Notes for Number Theory 2013–2014 Robin Chapman 24 September 2013 These are notes for my course. I do not include complete proofs or full details where they can be improvised at the board. Caveat emptor! Recall definitions of N (natural numbers), Z (integers), Q (rationals). Recall definition of divisibility: notation n | a (n divides a, n is a divisor of a, n is a factor of a, a is a multiple of n). Basic properties: 1 | n and n | n for all n; n | a implies n | ac; n | a and n | b implies n | (a ± b); n | m and m | a implies n | a. Definition of prime number. Give Euclid’s proof of their infinitude. Definition of congruences: they preserve addition, subtraction, multiplication but not division. For n ∈ N and x ∈ Z there is a unique a ∈ {0, . . . , n − 1} with x ≡ a (mod n). (This is the “division algorithm”). Also there is a unique b with −n/2 < b ≤ n/2 such that x ≡ b (mod n). Solving linear congruences ax ≡ b (mod n). Exhaustive search only useful for small n. Note ax ≡ b (mod n) is equivalent to ax+ny = b for some y ∈ Z. Problem: given m, n ∈ Z, which numbers have the form mx+ny for x, y ∈ Z, and can we find such x and y in practice? Theorem 1 (Euclid) Let m, n ∈ N. Then there is a unique g ∈ N and (non-unique) r, s ∈ Z such that (i) g | m and g | n, (ii) g = rm + sn, (iii) if h ∈ N, h | m and h | n then h | g. This g is the greatest common divisor or highest common divisor of m and n and is denoted g = gcd(m, n). There is a “non-constructive” proof which takes g as the smallest positive element of {mx + ny : x, y ∈ Z}, but also an algorithmic proof using the 1

extended Euclidean algorithm which computes g and a suitable r and s in short order. The corollary is that ax ≡ b (mod n) is soluble if and only if gcd(a, n) | b. We say that m and n are coprime or relatively prime if gcd(m, n) = 1. Another corollary is that m and n are coprime if and only if mx ≡ 1 (mod n) is soluble, that is m has a reciprocal modulo n. If m and n are coprime then we can cancel m in congruences modulo n, that is ma ≡ mb (mod n) implies a ≡ b (mod n). A more substantial corollary is Euclid’s lemma. Theorem 2 (Euclid’s lemma) Let p be prime and a, b ∈ Z. If p | ab then either p | a or p | b. This immediately generalizes to several factors: if p is prime and p | a1 a2 · · · ak then p | aj for some j. If we have a prime p and n ∈ N we can keep dividing n by p until we get a quotient which is not divisible by p. That is there is a number k ≥ 0 with pk | n and pk+1 - n. (That is k is the number of times “p goes into n”.) We write vp (n) for k and Euclid’s lemma is equivalent to vp (mn) = vp (m) + vp (n) for prime p. A straightforward induction shows that all composite numbers (numbers bigger than one which aren’t prime) are products of finite sequences of primes. Euclid’s lemma swiftly gives the following theorem. Theorem 3 (Unique factorization) Let a ∈ N and suppose that a = p1 · · · p r = q1 · · · qs where each pi and qj is prime. Assume also p1 ≤ p2 ≤ · · · ≤ pr and q1 ≤ q2 ≤ · · · ≤ qs . Then r = s and pi = qi for all i. Another way of stating this theorem is to assert that for n ∈ N, v

n = p1p1

(n)

· · · pvrpr (n)

where p1 , . . . , pr are the prime factors of n. A big corollary is the Chinese remainder theorem.

2

Theorem 4 (Chinese Remainder Theorem) Let m, n ∈ N be coprime. For each a, b ∈ N the pair of congruences  x ≡ a (mod m) (∗) x ≡ b (mod n) have a simultaneous solution. Moreover if x and x0 are solutions of (∗) then x ≡ x0 (mod mn). We now look at higher order congruences. Modulo a prime these behave like equations over R or over C. Theorem 5 Let f (x) = ad xd + ad−1 xd−1 + · · · + a0 . Suppose p is prime and p - ad . Then the congruence f (x) ≡ 0 (mod p) has at most d distinct solutions modulo p. In particular an integer has at most two “square roots” modulo a prime. Note it is ESSENTIAL here that p is prime. This fails badly modulo composite numbers. Congruences modulo powers of p can be solved by a trick called Hensel lifting. To solve f (x) ≡ 0 (mod pk ) first solve f (x) ≡ 0 (mod pk−1 ). Any solution of the first congruence is a solution of the second. Let x0 be a solution of the second congruence. Then x0 + pk−1 t also is a solution of the second. But putting x = x0 + pk−1 t into f (x) ≡ 0 (mod pk ) gives, after some manipulation a linear congruence for t modulo p. Solving that gives solutions of the original congruence. Repeat for all solutions of the second. Solving a congruence modulo a general n can be done by combining Hensel lifting and the Chinese remainder theorem. For n ∈ N the Euler phi-function ϕ(n) is defined as the number of a with 1 ≤ a ≤ n such that gcd(a, n) = 1. It is multiplicative: ϕ(mn) = ϕ(m)ϕ(n) provided gcd(m, n) = 1. Therefore ! r h r i Y Y tj tj −1 (pj − 1)pj ϕ pj = j=1

j=1

when the pi are distinct primes. Theorem 6 (Fermat’s little theorem) If p is prime and p - a then ap−1 ≡ 1

(mod p).

If p is prime and b ∈ Z then bp ≡ b (mod p). 3

An extension due to Euler (which I may not prove) is that if n ∈ N and gcd(a, n) = 1 then aϕ(n) ≡ 1 (mod n). If gcd(a, n) = 1 then ar ≡ 1 (mod n) for some r ∈ N. The least exponent r for which this holds is called the order of a modulo n and is denoted ordn (a). Then as ≡ at (mod n) if and only if s ≡ t (mod ordn (a)). In particular for prime p and p - a, vp (a) | (p − 1). If p is a prime and ordp (a) = p − 1 then the numbers 1, a, a2 , . . . , ap−2 are congruent to 1, 2, . . . , p − 1 in some order modulo p. Such an a is called a primitive root. Theorem 7 Let p be a prime. There is a ∈ Z such that ordp (a) = p − 1, that is a is a primitive root of p. A corollary of this (which can also be proved by other methods) is Wilson’s theorem: (p − 1)! ≡ −1 (mod p) for prime p. The proof of the theorem uses the following lemma: if p is prime and d | (p − 1) then xd ≡ 1 (mod p) has exactly d distinct solutions modulo p. Another corollary of this is that x2 ≡ −1 (mod p) is soluble whenever the prime p ≡ 1 (mod 4). A Pythagorean triple is a triple (x, y, z) of positive integers with x2 + y 2 = z 2 . If (x, y, z) is a Pythagorean triple and g is a common factor of two of x, y and z then it divides the third and then (x/g, y/g, z/g) is also a Pythagorean triple. It makes sense to mainly study Pythagorean triples where gcd(x, y, z) = 1, these are primitive Pythagorean triples. In a primitive Pythagorean triple one (x, y, z), of x or y is odd and the other is even (and so then z is odd). We usually stick to the case x odd and y even. Primitive Pythagorean triples can be fully characterized. Theorem 8 Let (x, y, z) be a primitive Pythagorean triple with x odd. Then there are integers r and s (x, y, z) = (r2 − s2 , 2rs, r2 + s2 ), r > s > 0, r + s is odd and gcd(r, s) = 1. Conversely given such r and s then (x, y, z) defined by the above formula is a primitive Pythagorean triple with x odd. A corollary to this is the following theorem. Theorem 9 There are no solutions to the equation x4 + y 4 = z 2 for x, y, z ∈ N. 4

Proof (Outline) We may assume gcd(x, y) = 1. Then (x2 , y 2 , z) is a primitive Pythagorean triple. We can assume x is odd and y is even: then (x2 , y 2 , z) = (r2 − s2 , 2rs, r2 + s2 ) for some integers r and s with r > s > 0, r + s odd and gcd(r, s) = 1. We must have r odd and s even, then from y 2 = 2rs we get r = u2 , s = 2v 2 for coprime positive integers u and v. Then x2 + 4v 4 = u4 and (x, 2v 2 , u2 ) is a primitive Pythagorean triple. Thus (x, 2v 2 , u2 ) = (a2 − b2 , 2ab, a2 + b2 ) for some integers a and b with a > b > 0, a + b odd and gcd(a, b) = 1. From v 2 = ab we get a = c2 , b = d2 for coprime positive integers c and d. Then c4 + d 4 = u 2 . √ But u ≤ u2 = r < r2 + s2 = z so we have a second solution of the original equation with smaller final value. We now say the magic words: “infinite descent”. 2 4 4 4 As a corollary, the equation x + y = z has no positive integer solutions (the n = 4 case of Fermat’s last theorem). We now look at sums of two squares. Let S2 be the set of positive integers which can be written as x2 + y 2 with x, y ∈ Z. Then S2 = {1, 2, 4, 5, 8, 9, 10, 13, 16, 17, 18, 20, 24, 25, 26, 29, 32, 34, 36, 37, 40, . . .}. Can we determine whether or not an integer is in S2 ? As squares are congruent to 0 or 1 modulo 4, each element of S2 is 0, 1 or 2 modulo 4. If n ≡ 3 (mod 4) then n ∈ / S2 . But this observation does not explain why 12 ∈ / S2 , 21 ∈ / S2 and 6 ∈ / S2 (12 ≡ 0, 21 ≡ 1, 6 ≡ 2 (mod 4)). Each of these is divisible by 3 though. From Fermat’s little theorem it is easy to see that if the prime p ≡ 3 (mod 4) the congruence x2 ≡ −1 (mod p) is insoluble. A further corollary is that if such a p satisfies p | (x2 + y 2 ) with x, y ∈ Z then p | x and p | y. Then we see that for such a p, if n ∈ S2 then vp (n) must be even. Fermat proved the converse: n ∈ S2 if and only if vp (n) is even whenever p is a prime with p ≡ 3 (mod 4). There are two ingredients in the proof of Fermat’s theorem. The first is the product formula (a2 + b2 )(c2 + d2 ) = (ac − bd)2 + (ad + bc)2 5

from which it is immediate that S2 is closed under multiplication: m, n ∈ S2 implies mn ∈ S2 . The product formula is easy to remember if you know complex numbers. Let z = a + bi and w = c + di. Then (a2 + b2 )(c2 + d2 ) = |z|2 |w|2 = |zw|2 = |(ac − bd) + (ad + bc)i|2 = (ac − bd)2 + (ad + bc)2 . If vp (n) is even for prime p ≡ 1 (mod n) then n is a product of numbers of the form 2, primes p ≡ 1 (mod 4) and squares. Using the product formula the theorem boils down to proving primes p ≡ 1 (mod 4) are sums of two squares. Theorem 10 Let p be prime and suppose p ≡ 1 (mod 4). Then p ∈ S2 . Proof (outline) The congruence x2 ≡ −1 (mod 4) is soluble. Therefore there is an integer m with 1 ≤ m < p with mp ∈ S2 . If m = 1 we win. If not I’ll show there’s an integer m0 with 1 ≤ m0 < m and with m0 p ∈ S2 . After a finite number of iterations we get down to p ∈ S2 . Let mp = x2 + y 2 with x, y ∈ Z. There are u, v ∈ Z with |u| ≤ m/2, |v| ≤ m/2, u ≡ x (mod m) and v ≡ y (mod m). We can’t have u = v = 0 as that would entail m | x and m | y so that m2 | mp. Let x0 =

ux + vy m

and

y0 =

uy − vx . m

Then x0 and y 0 are integers (WHY?) and (u2 + v 2 )(x2 + y 2 ) u2 + v 2 x +y = = p m2 m 02

02

(WHY?). Clearly m | (u2 + v 2 ) and so m0 = (u2 + v 2 )/m is a nonnegative integer. As we don’t have u = v = 0 then m0 > 0. As |u| ≤ m/2 and |v| ≤ m/2 then m0 ≤ m/2 < m. Also m0 p ∈ S2 . 2 0 Note that as m ≤ m/2 we need at most log2 m < log2 p iterations, so this gives a practical algorithm, provided we can solve x2 ≡ −1 (mod p) (later we see we can do this in practice). In fact the representation of a prime p as the sum of two squares is essentially unique. If x2 + y 2 = p has the solution (x, y) = (x0 , y0 ) the only solutions are (x, y) = (±x0 , ±y0 ) and (x, y) = (±y0 , ±x0 ). There is a formula for r2 (n), the number of representations of n as x2 + y 2 where x, y ∈ Z (NB here we regard r2 (13) = 8 since (±2, ±3) and (±3, ±2) count as eight representations), namely r2 (n) = d1,4 (n) − d3,4 (n) 6

where da,m (n) is the number of factors of n in N congruent to a modulo n. I probably won’t prove this. After two squares comes not three squares but four squares. Let S4 be the set of natural numbers of the form x2 + y 2 + z 2 + t2 with x, y, z, t ∈ Z. Lagrange proved that S4 = N: every natural number is the sum of four squares of integers. As with two squares, the key is a product formula: (a2 + b2 + c2 + d2 )(x2 + y 2 + z 2 + t2 ) = (ax + by + cz + dt)2 + (−ay + bx − ct + dz)2 (−az + bt + cz − dy)2 + (−at − bz + cy + dx)2 which shows that S4 is closed under multiplication: m, n ∈ S4 implies mn ∈ S4 . This comes from the theory of quaternions! Proving Lagrange boils down to proving each prime p ∈ S4 and by two squares we can assume p ≡ 3 (mod 4). Theorem 11 Let p be a prime congruent to 3 modulo 4. Then p ∈ S4 . Proof (Outline) By a pigeonhole principle argument, one shows there are u, v ∈ Z with u2 + v 2 + 1 ≡ 0 (mod p). Let √ A = {(a, b, c, d) ∈ Z4 : 0 ≤ a, b, c, d < p}. Then |A| > p2 . By the pigeonhole principle there are distinct (a1 , b1 , c1 , d1 ), (a2 , b2 , c2 , d2 ) ∈ A with ua1 + vb1 − c2 ≡ ua2 + vb2 − c2

(mod p)

va1 − ub1 − d2 ≡ va2 − ub2 − d2

(mod p).

and Setting a = a1 − a2 etc., we get ua + vb − c ≡ va − ub − d ≡ 0

(mod p).

These imply a2 + b2 + c2 + d2 ≡ 0 (mod p). Now (a, b, c, d) 6= (0, 0, 0, 0) so √ a2 +b2 +c2 +d2 = mp with m ∈ N. But |a| < p etc. so that a2 +b2 +c2 +d2 < 4p. Thus m = 1, 2 or 3. If m = 1 we win, otherwise by a bit of hacking we can transform a representation of 2p or 3p into one for p. 2 There is a formula for the number r4 (n) of representations of n as a sum of four squares:  8σ∗ (n) if n is odd, r4 (n) = 24σ∗ (n) if n is even 7

where σ∗ (n) is the sum of the odd (positive) divisors of n. I certainly won’t prove this. What about sums of three squares? This is a lot harder! Let S3 denote the set of sums of three squares. There are m, n ∈ S3 but with mn ∈ / S3 so there cannot be a product formula! One can easily show that 4m ∈ S3 implies m ∈ S3 and if m ≡ 7 (mod 8) then m ∈ / S3 . Thus if n = 4k m with m ≡ 7 (mod 8) then n ∈ / S3 . Gauss proved the converse: if n ∈ N is not of this form, then n ∈ S3 . This is still a very hard theorem! We turn to computational number theory. Obviously the first computational problem in number theory is to distinguish if a number is prime. Obviously not if it has an obvious proper factor, but what if it hasn’t. Trial division is the obvious√method. Given a number n, test whether it is divisible by each prime p ≤ n. This is foolproof, √ but only practical for smallish n. The number of primes ≤ n is about 2 n/ log n so this would be hopeless for n of say 100 digits. Nevertheless trial division up to a given bound is good for pulling out the small prime factors of a large composite number. The next test is the Fermat test. If p is prime and 1 < a < p then a(p−1) ≡ 1 (mod p). Thus is n is a large odd number, 1 < a < n and an−1 6≡ 1 (mod n) then n is certainly composite (although doing this calculation doesn’t give a factor of n). Alas if an−1 ≡ 1 (mod n) then it doesn’t follow that n must be prime. If n is not prime but this holds we call n a pseudoprime to base a. One might hope that pseudoprimes are fairly rare, but there are some very annoying numbers called Carmichael numbers. These are composite numbers n which are pseudoprime to every base a with gcd(a, n) = 1. Unless one is lucky and hits on an a with gcd(a, n) > 1 a Carmichael number will look like a prime as far as the Fermat test is concerned. In 1994, Alford, Granville and Pomerance proved that there are infinitely many Carmichael numbers, indeed they proved for large enough N there are at least N 2/7 of them between 1 and N . Before discussing an improvement to the Fermat test, note that it requires calculating an−1 modulo n. So how does one calculate ar modulo n in general. The most obvious approach is useless: whatever you do, don’t calculate ar as an integer and then reduce it modulo n. If r is 100 digits long say, even 2r would be a number too big to write down in a small universe like ours! Clearly we should do all intermediate calculations modulo n, which would not involve any numbers more than twice the length of n. The next approach that doesn’t work is to calculate ar by computing a2 , a3 , a4 all the way up to ar in turn. This takes far too much time! The trick for doing this is “binary powering”. If r = 2s is even, to compute ar (mod n) first compute 8

b ≡ as (mod n) and then ar ≡ b2 (mod n). If r = 2s + 1 is even, to compute ar (mod n) first compute b ≡ as (mod n) and then ar ≡ ab2 (mod n). By doing this recursively we need about log2 r steps and at most about 2 log2 r multiplications. This is practical for numbers hundreds of digits long! An improvement on the Fermat test is the Miller-Rabin test. The key observation is that if p is prime and x2 ≡ 1 (mod p) then x ≡ ±1 (mod p). Therefore if x2 ≡ 1 (mod n) but x 6≡ ±1 (mod n) then n is definitely composite. To perform the Miller-Rabin test, write n − 1 = 2k m with m odd. k Compute in turn am , a2m , a4m up to a2 m = an−1 modulo n. If an−1 6≡ 1 (mod n) then n is composite. But if anywhere on this sequence a 1 turns up, preceded by a value not ±1 (mod n) then n is composite also. Again with the Miller-Rabin test there are composites which look like primes with a given a (strong pseudo-primes to base a). But there is no analogue of Carmichael numbers. One can prove that if n is composite, then the number of a with 1 < a < n with respect to which n is a strong pseudoprime is less than n/4. Given composite n, picking an a at random with probability > 3/4 Miller-Rabin will prove n is composite. Repeating this one can be as “sure as one likes” that a given large number is prime (although Miller-Rabin cannot prove a number is prime). We now turn to factorizing numbers: given a composite number n, how can we write n as a product of prime numbers? This problem has received a lot of attention since the 1970s when the RSA (Rivest, Shamir, Adleman) cryptosystem was invented. RSA is a public key cryptosystem. Alice selects two large primes p and q and a number d coprime to ϕ(n) = (p − 1)(q − 1) where n = pq. She solves the congruence de ≡ 1 (mod (p − 1)(q − 1)). Her public key is the pair (n, d) and her private key is e. Bob communicates with Alice as follows. His message is a number a with 0 ≤ a < n and he encrypts it by computing b ≡ ad (mod n). Alice can decrypt the message by computing be modulo n as be ≡ ade ≡ a (mod n). The only known way to crack RSA is to find the prime factors of n. Trial division can find the factors of a small n easily enough, and the small prime factors of a general n. However “RSA numbers” are chosen to be far too high for trial division to be practical. Most advanced factorization methods find a number a (or a sequence of such numbers) such that a is more likely than average to be divisible by a prime factor of n, but that a isn’t a multiple of n. In that case gcd(a, n) (computed via the Euclidean algorithm) is a proper factor of n. We describe two such algorithms. The Pollard p − 1 method hopes to find a prime factor of p of n with the property that p − 1 is “smooth”, that is p − 1 is a product of small primes. There are many ways of implementing this, but here is a simple way. Pick 9

some number a with 1 < a < n. Compute a sequence of numbers bk as follows: b1 = a and bk ≡ bkk−1 (mod n) for k > 1. Then bk ≡ ak! (mod n). If n has a prime factor p for which p − 1 is smooth, then (p − 1) | k! for some smallish k. By Fermat’s little theorem, bk ≡ ak! ≡ 1 (mod p), but unless we are unlucky bk ≡ ak! 6≡ 1 (mod n). So we compute gcd(bk − 1, n) for k = 1, 2, 3, . . . and hope that a factor of n suddenly pops out. Alas, this method is useless if the the prime factors p of n all have p − 1 non-smooth. There are variants: a p + 1 method which works when some p + 1 is smooth, and a recent outgrowth is the elliptic curve method which works in full generality. We now describe the Pollard rho method. We want to find a prime factor p of a given composite n. We pick a simple polynomial f (x) with integer coefficients, and an integer a0 as a starting value. As an example of f , f (x) = x2 + 1 usually works well (NB f of degree 1, f (x) = x2 and f (x) = x2 − 2 are BAD!). Compute a sequence (ak ) by ak+1 ≡ f (ak ) (mod n). Eventually this sequence goes into a loop: for some k < l, ak = al and so ak+j = al+j for j ≥ 0. The idea of Pollard rho is that we expect the sequence to go into a loop considered modulo p much earlier than it goes into a loop modulo n. That is there are r < s with ar ≡ as (mod p) but ar 6≡ as (mod n). Then gcd(ar − as , n) is a proper factor of n. Floyd’s trick is to compute the values of gcd(ak − a2k , n) for k going from 1 upwards. This keeps storage space low and is easy to program. Beyond Pollard rho factor base methods have become dominant. The most powerful known is the Number Field Sieve (NFS) (originally die to Pollard too). The biggest triumph of the NFS is the factorization of the 232-digit challenge number RSA-768 in 2009 by a team led by Kleinjung. The NFS is very complex to describe and even more complex to implement. For an odd number p an integer a with p - a for which x2 ≡ a (mod p) is soluble is a quadratic residue modulo p; an integer a for which x2 ≡ a (mod p) is insoluble is a quadratic nonresidue modulo p. There are 21 (p − 1) quadratic residues and 12 (p − 1) quadratic nonresidues modulo p. Euler’s criterion is that a(p−1)/2 ≡ 1 (mod p) when a is a quadratic residue and a(p−1)/2≡−1 (mod p) when a is a quadratic nonresidue. The Legendre symbol ap is defined to be 1 if a is a quadratic   residue, −1 if a is a quadratic nonresidue and 0 if p | a (so a(p−1)/2 ≡ ap ). Consequently −1 is a quadratic residue of an odd prime p if and only if p ≡ 1 (mod 4). Gauss’s lemma gives a criterion for the value of the Legendre symbol. We coin a phrase: an integer a is p-positive if p - a and a is greater than the nearest multiple of p, and a is p-negative if p - a and a is less than the nearest multiple of p. 10

Theorem 12 (Gauss’s lemma) Let p be an odd prime, and a an integer   a with p - a. Then p = (−1)r where r is the number of integers j such that 0 < j < p/2 and aj is p-negative.   An easy corollary is that p2 = 1 if and only if p ≡ 1 (mod 8). A much harder corollary is the law of quadratic reciprocity. Theorem    13 (Quadratic reciprocity) Let p and qbeodd primes.   Then p q p = p unless p ≡ q ≡ −1 (mod 4) in which case q = − pq . q

11