3) and (4).
The part of Listing~\ref{listing:Greatest Common Divisor}
between triple quotes is a documentation string; it is where we
describe the {\tt gcd} function, its input and output, and gives
examples of usage.  All functions defined in this chapter 
include such a documentation string, which is usually longer than the
actual code that implements the function.  From within
{\tt IPython} the documentation string can be accessed by
typing {\tt gcd?}.

In line (2) notice that exponentiation $x^y$ in Python is denoted {\tt
  x**y}.  The output of the second example is {\tt 97L} instead of
{\tt 97} because Python implements two types of integers, {\tt int}
and {\tt long}.  The {\tt int} type represents integers that fit
within the ``word size'' of the computer.  The {\tt long} type
represents integers of arbitrary size, but computations with them are
slower than with {\tt int}.  When a computation involving an {\tt int}
results in an integer that is larger than can fit in an {\tt int}, the
result is of type {\tt long}.  The reason {\tt 97L} is printed instead
of {\tt 97} is that {\tt long}s are printed with a trailing {\tt L},
as the following example illustrates.
%session
\begin{verbatim}{}
>>> 100**2
10000
>>> 10**20
100000000000000000000L
\end{verbatim}
The rest of the code implements Algorithm~\ref{alg:gcd}.  
The expression {\tt a\%b}, read ``$a$ mod $b$'', in the while loop
is Python's notation for the the unique integer~$r$ such
that $0\leq r<|b|$ and $a=bq+r$ for some $q\in\Z$.
The command {\tt (a,b)=(b,a\%b)}
simultaneously sets~{\tt a} to~{\tt b}
and~{\tt b} to the remainder {\tt a\%b}. 

\subsection{Enumerating Primes}\label{sec:comp_enum_primes}
Listing~\ref{listing:Sieve of Eratosthenes} contains an implementation
of Algorithm~\ref{alg:sieve}.  
\begin{verbatim}{Sieve of Eratosthenes}
def primes(n):
    """
    Returns a list of the primes up to n, computed 
    using the Sieve of Eratosthenes.
    Input:
        n -- a positive integer
    Output:
        list -- a list of the primes up to n
    Examples:
    >>> primes(10)
    [2, 3, 5, 7]
    >>> primes(45)
    [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43]
    """
    if n <= 1: return []
    X = range(3,n+1,2)                            # (1)
    P = [2]                                       # (2)
    sqrt_n = sqrt(n)                              # (3)
    while len(X) > 0 and X[0] <= sqrt_n:          # (4)
        p = X[0]                                  # (5)
        P.append(p)                               # (6)
        X = [a for a in X if a%p != 0]            # (7)
    return P + X                                  # (8)
\end{verbatim}
In the line labeled (1) we create the list {\tt X} of odd numbers $i$
with $3\leq i<n+1$ using Python's {\tt range} function.  In line (2)
we create the list {\tt P} with the single element 2.  In line (3) we
compute $\sqrt{n}$ using the {\tt sqrt} library function imported
earlier.  Line (4) sets up a while loop that iterates until either
{\tt X} is empty or the first element of {\tt X} is greater than
$\sqrt{n}$.  Line (5) sets~{\tt p} equal to the first element of {\tt
  X}, then line (6) appends~{\tt p} to the end of~{\tt P}.  Line (7)
deletes the elements of {\tt X} that are divisible by {\tt p}. 
Finally line (8) is executed after the while loop terminates, and
returns the concatenation of~{\tt P} and~{\tt X}.

Our implementation of {\tt primes} makes extensive use the Python
{\tt list} data type.     The following examples further illustrate 
use of lists:
%session
\begin{verbatim}{}
>>> range(10)            # range(n) is from 0 to n-1       
[0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
>>> range(3,10)          # range(a,b) is from a to b-1
[3, 4, 5, 6, 7, 8, 9]
>>> [x**2 for x in range(10)]
[0, 1, 4, 9, 16, 25, 36, 49, 64, 81]
>>> [x**2 for x in range(10) if x%4 == 1]
[1, 25, 81]
>>> [1,2,3] + [5,6,7]    # concatenation
[1, 2, 3, 5, 6, 7]
>>> len([1,2,3,4,5])     # length of a list
5
>>> x = [4,7,10,'gcd']   # mixing types is fine
>>> x[0]                 # 0-based indexing
4
>>> x[3]
'gcd'
>>> x[3] = 'lagrange'    # assignment
>>> x.append("fermat")   # append to end of list
>>> x
[4, 7, 10, 'lagrange', 'fermat']
>>> del x[3]             # delete entry 3 from list
>>> x
[4, 7, 10, 'fermat']
\end{verbatim}

The following examples illustrate an application
of the {\tt primes} function to computation
of the number $\pi(x)$ of primes up to~$x$.
%session
\begin{verbatim}{}
>>> v = primes(10000)
>>> len(v)    # this is pi(10000)
1229
>>> len([x for x in v if x < 1000])   # pi(1000)
168
>>> len([x for x in v if x < 5000])   # pi(5000)
669
\end{verbatim}


\subsection{Integer Factorization}\label{sec:alg_intfac}
We implement integer factorization using two functions.  The first
function splits off a factor using an algorithm such as trial
division, the Pollard $p-1$ method, or the elliptic curve method.  The
second splits off factors until~$n$ is completely factored.
Listing~\ref{listing:Integer Factorization} contains an implementation
of a factorization algorithm, which by default uses the trial division
splitting algorithm implemented in Listing~\ref{listing:Trial
  Division}.  In Section~\ref{sec:comp_elliptic_curves} we will see
how to use the Pollard $p-1$ and elliptic
curve algorithms for splitting off factors.

Trial division is a simple method for splitting off the smallest prime
factor of an integer.  If it splits off a factor, then that factor is
guaranteed to be prime.  The implementation below quickly factors
numbers with up to about $12$ digits, and can also be used to factor
off small primes from a large number.
\begin{verbatim}{Trial Division}
def trial_division(n, bound=None):
    """
    Return the smallest prime divisor <= bound of the 
    positive integer n, or n if there is no such prime.  
    If the optional argument bound is omitted, then bound=n.
    Input:
        n -- a positive integer
        bound - (optional) a positive integer
    Output:
        int -- a prime p<=bound that divides n, or n if
               there is no such prime.
    Examples:
    >>> trial_division(15)
    3
    >>> trial_division(91)
    7
    >>> trial_division(11)
    11
    >>> trial_division(387833, 300)   
    387833
    >>> # 300 is not big enough to split off a 
    >>> # factor, but 400 is.
    >>> trial_division(387833, 400)  
    389
    """
    if n == 1: return 1
    for p in [2, 3, 5]:
        if n%p == 0: return p
    if bound == None: bound = n
    dif = [6, 4, 2, 4, 2, 4, 6, 2]
    m = 7; i = 1
    while m <= bound and m*m <= n:
        if n%m == 0:
            return m
        m += dif[i%8]
        i += 1
    return n
\end{verbatim}
When declaring {\tt trial\_division} the second
argument is {\tt bound=None}.  This means the second argument
is optional, and if the user omits it when calling
{\tt  trial\_division}, then {\tt bound} is set equal
to {\tt None}.   In the while
loop we use {\tt +=}, e.g., in the line {\tt i += 1}.
This has exactly the same effect as {\tt i=i+1}, but may be
implemented more efficiently.    

The following two observations are needed to see that the
implementation in Listing~\ref{listing:Trial Division}
is correct.  First, in order to find a divisor of~$n$ it is only 
necessary to consider integers $m\leq \sqrt{n}$.  This is because
if $m>\sqrt{n}$ and $m\mid n$, then $n/m$ also divides~$n$ and
$n/m<\sqrt{n}$.  Second, for efficiently the implementation above
does not simply march through all $m\leq \sqrt{n}$, but
after checking that none of $2,3,5$ divides~$n$, starts
with $m=7$ and increments~$m$ by each of 
$4,2,4,2,4,6,2,6$ in turn, cycling around. 
This has the affect of skipping those~$m$ 
that are divisible by $2$, $3$, or $5$.  
The reason is that the numbers modulo $30$ that are
coprime to $2,3,5$ are exactly $7$, $7+4$, $7+4+2$, 
$7+4+2+4$, etc.  One could, of course, replace $30$ by
$210=2\cdot 3\cdot 5\cdot 7$ at the expense of
replacing {\tt dif} by a longer list (see \exref{ch:computing}{ex:trialdiv}).

Listing~\ref{listing:Integer Factorization} contains
an implementation of a factorization algorithm
that uses {\tt trial\_division}. 
\begin{verbatim}{Integer Factorization}
def factor(n):
    """
    Returns the factorization of the integer n as 
    a sorted list of tuples (p,e), where the integers p
    are output by the split algorithm.  
    Input:
        n -- an integer
    Output:
        list -- factorization of n
    Examples:
    >>> factor(500)
    [(2, 2), (5, 3)]
    >>> factor(-20)
    [(2, 2), (5, 1)]
    >>> factor(1)
    []
    >>> factor(2004)
    [(2, 2), (3, 1), (167, 1)]
    """
    if n in [-1, 0, 1]: return []
    if n < 0: n = -n
    F = []
    while n != 1:
        p = trial_division(n)
        e = 1
        n /= p
        while n%p == 0:
            e += 1; n /= p
        F.append((p,e))
    F.sort()
    return F
\end{verbatim}

The pairs $(p,e)$ in the factorization are represented
as tuples.  The {\tt tuple} type is
similar to the list type, with some exceptions.  The
following examples illustrate usage of the
{\tt tuple} type:
%session
\begin{verbatim}{}
>>> x=(1, 2, 3)       # creation
>>> x[1]
2
>>> (1, 2, 3) + (4, 5, 6)  # concatenation
(1, 2, 3, 4, 5, 6)
>>> (a, b) = (1, 2)        # assignment assigns to each member
>>> print a, b
1 2
>>> for (c, d) in [(1,2), (5,6)]:   
...     print c, d
1 2
5 6
>>> x = 1, 2          # parentheses optional in creation
>>> x
(1, 2)
>>> c, d = x          # parentheses also optional 
>>> print c, d
1 2
\end{verbatim}



\section{The Ring of Integers Modulo $n$}


The main algorithmic issues of Chapter~\ref{ch:cong} are solving
linear equations and systems of linear equations in one variable
modulo~$n$, computing powers quickly, finding a generator of
$(\zmod{p})^*$, and determining whether or not a number is prime.

\subsection{Linear Equations Modulo $n$}\label{sec:comp_lin_eq}
Listing~\ref{listing:Extended GCD} is an implementation of
Algorithm~\ref{alg:inversemod} for computing $g$
and integers $x,y$ such that $ax+by=g$.
\begin{verbatim}{Extended GCD}
def xgcd(a, b):
    """
    Returns g, x, y such that g = x*a + y*b = gcd(a,b).
    Input:
        a -- an integer
        b -- an integer
    Output:
        g -- an integer, the gcd of a and b
        x -- an integer
        y -- an integer
    Examples:
    >>> xgcd(2,3)
    (1, -1, 1)
    >>> xgcd(10, 12)
    (2, -1, 1)
    >>> g, x, y = xgcd(100, 2004)
    >>> print g, x, y
    4 -20 1
    >>> print x*100 + y*2004
    4
    """
    if a == 0 and b == 0: return (0, 0, 1)
    if a == 0: return (abs(b), 0, b/abs(b))
    if b == 0: return (abs(a), a/abs(a), 0)
    x_sign = 1; y_sign = 1
    if a < 0: a = -a; x_sign = -1
    if b < 0: b = -b; y_sign = -1
    x = 1; y = 0; r = 0; s = 1
    while b != 0:
        (c, q) = (a%b, a/b)
        (a, b, r, s, x, y) = (b, c, x-q*r, y-q*s, r, s)
    return (a, x*x_sign, y*y_sign)
\end{verbatim}

Using Proposition \ref{prop:cancel2} and {\tt xgcd} we 
obtain the following algorithm for computing the 
inverse of $a\pmod{n}$.
\begin{verbatim}{Inverse Modulo}
def inversemod(a, n):
    """
    Returns the inverse of a modulo n, normalized to
    lie between 0 and n-1.  If a is not coprime to n,
    raise an exception (this will be useful later for 
    the elliptic curve factorization method).
    Input:
        a -- an integer coprime to n
        n -- a positive integer
    Output:
        an integer between 0 and n-1.
    Examples:
    >>> inversemod(1,1)
    0
    >>> inversemod(2,5)
    3
    >>> inversemod(5,8)
    5
    >>> inversemod(37,100)
    73
    """
    g, x, y = xgcd(a, n)
    if g != 1:
        raise ZeroDivisionError, (a,n)
    assert g == 1, "a must be coprime to n."
    return x%n
\end{verbatim}

Proposition~\ref{prop:cancel2} leads to the algorithm
implemented in Listing~\ref{listing:Solve Linear Modulo}
for solving a linear equation $ax\con b\pmod{n}$.
In line (1) we compute $c$ such that $ac \con g \pmod{n}$;
also in line (1) the underscore means that the third value
returned by {\tt xgcd} should be ignored (not saved to a variable).
Since $g\mid a$ and $g\mid n$, we have $(a/g)c \con 1 \pmod{n/g}$,
and multiplying by~$b$, rearranging, and using
that $g\mid b$, yields $a(b/g)c \con b \pmod{bn/g}$.
Thus $(b/g)c$ solves the equation $ax\con b\pmod{n}$.

\begin{verbatim}{Solve Linear Modulo}
def solve_linear(a,b,n):
    """
    If the equation ax = b (mod n) has a solution, return a 
    solution normalized to lie between 0 and n-1, otherwise
    returns None.
    Input:
        a -- an integer
        b -- an integer
        n -- an integer
    Output:
        an integer or None
    Examples:
    >>> solve_linear(4, 2, 10)
    8
    >>> solve_linear(2, 1, 4) == None
    True
    """
    g, c, _ = xgcd(a,n)                 # (1)
    if b%g != 0: return None
    return ((b/g)*c) % n                
\end{verbatim}


In Listing~\ref{listing:Chinese Remainder Theorem} we implement
Algorithm~\ref{alg:crt} for solving Chinese Remainder Theorem 
problems.
\begin{verbatim}{Chinese Remainder Theorem}
def crt(a, b, m, n):
    """
    Return the unique integer between 0 and m*n - 1 
    that reduces to a modulo n and b modulo m, where
    the integers m and n are coprime. 
    Input:
        a, b, m, n -- integers, with m and n coprime
    Output:
        int -- an integer between 0 and m*n - 1.
    Examples:
    >>> crt(1, 2, 3, 4)
    10
    >>> crt(4, 5, 10, 3)
    14
    >>> crt(-1, -1, 100, 101)
    10099
    """
    g, c, _ = xgcd(m, n)                       
    assert g == 1, "m and n must be coprime."
    return (a + (b-a)*c*m) % (m*n)
\end{verbatim}

\subsection{Computation of Powers}\label{sec:comp_powermod}
In Listing~\ref{listing:Power Modulo} we implement
Algorithm~\ref{alg:power} for quickly computing large
powers of an integer modulo~$n$.
\begin{verbatim}{Power Modulo}
def powermod(a, m, n):
    """
    The m-th power of a modulo n.
    Input:
        a -- an integer
        m -- a nonnegative integer
        n -- a positive integer
    Output:
        int -- an integer between 0 and n-1
    Examples:
    >>> powermod(2,25,30)
    2
    >>> powermod(19,12345,100)
    99
    """
    assert m >= 0, "m must be nonnegative."   # (1)
    assert n >= 1, "n must be positive."      # (2)
    ans = 1
    apow = a
    while m != 0:
        if m%2 != 0:
            ans = (ans * apow) % n            # (3)
        apow = (apow * apow) % n              # (4)
        m /= 2   
    return ans % n
\end{verbatim}
The two {\tt assert} statements in lines (1) and (2) express
conditions that must be satisfied by the input to the function.  If
either condition is not satisfied, the function terminates and the
corresponding error message is printed.  In the while loop,
in lines (3) and (4), we reduce each intermediate integer modulo~$n$,
since otherwise the integers involved could be huge. 

\subsection{Finding a Primitive Root}\label{sec:algprim}
Listing~\ref{listing:Primitive Root} contains an implementation
of Algorithm~\ref{alg:primitive_root} for computing a primitive
root modulo~$p$.
\begin{verbatim}{Primitive Root}
def primitive_root(p):
    """
    Returns first primitive root modulo the prime p.
    (If p is not prime, this return value of this function
    is not meaningful.)
    Input:
        p -- an integer that is assumed prime
    Output:
        int -- a primitive root modulo p
    Examples:
    >>> primitive_root(7)
    3
    >>> primitive_root(389)
    2
    >>> primitive_root(5881)
    31
    """
    if p == 2: return 1
    F = factor(p-1)
    a = 2
    while a < p:
        generates = True
        for q, _ in F:
            if powermod(a, (p-1)/q, p) == 1:
                generates = False
                break
        if generates: return a
        a += 1
    assert False, "p must be prime."
\end{verbatim}

\subsection{Determining Whether a Number is Prime}
\label{sec:comp_primality}\index{primality test!pseudoprime}
In Listing~\ref{listing:Is Pseudoprime} we define a function
that decides whether or not an integer is a pseudoprime to
several bases.  See Section~\ref{sec:prob_prime_test} for
the connection between primes and pseudo-primes.

\begin{verbatim}{Is Pseudoprime}
def is_pseudoprime(n, bases = [2,3,5,7]):
    """
    Returns True if n is a pseudoprime to the given bases,
    in the sense that n>1 and b**(n-1) = 1 (mod n) for each 
    elements b of bases, with b not a multiple of n, and 
    False otherwise.   
    Input:
        n -- an integer
        bases -- a list of integers
    Output:
        bool 
    Examples:
    >>> is_pseudoprime(91)
    False
    >>> is_pseudoprime(97)
    True
    >>> is_pseudoprime(1)
    False
    >>> is_pseudoprime(-2)
    True
    >>> s = [x for x in range(10000) if is_pseudoprime(x)]
    >>> t = primes(10000)
    >>> s == t 
    True
    >>> is_pseudoprime(29341) # first non-prime pseudoprime
    True
    >>> factor(29341)
    [(13, 1), (37, 1), (61, 1)]
    """
    if n < 0: n = -n                                
    if n <= 1: return False
    for b in bases:                       
        if b%n != 0 and powermod(b, n-1, n) != 1:       
            return False
    return True
\end{verbatim}
We iterate over the elements $b$ of {\tt bases}, and for each~$b$ that is not a multiple of $n$, we decide 
whether $b^{n-1}\con 1\pmod{n}$.   If not, then~$n$ 
is definitely not prime so we return {\tt False}; if 
the congruence is satisfied for all $b$, return {\tt True}.

The following session illustrates that for the default bases $2,3,5,7$,  the 
first non-prime pseudoprime is 29341,
and for the bases $2,3,5,7,11,13$, then the first non-prime 
pseudoprime is $162401$:
%session
\begin{verbatim}{}
>>> P = [p for p in range(200000) if is_pseudoprime(p)]
>>> Q = primes(200000)
>>> R = [x for x in P if not (x in Q)]; print R
[29341, 46657, 75361, 115921, 162401]
>>> [n for n in R if is_pseudoprime(n,[2,3,5,7,11,13])]
[162401]
>>> factor(162401)
[(17, 1), (41, 1), (233, 1)]
\end{verbatim}

We next turn to the Miller-Rabin primality test.\index{primality test!Miller-Rabin}  First
we state the algorithm precisely with proof, and give an implementation
in Listing~\ref{listing:Miller-Rabin Primality Test}
\begin{algorithm}{Miller-Rabin Primality Test}\label{alg:miller_rabin}
Given an integer~$n\geq 5$ this algorithm 
outputs either true or false.  If it outputs
true, then $n$ is ``probably prime'', and if
it outputs false, then $n$ is definitely composite.
\begin{steps}
\item{}[Split Off Power of $2$] 
Compute the unique integers $m$ and $k$ such that~$m$ is
odd  and $n-1=2^k \cdot m $.
\item{}[Random Base] Choose a random integer $a$ with $1<a<n$.
\item{}[Odd Power] Set $b\assign a^m\pmod{n}$.
If $b\con \pm 1\pmod{n}$ 
output true and terminate.
\item{}[Even Powers] If $b^{2^r}\con -1 \pmod{n}$ for any
$r$ with $1\leq r\leq k-1$, output true and terminate.
Otherwise output false.
\end{steps}
\end{algorithm}
If Miller-Rabin outputs true for~$n$, we can call it again
with~$n$ and if it again outputs true then the probability
that~$n$ is prime increases.   
\begin{proof}
We will prove that the algorithm is correct, but will prove
nothing about how likely the algorithm is to assert that
a composite is prime.  
We must prove that if the
algorithm pronounces an integer~$n$ composite, then~$n$
really is composite.  Thus suppose~$n$ is prime, 
yet the algorithm pronounces~$n$ composite.  
Then $a^m\not\con \pm 1\pmod{n}$, and for
all $r$ with $1\leq r\leq k-1$ we have
$a^{2^r m} \not \con -1\pmod{n}$.
Since $n$ is prime and $2^{k-1}m = (n-1)/2$, 
Proposition~\ref{prop:euler} 
implies that  $a^{2^{k-1}m}\con \pm 1\pmod{n}$,
so by our hypothesis $a^{2^{k-1}m}\con 1\pmod{n}$.
But then $(a^{2^{k-2}m})^2 \con 1\pmod{n}$, so by
Proposition~\ref{prop:atmost}, we have $a^{2^{k-2}m}\con \pm 1\pmod{n}$.
Again, by our hypothesis, this implies 
$a^{2^{k-2}}\con 1\pmod{n}$.  Repeating this argument
inductively we see that $a^m\con \pm 1\pmod{n}$,
which contradicts our hypothesis on~$a$.   
\end{proof}

The implementation of Algorithm~\ref{alg:miller_rabin}
in Listing~\ref{listing:Miller-Rabin Primality
  Test} runs the Miller-Rabin primality test on~$n$ several times (a
default of $4$) and returns true only if~$n$ is declared probably
prime every time.  One of the examples illustrate how Miller-Rabin
sometimes gives incorrect results.
\begin{verbatim}{Miller-Rabin Primality Test}
def miller_rabin(n, num_trials=4):
    """
    True if n is likely prime, and False if n 
    is definitely not prime.  Increasing num_trials
    increases the probability of correctness.
    (One can prove that the probability that this 
    function returns True when it should return
    False is at most (1/4)**num_trials.)
    Input:
        n -- an integer
        num_trials -- the number of trials with the 
                      primality test.   
    Output:
        bool -- whether or not n is probably prime.
    Examples:    
    >>> miller_rabin(91)
    False                         #rand
    >>> miller_rabin(97)
    True                          #rand
    >>> s = [x for x in range(1000) if miller_rabin(x, 1)]
    >>> t = primes(1000)
    >>> print len(s), len(t)  # so 1 in 25 wrong
    175 168                       #rand
    >>> s = [x for x in range(1000) if miller_rabin(x)]
    >>> s == t                    
    True                          #rand
    """
    if n < 0: n = -n
    if n in [2,3]: return True
    if n <= 4: return False
    m = n - 1
    k = 0
    while m%2 == 0:
        k += 1; m /= 2
    # Now n - 1 = (2**k) * m with m odd
    for i in range(num_trials):
        a = randrange(2,n-1)                  # (1)
        apow = powermod(a, m, n)
        if not (apow in [1, n-1]):            
            some_minus_one = False
            for r in range(k-1):              # (2)
                apow = (apow**2)%n
                if apow == n-1:
                    some_minus_one = True
                    break                     # (3)
        if (apow in [1, n-1]) or some_minus_one:
            prob_prime = True
        else:
            return False
    return True
\end{verbatim}

In line (1) we use {\tt randrange}; the command
{\tt randrange(a,b)} returns a random integer in the interval $[a,b-1]$.
Line (3) uses the {\tt break} statement, which
exists the immediately enclosing {\tt for} or {\tt while} loop;
in this case the {\tt for} loop starting at line (2).

\section{Public-Key Cryptography}
The main algorithms in Chapter~\ref{ch:crypto} deal with implementing
the Diffie-Hellman and RSA cryptosystems, and with some attacks on RSA
in special cases.  In this section we give a function for encoding an
arbitrary string as a sequence of numbers of some bounded size, and
vice-versa, then implement each of Diffie-Hellman and RSA.  
%% leave attacks as exercises

\subsection{The Diffie-Hellman Key Exchange}\label{sec:comp_DH}
In order for two parties to agree on a secret key using
Diffie-Hellman, we need a function to generate a large
random prime.   
\begin{verbatim}{Random Prime}
def random_prime(num_digits, is_prime = miller_rabin):
    """
    Returns a random prime with num_digits digits.
    Input:
        num_digits -- a positive integer
        is_prime -- (optional argment)
                    a function of one argument n that
                    returns either True if n is (probably)
                    prime and False otherwise.
    Output:
        int -- an integer
    Examples:
    >>> random_prime(10)
    8599796717L              #rand
    >>> random_prime(40)
    1311696770583281776596904119734399028761L  #rand
    """ 
    n = randrange(10**(num_digits-1), 10**num_digits)
    if n%2 == 0: n += 1
    while not is_prime(n): n += 2
    return n
\end{verbatim}

Suppose~$p$ is a large random prime.  Then it is extremely unlikely
that~$2$ will have small order modulo~$p$, so we will use $g=2$ as the
base for the key exchange.  The function {\tt dh\_init} below computes
and returns a random integer $n$ and $2^n\pmod{p}$.  Thus Nikita and
Michael should each call {\tt dh\_init} with input $p$, and send the
resulting $2^n\pmod{p}$ to each other.  Then each calls {\tt
  dh\_secret} with the powers of~$2$ they received to compute the the
shared secret key.  After defining {\tt dh\_init} and {\tt dh\_secret}
below, we give a complete nontrivial example.

\begin{verbatim}{Initialize Diffie-Hellman}
def dh_init(p):
    """
    Generates and returns a random positive
    integer n < p and the power 2^n (mod p). 
    Input:
        p -- an integer that is prime
    Output:
        int -- a positive integer < p,  a secret
        int -- 2^n (mod p), send to other user
    Examples:
    >>> p = random_prime(20)
    >>> dh_init(p)
    (15299007531923218813L, 4715333264598442112L)   #rand
    """
    n = randrange(2,p)
    return n, powermod(2,n,p)
\end{verbatim}

\begin{verbatim}{Diffie-Hellman Secret}
def dh_secret(p, n, mpow):
    """
    Computes the shared Diffie-Hellman secret key.
    Input:
        p -- an integer that is prime
        n -- an integer: output by dh_init for this user
        mpow-- an integer: output by dh_init for other user
    Output:
        int -- the shared secret key.
    Examples:
    >>> p = random_prime(20)
    >>> n, npow = dh_init(p)    
    >>> m, mpow = dh_init(p)
    >>> dh_secret(p, n, mpow) 
    15695503407570180188L      #rand
    >>> dh_secret(p, m, npow)    
    15695503407570180188L      #rand
    """
    return powermod(mpow,n,p)
\end{verbatim}

First Nikita and Michael generate a prime.
%session
\begin{verbatim}{}
>>> p = random_prime(50)
>>> p
13537669335668960267902317758600526039222634416221L #rand
\end{verbatim}
Nikita generates her secret $n$ and computes $2^n\pmod{p}$.
%session
\begin{verbatim}{}
>>> n, npow = dh_init(p)
>>> n
8520467863827253595224582066095474547602956490963L  #rand
>>> npow
3206478875002439975737792666147199399141965887602L  #rand
\end{verbatim}
Michael generates his secret $m$ and computes $2^m\pmod{p}$.
%session
\begin{verbatim}{}
>>> m, mpow = dh_init(p)
>>> m
3533715181946048754332697897996834077726943413544L  #rand
>>> mpow
3465862701820513569217254081716392362462604355024L  #rand
\end{verbatim}
At this point Nikita publicly announces {\tt npow} and
Michael publicly announces {\tt mpow}.  Nikita and Michael
can now compute the shared secret key.
%session
\begin{verbatim}{}
>>> dh_secret(p, n, mpow)
12931853037327712933053975672241775629043437267478L #rand
>>> dh_secret(p, m, npow)
12931853037327712933053975672241775629043437267478L #rand
\end{verbatim}


\subsection{Encoding Strings as Lists of Integers}\label{sec:encode_strings}
In order to encrypt actual messages, instead of single integers, we
define a function that converts an arbitrary string to a list of
integers, and another that converts a list of integers back to a
string.  

A chosen plain text attack is an attack on a cryptosystem in
which the attacker knows the unencrypted and encrypted versions of some
messages, and can use that information to deduce something about
future encrypted messages.  For example, if a remote weather station
encrypts the temperature and sends it encrypted, then an attacker who
knows the temperature at the weather station might know how that
temperature is encrypted.  To reduce the chance that such attacks could
weaken the cryptosystems implemented in this chapter, the function
{\tt str\_to\_numlist} randomizes its output, so the same string will
usually be encoded differently, depending on when the function is
called.

\begin{verbatim}{String to Number List}
def str_to_numlist(s, bound):
    """
    Returns a sequence of integers between 0 and bound-1 
    that encodes the string s.   Randomization is included, 
    so the same string is very likely to encode differently 
    each time this function is called. 
    Input:
        s -- a string
        bound -- an integer >= 256
    Output:
        list -- encoding of s as a list of integers 
    Examples:
    >>> str_to_numlist("Run!", 1000)
    [82, 117, 110, 33]               #rand
    >>> str_to_numlist("TOP SECRET", 10**20)
    [4995371940984439512L, 92656709616492L]   #rand
    """
    assert bound >= 256, "bound must be at least 256."
    n = int(log(bound) / log(256))          # (1)
    salt = min(int(n/8) + 1, n-1)           # (2)
    i = 0; v = []
    while i < len(s):                       # (3)
        c = 0; pow = 1
        for j in range(n):                  # (4)
            if j < salt:
                c += randrange(1,256)*pow   # (5)
            else:
                if i >= len(s): break 
                c += ord(s[i])*pow          # (6)
                i += 1
            pow *= 256                      
        v.append(c)
    return v
\end{verbatim}

In Listing~\ref{listing:String to Number List}, we 
view a string as a sequence of integers between $0$ and $255$.  In
line (1) we compute the number of characters that can be encoded in an
integer up to {\tt bound}; this is the block size.  In line (2) we
determine the number of random characters in each block.
The while loop (3) iterates until we have encoded every character of
the string in the list {\tt v} of numbers.  The for loop (4) iterates
over the number of characters in a block, forming a number in base
$256$.  The lower order digits are random (line 5), and the rest
encode actual text of the message (line 6).  The function {\tt ord}
used in line (6) converts a character to a number between $0$ and
$255$.  Listing~\ref{listing:Number List to String} takes a sequence
of integers output by {\tt str\_to\_numlist} and returns the
corresponding string.


\begin{verbatim}{Number List to String}
def numlist_to_str(v, bound):
    """
    Returns the string that the sequence v of 
    integers encodes. 
    Input:
        v -- list of integers between 0 and bound-1
        bound -- an integer >= 256
    Output:
        str -- decoding of v as a string
    Examples:
    >>> print numlist_to_str([82, 117, 110, 33], 1000)
    Run!
    >>> x = str_to_numlist("TOP SECRET MESSAGE", 10**20)
    >>> print numlist_to_str(x, 10**20)
    TOP SECRET MESSAGE
    """
    assert bound >= 256, "bound must be at least 256."
    n = int(log(bound) / log(256))
    s = ""
    salt = min(int(n/8) + 1, n-1)
    for x in v:
        for j in range(n):
            y = x%256
            if y > 0 and j >= salt:
                s += chr(y)
            x /= 256
    return s
\end{verbatim}

\subsection{The RSA Cryptosystem}\label{sec:comp_rsa}
Listings~\ref{listing:Initialize RSA}--\ref{listing:Decrypt Using RSA}
contain an implementation of the RSA cryptosystem.
\begin{verbatim}{Initialize RSA}
def rsa_init(p, q):
    """
    Returns defining parameters (e, d, n) for the RSA
    cryptosystem defined by primes p and q.  The
    primes p and q may be computed using the 
    random_prime functions.
    Input:
        p -- a prime integer
        q -- a prime integer
    Output:
        Let m be (p-1)*(q-1). 
        e -- an encryption key, which is a randomly
             chosen integer between 2 and m-1
        d -- the inverse of e modulo eulerphi(p*q), 
             as an integer between 2 and m-1
        n -- the product p*q.
    Examples:
    >>> p = random_prime(20); q = random_prime(20)
    >>> print p, q
    37999414403893878907L 25910385856444296437L #rand
    >>> e, d, n = rsa_init(p, q)
    >>> e
    5                                           #rand
    >>> d
    787663591619054108576589014764921103213L    #rand
    >>> n
    984579489523817635784646068716489554359L    #rand
    """
    m = (p-1)*(q-1)
    e = 3
    while gcd(e, m) != 1: e += 1
    d = inversemod(e, m)                  
    return e, d, p*q
\end{verbatim}
In Listing~\ref{listing:Initialize RSA}, we 
compute $m=\vphi(pq)$, find a random encryption exponent
that is coprime to~$m$, and compute the inverse of the
encryption exponent modulo~$m$.

\begin{verbatim}{Encrypt Using RSA}
def rsa_encrypt(plain_text, e, n):
    """
    Encrypt plain_text using the encrypt
    exponent e and modulus n.  
    Input:
        plain_text -- arbitrary string
        e -- an integer, the encryption exponent
        n -- an integer, the modulus
    Output:
        str -- the encrypted cipher text
    Examples:
    >>> e = 1413636032234706267861856804566528506075
    >>> n = 2109029637390047474920932660992586706589
    >>> rsa_encrypt("Run Nikita!", e, n)
    [78151883112572478169375308975376279129L]    #rand
    >>> rsa_encrypt("Run Nikita!", e, n)
    [1136438061748322881798487546474756875373L]  #rand
    """
    plain = str_to_numlist(plain_text, n)
    return [powermod(x, e, n) for x in plain]
\end{verbatim}
Listing~\ref{listing:Encrypt Using RSA} defines {\tt rsa\_encrypt},
which converts a plain text message
to a list of integers, then returns the $e$th powers of those integers
modulo~$n$, where~$e$ is the encryption exponent.

\begin{verbatim}{Decrypt Using RSA}
def rsa_decrypt(cipher, d, n):
    """
    Decrypt the cipher_text using the decryption
    exponent d and modulus n.
    Input:
        cipher_text -- list of integers output 
                       by rsa_encrypt
    Output:
        str -- the unencrypted plain text
    Examples:
    >>> d = 938164637865370078346033914094246201579
    >>> n = 2109029637390047474920932660992586706589
    >>> msg1 = [1071099761433836971832061585353925961069]
    >>> msg2 = [1336506586627416245118258421225335020977]
    >>> rsa_decrypt(msg1, d, n)
    'Run Nikita!'
    >>> rsa_decrypt(msg2, d, n)
    'Run Nikita!'
    """
    plain = [powermod(x, d, n) for x in cipher]
    return numlist_to_str(plain, n)
\end{verbatim}
In Listing~\ref{listing:Decrypt Using RSA} we define {\tt rsa\_decrypt},
which raises each input integer to the power of~$d$ modulo~$n$,
then converts the resulting list of integers back to a string.

\section{Quadratic Reciprocity}
The main algorithmic ideas in Chapter~\ref{ch:reciprocity}
are computation of the Legendre symbol, and an algorithm for
finding square roots in $\zmod{p}$.  
\subsection{Computing the Legendre Symbol}\label{sec:comp_legendre}
Corollary~\ref{cor:euler} provides a simple and efficient
algorithm to compute $\kr{a}{p}$, which we implement below.
\begin{verbatim}{Legendre Symbol}
def legendre(a, p):
    """
    Returns the Legendre symbol a over p, where
    p is an odd prime.
    Input:
        a -- an integer
        p -- an odd prime (primality not checked)
    Output:
        int: -1 if a is not a square mod p,
              0 if gcd(a,p) is not 1
              1 if a is a square mod p.
    Examples:
    >>> legendre(2, 5)
    -1
    >>> legendre(3, 3)
    0
    >>> legendre(7, 2003)
    -1
    """
    assert p%2 == 1, "p must be an odd prime."
    b = powermod(a, (p-1)/2, p)
    if b == 1: return 1
    elif b == p-1: return -1
    return 0
\end{verbatim}

\subsection{Finding Square Roots}\label{sec:comp_sqrt}
In this section we implement the algorithm
of Section~\ref{sec:findingsqrt} for finding square
roots of integers modulo~$p$.
\begin{verbatim}{Square Root Modulo}
def sqrtmod(a, p):
    """
    Returns a square root of a modulo p.
    Input:
        a -- an integer that is a perfect 
             square modulo p (this is checked)
        p -- a prime
    Output:
        int -- a square root of a, as an integer
               between 0 and p-1.
    Examples:
    >>> sqrtmod(4, 5)              # p == 1 (mod 4)
    3              #rand
    >>> sqrtmod(13, 23)            # p == 3 (mod 4)
    6              #rand
    >>> sqrtmod(997, 7304723089)   # p == 1 (mod 4)
    761044645L     #rand
    """
    a %= p
    if p == 2: return a 
    assert legendre(a, p) == 1, "a must be a square mod p."
    if p%4 == 3: return powermod(a, (p+1)/4, p)

    def mul(x, y):   # multiplication in R       # (1)
        return ((x[0]*y[0] + a*y[1]*x[1]) % p, \
                (x[0]*y[1] + x[1]*y[0]) % p)
    def pow(x, n):   # exponentiation in R       # (2)
        ans = (1,0)
        xpow = x
        while n != 0:
           if n%2 != 0: ans = mul(ans, xpow)
           xpow = mul(xpow, xpow)
           n /= 2
        return ans

    while True:
        z = randrange(2,p)
        u, v = pow((1,z), (p-1)/2)
        if v != 0:
            vinv = inversemod(v, p)
            for x in [-u*vinv, (1-u)*vinv, (-1-u)*vinv]:
                if (x*x)%p == a: return x%p
            assert False, "Bug in sqrtmod."
\end{verbatim}
The implementation above follows the algorithm in
Section~\ref{sec:findingsqrt} closely.  In lines (1) and (2) we define
the functions {\tt mul} and {\tt pow} for multiplying two elements of
the ring $R$ of Section~\ref{sec:findingsqrt}, where elements are
represented as pairs of integers modulo~$p$.  Notice that Python
supports definition of a function inside another function.  Also,
notice that the {\tt pow} function defined starting at line (2) 
is very similar to
{\tt powermod} defined in Listing~\ref{listing:Power Modulo}.

\section{Continued Fractions}\label{sec:comp_contfrac}
The main algorithms of Chapter~\ref{ch:contfrac} involve evaluating
the value of a continued fraction as in
Section~\ref{sec:finitecontfrac}, and computing
continued fractions of floating point numbers as described in
Section~\ref{sec:cfalg}.   We implement these algorithms, 
and also implement a simple function
for writing a number as a sum of two squares.

The function in Lisiting~\ref{listing:Convergents of Continued Fraction}
computes the partial convergents of a continued fraction
as in Proposition~\ref{prop:ratcf}.
\begin{verbatim}{Convergents of Continued Fraction}
def convergents(v):
    """
    Returns the partial convergents of the continued 
    fraction v.
    Input:
        v -- list of integers [a0, a1, a2, ..., am]
    Output:
        list -- list [(p0,q0), (p1,q1), ...] 
                of pairs (pm,qm) such that the mth 
                convergent of v is pm/qm.
    Examples:
    >>> convergents([1, 2])
    [(1, 1), (3, 2)]
    >>> convergents([3, 7, 15, 1, 292])
    [(3, 1), (22, 7), (333, 106), (355, 113), (103993, 33102)]
    """
    w = [(0,1), (1,0)]
    for n in range(len(v)):
        pn = v[n]*w[n+1][0] + w[n][0]
        qn = v[n]*w[n+1][1] + w[n][1]
        w.append((pn, qn))
    del w[0]; del w[0]  # remove first entries of w
    return w
\end{verbatim}

In Listing~\ref{listing:Continued Fraction of Rational}
we define {\tt contfrac\_rat}, which computes the
continued fraction of an arbitrary rational number,
using an algorithm derived from the proof of 
Proposition~\ref{prop:ratcf}.   Notice that we give
the rational number as input by giving its numerator
and denominator, since Python has no native type
for rational numbers (it is not difficult to define
such a type using Python classes, but we will not do so here,
since in this chapter we do no nontrivial arithmetic
with rational numbers).
Notice that the definition of {\tt contfrac\_rat} below is
almost the same as that of {\tt gcd} in 
Listing~\ref{listing:Greatest Common Divisor}, except
that we keep track of the partial quotients.
\begin{verbatim}{Continued Fraction of Rational}
def contfrac_rat(numer, denom):
    """
    Returns the continued fraction of the rational 
    number numer/denom.
    Input:
        numer -- an integer
        denom -- a positive integer coprime to num
    Output
        list -- the continued fraction [a0, a1, ..., am]
                of the rational number num/denom.
    Examples:
    >>> contfrac_rat(3, 2)
    [1, 2]
    >>> contfrac_rat(103993, 33102)
    [3, 7, 15, 1, 292]
    """
    assert denom > 0, "denom must be positive"
    a = numer; b = denom
    v = []
    while b != 0:
        v.append(a/b)
        (a, b) = (b, a%b)
    return v
\end{verbatim}

Listing~\ref{listing:Continued Fraction of Floating Point Number}
contains an implementation of the continued fraction procedure
from Section~\ref{sec:cfalg}.  Suppose $x$ is a floating point
number input to Python (i.e., a C double, i.e., a number possibly
in scientific notation like on a hand calculator).  
We compute terms $a_n$ of the continued fraction expansion of~$x$
along with the partial convergents $p_n/q_n$, until the difference
$p_n/q_n - x$ is $0$ to the precision of a Python float.
\begin{verbatim}{Continued Fraction of Floating Point Number}
def contfrac_float(x):
    """
    Returns the continued fraction of the floating
    point number x, computed using the continued
    fraction procedure, and the sequence of partial
    convergents.
    Input:
        x -- a floating point number (decimal)
    Output:
        list -- the continued fraction [a0, a1, ...]
                obtained by applying the continued 
                fraction procedure to x to the 
                precision of this computer.
        list -- the list [(p0,q0), (p1,q1), ...] 
                of pairs (pm,qm) such that the mth 
                convergent of continued fraction 
                is pm/qm.
    Examples:
    >>> v, w = contfrac_float(3.14159); print v
    [3, 7, 15, 1, 25, 1, 7, 4]
    >>> v, w = contfrac_float(2.718); print v
    [2, 1, 2, 1, 1, 4, 1, 12]
    >>> contfrac_float(0.3)
    ([0, 3, 2, 1], [(0, 1), (1, 3), (2, 7), (3, 10)])
    """
    v = []
    w = [(0,1), (1,0)] # keep track of convergents
    start = x
    while True:
        a = int(x)                                  # (1)
        v.append(a)
        n = len(v)-1
        pn = v[n]*w[n+1][0] + w[n][0]
        qn = v[n]*w[n+1][1] + w[n][1]
        w.append((pn, qn))
        x -= a
        if abs(start - float(pn)/float(qn)) == 0:    # (2)
            del w[0]; del w[0]                       # (3)
            return v, w
        x = 1/x
\end{verbatim}
In line (1) we use the {\tt int} command to coerce $x$
into an {\tt int}, which has the affect of 
computing $\lfloor x \rfloor$.  In line (2) the command
{\tt float(qn)} results in  a float, so that the
quotient {\tt float(pn)/float(qn)} is a float that approximates
the rational number $p_n/q_n$.  If we had instead written
{\tt pn/qn} in line (2), then {\tt pn/qn} would always
be an integer, which is not what we want.  In line (3) we 
delete the  first two entries of the list {\tt w}, which
are the partial convergents $0$ and $\infty$.

\begin{remark}
The Python module {\tt gmpy} 
supports arbitrary precision
arithmetic with floating point numbers. It does not
come standard with Python, but can be downloaded
from \url{http://gmpy.sourceforge.net/}.  You could
modify {\tt contfrac\_float}  to use {\tt gmpy},
and compute the continued fraction expansion of floating point
numbers with many digits.
\end{remark}

Listing~\ref{listing:Write Prime as Sum of Two Squares}
contains an implementation of an algorithm based on 
the proof of Theorem~\ref{thm:sumsquare} for quickly writing
a prime $p\con 1\pmod{4}$ as a sum of two integer squares,
even if the prime is huge (hundreds of digits).
\begin{verbatim}{Write Prime as Sum of Two Squares}
def sum_of_two_squares(p):
    """
    Uses continued fractions to efficiently compute 
    a representation of the prime p as a sum of
    two squares.   The prime p must be 1 modulo 4.
    Input:
        p -- a prime congruent 1 modulo 4.
    Output:
        integers a, b such that p is a*a + b*b
    Examples:
    >>> sum_of_two_squares(5)
    (1, 2)
    >>> sum_of_two_squares(389)
    (10, 17)
    >>> sum_of_two_squares(86295641057493119033)
    (789006548L, 9255976973L)
    """
    assert p%4 == 1, "p must be 1 modulo 4"
    r = sqrtmod(-1, p)                                # (1)
    v = contfrac_rat(-r, p)                           # (2)
    n = int(sqrt(p))                          
    for a, b in convergents(v):                       # (3)
        c = r*b + p*a                                 # (4)
        if -n <= c and c <= n: return (abs(b),abs(c))
    assert False, "Bug in sum_of_two_squares."        # (5)
\end{verbatim}
The code in Listing~\ref{listing:Write Prime as Sum of Two Squares}
combines several functions defined earlier in this chapter. 
In line (1) we call the {\tt sqrtmod} function
of Listing~\ref{listing:Square Root Modulo} in the case
$p\con 1\pmod{4}$, which was the difficult case for finding
square roots that uses a non-deterministic algorithm.
In line (2) we use compute
the continued fraction of the rational number $-r/p$, and
in line (3) we iterate over the convergents of this continued fraction.
When the $c$ from line (4) satisfies the appropriate bound, we
have found our sum-of-two-squares representation.  
The proof of Theorem~\ref{thm:sumsquare} guarantees that
there will be such a $c$ and that line (5) will never be reached.


\section{Elliptic Curves}\label{sec:comp_elliptic_curves}
The fundamental algorithms that we described in Chapter~\ref{ch:ec}
are arithmetic of points on elliptic curve, the Pollard $(p-1)$ and
elliptic curve integer factorization methods, and the the ElGamal
elliptic curve cryptosystem.  In this section we implement each of
these algorithms for elliptic curves over $\zmod{p}$, and finish with
an investigation of the associative law on an elliptic curve.

\subsection{Arithmetic}\label{sec:comp_ellcurve_arith}
Each elliptic curve function takes as first input an elliptic curve
$y^2=x^3+ax+b$ over $\zmod{p}$, which we represent by a triple {\tt
  (a,b,p)}.  We represent points on an elliptic curve in Python as a
pair {\tt (x,y)}, with $0\leq x, y <p$ or as the string {\tt "Identity"}.
The functions in Listings~\ref{listing:Elliptic Curve Group Law}
and \ref{listing:Computing a Multiple of a Point} implement
the group law (Algorithm~\ref{alg:grouplaw}) and computation
of $mP$ for possibly large~$m$.
\begin{verbatim}{Elliptic Curve Group Law}
def ellcurve_add(E, P1, P2):
    """
    Returns the sum of P1 and P2 on the elliptic 
    curve E.
    Input:
         E -- an elliptic curve over Z/pZ, given by a 
              triple of integers (a, b, p), with p odd.
         P1 --a pair of integers (x, y) or the 
              string "Identity".
         P2 -- same type as P1
    Output:
         R -- same type as P1
    Examples:
    >>> E = (1, 0, 7)   # y**2 = x**3 + x over Z/7Z
    >>> P1 = (1, 3); P2 = (3, 3)
    >>> ellcurve_add(E, P1, P2)
    (3, 4)
    >>> ellcurve_add(E, P1, (1, 4))
    'Identity'
    >>> ellcurve_add(E, "Identity", P2)
    (3, 3)
    """ 
    a, b, p = E
    assert p > 2, "p must be odd."
    if P1 == "Identity": return P2
    if P2 == "Identity": return P1
    x1, y1 = P1; x2, y2 = P2
    x1 %= p; y1 %= p; x2 %= p; y2 %= p
    if x1 == x2 and y1 == p-y2: return "Identity"
    if P1 == P2:
        if y1 == 0: return "Identity"
        lam = (3*x1**2+a) * inversemod(2*y1,p)
    else:
        lam = (y1 - y2) * inversemod(x1 - x2, p)
    x3 = lam**2 - x1 - x2
    y3 = -lam*x3 - y1 + lam*x1
    return (x3%p, y3%p)
\end{verbatim}

\begin{verbatim}{Computing a Multiple of a Point}
def ellcurve_mul(E, m, P):
    """
    Returns the multiple m*P of the point P on 
    the elliptic curve E.
    Input:
        E -- an elliptic curve over Z/pZ, given by a 
             triple (a, b, p).
        m -- an integer
        P -- a pair of integers (x, y) or the 
             string "Identity"
    Output:
        A pair of integers or the string "Identity".
    Examples:
    >>> E = (1, 0, 7)
    >>> P = (1, 3)
    >>> ellcurve_mul(E, 5, P)
    (1, 3)
    >>> ellcurve_mul(E, 9999, P)
    (1, 4)
    """   
    assert m >= 0, "m must be nonnegative."
    power = P
    mP = "Identity"
    while m != 0:
        if m%2 != 0: mP = ellcurve_add(E, mP, power)
        power = ellcurve_add(E, power, power)
        m /= 2
    return mP
\end{verbatim}

\subsection{Integer Factorization}\label{sec:comp_ecm_factor}
In Listing~\ref{listing:Least Common Multiple of Numbers} we 
implement Algorithm~\ref{alg:lcmupto} for computing the least
common multiple of all integers up to some bound.
\begin{verbatim}{Least Common Multiple of Numbers}
def lcm_to(B):
    """
    Returns the least common multiple of all 
    integers up to B.
    Input:
        B -- an integer
    Output:
        an integer
    Examples:
    >>> lcm_to(5)
    60
    >>> lcm_to(20)
    232792560
    >>> lcm_to(100)
    69720375229712477164533808935312303556800L
    """
    ans = 1
    logB = log(B)
    for p in primes(B):
        ans *= p**int(logB/log(p))
    return ans
\end{verbatim}

Next we implement Pollard's $p-1$ method, as in
Algorithm~\ref{alg:pollard}.   We use only the bases $a=2,3$,
but you could change this to use more bases by modifying
the {\tt for} loop in Listing~\ref{listing:Pollard}.
\begin{verbatim}{Pollard}
def pollard(N, m):
    """
    Use Pollard's (p-1)-method to try to find a
    nontrivial divisor of N.
    Input:
        N -- a positive integer
        m -- a positive integer, the least common
             multiple of the integers up to some 
             bound, computed using lcm_to.
    Output:
        int -- an integer divisor of n
    Examples:
    >>> pollard(5917, lcm_to(5))
    61
    >>> pollard(779167, lcm_to(5))
    779167
    >>> pollard(779167, lcm_to(15))
    2003L
    >>> pollard(187, lcm_to(15))
    11
    >>> n = random_prime(5)*random_prime(5)*random_prime(5)
    >>> pollard(n, lcm_to(100))
    315873129119929L     #rand
    >>> pollard(n, lcm_to(1000))
    3672986071L          #rand
    """
    for a in [2, 3]:
        x = powermod(a, m, N) - 1
        g = gcd(x, N)
        if g != 1 and g != N:
            return g
    return N
\end{verbatim}

In order to implement the elliptic curve method and also in our
upcoming elliptic curve cryptography implementation, it will be useful
to define the function {\tt randcurve} of Listing~\ref{listing:Random
  Elliptic Curve}, which computes a random elliptic curve over
$\zmod{p}$ and a point on it.  For simplicity, {\tt randcurve}
always returns a curve of the form $y^2=x^3+ax+1$, and the point
$P=(0,1)$.  As an exercise you could change this function to return a
more general curve, and find a random point by choosing a random
$x$, then incrementing it  until $x^3+ax+1$ is a perfect square.
\begin{verbatim}{Random Elliptic Curve}
def randcurve(p):
    """
    Construct a somewhat random elliptic curve 
    over Z/pZ and a random point on that curve.
    Input:
        p -- a positive integer
    Output:
        tuple -- a triple E = (a, b, p) 
        P -- a tuple (x,y) on E
    Examples:
    >>> p = random_prime(20); p
    17758176404715800329L    #rand
    >>> E, P = randcurve(p)
    >>> print E
    (15299007531923218813L, 1, 17758176404715800329L)  #rand
    >>> print P
    (0, 1)
    """
    assert p > 2, "p must be > 2."
    a = randrange(p)
    while gcd(4*a**3 + 27, p) != 1:
        a = randrange(p)
    return (a, 1, p), (0,1)
\end{verbatim}

In Listing~\ref{listing:Elliptic Curve Factorization Method}, 
we implement the elliptic curve factorization method.  
\begin{verbatim}{Elliptic Curve Factorization Method}
def elliptic_curve_method(N, m, tries=5):
    """
    Use the elliptic curve method to try to find a
    nontrivial divisor of N.
    Input:
        N -- a positive integer
        m -- a positive integer, the least common
             multiple of the integers up to some
             bound, computed using lcm_to.
        tries -- a positive integer, the number of
             different elliptic curves to try
    Output:
        int -- a divisor of n
    Examples:
    >>> elliptic_curve_method(5959, lcm_to(20))
    59L       #rand
    >>> elliptic_curve_method(10007*20011, lcm_to(100))
    10007L   #rand
    >>> p = random_prime(9); q = random_prime(9)
    >>> n = p*q; n
    117775675640754751L   #rand
    >>> elliptic_curve_method(n, lcm_to(100))
    117775675640754751L   #rand
    >>> elliptic_curve_method(n, lcm_to(500))
    117775675640754751L   #rand
    """
    for _ in range(tries):                     # (1)
        E, P = randcurve(N)                    # (2)
        try:                                   # (3)
            Q = ellcurve_mul(E, m, P)          # (4)
        except ZeroDivisionError, x:           # (5)
            g = gcd(x[0],N)                    # (6)
            if g != 1 or g != N: return g      # (7)
    return N             
\end{verbatim}
In line (1) the underscore means that the for loop
iterates {\tt tries} times, but that no variable
is ``wasted'' recording which iteration we are in.
In line (2) we compute a random elliptic curve and point on it.
The elliptic curve method works by assuming $N$ is prime,
doing a certain computation, on an elliptic curve over
$\zmod{N}$, and detecting if something goes wrong.
Python contains a mechanism called exception handling,
which leads to a very simple implementation of the elliptic
curve method, that uses the elliptic curve functions that
we have already defined. 
The {\tt try} statement in line (3) means that the
code in line (4) should be executed, and if the {\tt ZeroDivisionError}
exception is raised, then the code in lines (6) and (7)
should be executed, but not otherwise.   Recall that in the definition of 
{\tt inversemod} from Listing~\ref{listing:Inverse Modulo},
when the inverse could not be computed, we raised a 
{\tt ZeroDivisionError}, which included the offending 
pair $(a,n)$.   Thus when computing $mP$, if at any point
it is not possible to invert a number modulo~$N$, 
we jump to line (6), compute a $\gcd$ with $N$,
and hopefully split~$N$.

\subsection{ElGamal Elliptic Curve Cryptosystem}\label{sec:comp_elgamal}
Listing~\ref{listing:Initialize ElGamal} defines a function that
creates an ElGamal cryptosystem over $\zmod{p}$.  This is
simplified from what one would do in actual practice.
One would use a more general random elliptic curve and point than we do in
{\tt elgamal\_init}, and count the number of points on it using the
Schoof-Elkies-Atkin algorithm, then repeat this procedure if the
number of points is not a prime or a prime times a small number, or is
$p$, $p-1$, or $p+1$.  Since implementing Schoof-Elkies-Atkin is beyond
the scope of this book, we have not included this crucial
step.
\begin{verbatim}{Initialize ElGamal}
def elgamal_init(p):
    """
    Constructs an ElGamal cryptosystem over Z/pZ, by
    choosing a random elliptic curve E over Z/pZ, a 
    point B in E(Z/pZ), and a random integer n.  This
    function returns the public key as a 4-tuple 
    (E, B, n*B) and the private key n.
    Input:
        p -- a prime number
    Output:
        tuple -- the public key as a 3-tuple
                 (E, B, n*B), where E = (a, b, p) is an 
                 elliptic curve over Z/pZ, B = (x, y) is
                 a point on E, and n*B = (x',y') is
                 the sum of B with itself n times.
        int -- the private key, which is the pair (E, n)
    Examples:
    >>> p = random_prime(20); p
    17758176404715800329L    #rand
    >>> public, private = elgamal_init(p)
    >>> print "E =", public[0]
    E = (15299007531923218813L, 1, 17758176404715800329L)   #rand
    >>> print "B =", public[1]
    B = (0, 1)
    >>> print "nB =", public[2]
    nB = (5619048157825840473L, 151469105238517573L)   #rand
    >>> print "n =", private[1]
    n = 12608319787599446459    #rand
    """
    E, B = randcurve(p)
    n = randrange(2,p)    
    nB = ellcurve_mul(E, n, B)
    return (E, B, nB), (E, n)
\end{verbatim}

In Listing~\ref{listing:Encrypt Using ElGamal}
we define {\tt elgamal\_encrypt}, which encrypts
a message using the ElGamal cryptosystem on an 
elliptic curve.  
\begin{verbatim}{Encrypt Using ElGamal}
def elgamal_encrypt(plain_text, public_key):
    """
    Encrypt a message using the ElGamal cryptosystem
    with given public_key = (E, B, n*B).
    Input:
       plain_text -- a string
       public_key -- a triple (E, B, n*B), as output
                     by elgamal_init.
    Output:
       list -- a list of pairs of points on E that 
               represent the encrypted message
    Examples:
    >>> public, private = elgamal_init(random_prime(20))
    >>> elgamal_encrypt("RUN", public)
    [((6004308617723068486L, 15578511190582849677L), \ #rand
     (7064405129585539806L, 8318592816457841619L))]    #rand
    """
    E, B, nB = public_key
    a, b, p = E 
    assert p > 10000, "p must be at least 10000."
    v = [1000*x for x in \
           str_to_numlist(plain_text, p/1000)]       # (1)
    cipher = []
    for x in v:
        while not legendre(x**3+a*x+b, p)==1:        # (2)
            x = (x+1)%p  
        y = sqrtmod(x**3+a*x+b, p)                   # (3)
        P = (x,y)    
        r = randrange(1,p)
        encrypted = (ellcurve_mul(E, r, B), \
                ellcurve_add(E, P, ellcurve_mul(E,r,nB)))
        cipher.append(encrypted)
    return cipher   
\end{verbatim}
In line (1) we encode the plain text message as a sequence of integers
that are all $0$ modulo $1000$.  It would be nice if the integers
returned by {\tt str\_to\_numlist} were the $x$-coordinates of points
on the elliptic curve $E$, but typically only half the $x\in\zmod{p}$
will actually be $x$-coordinates of points on $E$.  Thus we multiply
the integers returned by {\tt str\_to\_numlist}, and $1$ to them in
line (2) until they are the $x$-coordinates of points on $E$.  Note
that since half the elements of $\zmod{p}$ are perfect squares, we
should only have to add $1$ very few times to obtain a perfect square.
The rest of the Listing~\ref{listing:Encrypt Using ElGamal} is a
straightforward implementation of ElGamal as described in
Section~\ref{sec:elgamal}.

In Listing~\ref{listing:Decrypt Using ElGamal} we give the corresponding
decryption routine, which takes into account the way we encoded integers
as points on $E$.
\begin{verbatim}{Decrypt Using ElGamal}
def elgamal_decrypt(cipher_text, private_key):
    """
    Encrypt a message using the ElGamal cryptosystem
    with given public_key = (E, B, n*B).
    Input:
        cipher_text -- list of pairs of points on E output
                       by elgamal_encrypt.
    Output:
        str -- the unencrypted plain text
    Examples:
    >>> public, private = elgamal_init(random_prime(20))
    >>> v = elgamal_encrypt("TOP SECRET MESSAGE!", public)
    >>> print elgamal_decrypt(v, private)
    TOP SECRET MESSAGE!
    """
    E, n = private_key
    p = E[2]
    plain = []
    for rB, P_plus_rnB in cipher_text:
        nrB = ellcurve_mul(E, n, rB)
        minus_nrB = (nrB[0], -nrB[1])
        P = ellcurve_add(E, minus_nrB, P_plus_rnB)
        plain.append(P[0]/1000)
    return numlist_to_str(plain, p/1000)
\end{verbatim}
    

% \subsection{Associativity of the Group Law}\label{sec:grouplawproof}
% \begin{theorem}\label{thm:assoc}
% Suppose that $P_1$, $P_2$, and $P_3$ are points on an elliptic curve
% $E$ over a field $K$.  If the additions in $(P_1+P_2)+P_3$ and $P_1+(P_2+P_3)$
% are all given 
% by step \ref{alg:grouplaw_4} of Algorithm~\ref{alg:grouplaw}
% with $\lambda=(y_1-y_2)/(x_1-x_2)$, then the $x$-coordinates
% of $(P_1+P_2)+P_3$ and $P_1+(P_2+P_3)$ are equal.
% \end{theorem}
% One could give similar proofs in the cases not covered by the theorem
% (and hence obtain full associative law), but we will be content with
% this one case, since the proofs of the other cases are similar.
% \begin{proof}
% We combine some algebra with a computer computation.
% Write $P_i=(x_i, y_i)$ for $i=1,2,3$.  For any $i,j$, set
% $\lambda_{ij} = (y_i-y_j)/(x_i-x_j)$ and 
% $\nu_{ij} = y_i - \lambda_{ij}x_i$.  
% Then letting $P_4 = (x_4,y_4) = P_1+P_2$ and $P_5=(x_5,y_5)=P_2 + P_3$, 
% we have by
% our hypothesis on the $P_i$ and Algorithm~\ref{alg:grouplaw}
% that
% $$
%   P_4 = \left(\lambda_{12}^2 - x_1 - x_2,\, -\lambda_{12}x_4 - \nu_{12}\right)
% $$
% and 
% $$  
%   P_5 = \left(\lambda_{23}^2 - x_2 - x_3,\, -\lambda_{23}x_5 - \nu_{23}\right).
% $$
% We use the formula from Algorithm~\ref{alg:grouplaw} and a computation
% to verify that
% the $x$-coordinates of $P_3+P_4$ are the same.  
% We have
% $$
% x(P_3+P_4) = \lambda_{34}^2 - x_3 - x_4
%       =\frac{(y_3-y_4)^2}{(x_3-x_4)^2} - (x_3 + x_4)
% $$
% and 
% $$
% x(P_1+P_5) = \lambda_{15}^2 - x_1 - x_5
%       =\frac{(y_1-y_5)^2}{(x_1-x_5)^2} - (x_1 + x_5).
% $$
% Equating and multiplying through by denominators, we see that
% to verify that the $x$ coordinates are the same we must show
% that the following equality holds:
% % \begin{equation}\label{eqn:assocgroupx}
% % (x_1 - x_5)^2((y_3 - y_4)^2 - (x_3 + x_4)(x_3 - x_4)^2) 
% %   = (x_3 - x_4)^2((y_1 - y_5)^2 - (x_1 + x_5)(x_1 - x_5)^2)
% % \end{equation}
% $$(x_1 - x_5)^2((y_3 - y_4)^2 - (x_3 + x_4)(x_3 - x_4)^2) \qquad\mbox{}$$
% $$\qquad\qquad= (x_3 - x_4)^2((y_1 - y_5)^2 - (x_1 + x_5)(x_1 - x_5)^2)$$
% To prove that this equality holds for all points on elliptic curves,
% it suffices to show that it holds in the fraction field $F$ of the ring 
% $$
%   R = \Z[x_1,x_2, x_3, y_1,y_2,y_3, a, b]/I,
% $$
% where $x_1,x_2, x_3, y_1,y_2,y_3, a, b$ are indeterminates,
% and $I$ is the ideal generated by $y_i^2-(x_i^3+a x_i+b)$ for
% $i=1,2,3$.  Note that we expressed $x_4$ and $x_5$ in terms of 
% the $x_i$ and $y_i$ for $i\leq 3$, so we may view $x_4$ and $x_5$
% as elements of $F$.
% Listing~\ref{listing:Verify Associativity of Elliptic Curve Group Law}
% contains a program that implements arithmetic
% in the ring $R$, the field $F$,
% and verifies that the equality needed does hold.  
% For a discussion of how the program works, see the remarks after
% Listing~\ref{listing:Verify Associativity of Elliptic Curve Group Law}.
% When run this program outputs true, which shows that 
% the $x$-coordinates are correct, as claimed.
% \end{proof}
% \begin{remark}
%   If the program below were implemented in a compiled language
%   (e.g., C++) it would be longer, but it would also likely be 
%   faster, as Python is not a good language from an efficiency point of
%   view for implementing basic arithmetic in a ring.
% \end{remark}

% \begin{verbatim}{Verify Associativity of Elliptic Curve Group Law}
% # The variable order is x1, x2, x3, y1, y2, y3, a, b
% class Poly:                                     # (1)
%     def __init__(self, d):                      # (2)
%         self.v = dict(d)                        
%     def __cmp__(self, other):                   # (3)
%         self.normalize(); other.normalize()     # (4)
%         if self.v == other.v: return 0
%         return -1

%     def __add__(self, other):                   # (5)
%         w = Poly(self.v)
%         for m in other.monomials():
%             w[m] += other[m]
%         return w
%     def __sub__(self, other):
%         w = Poly(self.v)
%         for m in other.monomials():
%             w[m] -= other[m]
%         return w
%     def __mul__(self, other):
%         if len(self.v) == 0 or len(other.v) == 0: 
%             return Poly([])
%         m1 = self.monomials(); m2 = other.monomials()
%         r = Poly([])
%         for m1 in self.monomials():
%             for m2 in other.monomials():
%                 z = [m1[i] + m2[i] for i in range(8)]
%                 r[z] += self[m1]*other[m2]
%         return r
%     def __neg__(self):
%         v = {}
%         for m in self.v.keys():
%             v[m] = -self.v[m]
%         return Poly(v)
%     def __div__(self, other):
%         return Frac(self, other)

%     def __getitem__(self, m):                   # (6)
%         m = tuple(m)
%         if not self.v.has_key(m): self.v[m] = 0
%         return self.v[m]
%     def __setitem__(self, m, c):
%         self.v[tuple(m)] = c
%     def __delitem__(self, m):
%         del self.v[tuple(m)]

%     def monomials(self):                        # (7)
%         return self.v.keys()
%     def normalize(self):                        # (8)
%         while True:
%             finished = True
%             for m in self.monomials():
%                 if self[m] == 0:
%                     del self[m]
%                     continue
%                 for i in range(3):
%                     if m[3+i] >= 2:  
%                         finished = False
%                         nx0 = list(m); nx0[3+i] -= 2; 
%                         nx0[7] += 1
%                         nx1 = list(m); nx1[3+i] -= 2; 
%                         nx1[i] += 1; nx1[6] += 1
%                         nx3 = list(m); nx3[3+i] -= 2; 
%                         nx3[i] += 3
%                         c = self[m]
%                         del self[m]
%                         self[nx0] += c; 
%                         self[nx1] += c; 
%                         self[nx3] += c
%                 # end for
%             # end for
%             if finished: return
%         # end while

% one = Poly({(0,0,0,0,0,0,0,0):1})               # (9)

% class Frac:                                     # (10)
%     def __init__(self, num, denom=one):         
%         self.num = num; self.denom = denom
%     def __cmp__(self, other):                   # (11)
%         if self.num * other.denom == self.denom * other.num:
%             return 0
%         return -1

%     def __add__(self, other):                   # (12)
%         return Frac(self.num*other.denom + \
%                     self.denom*other.num, 
%                     self.denom*other.denom)
%     def __sub__(self, other):
%         return Frac(self.num*other.denom - \
%                     self.denom*other.num,
%                     self.denom*other.denom)
%     def __mul__(self, other):
%         return Frac(self.num*other.num, \
%                     self.denom*other.denom)
%     def __div__(self, other):
%         return Frac(self.num*other.denom, \
%                     self.denom*other.num)
%     def __neg__(self):
%         return Frac(-self.num,self.denom)

% def var(i):                                     # (14)
%     v = [0,0,0,0,0,0,0,0]; v[i]=1; 
%     return Frac(Poly({tuple(v):1}))

% def prove_associative():                        # (15)
%     x1 = var(0); x2 = var(1); x3 = var(2)
%     y1 = var(3); y2 = var(4); y3 = var(5)
%     a  = var(6); b  = var(7)
    
%     lambda12 = (y1 - y2)/(x1 - x2)              
%     x4       = lambda12*lambda12 - x1 - x2
%     nu12     = y1 - lambda12*x1   
%     y4       = -lambda12*x4 - nu12
%     lambda23 = (y2 - y3)/(x2 - x3)
%     x5       = lambda23*lambda23 - x2 - x3
%     nu23     = y2 - lambda23*x2
%     y5       = -lambda23*x5 - nu23
%     s1 = (x1 - x5)*(x1 - x5)*((y3 - y4)*(y3 - y4) \
%                    - (x3 + x4)*(x3 - x4)*(x3 - x4))
%     s2 = (x3 - x4)*(x3 - x4)*((y1 - y5)*(y1 - y5) \
%                    - (x1 + x5)*(x1 - x5)*(x1 - x5))
%     print "Associative?"
%     print s1 == s2                              # (17)
% \end{verbatim}
% A class is a new Python datatype, and 
% Listing~\ref{listing:Verify Associativity of Elliptic Curve Group Law}
% makes use of them.
% In line (1) we begin the definition of a class called 
% {\tt Poly}, which will
% implement arithmetic in the ring $R$ of the proof
% of the Theorem~\ref{thm:assoc}.  
% We view an element of $R$ as a set of pairs $(c_i,m_i)$,
% where $c_i \in\Z$ and $m_i$ is a monomial in variables
% $x_1, x_2, x_3, y_1, y_2, y_3, a, b$.  In Python we
% represent a monomial by an $8$-tuple of integers, for
% example, we represent $x_1 x_2 x_3^5 y_1 y_2 y_3 a^3 b$
% by {\tt (1,1,5,1,1,1,3,1)}.  Python has a data structure
% called a dictionary, which is a mapping from an (almost)
% arbitrary finite set of Python objects to any Python objects;
% in Python we represent an element $f\in R$ as a dictionary
% viewed as a mapping from the nonzero monomials in $f$
% to the coefficients of those monomials.  

% In line (2) we initialize a {\tt Poly} from a dictionary {\tt d}.  In
% line (3) we compare two {\tt Poly}'s for equality after normalizing
% them in line (4) by applying the relations $y_i^2 = x_i^3+ax_i+b$.  In
% the block beginning at line (5), we define the basic arithmetic
% operations on elements of $R$.  In the block beginning at line (6), we
% define some functions that are useful for accessing coefficients of
% elements of $R$.  The {\tt monomials} function of line (7) returns the
% monomials in an element of $R$.  The {\tt normalize} function of line (8)
% reduces elements of $R$ modulo the relations $y_i^2 = x_i^3+ax_i+b$.
% A normalized element has the property that no exponent of any $y_i$ is
% bigger than $1$.
% In line (9) we define the element $1\in R$, which will be useful 
% later.  

% Line (10) begins the definition of the {\tt Frac} class, which
% represents elements of the fraction field $F$ of $R$.  
% The comparison function of line (11) decides whether two elements
% of $F$ are equal by cross multiplying and checking equality.
% The arithmetic in the block starting with line (12) is the
% standard arithmetic in any fraction field.

% The {\tt var} function of line (14) defines a function such
% that {\tt var(i)} returns the $i$th element of the following
% list: $x_1, x_2, x_3, y_1, y_2, y_3, a, b$, where $x_1$ is
% the $0$th element, etc.

% Finally the function {\tt prove\_associative}, which starts 
% at line (15),
% is where all the action is.  Here we define the variables
% $x_i$, $y_i$, $a$, $b$, and input the formulas appearing
% in the proof of Theorem~\ref{thm:assoc}.    
% Running {\tt prove\_associative} completes the computation
% for Theorem~\ref{thm:assoc}.
% %session
% \begin{verbatim}{}
% >>> prove_associative()
% Associative?
% True
% \end{verbatim}


\begin{exercises}

 \item\label{ex:pnt}
 \begin{enumerate}
\item Let $y=10000$.  Compute 
  $\pi(y) = \#\{ \text{primes } p \leq y\}.$
\item The prime number theorem implies $\pi(x)$ is
asymptotic to $\frac{x}{\log(x)}$.  How close is $\pi(y)$ to 
$y/\log(y)$, where $y$ is as in (a)?
\end{enumerate}

\item\label{ex:trialdiv} Design an analogue of the {\tt trial\_division}
function of Listing~\ref{listing:Trial Division}
that uses a sequence {\tt dif} of length longer
than $8$, so it skips integers not coprime to 
$210$ (see the discussion after Listing~\ref{listing:Trial Division}).

\item\label{ex:pow} Compute the last two digits
of $3^{45}$.

\item\label{ex:pow2}
Find the integer~$a$ such that $0\leq a < 113$ and
$$
  102^{70}+1 \con a^{37}\pmod{113}.
$$ 

\item  \label{ex:comp_prop} Find the proportion of primes~$p<1000$ 
such that~$2$ is a primitive root modulo~$p$.

\item \label{ex:pr2} Find a prime $p$ such that the smallest
primitive root modulo $p$ is $37$.

\item\label{ex:crypto1}  You and Nikita wish to agree on a secret key using
the Diffie-Hellman key exchange.  Nikita announces that $p=3793$ and
$g=7$.  Nikita secretly chooses a number~$n<p$ and tells you
that $g^n\con 454\pmod{p}$.  You choose the random number 
$m=1208$.  What is the secret key?

\item\label{ex:crypto3} You see Michael and Nikita agree on a secret
  key using the Diffie-Hellman key exchange.  Michael and Nikita
  choose $p=97$ and $g=5$.  Nikita chooses a random number~$n$ and
  tells Michael that $g^n\con 3\pmod{97}$, and Michael chooses a
  random number~$m$ and tells Nikita that $g^m\con 7\pmod{97}$.  Brute
  force crack their code: What is the secret key that Nikita and
  Michael agree upon?  What is~$n$?  What is~$m$?

% \item\label{ex:crypto4} 
% Using the RSA public key $(n,e) = (441484567519, 238402465195)$,
% encrypt the current year.

\item\label{ex:crypto5}  
In this problem, you will ``crack'' an RSA cryptosystem.
What is the secret decoding number~$d$ for the RSA 
cryptosystem with public key $(n,e) = (5352381469067, 4240501142039)$?

\item \label{ex:crypto7}
Nikita creates an RSA cryptosystem with public key
$$(n,e)=(1433811615146881, 329222149569169).$$ 
In the following two problems, show the steps you take to factor~$n$.
(Don't simply factor~$n$ directly using a computer.)
\begin{enumerate}
\item 
Somehow you discover that $d=116439879930113$.  Show how to use the
probabilistic algorithm of Section~\ref{sec:probcrack} to 
use~$d$ to factor~$n$.
\item 
In part (a) you found that the factors~$p$ and~$q$ of~$n$ are very close.
Show how to use the Fermat factorization
 method of Section~\ref{sec:fermatcrack} to factor~$n$.
\end{enumerate}

\item \label{ex:cf1}
Compute the $p_n$ and $q_n$ for the continued fractions
$[-3,1,1,1,1,3]$ and $[0,2,4,1,8,2]$.  Check that the
propositions in Section~\ref{sec:partconv} hold.

\item\label{ex:cf7} 
A theorem of 
Hurwitz (1891) asserts that for any irrational
number~$x$, there exists infinitely many rational numbers $a/b$
such that 
$$\left| x - \frac{a}{b}\right| < \frac{1}{\sqrt{5}b^2}.$$
Take $x=e$, and obtain four rational numbers that satisfy this
inequality.


\item\label{ex:qf1}
Which of the following numbers is a sum of two
squares?  Express those that are as a sum of 
two squares.
$$
-389,\,\, 12345, \,\,729,\,\, 1729,\,\, 5809961789
$$


\item \label{ex:bpowersmooth}
\begin{enumerate}
\item Show that the set of numbers $59+1\pm
s$ for $s\leq 15$ contains~$14$ numbers that are $B$-power smooth
for~$B=20$.
\item
Find the proportion of primes~$p$ in the interval 
from $10^{12}$ and $10^{12}+1000$ such that $p-1$ is 
$B=10^5$ power-smooth.
\end{enumerate}

%\item \label{ex:bpowersmooth}


\end{exercises}
\index{Python|)}
\chapter*{Answers and Hints}
\addcontentsline{toc}{chapter}{\numberline{}Answers and Hints}
\newcommand{\chapitem}[1]{\vspace{2ex}\item {\large \bf #1}}
\begin{enumerate}
\chapitem{Prime Numbers}
\begin{enumerate}
\item[\ref{ex:handsieve}.] They are
$2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59,$\\ 
$61, 67, 71, 73, 79, 83, 89, 97$.
\item[\ref{ex:primesform}.] Emulate the proof of Proposition~\ref{prop:4x-1}.
\end{enumerate}

\chapitem{The Ring of Integers Modulo $n$}
\begin{enumerate}
\item[\ref{ex:gcds}.] They are $5$, $13$, $3$, and $8$.
\item[\ref{ex:gcdrep}.] For example $x=22$, $y=-39$.

\item[\ref{ex:binomdiv}.] Hint: Use the binomial theorem
and prove that if $r\geq 1$ then $p$ divides 
$\binom{p}{r}$.

\item[\ref{ex:residues}.] For example, 
$S_1 = \{0,1,2,3,4,5,6\}$, $S_2 = \{1,3,5,7,11,13,23\}$,
$S_3 = \{0,2,4,6,8,10,12\}$, and $S_4 = \{2,3,5,7,11,13,29\}.$
In each we find $S_i$ by listing the first seven numbers
satisfying the $i$th condition, then adjusted the last number if
necessary so that the reductions would be distinct modulo $7$.
\item[\ref{ex:divrules}.] An integer is divisible by $5$ if 
and only if the last digits is $0$ or $5$.  An integer is
divisible by $9$ if and only if the sum of the digits is 
divisible by $9$.  An integer is divisible by $11$ if and only
if the alternating sum of the digits is divisible by $11$.
\item[\ref{ex:putnam98}.] Hint for part (a): Use the divisibility rule 
you found in \exref{ch:primes}{ex:divrules}.

\item[\ref{ex:invmod}.] $71$

\item[\ref{ex:ordmod}.] $8$

\item[\ref{ex:zpfield}.] As explained on page~\pageref{page:znring},
we know that $\zmod{n}$ is a ring for any $n$.  Thus to show that
$\zmod{p}$ is a field it suffices to show that every nonzero element 
$\overline{a}\in\zmod{p}$ has an inverse.  Lift $a$ to an element $a\in\Z$,
and set $b=p$ in Proposition~\ref{prop:xgcd}.   Because $p$ is prime,
$\gcd(a,p)=1$, so there exists $x,y$ such that $ax + py = 1$.
Reducing this equality modulo $p$ proves that $\overline{a}$ has
an inverse $x\pmod{p}$.  Alternative one could argue just
like after Definition~\ref{defn:order} that $\overline{a}^m=1$ 
for some $m$, so some power of $\overline{a}$ is the 
inverse of $\overline{a}$.

\item[\ref{ex:crt}.] $302$

\item[\ref{ex:phiodd}.] Only for $n=1,2$.  If $n>2$, then 
$n$ is either divisible by an odd prime $p$ or $4$.  If $4\mid n$,
then $2^e-2^{e-1}$ divides $\vphi(n)$ for some $e\geq 2$, so $\vphi(n)$
is even.  If an odd $p$ divides $n$, then the even number
$p^e-p^{e-1}$ divides $\vphi(n)$ for some $e\geq 1$.

\item[\ref{ex:multproof2}.]  The map $\psi$ is a homomorphism since
both reduction maps $$\zmod{mn}\to \zmod{m}\quad\text{and}\quad
\zmod{mn}\to \zmod{n}$$
are homomorphisms.  It is injective because if $a\in\Z$ is such
that $\psi(a)=0$, then $m\mid a$ and $n\mid a$, so $mn\mid a$ (since
$m$ and $n$ are coprime), so $a\con 0\pmod{mn}$.   
The cardinality of $\zmod{mn}$ is $mn$ and the cardinality of
the product $\zmod{m}\times \zmod{n}$ is also $mn$, so $\psi$
must be an isomorphism.  The units $(\zmod{mn})^*$ are thus
in bijection with the units $(\zmod{m})^*\times (\zmod{n})^*$.

For the second part of the exercise, let $g=\gcd(m,n)$ and
set $a=mn/g$.  Then $a\not\con 0\pmod{mn}$, but $m\mid a$ and
$n\mid a$, so $a\ker(\psi)$.

\item[\ref{ex:thieves}.] We express the question as a 
system of linear equations modulo various numbers, and use the Chinese
remainder theorem.    Let $x$ be the number of books.   
The problem asserts that 
\begin{align*}
x&\con 6\pmod{7}\\
x&\con 2\pmod{6}\\
x&\con 1\pmod{5}\\
x&\con 0\pmod{4}
\end{align*}
Applying CRT to the first pair of equations we find that 
$x\con 20\pmod{42}$.  Applying CRT to this equation and
the third we find that $x\con 146\pmod{210}$.  Since $146$
is not divisible by $4$, we add multiples of $210$ to $146$
until we find the first $x$ that is divisible by $4$.  The first multiple
works, and we find that the aspiring mathematicians 
have $356$ math books.

\item[\ref{ex:pcube}.]  Note that $p=3$ works, since $11=3^2+2$ is prime.
Now suppose $p\neq $ is any prime such that $p$ and $p^2+2$ are both prime.
We must have $p\con 1\pmod{3}$ or $p\con 2\pmod{3}$. 
Then $p^2\con 1\pmod{3}$, so $p^2+2\con 0\pmod{3}$, which contradicts
the fact that $p^2+2$ is prime.   

\item[\ref{ex:phimult}.] 
For (a) $n=1,2$, see solution to \exref{ch:cong}{ex:phiodd}.
For (b), yes there are many such examples.  For example, $m=2$, $n=4$.

\item[\ref{ex:phiformula}.]
By repeated application of multiplicativity and Equation (\ref{eqn:phipower})
on page~\pageref{eqn:phipower}, we see that if $n=\prod_i p_i^{e_i}$
is the prime factorization of $n$, then 
$$
   \vphi(n) = \prod_i (p_i^{e_i} - p_i^{e_i-1}) 
   = \prod_i p_i^{e_i-1} \cdot \prod_i (p_i-1).
$$

\item[\ref{ex:solnsqrtmod35}.] 1, 6, 29, 34

\item[\ref{ex:reducedfraction}.]  
Let $g=\gcd(12n+1,30n+2)$.   Then $g\mid 30n+2 - 2\cdot (12n+1) = 6n$. 
 For the same reason $g$ also divides
$12n+1 - 2\cdot (6n) = 1$, so $g=1$, as claimed.

\item[\ref{ex:prim1}.]  There is no primitive
root modulo $8$, since $(\zmod{8})^*$ has order $4$,
but every element of $(\zmod{8})^*$ has order $2$.
Prove that if $\zeta$ is a primitive root modulo $2^n$, for 
$n\geq 3$, then the reduction of $\zeta$ mod $8$ is a primitive
root, a contradiction.

\item[\ref{ex:prim2}.] $2$ is a primitive root modulo $125$.


\item[\ref{ex:prim_fac}.] Let $\prod_{i=1}^m p_i^{e_i}$ be the prime
factorization of $n$.  Slightly 
generalizing Exercise~\ref{ex:multproof2} we see that 
$$
  (\zmod{n})^* \isom \prod (\zmod{p_i^{e_i}})^*.
$$
Thus $(\zmod{n})^*$ is cyclic if and only if the product 
$(\zmod{p_i^{e_i}})^*$ is cyclic.  If $8\mid n$, then
there is no chance $(\zmod{n})^*$ is cyclic, so assume 
$8\nmid n$.  Then by \exref{ch:cong}{ex:prim2} 
each group $(\zmod{p_i^{e_i}})^*$ is itself cyclic.
A product of cyclic groups is cyclic if and only
the orders of the factors in the product are coprime (this
follows from \exref{ch:cong}{ex:multproof2}).  
Thus $(\zmod{n})^*$ is cyclic if and only if the numbers
$p_i(p_i-1)$, for $i=1,\ldots, m$ are pairwise coprime.
Since $p_i-1$ is even, there can be at most one odd 
prime in the factorization of $n$, and we see that 
$(\zmod{n})^*$ is cyclic if and only if $n$ is an odd
prime power, twice an odd prime power, or $n=4$.

\end{enumerate}


\chapitem{Public-Key Cryptography}
\begin{enumerate}
\item[\ref{ex:crypto2}.] The best case is that each letter is A.
Then the question is to find the largest $n$ such that
$1 + 27 + \cdots + 27^n \leq 10^{20}$.
By computing $\log_{27}(10^{20})$, we see that
$27^{13}<10^{20}$ and $27^{14}>10^{20}$.  Thus $n\leq 13$,
and since $1 + 27  + \cdots + 27^{n-1} < 27^n$, and
$2\cdot 27^{13}<10^{20}$, it follows that $n=13$.

\item[\ref{ex:crypto6}.] This is not secure, since it is just
equivalent to a ``Ceaser Cipher'', that is a permutation
of the letters of the alphabet, which is well-known to be
easily broken using a frequency analysis.

\item[\ref{ex:crack3}.] If we can compute the polynomial
$$f = (x-p)(x-q)(x-r)
  = x^3 - (p+q+r)x^2 + (pq+pr+qr)x - pqr,
$$
then we can factor $n$ by finding the roots of $f$, e.g., using
Newton's method (or Cardona's formula for the roots of a cubic).
Because $p$, $q$,~$r$, are distinct odd
primes we have
$$\vphi(n) =(p-1)(q-1)(r-1) = pqr-(pq+pr+qr)+p+q+r,$$
and 
$$\sigma(n) = 1 + (p+q+r)+(pq+pr+qr) + pqr.$$
Since we know $n$, $\vphi(n)$, and $\sigma(n)$, we know
\begin{align*}
\sigma(n)-1-n &= (p+q+r)+(pq+pr+qr),\quad\text{and}\\
\vphi(n)-n    &= (p+q+r)-(pq+pr+qr).
\end{align*}
We can thus compute
both $p+q+r$ and $pq+pr+qr$, hence deduce~$f$ 
and find $p,q,r$.
\end{enumerate}

\chapitem{Quadratic Reciprocity}
\begin{enumerate}
\item[\ref{ex:rec1}.]  They are all $1$, $-1$, $0$, and $1$.

\item[\ref{ex:rec2}.]  By Proposition~\ref{prop:euler_prop} 
the value of $\kr{3}{p}$ depends
only on the reduction $\pm p\pmod{12}$.  List enough primes~$p$ such that the
$\pm p$ reduce to $1,5,7,11$ modulo $12$ and verify that 
the asserted formula holds for each of them.

\item[\ref{ex:rec9}.] Since $p=2^{13}-1$ is prime there
are either two solutions or no solutions to $x^2\con 5\pmod{p}$,
and we can decide which using quadratic reciprocity.
We have
$$\kr{5}{p} = (-1)^{(p-1)/2\cdot (5-1)/2}\kr{p}{5} = \kr{p}{5},$$
so there are two solutions if and only if $p=2^{13}-1$ is $\pm 1$
mod~$5$.  In fact $p\con 1\pmod{5}$, so there are two solutions.

\item[\ref{ex:rec10}.] We have $4^{48} = 2^{96}$.  
By Fermat's Little Theorem $2^{96}=1$, so $x=1$.

\item[\ref{ex:rec13}.] For (a) take $a=19$ and $n=20$.  We
found this example using the Chinese remainder theorem applied
to $4\pmod{5}$ and $3\pmod{4}$, and used that 
$\kr{19}{20} = \kr{19}{5}\cdot\kr{19}{4} = (-1)(-1)=1$,
yet $19$ is not a square modulo either $5$ or $4$, so is
certainly not a square modulo $20$.

\item[\ref{ex:rec14}.]  Hint: First reduce to the case that $6k-1$ is
  prime, by using that if $p$ and $q$ are primes not of the form
  $6k-1$, then neither is their product.  If $p=6k-1$ divides
  $n^2+n+1$, it divides $4n^2+4n+4 = (2n+1)^2+3$, so $-3$ is a
  quadratic residue modulo~$p$.  Now use quadratic reciprocity to show
  that $-3$ is not a quadratic residue modulo~$p$.


\end{enumerate}

\chapitem{Continued Fractions}
\begin{enumerate}
\item[\ref{ex:qf4}.] Suppose $n=x^2+y^2$, with $x,y\in\Q$.  Let $d$ be
  such that $dx, dy\in\Z$.  Then $d^2 n = (dx)^2 + (dy)^2$ is a sum of
  two integer squares, so by Theorem~\ref{thm:sumsquare} if $p\mid d^2
  n$ and $p\con 3\pmod{4}$, then $\ord_p(d^2n)$ is even.  We have
  $\ord_p(d^2n)$ is even if and only if $\ord_p(n)$ is even, so
  Theorem~\ref{thm:sumsquare} implies that $n$ is also a sum of two
  squares.

\item[\ref{ex:qf7}.] The squares modulo $8$ are $0,1,4$, so a sum
of two squares reduces modulo $8$ to one of $0,1,2,4$ or $5$.
Four consecutive integers that are sums of squares would reduce to
four consecutive integers in the set $\{0,1,2,4,5\}$, which
is impossible.
\end{enumerate}

\chapitem{Elliptic Curves}
\begin{enumerate}
\item[\ref{ex:ell2}.] The second point of intersection is
$(129/100, 383/1000)$.

\item[\ref{ex:ell4}.] The group is cyclic of order $9$, generated
by $(4,2)$.  The elements of $E(K)$ are 
$$\{\O, (4,2), (3,4), (2,4), (0,4), (0,1), (2,1), (3,1), (4,3)\}.$$

\item[\ref{ex:ell11}.]  In part (a) the pattern is that $N_p=p+1$.
For part (b), a hint is that when $p\con 2\pmod{3}$, 
the map $x\mapsto x^3$ on $(\zmod{p})^*$ is an automorphism,
so $x\mapsto x^3+1$ is a bijection.  Now use what you learned
about squares in $\zmod{p}$ from Chapter~\ref{ch:reciprocity}.

\item[\ref{ex:ell13}.] For all sufficiently large real $x$, the
equation $y^2=x^3+ax+b$ has a real solution $y$.  Thus the
group $E(\R)$ is not countable, since $\R$ is not countable.  
But any finitely generated group is countable.

\item[\ref{ex:ector}.] In a course on abstract algebra one often
  proves the nontrivial fact that every subgroup of a finitely
  generated abelian group is finitely generated.  In particular, the
  torsion subgroup $G_{\tor}$ is finitely generated.  However, a 
  finitely generated abelian torsion group is finite.

\item[\ref{ex:elltrans}.] 
Hint: Multiply both sides of $y^2=x^3+ax+b$ by a power of a common
denominator, and ``absorb'' powers into~$x$ and~$y$.

\item[\ref{ex:pythag}.] Hint: see \exref{ch:reciprocity}{ex:rec8}.

\end{enumerate}

\chapitem{Computational Number Theory}\\
All code below assume that the Python functions from 
Chapter~\ref{ch:computing} have been defined.
\begin{enumerate}
\item[\ref{ex:pnt}.]
%session
\begin{verbatim}{}
>>> len(primes(10000))
1229
>>> 10000/log(10000)
1085.73620476
\end{verbatim}

\item[\ref{ex:pow}.]
%session
\begin{verbatim}{}
>>> powermod(3,45,100)
43
\end{verbatim}

\item[\ref{ex:pow2}.] 
First raise both sides of the equation to the power of the 
multiplicative inverse of $37$ modulo $112=\vphi(113)$, which
is $109$ to get $a \con (102^{70}+1)^{109}\pmod{113}$.  We then evaluate this
and obtain $a=60$.
%session
\begin{verbatim}{}
>>> inversemod(37, 112)
109
>>> powermod(102, 70, 113)
98
>>> powermod(99, 109, 113)
60
\end{verbatim}


\item[\ref{ex:comp_prop}.]  Using the following program we see that
  the number $2$ is a primitive root 67 out of 168 times (about 40
  percent).  %This session uses the functions {\tt primes} and
  %{\tt ordermod} defined in Chapter~\ref{ch:computing}.
%session
\begin{verbatim}{}
>>> P = primes(1000)
>>> Q = [p for p in P if primitive_root(p) == 2]
>>> print len(Q), len(P)
67 168
\end{verbatim}

\item[\ref{ex:pr2}.]  The first such prime is $36721$.
%session
\begin{verbatim}{}
>>> P = primes(50000)
>>> Q = [primitive_root(p) for p in P]
>>> Q.index(37)
3893
>>> P[3893]
36721
\end{verbatim}
  
\item[\ref{ex:crypto1}.] 2156, since the secret
key is $g^{nm} \con 454^m\con 2156$. 

\item[\ref{ex:crypto3}.] To break the system, we need to find~$n$ 
such that $5^n\con 3 \pmod{97}$.  The following program
does this finds $n=70$, and similarly one finds that $m=31$.  
The secret key is $5^{70\cdot 31}\con 44\pmod{97}$.
%session
\begin{verbatim}{}
>>> for n in range(97):
...     if powermod(5,n,97)==3: print n
70
\end{verbatim}

\item[\ref{ex:crypto5}.]
We factor $n$ and computer $\vphi(n)$ then the inverse~$d$ 
of~$e$ modulo $\vphi(n)$.
%session
\begin{verbatim}{}
>>> factor(5352381469067)
[(141307, 1), (37877681L, 1)]
>>> d=inversemod(4240501142039, (141307-1)*(37877681-1))
>>> d
5195621988839L
\end{verbatim}

\item[\ref{ex:cf1}.]
%session
\begin{verbatim}{}
>>> convergents([-3,1,1,1,1,3])
[(-3, 1), (-2, 1), (-5, 2), (-7, 3), \
          (-12, 5), (-43, 18)]
>>> convergents([0,2,4,1,8,2])
[(0, 1), (1, 2), (4, 9), (5, 11), \
          (44, 97), (93, 205)]
\end{verbatim}

\item[\ref{ex:cf7}.] The following code outputs
the first $8$ examples.   First we import the math
library, in order to compute a decimal approximation to $e$.
Then we compute terms of the continued fraction of $e$ along with the
partial convergents.  Finally we print only those partial convergents
that satisfy the Hurwitz inequality.
%session
\begin{verbatim}{}
>>> import math
>>> e = math.exp(1)
>>> v, convs = contfrac_float(e)
>>> [(a,b) for a, b in convs if \
       abs(e - a*1.0/b) < 1/(math.sqrt(5)*b**2)]
[(3, 1), (19, 7), (193, 71), (2721, 1001),\
 (49171, 18089), (1084483, 398959),\
 (28245729, 10391023), (325368125, 119696244)]
\end{verbatim}

\item [\ref{ex:qf1}.] $-389$ is not a sum of two squares because
it is negative.  $12345$ is not because $3$ exactly divides it.
$729 = 3^6 = (3^3)^2 + 0^2$.  The number $5809961789$ is prime
and equals $51542^2 + 56155^2$.
%session
\begin{verbatim}{}
>>> factor(12345)
[(3, 1), (5, 1), (823, 1)]
>>> factor(729)
[(3, 6)]
>>> factor(5809961789)
[(5809961789L, 1)]
>>> 5809961789 % 4
1L
>>> sum_of_two_squares(5809961789)
(51542L, 56155L)
\end{verbatim}

\item[\ref{ex:bpowersmooth}.] We use the following program.
The computation of {\tt Ps} takes a few seconds, since our
implementation of {\tt factor} is not very efficient.
%session
\begin{verbatim}{}
>>> N = [60 + s for s in range(-15,16)]
>>> def is_powersmooth(B, x):
...     for p, e in factor(x):
...         if p**e > B: return False
...     return True
>>> Ns = [x for x in N if is_powersmooth(20, x)]
>>> print len(Ns), len(N), len(Ns)*1.0/len(N)
14 31 0.451612903226
>>> P = [x for x in range(10**12, 10**12+1000)\
         if miller_rabin(x)]
>>> Ps = [x for x in P if \
         is_powersmooth(10000, x-1)]  
>>> print len(Ps), len(P), len(Ps)*1.0/len(P)
2 37 0.0540540540541
\end{verbatim}
\end{enumerate}

\end{enumerate}

%%%%%%%%%%
\bibliography{book}

\printindex
\end{document}
