This is page i

Printer: Opaque this

An Explicit Approach to Number Theory

William Stein April 15, 2002

ii

This is page iii

Printer: Opaque this

Contents

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

1 Primes and Congruences 9 1.1 Prime Factorization . . . . . . . . . . . . . . . . . . . . . . 9 1.2 The Sequence of Prime Numbers . . . . . . . . . . . . . . . 13 1.3 Congruences . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1.4 Congruences, Part II . . . . . . . . . . . . . . . . . . . . . . 22 1.5 Congruences, Part III . . . . . . . . . . . . . . . . . . . . . 26

2 Public-key Cryptography 33 2.1 Diffie-Hellman Key Exchange . . . . . . . . . . . . . . . . . 33 2.2 The RSA Cryptosystem . . . . . . . . . . . . . . . . . . . . 38 2.3 Attacking RSA . . . . . . . . . . . . . . . . . . . . . . . . . 43

3 Quadratic Reciprocity 51 3.1 Primitive Roots . . . . . . . . . . . . . . . . . . . . . . . . . 51 3.2 Quadratic Reciprocity I . . . . . . . . . . . . . . . . . . . . 54 3.3 Quadratic Reciprocity II . . . . . . . . . . . . . . . . . . . . 58

4 Continued Fractions 63 4.1 Finite Continued Fractions . . . . . . . . . . . . . . . . . . 64 4.2 Infinite Continued Fractions . . . . . . . . . . . . . . . . . . 67 4.3 Quadratic Irrationals . . . . . . . . . . . . . . . . . . . . . . 71 4.4 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 5 Binary Quadratic Forms 83

5.1 Sums of Two Squares . . . . . . . . . . . . . . . . . . . . . 83 5.2 Binary Quadratic Forms . . . . . . . . . . . . . . . . . . . . 86 5.3 Reduction Theory . . . . . . . . . . . . . . . . . . . . . . . 90 5.4 The Class Group . . . . . . . . . . . . . . . . . . . . . . . . 94

6 Elliptic Curves 103 6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 6.2 The Elliptic Curve Group Law . . . . . . . . . . . . . . . . 107 6.3 Torsion Points and Mazur’s Big Theorem . . . . . . . . . . 112

7 Applications of Elliptic Curves 121 7.1 Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . 121 7.2 Factorization . . . . . . . . . . . . . . . . . . . . . . . . . . 125 7.3 Fermat’s Last Theorem and Modularity . . . . . . . . . . . 134

8 The Birch and Swinnerton-Dyer Conjecture 139 8.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 8.2 The Conjecture . . . . . . . . . . . . . . . . . . . . . . . . . 142 8.3 A Rationality Theorem . . . . . . . . . . . . . . . . . . . . 144 8.4 Approximating the Rank . . . . . . . . . . . . . . . . . . . . 145

9 Computing With PARI/GP 149 9.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 9.2 Pari Programming . . . . . . . . . . . . . . . . . . . . . . . 156 9.3 Computing with Elliptic Curves . . . . . . . . . . . . . . . . 159

10 Solutions to Exercises 167

References 181

2 Contents

This is page 3

Printer: Opaque this

Preface

[A statement by the author describing the reasons for writing the book, the intended audience for the book, and the approach used in treating the subject.]

Software

Acknowledgments

[Acknowledgments: A statement thanking those individuals who have helped in the preparation of the manuscript. (This may be included in the Preface.]

4 Contents

Introduction

[Introduction: An essay by the author/editor describing the background and organization of the book.]

Factorization

Do you remember writing whole numbers as products of primes? For example,

12 = 2 × 2 × 3.

Can this sort of thing always be done? Is it really hard or really easy? For example, is factoring social security numbers “trivial” or hopeless? In fact, it’s trivial; even my wristwatch can do it!! (Mine might be the only wristwatch in the world that can factor social security numbers, but that’s another story.) What about bigger numbers?

These questions are important to your everyday life. If somebody out there secretly knows how to factor 200-digit numbers quickly, then that person could easily read you credit card number and expiration date when you send it to amazon.com.

Congruences and Public-key Cryptography

Two numbers a and b are congruent modulo another number n if a = b+nk for some integer k. That a and b are congruent just means you can “get from a to b on the number line” by adding or subtracting lots of copies of n. For example, 14 ≡ 2 (mod 12) since 14 = 2 + 12 · 1.

ℤ/nℤ = { equivalence classes of numbers modulo n }.

Your web browser’s “secret code language” uses arithmetic in ℤ/pqℤ to send messages in broad weblight to amazon.com. How can this possibly be safe!? You will find out exactly what is going on.

Computers

Computers make the study of properties of whole numbers vastly more interesting. A computer is to a number theorist, like a telescope is to an astronomer. It would be a shame to teach an astronomy class without touching a telescope; likewise, it would be shame to teach this class without telling you how to look at the integers “through the lens of a computer”.

Sums of Two Squares

I will tell you how to decide whether or not your order number is a sum of two squares. For example, an odd prime number is a sum of two squares if and only if when divided by 4 it leaves a remainder of 1. For example, 7 is not a sum of two squares, but 29 is.

Elliptic Curves

My experience is that elliptic curves are extraordinarily fun to study. Every such curve is like a whole galaxy in itself, just like the rational numbers are. An elliptic curve over ℚ is a curve that can be put in the form

y^{2} = x^{3} + ax + b,

where the cubic has distinct roots and a, b ∈ ℚ. The amazing thing is that the set of pairs

E(ℚ) = {(x, y) ∈ ℚ × ℚ : y^{2} = x^{3} + ax + b} ∪ {∞}

has a natural structure of “group”. In particular, this means that given two points on E, there is a way to “add” the two solutions together to get another solution.

Many exciting problems in number theory can be translated into questions about elliptic curves. For example, Fermat’s Last Theorem, which asserts that x^{n} + y^{n} = z^{n} has no positive integer solutions when n > 2 was proved using elliptic curves. Giving a method to decide which numbers are the area of a right triangle with rational side lengths has almost, but not quite, been solved using elliptic curves.

A central question about elliptic curves is The Birch and Swinnerton-Dyer Conjecture which gives a simple conjectural criterion to decide whether or not E(ℚ) is infinite (and more). Proving the BSD conjecture is one of the Clay Math Institute’s million dollar prize problems. We will discuss this conjecture in Chapter ??.

8 Contents

1

Primes and Congruences

1.1 Prime Factorization

1.1.1 Prime Numbers

We call positive whole numbers the natural numbers and denote them by ℕ. Thus

ℕ = {1, 2, 3, 4, …}.

We call all the whole numbers, both positive and negative, the integers, and write

ℤ = {…, −2, −1, 0, 1, 2, …}.

They are denoted by ℤ because the German word for the integers is “Zahlen” (and 19th century German number theorists rocked).

Definition 1.1. If a, b ∈ ℤ then “a divides b” if ac = b for some c ∈ ℤ.

To save time, we write

a | b.

For example, 2 | 6 and 389 | 97734562907. Also, everything divides 0.

Definition 1.2. A natural number p > 1 is a prime if 1 and p are the only divisors of p in ℕ. I.e., if a | p with a ∈ ℕ implies a = 1 or a = p. A number n > 1 is composite if it is not prime.

Thus the primes are

2, 3, 5, 7, 11, …, 389, …, 2003, ….

and the composites are

4, 6, 8, 9, 10, 12, …, 666 = 2 · 3^{2} · 37, …, 2001 = 3 · 23 · 29, ….

Primes are “primal”, in the sense that every natural number is built out of prime numbers.

Theorem 1.3 (Fundamental Theorem of Arithmetic). Every positive integer can be written as a product of primes, and this expression is unique (up to order).

This theorem is harder to prove than you might first think, and we will wait until Section 1.1.4 below to prove it. Why? First, we are lucky that there are any primes at all: if the natural numbers are replaced by the positive rational numbers then there are no primes; e.g., 2 = \frac{1}{2} · 4, so \frac{1}{2} | 2. Second, we are fortunate to have unique factorization in ℤ. In other “rings”, such as

ℤ[\sqrt{−5}] = \{a + b\sqrt{−5} : a, b ∈ ℤ\},

unique factorization can fail. In ℤ[\sqrt{−5}], the number 6 factors in two different ways:

2 · 3 = 6 = (1 + \sqrt{−5})(1 − \sqrt{−5}).

Remark 1.4. Are worried about whether or not 2 and 3 should be considered “prime” in ℤ[\sqrt{−5}]? If 2 = (a+b\sqrt{−5})(c+d\sqrt{−5}) with neither factor equal to ±1, then taking norms implies that

4 = (a^{2} + 5b^{2})(c^{2} + 5d^{2}),

with neither factor 1. Theorem 1.3 implies that 2 = a^{2} + 5b^{2}, which is impossible. Thus 2 is “prime” in the (nonstandard!) sense that it has no divisors besides ±1 and ±2. A similar argument shows that 3 has no divisors besides ±1 and ±3. On the other hand, as you will learn in an abstract algebra course, 2 should not be considered prime, because the “ideal” generated by 2 in ℤ[\sqrt{−5}] is not prime, in the following sense: we have (1 + \sqrt{−5})(1 − \sqrt{−5}) = 6 ∈ (2), but neither 1 + \sqrt{−5} nor 1 − \sqrt{−5} is in (2). We also note that (1 + \sqrt{−5}) does not factor. If (1 + \sqrt{−5}) = (a + b\sqrt{−5})(c + d\sqrt{−5}), then, upon taking norms,

2 · 3 = (a^{2} + 5b^{2})(c^{2} + 5d^{2}),

which is impossible.

1.1.2 The Greatest Common Divisor

We will use the notion of greatest common divisor of two integers to prove that if p is a prime and p | ab, then p | a or p | b. This is the key step in our proof of Theorem 1.3.

Definition 1.5. Let gcd(a, b) = max{d : d | a and d | b}, unless both a and b are 0 in which case gcd(0, 0) = 0.

For example, gcd(1, 2) = 1, gcd(3, 27) = 3, and for any a, gcd(0, a) = gcd(a, 0) = a.

Euclid’s Algorithm for Computing GCDs

It is initiall surprising that we can easily compute gcd(2261, 1275). Watch closely:

2261 = 1 · 1275 + 986.

Notice that if a number d divides both 2261 and 1275, then d automatically divides their difference 986, and of course d still divides 1275. Also, if a number divides both 1275 and 986, then it has got to divide their sum 2261 as well! So we have made progress:

gcd(2261, 1275) = gcd(1275, 986).

Let’s try again:

1275 = 1 · 986 + 289,

so gcd(1275, 986) = gcd(986, 289). Just keep at it:

986 = 3 · 289 + 119
289 = 2 · 119 + 51
119 = 2 · 51 + 17.

Thus gcd(2261, 1275) = ⋯ = gcd(51, 17), which is 17 because 17 | 51, so

gcd(2261, 1275) = 17.

Aside from tedious arithmetic, that was quick and very mechanical.

The Algorithm: That was an illustration of Euclid’s algorithm. More formally, fix a, b ∈ ℕ with a > b. Using “divide with quotient and remainder”, write a = bq + r, with 0 ≤ r < b. Then, just as above,

gcd(a, b) = gcd(b, r).

Let a_{1} = b, b_{1} = r, and repeat until r = 0. Soon enough we have computed gcd(a, b).

Here are two more examples: Example 1.6. Set a = 15 and b = 6.

15 = 6 · 2 + 3  gcd(15, 6) = gcd(6, 3)
6 = 3 · 2 + 0  gcd(6, 3) = gcd(3, 0) = 3

We can just as easily do an example that is “10 times as big”:

Example 1.7. Set a = 150 and b = 60.

150 = 60 · 2 + 30  gcd(150, 60) = gcd(60, 30)
60 = 30 · 2 + 0  gcd(60, 30) = gcd(30, 0) = 30

With Euclid’s algorithm in hand, we can prove that if a prime divides the product of two numbers, then it has got to divide one of them. This result is the key to proving that prime factorization is unique.

Theorem 1.8 (Euclid). Let p be a prime and a, b ∈ ℕ. If p | ab then p | a or p | b.

Proof. If p | a we are done. If p ∤ a then gcd(p, a) = 1, since only 1 and p divide p. Stepping through the Euclidean algorithm from above, we see that gcd(pb, ab) = b. At each step, we simply multiply the equation through by b. Since p | pb and, by hypothesis, p | ab, it follows that p | gcd(pb, ab) = b.

1.1.3 Numbers Do Factor

Let n = 1275, and recall from above that 17 | 1275, so n is definitely composite, n = 17·75. Next, 75 is 5·15 = 5·5·3. So, finally, 1275 = 3·5·5·17.

Now suppose n is any positive number. Then, just as above, n can be written as a product of primes:

• If n is prime, we are done.

• If n is composite, then n = ab with a, b < n. By induction, a, b are products of primes, so n is also a product of primes.

What if we had done something differently when breaking 1275 apart as a product of primes? Could the primes that show up be different? Why not just try? We have 1275 = 5 · 255. Now 255 = 5 · 51 and 51 = 17 · 3, so everything turned out the same. Will it always?

Incidently, there’s an open problem nearby, which is closely related to the famous “P = NP” problem that some consider the most important open problem in computer science:

Unsolved Question: Is there an algorithm which can factor any given integer n so quickly that its “running time” is bounded by a polynomial function of the number of decimal digits of n?

(By “algorithm”, we mean an algorithm in the sense of classical computer science; Peter Shor [Sho97] has devised a polynomial time algorithm for factoring integers on quantum computers.)

Most mathematicians would guess that the answer is “no”, but nobody has yet rigorously proved that it can not be done (and told everyone...). If there were such an algorithm, then the cryptosystem that we use to buy books online would be easily broken.

A $10,000 Challenge

As of February 2002, If you factor the following 174-digit number, affectionality known as “RSA-576”, then the RSA company will give you TEN THOUSAND DOLLARS!!!

1881988129206079638386972394616504398071635633794173827007 6335642298885971523466548531906060650474304531738801130339 6716199692321205734031879550656996221305168759307650257059

This number is called RSA-576, since it has 576 binary digits. See

http://www.rsasecurity.com/rsalabs/challenges/factoring/index.html

for more details.

1.1.4 The Fundamental Theorem of Arithmetic

We can now prove Theorem 1.3, as follows. Suppose we have two factorizations of n. Using Theorem 1.8 we cancel common primes from each factorization, one prime at a time. At the end, we discover that the factorizations must consist of exactly the same primes. The technical details, with all the p’s and q’s are given below:

Proof. We have

n = p_{1} · p_{2} ⋯ p_{d},

with each p_{i} prime. Suppose that

n = q_{1} · q_{2} ⋯ q_{m}

is another expression of n as a product of primes. Since

p_{1} | n = q_{1} · (q_{2} ⋯ q_{m}),

Euclid’s theorem implies that p_{1} = q_{1} or p_{1} | q_{2} ⋯ q_{m}. By induction, we see that p_{1} = q_{i} for some i.

Now cancel p_{1} and q_{i}, and repeat the above argument. Eventually, we find that, up to order, the two factorizations are the same.

1.2 The Sequence of Prime Numbers

This section is concerned with the following three questions:

1. Are there infinitely many primes? Answer: yes

2. Are there infinitely many primes of the form ax + b? Answer: yes, provided that gcd(a, b) = 1.

3. How many primes are there? Answer: asymptotically x/ log(x) primes less than x.

1.2.1 There are Infinitely Many Primes

Theorem 1.9 (Euclid). There are infinitely many primes.

Proof. Suppose that there are only finitely many primes in ℤ. Let p_{1} = 2, p_{2} = 3, …, p_{n} be all of them. Let

N = 2 × 3 × 5 × ⋯ × p_{n} + 1

Then N ≠ 1 so by Theorem 1.3

N = q_{1} × q_{2} × ⋯ × q_{m}

with each q_{i} prime and m ≥ 1. If q_{1} ∈ {2, 3, 5, …, p_{n}}, then N = q_{1}a + 1 for some a ∈ ℤ, so q_{1} ∤ N, a contradiction. Thus our assumption that {2, 3, 5, …, p_{n}} are all of the primes is false, which proves that there must be infinitely many primes.

This theorem is not obvious. There are completely reasonable rings where it is false. For example

R = \{\frac{a}{b} : a, b ∈ ℤ and gcd(b, 30) = 1\}

contains exactly three primes. If we try the proof of Theorem 1.9 in R, we run into trouble. We would let N = 2 · 3 · 5 + 1 = 31, which is a unit, hence not a nontrivial product of primes.

Joke (Hendrik Lenstra). “There are infinitely many composite numbers. Proof: Multiply together the first n primes and don’t add 1.”

According to

    http://www.utm.edu/research/primes/largest.html

the largest known prime, as of September 2001, is

p = 2^{6972593} − 1,

which is a number having exactly 2098960 decimal digits. Euclid’s theorem implies that there definitely is a bigger prime number. However, nobody has yet found it and proved that they are right. Deciding whether or not a number is prime is surprisingly interesting, both as a motivating problem and for applications to cryptography, as we will see in Section 1.5.3 and Chapter 2.

1.2.2 Primes of the Form ax + b

Next we turn to primes of the form ax + b, where a and b are fixed integers with a > 0 and x varies over ℕ. We assume that gcd(a, b) = 1, because otherwise there is no hope that ax+b is prime infinitely often. For example, 2x + 2 is never prime for x ∈ ℕ.

Proposition 1.10. There are infinitely many primes of the form 4x − 1.

Why might this be true? We list numbers of the form 4x−1 and underline those that are prime:

\underline{3}, \underline{7}, \underline{11}, 15, \underline{19}, \underline{23}, 27, \underline{31}, 35, 39, \underline{43}, \underline{47}, …

It certainly looks plausible that underlined numbers will continue to appear every so often.

Proof. This proof is similar to the proof of Thereom 1.9, but for variety we will explain it in a slightly more constructive way, which we illustrate below in Example 1.11.

Suppose p_{1}, p_{2}, …, p_{n} are primes of the form 4x−1. Consider the number

N = 4p_{1} × p_{2} × ⋯ × p_{n} − 1.

Then p_{i} ∤ N for any i. Moreover, not every prime p | N is of the form 4x + 1; if they all were, then N would also be of the form 4x + 1, which it is not. Thus there is a p | N that is of the form 4x − 1. Since p ≠ p_{i} for any i, we have found another prime of the form 4x − 1. We can repeat this process indefinitely, so the set of primes of the form 4x − 1 is infinite.

Example 1.11. Set p_{1} = 3, p_{2} = 7. Then

N = 4 × 3 × 7 − 1 = \underline{83}

is a prime of the form 4x − 1. Next

N = 4 × 3 × 7 × 83 − 1 = \underline{6971},

which is a again a prime of the form 4x − 1. Again:

N = 4 × 3 × 7 × 83 × 6971 − 1 = 48601811 = 61 × \underline{796751}.

This time 61 is a prime, but it is of the form 4x + 1 = 4 × 15 + 1. However, 796751 is prime and (796751 − (−1))/4 = 199188. We are unstoppable:

N = 4 × 3 × 7 × 83 × 6971 × 796751 − 1 = \underline{5591} × 6926049421.

This time the small prime, 5591, is of the form 4x − 1 and the large one is of the form 4x + 1. Etc!

Theorem 1.12 (Dirichlet). Let a and b be integers with gcd(a, b) = 1. Then there are infinitely many primes of the form ax + b.

You can find a proof, which uses sophisticated tools of algebraic number theory, in [FT93, VIII.4].

1.2.3 How Many Primes are There?

There are infinitely many primes, as we saw in Section 1.2.1. Can we say something more precise, more satisfying? Consider a similar question:

Question 1.13. How many integers are even?

Answer: Half of all integers.

Question 1.14. How many integers are there of the form 4x − 1?

Answer: One fourth of all integers.

Question 1.15. How many integers are perfect squares?

Answer: Zero percent of all positive integers, in the sense that the limit of the proportion of perfect squares to all positive integers converges to 0. More precisely,

lim_{x→∞} \frac{#\{n ∈ ℕ : n ≤ x and n is a perfect square\}}{x} = 0,

since the numerator is roughly \sqrt{x} and lim_{x→∞} \frac{\sqrt{x}}{x} = 0.

The following question is even more precise:

Question 1.16. How many positive integers ≤ x are perfect squares?

Answer: Up to a small error, the answer is \sqrt{x}.

So a good question is:

Question 1.17. How many positive integers ≤ x are prime?

Let

π(x) = #{primes p ≤ x}.

For example,

π(6) = #{2, 3, 5} = 3.

Here are some more values of π(x), that we found using a computer:

\begin{matrix}x & 100 & 200 & 300 & 400 & 500 & 600 & 700 & 800 & 900 & 1000 \\ π(x) & 25 & 46 & 62 & 78 & 95 & 109 & 125 & 139 & 154 & 168 \end{matrix}

The graph of π(x) in Figure 1.1 look like a straight line.

Gauss spent some of his free time counting primes. By the end of his life, he had computed π(x) for x up to 3 million.

π(3000000) = 216816.

(I don’t know if Gauss got the right answer.) Gauss conjectured the following:

x y ^{(100, 25)} ^{(200, 46)}  ^{(900, 154)} ^{(1000, 168)} Graph of π(x)

FIGURE 1.1. Graph of π(x) for x < 1000

Theorem 1.18 (Hadamard, Vallée Poussin, 1896). π(x) is asymptotic to x/ log(x), in the sense that

lim_{x→∞} \frac{π(x)}{x/ log(x)} = 1.

I will not prove this theorem in this class. The theorem implies that x/(log(x) − a) can be used to approximate π(x), for any a. In fact, a = 1 is the best choice.

? pi(x, c=0) = forprime(p=2,x,c++); c;
? for(n=1,10,print(n*1000,"\t",pi(n*1000),"\t",n*1000/(log(n*1000)-1)))
1000 168 169.2690290604408165186256278
2000 303 302.9888734545463878029800994
3000 430 428.1819317975237043747385740
4000 550 548.3922097278253264133400985
5000 669 665.1418784486502172369455815
6000 783 779.2698885854778626863677374
7000 900 891.3035657223339974352567759
8000 1007 1001.602962794770080754784281
9000 1117 1110.428422963188172310675011
10000 1229 1217.976301461550279200775705

Remark 1.19.

Counting Primes Today

People all over the world are counting primes, probably even as we speak. See, e.g.,

http://www.utm.edu/research/primes/howmany.shtml
http://numbers.computation.free.fr/Constants/Primes/Pix/pixproject.html

A huge computation:

π(10^{22}) = 201467286689315906290

(I don’t know for sure if this is right...)

The Riemann Hypothesis

The function

Li(x) = ∫_{2}^{x} \frac{1}{log(x)}dx.

is also a good approximation to π(x).

The famous Riemann Hypothesis is equivalent to the assertion that

π(x) = Li(x) + O(\sqrt{x} log(x)).

(This is another $1000000 prize problem.)

      pi(10^22)     = 201467286689315906290
      Li(10^22)     = 201467286691248261498.1505...    (using Maple)
      Log(x)/(x-1)  = 201381995844659893517.7648...    (pari)

1.3 Congruences

The point of this lecture: Define the ring ℤ/nℤ of integers modulo n. Prove Fermat’s little theorem, which asserts that if gcd(x, n) = 1, then x^{φ(n)} ≡ 1 (mod n).

1.3.1 Notation

Definition 1.20 (Congruence). Let a, b ∈ ℤ and n ∈ ℕ. Then

a ≡ b (mod n)

if n | a − b.

That is, there is c ∈ ℤ such that

nc = a − b.

One way I think about it: a is congruent to b modulo n, if we can get from b to a by adding multiples of n.

Congruence modulo n is an equivalence relation. Let

ℤ/nℤ = { the set of equivalence classes }

The set ℤ/nℤ is a ring, the “ring of integers modulo n”. It is the quotient of the ring ℤ by the ideal generated by n. Example 1.21.

ℤ/3ℤ = {{…, −3, 0, 3, …}, {…, −2, 1, 4, …}, {…, −1, 2, 5, …}} = {[0], [1], [2]}

where we let [a] denote the equivalence class of a.

1.3 Congruences 19

1.3.2 Arithmetic Modulo N

Suppose a, a′, b b′ ∈ ℤ and

a ≡ a′ (mod n), b ≡ b′ (mod n).

Then

a + b ≡ a′ + b′ (mod n)  (1.1)
a × b ≡ a′ × b′ (mod n)  (1.2)

So it makes sense to define + and × by [a]+[b] = [a+b] and [a]×[b] = [a×b].

Cancellation Proposition 1.22. If gcd(c, n) = 1 and

ac ≡ bc (mod n)

then a ≡ b (mod n).

Proof. By definition

n | ac − bc = (a − b)c.

Since gcd(n, c) = 1, it follows that n | a − b, so

a ≡ b (mod n),

as claimed.

Rules for Divisibility Proposition 1.23. A number n ∈ ℤ is divisible by 3 if and only if the sum of the digits of n is divisible by 3.

Proof. Write

n = a + 10b + 100c + · · · .

Since 10 ≡ 1 (mod 3),

n = a + 10b + 100c + ⋯ ≡ a + b + c + ⋯ (mod 3),

from which the proposition follows.

Similarly, you can find rules for divisibility by 5, 9 and 11. What about divisibility by 7?

1.3.3 Linear Congruences

Definition 1.24 (Complete Set of Residues). A complete set of residues modulo n is a subset R ⊂ ℤ of size n whose reductions modulo n are distinct. In other words, a complete set of residues is a choice of representive for each equivalence class in ℤ/nℤ.

Some examples:

R = {0, 1, 2, …, n − 1}

is a complete set of residues modulo n. When n = 5, a complete set of residues is

R = {0, 1, −1, 2, −2}.

Lemma 1.25. If R is a complete set of residues modulo n and a ∈ ℤ with gcd(a, n) = 1, then aR = {ax : x ∈ R} is also a complete set of residues.

Proof. If ax ≡ ax′ (mod n) with x, x′ ∈ R, then Proposition 1.22 implies that x ≡ x′ (mod n). Because R is a complete set of residues, this implies that x = x′. Thus the elements of aR have distinct reductions modulo n. It follows, since #aR = n, that aR is a complete set of residues modulo n.

Definition 1.26 (Linear Congruence). A linear congruence is an equation of the form

ax ≡ b (mod n).

Proposition 1.27. If gcd(a, n) = 1, then the equation

ax ≡ b (mod n)

must have a solution.

Proof. Let R be a complete set of residues modulo n (for example, R = {0, 1, …, n−1}). Then by Lemma 1.25, aR is also a complete set of residues. Thus there is an element ax ∈ aR such that ax ≡ b (mod n), which proves the proposition.

The point in the proof is that left multiplication by a defines a map ℤ/nℤ ↪ ℤ/nℤ, which must be surjective because ℤ/nℤ is finite.

Illustration:

2x ≡ 3 (mod 7)

Set R = {0, 1, 2, 3, 4, 5, 6}. Then

2R = {0, 2, 4, 6, 8 ≡ 1, 10 ≡ 3, 12 ≡ 5},

so 2 · 5 ≡ 3 (mod 7).

Warning: Note that the equation ax ≡ b (mod n) might have a solution even if gcd(a, n) ≠ 1. To construct such examples, let a be any divisor of n, x any number, and set b = ax. For example, 2x ≡ 6 (mod 8) has a solution!

1.3.4 Fermat’s Little Theorem

Definition 1.28 (Order). Let n ∈ ℕ and x ∈ ℤ with gcd(x, n) = 1. The order of x modulo n is the smallest m ∈ ℕ such that

x^{m} ≡ 1 (mod n).

We must show that this definition makes sense. To do so, we verify that such an m exists. Consider x, x^{2}, x^{3}, … modulo n. There are only finitely many residue classes modulo n, so we must eventually find two integers i, j with i < j such that

x^{i} ≡ x^{j} (mod n).

Since gcd(x, n) = 1, Proposition 1.22 implies that we can cancel x’s and conclude that

x^{j−i} ≡ 1 (mod n).

Definition 1.29 (Euler Phi function). Let

φ(n) = #{a ∈ ℕ : a ≤ n and gcd(a, n) = 1}.

For example,

φ(1) = #{1} = 1,
φ(5) = #{1, 2, 3, 4} = 4,
φ(12) = #{1, 5, 7, 11} = 4.

If p is any prime number then

φ(p) = #{1, 2, …, p − 1} = p − 1.

Theorem 1.30 (Fermat’s Little Theorem). If gcd(x, n) = 1, then

x^{φ(n)} ≡ 1 (mod n).

Proof. Let

P = {a : 1 ≤ a ≤ n and gcd(a, n) = 1}.

In the same way that we proved Lemma 1.25, we see that the reductions modulo n of the elements of xP are exactly the same as the reductions of the elements of P. Thus

∏_{a∈P}(xa) = ∏_{a∈P} a (mod n),

since the products are over exactly the same numbers modulo n. Now cancel the a’s on both sides to get

x^{#P} ≡ 1 (mod n),

as claimed.

Group-theoretic Interpretation

The set of invertible elements of ℤ/nℤ is a group

(ℤ/nℤ)^{∗} = {[a] ∈ ℤ/nℤ : gcd(a, n) = 1}.

This group has order φ(n). Theorem 1.30 asserts that the order of an element of (ℤ/nℤ)^{×} divides the order φ(n) of (ℤ/nℤ)^{×}. This is a special case of the more general theorem that if G is a finite group and g ∈ G, then the order of g divide #G.

1.3.5 What happened?

Take out a piece of paper and answer the following two questions:

1. What is a central idea that you learned in this lecture?

2. What part of this lecture did you find murky?

1.4 Congruences, Part II

Key Ideas Today

• Wilson’s theorem

• Chinese Remainder Theorem

• Multiplicativity of φ

1.4.1 Wilson’s Theorem

Theorem 1.31 (John Wilson’s theorem, from the 1770s). An integer p > 1 is prime if and only if

(p − 1)! ≡ −1 (mod p).

Example 1.32.

? p=3
%1 = 3
? (p-1)! % 3
%2 = 2
? p=17
%3 = 17
? (p-1)!
%4 = 20922789888000
? (p-1)! % p
%5 = 16

Proof. We first assume that p is prime and prove that (p − 1)! ≡ −1 (mod p). If a ∈ {1, 2, …, p − 1} then the equation

ax ≡ 1 (mod p)

has a unique solution a′ ∈ {1, 2, …, p − 1}. If a = a′, then a^{2} ≡ 1 (mod p), so p | a^{2} − 1 = (a − 1)(a + 1), so p | (a − 1) or p | (a + 1), so a ∈ {1, −1}. We can thus pair off the elements of {2, 3, …, p − 2}, each with its inverse. Thus

2 · 3 · · · · · (p − 2) ≡ 1 (mod p).

Multiplying both sides by p − 1 proves that (p − 1)! ≡ −1 (mod p).

Next we assume that (p − 1)! ≡ −1 (mod p) and prove that p must be prime. Suppose not, so that p is a composite number ≥ 4. Let ℓ be a prime divisor of p. Then ℓ < p, so ℓ | (p − 1)!. Also,

ℓ | p | ((p − 1)! − 1).

This is a contradiction, because a prime can’t divide a number a and also divide a − 1, since it would then have to divide a − (a − 1) = 1.

Example 1.33. When p = 17, we have

2·3·· · ··15 = (2·9)·(3·6)·(4·13)·(5·7)·(8·15)·(10·12)·(14·11) ≡ 1 (mod 17),

where we have paired up the numbers a, b for which ab ≡ 1 (mod 17). Let’s test Wilson’s Theorem in PARI:

? wilson(n) = Mod((n-1)!,n) == Mod(-1,n)
? wilson(5)
%9 = 1
? wilson(10)
%10 = 0
? wilson(389)
%11 = 1
? wilson(2001)
%12 = 0

Warning: In practice, this is a horribly inefficient way to check whether or not a number is prime.

1.4.2 The Chinese Remainder Theorem

Sun Tsu Suan-Ching (4th century AD):

There are certain things whose number is unknown. Repeatedly divided by 3, the remainder is 2; by 5 the remainder is 3; and by 7 the remainder is 2. What will be the number?

In modern notation, Sun is asking us to solve the following system of equations:

x ≡ 2 (mod 3)
x ≡ 3 (mod 5)
x ≡ 2 (mod 7)

The Chinese Remainder Theorem asserts that a solution to Sun’s question exists, and the proof gives a method to find a solution.

Theorem 1.34 (The Chinese Remainder Theorem). Let a, b ∈ ℤ and n, m ∈ ℕ such that gcd(n, m) = 1. Then there exists x ∈ ℤ such that

x ≡ a (mod m)
x ≡ b (mod n)

Proof. The equation

tm ≡ b − a (mod n)

has a solution t since gcd(m, n) = 1. Set x = a + tm. We next verify that x is a solution to the two equations. Then

x ≡ a + (b − a) ≡ b (mod n),

and

x = a + tm ≡ a (mod m).

Now we can solve Sun’s problem:

x ≡ 2 (mod 3)
x ≡ 3 (mod 5)
x ≡ 2 (mod 7).

First, we use the theorem to find a solution to the pair of equations

x ≡ 2 (mod 3)
x ≡ 3 (mod 5).

Set a = 2, b = 3, m = 3, n = 5. Step 1 is to find a solution to t · 3 ≡ 3 − 2 (mod 5). A solution is t = 2. Then x = a + tm = 2 + 2 · 3 = 8. Since any x′ with x′ ≡ x (mod 15) is also a solution to those two equations, we can solve all three equations by finding a solution to the pair of equations

x ≡ 8 (mod 15)
x ≡ 2 (mod 7).

Again, we find a solution to t · 15 ≡ 2 − 8 (mod 7). A solution is t = 1, so

x = a + tm = 8 + 15 = 23.

Note that there are other solutions. Any x′ ≡ x (mod 3 · 5 · 7) is also a solution; e.g., 23 + 3 · 5 · 7 = 128.

We can also solve Sun’s problem in PARI:

? chinese(Mod(2,3),Mod(3,5))
%13 = Mod(8, 15)
? chinese(Mod(8,15),Mod(2,7))
%14 = Mod(23, 105)

1.4.3 Multiplicative Functions

Definition 1.35. A function f : ℕ → ℤ is multiplicative if, whenever m, n ∈ ℕ and gcd(m, n) = 1, we have

f(mn) = f(m) · f(n).

Recall that the Euler φ-function is

φ(n) = #{a : 1 ≤ a ≤ n and gcd(a, n) = 1}.

Proposition 1.36. φ is a multiplicative function.

Proof. Suppose that m, n ∈ ℕ and gcd(m, n) = 1. Consider the map

{c : 1 ≤ c ≤ mn and gcd(c, mn) = 1} ⟶^{f}

{a : 1 ≤ a ≤ m and gcd(a, m) = 1} × {b : 1 ≤ b ≤ n and gcd(b, n) = 1}}

defined by

f(c) = (c mod m, c mod n).

The map f is injective: If f(c) = f(c′), then m | c − c′ and n | c − c′, so, since gcd(n, m) = 1, nm | c − c′, so c = c′.

The map f is surjective: Given a, b with gcd(a, m) = 1, gcd(b, n) = 1, the Chinese Remainder Theorem implies that there exists c with c ≡ a (mod m) and c ≡ b (mod n). We may assume that 1 ≤ c ≤ nm, ans since gcd(a, m) = 1 and gcd(b, n) = 1, we must have gcd(c, nm) = 1. Thus f(c) = (a, b).

Because f is a bijection, the set on the left has the same size as the product set on the right. Thus

φ(mn) = φ(m) · φ(n).

Example 1.37. The proposition makes it easier to compute φ(n). For example,

φ(12) = φ(2^{2}) · φ(3) = 2 · 2 = 4.

Also, for n ≥ 1, we have

φ(p^{n}) = p^{n} − \frac{p^{n}}{p} ,

since φ(p^{n}) is the number of numbers less than p^{n} minus the number of those that are divisible by p. Thus, e.g.,

φ(389 · 11^{2}) = 388 · (11^{2} − 11) = 388 · 110 = 42680.

The φ function is also available in PARI:

  ? eulerphi(389*11^2)
  %15 = 42680

Question 1.38. Is computing φ(1000 digit number) really easy or really hard?

1.5 Congruences, Part III

Key Ideas

1. How to solve ax ≡ 1 (mod n) efficiently.

2. How to compute a^{m} (mod n) efficiently.

3. A probabilistic primality test.

1.5.1 How to Solve ax ≡ 1 (mod n)

Let a, n ∈ ℕ with gcd(a, n) = 1. Then we know that ax ≡ 1 (mod n) has a solution. How can we find x?

More About GCDs

Proposition 1.39. Suppose a, b ∈ ℤ and gcd(a, b) = d. Then there exists x, y ∈ ℤ such that

ax + by = d.

I won’t give a formal proof of this proposition, though there are many in the literature. Instead I will show you how to find x and y in practice, because that’s what you will need to do in order to solve equations like ax ≡ 1 (mod n).

Example 1.40. Let a = 5 and b = 7. The steps of the Euclidean gcd algorithm are:

\underline{7} = 1 · \underline{5} + \underline{2}  so \underline{2} = \underline{7} − \underline{5}
\underline{5} = 2 · \underline{2} + \underline{1}  so \underline{1} = \underline{5} − 2 · \underline{2} = 3 · \underline{5} − 2 · \underline{7}

On the right, we have written each partial remainder as a linear combination of a and b. In the last step, we write gcd(a, b) as a linear combination of a and b, as desired.

That example wasn’t too complicated, next we try a much longer example. Example 1.41. Let a = 130 and b = 61. We have

\underline{130} = 2 · \underline{61} + \underline{8}  so \underline{8} = \underline{130} − 2 · \underline{61}
\underline{61} = 7 · \underline{8} + \underline{5}  so \underline{5} = −7 · \underline{130} + 15 · \underline{61}
\underline{8} = 1 · \underline{5} + \underline{3}  so \underline{3} = 8 · \underline{130} − 17 · \underline{61}
\underline{5} = 1 · \underline{3} + \underline{2}  so \underline{2} = −15 · \underline{130} + 32 · \underline{61}
\underline{3} = 1 · \underline{2} + \underline{1}  so \underline{1} = 23 · \underline{130} − 49 · \underline{61}

Thus x = 130 and y = −49. Remark 1.42. For our present purposes it will always be sufficient to find one solution to ax + by = d. In fact, there are always infinitely many solutions. If x, y is a solution to

ax + by = d,

then for any α ∈ ℤ,

a (x + α · \frac{b}{d}) + b (y − α · \frac{a}{d}) = d,

is also a solution, and all solutions are of the above form for some α. It is also possible to compute x and y using PARI.

? ?bezout
bezout(x,y): gives a 3-dimensional row vector [u,v,d] such that
             d=gcd(x,y) and u*x+v*y=d.
? bezout(130,61)
%1 = [23, -49, 1]

To solve ax ≡ 1 (mod n)

Suppose gcd(a, n) = 1. To solve

ax ≡ 1 (mod n),

find x and y such that ax + ny = 1. Then

ax ≡ ax + ny ≡ 1 (mod n).

Example 1.43. Solve 17x ≡ 1 (mod 61). First, we use the Euclidean algorithm to find x, y such that 17x + 61y = 1:

\underline{61} = 3 · \underline{17} + \underline{10}  so \underline{10} = \underline{61} − 3 · \underline{17}
\underline{17} = 1 · \underline{10} + \underline{7}  so \underline{7} = −\underline{61} + 4 · \underline{17}
\underline{10} = 1 · \underline{7} + \underline{3}  so \underline{3} = 2 · \underline{61} − 7 · \underline{17}
\underline{3} = 2 · \underline{3} + \underline{1}  so \underline{1} = −5 · \underline{61} + 18 · \underline{17}

Thus x = 18 is a solution to 17x ≡ 1 (mod 61).

1.5.2 How to Compute a^{m} (mod n) Efficiently

As we will see on Friday, a quick method to compute a^{m} (mod n) is absolutely essential to public-key cryptography.

Naive Algorithm: Compute a · a · · · · · a (mod n) by repeatedly multiplying by a and reducing modulo m. This is BAD because it takes m − 1 multiplications.

Clever Algorithm: The following observation is the key idea which makes the clever algorithm work. Write m = ∑_{i=1}^{r} ε_{i}2^{i} with each ε_{i} ∈ {0, 1}, i.e., write m in base 2 (binary). Then

a^{m} = ∏_{ε_{i}=1} a^{2^{i}} (mod n).

It is straightforward to write a number m in binary, as follows: If m is odd, then ε_{0} = 1, otherwise ε_{0} = 0. Replace m by floor(\frac{m}{2}). If the new m is odd then ε_{1} = 1, otherwise ε_{1} = 0. Keep repeating until m = 0. Example 1.44. Problem: Compute the last 2 digits of 6^{91}.

Solution: We compute 6^{91} (mod 100).

\begin{matrix}i & m & ε_{i} & 6^{2^{i}} mod 100 \\ 0 & 91 & 1 & 6 \\ 1 & 45 & 1 & 36 \\ 2 & 22 & 0 & 96 \\ 3 & 11 & 1 & 16 \\ 4 & 5 & 1 & 56 \\ 5 & 2 & 0 & 36 \\ 6 & 1 & 1 & 96 \end{matrix}

As a check, note that 91 = 1011011_{2} = 2^{6} + 2^{4} + 2^{3} + 2 + 2^{0}. Finally, we have

6^{91} = 6^{2^{6}} · 6^{2^{4}} · 6^{2^{3}} · 6^{2} · 6 ≡ 96 · 56 · 16 · 36 · 6 ≡ 56 (mod 100).

Summary of above table: The first column, labeled i, is just to keep track of i. The second column, labeled m, is got by dividing the entry above it by 2 and taking the integer part of the result. The third column, labeled ε_{i}, simply records whether or not the second column is odd. The forth column is computed by squaring, modulo 100, the entry above it.

Some examples in PARI to convince you that powering isn’t too difficult:

? Mod(17,389)^5000
%13 = Mod(330, 389)
? Mod(2903,49084098)^498494
%14 = Mod(13189243, 49084098)

These both take no noticeable time.

1.5.3 A Probabilistic Primality Test

Recall,

Theorem 1.45. A natural number p is prime if and only if for every a ≢ 0 (mod p),

a^{p−1} ≡ 1 (mod p).

Thus if p ∈ ℕ and, e.g., 2^{p−1} ≢ 1 (mod p), then we have proved that p is not prime. If, however, a^{p−1} ≡ 1 (mod p) for a couple of a, then it is “highly likely” that p is prime. I will not analyze this probability here, but we might later in this course. Example 1.46. Let p = 323. Is p prime? Let’s compute 2^{322} modulo 323. Making a table as above, we have

\begin{matrix}i & m & ε_{i} & 2^{2^{i}} mod 323 \\ 0 & 322 & 0 & 2 \\ 1 & 161 & 1 & 4 \\ 2 & 80 & 0 & 16 \\ 3 & 40 & 0 & 256 \\ 4 & 20 & 0 & 290 \\ 5 & 10 & 0 & 120 \\ 6 & 5 & 1 & 188 \\ 7 & 2 & 0 & 137 \\ 8 & 1 & 1 & 35 \end{matrix}

Thus

2^{322} ≡ 4 · 188 · 35 ≡ 157 (mod 323),

so 323 is not prime. In fact, 323 = 17 · 19.

It’s possible to prove that a large number is composite, but yet be unable to (easily) find a factorization! For example if

n = 95468093486093450983409583409850934850938459083,

then 2^{n−1} ≢ 1 (mod n), so n is composite. This is something one could verify in a reasonable amount of time by hand. (Though finding a factorization by hand would be very difficult!)

Finding large numbers that are probably prime

? probprime(n, a=2) = Mod(a,n)^(n-1) == Mod(1,n)
? x = 0948609348698406983409580934859034509834095809348509834905809345
%36 = 948609348698406983409580934859034509834095809348509834905809345
? for(i=0,100,if(probprime(x+2*i,2),print(i)))
27
? p = x + 2*27
%37 = 948609348698406983409580934859034509834095809348509834905809399
? probprime(p,3)
%39 = 1

Exercises

1.1 Let p be a prime number and r and integer such that 1 ≤ r < p. Prove that p divides the binomial coefficient

\frac{p!}{r!(p − r)!}.

You may not assume that this coefficient is a integer.

1.2 Compute the following gcd’s using a pencil and the Euclidean algorithm:

gcd(15, 35), gcd(247, 299), gcd(51, 897), gcd(136, 304)

1.3 (a) Using mathematical induction to prove that

1 + 2 + 3 + ⋯ + n = \frac{n(n + 1)}{2}.

(b) Find a formula for

1 − 2 + 3 − 4 + ⋯ ± n = ∑_{a=1}^{n}(−1)^{a−1}a.

1.4 What was the most recent prime year? I.e., which of …, 2002, 2001, 2000, … was it?

1.5 Use the Euclidean algorithm to find integers x, y ∈ ℤ such that

2261x + 1275y = 17.

1.5 Congruences, Part III 31

1.6 Let f(x) ∈ ℤ[x] be a polynomial with integer coefficients. Formulate a conjecture about when the set {f(a) : a ∈ ℤ and f(a) is prime } is infinite. Give computational evidence for your conjecture.

1.7 Is it easy or hard for a computer to compute the gcd of two random

2000-digit numbers? 1.8 Prove that there are infinitely many primes of the form 6x − 1. 1.9 (a) Let y be the current year (e.g., 2002). Use a computer to compute

π(y) = #{ primes p ≤ y}.

(b) The prime number theorem predicts that π(x) is asymptotic to

x/ log(x). How close is π(2001) to 2001/ log(2001)?

1.10 Find complete sets of residues modulo 7, all of whose elements are

(a) nonnegative, (b) odd, (c) even, (d) prime. 1.11 Find an integer x such that 37x ≡ 1 (mod 101). 1.12 What is the order of 5 modulo 37? 1.13 Let n = φ(7!). Compute the prime factorization of n. 1.14 Find an x ∈ ℤ such that x ≡ −4 (mod 17) and x ≡ 3 (mod 23). 1.15 Compute 7^{100} (mod 389). 1.16 Find a number a such that 0 ≤ a < 111 and

(102^{70} + 1)^{35} ≡ a (mod 111).

1.17 Prove that if n > 4 is composite then

(n − 1)! ≡ 0 (mod n).

1.18 For what values of n is φ(n) odd? 1.19 Prove that a positive number n is divisible by 11 if and only if the

alternating sum of the digits of n is divisible by 11. 1.20 Let φ : ℕ → ℕ be the Euler φ function.

(a) Find all natural numbers n such that φ(n) = 1.

(b) Do there exist natural numbers m and n such that φ(mn) ≠ φ(m) · φ(n)?

32 1. Primes and Congruences

2

Public-key Cryptography

2.1 Diffie-Hellman Key Exchange

Key Ideas

• Public-key cryptography

• The Diffie-Hellman key exchange

2.1.1 Public-key Cryptography

Nikita must communicate vital information to Michael, who is a thousand kilometers away. Their communications are being monitored by The Collective, which must not discover the message. If Nikita and Michael could somehow agree on a secret encoding key, they could encrypt their message. Fortunately, Nikita knows about an algorithm developed by Diffie and Hellman in 1976.

2.1.2 The Diffie-Hellman Key Exchange Protocol

Nikita and Michael agree on a prime number p and an integer g that has order p − 1 modulo p. (So g^{p−1} ≡ 1 (mod p), but g^{n} ≢ 1 (mod p) for any positive n < p − 1.) Nikita chooses a random number n < p, and Michael chooses a random number m < p. Nikita sends g^{n} (mod p) to Michael, and Michael sends g^{m} (mod p) to Nikita. Nikita can now compute the secret key:

s = g^{mn} = (g^{m})^{n} (mod p).

Likewise, Michael computes the secret key:

s = g^{mn} = (g^{n})^{m} (mod p).

Now Nikita uses the secret key s to send Michael an encrypted version of her critical message. Michael, who also knows s, is able to decode the message.

Meanwhile, hackers in The Collective see both g^{n} (mod p) and g^{m} (mod p), but they aren’t able to use this information to deduce either m, n, or g^{mn} (mod p) quickly enough to stop Michael from thwarting their plans. Yeah!

The Diffie-Hellman key exchange is the first public-key cryptosystem every published (1976). The system was discovered by GCHQ (British intelligence) a few years before Diffie and Hellman found it, but they couldn’t tell anyone about their work; perhaps it was discovered by others before. That this system was discovered independently more than once shouldn’t surprise you, given how simple it is!

Some Quotes

A review of Diffie and Hellman’s groundbreaking article is amusing, because the reviewer, J.S. Joel, says “They propose a couple of techniques for implementing the system, but the reviewer was unconvinced.”

Diffie, Whitfield; Hellman, Martin E.
 New directions in cryptography.
 IEEE Trans. Information Theory IT-22 (1976), no. 6, 644--654.

The authors discuss some of the recent results in communications theory that have arisen out of the need for security in the key distribution channels. They concentrate on the use of ciphers to restrict the extraction of information from a communication over an insecure [channel]. As is well known, the transmission and distribution is then likely to become a problem, in efficiency if not in security. The authors suggest various possible approaches to avoid these further problems that arise. The first they call a “public key distribution system”, which has the feature that an unauthorized “eavesdropper” will find it computationally infeasible to decipher the message since the enciphering and deciphering are governed by distinct keys. They propose a couple of techniques for implementing the system, but the reviewer was unconvinced.

Alan Westrope^{1} wrote in 1998 about political implications: 1

The 1976 publication of “New Directions in Cryptography”, by Whitfield Diffie and Martin Hellman, was epochal in cryptographic history. Many regard it as the beginning of public-key cryptography, analogous to a first shot in what has become an ongoing battle over privacy, civil liberties, and the meaning of sovereignty in cyberspace.

Here is what Diffie and Hellman look like, respectively^{2} : 2

2.1.3 Let’s try it!

To make finding g easier, let’s choose a prime p such that (p − 1)/2 = q is prime (so p − 1 = 2q, with q prime). Since for any g with gcd(g, p) = 1,

g^{2q} ≡ 1 (mod p),

the order of g is 1, 2, q, or 2q = p − 1, so the order of g is easy to compute.

For our first example, let p = 23. Then g = 5 has order p − 1 = 22. (I found g = 5 using the function znprimroot in PARI. You can also just compute the order of 2, 3, etc., until you find a number with order p − 1.)

Nikita: Chooses secret n = 12; sends g^{12} = 5^{12} ≡ 18 (mod 23).

Michael: Chooses secret n = 5; sends g^{5} = 5^{5} ≡ 20 (mod 23).

Compute Shared Secret: Nikita: 20^{12} ≡ 3 (mod 23) Michael: 18^{5} ≡ 3 (mod 23).

1Who is he?

2I think I photographed these from Simon Singh’s crypto book.

2.1.4 The Discrete Logarithm Problem

Let a, b, n be positive real numbers. Recall that

log_{b}(a) = n if and only if a = b^{n}.

Thus the log_{b} function solves the following problem: Given a base b and a power a of b, find an exponent n such that

a = b^{n}.

That is, given b^{n} and b, find n. Example 2.1. a = 19683, b = 3. A calculator quickly gives that

n = log(19683)/ log(3) = 9.

The discrete log problem is the analogue of this problem modulo p:

Discrete Log Problem: Given b (mod p) and b^{n} (mod p), find n. Put another way, compute log_{b}(a), when a, b ∈ ℤ/pℤ.

As far as we know, this problem is VERY HARD to solve quickly. Nobody has admitted publicly to having proved that the discrete log can’t be solved quickly, but many very smart people have tried hard and not succeeded. It’s easy to write a slow program to solve the discrete log problem. (There are better methods but we won’t discuss them in this class.)

? dislog(x,g, s) = s=g; for(n=1,znorder(g),if(x==s, return(n), s=s*g)); 0;
? dislog(18,Mod(5,23))
%6 = 12
? dislog(20,Mod(5,23))
%7 = 5

So the example above was far too simple. Let’s try a slightly larger prime:

? p=nextprime(9584)
%8 = 9587
? isprime((p-1)\2)
%9 = 1
? znorder(Mod(2,p))
%10 = 9586
? g=Mod(2,p)
%11 = Mod(2, 9587)
? a = g^389
%15 = Mod(7320, 9587)
? dislog(a,g)
%16 = 389

This is still very easy to “crack”. Let’s try an even bigger one.

? p = 9048610007
%1 = 9048610007
?  g = Mod(5,p)
%2 = Mod(5, 9048610007)
? a = g^948603
%3 = Mod(3668993056, 9048610007)
? dislog(a,g)              \\ this take a while
%4 = 948603
? znlog(a,g)        \\ builtin super-optimized version takes about 1/2 second
%31 = 948603

Computing the discrete log gets slow quickly, the larger we make the p. Doubling the number of digits of the modulus makes the discrete log much much harder.

The State of the Art

Discrete logarithms in GF(2^n)
From: Reynald LERCIER <lercier@club-internet.fr>
 To: NMBRTHRY@LISTSERV.NODAK.EDU
 Date: Tue, 25 Sep 2001 13:37:18 -0400
We are pleased to announce a new record for the discrete logarithm
problem. We were able to compute discrete logarithms in
GF(2^521). This was done in one month on a unique 525MHz
quadri-processors Digital Alpha Server 8400 computer. The approach
that we followed is a careful implementation of the general Function
Field Sieve as described from a theoretical point of view by Adleman
[Ad94].
As far as we know, the largest such computation previously done was
performed in GF(2^401) [GoMc92] using an algorithm due to Coppersmith
[Co84].
[...]
So, as a conclusion, time that we need for computing discrete
logarithms in GF(2^521) on a 525 MHz quadri-processor alpha server
8400 computer is approximatively 12 hours for each, once the sieving
step (21 days) and the linear algebra step (10 days) is performed.
Antoine JOUX    (DCSSI, Issy les Moulineaux, France, Antoine.Joux@ens.fr),
Reynald LERCIER (CELAR, Rennes, France, lercier@celar.fr).

2.1.5 Realistic Example

? p=nextprime(93450983094850938450983409583)

%17 = 93450983094850938450983409611
? isprime((p-1)\2)
%18 = 0
? nextgoodprime(p) = while(!isprime((p-1)\2), p=nextprime(p+1)); p
? nextgoodprime(p)
%19 = 93450983094850938450983409623
? g=2
%21 = 2
? znorder(Mod(g,p))
%22 = 93450983094850938450983409610
? ?random
random({N=2^31}): random integer between 0 and N-1.
? nikita = random(p)
%23 = 18319922375531859171613379181
? michael = random(p)
%24 = 82335836243866695680141440300
? nikita_say = Mod(g,p)^nikita
%26 = Mod(17037287637415625385373411504, 93450983094850938450983409611)
? michael_say=Mod(g,p)^michael
%27 = Mod(2201425894324369970772940547, 93450983094850938450983409611)
? secret = nikita_say^michael
%28 = Mod(25591938014843312529239952955, 93450983094850938450983409611)
? secret = michael_say^nikita
%29 = Mod(25591938014843312529239952955, 93450983094850938450983409611)

2.2 The RSA Cryptosystem

Key Ideas:

• Creating an RSA public key

• Encrypting and decrypting messages

• Breaking RSA and factoring

2.2.1 How RSA works

One-way Functions

The fundamental idea behind RSA is to try to construct a “one-way function”, i.e., an “encryption” function

E : X → X

such that it is easy for Nikita, say, to compute E^{−1}, but very hard for anybody else to compute E^{−1}.

How Nikita Makes an RSA Public Key

Here is how Nikita makes a one-way function E:

1. Nikita picks two large primes p and q, and lets n = pq.

2. It is easy for Nikita to then compute

φ(n) = φ(p) · φ(q) = (p − 1) · (q − 1).

3. Nikita next chooses a “random” integer e with

1 < e < φ(n) and gcd(e, φ(n)) = 1.

4. Finally, Nikita uses the algorithm from Lecture 7 to find a solution d

to the equation

ex ≡ 1 (mod φ(n)).

The Encoding Function: Nikita defines a function E : ℤ/nℤ → ℤ/nℤ

E(x) = x^{e}.

(Recall that ℤ/nℤ = {0, 1, …, n − 1} with addition and multiplication modulo n.) Then anybody can compute E fairly quickly using the repeatedsquaring algorithm from Lecture 7.

Nikita’s public key is the pair of integers (n, e), which is just enough information for people to easily compute E. Nikita knows a number d such that ed ≡ 1 (mod φ(n)), so, as we will see below, she can quickly compute E^{−1}.

Now Michael or even The Collective can send Nikita a message whenever they want, even if Nikita is asleep. They look up how to compute E and compute E(their message).

Sending Nikita an Encrypted Message

Encode your message as a sequence of numbers modulo n (see Section 2.2.2):

m_{1}, …, m_{r} ∈ ℤ/nℤ.

Send

E(m_{1}), …, E(m_{r})

to Nikita. (Recall that E(m) = m^{e}.)

How Nikita Decrypts a Message

When Nikita receives an E(m_{i}), she finds m_{i} as follows:

m_{i} = E^{−1}(E(m_{i})) = E(m_{i})^{d} = (m_{i}^{e})^{d} = m_{i}.

The following proposition proves that the last equality holds.

Proposition 2.2. Let n be a square-free integer and let d, e ∈ ℕ such that p − 1 | de − 1 for each prime p | n. Then a^{de} ≡ a (mod n) for all a ∈ ℤ.

Proof. Since n | a^{de} − a if and only if p | a^{de} − a for each prime divisor of p, it suffices to prove that a^{de} ≡ a (mod p) for each prime divisor p of n. If gcd(a, p) ≠ 0, then a ≡ 0 (mod p), so a^{de} ≡ a (mod p). If gcd(a, p) = 1, then Fermat’s Little Theorem asserts that a^{p−1} ≡ 1 (mod p). Since p − 1 | de − 1, we have a^{de−1} ≡ 1 (mod p) as well. Multiplying both sides by a shows that a^{de} ≡ a (mod p).

2.2.2 Encoding a Phrase in a Number

Think of a sequence of letters and spaces as a number in base 27. Let a single-space correspond to 0, the letter A to 1, B to 2, ..., Z to 26. Thus, e.g., “HARVARD” denotes a number written in base 27. The corresponding number written in decimal is 1808939906:

HARVARD ↔ 8+27·1+27^{2}·18+27^{3}·22+27^{4}·1+27^{5}·18+27^{6}·4 = 1808939906

To recover the digits of the number, repeatedly divide by 27:

\begin{aligned}1808939906 & = & 66997774 · 27 & + & 8 & H \\ 66997774 & = & 2481399 · 27 & + & 1 & A \end{aligned}

and so on.

How Many Letters Can a Number “Hold”?

If 27^{k} < n, then k letters can be encoded in a number < n. Put another way,

k < log(n)/ log(27) = log_{27}(n).

2.2.3 Examples

A Small Example

So the arithmetic is easy to follow, we use small primes p and q and encrypt the single letter “X”.

1. Choose p and q: Let p = 17, q = 19, so n = pq = 323.

2. Compute φ(n):

φ(n) = φ(p·q) = φ(p)·φ(q) = (p−1)(q−1) = pq−p−q+1 = 323−17−19+1 = 288.

3. Randomly choose an e ∈ ℤ/323ℤ: We choose e = 95.

4. Solve

95x ≡ 1 (mod 288).

Using the GCD algorithm, we find that d = 191 solves the equation.

The public key is (323, 95). So E : ℤ/323ℤ → ℤ/323ℤ is defined by

E(x) = x^{95}.

Next, we encrypt the letter “X”. It is encoded as the number 24, since X is the 24th letter of the alphabet. We have

E(24) = 24^{95} = 294 ∈ ℤ/323ℤ.

To decrypt, we compute E^{−1}:

E^{−1}(294) = 294^{191} = 24 ∈ ℤ/323ℤ.

A Bigger Example in PARI

? p=nextprime(random(10^30))
%3 = 738873402423833494183027176953
? q=nextprime(random(10^25))
%4 = 3787776806865662882378273
? n=p*q
%5 = 2798687536910915970127263606347911460948554197853542169
? e=random(n)
%6 = 1483959194866204179348536010284716655442139024915720699
? phin=(p-1)*(q-1)
%7 = 2798687536910915970127262867470721260308194351943986944
? while(gcd(e,phin)!=1,e=e+1)
? e
%8 = 1483959194866204179348536010284716655442139024915720699
? d = lift(Mod(e,phin)^(-1));
%9 = 2113367928496305469541348387088632973457802358781610803
? (e*d)%phin
%10 = 1
? log(n)/log(27)
%11 = 38.03851667699197952338510248

We can encode single blocks of up to 38 letters. Let’s encode “HARVARD”:

? m=8+27*1+27^2*18+27^3*22+27^4*1+27^5*18+27^6*4
%12 = 1808939906
? E(x)=lift(Mod(x,n)^e)
? D(x)=lift(Mod(x,n)^d)
? secret_message = E(m)
%14 = 625425724974078486559370130768554070421628674916144724
? D(secret_message)
%15 = 1808939906

The following complete PARI program automates the whole process, though it is a little clumsy. Call this file rsa.gp. It uses { and } so that functions can be extended over more than one line.

/* rsa.gp ------------------------------------------------ */
{alphabet=[" ","A","B","C","D","E","F","G","H","I","J","K","L","M",
           "N","O","P","Q","R","S","T","U","V","W","X","Y","Z"];
}
{letter_to_number(l,
     n)=
     for(n=1,27,if(alphabet[n]==l,return(n-1)));
     error("invalid input.")
}
{number_to_message(n,
     s="")=
     while(n>0, s = concat(s,alphabet[n%27+1]); n = n \ 27);
     return(s)
}
{message_to_number(w,
     i,n=0)=
     for(i=1,length(w), n = n + 27^(i-1)*letter_to_number(w[i]));
     return(n);
}
{make_rsa_key(len,
     p,q,n,e,d)=
     p = nextprime(random(10^(len\2+1)));
     q = nextprime(random(10^(len\2+3)));
     n = p*q; phin = (p-1)*(q-1);
     e = random(phin);
     while(gcd(e,phin)!=1,e=e+1);
     d = lift(Mod(e,phin)^(-1));
     return([n,e,d]);
}
encrypt(message, n, e) = lift(Mod(message_to_number(message),n)^e);
decrypt(secret, n, d)  = number_to_message(lift(Mod(secret,n)^d));
/* rsa.gp ------------------------------------------------ */

Here is an example that uses the above little program.

? \r rsa
? setrand(1)   \\ default random number seed is 1!
? rsa=make_rsa_key(20)   \\ returns [n, e, d]
%2 = [89050154117716728145939, 33735260657253161660951,
      49244741969289756040079]
? n = rsa[1]; e = rsa[2]; d = rsa[3];
? public_key = [n,e]
%3 = [89050154117716728145939, 33735260657253161660951]
? msg = ["H", "A", "R", "V", "A", "R", "D"];   \\ clumsy!!!
? secret = encrypt(msg,n,e)
%36 = 75524965161901413275866
? decrypt(secret, n, d)
%37 = "HARVARD"

2.2.4 A Connection Between Breaking RSA and Factoring Integers

Nikita’s public key is (n, e). If we compute the factorization of n = pq, then we can compute φ(n) and hence deduce her secret decoder number d. It is no easier to φ(n) than to factor n: Suppose n = pq. Given φ(n), it is very easy to compute p and q. We have

φ(n) = (p − 1)(q − 1) = pq − (p + q) + 1,

so we know pq = n and p + q = n + 1 − φ(n). Thus we know the polynomial

x^{2} − (p + q)x + pq = (x − p)(x − q)

whose roots are p and q.

There is also a more complicated “probabilistic algorithm” to find p and q given the secret decoding number d. I might describe it in the next lecture.

2.3 Attacking RSA

Nikita’s public key is (n, e). If we compute the factorization of n = pq, then we can compute φ(n) and hence deduce her secret decoding number d. Thus attempting to factor n is a way to try to break an RSA public-key cryptosystem. In this lecture we consider several approaches to “cracking” RSA, and relate them to the difficulty of factoring n.

2.3.1 Factoring n Given φ(n)

If you know φ(n) then it is easy to factor n: Suppose n = pq. Given φ(n), it is very easy to compute p and q. We have

φ(n) = (p − 1)(q − 1) = pq − (p + q) + 1,

so we know both pq = n and p + q = n + 1 − φ(n). Thus we know the polynomial

x^{2} − (p + q)x + pq = (x − p)(x − q)

whose roots are p and q. These roots can be found using the quadratic formula. Example 2.3.

? n=nextprime(random(10^10))*nextprime(random(10^10));
? phin=eulerphi(n);
? f = x^2 - (n+1-phin)*x + n
%6 = x^2 - 12422732288*x + 31615577110997599711
? polroots(f)
%7 = [3572144239, 8850588049]
? n
%8 = 31615577110997599711
? 3572144239*8850588049
%9 = 31615577110997599711

2.3.2 When p and q Are Close

Suppose that p and q are “close” to each other. Then it is easy to factor n using a factorization method of Fermat.

Suppose n = pq with p > q, say. Then

n = (\frac{p + q}{2} )^{2} − (\frac{p − q}{2} )^{2} .

Since p and q are “close”,

s = \frac{p − q}{2}

is small,

t = \frac{p + q}{2}

is only slightly larger than \sqrt{n}, and t^{2} − n = s^{2} is a perfect square. So we just try

t = ceil(\sqrt{n}), t = ceil(\sqrt{n}) + 1, t = ceil(\sqrt{n}) + 2, …

until t^{2} − n is a perfect square s^{2}. Then

p = t + s, q = t − s.

Example 2.4. Suppose n = 23360947609. Then

\sqrt{n} = 152842.88 ….

If t = 152843, then \sqrt{t^{2} − n} = 187.18 . . ..

If t = 152844, then \sqrt{t^{2} − n} = 583.71 . . ..

If t = 152845, then \sqrt{t^{2} − n} = 804 ∈ ℤ.

Thus s = 804. We find that p = t + s = 153649 and q = t − s = 152041.

Here is a bigger example in PARI:

? q=nextprime(random(10^50))
%20 = 78177096444230804504075122792410749354743712880803
? p=nextprime(q+1)  \\ a nearby prime
%21 = 78177096444230804504075122792410749354743712880899
? n=p*q
%22 = 6111658408450564697085634201845976850509908580949986889525704...
      ...259650342157399279163289651693722481897
? t=floor(sqrt(n))+1
  ***   precision loss in truncation
? \p150        \\ set precision of floating-point computations.
   realprecision = 154 significant digits (150 digits displayed)
? t=floor(sqrt(n))+1
%29 = 78177096444230804504075122792410749354743712880851
? sqrt(t^2-n)
%30 = 48.000000000000000000000000000000000000000000000000000000....
? s=48
%31 = 48
? t + s     \\ p
%33 = 78177096444230804504075122792410749354743712880899
? t - s     \\ q
%35 = 78177096444230804504075122792410749354743712880803

2.3.3 Factoring n Given d

Suppose that we crack an RSA cryptosystem by finding a d such that

a^{ed} ≡ a (mod n)

for all a. Then we’ve found an m (= ed − 1) such that a^{m} ≡ 1 (mod n) for all a with gcd(a, n) = 1. Knowing a does not lead to a factorization of n in as direct a manner as knowing φ(n) does (see Section 2.3.1). However, there is a probabilistic procedure that, given an m such that a^{m} ≡ 1 (mod n), will with high probability find a factorization of n.

Probabilistic procedure to factor n:

1. m is even since (−1)^{m} ≡ 1 (mod n).

2. If a^{m/2} ≡ 1 (mod n) for all a coprime to n, replace m by m/2. In practice, it is not possible to determine whether or not this condition holds, because it would require doing a computation for too many a. Instead, we try a few random a; if a^{m/2} ≡ 1 (mod n) for the a we check, then we divide m by 2. (If there exists even a single a such that a^{m/2} ≢ 1 (mod n), then at least half the a have this property.)

Keep repeating this step until we find an a such that a^{m/2} ≢ 1 (mod n).

3. There is a 50% chance that a randomly chosen a will have the property that

a^{m/2} ≡ +1 (mod p), a^{m/2} ≡ −1 (mod q)

or

a^{m/2} ≡ −1 (mod p), a^{m/2} ≡ +1 (mod q).

If the first case occurs, then

p | a^{m/2} − 1, but q ∤ a^{m/2} − 1,

so

gcd(a^{m/2} − 1, pq) = p,

and we have factored n. Just keep trying a’s until one of the cases occurs.

? \r rsa   \\ load the file rsa.gp, available at Lecture 9 web page.
? rsa = make_rsa_key(10)
%34 = [32295194023343, 29468811804857, 11127763319273]
? n = rsa[1]; e = rsa[2]; d = rsa[3];
? m = e*d-1
%38 = 327921963064646896263108960
? for(a=2,20, if(Mod(a,n)^m!=1,print(a)))   \\ prints nothing...
? m = m/2
%39 = 163960981532323448131554480
? for(a=2,20, if(Mod(a,n)^m!=1,print(a)))
? m = m/2
%40 = 81980490766161724065777240
? for(a=2,20, if(Mod(a,n)^m!=1,print(a)))
? m = m/2
%41 = 40990245383080862032888620
? for(a=2,20, if(Mod(a,n)^m!=1,print(a)))
? m = m/2
%42 = 20495122691540431016444310
? for(a=2,20,if(Mod(a,n)^m!=1,print(a)))

5
6
... etc.
? gcd(2^m,n)
  ***   power overflow in pow_monome.
? x = lift(Mod(2,n)^m)-1
%43 = 4015382800098
? gcd(x,n)
%46 = 737531
? p = gcd(x,n)
%53 = 737531
? q = n/p
? p*q
%54 = 32295194023343
? n
%55 = 32295194023343

2.3.4 RSA Challenge n

The easiest challenge at

  http://www.rsasecurity.com/rsalabs/challenges/factoring/numbers.html

is the 576-bit number

Name:         RSA-576
Prize:        Ten Thousand Dollars
Digits:       174
Digit Sum:    785
188198812920607963838697239461650439807163563379417382700763356422988859
715234665485319060606504743045317388011303396716199692321205734031879550
656996221305168759307650257059

Exercises

2.1 You and Nikita wish to agree on a secret key using the Diffie-Hellman protocol. Nikita announces that p = 3793 and g = 7. Nikita secretely chooses a number n < p and tells you that g^{n} ≡ 454 (mod p). You choose the random number m = 1208. Find the secret key!

2.2 This problem concerns encoding phrases using numbers using the encoding of Section ??.

(a) Find the number that corresponds to VE␣RI␣TAS. (Note that the left-most “digit”, V, is the least significant digit, and ␣ denotes a blank space.)

(b) What is the longest arbitrary sequence of letters (and space) that can be stored using a number that is less than 10^{20}?

2.3 You see Michael and Nikita agree on a secret key using the Diffie-Hellman key exchange protocol. Michael and Nikita choose p = 97 and g = 5. Nikita chooses a random number n and tells Michael that g^{n} ≡ 3 (mod 97), and Michael chooses a random number m and tells Nikita that g^{m} ≡ 7 (mod 97). Crack their code: What is the secret key that Nikita and Michael agree upon? What is n? What is m?

2.4 Using the RSA public key is (n, e) = (441484567519, 238402465195), encrypt the current year.

2.5 In this problem, you will “crack” an RSA cryptosystem.

(a) What is the secret decoding number d for the RSA cryptosystem with public key (n, e) = (5352381469067, 4240501142039)?

(b) The number 3539014000459 encrypts an important question using the RSA cryptosystem from part (a). What is the question? (After decoding, you’ll get a number. To find the corresponding word, see Section 2 of Lecture 9.)

2.6 Suppose Michael creates an RSA cryptosystem with a very large modulus N for which the factorization of N cannot be found in a reasonable amount of time. Suppose that Nikita sends messages to Michael by representing each alphabetic character as an integer between 0 and 26 (A corresponds to 1, B to 2, etc., and a space ␣ to 0), then encrypts each number separately using Michael’s RSA cryptosystem. Is this method secure? Explain your answer.

2.7 Nikita creates an RSA cryptosystem with public key

(n, e) = (1433811615146881, 329222149569169).

In the following two problems, show the steps you take. Don’t simply factor n directly using the factor function in PARI.

(a) Somehow you discover that d = 116439879930113. Show how to use the probabilistic algorithm of Lecture 10 to use d to factor n.

(b) In part (a) you found that the factors p and q of n are very close. Show how to use the “Fermat Factorization” method of Lecture 10 to factor n.

2.8 Nikita and Michael decide to agree on a secret encryption key using the Diffie-Hellman key exchange protocol. You observe the following:

(a) Nikita chooses p = 13 for the modulus and g = 2 as generator.

(b) Nikita sends 6 to Michael.

2.3 Attacking RSA 49

(c) Michael sends 11 to Nikita. What is the secret key?

2.9 Consider the RSA public-key cryptosystem defined by (n, e) = (77, 7). (a) Encrypt the number 4 using this cryptosystem.

(b) Find an integer d such that ed ≡ 1 (mod φ(n)).

50 2. Public-key Cryptography

3

Quadratic Reciprocity

3.1 Primitive Roots

Key Idea: There is an element of (ℤ/pℤ) of order p − 1.

3.1.1 Polynomials over ℤ/pℤ

Proposition 3.1. Let f ∈ (ℤ/pℤ)[x] be a nonzero polynomial over the ring ℤ/pℤ. Then there are at most deg(f) elements α ∈ ℤ/pℤ such that f(α) = 0.

Proof. We proceed by induction on deg(f). The cases deg(f) = 0, 1 are clear. Write f = a_{n}x^{n} + ⋯ a_{1}x + a_{0}. If f(α) = 0 then

f(x) = f(x) − f(α)
= a_{n}(x^{n} − α^{n}) + ⋯ a_{1}(x − α) + a_{0}(1 − 1)
= (x − α)(a_{n}(x^{n−1} + ⋯ + α^{n−1}) + ⋯ a_{1})
= (x − α)g(x),

for some polynomial g(x) ∈ (ℤ/pℤ)[x]. Next suppose that f(β) = 0 with β ≠ α. Then (β − α)g(β) = 0, so, since β − α ≠ 0 (hence gcd(β − α, p) = 1, we have g(β) = 0. By our inductive hypothesis, g has at most n − 1 roots, so there are at most n−1 possibilities for β. It follows that f has at most n roots.

Proposition 3.2. Let p be a prime number and let d be a divisor of p − 1. Then f(x) = x^{d} − 1 ∈ (ℤ/pℤ)[x] has exactly d solutions.

Proof. Let e be such that de = p − 1. We have

x^{p−1} − 1 = (x^{d})^{e} − 1
= (x^{d} − 1)((x^{d})^{e−1} + (x^{d})^{e−2} + ⋯ + 1)
= (x^{d} − 1)g(x),

where deg(g(x)) = p − 1 − d. Recall that Fermat’s little theorem implies that x^{p−1} − 1 has exactly p − 1 roots in ℤ/pℤ. By Proposition 3.1, f(x) has at most p − 1 − d roots and x^{d} − 1 has at most d roots, so g(x) has exactly p − 1 roots and x^{d} − 1 has exactly d roots, as claimed.

WARNING: The analogue of this theorem is false for some f ∈ (ℤ/nℤ)[x] with n composite. For example, if n = n_{1} · n_{2} with n_{1}, n_{2} ≠ 1, then f = nx has at least two distinct zeros, namely 0 and n_{2} ≠ 0.

3.1.2 The Structure of (ℤ/pℤ)^{∗} = {1, 2, …, p − 1}

In this section, we prove that the group (ℤ/pℤ)^{∗} is cylic.

Definition 3.3. A primitive root modulo p is an element of (ℤ/pℤ)^{∗} of order p − 1.

Question: For which primes p is there a primitive root? (Ans. Every prime.)

Lemma 3.4. Suppose a, b ∈ (ℤ/nℤ)^{∗} have orders r and s, respectively, and that gcd(r, s) = 1. Then ab has order rs.

This is a general fact about commuting elements of a group.

Proof. Since (ab)^{rs} = a^{rs}b^{rs} = 1, the order of ab is a divisor r_{1}s_{1} of rs, where r_{1} | r and s_{1} | s. Thus

a^{r_{1}s_{1}}b^{r_{1}s_{1}} = (ab)^{r_{1}s_{1}} = 1.

Raise both sides to the power r_{2}, where r_{1}r_{2} = r. Then

a^{r_{1}r_{2}s_{1}}b^{r_{1}r_{2}s_{1}} = 1,

so, since a^{r_{1}r_{2}s_{1}} = (a^{r_{1}r_{2}})^{s_{1}} = 1,

b^{r_{1}r_{2}s_{1}} = 1.

This implies that s | r_{1}r_{2}s_{1}, and, since gcd(s, r_{1}r_{2}) = 1, it follows that s = s_{1}. A similar argument shows that r = r_{1}, so the order of ab is rs.

Theorem 3.5. For every prime p there is a primitive root mod p. In other words, the group (ℤ/pℤ)^{∗} is a cyclic group of order p − 1.

Proof. Write

p − 1 = q_{1}^{n_{1}}q_{2}^{n_{2}} ⋯ q_{r}^{n_{r}}

as a product of distinct primes q_{i}.

By Proposition 3.2, the polynomial x^{q_{i}^{n_{i}}} − 1 has exactly q_{i}^{n_{i}} roots, and the polynomial x^{q_{i}^{n_{i}−1}} − 1 has exactly q_{i}^{n_{i}−1} roots. Thus there is an a_{i} ∈

ℤ/pℤ such that a_{i}^{q_{i}^{n_{i}}} = 1 but a_{i}^{q_{i}^{n_{i}−1}} ≠ 1. This a_{i} has order q_{i}^{n_{i}}. For each i = 1, …, r, choose such an a_{i}. By repeated application of Lemma 3.4, we see that

a = a_{1}a_{2} ⋯ a_{r}

has order q_{1}^{n_{1}} ⋯ q_{r}^{n_{r}} = p − 1, so a is a primitive root.

Remark 3.6. There are φ(p − 1) primitive roots modulo p, since there are q_{i}^{n_{i}} −q_{i}^{n_{i}−1} ways to choose a_{i}. To see this, we check that two distinct choices of sequence a_{1}, …, a_{r} define two different primitive roots. Suppose that

a_{1}a_{2} ⋯ a_{r} = a′_{1}a′_{2} ⋯ a′_{r},

with a_{i}, a′_{i} of order q_{i}^{n_{i}}, for i = 1, …, r. Upon raising both sides of this equality to the power s = q_{2}^{n_{2}} ⋯ q_{r}^{n_{r}}, we see that a_{1}^{s} = a_{1}^{′s}. Since gcd(s, q_{1}^{n_{1}}) = 1, there exists t such that st ≡ 1 (mod q_{1}^{n_{1}}). It follows that

a_{1} = (a_{1}^{s})^{t} = (a_{1}^{′s})^{t} = a′_{1}.

Upon canceling a_{1} from both sides, we see that a_{2} ⋯ a_{r} = a′_{2} ⋯ a′_{r}; by repeating the above argument, we see that a_{i} = a′_{i} for all i. Thus, different choices of the a_{i} must lead to different primitive roots; in other words, if the primitive roots are the same, then the a_{i} were the same.

For example, there are φ(16) = 2^{4} − 2^{4} = 8 primitive roots mod 17:

? for(n=1,16,if(znorder(Mod(n,17))==16,print1(n," ")))
3 5 6 7 10 11 12 14

Example 3.7. In this example, we illustrate the proof of Theorem 3.5 when p = 13. We have

p − 1 = 12 = 2^{2} · 3.

The polynomial x^{4} − 1 has roots {1, 5, 8, 12} and x^{2} − 1 has roots {1, 12}, so we take a_{1} = 5. The polynomial x^{3} − 1 has roots {1, 3, 9}, so set a_{2} = 3. Finally, a = 5 · 3 = 15 = 2. Note that the successive powers of 2 are

2, 4, 8, 3, 6, 12, 11, 9, 5, 10, 7, 1,

so 2 really does have order 12.

Example 3.8. The result is false if, e.g., p is replaced by a big power of 2. The elements of (ℤ/8ℤ)^{∗} all have order dividing 2, but φ(8) = 4.

Theorem 3.9. Let p^{n} be a power of an odd prime. Then there is an element of (ℤ/p^{n}ℤ)^{∗} of order φ(p^{n}). Thus (ℤ/p^{n}ℤ)^{∗} is cyclic.

I will not prove Theorem 3.9 in class. I will probably put a problem on your next homework set that will guide you to a proof.

3.1.3 Artin’s Conjecture

Conjecture 3.10 (Emil Artin). If a ∈ ℤ is not −1 or a perfect square, then the number N(x, a) of primes p ≤ x such that a is a primitive root modulo p is asymptotic to C(a)π(x), where C(a) is a constant that depends only on a. In particular, there are infinitely many primes p such that a is a primitive root modulo p.

Nobody has proved this conjecture for even a single choice of a. There are partial results, e.g., that there are infinitely many p such that the order of a is divisible by the largest prime factor of p−1. (See, e.g., Moree, Pieter, A note on Artin’s conjecture.)

3.2 Quadratic Reciprocity I

Key Ideas:

• Euler’s Criterion: When is a a square modulo p?

• Quadratic reciprocity

• Lemma of Gauss

3.2.1 Euler’s Criterion

Proposition 3.11 (Euler’s Criterion). Let p be an odd prime and a an integer not divisible by p. Then x^{2} ≡ a (mod p) has a solution if and only if

a^{(p−1)/2} ≡ 1 (mod p).

Proof. By the theorem from Lecture 11, there is an integer g that has order p − 1 modulo p. Every integer coprime to p is congruent to a power of g. First suppose that a is congruent to a perfect square modulo p, so

a ≡ (g^{r})^{2} ≡ g^{2r} (mod p)

for some r. Then

a^{(p−1)/2} ≡ g^{2r· \frac{p−1}{2}} ≡ g^{r(p−1)} ≡ 1 (mod p).

Conversely, suppose that a^{(p−1)/2} ≡ 1 (mod p). We have a ≡ g^{r} (mod p) for some integer r. Thus g^{r(p−1)/2} ≡ 1 (mod p), so

p − 1 | r(p − 1)/2

which implies that r is even. Thus a ≡ (g^{r/2})^{2} (mod p), so a is congruent to a square modulo p.

Corollary 3.12. If x^{2} ≡ a (mod p) has no solutions if and only if a^{(p−1)/2} ≡ −1 (mod p).

Proof. This follows from Proposition 3.11 and that the polynomial x^{2} − 1 has no roots besides +1 and −1.

Example 3.13. Suppose p = 11. By squaring each element of (ℤ/11ℤ)^{∗}, we see exactly which numbers are squares modulo 11:

1^{2} = 1, 2^{2} = 4, 3^{2} = 9, 4^{2} = 5, 5^{2} = 3, 6^{2} = 3, 7^{2} = 5, 8^{2} = 9, 9^{2} = 4, 10^{2} = 1.

Thus the squares are {1, 3, 4, 5, 9}. Next, we compute a^{(p−1)/2} = a^{5} for each a ∈ (ℤ/11ℤ)^{∗}.

1^{5} = 1, 2^{5} = −1, 3^{5} = 1, 4^{5} = 1, 5^{5} = 1, 6^{5} = −1, 7^{5} = −1, 8^{5} = −1, 9^{5} = 1, 10^{5} = −1.

The a with a^{5} = 1 are {1, 3, 4, 5, 9}, which is exactly the same as the set of squares, just as Proposition 3.11 predicts. Example 3.14. Determine whether or not 3 is a square modulo p = 726377359. Answer: We compute 3^{(p−1)/2} modulo p using PARI:

? Mod(3,p)^((p-1)/2)
%5 = Mod(726377358, 726377359)   \\ class of -1 modulo 726377359.

Thus 3 is not a square modulo p. This computation wasn’t too difficult, but it would have been very tedious to carry about by hand. The law of quadratic reciprocity, which we will state in the next section, is a vastly more powerful way to answer such questions. For example, you could easily answer the above question by hand using quadratic reciprocity. Remark 3.15. Proposition 3.11 can be reformulated in more group-theoretic language as follows. The map

(ℤ/pℤ)^{∗} → {±1}

that sends a to a^{(p−1)/2} (mod p) is a homomorphism of groups, whose kernel is the subgroup of squares of elements of (ℤ/pℤ)^{∗}.

Definition 3.16. An element a ∈ ℤ with p ∤ a is called a quadratic residue modulo p if a is a square modulo p.

3.2.2 The Quadratic Reciprocity Law

Let p be an odd prime and let a be an integer with p ∤ a. Set

(\frac{a}{p}) = \begin{cases}+1 & if a is a quadratic residue, and \\ −1 & otherwise. \end{cases}

Proposition 3.11 implies that

(\frac{a}{p}) ≡ a^{(p−1)/2} (mod p).

Also, notice that

(\frac{a}{p}) · (\frac{b}{p}) = (\frac{ab}{p}) ,

because (\frac{·}{p}) is a homomorphism (see Remark 3.15).

The symbol (\frac{a}{p}) only depends on the residue class of a modulo p. Thus tabulating the value of (\frac{a}{5}) for hundreds of a would be silly. Would it be equally silly to make a table of (\frac{5}{p}) for hundreds of primes p? Let’s begin making such a table and see whether or not there is an obvious pattern. (To compute (\frac{a}{p}) in PARI, use the command kronecker(a,b).)

\begin{matrix}p & (\frac{5}{p}) & p mod 5 \\ 7 & −1 & 2 \\ 11 & 1 & 1 \\ 13 & −1 & 3 \\ 17 & −1 & 2 \\ 19 & 1 & 4 \\ 23 & −1 & 3 \\ 29 & 1 & 4 \\ 31 & 1 & 1 \\ 37 & −1 & 2 \\ 41 & 1 & 1 \\ 43 & −1 & 3 \\ 47 & −1 & 2 \end{matrix}

The evidence suggests that (\frac{5}{p}) depends only on the congruence class of p;

more precisely, (\frac{5}{p}) = 1 if and only if p ≡ 1, 4 (mod 5), i.e., p is a square modulo 5. However, when I think directly about the equation

5^{(p−1)/2} (mod p),

I see no way that knowing that p ≡ 1, 4 (mod 5) helps us to evaluate that strange expression! And yet, the numerical evidence is so compelling! Argh!

Based on such computations, various mathematicians found a conjectural explanation for this mystery in the 18th century. Finally, on April 8, 1796, at your age (age 19), Gauss proved their conjecture.

Theorem 3.17 (The Law of Quadratic Reciprocity). Suppose that p and q are odd primes. Then

(\frac{p}{q}) = (−1)^{\frac{p−1}{2} · \frac{q−1}{2}} (\frac{q}{p}) .

We will prove this theorem in the next lecture.

In the case considered above, this theorem implies that

(\frac{5}{p}) = (−1)^{2· \frac{p−1}{2}} (\frac{p}{5}) = (\frac{p}{5}) = \begin{cases}+1 & if p ≡ 1, 4 (mod 5) \\ −1 & if p ≡ 2, 3 (mod 5). \end{cases}

Thus the quadratic reciprocity law “explains” why knowing p modulo 5 helps in computing 5^{\frac{p−1}{2}} (mod p).

Here is a list of almost 200 proofs of Theorem 3.23:

    http://www.rzuser.uni-heidelberg.de/~hb3/rchrono.html

3.2.3 A Lemma of Gauss

The proof we will give of Theorem 3.23 was first discovered by Gauss, though not when he was 19. This proof is given in many elementary number theory texts (including Davenport). It depends on the following lemma of Gauss:

Lemma 3.18. Let p be an odd prime and let a be an integer ≢ 0 (mod p). Form the numbers

a, 2a, 3a, …, \frac{p − 1}{2}a

and reduce them modulo p to lie in the interval (−\frac{p}{2}, \frac{p}{2}). Let ν be the number of negative numbers in the resulting set. Then

(\frac{a}{p}) = (−1)^{ν}.

Proof. In defining ν, we expressed each number in

S = \{a, 2a, …, \frac{p − 1}{2}a\}

as congruent to a number in the set

\{1, −1, 2, −2, …, \frac{p − 1}{2}, −\frac{p − 1}{2}\} .

No number 1, 2, … \frac{p−1}{2} appears more than once, with either choice of sign, because if it did then either two elements of S are congruent modulo p or 0 is the sum of two elements of S, and both events are impossible. Thus the resulting set must be of the form

T = \{ε_{1} · 1, ε_{2} · 2, …, ε_{(p−1)/2} · \frac{p − 1}{2}\} ,

where each ε_{i} is either +1 or −1. Multiplying together the elements of S and of T, we see that

(1a)·(2a)·(3a)·· · ··(\frac{p − 1}{2}a) ≡ (ε_{1}·1)·(ε_{2}·2) ⋯ (ε_{(p−1)/2} · \frac{p − 1}{2}) (mod p),

so

a^{(p−1)/2} ≡ ε_{1} · ε_{2} · · · · · ε_{(p−1)/2} (mod p).

The lemma then follows from Proposition 3.11.

3.3 Quadratic Reciprocity II

3.3.1 Recall Gauss’s Lemma

We proved the following lemma in the previous lecture.

Lemma 3.19. Let p be an odd prime and a an integer with p ∤ a. Form the numbers a, 2a, 3a, …, \frac{p−1}{2}a and reduce them modulo p to lie in the interval (−\frac{p}{2}, \frac{p}{2}). Let ν be the number of negative numbers in the resulting

set. Then (\frac{a}{p}) = (−1)^{ν}.

3.3.2 Euler’s Conjecture

Lemma 3.20. Let a, b ∈ ℚ. Then for any n ∈ ℤ,

# ((a, b) ∩ ℤ) ≡ # ((a, b + 2n) ∩ ℤ) ≡ # ((a + 2n, b) ∩ ℤ) (mod 2).

Proof. If n > 0, then

(a, b + 2n) = (a, b) ∪ [b, b + 2n),

where the union is disjoint. Let [x] denote the least integer ≥ x. There are 2n integers,

[b], [b] + 1, …, [b] + 2n − 1,

in the interval [b, b + 2n), so the assertion of the lemma is true in this case. We also have

(a, b − 2n) = (a, b)\[b − 2n, b)

and [b − 2n, b) also contains exactly 2n integers, so the lemma is also true when n is negative. The statement about # ((a + 2n, b) ∩ ℤ) is proved in a similar manner.

The following proposition was first conjectured by Euler, based on extensive numerical evidence. Once we’ve proved this proposition, it will be easy to deduce the quadratic reciprocity law.

Proposition 3.21 (Euler’s Conjecture). Let p be an odd prime and a ∈ ℕ a natural number with p ∤ a.

1. The symbol (\frac{a}{p}) depends only on p modulo 4a.

2. If q is a prime with q ≡ −p (mod 4a), then (\frac{a}{p}) = (\frac{a}{q}).

Proof. To apply Gauss’s lemma, we have to compute the parity of the intersection of

S = \{a, 2a, 3a, … \frac{p − 1}{2}a\}

and

I = (\frac{1}{2}p, p) ∪ (\frac{3}{2}p, 2p) ∪ ⋯ ∪ ((b − \frac{1}{2}) p, bp) ,

where b = \frac{1}{2}a or \frac{1}{2}(a − 1), whichever is an integer. (Why? We have to check

that every element of S that reduces to something in the interval (− \frac{p}{2} , 0) lies in I. This is clear if b = \frac{1}{2} a < \frac{p−1}{2} a. If b = \frac{1}{2} (a − 1), then bp + \frac{p}{2} > \frac{p−1}{2} a, so ((b − \frac{1}{2} )p, bp) is the last interval that could contain an element of of S that reduces to (− \frac{p}{2} , 0).) Also note that the integer endpoints of I are not in S, since those endpoints are divisible by p, but no element of S is divisible by p.

Dividing I through by a, we see that

#(S ∩ I) = # (ℤ ∩ \frac{1}{a}I) ,

where

\frac{1}{a}I = ((\frac{p}{2a}, \frac{p}{a}) ∪ (\frac{3p}{2a}, \frac{2p}{a}) ∪ ⋯ ∪ (\frac{(2b − 1)p}{2a}, \frac{bp}{a})) .

Write p = 4ac + r, and let

J = ((\frac{r}{2a}, \frac{r}{a}) ∪ (\frac{3r}{2a}, \frac{2r}{a} ) ∪ ⋯ ∪ (\frac{(2b − 1)r}{2a} , \frac{br}{a} )) .

The only difference between I and J is that the endpoints of intervals are changed by addition of an even integer. By Lemma 3.20,

ν = # (ℤ ∩ \frac{1}{a}I) ≡ #(ℤ ∩ J) (mod 2).

Thus (\frac{a}{p}) = (−1)^{ν} depends only on r, i.e., only on p modulo 4a. WOW!

If q ≡ −p (mod 4a), then the only change in the above computation is that r is replaced by 4a − r. This changes \frac{1}{a}I into

K = ((2 − \frac{r}{2a}, 4 − \frac{r}{a}) ∪ (6 − \frac{3r}{2a}, 8 − \frac{2r}{a} ) ∪ ⋯ ∪ (4b − 2 − \frac{(2b − 1)r}{2a} , 4b − \frac{br}{a} )) .

Thus K is the same as −\frac{1}{a}I, except even integers have been added to the endpoints. By Lemma 3.20,

#(K ∩ ℤ) ≡ # ((\frac{1}{a}I) ∩ ℤ) (mod 2),

so (\frac{a}{p}) = (\frac{a}{q}), which completes the proof.

The following more careful analysis in the special case when a = 2 helps illustrate the proof of the above lemma, and is frequently useful in computations.

Proposition 3.22. Let p be an odd prime. Then

(\frac{2}{p}) = \begin{cases}1 & if p ≡ ±1 (mod 8) \\ −1 & if p ≡ ±3 (mod 8) \end{cases} .

Proof. When a = 2, the set S = \{a, 2a, …, 2 · \frac{p−1}{2}\} is

{2, 4, 6, …, p − 1}.

We must count the parity of the number of elements of S that lie in the interval I = (\frac{p}{2}, p). Writing p = 8c + r, we have

# (I ∩ S) = # (\frac{1}{2}I ∩ ℤ) = # ((\frac{p}{4}, \frac{p}{2}) ∩ ℤ)

= # ((2c + \frac{r}{4}, 4c + \frac{r}{2}) ∩ ℤ) ≡ # ((\frac{r}{4}, \frac{r}{2}) ∩ ℤ) (mod 2),

where the last equality comes from Lemma 3.20. The possibilities for r are 1, 3, 5, 7. When r = 1, the cardinality is 0, when r = 3, 5 it is 1, and when r = 7 it is 2.

3.3.3 The Quadratic Reciprocity Law

With the lemma in hand, it is straightforward to deduce the quadratic reciprocity law.

Theorem 3.23 (Gauss). Suppose that p and q are distinct odd primes. Then

(\frac{p}{q}) · (\frac{q}{p}) = (−1)^{\frac{p−1}{2} · \frac{q−1}{2}} .

Proof. First suppose that p ≡ q (mod 4). By swapping p and q if necessary, we may assume that p > q, and write p − q = 4a. Since p = 4a + q,

(\frac{p}{q}) = (\frac{4a + q}{q} ) = (\frac{4a}{q}) = (\frac{a}{q}) ,

and

(\frac{q}{p}) = (\frac{p − 4a}{p}) = (\frac{−4a}{p}) = (\frac{−1}{p}) · (\frac{a}{p}) .

Proposition 4.16 implies that (\frac{a}{q}) = (\frac{a}{p}), since p ≡ q (mod 4a). Thus

(\frac{p}{q}) · (\frac{q}{p}) = (\frac{−1}{p}) = (−1)^{\frac{p−1}{2}} = (−1)^{\frac{p−1}{2} · \frac{q−1}{2}} ,

where the last equality is because \frac{p−1}{2} is even if and only if \frac{q−1}{2} is even.

Next suppose that p ≢ q (mod 4), so p ≡ −q (mod 4). Write p + q = 4a. We have

(\frac{p}{q}) = (\frac{4a − q}{q} ) = (\frac{a}{q}) , and (\frac{q}{p}) = (\frac{4a − p}{p}) = (\frac{a}{p}) .

Since p ≡ −q (mod 4a), Proposition 4.16 implies that (\frac{p}{q}) = (\frac{q}{p}). Since

(−1)^{\frac{p−1}{2} · \frac{q−1}{2}} = 1, the proof is complete.

Examples

Example 3.24. Is 6 a square modulo 389? We have

(\frac{6}{389}) = (\frac{2 · 3}{389}) = (\frac{2}{389}) · (\frac{3}{389}) = (−1) · (−1) = 1.

Here, we found that (\frac{2}{389}) = −1 using Proposition 3.22 and that 389 ≡ 3 (mod 8). We found (\frac{3}{389}) as follows:

(\frac{3}{389}) = (\frac{389}{3}) = (\frac{2}{3}) = −1.

Thus 6 is a square modulo 389.

Annoyingly, though we know that 6 is a square modulo 389, we still don’t know an x such that x^{2} ≡ 6 (mod 389)!

? for(a=1,388,if(Mod(a,389)^2==6,print1(a, " ")))
28 361

Example 3.25. Is 3 a square modulo p = 726377359? We proved that the answer is “no” in the previous lecture by computing 3^{p−1} (mod p). It’s easier to prove that the answer is no using Theorem 3.23:

(\frac{3}{726377359}) = (−1)^{1· \frac{726377358}{2}} · (\frac{726377359}{3}) = − (\frac{1}{3}) = −1.

Exercises

3.1 Calculate the following symbols by hand: (\frac{3}{97}), (\frac{5}{389}), (\frac{2003}{11}), and (\frac{5!}{7}).

3.2 Prove that for p ≥ 5 prime, (\frac{3}{p}) = \begin{cases}1 & if p ≡ 1, 11 (mod 12), \\ −1 & if p ≡ 5, 7 (mod 12). \end{cases}

3.3 Prove that there is no primitive root modulo 2^{n} for any n ≥ 3. [Relate the statement for n = 3 to the statement for n > 3.]

3.4 Prove that if p is a prime, then there is a primitive root modulo p^{2}. [Hint: Write down an element of (ℤ/p^{2}ℤ)^{∗} that looks like it might have order p, and prove that it does. Recall that if a, b have orders n, m, with gcd(n, m) = 1, then ab has order nm.]

3.5 Use the fact that (ℤ/pℤ)^{∗} is cyclic to give a direct proof that (\frac{−3}{p}) = 1 when p ≡ 1 (mod 3). [Hint: There is an c ∈ (ℤ/pℤ)^{∗} of order 3. Show that (2c + 1)^{2} = −3.]

3.6 If p ≡ 1 (mod 5), show directly that (\frac{5}{p}) = 1 by the method of Exercise 5. [Hint: Let c ∈ (ℤ/pℤ)^{∗} be an element of order 5. Show that (c + c^{4})^{2} + (c + c^{4}) − 1 = 0, etc.]

3.7 For which primes p is ∑_{a=1}^{p−1} (\frac{a}{p}) = 0?

3.8 Artin conjectured that the number of primes p ≤ x such that 2 is a primitive root modulo p is asymptotic to Cπ(x) where π(x) is the number of primes ≤ x and C is a fixed constant called Artin’s constant. Using a computer, make an educated guess as to what C should be, to a few decimal places of accuracy. Explain your reasoning. (Note: Don’t try to prove that your guess is correct.)

3.9 How many natural numbers x < 2^{13} satisfy the equation

x^{2} ≡ 5 (mod 2^{13} − 1)?

(You may assume that 2^{13} − 1 is prime.)

3.10 Find the natural number x < 97 such that x ≡ 4^{48} (mod 97). (Note that 97 is prime.)

4

Continued Fractions

A continued fraction is an expression of the form

a_{0} + \frac{1}{a_{1} + _{\frac{1}{a_{2}+ \frac{1}{a_{3}+···}}}}

which may or may not go on indefinitely. We denote^{1} the value of this continued fraction by

[a_{0}, a_{1}, a_{2}, …].

The a_{n} are called the partial quotients of the continued fraction (we will see why at the end of this lecture). Thus, e.g.,

[1, 2] = 1 + \frac{1}{2} = \frac{3}{2},

and

\frac{172}{51} = [3, 2, 1, 2, 6] = 3 + \frac{1}{2 + _{\frac{1}{1+_{\frac{1}{2+ \frac{1}{6}}}}}} .

Continued fractions have many applications, from the abstract to the concrete. They give good rational approximations to irrational numbers, and the have been used to understand why you can’t tune a piano perfectly.^{2} Continued fractions also suggest a sense in which e appears to be “less transcendental” than π.

1Warning: This notation clashes with the notation used in Davenport. Our notation is standard.

2See http://www.research.att.com/~njas/sequences/DUNNE/TEMPERAMENT.HTML

There are many places to read about continued fractions, including Chapter X of Hardy and Wright’s Intro. to the Theory of Numbers, §13.3 of Burton’s Elementary Number Theory, Chapter IV of Davenport, and Khintchine’s Continued Fractions. The notes you’re reading right now draw primarily on Hardy and Wright, since their exposition is very clear and to the point. I found Davenport’s chapter IV uneccessarily tedious; I felt marched through a thick jungle to see a beautiful river.

4.1 Finite Continued Fractions

Definition 4.1. A finite continued fraction is an expression

a_{0} + \frac{1}{a_{1} + _{\frac{1}{a_{2}+···+ \frac{1}{am} ,}}}

where each a_{n} is a rational number and a_{n} > 0 for all n ≥ 1. If the a_{n} are integers, we say that the continued fraction is integral.

To get a feeling for continued fractions, observe that

[a_{0}] = a_{0},
[a_{0}, a_{1}] = a_{0} + \frac{1}{a_{1}} = \frac{a_{0}a_{1} + 1}{a_{1}},
[a_{0}, a_{1}, a_{2}] = a_{0} + \frac{1}{a_{1} + \frac{1}{a_{2}}} = \frac{a_{0}a_{1}a_{2} + a_{0} + a_{2}}{a_{1}a_{2} + 1} .

Also,

[a_{0}, a_{1}, …, a_{m−1}, a_{m}] = [a_{0}, a_{1}, …, a_{m−2}, a_{m−1} + \frac{1}{a_{m}}]

= a_{0} + \frac{1}{[a_{1}, …, a_{m}]}

= [a_{0}, [a_{1}, …, a_{m}]].

Partial Convergents

Fix a continued fraction [a_{0}, …, a_{m}].

Definition 4.2. For 0 ≤ n ≤ m, the nth convergent of the continued fraction [a_{0}, …, a_{m}] is [a_{0}, …, a_{n}].

For each n ≥ −1, define real numbers p_{n} and q_{n} as follows:

p_{−1} = 1,  p_{0} = a_{0},  p_{1} = a_{1}p_{0} + p_{−1} = a_{1}a_{0} + 1,  p_{n} = a_{n}p_{n−1} + p_{n−2},
q_{−1} = 0,  q_{0} = 1,  q_{1} = a_{1}q_{0} + q_{−1} = a_{1},  q_{n} = a_{n}q_{n−1} + q_{n−2}.

Exercise 4.3. Compute p_{n} and q_{n} for the continued fractions [−3, 1, 1, 1, 1, 3] and [0, 2, 4, 1, 8, 2]. Observe that the propositions below hold.

Proposition 4.4. [a_{0}, …, a_{n}] = \frac{p_{n}}{q_{n}}

Proof. We use induction. We already verified the assertion when n = 0, 1. Suppose the proposition is true for all continued fractions of length n − 1. Then

[a_{0}, …, a_{n}] = [a_{0}, …, a_{n−2}, a_{n−1} + \frac{1}{a_{n}}]

= \frac{(a_{n−1} + \frac{1}{a_{n}} ) p_{n−2} + p_{n−3}}{(a_{n−1} + \frac{1}{a_{n}} ) q_{n−2} + q_{n−3}}

= \frac{(a_{n−1}a_{n} + 1)p_{n−2} + a_{n}p_{n−3}}{(a_{n−1}a_{n} + 1)q_{n−2} + a_{n}q_{n−3}}

= \frac{a_{n}(a_{n−1}p_{n−2} + p_{n−3}) + p_{n−2}}{a_{n}(a_{n−1}q_{n−2} + q_{n−3}) + q_{n−2}}

= \frac{a_{n}p_{n−1} + p_{n−2}}{a_{n}q_{n−1} + q_{n−2}} = \frac{p_{n}}{q_{n}} .

Proposition 4.5. For n ≤ m,

1. the determinant of (\begin{matrix}p_{n} & p_{n−1} \\ q_{n} & q_{n−1} \end{matrix}) is (−1)^{n−1}; equivalently,

\frac{p_{n}}{q_{n}} − \frac{p_{n−1}}{q_{n−1}} = (−1)^{n−1} · \frac{1}{q_{n}q_{n−1}} ;

2. the determinant of (\begin{matrix}p_{n} & p_{n−2} \\ q_{n} & q_{n−2} \end{matrix}) is (−1)^{n}a_{n}; equivalently,

\frac{p_{n}}{q_{n}} − \frac{p_{n−2}}{q_{n−2}} = (−1)^{n} · \frac{a_{n}}{q_{n}q_{n−2}} .

Proof. For the first statement, we proceed by induction. The case n = 0

holds because the determinant of (\begin{matrix}a_{0} & 1 \\ 1 & 0 \end{matrix}) is −1 = (−1)^{−1}. Suppose the

statement is true for n − 1. Then

p_{n}q_{n−1} − q_{n}p_{n−1} = (a_{n}p_{n−1} + p_{n−2})q_{n−1} − (a_{n}q_{n−1} + q_{n−2})p_{n−1}
= p_{n−2}q_{n−1} − q_{n−2}p_{m−1}
= −(p_{n−1}q_{n−2} − p_{n−2}q_{n−1})
= −(−1)^{n−2} = (−1)^{n−1}.

This completes the proof of the first statement. For the second statement,

p_{n}q_{n−2} − p_{n−2}q_{n} = (a_{n}p_{n−1} + p_{n−2})q_{n−2} − p_{n−2}(a_{n}q_{n−1} + q_{n−2})
= a_{n}(p_{n−1}q_{n−2} − p_{n−2}q_{n−1})
= (−1)^{n}a_{n}.

Corollary 4.6. The fraction \frac{p_{n}}{q_{n}} is in lowest terms.

Proof. If p | p_{n} and p | q_{n} then p | (−1)^{n−1}.

How the Convergents Converge

Let [a_{0}, …, a_{m}] be a continued fraction and for n ≤ m let

c_{n} = [a_{0}, …, a_{n}] = \frac{p_{n}}{q_{n}}

denote the nth convergent.

Proposition 4.7. The even convergents c_{2n} increase strictly with n, and the odd convergents c_{2n+1} decrease strictly with n. Moreover, the odd convergents c_{2n+1} are greater than all of the even convergents.

Proof. For n ≥ 1 the a_{n} are positive, so the q_{n} are all positive. By Proposition 4.5, for n ≥ 2,

c_{n} − c_{n−2} = (−1)^{n} · \frac{a_{n}}{q_{n}q_{n−2}} ,

which proves the first claim.

Next, Proposition 4.5 implies that for n ≥ 1,

c_{n} − c_{n−1} = (−1)^{n−1} · \frac{1}{q_{n}q_{n−1}}

has the sign of (−1)^{n−1}, so that c_{2n+1} > c_{2n}. Thus if there exists r, n such that c_{2n+1} < c_{2r}, then r ≠ n. If r < n, then c_{2n+1} < c_{2r} < c_{2n}, a contradiction. If r > n, then c_{2r+1} < c_{2n+1} < c_{2r}, also a contradiction.

4.1.1 Every Rational Number is Represented

Proposition 4.8. Every rational number is represented by a continued fraction.

Proof. Let a/b, where b > 0, be any rational number. Euclid’s algorithm gives:

a = b · a_{0} + r_{1},  0 < r_{1} < b
b = r_{1} · a_{1} + r_{2},  0 < r_{2} < r_{1}
⋯
r_{n−2} = r_{n−1} · a_{n−1} + r_{n},  0 < r_{n} < r_{n−1}
r_{n−1} = r_{n} · a_{n} + 0.

Note that a_{i} > 0 for i > 0. Rewrite the equations as follows:

a/b = a_{0} + r_{1}/b = a_{0} + 1/(b/r_{1}),
b/r_{1} = a_{1} + r_{2}/r_{1} = a_{1} + 1/(r_{1}/r_{2}),
r_{1}/r_{2} = a_{2} + r_{3}/r_{2} = a_{2} + 1/(r_{2}/r_{3}),
⋯
r_{n−1}/r_{n} = a_{n}.

It follows that

\frac{a}{b} = [a_{0}, a_{1}, … a_{n}].

4.2 Infinite Continued Fractions

4.2.1 The Continued Fraction Algorithm

Let x ∈ ℝ and write

x = a_{0} + t_{0}

with a_{0} ∈ ℤ and 0 ≤ t_{0} < 1. If t_{0} ≠ 0, write

\frac{1}{t_{0}} = a_{1} + t_{1}

with a_{1} ∈ ℕ and 0 ≤ t_{1} < 1. Thus t_{0} = \frac{1}{a_{1}+t_{1}} = [0, a_{1} + t_{1}], which is a (nonintegral) continued fraction expansion of t_{0}. Continue in this manner so long as t_{n} ≠ 0 writing

\frac{1}{t_{n}} = a_{n+1} + t_{n+1}

with a_{n+1} ∈ ℕ and 0 ≤ t_{n+1} < 1. This process, which associates to a real number x the sequence of integers a_{0}, a_{1}, a_{2}, …, is called the continued fraction algorithm.

Example 4.9. Let x = \frac{8}{3}. Then x = 2 + \frac{2}{3}, so a_{0} = 2 and t_{0} = \frac{2}{3}. Then \frac{1}{t_{0}} = \frac{3}{2} = 1 + \frac{1}{2}, so a_{1} = 1 and t_{1} = \frac{1}{2}. Then \frac{1}{t_{1}} = 2, so a_{2} = 2, t_{2} = 0, and the sequence terminates. Notice that

\frac{8}{3} = [2, 1, 2],

so the continued fraction algorithm produces the continued fraction of \frac{8}{3}.

Proposition 4.10. For every n such that a_{n} is defined, we have

x = [a_{0}, a_{1}, …, a_{n} + t_{n}],

and if t_{n} ≠ 0 then x = [a_{0}, a_{1}, …, a_{n}, \frac{1}{t_{n}}].

Proof. Use induction. The statements are both true when n = 0. If the second statement is true for n − 1, then

x = [a_{0}, a_{1}, …, a_{n−1}, \frac{1}{t_{n−1}} ] = [a_{0}, a_{1}, …, a_{n−1}, a_{n}+t_{n}] = [a_{0}, a_{1}, …, a_{n−1}, a_{n}, \frac{1}{t_{n}}].

Similarly, the first statement is true for n if it is true for n − 1.

Example 4.11. Let x = \frac{1+\sqrt{5}}{2}. Then

x = 1 + \frac{−1 + \sqrt{5}}{2},

so a_{0} = 1 and t_{0} = \frac{−1+\sqrt{5}}{2}. We have

\frac{1}{t_{0}} = \frac{2}{−1 + \sqrt{5}} = \frac{−2 − 2\sqrt{5}}{−4} = \frac{1 + \sqrt{5}}{2}

so again a_{1} = 1 and t_{1} = \frac{−1+\sqrt{5}}{2}. Likewise, a_{n} = 1 for all n. Does the following crazy-looking equality makes sense??

\frac{1 + \sqrt{5}}{2} = 1 + \frac{1}{1 + _{\frac{1}{1+_{\frac{1}{1+ \frac{1}{1+ \frac{1}{1+···}}}}}}}

Example 4.12. Next suppose x = e. Then

a_{0}, a_{1}, a_{2}, … = 2, 1, 2, 1, 1, 4, 1, 1, 6, 1, 1, 8, 1, 1, …

? contfrac(exp(1))
%1 = [2, 1, 2, 1, 1, 4, 1, 1, 6, 1, 1, 8, 1, 1, 10, 1, 1,
       12, 1, 1, 14, 1, 1, 16, 1, 1, 18, 1, 1, 20, 2]
? \\ to get more terms, increase the real precision:

? \p60
? contfrac(exp(1),[])
%12 = [2, 1, 2, 1, 1, 4, 1, 1, 6, 1, 1, 8, 1, 1, 10, 1, 1,
   12, 1, 1, 14, 1, 1, 16, 1, 1, 18, 1, 1, 20, 1, 1, 22, 1,
   1, 24, 1, 1, 26, 1, 1, 28, 1, 1, 30, 1, 1, 32, 1, 1, 34,
   1, 1, 36, 1, 1, 38, 1, 1, 40, 1, 1, 42, 2]

The following program uses a proposition we proved yesterday to compute the partial convergents of a continued fraction:

{convergents(v)=
    local(pp,qq,p,q,tp,tq,answer);
    pp=1; qq=0; p=v[1]; q=1;    \\ pp is p_{n-1} and p is p_n.
    answer = vector(length(v)); \\ put answer in this vector
    answer[1] = p/q;
    for(n=2,length(v),
       tp=p; tq=q; p=v[n]*p+pp; q=v[n]*q+qq; pp=tp; qq=tq;
       answer[n] = p/q;
    );
    return(answer);
}

Let’s try this with π:

? contfrac(Pi)
%26 = [3, 7, 15, 1, 292, 1, 1, ...]
? convergents([3,7,15])
%27 = [3, 22/7, 333/106]
? convergents([3,7,15,1,292])
%28 = [3, 22/7, 333/106, 355/113, 103993/33102]
? %[5]*1.0
%29 = 3.1415926530119026040...
? % - Pi
%30 = -0.000000000577890634...

4.2.2 Infinite Continued Fractions

Theorem 4.13. Let a_{0}, a_{1}, a_{2}, … be a sequence of integers such that a_{n} > 0 for all n ≥ 1, and for each n ≥ 0, set c_{n} = [a_{0}, a_{1}, … a_{n}]. Then lim_{n→∞} c_{n} exists.

Proof. For any m ≥ n, the number c_{n} is a partial convergent of [a_{0}, …, a_{m}]. Recall from the previous lecture that the even convergents c_{2n} form a strictly increasing sequence and the odd convergents c_{2n+1} form a strictly decreasing sequence. Moreover, the even convergents are all ≤ c_{1} and the odd convergents are all ≥ c_{0}. Hence α_{0} = lim_{n→∞} c_{2n} and α_{1} = lim_{n→∞} c_{2n+1} both exist and α_{0} ≤ α_{1}. Finally, by a proposition from last time

|c_{2n} − c_{2n−1}| = \frac{1}{q_{2n} · q_{2n−1}} ≤ \frac{1}{2n(2n − 1)} → 0,

so α_{0} = α_{1}.

We define

[a_{0}, a_{1}, …] = lim_{n→∞} c_{n}.

Example 4.14. We use PARI to illustrate the convergence of the theorem for x = π.

? a = contfrac(Pi)
%38 = [3, 7, 15, 1, 292, 1, 1, 1, 2, 1, 3, 1, 14, 2, 1, 1, 2, 2, ...]
? c = convergents(a)
%39 = [3, 22/7, 333/106, 355/113, 103993/33102, 104348/33215, ...]
? \p9                      \\ so we can see.
   realprecision = 9 significant digits
? [c[1]*1.0, c[3]*1.0, c[5]*1.0, c[7]*1.0]  \\ odd ones converge up to pi
%43 = [3.00000000, 3.14150943, 3.14159265, 3.14159265]
? [c[2]*1.0,c[4]*1.0,c[6]*1.0,c[8]*1.0]     \\ even ones swoop down on pi.
%44 = [3.14285714, 3.14159291, 3.14159265, 3.14159265]

Theorem 4.15. Let x ∈ ℝ be a real number. Then

x = [a_{0}, a_{1}, a_{2}, …],

where a_{0}, a_{1}, a_{2}, … is the sequence produced by the continued fraction algorithm.

Proof. If the sequence is finite then some t_{n} = 0 and the result follows by Proposition 4.10. Suppose the sequence is infinite. By Proposition 4.10,

x = [a_{0}, a_{1}, …, a_{n}, \frac{1}{t_{n}}].

By a proposition from the last lecture^{3},

x = \frac{\frac{1}{t_{n}} p_{n} + p_{n−1}}{\frac{1}{t_{n}} q_{n} + q_{n−1}} .

3Which we apply in a case when the partial quotients of the continued fraction are not integers!

Thus if c_{n} = [a_{0}, a_{1}, …, a_{n}], then

x − c_{n} = x − \frac{p_{n}}{q_{n}}

= \frac{\frac{1}{t_{n}} p_{n}q_{n} + p_{n−1}q_{n} − \frac{1}{t_{n}} p_{n}q_{n} − p_{n}q_{n−1}}{q_{n} (\frac{1}{t_{n}} q_{n} + q_{n−1})} .

= \frac{p_{n−1}q_{n} − p_{n}q_{n−1}}{q_{n} (\frac{1}{t_{n}} q_{n} + q_{n−1})}

= \frac{(−1)^{n}}{q_{n} (\frac{1}{t_{n}} q_{n} + q_{n−1})}.

Thus

|x − c_{n}| = \frac{1}{q_{n} (\frac{1}{t_{n}} q_{n} + q_{n−1})}

< \frac{1}{q_{n}(a_{n+1}q_{n} + q_{n−1})}

= \frac{1}{q_{n} · q_{n+1}} ≤ \frac{1}{n(n + 1)} → 0.

(In the inequality we use that a_{n+1} is the integer part of \frac{1}{t_{n}}, and is hence ≤ \frac{1}{t_{n}}.)

Proposition 4.16. If x is a rational number then the sequence a_{0}, a_{1}, a_{2}, … terminates (at n say) and

x = [a_{0}, a_{1}, a_{2}, …, a_{n}].

Proof. Let [b_{0}, b_{1}, …, b_{m}] be the continued fraction representation of x that we obtain using the Euclidean algorithm. Then

x = b_{0} + 1/[b_{1}, …, b_{m}].

If [b_{1}, …, b_{m}] = 1 then m = 1 and b_{1} = 1, which would never happen using the Euclidean algorithm since x is expressed in lowest terms. Thus [b_{1}, …, b_{m}] > 1, so in the continued fraction algorithm we choose a_{0} = b_{0} and t_{0} = 1/[b_{1}, …, b_{m}]. Repeating this argument enough times proves the claim.

4.3 Quadratic Irrationals

In this lecture we prove that the continued fraction expansion of a number is periodic if and only if the number is a quadratic irrational.

4.3.1 Quadratic Irrationals

Definition 4.17. An element α ∈ ℝ is a quadratic irrational if it is irrational and satisfies a quadratic polynomial.

Thus, e.g., (1 + \sqrt{5})/2 is a quadratic irrational. Recall that

\frac{1 + \sqrt{5}}{2} = [1, 1, 1, …].

The continued fraction of \sqrt{2} is [1, 2, 2, 2, 2, 2, …], and the continued fraction of \sqrt{389} is

[19, 1, 2, 1, 1, 1, 1, 2, 1, 38, 1, 2, 1, 1, 1, 1, 2, 1, 38, …].

Does the [1, 2, 1, 1, 1, 1, 2, 1, 38] pattern repeat over and over again??

4.3.2 Periodic Continued Fractions

Definition 4.18. A periodic continued fraction is a continued fraction [a_{0}, a_{1}, …, a_{n}, …] such that

a_{n} = a_{n+h}

for a fixed positive integer h and all sufficiently large n. We call h the period of the continued fraction.

Example 4.19. Consider the periodic continued fraction [1, 2, 1, 2, …] = [\overline{1, 2}]. What does it converge to?

[\overline{1, 2}] = 1 + \frac{1}{2 + _{\frac{1}{1+_{\frac{1}{2+ \frac{1}{1+···}}}}}} ,

so if α = [\overline{1, 2}] then

α = 1 + \frac{1}{2 + α}.

Thus 2α + α^{2} = 2 + α + 1, so

α^{2} + α − 3 = 0 and α = \frac{−1 + \sqrt{7}}{2}.

Theorem 4.20. An infinite integral continued fraction is periodic if and only if it represents a quadratic irrational.

Proof. (⟹) First suppose that

[a_{0}, a_{1}, …, a_{n}, \overline{a_{n+1}, …, a_{n+h}}]

is a periodic continued fraction. Set α = [a_{n+1}, a_{n+2}, …]. Then

α = [a_{n+1}, …, a_{n+h}, α],

so

α = \frac{αp_{n+h} + p_{n+h−1}}{αq_{n+h} + q_{n+h−1}} .

(We use that α is the last partial convergent.) Thus α satisfies a quadratic equation. Since the a_{i} are all integers, the number

[a_{0}, a_{1}, …] = [a_{0}, a_{1}, …, a_{n}, α]

= a_{0} + \frac{1}{a_{1} + \frac{1}{a_{2}+···+α}}

can be expressed as a polynomial in α with rational coefficients, so [a_{0}, a_{1}, …] also satisfies a quadratic polynomial. Finally, α ∉ ℚ because periodic continued fractions have infinitely many terms.

(⟸) This direction was first proved by Lagrange. The proof is much more exciting! Suppose α ∈ ℝ satisfies a quadratic equation

aα^{2} + bα + c = 0

with a, b, c ∈ ℤ. Let [a_{0}, a_{1}, …] be the expansion of α. For each n, let

r_{n} = [a_{n}, a_{n+1}, …],

so that

α = [a_{0}, a_{1}, …, a_{n−1}, r_{n}].

We have

α = \frac{r_{n}p_{n} + p_{n−1}}{r_{n}q_{n} + q_{n−1}} .

Substituting this expression for α into the quadratic equation for α, we see that

A_{n}r_{n}^{2} + B_{n}r_{n} + C_{n} = 0,

where

A_{n} = ap_{n−1}^{2} + bp_{n−1}q_{n−1} + cq_{n−1}^{2},
B_{n} = 2ap_{n−1}p_{n−2} + b(p_{n−1}q_{n−2} + p_{n−2}q_{n−1}) + 2cq_{n−1}q_{n−2},
C_{n} = ap_{n−2}^{2} + bp_{n−2}q_{n−2} + cp_{n−2}^{2}.

Note that A_{n}, B_{n}, C_{n} ∈ ℤ, that C_{n} = A_{n−1}, and that

B^{2} − 4A_{n}C_{n} = (b^{2} − 4ac)(p_{n−1}q_{n−2} − q_{n−1}p_{n−2})^{2} = b^{2} − 4ac.

Recall from the proof of Theorem 2.3 of the previous lecture that

|α − \frac{p_{n−1}}{q_{n−1}} | < \frac{1}{q_{n}q_{n−1}} .

Thus

|αq_{n−1} − p_{n−1}| < \frac{1}{q_{n}} < \frac{1}{q_{n+1}} ,

so

p_{n−1} = αq_{n−1} + \frac{δ}{q_{n−1}} with |δ| < 1.

Hence

A_{n} = a (αq_{n−1} + \frac{δ}{q_{n−1}} )^{2} + b (αq_{n−1} + \frac{δ}{q_{n−1}} ) q_{n−1} + cq_{n−1}^{2}

= (aα^{2} + bα + c)q_{n−1}^{2} + 2aαδ + a\frac{δ^{2}}{q_{n−1}^{2}} + bδ

= 2aαδ + a\frac{δ^{2}}{q_{n−1}^{2}} + bδ.

Thus

|A_{n}| = |2aαδ + a\frac{δ^{2}}{q_{n−1}^{2}} + bδ| < 2|aα| + |a| + |b|.

Thus there are only finitely many possibilities for the integer A_{n}. Also,

|C_{n}| = |A_{n−1}| and |B_{n}| = \sqrt{b^{2} − 4(ac − A_{n}C_{n})},

so there are only finitely many triples (A_{n}, B_{n}, C_{n}), and hence only finitely many possibilities for r_{n} as n varies. Thus for some h > 0,

r_{n} = r_{n+h}.

This shows that the continued fraction for α is periodic.

4.3.3 What About Higher Degree?

Definition 4.21. An algebraic number is a root of a polynomial f ∈ ℚ[x].

Open Problem: ^{4} What is the continued fraction expansion of the algebraic number \sqrt[3]{2}?

? contfrac(2^(1/3))
%5 = [1, 3, 1, 5, 1, 1, 4, 1, 1, 8, 1, 14, 1, 10, 2, 1, 4, 12, 2, 3,
 2, 1, 3, 4, 1, 1, 2, 14, 3, 12, 1, 15, 3, 1, 4, 534, 1, 1, 5, 1, 1,

4As far as I know this is still an open problem.

 121, 1, 2, 2, 4, 10, 3, 2, 2, 41, 1, 1, 1, 3, 7, 2, 2, 9, 4, 1, 3, 7,
 6, 1, 1, 2, 2, 9, 3, 1, 1, 69, 4, 4, 5, 12, 1, 1, 5, 15, 1, 4, 1, 1,
 1, 1, 1, 89, 1, 22, 186, 5, 2, 4, 3, 3, 1, \ldots]

I sure don’t see a pattern, and that 534 strips me of any confidence that I ever will. One could at least try to analyze the first few terms of the continued fraction statistically (see Lang and Trotter, 1972).

Khintchine (1963), page 59:

No properties of the representing continued fractions, analogous to those which have just been proved, are known for algebraic numbers of higher degree. [...] It is of interest to point out that up till the present time no continued fraction development of an algebraic number of higher degree than the second is known. It is not even known if such a development has bounded elements. Generally speaking the problems associated with the continued fraction expansion of algebraic numbers of degree higher than the second are extremely difficult and virtually unstudied.

Richard Guy Unsolved Problems in Number Theory (1994), page 260:

Is there an algebraic number of degree greater than two whose simple continued fraction has unbounded partial quotients? Does every such number have unbounded partial quotients?

4.4 Applications

In this lecture we will learn about two applications of continued fractions. The first is a solution to the computational problem of recognizing a rational number using a computer. The second application is to the following ancient question: Given a positive nonsquare integer d, find integers x and y such that x^{2} − dy^{2} = 1.

4.4.1 Recognizing Rational Numbers

Suppose that you can compute approximations to a rational number using a computer, and desparately want to know what the rational number is. As Henri Cohen explains in his book A Course in Computational Algebraic Number Theory, continued fraction are very helpful.

Consider the following apparently simple problem. Let x ∈ ℝ be given by an approximation (for example a decimal or binary one). Decide if x is a rational number or not. Of course, this question as posed does not really make sense, since an approximation is usually itself a rational number. In practice however the question does make a lot of sense in many different contexts, and we can make it algorithmically more precise. For example, assume that one has an algorithm which allows us to compute x to as many decimal places as one likes (this is usually the case). Then, if one claims that x is (approximately) equal to a rational number p/q, this means that p/q should still be extremely close to x whatever the number of decimals asked for, p and q being fixed. This is still not completely rigorous, but it comes quite close to actual practice, so we will be content with this notion. Now how does one find p and q if x is indeed a rational number? The standard (and algorithmically excellent) answer is to compute the continued fraction expansion [a_{0}, a_{1}, …] of x. The number x is rational if and only if its continued fraction expansion is finite, i.e., if and only if one of the a_{i} is infinite. Since x is only given with the finite precision, x we be considered rational if x has a very large partial quotient a_{i} in its continued fraction expansion.

The following example illustrates Cohen’s remarks: Example 4.22. ? x

%13 = 9495/3847
? x*1.0
%14 = 2.4681570054587990642058747075643358461138549519105
? contfrac(x)
%15 = [2, 2, 7, 2, 1, 5, 1, 1, 1, 1, 2]
? contfrac(2.468157005458799064)
%16 = [2, 2, 7, 2, 1, 5, 1, 1, 1, 1, 1, 1, 328210621945, 2, 1, 1, 1, 1, 7]
? contfracpnqn([2, 2, 7, 2, 1, 5, 1, 1, 1, 1, 1, 1])
%17 =
[9495 5852]
[3847 2371]
? contfrac(2.4681570054587990642058747075643)
%18 = [2, 2, 7, 2, 1, 5, 1, 1, 1, 1, 1, 1, 1885009518355562936415046, 1, 4]
? \p300
? x*1.0  \\ notice that no repeat is immediately evident in the digits of x
%19 = 2.468157005458799064205874707564335846113854951910579672472056147647517..
? \\ in fact, the length of the period of the decimal expansion
\\ of 1/3847 is 3846 (the order of 10 modulo 3847)!!

4.4.2 Pell’s Equation

In February of 1657, Pierre Fermat issued the following challenge:

Given a positive integer d, find a positive integer y such that dy^{2} + 1 is a perfect square.

In other words, find a solution to x^{2} − dy^{2} = 1 with y ∈ ℕ.

Note Fermat’s emphasis on integer solutions. It is easy to find rational solutions to the equation x^{2} − dy^{2} = 1. Simply divide the relation

(r^{2} + d)^{2} − d(2r)^{2} = (r^{2} − d)^{2}

by (r^{2} − d)^{2} to arrive at

x = \frac{r^{2} + d}{r^{2} − d}, y = \frac{2r}{r^{2} − d}.

Fermat said: “Solutions in fractions, which can be given at once from the merest elements of arithmetic, do not satisfy me.”

The equation x^{2} − dy^{2} = 1 is called Pell’s equation. This is because Euler (in about 1759) accidently called it “Pell’s equation” and the name stuck, though Pell (1611–1685) had nothing to do with it.

If d is a perfect square, d = n^{2}, then

(x + ny)(x − ny) = x^{2} − dy^{2} = 1

which implies that x + ny = x − ny = 1, so

x = \frac{x + ny + x − ny}{2} = \frac{1 + 1}{2} = 1.

We will thus always assume that d is not a perfect square. You can read about Pell’s equation in Section 0.6 of Kato-Kurokawa-Saito and on pages 107–111 of Davenport. Pell’s equation is best understood in terms of units in real quadratic fields.

4.4.3 Units in Real Quadratic Fields

Let d be a nonsquare positive integer, and set

ℚ(\sqrt{d}) = \{a + b\sqrt{d} : a, b ∈ ℚ\}
ℤ[\sqrt{d}] = \{a + b\sqrt{d} : a, b ∈ ℤ\}.

Then ℚ(\sqrt{d}) is a real quadratic field and ℤ[\sqrt{d}] is a ring. There is a homomorphism called norm:

N : ℚ(\sqrt{d})^{∗} → ℚ^{∗}, N (a + b\sqrt{d}) = (a + b\sqrt{d}) (a − b\sqrt{d}) = a^{2} − b^{2}d.

Definition 4.23. An element x ∈ R is a unit if there exists y ∈ R such that xy = 1.

Proposition 4.24. The units of ℤ[\sqrt{d}] are exactly the elements of norm ±1 in ℤ[\sqrt{d}].

Proof. Suppose u ∈ ℤ[\sqrt{d}] is a unit. Then

1 = N(1) = N(uu^{−1}) = N(u) · N(u^{−1}).

Since N(u), N(u^{−1}) ∈ ℤ, we have N(u) = N(u^{−1}) = ±1

Thus Fermat’s challenge amounts to determing the group U^{+} of units in ℤ[\sqrt{d}] of the form a + b\sqrt{d} with a, b ≥ 0.

Theorem 4.25. The group U^{+} is an infinite cyclic group. It is generated by p_{m} + q_{m}\sqrt{d}, where \frac{p_{m}}{q_{m}} is one of the partial convergents of the continued fraction expansion of \sqrt{d}. (In fact, if m is the period of the continued fraction of \sqrt{d} then n = m − 1 when m is even and 2n − 1 when m is odd.)

The theorem implies that Pell’s equation always has a solution! Warning: the smallest solution is typically shockingly large. For example, the value of x in the smallest solution to x^{2} − 1000099y^{2} = 1 has 1118 digits.

The following example illustrates how to use Theorem 4.25 to solve Pell’s equation when d = 61, where the simplest solution is already quite large. Example 4.26. Suppose d = 61. Then

\sqrt{d} = [7, \overline{1, 4, 3, 1, 2, 2, 1, 3, 4, 1, 14}],

which has odd period n = 11. Thus the group U^{+} is generated by

x = p_{21} = 1766319049
y = q_{21} = 226153980.

That is, we have

U^{+} = ⟨u⟩ = ⟨1766319049 + 226153980\sqrt{61}⟩,

and x = 1766319049, y = 226153980 gives a solution to x^{2} − dy^{2} = 1. All the other solutions arise from u^{n} for some n. For example,

u^{2} = 6239765965720528801 + 798920165762330040\sqrt{61}

leads to another solution. Remark 4.27. To help with your homework, note that if the equation

x^{2} − dy^{2} = n

has at least one (nonzero) solution (x_{0}, y_{0}) ∈ ℤ × ℤ, then it must have infinitely many solutions. This is because if x_{0}^{2}−dy_{0}^{2} = n and u is a generator of the cyclic group U^{+}, then for any integer i,

N(u^{i}(x_{0} + y_{0}\sqrt{d})) = N(u^{i}) · N(x_{0} + y_{0}\sqrt{d}) = 1 · n = n,

so

x_{1} + y_{1}\sqrt{d} = u^{i}(x_{0} + y_{0}\sqrt{d})

provides another solution to x^{2} + dy^{2} = n.

4.4.4 Some Proofs

The rest of this lecture is devoted to proving most of Theorem 4.25. We will prove that partial convergents to continued fractions contribute infinitely many solutions to Pell’s equation. We will not prove that every solution to Pell’s equation is a partial convergent, though this is true.^{5}

Fix a positive nonsquare integer d.

Definition 4.28. A quadratic irrational α = a + b\sqrt{d} is reduced if α > 1 and if the conjugate of α, denoted by α′, satisfies −1 < α′ < 0.

For example, the number α = 1 + \sqrt{2} is reduced.

Definition 4.29. A continued fraction is purely periodic if it is of the form [\overline{a_{0}, a_{1}, …, a_{n}}].

The continued fraction [\overline{2}] of 1 + \sqrt{2} is purely periodic.

Lemma 4.30. If α is a reduced quadratic irrational, then the continued fraction expansion of α is purely periodic. (The converse is also true, and is easy to prove.)

Proof. The proof can be found on pages 102–103 of Davenport’s book.

Lemma 4.31. The continued fraction expansion of \sqrt{d} is of the form

[a_{0}, \overline{a_{1}, …, a_{n−1}, 2a_{0}}].

Proof. Let a_{0} be the floor of \sqrt{d}. Then α = \sqrt{d} + a_{0} is reduced because α > 1 and α′ = −\sqrt{d} + a_{0} satisfies −1 < α′ < 0. Let [a_{0}, a_{1}, a_{2}, …] be the continued fraction expansion of \sqrt{d}. Then the continued fraction expansion of \sqrt{d} + a_{0} is [2a_{0}, a_{1}, a_{2}, …]. By Lemma 4.30, the continued fraction expansion of \sqrt{d} + a_{0} is purely periodic, so

[2a_{0}, a_{1}, a_{2}, …] = [\overline{2a_{0}, a_{1}, a_{2}, …, a_{n−1}}],

where n is the period. It follows that a_{n} = 2a_{0}, as claimed.

The following proposition shows that there are infinitely many solutions to Pell’s equation that arise from continued fractions.

5There is a complete proof in Section 13.5 of Burton’s Elementary Number Theory. It just involves more of the same sort of computations that we’ve been doing with continued fractions.

Proposition 4.32. Let p_{k}/q_{k} be the partial convergents of the continued fraction expansion of \sqrt{d}, and let n be the period of the expansion of \sqrt{d}. Then

p_{kn−1}^{2} − dq_{kn−1}^{2} = (−1)^{kn}

for k = 1, 2, 3, . . ..

Proof. ^{6} By Lemma 4.31, for k ≥ 1, the continued fraction of \sqrt{d} can be written in the form

\sqrt{d} = [a_{0}, a_{1}, a_{2}, …, a_{kn−1}, r_{kn}]

where

r_{kn} = [2a_{0}, \overline{a_{1}, a_{2}, …, a_{n}}] = a_{0} + \sqrt{d}.

Because \sqrt{d} is the last partial convergent of the continued fraction above, we have

\sqrt{d} = \frac{r_{kn}p_{kn−1} + p_{kn−2}}{r_{kn}q_{kn−1} + q_{kn−2}} .

Upon substituting r_{kn} = a_{0} + \sqrt{d} and simplifying, this reduces to

\sqrt{d}(a_{0}a_{kn−1} + q_{kn−2} − p_{kn−1}) = a_{0}p_{kn−1} + p_{kn−2} − dq_{kn−1}.

Because the right-hand side is rational and \sqrt{d} is irrational,

a_{0}a_{kn−1} + q_{kn−2} = p_{kn−1}, and a_{0}p_{kn−1} + p_{kn−2} = dq_{kn−1}.

Multiplying the first of these equations by p_{kn−1} and the second by −q_{kn−1}, and then adding them, gives

p_{kn−1}^{2} − dq_{kn−1}^{2} = p_{kn−1}q_{kn−2} − q_{kn−1}p_{kn−2}.

But

p_{kn−1}q_{kn−2} − q_{kn−1}p_{kn−2} = (−1)^{kn−2} = (−1)^{kn},

which proves the proposition.

Exercises

4.1 If c_{n} = p_{n}/q_{n} is the nth convergent of the continued fraction [a_{0}, a_{1}, …, a_{n}] and a_{0} > 0, show that

[a_{n}, a_{n−1}, …, a_{1}, a_{0}] = \frac{p_{n}}{p_{n−1}}

and

[a_{n}, a_{n−1}, …, a_{2}, a_{1}] = \frac{q_{n}}{q_{n−1}} .

(Hint: In the first case, notice that \frac{p_{n}}{p_{n−1}} = a_{n} + \frac{p_{n−2}}{p_{n−1}} = a_{n} + _{\frac{1}{\frac{p_{n−1}}{p_{n−2}}}} .)

6This proof is from Section 13.5 of Burton’s Elementary Number Theory.

4.2 There is a function j(τ), denoted by ellj in PARI, which takes as input a complex number τ with positive imaginary part, and returns a complex number called the “j-invariant of the associated elliptic curve”. Suppose that τ is approximately −0.5 + 0.3281996289i and that you know that j = j(τ) is a rational number. Use continued fractions and PARI to compute a reasonable guess for the rational number j = ellj(τ). (Hint: In PARI \sqrt{−1} is represented by I.)

4.3 Evaluate each of the following infinite continued fractions:

(a) [\overline{2, 3}]

(b) [2, \overline{1, 2, 1}]

(c) [0, \overline{1, 2, 3}]

4.4 Determine the infinite continued fraction of each of the following numbers:

(a) \sqrt{5}
(b) \frac{1 + \sqrt{13}}{2}
(c) \frac{5 + \sqrt{37}}{4}

4.5 (a) For any positive integer n, prove that \sqrt{n^{2} + 1} = [n, \overline{2n}].

(b) Find a convergent to \sqrt{5} that approximates \sqrt{5} to within four decimal places.

4.6 A famous theorem of Hurwitz (1891) says that for any irrational number x, there exists infinitely many rational numbers a/b such that

|x − \frac{a}{b}| < \frac{1}{\sqrt{5}b^{2}} .

Taking x = π, obtain three rational numbers that satisfy this inequality.

4.7 The continued fraction expansion of e is

[2, 1, 2, 1, 1, 4, 1, 1, 6, 1, 1, 8, 1, 1, …].

It is a theorem that the obvious pattern continues indefinitely. Do you think that the continued fraction expansion of e^{2} also exhibits a nice pattern? If so, what do you think it is?

4.8 (a) Show that there are infinitely many even integers n with the property that both n + 1 and \frac{n}{2} + 1 are perfect squares.

(b) Exhibit two such integers that are greater than 389.

4.9 A primitive Pythagorean triple is a triple x, y, z of integers such that x^{2} + y^{2} = z^{2}. Prove that there exists infinitely many primitive Pythagorean triples x, y, z in which x and y are consecutive integers.

5

Binary Quadratic Forms

5.1 Sums of Two Squares

In this section we consider the question of which integers are the sum of two squares.

During the next four lectures, we will study binary quadratic forms. A simple example of a binary quadratic form that will occupy us today is

x^{2} + y^{2}.

A typical question that one asks about a quadratic form is which integers does it represent. “Are there integers x and y so that x^{2} + y^{2} = 389? So that x^{2} + y^{2} = 2001?”

5.1.1 Which Numbers are the Sum of Two Squares?

The main goal of today’s lecture is to prove the following theorem.

Theorem 5.1. A number n is a sum of two squares if and only if all prime factors of n of the form 4m + 3 have even exponent in the prime factorization of n.

Before tackling a proof, we consider a few examples. Example 5.2.

• 5 = 1^{2} + 2^{2}.

• 7 is not a sum of two squares.

• 2001 is divisible by 3 because 2 + 1 is, but not by 9 since 2 + 1 is not, so 2001 is not a sum of two squares.

• 2 · 3^{4} · 5 · 7^{2} · 13 is a sum of two squares.

• 389 is a sum of two squares, since 389 ≡ 1 (mod 4) and 389 is prime.

• 21 = 3 · 7 is not a sum of two squares even though 21 ≡ 1 (mod 4).

In preparation for the proof of Theorem 5.1, we recall a result that emerged when we analyzed how partial convergents of a continued fraction converge.

Lemma 5.3. If x ∈ ℝ and n ∈ ℕ, then there is a fraction \frac{a}{b} in lowest terms such that 0 < b ≤ n and

|x − \frac{a}{b}| ≤ \frac{1}{b(n + 1)}.

Proof. Let [a_{0}, a_{1}, …] be the continued fraction expansion of x. As we saw in the proof of Theorem 2.3 in Lecture 18, for each m

|x − \frac{p_{m}}{q_{m}} | < \frac{1}{q_{m} · q_{m+1}} .

Since q_{m+1} is always at least 1 bigger than q_{m} and q_{0} = 1, either there exists an m such that q_{m} ≤ n < q_{m+1}, or the continued fraction expansion of x is finite and n is larger than the denominator of the rational number x. In the first case,

|x − \frac{p_{m}}{q_{m}} | < \frac{1}{q_{m} · q_{m+1}} ≤ \frac{1}{q_{m} · (n + 1)},

so \frac{a}{b} = \frac{p_{m}}{q_{m}} satisfies the conclusion of the lemma. In the second case, just

let \frac{a}{b} = x.

Definition 5.4. A representation n = x^{2} + y^{2} is primitive if gcd(x, y) = 1.

Lemma 5.5. If n is divisible by a prime p of the form 4m + 3, then n has no primitive representations.

Proof. If n has a primitive representation, n = x^{2} + y^{2}, then

p | x^{2} + y^{2} and gcd(x, y) = 1,

so p ∤ x and p ∤ y. Thus x^{2} + y^{2} ≡ 0 (mod p) so, since ℤ/pℤ is a field we can divide by y^{2} and see that

(x/y)^{2} ≡ −1 (mod p).

Thus the quadratic residue symbol (\frac{−1}{p}) equals +1. However,

(\frac{−1}{p}) = (−1)^{\frac{p−1}{2}} = (−1)^{\frac{4m+3−1}{2}} = (−1)^{2m+1} = −1.

Proof of Theorem 5.1. (⟹) Suppose that p is of the form 4m + 3, that p^{r} || n (exactly divides) with r odd, and that n = x^{2} + y^{2}. Letting d = gcd(x, y), we have

x = dx′, y = dy′, n = d^{2}n′

with gcd(x′, y′) = 1 and

(x′)^{2} + (y′)^{2} = n′.

Because r is odd, p | n′, so Lemma 5.5 implies that gcd(x′, y′) > 1, a contradiction. (⟸) Write n = n_{1}^{2}n_{2} where n_{2} has no prime factors of the form 4m + 3. It suffices to show that n_{2} is a sum of two squares. Also note that

(x_{1}^{2} + y_{1}^{2})(x_{2}^{2} + y_{2}^{2}) = (x_{1}x_{2} + y_{1}y_{2})^{2} + (x_{1}y_{2} − x_{2}y_{1})^{2},

so a product of two numbers that are sums of two squares is also a sum of two squares.^{1} Also, the prime 2 is a sum of two squares. It thus suffices to show that if p is a prime of the form 4m+1, then p is a sum of two squares.

Since

(−1)^{\frac{p−1}{2}} = (−1)^{\frac{4m+1−1}{2}} = +1,

−1 is a square modulo p; i.e., there exists r such that r^{2} ≡ −1 (mod p). Taking n = ⌊\sqrt{p}⌋ in Lemma 5.3 we see that there are integers a, b such that 0 < b < \sqrt{p} and

|−\frac{r}{p} − \frac{a}{b}| ≤ \frac{1}{b(n + 1)} < \frac{1}{b\sqrt{p}}.

If we write

c = rb + pa

then

|c| < \frac{pb}{b\sqrt{p}} = \frac{p}{\sqrt{p}} = \sqrt{p}

and

0 < b^{2} + c^{2} < 2p.

But c ≡ rb (mod p), so

b^{2} + c^{2} ≡ b^{2} + r^{2}b^{2} ≡ b^{2}(1 + r^{2}) ≡ 0 (mod p).

Thus b^{2} + c^{2} = p.

1This algebraic identity is secretely the assertion that the norm map N : ℚ(i)^{∗} → ℚ^{∗} sending x + iy to (x + iy)(x − iy) = x^{2} + y^{2} is a homomorphism.

5.1.2 Computing x and y

Suppose p is a prime of the form 4m + 1. There is a construction of Legendre of x and y that is explained on pages 120–121 of Davenport. I’m unconvinced that it is any more efficient than the following naive algorithm: compute \sqrt{p − x^{2}} for x = 1, 2, … until it’s an integer. This takes at most \sqrt{p} steps. Here’s a simple PARI program which implements this algorithm.

{sumoftwosquares(n) =
   local(y);
   for(x=1,floor(sqrt(n)),
      y=sqrt(n-x^2);
      if(y-floor(y)==0, return([x,floor(y)]))
   );
   error(n," is not a sum of two squares.")
}

5.1.3 Sums of More Squares

Every natural number is a sum of four squares. See pages 124–126 of Davenport for a proof.

A natural number is a sum of three squares if and only if it is not a power of 4 times a number that is congruent to 7 modulo 8. For example, 7 is not a sum of three squares. This is more difficult to prove.

5.2 Binary Quadratic Forms

5.2.1 Introduction

A binary quadratic form is a homogeneous polynomial

ax^{2} + bxy + cy^{2} ∈ ℤ[x, y].

(There is a theory of quadratic forms in n-variables, but we will not study it in this course.) Chapter VI of Davenport’s book is clear and well written. Read it.

The Classic Problem: Given a binary quadratic form f(x, y) = ax^{2} + bxy + cy^{2}, what is the set of integers {f(x, y) : x, y ∈ ℤ}?

That is, for which integers n are there integers x and y such that

ax^{2} + bxy + cy^{2} = n?

We gave a clean answer to this question in the last lecture in the case when f(x, y) = x^{2} + y^{2}. The set of sums of two squares is the set of integers n such that any prime divisor p of n of the form 4m + 3 exactly divides n to an even power (along with 0). In your homework (Problem 5), you will give a simple answer to the question of which numbers are of the form x^{2} + 2y^{2}. Is there a simple answer in general?

5.2.2 Equivalence

Definition 5.6. The modular group SL_{2}(ℤ) is the group of all 2×2 integer matrices with determinant +1.

If g = ( \begin{matrix}p & q \\ r & s \end{matrix}) ∈ SL_{2}(ℤ) and f(x, y) = ax^{2} + bxy + cy^{2} is a quadratic form, let

f|_{g}(x, y) = f(px + qy, rx + sy) = f ((\begin{matrix}p & q \\ r & s \end{matrix}) (\begin{matrix}x \\ y \end{matrix})) ,

where for simplicity we will sometimes write f ((\begin{matrix}x \\ y \end{matrix})) for f(x, y).

Proposition 5.7. The above formula defines a right action of the group SL_{2}(ℤ) on the set of binary quadratic forms, in the sense that

f|_{gh} = (f|_{g})|_{h}.

Proof.

f|_{gh}(x, y) = f (gh (\begin{matrix}x \\ y \end{matrix})) = f|_{g} (h ((\begin{matrix}x \\ y \end{matrix}))) = (f|_{g})|_{h}(x, y).

Proposition 5.8. Let g ∈ SL_{2}(ℤ) and let f(x, y) be a binary quadratic form. The set of integers represented by f(x, y) is exactly the same as the set of integers represented by f|_{g}(x, y).

Proof. If f(x_{0}, y_{0}) = n then since g^{−1} ∈ SL_{2}(ℤ), we have g^{−1} (\begin{matrix}x_{0} \\ y_{0} \end{matrix}) ∈ ℤ^{2}, so

f|_{g} (g^{−1} (\begin{matrix}x_{0} \\ y_{0} \end{matrix})) = f(x_{0}, y_{0}) = n.

Thus every integer represented by f is also represented by f|_{g}. Conversely,

if f|_{g}(x_{0}, y_{0}) = n, then f (g (\begin{matrix}x_{0} \\ y_{0} \end{matrix})) = n, so f represents n.

Define an equivalence relation ∼ on the set of all binary quadratic forms by declaring that f is equivalent to f′ if there exists g ∈ SL_{2}(ℤ) such that f|_{g} = f′.

For simplicity, we will sometimes denote the quadratic form ax^{2} + bxy + cy^{2} by (a, b, c). Then, for example, since g = ( \begin{matrix}0 & −1 \\ 1 & 0 \end{matrix} ) ∈ SL_{2}(ℤ), we see that (a, b, c) ∼ (c, −b, a), since if f(x, y) = ax^{2} + bxy + cy^{2}, then f(−y, x) = ay^{2} − bxy + cx^{2}.

Example 5.9. Consider the binary quadratic form

f(x, y) = 458x^{2} + 214xy + 25y^{2}.

Solving the representation problem for f might, at first glance, look hopeless. We find f(x, y) for a few values of x and y:

f(−1, −1) = 17 · 41
f(−1, 0) = 2 · 229
f(0, −1) = 5^{2}
f(1, 1) = 269
f(−1, 2) = 2 · 5 · 13
f(−1, 3) = 41

Each number is a sum of two squares! Letting g = ( \begin{matrix}4 & −3 \\ −17 & 13 \end{matrix} ), we have

f|_{g} = 458(4x−3y)^{2}+214(4x−3y)(−17x+13y)+25(−17x+13y)^{2} = ⋯ = x^{2}+y^{2}!!

By Proposition 5.8, f represents an integer n if and only if n is a sum of two squares.

5.2.3 Discriminants

Definition 5.10. The discriminant of f(x, y) = ax^{2} +bxy+cy^{2} is b^{2} −4ac.

Example 5.11. disc(x^{2} + y^{2}) = −4 and

disc(458, 214, 25) = 214^{2} − 4 · 25 · 458 = −4.

That the discriminants are the same is a good hint that (1, 0, 1) and (458, 214, 25) are closely related. Inspecting discriminants is more effective than simply computing f(x, y) for many values of x and y and staring at the result.

Proposition 5.12. If f ∼ f′, then disc(f) = disc(f′).

Proof. By tedious but elementary algebra (see page 133 of Davenport’s book), one sees that if g ∈ SL_{2}(ℤ), then

disc(f|_{g}) = disc(f) · (det(g))^{2} = disc(f).

Since f′ = f|_{g} for some g ∈ SL_{2}(ℤ), the proposition follows.

WARNING: The converse of the proposition is false! Forms with the same discriminant need not be equivalent. For example, the forms (1, 0, 6) and (2, 0, 3) have discriminant −24, but are not equivalent. To see this, observe that (1, 0, 6) represents 1, but 2x^{2} + 3y^{2} does not represent 1.

Proposition 5.13. The set of all discriminants of forms is exactly the set of integers d such that d ≡ 0 or 1 (mod 4).

Proof. First note that b^{2} − 4ac is a square modulo 4, so it must equal 0 or 1 modulo 4. Next suppose d is an integer such that d ≡ 0 or 1 (mod 4). If we set

c = \begin{cases}−d/4, & if d ≡ 0 (mod 4) \\ −(d − 1)/4 & if d ≡ 1 (mod 4), \end{cases}

then disc(1, 0, c) = d in the first case and disc(1, 1, c) = d in the second.

Definition 5.14. The form (1, 0, −d/4) or (1, 1, −(d − 1)/4) of discriminant d that appears in the proof of the previous proposition is called the principal form of discriminant d.

d  principal form
−4  (1,0,1)  x^{2} + y^{2}
5  (1,1,-1)  x^{2} + xy − y^{2}
−7  (1,1,2)  x^{2} + xy + 2y^{2}
8  (1,0,-2)  x^{2} − 2y^{2}
−23  (1,1,6)  x^{2} + xy + 6y^{2}
389  (1,1,-97)  x^{2} + xy − 97y^{2}

5.2.4 Definite and Indefinite Forms

Definition 5.15. A quadratic form with negative discriminant is called definite. A form with positive discriminant is called indefinite.

Let (a, b, c) be a quadratic form. Multiply by 4a and complete the square:

4a(ax^{2} + bxy + cy^{2}) = 4a^{2}x^{2} + 4abxy + 4acy^{2}
= (2ax + by)^{2} + (4ac − b^{2})y^{2}

If disc(a, b, c) < 0 then 4ac − b^{2} = − disc(a, b, c) > 0, so ax^{2} + bxy + cy^{2} takes only positive or only negative values, depending on the sign of a. In this sense, (a, b, c) is very definite about its choice of sign. If disc(a, b, c) > 0, then (2ax + by)^{2} + (4ac − b^{2})y^{2} takes both positive and negative values, so (a, b, c) does also.

We will consider only definite forms in the next two lectures.

5.2.5 Real Life

The following text is from the documentation for binary quadratic forms in the Magma computer algebra system. A quick scan of the buzzwords emphasized (by me) below conveys an idea of where binary quadratic forms appear in mathematics.

A binary quadratic form is an integral form ax^{2} + bxy + cy^{2} which is represented in Magma by a tuple (a, b, c). Binary quadratic forms play an central role in the ideal theory of quadratic fields, the classical theory of complex multiplication, and the theory of modular forms. Algorithms for binary quadratic forms provide efficient means of computing in the ideal class group of orders in a quadratic field. By using the explicit relation of definite quadratic forms with lattices with nontrivial endomorphism ring in the complex plane, one can apply modular and elliptic functions to forms, and exploit the analytic theory of complex multiplication.

The structures of quadratic forms of a given discriminant D correspond to ordered bases of ideals in an order in a quadratic number field, defined up to scaling by the rationals. A form is primitive if the coefficients a, b, and c are coprime. For negative discriminants the primitive reduced forms in this structure are in bijection with the class group of projective or invertible ideals. For positive discriminants, the reduced orbits of forms are used for this purpose. Magma holds efficient algorithms for composition, enumeration of reduced forms, class group computations, and discrete logarithms. A significant novel feature is the treatment of nonfundamental discriminants, corresponding to nonmaximal orders, and the collections of homomorphisms between different class groups coming from the inclusions of these orders.

The functionality for binary quadratic forms is rounded out with various functions for applying modular and elliptic functions to forms, and for class polynomials associated to class groups of definite forms.

5.3 Reduction Theory

Recall that a binary quadratic form is a function f(x, y) = ax^{2} +bxy +cy^{2}. Our motivating problem is to decide which numbers are “represented” by f; i.e., for which integers n do there exist integers x, y such that ax^{2} + bxy +

cy^{2} = n? If g ∈ SL_{2}(ℤ) then f(x, y) and f|_{g}(x, y) = f (g [\begin{matrix}x \\ y \end{matrix}]) represent

exactly the same set of integers. Also, disc(f) = disc(f|_{g}), where disc(f) = b^{2} − 4ac, and f is called positive definite if disc(f) < 0 and a > 0.

In today’s lecture, we will learn about reduction theory, which allows us to decide whether or not two positive definite binary quadratic forms are equivalent under the action of SL_{2}(ℤ).

If, in the future, you would like to pursue the theory of binary quadratic forms in either a more algebraic or algorithmic direction, I highly recommend that you look at Chapter 5 of Henri Cohen’s book A Course in Computational Algebraic Number Theory (GTM 138).

5.3.1 Reduced Forms

Definition 5.16 (Reduced). A positive definite quadratic form (a, b, c) is reduced if |b| ≤ a ≤ c and if, in addition, when one of the two inequalities is an equality (i.e., either |b| = a or a = c), then b ≥ 0.

There is a geometric interpretation of reduced, which we will not use this later. Let D = disc(a, b, c) = b^{2} − 4ac and set τ = \frac{−b+\sqrt{D}}{2a}, so τ is the root of ax^{2} + bx + c with positive imaginary part. The right action of SL_{2}(ℤ) on positive definite binary quadratic forms corresponds to the left action of SL_{2}(ℤ) by linear fractional transformations on the complex upper half plane 𝔥 = {z ∈ ℂ : Im(z) > 0}. The standard fundamental domain for the action of SL_{2}(ℤ) on 𝔥 is

F = \{τ ∈ 𝔥 : Re(τ) ∈ [−\frac{1}{2}, \frac{1}{2}) , |τ| > 1 or |τ| = 1 and Re(τ) ≤ 0\} .

Then (a, b, c) is reduced if and only if the corresponding complex number τ lies in F. For example, if (a, b, c) is reduced then Re(τ) = −b/2a ∈ [−1/2, 1/2) since |b| ≤ a and if |b| = a then b ≥ 0. Also

|τ| = \sqrt{\frac{b^{2} + 4ac − b^{2}}{4a^{2}}} = \sqrt{\frac{c}{a}} ≥ 1

and if |τ| = 1 then b ≥ 0 so Re(τ) ≤ 0.

The following theorem (which is not proved in Davenport) highlights the importance of reduced forms.

Theorem 5.17. There is exactly one reduced form in each equivalence class of positive definite binary quadratic forms.

Proof. We have to prove two things. First, that every class contains at least one reduced form, and second that this reduced form is the only one in the class.

We first prove that there is a reduced form in every class. Let C be an equivalence class of positive definite quadratic forms of discriminant D. Let (a, b, c) be an element of C such that a is minimal (amongst elements of C). Note that for any such form we have c ≥ a, since (a, b, c) is equivalent to (c, −b, a) (use the matrix ( \begin{matrix}0 & −1 \\ 1 & 0 \end{matrix} )). Applying the element ( \begin{matrix}1 & k \\ 0 & 1 \end{matrix} ) ∈ SL_{2}(ℤ) to (a, b, c) for a suitably chosen integer k (precisely, k = ⌊(a − b)/2a⌋) results in a form (a′, b′, c′) with a′ = a and b′ ∈ (−a′, a′]. Since a′ = a is minimal, we have just as above that a′ ≤ c′, hence (a′, b′, c′) is “just about” reduced. The only possible remaining problem would occur if a′ = c′ and b′ < 0. In that case, changing (a′, b′, c′) to (c′′, b′′, a′′) = (c′, −b′, a′) results in an equivalent form with b′′ > 0, so that (c′′, b′′, a′′) is reduced.

Next suppose (a, b, c) is a reduced form. We will now establish that (a, b, c) is the only reduced form in its equivalence class. First, we check that a is minimal amongst all forms equivalent to (a, b, c). Indeed, every other a′ has the form a′ = ap^{2} + bpr + cr^{2} with p, r coprime integers (see this by hitting (a, b, c) by ( \begin{matrix}p & q \\ r & s \end{matrix})). The identities

ap^{2} + bpr + cr^{2} = ap^{2} (1 + \frac{b}{a} \frac{r}{p}) + cr^{2} = ap^{2} + cr^{2} (1 + \frac{b}{c} \frac{p}{r})

then imply our claim since |b| ≤ a ≤ c (use the first identity if r/p < 1 and the second otherwise). Thus any other reduced form (a′, b′, c′) equivalent to (a, b, c) has a′ = a. But the same identity implies that the only forms equivalent to (a, b, c) with a′ = a are obtained by applying a transformation

of the form (\begin{matrix}1 & k \\ 0 & 1 \end{matrix}) (corresponding to p = 1, r = 0). Thus b′ = b + 2ak for

some k. Since a = a′ we have b, b′ ∈ (−a, a], so k = 0. Finally

c′ = \frac{(b′)^{2} − D}{4a′} = \frac{b^{2} − D}{4a} = c,

so (a′, b′, c′) = (a, b, c).

5.3.2 Finding an Equivalent Reduced Form

Here is how to find the reduced form equivalent to a given positive definite form (a, b, c). This algorithm is useful for solving problems 8 and 9 on the homework assignment. Consider the following two operations, which can be used to diminish one of a and |b|, without altering the other:

1. If c < a, replace (a, b, c) by the equivalent form (c, −b, a).

2. If |b| > a, replace (a, b, c) by the equivalent form (a, b′, c′) where b′ = b + 2ka and k is chosen so that b′ ∈ (−a, a] (more precisely, k = ⌊\frac{a−b}{2a}⌋), and c′ is found from the fact that (b′)^{2} − 4ac′ = D = disc(a, b, c), so c′ = \frac{(b′)^{2}−D}{4a}.

Starting with (a, b, c), if you iterate the appropriate operation, eventually you will find the reduced form that is equivalent to (a, b, c). Example 5.18. Let f = 458x^{2} + 214xy + 25y^{2}.

Equivalent form What I did  Matrix
(458, 214, 25)
(25, −214, 458) (1) ( \begin{matrix}0 & −1 \\ 1 & 0 \end{matrix} )
(25, −14, 2)  (2) with k = 4 ( \begin{matrix}1 & 4 \\ 0 & 1 \end{matrix} )
(2, 14, 25) (1) ( \begin{matrix}0 & −1 \\ 1 & 0 \end{matrix} )
(2, 2, 1)  (2) with k = −3 ( \begin{matrix}1 & −3 \\ 0 & 1 \end{matrix} )
(1, −2, 2) (1) ( \begin{matrix}0 & −1 \\ 1 & 0 \end{matrix} )
(1, 0, 1)  (2) with k = 1 ( \begin{matrix}1 & 1 \\ 0 & 1 \end{matrix} )

Let

g = (\begin{matrix}0 & −1 \\ 1 & 0 \end{matrix}) · (\begin{matrix}1 & 4 \\ 0 & 1 \end{matrix}) · (\begin{matrix}0 & −1 \\ 1 & 0 \end{matrix}) · (\begin{matrix}1 & −3 \\ 0 & 1 \end{matrix}) · (\begin{matrix}0 & −1 \\ 1 & 0 \end{matrix}) · (\begin{matrix}1 & 1 \\ 0 & 1 \end{matrix})

= (\begin{matrix}3 & 4 \\ −13 & −17 \end{matrix}) .

Then

f|_{g} = x^{2} + y^{2}!

5.3.3 Some PARI Code

The following PARI code checks whether or not a form is reduced, and computes the reduced form equivalent to a given form. You can download it from my web page if you don’t want to type it in.

\\ true if and only if (a,b,c) is reduced.
{isreduced(a,b,c) =
   if(b^2-4*a*c>=0 || a<0,
      error("reduce: (a,b,c) must be positive definite."));
   if(!(abs(b)<=a && a<=c), return(0));
   if(abs(b)==a || a==c, return(b>=0));
   return(1);
}
\\ reduces, printing out each step.  returns the reduced form
\\ and a matrix that transforms the input form to the reduced form.
{reduce(a,b,c,s) =
   local(D, k, t, g);
   D=b^2-4*a*c;
   if(D>=0 || a<0, error("reduce: (a,b,c) must be positive definite."));
   g=[1,0;0,1];
   while(!isreduced(a,b,c),       \\ ! means ``not''
      if(c<a,
         b = -b; t = a; a = c; c = t;
         g = g*[0,-1;1,0];
         print([a,b,c], "  \t(1)"),  \\ backslash t means ``tab''
      \\ else
         if (abs(b)>a || -b==a,
            k = floor((a-b)/(2*a));
            b = b+2*k*a;
            c = (b^2-D)/(4*a);
            g = g*[1,k;0,1];
            print([a,b,c], "  \t(2) with k=",k)
         )
      )

   );
   return([a,b,c,g])
}
/* Here is an example:
? \r quadform
? reduce(458,214,25)
[25, -214, 458] (1)
[25, -14, 2]    (2) with k=4
[2, 14, 25]     (1)
[2, 2, 1]       (2) with k=-3
[1, -2, 2]      (1)
[1, 0, 1]       (2) with k=1
%22 = [1, 0, 1, [3, 4; -13, -17]]
*/

5.4 The Class Group

5.4.1 Can You Hear the Shape of a Lattice?

After Lecture 23, Emanuele Viola asked me whether or not the following is true: “If f_{1} and f_{2} are binary quadratic forms that represent exactly the same integers, is f_{1} ∼ f_{2}?” The answer is no. For example, f_{1} = (2, 1, 3) = 2x^{2} + xy + 3y^{2} and f_{2} = (2, −1, 3) = 2x^{2} − xy + 3y^{2} are inequivalent reduced positive definite binary quadratic forms that represent exactly the same integers. Note that disc(f_{1}) = disc(f_{2}) = −23. There appears to be a sense in which all counterexamples resemble the one just given.

Questions like these are central to John H. Conway’s book The sensual (quadratic) form, which I’ve never seen because the Cabot library copy is checked out and the Birkhoff copy has gone missing. The following is taken from the MathSciNet review (I changed the text slightly so that it makes sense):

Chapter 2 begins by posing Mark Kac’s question of “hearing the shape of a drum”, and the author relates the higher-dimensional analogue of this idea on tori—quotients of R^{n} by a lattice—to the question of what properties of a positive definite integral quadratic form are determined by the numbers the form represents. A property of such a form is called “audible” if the property is determined by these numbers, or equivalently, by the theta function of the quadratic form. As examples, he shows that the determinant of the form and the theta function of the dual form are audible. He also provides counterexamples to the higher-dimensional Kac question, the first of which were found by J. Milnor...

5.4.2 Class Numbers

Proposition 5.19. Let D < 0 be a discriminant. There are only finitely many equivalence classes of positive definite binary quadratic forms of discriminant D.

Proof. Since there is exactly one reduced binary quadratic form in each equivalence class, it suffices to show that there are only finitely many reduced forms of discriminant D. Recall that if a form (a, b, c) is reduced, then |b| ≤ a ≤ c. If (a, b, c) has discriminant D then b^{2} − 4ac = D. Since b^{2} ≤ a^{2} ≤ ac, we have D = b^{2} − 4ac ≤ −3ac, so

3ac ≤ −D.

There are only finitely many positive integers a, c that satisfy this inequality.

Definition 5.20. A binary quadratic form (a, b, c) is primitive if gcd(a, b, c) = 1.

Definition 5.21. The class number h_{D} of discriminant D < 0 is the number of equivalence classes of primitive positive definite binary quadratic forms of discriminant D.

I computed the following table of class number h_{D} for −D ≤ 839 using the built-in PARI function qfbclassno(D,1). Notice that there are just a few 1s at the beginning and then no more.

\begin{matrix}−D & h_{D} \\ 3 & 1 \\ 7 & 1 \\ 11 & 1 \\ 15 & 2 \\ 19 & 1 \\ 23 & 3 \\ 27 & 1 \\ 31 & 3 \\ 35 & 2 \\ 39 & 4 \\ 43 & 1 \\ 47 & 5 \\ 51 & 2 \\ 55 & 4 \\ 59 & 3 \\ 63 & 4 \\ 67 & 1 \\ 71 & 7 \\ 75 & 2 \\ 79 & 5 \\ 83 & 3 \\ 87 & 6 \\ 91 & 2 \\ 95 & 8 \\ 99 & 2 \\ 103 & 5 \\ 107 & 3 \\ 111 & 8 \\ 115 & 2 \\ 119 & 10 \end{matrix} \begin{matrix}−D & h_{D} \\ 123 & 2 \\ 127 & 5 \\ 131 & 5 \\ 135 & 6 \\ 139 & 3 \\ 143 & 10 \\ 147 & 2 \\ 151 & 7 \\ 155 & 4 \\ 159 & 10 \\ 163 & 1 \\ 167 & 11 \\ 171 & 4 \\ 175 & 6 \\ 179 & 5 \\ 183 & 8 \\ 187 & 2 \\ 191 & 13 \\ 195 & 4 \\ 199 & 9 \\ 203 & 4 \\ 207 & 6 \\ 211 & 3 \\ 215 & 14 \\ 219 & 4 \\ 223 & 7 \\ 227 & 5 \\ 231 & 12 \\ 235 & 2 \\ 239 & 15 \end{matrix} \begin{matrix}−D & h_{D} \\ 243 & 3 \\ 247 & 6 \\ 251 & 7 \\ 255 & 12 \\ 259 & 4 \\ 263 & 13 \\ 267 & 2 \\ 271 & 11 \\ 275 & 4 \\ 279 & 12 \\ 283 & 3 \\ 287 & 14 \\ 291 & 4 \\ 295 & 8 \\ 299 & 8 \\ 303 & 10 \\ 307 & 3 \\ 311 & 19 \\ 315 & 4 \\ 319 & 10 \\ 323 & 4 \\ 327 & 12 \\ 331 & 3 \\ 335 & 18 \\ 339 & 6 \\ 343 & 7 \\ 347 & 5 \\ 351 & 12 \\ 355 & 4 \\ 359 & 19 \end{matrix} \begin{matrix}−D & h_{D} \\ 363 & 4 \\ 367 & 9 \\ 371 & 8 \\ 375 & 10 \\ 379 & 3 \\ 383 & 17 \\ 387 & 4 \\ 391 & 14 \\ 395 & 8 \\ 399 & 16 \\ 403 & 2 \\ 407 & 16 \\ 411 & 6 \\ 415 & 10 \\ 419 & 9 \\ 423 & 10 \\ 427 & 2 \\ 431 & 21 \\ 435 & 4 \\ 439 & 15 \\ 443 & 5 \\ 447 & 14 \\ 451 & 6 \\ 455 & 20 \\ 459 & 6 \\ 463 & 7 \\ 467 & 7 \\ 471 & 16 \\ 475 & 4 \\ 479 & 25 \end{matrix} \begin{matrix}−D & h_{D} \\ 483 & 4 \\ 487 & 7 \\ 491 & 9 \\ 495 & 16 \\ 499 & 3 \\ 503 & 21 \\ 507 & 4 \\ 511 & 14 \\ 515 & 6 \\ 519 & 18 \\ 523 & 5 \\ 527 & 18 \\ 531 & 6 \\ 535 & 14 \\ 539 & 8 \\ 543 & 12 \\ 547 & 3 \\ 551 & 26 \\ 555 & 4 \\ 559 & 16 \\ 563 & 9 \\ 567 & 12 \\ 571 & 5 \\ 575 & 18 \\ 579 & 8 \\ 583 & 8 \\ 587 & 7 \\ 591 & 22 \\ 595 & 4 \\ 599 & 25 \end{matrix} \begin{matrix}−D & h_{D} \\ 603 & 4 \\ 607 & 13 \\ 611 & 10 \\ 615 & 20 \\ 619 & 5 \\ 623 & 22 \\ 627 & 4 \\ 631 & 13 \\ 635 & 10 \\ 639 & 14 \\ 643 & 3 \\ 647 & 23 \\ 651 & 8 \\ 655 & 12 \\ 659 & 11 \\ 663 & 16 \\ 667 & 4 \\ 671 & 30 \\ 675 & 6 \\ 679 & 18 \\ 683 & 5 \\ 687 & 12 \\ 691 & 5 \\ 695 & 24 \\ 699 & 10 \\ 703 & 14 \\ 707 & 6 \\ 711 & 20 \\ 715 & 4 \\ 719 & 31 \end{matrix} \begin{matrix}−D & h_{D} \\ 723 & 4 \\ 727 & 13 \\ 731 & 12 \\ 735 & 16 \\ 739 & 5 \\ 743 & 21 \\ 747 & 6 \\ 751 & 15 \\ 755 & 12 \\ 759 & 24 \\ 763 & 4 \\ 767 & 22 \\ 771 & 6 \\ 775 & 12 \\ 779 & 10 \\ 783 & 18 \\ 787 & 5 \\ 791 & 32 \\ 795 & 4 \\ 799 & 16 \\ 803 & 10 \\ 807 & 14 \\ 811 & 7 \\ 815 & 30 \\ 819 & 8 \\ 823 & 9 \\ 827 & 7 \\ 831 & 28 \\ 835 & 6 \\ 839 & 33 \end{matrix}

We can compute these numbers using Proposition 5.19. The following PARI program enumerates the primitive reduced forms of discriminant D.

{isreduced(a,b,c) =
if(b^2-4*a*c>=0 || a<0,
   error("reduce: (a,b,c) must be positive definite."));
if(!(abs(b)<=a && a<=c), return(0));
if(abs(b)==a || a==c, return(b>=0));
return(1);
}
{reduce(f) =
local(D, k, t, a,b,c);
a=f[1]; b=f[2]; c=f[3]; D=b^2-4*a*c;
if(D>=0 || a<0, error("reduce: (a,b,c) must be positive definite."));
while(!isreduced(a,b,c),       \\ ! means ``not''
   if(c<a,
      b = -b; t = a; a = c; c = t,
   \\ else
      if (abs(b)>a || -b==a,
         k = floor((a-b)/(2*a));
         b = b+2*k*a;
         c = (b^2-D)/(4*a);
      )
   )
);
return([a,b,c])
}
{reducedforms(D)=
local(bound, forms, b, r);
if (D > 0 || D%4 == 2 || D%4==3, error("Invalid discriminant"));
bound = floor(-D/3);
forms = [];
for(a = 1, bound,
   for(c = 1, bound,
      if(3*a*c<=-D && issquare(4*a*c+D),
         b = floor(sqrt(4*a*c+D));
         r = reduce([a,b,c]);
         print1([a,b,c], " ----> ", r);
         if (gcd(r[1],gcd(r[2],r[3])) == 1,
            forms = setunion(forms,[r]); print(""),
            \\ else
            print ("  \t(not primitive)")
         )
      )
   )

   );
   return(eval(forms));    \\ eval gets rid of the annoying quotes.
}

For example, when D = −419 the program finds exactly 9 reduced forms:

? D = -419
%21 = -419
? qfbclassno(D,1)
%22 = 9
? reducedforms(D)
[1, 1, 105] ----> [1, 1, 105]
[1, 3, 107] ----> [1, 1, 105]
[1, 5, 111] ----> [1, 1, 105]
[1, 7, 117] ----> [1, 1, 105]
[1, 9, 125] ----> [1, 1, 105]
[1, 11, 135] ----> [1, 1, 105]
[3, 1, 35] ----> [3, 1, 35]
[3, 5, 37] ----> [3, -1, 35]
[3, 7, 39] ----> [3, 1, 35]
[3, 11, 45] ----> [3, -1, 35]
[5, 1, 21] ----> [5, 1, 21]
[5, 9, 25] ----> [5, -1, 21]
[5, 11, 27] ----> [5, 1, 21]
[7, 1, 15] ----> [7, 1, 15]
[9, 7, 13] ----> [9, 7, 13]
[9, 11, 15] ----> [9, -7, 13]
[13, 7, 9] ----> [9, -7, 13]
[15, 1, 7] ----> [7, -1, 15]
[15, 11, 9] ----> [9, 7, 13]
[21, 1, 5] ----> [5, -1, 21]
[25, 9, 5] ----> [5, 1, 21]
[27, 11, 5] ----> [5, -1, 21]
[35, 1, 3] ----> [3, -1, 35]
[37, 5, 3] ----> [3, 1, 35]
[39, 7, 3] ----> [3, -1, 35]
[45, 11, 3] ----> [3, 1, 35]
[105, 1, 1] ----> [1, 1, 105]
[107, 3, 1] ----> [1, 1, 105]
[111, 5, 1] ----> [1, 1, 105]
[117, 7, 1] ----> [1, 1, 105]
[125, 9, 1] ----> [1, 1, 105]
[135, 11, 1] ----> [1, 1, 105]
%23 = [[1, 1, 105], [3, -1, 35], [3, 1, 35], [5, -1, 21], [5, 1, 21],
       [7, -1, 15], [7, 1, 15], [9, -7, 13], [9, 7, 13]]
? length(%23)

%24 = 9

Theorem 5.22 (Heegner, Stark-Baker, Goldfeld-Gross-Zagier). Suppose D is a negative discriminant that is either square free or 4 times a square-free number. Then

• h_{D} = 1 only for D = −3, −4, −7, −8, −11, −19, −43, −67, −163.

• h_{D} = 2 only for D = −15, −20, −24, −35, −40, −51, −52, −88, −91, −115, −123, −148, −187, −232, −235, −267, −403, −427.

• h_{D} = 3 only for D = −23, −31, −59, −83, −107, −139, −211, −283, −307, −331, −379, −499, −547, −643, −883, −907.

• h_{D} = 4 only for D = −39, −55, −56, −68, …, −1555.

To quote Henri Cohen: “The first two statements concerning class numbers 1 and 2 are very difficult theorems proved in 1952 by Heegner and in 1968–1970 by Stark and Baker. The general problem of determing all imaginary quadratic fields with a given class number has been solved in principle by Goldfeld-Gross-Zagier, but to my knowledge the explicit computations have been carried to the end only for class numbers 3 and 4 (in addition to the already known class numbers 1 and 2).

5.4.3 The Class Group

There are much more sophisticated ways to compute h_{D} than simply listing the reduced binary quadratic forms of discriminant D, which is an O(|D|) algorithm. For example, there is an algorithm that can compute h_{D} for D having 50 digits in a reasonable amount of time. These more sophisticated algorithms use the fact that the set of primitive positive definite binary quadratic forms of given discriminant is a finite abelian group.

Definition 5.23. Let f_{1} = (a_{1}, b_{1}, c_{1}) and f_{2} = (a_{2}, b_{2}, c_{2}) be two quadratic forms of the same discriminant D. Set s = (b_{1} + b_{2})/2, n = (b_{1} − b_{2})/2 and let u, v, w and d be such that

ua_{1} + va_{2} + ws = d = gcd(a_{1}, a_{2}, s)

(obtained by two applications of Euclid’s algorithm), and let d_{0} = gcd(d, c_{1}, c_{2}, n). Define the composite of the equivalence classes of the two forms f_{1} and f_{2} to be the equivalence class of the form

(a_{3}, b_{3}, c_{3}) = (d_{0} \frac{a_{1}a_{2}}{d^{2}} , b_{2} + \frac{2a_{2}}{d} (v(s − b_{2}) − wc_{2}), \frac{b_{3}^{2} − D}{4a_{3}} ) .

This mysterious-looking group law is induced by “multiplication of ideals” in the “ring of integers” of the quadratic imaginary number field ℚ(\sqrt{D}). The following PARI program computes this group operation:

{composition(f1, f2)=
   local(a1,b1,c1,a2,b2,c2,D,s,n,bz0,bz1,u,v,w);
   a1=f1[1]; b1=f1[2]; c1=f1[3];
   a2=f2[1]; b2=f2[2]; c2=f2[3];
   D = b1^2 - 4*a1*c1;
   if(b2^2 - 4*a2*c2 != D, error("Forms must have the same discriminant."));
   s = (b1+b2)/2;
   n = (b1-b2)/2;
   bz0 = bezout(a1,a2);
   bz1 = bezout(bz0[3],s);
   u = bz1[1]*bz0[1];
   v = bz1[1]*bz0[2];
   w = bz1[2];
   d = bz1[3];
   d0 = gcd(gcd(gcd(d,c1),c2),n);
   a3 = d0*a1*a2/d^2;
   b3 = b2+2*a2*(v*(s-b2)-w*c2)/d;
   c3 = (b3^2-D)/(4*a3);
   f3 = reduce([a3,b3,c3]);
   return(f3);
}

Let’s try the group out in the case when D = −23.

? reducedforms(-23)
[1, 1, 6] ----> [1, 1, 6]
[2, 1, 3] ----> [2, 1, 3]
[3, 1, 2] ----> [2, -1, 3]
[6, 1, 1] ----> [1, 1, 6]
%56 = [[1, 1, 6], [2, -1, 3], [2, 1, 3]]

Thus the group has elements (1, 1, 6), (2, −1, 3), and (2, 1, 3). Since h_{−23} = 3, the group must be cyclic of order 3. Let’s find the identity element.

? composition([1,1,6],[2,-1,3])
%58 = [2, -1, 3]

Thus the identity element must be (1, 1, 6). The element (2, −1, 3) is a generator for the group:

? composition([2,-1,3],[2,-1,3])
%59 = [2, 1, 3]
? composition([2,-1,3],[2,1,3])
%60 = [1, 1, 6]

Exercises 5.1 Which of the following numbers is a sum of two squares? Express

those that are as a sum of two squares.

−389, 12345, 91210, 729, 1729, 68252

5.2 (a) Write a simple computer program that takes a positive integer n as input and outputs a sequence [x,y,z,w] of four integers such that x^{2} + y^{2} + z^{2} + w^{2} = n.

(b) Write 2001 as a sum of three squares.

5.3 Find a positive integer that has a least three different representations as the sum of two squares, disregarding signs and the order of the summands.

5.4 Show that a natural number n is the sum of two integer squares if and only if it is the sum of two rational squares.

5.5 Mimic the proof of the main theorem of Lecture 21 to show that an odd prime p is of the form 8m + 1 or 8m + 3 if and only if it can be written as p = x^{2} + 2y^{2} for some choice of integers x and y. [Hint: Use the formula for the quadratic residue symbol (\frac{−2}{p}) from ???.]

5.6 A triangular number is a number that is the sum of the first m integers for some positive integer m. If n is a triangular number, show that all three of the integers 8n^{2}, 8n^{2} + 1, and 8n^{2} + 2 can be written as a sum of two squares.

5.7 Prove that of any four consecutive integers, at least one is not representable as a sum of two squares.

5.8 Show directly that 13x^{2} + 36xy + 25y^{2} and 58x^{2} + 82xy + 29y^{2} are each equivalent to the form x^{2} + y^{2}, then find integers x and y such that 13x^{2} + 36xy + 25y^{2} = 389.

5.9 What are the discriminants of the forms 199x^{2} − 162xy + 33y^{2} and 35x^{2} − 96xy + 66y^{2}? Are these forms equivalent?

5.10 For any negative discriminant D, let C_{D} denote the finite abelian group of equivalence classes of primitive positive definite quadratic forms of discriminant D. Use a computer to compute representatives for C_{D} and determine the structure of C_{D} as a produce of cyclic groups for each of the following five values of D:

D = −155, −231, −660, −12104, −10015.

102 5. Binary Quadratic Forms

6

Elliptic Curves

6.1 Introduction

6.1.1 The Definition

Finally we come to elliptic curves, which I think are the most exciting and central easily accessibly objects in modern number theory. There are so many exciting things to tell you about elliptic curves, that the course is suddenly going to move more quickly than before.

Definition 6.1. An elliptic curve E over a field K is a plane cubic curve of the form

y^{2} + a_{1}xy + a_{3}y = x^{3} + a_{2}x^{2} + a_{4}x + a_{6},

where a_{1}, a_{2}, a_{3}, a_{4}, a_{6} ∈ K and

Δ = −b_{2}^{2}b_{8} − 8b_{4}^{3} − 27b_{6}^{2} + 9b_{2}b_{4}b_{6} ≠ 0,

where

b_{2} = a_{1}^{2} + 4a_{2}, b_{4} = 2a_{4} + a_{1}a_{3}, b_{6} = a_{3}^{2} + 4a_{6}.

Help! Don’t worry, when 2 and 3 are not equal to 0 in K, using completing the square and a little algebra we find a change of coordinates that transforms the above cubic equation into the form

y^{2} = x^{3} + ax + b,

and then Δ = −16(4a^{3} + 27b^{2}). We will consider only elliptic curves of the form y^{2} = x^{3} + ax + b for a while.

Hey! That’s not an ellipse! You’re right, elliptic curves are not ellipses; they are curves that first arose when 19th century mathematicians studied integral formulas for the arc lengths of ellipses.

In these lectures, I’ll give you a glimpse into two main ways in which elliptic curves feature in mathematics. On the left hand, they provide the simplest example of a class of diophantine equations that we still can’t totally solve. On the right hand, when K is a finite field (or, more sneakily, a finite ring), elliptic curves can be used as a tool for both making and breaking cryptosystems.

6.1.2 Linear and Quadratic Diophantine Equations

Consider the following question:

Let F (x, y) be an irreducible polynomial in two variables over ℚ.

Find all rational numbers x_{0}, y_{0} such that F (x_{0}, y_{0}) = 0.

When F is linear, this problem is easy. The equation

F (x, y) = ax + by + c = 0

defines a line, and letting y = t, the solutions are

\{(−\frac{b}{a}t − \frac{c}{a}, t) : t ∈ ℚ\} .

When F is quadratic, the solution is not completely trivial, but it is well understood. In this case, the equation F = 0 has infinitely many rational solutions if and only if it has at least one solution. Moreover, it is easy to describe all solutions when there is one. If (x_{0}, y_{0}) is a solution and L is a non-tangent line through (x_{0}, y_{0}), then L will intersect the curve F = 0 in exactly one other point (x_{1}, x_{1}). Also x_{1}, y_{1} ∈ ℚ since a quadratic polynomial over ℚ with 1 rational root has both roots rational. Thus the rational points on F = 0 are in bijection with the slopes of lines through (x_{0}, y_{0}).

Chapter 2 of [Kato et al.] is about how to decide whether or not an F of degree 2 has a rational point. The answer is that F = 0 has a rational solution if and only if F = 0 has a solution with x_{0}, y_{0} ∈ ℝ and a solution with x_{0}, y_{0} ∈ ℚ_{p} for every “p-adic field” ℚ_{p}. This condition, though it might sound foreboding, is easy to check in practice. I encourage you to flip through chapter 2 of loc. cit.

6.1.3 Points on Elliptic Curves

Next suppose that F is an irreducible cubic polynomial. The question of whether or not F = 0 has a rational solution is still an open problem!

We will not consider this problem further until we discuss the Birch and Swinnerton-Dyer conjecture.

Suppose that F = 0 has a given rational solution. Then one can change coordinates so that the question of finding the rational solutions to F = 0 is equivalent to the problem of finding all rational points on the elliptic curve

y^{2} = x^{3} + ax + b.

Recall that when F has degree 2 we can use a given rational point P on the graph of F = 0 to find all other rational points by intersecting a line through P with the graph of F = 0. The graph of y^{2} = x^{3} + ax + b looks like

[egg and curvy line] or [curvier line]

Notice that if P is a point on the graph of the curve, then a line through P (usually) intersects the graph in exactly two other points. In general, these two other points usually do not have rational coordinates. However, if P and Q are rational points on the graph of y^{2} = x^{3} + ax + b and L is the line through P and Q, then the third point of intersection with the graph will have rational coordinates. Explicitly, if P = (x_{1}, y_{1}) and Q = (x_{2}, y_{2}) then the third point of intersection has coordinates^{1}

x_{3} = (\frac{y_{2} − y_{1}}{x_{2} − x_{1}} )^{2} − x_{1} − x_{2}, y_{3} = \frac{y_{2} − y_{1}}{x_{2} − x_{1}} x_{3} − \frac{y_{2}x_{1} − y_{1}x_{2}}{x_{2} − x_{1}} .

Thus, given two points on E, we can find another. Also, given a single point, we can draw the tangent line to E through that point and obtain a third point.

To Infinity!

At first glance, the above construction doesn’t work if x_{1} = x_{2}. [draw picture]. Fortunately, there is a natural sense in which the graph of E is missing one point, and when x_{1} = x_{2} this one missing point is the third point of intersection.

The graph of E that we drew above is a graph in the plan ℝ^{2}. The plane is a subset of the projective plane ℙ^{2}, which I will define in just a moment. The closure of the graph of y^{2} = x^{3} + ax + b in ℙ^{2} has exactly one extra point, which has rational coordinates, and which we denote by ∞. Formally, ℙ^{2} can be viewed as the set of triples (a, b, c) with a, b, c not all 0 modulo the equivalence relation

(a, b, c) ∼ (λa, λb, λc)

1It is traditional in a course like ours for me to derive these formulas. I’m not going to, because it’s simple algebra and once you see the geometric picture it is easy to carry out.

You should do this as an exercise, or read the derivation in [Kato et al.] or [Davenport].

for any nonzero λ. Denote by (a : b : c) the equivalence class of (a, b, c). The closure of the graph of y^{2} = x^{3} +ax+b is the graph of y^{2}z = x^{3} +axz^{2} +bz^{3} and the extra point ∞ is (0 : 1 : 0).

Venerable Problem: Find an algorithm that, given an elliptic curve E over ℚ, outputs a complete description of the set of rational points (x_{0}, y_{0}) on E.

This problem is difficult. In fact, so far it has stumped everyone! There is a conjectural algorithm, but nobody has succeeded in proving that it is really an algorithm, in the sense that it terminates for any input curve E. Several of your profs at Harvard, including Barry Mazur, myself, and Christophe Cornut (who will teach Math 129 next semester) have spent, or will probably spend, a huge chunk of their life thinking about this problem. (Am I being overly pessimistic?)

How could one possible “describe” the set of rational points on E in the first place? In 1923, Louis Mordell proved an amazing theorem, which implies that there is a reasonable way to describe the rational points on E. To state his theorem, we introduce the “group law” on E.

6.1.4 The Group Law

Consider the set E(ℚ) = {∞} ∪ {(x_{0}, y_{0}) : y_{0}^{2} = x_{0}^{3} + ax_{0} + b}. There is a natural way to endow the set E(ℚ) with a group structure. Here’s how it works. First, the element ∞ ∈ E(ℚ) is the 0 element of the group. Next, suppose P and Q are elements of E(ℚ). Just like we did earlier, draw the line through P and Q and let R = (x_{3}, y_{3}) be the third point of intersection. Define P + Q = (x_{3}, −y_{3}). There are various special cases to consider, such as when P = Q or the third point of intersection is ∞, but I will let your read about them in [Kato et al.]. It is clear that this binary operation on E(ℚ) satisfies P + Q = Q + P. Also, the inverse of P = (x_{1}, y_{1}) is −P = (x_{1}, −y_{1}). The only other axiom to check in order to verify that + gives E(ℚ) an abelian group structure is the associative law. This is simple but very tedious to check using only elementary methods^{2}. Fortunately, we can coerce the computer algebra system MAGMA into verifying the associative law for us:

// The field K = Q(a,b,x0,x1,x2)
K<a,b,x0,x1,x2> := FieldOfFractions(PolynomialRing(Rationals(),5));
// The polynomial ring R = K[y0,y1,y2]
R<y0,y1,y2> := PolynomialRing(K,3);
// A maximal ideal of R.
I := ideal<R | y0^2 - (x0^3+a*x0+b), y1^2 - (x1^3+a*x1+b), y2^2-(x2^3+a*x2+b)>;

2The right way to prove that the associate law holds is to develop the theory of algebraic curves and define the group law in terms of divisors; this is way outside the scope of this course.

// The field L contains three distinct "generic" points on E.
L  := quo<R|I>;
E  := EllipticCurve([L| a,b]);  // The elliptic curve y^2 = x^3 + a*x + b.
P0 := E![L|x0,y0]; P1 := E![L|x1,y1]; P2 := E![L|x2,y2];
lhs := (P0 + P1) + P2;  rhs := P0 + (P1 + P2);
lhs eq rhs;
true     // yeah!

6.1.5 Mordell’s Theorem

Theorem 6.2 (Mordell). The group E(ℚ) is finitely generated.

This means that there are points P_{1}, …, P_{r} ∈ E(ℚ) such that every element of E(ℚ) is of the form n_{1}P_{1} + ⋯ + n_{r}P_{r} for some n_{1}, … n_{r} ∈ ℤ. I won’t prove Mordell’s theorem in this course. You can find an elementary proof of most of it in §1.3 of [Kato et al.].^{3}

Example 6.3. Consider the elliptic curve E given by y^{2} = x^{3} + x + 1. Then E(ℚ) ≈ ℤ with generator (0, 1). We have 2(0, 1) = (−1/4, −9/8), 3(0, 1) = (72, 611), and 4(0, 1) = (−\frac{287}{1296}, \frac{40879}{46656}).

6.2 The Elliptic Curve Group Law

6.2.1 Some Graphs

Recall that an elliptic curve over a field K (in which 2 and 3 are invertible) can be defined by an equation

y^{2} = x^{3} + ax + b

with a, b ∈ K. Here are some examples over ℚ.

y^{2} = x^{3} + 1, E(ℚ) ≈ ℤ/6ℤ

3Matt Baker is teaching a graduate course (255r) this semester, and he is just about to present a proof of Weil’s generalization of Mordell’s theorem.

y (0, 1)  (2, 3)  x

y^{2} = x^{3} − 6x − 4  and  y^{2} = x^{3} − 5x + 4

E(ℚ) ≈ (ℤ/2ℤ) × ℤ (for both curves)

(−2, 0) (−1, 1)  x y  ^{(1, 0) (0, 2)  x y}

(Exercise: Add the indicated points.)

6.2.2 The Point O at Infinity

The graphs of the previous section are each missing a point at infinity. They are graphs in the plane ℝ^{2}. The plane is a subset of the projective plane ℙ^{2}. The “closure” of the graph of y^{2} = x^{3} + ax + b in ℙ^{2} has exactly one extra point O, which has rational coordinates, and which we sometimes call “the point at infinity”.

Definition 6.4. The projective plane ℙ^{2} is the set of triples (a, b, c), with a, b, c not all 0, modulo the equivalence relation

(a, b, c) ∼ (λa, λb, λc)

for any nonzero λ. We denote by (a:b:c) the equivalence class of (a, b, c).

The “closure” in ℙ^{2} of the graph of y^{2} = x^{3} + ax + b is the graph of

y^{2}z = x^{3} + axz^{2} + bz^{3}

and the extra point is O = (0 : 1 : 0). All finite points are of the form (a:b:1).

For more about the projective plane, see page 28 of [Kato et al.].

6.2.3 The Group Law is a Group Law

Let E be an elliptic curve of the form y^{2} = x^{3} + ax + b over a field K. Consider the set

E(K) = {O} ∪ {(x, y) ∈ K × K : y^{2} = x^{3} + ax + b} .

Recall from the last lecture that there is a natural way to endow the set E(K) with a group structure. Here’s how it works. First, the element O ∈ E(K) is the zero element of the group. Next, suppose P and Q are elements of E(K). Just like we did earlier, let R = (x_{3}, y_{3}) be the third point of intersection of E and the line determined by P and Q (try this with the graphs on pages 1 and 2). Define

P + Q = (x_{3}, −y_{3}).

(For what goes wrong if you try to define P + Q = (x_{3}, y_{3}), see your homework assignment.) There are various special cases to consider, such as when P = Q or the third point of intersection is O, but I will let you read about them in [Kato et al.].

It is not surprising that this binary operation on E(K) satisfies P + Q = Q + P. Also, the inverse of P = (x_{1}, y_{1}) is −P = (x_{1}, −y_{1}). The only other axiom to check in order to verify that + gives E(K) an abelian group structure is the associative law. This is simple but tedious to check using only elementary methods. The right way to prove that the associate law holds is to develop the theory of algebraic curves and define the group law in terms of divisor classes, but this is outside the scope of this course. For fun, we can coerce the amazingly cool (but complicated) computer algebra system Magma into verifying the associative law (over ℚ) for us:

// Define the field K = Q(a,b,x0,x1,x2)
K<a,b,x0,x1,x2> := FieldOfFractions(PolynomialRing(Rationals(),5));
// Define the polynomial ring R = K[y0,y1,y2]
R<y0,y1,y2> := PolynomialRing(K,3);
// Define a maximal ideal of R:
I := ideal<R | y0^2 - (x0^3+a*x0+b),
               y1^2 - (x1^3+a*x1+b),
               y2^2 - (x2^3+a*x2+b)>;
// The quotient L = R/I is a field that contains three
// distinct "generic" points on E.
L  := quo<R|I>;
// Define the elliptic curve y^2 = x^3 + a*x + b over L.
E  := EllipticCurve([L| a,b]);
// Let P0, P1, and P2 be three distinct "generic" points on E.
P0 := E![L|x0,y0]; P1 := E![L|x1,y1]; P2 := E![L|x2,y2];
// The algebraic formulas for the group law are built into MAGMA.
lhs := (P0 + P1) + P2;  rhs := P0 + (P1 + P2);

// Verify the associative law.
lhs eq rhs;
true     // Yeah, it works!

6.2.4 An Example Over a Finite Field

Let E be the elliptic curve y^{2} = x^{3} + 3x + 3 over the finite field

K = ℤ/5ℤ = {0, 1, 2, 3, 4}.

First, we find all points on E using PARI:

? for(x=0,4, for(y=0,4, if((y^2-(x^3+3*x+3))%5==0, print1([x,y],"  "))))
[3, 2]  [3, 3]  [4, 2]  [4, 3]

Thus E(K) = {O, (3, 2), (3, 3), (4, 2), (4, 3)} , so E(K) must be a cyclic abelian group of order 5. Let’s verify that E(K) is generated by (3, 2).

? e = ellinit([0,0,0,Mod(3,5),Mod(3,5)])
? ?ellpow    \\ type ?5 for a complete list of elliptic-curve functions
ellpow(e,x,n): n times the point x on elliptic curve e (n in Z).
? x = [3,2];
? for(n=1,5,print(n,"*[3,2] =  ",lift(ellpow(e,x,n))))
1*[3,2] =  [3, 2]
2*[3,2] =  [4, 3]
3*[3,2] =  [4, 2]
4*[3,2] =  [3, 3]
5*[3,2] =  [0]

6.2.5 Mordell’s Theorem

Venerable Problem: Find an algorithm that, given an elliptic curve E over ℚ, outputs a complete description of the set of rational points (x_{0}, y_{0}) on E.

This problem is difficult. In fact, so far it has stumped everyone! There is a conjectural algorithm, but nobody has succeeded in proving that it is really an algorithm, in the sense that it terminates for any input curve E. Several of your profs at Harvard, including Barry Mazur, myself, and Christophe Cornut (who will teach Math 129 next semester) have spent, or might spend, a huge chunk of their life thinking about this problem.

How could one possible “describe” the group E(ℚ), since it can be infinite? In 1923, Mordell proved that there is always a reasonable way to describe E(ℚ).

Theorem 6.5 (Mordell). The group E(ℚ) is finitely generated.

This means that there are points P_{1}, …, P_{s} ∈ E(ℚ) such that every element of E(ℚ) is of the form n_{1}P_{1} + ⋯ + n_{s}P_{s} for some n_{1}, … n_{s} ∈ ℤ. I will not prove Mordell’s theorem in this course, but see §1.3 of [Kato et al.]. Example 6.6. Consider the elliptic curve E given by y^{2} = x^{3} −6x−4. Then E(ℚ) ≈ (ℤ/2ℤ) × ℤ with generators (−2, 0) and (−1, 1). We have

5(−1, 1) = (−\frac{131432401}{121462441}, −\frac{1481891884199}{1338637562261}) .

Trying finding that point without knowing about the group law!

(0, 1) + (0, 1) = (−1/4, −9/8), (0, 1) + (0, 1) + (0, 1) = (72, 611), and (0, 1) + (0, 1) + (0, 1) + (0, 1) = (−\frac{287}{1296}, \frac{40879}{46656}).

6.3 Torsion Points and Mazur’s Big Theorem

6.3.1 Mordell’s Theorem

Venerable Problem: Find an algorithm that, given an elliptic curve E over ℚ, outputs a complete description of the set of rational points (x_{0}, y_{0}) on E.

This problem is difficult. In fact, so far it has stumped everyone! There is a conjectural algorithm, but nobody has succeeded in proving that it is really an algorithm, in the sense that it terminates for any input curve E. Several of your profs at Harvard, including Barry Mazur, myself, and Christophe Cornut (who will teach Math 129 next semester) have spent, or might spend, a huge chunk of their life thinking about variants of this problem.

How could one possible “describe” the group E(ℚ), since it can be infinite? In 1923, Mordell proved that there is always a reasonable way to describe E(ℚ).

Theorem 6.7 (Mordell). The group E(ℚ) is finitely generated.

This means that there are points P_{1}, …, P_{s} ∈ E(ℚ) such that every element of E(ℚ) is of the form n_{1}P_{1} + ⋯ + n_{s}P_{s} for some n_{1}, … n_{s} ∈ ℤ. I will not prove Mordell’s theorem in this course. See §1.3 of [Kato et al.] for a proof in the special case when E is given by an equation of the form y^{2} = (x − a)(x − b)(x − c). Example 6.8. Consider the elliptic curve E given by y^{2} = x^{3} −6x−4. Then E(ℚ) ≈ (ℤ/2ℤ) × ℤ with generators (−2, 0) and (−1, 1). We have

5(−1, 1) = (−\frac{131432401}{121462441}, −\frac{1481891884199}{1338637562261}) .

Trying finding that point without knowing about the group law!

6.3.2 Exploring the Possibilities

As E varies over all elliptic curves over ℚ, what are the possibilities for E(ℚ)? What finitely generated abelian groups occur? Mordell’s theorem implies that

E(ℚ) ≈ ℤ^{r} ⊕ E(ℚ)_{tor},

where E(ℚ)_{tor} is the set of points of finite order in E(ℚ) and ℤ^{r} ≈ E(ℚ)/E(ℚ)_{tor}. The number r is called the rank of E.

The Torsion Subgroup

Theorem 6.9 (Mazur, April 16, 1976). Let E be an elliptic curve over ℚ. Then E(ℚ)_{tor} is isomorphic to one of the following 15 groups:

ℤ/nℤ  for n ≤ 10 or n = 12,
(ℤ/2ℤ) × (ℤ/2nℤ)  for n ≤ 4.

As we will see in the next section, all of these torsion subgroups really do occur. Mazur’s theorem is very deep, and I can barely begin to hint at how he proved it. The basic idea is to define, for each positive integer N, a curve Y_{1}(N) with the magnificient property that the points of Y_{1}(N) with complex coordinates are in natural bijection with the (isomorphism classes of) pairs (E, P), where E is an elliptic curve and P is a point of E of order N. Moreover, Y_{1}(N) is amazing in that it has a rational point if and only if there is an elliptic curve over ℚ with a rational point of order N. I won’t define Y_{1}(N), but here it is for the first few N:

N  A curve that contains Y_{1}(N)
1 − 10, 12 a straight line; these have lots of points!
11  y^{2} + y = x^{3} − x^{2}
13  y^{2} = x^{6} + 2x^{5} + x^{4} + 2x^{3} + 6x^{2} + 4x + 1
14  y^{2} + xy + y = x^{3} − x
15  y^{2} + xy + y = x^{3} + x^{2}
16  y^{2} = (x − 1)(x + 1)(x^{2} − 2x − 1)(x^{2} + 1)
17  The intersection of the hypersurfaces in ℙ^{4} defined by:

ac − b^{2} + 5bd − 3be − c^{2} − 4cd + 2ce − 4d^{2} + 7de − 2e^{2},

ad − bc + bd − be + c^{2} − 2cd − 2d^{2} + 4de − e^{2}, and
ae − be − cd + 2d^{2} − 2de + e^{2}.
18  y^{2} = x^{6} + 4x^{5} + 10x^{4} + 10x^{3} + 5x^{2} + 2x + 1

(Some of the curves in the right hand column have a few obvious rational points, but these points “don’t count”.)

114 6. Elliptic Curves

Mazur proved that if N = 11 or N ≥ 13, then Y_{1}(N) has no rational points. This result, together with the theory surrounding Y_{1}(N), yields his theorem.

The Rank

Conjecture 6.10. There exist elliptic curves over ℚ of arbitrarily large rank.

As far as I know, nobody has any real clue as to how to prove Conjecture 6.10 (Doug Ulmer recently wrote a paper which gives theoretical evidence). The current “world record” is a curve of rank ≥ 24. It was discovered in January 2000 by Roland Martin and William McMillen of the National Security Agency. For security reasons, I won’t tell you anything about how they found it.

Theorem 6.11. The elliptic curve

y2+xy+y = x3−120039822036992245303534619191166796374x+504224992484910670010801799168082726759443756222911415116

over ℚ has rank at least 24. The following points P_{1}, ..., P_{24} are independent points on the curve:

P1 = (2005024558054813068, −16480371588343085108234888252)
P2 = (−4690836759490453344, −31049883525785801514744524804)
P3 = (4700156326649806635, −6622116250158424945781859743)
P4 = (6785546256295273860, −1456180928830978521107520473)
P5 = (6823803569166584943, −1685950735477175947351774817)
P6 = (7788809602110240789, −6462981622972389783453855713)
P7 = (27385442304350994620556, 4531892554281655472841805111276996)
P8 = (54284682060285253719/4, −296608788157989016192182090427/8)
P9 = (−94200235260395075139/25, −3756324603619419619213452459781/125)
P10 = (−3463661055331841724647/576, −439033541391867690041114047287793/13824)
P11 = (−6684065934033506970637/676, −473072253066190669804172657192457/17576)
P12 = (−956077386192640344198/2209, −2448326762443096987265907469107661/103823)
P13 = (−27067471797013364392578/2809, −4120976168445115434193886851218259/148877)
P14 = (−25538866857137199063309/3721, −7194962289937471269967128729589169/226981)
P15 = (−1026325011760259051894331/108241, −1000895294067489857736110963003267773/35611289)
P16 = (9351361230729481250627334/1366561, −2869749605748635777475372339306204832/1597509809)
P17 = (10100878635879432897339615/1423249, −5304965776276966451066900941489387801/1697936057)
P18 = (11499655868211022625340735/17522596, −1513435763341541188265230241426826478043/73349586856)
P19 = (110352253665081002517811734/21353641, −461706833308406671405570254542647784288/98675175061)
P20 = (414280096426033094143668538257/285204544, 266642138924791310663963499787603019833872421/4816534339072)
P21 = (36101712290699828042930087436/4098432361, −2995258855766764520463389153587111670142292/262377541318859)
P22 = (45442463408503524215460183165/5424617104, −3716041581470144108721590695554670156388869/399533898943808)
P23 = (983886013344700707678587482584/141566320009, −126615818387717930449161625960397605741940953/53264752602346277)
P24 = (1124614335716851053281176544216033/152487126016, −37714203831317877163580088877209977295481388540127/59545612760743936)

Proof. See

    http://listserv.nodak.edu/scripts/wa.exe?A2=ind0005&L=nmbrthry&P=R182

6.3.3 How to Compute E(ℚ)_{tor}

The following theorem yields an algorithm to compute E(ℚ)_{tor}.

Theorem 6.12 (Nagell-Lutz). Suppose that y^{2} = x^{3} + ax + b (with a, b ∈ ℤ) defines an elliptic curve E over ℚ, let Δ = −16(4a^{3} + 27b^{2}) be the discriminant, and suppose that P = (x, y) ∈ E(ℚ)_{tor}. Then x and y are integers and either y = 0, in which case P has order 2, or y^{2} | Δ.

Non-proof. I will not prove this theorem. However, you can find a readable proof in Chapter II of Silverman and Tate’s Rational Points on Elliptic Curves.

Warning: Nagell-Lutz is NOT an if and only if statement. There are points of infinite order that satisfy the conclusion of Theorem 6.12. For example, the point (1, 3) on y^{2} = x^{3} + 8 has integer coordinates and y^{2} = 9 | Δ = −16 · 27 · 3^{2}. However,

(1, 3) + (1, 3) = (−\frac{7}{4}, −\frac{13}{8}) .

Since the coordinates of (1, 3) + (1, 3) are not integers, it follows from the contrapositive (not converse!) of Nagell-Lutz that (1, 3) must be a point of infinite order. Example 6.13. The following is a list of elliptic curves with each possible torsion subgroup. Tom Womack (a graduate student in Nottingham, where

Robin Hood lives) has a web page, http://www.tom.womack.net/maths/torsion.htm,

which contains PARI code that lists infinitely many elliptic curve with each torsion subgroup.

Curve  E(ℚ)_{tor}
y^{2} = x^{3} − 2  {0}
y^{2} = x^{3} + 8  ℤ/2ℤ
y^{2} = x^{3} + 4  ℤ/3ℤ
y^{2} = x^{3} + 4x  ℤ/4ℤ
y^{2} − y = x^{3} − x^{2}  ℤ/5ℤ
y^{2} = x^{3} + 1  ℤ/6ℤ
y^{2} = x^{3} − 43x + 166  ℤ/7ℤ
y^{2} + 7xy = x^{3} + 16x  ℤ/8ℤ
y^{2} + xy + y = x^{3} − x^{2} − 14x + 29 ℤ/9ℤ
y^{2} + xy = x^{3} − 45x + 81  ℤ/10ℤ
y^{2} + 43xy − 210y = x^{3} − 210x^{2}  ℤ/12ℤ
y^{2} = x^{3} − 4x  (ℤ/2ℤ) × (ℤ/2ℤ)
y^{2} = x^{3} + 2x^{2} − 3x  (ℤ/4ℤ) × (ℤ/2ℤ)
y^{2} + 5xy − 6y = x^{3} − 3x^{2}  (ℤ/6ℤ) × (ℤ/2ℤ)
y^{2} + 17xy − 120y = x^{3} − 60x^{2}  (ℤ/8ℤ) × (ℤ/2ℤ)

The elltors function in PARI computes torsion subgroups:

? ?elltors
elltors(e,{flag=0}): torsion subgroup of elliptic curve e: order, structure,
generators. If flag = 0, use Doud's algorithm; if flag = 1, use Lutz-Nagell.
? e=ellinit([17,-60,-120,0,0]);
? elltors(e)
%4 = [16, [8, 2], [[30, -90], [-40, 400]]]
? e.disc
%5 = 51438240000
? e.disc % 90^2        \\ verify Nagell-Lutz
%6 = 0
? e.disc % 400^2       \\ verify Nagell-Lutz
%7 = 0

Exercises

6.1 Draw a beautiful graph of the set E(ℝ) of real points on each of the following elliptic curves:

(a) y^{2} = x^{3} − 1296x + 11664,

(b) y^{2} + y = x^{3} − x,

(c) y^{2} + y = x^{3} − x^{2} − 10x − 20.

6.2 A rational solution to the equation y^{2} − x^{3} = −2 is (3, 5). Find a rational solution with x ≠ 3 by drawing the tangent line to (3, 5) and computing the third point of intersection.

6.3 Consider the elliptic curve y^{2} + xy + y = x^{3} over ℚ. Find a linear change of variables that transforms this curve into a curve of the form Y^{2} = X^{3} + aX + b for rational numbers a and b.

6.4 Let E be the elliptic curve over the finite field K = ℤ/5ℤ defined by

the equation

y^{2} = x^{3} + x + 1.

(a) List all 9 elements of E(K).

(b) What is the structure of the group E(K), as a product of cyclic groups?

6.5 Let E be an elliptic curve over ℝ. Define a binary operation ⊞ on E(ℝ)

as follows:

P ⊞ Q = −(P + Q).

Thus the ⊞ of P and Q is the third point of intersection of the line through P and Q with E.

(a) Lists the axiom(s) of a group that fail for E(ℝ) equipped with this binary operation. (The group axioms are “identity”, “inverses”, and “associativity”.)

(b) Under what conditions on E(ℚ) does this binary operation define a group structure on E(ℚ)? (E.g., when E(ℚ) = {O} this binary operation does define a group.)

6.6 Let g(t) be a quartic polynomial with distinct (complex) roots, and let α be a root of g(t). Let β ≠ 0 be any number.

(a) Prove that the equations

x = \frac{β}{t − α}, y = x^{2}u = \frac{β^{2}u}{(t − α)^{2}}

give an “algebraic transformation” between the curve u^{2} = g(t) and the curve y^{2} = f(x), where f(x) is the cubic polynomial

f(x) = g′(α)βx^{3} + \frac{1}{2}g′′(α)β^{2}x^{2} + \frac{1}{6}g′′′(α)β^{3}x + \frac{1}{24}g′′′′(α)β^{4}.

(b) Prove that if g has distinct (complex) roots, then f also has distinct roots, and so u^{2} = g(t) is an elliptic curve.

6.7 In this problem you will finally find out exactly why elliptic curves are called “elliptic curves”! Let 0 < β ≤ α, and let C be the ellipse

\frac{x^{2}}{α^{2}} + \frac{y^{2}}{β^{2}} = 1.

(a) Prove that the arc length of C is given by the integral

4α ∫_{0}^{π/2} \sqrt{1 − k^{2} sin^{2} θ}dθ

for an appropriate choice of constant k depending on α and β.

(b) Check your value for k in (i) by verifying that when α = β, the integral yields the correct value for the arc length of a circle.

(c) Prove that the integral in (i) is also equal to

4α ∫_{0}^{1} \sqrt{\frac{1 − k^{2}t^{2}}{1 − t^{2}}} dt = 4α ∫_{0}^{1} \frac{1 − k^{2}t^{2}}{\sqrt{(1 − t^{2})(1 − k^{2}t^{2})}}dt.

(d) Prove that if the ellipse E is not a circle, then the equation

u^{2} = (1 − t^{2})(1 − k^{2}t^{2})

defines an elliptic curve (cf. the previous exercise). Hence the problem of determining the arc length of an ellipse comes down to evaluating the integral

∫_{0}^{1} \frac{1 − k^{2}t^{2}}{u} dt

on the “elliptic” curve u^{2} = (1 − t^{2})(1 − k^{2}t^{2}).

6.8 Suppose that P = (x, y) is a point on the cubic curve

y^{2} = x^{3} + ax + b.

(a) Verify that the x coordinate of the point 2P is given by the duplication formula

x(2P) = \frac{x^{4} − 2ax^{2} − 8bx + a^{2}}{4y^{2}} .

(b) Derive a similar formula for the y coordinate of 2P in terms of x and y.

(c) Find a polynomial in x whose roots are the x-coordinates of the points P = (x, y) satisfying 3P = O. [Hint: The relation 3P = O can also be written 2P = −P.]

(d) For the particular curve y^{2} = x^{3} + 1, solve the equation in (iii) to find all of the points satisfying 3P = O. Note that you will have to use complex numbers.

6.9 Let Φ be the set of the 15 possible groups of the form E(ℚ)_{tor} for E an elliptic curve over ℚ (see Lecture 27). For each group G ∈ Φ, if possible, find a finite field k = ℤ/pℤ and an elliptic curve E over k such that E(k) ≈ G. (Hint: It is a fact that |p + 1 − #E(ℤ/pℤ))| ≤ 2\sqrt{p}, so you only have to try finitely many p to show that a group G does not occur as the group of points on an elliptic curve over a finite field.)

6.10 Some number theorists, such as author at one point, incorrectly think that Lutz-Nagell works reasonably well in practice. Describe the steps you would take if you were to use the Lutz-Nagell theorem (Lecture 27) to compute the torsion subgroup of the elliptic curve E defined by the equation

y^{2} + xy = x^{3} − 8369487776175x + 9319575518172005625,

then tell me why it would be very time consuming to actually carry these steps out. Find the torsion subgroup of E using the elltors command in PARI. Does elltors use the Lutz-Nagell algorithm by default?

6.11 Let E be the elliptic curve defined by the equation y^{2} = x^{3} + 1.

(a) For each prime p with 5 ≤ p < 30, describe the group of points on this curve having coordinates in the finite field ℤ/pℤ. (You can just give the order of each group.)

(b) For each prime in (i), let N_{p} be the number of points in the group. (Don’t forget the point infinity.) For the set of primes satisfying p ≡ 2 (mod 3), can you see a pattern for the values of N_{p}? Make a general conjecture for the value of N_{p} when p ≡ 2 (mod 3).

(c) Prove your conjecture.

6.12 Let p be a prime and let E be the elliptic curve defined by the equation y^{2} = x^{3}+px. Use Lutz-Nagel to find all points of finite order in E(ℚ).

6.13 (a) Let E be an elliptic curve over the real numbers ℝ. Prove that E(ℝ) is not a finitely generated abelian group.

(b) Let E be an elliptic curve over a finite field k = ℤ/pℤ. Prove that E(k) is a finitely generated abelian group.

120 6. Elliptic Curves

7

Applications of Elliptic Curves

7.1 Cryptography

Today’s lecture is about an application of elliptic curves to cryptography.

Disclaimer: I do not endorse breaking laws, and give the examples below as a pedagogical tool in the hope of making the mathematics in our course more fun and relevant to everyday life. I don’t think I have violated the Digital Millenium Copyright Act, because I have given very few details about Microsoft’s actual protocols, and I’ve given absolutely no source code.

7.1.1 Microsoft Digital Rights Management

Today I will describe one way to use elliptic curves in cryptography. Our central example will involve version 2 of the Microsoft Digital Rights Management (MS-DRM) system, as applied to .wma audio files.

I learned about this protocol from a paper by “Beale Screamer”.

Microsoft’s Favorite Elliptic Curve

The elliptic curve used in MS-DRM is an elliptic curve over the finite field k = ℤ/pℤ, where

p = 785963102379428822376694789446897396207498568951.

As Beale Screamer remarks, this modulus has high nerd appeal because in hexadecimal it is

89ABCDEF012345672718281831415926141424F7,

which includes counting in hexadecimal, and digits of e, π, and \sqrt{2}. The Microsoft elliptic curve E is

y^{2} = x^{3} + 317689081251325503476317476413827693272746955927x
+ 79052896607878758718120572025718535432100651934.

We have

#E(k) = 785963102379428822376693024881714957612686157429,

and the group E(k) is cyclic with generator

B = (771507216262649826170648268565579889907769254176,
390157510246556628525279459266514995562533196655).

Nikita and Michael

Our heros Nikita and Michael love to share digital music when they aren’t out thwarting terrorists. When Nikita installed Microsoft’s content rights management software on her compute, it sneakily generated a private key

n = 670805031139910513517527207693060456300217054473,

which it very stealthily hid in bits and pieces of files (e.g., blackbox.dll, v2ks.bla, and IndivBox.key). In order for Nikita to play Juno Reactor’s latest hit juno.wma, her web browser contacts a Microsoft rights management partner. After Nikita gives Microsoft her credit card number, she is allowed to download a license to play juno.wma. Microsoft created the license using the ElGamal public-key cryptosystem (see below) in the group E(k). Nikita’s license file can now be used to unlock juno.wma, but only on Nikita’s computer. When she shares both juno.wma and the license file with Michael, he is very annoyed because he can’t play juno.wma. This is because Michael’s computer doesn’t know Nikita’s computer’s private key (that integer n above), so Michael’s computer can’t decrypt the license file.

                           juno.wma

7.1.2 The Elliptic Curve Discrete Logarithm Problem

Definition 7.1. If E is an elliptic curve over ℤ/pℤ and B is a point on E, then the discrete log problem on E to the base B is the following problem: given a point P ∈ E, find an integer n such that nB = P, if such an integer exists.

For example, let E be the elliptic curve given by y^{2} = x^{3} + x + 1 over the field ℤ/7ℤ. We have

E(ℤ/7ℤ) = {O, (2, 2), (0, 1), (0, 6), (2, 5)}.

If B = (2, 2) and P = (0, 6), then 3B = P, so n = 3 is a solution to the discrete logarithm problem.

To the best of my knowledge, the discrete logarithm problem on E is really hard unless #E(ℤ/pℤ) is “smooth”, i.e., a product of small primes, or E is “supersingular” in the sense that p | #E(ℤ/pℤ). The Microsoft curve has neither of these deficiencies, and I expect that the discrete logarithm on that curve is quite difficult. This is not the weekness that “Beale Screamer” exploits in breaking MS-DRM.

7.1.3 ElGamal

How can we set up a public-key cryptosystem using an elliptic curve? The only public-key crytosystem that we’ve studied so far is the RSA cryptosystem; unfortunately, there is no analogue of RSA for elliptic curves! (Informal Exercise: Think about what goes wrong.)

MS-DRM uses the El Gamal system. Here’s how it works. Start with a fixed, publicly known prime p, an elliptic curve E over ℤ/pℤ, and a point B ∈ E(ℤ/pℤ). Michael and Nikita choose random integers m and n, which are kept secret, and compute and publish mB and nB.

In order to send a message P to Michael, Nikita computes a random integer r and sends the pair of points (rB, P +r(mB)). To read the message, Michael multiplies rB by his secret key m to get m(rB) = r(mB), and subtracts this from the second point to get

P = P + r(mB) − r(mB).

As far as I can tell, breaking this cryptosystem requires solving the discrete logarithm problem, so it’s very difficult.

The following example is based on an example taken from Beale Screamer’s paper. Example 7.2. Nikita’s license files contains the pair of points (rB, P + r(nB)), where

rB = (179671003218315746385026655733086044982194424660, 697834385359686368249301282675141830935176314718)

and

P +r(nB) = (137851038548264467372645158093004000343639118915, 110848589228676224057229230223580815024224875699).

Nikita’s computer sneakily loads the secret key

n = 670805031139910513517527207693060456300217054473

into memory and computes

n(rB) = r(nB) = (328901393518732637577115650601768681044040715701, 586947838087815993601350565488788846203887988162).

It then subtracts this from P + r(nB) to get

P = (14489646124220757767, 669337780373284096274895136618194604469696830074).

That x coordinate, 14489646124220757767, is the top secret magic “content key” that unlocks juno.wma.

If Nikita knew the private key n that her computer generated, she could compute P herself and unlock juno.wma and share her music with Michael, just like she used to share her favorite CDs with Michael. Beale Screamer found a weakness in Microsoft’s system that let him find n:

“These secret keys are stored in linked lists ... interspersed with the code in the library. The idea is that they can be read by that library, used internally by that library, and never communicated outside the library. Since the IndivBox.key file is shuffled in a random way for each client, these keys would be extremely difficult to extract from the file itself. Fortunately, we don’t have to: these keys are part of the object state that is maintained by this library, and since the offset within this object of these secret keys is known, we can let the library itself extract the secret keys! The code for this simply loads up the ‘black box’ library, has it initialize an instance of the object, and then reads the keys right out of that object. This is clearly a weakness in the code which can be corrected by the DRM software fairly easily, but for now it is the basis of our exploit.”

As you can see, Microsoft has undertaken a difficult and interesting problem. How can Microsoft store data on Nikita’s computer in such a way that Nikita can not access it, but Nikita’s computer can?

7.1.4 Why Use Elliptic Curves?

There are several advantages to using elliptic curves instead of ℤ/pℤ for cryptography, though the people at RSA Corporation might disagree. Elliptic curve cryptosystems with smaller key sizes appear to be just as secure as “classical” ℤ/pℤ cryptosystems with much larger key sizes, so elliptic curve cryptosystems can be more efficient. Another advantage, which I won’t explain at all, is that elliptic curve cryptosystems appear to be vastly more secure over “large finite fields of characteristic 2” than RSA, which is is very important in practical applications. Also, elliptic curves are simply way cooler than ℤ/pℤ, so they (used to) attract venture capitalists.

Some mobile phones also use elliptic curve cryptography. Do you have an elliptic curve in your pocket right now?

/* Base conversion */
function ToDeci(s)
   c := ["0","1","2","3","4","5","6","7","8","9","a","b","c","d","e","f"];
   ans := 0;
   b := 1;
   for i in [1..#s] do
      ans := ans + b*(Index(c,s[#s-i+1])-1);
      b := b*16;
   end for;
   return ans;
end function;

p := 785963102379428822376694789446897396207498568951
k := GF(p);
E := EllipticCurve([317689081251325503476317476413827693272746955927,  79052896607878758718120572025718535432100651934]);
B  := E![k|771507216262649826170648268565579889907769254176, 390157510246556628525279459266514995562533196655];
rB := E![k|179671003218315746385026655733086044982194424660,697834385359686368249301282675141830935176314718];
PrnB := E![k|137851038548264467372645158093004000343639118915,110848589228676224057229230223580815024224875699];
n := 670805031139910513517527207693060456300217054473;
PrnB - n*rB;
(14489646124220757767 : 669337780373284096274895136618194604469696830074 : 1)

7.2 Factorization

In 1987, Hendrik Lenstra published the landmark paper Factoring Integers with Elliptic Curves, Annals of Mathematics, 126, 649–673, which you can download from the Math 124 web page. Lenstra’s method is also described in §IV.4 of Silverman and Tate’s Rational Points on Elliptic Curves, §VIII.5 of [Davenport], and in §10.3 of Cohen’s A Course in Computational Algebraic Number Theory.

In this lecture and the next, I will tell you about Lenstra’s clever algorithm. It shines at finding “medium sized” factors of an integer N, which these days means 10 to 20 decimal digits but probaby not 30 decimal digits. The ECM method is thus not useful for earning money by factoring RSA challenge numbers, but is essential when factoring most integers. It also has small storage requirements. Lenstra writes:

“It turns out that ... the elliptic curve method is one of the fastest integer factorization methods that is currently used in practice. The quadratic sieve algorithm still seems to perform better on integers that are built up from two prime numbers of the same order of magnitude; such integers are of interest in cryptography.”

Lenstra’s discover of the elliptic curve method was inspired by Pollard’s (p−1)-method. I will spend most of the rest of this lecture introducing you to it.

7.2.1 Power-Smoothness

Definition 7.3 (Power-smooth). Let B be a positive integer. A positive integer n is B-power-smooth if all prime powers dividing n are less than or equal to B. The power-smoothness of n is the largest B such that n is B-power-smooth.

The following two PARI functions compute whether or not an integer is B-power-smooth and also the power-smoothness of n.

{ispowersmooth(n, B) =   \\ true if and only if n is B-powersmooth
   local(F,i);
   F = factor(n);
   for(i=1,matsize(F)[1],if(F[i,1]^F[i,2]>B,return(0)));
   return(1);
}
{powersmoothness(n) =    \\ the powersmoothness of n.
   local(F,L,i);
   F = factor(n);
   L = 1;
   for(i=1,matsize(F)[1],L=max(L,F[i,1]^F[i,2]));

   return(L);
}

7.2.2 Pollard’s (p − 1)-Method

Let N be an integer that we wish to factor. Choose a positive integer B (usually ≤ 10^{6} in practice). The Pollard (p − 1)-method hunts for prime divisors p of N such that p − 1 is B-power-smooth. Here is the strategy. Suppose that p | N and a > 1 is an integer that is prime to p. By Fermat’s Little Theorem,

a^{p−1} ≡ 1 (mod p).

Assume that further that p−1 is B-power-smooth and let m = lcm(1, 2, 3, … B). Then B | m, so p − 1 | m, and so

a^{m} ≡ 1 (mod p).

Thus

p | gcd(a^{m} − 1, N) > 1.

Usually gcd(a^{m}−1, N) < N also, and when this is the case we have split N. In the unlikely case when gcd(a^{m} − 1, N) = N, then a^{m} ≡ 1 (mod q^{r}) for every prime power divisor of N. In this case, repeat the above steps but with a smaller choice of B (so that m is smaller). Also, it’s a good idea to check from the start whether or not N is not a perfect power M^{r}, and if so replace N by M.

In practice, we don’t know p. We choose a B, then an a, cross our fingers, and proceed. If we split N, great! If not, increase B or change a and try again.

For fixed B, this algorithm works when N is divisible by a prime p such that p − 1 is B-power-smooth. How many primes p have the property that p − 1 is B-power-smooth? Is this very common or not? Using the above two functions, we find that roughly 15% of primes p between 10^{15} and 10^{15} + 10000 are such that p − 1 is 10^{6} power-smooth.

\\ Count the number of B-power-smooth numbers an interval.
{cnt(B)= s=0;t=0;
   for(p=10^15, 10^15+10000,
      if(isprime(p),
         t++;if(ispowersmooth(p-1,B),s++)
      )
   );
   s/t*1.0
}
? cnt(10^6)
%5 = 0.1482889733840304182509505703

Thus the Pollard (p − 1)-method with B = 10^{6} is blind to 85% of the primes around 10^{15}. There are nontrivial theorems about densities of powersmooth numbers, but I will not discuss them today.

7.2.3 Pollard’s Method in Action!

We now illustrate the Pollard (p − 1)-method through several examples. Example 7.4. Let N = 5917. We try to use the Pollard p − 1 method with B = 5 to split N. We have m = lcm(1, 2, 3, 4, 5) = 60. Take a = 2. We have

2^{60} − 1 ≡ 3416 (mod 5917), (can compute quickly!)

so

gcd(2^{60} − 1, 5917) = gcd(3416, 5917) = 61.

Wow, we found a prime factor of N!

In PARI, these computations are carried out as follows:

      {lcmfirst(B) =  \\ compute the lcm of 1,2,3,...,B
          local(L,i);
          L=1;
          for(i=2,B,L=lcm(L,i));
          return(L);}
      ? lcmfirst(5)
      %8 = 60
      ? Mod(2,5917)^60 - 1
      %9 = Mod(3416, 5917)
      ? gcd(3416,5917)
      %10 = 61

Example 7.5. Let N = 779167. First try B = 5 and a = 2:

2^{60} − 1 ≡ 710980 (mod N),

and gcd(2^{60} − 1, N) = 1. Thus no prime divisor p of N has the property that p − 1 is 5-power-smooth. Next, we try B = 15. We have m = lcm(1, 2, …, 15) = 360360, and

2^{360360} − 1 ≡ 584876 (mod N),

so

gcd(2^{360360} − 1, N) = 2003,

and we have split N! Example 7.6. Let N = 61 · 71. Then both 61 − 1 = 60 = 2^{2} · 3 · 5 and 71 − 1 = 2 · 5 · 7 are 7-power-smooth, so Pollard’s (p − 1)-method with any B ≥ 7 will fail, but in a confidence-inspiring way. Suppose B = 7, so m = lcm(1, 2, …, 7) = 420. Then

2^{420} − 1 ≡ 0 (mod N),

so gcd(2^{420} − 1, N) = N, and we get nothing. If we shrink B to 5, then Pollard works:

2^{60} − 1 ≡ 1464 (mod N),

and gcd(2^{60} − 1, N) = 61, so we split N.

7.2.4 Motivation for the Elliptic Curve Method

Fix an integer B. If N = pq with p and q prime and neither p − 1 nor q − 1 a B-power-smooth number, then the Pollard (p − 1)-method is extremely unlikely to work. For example, let B = 20 and suppose that N = 59 · 101 = 5959. Note that neither 59−1 = 2·29 nor 107−1 = 2·53 is B-power-smooth. With m = lcm(1, 2, 3, …, 20) = 232792560, we have

2^{m} − 1 ≡ 5944 (mod N),

and gcd(2^{m} − 1, N) = 1, so we get nothing.

As remarked above, the problem is that p−1 is not 20-power-smooth for either p = 59 or p = 101. However, notice that p − 2 = 3 · 19 is 20-power-smooth! If we could somehow replace the group (ℤ/pℤ)^{∗}, which has order p − 1, by a group of order p − 2, and compute a^{m} for an element of this new group, then we might easily split N. Roughly speaking, this is what Lenstra’s elliptic curve factorization method does; it replaces (ℤ/pℤ)^{∗} by an elliptic curve E over ℤ/pℤ. The order of the group E(ℤ/pℤ) is p + 1 ± s for some nonnegative integer s < 2\sqrt{p} (any s can occur). For example, if E is the elliptic curve

y^{2} = x^{3} + x + 54

over ℤ/59ℤ then E(ℤ/59ℤ) is cyclic of order 57. The set of numbers 59+1±s for s ≤ 15 contain numbers with very small power-smoothness.

I won’t describe the elliptic curve factorization method until the next lecture. The basic idea is as follows. Suppose that we wish to factor N. Choose an integer B. Choose a random point P and a random elliptic curve y^{2} = x^{3} + ax + b “over ℤ/Nℤ” that goes through P. Let m = lcm(1, 2, …, B). Try to compute mP working modulo N and using the group law formulas. If at some point it is necessary to divide modulo N, but division is not possible, we (usually) find a nontrivial factor of N. Something going wrong and not being able to divide is analogous to a^{m} being congruent to 1 modulo p.

More details next time!

7.2.5 The Elliptic Curve Method

{isalmostpowersmooth(p,B)= local(r);
for(r=p+1-floor(2*sqrt(p)),p+1+floor(2*sqrt(p)),
if(ispowersmooth(r,B), return(1)) ) }
cnt(B)=s=0;t=0;for(p=10^15,10^15+10000,
if(isprime(p),t++;if(isalmostpowersmooth(p,B),s++,print("BAD
",p));print(s/t*1.0))); s/t*1.0

I constructed N = 800610470601655221392794180058088102053408423 by multiplying together five random (and promptly forgotten) primes p with the property that p − 1 is not B-power-smooth for B = 10^{8}. Since N is a product of five not-too-big primes, N begs to be factored using the elliptic curve method.

7.2.6 The Elliptic Curve Method (ECM)

The following description of the algorithm is taken from Lenstra’s paper [Factoring Integers with Elliptic Curves, Annals of Mathematics, 126, 649– 673], which you can download from the Math 124 web page.

Cohen and Lenstra

“The new method is obtained from Pollard’s (p − 1)- method by replacing the multiplicative group by the group of points on a random elliptic curve. To find a non-trivial divisor of an integer n > 1, one begins by selecting an elliptic curve E over ℤ/nℤ, a point P on E with coordinates in ℤ/nℤ, and an integer k as above [k = lcm(2, 3, …, B)]. Using the addition law of the curve, one next calculates the multiple k·P of P. One now hopes that there is a prime divisor p of n for which k ·P and the neutral element O of the curve become the same modulo p; if E is given by a homogeneous Weierstrass equation y^{2}z = x^{3} +axz^{2} +bz^{3}, with O = (0 : 1 : 0), then this is equivalent to the zcoordinate of k · P being divisible by p. Hence one hopes to find a non-trivial factor of n by calculating the greatest common divisor of this z-coordinate with n.”

If the above algorithm fails with a specific elliptic curve E, there is an option that is unavailable with Pollard’s (p − 1)-method. We may repeat the above algorithm with a different choice of E. The number of points on E over ℤ/pℤ is of the form p + 1 − t for some t with |t| < 2\sqrt{p}, and the algorithm is likely to succeed if p + 1 − t is B-power-smoth.

Suppose that P = (x_{1}, y_{1}) and Q = (x_{2}, y_{2}) are nonzero points on an elliptic curve y^{2} = x^{3}+ax+b and that P ≠ ±Q. Let λ = (y_{1}−y_{2})/(x_{1}−x_{2}) and ν = y_{1} − λx_{1}. Recall that P + Q = (x_{3}, y_{3}) where

x_{3} = λ^{2} − x_{1} − x_{2}  and  y_{3} = −λx_{3} − ν.

If we do arithmetic on an elliptic curve modulo N and at some point we can not compute λ because we can not compute the inverse modulo N of x_{1} − x_{2}, then we (usually) factor N.

7.2.7 Implementation and Examples

For simplicity, we use an elliptic curve of the form

y^{2} = x^{3} + ax + 1,

which has the point P = (0, 1) already on it.

The following tiny PARI function implements the ECM. It generates an error message along with a usually nontrivial factor of N exactly when the ECM succeeds.

{ECM(N, m)= local(E);
   E = ellinit([0,0,0,random(N),1]*Mod(1,N));
   print("E: y^2 = x^3 + ",lift(E[4]),"x+1,  P=[0,1]");
   ellpow(E,[0,1]*Mod(1,N),m);  \\ this fails if and only if we win!
}

The following two functions are also useful:

{lcmfirst(B) =
   local(L,i); L=1; for(i=2,B,L=lcm(L,i));
   return(L);
}
numpoints(a,p) = return(p+1 - ellap(ellinit([0,0,0,a,1]),p));

First we will try the program on a small integer N, then we will try it on the N at the top of this lecture. (ECM uses the random function, so the results of your run may differ from the one below.)

? N = 5959;           \\ This number motivated the ECM last time.
\\ Recall what happened when we tried to factor 5959 using the p-1 method.
? m = lcmfirst(20);   \\ B = 20.
? Mod(2,N)^m-1
%108 = Mod(5944, 5959)
? gcd(5944,5959)
%109 = 1               \\ bummer!
\\ Now we try the ECM:
? ECM(N,m)
E: y^2 = x^3 + 1201x+1,  P=[0,1]
%112 = [Mod(666, 5959), Mod(3229, 5959)]
? ECM(N,m)
E: y^2 = x^3 + 1913x+1,  P=[0,1]
  ***   impossible inverse modulo: Mod(101, 5959).

\\ Wonderful!! There's a factor--------/\
? factor(numpoints(1913,101))
%120 =
[2 4]                          \\ #E(Z/101) is 16-power-smooth,
[7 1]                          \\ so ECM sees 101.
? factor(numpoints(1913,59))
%119 =
[2 1]                          \\ #E(Z/59) is 29-power-smooth,
[29 1]                         \\ so ECM doesn't see 59.
\\ Here's the view from another angle:
? E = ellinit([0,0,0,1752,0]*Mod(1,5959));
? P = [0,1]*Mod(1,5959);
? ellpow(E,P,2)
%127 = [Mod(4624, 5959), Mod(1495, 5959)]
? ellpow(E,P,3)
%128 = [Mod(3435, 5959), Mod(1031, 5959)]
? ellpow(E,P,4)
%129 = [Mod(803, 5959), Mod(5856, 5959)]
? ellpow(E,P,8)
%133 = [Mod(1347, 5959), Mod(2438, 5959)]
? ellpow(E,P,m)
  ***   impossible inverse modulo: Mod(101, 5959).

Now we are ready to try the big integer N from the begining of the lecture.

? N = 800610470601655221392794180058088102053408423;
? B = 100;
? m = lcmfirst(B);
? ECM(N,m);
E: y^2 = x^3 + 273687051132207711452727265152539544370874547x+1,  P=[0,1]
... many tries ..
? ECM(N,m);
E: y^2 = x^3 + 174264237886300715545169749498695137077020788x+1,  P=[0,1]
? B=1000;  \\ give up and try a bigger B.
? m=lcmfirst(B);
? ECM(N,m);
E: y^2 = x^3 + 652986182461202633808585244537305097270008449x+1,  P=[0,1]
... many tries ...
? ECM(N,m);
E: y^2 = x^3 + 755060727645891482095225151281965348765197238x+1,  P=[0,1]
? B=10000; \\ try an even bigger B
? m=lcmfirst(B);
? ECM(N,m);
E: y^2 = x^3 + 722355978919416556225676818691766898771312229x+1,  P=[0,1]

? ECM(N,m);
E: y^2 = x^3 + 124781379199538996805045456359983628056546634x+1,  P=[0,1]
? ECM(N,m);
E: y^2 = x^3 + 350310715627251979278144271594744514052364663x+1,  P=[0,1]
? ECM(N,m);
E: y^2 = x^3 + 39638500146503230913823829562620410547947307x+1,  P=[0,1]
  ***   impossible inverse modulo: Mod(1004320322301182911,
                            800610470601655221392794180058088102053408423).

Thus N = N_{1}·N_{2} = 1004320322301182911·797166454590134548773760793. One checks that neither N_{1} nor N_{2} is prime. Next we try ECM on each:

? N1 = 1004320322301182911; N2 = N / N1;
? ECM(N1,m);
E: y^2 = x^3 + 725771039569085210x+1,  P=[0,1]
  ***   impossible inverse modulo: Mod(1406051123, 1004320322301182911).
? ECM(N2,m);
E: y^2 = x^3 + 573369475441522110156437806x+1,  P=[0,1]
  ***   impossible inverse modulo: Mod(2029256729,
                                        797166454590134548773760793).

Now

N = N_{1,1}·N_{1,2}·N_{2,1}·N_{2,2} = 1406051123·714284357·2029256729·392836669307471617,

and one can check that N_{1,1}, N_{1,2}, N_{2,1} are prime but that N_{2,2} is composite. Again, we apply ECM:

? N22 = 392836669307471617
%173 = 392836669307471617
? ECM(N22,m)
E: y^2 = x^3 + 133284810657519512x+1,  P=[0,1]
%174 = [0]
? ECM(N22,m)
E: y^2 = x^3 + 368444010842952211x+1,  P=[0,1]
%175 = [Mod(236765299763600601, 392836669307471617),
                       Mod(63845045623767003, 392836669307471617)]
? ECM(N22,m)
E: y^2 = x^3 + 245772885854824846x+1,  P=[0,1]
%176 = [0]
? ECM(N22,m)
E: y^2 = x^3 + 33588046732320063x+1,  P=[0,1]
  ***   impossible inverse modulo: Mod(615433499, 392836669307471617).

This time it took a long time to factor N_{2,2} because m is too large so we often get both factors. A smaller m would have worked more quickly. In any case, we discover that the prime factorization is

N = 1406051123 · 714284357 · 2029256729 · 615433499 · 638308883.

7.2.8 How Good is ECM?

According to Henri Cohen (page 476 of A Course in Computational Algebraic Number Theory):

“Unique among modern factoring algorithms however, it is sensitive to the size of the prime divisors . In other words, its running time depends on the size of the smallest prime divisor p of N, and not on N itself. Hence, it can be profitably used to remove “small” factors [...]. Without too much trouble, it can find prime factors having 10 to 20 decimal digits [with B around 10^{4}]. On the other hand, it very rarely finds prime factors having more than 30 decimal digits.

7.3 Fermat’s Last Theorem and Modularity

In this section we sketch an outline of the proof of Fermat’s last theorem, then give a rigorous account of what it means for an elliptic curve to be “modular”.

7.3.1 Fermat’s Last Theorem

Theorem 7.7. Let n > 2 be an integer. If a, b, c ∈ ℤ and

a^{n} + b^{n} = c^{n},

then abc = 0.

Proof (sketch). First reduce to the case when n = ℓ is a prime greater than 3 (see Exercise 7.8). Suppose that

a^{ℓ} + b^{ℓ} = c^{ℓ}

with a, b, c ∈ ℤ and abc ≠ 0. Permuting (a, b, c), we may suppose that b is even and that we have a ≡ 3 (mod 4). Following Gerhard Frey, consider the elliptic curve E defined by

y^{2} = x(x − a^{ℓ})(x + b^{ℓ}).

The discriminant of E is 2^{4}(abc)^{2ℓ} (see Exercise 7.9 below).

Andrew Wiles and Richard Taylor [Annals of Math., May 1995] proved that E must be “modular”. This means that there is a “modular form”

f(z) = ∑_{n=1}^{∞} a_{n}e^{2πinz}

of “level N = abc” such that for all primes p ∤ abc,

a_{p} = p + 1 − #E(ℤ/pℤ).

Ken Ribet [Inventiones Math., 1991] used that the discriminant of E is a perfect ℓth power (away from 2) to prove that there is a cuspidal modular form

g(z) = ∑_{n=1}^{∞} b_{n}e^{2πinz}

of “level 2” such that

a_{p} ≡ b_{p} (mod ℓ) for all p ∤ abc.

This is a contradiction because the space of “cuspidal modular forms” of level 2 has dimension 0 (see Section 7.3.3).

Exercise 7.8. Reduce to the prime case. That is, show that if Fermat’s last theorem is true for prime exponents, then it is true. Exercise 7.9. Prove that y^{2} = x(x − a^{ℓ})(x + b^{ℓ}) has discriminant 2^{4}(abc)^{2ℓ}.

The rest of this lecture is about the words in the proof that are in quotes.

7.3.2 Holomorphic Functions

The complex upper half plane is the set

𝔥 = {z ∈ ℂ : Im(z) > 0}.

A holomorphic function f : 𝔥 → ℂ is a function such that for all z ∈ 𝔥 the derivative

f′(z) = lim_{h→0} \frac{f(z + h) − f(z)}{h}

exists. Holomorphicity is a very strong condition because h ∈ ℂ can approach 0 in many ways. Example 7.10. Let SL_{2}(ℤ) denote the set of 2 × 2 integers matrices with determinant 1. If γ = ( \begin{matrix}a & b \\ c & d \end{matrix} ) ∈ SL_{2}(ℤ), then the corresponding linear fractional transformation

γ(z) = \frac{az + b}{cz + d}

is a holomorphic function on 𝔥. (Note that the only possible pole of γ is −\frac{d}{c}, which is not an element of 𝔥.)

For future use, note that if f : 𝔥 → ℂ is a holomorphic function, and

γ = ( \begin{matrix}a & b \\ c & d \end{matrix} ) ∈ SL_{2}(ℤ), then

f|_{γ}(z) = f(γ(z))(cz + d)^{−2}

is again a holomorphic function.

Example 7.11. Let q(z) = e^{2πiz}. Then q is a holomorphic function on 𝔥 and q′ = 2πiq. Moreover, q defines a surjective map from 𝔥 onto the punctured open unit disk D = {z ∈ ℂ : 0 < |z| < 1}.

7.3.3 Cuspidal Modular Forms

Let N be a positive integer and consider the set

Γ_{0}(N) = \{(\begin{matrix}a & b \\ c & d \end{matrix}) ∈ SL_{2}(ℤ) : N | c\} .

Definition 7.12 (Cuspidal Modular Form). A cuspidal modular form of level N is a holomorphic function f : 𝔥 → ℂ such that

1. f|_{γ} = f for all γ ∈ Γ_{0}(N),

2. for every γ ∈ SL_{2}(ℤ),

lim_{z→∞} f(γ(z)) = 0,

and

3. f has a Fourier expansion:

f = ∑_{n=1}^{∞} a_{n}q^{n}.

Exercise 7.13. Prove that condition 3 is implied by conditions 1 and 2, so condition 3 is redundant. [Hint: Since γ = ( \begin{matrix}1 & 1 \\ 0 & 1 \end{matrix} ) ∈ Γ_{0}(N), condition 1 implies that f(z + 1) = f(z), so there is a function F (q) on the open punctured unit disc such that F (q(z)) = f(z). Condition 2 implies that lim_{q→0} F (q) = 0, so by complex analysis F extends to a holomorphic function on the full open unit disc.]

Definition 7.14. The q-expansion of f is the Fourier expansion f = ∑_{n=1}^{∞} a_{n}q^{n}.

Exercise 7.15. Suppose that f ∈ S_{2}(Γ_{0}(N)). Prove that

f(z)dz = f(γ(z))d(γ(z))

for all γ ∈ Γ_{0}(N). [Hint: This is simple algebraic manipulation.]

Exercise 7.16. Let S_{2}(Γ_{0}(N)) denote the set of cuspidal modular forms of level N. Prove that S_{2}(Γ_{0}(N)) forms a ℂ-vector space under addition.

The Dimension of S_{2}(Γ_{0}(N))

The dimension of S_{2}(Γ_{0}(N)) is

dim_{ℂ} S_{2}(Γ_{0}(N)) = 1 + \frac{μ}{12} − \frac{ν_{2}}{4} − \frac{ν_{3}}{3} − \frac{ν_{∞}}{2} ,

where μ = N ∏_{p|N}(1 + 1/p), and ν_{2} = ∏_{p|N} (1 + (\frac{−4}{p})) unless 4 | N in

which case ν_{2} = 0, and ν_{3} = ∏_{p|N} (1 + (\frac{−3}{p})) unless 2 | N or 9 | N in which case ν_{3} = 0, and ν_{∞} = ∑_{d|N} φ(gcd(d, N/d)). For example,

dim_{ℂ} S_{2}(Γ_{0}(2)) = 1 + \frac{3}{12} − \frac{1}{4} − \frac{0}{3} − \frac{2}{2} = 0,

and

dim_{ℂ} S_{2}(Γ_{0}(11)) = 1 + \frac{12}{12} − \frac{0}{4} − \frac{0}{3} − \frac{2}{2} = 1.

One can prove that the vector space S_{2}(Γ_{0}(11)) has basis

f = q ∏_{n=1}^{∞}(1 − q^{n})^{2}(1 − q^{11n})^{2} = q − 2q^{2} − q^{3} + 2q^{4} + q^{5} + 2q^{6} − 2q^{7} + · · · .

Exercise 7.17. Compute the dimension of S_{2}(Γ_{0}(25)).

7.3.4 Modularity of Elliptic Curves

Let E be an elliptic curve defined by a Weierstrass equation y^{2} = x^{3}+ax+b with a, b ∈ ℚ. For each prime p ∤ Δ = −16(4a^{3} + 27b^{2}), set

a_{p} = p + 1 − #E(ℤ/pℤ).

Definition 7.18 (Modular). E is modular if there exists a cuspidal modular form

f(z) = ∑_{n=1}^{∞} b_{n}q^{n} ∈ S_{2}(Γ_{0}(Δ))

such that b_{p} = a_{p} for all p ∤ Δ.

At first glance, modularity appears to be a bizarre and unlikely property for an elliptic curve to have. When poor Taniyama (and Shimura) first suggested in 1955 that every elliptic curve is modular, people were dubious. But Taniyama was right. The proof of that conjecture is one of the crowning achievements of number theory.

Theorem 7.19 (Breuil, Conrad, Diamond, Taylor, Wiles). Every elliptic curve over ℚ is modular.

Wiles

Exercises

7.1 Make up a simple example that illustrates how to use the ElGamal elliptic curve cryptosystem (see Lecture 29). You may mention Nikita and Michael if you wish. Be very clear about what you are illustrating so that the grader can effortlessly understand your example.

7.2 Make up an example that illustrates an interesting aspect of the Pollard (p − 1) factorization method.

7.3 Make up an example that illustrates something that you consider an interesting aspect of Lenstra’s elliptic curves factorization method.

7.4 Let R be a ring. We say that Fermat’s last theorem is false in R if there exists x, y, z ∈ R and n ∈ ℤ with n ≥ 3 such that x^{n} + y^{n} = z^{n} and xyz ≠ 0. For which prime numbers p is Fermat’s last theorem false in the ring ℤ/pℤ?

8

The Birch and Swinnerton-Dyer Conjecture

This chapter is about the Birch and Swinnerton-Dyer conjecture, which is considered by many people to be the most important accessible open problem in number theory. Today I will guide you through Wiles’s Clay Math Institute paper on the Birch and Swinnerton-Dyer conjecture.

8.1 Introduction

On Friday, I will talk about the following open problem, which is a frustrating specific case of the Birch and Swinnerton-Dyer conjecture. Let E be the elliptic curve defined by

y^{2} + xy = x^{3} − x^{2} − 79x + 289.

Denote by L(E, s) = ∑_{n=1}^{∞} a_{n}n^{−s} the corresponding L-series, which extends to a function everywhere. The graph of L(E, s) for s ∈ (0, 5) is given on the next page. It can be proved that E(ℚ) ≈ ℤ^{4} by showing that

(8, 7), (\frac{120}{27}, \frac{29}{27}) , (\frac{70}{8}, \frac{81}{8}) , and (\frac{564}{8}, \frac{665}{64})

generate a “subgroup of finite index” in E(ℚ). The Birch and Swinnerton-Dyer Conjecture then predicts that

ord_{s=1} L(E, s) = 4,

which looks plausible from the shape of the graph on the next page. It is relatively easy to prove that the following is equivalent to showing that ord_{s=1} L(E, s) = 4:

Open Problem: Prove that L′′(E, 1) = 0.

If you could solve this open problem, people like Gross, Tate, Mazur, Zagier, Wiles, me, etc., would be very excited. The related problem of giving an example of an L-series with ord_{s=1} L(E, s) = 3, was solved as a consequence of a very deep theorem of Gross and Zagier, and resulting in an effective solution to Gauss’s class number problem.

John Tate gave a talk about the BSD conjecture for the Clay Math Institute. I strongly encourage you to watch it online at

http://www.msri.org/publications/ln/hosted/cmi/2000/cmiparis/index-tate.html

y  x

The L-series of the “simplest” known elliptic curve of rank 4.

8.2 The Conjecture

8.2.1 The BSD Conjecture

Let E be an elliptic curve over ℚ given by an equation

y^{2} = x^{3} + ax + b

with a, b ∈ ℤ. For p ∤ Δ = −16(4a^{3} + 27b^{2}), let a_{p} = p + 1 − #E(ℤ/pℤ). Let

L(E, s) = ∏_{p∤Δ} \frac{1}{1 − a_{p}p^{−s} + p^{1−2s}} .

Theorem 8.1 (Breuil, Conrad, Diamond, Taylor, Wiles). L(E, s) extends to an analytic function on all of ℂ.

Conjecture 8.2 (Birch and Swinnerton-Dyer). The Taylor expansion of L(E, s) at s = 1 has the form

L(E, s) = c(s − 1)^{r} + higher order terms

with c ≠ 0 and E(ℚ) ≈ ℤ^{r} × E(ℚ)_{tor}.

A special case of the conjecture is the assertion that L(E, 1) = 0 if and only if E(ℚ) is infinite. The assertion “L(E, 1) = 0 implies that E(ℚ) is infinite” is the part of the conjecture that secretely motives much of my own research.

8.2.2 What is Known

On page 5 of Wiles’s paper, he discusses the history of the following theorem.

Theorem 8.3 (Gross, Kolyvagin, Zagier, et al.). Suppose that

L(E, s) = c(s − 1)^{r} + higher order terms

with r ≤ 1. Then the Birch and Swinnerton-Dyer conjecture is true for E, that is, E(ℚ) ≈ ℤ^{r} ⊕ E(ℚ)_{tor}.

I suspect that most elliptic curves satisfy the hypothesis of the above theorem, i.e., they have rank 0 or 1. For example, almost 96% of the “first 78198” elliptic curves have r ≤ 1. I suspect that the curves with r > 1 have “density” 0 amongst all elliptic curves. This doesn’t mean that we are done. In practice it is often the curves with r > 1 that are interesting and useful, and experts can still be observed saying “almost nothing is known about the Birch and Swinnerton-Dyer conjecture”.

8.2.3 How to Compute L(E, s) with a Computer

Best Models

Let E be an elliptic curve over ℚ, defined by a Weierstrass equation

y^{2} + a_{1}xy + a_{3}y = x^{3} + a_{2}x^{2} + a_{4}x + a_{6}.

There are many choices of Weierstrass equations that define an elliptic curve that is “essentially the same” as E. E.g., you found others by completing the square. Among all of these, there is a best possible model, which is the one with smallest discriminant. It can be computed in PARI as follows:

? E = ellinit([0,0,0,-43,166]);
? E.disc
%61 = -6815744
? E = ellchangecurve(E,ellglobalred(E)[2])
%62 = [1, -1, 1, -3, 3, ...]
? E.disc
%63 = -1664

Thus y^{2} + xy + y = x^{3} − x^{2} − 3x + 3 is a “better” model than y^{2} = x^{3} − 43x + 166.

WARNING: Some of the elliptic curves functions in PARI will LIE if you give as input an elliptic curve that is defined by a model that isn’t the best possible. These devious liars include elltors, ellap, ellak, and

elllseries.

Formula for L(E, s)

As mentioned before, the PARI function elllseries can compute L(E, s). I figured out how this function works, and explain it below.

Because E is modular, one can show that we have the following rapidlyconverging series expression for L(E, s), for s > 0:

L(E, s) = N^{−s/2} · (2π)^{s} · Γ(s)^{−1} · ∑_{n=1}^{∞} a_{n} · (F_{n}(s − 1) − εF_{n}(1 − s))

where

F_{n}(t) = Γ (t + 1, \frac{2πn}{\sqrt{N}} ) · (\frac{\sqrt{N}}{2πn} )^{t+1} .

Here

Γ(z) = ∫_{0}^{∞} t^{z−1}e^{−t}dt

is the Γ-function (e.g., Γ(n) = (n − 1)!), and

Γ(z, α) = ∫_{α}^{∞} t^{z−1}e^{−t}dt

is the incomplete Γ-function. The number N is called the conductor of E and is very similar to the discriminant of E; it is only divisible by primes that divide the best possible discriminant of E. You can compute N using

the PARI command ellglobalred(E)[1].

As usual, for p ∤ Δ, we have

a_{p} = p + 1 − #E(ℤ/pℤ),

and for r ≥ 2,

a_{p^{r}} = a_{p^{r−1}}a_{p} − pa_{p^{r−2}},

and a_{nm} = a_{n}a_{m} if gcd(n, m) = 1 (I won’t define the a_{p} when p | Δ, but it’s not difficult.) Finally, ε depends only on E and is either +1 or −1. I won’t define ε either, but you can compute it in PARI using ellrootno(E).

At s = 1, the formula can be massively simplified, and we have

L(E, 1) = (1 + ε) · ∑_{n=1}^{∞} \frac{a_{n}}{n} e^{−2πn/\sqrt{N}}.

This sum converges rapidly, because e^{−2πn/\sqrt{N}} → 0 quickly as n → ∞.

8.3 A Rationality Theorem

In the last lecture, I mentioned that it can be surprisingly difficult to say anything precise about L(E, s), even with the above formulas. For example, it is a very deep theorem of Gross and Zagier that for the elliptic curve y^{2} + y = x^{3} − 7x + 6 we have

L(E, s) = c(s − 1)^{3} + higher order terms,

and nobody has any idea how to prove that there is an elliptic curve with

L(E, s) = c(s − 1)^{4} + higher order terms.

Fortunately, it is possible to decide whether or not L(E, 1) = 0.

Theorem 8.4. Let y^{2} = x^{3} + ax + b be an elliptic curve. Let

Ω_{E} = 2^{n} ∫_{γ}^{∞} \frac{dx}{\sqrt{x^{3} + ax + b}},

where γ is the largest real root of x^{3} +ax+b, and n = 0 if Δ(E) < 0, n = 1 if Δ(E) > 0. Then

\frac{L(E, 1)}{Ω_{E}} ∈ ℚ,

and the denominator is ≤ 24.

In practice, one computes Ω_{E} using the “Arithmetic-Geometric Mean”, NOT numerical integration. In PARI, Ω_{E} is approximated by E.omega[1]*2^(E.disc>0). Remark 8.5. I don’t know if the denominator is ever really as big as 24. It would be a fun student project to either find an example, or to understand the proof that the quotient is rational and prove that 24 can be replaced by something smaller. Example 8.6. Let E be the elliptic curve y^{2} = x^{3} − 43x + 166. We compute L(E, 1) using the above formula and observe that L(E, 1)/Ω_{E} appears to be a rational number, as predicted by the theorem.

? E = ellinit([0,0,0,-43,166]);
? E = ellchangecurve(E, ellglobalred(E)[2]);
? eps = ellrootno(E)
%77 = 1
? N = ellglobalred(E)[1]
%78 = 26
? L = (1+eps) * sum(n=1,100, ellak(E,n)/n * exp(-2*Pi*n/sqrt(N)))
%79 = 0.6209653495490554663758626727
? Om = E.omega[1]*2^(E.disc>0)
%80 = 4.346757446843388264631038710
? L/Om
%81 = 0.1428571428571428571428571427
? contfrac(L/Om)
%84 = [0, 7]
? 1/7.0
%85 = 0.1428571428571428571428571428
? elltors(E)
%86 = [7, [7], [[1, 0]]]

Notice that in this example, L(E, 1)/Ω_{E} = 1/7 = 1/#E(ℚ). This is shadow of a more refined conjecture of Birch and Swinnerton-Dyer. Example 8.7. In this example, we verify that L(E, 1) = 0 computationally.

? E=ellinit([0, 1, 1, -2, 0]);
? L1 = elllseries(E,1)
%4 = -6.881235151133426545894712438 E-29
? Omega = E.omega[1]*2^(E.disc>0)
%5 = 4.980425121710110150642715583
? L1/Omega
%6 = 1.795732353252503036074927634 E-20

8.4 Approximating the Rank

Fix an elliptic curve E over ℚ.

The usual method to approximate the rank is to find a series that rapidly converges to L^{(r)}(E, 1) for r = 0, 1, 2, 3, …, then compute L(E, 1), L′(E, 1), L^{(2)}(E, 1), etc., until one appears to be nonzero. You can read about this method in §2.13 of Cremona’s book Algorithms for Elliptic Curves. For variety, I will describe a slightly different method that I’ve played with recently, which uses the formula for L(E, s) from the last lecture, the definition of the derivative, and a little calculus.

Proposition 8.8. Suppose that

L(E, s) = c(s − 1)^{r} + higher terms.

Then

lim_{s→1} (s − 1) · \frac{L′(E, s)}{L(E, s)} = r.

Proof. Write

L(s) = L(E, s) = c_{r}(s − 1)^{r} + c_{r+1}(s − 1)^{r+1} + · · · .

Then

lim_{s→1} (s − 1) · \frac{L′(s)}{L(s)} = lim_{s→1} (s − 1) · \frac{rc_{r}(s − 1)^{r−1} + (r + 1)c_{r+1}(s − 1)^{r} + ⋯}{c_{r}(s − 1)^{r} + c_{r+1}(s − 1)^{r+1} + ⋯}

= r · lim_{s→1} \frac{c_{r}(s − 1)^{r} + \frac{(r+1)}{r}c_{r+1}(s − 1)^{r+1} + ⋯}{c_{r}(s − 1)^{r} + c_{r+1}(s − 1)^{r+1} + ⋯}

= r.

Thus the rank r is “just” the limit as s → 1 of a certain (smooth) function. We know this limit is an integer. But, for example, for the curve

y^{2} + xy = x^{3} − x^{2} − 79x + 289

nobody has succeeded in proving that this integer limit is 4. (One can prove that the limit is either 2 or 4.)

Using the definition of derivative, we heuristically approximate (s − 1)\frac{L′(s)}{L(s)} as follows. For |s − 1| small, we have

(s − 1)\frac{L′(s)}{L(s)} = \frac{s − 1}{L(s)} · lim_{h→0} \frac{L(s + h) − L(s)}{h}

≈ \frac{s − 1}{L(s)} · \frac{L(s + (s − 1)^{2}) − L(s)}{(s − 1)^{2}}

= \frac{L(s^{2} − s + 1) − L(s)}{(s − 1)L(s)}

Question 8.9. Does

lim_{s→1} (s − 1) · \frac{L′(s)}{L(s)} = lim_{s→1} \frac{L(s^{2} − s + 1) − L(s)}{(s − 1)L(s)}?

In any case, we can use this formula in PARI to “approximate” r.

? E = ellinit([ 0, 1, 1, -2, 0 ]);
? r(E,s) = L1=elllseries(E,s); L2=elllseries(E,s^2-s+1); (L2-L1)/((s-1)*L1);
? r(E,1.01)
%8 = 2.004135342473941928617680057
? r(E,1.001)
%9 = 2.000431337547225544819319104
\\ One can prove that 2 is the correct limit.

Now let’s try the mysterious curve y^{2} + xy = x^{3} − x^{2} − 79x + 289 of rank 4:

? E=ellinit([ 1,-1,0,-79,289]);
? r(E,1.001)         \\ takes 6 seconds on PIII 1Ghz
%1 = 4.002222374519085610896440642
? r(E,1.00001)
%2 = 4.000016181256911064613006133

It certainly looks like lim_{s→1} r(s) = 4. We know for a fact that lim_{s→1} r(s) ∈ ℤ, and if only there were a good way to bound the error we could conclude that the limit is 4. But this has stumped people for years, and maybe it is impossible without a very deep result that somehow interprets this limit in a different way. This problem has totally stumped the experts for years. We desperately need a new idea!!

If one of you wants to do a reading or research project on this problem in the next year or two, let me know. One could draw pictures of L^{(3)}(E, s) or investigate the analogous problem for other more accessible L-series.

? E=ellinit([0,0,1,-7,6]);
? r(E,s) = L1=elllseries(E,s); L2=elllseries(E,s^2-s+1); (L2-L1)/((s-1)*L1);
? r(E,1.001)
%2 = 3.001144104985619206504448552

148 8. The Birch and Swinnerton-Dyer Conjecture

9

Computing With PARI/GP

“The object of numerical computation is theoretical advance.”

– Bryan Birch describing A. O. L. Atkin.

9.1 Introduction

Much progress in number theory has been driven by attempts to prove conjectures. It’s reasonably easy to play around with integers, see a pattern, and make a conjecture. Frequently proving the conjecture is extremely difficult. In this direction, computers help us to

• find more conjectures

• disprove conjectures

• increase our confidence in a conjecture

They also frequently help to solve a specific problem. For example, the following problem would be hopelessly tedious by hand. Here’s an example of such a problem:

Find all integer n < 100 that are the area of a right triangle with integer side lengths.^{1} This problem can be solved by a combination of very deep theorems, a few big computer computations, and a little luck.

1We will discuss the “The Congruent Number Problem” in more depth later in this course.

9.1.1 Some Assertions About Primes

A computer can quickly “convince” you that many assertions about prime numbers are true. Here are three.

• The polynomial x^{2} + 1 takes on infinitely many prime values.

Let

f(n) = {x : x < n : x and x^{2} + 1 is prime }.

With a computer, we quickly find that

f(10^{2}) = 19, f(10^{3}) = 112, f(10^{4}) = 841, f(10^{5}) = 6656.

Surely f(n) is unbounded! The PARI code to compute f(n) is very simple:

? f(n) = s=0; for(x=1,n,if(isprime(x^2+1),s++)); s
? f(100)
%1 = 19
? f(1000)
%2 = 112
? f(10000)
%3 = 841
? f(100000)
%4 = 6656

• Every even integer n > 2 is a sum of two primes.

With a computer we find that this seems true

\begin{matrix}n & p & q \\ 4 & 2 & 2 \\ 6 & 3 & 3 \\ 8 & 3 & 5 \\ 10 & 3 & 7 \\ 12 & 5 & 7 \end{matrix}

... and much further. In practice, it’s easy to write an even number as a sum of two primes. Why should there be any weird even numbers out there for which this can’t be done? PARI code to find p and q:

? gb(n) = forprime(p=2,n,if(isprime(n-p),return([p,n-p])));
? gb(4)
%7 = [2, 2]

? gb(6)
%8 = [3, 3]
? gb(100)
%9 = [3, 97]
? gb(1000)
%10 = [3, 997]
? gb(570)          \\ takes no time at all!
%11 = [7, 563]

• There are infinitely many primes p such that p + 2 is also prime. Let t(n) = #{p : p ≤ n and p + 2 is prime }. Using a computer we quickly find that

t(10^{2}) = 8, t(10^{3}) = 35, t(10^{4}) = 205, t(10^{5}) = 1024.

The PARI code to compute t(n) is very simple:

? t(n) = s=0; forprime(p=2,n,if(isprime(p+2),s++)); s
? t(10^2)
%12 = 8
? t(10^3)
%13 = 35
? t(10^4)
%14 = 205
? t(10^5)
%15 = 1224

Surely t(n) keeps getting bigger!!

As it turns out, these three assertions are all OLD famous extremely difficult \underline{unsolved} problems! Anyone who proves one of them will be very famous.

Assertion 2 is called “The Goldbach Conjecture”; Goldbach reformulated it in a letter to Euler in 1742. It’s featured in the following recent novel:

The publisher of that novel offers a MILLION dollar prize for the solution to the Goldbach conjecture:

  http://www.faber.co.uk/faber/million_dollar.asp?PGE=&ORD=faber&TAG=&CID=

The Goldbach conjecture is true for all n < 4 · 10^{14}, see

  http://www.informatik.uni-giessen.de/staff/richstein/ca/Goldbach.html

Assertion 3 is the “Twin Primes Conjecture”. According to

  http://perso.wanadoo.fr/yves.gallot/primes/chrrcds.html#twin

on May 17, 2001, David Underbakke and Phil Carmody discovered a 32220 digits twin primes record with a set of different programs: 318032361 · 2^{107001} ± 1. This is the current “world record”.

With a computer, even if you can’t solve one of these “Grand Challenge” problems, at least you can perhaps work very hard and prove it for more cases than anybody before you, especially since computers keep getting more powerful. This can be very fun, especially as you search for a more efficient algorithm to extend the computations.

9.1.2 Some Tools for Computing

Calculator: A TI-89 can deal with integers with 1000s of digits, factor, and do most basic number theory. I am not aware if anyone has programmed basic ”elliptic curve” computations into this calculator, but it could be done.

Mathematica and Maple: Both are commercial, but they are very powerful, can draw pretty pictures, and there are elliptic curve packages available for each (apecs for Maple, and something by Silverman for Mathematica).

PARI: Free, open source, excellent for our course, simple, runs on Macs, MS Windows, Linux, etc.

MAGMA: Huge, non-free but nonprofit, what I usually use for my research. I can legally give you a Linux executable if you are registered for 124.

My Wristwatch: Perhaps the only wristwatch in the world that can factor your social security number? :-)

9.1.3 Getting Started with PARI

Documentation

The documentation for PARI is available at

        http://modular.fas.harvard.edu/docs/

Some PARI documentation:

1. Installation Guide: Help for setting up PARI on a UNIX computer.

2. Tutorial: 42-page tutorial that starts with 2 + 2.

3. User’s Guide: 226-page reference manual; describes every function

4. Reference Card: hard to print, so I printed it for you (handout)

A Short Tour

$ gp
Appele avec : /usr/local/bin/gp -s 10000000 -p 500000 -emacs
                  GP/PARI CALCULATOR Version 2.1.1 (released)
                i686 running linux (ix86 kernel) 32-bit version
                (readline v4.2 enabled, extended help available)
                       Copyright (C) 2000 The PARI Group

PARI/GP is free software, covered by the GNU General Public License, and
comes WITHOUT ANY WARRANTY WHATSOEVER.
Type ? for help, \q to quit.
Type ?12 for how to get moral (and possibly technical) support.
   realprecision = 28 significant digits
   seriesprecision = 16 significant terms
   format = g0.28
parisize = 10000000, primelimit = 500000
? \\ this is a comment
? x = 571438063;
? print(x)
571438063
? x^2+17
%2 = 326541459845191986
? factor(x)
%3 =
[7 1]
[81634009 1]
? gcd(x,56)
%5 = 7
? x^20
%6 = 13784255037665854930357784067541250773222915495828020913935
8450113971943932613097560462268162512901194466231159983662241797
60816483100648674388195744425584150472890085928660801

Help in PARI

? ?
Help topics:
  0: list of user-defined identifiers (variable, alias, function)
  1: Standard monadic or dyadic OPERATORS
  2: CONVERSIONS and similar elementary functions
  3: TRANSCENDENTAL functions
  4: NUMBER THEORETICAL functions
  5: Functions related to ELLIPTIC CURVES
  6: Functions related to general NUMBER FIELDS
  7: POLYNOMIALS and power series
  8: Vectors, matrices, LINEAR ALGEBRA and sets
  9: SUMS, products, integrals and similar functions
 10: GRAPHIC functions

 11: PROGRAMMING under GP
 12: The PARI community
Further help (list of relevant functions): ?n (1<=n<=11).
Also:
  ? functionname (short on-line help)
  ?\             (keyboard shortcuts)
  ?.             (member functions)
Extended help looks available:
  ??             (opens the full user's manual in a dvi previewer)
  ??  tutorial   (same with the GP tutorial)
  ??  refcard    (same with the GP reference card)
  ??  keyword    (long help text about "keyword" from the user's manual)
  ??? keyword    (a propos: list of related functions).
? ?4
addprimes     bestappr      bezout        bezoutres     bigomega
binomial      chinese       content       contfrac      contfracpnqn
core          coredisc      dirdiv        direuler      dirmul
divisors      eulerphi      factor        factorback    factorcantor
factorff      factorial     factorint     factormod     ffinit
fibonacci     gcd           hilbert       isfundamental isprime
ispseudoprime issquare      issquarefree  kronecker     lcm
moebius       nextprime     numdiv        omega         precprime
prime         primes        qfbclassno    qfbcompraw    qfbhclassno
qfbnucomp     qfbnupow      qfbpowraw     qfbprimeform  qfbred
quadclassunit quaddisc      quadgen       quadhilbert   quadpoly
quadray       quadregulator quadunit      removeprimes  sigma
sqrtint       znlog         znorder       znprimroot    znstar
? ?gcd
gcd(x,y,{flag=0}): greatest common divisor of x and y. flag is optional, and
can be 0: default, 1: use the modular gcd algorithm (x and y must be
polynomials), 2 use the subresultant algorithm (x and y must be polynomials).
? ??gcd
\\ if set up correctly, brings up the typeset subsection from the manual on gcd

9.2 Pari Programming

9.2.1 Beyond One Liners

In today’s relaxing but decidely non-mathematical lecture, you will learn a few new PARI programming commands. Feel free to try out variations of the examples below (especially because there is no homework due this coming Wednesday). Also, given that you know PARI fairly well by now, ask me questions during today’s lecture!

Reading Files

The \r command allows you to read in a file. Example 9.1. Create a file pm.gp that contains the following lines

   {powermod(a, p, n) =
       return (lift(Mod(a,p)^n));}

Now use \r to load this little program into PARI:

> ?powermod
  ***   powermod: unknown identifier.
> \rpm               \\ \rpm.gp would do the same thing
? ?powermod
powermod(a, p, n) = return(lift(Mod(a,p)^n));
? powermod(2,101,7)
%1 = 27

If we change pm.gp, just type \r to reload it (omitting the file name reloads the last file loaded). For example, suppose we change return (lift(Mod(a,p)^n))

in pm.gp to return (lift(Mod(a,p)^n)-p). Then
? \r
? powermod(2,101,7)
%2 = -74

Arguments

PARI functions can have several arguments. For example,

{add(a, b, c)=
   return (a + b + c);}
? add(1,2,3)
%3 = 6

If you leave off arguments, they are set equal to 0.

? add(1,2)
%4 = 3

If you want the left-off arguments to default to something else, include that information in the declaration of the function:

{add(a, b=-1, c=2)=
   return (a + b + c);}
? add(1,2)
%6 = 5
? add(1)
%7 = 2
? add(1,2,3)
%8 = 6

Local Variables Done Right

Amidst the haste of a previous lecture, I mentioned that an unused argument can be used as a poor man’s local variable. The following example illustrates the right way to declare local variables in PARI. Example 9.2. The function verybad below sums the integers 1, 2, … n whilst wreaking havoc on the variable i.

{verybad(n)=
   i=0;
   for(j=1,n, i=i+j);
   return(i);}
? verybad(3)
%9 = 6
? i=4;
? verybad(3);
? i
%13 = 6                    \\ ouch!! what have you done to my eye!

The function poormans is better, but it uses a cheap hack to simulate a local variable.

{poormans(n,  i=0)=
   for(j=1,n, i=i+j);
   return(i);}
? i=4;
? poormans(3)
%16 = 6
? i
%17 = 4              \\ good

The following function is the best, because i is local and it’s clearly declared as such.

{best(n)=
   local(i);

   i=0;  for(j=1,n, i=i+j);
   return(i);}
? i=4;
? best(3)
%18 = 6
? i
%19 = 4

Making Your Program Listen

The input command reads a PARI expression from the keyboard. The expression is evaluated and the result returned to your program. This behavior is at first disconcerting if, like me, you naively expect input to return a string. Here are some examples to illustrate the input command:

? ?input
input(): read an expression from the input file or standard input.
? s = input();
1+1
? s                  \\ s is not the string "1+1", as you might expect
%24 = 2
? s=input()
hi there
%25 = hithere
? type(s)            \\ PARI views s as a polynomial in the variable hithere
%26 = "t_POL"
? s=input()
"hi there"
%27 = "hi there"
? type(s)            \\ now it's a string
%28 = "t_STR"

Writing to Files

Use the write command:

? ?write
write(filename,a): write the string expression a to filename.
? write("testfile", "Hello Kitty!")

The write command above appended the line “Hello Kitty!” to the last line of testfile. This is useful if, e.g., you want to save key bits of work during a session or in a function. There is also a logging facility in PARI, which records most of what you type and PARI outputs to the file pari.log.

? \l
   log = 1 (on)
? 2+2

%29 = 4
? \l
   log = 0 (off)
   [logfile was "pari.log"]

9.2.2 Coming Attractions

The rest of this course is about continued fractions, quadratic forms, and elliptic curves. The following illustrates some relevant PARI commands which will help us to explore these mathematical objects.

? ?contfrac
contfrac(x,{b},{lmax}): continued fraction expansion of x ...
? contfrac(7/9)
%30 = [0, 1, 3, 2]
? contfrac(sqrt(2))
%31 = [1, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, ...]
? ?qfbclassno
qfbclassno(x,{flag=0}): class number of discriminant x using Shanks's
method by default. If (optional) flag is set to 1, use Euler products.
? qfbclassno(-15,1)  \\ ALWAYS use flag=1, since ``the authors were too
%32 = 2              \\ lazy to implement Shanks' method completely...''
? E=ellinit([0,1,1,-2,0]);
? P=[0,0];
? elladd(E,P,P)
%36 = [3, 5]
? elladd(E,P,[3,5])
%37 = [-11/9, 28/27]
? a=-11/9;b=28/27;          \\ this is an ``amazing'' point on the curve.
? b^2+b == a^3+a^2-2*a
%38 = 1

9.3 Computing with Elliptic Curves

9.3.1 Initializing Elliptic Curves

We are concerned primarily with elliptic curves E given by an equation of the form

y^{2} = x^{3} + ax + b

with a and b either rational numbers or elements of a finite field ℤ/pℤ. If a and b are in ℚ, we initialize E in PARI using the following command:

? E = ellinit([0,0,0,a,b]);

If you wish to view a and b as element of ℤ/pℤ, initialize E as follows:

? E = ellinit([0,0,0,a,b]*Mod(1,p));

If Δ = −16(4a^{3}+27b^{2}) = 0 then ellinit will complain; otherwise, ellinit returns a 19-component vector of information about E. You can access some of this information using the dot notation, as shown below.

? E = ellinit([0,0,0,1,1]);
? E.a4
%11 = 1
? E.a6
%12 = 1
? E.disc
%13 = -496
? E.j
%14 = 6912/31
? E5 = ellinit([0,0,0,1,1]*Mod(1,5));
? E5.disc
%15 = Mod(4, 5)
? E5.j
%16 = Mod(2, 5)

Here E.j is the j-invariant of E. It is equal to \frac{2^{8}3^{3}a^{3}}{4a^{3}+27b^{2}} , and has some remarkable properties that I probably won’t tell you about.

Most elliptic curves functions in PARI take as their first argument the output of ellinit. For example, the function ellisoncurve(E,P) takes the output of ellinit as its first argument and a point P=[x,y], and returns 1 if P lies on E and 0 otherwise.

? P = [0,1]
? ellisoncurve(E, P)
%17 = 1
? P5 = [0,1]*Mod(1,5)
? ellisoncurve(E5, P)
%18 = 1

9.3.2 Computing in The Group

The following functions implement some basic arithmetic in the group of points on an elliptic curve: elladd, ellpow, and ellorder. The elladd function simply adds together two points using the group law. Warning: PARI does not check that the two points are on the curve.

? P = [0,1]
%2 = [0, 1]
? elladd(E,P,P)
%3 = [1/4, -9/8]
? elladd(E,P,[1,0])    \\ nonsense, since [1,0] isn't even on E!!!

%4 = [0, -1]
? elladd(E5,P5,P5)
%12 = [Mod(4, 5), Mod(2, 5)]
? [1/4,-9/8]*Mod(1,5)
%13 = [Mod(4, 5), Mod(2, 5)]

The ellpow function computes nP = P + P + ⋯ + P (n summands).

? ellpow(E,P,2)
%5 = [1/4, -9/8]
? ellpow(E,P,3)
%6 = [72, 611]
? ellpow(E,P,15)
%7 = [26449452347718826171173662182327682047670541792/9466094804586385762312509661837302961354550401,
4660645813671121765025590267647300672252945873586541077711389394563791/920992883734992462745141522111225908861976098219465616585649245395649]

9.3.3 The Generating Function L(E, s)

Suppose E is an elliptic curve over ℚ defined by an equation y^{2} = x^{3}+ax+b. Then for every prime p that does not divide Δ = −16(4a^{3} + 27b^{2}), the same equation defines an elliptic curve over the finite field ℤ/pℤ. As you will discover in problem 3 of homework 9, it can be exciting to consider the package of numbers #E(ℤ/pℤ) of points on E over all finite fields. The function ellap computes

a_{p}(E) = p + 1 − #E(ℤ/pℤ).

? E = ellinit([0,0,0,1,1]);
? ellap(E,5)
%19 = -3         \\ this should be 5+1 - #points
? E5 = ellinit([0,0,0,1,1]*Mod(1,5));
? for(x=0,4, for(y=0,4, if(ellisoncurve(E5,[x,y]),print([x,y]))))
[0, 1]
[0, 4]
[2, 1]
[2, 4]
[3, 1]
[3, 4]
[4, 2]
[4, 3]
? 5+1 - 9          \\ 8 points above, plus the point at infinity
%22 = -3

There is a natural way to extend the definition of a_{p} to define integers a_{n} for every integer n. For example, if a_{p} and a_{q} are defined as above and p and q are distinct primes, then a_{pq} = a_{p}a_{q}. Today I won’t tell you how to define the a_{p} when, e.g., p | Δ. However, you can compute the numbers a_{n} quickly in PARI using the function ellan, which computes the first few a_{n}.

? ellan(E,15)
%24 = [1, 0, 0, 0, -3, 0, 3, 0, -3, 0, -2, 0, -4, 0, 0]

This output means that a_{1} = 1, a_{2} = a_{3} = a_{4} = 0, a_{5} = −3, a_{6} = 0, and so on.

When confronted by a mysterious list of numbers, it is a “reflex action” for a mathematician to package them together in a generating function, and see if anything neat happens. It turns out that for the above numbers, a good way to do this is as follows. Define

L(E, s) = ∑_{n=1}^{∞} a_{n}n^{−s}.

This might remind you of Riemann’s ζ-function, which is the function you get if you make the simplest generating function ∑_{n=1}^{∞} n^{−s} of this form.

Using elllseries(E,s,1) I drew a graph of L(E, s) for y^{2} = x^{3} + x + 1.

y  x

That the value of L(E, s) makes sense at s = 1, where the series above doesn’t obviously converge, follows from the nontrivial fact that the function

f(z) = ∑_{n=1}^{∞} a_{n}e^{2πinz}

is a modular form. Also, keep your eyes on the dot; it plays a central roll in the Birch and Swinnerton-Dyer conjecture, which asserts that L(E, 1) = 0 if and only if the group E(ℚ) is infinite.

A Curve of Rank Two

Let E be the simplest rank 2 curve:

y^{2} + y = x^{3} + x^{2} − 2x.

The discriminant is 389.

y  x

A Curve of Rank Three

Let E be the simplest rank 3 curve:

y^{2} + y = x^{3} − 7x + 6.

The discriminant is 5077.

y  x

A Curve of Rank Four Let E be the simplest known rank 4 curve:

y^{2} + xy = x^{3} − x^{2} − 79x + 289

The conductor is 2 · 117223.

y  x

9.3.4 Other Functions and Programs

You can see a complete list of elliptic-curves functions by typing ?5:

                                ? ?5
                                elladd          ellak           ellan           ellap
                                ellbil          ellchangecurve  ellchangepoint  elleisnum
                                elleta          ellglobalred    ellheight       ellheightmatrix
                                ellinit         ellisoncurve    ellj            elllocalred
                                elllseries      ellorder        ellordinate     ellpointtoz
                                ellpow          ellrootno       ellsigma        ellsub
                                elltaniyama     elltors         ellwp           ellzeta          ellztopoint

I have only described a small subset of these. To understand many of them, you must first learn how to view an elliptic curve as a “donut”, that is, as quotient of the complex numbers by a lattice, and also as a quotient of the upper half plane.

There is a Maple package called APECS for computing with elliptic curves, which is more sophisticated than PARI in certain ways, especially in connection with algorithms that involve lots of commutative algebra. MAGMA also offers sophisticated features for computing with elliptic curves, which are built in to the standard distribution. I will give a demonstrations of MAGMA in the Basic Notions seminar at 3pm on Monday, December 3 in SC 507. There is also a C++ library called LiDIA that has libraries with some powerful elliptic curves features.

166 9. Computing With PARI/GP

10

Solutions to Exercises

Chapter 1

1.1 First we show by induction on n that the binomial coefficients \binom{n}{k}, for 0 ≤ k ≤ n, are integers. For the base case, note that \binom{1}{0} = \binom{1}{1} = 1. Next, suppose that \binom{n}{k} is an integer for 0 ≤ k ≤ n. Then \binom{n+1}{0} = \binom{n+1}{n+1} = 1, and for 0 ≤ i ≤ n − 1,

\binom{n}{i} + \binom{n}{i + 1} = \frac{n!}{i!(n − i − 1)!} (\frac{1}{n − i} + \frac{1}{i + 1})

= \frac{(n + 1)!}{(i + 1)!}(n − i)! = \binom{n + 1}{i + 1},

which by the inductive hypothesis is the sum of two integers.

Since p is prime, it suffices to show that there is no factor of p in the denominator. By assumption, r < p so p ∤ r!, and similarly 1 ≤ r implies that p − r ≤ p − 1 < p, so (p − r)! also contains no factor of p.

1.2 The gcds are 5, 13, 3, 8. E.g., gcd(15, 35) = gcd(15, 5) = gcd(5, 0) = 5.

1.3 (a) The base case is trivial. If the statment is true for n, then

1 + ⋯ + (n + 1) = \frac{n(n + 1)}{2} + (n + 1) = \frac{(n + 1)(n + 2)}{2},

as desired.

(b) If n is even group the terms as (1−2)+(3−4)+⋯+(n−1−n) = −\frac{n}{2}, and if n is odd we have 1 + (−2 + 3) + (−4 + 5) + ⋯ + (−(n − 1) + n) = \frac{n+1}{2}, so the general formula is (−1)^{n+1}⌈\frac{n}{2}⌉.

1.5 The Euclidean algorithm gives 2261 = 1275 · 1 + 986, 1275 = 986 · 1 + 289, 986 = 289 · 3 + 119, 289 = 119 · 2 + 51, and 119 = 51 · 2 + 17, so

17 = 119 − 51 · 2 = (986 − 289 · 3) − (289 − 119 · 2) · 2

= 986 − (1276 − 986) · 3 − (1275 − 986) · 2 + (986 − 289 · 3) · 4 = 1275 · (−5) + 986 · 10 + 289 · (−12) = 1275 · (−17) + 986 · 22

= 22 · 2261 − 39 · 1275.

1.6 See Theorem 1.12 for the case deg(f) = 1, and [Guy94, §A.1] when deg(f) = 2. In general, if there is a prime p such that f induces the 0 function on ℤ/pℤ, then p | f(n) for all integers n, so f does not take on infinitely many values. Thus, for example, f = x^{2} + x + 2 is irreducible, but takes on only finitely many prime values. If there is no such p and f is irreducible, then the author optimistically suspects that f takes on infinitely many prime values.

1.7 Easy.

1.8 First we note that all odd integers are congruent to ±1 or 3 modulo 6, and if x ≡ 3 (mod 6), then 3 | x. Therefore all odd primes (except 3) are congruent to ±1 modulo 6. Next we note that if p, q ≡ 1 (mod 6), then pq ≡ 1 (mod 6). Therefore if n ≡ −1 (mod 6), then n must have a prime factor p ≡ −1 (mod 6). Let T = {5, 11, …} be the set of all primes p ≡ −1 (mod 6). If T is finite, it makes sense to consider the product Π_{0} of the primes in T. Since Π = 6Π_{0} − 1 ≡ −1 (mod 6) there is a prime q ∈ T such that q | Π. But for all p ∈ T, Π ≡ −1 (mod p), a contradiction. Thus T is infinite.

1.9 (a) E.g., π(2002) = 303.

(b) For x = 2001, x/ log(x) ≈ 263, so the values differ by about 40.

1.10 (a) {0, 1, 2, 3, 4, 5, 6}, (b) {1, 3, 5, 7, 9, 11, 13}, (c) {0, 2, 4, 6, 8, 10, 12}, and (d) {2, 3, 5, 7, 11, 13, 17}.

1.11 71.

1.12 36.

1.13 2^{7} · 3^{2}.

1.14 302.

1.15 343.

1.16 61.

1.17 It suffices to prove that the congruence holds modulo each prime power p_{i}^{r_{i}} appearing in the prime factorization p_{1}^{r_{1}} ⋯ p_{m}^{r_{m}} of n. If m > 1, then p_{i}^{r_{i}} < n, so p_{i}^{r_{i}} | (n − 1)!, as required. It remains to consider the case when m = 1 and n = p^{r} is a prime power. We have 2p ≤ p^{r} − 1 and p^{r−1} ≤ p^{r} − 1, unless p^{r} = 2^{2}, which is not the case by assumption. Also, 2p ≠ p^{r−1}, unless p = 2 and r = 3, in which case one can check the statement we are proving directly. Thus

p^{r} | 2p · p^{r−1} = 2p^{r} | (p^{r} − 1)!.

1.18 φ(n) is odd only for n = 1, 2, as one sees by using the multiplicativity of φ and that if p^{r} > 2 is a prime power, then φ(p^{r}) = p^{r} − p^{r−1} = (p − 1)p^{r−1} is even.

1.19 We use that 10 ≡ −1 (mod 11) and facts about modular arithmetic. Write n = ∑_{i=0}^{r} d_{i}10^{i}. Then n ≡ ∑_{i=0}^{r}(−1)^{i}d_{i} (mod 11), so n ≡ 0 (mod 11) if and only if the alternating sum of the digits ∑(−1)^{i}d_{i} is congruent to 0 modulo 11.

1.20 For the first part, the answer is n = 1, 2. On a previous homework we proved that n = 1, 2 are the only n such that φ(n) is odd. For the second part, the fact that φ is multiplicative means that if gcd(m, n) = 1 then φ(mn) = φ(m) · φ(n). When gcd(m, n) ≠ 1 this implication can fail; for example, 2 = φ(2 · 2) ≠ φ(2) · φ(2) = 1.

Chapter 2

2.1 The secret code is s = g^{mn} = 454^{1208} = 2156 (all modulo 3793).

2.2 (a) 5384375093542

(b) 13, since the word with n Zs corresponds to 27^{n} − 1 and 13 is the greatest integer n such that 27^{n} − 1 < 10^{20}.

2.3 The numbers they chose are tiny, so we can write a program to very quickly compute n and m (simply try all posibilities ≤ 96). We find that n = 70 and m = 31, so s = 5^{70·31} = 44.

2.5 (a) Using a computer, we find that 5352381469067 = 141307·37877681, so φ(n) = (141307−1)·(37877681−1) = 5352343450080. The inverse of e = 4240501142039 modulo φ(n) is d = 5195621988839.

(b) We have 3539014000459^{d} = 18464, which encodes WHY.

2.6 Encrypting every letter individually is not a secure method. Rather, it is as secure as using a table of mappings of every letter to a number on both ends. This sort of encryption is very susceptible to word frequency examination.

2.7 (a) Let m = ed − 1 = 38334587566167741692779486096. We find that a^{m/2} ≡ 1 (mod n) for several random choices of a. Replace m by m/2 = 19167293783083870846389743048. Again, we find that a^{m/2} ≡ 1 (mod n) for several random a. Upon replacing m by m/2 = 9583646891541935423194871524, we find that 2^{m/2} ≡ 1433811615146880 (mod n). Unfortunately, gcd(2^{m/2} − 1, n) = 1, so we try 3^{m/2}, 5^{m/2}, and finally find that p = gcd(7^{m/2} − 1) = 37865717, which is a nontrivial factor of n. Setting q = n/p = 37865693, we have that n = pq.

(b) Letting t = ⌊\sqrt{n}⌋ = 37865704, we have \sqrt{t^{2} − n} ≈ 8702.37 and \sqrt{(t + 1)^{2} − n} ≈ 12.00, so already we see that p = t + 1 + 12 = 37865717 and q = t + 1 − 12 = 37865693.

2.8 Since 2^{n} ≡ 6 (mod 13), a table of powers of 2 modulo 13 quickly reveals that n must be 5 (we solve the discrete log problem easily in this case since 13 is so small). Likewise, since g^{m} ≡ 11 (mod 13) we see that m = 7. The secret key is s = 7 since g^{nm} = 2^{35} ≡ 2^{11} ≡ 7 (mod 13).

2.9 (a) We must compute 4^{7} (mod 77). Working modulo 77, we have that

4^{7} = 64 · 64 · 4 = 13^{2} · 4 = 169 · 4 = 15 · 4 = 60,

so 4 encrypts as 60.

(b) First, φ(n) = φ(77) = φ(7) · φ(11) = 6 · 10 = 60. We then use the extended Euclidean algorithm to find an integer e such that 7e ≡ 1 (mod 60). We find that 2 · 60 − 17 · 7 = 1, so e = −17 is a solution.

Chapter 3

3.1 (\frac{3}{97}) = (−1)^{48} · (\frac{97}{3}) = (\frac{1}{3}) = 1, (\frac{5}{389}) = (−1)^{2} · (\frac{389}{5}) = (\frac{4}{5}) = 1, (\frac{2003}{11}) = (\frac{1}{11}) = 1, and (\frac{5!}{7}) = (\frac{120}{7}) = (\frac{1}{7}) = 1.

3.2 By quadratic reciprocity (\frac{3}{p}) = (−1)^{\frac{p−1}{2}} ·(\frac{p}{3}). Since (−1)^{\frac{p−1}{2}} only de-

pends on p (mod 4) and (\frac{p}{3}) only depends on p (mod 3), their product depends only on p (mod 12), and the result follows by checking that the statement is true for each possibility of p modulo 12.

3.3 It is sufficient to give two distinct elements a, b in (ℤ/2^{n}ℤ)^{∗} of order 2, for if there was a primitive root g, then g^{ϕ(2^{n})/2} = g^{2^{n−2}} cannot simultaneously be congruent to a and b modulo 2^{n}. Put a = −1; since n > 2, −1 has order 2 in (ℤ/2^{n}ℤ)^{∗}. Set b = 2^{n−1} − 1 ∈ (ℤ/2^{n}ℤ)^{∗}; then b^{2} = (2^{n−1} − 1)^{2} = 2^{2n−2} − 2 · 2^{n−1} + 1 = 1. Now b ≠ a, since b − a = 2^{n−1} < 2^{n}, and b ≠ 1, since n > 2. Therefore a and b are distinct elements of order 2 in (ℤ/2^{n}ℤ)^{∗}, a contradiction.

3.4 We will construct an element g of (ℤ/p^{2}ℤ)^{∗} with order φ(p^{2}) = p(p − 1). Let g_{0} be a primitive root modulo p, and let g = g_{0} +pt for some t to be determined. By the binomial theorem

g^{p−1} ≡ g_{0}^{p−1} + (p − 1)pg_{0}^{p−2}t ≡ (1 + kp) + p(p − 1)g_{0}^{p−2}t (mod p^{2}),

for some k, since g_{0}^{p−1} ≡ 1 (mod p). Because p − 1 and g_{0}^{p−2} are both coprime to p, we can choose t such that n = k + (p − 1)g_{0}^{p−2}t is nonzero modulo p. Then g^{p−1} ≡ 1 + np (mod p^{2}) and p ∤ n, so the order of g in (ℤ/p^{2}ℤ)^{∗} does not divide p − 1. But it divides p(p − 1), and p is prime, so the order of g is p(p − 1), and g is a primitive root modulo p^{2}.

3.5 Let g be a primitive root modulo p. Since p ≡ 1 (mod 3), c = g^{(p−1)/3} has order 3. Therefore c is a solution to

x^{3} − 1 = (x − 1)(x^{2} + x + 1) = 0,

where all arithmetic is taking place in the integral domain ℤ/pℤ. Since c ≠ 1, we have c^{2} + c + 1 = 0. Thus 4c^{2} + 4c + 4 = (2c + 1)^{2} + 3 = 0, so (2c + 1)^{2} = −3, hence (\frac{−3}{p}) = 1.

3.6 The solution is similar to the solution of the Exercise 3.6. Let c in (ℤ/pℤ)^{∗} be an element of order 5. Then c^{5} − 1 = (c − 1)(c^{4} + c^{3} + c^{2} + c + 1) = 0 and c ≠ 1 implies that c^{4} + c^{3} + c^{2} + c + 1 = 0. Now

(c + c^{4})^{2} + (c + c^{4}) − 1 = c^{4} + c^{3} + c^{2} + c + 1 = 0,

so (2(c + c^{4}) + 1)^{2} = 4((c + c^{4})^{2} + (c + c^{4}) − 1) + 5 = 5.

3.7 All odd primes. Let p be an odd prime and g a primitive root modulo p. Rewrite the sum as:

∑_{a=1}^{p−1} (\frac{a}{p}) = ∑_{i=1}^{p−1} (\frac{g^{i}}{p} ) = ∑_{j=1}^{\frac{p−1}{2}} (\frac{g^{2j}}{p} ) + ∑_{j=1}^{\frac{p−1}{2}} (\frac{g^{2j+1}}{p} )

= ∑_{j=1}^{\frac{p−1}{2}} (\frac{g^{2j}}{p} ) + (\frac{g}{p}) ∑_{j=1}^{\frac{p−1}{2}} (\frac{g^{2j}}{p} ) = \frac{p − 1}{2} (1 + (\frac{g}{p})) .

Now (\frac{g}{p}) = −1, for if (\frac{g}{p}) = 1 then g^{\frac{p−1}{2}} = 1, and g would not be

primitive. Therefore ∑_{a=1}^{p−1} (\frac{a}{p}) = 0.

3.8 A good guess is to be C ≈ 0.37395. Using a computer, we can write a program to check the first n primes to see if 2 is a primitive root, and divide this total by n to see the behavior of the ratio. Artin conjectured that

C = ∏_{n=1}^{∞} (1 − \frac{1}{p_{n}(p_{n} − 1)}) ,

where p_{n} is the nth prime.

3.9 First we use the law of quadratic reciprocity to decide whether or not there is a solution. We have

(\frac{5}{2^{13} − 1}) = (−1)^{2·(2^{13}−2)/2} (\frac{2^{13} − 1}{5}) = (\frac{1}{5}) = 1,

so the equation x^{2} ≡ 5 (mod 2^{13} − 1) has at least one solution a. Since the polynomial x^{2} − 5 has degree two and 2^{13} − 1 is prime, there are at most 2 solutions. Since −a is also a solution and a ≠ 0, there are exactly two solutions.

3.10 Fermat’s Little Theorem implies that 4^{48} = 2^{96} ≡ 1 (mod 97).

Chapter 4

4.1 We establish both identities by induction.

• Claim: [a_{n}, a_{n−1}, …, a_{1}, a_{0}] = \frac{p_{n}}{p_{n−1}} .

Proof. Since p_{−1} = 1 and p_{0} = a_{0}, [a_{0}] = \frac{p_{0}}{p_{−1}} , which establishes the base case. Now suppose that [a_{n−1}, …, a_{0}] = \frac{p_{n−1}}{p_{n−2}} . Then

[a_{n}, a_{n−1}, …, a_{0}] = a_{n} + \frac{1}{[a_{n−1}, …, a_{0}]}

= a_{n} + \frac{1}{\frac{p_{n−1}}{p_{n−2}}} = a_{n} + \frac{p_{n−2}}{p_{n−1}} = \frac{a_{n}p_{n−1} + p_{n−2}}{p_{n−1}} .

The numerator is p_{n}, by definition.

• Claim: [a_{n}, a_{n−1}, …, a_{1}] = \frac{q_{n}}{q_{n−1}} .

Proof. Since q_{0} = 1 and q_{1} = a_{1}, [a_{1}] = \frac{q_{1}}{q_{0}} , which establishes the base case. Now suppose that [a_{n−1}, …, a_{1}] = \frac{q_{n−1}}{q_{n−2}} . Then

[a_{n}, a_{n−1}, …, a_{1}] = a_{n} + \frac{1}{[a_{n−1}, …, a_{1}]}

= a_{n} + \frac{1}{\frac{q_{n−1}}{q_{n−2}}} = a_{n} + \frac{q_{n−2}}{q_{n−1}} = \frac{a_{n}q_{n−1} + q_{n−2}}{q_{n−1}} .

The numerator is q_{n}, by definition.

4.2 If we compute ellj(t) in PARI, where t = −0.5 + 0.3281996289i the result is 61.7142856...-6.2E-26I. The imaginary part is approximately 0, so we guess the rational number that gives the real part. The

command contfrac(61.7142856) gives [61,1,2,2,178571], which

suggests that a good guess for our rational number is the rational number \frac{432}{7} represented by the continued fraction [61, 1, 2, 2].

4.3 (a) Let α = [\overline{2, 3}]. Then α = 2 + \frac{1}{3+ \frac{1}{α}}, so 3α^{2} − 6α − 2 = 0. Solving

for α yields 1 + \frac{\sqrt{15}}{3}.

(b) First we compute α = [\overline{1, 2, 1}]. This gives α = 1+(2 + \frac{1}{(1+α^{−1})})^{−1}.

Solving for α yields 3α^{2} − 2α − 3 = 0, so α = \frac{1+\sqrt{10}}{3}. Now [2, \overline{1, 2, 1}] = 2 + \frac{1}{[\overline{1,2,1}]}, so our final answer is \frac{5+\sqrt{10}}{3}.

(c) This is [\overline{1, 2, 3}]^{−1}. As above, if α = [\overline{1, 2, 3}] then α = 1+(2 + \frac{1}{3+ \frac{1}{α}} )^{−1}.

This simplifies to α = 7α^{2} +8α−3 = 0, so α = \frac{4+\sqrt{37}}{7}. Therefore our desired answer is \frac{−4+\sqrt{37}}{3}.

4.4 We use the command contfrac in PARI to find the continued fraction then prove that the answer is correct.

(a) We claim that \sqrt{5} = [2, \overline{4}]. Let α = [\overline{4}]; then α = 4 + \frac{1}{α}, so α = 2 + \sqrt{5}. Now [2, \overline{4}] = 2 + \frac{1}{2+\sqrt{5}} = \sqrt{5}, as desired.

(b) We claim that \frac{1+\sqrt{13}}{2} = [2, \overline{3}]. Let α = [\overline{3}]; then α = 3 + \frac{1}{α}, so α^{2}−3α−1 = 0. This gives α = \frac{3+\sqrt{13}}{2}. Then [2, \overline{3}] = 2+ \frac{2}{3+\sqrt{13}} =

\frac{1+\sqrt{13}}{2}.

(c) We claim that \frac{5+\sqrt{37}}{4} = [\overline{2, 1, 3}]. Let α = [\overline{2, 1, 3}]; then α = 2 + (1 + (3 + \frac{1}{α})^{−1})^{−1}, so 4α^{2} − 10α − 3 = 0. Solving for α gives \frac{5+\sqrt{37}}{4}, as desired.

4.5 (a) First we compute [\overline{2n}]. Let α = \overline{[2n]}; then α = 2n+ \frac{1}{α}. This gives α^{2} − 2nα − 1 = 0, so α = n + \sqrt{n^{2} + 1}. Now [n, \overline{2n}] = n + \frac{1}{α} = n − (n − \sqrt{n^{2} + 1}) = \sqrt{n^{2} + 1}, as desired.

(b) Using the previous part, we know that \sqrt{5} = [2, \overline{4}]. We can try successive convergents until two agree up to four decimal places; once such convergent is 682/305.

4.6 In PARI, use convergents(contfrac(Pi)) to obtain the convergents of the continued fraction of π. We can now test convergents for property described in the problem, noting that smaller denominators are more likely to work. One convergent that satisfies the property is 3/1, since π−3 < .15 and \frac{1}{\sqrt{5}} > .44. The next is 22/7, since 22/7−π < .002 and \frac{1}{49\sqrt{5}} > .009. A third is 355/113, since 355/113 − π < .0000003 while \frac{1}{113^{2}\sqrt{5}} > .00003.

4.7 In PARI, the command contfrac(exp(2)) gives

  [7,  2,1,1,3,18,   5,1,1,6,30,   8,1,1,9,42,  11,1,1,12,54,
       14,1,1,15,77, 17,1,1,18,78, 20,1,1,21,90,...]

This suggests that after the initial 7 terms, the ith group of 5 numbers (grouping after the initial 7) is of the form

3(i − 1) + 2, 1, 1, 3i, 18 + 12(i − 1).

4.8 (a) We are looking for natural number solutions to n + 1 = x^{2}, \frac{n}{2} + 1 = y^{2}. Isolating n yields n = x^{2} − 1 = 2(y^{2} − 1), implying that x^{2} − 2y^{2} = −1. There are infinitely many solutions (x, y) to this equation if the period of the continued fraction of \sqrt{2} has odd order. Indeed, \sqrt{2} = [1, \overline{2}]. For each (x, y) we can take 2(y^{2} − 1) to find a unique (even) n; thus there are infinitely many n satisfying the desired property.

(b) We compute list of convergents for the continued fraction of \sqrt{2}. The odd terms are of interest, and since we want to find n > 389, we want the denominator of the convergent to be at least 14. The first two such convergents are \frac{41}{29} and \frac{239}{169}, which yield n = 2(29^{2} − 1) = 1680 and n = 2(169^{2} − 1) = 57120.

4.9 If x and y are consecutive integers, then we have z^{2} = x^{2} +(x+1)^{2} = 2x^{2} + 2x + 1. Multiplying by 2, we have 2z^{2} = 4x^{2} + 4x + 2 = (2x + 1)^{2} + 1. Putting u = 2x + 1, we have u^{2} − 2z^{2} = −1. From the previous problem we know there are infinitely many solutions to this equation for u and z. Each solution (u, z) gives a unique (x, z), and each of these solutions (x, z) leads to a primitive Pythagorean triple (x and x+1 are coprime and if either shares a nontrivial divisor with z then the third must also share this divisor).

Chapter 5

5.1 Since −389 is negative, it is not the sum of two squares. Since 3 || 12345, we see that 12345 is not the sum of two squares. Since 7 || 91210, it follows that 91210 is not the sum of two squares. The fourth number is 729 = 27^{2}, which is a perfect square. Since 7 || 1729, we see that 1729 is not the sum of two squares. Finally, 151 || 68252 and 151 ≡ 3 (mod 4), so 68252 is not the sum of two squares.

5.2 (a) Given an input n, the following PARI program breaks n up into two parts and looks for a sum of two squares representation.

    {squares(n) =
       local(y);
       for(x=1,floor(sqrt(n)),
          y=sqrt(n-x^2);
          if(y-floor(y)==0,
             return([x,floor(y)])
          )
       );
       return(0)
    };
    {f(n) =
       for(x=1,n,
          a=squares(x);
          b=squares(n-x);
          if(a!=0 && b!=0,
             return([a[1],a[2],b[1],b[2]])
          )
      )
    }

(b) 2001 = 1^{2} + 8^{2} + 44^{2}

5.3 Answer: 625. There are two Pythagorean triples with 25 as the hypotenuse: (7, 24, 25) and (15, 20, 25). This gives two representations of 625 as the sum of two squares. Of course, 25^{2} is a third.

5.4 The forward direction is trivial. For the opposite direction, suppose that n is the sum of two rational squares: n = (\frac{a}{b})^{2} +(\frac{c}{d})^{2}, but that n is not the sum of two integer squares. Then there exists a prime p such that p^{r} || n, where p ≡ 3 (mod 4) and r is odd. Now, nb^{2}d^{2} = (ad)^{2} + (bc)^{2}, so nb^{2}d^{2} is the sum of two integer squares. However, all the prime factors of b^{2}d^{2} have even exponent, so p^{s} || nb^{2}d^{2}, where s is odd, a contradiction.

5.5 Suppose p = x^{2} + 2y^{2}, where p is an odd prime and x and y are

integers. Then x^{2} + 2y^{2} ≡ 0 (mod p), so (\frac{x}{y})^{2} ≡ −2 (mod p) (since

ℤ/pℤ is a field). From XXX, (\frac{2}{p}) = 1 if and only if p ≡ ±1 (mod 8).

Also, (\frac{−1}{p}) = 1 if and only if p ≡ 1 (mod 4) (i.e., p ≡ 1, −3 (mod 8)).

Since (\frac{−2}{p}) = (\frac{−1}{p}) · (\frac{2}{p}), we have (\frac{−2}{p}) = 1 if and only if p ≡ 1, 3 (mod 8).

Conversely, suppose that p ≡ 1, 3 (mod 8) is prime. Let r be such that r^{2} ≡ −2 (mod p). Taking n = ⌊\sqrt{p}⌋ and applying Lemma 1.3 from Lecture 21 (XXX), there exist integers a, b with 0 < b < \sqrt{p} such that

|−\frac{r}{p} − \frac{a}{b}| ≤ \frac{1}{b(n + 1)} < \frac{1}{b\sqrt{p}}.

Let c = rb + pa; then |c| < \frac{pb}{b\sqrt{p}} = \sqrt{p}, so 2b^{2} + c^{2} < 3p. Since c ≡ rb (mod p), we also have that 2b^{2} + c^{2} ≡ b^{2}(2 + r^{2}) ≡ 0 (mod p). Therefore 2b^{2}+c^{2} = p or 2p. If 2b^{2}+c^{2} = p we are done. If 2b^{2}+c^{2} = 2p then c must be even (else 2b^{2} + c^{2} is odd). Putting c = 2d, we have

2p = 2b^{2} + c^{2} = 2b^{2} + 4d^{2},

so p = b^{2} + 2d^{2}, as desired.

5.6 Let T_{m} be the mth triangular number. It is easy to see by induction that T_{m} = m(m + 1)/2. Then

8T_{m}^{2} + 0 = (2T_{m})^{2} + (2T_{m})^{2},
8T_{m}^{2} + 1 = 2m^{2}(m + 1)^{2} + 1 = [(m − 1)(m + 1)]^{2} + [m(m + 2)]^{2},
8T_{m}^{2} + 2 = 2m^{2}(m + 1)^{2} + 2 = [m(m + 1) − 1]^{2} + [m(m + 1) + 1]^{2}.

5.7 Of any four consecutive integers, there is one n such that n ≡ −1 (mod 4). Since all odd prime factors are congruent to ±1 (mod 4), n must have some prime factor p ≡ −1 (mod 4) with odd exponent, so n is not representable as the sum of two squares.

5.8 We first solve

13x^{2} + 36xy + 25y^{2} = (ax + by)^{2} + (cx + dy)^{2}
= (a^{2} + c^{2})x^{2} + 2(ab + cd)xy + (b^{2} + d^{2})y^{2},

then check that ad − bc = 1. By inspection, we try a = 3, c = 2. Then b^{2} + d^{2} = 25 and 2b + 3d = 18, which again by inspection is satisfied by b = 4, d = 3. Since ad − bc = 1, the form is equivalent to x^{2} + y^{2}.

As above, we solve

58x^{2} + 82xy + 29y^{2} = (ax + by)^{2} + (cx + dy)^{2}
= (a^{2} + c^{2})x^{2} + 2(ab + cd)xy + (b^{2} + d^{2})y^{2},

then check that ad − bc = 1. By inspection, we try a = 3, c = 7. Then b^{2} + d^{2} = 29 and 7b + 3d = 41, which again by inspection is satisfied by b = 2, d = 5. Since ad − bc = 1, the form is equivalent to x^{2} + y^{2}.

We know that x = 17, y = 10 satisfies x^{2} + y^{2} = 389. To find x, y such that 13x^{2} + 36xy + 25y^{2}, We use the transformation above and solve for

17 = 3x + 4y, 10 = 2x + 3y.

The solution to this system is x = 11, y = −4. Indeed,

13 · 11^{2} − 36 · 11 · 4 + 25 · 4^{2} = 389.

5.9 The discriminants are equal: −24 = 162^{2} −4·199·33 = 96^{2} −4·35·66. However, the forms are not equivalent. To see this, we first show that 35x^{2} − 96xy + 66y^{2} is equivalent to 2x^{2} + 3y^{2}. As above, this means solving

35x^{2} − 96xy + 66y^{2} = 2(ax + by)^{2} + 3(cx + dy)^{2}
= (2a^{2} + 3c^{2})x^{2} + 2(2ab + 3cd)xy + (2b^{2} + 3d^{2})y^{2}

in integers a, b, c, d such that ad − bc = 1. By inspection we see that a = 2, b = −3, c = 3, d = −4 is a solution, so the forms are equivalent. Now we show the first form is not equivalent to 2x^{2} +3y^{2}. If we try to solve for as above, we encounter the equation 33 = 2b^{2} + 3d^{2}, which has no solutions over the integers (we can just check 0 ≤ b ≤ 5).

5.10 • D = −155: The group C_{D} has four elements, represented by [[1, 1, 39], [3, −1, 13], [3, 1, 13], [5, 5, 9]]. By the structure theorem, C_{D} is isomorphic to either C_{2} × C_{2} or C_{4}. It is easy to verify that [1, 1, 39] is the identity. From this we find that [3, −1, 13] has order 4, so C_{D} ≈ C_{4}.

• D = −231: There are 12 elements: [1, 1, 58], [2, −1, 29], [2, 1, 29], [3, 3, 20], [4, −3, 15], [4, 3, 15], [5, −3, 12], [5, 3, 12], [6, −3, 10], [6, 3, 10], [7, 7, 10], [8, 5, 8], so C_{D} ≈ C_{12} or C_{2} × C_{6}. The identity is [1, 1, 58] and both [2, −1, 29] and [2, 1, 29] have order 6, which is impossible in C_{12}, so C_{D} ≈ C_{2} × C_{6}.

• D = −660: There are eight elements: [1, 0, 165], [10, 10, 19], [11, 0, 15], [13, 4, 13], [2, 2, 83], [3, 0, 55], [5, 0, 33], [6, 6, 29]. The first element is the identity, and all others have order 2, so C_{−660} ≈ C_{2} × C_{2} × C_{2}.

• D = −12104: There are forty-eight elements (and these can take a while to compute!): By the structure theorem,

C_{D} ≈ C_{48}, C_{4} × C_{12}, or C_{2} × C_{24}.

The identity element is [1, 0, 3026], and using it we find two elements of order four: [45, −26, 71] and [50, −36, 67], eliminating everything but C_{4} × C_{12}.

• D = −10015: There are fifty-four elements (which take a while to compute!). Therefore C_{D} ≈ C_{3} × C_{18} or C_{54}. The identity is [1, 1, 2504], and from this we find that [10, −5, 251] and [10, 5, 251] have order 9. Thus C_{D} cannot be C_{54}, so C_{D} ≈ C_{3} × C_{18}.

Chapter 6

6.2 Differentiating implicitly, the slope of the tangent at (x, y) is \frac{3x^{2}}{2y}. At (3, 5), the slope is \frac{27}{10}, and the tangent line has equation y = \frac{27x−31}{10}. Substituting into the relation y^{2} −x^{3} = −2, we have (\frac{27x−31}{10})^{2} −x^{3} = −2, which simplifies to the polynomial

100x^{3} − 729x^{2} + 1674x − 1161 = 0.

This polynomial has a double root at x = 3, so it factors as (100x − 129)(x − 3)^{2}, giving a rational root with x = 129/1000. Therefore (129/100, 383/1000) is a rational solution to the original equation.

6.3 The transformation

x ↦ X − \frac{1}{12}, y ↦ −\frac{1}{2}X + Y − \frac{11}{24}.

transforms y^{2} + xy + y = x^{3} into

Y^{2} = X^{3} + \frac{23}{48}X + \frac{181}{864}.

6.4

6.5 (a) In general there is no identity element. Suppose to the contrary that O is the identity, and suppose that P, Q, and O are distinct and colinear. Then P ⊞O = Q ≠ P, so O is not the identity. The inverse axiom sort of works, in that if O were the identity and P ∈ E(ℝ), then there is Q such that P + Q = O. Associativity fails; for example, consider y^{2} = x^{3} + 1. We have ((−1, 0) ⊞ (0, 1))⊞(0, −1) = (2, 3), yet (−1, 0)⊞((0, 1)⊞(0, −1)) = (−1, 0).

10. Solutions to Exercises 179

(b) Note that P ⊞ Q = −(P + Q), where + is the usual group law. Thus if E(ℚ) ∈ {{0}, ℤ/2ℤ, (ℤ/2ℤ)^{2}}, then (E(ℚ), ⊞) is a group. Otherwise it isn’t, because there is no identity, as mentioned above.

6.6 6.7 6.8 6.9 6.10 6.11 6.12 6.13

180 10. Solutions to Exercises

References

[FT93] A. Fröhlich and M. J. Taylor, Algebraic number theory, Cambridge University Press, Cambridge, 1993.

[Guy94] Richard K. Guy, Unsolved problems in number theory, second ed., Springer-Verlag, New York, 1994, Unsolved Problems in Intuitive Mathematics, I.

[Sho97] Peter W. Shor, Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer, SIAM J. Comput. 26 (1997), no. 5, 1484–1509.