Lecture 14: Review for Midterm

William Stein

Math 124 Harvard University Fall 2001

Today I will briefly describe some key ideas that we’ve covered in this course up until now. Make sure you understand these, so you can do well on the midterm, which is Wednesday, October 17, and is worth 20% of your grade.

1 Some Basic Definitions

Greatest common divisor:

gcd(a, b) = max{d : d | a and d | b}

Congruence: a ≡ b (mod n) means that n | a − b.

Example 1.1. We have 7 ≡ −19 (mod 13) since 13 | 7 − (−19) = 26.

If a is an integer such that gcd(a, n) = 1, then the order of a modulo n is

min {i ∈ ℕ : a^{i} ≡ 1 (mod n)} .

For example, the order of 2 modulo 15 is 4.

Some Rings and Groups: We let ℤ/nℤ denote the ring of equivalence classes of integers modulo n. We also frequently consider the group

(ℤ/nℤ)^{∗} = {a : 1 ≤ a ≤ n and gcd(a, n) = 1} .

The order of a modulo n is then the order of the image of a in the multiplicative group (ℤ/nℤ)^{∗}.

2 Equations Modulo n

2.1 Linear Equations

The equation ax ≡ b (mod n) must have a solution if gcd(a, n) = 1. Warning: It might still have a solution even if gcd(a, n) ≠ 1.

Example 2.1. The equation 3x ≡ 2 (mod 5) has the solution x = 4. The equation 3x ≡ 9 (mod 18) has a solution x = 3 even though gcd(3, 18) = 3 ≠ 1.

2.2 Quadratic Equations

Suppose a is an integer that is not divisible by p. The solvability or nonsolvability of the quadratic equation x^{2} ≡ a (mod p) is addressed by quadratic reciprocity. (So far we have not discussed how to find a solution, only whether or not one exists.) The quadratic residue symbol is

(\frac{a}{p}) = \begin{cases}+1 & if x^{2} ≡ a (mod p) has a solution \\ −1 & otherwise. \end{cases}

We have

(\frac{a}{p}) ≡ a^{(p−1)/2} (mod p).

The Quadratic Reciprocity Law, which was proved by Gauss, asserts that if p and q are distinct odd primes then

(\frac{p}{q}) = (−1)^{\frac{p−1}{2} · \frac{q−1}{2}} (\frac{q}{p}) .

This is the deepest result that we’ve proved in the course so far. On the midterm, you will not be held responsible for understanding the proof I gave last Friday. However, you should know the statement of the quadratic reciprocity law and have some practice applying it.

3 Systems of Equations

Suppose that n and m are coprime integers. Then the Chinese Remainder Theorem (CRT) asserts that the system of equations

x ≡ a (mod m),
x ≡ b (mod n)

has solutions. (There is exactly one nonnegative solution x < nm.)

Example 3.1. Because of CRT, I know that there is an x such that

x ≡ 1 (mod 37),
x ≡ 17 (mod 23)

even though I am too lazy to find x right now.

4 The Euler φ Function

Define a function φ : ℕ → ℕ by

φ(n) = #{a : 1 ≤ a ≤ n and gcd(a, n) = 1} = #(ℤ/nℤ)^{∗}.

Using the Chinese Remainder Theorem we proved that φ is a multiplicative function, i.e., if m, n ∈ ℕ and gcd(m, n) = 1, then

φ(mn) = φ(m) · φ(n).

Also, if p is a prime then φ(p^{n}) = p^{n} − \frac{p^{n}}{p} = p^{n} − p^{n−1}. Example 4.1.

φ(2^{3} · 5^{2}) = φ(2^{3}) · φ(5^{2}) = (2^{3} − 2^{2}) · (5^{2} − 5) = 4 · 20 = 80.

5 Public-key Cryptography

5.1 The Diffie-Hellman Key Exchange

1. Nikita chooses a prime p and a number g that is a primitive root modulo p. She tells Michael both p and g.

2. Nikita secretely chooses a random number n and sends Michael g^{n} (mod p).

3. Michael secretely chooses a random number m and sends Nikita g^{m} (mod p).

4. The secret key is s = g^{nm} (mod p). Both Michael and Nikita can easily compute s, but The Collective can’t because of the difficulty of the “discrete logarithm problem”.

5.2 The RSA Cryptosystem

1. Nikita creates her public key as follows:

(a) She chooses two distinct large primes p and q, then computes both n = pq and φ(n) = (p − 1)(q − 1).

(b) She picks a random natural number e < φ(n) such that gcd(e, φ(n)) = 1.

(c) She computes a number d such that ed ≡ 1 (mod φ(n)).

(d) Her public key is (n, e). (And her private decoding key is d.)

2. To send Nikita a message, Michael encodes it (or a piece of it) as a number m (mod n). He then sends m^{e} (mod n) to Nikita.

3. Nikita recovers m from m^{e} (mod n) by using that m ≡ (m^{e})^{d} (mod n).

6 Important Algorithms

6.1 Euclid’s Algorithm

Given integers a and b, a slight extension of Euclid’s gcd algorithm enables us to find integers x and y such that

ax + by = gcd(a, b).

Example 6.1. a = 12, b = 101.

\underline{101} = 8 · \underline{12} + \underline{5}  \underline{5} = \underline{101} − 8 · \underline{12}
\underline{12} = 2 · \underline{5} + \underline{2}  \underline{2} = −2 · \underline{101} + 17 · \underline{12}
\underline{5} = 2 · \underline{2} + \underline{1}  \underline{1} = \underline{5} − 2 · \underline{2} = 5 · \underline{101} − 42 · \underline{12}.

Thus x = −42, y = 5 works, and gcd(a, b) = 1.

We can use the result of this computation to solve

12x ≡ 1 (mod 101).

Indeed, 1 = (−42) · 12 + 5 · 101, so x = −42 is a solution.

6.2 Powering Algorithm

There is a clever trick that makes computing a^{n} easier. Write n in binary, that is is write n = ∑_{i=0}^{r} ε_{i}2^{i} with ε_{i} ∈ {0, 1}. Then

a^{n} = ∏_{i with ε_{i}≠0} a^{2^{i}}.

6.3 PARI

The midterm will NOT test knowledge of PARI.