\documentclass{article}

\usepackage{amssymb}
\usepackage{amsthm}
\usepackage[UKenglish]{babel}
\usepackage{enumitem}
\usepackage{fancyhdr}
\usepackage[margin=1in]{geometry}
\usepackage{graphicx}
\usepackage[utf8]{inputenc}
\usepackage{listings}
\usepackage{mathtools}
\usepackage{tikz-cd}
\usepackage{csquotes}

\newcommand{\F}{\mathbb{F}}
\newcommand{\N}{\mathbb{N}}
\newcommand{\Z}{\mathbb{Z}}
\newcommand{\Q}{\mathbb{Q}}
\newcommand{\R}{\mathbb{R}}
\newcommand{\C}{\mathbb{C}}
\renewcommand{\H}{\mathbb{H}}

\newcommand{\val}[1]{\left. #1 \right\rvert}
\newcommand{\rb}[1]{\left( #1 \right)}
\renewcommand{\sb}[1]{\left[ #1 \right]}
\newcommand{\cb}[1]{\left\{ #1 \right\}}
\newcommand{\ab}[1]{\left\langle #1 \right\rangle}
\newcommand{\abs}[1]{\left\lvert #1 \right\rvert}
\newcommand{\two}[2]{\begin{pmatrix} #1 \\ #2 \end{pmatrix}}
\newcommand{\three}[3]{\begin{pmatrix} #1 & #2 & #3 \end{pmatrix}}

\newcommand{\unit}[1]{\rb{\Z / #1\Z}^\times}
\newcommand{\legendre}[2]{\rb{\tfrac{#1}{#2}}}

\theoremstyle{definition}\newtheorem{definition}{Definition}
\theoremstyle{definition}\newtheorem{remark}[definition]{Remark}
\theoremstyle{definition}\newtheorem*{example}{Example}
\theoremstyle{definition}\newtheorem*{note}{Note}
\newtheorem{proposition}[definition]{Proposition}
\newtheorem{lemma}[definition]{Lemma}
\newtheorem{theorem}[definition]{Theorem}
\newtheorem{corollary}[definition]{Corollary}

\pagestyle{fancy}
\lhead{M3P14 Number Theory}
\rhead{Autumn 2018}

\title{M3P14 Number Theory}
\author{Lectured by Prof Toby Gee \\ Typeset by David Kurniadi Angdinata}
\date{Autumn 2018}

\setcounter{section}{-1}

\begin{document}

\maketitle

\vfill

\tableofcontents

\pagebreak

\marginpar{Lecture 1 \\ Friday \\ 05/10/18}

\section{Introduction}

Roughly speaking number theory is the study of the integers. More specifically, problems in number theory often have a lot to do with primes and divisibility, congruences, and include problems about the rational numbers. For example, solving equations in integers or in the rationals, such as $ x^2 - 2y^2 = 1 $, etc. We will be looking at problems that can be tackled by elementary means, but this does not mean easy. Also the statements of problems can be elementary without the solution being elementary, such as Fermat's Last Theorem, or even known, such as the twin prime conjecture. Sometimes we will state interesting things, like the prime number theorem, without proving them. Typically these will be things that we could prove if the course was much longer. We will start the course with a look at prime numbers and factorisation, a review of Euclid's algorithm and consequences, congruences, the structure of $ \unit{n} $, RSA algorithm, and quadratic reciprocity. We will return to primes at the end, too. Typical questions here include the following.
\begin{enumerate}
\item How do you tell if a number is prime?
\item How many primes are there congruent to $ a $ modulo $ b $ for given $ a, b $?
\item How many primes are there less than $ n $?
\end{enumerate}
A warning is that we will be using plenty of things from previous algebra courses, about groups, rings, ideals, fields, Lagrange's theorem, the first isomorphism theorem, and so on. You may want to revise this material if you are not comfortable with it. The course is not based on any particular book, although some material, such as continued fractions, was drawn from the following.
\begin{enumerate}
\item A Baker, A concise introduction to the theory of numbers, 1984
\end{enumerate}
Not everything we will do is in that book, though.

\section{Euclid's algorithm and unique factorisation}

\subsection{Divisibility}

\begin{definition}
Let $ a, b \in \Z $. We say that $ a $ \textbf{divides} $ b $, written $ a \mid b $, if there exists $ c \in \Z $ such that $ b = ac $. If $ a $ does not divide $ b $, write $ a \nmid b $.
\end{definition}

\begin{note}
If $ a, b, c \in \Z $ such that $ a \mid b $ and $ a \mid c $, then $ a \mid \rb{rb + sc} $ for any $ r, s \in \Z $.
\end{note}

\begin{definition}
Let $ a, b \in \Z $, not both zero. The \textbf{greatest common divisor} (GCD) or \textbf{highest common factor} (HCF) of $ a $ and $ b $, written $ \rb{a, b} $, is the largest positive integer dividing both $ a $ and $ b $.
\end{definition}

Such an integer always exists since if $ a \ne 0 $ and $ c \mid a $, then $ -a \le c \le a $.

\begin{example}
$ \rb{-10, 15} = 5 $.
\end{example}

\begin{note}
This notation is consistent with notation from ring theory. The ring $ \Z $ is a principal ideal domain (PID), that is it is an integral domain, and every ideal can be generated by one element. The ideal generated by $ f_1, \dots, f_n \in R $ for some ring $ R $ is usually written $ \rb{f_1, \dots, f_n} $, and indeed the ideal $ \rb{a, b} $ is generated by the highest common factor of $ a $ and $ b $, by Theorem \ref{thm:6} below.
\end{note}

\begin{definition}
$ n \in \Z $ is \textbf{prime} if $ n $ has exactly two positive divisors, namely $ 1 $ and $ n $.
\end{definition}

\begin{note}
By definition, primes can be both positive and negative. In spite of this, frequently when people talk about prime numbers they restrict to the positive case. In this course when we say 'Let $ p $ be a prime number' we will generally mean $ p > 0 $. Also $ 1 $ is not prime.
\end{note}

\subsection{Euclid's algorithm}

\begin{proposition}
Let $ a, b \in \Z $, not both zero. Then for any $ n \in \Z $, we have $ \rb{a, b} = \rb{a, b - na} $.
\end{proposition}

\begin{proof}
By definition of $ \rb{a, b} $, it suffices to show that any $ r \in \Z $ divides both $ a $ and $ b $ if and only if it divides both $ a $ and $ b - na $. But if $ r $ divides $ a $ and $ b $, it clearly divides $ b - na $, and if it divides $ a $ and $ b - na $, it clearly divides $ b $.
\end{proof}

This suggests an approach to computing $ \rb{a, b} $ by replacing $ \rb{a, b} $ by a pair $ \rb{a, b - na} $, and repeat until the numbers involved are small enough that it is easy to compute the greatest common divisor. The key to being able to do this is the following innocuous looking result.

\begin{theorem}
\label{thm:5}
Let $ a, b \in \Z $ with $ b > 0 $. Then there exist unique $ q, r \in \Z $ such that $ a = qb + r $ and $ 0 \le r < b $.
\end{theorem}

\begin{proof}
Let $ q = \lfloor a / b \rfloor $ be the largest integer less than $ a / b $. Then by definition $ 0 \le a / b - q < 1 $. Thus $ 0 \le a - qb < b $, so we can take $ r = a - bq $. Uniqueness is easy.
\end{proof}

This gives us \textbf{Euclid's algorithm} for finding $ \rb{a, b} $ for any $ a, b \in \Z $ not both zero. Without loss of generality, assume $ 0 \le b \le a $ and $ a > 0 $.
\begin{enumerate}
\item Check if $ b = 0 $. If so then $ \rb{a, b} = a $.
\item Otherwise, replace $ \rb{a, b} $ with $ \rb{b, r} $ as in Theorem \ref{thm:5}. Then return to step 1.
\end{enumerate}
Since at every stage $ \abs{a} + \abs{b} $ is decreasing, this algorithm terminates. We have shown that $ \rb{a, b} = \rb{b, r} $ so the output is always equal to $ \rb{a, b} $.

\begin{example}
Let us make this explicit.
\begin{align*}
\rb{120, 87}
& = \rb{87, 33} & 120 = 87 + 33 \\
& = \rb{33, 21} & 87 = 2\rb{33} + 21 \\
& = \rb{21, 12} & 33 = 21 + 12 \\
& = \rb{12, 9} & 21 = 12 + 9 \\
& = \rb{9, 3} & 12 = 9 + 3 \\
& = \rb{3, 0} & 9 = 3\rb{3} + 10
\end{align*}
Now run this backwards, writing out the equations.
\begin{align*}
3
& = 12 - 9 \\
& = 12 - \rb{21 - 12} \\
& = 2\rb{12} - 21 \\
& = 2\rb{33 - 21} - 21 \\
& = 2\rb{33} - 3\rb{21} \\
& = 2\rb{33} - 3\rb{87 - 2\rb{33}} \\
& = 8\rb{33} - 3\rb{87} \\
& = 8\rb{120 - 87} - 3\rb{87} \\
& = 8\rb{120} - 11\rb{87}.
\end{align*}
\end{example}

The same works in general, that is the algorithm gives us more than just a way to compute $ \rb{a, b} $. It also allows us to express $ \rb{a, b} $ in terms of $ a $ and $ b $.

\begin{theorem}
\label{thm:6}
Let $ a, b \in \Z $, not both zero. Then there exist $ r, s \in \Z $ such that $ \rb{a, b} = ra + sb $.
\end{theorem}

\begin{proof}
Let $ a_0 = a $ and $ b_0 = b $, and for each $ i $ let $ \rb{a_i, b_i} $ be the result after running $ i $ steps of Euclid's algorithm on the pair $ \rb{a, b} $. For some $ r $ we have $ a_r = \rb{a, b} $ and $ b_r = 0 $. We will show, by downwards induction on $ i $, that there exist $ n_i, m_i \in \Z $ such that $ \rb{a, b} = n_ia_i + m_ib_i $. For $ i = r $ this is clear. On the other hand, for any $ i $ we have $ a_i = b_{i - 1} $ and $ b_i = a_{i - 1} - q_ib_{i - 1} $ for some $ q_i \in \Z $. Thus if $ \rb{a, b} = n_ia_i + m_ib_i $, we have
$$ \rb{a, b} = n_ib_{i - 1} + m_i\rb{a_{i - 1} - q_ib_{i - 1}} = \rb{n_i - m_iq_i}b_{i - 1} + m_ia_{i - 1}, $$
and the claim follows.
\end{proof}

\subsection{Unique factorisation}

The fact that $ \rb{a, b} $ is an integer linear combination of $ a $ and $ b $ has strong consequences for factorisation and divisibility. First note the following.

\begin{proposition}
\label{prop:7}
Let $ n, a, b \in \Z $, and suppose that $ n \mid ab $ and $ \rb{n, a} = 1 $. Then $ n \mid b $.
\end{proposition}

\begin{proof}
Since $ \rb{n, a} = 1 $, there exist $ r, s \in \Z $ such that $ rn + sa = 1 $. Thus $ rnb + sab = b $. But $ n $ clearly divides $ rnb $ and $ sab $, so $ n \mid b $.
\end{proof}

By definition, if $ n $ is prime, then either $ n \mid a $ or $ \rb{n, a} = 1 $. If $ \rb{n, a} = 1 $, we say that $ n, a $ are \textbf{coprime}.

\marginpar{Lecture 2 \\ Tuesday \\ 09/10/18}

\begin{corollary}
\label{cor:8}
If $ p $ is prime, and $ a, b \in \Z $ are such that $ p \mid ab $, then either $ p \mid a $ or $ p \mid b $.
\end{corollary}

\begin{proof}
If $ p \nmid a $ then $ \rb{p, a} = 1 $, so \ref{prop:7} implies $ p \mid b $.
\end{proof}

\begin{proposition}
\label{prop:9}
If $ \rb{a, b} = 1 $, and $ a \mid n $ and $ b \mid n $, then $ ab \mid n $.
\end{proposition}

\begin{proof}
By \ref{thm:6}, we can write $ n = n\rb{a, b} = nra + nsb $ with $ r, s \in \Z $. Each term is divisible by $ ab $, so $ ab \mid n $.
\end{proof}

We say that $ m_1, \dots, m_n \in \Z $ are \textbf{pairwise coprime} if $ \rb{m_i, m_j} = 1 $ for all $ i \ne j $.

\begin{corollary}
\label{cor:10}
Suppose that $ m_1, \dots, m_n $ are pairwise coprime. If $ m_i \mid N $ for all $ i $, then $ m_1 \dots m_n \mid N $.
\end{corollary}

\begin{proof}
Induction on $ n $. $ n = 2 $ is Proposition \ref{prop:9}. (TODO Exercise)
\end{proof}

We can now prove the existence and uniqueness of prime factorisations.

\begin{proposition}
\label{prop:11}
Every $ n \in \Z^\times $ can be written as $ \pm p_1 \dots p_r $ for some $ r \ge 0 $ and some primes $ p_1, \dots, p_r $.
\end{proposition}

\begin{proof}
Use induction on $ \abs{n} $. The case $ \abs{n} $ is trivial, so suppose $ \abs{n} > 1 $. Then either $ \abs{n} $ is prime, or $ \abs{n} = ab $ with $ 1 < a, b < \abs{n} $, and by induction each of $ a, b $ is a product of primes.
\end{proof}

\begin{theorem}
Let $ n \in \Z_{> 0} $. Then $ n $ can be written as $ p_1 \dots p_r $ where the $ p_i $ are prime, and are uniquely determined up to reordering.
\end{theorem}

\begin{proof}
Existence is Proposition \ref{prop:11}. For uniqueness, suppose that
$$ n = p_1 \dots p_r = q_1 \dots q_s, $$
with $ p_i, q_i $ prime. Then without loss of generality suppose $ r, s \ge 1 $. Then $ p_1 \mid p_1 \dots p_r $, so $ p_1 \mid q_1 \dots q_s $. By Corollary \ref{cor:8}, either $ p_1 \mid q_1 $ or $ p_1 \mid q_2 \dots q_s $. Proceeding inductively, eventually $ p_1 \mid q_i $ for some $ i $. Since $ q_i $ is prime this means $ p_1 = q_i $. We then have
$$ p_2 \dots p_r = q_1 \dots q_i \dots q_s. $$
Since this product is smaller than $ n $, by the inductive hypothesis we must have $ r - 1 = s - 1 $ and the $ p_i $ except $ p_1 $ are a rearrangement of the $ q_i $ except $ q_i $.
\end{proof}

Put together, these are the fundamental theorem of arithmetic.

\subsection{Linear diophantine equations}

Suppose now that we are given $ a, b, c \in \Z^\times $ and we want to solve $ ax + by = c $ for $ x, y \in \Z $. We first note that $ \rb{a, b} $ divides both $ a $ and $ b $, so for there to be any solutions, we must have $ \rb{a, b} \mid c $.

\begin{example}
$ 2x + 6y = 3 $ has no solutions.
\end{example}

From now on, suppose this is true. Let $ a' = a / \rb{a, b} $, $ b' = b / \rb{a, b} $, and $ c' = c / \rb{a, b} $. Then $ ax + by = c $ if and only if $ a'x + b'y = c' $. By Theorem \ref{thm:6}, since $ \rb{a', b'} = 1 $, we can find $ r, s \in \Z $ with $ a'r + b's = 1 $, so $ a'rc' + b'sc' = c' $. So $ x = rc' $, $ y = sc' $ is a solution. $ X, Y $ is another solution if and only if $ a'X + b'Y = a'x + b'y $, if and only if $ a'\rb{X - x} = b'\rb{y - Y} $. For this to hold, we need $ a' \mid \rb{y - Y} $, $ b' \mid \rb{X - x} $. Putting this all together, we find that if $ x, y $ is one solution to $ ax + by = c $, then the other solutions are exactly of the form
$$ X = x + n\dfrac{b}{\rb{a, b}}, \qquad Y = y - n\dfrac{a}{\rb{a, b}} $$
for all $ n \in \Z $.

\begin{example}
Using the example above where we have $ 8\rb{120} - 11\rb{87} = 3 $, we can solve $ 120x + 87y = 9 $. One solution is $ x = 24 $ and $ y = -33 $. The general solution is $ x = 24 + 29n $ and $ y = -33 - 40n $. Taking $ n = -1 $, we have for example, $ x = -5 $ and $ y = 7 $.
\end{example}

\section{Congruences and modular arithmetic}

\subsection{Congruences}

\begin{definition}
Let $ n \in \Z^\times $, and let $ a, b \in \Z $. We say $ a $ is \textbf{congruent to $ b $ modulo $ n $}, written $ a \equiv b \mod n $, if $ n \mid \rb{a - b} $.
\end{definition}

For $ n $ fixed, it is easy to verify that congruence modulo $ n $ is an equivalence relation, and therefore partitions $ \Z $ into equivalence classes. The set of equivalence classes modulo $ n $ is denoted $ \Z / n\Z $.

\begin{example}
If $ a \equiv b \mod n $, $ c \equiv d \mod n $, then $ a + c \equiv b + d \mod n $ and $ ac \equiv bd \mod n $.
\end{example}

In fact $ \Z / n\Z $ is a ring, with the obvious addition and multiplication. Indeed $ n\Z = \cb{nr \mid r \in \Z} $ is an ideal in $ \Z $, and $ \Z / n\Z $ is just the quotient ring. For any $ a \in \Z $, we sometimes write $ \bar{a} $ for the image of $ a $ in $ \Z / n\Z $. We can write $ a = qn + r $ with $ 0 \le r < n $. Then $ a \equiv r \mod n $, so $ \bar{a} = \bar{r} $.

\begin{example}
If $ n = 12 $, then $ \bar{25} = \bar{1} $.
\end{example}

It follows that $ 0, \dots, n - 1 $ are representatives for the elements of $ \Z / n\Z $, so every element of $ \Z / n\Z $ is equal to $ \bar{r} $ for some unique $ r \in \cb{0, \dots, n - 1} $. It will also be convenient to write $ \Z / n\Z = \cb{0, \dots, n - 1} $.

\begin{example}
If $ n = 6 $, we could write $ 3 + 4 = 1 $ and $ 3 \times 4 = 0 $.
\end{example}

Recall that if $ R $ is a commutative ring, a \textbf{unit} of $ R $ is an element with a multiplicative inverse, that is $ x $ such that there exists $ y \in R $ with $ xy = 1 $. Write $ R^\times $ for the set of units in $ R $. This is a group under multiplication.

\begin{example}
$ \Z^\times = \cb{\pm 1} $ and $ \Q^\times = \Q \setminus \cb{0} = \cb{x \in \Q \mid x \ne 0} $.
\end{example}

We want to understand $ \unit{n} $. Which elements of $ \cb{0, \dots, n - 1} $ are in $ \unit{n} $? If $ r \in \Z $ and $ \bar{r} \in \unit{n} $ then there exists $ s \in \Z $ such that $ rs \equiv 1 \mod n $. This implies that $ \rb{r, n} = 1 $. Conversely, if $ \rb{r, n} = 1 $, then there exist $ x, y \in \Z $ such that $ rx + ny = 1 $, so $ \bar{rx} = 1 $, so $ \bar{r} $ is a unit. Thus we have $ \unit{n} = \cb{\bar{i} \mid \rb{i, n} = 1} $.

\begin{note}
If $ p $ is a prime, then either $ a \equiv 0 \mod p $ or $ \rb{a, p} = 1 $, so $ \unit{p} = \cb{1, \dots, p - 1} $. Thus every non-zero congruence class modulo $ p $ is a unit, that is $ \Z / p\Z $ is a ring with the property that every non-zero element has a multiplicative inverse, so it is a field. Another equivalent way to see this is to check that $ p\Z $ is a maximal ideal of $ \Z $.
\end{note}

\marginpar{Lecture 3 \\ Wednesday \\ 10/10/18}

\subsection{Linear congruence equations}

Fix $ a, b \in \Z $ and $ c \in \Z^\times $. Suppose we want to solve $ ax \equiv b \mod c $. This is equivalent to finding $ x, y $ such that $ ax + cy = b $. In particular, by our analysis of linear diophantine equations, there is a solution precisely when $ \rb{a, c} \mid b $. Furthermore, there is a unique solution modulo $ c' = c / \rb{a, c} $, because all the solutions are obtained by adding multiples of $ c' $ to our given $ x $, and subtracting the corresponding multiple of $ a / \rb{a, c} $ from $ y $. This implies that there are a total of $ \rb{a, c} $ solutions to the original congruence modulo $ c $. If $ x $ is a solution, the other solutions are of the form $ X = x + c'j $ for $ 0 \le j < \rb{a, c} $. In particular, if $ \rb{a, c} = 1 $, then there is a unique solution to $ ax \equiv b \mod c $. Indeed $ a \in \unit{c} $, so it has an inverse $ a^{-1} $, and $ x \equiv a^{-1}b \mod c $ is the unique solution.

\begin{example}
$ 2x \equiv 3 \mod 6 $ has no solutions as $ \rb{2, 6} = 2 \nmid 3 $. $ 2x \equiv 4 \mod 6 $, which is equivalent to $ x \equiv 2 \mod 3 $, has solutions $ x \equiv 2 \mod 6 $ and $ x \equiv 5 \mod 6 $.
\end{example}

\subsection{Chinese remainder theorem}

\begin{theorem}[Chinese remainder theorem]
Let $ m_1, \dots, m_n \in \Z_{\ge 0} $ be pairwise coprime. Then the natural map
$$ \Z / m_1 \dots m_n\Z \to \Z / m_1\Z \times \dots \times \Z / m_n\Z $$
is an isomorphism of rings, and the induced map
$$ \unit{m_1 \dots m_n} \to \unit{m_1} \times \dots \times \unit{m_n} $$
is an isomorphism of abelian groups.
\end{theorem}

\begin{note}
This is false without the assumption that $ m_i $ pairwise coprime, for example $ m_1 = m_2 = 2 $.
\end{note}

\begin{proof}
Note firstly that the map exists and is a ring homomorphism. This follows from the fact that if $ x \equiv y \mod m_1 \dots m_n $ then certainly $ x \equiv y \mod m_i $ for each $ i $. The source and target of the ring homomorphism both have order $ m_1 \dots m_n $, so it suffices to show that the map is injective to show that it is an isomorphism. So we only need to check that the kernel is zero. So we need to know that if $ m_i \mid N $ for all $ i $, that is $ \bar{N} = 0 $ in $ \Z / m_i\Z $, then $ m_1 \dots m_n \mid N $, that is $ \bar{N} = 0 $ in $ \Z / m_1 \dots m_n\Z $. This is just Corollary \ref{cor:10}. The statement about unit groups follows by noting that if $ R, S $ are rings, then $ \rb{R \times S}^\times = R^\times \times S^\times $.
\end{proof}

\begin{note}
This can be reformulated more concretely as a statement about congruences. It says that for any $ a_i $, there is a unique $ x \mod m_1 \dots m_n $ such that $ x \equiv a_i \mod m_i $. The proof does not tell us how to find $ x $, but it is actually quite easy in practice. Here is one way to do it. Write $ M = m_1 \dots m_n $ and $ M_i = M / m_i $. Choose $ q_i $ such that $ q_iM_i \equiv 1 \mod m_i $, using Euclid's algorithm and $ \rb{M_i, m_i} = 1 $ because $ \rb{m_j, m_i} = 1 $ for all $ j \ne i $. Then set
$$ x = a_1q_1M_1 + \dots + a_nq_nM_n. $$
For each $ i $ we have $ M_j \equiv 0 \mod m_i $ if $ i \ne j $, so $ x \equiv a_iq_iM_i \equiv a_i \mod m_i $ for each $ i $.
\end{note}

\section{The structure of $ \unit{n} $}

For the next few lecture we will study the abelian group $ \unit{n} $.

\subsection{The Euler $ \Phi $ function}

We define a function $ \Phi\rb{n} $ on $ \Z_{> 0} $ by letting $ \Phi\rb{n} $ denote the order of $ \unit{n} $. Explicitly we have $ \Phi\rb{n} = \#\cb{1 \le i < n \mid \rb{i, n} = 1} $, that is $ \Phi\rb{n} $ is the number of integers between $ 0 $ and $ n - 1 $ coprime to $ n $.

\begin{example}
If $ p $ is prime, $ \Phi\rb{p} = p - 1 $.
\end{example}

$ \Phi $ is called \textbf{Euler's $ \Phi $ function}.

\begin{definition}
A function $ f $ on $ \Z_{> 0} $ is \textbf{multiplicative} if for all $ m, n \in \Z $ such that $ \rb{m, n} = 1 $, we have $ f\rb{mn} = f\rb{m}f\rb{n} $. We say $ f $ is \textbf{strongly multiplicative} if for any pair of $ m, n \in \Z_{> 0} $ we have $ f\rb{mn} = f\rb{m}f\rb{n} $.
\end{definition}

\begin{note}
By the Chinese remainder theorem, $ \Phi $ is multiplicative, because if $ \rb{m, n} = 1 $ then $ \unit{mn} \cong \unit{m} \times \unit{n} $, but not strongly multiplicative, since $ \Phi\rb{4} = 2 \ne 1 = \Phi\rb{2}\Phi\rb{2} $.
\end{note}

It is clear that a multiplicative function is determined by its values on prime powers. For $ p $ prime we have $ \rb{i, p^a} = 1 $ if and only if $ p $ does not divide $ i $, so $ \Phi\rb{p^a} $ is the number of integers between $ 0 $ and $ p^a - 1 $ that are not divisible by $ p $. There are $ p^{a - 1} $ numbers in this range divisible by $ p $, so we have
$$ \Phi\rb{p^a} = \#\cb{1 \le i < p^a \mid \rb{i, p^a} = 1} = \#\cb{1 \le i < p^a \mid p \nmid i} = p^a - p^{a - 1} = p^a\rb{1 - \dfrac{1}{p}}. $$
Write $ n = \prod_i p_i^{a_i} $ where $ p_i $ are distinct primes. From this and multiplicativity of $ \Phi $ one has that
$$ \Phi\rb{n} = \prod_i \Phi\rb{p_i^{a_i}} = \prod_i p_i^{a_i}\rb{1 - \dfrac{1}{p_i}} = n\prod_i \rb{1 - \dfrac{1}{p_i}} = n\prod_{p \mid n} \rb{1 - \dfrac{1}{p}}, $$
where $ p $ runs over the primes dividing $ n $.

\subsection{Euler's theorem}

The units $ \unit{n} $ form a group under multiplication. By definition, $ \phi\rb{n} $ is the order of this group. Recall that for any group $ G $ of finite order $ d $, Lagrange's theorem states that for all $ g \in G $, $ g^d $ is the identity in $ G $. For the group $ \unit{n} $, this means the following.

\begin{theorem}[Euler's theorem]
\label{thm:16}
Let $ a \in \Z $ with $ \rb{a, n} = 1 $. Then $ a^{\Phi\rb{n}} \equiv 1 \mod n $.
\end{theorem}

\begin{proof}
This is equivalent to saying that $ \bar{a}^{\Phi\rb{n}} = 1 $ in $ \unit{n} $. This is a group of order $ \Phi\rb{n} $, so this is immediate from Lagrange's theorem.
\end{proof}

\begin{corollary}[Fermat's little theorem]
If $ p $ is a prime and $ p \nmid a $ then $ a^{p - 1} \equiv 1 \mod p $.
\end{corollary}

\begin{proof}
Theorem \ref{thm:16} with $ n = p $, so $ \Phi\rb{n} = p - 1 $.
\end{proof}

Of course knowing the order of an abelian group does not tell you its structure.

\begin{example}
Let $ n = 5 $. $ \unit{5} = \cb{1, 2, 3, 4} $. This has order $ 4 $. There are two isomorphism classes of abelian groups of order $ 4 $, namely $ \Z / 4\Z $ and $ \Z / 2\Z \times \Z / 2\Z $. So it is either cyclic of order $ 4 $ or a product of two cyclic groups of order $ 2 $. $ 2^2 = 4 $, $ 2^3 = 3 $, $ 2^4 = 1 $ in $ \unit{5} $. So $ \unit{5} $ is cyclic of order $ 4 $.
\end{example}

By the Chinese remainder theorem, to understand the structure of $ \unit{n} $, it is enough to understand the structure of $ \Z / p^m\Z $ where $ p $ is prime and $ m \ge 1 $. We will do this next, beginning with the case $ m = 1 $.

\marginpar{Lecture 4 \\ Friday \\ 12/10/18}

\begin{definition}
If $ G $ is a group and $ g \in G $ is an element, the \textbf{order} of $ g $ is the least $ a \ge 1 $ such that $ g^a = 1 $. In particular, if $ \rb{g, n} = 1 $, then we write $ ord_n\rb{g} $ for the order of $ g $ in $ \unit{n} $, or the order of $ g $ modulo $ n $.
\end{definition}

Equivalently, let $ n \in \Z_{> 0} $ and $ g \in \Z $ with $ \rb{g, n} = 1 $, then the order of $ g $ modulo $ n $ is the smallest $ a \in \Z_{\ge 0} $ such that $ g^a \equiv 1 \mod n $.

\begin{proposition}
\label{prop:19}
If $ G $ is a group and $ g $ is an element of order $ a $, then $ g^n = 1 $ if and only if $ a \mid n $.
\end{proposition}

Equivalently, let $ g \in \Z $ with $ \rb{g, n} = 1 $, then if $ g^n \equiv \mod n $ then $ ord_n\rb{g} \mid n $.

\begin{proof}
If $ n = ab $ then $ g^n = \rb{g^a}^b = 1^b = 1 $. Conversely write $ n = ab + r $ with $ b, r \in \Z $ and $ 0 \le r < a $. Then since $ g^a = 1 $ it follows that $ g^r = 1 $. Since $ r < a $, $ r $ cannot be positive by the definition by order, so $ r = 0 $ and $ n = ab $.
\end{proof}

In particular, if $ \rb{g, n} = 1 $, then $ g^{\Phi\rb{n}} = 1 $ by Euler's theorem, so Proposition \ref{prop:19} gives the order of $ g $ modulo $ n $ divides $ \Phi\rb{n} $. We are going to prove that if $ p $ is prime, then $ \unit{p} $ is cyclic. Equivalently, we need to show that there exists $ g $ such that $ ord_p\rb{g} = \Phi\rb{p} = p - 1 $. We will do this by counting the number of elements of each order. Key point is that $ \Z / p\Z $ is a field. For any $ d \ge 1 $, the elements of $ \unit{p} $ of order dividing $ d $ are exactly the roots of the equation $ X^d - 1 $ in $ \Z / p\Z $ by Proposition \ref{prop:19}.

\begin{example}
The equation $ X^2 = 1 $ has exactly two solutions modulo $ p $ for any prime $ p $, namely $ \pm 1 $, but it can have more modulo $ n $ if $ n $ is composite. If $ n = 15 $, then $ 4, 11 $ are also solutions. $ X^2 - 1 \equiv 0 \mod n $ if and only if $ n \mid \rb{X + 1}\rb{X - 1} $, so $ 15 \mid \rb{4 + 1}\rb{4 - 1} $.
\end{example}

\begin{definition}
$ g \in \Z $ with $ \rb{g, p} = 1 $ is a \textbf{primitive root modulo $ p $} if the order of $ g $ modulo $ p $ is exactly $ p - 1 $, equivalently, if $ \bar{g} $ is a generator of $ \unit{p} $.
\end{definition}

To prove that primitive roots exist, we require some results about roots of polynomials modulo $ p $. Over the rational numbers we all know that a polynomial of degree $ d $ has at most $ d $ roots. This can fail over other rings.

\begin{example}
The polynomial $ x^2 - x $ has the roots $ 0, 1, 3, 4 $ modulo $ 6 $. The issue here is that $ \Z / 6\Z $ is not a field.
\end{example}

\begin{lemma}
\label{lem:21}
Let $ R $ be a commutative ring, and let $ P\rb{X} $ be a polynomial in $ X $ with coefficients in $ R $. If $ \alpha \in R $ has $ P\rb{\alpha} = 0 $, then there exists a polynomial $ Q\rb{X} $ with coefficients in $ R $ such that $ P\rb{X} = \rb{X - \alpha}Q\rb{X} $.
\end{lemma}

\begin{example}
If $ R = \Z / 15\Z $, $ X^2 - 1 = \rb{X + 1}\rb{X - 1} = \rb{X + 4}\rb{X - 4} $.
\end{example}

\begin{proof}
We proceed by induction on the degree of $ P $, the degree zero case being clear. Suppose the result is true for polynomials of degree less than $ d - 1 $, and let $ P\rb{X} $ have degree $ d $. If the leading term of $ P\rb{X} $ is $ cX^d $, so $ P\rb{X} = cX^d + \dots $, let $ S\rb{X} = P\rb{X} - cX^{d - 1}\rb{X - \alpha} $. We have $ S\rb{\alpha} = 0 $, and $ S\rb{X} $ has degree less than $ d - 1 $. By induction, there exists $ R\rb{X} $ with coefficients in $ R $ such that we can write $ S\rb{X} = \rb{X - \alpha}R\rb{X} $. Set $ Q\rb{X} = cX^{d - 1} + R\rb{X} $. Then
$$ \rb{X - \alpha}Q\rb{X} = \rb{X - \alpha}\rb{cX^{d - 1} + R\rb{X}} = cX^{d - 1}\rb{X - \alpha} + S\rb{X} = P\rb{X}. $$
\end{proof}

\begin{theorem}
\label{thm:22}
Let $ F $ be a field, and $ P\rb{X} $ a polynomial of degree $ d $ with coefficients in $ F $. Then $ P\rb{X} $ has at most $ d $ distinct roots in $ F $.
\end{theorem}

\begin{proof}
We again proceed by induction on $ d = \deg\rb{P} $. The case $ d = 0 $ is clear. If $ P $ has no roots, then we are done. Otherwise, $ P\rb{X} $ has degree $ d $ and let $ \alpha $ be a root. By Lemma \ref{lem:21}, we can write $ P\rb{X} = \rb{X - \alpha}Q\rb{X} $. Now if $ P\rb{\beta} = 0 $, then $ \rb{\beta - \alpha}Q\rb{\beta} = 0 $, so since $ F $ is a field either $ \beta = \alpha $ or $ \beta $ is a root of $ Q\rb{X} $. By the inductive hypothesis $ Q\rb{X} $ has degree $ d - 1 $, so $ P $ has at most $ d $ roots and we are done by induction.
\end{proof}

As a corollary, we deduce the following.

\begin{corollary}
\label{cor:23}
Let $ p $ be a prime, and let $ d $ be any divisor of $ p - 1 $. Then there are exactly $ d $ elements of $ \unit{p} $ of order dividing $ d $.
\end{corollary}

Equivalently, we have to show that the polynomial $ X^d - 1 $ has exactly $ d $ roots modulo $ p $.

\begin{proof}
Note that by Fermat's little theorem, $ 1, \dots, p - 1 $ are all roots of $ x^{p - 1} - 1 $ modulo $ p $. Thus $ X^{p - 1} - 1 $ has exactly $ p - 1 $ roots. Now fix $ d $ dividing $ p - 1 $ and write
$$ X^{p - 1} - 1 = \rb{X^d - 1}\rb{\rb{X^d}^{\tfrac{p - 1}{d} - 1} + \dots + 1} = \rb{X^d - 1}Q\rb{X}, \qquad \deg\rb{Q} = p - 1 - d, $$
for a polynomial $ Q\rb{X} $. $ Q\rb{X} $ has integer coefficients so we can view it as a polynomial modulo $ p $. Now $ X^{p - 1} - 1 $ has exactly $ p - 1 $ roots, $ X^d - 1 $ has at most $ d $ roots, and $ Q\rb{X} $ has at most $ p - 1 - d $ roots by Theorem \ref{thm:22}. We must therefore have equality in these inequalities, that is $ X^d - 1 $ has exactly $ d $ roots modulo $ p $.
\end{proof}

Another way of stating the corollary is to say that for any $ d $ dividing $ p - 1 $, there are exactly $ d $ elements of $ \unit{p} $ whose order divides $ d $.

\begin{example}
Let $ p = 7 $. Then $ \unit{p} $ has
\begin{enumerate}
\item $ 1 $ element of order $ 1 $,
\item $ 2 $ elements of order dividing $ 2 $, so $ 1 $ element of order $ 2 $,
\item $ 3 $ elements of order dividing $ 3 $, so $ 2 $ elements of order $ 3 $, and
\item $ 6 $ elements of order dividing $ 6 $, so $ 2 $ elements of order $ 6 $.
\end{enumerate}
\end{example}

\begin{lemma}
\label{lem:24}
For any $ n \ge 1 $, we have $ \sum_{d \mid n, \ d > 0} \Phi\rb{d} = n $.
\end{lemma}

\begin{proof}
For each $ d \mid n $, the elements $ i \in \cb{1, \dots, n} $ with $ \rb{i, n} = n / d $ are precisely those of the form $ i = \rb{n / d}j $ with $ 1 \le j \le d $ and $ \rb{j, d} = 1 $. There are exactly $ \Phi\rb{d} $ possibilities for $ j $, so there are exactly $ \Phi\rb{d} $ such elements. Summing over all $ d $, since the $ n / d $ run over all the divisors of $ n $, we are done with the result.
\end{proof}

\begin{theorem}
\label{thm:26}
Let $ p $ be a prime. Then for any $ d $ dividing $ p - 1 $, there are exactly $ \Phi\rb{d} $ elements of order $ d $ in $ \unit{p} $. In particular there are $ \Phi\rb{p - 1} $ primitive roots modulo $ p $, and $ \unit{p} $ is cyclic.
\end{theorem}

\begin{proof}
We prove this by strong induction on $ d $. The case $ d = 1 $ is clear. Fix $ d $. The inductive hypothesis tells us that for any $ d' $ dividing $ d $ and strictly less than $ d $ there are $ \Phi\rb{d'} $ elements of exact order $ d' $. On the other hand by Corollary \ref{cor:23} there are a total of $ d $ elements of $ \unit{p} $ of order dividing $ d $. Thus the number of elements of $ \unit{p} $ of order exactly $ d $ is
$$ \Phi\rb{d} = d - \sum_{d' \mid d, \ d' \ne d} \Phi\rb{d'}. $$
precisely by Lemma \ref{lem:24}. Now use inductive hypothesis.
\end{proof}

\marginpar{Lecture 5 \\ Tuesday \\ 16/10/18}

We can now go on to the case of $ \unit{p^n} $ for $ n \ge 2 $. Firstly we do the case $ p > 2 $.

\begin{proposition}
\label{prop:26}
Let $ p $ be an odd prime and let $ n \ge 1 $. Then $ \unit{p^n} $ is cyclic.
\end{proposition}

\begin{proof}
Consider three cases.
\begin{itemize}
\item[$ n = 1 $] Theorem \ref{thm:26}.
\item[$ n = 2 $] Let $ g $ be a primitive root modulo $ p $. Claim that either $ g^{p - 1} \not\equiv 1 \mod p^2 $, and $ g $ is a generator for $ \unit{p^2} $, or $ g^{p - 1} \equiv 1 \mod p^2 $, and $ g + p $ is a generator for $ \unit{p^2} $. Either way, $ \unit{p^2} $ is cyclic. Suppose firstly that $ g^{p - 1} \not\equiv 1 \mod p^2 $. $ g^{ord_{p^2}\rb{g}} \equiv 1 \mod p^2 $ gives $ g^{ord_{p^2}\rb{g}} \equiv 1 \mod p $, so we have by assumption
$$ p - 1 = ord_p\rb{g} \mid ord_{p^2}\rb{g} \mid \#\unit{p^2} = \Phi\rb{p^2} = p\rb{p - 1}. $$
But $ ord_{p^2}\rb{g} \ne p - 1 $, as $ g^{p - 1} \not\equiv 1 \mod p^2 $. So $ ord_{p^2}\rb{g} = p\rb{p - 1} $ as required. Now suppose that $ g^{p - 1} \equiv 1 \mod p^2 $, and set $ h = g + p $. It suffices to show that $ h^{p - 1} \not\equiv 1 \mod p^2 $, as we can then apply the analysis above with $ h $ in place of $ g $ to show that $ ord_{p^2}\rb{h} = p\rb{p - 1} $ and $ \unit{p^2} $ is cyclic. To see the claim, observe that if we expand with the binomial theorem, then we get
$$ h^{p - 1} = \rb{g + p}^{p - 1} \equiv g^{p - 1} + \rb{p - 1}pg^{p - 2} \equiv 1 + p\rb{p - 1}g^{p - 2} \mod p^2, $$
and since $ p \nmid \rb{p - 1}g^{p - 2} $, $ \rb{g + p}^{p - 1} \not\equiv 1 \mod p^2 $, as required.
\item[$ n \ge 2 $] We claim that if $ ord_{p^2}\rb{g} = p\rb{p - 1} $ then in fact $ ord_{p^n}\rb{g} = p^{n - 1}\rb{p - 1} $ for all $ n \ge 2 $, so that in particular $ \unit{p^n} $ is cyclic. We do this by induction on $ n $. So assume that $ ord_{p^n}\rb{g} = p^{n - 1}\rb{p - 1} $. Then
$$ p^{n - 1}\rb{p - 1} = ord_{p^n}\rb{g} \mid ord_{p^{n + 1}}\rb{g} \mid \Phi\rb{p^{n + 1}} = p^n\rb{p - 1}. $$
So either $ ord_{p^{n + 1}}\rb{g} = p^n\rb{p - 1} $, or $ ord_{p^{n + 1}}\rb{g} = p^{n - 1}\rb{p - 1} $. The statement that $ ord_{p^{n + 1}}\rb{g} = p^n\rb{p - 1} $ is equivalent to showing that $ g^{p^{n - 1}\rb{p - 1}} \not\equiv 1 \mod p^{n + 1} $. To do this, consider $ g^{p^{n - 2}\rb{p - 1}} \mod p^{n - 1} $ and $ g^{p^{n - 2}\rb{p - 1}} \mod p^n $. Since $ \Phi\rb{p^{n - 1}} = p^{n - 2}\rb{p - 1} $, $ g^{p^{n - 2}\rb{p - 1}} \equiv 1 \mod p^{n - 1} $ by Euler's theorem, so we may write
$$ g^{p^{n - 2}\rb{p - 1}} = 1 + p^{n - 1}t. $$
Since $ ord_{p^n}\rb{g} = p^{n - 1}\rb{p - 1} $ by assumption, $ g^{p^{n - 2}\rb{p - 1}} \not\equiv 1 \mod p^n $, that is $ p \nmid t $. Then the binomial theorem shows that
$$ g^{p^{n - 1}\rb{p - 1}} = \rb{g^{p^{n - 2}\rb{p - 1}}}^p = \rb{1 + p^{n - 1}t}^p \equiv 1 + p^nt + \two{p}{2}p^{2\rb{n - 1}}t^2 + \dots + p^{p\rb{n - 1}}t^p \mod p^{n + 1}, $$
Now $ r\rb{n - 1} \ge n + 1 $ if and only if $ \rb{r - 1}n \ge r + 1 $. Since $ p > 2 $,
$$ p \ \Big| \ \two{p}{2} \qquad \implies \qquad p^{n + 1} \ \Big| \ p^{2n - 1} = p^{2\rb{n - 1} + 1} \ \Big| \ \two{p}{2}p^{2\rb{n - 1}}. $$
So $ g^{p^{n - 1}\rb{p - 1}} \equiv 1 + p^nt \not\equiv 1 \mod p^{n + 1} $, because $ p \nmid t $. So the statement holds for $ n + 1 $, and we are done by induction
\end{itemize}
\end{proof}

\begin{note}
We used the hypothesis that $ p \ne 2 $ right at the end here. If $ p = 2 $ then we cannot ignore the higher order terms.
\end{note}

If $ n = 1, 2 $ then the proof of Proposition \ref{prop:26} did not use $ p > 2 $, and indeed
\begin{enumerate}
\item $ \unit{2} = \cb{1} $ is cyclic,
\item $ \unit{4} = \cb{1, 3} $ is cyclic of order $ 2 $, with $ 3 $ as a generator, but
\item this fails for higher powers, say $ \unit{8} = \cb{1, 3, 5, 7} $ is not cyclic since $ 1^2 \equiv 3^2 \equiv 5^2 \equiv 7^2 \equiv 1 \mod 8 $, so every element has order two.
\end{enumerate}
The key is the following lemma.

\begin{lemma}
\label{lem:27}
For $ n \ge 0 $ we have $ 5^{2^n} \equiv 1 + 2^{n + 2} \mod 2^{n + 3} $.
\end{lemma}

\begin{proof}
Induction on $ n $. The case $ n = 0 $ follows from $ 5 = 1 + 4 $. Suppose that $ 5^{2^n} = 1 + 2^{n + 2}t $ with $ t $ odd. Then
$$ 5^{2^{n + 1}} = \rb{1 + 2^{n + 1}t}^2 = 1 + 2^{n + 3}t + 2^{2\rb{n + 2}}t^2 = 1 + 2^{n + 3}\rb{t + 2^{n + 1}t^2}, $$
and since $ n + 1 \ge 1 $ and $ t + 2^{n + 1}t^2 $ is odd we are done by induction.
\end{proof}

\begin{proposition}
If $ n \ge 2 $ then we have an isomorphism $ \unit{2^n} \to \rb{\Z / 2\Z} \times \rb{\Z / 2^{n - 2}\Z} $, so that in particular if $ n \ge 3 $ then $ \unit{2^n} $ is not cyclic.
\end{proposition}

\begin{proof}
Consider the natural map
$$ \ab{-1} \times \ab{5} \to \unit{2^n}, $$
where if $ G $ is a group and $ g \in G $ we write $ \ab{g} $ for the cyclic subgroup $ \cb{1, \dots, g^{ord\rb{g} - 1}} $ of $ G $ generated by $ g $. We claim that this map is an isomorphism. To see this, note that it is injective, because if $ \rb{-1}^r\rb{5}^s \equiv 1 \mod 2^n $ then in particular $ \rb{-1}^r\rb{5}^s \equiv 1 \mod 4 $ so $ \rb{-1}^r \equiv 1 \mod 4 $, so we must have $ r = 1 $ and $ 5^s \equiv 1 \mod 2^n $, that is $ 5^s = 1 $ in $ \ab{5} $. $ \ab{-1} \cong \Z / 2\Z $ has order $ 2 $ and $ \ab{5} \cong \Z / 2^{n - 2}\Z $ has order $ ord_{2^n}\rb{5} = 2^{n - 2} $ by Lemma \ref{lem:27}. So $ \ab{-1} \times \ab{5} $ has order $ 2\rb{2^{n - 2}} = 2^{n - 1} = \Phi\rb{2^n} = \#\unit{2^n} $. So the map $ \ab{-1} \times \ab{5} \to \unit{2^n} $ is an injection of groups of the same order, so it is a bijection.
\end{proof}

Using what we have shown so far, one can conclude the following. See the first example sheet.

\begin{theorem}
Let $ n \in \Z_{> 0} $. The group $ \unit{n} $ is cyclic if and only if either
\begin{enumerate}
\item $ n = 1, 2, 4 $,
\item $ n = p^r $ where $ p $ is an odd prime and $ r \ge 1 $, or
\item $ n = 2p^r $ where $ p $ is an odd prime and $ r \ge 1 $.
\end{enumerate}
\end{theorem}

\marginpar{Lecture 6 \\ Wednesday \\ 17/10/18}

Note that while the existence of primitive roots is very useful both theoretically and computationally, there is no simple procedure for finding them in practice, beyond trial and error by guessing small values of $ g $, and see if $ g $ is a generator. If $ p $ is prime then there are $ \Phi\rb{p - 1} $ primitive roots modulo $ p $, so they are plentiful, which means that you have a high probability of success, and so trying $ 2, 3, 5, 6, \dots $ is a reasonable strategy, but note that trying $ 4 $ would not be a good idea. We could work out $ 1, \dots, g^{p - 2} $ and check these are distinct, but this would be inefficient. Better is to check that if $ q $ is any prime factor of $ p - 1 $, then $ g^{\rb{p - 1} / q} \ne 1 $. This works, because if $ g $ is not a primitive root, then the order of $ g $ modulo $ p $ is a proper factor of $ p - 1 $, so divides some $ \rb{p - 1} / q $, so $ g^{\rb{p - 1} / q} = 1 $, while if $ g^{\rb{p - 1} / q} \ne 1 $ then $ ord_p\rb{g} \mid \rb{p - 1} $ and $ ord_p\rb{g} \nmid \rb{p - 1} / q $. If this holds for all $ q \mid \rb{p - 1} $, then $ ord_p\rb{g} = p - 1 $, because otherwise it would be a proper divisor, and so would divide $ \rb{p - 1} / q $ for some prime $ q \mid \rb{p - 1} $.

\begin{note}
This does rely on being able to factor $ p - 1 $, which is a hard problem in general. See the next section.
\end{note}

The work of computing powers of $ a^k $ modulo $ p $ can be done efficiently by repeated squaring followed by multiplication according to the binary expansion of $ k $.

\begin{example}
Let us find a primitive root modulo $ p = 31 $. $ p - 1 = 30 = \rb{2}\rb{3}\rb{5} $. $ g $ is a primitive root if and only if $ g^{15} \ne 1 $, $ g^{10} \ne 1 $, $ g^{6} \ne 1 $. It is easy to see that $ 2 $ does not work because $ 2^2 = 4 $, $ 2^4 = 16 $, $ 2^6 = 2 $, but $ 2^10 = 2^15 = 1 $ because $ 2^5 = 32 = 1 $, so $ 2 $ is not a primitive root. We claim that $ 3 $ is a primitive root. We need to show that none of $ 3^6 $, $ 3^{10} $, $ 3^{15} $ are $ 1 $.
$$ 3^2 = 9, \quad 3^4 = -12, \quad 3^8 = 20 \quad \implies \quad 3^6 = 9\rb{-12} = 16, \quad 3^{10} = 9\rb{20} = 25, \quad 3^{15} = 3\rb{25}\rb{-12} = -1. $$
So $ 3 $ is a primitive root modulo $ 31 $, as required.
\end{example}

\section{Primality testing and factorisation}

The basic idea of this section, which will be exploited in the next brief section on cryptography, is that checking whether $ n \in \Z $ is prime or not is easy, but factorising $ n $ is expected to be hard, even if we know that it is not prime. Actually, there is no proof that factorisation is hard, merely an expectation. We will not make the notions of easy and hard precise, but the difficulty should be measured in terms of $ \log n $, that is in terms of the number of digits of $ n $ in some base. Easy here means that there is an algorithm to check whether $ n $ is prime or not which runs in time polynomial in $ \log n $. Then it is known that there exists a deterministic algorithm, the Agrawal-Kayal-Saxena (AKS) algorithm in 2005, to check whether or not $ n $ is prime which runs in time which is polynomial in $ \log n $. We will not describe this algorithm, although it is fairly elementary. We will discuss another algorithm which is more effective than this in practice. In contrast it is unknown whether or not there is an algorithm for factorising $ n $ that runs in time polynomial in $ \log n $, but it is suspected that no such algorithm should exist. There are algorithms better than exponential in $ \log n $, but nothing close to polynomial time.

\subsection{Factorisation}

One way to check if $ n $ is prime or not is to try dividing by all primes up to $ \sqrt{n} $, because if $ d $ is a proper divisor of $ n $, then either $ d \le \sqrt{n} $ or $ n / d \le \sqrt{n} $. This is fine if you are factoring a small integer in your head, but hopeless if you want to factor numbers which are hundreds of digits long on a computer.

\begin{note}
If you want to check primality or factorise relatively small numbers, there are tricks. In particular, if you want to check divisibility by $ 2 $, $ 3 $, $ 5 $, $ 7 $, or $ 11 $ there are the following tests.
\begin{enumerate}
\item Checking by divisibility by $ 2 $ or $ 5 $ is easy, just a matter of looking at the last decimal digit.
\item For $ 3 $ and $ 11 $, we have $ 10 \equiv 1 \mod 3 $ and $ 10 \equiv -1 \mod 11 $, so
$$ \sum_{i = 0}^{\log n} a_i10^i \equiv \sum_{i = 0}^{\log n} a_i \mod 3, \qquad \sum_{i = 0}^{\log n} a_i10^i \equiv \sum_{i = 0}^{\log n} a_i\rb{-1}^i \mod 11, $$
so we can check divisibility by taking the sum of the decimal digits for $ 3 $ or $ 9 $, and taking the alternating sum for $ 11 $.
\item For $ 7 $ things are slightly more awkward, but there is the following observation. $ 10x + y \equiv 0 \mod 7 $ if and only if $ -2\rb{10x + y} \equiv 0 \mod 7 $ if and only if $ x - 2y \equiv 0 \mod 7 $. So we can repeatedly subtract off twice the last digit from the number formed by removing the last digit.
\end{enumerate}
\end{note}

If we wanted to factor three digit numbers, or small four digit numbers, say $ n \le 400 $ is composite, with paper or calculator, then $ n $ has a prime factor $ d \le \sqrt{400} = 20 $. Then we only have to worry about checking divisibility by primes up to $ 19 $. If $ n $ is not divisible by $ 2, 3, 5, 7, 11 $, then the smallest prime factor of $ n $ is at least $ 13 $. So with these tests we only have difficulties if the only prime factors are $ 13 $, $ 17 $, $ 19 $, where there are no good tests. Since $ 13^3 > 400 $, it can have at most $ 2 $ prime factors. If you can recognise the squares $ 169 $, $ 289 $, $ 361 $, then you only have to remember a short list $ 13 \times 17 = 221 $, $ 13 \times 19 = 247 $, $ 13 \times 23 = 299 $, $ 13 \times 29 = 377 $, $ 17 \times 19 = 323 $, $ 17 \times 23 = 391 $.

\begin{example}
$ 143 \equiv 1 - 4 + 3 \equiv 0 \mod 11 $, $ 144 \equiv 1 + 4 + 4 \equiv 0 \mod 9 $, and $ 154 \equiv 15 - 2\rb{4} = 7 \equiv 0 \mod 7 $.
\end{example}

\marginpar{Lecture 7 \\ Friday \\ 19/10/18}

In fact, there is a method due to Fermat which allows you to factor even four digit numbers by hand, if you really have to. Idea is to first eliminate small prime factors by hand, up to say $ p = 2, \dots, 19 $. If $ n $ is composite and does not have any small factors, the remaining possibility is that if $ n $ has prime factors, they are close together to $ \sqrt{n} $, as in the exceptional cases we considered in the last paragraph. Now, if $ n = ab $ with $ a \le b $ both odd, then we can write
$$ n = ab = \rb{\dfrac{a + b}{2}}^2 - \rb{\dfrac{b - a}{2}}^2, \qquad \implies \qquad \rb{\dfrac{a + b}{2}}^2 - n = \rb{\dfrac{b - a}{2}}^2. $$
If you know $ \rb{a + b} / 2 $ and $ \rb{b - a} / 2 $, you can recover $ a, b $. This suggests the following procedure. If $ n $ is a square, we are done. If not, let $ m $ be the least integer with $ m^2 \le n < \rb{m + 1}^2 $, and check if $ \rb{m + 1}^2 - n $ is a square. If it is not, try $ \rb{m + 2}^2 - n $, and so on. Once you can write $ y^2 - n = x^2 $ then $ n = y^2 - x^2 = \rb{y + x}\rb{y - x} $ and we have a factorisation.

\begin{example}
If $ n  = 6077 $, then you find that $ 77^2 < 6077 < 78^2 $, and
\begin{align*}
78^2 - 6077 & = 7, \\
79^2 - 6077 & = 164, \\
80^2 - 6077 & = 323, \\
81^2 - 6077 & = 484 = 22^2,
\end{align*}
so $ 6077 = 81^2 - 22^2 = 103 \times 59 $.
\end{example}

In the worst case even the combination of trial division and the Fermat method run in time which is exponential in $ \log n $. The fastest algorithms known for factoring $ n $ run in better than exponential time in $ \log n $ are subexponential. They are the quadratic sieve, Lenstra elliptic curve factorisation, and the general number field sieve. They are all significantly more complicated, although at least the \textbf{quadratic sieve} could be described in this course if we wanted to. Rather than go through it in detail, we just give a sense of the idea using an example.

\begin{example}
Imagine trying to factor $ n = 1649 $ using the Fermat method. Since $ 40^2 < 1649 < 41^2 $, we compute
\begin{align*}
41^2 - 1649 & = 32 = 2^5, \\
42^2 - 1649 & = 115 = 5 \times 23, \\
43^2 - 1649 & = 200 = 2^3 \times 5^2.
\end{align*}
We certainly have not factored it yet, as none of these is a square, and indeed we would have to do another fourteen steps to find a factor. However, $ 32 \times 200 = 2^8 \times 5^2 = 80^2 $. This means that we have a congruence
$$ \rb{2^5 \times 2^3 \times 5^2}^2 = \rb{41 \times 43}^2 \equiv 80^2 \mod 1649. $$
Since $ 41 \times 43 = 1763 \equiv 114 \mod 1649 $, this means that $ 1649 \mid \rb{114 + 80}\rb{114 - 80} = 194 \times 34 = 2^2 \times 17 \times 97 $ and indeed $ 1649 = 17 \times 97 $.
\end{example}

This is the basic idea of the quadratic sieve. In order to factor $ n $, rather than trying to find numbers $ a, b $ with $ a^2 - b^2 = n $, you try to find them with $ a^2 \equiv b^2 \mod n $. Then you can hope that one of $ a \pm b $ has a common factor with $ n $.

\begin{note}
For illustration we factored $ a \pm b $ above, but in general a better idea for the last step would be to compute the GCD $ \rb{a \pm b, n} $, $ \rb{194, 1649} = 97 $ and $ \rb{34, 1649} = 17 $, quickly using Euclid's algorithm.
\end{note}

How do we find congruences like this? To make this into an efficient algorithm, the idea is that it is easy to spot relations like the one we found if the numbers have only small prime factors. In fact, we can turn it into a linear algebra problem over the field with two elements $ \Z / 2\Z $, in the following way. Suppose that we have a set $ x_1, \dots, x_r \in \Z $ and we want to find a product of a subset of them which is a square. If we know the prime factorisation for the $ x_i $, we can write $ x_i = p_1^{a_{i1}} \dots p_k^{a_{ik}} $, then we are trying to find $ \epsilon_i \in \cb{0, 1} $ such that $ \prod_{i = 1}^r x_i^{\epsilon_i} $ is a square. Equivalently, for each $ 1 \le j \le k $, want the exponent of $ p_j $ to be even, that is we have $ \sum_{i = 1}^r \epsilon_ia_{ij} = \epsilon_1a_{1j} + \dots + \epsilon_ra_{rj} \equiv 0 \mod 2 $. This is just a linear algebra question.

\begin{example}
Let $ x_1 = 2^5 $, $ x_2 = 5 \times 23 $, $ x_3 = 2^3 \times 5^2 $. If we just look at the numbers above which only had small primes less than or equal to $ 5 $ in their factorisations, then we are looking at $ x_1 $ and $ x_3 $. Taking $ p_1 = 2 $ and $ p_2 = 5 $, we need to solve
$$ \begin{pmatrix} \epsilon_1 & \epsilon_2 \end{pmatrix} \two{5 & 0}{3 & 2} \equiv \begin{pmatrix} 0 & 0 \end{pmatrix} \mod 2 \qquad \iff \qquad \begin{pmatrix} \epsilon_1 & \epsilon_2 \end{pmatrix} \two{1 & 0}{1 & 0} = \begin{pmatrix} 0 & 0 \end{pmatrix} $$
in the field $ \Z / 2\Z = \F_2 $, that is $ \epsilon_1 + \epsilon_2 = 0 $, which has the non-trivial solution $ \epsilon_1 = \epsilon_2 = 1 $.
\end{example}

This step, solving linear equations in $ \Z / 2\Z $, can be done efficiently. In order to make this into a practical algorithm to factor $ n $, the remaining difficulty is to find a good supply of $ m \in \Z $ such that $ m^2 - n $ is smooth, in the sense that it only has small prime factors.

\begin{note}
This is something that you could try to do by trial division. Once we had decided above that we only wanted prime factors up to $ 5 $, we could just keep dividing $ a^2 - n $ by $ 2 $, $ 3 $, $ 5 $, and if we did not get to $ 1 $ then we could throw the number away. In practice, there are faster ways to proceed, which is where the sieve in quadratic sieve comes from.
\end{note}

The basic idea is if we fix a list of small primes to start with, we use congruence conditions on $ m $, because for each prime $ 2 < p \nmid n $, there will be zero or two possible values for $ m $ in $ m^2 \equiv n \mod p $. It turns out that there is a straightforward algorithm for solving $ m^2 \equiv n \mod p $, which is part of the theory of quadratic residues, which we will get to shortly. If you do this for lots of primes $ p $, you get a supply of congruence conditions for $ m $, so you can eliminate ever considering $ m $ such that $ m^2 - n $ has large prime factors.

\begin{example}
It is easy to check that $ m^2 \equiv 1649 \mod 3 $ has no solutions, so there would have been no point in looking for $ 3 $, and if we want $ 5 $ to be a factor of $ m^2 - 1649 $ then we need $ x \equiv \pm 2 \mod 5 $, and so on.
\end{example}

\marginpar{Lecture 8 \\ Tuesday \\ 23/10/18}

\subsection{Testing primality}

By Euler's theorem if $ \rb{a, n} = 1 $ then $ a^{\Phi\rb{n}} \equiv 1 \mod n $. In particular, if $ p $ is prime then $ a^{p - 1} \equiv 1 \mod p $ for all $ 1 \le a \le p - 1 $. Conversely, if we can find an $ 1 \le a < n $ with $ a^{n - 1} \not\equiv 1 \mod n $, then $ n $ is not prime. Even just taking $ a = 2 $ in $ 2^{n - 1} \not\equiv 1 \mod n $ is often enough to show that $ n $ is not prime, and using repeated squaring this can be checked quickly.

\begin{example}
To check if $ 9 $ is prime, we can compute $ 2^8 \equiv 2^{2^{2^2}} \equiv 4^{2^2} \equiv 7^2 \equiv 4 \mod 9 $.
\end{example}

However it does not always work. $ 341 = 11 \times 31 $ has $ 2^{340} \equiv 1 \mod 341 $. In general even varying $ a $ is not enough. A \textbf{Carmichael number} is a composite number such that for all $ \rb{a, n} = 1 $ then $ a^{n - 1} \equiv 1 \mod n $. It is known that infinitely many of them exist, a hard theorem, although they are rare. See the example sheet for an example of a few of them. A variant on this idea gives an efficient primality test, the \textbf{Miller-Rabin test}, a test for whether $ n \in \Z $ is prime or not. We restrict ourselves to considering the case that $ n \equiv 3 \mod 4 $, as the essential idea is already clear in this case, but the analysis is more complicated in the case $ n \equiv 1 \mod 4 $, in an example sheet. Of course if $ n $ is even we do not need a primality test. The key point is the following.

\begin{lemma}
\label{lem:30}
If $ n \equiv 3 \mod 4 $, then $ n $ is prime if and only if for every $ a \in \unit{n} $, we have $ a^{\rb{n - 1} / 2} \equiv \pm 1 \mod n $.
\end{lemma}

\begin{proof}
Suppose firstly that $ n $ is prime. Then $ a^{n - 1} \equiv 1 \mod n $ by Fermat's little theorem, so $ \rb{a^{\rb{n - 1} / 2}}^2 \equiv 1 \mod n $, so $ a^{\rb{n - 1} / 2} \equiv \pm 1 \mod n $, because $ n $ is prime, the equation $ x^2 = 1 $ has just the roots $ \pm 1 $ in $ \Z / n\Z $. Suppose next that $ n = p^k $ for $ p $ prime is a prime power with $ k \ge 2 $, and take $ a = 1 + p $. Then
$$ \rb{1 + p}^{\tfrac{n - 1}{2}} \equiv 1 + \rb{\tfrac{n - 1}{2}}p \mod p^2, $$
by the binomial theorem. If $ \rb{1 + p}^{\rb{n - 1} / 2} \equiv \pm 1 \mod p^k = n $, then $ \rb{1 + p}^{\rb{n - 1} / 2} \equiv \pm 1 \mod p, p^2 $ gives
$$ \pm 1 \equiv \rb{1 + p}^{\tfrac{n - 1}{2}} \equiv 1 + \rb{\dfrac{n - 1}{2}}p \equiv 1 \mod p \qquad \implies \qquad 1 \equiv \rb{1 + p}^{\tfrac{n - 1}{2}} \equiv 1 + \rb{\dfrac{n - 1}{2}}p \mod p^2, $$
then $ p \mid \rb{\rb{n - 1} / 2} $, so $ p \mid \rb{n - 1} $. But $ p \mid n $, a contradiction. Finally for the remaining case suppose that $ n $ is composite but not a power of a prime, and write $ n = rs $ for $ r, s > 1 $ and odd, and $ \rb{r, s} = 1 $. By the Chinese remainder theorem, $ \Z / n\Z \cong \Z / r\Z \times \Z / s\Z $. We can choose $ a $ with $ \rb{a, n} = 1 $ such that $ a \equiv -1 \mod r $ and $ a \equiv 1 \mod s $. Then $ \rb{a, r} = \rb{a, s} = 1 $, so $ \rb{a, n} = 1 $. Since $ n \equiv 3 \mod 4 $ by assumption, $ \rb{n - 1} / 2 $ is odd, so $ a^{\rb{n - 1} / 2} \equiv -1 \mod r $ and $ a^{\rb{n - 1} / 2} \equiv 1 \mod s $. So $ a^{\rb{n - 1} / 2} \not\equiv \pm 1 \mod n $.
\end{proof}

So we know that if $ n $ is composite, there will exist values of $ a $ with $ a^{\rb{n - 1} / 2} \not\equiv \pm 1 \mod n $. To understand how efficient the algorithm is, we need to know how many such $ a $ there are.

\begin{lemma}
\label{lem:31}
Suppose that $ n \equiv 3 \mod 4 $ and that $ n $ is composite. Then the set of $ a \in \unit{n} $ satisfying $ a^{\rb{n - 1} / 2} \equiv \pm 1 \mod n $ is a proper subgroup of $ \unit{n} $.
\end{lemma}

\begin{proof}
That it is a subgroup follows easily from the definition. Just check that it is closed under products and inverses. Certainly $ 1^{\rb{n - 1} / 2} \equiv 1 \mod n $. If $ a^{\rb{n - 1} / 2} \equiv \pm 1 \mod n $ and $ b^{\rb{n - 1} / 2} \equiv \pm 1 \mod n $,
$$ \rb{ab}^{\rb{n - 1} / 2} \equiv a^{\rb{n - 1} / 2}b^{\rb{n - 1} / 2} \equiv \rb{\pm 1}\rb{\pm 1} \equiv \pm 1, \quad \rb{a^{-1}}^{\rb{n - 1} / 2} \equiv \rb{a^{\rb{n - 1} / 2}}^{-1} \equiv \rb{\pm 1}^{-1} \equiv \pm 1 \mod n. $$
So this set is a subgroup of $ \unit{n} $. That it is a proper subgroup is then immediate from Lemma \ref{lem:30}.
\end{proof}

We immediately get the following bound.

\begin{corollary}
Suppose that $ n \equiv 3 \mod 4 $ and that $ n $ is composite. Then at most half of the values of $ a \in \unit{n} $ satisfy $ a^{\rb{n - 1} / 2} \equiv \pm 1 \mod n $.
\end{corollary}

\begin{proof}
The set of such elements is a proper subgroup of $ \unit{n} $ by Lemma \ref{lem:31}, and any proper subgroup has index at least two.
\end{proof}

In fact we can do better than this. It can be shown with some more work that you can improve this to show that at least $ 3 / 4 $ of the integers $ 1 \le a \le n - 1 $ satisfy $ a^{\rb{n - 1} / 2} \not\equiv \pm 1 \mod n $. It follows that if $ n \equiv 3 \mod 4 $ and you choose $ x $ integers $ 1 \le a \le n - 1 $ at random, and $ n $ is composite, then the probability that you find such an $ a $ with $ a^{\rb{n - 1} / 2} \not\equiv \pm 1 \mod n $ is at least $ 1 - 1 / 4^x $, so this gives an efficient polynomial time probabilistic random algorithm for testing if $ n $ is prime. If you want it to be deterministic, if you assume the generalised Riemann hypothesis (GRH), then it is known that you can find a counterexample $ a \in \Z $ with
$$ 1 \le a \le \left\lceil 2 \rb{\log n}^2 \right\rceil, \qquad a^{\rb{n - 1} / 2} \not\equiv \pm 1 \mod n, $$
and again we have a polynomial time algorithm. In practice it is even better than this.

\begin{example}
If $ n < 341550071728321 $, it is enough to test $ a = 2, 3, 5, 7, 11, 13, 17 $.
\end{example}

\section{Public-key cryptography}

\subsection{Messages as sequences of classes modulo $ n $}

How do we turn messages into numbers in $ \Z / n\Z $? Since the advent of computers, the idea of representing a message by a string of numbers is a familiar one. In practice, to do this one typically chooses a way of encoding individual characters as binary numbers of a fixed length $ d $, usually eight or sixteen bits, that is binary digits. If we then cut a message up into blocks or strings of at most $ k $ characters and concatenate the binary representations of each character in the block together, we obtain a $ dk $ bit binary number that represents an $ k $ character block as an integer between $ 0 $ and $ 2^{dk} $. If we choose some very large modulus $ n > 2^{dk} $, then we can alternatively represent a block as a class in $ \Z / n\Z $. Thus we will be mainly concerned with the problem of communicating a congruence class $ c $ modulo $ n $, for some large $ n $, between a sender $ A $ and a recipient $ B $. The goal is to do this in such a way that any eavesdroppers on the communication cannot deduce what $ c $ is, but $ B $ can.

\subsection{The Rivest-Shamir-Adleman (RSA) algorithm}

Most traditional forms of cryptography rely on a shared secret known to both $ A $ and $ B $. This shared secret is effectively some invertible function $ f : \Z / n\Z \to \Z / n\Z $. The idea is that rather than sending $ c $ to $ B $ directly, $ A $ applies $ f $ to $ c $ and computes $ f\rb{c} $, sends that to $ B $, and then $ B $ applies some other function $ g : \Z / n\Z \to \Z / n\Z $ and computes $ g\rb{f\rb{c}} $, where $ g = f^{-1} $, to get back the number $ A $ started with. Since eavesdroppers do not know $ f $, they, at least in principle, cannot recover $ c $ from $ f\rb{c} $. In practice, for $ A $ and $ B $ to agree on a function $ f $ poses problems. In particular, they have to communicate to do so, and if eavesdroppers listen to that communication they can learn $ f $. Want to be able to make $ f $ public without making $ g $ public. The algorithm we describe today avoids this problem completely. It is what is known as a public-key algorithm. Instead of secrets being shared between $ A $ and $ B $, our recipient $ B $ creates a secret known only to $ B $, his \textbf{private key}, and then releases additional information, his \textbf{public key}, to anyone who wants to communicate with him. For anyone to send $ B $ a message, only the public key is required, but decoding the message requires the private key. Here is how the algorithm works.
\begin{enumerate}
\item $ B $ first chooses two large prime numbers $ p $ and $ q $ and sets $ n = pq $. In practice, each of these is around $ 2^{1024} $ or so. An integer modulo $ n $ thus allows $ B $ to represent $ 2048 $ bits of information, or $ 256 $ eight bit characters.
\item $ B $ also chooses a number $ e $ such that $ \rb{e, \Phi\rb{n}} = 1 $, and lets $ d $ be a multiplicative inverse of $ e $ modulo $ \Phi\rb{n} $ such that $ de = 1 \mod \Phi\rb{n} = \rb{p - 1}\rb{q - 1} = n - \rb{p + q} + 1 $.
\item The public key, that $ B $ publishes and shares with everyone, consists of the numbers $ n $ and $ e $.
\item The private key, that $ B $ must keep secret, consists of the numbers $ p $, $ q $, $ \Phi\rb{n} $, and $ d $.
\item To encode a message $ x $, a sender $ A $ computes $ f\rb{x} \equiv x^e \mod n $, and sends it to $ B $.
\item Given an encoded message $ y $, $ B $ decodes it by computing $ g\rb{y} \equiv y^d \mod n $.
\end{enumerate}
The reason this works is that if $ y \equiv x^e \mod n $, then one has $ \rb{x^e}^d \equiv x^{ed} \equiv x^{1 + k\Phi\rb{n}} \mod n $, since, by construction, $ de \equiv 1 \mod \Phi\rb{n} $. Thus $ y^d \equiv x^{ed} \equiv x^1 \equiv x \mod n $ by Euler's theorem, $ x^{\Phi\rb{n}} \equiv 1 \mod n $.

\begin{note}
This works provided $ x $ is coprime to $ n $, but the probability of this is extremely high. It is still ok even without that, since $ n $ is squarefree. (TODO Exercise using Fermat's little theorem plus Chinese remainder theorem)
\end{note}

The prevailing assumption is that with only the information $ n $ and $ e $, it is hopeless to discover $ d $. Any eavesdropper who knows $ x^e $ and wants to recover $ x $ from $ x^e $ then has to be able to compute an $ e^{th} $ root of $ x $ modulo $ n $. As far as we know, this is quite difficult computationally. The best publicly known approaches all involve factoring $ n $. For numbers around $ 2^{2048} $, this is not feasible with today's computing equipment, and might well never be feasible. On the other hand, we have no formal proof that factoring is as computationally difficult as it seems to be. As far as I am aware, we do not even have a formal proof that breaking RSA is as computationally difficult as factoring. In spite of these uncertainties, our intuition and experience suggests that recovering $ x $ from $ x^e $ without knowing a factorisation of $ n $ is computationally infeasible. It is this infeasibility that allows the cryptosystem to work.

\marginpar{Lecture 9 \\ Wednesday \\ 24/10/18}

Lecture 9 is a problem class.

\marginpar{Lecture 10 \\ Friday \\ 26/10/18}

\subsection{Signing with RSA}

Public-key cryptography can also be used as verification of identity. Suppose $ B $ wants to make a declaration to the world, and prove beyond all doubt that it was $ B $ who made the declaration, and not an impostor. Perhaps this declaration is a will, or acceptance of a contract, for instance. Suppose $ B $ has functions $ f, g : \Z / n\Z \to \Z / n\Z $ with $ f \circ g = g \circ f = id $. Again, make $ f $ public, and any time $ B $ publishes a message $ m $, $ B $ also publishes $ g\rb{m} $. Then anyone can apply $ f $ to $ g\rb{m} $ to recover $ m = f\rb{g\rb{m}} $, but without $ g $, no one can forge $ B $'s signature. With RSA, $ B $ first represents the message he wants to sign as a class $ m $ modulo $ n $. To sign this class, $ B $ computes $ m^d $ modulo $ n $ using the private part of the key, and sends the world the pair $ \rb{m, m^d} $. Suppose $ A $ wants to verify that a pair $ \rb{m, s} $ was a message signed by $ B $. Then $ A $ computes $ s^e $ modulo $ n $, which requires only the public part of the key. If $ s \equiv m^d \mod n $, then $ s^e = m^{de} \equiv m \mod n $. So $ A $ just needs to check that $ s^e \equiv m \mod n $ and if so the signature is verified. To fake a message signed by $ B $, a forger needs to solve the problem of, given a message $ m $, finding a signature $ s $ such that $ s^e \equiv m \mod n $. This is precisely the same problem as deciphering a message sent by the algorithm above. Thus forging signatures is just as hard as breaking the encryption.

\subsection{Discrete logarithms}

If $ \unit{n} $ is cyclic, for example, if $ n $ is prime, and $ g $ is a generator for this group, that is a primitive root, then the map $ \Z / \Phi\rb{n}\Z \to \unit{n} $ taking $ a $ modulo $ \Phi\rb{n} $ to $ g^a $ is an isomorphism, from the additive group of $ \Z / \Phi\rb{n}\Z $ to $ \unit{n} $. It thus has an inverse, which we call the \textbf{discrete logarithm to the base $ g $}. Explicitly, if $ g $ is a primitive root modulo $ n $, then the discrete logarithm to the base $ g $, denoted $ \log_g $, is defined for any $ a \in \unit{n} $ by $ \log_g\rb{a} \equiv m \mod \Phi\rb{n} $, for some unique $ m \in \Z $ such that $ 0 \le m < \Phi\rb{n} $ and $ g^m \equiv a \mod n $.

\begin{example}
One use of the discrete logarithm is to solve exponential equations modulo $ n $. By applying $ \log_g $ to both sides of the equation $ x^r \equiv a \mod n $, write $ x = g^y $, we obtain that the congruence becomes equivalent to the linear congruence equation $ yr \equiv \log_g\rb{a} \mod \Phi\rb{n} $, and we can solve those with techniques explained earlier.
\end{example}

Unfortunately, or fortunately for cryptography, it is expected that the discrete logarithm is hard to compute, much in the way that it is expected to be hard to crack RSA, but we do not know for sure. In particular, there is no known polynomial time algorithm.

\begin{example}
Here is a practical application of this. Imagine that you have a system where you need to safely store passwords for different users, but you do not want to store the actual passwords. One way to do this is to let $ p $ be a large prime, big enough so that all passwords can be thought of as residues modulo $ \rb{p - 1} $, and fix a primitive root $ g $ modulo $ p $. Then if someone inputs their password to be $ x $, you can compute and store $ g^x $ modulo $ p $. If they later want to login with input $ y $, you compute $ g^y $, and check if it matches what you stored. If it does then $ y \equiv x \mod p - 1 $. Even if someone has access to what you have stored, and to g, they still cannot recover the password a without solving the discrete logarithm problem. Of
course, nor can you, so it is not so good if you require people to be able to
be reminded of their passwords.
\end{example}

\section{Quadratic reciprocity}

\subsection{Quadratic residues}

\begin{definition}
Let $ p $ be a prime number and $ a \in \Z $ not divisible by $ p $, that is $ \rb{a, p} = 1 $. We say that $ a $ is a \textbf{quadratic residue modulo $ p $} (QR) if and only if there exists a solution $ x \in \Z $ to $ x^2 \equiv a \mod p $. If no such $ d $ exists, so $ a $ is not a QR, it is called a \textbf{quadratic non-residue modulo $ p $} (QNR).
\end{definition}

\begin{note}
By this convention, $ a \in \Z $ divisible by $ p $ are neither QRs nor QNRs modulo $ p $. Other conventions exist, so sometimes zero is a QR.
\end{note}

\begin{example}
If $ p = 2 $, $ 1 $ is a QR. If $ p = 3 $, $ 1 $ is a QR, $ -1 $ is a QNR, since $ 1^2 \equiv \rb{-1}^2 \equiv 1 \mod 3 $. If $ p = 5 $, $ 1, 4 $ are QRs, $ 2, 3 $ are QNRs, since $ 1^2 \equiv \rb{-1}^2 \equiv 1 \mod 5 $ and $ 2^2 \equiv 3^2 \equiv 4 \mod 5 $.
\end{example}

\begin{lemma}
\label{lem:34}
If $ p > 2 $ then there are exactly $ \rb{p - 1} / 2 $ QRs modulo $ p $, and $ \rb{p - 1} / 2 $ QNRs modulo $ p $.
\end{lemma}

\begin{proof}
The QRs are exactly the image of the group homomorphism $ \unit{p} \to \unit{p} $ by $ x \mapsto x^2 $. This has kernel $ x = \pm 1 $, so the image has order $ \rb{p - 1} / 2 $.
\end{proof}

\begin{proposition}
\label{prop:35}
Let $ a, b \in \Z $ with $ \rb{a, p} = \rb{b, p} = 1 $. Then
\begin{enumerate}
\item if $ a $ and $ b $ are both QRs modulo $ p $, then so is $ ab $,
\item if $ a $ is a QR modulo $ p $ and $ b $ is a QNR modulo $ p $, then $ ab $ is a QNR modulo $ p $, and
\item if $ a $ and $ b $ are both QNRs modulo $ p $, then $ ab $ is a QR modulo $ p $.
\end{enumerate}
\end{proposition}

\begin{proof}
Note that the set $ H $ of QRs in $ \unit{p} $ is a subgroup, because it is the image of the group homomorphism $ \unit{p} \to \unit{p} $ by $ x \mapsto x^2 $ by Lemma \ref{lem:34}, and by the first isomorphism theorem we have $ \unit{p} / H \cong \Z / 2\Z $. The proposition is a restatement of this, since $ \unit{p} = H \sqcup 1 + H $.
\end{proof}

\begin{definition}
The \textbf{Legendre symbol} $ \legendre{a}{p} $, for $ p $ a prime and $ a \in \Z $, is defined by
$$ \legendre{a}{p} = \begin{cases} 1 & a \text{ is a QR modulo } p \\ 0 & p \mid a \\ -1 & a \text{ is a QNR modulo } p \end{cases}. $$
\end{definition}

Proposition \ref{prop:35} above then amounts to saying that the map $ \unit{p} \to \cb{\pm 1} $ defined by $ a \mapsto \legendre{a}{p} $ is a group homomorphism, that is $ \legendre{ab}{p} = \legendre{a}{p}\legendre{a}{p} $. Even holds if we do not assume that $ \rb{a, p} = \rb{b, p} = 1 $. In fact, the existence of primitive roots gives us an easy description of the following map.

\marginpar{Lecture 11 \\ Tuesday \\ 30/10/18}

\begin{theorem}[Euler's criterion]
Let $ p $ be an odd prime, and $ a \in \Z $ not divisible by $ p $. Then
$$ \legendre{a}{p} \equiv a^{\rb{p - 1} / 2} \mod p. $$
\end{theorem}

\begin{proof}
Let $ g $ be a primitive root modulo $ p $, and write $ a \equiv g^r \mod p $ for $ 0 \le r < p - 1 $. Then $ \rb{g^{\rb{p - 1} / 2}}^2 = g^{p - 1} \equiv 1 \mod p $. So $ g^{\rb{p - 1} / 2} \equiv \pm 1 \mod p $. Since $ g $ is a primitive root, $ g^{\rb{p - 1} / 2} \not\equiv 1 \mod p $, so $ g^{\rb{p - 1} / 2} \equiv -1 \mod p $. So $ a^{\rb{p - 1} / 2} \equiv \rb{g^r}^{\rb{p - 1} / 2} \equiv \rb{g^{\rb{p - 1} / 2}}^r = \rb{-1}^2 \mod p $. But
\begin{align*}
\legendre{a}{p} = 1 \qquad
& \iff \qquad \rb{g^s}^2 \equiv a \mod p
& \iff \qquad 2s \equiv r \mod p - 1 \\
& \iff \qquad 2 \mid r
& \iff \qquad \rb{-1}^r \equiv 1 \mod p,
\end{align*}
and we are done.
\end{proof}

\subsection{Computing Legendre symbols}

Euler's criterion lets us determine, for fixed $ p $, which $ a $ are QRs modulo $ p $. What if we fix $ a $, and ask for which odd primes $ p $ is $ a $ a QR? When $ a = -1 $, Euler's criterion gives an easy answer. $ \legendre{-1}{p} = \rb{-1}^{\rb{p - 1} / 2} $, so $ -1 $ is a QR modulo $ p $ if and only if $ \rb{p - 1} / 2 $ is even. In other words, the following holds.

\begin{proposition}
$ -1 \in \Z $ is a QR modulo $ p $ if and only if $ p = 2 $ or $ p \equiv 1 \mod 4 $.
\end{proposition}

\begin{proof}
$ p = 2 $ is trivial. If $ p > 2 $, then by Euler's criterion, $ \legendre{-1}{p} \equiv \rb{-1}^{\rb{p - 1} / 2} \mod p $, so in fact $ \legendre{-1}{p} = \rb{-1}^{\rb{p - 1} / 2} $. Then
$$ \rb{-1}^{\tfrac{p - 1}{2}} = \begin{cases} 1 & p \equiv 1 \mod 4 \\ -1 & p \equiv 3 \mod 4 \end{cases}. $$
\end{proof}

\begin{example}
If $ p = 5 $ then it is a square, and if $ p = 7 $ it is not, and in each case we can check directly.
\end{example}

When $ a = 2 $, the situation is more difficult, but still amenable to a direct approach.

\begin{proposition}[A special case of Gauss' Lemma]
$$ \legendre{2}{p} = \begin{cases} 1 & p \equiv \pm 1 \mod 8 \\ -1 & p \equiv \pm 3 \mod 8 \end{cases}, $$
that is $ \legendre{2}{p} = \rb{-1}^{\rb{p^2 - 1} / 8} $.
\end{proposition}

\begin{example}
$ \legendre{2}{7} = 1 $ since $ 2 \equiv 3^3 \mod 7 $. $ \legendre{2}{11} = -1 $ since squares modulo $ 11 $ are $ 1, 4, 9, 5, 3 $. $ \legendre{-1}{11} = -1 $, so $ \legendre{-2}{11} = \legendre{2}{11}\legendre{-1}{11} = \rb{-1}^2 = 1 $ and $ -2 \equiv 3^2 \mod 11 $.
\end{example}

\begin{proof}
$ \legendre{2}{p} \equiv 2^{\rb{p - 1} / 2} \mod p $ by Euler's criterion. Let $ q = \rb{p - 1} / 2 $, and set
$$ Q = \rb{2}\rb{4} \dots \rb{p - 3}\rb{p - 1} = \rb{2 \times 1}\rb{2 \times 2} \dots \rb{2 \times \rb{q - 1}}\rb{2 \times q} = 2^qq! = 2^{\tfrac{p - 1}{2}}q!. $$
Reduce all the factors in the product defining $ Q $ modulo $ p $ so that they lie between $ -q $ and $ q $, that is subtract $ p $ from every factor which is greater than $ q $. Let $ Q' $ be the resulting product $ \rb{2}\rb{4} \dots \rb{-3}\rb{-1} $. We have $ Q' \equiv Q \mod p $. On the other hand, the factors in the product defining $ Q' $ are the even integers from $ 1 $ to $ q $ and the negatives of the odd integers from $ 1 $ to $ q $. Thus $ Q' = \rb{-1}^rq! $, where $ r $ is the number of odd integers between $ 1 $ and $ q $. We thus have $ 2^qq! \equiv \rb{-1}^rq! \mod p $, and since $ p \nmid q! $, we have $ 2^{\rb{p - 1} / 2} \equiv \rb{-1}^r \mod p $. The result follows by noting that
$$ \rb{-1}^r = \begin{cases} 1 & p \equiv \pm 1 \mod 8 \\ -1 & p \equiv \pm 3 \mod 8 \end{cases}, $$
and invoking Euler's criterion.
\end{proof}

\begin{example}
If $ p \equiv 1 \mod 8 $, say $ p = 1 + 8n $, so $ q = 4n $. Odd integers in $ 1, \dots, 4n $ are $ 1, \dots, 4n - 1 $, so $ r = 2n $.
\end{example}

Since we have $ \legendre{ab}{p} = \legendre{a}{p}\legendre{b}{p} $, to answer this question in full generality it suffices to answer it for $ a = -1 $, for $ a = 2 $, and for $ a $ an odd prime. In the latter case we have the following.

\begin{theorem}[Law of quadratic reciprocity]
Let $ p $ and $ q $ be odd primes. Then
$$ \legendre{p}{q} = \begin{cases} -\legendre{q}{p} & p \equiv q \equiv 3 \mod 4 \\ \legendre{q}{p} & \text{otherwise} \end{cases}. $$
One can rephrase this a bit more tersely as the equivalent statement
$$ \legendre{p}{q} = \legendre{q}{p}\rb{-1}^{\rb{\tfrac{p - 1}{2}}\rb{\tfrac{q - 1}{2}}}. $$
\end{theorem}

Note that this implies that for each odd prime $ q $, the question of whether $ q $ is a QR modulo $ p $ has an answer in terms of congruence conditions modulo $ q $ and modulo $ 4 $. From this and the Chinese remainder theorem, we can deduce that the question, for which primes $ p $ is $ a $ a QR modulo $ p $, has an answer in terms of congruence conditions on $ p $.

\begin{example}
If $ p \ne 5 $ is an odd prime, then we see that $ 5 $ is QR modulo $ p $ if and only if $ p $ is a QR modulo $ 5 $, so $ \legendre{5}{p} = \legendre{p}{5} $, that is if and only if $ p \equiv \pm 1 \mod 5 $. So
$$ \legendre{5}{p} = \begin{cases} 1 & p \equiv \pm 1 \mod 5 \\ -1 & p \equiv \pm 2 \mod 5 \end{cases}. $$
\end{example}

\begin{example}
Slightly more complicated example, let $ p \ne 3 $ be an odd prime. When is $ 3 $ a QR modulo $ p $, that is what is $ \legendre{3}{p} $? Well, if $ p \equiv 1 \mod 4 $ then this is if and only if $ p $ is a QR modulo $ 3 $, so if and only if $ p \equiv 1 \mod 3 $, so
$$ \legendre{3}{p} = \legendre{p}{3} = \begin{cases} 1 & p \equiv 1 \mod 3 \\ -1 & p \equiv -1 \mod 3 \end{cases}. $$
If $ p \equiv -1 \mod 4 $ then if and only if $ p \equiv -1 \mod 3 $, so
$$ \legendre{3}{p} = -\legendre{p}{3} = \begin{cases} 1 & p \equiv -1 \mod 3 \\ -1 & p \equiv 1 \mod 3 \end{cases}. $$
Putting this together with the Chinese remainder theorem,
$$ \legendre{3}{p} = \begin{cases} 1 & p \equiv \pm 1 \mod 12 \\ -1 & p \equiv \pm 5 \mod 12 \end{cases}. $$
If $ p = 7 $, QRs are $ 1, 2, 4 $, so $ \legendre{3}{p} = -1 $. If $ p = 11 $, $ 5^2 \equiv 3 \mod 11 $, so $ \legendre{3}{p} = 1 $.
\end{example}

In general to compute $ \legendre{a}{p} $, we could do the following. Use that if $ a \equiv b \mod p $ then $ \legendre{a}{p} = \legendre{b}{p} $. So without loss of generality $ \abs{a} < p $. Then write $ a = \pm \prod_i q_i^{s_i} $ for $ q_i $ prime. Then $ \legendre{a}{p} = \legendre{\pm 1}{p} \prod_i \legendre{q_i}{p}^{s_i} $. If $ s_i $ is even, then $ \legendre{q_i}{p}^{s_i} = 1 $. If $ s_i $ is odd, then $ \legendre{q_i}{p}^{s_i} = \legendre{q_i}{p} $. We have formulas for $ \legendre{-1}{p} $ and $ \legendre{2}{p} $. If $ q $ is an odd prime, $ q < p $, then use quadratic reciprocity to relate $ \legendre{q}{p} $ and $ \legendre{p}{q} $. Then repeat modulo $ q $.

\begin{example}
$ \legendre{6}{19} = \legendre{2}{19}\legendre{3}{19} = \rb{-1}\rb{-1} = 1 $. $ \legendre{2}{19} = -1 $ because $ 19 \equiv 3 \mod 8 $. $ \legendre{3}{19} \equiv -1 \mod 12 $ by the above.
\end{example}

More generally, one can ask, given a monic polynomial $ f $ with integer coefficients, for which primes $ p $ does $ f $ have a root? The above case is the case of the polynomial $ X^2 - a $. This is a very deep question in number theory. Indeed, we are still extremely far from having a complete answer. One question it is natural to ask is, for which $ f $ does the above question have an answer given in terms of congruence conditions on $ p $. A deep branch of algebraic number theory called class field theory tells us that this will happen precisely when the field extension determined by $ f $ has abelian Galois group. Beyond this we know very little, but there are connections to the theory of modular forms.

\marginpar{Lecture 12 \\ Wednesday \\ 31/10/18}

\subsection{Proof of quadratic reciprocity}

Quadratic reciprocity was one of the deepest results of the $ 18^{th} $ century, and there are many approaches to proving it, none of which are particularly simple. The more motivated ones require algebraic number theory, and even then the motivation is really coming from class field theory, which is a long way beyond the boundaries of this course. The proof that we give is due to Rousseau, from 1991. It has the merits of being elementary and relatively easy to remember, and of resembling the proof of Gauss' Lemma that we gave above, that $ \legendre{2}{p} = \rb{-1}^{\rb{p^2 - 1} / 8} $. Let $ p, q $ be distinct odd primes, and consider the group
$$ \unit{pq} \cong \unit{p} \times \unit{q}. $$
What are we going to do is to compare the products of different sets of coset representatives for the subgroup $ \cb{\pm 1} $. That is, we will look at different ways of choosing exactly one element of each pair $ \cb{x, -x} $ for each $ x \in \unit{pq} $. We will always write everything as a pair $ \rb{\alpha, \beta} \in \unit{p} \times \unit{q} $. Firstly we recall from the first example sheet.

\begin{theorem}[Wilson's theorem]
If $ p $ is prime then $ \rb{p - 1}! \equiv -1 \mod p $.
\end{theorem}

Write $ P = \rb{p - 1} / 2 $, $ Q = \rb{q - 1} / 2 $, and $ R = \rb{pq - 1} / 2 = pQ + P $. As out first set of coset representatives, consider the product of all the pairs
$$ \cb{\rb{x, y} \in \unit{p} \times \unit{q} \mid 1 \le x \le P, \ 1 \le y \le q - 1}. $$ Let $ A $ be the product of these coset representatives. Then the product of the $ y $-coordinates is $ \rb{q - 1}!^P \equiv \rb{-1}^P \mod q $. The product of the $ x $-coordinates is $ P!^{q - 1} $ in the same way, so
$$ A = \prod_{1 \le x \le P, \ 1 \le y \le q - 1} \rb{x, y} = \rb{P!^{q - 1}, \rb{-1}^P}. $$
Similarly we let the second set of representatives be all the pairs
$$ \cb{\rb{x, y} \in \unit{p} \times \unit{q} \mid 1 \le x \le p - 1, \ 1 \le y \le Q}. $$
Let $ B $ be the product of these representatives. In the same way by symmetry, we get
$$ B = \prod_{1 \le x \le p - 1, \ 1 \le y \le Q} \rb{x, y} = \rb{\rb{-1}^Q, Q!^{p - 1}}. $$
For the third set of representatives, select the pairs in $ \Z / pq\Z $ which correspond via the Chinese remainder theorem to the set
$$ \cb{1 \le i \le R \mid \rb{i, pq} = 1}. $$
Let $ C $ be the product of these coset representatives. Let us figure out the product of the $ x $-coordinates. It is
$$ \prod_{i = 1, \ \rb{i, pq} = 1}^R i. $$
Since
\begin{equation}
\label{eq:1}
\prod_{i = 1, \ \rb{i, pq} = 1}^R i = \rb{\prod_{i = 1, \ \rb{i, p} = 1}^R i} \ \Bigg/ \ \rb{\prod_{i = 1, \ \rb{i, p} = 1, \ q \mid i}^R i},
\end{equation}
\begin{equation}
\label{eq:2}
\prod_{i = 1, \ \rb{i, p} = 1}^R i = \rb{\prod_{i = 1, \ \rb{i, p} = 1}^{pQ} i}\rb{\prod_{i = pQ + 1, \ \rb{i, p} = 1}^{pQ + P} i},
\end{equation}
\begin{equation}
\label{eq:3}
\prod_{i = 1, \ \rb{i, p} = 1, \ q \mid i}^{R} i = \prod_{j = 1, \ \rb{j, p} = 1}^{P} qj = q^PP!,
\end{equation}
combining $ \rb{\ref{eq:1}} $, $ \rb{\ref{eq:2}} $, $ \rb{\ref{eq:3}} $, get that the $ x $-coordinate of the product is
$$ \prod_{i = 1, \ \rb{i, pq} = 1}^R i = \dfrac{\rb{p - 1}!^QP!}{q^PP!} = \dfrac{\rb{-1}^Q}{q^P}. $$
So by symmetry we have the product of these representatives
$$ C = \rb{\dfrac{\rb{-1}^Q}{q^P}, \dfrac{\rb{-1}^P}{p^Q}} = \rb{\rb{-1}^Q\legendre{q}{p}, \rb{-1}^P\legendre{p}{q}}, $$
by Euler's criterion. Now, we can compare $ A $, $ B $, $ C $. We know that they all agree up to sign, that is up to possibly multiplication by $ \pm 1 $, that is up to multiplication by the pair $ \rb{-1, -1} \in \unit{p} \times \unit{q} $. Comparing the $ y $-coordinates, we have $ C = \legendre{p}{q}A $ and comparing the $ x $-coordinates, similarly $ C = \legendre{q}{p}B $. So
$$ B = \legendre{q}{p}\legendre{p}{q}A. $$
But we can compare $ A $ and $ B $ more directly. To go between $ A $ and $ B $ we need to swap the signs of all the $ PQ $ elements of the form $ \rb{x, y} $ with $ 1 \le x \le P $ and $ Q \le y \le q - 1 $. So $ B = \rb{-1}^{PQ}A $. So $ \legendre{q}{p}\legendre{p}{q} = \rb{-1}^{PQ} $, that is $ \legendre{q}{p} = \rb{-1}^{PQ}\legendre{p}{q} $.

\subsection{Jacobi symbols}

While it is often quite straightforward to compute Legendre symbols using quadratic reciprocity, there is one serious difficulty, which is that in order to compute $ \legendre{a}{p} $, we need to factor $ a $, and we do not know a polynomial time algorithm for factorisation. However it is possible to make computations for Legendre symbols in polynomial time, with the key being the following generalisation due to Jacobi.

\begin{definition}
Let $ b \in \Z_{> 0} $ be odd, and $ a \in \Z $. Then the \textbf{Jacobi symbol} $ \legendre{a}{b} $ is defined to be $ \prod_{i = 1}^s \legendre{a}{p_i}^{r_i} $, where $ b = \prod_{i = 1}^s p_i^{r_i} $ for $ p_i $ distinct primes is the prime factorisation of $ b $.
\end{definition}

\begin{note}
In the special case that $ b $ is prime this agrees with the Legendre symbol. Warning that it is no longer the case that $ \legendre{a}{b} = 1 $ implies that $ a $ is a square modulo $ b $. On the other hand, of course $ \legendre{a}{b} = -1 $ implies that $ a $ is not a square modulo $ b $.
\end{note}

\marginpar{Lecture 13 \\ Friday \\ 02/11/18}

The key properties of the Jacobi symbol are deduced from those of the Legendre symbol in the following lemma.

\begin{lemma}
\hfill
\begin{enumerate}
\item We have $ \legendre{a_1}{b}\legendre{a_2}{b} = \legendre{a_1a_2}{b} $ and $ \legendre{a}{b_1}\legendre{a}{b_2} = \legendre{a}{b_1b_2} $.
\item $ \legendre{a}{b} $ depends only on $ a $ modulo $ b $.
\item $ \legendre{a^2}{b} = 1 $.
\item $ \legendre{-1}{b} = \rb{-1}^{\rb{b - 1} / 2} $.
\item $ \legendre{2}{b} = \rb{-1}^{\rb{b^2 - 1} / 8} $.
\item If $ a, b > 0 $ are both odd then $ \legendre{a}{b}\legendre{b}{a} = \rb{-1}^{\rb{\rb{a - 1} / 2}\rb{\rb{b - 1} / 2}} $.
\end{enumerate}
\end{lemma}

\begin{proof}
All of these statements are true for Legendre symbols, that is for $ b $ prime, and $ a $ prime in $ 6 $. The first three parts are immediate from the definition and the corresponding results for the Legendre symbol. The same is true of the last three from $ 1 $ and the corresponding statements for Legendre symbols. We give the details for $ \legendre{2}{b} = \rb{-1}^{\rb{b^2 - 1} / 8} $. It is enough to show that if it holds for $ b_1, b_2 $, then it holds for $ b_1b_2 $. Since $ \legendre{2}{b_1b_2} = \legendre{2}{b_1}\legendre{2}{b_2} $, we need to show that $ \rb{-1}^{\rb{b_1^2 - 1} / 8}\rb{-1}^{\rb{b_2^2 - 1} / 8} = \rb{-1}^{\rb{\rb{b_1b_2}^2 - 1} / 8} $, or equivalently that
$$ \rb{b_1^2 - 1} + \rb{b_2^2 - 1} \equiv \rb{b_1b_2}^2 - 1 \mod 16, $$
which is equivalent to $ \rb{b_1^2 - 1}\rb{b_2^2 - 1} \equiv 0 \mod 4 $, which is true because $ b_1^2 \equiv b_2^2 \equiv 1 \mod 4 $.
\end{proof}

The last quadratic reciprocity property means that we can compute Jacobi symbols, and thus Legendre symbols, in a similar way to computing $ \rb{a, b} $ with Euclid's algorithm, although we also have to take care of powers of two in the numerator.

\begin{example}
$ 9283 $ is prime, and we can compute $ \legendre{7411}{9283} $ as follows.
\begin{align*}
\legendre{7411}{9283}
& = -\legendre{9283}{7411} = -\legendre{1872}{7411} = -\legendre{16}{7411}\legendre{117}{7411} = -\legendre{117}{7411} = -\legendre{7411}{117} = -\legendre{40}{117} \\
& = -\legendre{8}{117}\legendre{5}{117} = -\legendre{2}{117}\legendre{5}{117} = \legendre{5}{117} = \legendre{117}{5} = \legendre{2}{5} = -1.
\end{align*}
So $ 7411 $ is not a square modulo $ 9283 $.
\end{example}

\section{Sums of squares}

Here we answer the question, which integers are representable as a sum of two squares or four squares?

\subsection{Sums of two squares}

\begin{definition}
We say that $ n \in \Z $ is a \textbf{sum of two squares} if there exist $ x, y \in \Z $ such that $ n = x^2 + y^2 $.
\end{definition}

Of course there is an algorithm to work this out, which is just to use brute force, as $ \abs{x} $ and $ \abs{y} $ are both at most $ \sqrt{n} $.

\begin{example}
$ 21 \equiv 1 \mod 4 $, but $ 21 $ is not a sum of two squares. On the other hand, we will see that all primes which are $ 1 $ modulo $ 4 $ are sums of two squares.
\end{example}

\begin{example}
In a negative direction, note that any square is congruent to $ 0 $ or $ 1 $ modulo $ 4 $, so if $ n $ is a sum of two squares, then $ n $ cannot be congruent to $ 3 $ modulo $ 4 $.
\end{example}

It is convenient to make use of the following.

\begin{definition}
The ring of \textbf{Gaussian integers}, denoted $ \Z\sb{i} $, is the subring of $ \C $ consisting of all complex numbers of the form $ a + bi $, where $ a, b \in \Z $.
\end{definition}

Here are some brief recollections about this. To see that $ \Z\sb{i} $ is a subring one must of course check that it is closed under addition and multiplication. This is easy. There is a natural \textbf{norm} $ N : \Z\sb{i} \to \Z_{\ge 0} $ defined by $ N\rb{z} = z\bar{z} $. We have $ N\rb{a + bi} = a^2 + b^2 $. On the other hand, since $ \bar{z}\bar{w} = \bar{zw} $, we have $ N\rb{zw} = \rb{zw}\rb{\bar{zw}} = \rb{z\bar{z}}\rb{w\bar{w}} = N\rb{z}N\rb{w} $. Let $ z = a + bi $, $ w = c + di $. We then have $ zw = \rb{ac - bd} + \rb{ad + bc}i $. Applying the formula $ N\rb{zw} = N\rb{z}N\rb{w} $, we find that $ \rb{a^2 + b^2}\rb{c^2 + d^2} = \rb{ac - bd}^2 + \rb{ad + bc}^2 $. We record this as the following.

\begin{lemma}
\label{lem:46}
If $ m $ and $ n $ are sums of two squares, then so is $ mn $.
\end{lemma}

In light of this result it makes sense to focus first on which primes are a sum of two squares. Indeed, we have the following.

\begin{theorem}[Fermat's two square theorem]
\label{thm:47}
Every prime congruent to $ 1 $ modulo $ 4 $ is a sum of two squares.
\end{theorem}

Lemma \ref{lem:46} and Theorem \ref{thm:47} together allow you to give a complete classification of the integers which are sums of two squares, in terms of their prime factorisations. We will prove this shortly. Recall that in fact $ \Z\sb{i} $ with its norm $ N $ is a Euclidean domain.

\begin{definition}
A ring $ R $ is a \textbf{Euclidean domain} if it is an integral domain, that is $ ab = 0 $ gives $ a = 0 $ or $ b = 0 $, and there exists a function $ N : R \to \Z_{\ge 0} $ such that for all $ a, b \in R $, with $ b \ne 0 $, there exist $ q, r \in R $ such that
\begin{enumerate}
\item $ a = qb + r $, and
\item either $ r = 0 $, or $ N\rb{r} < N\rb{b} $.
\end{enumerate}
\end{definition}

In particular, in a Euclidean domain $ R $ you can carry out Euclid's algorithm, hence the name. In particular, it follows by the same proof that we gave for $ \Z $ that prime elements and irreducible elements are the same, and that, up to reordering and multiplication by units, which are the elements $ \pm 1 $, $ \pm i $ with $ N\rb{z} = 1 $, we have unique factorisation for every element as a product of irreducibles. $ \Z\sb{i} $ together with $ N $ is a Euclidean domain. By definition, we can rephrase the question of which $ n \in \Z $ are representable as a sum of two squares by asking which $ n \in \Z $ are norms in $ \Z\sb{i} $, so there exists $ z \in \Z\sb{i} $ with $ N\rb{z} = n $. Since the norm is multiplicative, $ N\rb{zw} = N\rb{z}N\rb{w} $, and every element of $ \Z\sb{i} $ is a product of primes, we can answer this question by asking what the primes in $ \Z\sb{i} $ are, and what their norms are. (TODO Exercise: Show that the units in $ \Z\sb{i} $ are $ \pm 1 $, $ \pm i $)

\marginpar{Lecture 14 \\ Tuesday \\ 06/11/18}

Two elements of $ \Z\sb{i} $ are \textbf{associates} if their ratio is a unit, that is $ z, w $ are associates if $ z = uw $ for $ u \in \cb{\pm 1, \pm i} $. $ \Z\sb{i} $ is a Euclidean domain, so in particular we have unique factorisation into primes.

\begin{lemma}
Let $ p $ be a prime in $ \Z\sb{i} $. Then there exists a prime $ q \in \Z $ such that either $ N\rb{p} = q $ or $ N\rb{p} = q^2 $. In the latter case, $ p $ is an associate of $ q $, that is $ p = uq $ for some unit $ u $. Moreover, given $ q $ a prime in $ \Z $, there exists a prime $ p \in \Z\sb{i} $ such that $ N\rb{p} = q $ if and only if $ q $ is a sum of two squares.
\end{lemma}

\begin{proof}
Let $ n = N\rb{p} $, and factor $ n = q_1^{s_1} \dots q_r^{s_r} $ as a product of integer primes. Since by definition, $ n = p\bar{p} $, we have that $ p \mid n = q_1^{s_1} \dots q_r^{s_r} $ in $ \Z\sb{i} $, and so since $ p $ is prime, $ p \mid q_i $ for some $ i $. Let $ q = q_i $. Then we have $ p \mid q $ gives $ q = pv $ for some $ v $, so $ N\rb{p}N\rb{v} = N\rb{pv} = N\rb{q} = q^2 $. If $ N\rb{p} = 1 $, then $ p $ would be a unit, a contradiction. Since $ N\rb{p} $ is not $ 1 $, so $ N\rb{p} \mid q^2 $ gives $ N\rb{p} = q $ or $ N\rb{p} = q^2 $, as claimed. First suppose that $ N\rb{p} = q^2 $. Since $ p $ divides $ q $ we have $ q = pv $. Since $ N\rb{p} = N\rb{q} = q^2 $ we must have $ N\rb{v} = 1 $, so $ v $ is a unit and $ p $ is an associate of $ q $, by definition. Suppose $ N\rb{p} = q $. Writing $ p = a + bi $, we see that $ q = a^2 + b^2 $. Conversely, if $ q = a^2 + b^2 $, then $ q = \rb{a + bi}\rb{a - bi} $. Since $ p $ divides $ q $, we have either $ p $ divides $ \rb{a + bi} $ or $ p $ divides $ \rb{a - bi} $, so $ N\rb{p} \mid N\rb{a + bi} = q $ or $ N\rb{p} \mid N\rb{a - bi} = q $. In either case $ N\rb{p} $ divides $ q $ and must thus equal $ q $.
\end{proof}

\begin{corollary}
\label{cor:50}
The primes in $ \Z\sb{i} $ are either of the form $ a + bi $, where $ a^2 + b^2 \in \Z $ is a prime, or an associate of $ q $, where $ q \in \Z $ is a prime that is not a sum of two squares.
\end{corollary}

\begin{theorem}
If $ p = 2 $ or $ p \equiv 1 \mod 4 $, then $ p $ is a sum of two squares.
\end{theorem}

\begin{proof}
By Corollary \ref{cor:50}, we just have to show that $ p $ is not a prime in $ \Z\sb{i} $. There exists $ n $ such that $ n^2 \equiv -1 \mod p $. If $ p = 2 $ obvious, and if $ p \equiv 1 \mod 4 $, $ \legendre{-1}{p} = \rb{-1}^{\rb{p - 1} / 2} = 1 $ by Euler's criterion, so $ -1 $ is a QR modulo $ p $. That is, $ p \mid \rb{n^2 + 1} = \rb{n + i}\rb{n - i} $. If $ p $ were prime, then $ p \mid \rb{n + i} $ or $ p \mid \rb{n - i} $, that is there exist $ c, d \in \Z $ such that $ n \pm i = p\rb{c + di} $, so $ 1 = pd $, a contradiction. It follows that $ p $ is not prime, so by Corollary \ref{cor:50}, $ p $ is a sum of two squares.
\end{proof}

This proof looks non-constructive, but in fact it is not. In practice, if you want to go from $ n^2 + 1 \equiv 0 \mod p $ to finding $ a, b $ such that $ a^2 + b^2 = p $, simply use Euclid's algorithm in $ \Z\sb{i} $ to compute a GCD $ \rb{n + i, p} = a + bi $ of $ p $ and $ n + i $. Since $ p $ divides neither $ n + i $ nor $ n - i $, this GCD is not a unit, nor is it an associate of $ p $, so its norm is neither $ 1 $ nor $ p^2 $. Therefore this GCD has norm exactly $ p $. Since we have also shown that primes congruent to $ 3 $ modulo $ 4 $ are not a sum of two squares, even modulo $ 4 $, we have the following complete characterisation of sums of two squares.

\begin{theorem}
$ n \in \Z $ is a sum of two squares if and only if its prime factorisation only contains primes congruent to $ 3 $ modulo $ 4 $ to even powers, that is of the form
$$ n = 2^a\prod_{p_i \equiv 1 \mod 4} p_i^{r_i}\prod_{q_i \equiv 3 \mod 4} q_i^{2s_i}. $$
\end{theorem}

\begin{proof}
Suppose $ n $ is of the above form, and write
$$ z = \rb{1 + i}^a\rb{a_1 + b_1i}^{r_i} \dots \rb{a_k + b_ki}^{r_k}q_1^{s_1} \dots q_h^{s_h}, $$
where $ p_i = N\rb{a_i + b_ii} $. Then these are all sums of two squares, so $ N\rb{z} = n $ is a sum of two squares by Lemma \ref{lem:46}. Conversely, if $ n = a^2 + b^2 $ is a sum of two squares, we can write $ a + bi $ as a product of primes in $ \Z\sb{i} $. Then $ n = N\rb{a + bi} $ is the product of the norms of these primes, and we already saw that the norms of primes in $ \Z\sb{i} $ are either $ 2 $, a prime which is $ 1 $ modulo $ 4 $, or the square of a prime which is $ 3 $ modulo $ 4 $. Then $ N\rb{a + bi} $ has the claimed form.
\end{proof}

\subsection{Sums of four squares - the ring of quaternions}

We have used the arithmetic of the ring $ \Z\sb{i} $ to determine precisely which integers are a sum of two squares. On the other hand, it is a fact, first proved by Lagrange, that every positive integer is a sum of four integer squares. This fact is connected with the arithmetic of a non-commutative ring, which we now describe.

\begin{definition}
The ring $ \H $ of \textbf{quaternions} is the ring whose elements are formal sums $ a + bi + cj + dk $, with $ a, b, c, d \in \R $. Addition is given by the rule
$$ \rb{a + bi + cj + dk} + \rb{A + Bi + Cj + Dk} = \rb{a + A} + \rb{b + B}i + \rb{c + C}j + \rb{d + D}k. $$
Multiplication is given by the rules
$$ i^2 = j^2 = k^2 = -1, \qquad ij = -ji = k, \qquad jk = -kj = i, \qquad ki = -ik = j, $$
extended by $ \R $-linearity and the distributive law.
\end{definition}

Let $ z = a + bi + cj + dk $ be a quaternion. The \textbf{conjugate} $ z^* $ of $ z $ is the quaternion $ a - bi - cj - dk $. Note that if $ z $ and $ w $ are quaternions, then $ \rb{zw}^* = w^*z^* $. The norm $ N\rb{z} $ of $ z $ is defined by $ N\rb{z} = zz^* = a^2 + b^2 + c^2 + d^2 $. Note that this is a real number, and hence commutes with all elements of $ \H $. Thus we have
$$ N\rb{zw} = zw\rb{zw}^* = zww^*z^* =  zN\rb{w}z^* = zz^*N\rb{w} = N\rb{z}N\rb{w}, $$
because $ N\rb{w} \in \R $. As was the case with $ \Z\sb{i} $, this gives an expression for the product of two sums of four squares as a sum of four squares. Explicitly, one has
\begin{align*}
\rb{a^2 + b^2 + c^2 + d^2}\rb{x^2 + y^2 + z^2 + w^2}
& = N\rb{a + bi + cj + dk}N\rb{x + yi + zj + wk} \\
& = N\rb{\rb{a + bi + cj + dk}\rb{x + yi + zj + wk}} \\
& = \rb{ax - by - cz - dw}^2 + \rb{ay + bx + cw - dz}^2 \\
& + \rb{az - bw + cx + dy}^2 + \rb{aw + bz - cy + dx}^2.
\end{align*}
In particular, if $ m, n \in \Z $ are representable as sums of four integer squares, then so is their product $ mn $. Thus to prove Lagrange's theorem, it suffices to prove that every prime is a sum of four integer squares.

\subsection{Proof of Lagrange's theorem}

Let $ p $ be a prime. If $ p = 2 $, or $ p \equiv 1 \mod 4 $, then we have already shown that $ p $ is a sum of two squares, hence also a sum of four squares. It thus remains to prove that primes congruent to $ 3 $ modulo $ 4 $ are sums of four squares. We will do this via a descent argument.

\marginpar{Lecture 15 \\ Wednesday \\ 07/11/18}

\begin{lemma}
\label{lem:54}
Let $ p $ be a prime congruent to $ 3 $ modulo $ 4 $. Then there exist $ x $ and $ y $ such that $ x^2 + y^2 + 1 \equiv 0 \mod p $.
\end{lemma}

\begin{proof}
It suffices to find $ a \in \Z $ such that $ a $ is a square modulo $ p $ and $ a + 1 $ is not, so $ \legendre{a}{p} = 1 $ and $ \legendre{a + 1}{p} = -1 $. Since $ p \equiv 3 \mod 4 $, $ \legendre{-1}{p} = -1 $ by Euler's criterion, so $ -1 $ is not a QR modulo $ p $. So we would then have $ \legendre{-\rb{a + 1}}{p} = \legendre{a + 1}{p}\legendre{-1}{p} = 1 $, so $ -\rb{a + 1} $ is a QR modulo $ p $. Taking $ x $ such that $ x^2 \equiv a \mod p $ and $ y $ such that $ y^2 \equiv -\rb{a + 1} \mod p $. Then $ x^2 + y^2 \equiv -1 \mod p $ and the claim would follow. Suppose that we cannot do this. Then for each square $ a $ modulo $ p $, $ a + 1 $ would also be a square modulo $ p $. In particular since $ \legendre{1}{p} = 1 $, we must have $ \legendre{2}{p} = \dots = \legendre{p - 1}{p} = 1 $, so every congruence class modulo $ p $ would be a square. But we know that there are $ \rb{p - 1} / 2 $ values of $ b $ with $ 1 \le b \le p - 1 $ and $ \legendre{b}{p} = -1 $, a contradiction. Since this does not happen we are done.
\end{proof}

Fix a prime congruent to $ 3 $ modulo $ 4 $. By Lemma \ref{lem:54}, we can find $ x, y \in \Z $ such that $ x^2 + y^2 + 1 = pr $ for some $ r \in \Z $. Since we only care about $ x $ and $ y $ modulo $ p $ and the congruence $ x^2 + y^2 + 1 \equiv 0 \mod p $ only depends on $ x, y $ modulo $ p $, we can further arrange $ x, y $ with $ \abs{x}, \abs{y} \le p / 2 $. Then $ \rb{x^2 + y^2 + 1} / p = r < p $. We are now ready to begin our descent.

\begin{proposition}
\label{prop:55}
Suppose that for some $ 1 \le r < p $, we have $ x, y, z, w $ such that $ x^2 + y^2 + z^2 + w^2 = pr $. Then there exist $ x', y', z', w', r' \in \Z $ with $ 1 \le r' < r $, and $ \rb{x'}^2 + \rb{y'}^2 + \rb{z'}^2 + \rb{w'}^2 = pr' $.
\end{proposition}

\begin{proof}
There are two cases we must treat separately. First suppose that $ r $ is even. Then either all of $ x, y, z, w $ have the same parity, so all even or all odd, or two of them are odd and two of them are even. Permuting $ x, y, z, w $ as necessary, we can assume without loss of generality $ x $ and $ y $ have the same parity, as do $ z $ and $ w $, so $ x \equiv y \mod 2 $ and $ z \equiv w \mod 2 $. Then set
$$ x' = \dfrac{x + y}{2}, \qquad y' = \dfrac{x - y}{2}, \qquad z' = \dfrac{z + w}{2}, \qquad w' = \dfrac{z - w}{2}, \qquad r' = \dfrac{r}{2}. $$
It is then easy to verify that $ \rb{x'}^2 + \rb{y'}^2 + \rb{z'}^2 + \rb{w'}^2 = pr' $. Now suppose that $ r $ is odd. Choose $ a, b, c, d $ such that
$$ -\dfrac{r}{2} < a, b, c, d < \dfrac{r}{2}, \qquad x \equiv a \mod r, \qquad y \equiv b \mod r, \qquad z \equiv c \mod r, \qquad w \equiv d \mod r. $$
We can get away with strict inequalities here because $ r $ is odd. Since $ x^2 + y^2 + z^2 + w^2 = pr \equiv 0 \mod r $, our congruences imply that $ a^2 + b^2 + c^2 + d^2 \equiv 0 \mod r $. Write $ a^2 + b^2 + c^2 + d^2 = rr' $, and note that $ 0 \le r' < r $ since $ a^2, b^2, c^2, d^2 < \rb{r / 2}^2 = r^2 / 4 $. On the other hand if $ r' $ were zero, then $ a = b = c = d = 0 $, so all of $ x, y, z, w $ would be divisible by $ r $. Since $ x^2 + y^2 + z^2 + w^2 = pr $, we would have $ r^2 \mid rp $, hence $ r \mid p $, and since $ r < p $, we get $ r = 1 $, and we are done. Otherwise we have $ 1 \le r' < r $. We then have
\begin{align*}
\rb{rr'}\rb{rp}
& = \rb{a^2 + b^2 + c^2 + d^2}\rb{x^2 + y^2 + z^2 + w^2} \\
& = \rb{ax + by + cz + dw}^2 + \rb{-ay + bx + cw - dz}^2 \\
& + \rb{-az - bw + cx + dy}^2 + \rb{-aw + bz - cy + dx}^2.
\end{align*}
Note that
\begin{align*}
ax + by + cz + dw \equiv x^2 + y^2 + z^2 + w^2 & \equiv 0 \mod r, \\
-ay + bx + cw - dz \equiv -xy + yx + zw - wz & \equiv 0 \mod r, \\
-az - bw + cx + dy \equiv -xz - yw + zx + wy & \equiv 0 \mod r, \\
-aw + bz - cy + dx \equiv -xw + yz - zy + wx & \equiv 0 \mod r.
\end{align*}
We thus have integers
$$ x' = \dfrac{ax + by + cz + dw}{r}, \qquad y' = \dfrac{-ay + bx + cw - dz}{r}, $$
$$ z' = \dfrac{-az - bw + cx + dy}{r}, \qquad w' = \dfrac{-aw + bz - cy + dx}{r}, $$
and $ \rb{x'}^2 + \rb{y'}^2 + \rb{z'}^2 + \rb{w'}^2 = pr' $ as desired.
\end{proof}

Proposition \ref{prop:55} gives $ p $ is a sum of four squares. To complete the proof, one begins with $ x^2 + y^2 + 1 = pr $ as above with $ z = 1 $ and $ w = 0 $ and repeatedly applies the proposition until $ r = 1 $.

\begin{remark}
This descent can be interpreted as a version of Euclid's algorithm in a non-commutative setting. The associated ring is the ring of quaternions of the form $ a + bi + cj + dk $, where either $ a, b, c, d \in \Z $, or $ a, b, c, d \in \Z / 2 $, that is fractions of the form $ r / 2 $ with $ r $ odd. That is,
$$ \cb{\dfrac{a + bi + cj + dk}{2} \ \Bigg| \ a \equiv b \equiv c \equiv d \mod 2}. $$
\end{remark}

\begin{note}
This ring is non-commutative, and also $ 5 = \rb{1 - 2i}\rb{1 - 2i} = \rb{1 + 2j}\rb{1 - 2j} $ for example, so you have to be careful with unique factorisation, etc.
\end{note}

\subsection{Sums of three squares}

At this point it is natural to ask which positive integers are a sum of three integer squares. This turns out to be much more difficult. $ 7 $ is the smallest positive integer which is not a sum of three squares. In one direction, no integer congruent to $ 7 $ modulo $ 8 $ can be a sum of three squares, because the squares modulo $ 8 $ are $ 0, 1, 4 $. In fact no integer of the form $ 4^a\rb{8k + 7} $ for $ t, k \in \Z $ is a sum of three squares. (TODO Exercise) Conversely, one has the following.

\begin{theorem}
Every positive integer is not a sum of three squares if and only if it is of the form $ 4^a\rb{8k + 7} $.
\end{theorem}

The proof of this requires tools beyond the scope of the class, such as the Hasse principle for quadratic forms. One good place to read about this is in Serre's a course in arithmetic.

\section{Pell's equation}

\subsection{Pell's equation}

Let $ d \in \Z_{> 1} $ be squarefree, and consider the equation $ x^2 - dy^2 = 1 $. This is called \textbf{Pell's equation}.

\begin{example}
For $ d = 2 $, $ \rb{x, y} = \rb{3, 2} $ is a solution. In fact, there are infinitely many solutions, and this is true for any $ d $.
\end{example}

Here is another way of thinking about this, generalizing what we said about the Gaussian integers. We will find it useful to write $ x^2 - dy^2 = \rb{x + \sqrt{d}y}\rb{x - \sqrt{d}y} $. This suggests that we should look at a ring like $ \Z\sb{\sqrt{d}} = \cb{a + b\sqrt{d} \mid a, b \in \Z} $.

\begin{definition}
Let $ \alpha \in \C $. Then the ring $ \Z\sb{\alpha} $ is the smallest subring of $ \C $ containing $ \alpha $.
\end{definition}

\begin{note}
Note that for this course, a ring always contains $ 1 $.
\end{note}

As usual one has to check that this makes sense. An alternative definition is to take $ \Z\sb{\alpha} $ to be the intersection of all subrings of $ \C $ containing $ \alpha $. This intersection clearly contains $ 0 $, $ 1 $, and $ \alpha $, so it is non-empty. It is also closed under addition and multiplication, since it is an intersection of sets that are closed under these operations. Therefore it is a subring of $ \C $ that, by construction is contained in any subring of $ \C $ that contains $ \alpha $.

\begin{example}
If $ \alpha = 1 $, then $ \Z\sb{\alpha} = \Z $. Let us show that for $ \alpha = i $, this agrees with our earlier definition of $ \Z\sb{i} $. We have already shown that the set of all integers of the form $ a + bi $ is a subring of $ \C $. On the other hand, any subring of $ \C $ containing $ i $ is closed under addition and multiplication, and contains $ 1 $, so it contains every complex number of the form $ a + bi $. Thus our new definition is consistent with our old one.
\end{example}

\begin{note}
For arbitrary $ \alpha $, it is not necessarily true that $ \Z\sb{\alpha} $ consists of all complex numbers of the form $ a + b\alpha $ for $ a, b \in \Z $, although it always contains all complex numbers of that form.
\end{note}

\begin{example}
To see this, consider examples like $ \Z\sb{\pi} $, the ring of $ a_0 + \dots + a_n\pi^n $ for $ a_i \in \Z $ and $ n $ arbitrary. Also $ \Z\sb{1 / p} $ for $ p $ some prime contains $ 1 / p^n $ for all $ n $, so in fact $ \Z\sb{1 / p} = \cb{a / p^n \mid a \in \Z, \ n \ge 0} $. Also $ \Z\sb{\beta} $ where $ \beta = \sqrt[3]{2} $ is a cube root of $ 2 $ is not just the set $ \cb{a + b\sqrt[3]{2} \mid a, b \in \Z} $, because the set does not contain $ \beta^2 = \rb{\sqrt[3]{2}}^2 = \sqrt[3]{4} $, which is not of the form $ a + b\sqrt[3]{2} $ for any $ a, b \in \Z $.
\end{example}

\marginpar{Lecture 16 \\ Friday \\ 09/11/18}

Lecture 16 is a problem class.

\marginpar{Lecture 17 \\ Tuesday \\ 13/11/18}

\subsection{Quadratic subrings of $ \C $}

\begin{definition}
An element $ \alpha $ of $ \C $ is an \textbf{algebraic integer of degree two}, alternatively a \textbf{quadratic algebraic integer}, if there exists a polynomial of the form $ P\rb{X} = X^2 + aX + b $ with $ a, b \in \Z $ and $ \alpha \notin \Z $ such that $ P\rb{X} $ has no rational, equivalently integer, roots and $ P\rb{\alpha} = 0 $.
\end{definition}

\begin{example}
$ \alpha = i $ is an algebraic integer of degree two and a root of $ X^2 + 1 $ since $ i^2 + 1 = 0 $. $ \alpha = \sqrt{d} $ is a root of $ X^2 - d $ for $ d > 1 $ squarefree.
\end{example}

We thus have the following.

\begin{proposition}
If $ \alpha $ is an algebraic integer of degree two, then $ \Z\sb{\alpha} $ is equal to the set of complex numbers $ \cb{x + y\alpha \mid x, y \in \Z} $.
\end{proposition}

\begin{proof}
Let $ a, b \in \Z $ such that $ \alpha^2 + a\alpha + b = 0 $. Since $ \alpha \notin \Z $, we have $ \alpha \notin \Q $. If $ \alpha = r / s $ for $ \rb{r, s} = 1 $ then $ r^2 + ars + bs^2 = 0 $, so $ s \mid r^2 $, so $ s \mid 1 $, so $ \alpha \in \Z $. So if $ x, y \in \Z $ and $ x + y\alpha = 0 $, then $ x = y = 0 $. Then, for $ x, y, X, Y \in \Z $, we have
\begin{align*}
\rb{x + y\alpha}\rb{X + Y\alpha}
& = xX + \rb{xY + yX}\alpha + yY\alpha^2 \\
& = xX + \rb{xY + yX}\alpha + yY\rb{a\alpha + b} \\
& = \rb{xX + byY} + \rb{xY + yX + ayY}\alpha.
\end{align*}
In particular the set of complex numbers of the form $ x + y\alpha $ for $ x, y \in \Z $ is closed under addition, subtraction, and multiplication and is therefore a subring of $ \C $. Since this subring contains $ \alpha $, it contains $ \Z\sb{\alpha} $. On the other hand it is clear that this subring is certainly contained in $ \Z\sb{\alpha} $, so the two must be equal.
\end{proof}

For $ \alpha $ an algebraic integer of degree two, we will say that $ \Z\sb{\alpha} $ is a \textbf{real quadratic} subring of $ \C $ if $ \alpha \in \R $, and an \textbf{imaginary quadratic} subring of $ \C $ if $ \alpha \notin \R $. We let $ \alpha^* $ denote the root of $ X^2 + aX + b = 0 $ that is not equal to $ \alpha $. If $ z = x + y\alpha \in \Z\sb{\alpha} $, write $ z^* = x + y\alpha^* $.

\begin{example}
$ i^* = -i = \bar{i} $. $ \sqrt{d}^* = -\sqrt{d} $.
\end{example}

If $ \Z\sb{\alpha} $ is imaginary quadratic, $ \alpha^* = \bar{\alpha} $ and $ z^* = \bar{z} $ and then, as with $ \Z\sb{i} $, we can define a norm $ N : \Z\sb{\alpha} \to \Z_{\ge 0} $ by setting $ N\rb{z} = z\bar{z} $. Note that $ \bar{\alpha} $ is also a root of $ X^2 + aX + b $ in this case, so we have $ \alpha + \bar{\alpha} = -a $, and $ \alpha\bar{\alpha} = b $. Thus we have
$$ N\rb{x + y\alpha} = \rb{x + y\alpha}\rb{x + y\bar{\alpha}} = x^2 + xy\rb{\alpha + \bar{\alpha}} + y^2\alpha\bar{\alpha} = x^2 - axy + by^2 \in \Z_{\ge 0}. $$
This is multiplicative, $ N\rb{zw} = N\rb{z}N\rb{w} $. If $ \Z\sb{\alpha} $ is real quadratic, note that $ \alpha^* $ is no longer equal to $ \bar{\alpha} $. In this case we define
$$ N\rb{x + y\alpha} = \rb{x + y\alpha}\rb{x + y\alpha^*} = x^2 - axy + by^2 \in \Z. $$
We thus get a map $ N : \Z\sb{\alpha} \to \Z $. We have $ \rb{zw}^* = z^*w^* $ gives $ N\rb{z}N\rb{w} = zz^*ww^* = \rb{zw}\rb{zw}^* = N\rb{zw} $. This is again multiplicative, but no longer non-negative, so we can have $ N\rb{z} < 0 $.

\begin{example}
In $ \Z\sb{\sqrt{2}} $, $ N\rb{1 + \sqrt{2}} = \rb{1 + \sqrt{2}}\rb{1 - \sqrt{2}} = -1 $. In $ \Z\sb{\sqrt{d}} $, $ N\rb{\sqrt{d}} = \rb{\sqrt{d}}\rb{-\sqrt{d}} = -d < 0 $.
\end{example}

(TODO Exercise: $ N\rb{x + y\alpha} = 0 $ if and only if $ x = y = 0 $)

\subsection{Factorisation in quadratic rings}

In general, quadratic rings are not Euclidean domains, or even unique factorisation domains. The situation is more complicated, see the algebraic number theory class. First, some definitions.

\begin{definition}
An element of $ \Z\sb{\alpha} $ is a unit if it has a multiplicative inverse, that is, if it lies in the group $ \Z\sb{\alpha}^\times $ under multiplication. Two elements $ z, w \in \Z\sb{\alpha} $ are associates if there exists a unit $ u \in \Z\sb{\alpha}^\times $ such that $ z = uw $.
\end{definition}

\begin{note}
If $ u \in \Z\sb{\alpha}^\times $ is a unit, there exists $ v $ such that $ uv = 1 $. Taking norms we find that $ 1 = N\rb{1} = N\rb{u}N\rb{v} $, so $ N\rb{u} = \pm 1 $. If $ \Z\sb{\alpha} $ is imaginary quadratic, then this means $ N\rb{u} = 1 $. Conversely, if $ N\rb{u} = \pm 1 $, then $ \pm 1 = N\rb{u} = u\rb{u^*} $, so $ u\rb{\pm u^*} = 1 $, so either $ u^* $ or $ -u^* $ is a multiplicative inverse of $ u $, so $ u \in \Z\sb{\alpha}^\times $. So $ \Z\sb{\alpha}^\times = \cb{z \in \Z\sb{\alpha} \mid N\rb{z} = \pm 1} $.
\end{note}

\subsection{Back to Pell's equation}

If $ \alpha = \sqrt{d} $ for $ d > 1 $ squarefree, then $ \Z\sb{\sqrt{d}} $ is a real quadratic subring of $ \C $, and its norm form is given by
$$ N\rb{x + y\sqrt{d}} = \rb{x + y\sqrt{d}}\rb{x + y\sqrt{d}}^* = \rb{x + y\sqrt{d}}\rb{x - y\sqrt{d}} = x^2 - dy^2. $$
Thus the problem of finding integer solutions to Pell's equation is equivalent to finding elements of norm one in $ \Z\sb{\sqrt{d}} $. Since such elements are units, and the norm is multiplicative, these elements form a multiplicative subgroup
$$ \Z\sb{\sqrt{d}}^{\times, 1} = \cb{z \in \Z\sb{\sqrt{d}} \ \Big| \ N\rb{z} = 1} = \cb{x + y\sqrt{d} \ \Big| \ x^2 - dy^2 = 1}, $$
the \textbf{$ 1 $-units} of $ \Z\sb{\sqrt{d}} $. (TODO Exercise: If $ \Z\sb{\alpha} $ is imaginary quadratic, show that $ \Z\sb{\alpha}^\times = \Z\sb{\alpha}^{\times, 1} $ is finite. What are the possibilities for this group?) There are certainly two obvious elements of $ \Z\sb{\sqrt{d}}^{\times, 1} $, namely $ \pm 1 $. All others are of the form $ x + y\sqrt{d} $, with $ x, y \in \Z $ and $ y $ non-zero. We have the following.

\begin{lemma}
\label{lem:62}
Let $ x + y\sqrt{d} $ be an element of $ \Z\sb{\sqrt{d}}^{\times, 1} $. Then
\begin{enumerate}
\item We have $ x > 0 $, $ y > 0 $ if and only if $ x + y\sqrt{d} > 1 $.
\item We have $ x > 0 $, $ y < 0 $ if and only if $ 0 < x + y\sqrt{d} < 1 $,
\item We have $ x < 0 $, $ y > 0 $ if and only if $ -1 < x + y\sqrt{d} < 0 $, and
\item We have $ x < 0 $, $ y < 0 $ if and only if $ x + y\sqrt{d} < -1 $.
\end{enumerate}
\end{lemma}

\begin{proof}
It is clear that if $ x, y > 0 $ then $ x + y\sqrt{d} > y\sqrt{d} \ge \sqrt{d} > 1 $. But then $ x - y\sqrt{d} = 1 / \rb{x + y\sqrt{d}} $ lies between $ 0 $ and $ 1 $. So replacing $ y $ by $ -y $, we get $ x > 0 $ and $ y < 0 $, so $ 0 < x + y\sqrt{d} < 1 $. Similarly, replacing $ \rb{x, y} $ with $ \rb{-x, -y} $, $ -x + y\sqrt{d} $ lies between $ -1 $ and $ 0 $, and $ -x - y\sqrt{d} < -1 $. But since the four cases are mutually exclusive and exhaust all the possibilities for $ x, y \ne 0 $, the leftward implications from the right hand side hold as well.
\end{proof}

\begin{lemma}
\label{lem:63}
Let $ z = x + y\sqrt{d} $, $ z' = x' + y'\sqrt{d} $ be two elements of $ \Z\sb{\sqrt{d}}^{\times, 1} $ with $ z, z' > 1 $, that is $ x, y, x', y' $ all positive. Then $ z > z' $ if and only if $ y > y' $.
\end{lemma}

\begin{proof}
We have $ z - 1 / z = x + y\sqrt{d} - \rb{x - y\sqrt{d}} = 2y\sqrt{d} $. Since $ z - 1 / z $ is increasing for $ z $ positive, since its derivative is $ 1 + 1 / z^2 > 0 $, we have $ z > z' $ if and only if $ z - 1 / z > z' - 1 / z' $, if and only if $ y > y' $.
\end{proof}

\marginpar{Lecture 18 \\ Wednesday \\ 14/11/18}

Suppose we have a non-trivial element $ z $ of $ \Z\sb{\sqrt{d}}^{\times, 1} $, that is $ z \ne \pm 1 $. Without loss of generality by replacing $ z $ by $ \pm z^{\pm 1} $, we can take $ z > 1 $. So by Lemma \ref{lem:62}, if $ z = x + y\sqrt{d} $, then $ x, y > 0 $. Then there exists $ \epsilon = x + y\sqrt{d} \in \Z\sb{\sqrt{d}}^{\times, 1} $ such that $ x $ and $ y $ are both positive and $ y $ as small as possible. We will call $ \epsilon $ the \textbf{fundamental $ 1 $-unit} in $ \Z\sb{\sqrt{d}} $. By the previous lemmas it is the smallest element of $ \Z\sb{\sqrt{d}}^{\times, 1} $ that is greater than one.

\begin{example}
For $ d = 2 $, in $ \Z\sb{\sqrt{2}} $ we have $ y = 2 $, $ x = 3 $. So $ \epsilon = 3 + 2\sqrt{2} $.
\end{example}

\begin{proposition}
Suppose that $ \Z\sb{\sqrt{d}}^{\times, 1} \ne \cb{\pm 1} $, so there exists a non-trivial element of $ \Z\sb{\sqrt{d}}^{\times, 1} $. Then every element of $ \Z\sb{\sqrt{d}}^{\times, 1} $ is of the form $ \pm \epsilon^n $ for some $ n \in \Z $, where $ \epsilon $ is the fundamental $ 1 $-unit.
\end{proposition}

Conversely, $ N\rb{\pm \epsilon^n} = N\rb{\pm 1}N\rb{\epsilon}^n = 1 $.

\begin{proof}
Let $ z $ be an element of $ \Z\sb{\sqrt{d}}^{\times, 1} $, $ z \ne \pm 1 $. After negating $ z $ or replacing $ z $ by $ 1 / z $, as necessary, we can assume that $ z > 1 $. Since $ \epsilon $ is also greater than one, there exists $ n \ge 0 $ such that $ \epsilon^n \le z < \epsilon^{n + 1} $. Then $ 1 \le z\epsilon^{-n} < \epsilon $, so $ N\rb{z\epsilon^{-n}} = N\rb{z}N\rb{\epsilon}^{-n} = 1 $. Then $ z\epsilon^{-n} $ is a $ 1 $-unit in $ \Z\sb{\sqrt{d}}^{\times, 1} $. Since $ \epsilon $ is the smallest $ 1 $-unit greater than one by choice, and Lemma \ref{lem:63}, we have $ z\epsilon^{-n} = 1 $, that is $ z = \epsilon^n $.
\end{proof}

\begin{example}
For $ d = 2 $, $ \epsilon = 3 + 2\sqrt{2} $. $ \epsilon^2 = \rb{3 + 2\sqrt{2}}^2 = 17 + 12\sqrt{2} $, and $ 17^2 - 2\rb{12}^2  = 1 $.
\end{example}

\subsection{Constructing the fundamental $ 1 $-unit}

In fact, we will show that there are always elements of $ \Z\sb{\sqrt{d}}^{\times, 1} $ other than $ \pm 1 $, so that we are always in the situation of the preceding proposition. The key idea is to note that $ x^2 - dy^2 = 0 $ for $ x, y > 0 $ precisely when $ x / y $ is a square root of $ d $, and thus, when $ d $ is squarefree, $ x^2 - dy^2 = 1 $ when $ x / y $ is in some sense as close as possible to $ \sqrt{d} $. This suggests we should think about approximating $ \sqrt{d} $ by rational numbers. So one way to try to find $ 1 $-units is to find rational numbers which are good approximations to $ \sqrt{d} $. $ \abs{x - y\sqrt{d}} = 1 / \abs{x + y\sqrt{d}} $, which is small. Want to make $ \abs{x / y - \sqrt{d}} $ as small as possible for $ y $ of a given size. More generally, it is clear that if $ x $ and $ y $ are integers, and $ \alpha $ is an irrational number, then we can make $ \abs{x / y - \alpha} $ as small as we want. However, in order to do so we might need to make $ y $ large. We will thus be interested in approximations to $ \alpha $ where the error $ \abs{x / y - \alpha} $ is small compared to $ C / y^n $ for various $ C, n $ fixed. As $ n $ gets larger it will become harder and harder to find such approximations. $ n = 0 $ is trivial. When $ n = 1 $ and $ C = 1 $ the situation is very easy. For any $ \alpha $, and any $ y $, there exists $ x $ such that $ x / y $ is as close to $ \alpha $ as possible, and $ \abs{x / y - \alpha} < 1 / y $. When $ n = 2 $ things are much less obvious, but in fact we have the following important result that there always exist infinitely many $ x, y $ with $ \abs{x / y - \alpha} < 1 / y^2 $, due to Dirichlet.

\begin{theorem}[Dirichlet]
\label{thm:65}
Let $ \alpha $ be an irrational number, and let $ Q \in \Z_{> 1} $. Then there exist $ p, q \in \Z $, with $ 1 \le q < Q $, such that $ \abs{p - q\alpha} < 1 / Q $.
\end{theorem}

\begin{proof}
For $ 1 \le k \le Q - 1 $, let $ a_k = \left\lfloor k\alpha \right\rfloor $, so that $ 0 < k\alpha - a_k < 1 $. Partition the interval $ \sb{0, 1} $ into $ Q $ subintervals of length $ 1 / Q $, $ \sb{0, 1 / Q}, \dots, \sb{\rb{Q - 1} / Q, 1} $. One of these intervals contains some pair of elements of the set
$$ \cb{0, \alpha - a_1, \dots, \rb{Q - 1}\alpha - a_{Q - 1}, 1}, $$
which contains $ Q + 1 $ elements. The difference between these two elements is of the form $ p - q\alpha $, where $ p, q \in \Z $ and $ 1 \le q < Q $, and this difference is less than $ 1 / Q $.
\end{proof}

\begin{corollary}
\label{cor:66}
For any irrational $ \alpha $, there are infinitely many pairs $ p, q \in \Z $ such that $ \abs{\alpha - p / q} < 1 / q^2 $.
\end{corollary}

\begin{proof}
Certainly there exists $ p $ for $ q = 1 $. It suffices to show, given any $ p, q $ with $ \abs{\alpha - p / q} < 1 / q^2 $, that we can find another $ p', q' $ with $ \abs{\alpha - p' / q'} < 1 / \rb{q'}^2 $ and $ \abs{\alpha - p' / q'} < \abs{\alpha - p / q} $. Suppose given such a $ p, q $, and choose $ Q $ such that $ 1 / Q < \abs{\alpha - p / q} $. Then by Theorem \ref{thm:65}, there exist $ p', q' $ with $ 1 \le q' < Q $, and $ \abs{\alpha - p' / q'} < 1 / \rb{Qq'} < 1 / \rb{q'}^2 $. Also $ \abs{\alpha - p' / q'} < 1 / \rb{Qq'} \le 1 / Q < \abs{\alpha - p / q} $, as required. The claim follows.
\end{proof}

We can now show the following.

\begin{theorem}
For any squarefree $ d > 1 $, there is a nontrivial solution $ x, y \ne 0 $ to $ x^2 - dy^2 = 1 $.
\end{theorem}

\begin{proof}
Corollary \ref{cor:66} gives us infinitely many pairs $ \rb{p_i, q_i} $ such that $ p_i, q_i > 0 $ and $ \abs{p_i / q_i - \sqrt{d}} < 1 / q_i^2 $, that is $ \abs{p_i - q_i\sqrt{d}} < 1 / q_i $. Note that then
$$ \abs{p_i + q_i\sqrt{d}} \le \abs{p_i - q_i\sqrt{d}} + 2q_i\sqrt{d} < 1 / q_i + 2q_i\sqrt{d} < 3q_i\sqrt{d}. $$
We thus have
$$ \abs{N\rb{p_i + q_i\sqrt{d}}} = \abs{p_i + q_i\sqrt{d}}\abs{p_i - q_i\sqrt{d}} < \rb{3q_i\sqrt{d}}\rb{1 / q_i} = 3\sqrt{d}. $$
Thus for some $ M $ between $ -3\sqrt{d} $ and $ 3\sqrt{d} $ there are infinitely many pairs $ \rb{p_i, q_i} $ such that $ N\rb{p_i + q_i\sqrt{d}} = M $ for infinitely many $ i $. Since there are finitely many congruence classes modulo $ M $, there is some pair $ \rb{p_0, q_0} $ such that there are infinitely many pairs $ \rb{p_i, q_i} $ with
$$ N\rb{p_i + q_i\sqrt{d}} = M, \qquad p_i \equiv p_0 \mod M, \qquad q_i \equiv q_0 \mod M, $$
for infinitely many $ i $. Now for $ \rb{p_i, q_i} $ and $ \rb{p_j, q_j} $ any two distinct such pairs of this form, that is
$$ N\rb{p_i + q_i\sqrt{d}} = N\rb{p_j + q_j\sqrt{d}} = M, \qquad p_i \equiv p_j \mod M, \qquad q_i \equiv q_j \mod M, $$
consider the quotient
$$ \dfrac{\rb{p_i - q_i\sqrt{d}}}{\rb{p_j + q_j\sqrt{d}}} = \dfrac{\rb{p_i - q_i\sqrt{d}}\rb{p_j + q_j\sqrt{d}}}{M} = \dfrac{\rb{p_ip_j - dq_iq_j} + \rb{p_iq_j - p_jq_i}\sqrt{d}}{M}. $$
The congruence conditions show that $ p_iq_j \equiv p_jq_i \mod M $ and $ p_ip_j - dq_iq_j \equiv p_i^2 - dq_i^2 = M \equiv 0 \mod M $. So $ \rb{p_i - q_i\sqrt{d}} / \rb{p_j - q_j\sqrt{d}} \in \Z\sb{\sqrt{d}} $, and it has norm $ N\rb{\rb{p_i - q_i\sqrt{d}} / \rb{p_j - q_j\sqrt{d}}} = M / M = 1 $ by multiplicativity of the norm, as required.
\end{proof}

\end{document}