Lecture 7: Congruences, Part III

William Stein

Math 124 Harvard University Fall 2001

Key Ideas

1. How to solve ax ≡ 1 (mod n) efficiently.

2. How to compute a^{m} (mod n) efficiently.

3. A probabilistic primality test.

1 How to Solve ax ≡ 1 (mod n)

Let a, n ∈ ℕ with gcd(a, n) = 1. Then we know that ax ≡ 1 (mod n) has a solution. How can we find x?

1.1 More About GCDs

Proposition 1.1. Suppose a, b ∈ ℤ and gcd(a, b) = d. Then there exists x, y ∈ ℤ such that

ax + by = d.

I won’t give a formal proof of this proposition, though there are many in the literature. Instead I will show you how to find x and y in practice, because that’s what you will need to do in order to solve equations like ax ≡ 1 (mod n).

Example 1.2. Let a = 5 and b = 7. The steps of the Euclidean gcd algorithm are:

\underline{7} = 1 · \underline{5} + \underline{2}  so \underline{2} = \underline{7} − \underline{5}
\underline{5} = 2 · \underline{2} + \underline{1}  so \underline{1} = \underline{5} − 2 · \underline{2} = 3 · \underline{5} − 2 · \underline{7}

On the right, we have written each partial remainder as a linear combination of a and b. In the last step, we write gcd(a, b) as a linear combination of a and b, as desired.

That example wasn’t too complicated, next we try a much longer example.

Example 1.3. Let a = 130 and b = 61. We have

\underline{130} = 2 · \underline{61} + \underline{8}  so \underline{8} = \underline{130} − 2 · \underline{61}
\underline{61} = 7 · \underline{8} + \underline{5}  so \underline{5} = −7 · \underline{130} + 15 · \underline{61}
\underline{8} = 1 · \underline{5} + \underline{3}  so \underline{3} = 8 · \underline{130} − 17 · \underline{61}
\underline{5} = 1 · \underline{3} + \underline{2}  so \underline{2} = −15 · \underline{130} + 32 · \underline{61}
\underline{3} = 1 · \underline{2} + \underline{1}  so \underline{1} = 23 · \underline{130} − 49 · \underline{61}

Thus x = 130 and y = −49.

Remark 1.4. For our present purposes it will always be sufficient to find one solution to ax+by = d. In fact, there are always infinitely many solutions. If x, y is a solution to

ax + by = d,

then for any α ∈ ℤ,

a (x + α · \frac{b}{d}) + b (y − α · \frac{a}{d}) = d,

is also a solution, and all solutions are of the above form for some α.

It is also possible to compute x and y using PARI.

? ?bezout
bezout(x,y): gives a 3-dimensional row vector [u,v,d] such that
             d=gcd(x,y) and u*x+v*y=d.
? bezout(130,61)
%1 = [23, -49, 1]

1.2 To solve ax ≡ 1 (mod n)

Suppose gcd(a, n) = 1. To solve

ax ≡ 1 (mod n),

find x and y such that ax + ny = 1. Then

ax ≡ ax + ny ≡ 1 (mod n).

Example 1.5. Solve 17x ≡ 1 (mod 61). First, we use the Euclidean algorithm to find x, y such that 17x + 61y = 1:

\underline{61} = 3 · \underline{17} + \underline{10}  so \underline{10} = \underline{61} − 3 · \underline{17}
\underline{17} = 1 · \underline{10} + \underline{7}  so \underline{7} = −\underline{61} + 4 · \underline{17}
\underline{10} = 1 · \underline{7} + \underline{3}  so \underline{3} = 2 · \underline{61} − 7 · \underline{17}
\underline{3} = 2 · \underline{3} + \underline{1}  so \underline{1} = −5 · \underline{61} + 18 · \underline{17}

Thus x = 18 is a solution to 17x ≡ 1 (mod 61).

2 How to Compute a^{m} (mod n) Efficiently

As we will see on Friday, a quick method to compute a^{m} (mod n) is absolutely essential to public-key cryptography.

Naive Algorithm: Compute a · a · · · · · a (mod n) by repeatedly multiplying by a and reducing modulo m. This is BAD because it takes m − 1 multiplications.

Clever Algorithm: The following observation is the key idea which makes the clever algorithm work. Write m = ∑_{i=1}^{r} ε_{i}2^{i} with each ε_{i} ∈ {0, 1}, i.e., write m in base 2 (binary). Then

a^{m} = ∏_{ε_{i}=1} a^{2^{i}} (mod n).

It is straightforward to write a number m in binary, as follows: If m is odd, then ε_{0} = 1, otherwise ε_{0} = 0. Replace m by floor(\frac{m}{2}). If the new m is odd then ε_{1} = 1, otherwise ε_{1} = 0. Keep repeating until m = 0.

Example 2.1. Problem: Compute the last 2 digits of 6^{91}.

Solution: We compute 6^{91} (mod 100).

\begin{matrix}i & m & ε_{i} & 6^{2^{i}} mod 100 \\ 0 & 91 & 1 & 6 \\ 1 & 45 & 1 & 36 \\ 2 & 22 & 0 & 96 \\ 3 & 11 & 1 & 16 \\ 4 & 5 & 1 & 56 \\ 5 & 2 & 0 & 36 \\ 6 & 1 & 1 & 96 \end{matrix}

As a check, note that 91 = 1011011_{2} = 2^{6} + 2^{4} + 2^{3} + 2 + 2^{0}. Finally, we have

6^{91} = 6^{2^{6}} · 6^{2^{4}} · 6^{2^{3}} · 6^{2} · 6 ≡ 96 · 56 · 16 · 36 · 6 ≡ 56 (mod 100).

Summary of above table: The first column, labeled i, is just to keep track of i. The second column, labeled m, is got by dividing the entry above it by 2 and taking the integer part of the result. The third column, labeled ε_{i}, simply records whether or not the second column is odd. The forth column is computed by squaring, modulo 100, the entry above it.

Some examples in PARI to convince you that powering isn’t too difficult:

? Mod(17,389)^5000
%13 = Mod(330, 389)
? Mod(2903,49084098)^498494
%14 = Mod(13189243, 49084098)

These both take no noticeable time.

3 A Probabilistic Primality Test

Recall,

Theorem 3.1. A natural number p is prime if and only if for every a ≢ 0 (mod p),

a^{p−1} ≡ 1 (mod p).

Thus if p ∈ ℕ and, e.g., 2^{p−1} ≢ 1 (mod p), then we have proved that p is not prime. If, however, a^{p−1} ≡ 1 (mod p) for a couple of a, then it is “highly likely” that p is prime. I will not analyze this probability here, but we might later in this course. Example 3.2. Let p = 323. Is p prime? Let’s compute 2^{322} modulo 323. Making a table as above, we have

\begin{matrix}i & m & ε_{i} & 2^{2^{i}} mod 323 \\ 0 & 322 & 0 & 2 \\ 1 & 161 & 1 & 4 \\ 2 & 80 & 0 & 16 \\ 3 & 40 & 0 & 256 \\ 4 & 20 & 0 & 290 \\ 5 & 10 & 0 & 120 \\ 6 & 5 & 1 & 188 \\ 7 & 2 & 0 & 137 \\ 8 & 1 & 1 & 35 \end{matrix}

Thus

2^{322} ≡ 4 · 188 · 35 ≡ 157 (mod 323),

so 323 is not prime. In fact, 323 = 17 · 19.

It’s possible to prove that a large number is composite, but yet be unable to (easily) find a factorization! For example if

n = 95468093486093450983409583409850934850938459083,

then 2^{n−1} ≢ 1 (mod n), so n is composite. This is something one could verify in a reasonable amount of time by hand. (Though finding a factorization by hand would be very difficult!)

3.1 Finding large numbers that are probably prime

? probprime(n, a=2) = Mod(a,n)^(n-1) == Mod(1,n)
? x = 0948609348698406983409580934859034509834095809348509834905809345
%36 = 948609348698406983409580934859034509834095809348509834905809345
? for(i=0,100,if(probprime(x+2*i,2),print(i)))
27
? p = x + 2*27
%37 = 948609348698406983409580934859034509834095809348509834905809399
? probprime(p,3)
%39 = 1