notes.xml

<sheaf title="Algebraic Algorithms"
       subtitle="Introductory Number Theory and Abstract Algebra for Computer Science Applications"
       author="Andrei Lapets"
       authorlink="http://lapets.io"
       >
  <section title="Introduction, Background, and Motivation">
    <subsection title="Overview">
      <text><![CDATA[
When many real-world problems are addressed or solved mathematically and computationally, the details of those problems are abstracted away until they can be represented directly as idealized mathematical structures (e.g., numbers, sets, trees, graphs, matrices, and so on). In this course, we will study a collection of such idealized mathematical objects: integers, residues, groups, isomorphisms, and several others. We will see how these structures and their properties can be used for implementing useful computational solutions to problems such as random number generation, prime number generation, error correction, trusted and distributed storage and computation, secure communication, and others.
      ]]></text>
      <paragraph><![CDATA[
In covering the material for this course, we will use the standard language and conventions for discussing these mathematical structures that have been developed by the community of mathematicians over the course of history. You will need to become familiar with these conventions in order to find, identify, and use the structures and techniques that have already been developed for representing and solving certain computational problems. At the same time, we will also learn how modern programming languages and programming paradigms can be used to implement these structures and algorithms both accessibly and efficiently.
      ]]></paragraph>
      <paragraph><![CDATA[
The development and application of mathematics involves <i>abstraction</i>. A problem can be viewed at multiple levels of abstraction, and in developing mathematics humans have adopted a variety of techniques that allow them to successfully employ abstraction to study natural phenomena and solve problems.
      ]]></paragraph>
      <table id="5a30782285aa11e5af63feff819cdc9f"><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>symbolic</b></td>
  <td><b>abstract meaning</b></td>
  <td><b>concrete meaning in<br/>application domain</b></td>
 </tr>
 <tr>
  <td>2 + 3</td>
  <td>5</td>
  <td>five objects</td>
 </tr>
 <tr>
  <td>{(1, 2), (1, 3)}</td> 
  <td>acyclic graph</td>
  <td>file system</td>
 </tr>
 <tr>
  <td>{(1, 2), (2, 3), (3, 1)}</td>
  <td>graph with cycle</td>
  <td>network</td>
 </tr>
 <tr>
  <td>{(0,1), (1,2), (2,0)}</td>
  <td>permutation</td>
  <td>random number sequence</td>
 </tr>
</table>
      ]]></table>
      <text><![CDATA[
The above illustrates the different levels of abstraction that may exist for a given problem. We employ a <i>language</i> of <i>symbols</i> to denote certain abstract structures, which may correspond to actual structures in the world. A string of symbols corresponds to a particular abstract object. Notice that the actual object being modeled and the abstract structure behave the same way, and that this behavior implies certain rules about how we can manipulate the symbols without changing the object that they name. For example, we can represent the same graph using the two strings of symbols "{(1,2), (2,3), (3,1)}" and "{(1,2), (2,3), (3,1)}", or the same number of objects using "2 + 3", "3 + 2", "1 + 4", and so on.
      ]]></text>
      <paragraph><![CDATA[
In this course, we will begin to reviewing the terminology and concepts of logic, integer arithmetic, and set theory, which we will use throughout the course. We will then show that the algebraic properties of the integers also apply to congruence classes of integers (i.e., the properties of modular arithmetic operations), and we will derive and utilize theorems that have useful computer science applications (such as for generating random numbers and creating cryptographic protocols). We will then go further and show that some of the algebraic properties that hold in integer and modular arithmetic can also apply to any data structure, and we will study how to recognize and take advantage of these properties.
      ]]></paragraph>
    </subsection>
    <subsection title="Informal motivating example: random number generation">
      <text hooks="math"><![CDATA[
Let us informally consider the problem of generating a sequence of random positive integers. Random number generators are needed in many situations and applications, including:
<ul>
  <li>generating unique identifiers for database records, objects, etc.;</li>
  <li>generating a one-time pad for a simple encryption scheme;</li>
  <li>generating public and private keys for more sophisticated encryption and signature schemes;</li>
  <li>simulation and approximation methods that employ random sampling (Monte-Carlo, and so on).</li>
</ul>
Different applications will impose different requirements on what is and is not a sufficiently "random" sequence of number. Suppose we adopt the following method:
<ul>
  <li>%n_0 = a number in the range (inclusive) 0 to 5;</li>
  <li>%n_{%i} = (2 \cdot %n_{%i-1} + 1) \mod 6.</li>
</ul>
We can consider another method:
<ul>
  <li>%n_0 = an initial seed integer 10^4 > %n \geq 10^3;</li>
  <li>%n_{%i} = only the last four digits of %n_{%i-1}^2.</li>
</ul>
Frequent repetition of a sequence may or may not be allowed in our given application. Does the above method produce repeating numbers? How often? For how many initial seeds? How do we choose a good seed? We can measure a physical process or component (a clock, a keyboard), but even under these circumstances we need a way to reason about the range of random values the measurement produces, and the range of random values the application requires. How do we begin to approach and formally characterize these aspects of the problem so that we are certain we are meeting the requirements imposed by the application?
      ]]></text>
      <paragraph hooks="math"><![CDATA[
One way to model a random number generation process is to view it is a permutation. In fact, there is more than one way to view the process as a permutation. We could simply count up from 0 to %m and apply the same permutation to each 0 \leq %n \leq %m in order to produce the %nth random number in the sequence. Is there an efficient way (i.e., using no more memory than O(\log %m)) to compute a random number from each %n such that a number never repeats?
      ]]></paragraph>
      <paragraph hooks="math"><![CDATA[
In this course we will learn about a variety of mathematical structures and their properties that will allow us to precisely specify the above problem and others like it, to identify what solutions are appropriate for such a problem, and to implement these solutions correctly and, where necessary, efficiently.
      ]]></paragraph>
    </subsection>
  </section>
  <section title="Review of Logic with Sets, Relations, and Operators">
    <text><![CDATA[
In this section, we will review several abstract structures and associated properties (and the symbolic language used to represent them) that you should have already encountered in past courses. Simultaneously, we will review one way in which these structures can be implemented and manipulated within the modern programming language Python.
    ]]></text>
    <text><![CDATA[
As with most human languages that have developed organically over time, mathematics has a rich and often redundant vocabulary. We introduce many terms in this section that we will use consistently in this course. However, keep in mind that there are often other synonyms within mathematics and computer science for these structures.
    ]]></text>
    <subsection title="Formulas without quantifiers">
      <definition required="true" hooks="math" id="47254608df414ace8d04c630a2b15689">
        <text><![CDATA[
A <i>logical formula</i> or <i>formula</i> is a string of symbols that follow a certain syntax. If the formula is written using a correct syntax, we can ask about its <i>meaning</i> (i.e., is the formula <i>true</i> or <i>false</i>). The symbols <i>or</i>, <i>and</i>, <i>not</i>, <i>implies</i>, and <i>iff</i> are <i>logical operators</i>.
        ]]></text>
        <paragraph><![CDATA[
The basic building blocks (a.k.a., base cases) for formulas are <i>true</i>, <i>false</i>, and <i>predicates</i>. When a formula consists of only one of these (and no operators), it is an <i>atomic formula</i>. Like any formula, each atomic formula has a particular meaning (it is either true or it is false). Atomic formulas can be combined using logical operators to build up larger formulas. The table below provides a way to determine the meaning of a formula by breaking it down into its constituent parts.
        ]]></paragraph>
        <table><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>formula</b></td>
  <td><b>meaning</b></td>
  <td><b>example of one possible<br/>Python representation</b></td>
 </tr>
 <tr> 
  <td>true</td>
  <td>always true</td>
  <td><code>True</code></td>
 </tr>
 <tr> 
  <td>false</td>
  <td>always false</td>
  <td><code>False</code>
  </td>
 </tr>
 <tr>
  <td>%f_1 and %f_2</td>
  <td>only true if both %f_1 and %f_2 are true</td>
  <td><code>True and False</code></td>
 </tr>
 <tr> 
  <td>%f_1 or %f_2</td>
  <td>true if %f_1 or %f_2 (or both) are true</td>
  <td><code>True or (False and True)</code></td>
 </tr>
 <tr> 
  <td>%f_1 implies %f_2</td>
  <td>
    <ul style="margin-left:-22px;">
      <li>if %f_1 is true, then %f_2 must be true</li>
      <li>%f_1 is false, or %f_2 is true</li>
      <li>%f_1 is "less than or equal to" %f_2<br/>(if false is 0 and true is 1)</li>
    </ul>
  </td>
  <td><code>False <= True</code></td>
 </tr>
 <tr> 
  <td>%f_1 iff %f_2</td>
  <td>
    <ul style="margin-left:-22px;">
      <li>%f_1 is true if and only if %f_2 is true</li>
      <li>%f_1 and %f_2 are either<br/>both true or both false</li>
    </ul>
  </td>
  <td><code>True == False</code></td>
 </tr>
 <tr> 
  <td>\neg %f</td>
  <td>true if %f is false</td>
  <td><code>not (True or (False and True))</code></td>
 </tr>
 <tr> 
  <td>( %f )</td>
  <td>true if %f is true</td>
  <td><code>(True and (not (False))</code></td>
 </tr>
 <tr> 
  <td>%[predicate example]%</td>
  <td>depends on the definition<br/>of the predicate</td>
  <td><code>isPrime(7)</code></td>
 </tr>
</table>
        ]]></table>
        <text><![CDATA[
A predicate can have zero or more arguments. Whether a given atomic formula consisting of a predicate that takes at least one argument is true or false depends on the arguments supplied to it. For example, we see above for the predicate <code>isPrime(?)</code> that takes one argument, the meaning of <code>isPrime(7)</code> should be true but the meaning of <code>isPrime(4)</code> should be false.
        ]]></text>
      </definition>
      <text hooks="math"><![CDATA[
The following table may help with gaining a good intuition for the meaning of the <i>implies</i> operator.
      ]]></text>
      <table id="5a30890285aa11e5af63feff819cdc9f" hooks="math"><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>meaning of<br/>left-hand side<br/>(premise)</b></td>
  <td><b>meaning of<br/>right-hand side<br/>(conclusion)</b></td>
  <td><b>meaning of<br/>entire formula</td>
  <td><b>comments</td>
 </tr>
 <tr> 
  <td>true</td>
  <td>true</td>
  <td>true</td>
  <td>if the premise is true and the conclusion<br/>is true, the claim of implication is true;<br/><br/>thus, the whole formula is true</td>
 </tr>
 <tr> 
  <td>true</td>
  <td>false</td>
  <td>false</td>
  <td>if the premise is true but the conclusion is<br/>false, the conclusion is <i>not</i> implied<br/>by the premise, so the 
 claim of implication<br/>is false; thus, the formula is false</td>
 </tr>
 <tr> 
  <td>false</td>
  <td>true</td>
  <td>true</td>
  <td>if the conclusion is true on its own, it doesn't matter<br/>that the premise is false, because <i>anything</i> implies<br/>an 
  independently true conclusion; thus, the claim<br/>of implication is true, and so is the<br/>entire formula</td>
 </tr>
 <tr> 
  <td>false</td>
  <td>false</td>
  <td>true</td>
  <td>if we assume that a false premise is true, then "false"<br/>itself is "true"; in other words, false<br/>implies itself, so 
     the formula is true</td>
 </tr>
</table>
      ]]></table>
      <example required="true" hooks="math" id="0dd54f9ef9a248f4aaa7a99c88e62099">
        <text><![CDATA[
Suppose we have the following formula involving two predicates %[the sun is visible]% and %[it is daytime]%:
\begin{eqnarray}
  %[the sun is visible]% \Rightarrow %[it is daytime]%
\end{eqnarray}
This formula might describe a property of our real-world experience of a person that is in a particular fixed location on the surface of the Earth. We could state that the above formula is <i>always</i> true (i.e., it is always an accurate description of the system it describes). For every possible assignment of values to each variable, the above formula is indeed accurate, in that it is true exactly in those situations that might occur on Earth, and false in any situation that cannot occur:
        ]]></text>
        <table><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>%[the sun is visible]%</b></td>
  <td><b>%[it is daytime]%</b></td>
  <td><b>meaning</b></td>
  <td><b>interpretation</b></td>
 </tr>
 <tr> 
  <td>true</td>
  <td>true</td>
  <td><i>true</i></td>
  <td>a sunny day</td>
 </tr>
 <tr> 
  <td>true</td>
  <td>false</td>
  <td><i>false</i></td>
  <td></td>
 </tr>
 <tr> 
  <td>false</td>
  <td>true</td>
  <td><i>true</i></td>
  <td>a cloudy day</td>
 </tr>
 <tr> 
  <td>false</td>
  <td>false</td>
  <td><i>true</i></td>
  <td>nighttime</td>
 </tr>
</table>
        ]]></table>
        <text><![CDATA[
In particular, only one set of values causes the formula to be false: if the sun is in the sky, but it is not daytime. This is indeed impossible; all the others are possible (it may be day or night, or it may be cloudy during the day). The <i>contrapositive</i> of the formula is true if the formula is true:
\begin{eqnarray}
   \neg(%[it is daytime]%) \Rightarrow \neg(%[the sun is visible]%)
\end{eqnarray}
Notice that the <i>contrapositive</i> of the above is a direct result of the fact that if %[the sun is visible]% \Rightarrow %[it is daytime]% must be true, the rows in the truth table in which it is false must be ignored, and then the only possible row in the truth table in which %[it is daytime]% is false is the one in which %[the sun is visible]% is also false.
        ]]></text>
      </example>
    </subsection>
    <subsection title="Terms: integers and term operators that take integer inputs"> 
      <definition required="true" hooks="math" id="e601deb568ed46a1a1d741907a6dcfa9">
        <text><![CDATA[
A <i>term</i> is a string of symbols that represents some kind of mathematical structure. In our case, terms will initially
represent integers or sets of integers. Terms may contain <i>term operators</i>. We can view these as functions that take
terms as input and return terms as output. The term operators for terms that represent integers with which we will
be working are +, -, \cdot, and mod.
        ]]></text>
        <table><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>term</b></td>
  <td><b>what it represents</b></td>
  <td><b>example of one possible<br/>Python representation</b></td>
 </tr>
 <tr> 
  <td>0</td>
  <td>0</td>
  <td><code>0</code></td>
 </tr>
 <tr> 
  <td>1</td>
  <td>1</td>
  <td><code>1</code></td>
 </tr>
 <tr> 
  <td>%z_1 + %z_2</td>
  <td>the integer sum of %z_1 and %z_2</td>
  <td><code>3 + 4</code>
  </td>
 </tr>
 <tr> 
  <td>%z_1 %- %z_2</td>
  <td>the integer difference of %z_1 and %z_2</td>
  <td><code>(1 + 2) - 4</code>
  </td>
 </tr>
 <tr> 
  <td>%z_1 \cdot %z_2</td>
  <td>the integer product of %z_1 and %z_2</td>
  <td><code>3 * 5</code>
  </td>
 </tr>
 <tr> 
  <td>%z_1 \mod %z_2</td>
  <td>the remainder of the integer quotient %z_1 / %z_2<br/>%z_1 - \lfloor %z_1/%z_2 \rfloor \cdot %z_2</td>
  <td><code>17 % 5</code>
  </td>
 </tr>
 <tr> 
  <td>%z_1^{%z_2}</td>
  <td>product of %z_2 instances of %z_1</td>
  <td><code>2**3</code><br/><code>pow(2,3)</code>
  </td>
 </tr>
</table>
        ]]></table>
      </definition>
    </subsection>
    <subsection title="Formulas: relational operators and predicates dealing with integers">
      <definition required="true" hooks="math" id="db9e874ec6b6475a93bc3ef4db0f2066">
        <text><![CDATA[
A term can only appear in a formula if it is an argument to a <i>predicate</i>. A few common predicates involving integers are
represented using <i>relational operators</i> (e.g, \leq, \geq).
        ]]></text>
        <table><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>formula</b></td>
  <td><b>what it represents</b></td>
  <td><b>example of one possible<br/>Python representation</b></td>
 </tr>
 <tr> 
  <td>%z_1 = %z_2</td>
  <td>true if %z_1 and %z_2<br/>have the same meaning;<br/>false otherwise</td>
  <td><code>1 == 2</code></td>
 </tr>
 <tr> 
  <td>%z_1 < %z_2</td>
  <td>true if %z_1 is less than %z_2;<br/>false otherwise</td>
  <td><code>4 < 3</code></td>
 </tr>
 <tr> 
  <td>%z_1 > %z_2</td>
  <td>true if %z_1 is greater than %z_2;<br/>false otherwise</td>
  <td><code>4 > 3</code></td>
 </tr>
 <tr> 
  <td>%z_1 \leq %z_2</td>
  <td>true if %z_1 is less than or equal to %z_2;<br/>false otherwise</td>
  <td><code>4 <= 3</code></td>
 </tr>
 <tr> 
  <td>%z_1 \geq %z_2</td>
  <td>true if %z_1 is greater than or equal to %z_2;<br/>false otherwise</td>
  <td><code>4 >= 3</code></td>
 </tr>
 <tr> 
  <td>%z_1 \neq %z_2</td>
  <td>true if %z_1 is not equal to %z_2;<br/>false otherwise</td>
  <td><code>4 != 3</code></td>
 </tr>
</table>
        ]]></table>
      </definition>
      <example required="true" hooks="math" id="3c944fff48f246aba9409f76e48ccef4">
        <text><![CDATA[
We can define our own predicates as well. Notice that one way we can represent these in Python is by defining a function that
returns a boolean result.
        ]]></text>
        <table><![CDATA[ 
<table class="fig_table">
 <tr>
  <td><b>predicate definition</b></td>
  <td><b>example of one possible<br/>Python representation</b></td>
 </tr>
 <tr> 
  <td>%P(%x) &nbsp;&nbsp;&nbsp; iff &nbsp;&nbsp;&nbsp; %x > 0 and %x < 2</td>
  <td><code>def P(x): return x > 0 and x < 2</code></td>
 </tr>
 <tr> 
  <td>%Q(%x) &nbsp;&nbsp;&nbsp; iff &nbsp;&nbsp;&nbsp; %x > 3</td>
  <td><code>Q = lambda x: x > 3</code></td>
 </tr>
</table>
        ]]></table>
        <table><![CDATA[ 
<table class="fig_table">
 <tr>
  <td><b>formula</b></td>
  <td><b>what it represents</b></td>
  <td><b>example of one possible<br/>Python representation</b></td>
 </tr>
 <tr> 
  <td>%P(1)</td>
  <td>true</td>
  <td><code>P(1)</code></td>
 </tr>
 <tr> 
  <td>%P(1) or %P(2)</td>
  <td>true</td>
  <td><code>P(1) or P(2)</code>
  </td>
 </tr>
 <tr> 
  <td>%Q(1) and %Q(2)</td>
  <td>false</td>
  <td><code>Q(1) and Q(2)</code>
  </td>
 </tr>
</table>
        ]]></table>
      </example>
      <text hooks="math"><![CDATA[
We will use the following predicates throughout the course.
      ]]></text>
      <definition required="true" hooks="math" id="3f625b68bc8a426c80fe1c774e04c362"><![CDATA[
For any %x,%y \in \Z, %x | %y &nbsp;&nbsp; iff &nbsp;&nbsp;%y/%x \in \Z. If %x | %y, we then say that %x is a <i>factor</i> of %y.
      ]]></definition>
      <definition required="true" hooks="math" id="2c7cc0e69813454eafc7128e5ac57055"><![CDATA[
For any %y \in \Z, %y is prime &nbsp;&nbsp; iff &nbsp;&nbsp; for any integer %x where 2 \leq %x < %y, it is not true that %x | %y. In other words, %y is prime if its only factors are 1 and %y (itself).
      ]]></definition>
      <table id="5a307cd285aa11e5af63feff819cdc9f" hooks="math"><![CDATA[  
<table class="fig_table">
 <tr>
  <td><b>formula</b></td>
  <td><b>what it represents</b></td>
 </tr>
 <tr> 
  <td>%x | %y</td>
  <td>
    <ul style="margin-left:-22px;">
      <li>%y / %x \in \Z</li>
      <li>%x divides %y</li>
      <li>%y is divisible by %x</li>
      <li>%y is an integer multiple of %x</li>
      <li>%y \mod %x = 0</li>
      <li>%x is a factor of %y</li>
    </ul>
  </td>
 </tr>
 <tr> 
  <td>%y is prime</td>
  <td>
    <ul style="margin-left:-22px;">
      <li>%y > 1 and<br/>%x | %y implies %x = 1 or %x = %y</li>
      <li>%y > 1 and<br/>%y is divisible only by 1 and itself</li>
    </ul>
  </td>
 </tr>
</table>
      ]]></table>
      <example required="true" id="78a1e0ed892346a396f55cd665904b0d">
        <text hooks="math"><![CDATA[
We can define the divisibility and primality predicates in Python in the following way:
        ]]></text>
        <code class="py"><![CDATA[
def divides(x, y):
    return y % x == 0   # The remainder of y/x is 0.

def prime(y):
    for x in range(2,y):
        if divides(x,y):
            return False
    return True
        ]]></code>
      </example>
      <example required="true" id="1231e0ed892346a396f55cd665904b0d">
        <text hooks="math"><![CDATA[
We can gradually generalize our primality predicate from the <a href="#78a1e0ed892346a396f55cd665904b0d">previous example</a> to work for any other predicate. Note that we restate the property slightly: a number is prime if no smaller number can divide it evenly, so if we ever find one that doesn't satisfy this property, we immediately return <code>False</code>. This is effectively the implementation of a <i>quantifier</i>, which we <a href="#2cd418f2876c42d59a57e34bd6288f22">introduce</a> further below.
        ]]></text>
        <code class="py"><![CDATA[
def doesNotDivide(x, y):
    return y % x != 0   # The remainder of y/x is nonzero.

def prime(y):
    for x in range(2,y):
        if not doesNotDivide(x,y):
            return False
    return True

def checkAll(S, P):
    for x in S:
        if not P(x):
            return False
    return True
        ]]></code>
        <text hooks="math"><![CDATA[
Given the above, it is now possible to get the same behavior provided by <code>prime()</code> by supplying appropriate arguments:
        ]]></text>
        <code class="py"><![CDATA[
>>> checkAll(set(range(2,y)), lambda x: doesNotDivide(x,y))
        ]]></code>
      </example>
      <definition required="true" hooks="math" id="cdf2df96b7924749a37bcbc2f4415180"><![CDATA[
For any %x,%y \in \Z, %x is a <i>proper factor</i> of %y &nbsp;&nbsp; iff &nbsp;&nbsp; %y/%x \in \Z and %x < %y.
      ]]></definition>
    </subsection>
    <subsection title="Terms: finite sets of integers, term operators that take set inputs, and set comprehensions">
      <definition required="true" hooks="math" id="8c1203dd65bb49868abc64ad5353725f">
        <text><![CDATA[
A finite set of integers is an unordered, finite collection of zero or more integers with no duplicates. The following are examples of terms the meaning of which is a finite set of integers (with the exception of the set size terms, the meaning of
which is a positive integer).
        ]]></text>
        <table><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>term</b></td>
  <td><b>what it represents</b></td>
  <td><b>example of one possible<br/>Python representation</b></td>
 </tr>
 <tr> 
  <td>\emptyset</td>
  <td>a set with no elements in it</td>
  <td><code>set()</code></td>
 </tr>
 <tr> 
  <td>{1,2,3}</td>
  <td>{1,2,3}</td>
  <td><code>{1,2,3}</code></td>
 </tr>
 <tr> 
  <td>{2,..,5}</td>
  <td>{2,3,4,5}</td>
  <td><code>set(range(2,6))</code></td>
 </tr>
 <tr>
  <td>{ %x | %x \in {1,2,3,4,5,6}, %x > 3 }</td>
  <td>{4,5,6}</td>
  <td><code>{x for x in {1,2,3,4,5,6} if x > 3}</code>
  </td>
 </tr>
 <tr> 
  <td>|{1,2,3,4}|</td>
  <td>4</td>
  <td><code>len({1,2,3,4})</code>
  </td>
 </tr>
</table>
        ]]></table>
        <text><![CDATA[
The following are term operators on terms the meaning of which is a finite set of integers.
        ]]></text>
        <table><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>term</b></td>
  <td><b>what it represents</b></td>
  <td><b>example of one possible<br/>Python representation</b></td>
 </tr>
 <tr> 
  <td>%S_1 \cup %S_2</td>
  <td>{%z | %z \in \Z, %z \in %S_1 or %z \in %S_2}</td>
  <td><code>{1,2,3}.union({4,5})</code><br/><code>{1,2,3} | {4,5}</code></td>
 </tr>
 <tr> 
  <td>%S_1 \cap %S_2</td>
  <td>{%z | %z \in \Z, %z \in %S_1 and %z \in %S_2}</td>
  <td><code>{1,2,3}.intersection({2,3,5})</code><br/><code>{1,2,3} &amp; {2,3,5}</code></td>
 </tr>
 <tr> 
  <td>|%S|</td>
  <td>the number of elements in %S</td>
  <td><code>len({1,2,3})</code></td>
 </tr>
</table>
        ]]></table>
      </definition>
      <text><![CDATA[
While the terms below do not represent <i>finite</i> sets of integers, we introduce the following two set terms in order to reference them throughout the notes.
      ]]></text>
      <definition required="true" id="19dc317f45ec4ae18018ca5b17fce114">
        <text hooks="math"><![CDATA[
Let \Z be the set of all integers, and let \N be the set of all non-negative integers (i.e., positive integers and 0).
        ]]></text>
        <table id="5a3081a085aa11e5af63feff819cdc9f" hooks="math"><![CDATA[
  <table class="fig_table">
   <tr>
    <td><b>term</b></td>
    <td><b>what it represents</b></td>
   </tr>
   <tr> 
    <td>\N</td>
    <td>{0, 1, 2, ...}</td>
   </tr>
   <tr> 
    <td>\Z</td>
    <td>{..., -2, -1, 0, 1, 2, ...}</td>
   </tr>
  </table>
        ]]></table>
      </definition>
    </subsection>
    <subsection title="Formulas: quantifiers over finite sets of integers">
      <definition required="true" id="2cd418f2876c42d59a57e34bd6288f22">
        <text hooks="math"><![CDATA[
Suppose we define the following two Python functions that take predicates (or, more specifically, functions that represent predicates) as input.
        ]]></text>
        <code class="py"><![CDATA[
def forall(S, P):
    for x in S:
        if not P(x):
            return False
    return True

def exists(S, P):
    for x in S:
        if P(x):
            return True
    return False
        ]]></code>
        <text hooks="math"><![CDATA[
We could redefine the above using comprehensions. We will also introduce a <code>subset()</code> operation on sets.
        ]]></text>
        <code class="py"><![CDATA[
def forall(X, P):
  S = {x for x in X if P(x)}
  return len(S) == len(X)

def exists(X, P):
  S = {x for x in X if P(x)}
  return len(S) > 0

def subset(X,Y):
  return forall(X, lambda x: x in Y)
        ]]></code>
        <text hooks="math"><![CDATA[
Then we can introduce the following definitions and corresponding Python examples.
        ]]></text>
        <table hooks="math"><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>formula</b></td>
  <td><b>what it represents</b></td>
  <td><b>example of one possible<br/>Python representation</b></td>
 </tr>
 <tr> 
  <td>1 \in {1,2,3}</td>
  <td>true</td>
  <td><code>1 in {1,2,3}</code></td>
 </tr>
 <tr> 
  <td>4 \in {1,2,3}</td>
  <td>false</td>
  <td><code>4 in {1,2,3}</code></td>
 </tr>
 <tr> 
  <td>\forall %x \in {1,2,3}, %x > 0 and %x < 4</td>
  <td>true</td>
  <td><code>forall({1,2,3}, lambda x: x > 0 and x < 4)</code></td>
 </tr>
 <tr> 
  <td>\exists %x \in {1,2,3}, %x < 1 and %x > 3</td>
  <td>false</td>
  <td><code>exists({1,2,3}, lambda x: x < 1 or x > 3)</code></td>
 </tr>
 <tr> 
  <td>\forall %x \in \emptyset, %f</td>
  <td>true</td>
  <td></td>
 </tr>
 <tr> 
  <td>\exists %x \in \emptyset, %f</td>
  <td>false</td>
  <td></td>
 </tr>
</table>
        ]]></table>
      </definition>
      <text hooks="math"><![CDATA[
Notice that when we quantify over an empty set with a universal quantifier \forall, the formula is always true. When we quantify over an empty set
with an existential quantifier, the formula is always false (since no element satisfying any formula could exist if no elements exist at all). We can see that the Python
functions for these quantifiers are consistent with this interpretation.
      ]]></text>
      <fact required="true" hooks="math" id="3cd40be053794f17b638f78d66b7c7aa"><![CDATA[
Let %X = {%x_1 , ..., %x_{%n}} be a finite set and let %P be a predicate that applies to a single integer argument. Then we have the following correspondences between quantifiers and logical operators:
\begin{eqnarray}
  \forall %x \in %X, %P(%x) %~ & iff & %~ %P(%x_1) and %P(%x_2) and %P(%x_3) and ... and %P(%x_{%n}) \\
  \exists %x \in %X, %P(%x) %~ & iff & %~ %P(%x_1) or %P(%x_2) or %P(%x_3) or ... or %P(%x_{%n})
\end{eqnarray}
Notice that if %X is empty, the "base case" for \forall must be true (since that is the identity of the <b>and</b> logical operator), while the "base case" for \exists must be false (since that is the identity of the <b>or</b> logical operator).
      ]]></fact>
      <exercise required="true" id="5917f6f5de7c46079190f4b6c4961ca3">
        <text hooks="math"><![CDATA[
Implement Python functions that correspond to formulas which can be used to define each of the following statements about
a set %X and a predicate %P.
        ]]></text>
        <unorderedlist>
          <item>
            <text hooks="math"><![CDATA[All the elements of a set %X satisfy the predicate %P.]]></text>
            <code class="py"><![CDATA[
# We provide two equivalent implementations.
            
def all(X, P):
    return  forall(X, P)
    
def all(X, P):
  S = {x for x in X if P(x)}
  return len(S) == len(X)
            ]]></code>
          </item>
          <item>
            <text hooks="math"><![CDATA[None of the elements of a set %X satisfy the predicate %P.]]></text>
            <code class="py"><![CDATA[
# We provide two equivalent implementations.

def none(X, P):
    return  forall(X, lambda x: not P(x))
    
def none(X, P):
  S = {x for x in X if P(x)}
  return len(S) == 0
            ]]></code>
          </item>
          <item>
            <text hooks="math"><![CDATA[At most one of the elements of a set %X satisfy the predicate %P.]]></text>
            <code class="py"><![CDATA[
def atMostOne(X, P):
  S = {x for x in X if P(x)}
  return len(S) <= 1
            ]]></code>
          </item>
          <item>
            <text hooks="math"><![CDATA[At least one of the elements of a set %X satisfy the predicate %P.]]></text>
            <code class="py"><![CDATA[
# We provide two equivalent implementations.

def atLeastOne(X, P):
  return exists(X, P)

def atLeastOne(X, P):
  S = {x for x in X if P(x)}
  return len(S) >= 1
            ]]></code>
          </item>
        </unorderedlist>
      </exercise>
      <exercise required="true" id="69acaf35c3e74e6593beb864d3f3ea6f">
        <text hooks="math"><![CDATA[
Use quantifiers to implement a Python function corresponding to the predicate %[%p is prime]% for any integer %p.
        ]]></text>
        <code class="py"><![CDATA[
def prime(p):
    return  p > 1 and forall(set(range(2, p)), lambda n: p % n != 0)
        ]]></code>
      </exercise>
    </subsection>
    <subsection title="Formulas: predicates dealing with finite sets of integers">
      <definition required="true" hooks="math" id="a53c6952efd64145a6fa15dd570b1d24">
        <text><![CDATA[
The following are examples of formulas that contain relational operators dealing with finite sets of integers.
        ]]></text>
        <table><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>formula</b></td>
  <td><b>what it represents</b></td>
  <td><b>example of one possible<br/>Python representation</b></td>
 </tr>
 <tr> 
  <td>3 \in {1,2,3}</td>
  <td>true</td>
  <td><code>3 in {1,2,3}</code></td>
 </tr>
 <tr> 
  <td>{1,2} \subset {1,2,3}</td>
  <td>true</td>
  <td><code>subset({1,2}, {1,2,3})</code></td>
 </tr>
 <tr> 
  <td>{4,5} \subset {1,2,3}</td>
  <td>false</td>
  <td><code>subset({4,5}, {1,2,3})</code></td>
 </tr>
</table>
        ]]></table>
        <text><![CDATA[
Below are the general forms of formulas containing relational operators dealing with finite sets of integers.
        ]]></text>
        <table><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>formula</b></td>
  <td><b>what it represents</b></td>
 </tr>
 <tr> 
  <td>%z \in %S</td>
  <td>true if %z is an element of %S; false otherwise</td>
 </tr>
 <tr> 
  <td>%S_1 \subset %S_2</td>
  <td>\forall %z \in %S_1, %z \in %S_2</td>
 </tr>
 <tr> 
  <td>%S_1 = %S_2</td>
  <td>%S_1 \subset %S_2 and %S_2 \subset %S_1</td>
 </tr>
</table>
        ]]></table>
      </definition>
    </subsection>
    <subsection title="Terms: set products and binary relations">
      <definition required="true" hooks="math" id="95e72ad05e66427281549720c9ed975f"><![CDATA[
The product of two sets %X and %Y is denoted %X \times %Y and is defined to be the set of <i>ordered</i> pairs
(%x,%y) for every possible combination of %x \in %X and %y \in %Y.
      ]]></definition>
      <example required="true" hooks="math" id="6d31feaec48d48938ca705b2d75ab946">
        <table><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>term</b></td>
  <td><b>what it represents</b></td>
  <td><b>example of one possible<br/>Python representation</b></td>
 </tr>
 <tr> 
  <td>{1,2} \times {5,6,7}</td>
  <td>{(1,5),(1,6),(1,7),(2,5),(2,6),(2,7)}</td>
  <td><code>{ (x,y) for x in {1,2} for y in {4,5,6,7} }</code></td>
 </tr>
</table>
        ]]></table>
      </example>
      <definition required="true" hooks="math" id="95e72ad05e66427281549720c9ed875f"><![CDATA[
A set %R is a <i>relation</i> between the sets %X and %Y if %R \subset %X \times %Y. We also say that a set %R is a relation on a set %X if %R \subset %X \times %X.
      ]]></definition>
      <example required="true" hooks="math" id="95dff10354af483da4f3aad312b46d5c"><![CDATA[
Suppose we have the sets %X = {@a, @b, @c} and %Y = {@D, @E, @F}. Then one possible relation between %X and %Y is {(@a, @D), (@c, @E)}. One possible relation on %X is {(@a, @a), (@a, @b), (@a, @c), (@b, @b), (@c, @a)}. 
      ]]></example>
    </subsection>
    <subsection title="Formulas: predicates dealing with relations">
      <text hooks="math"><![CDATA[
There are several common properties that relations may possess.
      ]]></text>
      <table id="5a30863285aa11e5af63feff819cdc9f" hooks="math"><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>predicate</b></td>
  <td><b>definition</b></td>
  <td><b>visual example</b></td>
 </tr>
 <tr>
  <td style="background-color:#F6F4D8;">%X \times %Y is the set product of %X and %Y</td>
  <td style="background-color:#F6F4D8;">%X \times %Y = { (%x,%y) | %x \in %X, %y \in %Y }</td>
  <td><div class="pql" style="height:160px; width:200px;">!relation({'a','b','c'}, {'x','y','z'}, {('a','x'),('a','y'),('a','z'),('b','x'),('b','y'),('b','z'),('c','x'),('c','y'),('c','z')})</div></td>
 </tr>
 <tr>
  <td style="background-color:#F6F4D8;">%R is a relation between %X and %Y</td>
  <td style="background-color:#F6F4D8;">%R \subset %X \times %Y</td>
  <td><div class="pql" style="height:160px; width:200px;">!relation({'a','b','c'}, {'x','y','z'}, {('a','x'),('b','x'),('b','z'),('c','z')})</div></td>
 </tr>
 <tr>
  <td>%R is a function from %X to %Y<br/>%R is a (many-to-one) map from %X to %Y</td>
  <td>
    %R is a relation between %X and %Y and<br/>
    \forall %x \in %X,<br/>
    &nbsp;&nbsp;&nbsp; there is at most one<br/>
    &nbsp;&nbsp;&nbsp; %y \in %Y s.t. (%x,%y) \in %R
  </td>
  <td><div class="pql" style="height:160px; width:200px;">!relation({'a','b','c'}, {'x','y','z'}, {('a','x'),('b','x'),('c','z')})</div></td>
 </tr>
 <tr>
  <td>%R is an injection from %X to %Y</td>
  <td>
  %R is a function from %X to %Y and<br/>
    \forall %y \in %Y,<br/>
    &nbsp;&nbsp;&nbsp; there is at most one<br/>
    &nbsp;&nbsp;&nbsp; %x \in %X s.t. (%x,%y) \in %R
  </td>
  <td><div class="pql" style="height:160px; width:200px;">!relation({'a','b','c'}, {'x','y','z'}, {('a','x'),('b','y')})</div></td>
 </tr>
 <tr>
  <td>%R is a surjection from %X to %Y</td>
  <td>
  %R is a function from %X to %Y and<br/>
    \forall %y \in %Y,<br/>
    &nbsp;&nbsp;&nbsp; there is at least one<br/>
    &nbsp;&nbsp;&nbsp; %x \in %X s.t. (%x,%y) \in %R
  </td>
  <td><div class="pql" style="height:160px; width:200px;">!relation({'a','b','c','d'}, {'x','y','z'}, {('a','x'),('c','y'),('d','z')})</div></td>
 </tr>
 <tr>
  <td style="background-color:#F6F4D8;">%R is a bijection between %X and %Y</td>
  <td style="background-color:#F6F4D8;">%R is an injection from %X and %Y and<br/>%R is a surjection from %X and %Y</td>
  <td><div class="pql" style="height:160px; width:200px;">!relation({'a','b','c'}, {'x','y','z'}, {('a','y'),('b','z'),('c','x')})</div></td>
 </tr>
 <tr>
  <td style="background-color:#F6F4D8;">%R is a permutation on %X</td>
  <td style="background-color:#F6F4D8;">
  %R \subset %X \times %X and<br/>
      %R is a bijection between %X and %X
  </td>
  <td><div class="pql" style="height:160px; width:200px;">!relation({'a','b','c'}, {('a','b'),('b','c'),('c','a')})</div></td>
 </tr>
 <tr>
  <td style="background-color:#F6F4D8;">%R is a reflexive relation on %X</td>
  <td style="background-color:#F6F4D8;">%R \subset %X \times %X and<br/>\forall %x \in %X, (%x,%x) \in %R </td>
  <td><div class="pql" style="height:160px; width:200px;">!relation({'a','b','c'}, {('a','a'),('b','b'),('c','c')})</div></td>
 </tr>
 <tr>
  <td style="background-color:#F6F4D8;">%R is a symmetric relation on %X</td>
  <td style="background-color:#F6F4D8;">%R \subset %X \times %X and<br/>\forall %x \in %X, \forall %y \in %X, (%x,%y) \in %R implies (%y,%x) \in %R</td>
  <td><div class="pql" style="height:160px; width:200px;">!relation({'a','b','c'}, {('a','b'),('b','a'),('c','c')})</div></td>
 </tr>
 <tr>
  <td style="background-color:#F6F4D8;">%R is a transitive relation on %X</td>
  <td style="background-color:#F6F4D8;">%R \subset %X \times %X and<br/>
      \forall %x \in %X, \forall %y \in %X, \forall %z \in %X,<br/>
      &nbsp;&nbsp;&nbsp;((%x,%y) \in %R and (%y,%z) \in %R) implies (%x,%z) \in %R
  </td>
  <td><div class="pql" style="height:160px; width:200px;">!relation({'a','b','c'}, {('a','b'),('b','c'),('a','c')})</div></td>
 </tr>
 <tr>
  <td style="background-color:#F6F4D8;">%R is an equivalence relation on %X<br/>%R is a congruence relation on %X</td>
  <td style="background-color:#F6F4D8;">%R \subset %X \times %X and<br/>
      %R is a reflexive relation on %X and<br/>
      %R is a symmetric relation on %X and<br/>
      %R is a transitive relation on %X
  </td>
  <td><div class="pql" style="height:160px; width:200px;">!relation({'a','b','c'}, {('a','a'),('b','b'),('a','b'),('b','a'),('c','c')})</div></td>
 </tr>
</table>
      ]]></table>
<!--

We introduce several terms that deal with the relationship between the relation and the members and subsets of the two sets that the relation involves.

<table class="fig_table">
 <tr>
  <td><b>predicate</b></td>
  <td><b>required conditions</b></td>
 </tr>
 <tr>
  <td>%X is the domain of %R between %X and %Y</td>
  <td>%R is a function from %X to %Y</td>
 </tr>
 <tr>
  <td>%Y is the codomain of %R between %X and %Y</td>
  <td>%R is a function from %X to %Y</td>
 </tr>
 <tr>
  <td>%B is the image of %R between %X and %Y</td>
  <td>%R is a function from %X to %Y and<br/>
      %B = {%y | %x \in %X, (%x',%y) \in %R, %x = %x'}</td>
 </tr>
 <tr>
  <td>%B is the image of %x under %R between %X and %Y</td>
  <td>%R is a function from %X to %Y and<br/>
      %B = {%y | (%x,%y) \in %R}</td>
 </tr>
 <tr>
  <td>%A is the pre-image of %y under %R between %X and %Y</td>
  <td>%R is a function from %X to %Y and<br/>
      %A = {%x | (%x,%y) \in %R}</td>
 </tr>
</table>
<br/><br/>
<b>Exercise:</b> Implement Python functions that correspond to each of the structures above.
-->
      <exercise required="true" id="5aa3dc1edbed4422b77ac051dff6f3b2">
        <text hooks="math"><![CDATA[
Define the set of all even numbers between 0 and 100 (inclusive). There are at least two ways we can do this:
        ]]></text>
        <code class="py"><![CDATA[
evens = { 2 * x for x in set(range(0,51)) }
evens = { x for x in set(range(0,101)) if x % 2 == 0 }
        ]]></code>
      </exercise>
      <exercise required="true" id="3bd4848251cb47c98a603e19d5beea64">
        <text hooks="math"><![CDATA[
Implement a Python function that computes the set product of two sets <code>X</code> and <code>Y</code>.
        ]]></text>
        <code class="py"><![CDATA[
def product(X, Y):
  return { (x,y) for x in X for y in Y }
        ]]></code>
      </exercise>
      <exercise required="true" id="06bf17302b314e80837ad892aca57106">
        <text hooks="math"><![CDATA[
Implement a Python function that takes a finite set of integers and builds the relation on that set correspondingto the operator relational operator \leq.
        ]]></text>
        <code class="py"><![CDATA[
def leq(S):
  return { (x, y) for x in S for y in S if x <= y }
        ]]></code>
      </exercise>
      <exercise required="true" id="46859e4a64eb47eba16fd09822382e83">
        <text hooks="math"><![CDATA[
Implement a Python function that determines whether a relation <code>R</code> is a relation over a set <code>X</code>.
        ]]></text>
        <code class="py"><![CDATA[
# Using our definition of subset().
def relation(R, X):
  return subset(R, product(X, X))

# Using the built-in set implementation.
def relation(R, X):
  return R.issubset(product(X, X))
        ]]></code>
      </exercise>
      <exercise required="true" id="79e0f3993b2e409f95882713c4ad5f5b">
        <text hooks="math"><![CDATA[
One property of relations that is studied in other subject areas within computer science and mathematics is <i>asymmetry</i>. We say that %R is an asymmetric relation on a set %X if:
\begin{eqnarray}
\forall %x \in %X, \forall %y \in %X, (%x,%y) \in %R implies \neg((%y,%x) \in %R)</td>
\end{eqnarray}
One example of an asymmetric relation is the "less than" relation on integers, usually represented using the < relational operator. How can we write a Python function that takes as its input a relation <code>R</code> and a set <code>X</code> and determines whether that relation is asymmetric? Recall that we can represent the implication logical operator using the Python operator <code><=</code>.
        ]]></text>
        <code class="py"><![CDATA[
def isAsymmetric(X, R):
  return relation(R,X) and forall(X, lambda a: forall(X, lambda b: ((a,b) in R) <= (not ((b,a) in R))))
        ]]></code>
      </exercise>
    </subsection>
    <subsection title="Terms: set quotients and quotient maps">
      <text hooks="math"><![CDATA[
Given an equivalence relation on a set, we can partition that set into a collection of distinct subsets, called <i>equivalence classes</i>,
such that all the elements of each subset are equivalent to one another.
      ]]></text>
      <definition required="true" hooks="math" id="da8dad0b97484112b92dbd03c35cd437"><![CDATA[
For any set %X and equivalence relation %R on %X, let the quotient set of %X with respect to %R, denoted %X/%R, be defined as:
\begin{eqnarray}
 %X/%R & = & {{%y | %y \in %X, (%x,%y) \in %R} | %x \in %X}
\end{eqnarray}
      ]]></definition>
      <exercise required="true" id="4c9bacdb892845aab62a3c1b656f4c20">
        <text hooks="math"><![CDATA[
Implement a Python function that takes two inputs (a set %X and an equivalence relation %R on that set), and outputs the
quotient set %X/%R.
        ]]></text>
        <code class="py"><![CDATA[
def quotient(X,R):
    return {frozenset({y for y in X if (x,y) in R}) for x in X}
        ]]></code>
        <text hooks="math"><![CDATA[
Below, we evaluate the above function on an example input.
        ]]></text>  
        <code class="py"><![CDATA[
>>> quotient({1,2,3,4}, {(1,1),(2,2),(3,3),(2,3),(3,2),(4,4)})

{frozenset({4}), frozenset({2, 3}), frozenset({1})}
        ]]></code>
      </exercise>
      <definition required="true" hooks="math" id="716e6323dee9472ba28e91ef44eebf02"><![CDATA[
For a set %X and a relation %R over %X, the relation that relates each %x \in %X to its equivalence class in %X under %R is called
the <i>quotient map</i>. The function is typically denoted using [ ... ]. That is, [%x] is the equivalence class of %x under %R.
      ]]></definition>
      <exercise required="true" id="12e3abaa27f24efcb6ab284d0cf6a00a">
        <text hooks="math"><![CDATA[
Implement a Python function that takes two inputs (a set %X and an equivalence relation %R on that set), and outputs the
quotient map taking each element %x \in %X to its corresponding equivalence class [%x] \in %X/%R.
        ]]></text>  
        <code class="py"><![CDATA[
def quotientMap(X,R):
  return {(x, frozenset({y for y in X if (x,y) in R})) for x in X}
        ]]></code>
      </exercise>
      <exercise required="true" hooks="math" id="252d2fdc848f4fa7936c3a48e9795289">
        <text><![CDATA[
Determine whether {(%x,%y) | %x \in \Z, %y \in \Z, (%x + %y) \mod 2 = 0} is an equivalence relation.
        ]]></text>
        <solution><![CDATA[
It is reflexive because any integer plus itself must be even (the sum of two odd numbers is even, and the sum of two even numbers is even).
Because of commutativity of addition, the relation is symmetric. Finally, it is transitive because if %x + %y is even and %y + %z is even, then %x and %z must either both be even, or they must both be odd, so %x + %z must be even, as well. Thus, the relation is reflexive, symmetric, and transitive, so it is an equivalence relation.
        ]]></solution>
      </exercise>
      <example required="true" id="9be77fde95e94608ab887451faa3b74b">
        <text hooks="math"><![CDATA[
Let %X be a set of humans. Let %R be the following relation %R \subset %X \times %X:
\begin{eqnarray}
 %R & = & { (%x, %y) | %x \in %X, %y \in %X, %x is %y or %x is a relative of %y }
\end{eqnarray}
Then %R is an equivalence relation (we assume everyone is related to themselves, and that if two people are both related to the same person, then they are themselves related). Furthermore, the quotient set %X/%R is a separation of the humans in %X into families of relatives. No one in any equivalence class (a.k.a., a family) in %X/%R is related to anyone in any other equivalence class, and everyone in each equivalence class in %X/%R is related to everyone else in that equivalence class. Thus, |%X/%R| is the number of distinct families of humans in the set %X.
        ]]></text>
        <paragraph hooks="math"><![CDATA[
More generally, we can view the quotient set %X/%R as the separation of %X into as many groups as possible such that no two relatives are separated into separate groups. We can illustrate this with a Python example. Suppose we have the following relation on the set <code>{'Alice', 'Bob', 'Carl', 'Dan', and 'Eve'}</code>:
        ]]></paragraph>
        <code class="py"><![CDATA[
R = {\
     ('Alice', 'Alice'), ('Bob', 'Bob'), ('Carl', 'Carl'), ('Dan', 'Dan'), ('Eve', 'Eve'),\
     ('Alice', 'Carl'), ('Carl', 'Alice'), ('Dan', 'Eve'), ('Eve', 'Dan')\
    }
        ]]></code>
        <text hooks="math"><![CDATA[
We can then compute the set of families:
        ]]></text>
        <code class="py"><![CDATA[
families = quotient({'Alice', 'Bob', 'Carl', 'Dan', 'Eve'}, R)
        ]]></code>
        <text hooks="math"><![CDATA[
A visualization might look as follows:
        ]]></text>
        <text><![CDATA[
        <br/>
<div class="pql" style="border:1px solid #7F7F7F; height:200px; display:inline-block; width:100%;">#graph({'Alice','Carl','Bob','Dan','Eve'}, {('Alice','Alice'),('Bob','Bob'),('Carl','Carl'),('Dan','Dan'),('Eve','Eve'),('Alice','Carl'),('Carl','Alice'),('Dan', 'Eve'), ('Eve', 'Dan')})</div>
        ]]></text>
      </example>
    </subsection>
    <!--include sheaf="assignment-one.xml"/-->
  </section>
  <section title="Modular Arithmetic">
    <text><![CDATA[
Modular arithmetic can be viewed as a variant of integer arithmetic in which we introduce a congruence (or equivalence) relation on the integers and redefine the integer term operators so that they are defined on these congruence (or equivalence) classes.
    ]]></text>
    <subsection title="Terms: congruence classes in &#8484;/&lt;i&gt;m&lt;/i&gt;&#8484;, term operators, and relations">
      <definition required="true" hooks="math" id="8854da3617884771b82ceb3064037466"><![CDATA[
For any %m \in \Z, define:
\begin{eqnarray}
 %m\Z & = & {%x \cdot %m | %x \in \Z}
\end{eqnarray}
      ]]></definition>
      <definition required="true" hooks="math" id="bfc4251f5c294e258da60cd499fe9632"><![CDATA[
For any %k \in \Z and %m \in \Z, we define the <i>congruence class</i> %k + %m\Z below:
\begin{eqnarray}
 %k + %m\Z & = & {%k + (%x \cdot %m)  | %x \in \Z}
\end{eqnarray}
The word <i>congruence</i> is a synonym for <i>equivalence</i>; in the <a href="#454e045906a8494e81b1c47ca89f6c26">next definition below</a>, each congruence class %k + %m\Z is an equivalence class in a particular quotient set in which numbers are grouped by the remainder %k that they have when divided by the chosen modulus %m.
      ]]></definition>
      <exercise required="true" hooks="math" id="292fadafed89488990a2f03c7d8fb0ff"><![CDATA[
Show that the relation %R = {(%x,%y) | %x \in \Z, %y \in \Z, %x \mod 17 = %y \mod 17} is an equivalence relation.
      ]]></exercise>
      <definition required="true" hooks="math" id="454e045906a8494e81b1c47ca89f6c26"><![CDATA[
For any given %m \in \Z, we define the set of all congruence classes modulo %m:
\begin{eqnarray}
 \Z/%m\Z & = & \Z/{(%x,%y) | %x \in \Z, %y \in \Z, %x \mod %m = %y \mod %m}
\end{eqnarray}
In English, we can read the notation \Z/%m\Z as "\Z modulo %m" or simply "\Z mod %m".
      ]]></definition>
      <example required="true" hooks="math" id="d42bee0a337a4892b4d62e9eab9d2bed"><![CDATA[
How do we determine whether 7 \in 2 + 5\Z is a true formula? We can expand the notation 2 + 5\Z into its definition:
\begin{eqnarray}
 7 & \in & 2 + 5\Z \\
 7 & \in & { 2 + 5 \cdot %z | %z \in \Z }
\end{eqnarray}
Thus, if 7 is in the set of elements of the form 2 + 5 \cdot %z, then we must be able to solve the following equation on <b><i>integers</i></b> for %z:
\begin{eqnarray}
 7 & = & 2 + 5 \cdot %z \\
 5 & = & 5 \cdot %z \\
 1 & = & %z
\end{eqnarray}
Since we can solve for %z, it is true that 7 \in 2 + 5\Z.
      ]]></example>
      <text hooks="math"><![CDATA[
      Informally and intuitively, we could think of the structure of the above set as a logical consequence of letting all multiples of %m be equivalent to 0.
That is, if 0 = %m = 2%m = ..., then 1 = %m + 1 = 2%m + 1 = ..., and so on.
      ]]></text>
      <table id="5a30877285aa11e5af63feff819cdc9f" hooks="math"><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>term</b></td>
  <td><b>what it represents</b></td>
 </tr>
 <tr>
  <td>%z<br/>%z \mod %m<br/>%z + %m\Z</td>
  <td>{%z + (%a \cdot %m) | %a \in \Z}</td>
 </tr>
 <tr>
  <td>%c_1 + %c_2</td>
  <td>{(%x + %y) | %x \in %c_1, %y \in %c_2}</td>
 </tr>
 <tr>
  <td>%c_1 %- %c_2</td>
  <td>{(%x %- %y) | %x \in %c_1, %y \in %c_2}</td>
 </tr>
 <tr>
  <td>%c_1 \cdot %c_2</td>
  <td>{(%x \cdot %y) | %x \in %c_1, %y \in %c_2}</td>
 </tr>
 <tr>
  <td>%c^{%z}</td>
  <td>%c \cdot ... \cdot %c</td>
 </tr>
 <tr>
  <td>%c!</td>
  <td>%c \cdot (%c-1) \cdot (%c-2) \cdot ... \cdot 1</td>
 </tr>
</table>
      ]]></table>
      <table id="5a307e4e85aa11e5af63feff819cdc9f" hooks="math"><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>formula</b></td>
  <td><b>what it represents</b></td>
 </tr>
 <tr> 
  <td>%c_1 \equiv %c_2</td>
  <td>true only if %c_1 \subset %c_2 and %c_2 \subset %c_1, i.e., set equality<br/>applied to the congruence classes %c_1 and %c_2;<br/>false otherwise</td>
 </tr>
</table>
      ]]></table>
    </subsection>   
    <subsection title="Algebra of congruence classes">
      <paragraph hooks="math"><![CDATA[
We use the familiar symbols +, -, \cdot, and 0, 1, 2, 3, 4, ... to represent operations on congruence classes. When these symbols are used to represent operations on integers, they have certain algebraic properties. This allows us, for example, to solve equations involving integers and variables, such as in the example below (in which we add the same integer to both sides, use associativity of + and commutativity of \cdot, and cancel 2 on both sides of the equation):
\begin{eqnarray}
 2 \cdot %x %- 3 & = & 1 \\
 (2 \cdot %x %- 3) + 3 & = & 1 + 3 \\
 2 \cdot %x & = & 4 \\
 2 \cdot %x & = & 2 \cdot 2 \\
 %x \cdot 2 & = & 2 \cdot 2 \\
 %x & = & 2
\end{eqnarray}
Do the operations on congruence classes, represented by the operators +, -, and \cdot, also share the familiar algebraic properties of the corresponding operations on integers? In many cases they do, but in some cases these properties only apply under specific circumstances.
      ]]></paragraph>      
      <example required="true" hooks="math" id="7b4fccc302674785ba250091ceac0e18"><![CDATA[
Suppose we write the term 3 + 4 \equiv 2 where 2, 3, and 4 are congruence classes in \Z/5\Z. What is the meaning
of this term? First, note the following equivalence.
\begin{eqnarray}
  { %x + %y | %x \in \Z, %y \in \Z} = {%z | %z \in \Z }
\end{eqnarray}
Now, we expand the definitions of congruence classes and the operation + on congruence classes below.
\begin{eqnarray}
 3 + 4 & \equiv & (3 + 5\Z) + (4 + 5\Z) \\
       & = & {3 + %a \cdot 5 | %a \in \Z} + {4 + %b \cdot 5 | %b \in \Z} \\
       & = & {(%x + %y) &nbsp; | &nbsp; %x \in {3 + %a \cdot 5 | %a \in \Z}, %y \in {4 + %b \cdot 5 | %b \in \Z}} \\
       & = & {(3 + %a \cdot 5) + (4 + %b \cdot 5) &nbsp; | &nbsp; %a \in \Z, %b \in \Z} \\
       & = & {(3 + 4) + (%a \cdot 5) + (%b \cdot 5) &nbsp; | &nbsp; %a \in \Z, %b \in \Z} \\
       & = & {2 + 5 + (%a \cdot 5) + (%b \cdot 5) &nbsp; | &nbsp; %a \in \Z, %b \in \Z} \\
       & = & {2 + (1 + %a + %b) \cdot 5 &nbsp; | &nbsp; %a \in \Z, %b \in \Z}  \\
       & = & {2 + %c \cdot 5 | %c \in \Z}  \\
       & \equiv & 2 + 5\Z \\
       & \equiv & 2
\end{eqnarray}
      ]]></example>
      <fact required="true" hooks="math" id="33037fc4d0ac4f52baa4455cbc5753cb"><![CDATA[
The set \Z/%m\Z is closed under the operation represented by +.
      ]]></fact>
      <fact required="true" hooks="math" id="970bf6956a374beb928e181ca835d07b"><![CDATA[
It is the case that \Z/%m\Z = {0,...,%m-1} where 0,...,%m-1 are congruence classes, and thus, |\Z/%m\Z| = %m.
      ]]></fact>
      <fact required="true" hooks="math" id="dfc1dbf5ad3f44afa6dd165a91adb21c"><![CDATA[
The addition operation on congruence classes in \Z/%m\Z represented by + is commutative, associative, and has the additive identity 0 + %m\Z (a.k.a., %m\Z, or simply 0).
      ]]></fact>
      <fact required="true" hooks="math" id="a425dbf5ad3f43af76dd165a91adb21d"><![CDATA[
The multiplication operation on congruence classes in \Z/%m\Z represented by \cdot is commutative, associative, and has the multiplicative identity 1 + %m\Z (a.k.a., 1).
      ]]></fact>
      <table id="5a308a7e85aa11e5af63feff819cdc9f" hooks="math"><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>property</b></td>
  <td><b>definition</b></td>
 </tr>
 <tr>
  <td>\Z/%m\Z is closed under +</td>
  <td>\forall %x,%y \in \Z/%m\Z, <br/>&nbsp;&nbsp;&nbsp; %x + %y \in \Z/%m\Z</td>
 </tr>
 <tr>
  <td>+ is commutative on \Z/%m\Z</td>
  <td>\forall %x,%y \in \Z/%m\Z, <br/>&nbsp;&nbsp;&nbsp; %x + %y \equiv %y + %x</td>
 </tr>
 <tr>
  <td>+ is associative on \Z/%m\Z</td>
  <td>\forall %x,%y,%z \in \Z/%m\Z, <br/>&nbsp;&nbsp;&nbsp; (%x + %y) + %z \equiv %x + (%y + %z)</td>
 </tr>
 <tr>
  <td>+ has a (left and right) identity <b>0</b> in \Z/%m\Z</td>
  <td>\forall %x \in \Z/%m\Z, <br/>&nbsp;&nbsp;&nbsp; <b>0</b> + %x \equiv %x and %x + <b>0</b> \equiv %x</td>
 </tr>
 <tr>
  <td>\Z/%m\Z has inverses with respect to +</td>
  <td>\forall %x \in \Z/%m\Z, <br/>&nbsp;&nbsp;&nbsp; (%m - %x) + %x \equiv 0</td>
 </tr>
 <tr>
  <td>\Z/%m\Z is closed under \cdot</td>
  <td>\forall %x,%y \in \Z/%m\Z, <br/>&nbsp;&nbsp;&nbsp; %x \cdot %y \in \Z/%m\Z</td>
 </tr>
 <tr>
  <td>\cdot is commutative on \Z/%m\Z</td>
  <td>\forall %x,%y \in \Z/%m\Z, <br/>&nbsp;&nbsp;&nbsp; %x \cdot %y \equiv %y \cdot %x</td>
 </tr>
 <tr>
  <td>+ is associative on \Z/%m\Z</td>
  <td>\forall %x,%y,%z \in \Z/%m\Z, <br/>&nbsp;&nbsp;&nbsp; (%x \cdot %y) \cdot %z \equiv %x \cdot (%y \cdot %z)</td>
 </tr>
 <tr>
  <td>+ has a (left and right) identity <b>1</b> in \Z/%m\Z</td>
  <td>\forall %x \in \Z/%m\Z, <br/>&nbsp;&nbsp;&nbsp; 1 \cdot %x \equiv %x and %x \cdot 1 \equiv %x</td>
 </tr>
 <tr>
  <td>\cdot distributes across + in \Z/%m\Z</td>
  <td>\forall %x,%y,%z \in \Z/%m\Z, <br/>&nbsp;&nbsp;&nbsp; %x \cdot (%y + %z) \equiv (%x \cdot %y) + (%x \cdot %z)</td>
 </tr>
</table>
      ]]></table>  
      <paragraph hooks="math"><![CDATA[
In the rest of this subsection, we derive some familiar algebraic properties for congruence classes. We derive some of these properties from the properties of the divisibility predicate (i.e., for any %x, %y \in \Z, %x | %y iff %y/%x \in \Z). These properties will allow us to use algebra to solve equations involving congruence classes in \Z/%m\Z.
      ]]></paragraph>
      <paragraph hooks="math"><![CDATA[
It is worth considering why we choose to work with the set of congruence classes \Z/%m\Z = {0 + %m\Z, 1 + %m\Z, 2 + %m\Z, ..., (%m-1) + %m\Z} and operations over it rather than simply working with equations involving integer variables and the modulus operator. Modular arithmetic textbooks can be written (and such textbooks exist) in which the techniques covered in these notes are used to solve <i>integer</i> equations of the form %f(%x) \mod %m = %g(%x) \mod %m for some functions %f and %g. Some of the reasons for using the set of congruence classes \Z/%m\Z include:
<ul>
  <li>it is often possible to find the <i>unique</i> solution to an equation over \Z/%m\Z, while equations over \Z involving the modulus operation may have infinitely many solutions;</li>
  <li>the set \Z/%m\Z is finite, so there is always a finite number of possible solutions to test, even if this is very inefficient, while equations over the integers involving modulus have an infinite range of possible solutions to test;</li>
  <li>the set \Z/%m\Z is a group and is a prototypical example of an algebraic structure, and gaining experience with algebraic structures is one of the purposes of this course, as algebraic structures are ubiquitous in computer science and its areas of application.</li>
</ul>
      ]]></paragraph>
      <fact required="true" hooks="math" id="79386831be43430d8ea32205e88965ee"><![CDATA[
Given an equation involving congruence classes, we are allowed to add the same value to both sides. In other words, for any congruence classes %a, %b, %c \in \Z/%m\Z, %a \equiv %b implies %a + %c \equiv %b + %c:
\begin{eqnarray}
  %a & \equiv & %b (\mod %m) \\
  %a + %c & \equiv & %a + %c
\end{eqnarray}
To see that this is true, we can simply appeal to algebraic facts about integers:
\begin{eqnarray}
  %a & = & %b \\
  %a + %c & = & %b + %c \\
  (%a + %c) \mod %m & = & (%b + %c) \mod %m \\
  %a + %c & \equiv & %b + %c (\mod %m)
\end{eqnarray}
Thus, the two congruence classes contain the same elements, so they are equivalent.
      ]]></fact>
      <fact required="true" hooks="math" id="9e24fe90f4184c11b8b76e198a6d4876"><![CDATA[
For any congruence classes %a, %b, %c \in \Z/%m\Z, %a \equiv %b implies %a - %c \equiv %b - %c. We can adjust the argument for + in the following way:
\begin{eqnarray}
  %a & = & %b \\
  %a - %c & = & %b - %c \\
  (%a - %c) \mod %m & = & (%b - %c) \mod %m \\
  %a - %c & \equiv & %b - %c (\mod %m)
\end{eqnarray}
      ]]></fact>
      <text hooks="math"><![CDATA[
We saw that we can add and subtract from both sides of an equation involving congruence classes. Can we also "divide" both sides by the same factor (or
"cancel" that factor) in such an equation?
      ]]></text>
      <example required="true" hooks="math" id="abb7f7a014d546098a018a0524f639f6"><![CDATA[
Consider the following sequence of equations within \Z/2\Z:
\begin{eqnarray}
  4 & \equiv & 6 \\
  2 \cdot 2 & \equiv & 2 \cdot 3 \\
  2 & \equiv & 3
\end{eqnarray}
Clearly, 2 \not\equiv 3 (\mod 2) since the left-hand side is even and the right-hand side is odd. Thus, cancelling 2 on both sides of the equation in the above case is not correct. On the other hand, we have the following:
\begin{eqnarray}
  10 & \equiv & 6 \\
  2 \cdot 5 & \equiv & 2 \cdot 3 \\
  5 & \equiv & 3
\end{eqnarray}
In the above case, cancelling 2 on both sides led to a true equation.
      ]]></example>
      <text hooks="math"><![CDATA[
It seems that we cannot always "divide" by the same factor on both sides, but we can do so under certain conditions. In order to characterize at least some of the cases in which this is possible, we need a few preliminary facts.
      ]]></text>
      <fact required="true" hooks="math" id="0ab713d1b2ec47b7a0b11940ca14c2e2"><![CDATA[
For any %a, %m \in \Z, %a \mod %m = 0 iff we have that %m | %a. Thus, the following are all equivalent (i.e., all three are true at the same time):
\begin{eqnarray}
  %m & | & %a \\
  %a \mod %m & = & 0 \\
  %a & \equiv & 0 (\mod %m) \\
  0 & \equiv & %a (\mod %m)
\end{eqnarray}
      ]]></fact>
      <text hooks="math"><![CDATA[
We can derive the fact that %m | %a iff %a \mod %m = 0 as follows. If %a \mod %m = 0 then by definition of \mod we have:
\begin{eqnarray}
  %a - \lfloor %a/%m \rfloor \cdot %m & = & 0\\
  %a & = & \lfloor %a/%m \rfloor \cdot %m \\
  %a / %m & = & \lfloor %a/%m \rfloor \\
  %a / %m & \in & \Z \\
  %m & | & %a
\end{eqnarray}
If %m | %a then by definition of %m | %a we have:
\begin{eqnarray}
  %m & | & %a \\
  %a / %m & \in & \Z \\
  %a / %m & = & \lfloor %a/%m \rfloor \\
  %a & = & \lfloor %a/%m \rfloor \cdot %m \\
  %a - \lfloor %a/%m \rfloor \cdot %m & = & 0 \\
  %a \mod %m & = & 0
\end{eqnarray}
      ]]></text>
      <fact required="true" hooks="math" id="9e1208f7691e45f1abd3adbfc6bd3242">
        <text><![CDATA[
For any %a, %b, %c \in \N, if %c|%a then %c|(%a \cdot %b).
        ]]></text>
        <paragraph><![CDATA[
Because %c|%a, it must be that %a/%c \in \Z. But then we have that:
\begin{eqnarray}
  (%a \cdot %b) / %c = (%a / %c) \cdot %b
\end{eqnarray}
Since (%a / %c) \in \Z and %b \in \Z, (%a / %c) \cdot %b \in \Z and  (%a \cdot %b) / %c \in \Z. Thus, %c|(%a \cdot %b).
        ]]></paragraph>
      </fact>
      <fact required="true" hooks="math" id="9e1208f7691e45f1abd3adbfc6bd3242">
        <text><![CDATA[
In \Z/%m\Z, Multiplying by the 0 + %m\Z congruence class yields the 0 + %m\Z congruence class.
For any %a, %b, %m \in \N, if %a \equiv 0 (\mod %m) then %a \cdot %b \equiv 0 (\mod %m).
        ]]></text>
        <paragraph><![CDATA[
We can show this as follows:
\begin{eqnarray}
  %a & \equiv & 0 (\mod %m) \\
  %m & | & %a \\
  %m & | & (%a \cdot %b) \\
  %a \cdot %b & \equiv & 0 (\mod %m)
\end{eqnarray}
Thus, 0 \in \Z/%m\Z behaves with respect to multiplication over \Z/%m\Z much the same way that 0 \in \Z behaves with respect to multiplication over \Z.
        ]]></paragraph>
      </fact>
      <example required="true" hooks="math" id="a4346c3394ec4d109d085509bcd7f667"><![CDATA[
For any %a, %b, %m \in \N, it is not necessarily the case that just because %a \cdot %b \equiv 0 (\mod %m), either %a or %b must be the congruence class 0 \in \Z/%m\Z. For example, let %m = 6, %a = 4, and %b = 9. Then we have:
\begin{eqnarray}
  4 \cdot 9 & \equiv & 0 (\mod 6) \\
  (2 \cdot 2) \cdot (3 \cdot 3) & \equiv & 0 (\mod 6) \\
  2 \cdot (2 \cdot 3) \cdot 3 & \equiv & 0 (\mod 6) \\
  2 \cdot 6 \cdot 3 & \equiv & 0 (\mod 6)
\end{eqnarray}
However, we have that:
\begin{eqnarray}
  6 & \nmid & 4 \\
  4 & \not\equiv & 0 (\mod 6) \\
  6 & \nmid & 9 \\
  9 & \not\equiv & 0 (\mod 6)
\end{eqnarray}
Thus, the congruence class 0 \in \Z/%m\Z does not always behave the same way that 0 \in \Z behaves.
      ]]></example>
      <fact title="Euclid's lemma" required="true" hooks="math" id="77c204e590044e8e95177a2582ad1abf"><![CDATA[
For any %a, %b, %p \in \Z, if %p is prime and %p | (%a \cdot %b), then it must be that %p|%a or %p|%b (or both).
      ]]></fact>
      <fact required="true" hooks="math" id="b62aa8da5dc34cdf82909746579fb36d">
        <text><![CDATA[
For any congruence classes %a, %b, %c \in \Z/%p\Z, if %c is not divisible by %p then %a \cdot %c \equiv %b \cdot %c implies %a \equiv %b.
        ]]></text>
        <paragraph><![CDATA[
We can derive the above fact by using the following steps:
\begin{eqnarray}
  %a \cdot %c & \equiv & %b \cdot %c \\
  (%a \cdot %c) - (%b \cdot %c) & \equiv & 0 \\
  ((%a \cdot %c) - (%b \cdot %c)) \mod %p & = & 0 \\
  ((%a - %b) \cdot %c) \mod %p & = & 0 \\
  %p & | & ((%a - %b) \cdot %c)
\end{eqnarray}
By Euclid's lemma, the fact that %c is not divisible by %p requires that %a - %b must be divisible by %p. Thus:
\begin{eqnarray}
  %p & | & (%a - %b) \\
  (%a - %b) \mod %p & = & 0 \\
  %a - %b & \equiv & 0 \\
  %a & \equiv & %b
\end{eqnarray}
        ]]></paragraph>
      </fact>      
      <example required="true" hooks="math" id="29223a953c1a46c1979a9769191552b1"><![CDATA[
Solve the following equation for all possible congruence classes %x \in \Z/3\Z:
\begin{eqnarray}
  6 \cdot %x & \equiv & 0 (\mod 3)
\end{eqnarray}
Since 6 \equiv 0 \mod 3, we can rewrite the equation as follows:
\begin{eqnarray}
  0 \cdot %x & \equiv & 0 (\mod 3)
\end{eqnarray}
Thus, any congruence class %x \in {0 + 3\Z, 1 + 3\Z, 2 + 3\Z} is a solution to the equation.
      ]]></example>
      <example required="true" hooks="math" id="eee4a8e1e9864798a885de4fe2689de5"><![CDATA[
Solve the following equation for all possible congruence classes %x \in \Z/5\Z:
\begin{eqnarray}
  2 \cdot %x & \equiv & 0 (\mod 5)
\end{eqnarray}
We know that 2 \cdot 0 \equiv 0 (\mod 5), so we can rewrite the above by substituting the right-hand side of the equation:
\begin{eqnarray}
  2 \cdot %x & \equiv & 2 \cdot 0 (\mod 5)
\end{eqnarray}
We can now cancel 2 on both sides of the equation using the cancellation law because 5 is prime and 2 \not\equiv 0 (\mod 5):
\begin{eqnarray}
  %x & \equiv & 0 (\mod 5)
\end{eqnarray}
Thus, the only solution is the single congruence class %x = 0 + 5\Z.
      ]]></example>
      <example required="true" hooks="math" id="f3afb4ae13474c02b30c77834bc804c6"><![CDATA[
Solve the following equation for all possible congruence classes %x \in \Z/11\Z:
\begin{eqnarray}
  3 \cdot %x + 5 & \equiv & 6 (\mod 11)
\end{eqnarray}
We can begin by subtracting 5 from both sides:
\begin{eqnarray}
  3 \cdot %x & \equiv & 1 (\mod 11)
\end{eqnarray}
We can then see that 12 \equiv 1 (\mod 11), so we can substitute 1 with 12 on the right-hand side:
\begin{eqnarray}
  3 \cdot %x & \equiv & 12 (\mod 11)
\end{eqnarray}
We can then rewrite 12 as 3 \cdot 4:
\begin{eqnarray}
  3 \cdot %x & \equiv & 3 \cdot 4 (\mod 11)
\end{eqnarray}
Since 11 is prime and 3 \not\equiv 0 (\mod 11), we can cancel the 3 on both sides to solve the problem:
\begin{eqnarray}
  %x & \equiv & 4 (\mod 11)
\end{eqnarray}
Thus, the only solution is the single congruence class %x = 4 + 11\Z.
      ]]></example>
      <example required="true" hooks="math" id="ec11f04d574a4d71bb816901c6c1a64c"><![CDATA[
Let %a \in \Z be any integer. Solve the following equation for all possible congruence classes %x \in \Z/7\Z:
\begin{eqnarray}
  %a + 3 \cdot %x & \equiv & 6 - 6 \cdot %a (\mod 7)
\end{eqnarray}
We can begin by adding 6 \cdot %a to both sides:
\begin{eqnarray}
  (%a + 6 \cdot %a) + 3 \cdot %x & \equiv & 6 (\mod 7)
\end{eqnarray}
Now we can add %a + 6 %a to obtain 7 \cdot %a:
\begin{eqnarray}
  7 \cdot %a + 3 \cdot %x & \equiv & 6 (\mod 7)
\end{eqnarray}
We know that 7 \equiv 0 (\mod 7), so we know that for any %a \in \Z, 7 \cdot %a \equiv 0 (\mod 7). Thus, we can substitute the term 7 \cdot %a with 0:
\begin{eqnarray}
  0 + 3 \cdot %x & \equiv & 6 (\mod 7) \\
  3 \cdot %x & \equiv & 6 (\mod 7) \\
  3 \cdot %x & \equiv & 3 \cdot 2 (\mod 7)
\end{eqnarray}
Since 7 is prime and 3 \not\equiv 0 (\mod 7), we can cancel 3 on both sides:
\begin{eqnarray}
  %x & \equiv & 2 (\mod 7)
\end{eqnarray}
Thus, the only solution is the single congruence class %x = 2 + 7\Z.
      ]]></example>
      <exercise required="true" hooks="math" id="2a900b2f4f3d49ef8bdd3576495bf0e5">
        <text><![CDATA[
Solve the following equation for all possible congruence classes %x \in \Z/13\Z:
\begin{eqnarray}
  4 \cdot %x %- 2 & \equiv & 10 (\mod 13)
\end{eqnarray}
        ]]></text>
        <solution><![CDATA[
We can add 2 to both sides to obtain:
\begin{eqnarray}
  4 \cdot %x & \equiv & 12 (\mod 13)
\end{eqnarray}
At this point, since 13 is prime and 4 is not equivalent to the congruence class 0 + 13\Z (i.e., it is not a multiple of 13), we know a solution must exist. Since 12 is a multiple of 4, we can cancel 4 on both sides:
\begin{eqnarray}
  4 \cdot %x & \equiv & 4 \cdot 3 (\mod 13) \\
  %x & \equiv & 3
\end{eqnarray}
Thus, we have a unique solution %x = 3 + 13\Z, which we can also denote using the symbol 3.
        ]]></solution>
      </exercise>
      <exercise required="true" hooks="math" id="397f7d6868034e5daf039f08becbf6a0">
        <text><![CDATA[
Let %a \in \Z be any integer. Solve the following equation for all possible congruence classes %x \in \Z/19\Z. <b>Hint:</b> notice that 17 + 19 = 36.
\begin{eqnarray}
  6 \cdot %x %- 11 & \equiv & 6 (\mod 19)
\end{eqnarray}
        ]]></text>
        <solution><![CDATA[
We can add11 to both sides to obtain:
\begin{eqnarray}
  6 \cdot %x & \equiv & 17 (\mod 19)
\end{eqnarray}
At this point, we know a solution must exist because 19 is prime and 6 is not a multiple of 19 (so it is not in 0 + 19\Z and not equivalent to the congruence class 0 (\mod 19)). However, it is not immediately obvious that we can cancel a multiple of 6 on the right-hand side. What we do know is that there <i>must exist</i> an integer in 17 + 19\Z that will allow us to cancel. We can list the members of this set:
\begin{eqnarray}
  17 + 19\Z & = & {..., 17, 36, 55, ...}
\end{eqnarray}
We note that 36 is a multiple of 6 and that 17 \equiv 36 (\mod 19), so we can cancel:
\begin{eqnarray}
  6 \cdot %x & \equiv & 36 (\mod 19) \\
  6 \cdot %x & \equiv & 6 \cdot 6 \\
  %x & \equiv & 6
\end{eqnarray}
Thus, we have a unique solution %x = 6 + 19\Z, which we can also denote using the symbol 6.
        ]]></solution>
      </exercise>
    </subsection>
    <subsection title="Multiplication by a congruence class as a permutation">
      <paragraph hooks="math"><![CDATA[
We have seen that in certain situations, it is possible to cancel on both sides of an equation involving congruence classes. While <a href="#77c204e590044e8e95177a2582ad1abf">Euclid's lemma made this possible</a>, we might be interested in finding other ways to understand why cancelling is possible in this particular situation. In fact, the alternative explanation is useful in its own right because it can be applied to the practical problem of generating random numbers.
      ]]></paragraph>
      <paragraph hooks="math"><![CDATA[
Let us consider the situations in which we can cancel on both sides in an equation involving integers. Suppose %a,%b,%c \in \Z, and:
\begin{eqnarray}
  %a \cdot %c & = & %b \cdot %c 
\end{eqnarray}
It is possible to cancel in the above equation exactly when the operation of multiplication by %c is <i>invertible</i>. In particular, if %c is 0, then %a \cdot %c = 0, and all information about %a is lost (likewise for %b \cdot %c = 0). So, if %c = 0, the operation of multiplication by %c is not invertible (i.e., multiple inputs map to the same output, namely 0, so multiplication by %c = 0 is <i>not</i> a <a href="#2.8">bijection</a>), and it is not possible to cancel %c on both sides. In all other situations where %c \neq 0, the operation is invertible (we can simply perform integer division by %c on %a \cdot %c and %b \cdot %c). This raises a natural question: does the ability to cancel congruence classes on both sides of a congruence class equation also imply that the operation of multiplying by the congruence class that can be cancelled on both sides is an invertible operation? The answer is "yes".
      ]]></paragraph>
      <paragraph hooks="math"><![CDATA[
For a prime %p, multiplication by a congruence class in \Z/%p\Z corresponds to an invertible relation, also known as a <i>bijection</i> or a <i>permutation</i>.
      ]]></paragraph>
      <fact required="true" hooks="math" id="f39cb7c04c164e9b88e15fe83d47fe7d"><![CDATA[
For any %p \in \N, for any %a \in {1,...,%p-1}, if %p is prime then the following relation %R is a permutation from {0, 1,...,%p-1} to
\Z/%p\Z (the non-zero congruence classes in \Z/%p\Z):
\begin{eqnarray}
 %R & = & { (0, (0 \cdot %a) \mod %p), (1, (1 \cdot %a) \mod %p), (2, (2 \cdot %a) \mod %p), ..., (%p-1, ((%p-1) \cdot %a) \mod %p) } \\
    & = & { (%i, (%i \cdot %a) \mod %p) | %i \in {0,...,%p-1} }
\end{eqnarray}
      ]]></fact>
      <paragraph hooks="math"><![CDATA[
Recall that %R is a permutation if %R is a bijection. In order to be a bijection, %R must be both an injection and a surjection.
      ]]></paragraph>
      <paragraph hooks="math"><![CDATA[
To show that %R is an injection, suppose that it is not. We will derive a contradiction from this assumption, which
will tell us that the assumption must be false.
      ]]></paragraph>
      <paragraph hooks="math"><![CDATA[
If it is not injective, then there exist distinct %i \in {0,...,%p-1} and %j \in {0,...,%p-1} where without loss of generality 
%j < %i such that:
\begin{eqnarray}
 %i & \neq & %j \\
 (%i \cdot %a) \mod %p & = & (%j \cdot %a) \mod %p
\end{eqnarray}
 But the above implies the following:
\begin{eqnarray}
 (%i \cdot %a) \mod %p & = & (%j \cdot %a) \mod %p  \\
 ((%i \cdot %a) - (%j \cdot %a)) \mod %p & = & 0 \mod %p \\
 ((%i - %j) \cdot %a) \mod %p & = & 0 \mod %p \\
 %p & | & (%i - %j) \cdot %a
\end{eqnarray}
By <a href="#77c204e590044e8e95177a2582ad1abf">Euclid's lemma</a>, the above implies that %p must divide either (%i %- %j) or %a. But also know that:
<ul>
  <li>because %a < %p, %p does not divide %a;</li>
  <li>because %p > %i - %j > 0, %p cannot divide (%i %- %j).
</ul>
Alternatively, notice that in (%i \cdot %a) \mod %p = (%j \cdot %a) \mod %p , we should be able to simply divide both sides of the equation by %a because %p is prime; however, this contradicts our initial assumption!
      ]]></paragraph>
      <paragraph hooks="math"><![CDATA[
Since assuming that distinct %i and %j can be mapped to the same element when they are multiplied by %a leads to a contradiction, it must be that this is not possible. Thus, no two distinct %i and %j map to the same result, so %R is an injection from {0,...,%p-1} to \Z/%p\Z and we have that:
\begin{eqnarray}
|{0,...,%p-1}| & = & |\Z/%p\Z|
\end{eqnarray}
Thus, since %R maps to at least %p distinct elements, and |\Z/%p\Z| has at most %p elements, %R must map to every element in \Z/%p\Z, so it is also a surjection by the <a href="http://en.wikipedia.org/wiki/Pigeonhole_principle">Pigeonhole principle</a>.
      ]]></paragraph>  
      <paragraph hooks="math"><![CDATA[
Since %R is both an injection and a surjection from {1,...,%p-1} to \Z/%p\Z - {0}, it must be a bijection, and thus a permutation.
      ]]></paragraph>
      <example required="true" hooks="math" id="eaae8a531cb7445b998a36a2dd4c3b41"><![CDATA[
Consider 2 \in \Z/5\Z. We can write out the results of multiplying all the congruence classes in \Z/5\Z by the congruence class 2:
\begin{eqnarray}
  2 \cdot 0 & \equiv & 0 (\mod 5) \\
  2 \cdot 1 & \equiv & 2 (\mod 5) \\
  2 \cdot 2 & \equiv & 4 (\mod 5) \\
  2 \cdot 3 & \equiv & 1 (\mod 5) \\
  2 \cdot 4 & \equiv & 3 (\mod 5)
\end{eqnarray}
Notice that each congruence class in \Z/5\Z appears exactly once as a result.
      ]]></example>
    </subsection>
    <subsection title="Generating random numbers">
      <paragraph hooks="math"><![CDATA[
Suppose we wish to automatically generate a sequence of "random" numbers using an algorithm. Before we can implement an algorithm and determine whether it solves our problem, we must first determine what constitutes an acceptable "random" sequence.
      ]]></paragraph>
      <example required="true" hooks="math" id="8d08adaeb08848dcb7cb95632f5e2119">
        <text><![CDATA[
Suppose we want to find a way to generate a "random" sequence %v of positive integers. Assume we have only one requirement.
        ]]></text>
        <paragraph><![CDATA[
<b>Requirement 1:</b> The sequence %v has %m distinct positive integers between 0 and %m-1, where %v_{%i} is the %ith element in the sequence.</li>
        ]]></paragraph>
        <paragraph><![CDATA[
In this case, a relation %R \subset \N \times \Z/%m\Z that is a permutation would be sufficient. One such relation is:
\begin{eqnarray}
  %v_0 & = & 0 \mod %m \\
  %v_{%i} & = & (%v_{%i-1} + 1) \mod %m \\
  %R_0 & = & {(%i, %v_{%i}) | %i \in {0,...,%m-1}}
\end{eqnarray}
Notice that the second term in (%x, %x \mod %m) is in this case the <i>congruence class</i> modulo %m that corresponds to %x. The relation %R_0 is indeed a permutation, but it does not satisfy our intuitive notion of a random sequence because it simply counts from 0 to %m %- 1, so we impose another requirement.
        ]]></paragraph>
        <paragraph><![CDATA[
<b>Requirement 2:</b> The sequence %v must not be the trivial sequence (0,...,%m-1).</li>
        ]]></paragraph>
        <paragraph><![CDATA[
Suppose we propose the following relation:
\begin{eqnarray}
  %v_0 & = & 0 \\
  %v_{%i} & = & (%v_{%i-1} + 2) \mod %m \\
  %R_1 & = & {(%i, %v_{%i}) | %i \in {0,...,%m-1}}
\end{eqnarray}
Notice that we can redefine %R_1 above more concisely:
\begin{eqnarray}
  %R_1 & = & {(%i, (0 + 2 \cdot %i) \mod %m) | %i \in {0,...,%m-1}}
\end{eqnarray}
Does %R_1 always satisfy both requirements? Suppose that %m is even. Then we have that there exists %j \in {0,...,%m-1} such that 2 \cdot %j = %m. But
this means that 2 \cdot %j \equiv 0, so 2 \cdot (%j+1) \equiv 2 \cdot %j + 2 \cdot 1 \equiv 2 \cdot 1 \equiv 2 and so on. This means that %R_1 is
not injective, so the first requirement is not met when %m is even. Suppose we define %R_2 to be a variant of %R_1 parameterized by some %b \in {0,...,%m-1}:
\begin{eqnarray}
  %R_2 & = & {(%i, (0 + %b \cdot %i) \mod %m) | %i \in {0,...,%m-1}}
\end{eqnarray}
What conditions can we impose on %b and %m so that they satisfy both requirements?
        ]]></paragraph>
      </example>
      <paragraph hooks="math"><![CDATA[
After examining the permutation we can obtain by multiplying all the congruence classes in some set \Z/%p\Z by a particular %a \in \Z/%p\Z, we might wonder if we can use this fact to implement a random number generator. One immediate benefit of this approach is that this approach would satisfy several conditions that we might associate with a "good" algorithm for generating random numbers:
<ul>
  <li>the "state" of the algorithm is easy to store: it consists of a single congruence class in \Z/%p\Z, which can be represented using an integer;</li>
  <li>it is possible to compute the %ith random number in the sequence efficiently (i.e., with a single multiplication followed by a single modulus operation);</li>
  <li>the sequence that is generated will contain exactly one instance of all the numbers in the chosen range {0,...,%p-1};</li>
  <li>the sequence that is generated can, at least in some cases, be a non-trivial sequence that might appear "random".</li>
</ul>
      ]]></paragraph>
      <fact required="true" id="b839e06e289c4fbcb9c55e9b00456a3a">
        <text hooks="math"><![CDATA[
If %m is prime and %b \in {2,...,%m-1}, then %R_2 satisfies both requirements.
        ]]></text>
        <paragraph hooks="math"><![CDATA[
We know this is true because in this case, %R is a permutation, so it satisfies <b>Requirement 1</b>. Furthermore, element %v_1 = %b, so
%v is never the trivial sequence. Thus, <b>Requirement 2</b> is satisfied.
        ]]></paragraph>
      </fact>
      <algorithm required="true" id="df42e3a01fcd11e3831ff23c91aec05e">
        <text hooks="math"><![CDATA[
The following is one possible implementation of a simple random number generation algorithm.
<ol style="list-style-type:none;">
 <li><b>inputs:</b> upper bound (prime) %p \in \N, seed %a \in {0,...,%p-1}, index %i \in \in {0,...,%p-1}</li>
 <li>
   <ol style="list-style-type:none; margin-left:-12px;">
     <li><b>return</b> (%a \cdot %i) \mod %p</li>
   </ol>
 </li>
</ol>
        ]]></text>
      </algorithm>
      <exercise required="true" id="44bf303ffc72497594214b5cab93175f">
        <text hooks="math"><![CDATA[
What are some drawbacks (or unresolved issues) with building random sequences by choosing a prime %m and some %a \in {2,...,%m-1}?
        ]]></text>
        <solution hooks="math"><![CDATA[
The biggest limitation is that the range must be a prime number. This will present a number of difficulties:
<ul>
  <li>if a non-prime upper bound is needed, it would be necessary to scale down the results from the smallest prime number that is greater than the desired upper bound, and this would eliminate the bijective property of the generator (multiple indices might map to the same random number);</li>
  <li>where do we even find a prime %p efficiently that is close to the desired upper bound?</li>
</ul>
Regarding the second point above: we will see that an efficient, commonly used algorithm for finding prime numbers in a given range actually <i>uses</i> a random number generator as a subroutine. This circular dependency would certainly present a problem, so it would be ideal if we could generate a random number without relying on the ability to generate prime numbers within a certain range.
        ]]></solution>
      </exercise>
    </subsection>
    <subsection title="Greatest common divisor and related facts">
      <paragraph hooks="math"><![CDATA[
It is actually possible to generalize <a href="#77c204e590044e8e95177a2582ad1abf">Euclid's lemma</a> so that it does not rely on prime numbers existing at all. In order to do so, however, we must first introduce concepts that make it possible to reason about a particular relationship between numbers that is similar to the property of primality, but is less restrictive.
      ]]></paragraph>
      <definition required="true" id="ff2ccf893ec443e8a14bc8538d999e38">
        <text hooks="math"><![CDATA[
For any two %x, %y \in \Z, we define the <i>greatest common divisor</i>, denoted \gcd(%x,%y), as the greatest
integer %z \in \Z such that %z | %x and %z | %y. Equivalently, we can define it as the maximum of a set:
\begin{eqnarray}
 \gcd(%x,%y) & = & \max{%z | %z \in \Z, %z | %x, %z | %y} 
\end{eqnarray}
We can also define it recursively (not that %z | 0 for all %z \in \Z because 0/%z \in \Z):
\begin{eqnarray}
 \gcd(%x,0) & = & %x \\
 \gcd(%x,%y) & = & \gcd(%y, %x \mod %y)
\end{eqnarray}
        ]]></text>
      </definition>
      <text hooks="math"><![CDATA[
To see why the recursive definition of \gcd works, consider two cases. If %x < %y, then the two inputs are simply reversed. This ensures that the
first input %x is eventually larger than the second input %y. If %x \geq %y and they share a greatest common divisor %a,
then we have for %n = \lfloor %x/%y \rfloor
that:
\begin{eqnarray}
 %y & = & %y' \cdot %a \\
 %x & = & %x' \cdot %a \\
 %x \mod %y & = & %x - (%n \cdot %y)\\
            & = & (%x' \cdot %a) - (%n \cdot %y)\\
            & = & %x' \cdot %a - ((%n \cdot %y') \cdot %a)\\
            & = & (%x' - %n \cdot %y') \cdot %a
\end{eqnarray}
Notice that (%x' - %n \cdot %y') \cdot %a < %x' \cdot %a, but that the new smaller value is still a multiple of %a, so the greatest common
divisor of this value and %y is still %a.
      ]]></text>
      <example required="true" id="a9831f10979c4c669cf393f765025977">
        <text hooks="math"><![CDATA[
Consider the number 8 and 9. The factors of 8 are 1, 2, 4, and 8, while the factors of 9 are 1, 3, and 9. Thus, the maximum of the numbers in the intersection {1,2,4,8} \cap {1,3,9} is 1, so we have that \gcd(8, 9) = 1.
        ]]></text>
      </example>
      <example required="true" id="ae2ced1a893748108285eb41075b824a">
        <text hooks="math"><![CDATA[
We can implement the inefficient algorithm for the greatest common divisor using Python in the following way:
        ]]></text>
        <code class="py"><![CDATA[
def gcd(x, y):
  return max({z for z in range(0, min(x,y)) if x % z == 0 and y % z == 0})
         ]]></code>
      </example>
      <exercise required="true" id="00b5aa4aa094475e9ebaaf499df13806">
        <text hooks="math"><![CDATA[
Consider the following relation:
\begin{eqnarray}
 { (%x, %y) | \gcd(%x,%y) \neq 1 }
\end{eqnarray}
Is this an equivalence relation?
        ]]></text>
        <solution>
          <text hooks="math"><![CDATA[
The relation is reflexive because \gcd(%x,%x) = %x, and it is symmetric because \gcd(%x,%y) = \gcd(%y,%x). However it is not transitive. For example, \gcd(4,6) = 2 and \gcd(6,9) = 3, but \gcd(4,9) = 1. Note also that we can define such a relation for some range using Python:
          ]]></text>
          <code class="py"><![CDATA[
{(x,y) for x in S for y in S if gcd(x,y) != 1}
           ]]></code>
        </solution>
      </exercise>
      <fact required="true" id="3cf51c6fb52a40909578ea9d076fc503">
        <text hooks="math"><![CDATA[
For any %x \in \Z, %y \in \Z, %x | %y iff \gcd(%x,%y) = %x.
        ]]></text>
      </fact>
      <definition required="true" id="f84d5cc6cb964a1292b39ee3037c2d0b">
        <text hooks="math"><![CDATA[
For any %x \in \Z, %y \in \Z, %x and %y are <i>relatively prime</i>, <i>relative primes</i>, and <i>coprime</i> iff \gcd(%x,%y) = 1.
        ]]></text>
      </definition>
      <fact title="Euclid's lemma generalization" required="true" id="c32b1fae4f5d4abb997c85429ae85976">
        <text hooks="math"><![CDATA[
For any %a, %b, %c \in \N, if %a | (%b \cdot %c) and %a and %b are relatively prime, then it must be that %a | %c.
        ]]></text>
      </fact>
      <fact required="true" id="df42e68e1fcd11e3831ff23c91aec05e">
        <text hooks="math"><![CDATA[
If %m, %a \in \N and %x, %y \in \Z/%m\Z where gcd(%a, %m) = 1 (i.e., %a and %m are coprime), and suppose we have that:
\begin{eqnarray}
  %x & \not\equiv & %y (\mod %m) \\
\end{eqnarray}
Then it must be that:
\begin{eqnarray}
  %a \cdot %x & \not\equiv & %a \cdot %y (\mod %m)
\end{eqnarray}
Notice that we can prove the above by contradiction. If we instead suppose that %a \cdot %x \equiv %a \cdot %y (\mod %m), then because %a and %m are coprime, by <a href="#c32b1fae4f5d4abb997c85429ae85976">Euclid's generalized theorem</a>, we can canel %a on both sides of the equation to obtain %x \equiv %y (\mod %m).
        ]]></text>
      </fact>
      <exercise required="true" id="f38ece98e82f4fe08fa40742c56e6923">
        <text hooks="math"><![CDATA[
Solve the following problems using the algebraic facts you know about the \gcd operation.
        ]]></text>
        <unorderedlist>
          <item>
            <text hooks="math"><![CDATA[Find \gcd(18,42).]]></text>
          </item>
          <item>
            <text hooks="math"><![CDATA[Find \gcd(2<sup>1000</sup>, 2<sup>100</sup>).]]></text>
          </item>
          <item>
            <text hooks="math"><![CDATA[For a positive <i>even</i> integer %a \in \Z, find \gcd(%a/2, %a - 1).]]></text>
          </item>
          <item>
            <text hooks="math"><![CDATA[Suppose that for some %a \in \Z/%m\Z, the set {%i \cdot %a \mod %m | %i \in {1,...,%m-1}} contains every number in the set {1,...,%m-1}. What is \gcd(%a, %m)?]]></text>
          </item>
        </unorderedlist>
      </exercise>
      <exercise required="true" hooks="math" id="716de6730d364d9aaa244800f465f2ab">
        <text><![CDATA[
Solve the following equation for all possible congruence classes %x \in \Z/16\Z:
\begin{eqnarray}
  9 \cdot %x + 2 & \equiv & 4 (\mod 16)
\end{eqnarray}
        ]]></text>
        <solution><![CDATA[
We can subtract 2 from both sides to obtain:
\begin{eqnarray}
  9 \cdot %x & \equiv & 2 (\mod 16)
\end{eqnarray}
At this point, since 9 and 16 are coprime, we know a solution must exist. We can list all the members of 2 + 16\Z:
\begin{eqnarray}
  2 + 16\Z & = & {..., 2, 18, 34, ...}
\end{eqnarray}
We note that 18 is a multiple of 9, so we can cancel 9 on both sides:
\begin{eqnarray}
  9 \cdot %x & \equiv & 18 (\mod 16) \\
  9 \cdot %x & \equiv & 9 \cdot 2 \\
  %x & \equiv & 2
\end{eqnarray}
Thus, we have a unique solution %x = 2 + 16\Z, which we can also denote using the symbol 2.
        ]]></solution>
      </exercise>
      <exercise required="true" hooks="math" id="716de6730d114d9aaa244800f465f2ab">
        <text><![CDATA[
Solve the following equation for all possible congruence classes %x \in \Z/15\Z:
\begin{eqnarray}
  30 \cdot %x & \equiv & 14 (\mod 15)
\end{eqnarray}
        ]]></text>
        <solution><![CDATA[
We note that 30 = 15 \cdot 2, so 15|30, which means:
\begin{eqnarray}
  30 & \equiv & 0 (\mod 15)
\end{eqnarray}
Thus, we can write the equation as:
\begin{eqnarray}
  0 \cdot %x & \equiv & 14 (\mod 15) \\
  0 & \equiv & 14 
\end{eqnarray}
There is no possible congruence class %x \in \Z/15\Z that will make the above formula true; the formula 0 \equiv 14 is always false in \Z/15\Z. Thus, there are no solutions to the original equation.
        ]]></solution>
      </exercise>
      <fact required="true" id="c9ccf01dcaf440cc815f96df5e09ef04">
        <text hooks="math"><![CDATA[
For any %a \in \N and %m \in \N, if gcd(%a,%m) = 1, then {(%i, (%i \cdot %a) mod %m) | %i \in {0,...,%m-1}} is a permutation.
        ]]></text>
        <paragraph hooks="math"><![CDATA[
The above can be proven by noticing that if gcd(%a,%m) = 1, then %a does not divide %m and %m does not divide %a.
Notice that in <a href="#f39cb7c04c164e9b88e15fe83d47fe7d">this fact in which %p was required to be prime</a>, the fact that %p is prime was not used in isolation; only the coprime relationship between %p and %a was required.
        ]]></paragraph>
      </fact>
      <text hooks="math"><![CDATA[
Using the <a href="#c32b1fae4f5d4abb997c85429ae85976">generalization of Euclid's lemma</a>, it is now possible to address the <a href="#44bf303ffc72497594214b5cab93175f">drawback</a> we observed in our <a href="#df42e3a01fcd11e3831ff23c91aec05e">initial random number generating algorithm</a>. We can now accept any upper bound %m, not just a prime upper bound, and there is no need for either the algorithm or the user to find a prime %p before generating random numbers. However, we have a new problem: how to do we obtain a non-trivial coprime for any given %m?
      ]]></text>
      <fact required="true" id="d748c2e939724ce4a08db35933e7af69">
        <text hooks="math"><![CDATA[
For any %m \in \Z where %m \geq 2, \gcd(%m,%m+1) = 1.
        ]]></text>
        <paragraph hooks="math"><![CDATA[
We can prove this fact by contradiction. Suppose there exists a factor %z > 1 of %m and %m+1. In other words, \gcd(%m,%m+1) > 1. Then we have
that:
\begin{eqnarray}
 %z \cdot %a & = & %m \\
 %z \cdot %b & = & %m + 1 \\
 (%z \cdot %b) - (%z \cdot %a) & = & %m + 1 %- %m\\
 %z \cdot (%b %- %a) & = & 1\\
          %b %- %a & = & 1 / %z
\end{eqnarray}
If %z > 1 then 1/%z \not\in \Z, so (%b %- %a) \not\in \Z. Since %b-%a \in \Z, this is a contradiction, so it must be that \gcd(%m, %m+1) = %z = 1.
        ]]></paragraph>
      </fact>
      <fact required="true" id="6e9970794ae24fc6860368be7afe8154">
        <text hooks="math"><![CDATA[
Suppose that %m \in \N is an odd positive integer. Then for any %k \in \N, \gcd(%m, 2^{%k}) = 1. This is because if %m had any factors of 2, it would be even.
        ]]></text>
      </fact>
      <fact required="true" id="9e7a019d05154ba0b8e71ad59d57ad0a">
        <text hooks="math"><![CDATA[
Suppose that %m \in \N is of the form 2^{%k} \cdot %m' for some odd %m' and some %k \geq 1. Then %m' \cdot 2 and %m have exactly the same prime factors, which means (%m' \cdot 2) %- 1 and %m share no factors, so \gcd(%m, (%m' \cdot 2) %- 1) = 1.
        ]]></text>
      </fact>
      <algorithm required="true" id="3a48cfd102124a17a72c0eb3e81c8724">
        <text hooks="math"><![CDATA[
The following algorithm uses <a href="#d748c2e939724ce4a08db35933e7af69">this fact</a> to generate a new coprime. In the worst case, it runs in a linear amount of time in the length of the bit representation of %m, and it may in some cases return %m %- 1 as a result. Note that the operations below (e.g., multiplication \cdot and subtraction %-) are on <i>congruence classes</i> in \Z/%m\Z and not on integers.
<ol style="list-style-type:none;">
  <li><b>inputs:</b> positive integer %m \in \N</li>
  <li>
    <ol style="list-style-type:none; margin-left:-12px;">
      <li>%p := any number in {3,...,%m-1}</i></li>
      <li><b>while</b> %p %- 1 and %m are not coprime
        <ol style="list-style-type:none; margin-left:-12px;">
          <li>%p := %p \cdot \gcd(%p %- 1, %m)</li>
        </ol>
      </li>
      <li><b>return</b> %p %- 1</li>
    </ol>
  </li>    
</ol>
Suppose that during the %ith iteration of the algorithm, we have %p_{%i}. This algorithm works by "moving" the factors shared by %m and that iteration's %p_{%i} %- 1 quantity into %p<sub>%i+1</sub>, thus ensuring %m and %p<sub>%i+1</sub> in the subsequent iteration do share that factor (thus ensuring by <a href="#d748c2e939724ce4a08db35933e7af69">this fact</a> that %m and %p<sub>%i+1</sub> %- 1 in the next iteration <i>do not</i> share it).
        ]]></text>
      </algorithm>
      <fact required="true" id="135ad791f7d2406db11b709d04f03f63">
        <text hooks="math"><![CDATA[
Suppose that we have some %m \in \N, and that we choose some %b \in {2,...,%m-1} such that %b > %m/2. Then it is guaranteed that:
\begin{eqnarray}
  \gcd(%m, %b) & \lt & %b
\end{eqnarray}
To see why, consider that if \gcd(%m, %b) = %b, this would mean that there exists some %k \geq 2 such that %b \cdot %k = %m, and this would mean that:
\begin{eqnarray}
  %b \cdot 2 & \leq & %m \\
  %b & \leq & %m/2
\end{eqnarray}
This contradicts our assumption that %b > %m/2, so it must be that \gcd(%m, %b) < %b. We can then further conclude that:
\begin{eqnarray}
  %b / \gcd(%m, %b) & \gt & 1
\end{eqnarray}
Thus, <i>if</i> \gcd(%m, (%b / \gcd(%m, %b))) = 1, this provides a way to find a number that is greater than 1 and coprime with %m. <b style="color:firebrick;">However, this is not guaranteed to work every time because it may still be that \gcd(%m, (%b / \gcd(%m, %b))) > 1. Under those conditions, the options would be to try a different %b, or to use a different technique.</b>
        ]]></text>
      </fact>
      <text hooks="math"><![CDATA[
At this point, we can define an improved random number generation algorithm that works for any upper bound.
      ]]></text>
      <algorithm required="true" id="df42e88c1fcd11e3831ff23c91aec05e">
        <text hooks="math"><![CDATA[
The following is another variant of a simple random number generation algorithm.
<ol style="list-style-type:none;">
  <li><b>inputs:</b> upper bound %m \in \N, index %i \in {0,...,%m-1}</li>
  <li>
    <ol style="list-style-type:none; margin-left:-12px;">
     <li>%a := number in {2,...,%m-1} s.t. %a and %m are coprime <i>(always the same %a for an %m)</i></li>
     <li><b>return</b> (%a \cdot %i) \mod %m</li>
    </ol>
  </li>    
</ol>
        ]]></text>
      </algorithm>
      <text hooks="math"><![CDATA[
This algorithm has a more subtle flaw: poor choices of %a (e.g., very small values such as 2) result in a very predictable "random" sequence. It is preferable to choose an %a that is coprime with the upper bound %m, and that falls somewhere between the middle and the upper quarter of the range {0,...,%m-1} (i.e., between 0.5 \cdot %m and 0.75 \cdot %m).
      ]]></text>
      <algorithm required="true" id="e0ff1c992c6149df8a4c1f742bb55b00">
        <text hooks="math"><![CDATA[
In this variant, the algorithm attempts to find a coprime that is as close as possible to (4/7) \cdot %m. The value 4/7 is chosen in an ad hoc manner in this example. Other values in the range between 1/2 and 3/4 might also produce "nice"-looking results.
<ol style="list-style-type:none;">
  <li><b>inputs:</b> upper bound %m \in \N, index %i \in {0,...,%m-1}</li>
  <li>
    <ol style="list-style-type:none; margin-left:-12px;">
      <li>%b := number in {2,...,%m-1} s.t. %b and %m are coprime</li>
      <!--<li>%b := number in {\lfloor 0.5 \cdot %m \rfloor, ..., \lfloor 0.75 \cdot %m \rfloor} s.t. %b and %m are coprime</li>-->
      <li>
        <b>for</b> possible powers %k in the range 1 to the bit length of %m
        <ol style="list-style-type:none; margin-left:-12px;">
          <li>%a := power %b^{%k} of %b that is as close as possible to ((4/7) \cdot %m)</li>
        </ol>
      </li>
      <li><b>return</b> (%a \cdot %i) \mod %m</li>
    </ol>
  </li>
</ol>
        ]]></text>
      </algorithm>
      <text hooks="math"><![CDATA[
<!--We introduce another useful fact about greatest common divisors. Notice that the above fact suggests one possible way to build a prime number generator: for a product %p of known prime numbers, it is guaranteed that %p+1 shares no factors with %p, so any prime factors it has must be new.-->
However, the above algorithm is not ideal, and common random number generators found in standard libraries (such as the <a href="http://en.wikipedia.org/wiki/Linear_congruential_generator">linear congruential generator</a>) use a slightly different fact about permutations that results in sequences that appear yet more "random". So far, we have learned enough to build a simplified version of a linear congruential generator in which the "multiplier" is one modulo the modulus (it happens to be a very simple extension of our existing <a href="#e0ff1c992c6149df8a4c1f742bb55b00">permutation-based random number generator</a>).
        ]]></text>
      <fact required="true" id="9e7a019d05154ba0b8e71ad59d57ad0b">
        <text hooks="math"><![CDATA[
For any %m \in \N, for any %s \in \Z/%m\Z, the relation {(%i, %i + %s) | %i \in \Z/%m\Z} is a permutation. Note that this permutation merely "shifts" all the congruence classes up by %s (wrapping around through %m \equiv 0 any values that exceed %m %- 1).
        ]]></text>
      </fact>
      <algorithm required="true" title="simplified linear congruential generator" id="9e7a019d05154ba0b8e71ad59d57ad0c">
        <text hooks="math"><![CDATA[
Below is a simplified version of a linear congruential generator (in which the "multiplier" is one modulo the modulus).
<ol style="list-style-type:none;">
  <li><b>inputs:</b> upper bound %m \in \N, index %i \in {0,...,%m-1}</li>
  <li>
    <ol style="list-style-type:none; margin-left:-12px;">
      <li>%a := number in {2,...,%m-1} s.t. %a and %m are coprime <i>(with the same additional preferences found in <a href="#e0ff1c992c6149df8a4c1f742bb55b00">this algorithm</a>)</i></li>
      <li>%s := number in {1,...,%m-1} <i>(ideally, this number is different for each input %m)</i></li>
      <li><b>return</b> (%a \cdot %i + %s) \mod %m</li>
    </ol>
  </li>
</ol>
        ]]></text>
      </algorithm>
      <text hooks="math"><![CDATA[
The fully generalized linear congruential generator has a few drawbacks if we want to construct an implementation that satisfies our desired criteria (i.e., full coverage of the domain \Z/%m\Z, no repetition, and the ability to compute the %ith random number in the sequence with a small, constant number of arithmetic operations). In particular, we would need to find an additional "multiplier" %k \in {2,...,%m %- 1} such that %k %- 1 shares all prime factors and factors of 4 with %m (this is difficult to guarantee without the prime factorization of %m).
      ]]></text>
      <algorithm title="linear congruential generator" id="9e7a019d05154ba0b8e71ad59d57ad0d">
        <text hooks="math"><![CDATA[
Below is the implementation of a linear congruential generator. Note that it makes a recursive call to itself.
<ol style="list-style-type:none;">
  <li><b>inputs to LCG:</b> upper bound %m \in \N, index %i \in {0,...,%m-1}</li>
  <li>
    <ol style="list-style-type:none; margin-left:-12px;">
      <li>%a := number in {2,...,%m-1} s.t. %a and %m are coprime</li>
      <li>%s := number in {1,...,%m-1} s.t. %s and %m are coprime</li>
      <li>%k := number in {1,...,%m-1} s.t. %k %- 1 shares all prime factors and factors of 4 with %m</li>
      <li><b>if</b> %i = 0 <b>then</b> <b>return</b> %s</li>
      <li><b>else</b> <b>return</b> (%k \cdot <b>LCG(</b>%m, %i %- 1<b>)</b> + %a) \mod %m</li>
    </ol>
  </li>
</ol>
        ]]></text>
      </algorithm>
      <text hooks="math"><![CDATA[
Under circumstances in which the modulus satisfies predetermined criteria (e.g., it is of the form %m = 2<sup>%t</sup> for some %t \in \N), it is easier to obtain an appropriate %k. However, to determine the %ith number in the sequence we would also need to either (1) maintain a counter in memory to keep track of the index of the current random number in the sequence, (2) compute a fairly large sum, or (3) perform an iterative loop or recursive chain of calls (as in the <a href="#9e7a019d05154ba0b8e71ad59d57ad0d">above implementation</a>).
      ]]></text>
    </subsection>
    <subsection title="Generating prime numbers">
      <text hooks="math"><![CDATA[
Many applications require the generation of new primes. We have already seen a simple example in which generating new random sequences required prime numbers. Another important class of applications with this requirement are cryptographic schemes and protocols. In this section, we consider the problem of generating prime numbers, and in particular, random prime numbers in a particular range.
      ]]></text>
      <algorithm required="true" id="827ed3727bfa4101ba742d38f6751d91">
        <text hooks="math"><![CDATA[
There exists a simple algorithm that is guaranteed to generate a new prime number distinct from any of its inputs, but it is not efficient. 
<ol style="list-style-type:none;">
 <li><b>inputs:</b> set of primes {%p_1 ,... , %p_{%n}}</li>
  <li>
    <ol style="list-style-type:none; margin-left:-12px;">
      <li>%n := %p_1 \cdot ... \cdot %p_{%n} + 1</li>
      <li>%F := factors of %n</li>
      <li><b>return</b> any element in %F</li>
    </ol>
 </li>
</ol>
The above algorithm must return a new prime distinct from any of the primes %p_1 ,... , %p_{%n}. To see why, consider the following:
\begin{eqnarray}
  %P & = & %p_1 \cdot ... \cdot %p_{%n} \\
  \gcd(%P, %P + 1) & = & 1\\
\end{eqnarray}
There are two possibilities: %P+1 is prime, or %P+1 is not prime. 
<ul>
 <li>If %P+1 is prime, then %P > %p_{%i} for all %i \in {1,...,%n}, so %P+1 is a new prime.</li>
 <li>If %P+1 is not prime, it cannot share any factors with %P since \gcd(%P, %P + 1) = 1, so no factors of %P+1 are in the set {%p_1 ,... , %p_{%n}}. But it must have factors, so any of these factors will be different from the primes in the input set {%p_1 ,... , %p_{%n}}.</li>
</ul>
Thus, the algorithm is a guaranteed method for generating new primes. It also constitutes a proof that there are infinitely many primes. Unfortunately, this algorithm is impractical because the new primes produced by it grow exponentially as the set of primes {%p_1 ,... , %p_{%n}} is extended with new primes returned by the algorithm.
        ]]></text>
      </algorithm>
      <text hooks="math"><![CDATA[
In practice, most algorithms that need to generate large primes for commercial applications simply choose from a range of numbers (e.g., at random) and filter out non-primes using some efficient algorithm that does not provide an absolute guarantee that the numbers that remain are all prime. As long as it is not too likely that the generated number is not a prime, this may be sufficient.
      ]]></text>
      <example required="true" id="94894af872e44fa1b814e289b3ae296a">
        <text hooks="math"><![CDATA[
Suppose we want to generate a %d-digit prime number (in decimal representation). 
The <a href="http://en.wikipedia.org/wiki/Prime_number_theorem">prime number theorem</a> states that for a given %N, the number of primes in the
range {2,...,%N} is about %N/(\ln(%N)). We can roughly estimate the number of primes with %d-digit decimal representations using
the following formula:
\begin{eqnarray}
  (10^{%d+1}-1 / \ln(10^{%d+1}-1)) - (10^{%d} / \ln(10^{%d}))
\end{eqnarray}
For %d = 8, this value is about 4,780,406, so we can roughly say that the chances that an 8-digit number chosen at random (here we are ignoring the details of what distribution is used) is prime are about:
\begin{eqnarray}
  4,780,406/((10^9 - 1) - 10^8) \approx 5.5/100
\end{eqnarray}
        ]]></text>
      </example>
      <text hooks="math"><![CDATA[
We can use our ability to generate random numbers in a specific range to build a generic algorithm template for generating prime numbers (without specifying exactly how we check that each candidate number we consider is prime).
      ]]></text>
      <algorithm required="true" id="a037752e4a104b0d863bdcb37bba62c2">
        <text hooks="math"><![CDATA[
Suppose we defined the following algorithm for generating a prime with a %d-digit representation.
<ol style="list-style-type:none;">
  <li><b>inputs:</b> %d \in \N</li>
  <li>
    <ol style="list-style-type:none; margin-left:-12px;">
      <li>
        <b>do</b>
        <ol style="list-style-type:none;">
          <li>%n := a random number from {10^{%d}, ..., 10^{%d+1}-1}</li>
        </ol>
        <b>while</b> %n is not prime
      </li>
      <li><b>return</b> %n</li>
    </ol>
  </li>
</ol>
Assuming we were choosing numbers "well" with respect to their distribution (we are being imprecise here), we could optimistically hope that
for %d = 8, the above algorithm would only need to check for primality about 20 times (since roughly 1 out of every 20 numbers it tries should be
a prime).
        ]]></text>
      </algorithm>
      <text hooks="math"><![CDATA[
It remains to define an algorithm for checking whether an arbitrary input %m \in \N is prime. We could check every number %k between 2 and \lfloor \sqrt(%m) \rfloor to see if it is a factor of %m. However, \lfloor \sqrt(%m) \rfloor still grows exponentially in the representation size of %m. For example, for an %n-bit input, an integer %m in {0,...,2^{%n}-1} which must have a representation size of at least %n bits, we have the following exponential running time:
\begin{eqnarray}
  \sqrt(%m) & = & \sqrt(2^{%n})\\
            & = & 2^{%n/2}\\
            & = & (2^{1/2})^{%n}\\
            & \approx & 1.42^{%n}
\end{eqnarray}
If we only consider primes and not any of their multiples (i.e., we apply the <a href="http://en.wikipedia.org/wiki/Sieve_of_Eratosthenes">Sieve of Eratosthenes</a> to the set {2,...,\lfloor \sqrt(%m) \rfloor}), we can decrease the number of times we check the divisibility of %m. However, we would need to do a lot of extra work to filter out the multiples of primes. Modern algorithms such as <a href="http://en.wikipedia.org/wiki/Elliptic_curve_primality_testing">ECPP</a> run in polynomial time, but in practice it is currently difficult to implement a version of these algorithms that runs quickly enough for certain applications (or doesn't consume too much power, such as when it runs on mobile devices).

<!-- 
Consider the application of generating random sequences. If the number %m is chosen from the range {2,...,65536}, then depending on the distribution, the chance of choosing a prime %m is about 1/11. If for a given application domain, it is okay that only 1/11 of the random sequences is actually a permutation (and that sequences can be of any length), this may be an acceptable solution.
-->
      ]]></text>
      <algorithm required="true" id="8a44f8446574404d85e249644f019b3c">
        <text hooks="math"><![CDATA[
Given the above considerations, we introduce a modified algorithm.
<ol style="list-style-type:none;">
  <li><b>inputs:</b> %d \in \N</li>
  <li>
    <ol style="list-style-type:none; margin-left:-12px;">
      <li>
        <b>do</b>
        <ol style="list-style-type:none;">
          <li>%n := a random number from {10<sup>%d-1</sup>, ..., 10^{%d}-1}</li>
        </ol>
        <b>while</b> %n is not <i><b>probably prime</b></i>
      </li>
      <li><b>return</b> %n</li>
    </ol>
  </li>
</ol>
It remains to define a subroutine for checking whether a number is <i>probably</i> prime (for some appropriate definition of "probably") that is very efficient.
        ]]></text>
      </algorithm>
    </subsection>
    <subsection title="Detecting probable prime numbers">
      <text hooks="math"><![CDATA[
In this subsection, we consider the problem of defining a very efficient algorithm to check whether a positive integer %m \in \N is prime. In fact, the algorithm we consider will be detectors of <i>some</i>, but not all, <i>composite</i> numbers.
      ]]></text>
      <fact required="true" id="eebfb3f460ca4280b0709ee23b5e9c98">
        <text hooks="math"><![CDATA[
For any %n \in \N, %n is <i>composite</i> iff %n > 1 and it is not the case that %n is prime.
        ]]></text>
      </fact>
      <text hooks="math"><![CDATA[
That is, the algorithms we consider recognizes prime numbers but with false positives. They only guarantee that there are no false negatives (i.e., if the algorithm outputs that its input is <i>composite</i>, then it is indeed composite; otherwise, the number may or may not be prime and we call it <i>probably prime</i> because we were not able to detect that it is composite). First, consider how an algorithm for checking primality that never has a "false" output behaves:
      ]]></text>
      <table id="5a3084c085aa11e5af63feff819cdc9f" hooks="math"><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>algorithm input</b></td>
  <td><b>algorithm output</b></td>
  <td><b>meaning</b></td>
  <td><b>description</b></td>
 </tr>
 <tr> 
  <td>actually a composite number<br/>(this is not known at time of input)</td>
  <td>composite</td>
  <td>the input is composite</td>
  <td>true negative</td>
 </tr>
 <tr> 
  <td>actually a prime number<br/>(this is not known at time of input)</td>
  <td>prime</td>
  <td>the input is prime</td>
  <td>true positive</td>
 </tr>
</table>
      ]]></table>
      <text hooks="math"><![CDATA[
Compare the above table to the following table describing three possible conditions (and one forbidden condition) for an algorithm that detects probable primes.
      ]]></text>
      <table id="5a308bfa85aa11e5af63feff819cdc9f" hooks="math"><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>algorithm input</b></td>
  <td><b>algorithm output</b></td>
  <td><b>meaning</b></td>
  <td><b>description</b></td>
 </tr>
 <tr> 
  <td>actually a composite number<br/>(this is not known at time of input)</td>
  <td>composite</td>
  <td>the input is<br/>definitely composite</td>
  <td>true negative</td>
 </tr>
 <tr> 
  <td>actually a composite number<br/>(this is not known at time of input)</td>
  <td>probably prime</td>
  <td>the input is either<br/>composite or prime</td>
  <td>false positive</td>
 </tr>
 <tr> 
  <td>actually a prime number<br/>(this is not known at time of input)</td>
  <td>probably prime</td>
  <td>the input is either<br/>composite or prime</td>
  <td>true positive</td>
 </tr>
 <tr> 
  <td>actually a prime number<br/>(this is not known at time of input)</td>
  <td>composite</td>
  <td><b style="color:firebrick">impossible</b></td>
  <td>false negative<br/>(we will not consider algorithms<br/>that return such outputs)</td>
 </tr>
</table>
      ]]></table>
      <text hooks="math"><![CDATA[
Below is a comparison of the outputs of four possible probable prime algorithms on inputs in the range {2,...,10} \subset \N.
      ]]></text>
      <table id="5a30801a85aa11e5af63feff819cdc9f" hooks="math"><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>input<br/>number</b></td>
  <td><b>perfect<br/>algorithm</b></td>
  <td><b>perfect probable<br/>prime algorithm</b></td>
  <td><b>less accurate<br/>probable prime<br/>algorithm</b></td>
  <td><b>very inaccurate<br/>probable prime<br/>algorithm</b></td>
 </tr>
 <tr> 
  <td>2</td>
  <td>prime</td>
  <td>probably<br/>prime</td>
  <td>probably<br/>prime</td>
  <td>probably<br/>prime</td>
 </tr>
 <tr> 
  <td>3</td>
  <td>prime</td>
  <td>probably<br/>prime</td>
  <td>probably<br/>prime</td>
  <td>probably<br/>prime</td>
 </tr>
 <tr> 
  <td>4</td>
  <td>composite</td>
  <td>composite</td>
  <td><b style="color:firebrick;">probably<br/>prime</b></td>
  <td><b style="color:firebrick;">probably<br/>prime</b></td>
 </tr>
 <tr> 
  <td>5</td>
  <td>prime</td>
  <td>probably<br/>prime</td>
  <td>probably<br/>prime</td>
  <td>probably<br/>prime</td>
 </tr>
 <tr> 
  <td>6</td>
  <td>composite</td>
  <td>composite</td>
  <td>composite</td>
  <td><b style="color:firebrick;">probably<br/>prime</b></td>
 </tr>
 <tr> 
  <td>7</td>
  <td>prime</td>
  <td>probably<br/>prime</td>
  <td>probably<br/>prime</td>
  <td>probably<br/>prime</td>
 </tr>
 <tr> 
  <td>8</td>
  <td>composite</td>
  <td>composite</td>
  <td><b style="color:firebrick;">probably<br/>prime</b></td>
  <td><b style="color:firebrick;">probably<br/>prime</b></td>
 </tr>
 <tr> 
  <td>9</td>
  <td>composite</td>
  <td>composite</td>
  <td>composite</td>
  <td>probably<br/>prime</td>
 </tr>
 <tr> 
  <td>10</td>
  <td>composite</td>
  <td>composite</td>
  <td><b style="color:firebrick;">probably<br/>prime</b></td>
  <td><b style="color:firebrick;">probably<br/>prime</b></td>
 </tr>
</table>
      ]]></table>
      <algorithm required="true" id="60a6cf85bbe346698366c3594e880fc4">
        <text hooks="math"><![CDATA[
We now define our first algorithm for testing whether a number is <i>probably</i> prime.
<ol style="list-style-type:none;">
 <li><b>inputs:</b> %m \in \N, %k \in \N</li>
 <li>
    <ol style="list-style-type:none; margin-left:-12px;">
      <li>
        <b>repeat</b> %k times:
        <ol style="list-style-type:none;">
          <li>%a := a random number from {2,...,%m-1}</li>
          <li><b>if</b> %a | %m <b>then return</b> <b><i>composite</i></b></li>
        </ol>
      </li>
      <li><b>return</b> <b><i>probably prime</i></b></li>
    </ol>
  </li>
</ol>
        ]]></text>
      </algorithm>
      <text hooks="math"><![CDATA[
Notice that the above algorithm will <i>never</i> say that a prime number is actually composite. If it does not find a factor of %m because it did not run for sufficiently many iterations, then it will indicate that %m is probably prime. Thus, it will have no false negatives (i.e., an incorrect output indicating a prime number is composite).
      ]]></text>
      <algorithm required="true" id="2be21cdbefdb422e821e8291f5575316">
        <text hooks="math"><![CDATA[
We now define another algorithm for testing whether a number is probably prime.
<ol style="list-style-type:none;">
 <li><b>inputs:</b> %m \in \N, %k \in \N</li>
 <li>
    <ol style="list-style-type:none; margin-left:-12px;">
      <li>
        <b>repeat</b> %k times:
        <ol style="list-style-type:none;">
          <li>%a := a random number from {2,...,%m-1}</li>
          <li><b>if</b> %a | %m <b>then return</b> <b><i>composite</i></b></li>
          <li><b>if</b> gcd(%a,%m) \neq 1 <b>then return</b> <b><i>composite</i></b></li>
        </ol>
      </li>
      <li><b>return</b> <b><i>probably prime</i></b></li>
    </ol>
  </li>
</ol>
        ]]></text>
      </algorithm>
      <text hooks="math"><![CDATA[
The above algorithm is interesting because by using the \gcd operation, we get more value out of each random number we try. In fact, the \gcd operation runs in polynomial time but tells us if the intersection between the two sets of factors (the factors of %a and the factors of %m) contains any numbers. Checking this intersection using the naive approach would take exponential time.
      ]]></text>
      <paragraph hooks="math"><![CDATA[
The above algorithm is somewhat problematic if we want to have a good idea of how to set %k given our desired level of confidence in the output. For example, how high should %k be so that the probability that we detect a composite is more than 1/2? If we require that %k \approx \sqrt(%m) to be sufficiently confident in the output, we might as well use the brute force method of checking every %a \in {2,..., \lfloor \sqrt(%m) \rfloor}.
      ]]></paragraph>
<!-- If we do no filtering, one drawback of this approach is that if %m is composite, in the worst case we may find only one factor in the set {2,...,\lfloor \sqrt(%m) \rfloor}. In other words, for some %m, the probability of detecting that %m is composite by choosing some candidate factor in {2,...,\lfloor \sqrt(%m) \rfloor} uniformly at random is about 1/\sqrt(%m). Note that \sqrt(%m) grows exponentially with the representation size of %m. -->
      <paragraph hooks="math"><![CDATA[
To define a more predictable testing approach for our algorithm, we derive a theorem that is frequently used in applications of modular arithmetic (in fact, this fact underlies the prime number generators found in many software applications).
      ]]></paragraph>
      <fact required="true" title="Fermat's little theorem" id="e7d7dd05b62144f1a68b78d34d9e268a">
        <text hooks="math"><![CDATA[
For any %p \in \N, for any %a \in {1,...,%p-1}, if %p is prime then it is true that:
\begin{eqnarray}
 %a^{%p-1} & \equiv & 1 (\mod %p)
\end{eqnarray}
        ]]></text>
      </fact>
      <text hooks="math"><![CDATA[
We have already shown that if %p is a prime then %R defined as below is a permutation:
\begin{eqnarray}
 %R & = & { (1, (1 \cdot %a) \mod %p), (2, (2 \cdot %a) \mod %p), ..., (%p-1, ((%p-1) \cdot %a) \mod %p) } \\
    & = & { (%i, (%i \cdot %a) \mod %p) | %i \in {1,...,%p-1} }
\end{eqnarray}
Next, to make our notation more concise, note that:
\begin{eqnarray}
1 \cdot 2 \cdot ... \cdot %p-1 & = & (%p - 1)! \\
(1 \cdot %a) \cdot (2 \cdot %a) \cdot ... \cdot ((%p-1) \cdot %a) & = & %a^{%p-1} (%p - 1)! \\
\end{eqnarray}
Recall that %p is prime, so %p does not divide (%p - 1)!. Thus, we can divide by (%p - 1)! both sides of the following equation:
\begin{eqnarray}
  %a^{%p-1} (%p - 1)! & \equiv & 1 \cdot (%p - 1)!  \\
  %a^{%p-1} & \equiv & 1 \\
\end{eqnarray}
We now have derived the statement of Fermat's little theorem.
      ]]></text>
      <fact required="true" id="53ffd37ae6c747b6a590a84d8cc055c7">
        <text hooks="math"><![CDATA[
A number %p \in \N is prime iff %p > 1 and for all %a \in {1,...,%p-1}, %a^{%p-1} \mod %p = 1. 
        ]]></text>
      </fact>
      <text hooks="math"><![CDATA[
If we negate the statement above, we can define when a number is composite (i.e., when it is not prime) in a way that suggests a straightforward algorithm.
      ]]></text>
      <definition required="true" id="070ad746bee940ca8647860f3bd5e196">
        <text hooks="math"><![CDATA[
A number %m \in \N is composite iff %m > 1 and there exists %a \in {1,...,%m-1} such that %a^{%m-1} \mod %m \neq 1. In this case, %a is a <i>Fermat witness</i> to the compositeness of %m. 
        ]]></text>
      </definition>
      <definition required="true" id="e5302390c3de475392688a60f235c652">
        <text hooks="math"><![CDATA[
If for composite %m \in \N and %a \in {1,...,%m-1}, we have that %a^{%m-1} \mod %m = 1, then %a is a <i>Fermat liar</i> and %m is a <i>pseudoprime</i> with respect to %a.
        ]]></text>
      </definition>
      <algorithm required="true" title="Fermat primality test" id="458a8c0d2a934388ade43c11e27bb3e5">
        <text hooks="math"><![CDATA[
We now extend our algorithm. The following algorithm can be used to test whether a number is probably prime.
<ol style="list-style-type:none;">
 <li><b>inputs:</b> %m \in \N, %k \in \N</li>
 <li>
    <ol style="list-style-type:none; margin-left:-12px;">
      <li>
        <b>repeat</b> %k times:
        <ol style="list-style-type:none;">
          <li>%a := a random number from {2,...,%m-1}</li>
          <li><b>if</b> %a | %m <b>then return</b> <b><i>composite</i></b></li>
          <li><b>if</b> gcd(%a,%m) \neq 1 <b>then return</b> <b><i>composite</i></b></li>
          <li><b>if</b> %a^{%m-1} \mod %m \neq 1 <b>then return</b> <b><i>composite</i></b></li>
        </ol>
      </li>
      <li><b>return</b> <b><i>probably prime</i></b></li>
    </ol>
  </li>
</ol>
If %m is a prime, the above algorithm will always return <b><i>probably prime</i></b>.
        ]]></text>
      </algorithm>
      <text hooks="math"><![CDATA[
For any given candidate %a in the above algorithm, if the first test fails and gcd(%a,%m) \neq 1 then %a is a factor of %m. Thus, in the worst case, the first is gcd(%a,%m) = 1 for all %k instances of %a that we consider. How many of these %k instances must pass the second test before we are confident that %m is prime? In fact, for most composite numbers %m, %k can be very low. 
      ]]></text>
      <fact required="true" id="174796f17f4347899dcfe1e88b8f3836">
        <text hooks="math"><![CDATA[
If for a composite %m \in \Z there is at least one Fermat witness %a \in {2,...,%m-1} such that \gcd(%a,%m) = 1, then at least half of all %a such that gcd(%a,%m) = 1 are Fermat witnesses.
        ]]></text>
      </fact>
      <text hooks="math"><![CDATA[
Suppose that %a is a Fermat witness and %a_1,...,%a_{%n} are distinct Fermat liars. Then for every Fermat liar %a_{%i} we have that:
\begin{eqnarray}
  (%a \cdot %a_{%i})^{%m-1} & \equiv & %a^{%m-1} \cdot %a_{%i}^{%m-1} (\mod %m)\\
                          & \equiv & %a^{%m-1}
\end{eqnarray}
But %a is a Fermat witness, so %a^{%m-1} \mod %m \neq 1. Thus, (%a \cdot %a_{%i})^{%m-1} \mod %m \neq 1, so %a \cdot %a_{%i} is also Fermat witness. Furthermore, for any two distinct Fermat liars %a_{%i} and %a_{%j} we have by the <a href="#c32b1fae4f5d4abb997c85429ae85976">generalized Euclid's lemma</a> and the fact that %a_{%i}, %a_{%j}, and %a are all coprime with %m:
\begin{eqnarray}
         %a_{%i}  & \not\equiv & %a_{%j} (\mod %m)\\
   %a \cdot %a_{%i} & \not\equiv & %a \cdot %a_{%j} 
\end{eqnarray}
Since there is a witness for every liar, there are at least as many witness as liars, so at least half the values are witnesses. How many numbers %m have at least one Fermat witness? Equivalently, how many numbers have no Fermat witnesses?
      ]]></text>
      <definition required="true" id="eeab7ca11623443fb659f40a7eb5a24c">
        <text hooks="math"><![CDATA[
For any %m \in \Z, if %m has no <b>coprime</b> Fermat witnesses, then %m is a <i>Carmichael number</i>, also known as a <i>Fermat pseudoprime</i>.
        ]]></text>
      </definition>
      <text hooks="math"><![CDATA[
The distribuation of Carmichael numbers is high enough that the Fermat primality test is usually not used in favor of slightly more complex tests for probable primes. However, those tests follow a similar principle. The Fermat primality test is used in some deployed software applications (such as <a href="http://en.wikipedia.org/wiki/Pretty_Good_Privacy">PGP</a>).
      ]]></text>
      <table id="9a8946464b8f45cb9c639a60e1a26e4d" hooks="math"><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>for the chosen<br/>%a we have...</b></td>
  <td><b>what it means</b></td>
  <td><b>probability of this occurring<br/>if %m is a non-Carmichael composite</b></td>
 </tr>
 <tr> 
  <td>%a | %m</td>
  <td>%a is a non-trivial factor of %m,<br/>so %m is composite</td>
  <td>(# integers in {2,...,%m-1} that are factors with %m) / (%m-2)</td>
 </tr>
 <tr> 
  <td>gcd(%a,%m) \neq 1</td>
  <td>%m and %a have a non-trivial factor,<br/>so %m is composite</td>
  <td>(# integers in {2,...,%m-1} that share factors with %m) / (%m-2)</td>
 </tr>
 <tr> 
  <td>%a^{%m-1} \mod %m \neq 1</td>
  <td>%a is a Fermat witness<br/>that %m is composite</td>
  <td>at least 1/2</td>
 </tr>
</table>
      ]]></table>
      <text hooks="math"><![CDATA[
We can consider a particular example input for the primality test to see how each successive check in the algorithm can extract valuable information about whether the input is composite. The following table is for %m = 15.
      ]]></text>
      <table id="ff818b0a078b4d9fb948e6e1e2e11a86" hooks="math"><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>%m = 15 and %a = ...</b></td>
  <td>2</td>
  <td>3</td>
  <td>4</td>
  <td>5</td>
  <td>6</td>
  <td>7</td>
  <td>8</td>
  <td>9</td>
  <td>10</td>
  <td>11</td>
  <td>12</td>
  <td>13</td>
  <td>14</td>
 </tr>
 <tr>
  <td><b>%a | %m</b></td>
  <td>PP</td>
  <td><b style="color:firebrick;">C</b></td>
  <td>PP</td>
  <td><b style="color:firebrick;">C</b></td>
  <td>PP</td>
  <td>PP</td>
  <td>PP</td>
  <td>PP</td>
  <td>PP</td>
  <td>PP</td>
  <td>PP</td>
  <td>PP</td>
  <td>PP</td>
 </tr>
 <tr>
  <td><b>\gcd(%a,%m) \neq 1</b></td>
  <td>PP</td>
  <td><b style="color:firebrick;">C</b></td>
  <td>PP</td>
  <td><b style="color:firebrick;">C</b></td>
  <td><b style="color:firebrick;">C</b></td>
  <td>PP</td>
  <td>PP</td>
  <td><b style="color:firebrick;">C</b></td>
  <td><b style="color:firebrick;">C</b></td>
  <td>PP</td>
  <td><b style="color:firebrick;">C</b></td>
  <td>PP</td>
  <td>PP</td>
 </tr>
 <tr>
  <td><b>%a^{%m-1} \mod %m = ...</b></td>
  <td><b style="color:firebrick;">4</b></td>
  <td><b style="color:firebrick;">9</b></td>
  <td>1</td>
  <td><b style="color:firebrick;">10</b></td>
  <td><b style="color:firebrick;">6</b></td>
  <td><b style="color:firebrick;">4</b></td>
  <td><b style="color:firebrick;">4</b></td>
  <td><b style="color:firebrick;">6</b></td>
  <td><b style="color:firebrick;">10</b></td>
  <td>1</td>
  <td><b style="color:firebrick;">9</b></td>
  <td><b style="color:firebrick;">4</b></td>
  <td>1</td>
 </tr>
</table>
      ]]></table>
      <text hooks="math"><![CDATA[
We can now summarize all the facts and algorithms we have introduced and how their relationships allow us to construct a prime number generator.
      ]]></text>
      <diagram hooks="math" id="5f90de2d6d6a4fc3ba586bb4dc80584f"><![CDATA[
<table class="container">
  <tr>
    <td></td>
    <td></td>
    <td class="box" style="background-color:#EFEFEF;">Euclid's<br/>lemma<br/>generalization</td>
    <td><span style="font-size:20px;">&lArr;</span></td>
    <td class="box" style="background-color:#EFEFEF;">multiples of<br/>coprime %a in \Z/%m\Z<br/>are a permutation</td>
    <td></td>
    <td class="box" style="background-color:#EFEFEF;">\gcd(%m,%m+1) = 1</td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td class="box" style="background-color:#EFEFEF;">Fermat's<br/>little<br/>theorem</td>
    <td></td>
    <td class="box" style="background-color:powderblue;">random<br/>number<br/>generator</td>
    <td><span style="font-size:20px;">&rArr;</span></td>
    <td class="box" style="background-color:powderblue;">coprime<br/>generator</td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td class="box" style="background-color:powderblue;">greatest<br/>common<br/>divisor<br/>algorithm</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue">Fermat<br/>primality<br/>test</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">probable<br/>prime<br/>detector</td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td class="box" style="background-color:powderblue;">probable<br/>prime<br/>generator</td>
    <td></td>
    <td></td>
  </tr>
</table>
      ]]></diagram>
    </subsection>
    <!--include sheaf="assignment-two.xml"/-->
    <subsection title="Multiplicative inverses">
      <text hooks="math"><![CDATA[
To better understand multiplicative inverses, we first review the definition of an additive inverse.
      ]]></text>
      <fact required="true" hooks="math" id="cfe9b32e947144098fec7d26a6b2ce8f"><![CDATA[
For any %m \in \N, every element in the set \Z/%m\Z has an inverse with respect to addition defined over \Z/%m\Z (i.e., an <i>additive inverse</i>).
Consider any %x \in \Z/%m\Z. Then %p %- %x \in \Z/%m\Z and
\begin{eqnarray}
  %x + (%p %- %x) & \equiv & %p (\mod %p)\\
                 & \equiv & 0
\end{eqnarray}
We denote by %-%x the additive inverse of %x.
      ]]></fact>
      <example required="true" hooks="math" id="b2e9a1cc309c465fb3a8426631b678f3">
        <text><![CDATA[
What is the additive inverse of 2 \in \Z/5\Z?
        ]]></text>
        <paragraph><![CDATA[
The additive inverse is 5 %- 2 = 3, since 2 + 3 \mod 5 = 0.
        ]]></paragraph>
      </example>
      <text hooks="math"><![CDATA[
There is more than one way to compute multiplicative inverses; in this subsection, we will present facts that will help us build algorithms for computing multiplicative inverses.
<!-- and then we will use these algorithms to build a solver for systems of equations that have solutions according to CRT.-->
      ]]></text>
      <definition required="true" hooks="math" id="441029823650410787b30f41dee9936f"><![CDATA[
Given a positive integer %m \in \N and a congruence classes %x \in \Z/%m\Z, suppose there exists a congruence class %y \in \Z/%m\Z such that:
\begin{eqnarray}
  %x \cdot %y & \equiv & 1 (\mod %m)
\end{eqnarray}
Then we say that %y is the <i>multiplicative inverse</i> of %x in \Z/%m\Z. We usually denote the multiplicative inverse of %x as %x^{-1} (as is often done for multiplicative inverses over the integers, i.e., 2^{-1} = 1/2).
      ]]></definition>
      <fact required="true" hooks="math" id="71a8e073b8f244809d2c321d5b5d2987"><![CDATA[
Let %p \in \N be a prime number, and let %a \in \Z/%p\Z. Then we know by <a href="#e7d7dd05b62144f1a68b78d34d9e268a">Fermat's little theorem</a> that:
\begin{eqnarray}
  %a^{%p-1} & \equiv & 1 (\mod %p)
\end{eqnarray}
But we can factor the above to get:
\begin{eqnarray}
  %a \cdot %a^{%p-2} & \equiv & 1 (\mod %p)
\end{eqnarray}
Thus, the multiplicative inverse of %a \in \Z/%p\Z is:
\begin{eqnarray}
  %a^{-1} & \equiv & %a^{%p-2} (\mod %p)
\end{eqnarray}
Note that:
\begin{eqnarray}
  %a \cdot %a^{-1} & \equiv & %a \cdot %a^{%p-2} (\mod %p) \\
                   & \equiv & %a^{%p-1} \\
                   & \equiv & 1
\end{eqnarray}
      ]]></fact>
      <example required="true" hooks="math" id="a5494e97868a489b95f15374cf169427"><![CDATA[
What is the multiplicative inverse of 2 \in \Z/5\Z? We can compute it as follows:
\begin{eqnarray}
  2^{-1} & \equiv & 2<sup>5-2</sup> (\mod 5) \\
         & \equiv & 2^3 \\
         & \equiv & 8 \\
         & \equiv & 3
\end{eqnarray}
We can check to confirm that this is true:
\begin{eqnarray}
  2 \cdot 3 & \equiv & 6 (\mod 5) \\
         & \equiv & 1
\end{eqnarray}
      ]]></example>
    </subsection>
    <subsection title="Chinese remainder theorem (CRT) and applications">
      <text hooks="math"><![CDATA[
In previous sections we presented facts that allowed us to solve certain individual equations with solution spaces corresponding to sets of congruence classes such as \Z/%m\Z. It is also possible to solve <i>systems of equations</i> over sets of congruence classes.
      ]]></text>
      <theorem title="Chinese remainder theorem" required="true" hooks="math" id="df42e88c1fcd11e3831ff55c91aec05e"><![CDATA[
The <i>Chinese remainder theorem</i> (CRT) states that given primes %p_1,...,%p_{%k} \in \N, for any %a_1,...,%a_{%k} \in \Z there exists a solution %x \in \Z to the system of equations:
\begin{eqnarray}
  %x mod %p_1 & = & %a_1 \\
              & \vdots & \\
  %x mod %p_{%k} & = & %a_{%k}
\end{eqnarray}
We can also state the theorem in terms of congruences. Given primes %p_1,...,%p_{%k} \in \N, for any %a_1 \in \Z/%p_1\Z, ..., %a_{%k} \in \Z/%p_{%k}\Z there exists a <i>unique</i> 
solution %x \in \Z/(%p_1 \cdot ... \cdot %p_{%k})\Z to the system of equations:
\begin{eqnarray}
  %x & \equiv & %a_1 (\mod %p_1)\\
              & \vdots & \\
  %x & \equiv & %a_{%k} (\mod %p_{%k})
\end{eqnarray}
In other words, all the solutions to the first system above are from the same congruence class of \Z/(%p_1 \cdot ... \cdot %p_{%k})\Z.
The theorem applies even if %p_1,...,%p_{%k} are only <i>relatively prime</i> or <i>coprime</i>.
      ]]></theorem>
      <example required="true" hooks="math" id="ef97b237344c4039bf3764a6ca15f1cc"><![CDATA[
Solve the following system of equations for the unique solution %x \in \Z/10\Z:
\begin{eqnarray}
  %x & \equiv & 3 (\mod 5) \\
  %x & \equiv & 0 (\mod 2)
\end{eqnarray}
We can list the integers corresponding to each congruence class and find the unique integer in {0, ..., 2 \cdot 5 - 1} that is in both lists:
\begin{eqnarray}
  3 + 5\Z & = & {..., 3, <b>8</b>, 13, <b>18</b>, 23, <b>28</b>, ...} \\
  0 + 2\Z & = & {..., 0, 2, 4, 6, <b>8</b>, 10, 12, 14, 16, <b>18</b>, 20, 22, 24, 26, <b>28</b>, ...}
\end{eqnarray}
We can compute the intersection, which should contain all the integers that satisfy both equations:
\begin{eqnarray}
  (3 + 5\Z) \cap (0 + 2\Z) & = & {..., 8, 18, 28, ...}
\end{eqnarray}
This appears to be the congruence class 8 + 10\Z. Thus, we have the unique solution:
\begin{eqnarray}
  %x & \equiv & 8 (\mod 10)
\end{eqnarray}
      ]]></example>
      <text hooks="math"><![CDATA[
The Chinese remainder theorem has many applications in a variety of contexts. In this section we present the following algorithms, which all rely on the ability to solve systems of equations involving congruence classes.
      ]]></text>
      <diagram hooks="math" id="7f05cff9e8b443688643647df9f437d4"><![CDATA[
<table class="container">
  <tr>
    <td></td>
    <td></td>
    <td class="box" style="background-color:powderblue;">efficient<br/>modular<br/>arithmetic</td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td><span style="font-size:20px;">&dArr;</span></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td class="box" style="background-color:#EFEFEF;">Chinese<br/>remainder<br/>theorem</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">CRT solver</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">range<br/>ambiguity<br/>resolution</td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td class="box" style="background-color:powderblue;">Shamir secret<br/>sharing protocol</td>
    <td></td>
    <td></td>
  </tr>
</table>
      ]]></diagram>
      <fact required="true" hooks="math" id="fa37b1eca05d47e3ae9fc97803551667"><![CDATA[
Given %a, %a \in \Z, if %a + b \in {0,...,%m-1}, then it is true that
\begin{eqnarray}
  (%a \mod %m) + (%b \mod %m) & \equiv & %a + %b (\mod %m)
\end{eqnarray}
Likewise, if %a \cdot b \in {0,...,%m-1}, then it is true that
\begin{eqnarray}
  (%a \mod %m) \cdot (%b \mod %m) & \equiv & %a \cdot %b (\mod %m)
\end{eqnarray}
      ]]></fact>
      <example title="efficient modular arithmetic" required="true" hooks="math" id="8c5dfc206bfe416489d053316a34e376">
        <text><![CDATA[
Suppose we want to perform a large number of arithmetic operations in sequence. The operations could be specified as a program that operates on a single variable and performs a sequence of variable updates that correspond to arithmetic operations, such as the example below.
\begin{eqnarray}
  %x & := & 3 \\
  %x & := & %x + 6 \\
  %x & := & %x \cdot 2 \\
  %x & := & %x %- 17 \\
  %x & := & %x + 1 \\
   & \vdots &
\end{eqnarray}
Suppose that over the course of the computation, %x might become very large (e.g., 0 \leq %x \leq 2<sup>1000000000</sup>). However, we have an additional piece of information: once the sequence of operations ends, we know that 0 \leq %x < 1024.
        ]]></text>
        <paragraph hooks="math"><![CDATA[
Given our additional information about the range of the final output, we do not need to store 1000000000 bit numbers in order to perform the computation and get a correct result. It is sufficient to instead perform all the operations in \Z/1024\Z:
\begin{eqnarray}
  %x & := & 3 \mod 1024 \\
  %x & := & (%x + 6) \mod 1024 \\
  %x & := & (%x \cdot 2) \mod 1024 \\
  %x & := & (%x %- 17) \mod 1024 \\
  %x & := & (%x + 1) \mod 1024 \\
   & \vdots &
\end{eqnarray}
The above will produce the same result in \Z/1024\Z, and we will only need 1024 bits at any single point in the computation to store each intermediate result.
        ]]></paragraph>
      </example>
      <example title="efficient &lt;i&gt;distributed&lt;/i&gt; modular arithmetic" required="true" hooks="math" id="df42e88c1fcd11e3831ff55c91aec05Z">
        <text><![CDATA[
Suppose that, as in the <a href="#8c5dfc206bfe416489d053316a34e376">previous example</a>, we want to perform a large number of arithmetic operations in sequence on large integers (e.g., in \Z/2<sup>70</sup>\Z). However, our resources may be limited. For example, we may only have a collection of processors that can each perform arithmetic on relatively small integers (e.g., in \Z/2<sup>8</sup>\Z).  Is it possible for us to perform this computation using these processors, and is it possible for us to speed up the computation by running the processors in parallel? We may assume that a single arithmetic computation in \Z/2<sup>%n</sup>\Z running on a single processor takes %n time steps to perform. 
        ]]></text>
        <paragraph><![CDATA[
Suppose we have ten processors that can perform arithmetic computations in \Z/2<sup>8</sup>\Z or any smaller space (such as \Z/2<sup>7</sup>\Z). We can approach this problem by choosing a collection of primes %p_1,...,%p_{10} such that 2^7 < %p_{%i} < 2^8, which implies that:
\begin{eqnarray}
  %p_1 \cdot ... \cdot %p_{10} & &gt; & 2^7 \cdot ... \cdot 2^7 \\
                               & \geq & 2<sup>70</sup> \\
\end{eqnarray}
We can then perform the sequence of computations modulo each of the primes %p_{%i} to obtain ten results %a_1, ..., %a_{10}. Once we obtain the results, we can apply the Chinese remainder theorem to obtain %x:
\begin{eqnarray}
  %x & = & %a_1 \mod %p_1 \\
              & \vdots & \\
  %x & = & %a_{10} \mod %p_{10}
\end{eqnarray}
Since the product of the primes is greater than 2<sup>70</sup>, the unique solution %x to the above system of equations will be the correct result of the computation. Since the processors were running in parallel, the computation was about 10 times faster than it would have been if we had performed the computation in \Z/2<sup>70</sup>\Z (or in sequence using a single processor that can perform computations in \Z/2<sup>8</sup>\Z).
        ]]></paragraph>
      </example>
      <example title="variant of range ambiguity resolution" required="true" hooks="math" id="df42e88c1fcd11e3831ff55c91aec05A">
        <text><![CDATA[
Suppose we want to build a radar or other sensing device that sends signals out and listens for reflections of those signals in order to detect the distances of obstacles in the environment. The device has a clock that counts up from 0, one integer per second. If the device sends a single signal out that travels at 1 km per second at time 0 and receives a response in 12 seconds at time 12, it knows that the distance to the object and back is 12 km.
        ]]></text>
        <paragraph><![CDATA[
However, what if we cannot wait 12 seconds or more? For example, the obstacle may be moving quickly and we want to constantly update our best guess of the distance to that object. We would need to send signals more frequently (for example, every 5 seconds). But then if an object is 12 seconds away, we would have no way to tell when running in a steady state which of the signals we just received.
        ]]></paragraph>
        <paragraph><![CDATA[
However, we can obtain some information in this scenario. Suppose we send a signal every 5 seconds, only when the clock's timer is at a multiple of 5. Equivalently, imagine the clock counts up modulo 5 (i.e., 0,1,2,3,4,0,1,2,3,4,0,...) and we only send signals when the clock is at 0. What information can we learn about the object's distance in this scenario? If the distance to the object and back is %d, then we would learn %d \mod 5, because we would get the signal back when the clock is at 0, 1, 2, 3, or 4.
        ]]></paragraph>
        <paragraph><![CDATA[
We can use multiple instances of the above device (each device using its own distinct frequency for sending signals) to build a device that can check for obstacles more frequently while not giving up too much accuracy. Pick a collection of primes %p_1,..., %p_{%n} such that their product is greater than the distance to any possible obstacle (e.g., if this is a ship or plane, we could derive this by considering the line of sight and the Earth's curvature). Take %n instances of the above devices, each with their own clock that counts in cycles through \Z/%p_{%i}\Z and sends out a signal when the clock is at 0. Running in a steady state, if at any point in time the known offsets are %a_1,...,%a_{%n}, we would know the following about the distance %d to an obstacle:
\begin{eqnarray}
  %d & \equiv & %a_1 (\mod %p_1)\\
              & \vdots & \\
  %d & \equiv & %a_{%n} (\mod %p_{%n})
\end{eqnarray}
We can then use the Chinese remainder theorem to derive the actual distance %d < %p_1 \cdot ... \cdot %p_{%n}.
        ]]></paragraph>
      </example>
      <protocol title="Shamir secret sharing" required="true" hooks="math" id="df42e88c1fcd11e3831ff55c91aec05V"><![CDATA[
Suppose there are %N participants and we want to divide some secret information among them into %N parts so that any %k or greater number of participants can reconstruct the secret information, but no subset of fewer than %k participants can reconstruct it. Let %s \in \Z be the secret information. Collect a set of randomly chosen relatively prime integers %M = {%m_1,...,%m_{%N}} such that:
<ul>
  <li>the product of any collection of at least %k integers in %M is greater than %s;</li>
  <li>the product of any collection of %k-1 integers in %M is less than %s.</li>
</ul>
Give each participant %i \in {1,...,%N} the value %s \mod %m_{%i}. Now, any number of participants %n \geq %k can use the Chinese remainder theorem to solve for %s.
      ]]></protocol>
      <text hooks="math"><![CDATA[
<b><i>Note:</i></b> There are many alternative ways to implement Shamir secret sharing. Consider the following example using curve-fitting. We choose some large %m \in \Z, and then randomly select integers %c_1,...,%c_{%k} \in \Z/%m\Z. We then use these integers as coefficients in a polynomial:
\begin{eqnarray}
  %f(%x) & = & %s + %c_1 %x + %c_2 %x^2 + ... + %c_{%k} %x^{%k}
\end{eqnarray}
Each participant %i \in {1,...,%N} is given %f(%i). Any %k participants can now use curve-fitting techniques or techniques for solving collections of equations (e.g., computing the reduced row echelon form of a matrix) to determine all the coefficients of %f and, thus, solve for %s.
      ]]></text>
    </subsection>
    <subsection title="Solving systems of equations with CRT solutions using multiplicative inverses">
      <text hooks="math"><![CDATA[
The Chinese remainder theorem guarantees that a unique solution exists to particular systems of equations involving congruence classes. But can these solutions be computed automatically and efficiently? In fact, they can. However, computing such solutions requires the ability to compute multiplicative inverses in \Z/%m\Z.
      ]]></text>
      <diagram hooks="math" id="c5f0b09e028040c7af8365fdc25c711a"><![CDATA[
<table class="container">
  <tr>
    <td></td>
    <td></td>
    <td class="box" style="background-color:powderblue;">greatest<br/>common<br/>divisor<br/>algorithm</td>
    <td></td>
    <td class="box" style="background-color:#EFEFEF;">Fermat's<br/>little<br/>theorem</td>
    <td></td>
    <td class="box" style="background-color:#EFEFEF;">Euler's<br/>theorem</td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
  </tr>
  <tr>
    <td class="box" style="background-color:#EFEFEF;">B&eacute;zout's<br/>identity</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">extended<br/>Euclidean<br/>algorithm</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">algorithm for<br/>finding<br/>multiplicative<br/>inverses</td>
    <td><span style="font-size:20px;">&rArr;</span></td>
    <td class="box" style="background-color:powderblue;">Euler's<br/>totient<br/>function &phi;</td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td class="box" style="background-color:#EFEFEF;">Chinese<br/>remainder<br/>theorem</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">CRT solver<br/>for two<br/>equations</td>
    <td></td>
    <td></td>
  </tr>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td class="box" style="background-color:#EFEFEF;">induction</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">CRT solver<br/>for %n<br/>equations</td>
    <td></td>
    <td></td>
  </tr>
</table> 
      ]]></diagram>
      <text hooks="math"><![CDATA[
How is computing multiplicative inverses related to solving systems of equations that have solutions according to CRT? Consider the following example.
      ]]></text>  
      <example required="true" hooks="math" id="a4c6d191713e4f3e83019aa63b86e883"><![CDATA[
Suppose we want to solve the following system of equations:
\begin{eqnarray}
  %x & \equiv & 1 (\mod 5)\\
  %x & \equiv & 0 (\mod 4)
\end{eqnarray}
The above two equations are constraints on the integers that can be in the congruence class %x. One way to state these constraints in English is: "%x must be a multiple of 4, and %x must be in 1 + 5\Z". But then we can rewrite the above as a single equation:
\begin{eqnarray}
  4 \cdot %y & \equiv & 1 (\mod 5)\\
\end{eqnarray}
Then, we only need to solve for %y, and let %x = 4 \cdot %y. What is %y? The above equation implies that %y is the multiplicative inverse of 4 in \Z/5\Z. Thus, we can compute:
\begin{eqnarray}
  %y & \equiv & 4^{-1} (\mod 5)\\
         & \equiv & 4<sup>5-2</sup> (\mod 5)\\
         & \equiv & 4^3 \\
         & \equiv & 64 \\
         & \equiv & 4
\end{eqnarray}
Thus, the multiplicative inverse of 4 in \Z/5\Z is itself. Plugging %y into %x = 4 \cdot %y gives us 16. Thus, we know by CRT that we have our unique solution in \Z/(4 \cdot 5)\Z = \Z/20\Z:
\begin{eqnarray}
  %x & \equiv & 16 (\mod 20)
\end{eqnarray}
      ]]></example>
      <text hooks="math"><![CDATA[
The above example suggests that we can solve certain pairs of equations with CRT solutions if one of the congruence classes is 0 and the other 1. What if the other congruence class is not 1?
      ]]></text>
      <example required="true" hooks="math" id="6eeacc649d97481883bdb5ac89749d74"><![CDATA[
Suppose we want to solve the following system of equations for %x \in \Z/15\Z:
\begin{eqnarray}
  %x & \equiv & 4 (\mod 5) \\
  %x & \equiv & 0 (\mod 3)
\end{eqnarray}
We can observe that we want some %x that is a multiple of 3 and is in 4 + 5\Z. We can set %x = 3 \cdot %y for some %y, and then we want to solve the following for %y \in \Z/5\Z:
\begin{eqnarray}
  3 \cdot %y & \equiv & 4 (\mod 5)
\end{eqnarray}
Using <a href="#71a8e073b8f244809d2c321d5b5d2987">Fermat's little theorem</a>, we can compute the multiplicative inverse of 3 \in \Z/5\Z:
\begin{eqnarray}
  3<sup>5-1</sup> & \equiv & 1 (\mod 5) \\
  3<sup>5-1</sup> \cdot 3^{-1} & \equiv & 1 \cdot 3^{-1}  \\
  3<sup>(5-1)-1</sup> & \equiv & 3^{-1}  \\
  3<sup>5-2</sup> & \equiv & 3^{-1}  \\
  3<sup>3</sup> & \equiv & 3^{-1}  \\
  27 & \equiv & 3^{-1}  \\
  2 & \equiv & 3^{-1}
\end{eqnarray}
Thus, we know that the multiplicative inverse of 3 \in \Z/5\Z is 2, and we have that 2 \cdot 3 \equiv 1 (\mod 5).  Notice that 4 \equiv 4 \cdot 1 (\mod 5):
\begin{eqnarray}
  3 \cdot %y & \equiv & 4 (\mod 5) \\
  3 \cdot %y & \equiv & 4 \cdot 1 (\mod 5)
\end{eqnarray}
Since 1 \equiv 2 \cdot 3 (\mod 5), we can substitute:
\begin{eqnarray}
  3 \cdot %y & \equiv & 4 \cdot (3 \cdot 2) (\mod 5)
\end{eqnarray}
We can cancel 3 on both sides using <a href="#77c204e590044e8e95177a2582ad1abf">Euclid's lemma</a> (since 5 is prime) or <a href="#c32b1fae4f5d4abb997c85429ae85976">Euclid's generalized lemma</a> (since 3 and 5 are coprime):
\begin{eqnarray}
  %y & \equiv & 4 \cdot 2 (\mod 5) \\
  %y & \equiv & 8 \\
  %y & \equiv & 3
\end{eqnarray}
Since we originally set %x = 3 \cdot %y, we can now substitute and solve for %x \in \Z/15\Z:
\begin{eqnarray}
  %x & \equiv & 3 \cdot %y (\mod 15) \\
  %x & \equiv & 3 \cdot 3 \\
  %x & \equiv & 9 \\
  %x & \equiv & 9
\end{eqnarray}
Thus, %x \equiv 9 (\mod 15) is a solution to our equation. We can confirm this:
\begin{eqnarray}
  9 & \equiv & 4 (\mod 5) \\
  9 & \equiv & 0 (\mod 3)
\end{eqnarray}
      ]]></example>
      <example required="true" hooks="math" id="a089f48b8d764402873ead43c6e65d34"><![CDATA[
Note that what we actually did in the <a href="#6eeacc649d97481883bdb5ac89749d74">previous example</a> when we cancelled 3 \in \Z/5\Z on both sides is that we <i>multiplied both sides by the multiplicative inverse of 3 \in \Z/5\Z</i>. Suppose we knew that the multiplicative inverse of 3 \in \Z/5\Z is 2. We can use this information to help us solve the following equation:
\begin{eqnarray}
  3 \cdot %x & \equiv & 2 (\mod 5)
\end{eqnarray}
We multiply both sides by 3^{-1} \equiv 2 (\mod 5):
\begin{eqnarray}
  3^{-1} \cdot 3 \cdot %x & \equiv & 3^{-1} \cdot 2 (\mod 5) \\
  %x & \equiv & 2 \cdot 2 \\
  %x & \equiv & 4
\end{eqnarray}
Notice that we have now reduced the problem of solving an equation with a single coefficient before %x into the problem of finding the multiplicative inverse of the coefficient.
      ]]></example>
      <example required="true" hooks="math" id="a63d7bd9d51f478093900fd31f9c700a"><![CDATA[
Suppose we want to solve the following system of equations:
\begin{eqnarray}
  %x & \equiv & 0 (\mod 11)\\
  %x & \equiv & 4 (\mod 7)
\end{eqnarray}
The above equations require that %x \in \Z/77\Z be divisible by 11, and that %x \in 4 + 7\Z. Since %x is divisible by 11, it is a multiple of 11, so we want to find %x = 11 \cdot %y where:
\begin{eqnarray}
  11 \cdot %y & \equiv & 4 (\mod 7)
\end{eqnarray}
To solve the above, it is sufficient to multiply both sides of the equation by 11^{-1} (\mod 7). Since 11 \equiv 4 (\mod 7), it is sufficient to find 4^{-1} (\mod 7).
\begin{eqnarray}
  11^{-1} & \equiv & 4^{-1} (\mod 7) \\
          & \equiv & 4<sup>7-2</sup> \\
          & \equiv & 4<sup>5</sup> \\
          & \equiv & 1024 \\
          & \equiv & 2
\end{eqnarray}
Thus, we can multiply both sides to obtain:
\begin{eqnarray}
  11 \cdot %y & \equiv & 4 (\mod 7) \\
  11^{-1} \cdot  11 \cdot %y & \equiv & 11^{-1} \cdot 4 \\
  %y & \equiv & 2 \cdot 4 \\
  %y & \equiv & 8 \\
  %y & \equiv & 1 \\
\end{eqnarray}
Thus, we have:
\begin{eqnarray}
  %x & \equiv & 11 \cdot %y (\mod 77) \\
  %x & \equiv & 11 \cdot 1 \\
  %x & \equiv & 11 (\mod 77)
\end{eqnarray}
      ]]></example>
      <fact required="true" hooks="math" id="c81c8d4504d8476385aadc9f3965f7fc"><![CDATA[
Suppose we are given two unequal prime numbers %p, %q \in \N, and the following two equations:
\begin{eqnarray}
  %x & \equiv & 1 (\mod %p) \\
  %x & \equiv & 0 (\mod %q) \\
\end{eqnarray}
This implies %x must be a multiple of %q, so rewrite %x = %q \cdot %y. Then we have:
\begin{eqnarray}
  %q \cdot %y & \equiv & 1 (\mod %p) \\
\end{eqnarray}
Thus, we can solve for %q^{-1} by computing:
\begin{eqnarray}
  %q^{-1} & \equiv & %q^{%p-2} (\mod %p)
\end{eqnarray}
Then we have:
\begin{eqnarray}
  %q^{-1} \cdot %q \cdot  %y & \equiv & %q^{-1} \cdot 1 (\mod %p) \\
  %y & \equiv & %q^{-1} (\mod %p) \\
  %x & \equiv & %q \cdot %y (\mod (%p \cdot %q))
\end{eqnarray}
Notice that %q \cdot %y is indeed a solution to the original system because:
\begin{eqnarray}
  %q \cdot %y & \equiv & 1 (\mod %p) & %~ & %~ because %y \equiv %q^{-1} (\mod %p);\\
  %q \cdot %y & \equiv & 0 (\mod %q) & %~ & %~ because %q \cdot %y is a multiple of %q.
\end{eqnarray}
      ]]></fact>
      <fact required="true" hooks="math" id="b515c5d406d14fabaa48e4bb669a6b12"><![CDATA[
Suppose we are given two unequal prime numbers %p, %q \in \N, and the following two equations where %a \in \Z/%p\Z:
\begin{eqnarray}
  %x & \equiv & %a (\mod %p) \\
  %x & \equiv & 0 (\mod %q) \\
\end{eqnarray}
This implies %x must be a multiple of %q and a multiple of %a, so rewrite %x = %a \cdot %q \cdot %y. Then we have:
\begin{eqnarray}
  %a \cdot %q \cdot %y & \equiv & %a (\mod %p) \\
\end{eqnarray}
As in the <a href="#c81c8d4504d8476385aadc9f3965f7fc">previous fact</a>, the above works if %y = %q^{-1} (\mod %p), so compute:
\begin{eqnarray} 
  %y & = & %q^{-1} (\mod %p) \\
  %x & \equiv & %a \cdot %q \cdot %y (\mod (%p \cdot %q))
\end{eqnarray}
Notice that %a \cdot %q \cdot %y is indeed a solution to the original system because:
\begin{eqnarray}
  %a \cdot %q \cdot %y & \equiv & %a (\mod %p) & %~ & %~ because %y \equiv %q^{-1} (\mod %p);\\
  %a \cdot %q \cdot %y & \equiv & 0 (\mod %q) & %~ & %~ because %a \cdot %q \cdot %y is a multiple of %q.
\end{eqnarray}
      ]]></fact>
      <fact required="true" hooks="math" id="cdf66ebaf3a24a54a2b097be73f8a8f4"><![CDATA[
Suppose we are given two unequal prime numbers %p, %q \in \N, and the following two equations where %a \in \Z/%p\Z and %b \in \Z/%q\Z:
\begin{eqnarray}
  %x & \equiv & %a (\mod %p) \\
  %x & \equiv & %b (\mod %q)
\end{eqnarray}
Suppose we instead solve the following two systems:
\begin{eqnarray}
  %x_1 & \equiv & %a (\mod %p) \\
  %x_1 & \equiv & 0 (\mod %q) \\
  %x_2 & \equiv & 0 (\mod %p) \\
  %x_2 & \equiv & %b (\mod %q)
\end{eqnarray}
Notice that %x_1 + %x_2 is a solution to the original system because:
\begin{eqnarray}
  %x_1 + %x_2 & \equiv & %x_1 + 0 (\mod %p) \\
              & \equiv & %a + 0 (\mod %p) \\
              & \equiv & %a (\mod %p) \\
  %x_1 + %x_2 & \equiv & 0 + %x_2 (\mod %q) \\
              & \equiv & 0 + %b (\mod %q) \\
              & \equiv & %b (\mod %q)
\end{eqnarray}
We know how to solve the above two systems separately:
\begin{eqnarray}
  %x_1 & \equiv & %a \cdot %q \cdot %q^{-1} (\mod (%p \cdot %q)) \\
  %x_2 & \equiv & %b \cdot %p \cdot %p^{-1} (\mod (%p \cdot %q))
\end{eqnarray}
Thus, we have the solution to the original system:
\begin{eqnarray}
  %x & \equiv & %x_1 + %x_2 (\mod (%p \cdot %q))
\end{eqnarray}
      ]]></fact>
      <text hooks="math"><![CDATA[
We have shown that we can solve a system of equations with a solution according to CRT if the moduli in the equations are both prime. What if the moduli are merely coprime? So far, we only needed a way to compute multiplicative inverses of numbers modulo a prime, and Fermat's little theorem was sufficient for this purpose. However, if the moduli are not prime, we need some other method to compute multiplicative inverses.
      ]]></text>
      <fact required="true" hooks="math" id="5e8cdc75405344e6a8f8cb5c1eeb47f6"><![CDATA[
For any %m \in \N, an %x \in \Z/%m\Z has an inverse with respect to multiplication defined over \Z/%m\Z 
(i.e., a <i>multiplicative inverse</i>) iff \gcd(%x,%m) = 1.
      ]]></fact>
      <fact title="Bezout's identity" required="true" hooks="math" id="4353592f86d4482c93cebb6da6d749b9"><![CDATA[
For any two integers %x \in \Z, %y \in \Z where %x \neq 0 or %y \neq 0, let %z = \gcd(%x,%y). Then
there exist %a \in \Z and %b \in \Z such that:
\begin{eqnarray}
  %a \cdot %x + %b \cdot %y & = & %z
\end{eqnarray}
      ]]></fact>
      <fact required="true" hooks="math" id="32cdd190ad1c47fb805b6e2b9a4ca667"><![CDATA[
For any two integers %x \in \Z, %y \in \Z where %x \neq 0 or %y \neq 0, and \gcd(%x,%y) = 1, there exist %a \in \Z and %b \in \Z 
such that:
\begin{eqnarray}
  %a \cdot %x + %b \cdot %y & = & 1
\end{eqnarray}
This fact is a special case of B&eacute;zout's identity (i.e., the case in which \gcd(%x,%y) = 1).
      ]]></fact>
      <example required="true" hooks="math" id="91bd4ded905747a6bb4a1f5a79f01f8e">
        <text><![CDATA[
Suppose we have %s,%t \in \Z such that:
\begin{eqnarray}
  5 \cdot %s + 3 \cdot %t & = & 1
\end{eqnarray}
We can then do the following:
\begin{eqnarray}
  %- 5 \cdot %t + (5 \cdot %s + 3 \cdot %t) + 5 \cdot %t & = & 1 \\
  (5 \cdot %s %- 5 \cdot %t) + (3 \cdot %t + 5 \cdot %t) & = & 1 \\
  5 \cdot (%s %- %t) + 8 \cdot %t & = & 1
\end{eqnarray}
Thus, we have converted a instance of B&eacute;zout's identity for 5 and 3 into an instance of B&eacute;zout's identity for 5 and 8.
        ]]></text>
        <paragraph hooks="math"><![CDATA[
We can repeat the above as many times as we want. Suppose we instead want B&eacute;zout's identity for 3 and 13. We can do the following:
\begin{eqnarray}
  %- 5  \cdot 2  \cdot %t + (5 \cdot %s + 3 \cdot %t) + 5  \cdot 2 \cdot %t & = & 1 \\
  (5 \cdot %s %- 5 \cdot 2  \cdot %t) + (3 \cdot %t + 5 \cdot 2 \cdot %t) & = & 1 \\
  5 \cdot (%s %- 2 \cdot %t) + 13 \cdot %t & = & 1
\end{eqnarray}
        ]]></paragraph>
      </example>
      <fact required="true" hooks="math" id="29c13f60ff224ad083162d2d60af94a1"><![CDATA[
For any two integers %a, %b, %s, %t \Z, suppose we have that:
\begin{eqnarray}
  %a \cdot %s + %b \cdot %t & = & 1
\end{eqnarray}
Let us assume that %a > %b and that %a \mod %b = %r (in other words, for some %k,
\begin{eqnarray}
  %a \mod %b & = & %r \\
  %b \cdot %k + %r & = & %a
\end{eqnarray}
Then we have that:
\begin{eqnarray}
  %a \cdot %s + %b \cdot %t & = & 1 \\
  %- %b \cdot %k \cdot %s + (%a \cdot %s + %b \cdot %t) + %b \cdot %k \cdot %s & = & 1 \\
  (%a \cdot %s %- %b \cdot %k \cdot %s) + (%b \cdot (%t + %k \cdot %s)) & = & 1 \\
  (%a %- %b \cdot %k) \cdot %s + %b \cdot (%t + %k \cdot %s) & = & 1 \\
  %r \cdot %s + %b \cdot (%t + %k \cdot %s) & = & 1 \\
  (%a \mod %b) \cdot %s + %b \cdot (%t + %k \cdot %s) & = & 1
\end{eqnarray}
Thus, for any instance of B&eacute;zout's identity for %a and %b and %a > %b, there must exist an instance of B&eacute;zout's identity for %a \mod %b and %b.
      ]]></fact>
      <text hooks="math"><![CDATA[
The above fact suggests that if we want to find the %s and %t coefficients for an equation %a \cdot %s + %b \cdot %t = 1 given %a > %b, we should try finding B&eacute;zout's identity for %a \mod %b and %b. But notice that:
\begin{eqnarray}
  %a \mod %b & \lt & %b
\end{eqnarray}
The above implies that the problem of finding the coefficients for an instance of B&eacute;zout's identity can be reduced to a smaller version of the problem: find B&eacute;zout's identity for %a \mod %b and %b can then be reduced further to finding %b \mod (%a \mod %b) and %a \mod %b. At this point, we have a strictly smaller instance of the problem:
\begin{eqnarray}
  %a \mod %b & \lt & %b & \lt & %a \\
  %b \mod (%a \mod %b) & \lt & %b & \lt & %a 
\end{eqnarray}
Thus, we can use recursion; the recursive algorithm that solves this problem is called the <i>extended Euclidean algorithm</i>, and is a modification of the recursive algorithm that computes the \gcd of two numbers.
      ]]></text>
      <!--<example required="true" hooks="math" id="7ce7976a22fc4f2d9e55a889399f3703"><![CDATA[
Suppose we start with the integers 5 and 8, and we want to find %a and %b such that 5 \cdot %a - 8 \cdot %b = 1. How can we break this problem down? We know that:
\begin{eqnarray}
  1 \cdot (%-1) + 2 \cdot (1) & = & 1 \\
  2 \cdot (%-1) + 1 \cdot (%-1) + 2 \cdot (2) & = & 1 \\
  (2+1) \cdot (%-1) + 2 \cdot (2) & = & 1 \\
  3 \cdot (%-1) + 2 \cdot (2) & = & 1 \\
  3 \cdot (2 %- 3) + 2 \cdot (2) & = & 1 \\
  3 \cdot (2) + 2 \cdot (2) %- 3 \cdot (3) & = & 1 \\
  (3+2) \cdot (2) %- 3 \cdot (3) & = & 1 \\
  5 \cdot (2)  %- 3 \cdot (3) & = & 1 \\
  5 \cdot (5) %- 5 \cdot (3) %- 3 \cdot (3) & = & 1 \\
  5 \cdot (5) %- (5+3) \cdot (3 & = & 1 \\
  5 \cdot (5) %- 8 \cdot (3) & = & 1 \\
  25 %- 24 & = & 1 \\
\end{eqnarray}
      ]]></example>-->
      <algorithm title="extended Euclidean algorithm" required="true" hooks="math" id="4b73a6de740d492d9bf4d536da9f15ce"><![CDATA[
The collection of equations considered in the Chinese remainder theorem can be solved constructively (i.e., in a way that provides
a concrete solution and not just a proof that a solution exists) by applying an extended version of the greatest common divisor
algorithm. We provide the definition of the algorithm below.

<ol style="list-style-type:none;">
 <li><b>extended Euclidean algorithm:</b> %x \in \Z, %y \in \Z</li>
 <li>
   <ol style="list-style-type:none;">
     <li>if %y = 0
       <ol style="list-style-type:none;">
         <li>(%s,%t) := (1, 0)</li>
         <li>return (%s,%t)</li>
       </ol>
     </li>
     <li>otherwise
       <ol style="list-style-type:none;">
         <li>(%s,%t) := <b>extended Euclidean algorithm</b>(%y, %x \mod %y)</li>
         <li>return (%t, %s - (\lfloor %x/%y \rfloor \cdot %t) )</li>
       </ol>
     </li>
   </ol>
 </ol>

Given two inputs %x \in \Z, %y \in \Z, the extended Euclidean algorithm returns two integers %u, %v such that
\begin{eqnarray}
  %u \cdot %x + %v \cdot %y & = & \gcd(%x,%y)
\end{eqnarray}
      ]]></algorithm>
      <text hooks="math"><![CDATA[
We can check that the above is indeed a solution to %x \equiv %a (\mod %m). Consider the following:
\begin{eqnarray}
  %u \cdot %m + %v \cdot %n & = & 1 \\
  %v \cdot %n & = & 1 - %u \cdot %m\\
  %v \cdot %n & \equiv & 1 (\mod %m)\\
\end{eqnarray}
Furthermore, we have that:
\begin{eqnarray}
  ((%u \cdot %m) \cdot %b) \mod %m & = & 0 
\end{eqnarray}
Then, we can conclude:
\begin{eqnarray}
  ((%u \cdot %m) \cdot %b + (%v \cdot %n) \cdot %a) \mod %m & = & 0 + ((%v \cdot %n) \cdot %a) \mod %m \\
                                                            & = & 0 + (1 \cdot %a) \mod %m \\
                                                            & = & %a \mod %m
\end{eqnarray}
Using a similar argument, we can show that the solution is also equivalent to %b (\mod %m).
      ]]></text>
      <example required="true" hooks="math" id="f6ffb13bb54f4df3ba35fe61ac5b7fac"><![CDATA[
Suppose we want to find the multiplicative inverse of 49 in \Z/100\Z and the multiplicative inverse of 100 in \Z/49\Z. We run the <a href="#4b73a6de740d492d9bf4d536da9f15ce">extended Euclidean algorithm</a> on the inputs 49 and 100 to obtain the following instance of  B&eacute;zout's identity:
\begin{eqnarray}
  (-24) \cdot 100 + 49 \cdot 49 & = & 1
\end{eqnarray}
We can use the above to find the multiplicative inverse of 49 in \Z/100\Z:
\begin{eqnarray}
  (-24) \cdot 100 + 49 \cdot 49 & = & 1 \\
  (-24) \cdot 100 + 49 \cdot 49 & \equiv & 1 (\mod 100) \\
  49 \cdot 49 & \equiv & 1 (\mod 100)
\end{eqnarray}
Thus, 49^{-1} = 49 in \Z/100\Z. We can also find the multiplicative inverse of 100 in \Z/49\Z (also known as 2 \in \Z/49\Z):
\begin{eqnarray}
  (-24) \cdot 100 + 49 \cdot 49 & = & 1 \\
  (-24) \cdot 100 + 49 \cdot 49 & \equiv & 1 (\mod 49) \\
  -24 \cdot 100 & \equiv & 1 (\mod 49) \\
  25 \cdot 100 & \equiv & 1 (\mod 49)
\end{eqnarray}
Thus, 100^{-1} = 25 in \Z/49\Z.
      ]]></example>
      <example required="true" hooks="math" id="540e30122cbc48fca9ccd017ae31374b"><![CDATA[
Suppose we want to solve the following system:
\begin{eqnarray}
  %x & \equiv & 23 (\mod 100)\\
  %x & \equiv & 31 (\mod 49)
\end{eqnarray}
We use the extended Euclidean algorithm to find that:
\begin{eqnarray}
  (-24) \cdot 100 + 49 \cdot 49 & = & 1
\end{eqnarray}
This tells us that %-24 is the inverse of 100 in \Z/49\Z and that 49 is the inverse of 49 in \Z/100\Z. Thus, to build 31 in \Z/49\Z, we need:
\begin{eqnarray}
  31 & \equiv & 1 \cdot 31 (\mod 49) \\
     & \equiv & (100 \cdot 100^{-1}) \cdot 31 \\
     & \equiv & (100 \cdot -24) \cdot 31
\end{eqnarray}
To build 23 in \Z/100\Z, we need:
\begin{eqnarray}
  23 & \equiv & 1 \cdot 23 (\mod 100) \\
     & \equiv & (49 \cdot 49^{-1}) \cdot 23 \\
     & \equiv & (49 \cdot 49) \cdot 23
\end{eqnarray}
Then the solutions to the system are in the congruence class:
\begin{eqnarray}
  %x & \equiv & (100 \cdot -24) \cdot 31 + (49 \cdot 49) \cdot 23 (\mod (100 \cdot 49)) \\
     & \equiv & -19177 \mod 4900 \\
     & \equiv & 423
\end{eqnarray}
      ]]></example>
      <algorithm required="true" hooks="math" id="475eebe58a8b4fd79cb2aa108a07eebe"><![CDATA[
Suppose we are given a collection of equations of the following form such that %m_1,...,%m_{%k} are all pairwise coprime.
\begin{eqnarray}
  %x & \equiv & %a_1 (\mod %m_1)\\
              & \vdots & \\
  %x & \equiv & %a_{%k} (\mod %m_{%k})
\end{eqnarray}
Let %C be the set of these equations, where %C_{%i} is the %ith equation. The following algorithm can be used to find a solution for this
system of equations.

<ol style="list-style-type:none;">
 <li><b>solve system of equations:</b> %C is a set of constraints %x \equiv %a_{%i} \mod %m_{%i}</li>
 <li>
   <ol style="list-style-type:none;">
     <li> while |%C| > 1
       <ol style="list-style-type:none;">
         <li>remove two equations %C_{%i} and %C_{%j} from %C and solve them to obtain a new equation %x \equiv %c (\mod %m_{%i} \cdot %m_{%j})</li>
         <li>add the new equation to %C</li>
       </ol>
     </li>
     <li> return the one equation left in %C</li>
   </ol>
 </li>
</ol>
      ]]></algorithm>
    </subsection>
    <subsection title="More practice with CRT">
      <example required="true" hooks="math" id="d777986d0d1e448eb2e9b10d8e3d6395">
        <text><![CDATA[
Solve the following equation for %x \in \Z/5\Z by multiplying both sides by the appropriate multiplicative inverse:
\begin{eqnarray}
  3 \cdot %x & \equiv & 2 (\mod 5)
\end{eqnarray}
        ]]></text>
      </example>
      <example required="true" hooks="math" id="604d8d0e27fe47d982ff33856b933ff5">
        <text><![CDATA[
Solve the following system of equations for %x \in \Z/35\Z by finding multiplicative inverses of 5 \in \Z/7\Z and 7 \in \Z/5\Z:
\begin{eqnarray}
  %x & \equiv & 4 (\mod 5) \\
  %x & \equiv & 2 (\mod 7)
\end{eqnarray}
        ]]></text>
      </example>
      <example required="true" hooks="math" id="83c473bffbd3429ca571c8018105ce97">
        <text><![CDATA[
Suppose you know that 7^{-1} \equiv 3 (\mod 10). Solve the following system of equations:
\begin{eqnarray}
  %x & \equiv & 0 (\mod 2) \\
  %x & \equiv & 1 (\mod 5) \\
  %x & \equiv & 3 (\mod 7) \\
\end{eqnarray}
        ]]></text>
        <solution hooks="math"><![CDATA[
We first solve the first two equations. We know %x must be a multiple of 2 that is in 1 + 5\Z. Thus, we set %x = 2 \cdot %y and we solve:
\begin{eqnarray}
  %x & \equiv & 1 (\mod 5) \\
  2 \cdot %y & \equiv & 1 (\mod 5) \\  
\end{eqnarray}
Then we know that:
\begin{eqnarray}
  %y & \equiv & 2^{-1} (\mod 5) \\
     & \equiv & 2<sup>5-2</sup> \\
     & \equiv & 2^3 \\
     & \equiv & 8 \\
     & \equiv & 3
\end{eqnarray}
Thus, %x \equiv 2 \cdot 3 \equiv 6 (\mod (2 \cdot 5)). This leaves two equations:
\begin{eqnarray}
  %x & \equiv & 6 (\mod 10) \\
  %x & \equiv & 3 (\mod 7) \\
\end{eqnarray}
We first find 10^{-1} (\mod 7):
\begin{eqnarray}
  10^{-1} & \equiv & 10<sup>7-2</sup> (\mod 7) \\
         & \equiv & 10^5\\
         & \equiv & 5
\end{eqnarray}
We now have 10^{-1} \equiv 5 (\mod 7) and 7^{-1} \equiv 3 (\mod 10), so now we can express 6 as a multiple of 7 in \Z/10\Z, and we can express 3 as a multiple of 10 in \Z/7\Z:
\begin{eqnarray}
  %x & \equiv & 6 (\mod 10) \\
     & \equiv & 6 \cdot 1 \\
     & \equiv & 6 \cdot (7 \cdot 7^{-1}) \\
  %x & \equiv & 3 (\mod 7) \\
     & \equiv & 3 \cdot 1  \\
     & \equiv & 3 \cdot (10 \cdot 10^{-1})
\end{eqnarray}
Thus, we add these two terms to obtain our solution in \Z/(7 \cdot 10)\Z:
\begin{eqnarray}
  %x & \equiv & 6 \cdot (7 \cdot 7^{-1}) + 3 \cdot (10 \cdot 10^{-1}) (\mod 70) \\
     & \equiv & 6 \cdot (7 \cdot 3) + 3 \cdot (10 \cdot 5) \\
     & \equiv & 6 \cdot 21 + 3 \cdot 50 \\
     & \equiv & 126 + 150 \\
     & \equiv & 276 \\
     & \equiv & 66 \\
\end{eqnarray}
        ]]></solution>
      </example>
      <example required="true" id="ed75855fa50c4005a8e2f284bdcb23cf">
        <text hooks="math"><![CDATA[
Suppose we have a single processor that can perform arithmetic operations (addition, subtraction, multiplication, and modulus) on integers that can be represented with at most 11 bits (2^{11} = 2048). On this processor, a single arithmetic operation can be performed in 11 time steps. We also have three other processors that can perform arithmetic on integers that can be represented with at most 4 bits (2^4 = 16). Each of these processors can perform an arithmetic operation on 4-bit integers in 4 time steps.
        ]]></text>
        <paragraph hooks="math"><![CDATA[
For example, suppose we want to perform 1000 arithmetic operations on 11-bit integers. Using a single processor, this would require:
\begin{eqnarray}
  1000 \cdot 11 = 11,000 time steps
\end{eqnarray}
If we use three coprime numbers 13, 14, and 15, and we use each of the three 4-bit processors to perform these operations modulo 13, 14, and 15 in parallel, 1000 operations would require:
\begin{eqnarray}
  1000 \cdot 4 = 4,000 time steps
\end{eqnarray}
Note that 13 \cdot 14 \cdot 15 = 2730, and that 2730 \gt 2048, so:
\begin{eqnarray}
13 \cdot 14 \cdot 15 & \gt & 2^{11}
\end{eqnarray}
Suppose it takes 1400 time steps to solve a system of three congruence equations of the following form:
\begin{eqnarray}
  %x & \equiv & %a (\mod 13) \\
  %x & \equiv & %b (\mod 14) \\
  %x & \equiv & %c (\mod 15) \\
\end{eqnarray}
If we want to perform the computations as quickly as possible and we can use either the 11-bit processor or the three 4-bit processors, how many operations %k would we need to perform before we decided to switch from the the 11-bit processor to the 4-bit processors?
        ]]></paragraph>
        <solution hooks="math"><![CDATA[
To solve this problem, we can first write down two function describing the time cost of the two strategies for %k operations:
\begin{eqnarray}
  %f(%k) & = & %k \cdot 11 \\
  %g(%k) & = & %k \cdot 4 + 1400
\end{eqnarray}
Notice that %f(1) < %g(1), so if we only wanted to perform %k = 1 operation, we would prefer to use the 11-bit processor. The point at which we would want to switch would be when %f(%k) \geq %g(k), so we can find the point at which the two functions intersect:
\begin{eqnarray}
  %f(%k) & \geq & %g(%k) \\
  %k \cdot 11 & \geq & %k \cdot 4 + 1400 \\
  %k \cdot 7 & \geq & 1400 \\
  %k& \geq & 200
\end{eqnarray}
Thus, if %k \geq 200, we want to use the 4-bit processors.
        ]]></solution>
      </example>
      <example required="true" hooks="math" id="92c09aa50d3646fab41fa61bfd4b12e4">
        <text hooks="math"><![CDATA[
Suppose we are using echolocation to measure the distance to a wall that is at most 15 distance units away. We have two devices that emit sounds at two different frequencies. One device emits sound every 3 seconds, while the other device emits a sound every 11 seconds. Suppose we hear the following:
<ul>
  <li>the device that emits a sound every 3 seconds hears a response 2 seconds after each time it emits a sound;</li>
  <li>the device that emits a sound every 11 seconds hears a response 4 seconds after each time it emits a sound.</li>
</ul>
If sound travels one distance unit per second, how far away is the wall?
        ]]></text>
        <solution hooks="math"><![CDATA[
The information presented in the problem statement can be translated into the following system of equations:
\begin{eqnarray}
  %d & \equiv & 2 (\mod 3) \\
  %d & \equiv & 4 (\mod 11)
\end{eqnarray}
Since the wall is at most 15 distance units away and sound travels one distance unit per second, sound takes at most 30 seconds to travel to the wall and back, so %d \leq 30 < 3 \cdot 11. Thus, the solution %d will be the exact distance traveled to the wall and back. We can solve for %d in the usual way:
\begin{eqnarray}
  %d & \equiv & 2 \cdot (11 \cdot 11^{-1}) + 4 \cdot (3 \cdot 3^{-1}) (\mod (3 \cdot 11)) \\
     & \equiv & 2 \cdot (11 \cdot 2) + 4 \cdot (3 \cdot 4) \\
     & \equiv & 44 + 48 \\
     & \equiv & 92 (\mod 33) \\
     & \equiv & 26 (\mod 33)
\end{eqnarray}
Thus, sound is traveling 26 distance units to the wall and back, so the distance to the wall is 26/2 = 13 distance units.
        ]]></solution>
      </example>
      <example required="true" id="97cacd0683e94c2db33cc3ccb85011bb">
        <text hooks="math"><![CDATA[
Suppose Alice, Bob, and Eve are using the Shamir secret sharing protocol to store a combination for a lock; all three participants would need to work together to retrieve the secret lock combination in \Z/60\Z. They are each given the following equations:
\begin{eqnarray}
  <b>Alice:</b> & %~ & %x & \equiv & 1 (\mod 3) \\
  <b>Bob:</b> & %~ & %x & \equiv & 3 (\mod 4) \\
  <b>Eve:</b> & %~ & %x & \equiv & 2 (\mod 5)
\end{eqnarray}
<ul>
  <li>
What is the lock combination?
  </li>
  <li>
The lock only permits anyone to try two incorrect combinations before locking down completely and becoming inaccessible. Suppose Eve has a chance to steal either Bob's secret information or Alice's secret information, but she can only choose one. Whose information should she steal in order to unlock the lock?
  </li>
</ul>
        ]]></text>
        <solution hooks="math">
          <text><![CDATA[
We can solve for %x by breaking the problem down into smaller systems; we first solve the first two equations:
\begin{eqnarray}
  %x & \equiv & 1 (\mod 3) \\
  %x & \equiv & 3 (\mod 4) \\
  %x & \equiv & 1 \cdot (4 \cdot 4^{-1}) + 3 \cdot (3 \cdot 3^{-1}) (\mod (3 \cdot 4)) \\
     & \equiv & 7 (\mod 12)
\end{eqnarray}
We can then combine this with the last equation (note that 5 and 12 are coprime):
\begin{eqnarray}
  %x & \equiv & 7 (\mod 12) \\
  %x & \equiv & 2 (\mod 5) \\
  %x & \equiv & 7 \cdot (5 \cdot 5^{-1}) + 2 \cdot (12 \cdot 12^{-1}) (\mod (12 \cdot 5)) \\
     & \equiv & 7 \cdot (5 \cdot 5) + 2 \cdot (12 \cdot 3) \\
     & \equiv & 175 + 72 \\
     & \equiv & 247 \\
     & \equiv & 7 (\mod 60)
\end{eqnarray}
Thus, the lock combination is 7 \in \Z/60\Z.
          ]]></text>
          <paragraph><![CDATA[
Eve should steal Bob's secret because it provides more information about the overall solution. Suppose Eve steals Alice's information; then she must guess Bob's secret, but there are four possibilities (i.e., 0, 1, 2, or 3 in \Z/4\Z). On the other hand, if she steals Bob's information, Eve can try guessing Alice's secret. There are only three possible guesses to make (0, 1, or 2 in \Z/3\Z). She is certain to guess correctly before she runs out of tries.
          ]]></paragraph>
          <paragraph><![CDATA[
Another way to think about this is to consider the space of possible solutions that remains in \Z/60\Z given only two of the equations. If all we have is Alice's and Eve's equations, then possible solutions to the system are all the elements in 7 + 15\Z that are less than 60: 7, 22, 37, or 52. That is four possibilities. On the other hand, if we have Bob's and Eve's equations, the possibilities are 7 + 20\Z: 7, 27, or 47. There are only three possibilities to try.
          ]]></paragraph>
        </solution>
      </example>
      <example required="true" hooks="math" id="e44bcc8621a0449690fc9f708c74ec65">
        <text><![CDATA[
Suppose we want to store a number %n between 0 and 500,000 on a collection of 5-bit memory regions. However, we want to make sure that if any one of the memory regions is turned off, we can still recover the number exactly, without any missing information or errors. How many memory regions will we need to use? Note that 32^3 = 32,768 and 32^4 = 1,048,576.
        ]]></text>
        <solution><![CDATA[
We will need five memory regions. Suppose we choose five coprime numbers less than or equal to 2^5 = 32: 25,27,29,31, and 32. Note that any product of four of these numbers is greater than 500,000 because 25 \cdot 27 \cdot 29 \cdot 31 = 606,825. Then with five 5-bit memory regions, we can store each of the following five values in one region:
\begin{eqnarray}
  %n \mod 25 \\
  %n \mod 27 \\
  %n \mod 29 \\
  %n \mod 31 \\
  %n \mod 32
\end{eqnarray}
If any of the above values are lost, it is still possible to recover %n by solving a system with four equations. In the worst case, the product of the moduli would be 606,825 > 500,000.
        ]]></solution>
      </example>
      <example required="true" hooks="math" id="e8f3975a8a9d47c89471de8815e333b0">
        <text><![CDATA[
Suppose we make the following simplifications: for every %t years,
<ul>
  <li>when the Earth revolves around the sun, it travels a circumference of 1 unit, at a rate of 1 \cdot %t (once per year);</li>
  <li>when the asteroid Ceres revolves around the sun, it travels a circumference of 5 units;</li>
  <li>when the planet Jupiter revolves around the sun, it travels a circumference of 11 units.</li>
</ul>
Suppose that on June 21st, 2000, the Earth, Ceres, and Jupiter all align (i.e., one can draw a straight line through all three). Next, suppose that it is June 21st of some year between 2000 and 2055. At this time, there is no alignment. However, Jupiter aligned with earth on June 21st two years ago, and Ceres aligned with Earth on June 21st three year ago. What year is it?
        ]]></text>
        <solution><![CDATA[
Let %t be the number of years since the year 2000. That all three planets are aligned in the year 2000 can be interpreted to mean that at %t = 0 we have %t \equiv 0 (\mod 5) and %t \equiv 0 (\mod 11). Then, the information presented in the problem statement about the current moment can be represented using the following system of equations:
\begin{eqnarray}
  %t & \equiv & 0 (\mod 1) \\
  %t & \equiv & 2 (\mod 5) \\
  %t & \equiv & 3 (\mod 11)
\end{eqnarray}
Since we know %t < 55, we will certainly find the exact solution for %t. Note that all integers are solutions to the first equation, so all that remains is to solve the latter two equations:
\begin{eqnarray}
  %t & \equiv & 2 \cdot (11 \cdot 11^{-1}) + 3 \cdot (5 \cdot 5^{-1}) (\mod (5 \cdot 11)) \\
     & \equiv & 2 \cdot (11 \cdot 1) + 3 \cdot (5 \cdot 9) \\
     & \equiv & 22 + 135 \\
     & \equiv & 157 \\
     & \equiv & 47 (\mod 55)
\end{eqnarray}
Thus, 47 years have passed since the last alignment of all three planets. The current year is 2047.
        ]]></solution>
      </example>
    </subsection>
    <subsection title="Euler's totient function, Euler's theorem, and applications">
      <definition required="true" hooks="math" id="363015589b5c4b168afdf08dc2b2e609"><![CDATA[
For any input %m \in \N, define <i>Euler's totient function</i> \phi by:
\begin{eqnarray}
  \phi(%m) & = & |{%k | %k \in {1,...,%m}, \gcd(%k,%m) = 1}|\\
\end{eqnarray}
      ]]></definition>
      <example required="true" hooks="math" id="fcd2435810694667a9ef85f531830ac5"><![CDATA[
Compute \phi(15).
\begin{eqnarray}
  \phi(15) & = & |{%k | %k \in {1,...,15}, \gcd(%k,15) = 1}| \\ 
           & = & |{1,2,4,7,8,11,13,14}| \\
           & = & 8
\end{eqnarray}
      ]]></example>
      <example required="true" hooks="math" id="3124a3c8c9744310bbe184f41be5e8d2">
        <text><![CDATA[
Suppose %p \in \N is a prime number. What is \phi(%p)?
        ]]></text>
        <paragraph hooks="math"><![CDATA[
\begin{eqnarray}
  \phi(%p) & = & |{%k | %k \in {1,...,%p}, \gcd(%k,%p) = 1}| \\ 
           & = & |{1,2,3,...,%p-1}| \\
           & = & %p-1
\end{eqnarray}
        ]]></paragraph>
      </example>
      <example required="true" hooks="math" id="e0f82cd4eb0443f4afba0e3818c2a200"><![CDATA[
What is \phi(15)?
\begin{eqnarray}
  \phi(15) & = & |{%k | %k \in {1,...,15}, \gcd(%k,15) = 1}| \\ 
           & = & 15 - |{%k | %k \in {1,...,15}, \gcd(%k,15) \neq 1}| \\
           & = & 15 - |{3,6,9,12,15} \cup {5,10,15}| \\
           & = & 15 - |{3,6,9,12}| - |{5,10}| - |{15}| \\
           & = & 15 - (5-1) - (3-1) - 1 \\
           & = & 15 - 5 - 3 + 1 + 1 - 1 \\
           & = & 15 - 5 - 3 + 1 \\
           & = & (3 \cdot 5) - 5 - 3 + 1 \\
           & = & (3-1) \cdot (5-1) \\
           & = & 2 \cdot 4 \\
           & = & 8
\end{eqnarray}
      ]]></example>
      <fact required="true" hooks="math" id="da48e3ec693c4a07b4c6da648e5c1996"><![CDATA[
For any %x \in \N and %y \in \N, if \gcd(%x,%y) = 1 then:
\begin{eqnarray}
  \phi(%x) \cdot \phi(%y) & = & \phi(%x \cdot %y)
\end{eqnarray}
      ]]></fact>
      <example required="true" hooks="math" id="8daf99d05046443b8612d9dd73a19e8f"><![CDATA[
Suppose %p \in \N and %q \in \N are prime numbers. What is \phi(%p \cdot %q)?
\begin{eqnarray}
  \phi(%p \cdot %q) & = & \phi(%p) \cdot \phi(%q) \\ 
                    & = & (%p-1) \cdot (%q-1)
\end{eqnarray}
      ]]></example>
      <fact required="true" hooks="math" id="15f709b061db4798ab0ff29bef64f200"><![CDATA[
For any prime %p \in \N, we have that:
\begin{eqnarray}
  \phi(%p^{%k}) & = & %p^{%k} - %p^{%k-1}
\end{eqnarray}
      ]]></fact>
      <fact required="true" hooks="math" id="8312ecb0d47242219a93a85c851802f1"><![CDATA[
For any %a \in \N and %m \in \N, if %a^{%m-1} \mod %m = 1 then:
\begin{eqnarray}
  %a^{%m-1} \mod %m & = & 1 \\
  %a^{%m-1} & = & 1 + %k \cdot %m \\
  1 & = & \gcd(1 + %k \cdot %m, %k \cdot %m)  \\
    & = & \gcd(%a^{%m-1}, %k \cdot %m) \\
    & = & \gcd(%a, %k \cdot %m) \\
    & = & \gcd(%a, %m) \\
\end{eqnarray}
Thus, %a and %m are coprime.
      ]]></fact>
      <example required="true" hooks="math" id="e78b477d1f2d4338a87dd895b6dc8c41"><![CDATA[
Suppose %m \in \N is a Carmichael number. At most how many Fermat liars does %m have?
      ]]></example>
      <fact required="true" hooks="math" id="aea9ea3a80714971a4256083cc20ef9f"><![CDATA[
We can use \phi to provide a formula for the probability that the Fermat primality test
will detect that a Carmichael number %m \in \N is actually composite. It is approximately:
\begin{eqnarray}
  (%m - \phi(%m)) / %m
\end{eqnarray}
To be more precise (since we do not check 0 or 1 in our actual implementation), it is:
\begin{eqnarray}
  ((%m - 3) - \phi(%m)) / (%m - 3)
\end{eqnarray}
      ]]></fact>
      <text hooks="math"><![CDATA[
Unfortunately, Euler's totient function does not in general have a better upper bound than %f(%m) = %m.
      ]]></text>
      <example required="true" hooks="math" id="a01b6e7d9ce84f61b88078768c1eb66b"><![CDATA[
How many elements of \Z/%m\Z have a multiplicative inverse in \Z/%m\Z?

Since an %x \in \Z/%m\Z has an inverse iff \gcd(%x,%m) = 1. Thus, the set of such %x is exactly the set
{%x | %x \in {1,...,%m}, \gcd(%k,%m) = 1}. But this is the definition of \phi(%m). Thus, there are \phi(%m)
elements in \Z/%m\Z that have a multiplicative inverse.
      ]]></example>
      <theorem title="Euler's theorem" required="true" hooks="math" id="360652037d3e48069d182158129d21af"><![CDATA[
For any %m \in \N and %a \in \Z/%m\Z, if \gcd(%m,%a) = 1 then we have that:
\begin{eqnarray}
  %a^{\phi(%m)} \mod %m & = & 1
\end{eqnarray}
      ]]></theorem>
      <text hooks="math"><![CDATA[
Notice that if %m is a prime number, then \phi(%m) = %m-1. Then for any %a \in \Z/%m\Z, \gcd(%a,%m) = 1 and
%a^{%m-1} \mod %m = 1. This is exactly the statement of <a href="#71a8e073b8f244809d2c321d5b5d2987">Fermat's little theorem</a>. Thus,
Euler's theorem is a generalization of Fermat's little theorem.
      ]]></text>
      <fact required="true" hooks="math" id="1f18f9b7a6374aa4b26e3c8a7394416a"><![CDATA[
For any %m \in \N and %a \in \Z/%m\Z, if \gcd(%m,%a) = 1 then for any %i \in \Z/\phi(%m)\Z such that %i \equiv 0 we have that
\begin{eqnarray}
  %a^{%i} \mod %m & = & 1
\end{eqnarray}
This is because:
\begin{eqnarray}
  %i & \equiv & 0 (\mod \phi(%m)) \\
     & = & %k \cdot \phi(%m) \\
  %a^{\phi(%m) \cdot %k} \mod %m & = & (%a^{\phi(%m)})^{%k} \mod %m \\
                                 & = & 1^{%k} \mod %m\\
                                 & = & 1 \mod %m
\end{eqnarray}
      ]]></fact>
      <fact required="true" hooks="math" id="f5afc57d00224255b4aa8326f21fa03f"><![CDATA[
For any %p \in \N, if %p is prime and %a \in \Z/%p\Z then for any %k \in \Z we have that:
\begin{eqnarray}
  %a^{%k} \mod %p & = & %a<sup>(%k \mod (%p-1))</sup> \mod %p
\end{eqnarray}
      ]]></fact>      
      <fact required="true" hooks="math" id="8bad52b8e4a740bd82929e05b1f36f15"><![CDATA[
For any %m \in \N and %a \in \Z/%m\Z, if \gcd(%m,%a) = 1 then for any %k \in \Z we have that:
\begin{eqnarray}
  %a^{%k} \mod %m & = & %a<sup>(%k \mod \phi(%m))</sup> \mod %m
\end{eqnarray}
      ]]></fact>
      <example required="true" hooks="math" id="c47927590c574dce988fa40e2e91208f"><![CDATA[
We can compute the integer value 2<sup>38</sup></sup> \mod 7 as follows because 7 is prime:
\begin{eqnarray}
 2<sup>38</sup> & \equiv & 2<sup>38 \mod (7-1)</sup></sup> (\mod 7) \\
           & \equiv & 2<sup>38 \mod 6</sup></sup> \\
           & \equiv & 2<sup>2</sup> \\
           & \equiv & 4
\end{eqnarray}
Since the final operation in the integer term is a modulus operation, the congruence class 4 is also exactly the integer result of the term.
      ]]></example>
      <example required="true" hooks="math" id="a6a86d873169432191980582bc8df5ac"><![CDATA[
We can compute 4<sup>2<sup>10000000</sup></sup> \mod 5 as follows because 5 is prime:
\begin{eqnarray}
 4<sup>2<sup>10000000</sup></sup> & \equiv & 4<sup>2<sup>10000000</sup> \mod (5-1)</sup> (\mod 5) \\
           & = & 4<sup>2<sup>10000000</sup> \mod 4</sup> \\
           & = & 4<sup>0</sup> \\
           & = & 1
\end{eqnarray}
      ]]></example>
      <example required="true" hooks="math" id="f5278854ef4646ed91d31eb66e027d89"><![CDATA[
We can compute 4<sup>8<sup>100</sup>+ 3</sup> \mod 15 as follows because \gcd(4,15) = 1:
\begin{eqnarray}
 4<sup>(8<sup>100</sup> + 3)</sup> & \equiv & 4<sup>(8<sup>100</sup> + 3) \mod \phi(15)</sup> (\mod 15) \\
           & = & 4<sup>(8<sup>100</sup> + 3) \mod ((5-1) \cdot (3-1))</sup> \\
           & = & 4<sup>(8<sup>100</sup> + 3) \mod 8</sup> \\
           & = & 4<sup>3</sup> \\
           & = & 64 \\
           & = & 4
\end{eqnarray}
      ]]></example>
      <example required="true" hooks="math" id="d26c725f52774b4a99bd80e50166cf09"><![CDATA[
Compute 5<sup>6603</sup> \mod 7.
      ]]></example>
      <fact required="true" hooks="math" id="aae0b3af632b4da99cd398d887c5f764"><![CDATA[
For any %m \in \N and %a \in \Z/%m\Z where \gcd(%m,%a) = 1, we can use the
<a href="#360652037d3e48069d182158129d21af">Euler's theorem</a> to find the inverse of %a. Notice that:
\begin{eqnarray}
  %a^{\phi(%m)} \mod %m & = & 1 \\
  (%a^{\phi(%m)-1} \cdot %a) \mod %m & = & 1
\end{eqnarray}
Thus, %a^{\phi(%m)-1} \mod %m is the multiplicative inverse of %a in \Z/%m\Z.
      ]]></fact>
      <example required="true" hooks="math" id="7a27183ee864460b9e74c00f50dca709">
        <text><![CDATA[
Find the multiplicative inverse of 5^2 in \Z/7\Z.
        ]]></text>
        <paragraph hooks="math"><![CDATA[
It is sufficient to notice that 5^6 \equiv 1 (\mod 7), so 5^2 \cdot 5^4 \equiv 1, so 5^4 is the inverse of 5^2 in \Z/7\Z.
        ]]></paragraph>
      </example>
      <example required="true" hooks="math" id="96f6de6566c2443eb6442088a6656ca0"><![CDATA[
We can find the multiplicative inverse of 3 in \Z/22\Z using the following steps. We first compute \varphi(22) = 10. 
\begin{eqnarray}
  \varphi(22) & = & \varphi(11 \cdot 2) \\
               & = & \varphi(11) \cdot \varphi(2)\\
               & = & (11 %- 1) \cdot (2 %- 1) \\
               & = & 10 \cdot 1\\
               & = & 10
\end{eqnarray}
Next, we compute the inverse using <a href="#aae0b3af632b4da99cd398d887c5f764">Euler's theorem</a>.
\begin{eqnarray}
  3^{-1} & \equiv & 3<sup>\varphi(22) %- 1</sup> (\mod 22) \\
         & \equiv & 3<sup>10 %- 1</sup>\\
         & \equiv & 3<sup>9</sup> \\
         & \equiv & 3^3 \cdot 3^3 \cdot 3^3 \\
         & \equiv & 5 \cdot 5 \cdot 5 \\
         & \equiv & 25 \cdot 5 \\
         & \equiv & 3 \cdot 5 \\
         & \equiv & 15
\end{eqnarray}
      ]]></example>
      <definition required="true" hooks="math" id="a82f514b4c124193bc2b24d4314ad8a6"><![CDATA[
For %m \in \N, We define (\Z/%m\Z)* to be the following subset of
\Z/%m\Z:
\begin{eqnarray}
  (\Z/%m\Z)* & = & { %a | %a \in \Z/%m\Z, %a has an inverse in \Z/%m\Z }
\end{eqnarray}
      ]]></definition>
      <example hooks="math" id="d68ae36aa965466889e7612bfd8a0ba2"><![CDATA[
Does 11 have an inverse in \Z/22\Z (i.e., is it true that 11 \in (\Z/22\Z)*)?
      ]]></example>
      <example hooks="math" id="d697264b13d1422480042e2c5cf09a7b"><![CDATA[
Compute |(\Z/35\Z)*|.

\begin{eqnarray}
  |(\Z/35\Z)*| & = & |{ %a | %a \in \Z/35\Z, %a has an inverse in \Z/35\Z }| \\
               & = & |{ %a | %a \in \Z/35\Z, \gcd(%a,35) = 1 }| \\
               & = & |{ %a | %a \in \Z/35\Z, \gcd(%a,35) = 1 }| \\
               & = & \phi(35) \\
               & = & \phi(5 \cdot 7) \\
               & = & \phi(5) \cdot \phi(7) \\
               & = & 4 \cdot 6 \\
               & = & 24 \\
\end{eqnarray}
      ]]></example>
      <fact required="true" hooks="math" id="1827900c115b4594bb5bd74ef4071600"><![CDATA[
For any %m \in \N, (\Z/%m\Z)* is closed under multiplication modulo %m.
That is, for any %a \in \Z/%m\Z and %b \in \Z/%m\Z, if there exist %a^{-1} \in \Z and %b^{-1} \in \Z
then (%a \cdot %b) has an inverse (%a^{-1} \cdot %b^{-1}). We can use the commutativity of multiplication to show this:
\begin{eqnarray}
 (%a \cdot %b) \cdot (%a^{-1} \cdot %b^{-1}) & \equiv & (%a \cdot %a^{-1}) \cdot (%b \cdot %b^{-1}) \\
                                             & \equiv & 1 \cdot 1 \\
                                             & \equiv & 1
\end{eqnarray}
      ]]></fact>
    </subsection>
    <!--include sheaf="assignment-three.xml"/-->
  </section>
  <review title="Properties, Algorithms, and Applications of Modular Arithmetic">
    <text><![CDATA[
This section contains a comprehensive collection of review problems going over the course material covered until this point. Many of these problems are an accurate representation of the kinds of problems you may see on an exam.
    ]]></text>
    <exercise required="true" id="7f89ddc6035e40679e68e1c67eeefe16">
      <text hooks="math"><![CDATA[
For some %a \in \N, suppose that %a^{-1} \in \Z/21\Z and %a^{-1} \in \Z/10\Z (that is, %a has an inverse in \Z/21\Z, and it also has
an inverse in \Z/10\Z). Determine whether or not %a has an inverse in \Z/210\Z. Explain why or why not. <b>Hint:</b> use \gcd.
      ]]></text>
      <solution hooks="math"><![CDATA[
If %a has an inverse in \Z/10\Z and \Z/21\Z, then \gcd(%a,10) = 1 and \gcd(%a,21) = 1. Since \gcd(10,21) = 1, %a shares no factors with the product
10 \cdot 21 = 210, so \gcd(%a, 210) = 1. Thus, %a must have a multiplicative inverse in \Z/210\Z.
      ]]></solution>
    </exercise>
    <exercise required="true" id="f0e87d17fbe1489d91ff8fa60e92c449">
      <text hooks="math"><![CDATA[
Bob is trying to implement a random number generator. However, he's distracted and keeps making mistakes while building his implementation.    
      ]]></text>
      <orderedlist style="list-style-type:lower-alpha">
        <item>
          <text hooks="math"><![CDATA[
Bob begins his algorithm by generating two coprime numbers %a and %m such that \gcd(%a,%m) = 1. However, he mixes them up and defines the following computation:
\begin{eqnarray}
  [ %~ (%i \cdot %m) \mod %a %~ | %~ %i \in {1,...,%a-1} %~ ]
\end{eqnarray}
Is Bob going to get a permutation? Why or why not?
          ]]></text>
          <solution hooks="math"><![CDATA[
Yes, Bob will still get a permutation because \gcd(%a,%m) = 1, which means %m \mod %a is also coprime with %m (we can see this because this is exactly what the extended Euclidean algorithm computes before making a recursive call, or by observing that if %m \mod %a shares a factor with %a, so must %m).
          ]]></solution>
        </item>
        <item>
          <text hooks="math"><![CDATA[
Bob notices part of his mistake and tries to fix his algorithm; he ends up with the following:
\begin{eqnarray}
  [ %~ (%i \cdot %m) \mod %m %~ | %~ %i \in {1,...,%m-1} %~ ]
\end{eqnarray}
How many distinct elements does the list he gets in his output contain?
          ]]></text>
          <solution hooks="math"><![CDATA[
It contains exactly one element: 0 (\mod %m), since all multiples of the congruence class %m are equivalent to 0 (\mod %m).
          ]]></solution>
        </item>
        <item>
          <text hooks="math"><![CDATA[
Bob notices his algorithm isn't returning a permutation, but he mixes up a few theorems and attempts the following fix:
\begin{eqnarray}
  [ %~ (%i \cdot %a^{%m-1}) \mod %m %~ | %~ %i \in {1,...,%m-1} %~ ]
\end{eqnarray}
Bob tests his algorithm on some %m values that are prime numbers. How many elements does the set he gets in his output contain?
          ]]></text>
          <solution hooks="math"><![CDATA[
It contains all the elements {1,...,%m-1}, generated in ascending order, since by Fermat's little theorem, %a^{%m-1} \equiv 1 (\mod %m) if %m is prime.
          ]]></solution>
        </item>
        <item>
          <text hooks="math"><![CDATA[
Bob doesn't like the fact that his permutation doesn't look very random, so he moves the %i term to the exponent:
\begin{eqnarray}
  [ %~ (%a<sup>%i \cdot (%m-1)</sup>) \mod %m %~ | %~ %i \in {1,...,%m-1} %~ ]
\end{eqnarray}
Bob tests his algorithm on some %m values that are prime numbers. How many elements does the set he gets in his output contain?
          ]]></text>
          <solution hooks="math"><![CDATA[
It contains exactly one element: 1 (\mod %m), since by the consequences of Fermat's little theorem and Euler's theorem, if %m is prime we have:
\begin{eqnarray}
  %a^{%k} & \equiv &  %a<sup>%k \mod \phi(%m)</sup> (\mod %m) \\
          & \equiv &  %a<sup>%k \mod (%m-1)</sup> (\mod %m)
\end{eqnarray}
          ]]></solution>
        </item>
      </orderedlist>
    </exercise>
    <exercise required="true" id="7fd62f148a51409d9ae771dd8fc598f3">
      <text hooks="math"><![CDATA[
Suppose you have the following instance of B&eacute;zout's identity: 2 \cdot 3 + (%-1) \cdot 5 = 1. Solve the following system of equations:
\begin{eqnarray}
  %x & \equiv & 2 (\mod 3)\\
  %x & \equiv & 3 (\mod 5)
\end{eqnarray}
      ]]></text>
      <solution hooks="math"><![CDATA[
Given 3^{-1} \equiv 2 (\mod 5), and 5^{-1} \equiv %-1 \equiv 2 (\mod 3), the formula for the solution is:
\begin{eqnarray}
  %x & \equiv & 2 \cdot (5 \cdot 5^{-1}) + 3 \cdot (3 \cdot 3^{-1}) (\mod (3 \cdot 5)) \\
     & \equiv & 2 \cdot (5 \cdot 2) + 3 \cdot (3 \cdot 2) \\
     & \equiv & 20 + 18 \\
     & \equiv & 38 (\mod 15) \\
     & \equiv & 8 (\mod 15)
\end{eqnarray}
      ]]></solution>
    </exercise>
    <exercise required="true" id="de15ff32c7af4d709b0524179a70c225">
      <text hooks="math"><![CDATA[
Solve the following system of equations:
\begin{eqnarray}
  %x & \equiv & 2 (\mod 7)\\
  %x & \equiv & 3 (\mod 5)
\end{eqnarray}
      ]]></text>
      <solution hooks="math"><![CDATA[
To demonstrate an alternative but inefficient method to find a solution, we can list the positive members of the equivalence classes 2 \in \Z/7\Z and 3 \in \Z/5\Z that are less than 7 \cdot 5 = 35. The one element that appears in both lists is the unique solution in \Z/35\Z to the above system.
\begin{eqnarray}
  2 + 7\Z & = & {..., 2, 9, 16, <b style="color:firebrick;">23</b>, 30, ...} \\
  3 + 5\Z & = & {..., 3, 8, 13, 18, <b style="color:firebrick;">23</b>, 28, 33, ...}
\end{eqnarray}
      ]]></solution>
    </exercise>
    <exercise required="true" id="f808918018c94205b8837f923a021b7c">
      <text hooks="math"><![CDATA[
Determine the size of the following set:
\begin{eqnarray}
  {%x | %x \in \Z/(11 \cdot 13)\Z, %~ %x \equiv 5 \mod 11, %~ %x \equiv 7 \mod 13}
\end{eqnarray}
      ]]></text>
      <solution hooks="math"><![CDATA[
By the Chinese remainder theorem, we know there exists exactly one solution in \Z/(11 \cdot 13)\Z to the following system of equations:
\begin{eqnarray}
  %x & \equiv & 5 (\mod 11)\\
  %x & \equiv & 7 (\mod 13)
\end{eqnarray}
Thus, the size of the set is 1.
      ]]></solution>
    </exercise>
    <exercise required="true" id="18058ad03ac0424c8fb39d9c8c3b0b09">
      <text hooks="math"><![CDATA[
For a given %y \in \Z/(%p \cdot %q)\Z where %p and %q are distinct primes,
how many solutions does the following system of equations have:
\begin{eqnarray}
  %x & \equiv & %y^2 (\mod %p)\\
  %x & \equiv & %y^2 (\mod %q)
\end{eqnarray}
      ]]></text>
      <solution hooks="math"><![CDATA[
The value %y^2 \in \Z/(%p \cdot %q)\Z is a constant with respect to %x, so by the Chinese remainder theorem, there
is exactly one solution %x \in \Z/(%p \cdot %q)\Z to the above system.
      ]]></solution>
    </exercise>
    <exercise required="true" id="3b0c37d6b09a4b48b82784b3ea5cdb6a">
      <text hooks="math"><![CDATA[
    Determine the size of the following set:
\begin{eqnarray}
  {%x | %x \in \Z/(11 \cdot 13)\Z, %~ %s \in \Z/11\Z, %~ %t \in \Z/13\Z, %~ %x \equiv %s \mod 11, %~ %x \equiv %t \mod 13 }
\end{eqnarray}
      ]]></text>
      <solution hooks="math"><![CDATA[
Consider the following set. Notice that the right-hand side of the comprehension is exactly the same as that of the above.
The only difference is that the left-hand side %x in the above expression has been replaced with (%x, %s, %t).
\begin{eqnarray}
  {(%x, %s, %t) | %x \in \Z/(11 \cdot 13)\Z, %s \in \Z/11\Z, %t \in \Z/13\Z, %x \equiv %s \mod 11, %x \equiv %t \mod 13 }
\end{eqnarray}
By the Chinese remainder theorem, we know that exactly one tuple (%x, %s, %t) for each %x \in \Z/(11 \cdot 13)\Z will satisfy
the conditions in the comprehension,
because for each distinct pair (%s, %t), exactly one %x \in \Z/(11 \cdot 13)\Z will be a solution to the system of equations:
\begin{eqnarray}
  %x & \equiv & %s (\mod 11)\\
  %x & \equiv & %t (\mod 13)
\end{eqnarray}
Thus, the conditions in the comprehension will be satisfied at least once for every %x \in \Z/(11 \cdot 13)\Z. Thus, the entire
set is exactly the set \Z/(11 \cdot 13)\Z, and it is the case that
\begin{eqnarray}
  |\Z/(11 \cdot 13)\Z| & = & 11 \cdot 13 & = & 143
\end{eqnarray}
      ]]></solution>
    </exercise>
    <exercise required="true" id="30252cf47de746dd99a8c2b0a8836a6d">
      <text hooks="math"><![CDATA[
Suppose that %n \in \N is even and %n/2 %- 1 is odd. Determine the size of the following set:
\begin{eqnarray}
  {%i \cdot (%n/2 - 1) \mod %n | %i \in {0,...,%n-1} }
\end{eqnarray}
      ]]></text>
      <solution hooks="math"><![CDATA[
We know that \gcd(%n/2 %- 1, %n/2) = 1. Since %n/2 %- 1 is odd, 2 is not a factor of %n/2 %- 1, so \gcd(%n/2 %- 1, %n) = 1.
Thus, %n/2 %- 1 and %n are coprime. Thus, the above set must be a permutation.
      ]]></solution>
    </exercise>
    <exercise required="true" id="683b2face9e9464da3d80a9785bd33ce">
      <text hooks="math"><![CDATA[
    For any %n \in \N, let %a \in \Z/%n\Z have an inverse %a^{-1} \in \Z/%n\Z.
Determine the size of the following set:
\begin{eqnarray}
  { (%a \cdot %i) \mod %n | %i \in \Z/%n\Z }
\end{eqnarray}
      ]]></text>
      <solution hooks="math"><![CDATA[
If %a has an inverse in \Z/%n\Z (whether or not %n is prime), then \gcd(%a, %n) = 1, so 
the above set must be a permutation.
      ]]></solution>
    </exercise>
    <exercise required="true" id="80c62418f74f4940b153f61233b615a4">
      <text hooks="math"><![CDATA[
Let %p be a prime number. Compute the set size |\Z/%p\Z - (\Z/%p\Z)*|.
      ]]></text>
      <solution hooks="math"><![CDATA[
Since (\Z/%p\Z)* is the set of elements of \Z/%p\Z that have multiplicative inverses, it is the set of elements %a \in \Z/%p\Z such that
\gcd(%a, %p) = 1. However, because %p is prime, all of the elements in \Z/%p\Z except 0 have this property (since \gcd(%p, 0) = %p; recall that
0/%p \in \Z and %p|0). Thus,
\begin{eqnarray}
  \Z/%p\Z - (\Z/%p\Z)* & = & {0}
\end{eqnarray}
Thus, |\Z/%p\Z - (\Z/%p\Z)*| = 1. Alternatively, we know that |\Z/%p\Z| = %p and |(\Z/%p\Z)*| = \phi(%p) = %p %- 1, and %p %- (%p %- 1) = 1.
      ]]></solution>
    </exercise>
    <exercise required="true" id="ff53ed5f701940399ccdc2672bf31470">
      <text hooks="math"><![CDATA[
In a game, you win if you can guess correctly whether a large number %n is prime in under a minute (if you are wrong, you win nothing and you lose nothing). You are given a handheld calculator that can only perform addition, subtraction, multiplication, division, exponentiation, and modulus (the calculator can represent arbitrarily large numbers, and can provides quotients to any precision). Describe one strategy you can use to give yourself a high probability of winning.
      ]]></text>
      <solution hooks="math"><![CDATA[
If you pick a few random %a \in {2,...,%n-1} and compute %a^{%n-1} \mod %n, if the result is ever greater than 1 (i.e., the Fermat primality test) then %a would be a witness that %n is composite. You would then be able to say with certainty that %p is not prime, winning the game. Once time is about to run out, you should guess that the number is prime.
      ]]></solution>
    </exercise>
    <exercise required="true" id="e4405c007621440ba33fbc71080daf84">
      <text hooks="math"><![CDATA[
Suppose that %n \in \N. Compute the following:
\begin{eqnarray}
  5<sup>3<sup>4 \cdot %n + 1</sup></sup> \mod 11
\end{eqnarray}
      ]]></text>
      <solution hooks="math"><![CDATA[
We can compute the exponent 3<sup>4 \cdot %n + 1</sup> modulo \phi(11) by Euler's theorem, because \gcd(5,11) = 1.
Likewise, we can compute the exponent within the exponent, 4 \cdot %n + 1, modulo \phi(\phi(11)) because \gcd(3,\phi(11)) = 1.
Thus, we have:
\begin{eqnarray}
  \phi(11) & = & 11 - 1 \\
           & = & 10 \\
  \phi(10) & = & \phi(5) \cdot \phi(2) \\
           & = & (5-1) \cdot (2-1) \\
           & = & 4 \\
  5<sup>3<sup>4 \cdot %n + 1</sup></sup> \mod 11 
     & = & 5<sup>3<sup>4 \cdot %n + 1 \mod \phi(\phi(11))</sup> \mod \phi(11)</sup> \mod 11 \\
     & = & 5<sup>3<sup>4 \cdot %n + 1 \mod 4</sup> \mod 10</sup> \mod 11 \\
     & = & 5<sup>3<sup>1</sup> \mod 10</sup> \mod 11 \\
     & = & 5<sup>3</sup> \mod 11 \\
     & = & (25 \cdot 5) \mod 11 \\
     & = & (3 \cdot 5) \mod 11 \\
     & = & 15 \mod 11 \\
     & = & 4 \mod 11
\end{eqnarray}
      ]]></solution>
    </exercise>
    <exercise required="true" id="b205a614b7c54fb9a2197cdf2371d615">
      <text hooks="math"><![CDATA[
Suppose we make the following simplifications:
<ul>
  <li>the Earth rovolves around the sun once per year;</li>
  <li>the asteroid Ceres rovolves around the sun every 5 years;</li>
  <li>the planet Jupiter revolves around the sun every 11 years.</li>
</ul>
Suppose that on June 21st, 2000, the Earth, Ceres, and Jupiter all align (i.e., one can draw a straight line through all three).      
      ]]></text>
      <orderedlist style="list-style-type:lower-alpha">
        <item>
          <text hooks="math"><![CDATA[
          Which two of these objects will align again on June 21st, and in which year?
          ]]></text>
          <solution hooks="math"><![CDATA[
 The next time Earth and Ceres align will be in five years, in 2005, as %x = 5 is the smallest non-zero solution in \N to the following
  system (the first equation represents alignment with Earth; the second equation represents alignment with
  Ceres):
\begin{eqnarray}
  %x & \equiv & 0 \mod 1 \\
  %x & \equiv & 0 \mod 5
\end{eqnarray}
          ]]></solution>
        </item>
        <item>
          <text hooks="math"><![CDATA[
          How many years will pass before all three align again?
          ]]></text>
          <solution hooks="math"><![CDATA[
  The smallest non-zero solution in \N to the following system is %x = 55, so they will all align again in 2055:
\begin{eqnarray}
  %x & \equiv & 0 \mod 1 \\
  %x & \equiv & 0 \mod 5 \\
  %x & \equiv & 0 \mod 11
\end{eqnarray}
          ]]></solution>
        </item>
        <item>
          <text hooks="math"><![CDATA[
Suppose that it is June 21st of some year between 2000 and 2055. At this time, there is no alignment. However, Jupiter aligned with earth on June 21st four years ago, and Ceres aligned with Earth on June 21st one year ago. What year is it?
          ]]></text>
          <solution hooks="math"><![CDATA[
The following system of equations captures the situation. Since the solution must be in \Z/55\Z, we can find a unique solution using the Chinese remainder theorem. By inspection of the elements of 4 + 11\Z = {4, 15, 26, ...}, the solution is %x = 26.
\begin{eqnarray}
  %x & \equiv & 0 \mod 1 \\
  %x & \equiv & 1 \mod 5 \\
  %x & \equiv & 4 \mod 11
\end{eqnarray}
Alternatively, we can use the formula; since %x \equiv 0 (\mod 1) is true for all %x, there are actually only two equations:
\begin{eqnarray}
  %x & \equiv & 1 \mod 5 \\
  %x & \equiv & 4 \mod 11
\end{eqnarray}
Since 11 \equiv 1 (\mod 5), 11^{-1} \equiv 1 (\mod 5); we also have:
\begin{eqnarray}
  5^{-1} & \equiv & 5^9 (\mod 11) \\
         & \equiv & 25^4 \cdot 5 \\
         & \equiv & 3^4 \cdot 5 \\
         & \equiv & 5 \cdot 3 \cdot 5 \\
         & \equiv & 4 \cdot 5 \\
         & \equiv & 9
\end{eqnarray}
Then the solution is:
\begin{eqnarray}
  %x & \equiv & 1 \cdot (11 \cdot 1) + 4 \cdot (5 \cdot 9) (\mod (5 \cdot 11)) \\
     & \equiv & 11 + 180 \\
     & \equiv & 191 \\
     & \equiv & 26
\end{eqnarray}
          ]]></solution>
        </item>
      </orderedlist>
    </exercise>
    <exercise required="true" id="7ec37fae5c0c4120ac8bbcce67b5802b">
      <text hooks="math"><![CDATA[
Suppose there exist two devices, where one can either produce or consume exactly 2 units of power and another can either produce or consume exactly 7 units of power:
<ul>
 <li>device A: +/%- 2 units</li>
 <li>device B: %-/+ 7 units</li>
</ul>
Suppose we want to produce exactly 1 unit of power using a combination of some number of A devices and B devices. Is this possible?
      ]]></text>
      <solution hooks="math"><![CDATA[
Yes, this is possible because 2 and 7 are coprime, so there exists an instance of B&eacute;zout's identity of the form 2 \cdot %s + 7 \cdot %t = 1.
      ]]></solution>
    </exercise>
    <!--<exercise required="true" id="8e6e32bb04754597ac53a7a3b6815825">
      <text hooks="math"><![CDATA[
Suppose Eve asks Alice for some sensitive information, so Alice requests that they employ the RSA protocol.
However, Eve wants to conserve resources, so she cheats. Eve chooses a large prime %p, picks an %e \in \Z/(%p-1)\Z, and tells
Alice that (%p,%e) is her public key.
      ]]></text>
      <text hooks="math"><![CDATA[
<ol style="list-style-type:lower-alpha;">
  <li>Suppose another eavesdropper, Carl, learns that Eve is cheating this way.
      Can he decrypt Alice's messages if he intercepts them in transit?</li>
      <div class="solution_container"><div class="solution">
      Yes. Carl can easily compute %d = %e^{-1} \mod \phi(%p) because he can compute \phi(%p) = %p-1 given the
      public value %p. Given any ciphertext %m^{%e} \mod %p, he can compute (%m^{%e})^{%d} \mod %p = %m
      to decrypt it.
      </div></div>
  <li>What can Alice do to check whether Eve is cheating 
      before she transmits any "encrypted" messages to her?
      <div class="solution_container"><div class="solution">
      Alice can use the Fermat primality test to check whether the %n in Eve's public key (%n,%e) is probably prime or composite.
      If the Fermat primality test indicates that %n is composite (i.e., Alice finds a witness %a \in \Z/%n\Z that %n is composite
      because %a^{%n-1} \mod %n \neq 1), Alice can agree to send encrypted messages to Eve.
      </div></div>
  </li>
  <li>What can Eve do to keep cheating but make it computationally more difficult for Alice to catch her?
      <div class="solution_container"><div class="solution">
      If Eve tells Alice that she will always use a Carmichael number %n for all her public keys, Alice will have
      a harder time detecting when Eve is cheating (i.e., if Alice is unable to find witnesses, Alice has no way of
      knowing whether this is because Eve is cheating and using a prime, or because Eve is using a Carmichael number for %n).
<br/><br/>
      However, Alice can adopt a policy that makes it impossible for Eve to cheat if she wants to communicate with Alice. Alice can
      announce that she will only send messages to Eve if Alice is able to quickly find a Fermat witness for %n. If Alice cannot
      find a witness quickly, Alice will request that the receiver generate a new %n and a new public key (%n, %e).
<br/><br/>
      Assuming Eve does not want to cheat, but wants to communicate with Alice, it is likely that any %n Eve generates will not be
      a Carmichael number, and if so, it is likely that Alice will be able to quickly detect that the %n is composite. Thus, adopting
      such a policy is very unlikely to impair Alice's ability to communicate with an honest receiver.
<br/><br/>
      Notice that simply encrypting some test messages and then trying to decrypt them in order to detect whether Eve is cheating
      can lead to false positive. As we saw in the previous problem, some ciphertexts may be exactly the same as the message being
      sent (by coincidence).
      </div></div>
  </li>
</ol>
      ]]></text>
    </exercise>-->
    <!--<text hooks="math"><![CDATA[
The following is a breakdown of what you should be able to do at this point in the course (and of what you may be tested on in an exam).
Notice that many of the tasks below can be composed. This also means that many problems can be solved in more than one way.
<ul>
  <li>problems that can be solved
    <ul>
      <li>generate a permutation of a set {1,...,%m-1}</li>
      <li>generate a "random" number using permutations</li>
      <li>find the greatest common divisor of two relatively small integers</li>
      <li>check if a number is prime
        <ul>
          <li>using an exhaustive search</li>
          <li>using the Fermat primality test</li>
        </ul>
      </li>
      <li>generate a random number in a certain range
      </li>
      <li>generate a random prime in a certain range
      </li>
      <li>use random primes to...
        <ul>
          <li>to share information requiring cooperation using Shamir secret sharing</li>
          <li>to store information on unreliable storage devices (using Shamir secret sharing)</li>
          <li>to perform many arithmetic operations %x_1 \oplus ... \oplus %x_{%n} for some operator \oplus in sequence more efficiently (using CRT)
            <ul>
              <li>if the range of the final output is known</li>
              <li>if working in parallel along multiple distinct %p_{%i} in \Z/%p_{%i}\Z, and then performing CRT once is less expensive than working in \Z/%n\Z the whole time</li>
            </ul>
          </li>
        </ul>
      </li>
      <li>solving equations and performing computations
        <ul>
          <li>solve a system of linear equations where each equation is modulo some %n_{%i} and the coefficient is coprime with the moduli
            <ul>
              <li>derive a system of equations from a word problem
                <ul>
                  <li>rotating objects</li>
                  <li>objects that generate/consume different amounts of power</li>
                  <li>Shamir secret sharing and applications</li>
                </ul>
              </li>
              <li>solve a system with additive and multiplicative inverses</li>
              <li>solve generalized cases (\gcd(%n,%m) > 1 and/or %c > 1 in %c \cdot %x \equiv %a (\mod %n))</li>
              <li>solve a system of three or four equations</li>
            </ul>
          </li>
          <li>compute exponents modulo %n efficiently
            <ul>
              <li>using Euler's theorem and \phi (when possible)</li>
              <li>using the efficient repeated-squaring method</li>
            </ul>
          </li>
          <li>compute multiplicative inverses \Z/%n\Z
            <ul>
              <li>using \phi(%n)</li>
              <li>using a given output from the extended Euclidean algorithms or (equivalently) an instance of B&eacute;zout's identity</li>
            </ul>
          </li>
        </ul>
      </li>
      <li>recognize when you cannot solve problems efficiently
        <ul>
          <li>RSA problem</li>
          <li>discrete logarithm</li>
        </ul>
      </li>
      <li>solve for the square root of a congruence class modulo a composite using CRT</li>
    </ul>
  </li>
</ul>
    ]]></text>-->
  </review>
  <section title="Computational Complexity of Modular Arithmetic Algorithms">
    <subsection title="Definition of computational problems and their complexity">
      <text><![CDATA[
Below, we review a small set of definitions and facts from complexity theory. We will only use these facts as they relate to problems in modular arithmetic
and abstract algebra. A course on computational complexity theory would go into more detail.
      ]]></text>
      <definition required="true" hooks="math" id="c10fd4086eb64890a943e7374e431d48"><![CDATA[
Informally, for some formula %f, we call a statement of the following form a <i>problem</i>:
<ul style="list-style-type:none;">
  <li>"<i>Given %x, find %y such that %f(%x, %y) is true.</i>"</li>
</ul>
      ]]></definition>
      <text hooks="math"><![CDATA[
In the above, %x can be viewed as the input describing the problem, and %y can be viewed as the solution to the problem.
      ]]></text>
      <definition required="true" hooks="math" id="be9d99a70ee040cabf8c338658d0e526"><![CDATA[
The <i>computational complexity</i> of a problem refers to the running time of the most efficient algorithm that can solve the problem.
      ]]></definition>
    </subsection>
    <subsection title="Complexity of algorithms for solving tractable problems">
      <text hooks="math"><![CDATA[
In this subsection we consider the running time of efficient algorithms for performing common arithmetic operations (addition, subtraction, multiplication, exponentiation, and division). We consider the complexity of these arithmetic operations on each of the following domains:
<ul>
  <li>unbounded positive integers;</li>
  <li>integers modulo 2^{%k};</li>
  <li>integers modulo %n for some %n \in \N.</li>
</ul>
All of our arithmetic algorithms will operate on bit string representations of positive integers. A bit string representation such as
\begin{eqnarray}
 %a_{%k-1}...%a_0
\end{eqnarray}
is defined to represent the integer
\begin{eqnarray}
2^{%k-1} \cdot %a_{%k-1} + ... + 2^0 \cdot %a_0 
\end{eqnarray}
Note that this means that %k = \lceil\log_2(%a)\rceil. Below are some specific examples:
\begin{eqnarray}
 <b>111</b> & = & 2^2 \cdot <b>1</b> + 2^1 \cdot <b>1</b> + 2^0 \cdot <b>1</b> \\
 <b>1101</b> & = & 2^3 \cdot <b>1</b> + 2^2 \cdot <b>1</b> + 2^1 \cdot <b>0</b> + 2^0 \cdot <b>1</b> \\
 <b>10</b> & = & 2^1 \cdot <b>1</b> + 2^0 \cdot <b>0</b>
\end{eqnarray}
Since the operations we consider usually take two arguments, we will follow the following conventions:
<ul>
  <li>the first (left-hand side) input is %x, an %k-bit integer;</li>
  <li>the second (right-hand side) input is %y, an %l-bit integer.</li>
</ul>
Thus, %x \leq 2^{%k} - 1 and %y \leq 2^{%l} - 1.
      ]]></text>
      <algorithm required="true" hooks="math" id="953ca38da75144f69c1742affe4639d5"><![CDATA[
There exists an algorithm that can compute the sum of a %k-bit integer %x and an %l-bit integer %y in time O(\max(%k,%l)+1). The size
of the output is O(\max(%k,%l)+1).

<ol style="list-style-type:none;">
 <li><b>addition of unbounded positive integers:</b> %k-bit integer %x, %l-bit integer %y</li>
 <li>
   <ol style="list-style-type:none;">
     <li>%r := 0 (a bit vector to store the result)</li>
     <li>%c := 0 (the carry bit)</li>
     <li>for %i from 0 to \max(%k,%l) %- 1
       <ol style="list-style-type:none;">
         <li>%r[%i] := (%x[%i] <b>xor</b> %y[%i]) <b>xor</b> %c</li>
         <li>%c := (%x[%i] <b>and</b> %y[%i]) <b>or</b> (%x[%i] <b>and</b> %c) <b>or</b> (%y[%i] <b>and</b> %c)</li>
       </ol>
     </li>
     <li>%r[\max(%k,%l)] := %c</li>
     <li>return %r</li>
   </ol>
 </li>
</ol>
      ]]></algorithm>
      <example required="true" id="953ca38da75144f69c1742affe4639da">
        <text hooks="math"><![CDATA[
Below is a Python implementation of the bitwise <a href="#953ca38da75144f69c1742affe4639d5">addition algorithm</a>.
        ]]></text>
        <code class="py"><![CDATA[
from bitlist import bitlist
def add(x, y):
    k = len(x)
    l = len(y)
    r = bitlist(0)
    c = 0
    for i in range(0, max(k,l)): # Upper bound is not inclusive.
        r[i] = (x[i] ^ y[i]) ^ c
        c = (x[i] & y[i]) | (x[i] & c) | (y[i] & c)
    r[max(k,l)] = c
    return r
        ]]></code>
      </example>
      <text hooks="math"><![CDATA[
How can we use the addition algorithm to implement multiplication? One approach for multiplying two positive integers %x, %y \in \N is to do repeated addition of %y (repeating the addition operations %x times). However, if %x is an %k-bit integer, this would require up to 2^{%k-1} addition operations, which would take exponential time in the representation size of the input %x.
      ]]></text>
      <paragraph hooks="math"><![CDATA[
A more efficient approach is to use the representation of %x as a sum of powers of 2, and to apply the distributive property. Suppose %x is represented as the binary bit string %a_{%k-1}...%a_0. Then we have:
\begin{eqnarray}
%x \cdot %y & = & (%a_{%k-1} \cdot 2^{%k-1} + ... + %a_2 \cdot 2^2 + %a_1 \cdot 2^1 + %a_0 \cdot 2^0) \cdot %y \\
            & = & (%a_{%k-1} \cdot 2^{%k-1} \cdot %y) + ... + (%a_2 \cdot 2^2 \cdot %y) + (%a_1 \cdot 2^1 \cdot %y) + (%a_0 \cdot 2^0 \cdot %y)
\end{eqnarray}
Notice that we have now rewritten multiplication as %k %- 1 addition operations. The only other problem is how to multiply %y by powers of 2. We can do so simply by appending a 0 to the bit string representation of %y. Suppose %y is represented as the binary bit string %b_{%k-1}...%b_0. Then we have:
\begin{eqnarray}
2 \cdot %y & = & 2 \cdot %b_{%k-1}...%b_1%b_0 \\
            & = & 2 \cdot (%b_{%k-1} \cdot 2^{%k-1} + ... + %b_1 \cdot 2^1 + %b_0 \cdot 2^0) \\
            & = & %b_{%k-1} \cdot 2^{%k} + ... + %b_1 \cdot 2^2 + %b_0 \cdot 2^1 \\
            & = & (%b_{%k-1} \cdot 2^{%k} + ... + %b_1 \cdot 2^2 + %b_0 \cdot 2^1) + 0 \cdot 2^0 \\
            & = & %b_{%k-1}...%b_1%b_0<b>0</b> \\
\end{eqnarray}
Thus, our algorithm only needs to depend on addition, and on shifting bit strings left by one (a.k.a., appending a 0 to the bit string at the position of the least significant bit).
      ]]></paragraph>
      <algorithm required="true" hooks="math" id="7e765d2f169941da9781157ee7e45e5c"><![CDATA[
There exists an algorithm that can compute the product of a %k-bit integer %x and an %l-bit integer %y in time O(%k \cdot (\max(%k,%l)+1+%k)) or O(\max(%k,%l)^2). The size of the output is O(%k+%l) (because the shift left for the 2^1 case does not contribute to the final result, the %l-bit integer is shifted left at most %k-1 times, but there may still be a carried bit on the last addition operation that is performed).

<ol style="list-style-type:none;">
 <li><b>multiplication of unbounded positive integers:</b> %k-bit integer %x, %l-bit integer %y</li>
 <li>
   <ol style="list-style-type:none;">
     <li>%r := 0 (a bit vector to store the result)</li>
     <li>for %i from 0 to %k %- 1
       <ol style="list-style-type:none;">
         <li>if %x[%i] is 1
           <ol style="list-style-type:none;">
             <li>%r := %r + %y (using unbounded integer addition)</li>
           </ol>
         </li>
         <li>shift the bits of %y left by one bit (i.e., multiply %y by 2)</li>
       </ol>
     </li>
     <li>return %r</li>
   </ol>
 </li>
</ol>
      ]]></algorithm>
      <example required="true" id="7e765d2f169941da9781157ee7e45e5a">
        <text hooks="math"><![CDATA[
Below is a Python implementation of the bitwise <a href="#7e765d2f169941da9781157ee7e45e5c">multiplication algorithm</a>. Note that it relies on the <a href="#953ca38da75144f69c1742affe4639da">bitwise addition algorithm implementation</a>.
        ]]></text>
        <code class="py"><![CDATA[
def mult(x, y):
    k = len(x)
    l = len(y)
    r = bitlist(0)
    for i in range(0, k): # Upper bound is not inclusive.
        if x[i] == 1:
            r = add(r, y)
        y = y << 1
    return r
        ]]></code>
      </example>
      <algorithm required="true" hooks="math" id="7f69eb1db05840608ceaa5f756e3512b"><![CDATA[
There exists an algorithm that can compute the exponentiation %x^{%y} of an %k-bit integer %x and an %l-bit integer %y in time O(%k \cdot 2^{%l}). The size of the output is O(%k \cdot 2^{%l}). Notice that this means that for unbounded integer outputs, the algorithm runs in exponential time because it must build an output the size of which is exponentially large in the size of the input.

<ol style="list-style-type:none;">
 <li><b>exponentiation of unbounded positive integers:</b> %k-bit integer %x, %l-bit integer %y</li>
 <li>
   <ol style="list-style-type:none;">
     <li>%r := 1 (a bit vector to store the result)</li>
     <li>for %i from 0 to %l %- 1
       <ol style="list-style-type:none;">
         <li>if %y[%i] is 1
           <ol style="list-style-type:none;">
             <li>%r := %r \cdot %x (using unbounded integer multiplication)</li>
           </ol>
         </li>
         <li>%x := %x \cdot %x (using unbounded integer multiplication)</li>
       </ol>
     </li>
     <li>return %r</li>
   </ol>
 </li>
</ol>
      ]]></algorithm> 
      <example required="true" id="7f69eb1db05840608ceaa5f756e3512a">
        <text hooks="math"><![CDATA[
Below is a Python implementation of the bitwise <a href="#7f69eb1db05840608ceaa5f756e3512b">exponentiation algorithm</a>. Note that it relies on the <a href="#7e765d2f169941da9781157ee7e45e5a">bitwise multiplication algorithm implementation</a>.
        ]]></text>
        <code class="py"><![CDATA[
def exp(x, y):
    k = len(x)
    l = len(y)
    r = bitlist(1)
    for i in range(0, l): # Upper bound is not inclusive.
        if y[i] == 1:
            r = mult(r, x)
        x = mult(x, x)
    return r
        ]]></code>
      </example>
      <algorithm required="true" hooks="math" id="8956b7ca2c7c49db8ce910ad6e21473c"><![CDATA[
There exists an algorithm that can compute the integer quotient \lfloor %x / %y \rfloor of an %k-bit integer %x and an %l-bit integer %y in time O((%k \cdot %k) + (%k \cdot (2 \cdot %k))) or O(%k^2).

<ol style="list-style-type:none;">
 <li><b>integer division of unbounded positive integers:</b> %k-bit integer %x, %l-bit integer %y</li>
 <li>
   <ol style="list-style-type:none;">
     <li>if %y > %x
       <ol style="list-style-type:none;">
         <li>return 0</li>
       </ol>
     </li>
     <li>for %i from 0 to %k %- 1
       <ol style="list-style-type:none;">
         <li>shift %y left by one bit</li>
       </ol>
     </li>
     <li>%t := 0 (a bit vector to store \lfloor %x / %y \rfloor \cdot %y)</li>
     <li>%q := 0 (a bit vector to store the integer quotient)</li>
     <li>%p := 2^{%k} (to keep track of the current power of 2)</li>
     <li>for %i from 0 to %k
       <ol style="list-style-type:none;">
         <li>if %t + %y \leq %x
           <ol style="list-style-type:none;">
             <li>%t := %t + %y (using unbounded integer addition)</li>
             <li>%q := %q + %p (using unbounded integer addition)</li>
           </ol>
         </li>
         <li>shift %y right by one bit</li>
         <li>shift %p right by one bit</li>
       </ol>
     </li>
     <li>return %q</li>
   </ol>
 </li>
</ol>
      ]]></algorithm>
      <example required="true" id="8956b7ca2c7c49db8ce910ad6e21473a">
        <text hooks="math"><![CDATA[
Below is a Python implementation of the bitwise <a href="#8956b7ca2c7c49db8ce910ad6e21473c">integer division algorithm</a>. Note that it relies on the <a href="#953ca38da75144f69c1742affe4639da">bitwise addition algorithm implementation</a>.
        ]]></text>
        <code class="py"><![CDATA[
def div(x, y):
    k = len(x)
    l = len(y)
    if y > x:
        return bitlist(0)
    for i in range(0, k): # Upper bound is not inclusive.
        y = y << 1
    t = bitlist(0)
    q = bitlist(0)
    p = bitlist(2**k)
    for i in range(0, k+1): # Upper bound is not inclusive.
        if add(t, y) <= x:
            t = add(t, y)
            q = add(q, p)
        y = y >> 1
        p = p >> 1
    return q
        ]]></code>
      </example>
      <algorithm required="true" hooks="math" id="057d160b84f04e01a6e3e07a70d6fcfb"><![CDATA[
There exists an algorithm that can compute %x \mod %y of an %k-bit integer %x and an %l-bit integer %y in time O(%k^2). This is accomplished by first performing integer division, then an integer multiplication, and then a subtraction. This corresponds to the formula for the modulus operation:
\begin{eqnarray}
%x \mod %y & = & %x - \lfloor %x/%y \rfloor \cdot %y
\end{eqnarray}
      ]]></algorithm>
      <text hooks="math"><![CDATA[
When we consider the operations above as operating on integers modulo 2^{%k} (with results also in 2^{%k}), this corresponds to simply dropping any bits beyond the %k least-significant bits when performing the computation.
      ]]></text>
      <fact required="true" hooks="math" id="4db1d122618f49c9bb5d4152f4067e19"><![CDATA[
There exists an algorithm that can compute the sum of two %k-bit integers %x and %y in time O(%k). The size of the output is O(%k).
      ]]></fact>
      <fact required="true" hooks="math" id="8740737aa2d84e10a057d4e9de7b3c28"><![CDATA[
There exists an algorithm that can compute the product of two %k-bit integers %x and %y in time O(%k^2). The size of the output is O(%k).
      ]]></fact>
      <fact required="true" hooks="math" id="bc171519c2314b30bb080119883eb73d"><![CDATA[
There exists an algorithm that can compute %x^{%y} for two %k-bit integers %x and %y in time O(%k^3). The size of the output is O(%k).
      ]]></fact>
      <fact required="true" hooks="math" id="092d3437af6449dd98379fbc3f3810d5"><![CDATA[
The recursive algorithm for \gcd (and the <a href="#4b73a6de740d492d9bf4d536da9f15ce">extended Euclidean algorithm</a>) makes O(\log (\max(%x,%y))) recursive calls on an integer inputs %x \in \N and %y \in \N. Notice that this means that the number of recursive calls is <i>linear</i>, or O(\max(%k,%l)), for inputs consisting of an %k-bit integer %x and an %l-bit integer %y.
      ]]></fact>
      <text hooks="math"><![CDATA[
To see the above, consider the following fact: for any %a \in \N, %b \in \N, if %b \leq %a then %a \mod %b < (1/2) \cdot %a. Consider the two possibilities for %a and %b:
<ul>
  <li>if %b \leq (1/2) \cdot %a, then \lfloor %a / %b \rfloor > 1, so:
\begin{eqnarray}
 (%a \mod %b)   & \lt &   %b   & \leq &   (1/2) \cdot %a
\end{eqnarray}
  </li>
  <li>if %b > (1/2) \cdot %a, then \lfloor %a / %b \rfloor = 1, so:
\begin{eqnarray}
 %a \mod %b & = & %a %- \lfloor %a/%b \rfloor \cdot %b \\
            & = & %a %- 1 \cdot %b \\
            & = & %a %- %b \\
            & \lt & %a %- ((1/2) \cdot %a) \\
            & \lt & (1/2) \cdot %a
\end{eqnarray}
  </li>
</ul>
Thus, every time %a \mod %b is computed in the algorithms, size of the second paramter is halved. Since every other invocation switches the two parameters, both parameters are halved. Thus, the number of invocations or iterations for an input %m is \log(%m).
      ]]></text>
      <fact required="true" hooks="math" id="1bd9fdaa8e794d36961c7653274eb297">
        <text><![CDATA[
The recursive algorithm for the <a href="#4b73a6de740d492d9bf4d536da9f15ce">extended Euclidean algorithm</a> on inputs consisting of a %k-bit integer %x and an %l-bit integer %y runs in time O(\max(%k,%l) \cdot (2 \cdot \max(%k,%l)^2 + \max(%k,%l))), or O(\max(%k,%l)^3). The number of recursive calls is about \max(%k,%l), and each recursive call involves an integer division, a multiplication, and a subtraction.
        ]]></text>
        <paragraph><![CDATA[
If all inputs and outputs are integers that can be represented with at most %k bits, the running time is then O(%k^3).
        ]]></paragraph>
      </fact>
      <fact required="true" hooks="math" id="9c4ff76f65dc4151babcb44010173a50">
        <text><![CDATA[
The following problem can be solved in polynomial time: given %x \in (\Z/%n\Z)*, compute %x^{-1}. This can be reduced to running the extended Euclidean algorithm, which has a polynomial running time.
        ]]></text>
        <paragraph><![CDATA[
If all inputs and outputs are integers that can be represented with at most %k bits, the running time is then O(%k^3).
        ]]></paragraph>
      </fact>
      <fact required="true" hooks="math" id="f93aa6f8325c4d3abf45fa13b2fe28eb">
        <text><![CDATA[
There exists an O(\max(%k,%l)^3 + (%k+%l)^2) algorithm that can solve the following system of two equations (for %k-bit integers %x,%x' and %l-bit integers %y,%y') using the Chinese remainder theorem:
\begin{eqnarray}
  %s & \equiv & %x' (\mod %x) \\
  %s & \equiv & %y' (\mod %y)
\end{eqnarray}
This algorithm calls the <a href="#4b73a6de740d492d9bf4d536da9f15ce">extended Euclidean algorithm</a> on %x and %y, and then performs four multiplications modulo (%x \cdot %y). If all inputs and outputs are integers that can be represented with at most %k bits, the running time is then O(%k^3).
        ]]></text>
      </fact>      
<!--
Suppose we have a set of distinct prime numbers {%p_1,...%p_{%j}} such that each prime has an %n-bit representation.
Let %P be the product of these primes. We must perform the following number of operations modulo %P:
<ol>
  <li>%k multiplications;</li>
  <li>%k exponentiations.</li>
</ol>
For each of the above, how large must %k be in order for us to choose to employ the Chinese remainder theorem instead of simply
performing the operations modulo %P directly using
the multiplication or exponentiation algorithms?

<ol>
  <li>Since the representation size of %P is %j \cdot %n bits, the multiplication operation modulo %P has a running time of O((%j \cdot %n)^2). 
      Multiplication operations modulo any of the
      primes %p_{%i} \in {%p_1,...%p_{%j}} have a running time of O(%n^2). Thus, the crossover point is the solution for %k given the following equation:
\begin{eqnarray}
  %k \cdot (%j \cdot %n)^2 & = & %k \cdot %j \cdot (%n^2) + (%j \cdot (%j \cdot %n)^3)
\end{eqnarray}
  </li>
</ol>
-->
      <exercise required="true" id="e37ef995bf8c4139b44a4d55aedbec3e">
        <text hooks="math"><![CDATA[
Multiply the following two numbers (represented in binary) using the multiplication algorithm presented in lecture: <b>1101</b> \cdot <b>101</b>.
        ]]></text>
        <solution hooks="math"><![CDATA[
We can proceed by repeatedly shifting the first input left (corresponding to multiplication by 2), and multiplying each shifted version by a corresponding digit from the second input:
\begin{eqnarray}
  <b>1101</b> \cdot <b>1</b> + <b>11010</b> \cdot <b>0</b> + <b>110100</b> \cdot <b>1</b>
    & = & <b>1101</b> + <b>110100</b> \\
    & = & <b>1000001</b>   
\end{eqnarray}
        ]]></solution>
      </exercise>
    </subsection>
    <subsection title="Complexity of (probably) intractable problems">
      <text hooks="math"><![CDATA[
In the previous section we saw that addition, subtraction, multiplication, exponentiation, and division (both integer division, modulus, and multiplication by multiplicative inverses) can all be computed efficiently (i.e., in polynomial time) both over integers and over congruence classes. It is also possible to efficiently compute roots and logarithms of integers (we omit proofs of this fact in this course). However, no efficient algorithms are known for computing roots and logarithms of congruence classes.
      ]]></text>
      <definition required="true" hooks="math" id="8766a5625b7f41189e61b5358a0d6c15"><![CDATA[
A problem can be solved in polynomial time iff there exists for some constant %c an algorithm that solves all instances of
the problem in time O(%n^{%c}). The set of all problems that can be solved in polynomial time is called %P, and if a problem can be solved in polynomial time, we say that <i>the problem is in %P</i>.
      ]]></definition>
      <definition required="true" hooks="math" id="2f6108a89f9a448d942add55faa473a7"><![CDATA[
A problem can be solved in exponential time iff there exists an algorithm that solves all instances of
the problem in time O(2^{%n}).    
      ]]></definition>
      <definition required="true" hooks="math" id="a0401871e9704af8867669de0f749bbf"><![CDATA[
There exists a <i>polynomial-time reduction</i> from a problem %A to a problem %B iff there exists a polynomial-time algorithm that
can convert any instance of problem %A into an instance of problem %B (i.e., convert an input for %A into an input for %B, and convert the output from %B into an output from %A). 
      ]]></definition>
      <text hooks="math"><![CDATA[
A polynomial-time reduction from one problem to another can be viewed as two separate polynomial-time algoritms: a conversion algorithm that takes inputs to problem %A and invokes a solver for problem %B some polynomial number of times, and a conversion algorithm that takes all the outputs obtained from the solver for problem %B and assembles and/or converts them into outputs for problem %A.
      ]]></text>
      <diagram hooks="math" id="c5f0b09e028040c7af8365fdc25c123a"><![CDATA[
<table class="container">
  <tr>
    <td class="box" style="background-color:powderblue;">solver for<br/>problem %B</td>
    <td><span style="font-size:20px;">&rArr;<br/>&rArr;<br/>&rArr;</span></td>
    <td class="box" style="background-color:powderblue;">conversion<br/>from output(s) from<br/>%B to output from %A</td>
  </tr>
  <tr>
    <td><span style="font-size:20px;">&uArr;&uArr;&uArr;</span></td>
    <td></td>
    <td><span style="font-size:20px;">&dArr;</span></td>
  </tr>
  <tr>
    <td class="box" style="background-color:powderblue;">conversion<br/>from input for<br/>%A to input(s) for %B</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">solver for<br/>problem %A</td>
  </tr>
</table>
      ]]></diagram>
      <text hooks="math"><![CDATA[
We can summarize the above diagram by simply saying that problem %A <i>reduces</i> to problem %B.
      ]]></text>
      <diagram hooks="math" id="5ebbf7b584394a8bb3a62e9be3fae8dc"><![CDATA[
<table class="container">
  <tr>
    <td class="box" style="background-color:powderblue;">problem %B</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">problem %A</td>
  </tr>
</table>
      ]]></diagram>
      <text hooks="math"><![CDATA[
We have already seen examples of such reductions. For example, a CRT solver for two equations makes a single call to the extended Euclidean algorithm. Thus, there exists a polynomial-time reduction from the problem of solving a two-equation system using CRT to the problem of computing multiplicative inverses.
      ]]></text>
      <diagram hooks="math" id="5ebbf7b584394a8bb3a62e9be3fa123c"><![CDATA[
<table class="container">
  <tr>
    <td class="box" style="background-color:powderblue;">finding<br/>multiplicative<br/>inverses</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">solving two-equation<br/>systems using CRT</td>
  </tr>
</table>
      ]]></diagram>
      <fact required="true" hooks="math" id="046a2bb8df6849f1a0d31d7f300087d2">
        <text><![CDATA[
If there exists a polynomial-time reduction from problem %A to problem %B, and problem %A is not in %P (i.e., there exists no polynomial-time algorithm to solve %A), then problem %B must not be in %P, either.
        ]]></text>
        <paragraph hooks="math"><![CDATA[
To see why %B cannot be in %P, we can present a proof by contradiction. Suppose that there <i>does</i> exist a polynomial-time algorithm to solve problem %B. Then the polynomial-time reduction from %A to %B can invoke a polynomial-time algorithm. But then the reduction and algorithm for %B working together will constitute a polynomial-time algorithm to solve %A. Then it must be that %A is in %P. But this contradicts the fact that %A is not in %P, so no such polynomial-time algorithm for %B could exist.
        ]]></paragraph>
      </fact>
      <text hooks="math"><![CDATA[
The above fact allows us to make conclusions about the computational complexity of certain problems based on their relationships (in terms of implementation) to other problems.
      ]]></text>
      <diagram hooks="math" id="123bf7b584394a8bb3a62e9be3fae8dc"><![CDATA[
<table class="container">
  <tr>
    <td class="box" style="background-color:powderblue;">problem %B<br/><br/><span style="color:firebrick; text-decoration:underline;">premise:</span><br/><span style="color:firebrick;">can be solved in<br/>polynomial time<br/><br/>%B \in %P</span></td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">problem %A<br/><br/><span style="color:green; text-decoration:underline;">conclusion:</span><br/><span style="color:green;">can be solved in<br/>polynomial time<br/><br/>%A \in %P</span></td>
  </tr>
  <tr><td></td><td></td><td></td></tr>
  <tr>
    <td class="box" style="background-color:powderblue;">problem %B<br/><br/><span style="color:green; text-decoration:underline;">conclusion:</span><br/><span style="color:green;"><i>cannot</i> be solved in<br/>polynomial time<br/><br/>%B \not\in %P</span></td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">problem %A<br/><br/><span style="color:firebrick; text-decoration:underline;">premise:</span><br/><span style="color:firebrick;"><i>cannot</i> be solved in<br/>polynomial time<br/><br/>%A \not\in %P</span></td>
  </tr>
</table>
      ]]></diagram>
      <text hooks="math"><![CDATA[
Intuitively, we can imagine that if problem %A is "attached to" (i.e., depends on) problem %B, an "easy" problem %B will "pull" %A down into the set of easily solvable problems %P, while a "difficult" problem %A will "pull" problem %B into the set of hard-to-solve problems.
      ]]></text>
      <conjecture title="factoring" required="true" hooks="math" id="40311190a4a9401486183845c7dabf11"><![CDATA[
The following problem is not in %P: given any integer %n \in \N where %n = %p \cdot %q and %p and %q 
are prime, find %p and %q.   
      ]]></conjecture>
      <fact required="true" hooks="math" id="f1bae63934b04111b2d98fb1f1b67e45"><![CDATA[
Suppose that %n = %p \cdot %q for two primes %p \in \N and %q \in \N. Given only %n and \phi(%n), it is possible
to compute %p and %q. Consider the following:
\begin{eqnarray}
 \phi(%n) & = & (%p %- 1) \cdot (%q %- 1) \\
 \phi(%n) & = & %p \cdot %q %- %p %- %q + 1 \\
 \phi(%n) & = & %n - %p %- %q + 1 \\
 \phi(%n) - %n & = & - %p %- %q + 1\\
 \phi(%n) - %n - 1 & = & %- %p %- %q
\end{eqnarray}
Thus, it is sufficient to solve the following system of equations for %p and %q:
\begin{eqnarray}
 %n & = & %p \cdot %q \\
 \phi(%n) - %n - 1 & = & %- %p %- %q
\end{eqnarray}
      ]]></fact>
      <example required="true" hooks="math" id="4c755c5e1f134888b50ab6239821d80f">
        <text><![CDATA[
Suppose that %n = 15 and \phi(%n) = 8. Factor %n.
        ]]></text>
        <paragraph hooks="math"><![CDATA[
We can plug %n and \phi(%n) into the system of equations derived in the <a href="#f1bae63934b04111b2d98fb1f1b67e45">applicable fact</a>:
\begin{eqnarray}
 15 & = & %p \cdot %q \\
 8 %- 15 %- 1 & = & %- %p %- %q
\end{eqnarray}
With two equations and two unknowns, we can now solve for %p and %q:
\begin{eqnarray}
 8 %- 15 %- 1 & = & %- %p %- %q \\
 %p & = & 15 %- 8 + 1 %- %q \\
     & = & 8 %- %q \\
 15 & = & (8 %- %q) \cdot %q \\
  0 & = & %- %q^2 + 8%q %- 15 \\
  0 & = & %q^2 %- 8%q + 15 \\
\end{eqnarray}
At this point, we use the quadratic equation:
\begin{eqnarray}
  %q & = & 1/2 \cdot (8 \pm \sqrt(64 %- 4(1)(15))) \\
  %q & = & 1/2 \cdot (8 \pm \sqrt(4)) \\
  %q & = & 1/2 \cdot (8 \pm 2) \\
  %q & \in & {3, 5} \\
  {%p, %q} & = & {3, 5}
\end{eqnarray}
        ]]></paragraph>
      </example>
      <conjecture title="computing &amp;phi;" required="true" hooks="math" id="89a168d4a51f419a9ed5619307d05b5e">
        <text><![CDATA[
The following problem is not in %P: given any integer %n \in \N where %n = %p \cdot %q and %p and %q are prime, find
\phi(%n).
        ]]></text>
        <paragraph><![CDATA[
If we can compute \phi(%n), then <a href="#f1bae63934b04111b2d98fb1f1b67e45">we can compute %p and %q</a>. If computing \phi(%n) were any easier than factoring %n (e.g., if we had a polynomial-time algorithm for computing \phi(%n)), then our claim about the hardness of factoring %n would be a contradiction. In other words, factoring %n can be <i>reduced</i> to solving \phi(%n).
        ]]></paragraph>
        <diagram><![CDATA[
<table class="container">
  <tr>
    <td class="box" style="background-color:powderblue;">computing \phi(%n)<br/><br/><span style="color:green; text-decoration:underline;">conclusion:</span><br/><span style="color:green;"><i>cannot</i> be solved in<br/>polynomial time<br/><br/>computing \phi(%n) \not\in %P</span></td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">factoring %n<br/><br/><span style="color:firebrick; text-decoration:underline;">conjecture:</span><br/><span style="color:firebrick;"><i>cannot</i> be solved in<br/>polynomial time<br/><br/>factoring \not\in %P</span></td>
  </tr>
</table>
        ]]></diagram>
      </conjecture>
      <text hooks="math"><![CDATA[
The above fact (i.e., that if factoring %n is not in %P, then neither is computing \phi(%n)) holds for arbitrary %n, not just a product of two primes. However, the proofs in those cases are more sophisticated [<a href="http://www.shoup.net/ntb/ntb-v2.pdf">Shoup</a>].
      ]]></text>
      <paragraph hooks="math"><![CDATA[
Suppose we are given the following equation:
\begin{eqnarray}
  %x^{%y} & = & %z
\end{eqnarray}
There are three computational questions we could ask about the above equation:
<ul>
  <li>given %x and %y, compute %z (this is the exponentiation operation);</li>
  <li>given %x and %z, compute %y (this is the logarithm operation, since we have \log<sub>%x</sub> %z = %y in an equivalent notation);</li>
  <li>given %y and %z, compute %x (this is the %yth root operation, since we have &nbsp;^{%y}\sqrt(%z) = %x in an equivalent notation).</li>
</ul>
We have efficient algorithms for computing all three of the above if %x, %y, and %z are all integers or real numbers. Suppose we instead consider the following equation for some %n \in \N:
\begin{eqnarray}
  %x^{%y} & \equiv & %z (\mod %n)
\end{eqnarray}
In other words, we can interpret the equation as a congruence of equivalence classes in \Z/%n\Z. In this case, we already know that the first operation (exponentiation) has an efficient implementation because <a href="#7f69eb1db05840608ceaa5f756e3512b">exponentiation</a> and <a href="#057d160b84f04e01a6e3e07a70d6fcfb">modulus</a> are both efficient operations. However, we believe that the other two operations (computation of logarithms and roots of congruence classes) are computationally difficult (no polynomial-time algorithm exists to compute solutions).
      ]]></paragraph>
      <conjecture title="RSA problem" required="true" hooks="math" id="ef5cfce470f24effab453d5e770b1a37"><![CDATA[
The following problem is not in %P: compute %m given only the following:
\begin{eqnarray}
  %n & = & %p \cdot %q & %~ & for two primes %p and %q in \N \\
  %e & \in & \Z/\phi(%n)\Z & %~ & where %e \geq 3 \\
  %c & = & %m^{%e} \mod %n & %~ & for an unknown %m \in \Z/%n\Z
\end{eqnarray}
Notice that the RSA problem is analogous to computing the %eth root of %c in \Z/%n\Z:
\begin{eqnarray}
 ^{%e}\sqrt(%c) (\mod %n) & = & ^{%e}\sqrt(%m^{%e}) (\mod %n) & = & %m (\mod %n)
\end{eqnarray}

Note also that this can be accomplished by first finding \phi(%n) and then computing the inverse of %e, but this is as difficult as factoring
%n, and we assume that is not in %P. Is there another way to
compute %m? We do not know, but we assume that there is no other <i>faster</i> (i.e., polynomial-time) way to do so.
      ]]></conjecture>
      <conjecture title="discrete logarithm assumption" required="true" hooks="math" id="4c406aab6b32433f95de381191900df7"><![CDATA[
The following problem is not in %P: compute %e given only the following:
\begin{eqnarray}
  %n & \in & \N \\
  %m & \in & {1,...,%n %- 1} \\
  %c & = & %m^{%e} \mod %n & %~ & for an unknown %e \in \N
\end{eqnarray}
Notice that this is analogous to computing the logarithm of a value %c in \Z/%n\Z with respect to a known base %m:
\begin{eqnarray}
 \log_{%m} (%c) & = & \log_{%m} (%m^{%e}) & = & %e
\end{eqnarray}      
      ]]></conjecture>
      <text hooks="math"><![CDATA[
Note that the RSA problem requires that %e \geq 3, so it does not include the problem of computing square roots. The last intractable problem we will consider in this section is the problem of computing square roots of congruence classes within \Z/%n\Z for some %n \in \N. We examine this problem separately from the RSA problem because it is possible to reduce factoring directly to the problem of computing square roots (while there is currently no known deterministic polynomial-time reduction from the factoring problem to the RSA problem).
      ]]></text>
      <paragraph hooks="math"><![CDATA[
Before we formally define the problem of computing square roots in \Z/%n\Z, we must first introduce some concepts and facts. This is because the problem of computing square roots in \Z/%n\Z is different from the problem of computing square roots of integers in \N, and this difference is likely what makes it computationally more difficult.
      ]]></paragraph>
      <definition required="true" hooks="math" id="4b7191643ef4439abe376faad0aee172"><![CDATA[
Given some %n \in \N and some %y \in \Z/%n\Z, we say that %y is a <i>quadratic residue</i> in \Z/%n\Z if there exists %x \in \Z/%n\Z such that %x^2 \equiv %y.
      ]]></definition>
      <example required="true" hooks="math" id="5ea62ac0bcc44592bd1098e5b7e4733b"><![CDATA[
Let us find the quadratic residues in \Z/7\Z:
\begin{eqnarray}
 0^2 \equiv 0 (\mod 7) \\
 1^2 \equiv 1 (\mod 7) \\
 2^2 \equiv 4 (\mod 7) \\
 3^2 \equiv 2 (\mod 7) \\
 4^2 \equiv 2 (\mod 7) \\
 5^2 \equiv 4 (\mod 7) \\
 6^2 \equiv 1 (\mod 7)
\end{eqnarray}
The quadratic residues in \Z/7\Z are 0, 1, 2, and 4. Notice that 3, 5, and 6 are not quadratic residues in \Z/7\Z. Thus, the equations %x^2 \equiv 3, %x^2 \equiv 5, and %x^2 \equiv 6 have no solution in \Z/7\Z.
      ]]></example>
      <example required="true" hooks="math" id="e2fd94d60f4d4268b38e671751f68d6e"><![CDATA[
Consider the set of congruence classes \Z/5\Z. We have that:
\begin{eqnarray}
 0^2 \equiv 0 (\mod 5) \\
 1^2 \equiv 1 (\mod 5) \\
 2^2 \equiv 4 (\mod 5) \\
 3^2 \equiv 4 (\mod 5) \\
 4^2 \equiv 1 (\mod 5)
\end{eqnarray}
Notice that 2 and 3 are not quadratic residues in \Z/5\Z. Thus, neither %x^2 \equiv 2 nor %x^2 \equiv 3 have solutions in \Z/5\Z.
      ]]></example>
      <fact required="true" hooks="math" id="c16f0f811c8c44338b07fd7d19188c7d">
        <text><![CDATA[
Given some %n \in \N and some %y \in \Z/%n\Z, if %y and %n are coprime and %y is a <i><b>non-zero</b> quadratic residue</i> in \Z/%n\Z then there exist <i>at least</i> two %a,%b \in \Z/%n\Z such that %a \neq %b, %a^2 \equiv %y, and %b^2 \equiv %y.
        ]]></text>
        <paragraph hooks="math"><![CDATA[
Note that this is analogous to square roots in \Z (since \sqrt(%z) \in \Z and %-\sqrt(%z) \in \Z are both square roots of %z \in \Z if they exist).
        ]]></paragraph>
        <paragraph hooks="math"><![CDATA[
We can prove this fact in the following way: suppose that %y is a quadratic residue. Then there exists at least one %x \in \Z/%n\Z such that:
\begin{eqnarray}
 %x^2 \mod %n & = & %y
\end{eqnarray}
But this means that (%n %- %x) \in \Z/%n\Z is such that:
\begin{eqnarray}
  ((%n %- %x)^2) \mod %n & = & (%n^2 %- (2 \cdot %n \cdot %x) + %x^2) \mod %n \\
                      & = & %x^2 \mod %n \\
                      & = & %y \mod %n \\
\end{eqnarray}
Thus, %x and (%n %- %x) are both roots of %y.
        ]]></paragraph>
      </fact>
      <example required="true" hooks="math" id="7a1e37130bb84e0dbeef0112278ceb5d"><![CDATA[
It is the case that 4 \in \Z/5\Z is a quadratic residue in \Z/5\Z, with two roots 2 and 3:
\begin{eqnarray}
 2^2 \mod 5 & = & 4 \\
 3^2 \mod 5 & = & 9 \mod 5 \\
            & = & 4 \\
\end{eqnarray}
      ]]></example>
      <example required="true" hooks="math" id="3d4c2f8a896b420a895a4c57af3ac489"><![CDATA[
Consider 0 \in \Z/3\Z. We have that:
\begin{eqnarray}
 0^2 \equiv 0 (\mod 3) \\
 1^2 \equiv 1 (\mod 3) \\
 2^2 \equiv 1 (\mod 3)
\end{eqnarray}
Thus, %x^2 \equiv 0 has exactly one solution in \Z/3\Z.
      ]]></example>
      <fact required="true" hooks="math" id="c9d99b8895184194a8462eda35fb5d30"><![CDATA[
Let %p \in \N be a prime such that %p \mod 4 = 3, and suppose that %y \in \Z/%p\Z. Then %y has either 0, 1, or 2 roots in \Z/%p\Z.
      ]]></fact>
      <example required="true" hooks="math" id="7d06a3b77e4846728ea3569d9d1d7c6f"><![CDATA[
Suppose we want to solve the following equation for %x \in \Z/7\Z:
\begin{eqnarray}
  %x^2 & \equiv & 3 (\mod 7)
\end{eqnarray}
Suppose we start by squaring both sides:
\begin{eqnarray}
  %x^4 & \equiv & 3^2 (\mod 7)
\end{eqnarray}
We can then use Euler's theorem to add any multiple of \varphi(7) to the exponent:
\begin{eqnarray}
  %x^4 & \equiv & 3^2 \cdot 1 (\mod 7) \\
  %x^4 & \equiv & 3^2 \cdot 3<sup>\varphi(7)</sup> \\
  %x^4 & \equiv & 3<sup>2 + \varphi(7)</sup>
\end{eqnarray}
Since 7 is prime, \varphi(7) must be even, so 2 + \varphi(7) is also even. Thus, we can divide the exponent by 2 on both sides.
\begin{eqnarray}
  %x^2 & \equiv & 3<sup>(2 + \varphi(7))/2</sup>
\end{eqnarray}
Furthermore, since 7 \equiv 3 (\mod 4), we know that 2 + \varphi(7) is a multiple of 4. Thus, we can actually divide both exponents by 4:
\begin{eqnarray}
  %x & \equiv & 3<sup>(2 + \varphi(7))/4</sup>
\end{eqnarray}
Thus, we have found %x as a power of the original quadratic residue 3.
      ]]></example>
      <fact required="true" hooks="math" id="3d06a3b21e4846728ea3569d9d1d7c6f"><![CDATA[
Let %p \in \N be a prime such that %p \mod 4 = 3, and suppose that %y \in \Z/%p\Z is a quadratic residue with two roots in \Z/%p\Z.
Then we can compute the roots using the following formula:
\begin{eqnarray}
 %x \equiv \pm %y<sup>(%p+1)/4</sup> (\mod %p)
\end{eqnarray}
      ]]></fact>
      <text hooks="math"><![CDATA[
In fact, if the modulus %n is not prime, there may exist <i>more than two</i> roots of a value in \Z/%n\Z.
      ]]></text>
      <example required="true" hooks="math" id="444c4ac15a59427782f566d7b8d32fd7"><![CDATA[
It is the case that 1,-1,6,-6 \in \Z/35\Z are all square roots of 1 \in \Z/35\Z:
\begin{eqnarray}
 1^2 \mod 35 & = & 1 \\
 (-1)^2 \mod 35 & = & 34^2 \mod 35 \\
                & = & 1156 \mod 35 \\
                & = & ((33 \cdot 35)+1) \mod 35 \\
                & = & 1 \mod 35 \\
 6^2 \mod 35 & = & 36 \mod 35 \\
                & = & 1 \mod 35 \\
 (-6)^2 \mod 35 & = & 29^2 \mod 35 \\
                & = & 841 \mod 35 \\
                & = & ((24 \cdot 35)+1) \mod 35 \\
                & = & 1 \mod 35
\end{eqnarray}
      ]]></example>
      <example required="true" hooks="math" id="ae8852f36bbb47028ce9c1dc6726327c"><![CDATA[
Suppose we are given an instance of the congruent squares problem where %y = 2 and %n = 15. We want to find %x \in \Z/15\Z
such that %x \not\equiv \pm %y but %x^2 \equiv %y^2 \equiv 2^2 \equiv 4.

Notice that we have that:
\begin{eqnarray}
 %y       & \equiv & 2 \mod 3 \\
 %y^2     & \equiv & 2^2 \mod 3 \\
          & \equiv & 1 \mod 3 \\
 (3-%y)^2 & \equiv & 1^2 \mod 3 \\
          & \equiv & 1 \mod 3
\end{eqnarray}
Notice also that we have that:
\begin{eqnarray}
 %y       & \equiv & 2 \mod 5 \\
 %y^2     & \equiv & 2^2 \mod 5 \\
          & \equiv & 4 \mod 5 \\
 (5-%y)^2 & \equiv & 3^2 \mod 5 \\
          & \equiv & 4 \mod 5
\end{eqnarray}
Thus, the square roots of 4 in \Z/3\Z are 1 and 2, and the square roots of 4 in \Z/5\Z are 2 and 3. We can then apply the Chinese
remainder theorem to every pair of combinations:
\begin{eqnarray}
 %r_1 & \equiv & 1 \mod 3 \\
 %r_1 & \equiv & 2 \mod 5 \\
 <b>%r_1</b> & \equiv & <b>7 \mod 15</b> \\
 %r_2 & \equiv & 2 \mod 3 \\
 %r_2 & \equiv & 2 \mod 5 \\
 <b>%r_2</b> & \equiv & <b>2 \mod 15</b> \\
 %r_3 & \equiv & 1 \mod 3 \\
 %r_3 & \equiv & 3 \mod 5 \\
 <b>%r_3</b> & \equiv & <b>13 \mod 15</b> \\
 %r_4 & \equiv & 2 \mod 3 \\
 %r_4 & \equiv & 3 \mod 5 \\
 <b>%r_4</b> & \equiv & <b>8 \mod 15</b>
\end{eqnarray}
Thus, %x = 8 and %x = 7 are solutions to %x \not\equiv \pm 2 and %x^2 \equiv 4.
      ]]></example>
      <fact required="true" hooks="math" title="Hensel's lemma" id="c3d98dd1e93c4a77a39e34941d6ac381"><![CDATA[
Let %p \in \N be a prime number greater than 2, and let %k \in \N be any positive integer (i.e., %k \geq 1). Suppose that %x and %p are coprime, and that %x \in \Z/%p^{%k}\Z can be squared to obtain some quadratic residue %r \in \Z/%p^{%k}\Z:
\begin{eqnarray}
 %x^2 \equiv %r (\mod %p^{%k})
\end{eqnarray}
We can compute %y \in \Z/%p^{%k+1}\Z such that:
\begin{eqnarray}
 %y^2 \equiv %r (\mod %p^{%k+1})
\end{eqnarray}
We compute it as follows. First, we compute %c using the following formula:
\begin{eqnarray}
 %c & \equiv & %x^{-1} \cdot 2^{-1} \cdot ((%r - %x^2) / %p^{%k}) (\mod %p)
\end{eqnarray}
Then, we have that:
\begin{eqnarray}
 %y & \equiv & %x + %c \cdot %p^{%k}
\end{eqnarray}
      ]]></fact>
      <text hooks="math"><![CDATA[
To see why Hensel's lemma is true, suppose that we have that:
\begin{eqnarray}
 %x^2 & \equiv & %r (\mod %p^{%k})
\end{eqnarray}
Notice that if it is possible to "lift" %x to a root of %r in \Z/%p^{%k+1}\Z, the only possibility is that this new root %y has an additional multiple of %p^{%k}. Thus, it must be that for some integer multiple %c, we have:
\begin{eqnarray}
 %y & = & %x + %c \cdot %p^{%k}
\end{eqnarray}
We can then substitute:
\begin{eqnarray}
 %y^2 & \equiv & %r (\mod %p^{%k+1}) \\
 (%x + (%c \cdot %p^{%k}))^2 & \equiv & %r (\mod %p^{%k+1})
\end{eqnarray}
But we can simplify the above equation:
\begin{eqnarray}
 (%x + (%c \cdot %p^{%k}))^2 & \equiv & %r (\mod %p^{%k+1}) \\
 %x^2 + (2 \cdot %x \cdot %c \cdot %p^{%k}) + (%c^2 \cdot %p<sup>2%k</sup>) & \equiv & %r (\mod %p^{%k+1})
\end{eqnarray}
But notice that the third term on the left-hand side in the above equation is equivalent to the congruence class 0 + %p^{%k+1}\Z:
\begin{eqnarray}
 %c^2 \cdot %p<sup>2%k</sup> & \equiv & 0 (\mod %p^{%k+1})
\end{eqnarray}
Thus, we have:
\begin{eqnarray}
 %x^2 + (2 \cdot %x \cdot %c \cdot %p^{%k}) & \equiv & %r (\mod %p^{%k+1}) \\
 (%x^2 %- %r) + (2 \cdot %x \cdot %c \cdot %p^{%k}) & \equiv & 0
\end{eqnarray}
The above can be rewritten using the divisibility predicate as:
\begin{eqnarray}
 %p^{%k+1} & | & (%x^2 %- %r) + (2 \cdot %x \cdot %c \cdot %p^{%k})
\end{eqnarray}
Thus, we can divide both sides of the above relationship by %p^{%k} to obtain:
\begin{eqnarray}
 %p & | & (%x^2 %- %r)/(%p^{%k}) + (2 \cdot %x \cdot %c)
\end{eqnarray}
We can then rewrite the above as an equation of congruence classes:
\begin{eqnarray}
 (%x^2 %- %r)/(%p^{%k}) + (2 \cdot %x \cdot %c) & \equiv & 0 (\mod %p) \\
 (2 \cdot %x \cdot %c) & \equiv & %- (%x^2 %- %r)/%p^{%k} \\
 %c & \equiv & %x^{-1} \cdot 2^{-1} \cdot (%- (%x^2 %- %r)/%p^{%k})\\
 %c & \equiv & %x^{-1} \cdot 2^{-1} \cdot ((%r %- %x^2)/%p^{%k})
\end{eqnarray}
Thus, we have derived the formula in Hensel's lemma.
      ]]></text>   
      <example required="true" hooks="math" id="46d48801b74a42a480e343805b917c72"><![CDATA[
To better understand Hensel's lemma, we can derive the lemma for a particular example. Let us start with the following equation:
\begin{eqnarray}
 4^2 & \equiv & 2 (\mod 7)
\end{eqnarray}
Suppose we want to find %y \in \Z/7^2\Z such that:
\begin{eqnarray}
 %y^2 & \equiv & 2 (\mod 49)
\end{eqnarray}
We know that the difference between 4 and %y must be a multiple of 7, so we write:
\begin{eqnarray}
 %y & = & 4 + 7 \cdot %c
\end{eqnarray}
Then we proceed:
\begin{eqnarray}
 %y^2 & \equiv & 2 (\mod 49) \\
 (4 + 7 \cdot %c)^2 & \equiv & 2 (\mod 49) \\
 4^2 + (2 \cdot 7 \cdot %c \cdot 4) + (49 \cdot %c^2) & \equiv & 2 (\mod 49) \\
 4^2 + (2 \cdot 7 \cdot %c \cdot 4) & \equiv & 2 (\mod 49)
\end{eqnarray}
We simplify further to compute %c:
\begin{eqnarray}
 (4^2 - 2) + (2 \cdot 7 \cdot %c \cdot 4) & \equiv & 0 (\mod 49) \\
 14 + (2 \cdot 7 \cdot %c \cdot 4) & \equiv & 0 (\mod 49)
\end{eqnarray}
The above can be rewritten using the divisibility predicate as:
\begin{eqnarray}
 49 | 14 + (2 \cdot 7 \cdot %c \cdot 4) \\
 7 | 2 + (2 \cdot %c \cdot 4)
\end{eqnarray}
We can again rewrite the above as an equation of congruence classes:
\begin{eqnarray}
 2 + (2 \cdot %c \cdot 4) & \equiv & 0 (\mod 7) \\
2 \cdot %c \cdot 4 & \equiv & %- 2 (\mod 7) \\
2 \cdot %c \cdot 4 & \equiv & 5 (\mod 7) \\
%c & \equiv & 2^{-1} \cdot 4^{-1} \cdot 5 (\mod 7) \\
%c & \equiv & 4 \cdot 2 \cdot 5 (\mod 7) \\
%c & \equiv & 5 (\mod 7)
\end{eqnarray}
Thus, we have:
\begin{eqnarray}
 %y & \equiv & 4 + 7 \cdot 5 (\mod 49) \\
 %y & \equiv & 39 (\mod 49)
\end{eqnarray}
Since 49 %- 39 = 10, we have:
\begin{eqnarray}
 %y & \equiv & \pm 10  (\mod 49) \\
 %y^2 & \equiv & 2  (\mod 49) \\
\end{eqnarray}
      ]]></example>
      <example required="true" hooks="math" id="270dab778afa4427b2b9e9f8314553d2"><![CDATA[
We want to find both solutions %y \in \Z/121\Z to:
\begin{eqnarray}
 %y^2 & \equiv & 5 (\mod 121)
\end{eqnarray}
Since 121 = 11^2, we have %p = 11, %k = 1, and %r = 5. We begin by finding %x \in \Z/11\Z such that:
\begin{eqnarray}
 %x^2 & \equiv & 5 (\mod 11)
\end{eqnarray}
Since 11 \in 3 + 4\Z, we can use an explicit formula:
\begin{eqnarray}
 %x & \equiv & \pm 5<sup>(11+1)/4</sup> (\mod 11) \\
    & \equiv & \pm 5^3  \\
    & \equiv & \pm 3 \cdot 5 \\
    & \equiv & \pm 4
\end{eqnarray}
Thus, it is sufficient to lift the solution 4 \in \Z/11\Z to a solution in \Z/121\Z using <a href="#c3d98dd1e93c4a77a39e34941d6ac381">Hensel's lemma</a>. We compute %c:
\begin{eqnarray}
 %c & \equiv & %x^{-1} \cdot 2^{-1} \cdot ((%r %- %x^2)/%p^{%k}) (\mod %p)\\
    & \equiv & 4^{-1} \cdot 2^{-1} \cdot ((5 %- 16)/11)  (\mod 11)\\
    & \equiv & 4^{-1} \cdot 2^{-1} \cdot (%- 1) \\
    & \equiv & 3 \cdot 6 \cdot (%- 1) \\
    & \equiv & (%- 18) \\
    & \equiv & 4
\end{eqnarray}
Thus, we have:
\begin{eqnarray}
 %y & \equiv & 4 + 4 \cdot 11 (\mod 121) \\
    & \equiv & 4 + 44 \\
    & \equiv & 48
\end{eqnarray}
Thus, we have the solution
\begin{eqnarray}
 %y & \equiv & \pm 48 (\mod 121)
\end{eqnarray}
      ]]></example>
      <example required="true" hooks="math" id="6126754f428448f98fd3c2bb151b89b3">
        <text><![CDATA[
The distance traveled by an object that is at rest at time %t = 0 and then immediately begins accelerating at 4 meters/second^2 (i.e., the speed of the object increases by the quantity 4 meters/second every second) can be defined in terms of time in second %t as:
\begin{eqnarray}
  %d & = & 1/2 \cdot 4 \cdot %t^2
\end{eqnarray}
We might expect an object to behave this way if it is being pulled by gravity, or if it is using a stable propulsion engine (e.g., a rocket).
        ]]></text>
        <paragraph><![CDATA[
Suppose we are using a <a href="#df42e88c1fcd11e3831ff55c91aec05A">range ambiguity resolution</a> technique to track the distance the object has traveled. If it a particular moment, we know that the distance from the object is in the congruence class 10 + 11\Z, what can we say about the amount of time %t that has elapsed since the object started moving?
        ]]></paragraph>
        <paragraph><![CDATA[
Since the distance is in 10 + 11\Z, we can say:
\begin{eqnarray}
  %d & \equiv & 10 (\mod 11) \\
  1/2 \cdot 4 \cdot %t^2 & \equiv & 10 \\
  2 \cdot %t^2 & \equiv & 10
\end{eqnarray}
We know that 2^{-1} \equiv 6 (\mod 11), so we multiply both sides of the above equation to obtain:
\begin{eqnarray}
  %t^2 & \equiv & 60 (\mod 11) \\
  %t^2 & \equiv & 5 (\mod 11)
\end{eqnarray}
Thus, we can compute:
\begin{eqnarray}
  %t & \equiv & 5<sup>(11+1)/4</sup> (\mod 11) \\
  %t & \equiv & 5<sup>3</sup> \\
  %t & \equiv & 3 \cdot 5  \\
  %t & \equiv & 4 (\mod 11)
\end{eqnarray}
Thus, we can say that the amount of time that has elapsed is in 4 + 11\Z.
        ]]></paragraph>
      </example>
      <example required="true" hooks="math" id="9399d6d264094a5084fff0d884406638"><![CDATA[
Solve the following system of equations for %x \in \Z/21\Z (find all solutions):
\begin{eqnarray}
  %x^2 & \equiv & 1 (\mod 3)\\
  %x^2 & \equiv & 1 (\mod 7)
\end{eqnarray}
We know that there is exactly one solution %y \in \Z/21\Z to the following system:
\begin{eqnarray}
  %y & \equiv & 1 (\mod 3)\\
  %y & \equiv & 1 (\mod 7)
\end{eqnarray}
The solution is simply %y = 1, and since there is only one solution, this is the only possibility.
Thus, we are looking for all the solutions to the following equation:
\begin{eqnarray}
  %x^2 & \equiv & 1 (\mod 21)
\end{eqnarray}
Since 3 \mod 4 = 7 \mod 4 = 3, we know that there are two solutions to each of the following equations:
\begin{eqnarray}
  %x^2 & \equiv & 1 (\mod 3)\\
  %x^2 & \equiv & 1 (\mod 7)
\end{eqnarray}
The solutions are as follows:
\begin{eqnarray}
  %x & \equiv & 1 (\mod 3)\\
  %x & \equiv & 2 (\mod 3)\\
  %x & \equiv & 1 (\mod 7)\\
  %x & \equiv & 6 (\mod 7)
\end{eqnarray}
Taking every pair of combinations with one solution from \Z/3\Z and one solution from \Z/7\Z, we get:
\begin{eqnarray}
  %x_1 & \equiv & 1 (\mod 3)\\
  %x_1 & \equiv & 1 (\mod 7)\\
  %x_1 & \equiv & 1 (\mod 21)\\
  %x_2 & \equiv & 2 (\mod 3)\\
  %x_2 & \equiv & 1 (\mod 7)\\
  %x_2 & \equiv & 8 (\mod 21)\\
  %x_3 & \equiv & 1 (\mod 3)\\
  %x_3 & \equiv & 6 (\mod 7)\\
  %x_3 & \equiv & 13 (\mod 21)\\
  %x_4 & \equiv & 2 (\mod 3)\\
  %x_4 & \equiv & 6 (\mod 7)\\
  %x_4 & \equiv & 20 (\mod 21)
\end{eqnarray}
      ]]></example>
      <example required="true" hooks="math" id="3dac407c9e394cb19dad066d5a8f6364"><![CDATA[
How many solutions %x \in \Z/(33 \cdot 35)\Z does the following system of equations have:
\begin{eqnarray}
  %x^2 & \equiv & 4 (\mod 33)\\
  %x^2 & \equiv & 4 (\mod 35)
\end{eqnarray}
We know that each of the following equations have two solutions (2 and -2 in the respective sets). Notice that 4 \mod 3 = 1.
\begin{eqnarray}
  %x^2 & \equiv & 1 (\mod 3)\\
  %x^2 & \equiv & 4 (\mod 11)\\
  %x^2 & \equiv & 4 (\mod 5)\\
  %x^2 & \equiv & 4 (\mod 7)
\end{eqnarray}
Thus, there are two possible choices for each of the variables %r_1 \in {-2,2}, %r_2 \in {-2,2}, %r_3 \in {-2,2}, %r_4 \in {-2,2}, so there
are 2 \cdot 2 \cdot 2 \cdot 2 = 2^4 = 16 possible systems of the form:
\begin{eqnarray}
  %x & \equiv & %r_1 (\mod 3)\\
  %x & \equiv & %r_2 (\mod 11)\\
  %x & \equiv & %r_3 (\mod 5)\\
  %x & \equiv & %r_4 (\mod 7)
\end{eqnarray}
Each system has a unique solution because the tuple (%r_1, %r_2, %r_3, %r_4) is unique, so there are 16 solutions for %x in \Z/(33 \cdot 35)\Z.

Alternatively, we could break the problem down into two subproblems. First, we solve the following equation:
\begin{eqnarray}
  %x^2 & \equiv & 4 (\mod 33)
\end{eqnarray}
We obtain four distinct solutions (%r_1, %r_2, %r_3, %r_4) in \Z/33\Z. Next, we solve the following equation:
\begin{eqnarray}
  %x^2 & \equiv & 4 (\mod 35)
\end{eqnarray}
We then have four distinct solutions in (%s_1, %s_2, %s_3, %s_4) \Z/35\Z. Since \gcd(33,35) = 1, we can then take any combination of solutions
%r_{%i} and %s_{%i} and set up the system:
\begin{eqnarray}
  %x & \equiv & %r_{%i} (\mod 33)\\
  %x & \equiv & %s_{%i} (\mod 35)
\end{eqnarray}
There will be exactly one solution to each of the above systems. There are 4^2 = 16 distinct systems, so there will be 16 distinct solutions.
      ]]></example>
      <text hooks="math"><![CDATA[
We can summarize everything we know about computing square roots of congruence classes as follows. Suppose we want to find all solutions to the equation %x^2 \equiv %a (\mod %n) for some %n \in \N and some %a \in \Z/%n\Z.
<ul>
  <li>If %n is a prime %p, the possibilities are:
    <ul>
      <li>
        %a is not a quadratic residue in \Z/%p\Z, so there are no solutions to the equation,
      </li>
      <li>
        %a \equiv 0, in which case %x \equiv 0 is the one and only solution to the equation,
      </li>
      <li>
        %a is a quadratic residue in \Z/%p\Z, so there are exactly two solutions to the equation, \pm %x \in \Z/%p\Z.
      </li>
    </ul>
  </li>
  <li>If %n is prime power %p^{%k+1} and %a is coprime with %p, the possibilities are:
    <ul>
      <li>
        %a is not a quadratic residue in \Z/%p^{%k}\Z, so it is not a quadratic residue in \Z/%p^{%k+1}\Z;
      </li>
      <li>
        %a is a quadratic residue in \Z/%p^{%k}\Z, and both square roots of %a in \Z/%p^{%k}\Z can be "lifted" to \Z/%p^{%k+1}\Z using <a href="#c3d98dd1e93c4a77a39e34941d6ac381">Hensel's lemma</a>.
         <!--<ul>
          <li>
            both square roots of %a can be "lifted" to \Z/%p^{%k+1}\Z using <a href="#c3d98dd1e93c4a77a39e34941d6ac381">Hensel's lemma</a>,
          </li>
         <li>
            or the lifting formula in <a href="#c3d98dd1e93c4a77a39e34941d6ac381">Hensel's lemma</a> does not produce a square root in \Z/%p^{%k+1}\Z.
          </li>
        </ul>-->
      </li>
      <!--<li>
        %a is a multiple of %p, so %a \equiv 0 (\mod %p), in which case ,
      </li>-->
    </ul>
  </li>
  <li>If %n is a product of two coprime numbers %k and %m, then there is a solution in \Z/%n\Z for every possible combination of %y and %z such that:
\begin{eqnarray}
 %y^2 & \equiv & %a \mod %k \\
 %z^2 & \equiv & %a \mod %m
\end{eqnarray}
Each combination corresponds to a solution %x \in \Z/%n\Z defined using CRT as:
\begin{eqnarray}
 %x & \equiv & %y \mod %k \\
 %x & \equiv & %z \mod %m
\end{eqnarray}
  </li>
</ul>
Let us consider the problem of finding all of the square roots of a member of \Z/%n\Z. Notice that this problem is analogous to computing <i>all</i> the square roots of %y in \Z/%n\Z:
\begin{eqnarray}
 \sqrt(%y) & = & \pm %x
\end{eqnarray}
The main difference is that the number of square roots may be greater than 2. This problem is believed to be computationally difficult (i.e., no algorithm in %P exists that can solve the problem). In fact, even finding just <i>one</i> additional square root is believed to be computationally difficult.
      ]]></text>
      <conjecture title="congruent squares" required="true" hooks="math" id="92c05f074c4242d381e07935f9db5ea9">
        <text><![CDATA[
The following problem is not in %P: given %n = %p \cdot %q for two primes %p and %q in \N and
%y \in \Z/%n\Z, find an %x \in \Z/%n\Z such that %x^2 \equiv %y^2 but %x \not\equiv \pm %y.
        ]]></text>
        <paragraph><![CDATA[
Factoring can be reduced to finding congruent squares. Suppose we want to factor %n. We find %x and %y such that:
\begin{eqnarray}
 %x^2 \mod %n & = & %y^2 \mod %n \\
 0 \mod %n & = & (%x^2 %- %y^2) \mod %n \\
           & = &  ((%x + %y) \cdot (%x %- %y)) \mod %n \\
 %n & | & (%x + %y) \cdot (%x %- %y)
\end{eqnarray}
Since %n cannot divide (%x+%y) (because %x \not\equiv \pm %y, so %x + %y \neq %n), and it cannot divide (%x-%y) (since (%x+%y) < %n), and
(%x-%y) \neq 0 (since %x \not\equiv \pm %y), it must be that %n shares factors with both (%x+%y) and (%x-%y). Thus, it must be that either
\gcd(%n,%x + %y) or \gcd(%n,%x - %y) is a non-trivial factor of %n, and this can be computed efficiently.
        ]]></paragraph>
      </conjecture>
<!--
Suppose that for a prime %p, we can solve the congruent squares problem efficiently (in fact, we have such algorithms
for %p \equiv 3, %p \equiv 5, and %p \equiv 7 in \Z/8\Z, but for primes where %p \equiv 1 (\mod 8), no efficient
algorithm is known). Then we can use the <a href="#chinese-remainder-theorem">Chinese remainder theorem</a> to solve the congruent squares
problem for %n = %p \cdot %q where %p and %q are prime.
-->
      <text hooks="math"><![CDATA[
The following diagram summarizes the relationships between the problems that are conjectured to be intractable (i.e., not in %P). Each directed edge represents that
there exists a polynomial-time reduction from the source problem to the destination problem. All of the nodes in the graph are conjectured to be not in %P.
      ]]></text>
      <diagram id="a7d611922fe211e38cf6ce3f5508a345" hooks="math"><![CDATA[
<table class="container">
  <tr>
    <td colspan="3" class="box" style="background-color:powderblue;">congruent squares<br/>(square roots of<br/>congruence classes)</td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td><span style="font-size:20px;">&uArr;&dArr;</span></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;&dArr;</span></td>
  </tr>
  <tr>
    <td class="box" style="background-color:powderblue;">computing \phi(%n)<br/>for %n = %p \cdot %q</td>
    <td><span style="font-size:20px;">&lArr;<br/>&rArr;</span></td>
    <td class="box" style="background-color:powderblue;">factoring<br/>%n = %p \cdot %q</td>
  </tr>
  <tr>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
  </tr>
  <tr>
    <td colspan="3" class="box" style="background-color:powderblue;">RSA problem<br/>(%eth roots of<br/>congruence classes)</td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td colspan="3" class="box" style="background-color:powderblue;">discrete logarithm<br/>(logarithms of<br/>congruence classes)</td>
  </tr>
</table>
      ]]></diagram>
    </subsection>
    <subsection title="Applications of intractability">
      <text hooks="math"><![CDATA[
The computational intractability of certain problems in modular arithmetic makes it possible to address some practical security issues associated with implementing communication protocols. In particular, it helps address two common problems:
<ul>
  <li>parties must communicate over a public communications channel, so everything they send is visible both to their receiver and to anyone that may be eavesdropping;</li>
  <li>parties trying to communicate cannot physically meet to agree on shared secret information before communicating.</li>
</ul>
      ]]></text>
      <protocol title="hard-to-forge identification with meeting" required="true" hooks="math" id="7d720e67974f4768b687126f1d94b276">
        <text><![CDATA[
Suppose Alice and Bob know that Alice will need to send Bob a single message at some point in the future. However, it is possible that Eve might try to impersonate Alice and send a message to Bob while pretending to be Alice.
        ]]></text>
        <paragraph><![CDATA[
In order to help Bob confirm that a message is truly from Alice (or to determine which message is from Alice given multiple messages), Alice and Bob meet in person and agree on a secret identifier %s. When Alice decides to send a message %m to Bob, she will send (%m, %s). Bob can then compare %s to his own copy of %s and confirm the message is from Alice.
        ]]></paragraph>
        <paragraph><![CDATA[
Eve's only attack strategy is to try and guess %s. As long as Alice and Bob choose %s from a very large range of integers, the probability that Eve can guess %s correctly is small.
        ]]></paragraph>
      </protocol>
      <text hooks="math"><![CDATA[
A major flaw in the <a href="#7d720e67974f4768b687126f1d94b276">above identification protocol</a> is that Alice and Bob must first meet in person to agree on a secret. Can Alice and Bob agree on a secret without meeting in person?
      ]]></text>
      <protocol title="hard-to-forge identification without meeting" required="true" hooks="math" id="6ec9b71422944628a633f1b910180a9b"><![CDATA[
Suppose Alice and Bob know that Alice will need to send Bob a single message at some point in the future. Alice prepares for this by doing the following:
<ul>
  <li>choose two large primes %p and %q at random;</li>
  <li>compute %n = %p \cdot %q;</li>
  <li>send the public identifier %n to Bob over a public/non-secure communication channel.</li>
</ul>
When Alice is ready to send her message %m to Bob, Alice will send (%m, (%p, %q)), where (%p, %q) is the private identifier. Bob can confirm that %p \cdot %q = %n, at which point he will know Alice was the one who sent the message.
      ]]></protocol>
      <conjecture title="forging identification" required="true" hooks="math" id="53b4675970e444fe8de9590252e85933">
        <text><![CDATA[
The following problem is not in %P: in the <a href="#6ec9b71422944628a633f1b910180a9b">previously defined protocol</a>, given a public identifier %n, compute the private identifier (%p, %q).
        ]]></text>
        <paragraph><![CDATA[
If it were possible to quickly (i.e., in polynomial time) compute the private identifier, then it would be easy to forge the identity of a sender by recording their public identifier %n. However, suppose that this forging computation could be used as a subprocedure in a factoring algorithm. Then it would be possible to implement an efficient factoring algorithm. In other words, factoring %n can be <i>reduced</i> to forging a private identifier. Thus, the problem of forging a private identifier must not be in %P (i.e., the fastest algorithm that exists for forging an identity is not in %P, which means there is no polynomial-time for forging an identity).
        ]]></paragraph>
        <diagram><![CDATA[
<table class="container">
  <tr>
    <td class="box" style="background-color:powderblue;">forging private<br/>identifier for %n<br/><br/><span style="color:green; text-decoration:underline;">conclusion:</span><br/><span style="color:green;"><i>cannot</i> be solved in<br/>polynomial time<br/><br/>forging \not\in %P</span></td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">factoring %n<br/><br/><span style="color:firebrick; text-decoration:underline;">conjecture:</span><br/><span style="color:firebrick;"><i>cannot</i> be solved in<br/>polynomial time<br/><br/>factoring \not\in %P</span></td>
  </tr>
</table>
        ]]></diagram>
        <paragraph><![CDATA[
Note that the reduction also works in the other direction: an algorithm for factoring can be used for forging an identity. However, this proves nothing about the difficulty of forging! Just because forging can be reduced to an inefficient algorithm for factoring does not mean that there does not exist some <i>other</i> algorithm for forging that does <b>not</b> rely on factoring.
        ]]></paragraph>
        <diagram><![CDATA[
<table class="container">
  <tr>
    <td class="box" style="background-color:powderblue;">alternative<br/>efficient<br/>algorithm</td>
    <td><span style="font-size:20px;">&lArr;</span></td>
    <td class="box" style="background-color:powderblue;">forging private<br/>identifier for %n</td>
    <td><span style="font-size:20px;">&rArr;</span></td>
    <td class="box" style="background-color:powderblue;">factoring %n</td>
  </tr>
</table>
        ]]></diagram>
      </conjecture>
      <text hooks="math"><![CDATA[
The <a href="#6ec9b71422944628a633f1b910180a9b">above identification protocol</a> improves over the <a href="#7d720e67974f4768b687126f1d94b276">previous protocol</a> because it allows Alice and Bob to agree on an identifier for Alice without meeting in person. Its security relies on the fact that it is unlikely that Eve is capable of forging identifiers because her ability to forge would solve a problem that we believe is very difficult to solve.
      ]]></text>
      <paragraph><![CDATA[
However, the protocol still has many other flaws. For example, Eve could preempt Alice and send her own signature %n before Alice has a chance to send her signature to Bob. A more thorough examination of such protocols is considered in computer science courses focusing explicitly on the subject of cryptography.
      ]]></paragraph>
      <protocol title="Diffie-Hellman key exchange" required="true" hooks="math" id="19b2f1f8f630468d8e0725fde88300a7"><![CDATA[
We introduce the Diffie-Hellman key exchange protocol. This protocol is useful if two parties who cannot meet physically want to agree on a secret value that only they know.
<ul>
  <li><b>Public key generation (performed by one party):</b> 
    <ol>
      <li>Randomly choose a <b>public</b> large prime number %p \in \N and an element %g \in \Z/%p\Z.</li>
    </ol>
  </li>
  <li><b>Private key generation (performed by both parties):</b> 
    <ol>
      <li>Party <b>A</b> randomly chooses a secret %a \in \Z/\phi(%p)\Z.</li>
      <li>Party <b>B</b> randomly chooses a secret %b \in \Z/\phi(%p)\Z.</li>
    </ol>
  </li>
  <li><b>Protocol:</b> 
    <ol>
      <li>Party <b>A</b> computes (%g^{%a} \mod %p) and sends this public value to party <b>B</b>.</li>
      <li>Party <b>B</b> computes (%g^{%b} \mod %p) and sends this public value to party <b>A</b>.</li>
      <li>Party <b>A</b> computes (%g^{%b} \mod %p)^{%a} \mod %p.</li>
      <li>Party <b>B</b> computes (%g^{%a} \mod %p)^{%b} \mod %p.</li>
      <li>Since multiplication over \Z/\phi(%p)\Z is commutative, both parties now share a secret %g^{%a \cdot %b} \mod %p.</li>
    </ol>
  </li>
</ul>
This protocol's security only relies on the discrete logarithm assumption.
      ]]></protocol>
      <text hooks="math"><![CDATA[
It is not known whether the discrete logarithm problem is related to the factoring problem. Factoring <i>can</i> be reduced using a probabilistic approach to the discrete logarithm problem modulo %p \cdot %q.
      ]]></text>
      <protocol title="RSA protocol" required="true" hooks="math" id="673d171d89904d208850043a22650f65"><![CDATA[
We introduce the RSA public-key cryptographic protocol. This protocol is useful in many scenarios, such
as the following:
<ul>
  <li>a sender wants to send the receiver a secret message over a public channel;</li>
  <li>a receiver wants to allow any number of senders to send him messages over a public channel, 
      and the receiver does not yet know who the senders will be.</li>
</ul>
This protocol can also be used to prove the identity of the receiver.

<ul>
  <li><b>Key generation (performed by the receiver):</b> 
    <ol>
      <li>Randomly choose two <b>secret</b> prime numbers %p \in \N and %q \in \N of similar size.</li>
      <li>Compute a <b>public key</b> value %n = %p \cdot %q.</li>
      <li>Compute the <b>secret</b> value \phi(%n) = (%p-1) \cdot (%q-1).</li>
      <li>Choose a <b>public key</b> value %e \in {2,...,\phi(%n)-1} such that \gcd(%e, \phi(%n)) = 1.</li>
      <li>Compute the <b>secret private key</b> %d = %e^{-1} \mod \phi(%n)</li>
    </ol>
  </li>
  <li><b>Protocol (encryption and decryption):</b> There are two participants: the sender and the receiver. 
    <ol>
      <li>The sender wants to send a <b>message</b> %m \in {0,...,%n-1} where \gcd(%m,%n) = 1 to the receiver.</li>
      <li>The receiver reveals the public key (%n,%e) to the sender.</li>
      <li>The sender computes the <b>ciphertext</b> (encrypted message) %c = %m^{%e} \mod %n.</li>
      <li>The sender sends %c to the receiver.</li>
      <li>The receiver can recover the original message by computing %m = %c^{%d} \mod %n.</li>
    </ol>
  </li>
</ul>
      ]]></protocol>
      <text hooks="math"><![CDATA[
The above encryption-decryption process works because for some %k \in \Z:
\begin{eqnarray}
  %e \cdot %d & \equiv & 1 (\mod \phi(%n)) \\
              & = & 1 + \phi(%n) \cdot %k \\
  (%m^{%e})^{%d} \mod %n & = & (%m<sup>1 + \phi(%n) \cdot %k</sup>) \mod %n\\
                         & = & (%m \cdot (%m<sup>\phi(%n) \cdot %k</sup>)) \mod %n\\
                         & = & (%m \cdot (%m<sup>\phi(%n) \cdot %k</sup>)) \mod %n\\
                         & = & (%m \cdot %m<sup>\phi(%n)</sup>) \mod %n \\
                         & = & (%m \cdot 1) \mod %n \\
                         & = & %m \mod %n
\end{eqnarray}
Besides the message %m, there are three pieces of secret information that an eavesdropper cannot know in order for the
encryption to provide any privacy:
<ul>
  <li>%p and %q</li>
  <li>\phi(%n)</li>
  <li>%d = %e^{-1}</li>
</ul>
Notice that if an eavesdropper knows %p and %q where %n = %p \cdot %q, the eavesdropper can easily compute \phi(%n) (which was supposed to be private).
If the eavesdropper can compute \phi(%n), then they can use the <a href="#4b73a6de740d492d9bf4d536da9f15ce">extended Euclidean algorithm</a> to compute the inverse %d = %e^{-1} of the public key value %e. They can then use %d to decrypt messages.
      ]]></text>
      <paragraph><![CDATA[
Suppose the eavesdropper only knows \phi(%n). Then the eavesdropper can compute %d and decrypt any message. In fact, the eavesdropper <a href="#f1bae63934b04111b2d98fb1f1b67e45">can also recover %p and %q</a>.
      ]]></paragraph>
      <protocol title="Rabin cryptosystem" required="true" hooks="math" id="00ad493287b94f6da088ba159d3b4716"><![CDATA[
We introduce the Rabin cryptosystem protocol. It is similar to the RSA scheme, but it does
not rely on the difficulty of the RSA problem.

<ul>
  <li><b>Key generation (performed by the receiver):</b> 
    <ol>
      <li>Randomly choose two <b>secret</b> prime numbers %p \in \N and %q \in \N of similar size.</li>
      <li>Compute a <b>public key</b> value %n = %p \cdot %q.</li>
    </ol>
  </li>
  <li><b>Protocol (encryption and decryption):</b> There are two participants: the sender and the receiver. 
    <ol>
      <li>The sender wants to send a <b>message</b> %m \in {0,...,%n-1} to the receiver.</li>
      <li>The receiver reveals the public key %n to the sender.</li>
      <li>The sender computes the <b>ciphertext</b> (encrypted message) %c = %m^2 \mod %n.</li>
      <li>The sender sends %c to the receiver.</li>
      <li>The receiver can recover the original message by computing \sqrt(%c) in \Z/%p\Z and \Z/%q\Z,
          and then finding the four solutions to the following system by using the Chinese remainder theorem:
\begin{eqnarray}
%m & \equiv & \sqrt(%c) \mod %p\\
%m & \equiv & \sqrt(%c) \mod %q.
\end{eqnarray}
      </li>
    </ol>
  </li>
</ul>
Notice that the receiver must guess which of the square roots corresponds to the original message. Also notice that it is not a good idea to encrypt messages in the ranges {0, ..., \sqrt(%n)} and {%n %- \sqrt(%n), ..., %n %- 1} because it is easy to decrypt such messages by computing the integer square root \sqrt(%c) of %c and then confirming that \sqrt(%c)^2 \equiv %c (\mod %n).
      ]]></protocol>
      <text hooks="math"><![CDATA[
The following diagram summarizes the relationships between algorithms that might break each of the protocols presented in this section, and existing problems that are believed not to be in %P. Thus, our conjectures imply that all of the problems below are not in %P.
      ]]></text>
      <diagram id="a7d611922fe211e38cf6ce3f5508a567" hooks="math"><![CDATA[
<table class="container">
  <tr>
    <td class="box" style="background-color:powderblue;">breaking<br/>Rabin encryption</td>
    <td><span style="font-size:20px;">&lArr;</span></td>
    <td colspan="3" class="box" style="background-color:powderblue;">congruent squares<br/>(square roots of<br/>congruence classes)</td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;&dArr;</span></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;&dArr;</span></td>
  </tr>
  <tr>
    <td class="box" style="background-color:powderblue;">finding RSA<br/>secret key</td>
    <td><span style="font-size:20px;">&lArr;</span></td>
    <td class="box" style="background-color:powderblue;">computing \phi(%n)<br/>for %n = %p \cdot %q</td>
    <td><span style="font-size:20px;">&lArr;<br/>&rArr;</span></td>
    <td class="box" style="background-color:powderblue;">factoring<br/>%n = %p \cdot %q</td>
  </tr>
  <tr>
    <td>
    <td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
  </tr>
  <tr>
    <td class="box" style="background-color:powderblue;">decrypting individual<br/>RSA messages</td>
    <td><span style="font-size:20px;">&lArr;</span></td>
    <td colspan="3" class="box" style="background-color:powderblue;">RSA problem<br/>(%eth roots of<br/>congruence classes)</td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td class="box" style="background-color:powderblue;">breaking<br/>Diffie-Hellman</td>
    <td><span style="font-size:20px;">&lArr;</span></td>
    <td colspan="3" class="box" style="background-color:powderblue;">discrete logarithm<br/>(logarithms of<br/>congruence classes)</td>
  </tr>
</table>
      ]]></diagram>
      <fact required="true" hooks="math" id="760711586e3c462ab798b23c1dc421a0">
        <text><![CDATA[
Suppose we have some modulus %n \in \N and some %a \in (\Z/%n\Z)*. Let %r \in \Z/\varphi(n)\Z be the smallest %r such that %a^{%r} \equiv 1 (\mod %n). Then it must be that %r | \varphi(%n).
        ]]></text>
        <paragraph><![CDATA[
To see why, suppose that \varphi(%n) is not divisible by %r. Then there must be some %c < %r such that:
\begin{eqnarray}
  \varphi(%n) & = & %c + %k \cdot %r
\end{eqnarray}
But if that's true, we have:
\begin{eqnarray}
  %a^{\varphi(%n)} & \equiv & %a<sup>%c + %k \cdot %r</sup> \\
                   & \equiv & %a<sup>%c</sup> \cdot %a<sup>%k \cdot %r</sup> \\
                   & \equiv & %a<sup>%c</sup> \cdot (%a^{%r})^{%k} \\
                   & \equiv & %a<sup>%c</sup>
\end{eqnarray}
The above implies %a<sup>%c</sup> \equiv %a^{\varphi(%n)} \equiv 1. But since %c < %r, this contradicts our initial assumption. Thus, it must be that %r | \varphi(%n).
        ]]></paragraph>
      </fact>
      <text><![CDATA[
Recall the <a href="#df42e3a01fcd11e3831ff23c91aec05e">algorithm</a> we learned before for generating random numbers based on using the multiples of a congruence class. In a setting with an adversary, we could imagine the adversary may want to predict the next random number in a sequence given some partial information. If we are using the original algorithm, an adversary can do this efficiently.
      ]]></text>
      <paragraph hooks="math"><![CDATA[
Suppose the adversary knows the modulus %n, and knows that some number %r is the %ith random number in the sequence. The adversary then knows the following equation must hold:
\begin{eqnarray}
  %a \cdot %i & \equiv & %r (\mod %n)
\end{eqnarray}
If it happens to be the case that \gcd(%i, %n) = 1, the adversary can then compute the original "seed" %a by doing a single inversion followed by a single multiplication:
\begin{eqnarray}
  %i^{-1} \cdot %a \cdot %i & \equiv & %i^{-1} \cdot %r (\mod %n) \\
                         %a & \equiv & %i^{-1} \cdot %r
\end{eqnarray}
This would then allow the adversary to predict any random number in the sequence.
      ]]></paragraph>
      <paragraph hooks="math"><![CDATA[
Suppose the adversary knows the modulus %n, and knows that the "seed" for a random sequence is %a. Then given a random number in the sequence %r, the adversary can determine which number in the sequence it must be by using the same equation as above and computing %a^{-1} (\mod %n):
\begin{eqnarray}
  %a \cdot %i & \equiv & %r (\mod %n) \\
  %a^{-1} \cdot %a \cdot %i & \equiv & %a^{-1} \cdot %r \\
                         %i & \equiv & %a^{-1} \cdot %r
  
\end{eqnarray}
      ]]></paragraph>
      <paragraph><![CDATA[
We can use what we have learned about intractable problems to create an algorithm for generating random numbers that is slightly more robust against the two attacks described above.
      ]]></paragraph>
      <algorithm required="true" id="df42e3a01f1231e3831ff23c91aec05e">
        <text hooks="math"><![CDATA[
The following is another possible implementation of a random number generation algorithm.
<ol style="list-style-type:none;">
 <li><b>inputs:</b> upper bound %n \in \N, seed %a \in (\Z/%n\Z)*, index %i \in {2,...,\varphi(%n) %- 1}</li>
 <li>
   <ol style="list-style-type:none; margin-left:-12px;">
     <li><b>return</b> (%a^{%i}) \mod %n</li>
   </ol>
 </li>
</ol>
One downside of this algorithm is that it will never produce a permutation of \Z/%n\Z. Even if %n is prime and greater than 2, then \varphi(%n) must be composite (since it is even), which means that the smallest exponent %i that solves the identity %a^{%i} \equiv 1 could be some factor of \varphi(%n). Even if \varphi(%n) happens to be prime, it cannot be close to %n (since %n cannot then also be prime, which means \varphi(%n) \neq %n %- 1). However, this algorithm does have a few benefits if an adversary is involved.
        ]]></text>
        <paragraph hooks="math"><![CDATA[
Given some partial information, an adversary would have a more difficult time making predictions about the random sequence. Suppose the adversary knows the modulus %n, and knows that some number %r is the %ith random number in the sequence. The adversary then knows the following equation must hold:
\begin{eqnarray}
  %a^{%i} & \equiv & %r (\mod %n)
\end{eqnarray}
However, in order to compute %a, the adversary would now need to compute the %ith root of the congruence class %r modulo %n. Effectively, this means the adversary could solve the <a href="#ef5cfce470f24effab453d5e770b1a37">RSA problem</a> if %i &gt; 2 (or the <a href="#92c05f074c4242d381e07935f9db5ea9">congruent squares problem</a> if %i = 2). If we believe these problems cannot be solved efficiently, such an adversary cannot exist.
        ]]></paragraph>
        <paragraph hooks="math"><![CDATA[
Alternatively, suppose the adversary knows the modulus %n, and knows that the "seed" for a random sequence is %a. Then given a random number in the sequence %r, the adversary could try to determine which number in the sequence it must be by solving the following equation for %i:
\begin{eqnarray}
  %a^{%i} & \equiv & %r (\mod %n)
\end{eqnarray}
If the adversary can do so, then the adversary can solve the <a href="#4c406aab6b32433f95de381191900df7">discrete logarithm problem</a>, so it is unlikely that such an adversary exists.
        ]]></paragraph>
      </algorithm>
      <example required="true" id="0894e2bc92af46e5bc79ad9f7cd92c65">
        <text hooks="math"><![CDATA[
Bob decides to create his own online currency BobCoin. Bob knows that in order for BobCoin to be successful, it needs to be possible to make more BobCoins as more and more people start using them. However, he also does not want rapid inflation to occur. Thus, Bob issues BobCoins according to the following protocol:
<ul>
  <li>every day, Bob chooses two new random primes %p and %q;</li>
  <li>Bob computes %n = %p \cdot %q, and then discards %p and %q;</li>
  <li>Bob posts %n online for everyone to see;</li>
  <li>at any time on that day, anyone can submit a factor %f of %n;</li>
  <li>if %f is a factor of %n, Bob issues that person a BobCoin, invalidates %n permanently so that no one else can use it, and generates a new %n.</li>
</ul>
        ]]></text>
        <orderedlist style="list-style-type:lower-alpha">
          <item>
            <text hooks="math"><![CDATA[
Why is it okay for Bob to discard %p and %q?
            ]]></text>
            <solution hooks="math"><![CDATA[
Because Bob can easily check whether a submitted %f actually is a factor by computing \gcd(%f, %n), or simply dividing %n by %f.
            ]]></solution>
          </item>
          <item>
            <text hooks="math"><![CDATA[
Suppose that Bob always posts numbers %n that have 100 digits, and it takes the fastest computer one year to factor a 100-digit number through trial and error. If Alice wants to earn a BobCoin in one day, how many computers will Alice need to run in parallel to earn a BobCoin? 
            ]]></text>
            <solution hooks="math"><![CDATA[
Since it takes a 365 days to try all possible %k factors of a 100-digit number, in one day one computer can try 1/365 \cdot %k factors. Thus, Alice would need 365 computers that she could run for one day, with each computer looking through a different region of factors.
            ]]></solution>
          </item>
          <item>
            <text hooks="math"><![CDATA[
Suppose Bob wants to issue a complimentary BobCoin coupon to a group of 100 people. However, he wants to make sure that they can use their BobCoin coupon only if at least 20 out of those 100 people agree that the coupon should be redeemed for a BobCoin. How can Bob accomplish this?
            ]]></text>
            <solution hooks="math"><![CDATA[
Bob can use Shamir secret sharing to accomplish this. Bob can take one of the factors %f of %n when he generates %n, and choose 100 distinct primes such that the product of any 20 of the primes is greater than %f while the product of any 19 of these primes is less than %f. Bob can then distribute %f \mod %m for each prime modulus %m to each of the 100 people. If any 20 (or greater) of these 100 people agree to redeem the coupon, then can use CRT to reconstruct %f and submit it to Bob for redemption.
            ]]></solution>
          </item>
        </orderedlist>
      </example>

<!--
<div class="mathenv fact proposition_to_know">
<b>Definition:</b> A problem %X is <i>NP-hard</i> iff there is a polynomial-time reduction from an NP-complete problem to %X.
</div>

Note that it is equivalent to say that an NP-hard problem is one to which polynomial-time reductions exist from every problem in NP (i.e.,
a problem that satisfies only the second condition of the definition of NP-complete).

<div class="mathenv fact proposition_to_know">
<b>Fact:</b> A problem %X is NP-hard if there exists a polynomial-time reduction to it from another NP-hard problem %Y.

Suppose that %X is not NP-hard but is in NP (or in %P). Then there is a polynomial-time reduction from %Y to %X, which means %Y is also in NP (or, respectively, in %P).
Since this is a contradiction, it must be that %X is NP-hard.
</div>

Above, we have shown that several problems are not in %P. There is another complexity class to which they definitely belong.

<div class="mathenv fact proposition_to_know">
<b>Definition:</b> A problem %X is in <i>NP</i> iff there exists a polynomial-time algorithm that, when given a problem instance and 
a candidate solution, can always verify whether the candidate solution is indeed a solution.

Another (equivalent) definition: a problem %X is in <i>NP</i> iff a polynomial-time non-deterministic Turing machine can solve every
instance of the problem.
</div>

<div class="mathenv fact proposition_to_know">
<b>Definition:</b> A problem %X is <i>NP-complete</i> iff it is in NP and for every problem in NP there is a polynomial-time reduction to %X.
</div>
-->
    </subsection>
    <!--include sheaf="assignment-four.xml"/-->
  </section>
  <section title="Algebraic Structures">
    <text hooks="math"><![CDATA[
In the previous sections, we studied a specific algebraic structure, \Z/%n\Z, as well as its operations (e.g., addition, multiplication), and its properties (commutativity, associativity, and so on). There exist many other algebraic structures that share some of the properties of \Z/%n\Z. In fact, we can create a hierarchy, or even a web, of algebraic structures by picking which properties of \Z/%n\Z we keep and which we throw away.
    ]]></text>
    <paragraph hooks="math"><![CDATA[
Showing that some new algebraic structure is similar or equivalent to another, more familiar structure allows us to make inferences about that new structure based on everything we already know about the familiar structure. In computer science, the ability to compare algebraic structures using their properties is especially relevant because every time a programmer defines a new data structure and operations on that data structure, they are defining an <i>algebraic</i> structure. Which properties that algebraic structure possesses determines what operations can be performed on it, in what order they can be performed, how efficiently they can be performed, and how they can be broken down and reassembled.
    ]]></paragraph>
    <subsection title="Permutations">
      <text hooks="math"><![CDATA[
Recall that a permutation on a set %X is a bijective relation between %X and %X (i.e., a subset of the set product %X \times %X). Since a permutation is a bijective map (i.e., a function), we can reason about composition of permutations (it is just the composition of functions). Thus, we can study sets of permutations as algebraic structures under the composition operation \circ.
      ]]></text>
      <paragraph hooks="math"><![CDATA[
Notice that for any set %X of finite size %n, we can relabel the elements of %X to be {0,...,%n-1} (that is, we can define a bijection between %X and {0,...,%n-1}). Thus, we can study permutations on {0,...,%n-1} without loss of generality. We will adopt the following notation for permutations:
\begin{eqnarray}
  [%a_1,...,%a_{%n}]
\end{eqnarray}
Where %a_1,...,%a_{%n} is some rearrangement of the integers from 0 to %n-1. For example, the identity permutation on %n elements would be:
\begin{eqnarray}
  [0,1,2,3,4,5,...,%n-1]
\end{eqnarray}
      ]]></paragraph>
      <definition required="true" hooks="math" id="3f36088269ca4100a875028b72b9d8b6"><![CDATA[
Any permutation that swaps exactly two elements is called a <i>swap</i>. Examples of swaps are 
[0,<b style="color:firebrick;">3</b>,2,<b style="color:firebrick;">1</b>],
[<b style="color:firebrick;">1</b>,<b style="color:firebrick;">0</b>], and
[0,<b style="color:firebrick;">6</b>,2,3,4,5,<b style="color:firebrick;">1</b>].
      ]]></definition>
      <definition required="true" hooks="math" id="06eb467b8b854f3582e1ead2e2fd068e"><![CDATA[
Any permutation that swaps exactly two adjacent elements is called an <i>adjacent swap</i>. 
Examples of adjacent swaps are [0,1,<b style="color:firebrick;">3</b>,<b style="color:firebrick;">2</b>],
[<b style="color:firebrick;">1</b>,<b style="color:firebrick;">0</b>,2,3,4], and
[0,1,<b style="color:firebrick;">3</b>,<b style="color:firebrick;">2</b>,4,5,6].
      ]]></definition>
      <definition required="true" hooks="math" id="38184b9fd9124520a62514ba8fdcc124"><![CDATA[
Define %S_{%n} to be the set of all permutations of the set {0,...,%n-1}.
      ]]></definition>
      <example required="true" hooks="math" id="9c1597ef96d048bb88c90043e712a93e"><![CDATA[
The set of permutations of {0,1} is %S_2 = {[0,1], [1,0]}.
      ]]></example>
      <example required="true" hooks="math" id="b386a709b21a48ecaf69c8f97fe58655"><![CDATA[
The set of permutations of {0,1,2} is %S_3 = {[0,1,2], [0,2,1], [1,0,2], [1,2,0], [2,0,1], [2,1,0]}.
      ]]></example>
      <fact required="true" hooks="math" id="ae45388601ce4c11b0f7d937e27ffcda">
        <text hooks="math"><![CDATA[
The set %S_{%n} contains %n! permutations.
        ]]></text>
        <paragraph hooks="math"><![CDATA[
Suppose we want to construct a permutation [%a_1,...,%a_{%n}] using the elements in {0,...,%n-1}, where we are only allowed to take each
element in the set once and assign it to an unassigned entry %a_{%i}. Then for the first slot, we have %n possibilities; for the second,
we have %n-1 possibilities. For the third, we have %n-2 possibilities, and so on until we have only one possibility left.
Thus, the number of possible permutations we can make is:
\begin{eqnarray}
%n! & = & %n \cdot (%n-1) \cdot (%n-2) \cdot ... \cdot 2 \cdot 1
\end{eqnarray}
        ]]></paragraph>
      </fact>
      <definition required="true" hooks="math" id="c96d85c46ac84ef3a7207233e4e16bc4"><![CDATA[
Define the set %C_{%n} to be the set of all <i>cyclic</i> permutations on %n elements. Any permutation that performs a circular shift on elements is a <i>cyclic permutation</i> (also known as a <i>cyclic shift permutation</i>, a <i>circular shift permutation</i>, or just a <i>shift</i> permutation). Examples of shifts are [6,7,0,1,2,3,4,5], [2,3,4,0,1], and [4,0,1,2,3].
      ]]></definition>
      <definition required="true" hooks="math" id="9d47bbaba8524ecb99bf3ee7939b8fa5"><![CDATA[
Define the set %M_{%n} to be the set of all <i>multiplication-induced</i> permutations on %n elements. Any permutation on %n elements that corresponds to multiplication by some coprime %a < %n is called a <i>multiplication-induced</i> permutation. Examples of such permutations include [0,2,4,1,3] (corresponding to multiples 2 \cdot %i for ascending %i in \Z/5\Z).
      ]]></definition>
      <example required="true" hooks="math" id="c0dc8aca1a7d4e36ad1a930fb47ee2d9"><![CDATA[
The set of multiplication-induced permutations on 6 elements (i.e., permutations of {0,1,2,3,4,5}) is the collection of permutations of the form [%a \cdot 0 \mod 6, %a \cdot 1 \mod 6, %a \cdot 2 \mod 6, %a \cdot 3 \mod 6, %a \cdot 4 \mod 6, %a \cdot 5 \mod 6] for each %a that is coprime with 6. Thus, %a \in {1,5}, and so we have:
\begin{eqnarray}
%M_6 = {[0,1,2,3,4,5], [0,5,4,3,2,1]}.
\end{eqnarray}
      ]]></example>
      <example required="true" hooks="math" id="6da077955f0c442bb08d8fa635ca8344"><![CDATA[
The set of multiplication-induced permutations on 7 elements (i.e., permutations of {0,1,2,3,4,5,6}) is:
\begin{eqnarray}
%M_7 = {[0,1,2,3,4,5,6], [0,2,4,6,1,3,5], [0,3,6,2,5,1,4], [0,4,1,5,2,6,3], [0,5,3,1,6,4,2], [0,6,5,4,3,2,1]}.
\end{eqnarray}
Note that |%M_7| = \phi(7) = 6 because there are 6 possible %a \in \Z/7\Z that are coprime with 7.
      ]]></example>
    </subsection>
    <subsection title="Isomorphisms: Equivalence of Algebraic Structures">
      <text hooks="math"><![CDATA[
An algebraic structure is a set together with a binary operator over that set. All algebraic structures are closed under their binary operation.
      ]]></text>
      <definition required="true" hooks="math" id="30ad3d58bd84468eaa1525d39e41ca1f"><![CDATA[
Let %S be a set, and let \oplus be a binary operator. Let closure(%S,\oplus) be the closure of %S under \oplus. We can define the set closure(%S,\oplus) in the following way:
\begin{eqnarray}
closure(%S, \oplus) & = & 
       { %x_1 \oplus %x_2 | %x_1,%x_2 \in %S } 
  \cup { %x_1 \oplus (%x_2 \oplus %x_3) | %x_1,%x_2,%x_3 \in %S } 
  \cup { (%x_1 \oplus %x_2) \oplus %x_3 | %x_1,%x_2,%x_3 \in %S } 
  \cup ...
\end{eqnarray}
Alternatively, we could define it in the following way using recursion:
\begin{eqnarray}
closure_0(%S, \oplus) & = & %S \\
closure_{%n}(%S, \oplus) & = & 
  { %x \oplus %y | %x,%y \in (closure_{%n-1}(%S, \oplus) \cup ... \cup closure_0(%S, \oplus)} \\
closure(%S, \oplus) & = & 
  closure_0(%S, \oplus) \cup closure_1(%S, \oplus) \cup closure_2(%S, \oplus) \cup ... \\
\end{eqnarray}
Notice that if a set %S is finite, there is a natural way to algorithmically
list all elements in closure(%S, \oplus) by starting with the elements in %S and "building up" all
the elements in each of the closure_{%i}(%S, \oplus) subsets.
      ]]></definition>
      <text hooks="math"><![CDATA[
The concept of an <i>isomorphism</i> between two algebraic structures captures the fact that two structures are not only the same size, but that the two structures have the same internal "structure" with respect to their respective operations. Isomorphisms are useful because they allow us to learn more about a structure by studying the structure isomorphic to it. They can also be useful because if two structures are isomorphic, we can perform computations in one structure instead of another structure (e.g., because it is more secure, more efficient, and so on) while obtaining the same final result.
      ]]></text>
      <fact required="true" hooks="math" id="b08bee6d540843098c2da6b9a0fab2ef"><![CDATA[
Let %A be an algebraic structure with operator \oplus and let %B be an algebraic structure with operator \otimes. We say that %A is <i>isomorphic</i> to %B, which we denote as (%A,\oplus) \cong (%B,\otimes) or simply %A \cong %B, if the following
conditions hold:
<ul>
  <li>there exists a bijection (i.e., a bijective relation) between %A and %B, which we denote using &nbsp;=&nbsp;;</li>
  <li>for all %a, %a' \in %A and %b,%b' \in %B, if %a = %b and %a' = %b' then %a \oplus %a' = %b \otimes %b'.</li>
</ul>
Another way to state the definition is to write it in terms of a bijective map %m between %A and %B:
<ul>
  <li>there exists a bijective map %m between %A and %B;</li>
  <li>for all %a, %a' \in %A, %~ %m(%a \oplus %a') = %m(%a) \otimes %m(%a').</li>
</ul>
In other words, an isomorphism is a bijection that preserves (or <i>respects</i>) the binary operations on the two sets: if any true equation involving elements from %A and the operator \oplus is transformed by replacing all elements of %a with their corresponding elements %m(%b) \in %B and by replacing all instances of \oplus with \otimes, the resulting equation is still true.
      ]]></fact>
      <example required="true" hooks="math" id="4ad19f8692ce45e7b99277ff9706eb23">
        <text><![CDATA[
Consider the set of permutations on two elements %S_2 and the set of congruence classes \Z/2\Z. It is true that (%S_2,\circ) \cong (\Z/2\Z,+), where \circ is composition of permutations and where + is addition of congruence classes in \Z/2\Z. The following table demonstrates the bijection:
        ]]></text>
        <table><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>%S_2</b></td>
  <td><b>\Z/2\Z</b></td>
 </tr>
 <tr> 
  <td>[0,1]</td>
  <td>0</td>
 </tr>
 <tr> 
  <td>[1,0]</td>
  <td>1</td>
 </tr>
</table>
        ]]></table>
        <text><![CDATA[
The following table demonstrates that the bijection above respects the two operations.
        ]]></text>
        <table><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>%S_2</b></td>
  <td><b>\Z/2\Z</b></td>
 </tr>
 <tr> 
  <td>[0,1] \circ [0,1] = [0,1]</td>
  <td>0 + 0 = 0</td>
 </tr>
 <tr> 
  <td>[0,1] \circ [1,0] = [1,0]</td>
  <td>0 + 1 = 1</td>
 </tr>
 <tr> 
  <td>[1,0] \circ [0,1] = [1,0]</td>
  <td>1 + 0 = 1</td>
 </tr>
 <tr> 
  <td>[1,0] \circ [1,0] = [0,1]</td>
  <td>1 + 1 = 0</td>
 </tr>
</table>
        ]]></table>
        <text><![CDATA[
Another way to demonstrate the above is to show that the "multiplication tables" (though the operation need not be multiplication) for the two operators are exactly the same (i.e., the entries in the multiplication table all correspond according to the bijection).
        ]]></text>
        <table><![CDATA[
<table class="fig_table">
 <tr>
  <td><b style="color:green">+</b><br/><b style="color:firebrick">\circ</b></td>
  <td><b style="color:green">0</b><br/><b style="color:firebrick">[0,1]</b></td>
  <td><b style="color:green">1</b><br/><b style="color:firebrick">[1,0]</b></td>
 </tr>
 <tr> 
  <td><b style="color:green">0</b><br/><b style="color:firebrick">[0,1]</b></td>
  <td><span style="color:green">0</span><br/><span style="color:firebrick">[0,1]</span></td>
  <td><span style="color:green">1</span><br/><span style="color:firebrick">[1,0]</span></td>
 </tr>
 <tr> 
  <td><b style="color:green">1</b><br/><b style="color:firebrick">[1,0]</b></td>
  <td><span style="color:green">1</span><br/><span style="color:firebrick">[1,0]</span></td>
  <td><span style="color:green">0</span><br/><span style="color:firebrick">[0,1]</span></td>
 </tr>
</table>
        ]]></table>
      </example>
      <fact required="true" hooks="math" id="4994f8d9a4964c41be392085050f5f98"><![CDATA[
For any positive integer %n \in \N, (\Z/%n\Z,+) \cong (%C_{%n}, \circ). 
      ]]></fact>
      <example required="true" hooks="math" id="ecebeabbc18c4756af1c3c0f3b6cc937">
        <text><![CDATA[
Consider the set of cyclic permutations on three elements %C_3 and the set of congruence classes \Z/3\Z. It is true that (%C_3,\circ) \cong (\Z/3\Z,+).
        ]]></text>
        <table><![CDATA[
<table class="fig_table" style="font-size:11px;">
 <tr><td><b>%C_3</b></td><td><b>\Z/3\Z</b></td></tr>
 <tr><td>[0,1,2] \circ [0,1,2] = [0,1,2]</td><td>0 + 0 = 0</td></tr>
 <tr><td>[0,1,2] \circ [1,2,0] = [1,2,0]</td><td>0 + 1 = 1</td></tr>
 <tr><td>[0,1,2] \circ [2,0,1] = [2,0,1]</td><td>0 + 2 = 2</td></tr>
 <tr><td>[1,2,0] \circ [0,1,2] = [1,2,0]</td><td>1 + 0 = 1</td></tr>
 <tr><td>[1,2,0] \circ [1,2,0] = [2,0,1]</td><td>1 + 1 = 2</td></tr>
 <tr><td>[1,2,0] \circ [2,0,1] = [0,1,2]</td><td>1 + 2 = 0</td></tr>
 <tr><td>[2,0,1] \circ [0,1,2] = [2,0,1]</td><td>2 + 0 = 2</td></tr>
 <tr><td>[2,0,1] \circ [1,2,0] = [0,1,2]</td><td>2 + 1 = 0</td></tr>
 <tr><td>[2,0,1] \circ [2,0,1] = [1,2,0]</td><td>2 + 2 = 1</td></tr> 
</table>
        ]]></table>
      </example>
      <example required="true" hooks="math" id="ed42f4eb5ff1469cb6d57149a269152e"><![CDATA[
To compute the composition of two permutations [45,46,...,49,0,1,2,...,44] \circ [3,4,5,...,49,0,1,2], it is sufficient to recognize that [45,46,...,49,0,1,2,...,44] corresponds to 45 \in \Z/50\Z, and [3,4,5,...,49,0,1,2] corresponds to 3 \in \Z/50\Z. Thus, since 45 + 3 = 48, the result of the composition must be [48,49,0,1,2,...,47].
\begin{eqnarray}
  45 + 3 & = & 48 \\
  [45,46,...,49,0,1,2,...,44] \circ [3,4,5,...,49,0,1,2] & = & [48,49,0,1,2,...,47]
\end{eqnarray}
      ]]></example>
      <fact required="true" hooks="math" id="dd5f610bdf6046a89c16f963a9297e83">
        <text><![CDATA[
For any prime %p \in \N, (\Z/\phi(%p)\Z,+) \cong ((\Z/%p\Z)*, \cdot).
        ]]></text>
        <paragraph><![CDATA[
Note that |\Z/\phi(%p)\Z| = \phi(%p) = |(\Z/%p\Z)*|.
        ]]></paragraph>
      </fact>
      <example required="true" hooks="math" id="e450ce1330404ba9a4768fc0540843c9">
        <text><![CDATA[
Consider the set \Z/2\Z with the addition operation + modulo 2, and the set (\Z/3\Z)* together with the multiplication operation \cdot modulo 3. It is true that (\Z/2\Z, +) \cong ((\Z/3\Z)*,\cdot).
        ]]></text>
        <table><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>(\Z/2\Z, +)</b></td>
  <td><b>((\Z/3\Z)*, \cdot)</b></td>
 </tr>
 <tr> 
  <td>0 + 0 = 0</td>
  <td>1 \cdot 1 = 1</td>
 </tr>
 <tr> 
  <td>0 + 1 = 1</td>
  <td>1 \cdot 2 = 2</td>
 </tr>
 <tr> 
  <td>1 + 0 = 1</td>
  <td>2 \cdot 1 = 2</td>
 </tr>
 <tr> 
  <td>1 + 1 = 0</td>
  <td>2 \cdot 2 = 1</td>
 </tr>
</table>
        ]]></table>
      </example>
      <example required="true" hooks="math" id="6677b4ba24e041919b9a312bad737a87">
        <text><![CDATA[
Consider the set \Z/2\Z with the addition operation + modulo 2, and the set (\Z/6\Z)* together with the multiplication operation \cdot modulo 6. It is true that (\Z/2\Z, +) \cong ((\Z/6\Z)*,\cdot). Note that (\Z/6\Z)* = {1,5}, because only 1 and 5 in the range {0,...5} are coprime with 6.
        ]]></text>
        <table><![CDATA[
<table class="fig_table">
 <tr>
  <td><b>(\Z/2\Z, +)</b></td>
  <td><b>((\Z/6\Z)*, \cdot)</b></td>
 </tr>
 <tr> 
  <td>0 + 0 = 0</td>
  <td>1 \cdot 1 = 1</td>
 </tr>
 <tr> 
  <td>0 + 1 = 1</td>
  <td>1 \cdot 5 = 5</td>
 </tr>
 <tr> 
  <td>1 + 0 = 1</td>
  <td>5 \cdot 1 = 5</td>
 </tr>
 <tr> 
  <td>1 + 1 = 0</td>
  <td>5 \cdot 5 = 1</td>
 </tr>
</table>
        ]]></table>
      </example>
      <text hooks="math"><![CDATA[
Isomorphisms need not be defined between different sets. It is possible to define an isomorphism between a set and itself that has non-trivial, interesting, and even useful characteristics.
      ]]></text>
      <fact required="true" hooks="math" id="1617a44b1293414cbf48a5bf4eb7ef9d"><![CDATA[
For any %n \in \N and any %a \in \Z/%n\Z where %a is coprime with %n, (\Z/%n\Z,+) \cong (\Z/%n\Z,+) under the bijection that relates %x \in \Z/%n\Z with %a \cdot %x \in \Z/%n\Z. This is because for any %x,%y \in \Z/%n\Z, we have:
\begin{eqnarray}
  %a \cdot (%x + %y) & \equiv & %a \cdot %x + %a \cdot %y
\end{eqnarray}
      ]]></fact>
      <fact required="true" hooks="math" id="68cb7199f61240cfa1e8b6f22bafd583"><![CDATA[
For any %n \in \N and any %e \in \Z/\phi(n)\Z where %e is coprime with \phi(n), ((\Z/%n\Z)*,\cdot) \cong ((\Z/%n\Z)*,\cdot) under the bijection that relates %x \in (\Z/%n\Z)* with %x^{%e} \in (\Z/%n\Z)*. This is because for any %x, %y \in (\Z/%n\Z)*, we have:
\begin{eqnarray}
  (%x \cdot %y)^{%e} & \equiv & %x^{%e} \cdot %y^{%e} (\mod %n)
\end{eqnarray}
      ]]></fact>
      <example required="true" hooks="math" id="7eb018ba49d54b9183b62eb01d35b19a">
        <text><![CDATA[
Consider the set \Z/3\Z with the addition operation + modulo 3, and another instance of the set \Z/3\Z with the addition operation + modulo 3. The following is a bijection between (\Z/3\Z, +) and (\Z/3\Z, +):
        ]]></text>
        <table><![CDATA[
<table class="fig_table">
 <tr><td><b>\Z/3\Z</b></td><td><b>\Z/3\Z</b></td></tr>
 <tr><td>0</td><td>0</td></tr>
 <tr><td>1</td><td>2</td></tr>
 <tr><td>2</td><td>1</td></tr>
</table>
        ]]></table>
        <text><![CDATA[
Note that the above bijection corresponding to multiplication by 2 modulo 3, since 0 \cdot 2 \equiv 0, 1 \cdot 2 \equiv 2, and 2 \cdot 2 \equiv 1. This bijection is an isomorphism (and is an instance of <a href="#1617a44b1293414cbf48a5bf4eb7ef9d">this fact</a> about isomorphisms):
        ]]></text>
        <table><![CDATA[
<table class="fig_table" style="font-size:11px;">
 <tr><td><b>\Z/3\Z</b></td><td><b>\Z/3\Z</b></td></tr>
 <tr><td>0 + 0 = 0</td><td>0 + 0 = 0</td></tr>
 <tr><td>0 + 1 = 1</td><td>0 + 2 = 2</td></tr>
 <tr><td>0 + 2 = 2</td><td>0 + 1 = 1</td></tr>
 <tr><td>1 + 0 = 1</td><td>2 + 0 = 2</td></tr>
 <tr><td>1 + 1 = 2</td><td>2 + 2 = 1</td></tr>
 <tr><td>1 + 2 = 0</td><td>2 + 1 = 0</td></tr>
 <tr><td>2 + 0 = 2</td><td>1 + 0 = 1</td></tr>
 <tr><td>2 + 1 = 0</td><td>1 + 2 = 0</td></tr>
 <tr><td>2 + 2 = 1</td><td>1 + 1 = 2</td></tr>
</table>
        ]]></table>
      </example>
      <text hooks="math"><![CDATA[
If we only consider algebraic structures with particular algebraic properties, we can actually show that there is only one algebraic structure of a particular size (i.e., there is only one "isomorphism class" of algebraic structures having that size).
      ]]></text>
      <fact required="true" hooks="math" id="aece13ef4c6244deb1b4a9499ddc99d0"><![CDATA[
Suppose we have an algebraic structure (%A, \oplus) with two elements in which the elements in the set must have inverses, one of them must be an identity, and \oplus is associative. Without loss of generality, let's label the two elements %a and %b, and let %a be the label of the identity element. Because %a is the identity, we must have:
\begin{eqnarray}
  %a \oplus %a & = & %a \\
  %a \oplus %b & = & %b \\
  %b \oplus %a & = & %b
\end{eqnarray}
The identity is its own inverse, so %a^{-1} = %a. The only question that remains is to determine what %b \oplus %b must be. If we have %b \oplus %b = %b, then we must ask what the inverse of %b can be (since it isn't %b itself, as we would then have %b \oplus %b = %a). But then the only option is %a. That would mean that %b \oplus %a should be %a (since %b and its inverse should yield the identity element). But this contradicts the equations we already derived above. So it must be that %b is its own inverse:
\begin{eqnarray}
  %a \oplus %b & = & %a
\end{eqnarray}
Thus, there can be only one distinct algebraic structure (in terms of its "multiplication table") having two elements; it's the algebraic structure isomorphic to (%A, \oplus), as well as all the other algebraic structures isomorphic to it: (%S_2, \circ), (%C_2, \circ), (\Z/2\Z, +), ((\Z/3\Z)*, \cdot), ((\Z/6\Z)*, \cdot), and so on.
      ]]></fact>
      <example title="partial homomorphic encryption supporting addition" required="true" hooks="math" id="cbb6c30b5c654b5db145521988509173">
        <text><![CDATA[
Suppose that for some %n \in \N, Alice wants to store a large number of congruence classes %b_1,...,%b_{%k} \in \Z/%n\Z in Eve's database (perhaps Alice will generate or collect these over a long period of time). Alice does not have enough memory to store the congruence classes herself, but she does not want to reveal the congruence classes to Eve.
        ]]></text>
        <paragraph><![CDATA[
What Alice can do before she stores anything in Eve's database is to pick some secret %a \in \Z/%n\Z that is coprime with %n. Then, every time Alice needs to store some %b in Eve's database, Alice will instead send Eve the obfuscated value (%a \cdot %b) \mod %n. Since %a is coprime with %n, there exists %a^{-1} \in \Z/%n\Z. Thus, if Alice retrieves some obfuscated data entry %c from Eve's database, she can always recover the original value by computing (%a^{-1} \cdot %c) \mod %n, because:
\begin{eqnarray}
  %a^{-1} \cdot (%a \cdot %b) & \equiv & %b (\mod %n)
\end{eqnarray}
Furthermore, Alice can ask Eve to compute the sum (modulo %n) of all the entries in the database (or any subset of them). Suppose that Alice has stored obfuscated versions of %b_1,...,%b_{%k} \in \Z/%n\Z in Eve's database. Then if Eve computes the sum of all the obfuscated entries stored in her database, she will get:
\begin{eqnarray}
  %a \cdot %b_1 + ... + %a \cdot %b_{%k} & = & %a \cdot (%b_1 + ... + %b_{%k}) (\mod %n)
\end{eqnarray}
Thus, if Alice asks Eve for the sum of all the obfuscated entries in the database, Alice can recover the <i>actual</i> sum of the <i>original</i> entries that she stored in the database because:
\begin{eqnarray}
  %a^{-1} \cdot (%a \cdot (%b_1 + ... + %b_{%k})) & = & %b_1 + ... + %b_{%k} (\mod %n)
\end{eqnarray}
In this way, Alice has avoided having to store and add all the database entries, while preventing Eve finding out the actual entries, or their sum.
        ]]></paragraph>
      </example>
      <example title="partial homomorphic encryption supporting multiplication" required="true" hooks="math" id="46785e266a2742329077115d68dc1190">
        <text><![CDATA[
Suppose that for some %n \in \N, Alice wants to store a large number of congruence classes %b_1,...,%b_{%k} \in (\Z/%n\Z)* in Eve's database. Alice does not have enough memory to store the congruence classes herself, but she does not want to reveal the congruence classes to Eve.
        ]]></text>
        <paragraph><![CDATA[
We assume that Alice knows or can easily compute \phi(%n), while Eve does not know and cannot compute it (perhaps Alice generated %n using a method similar to the one in <a href="#673d171d89904d208850043a22650f65">RSA encryption protocol</a>).
        ]]></paragraph>
        <paragraph><![CDATA[
What Alice can do before she stores anything in Eve's database is to pick some secret %e \in \Z/\phi(%n)\Z that is coprime with \phi(%n). Since Alice knows %e and \phi(%n), she can compute %e^{-1} using the <a href="#4b73a6de740d492d9bf4d536da9f15ce">extended Euclidean algorithm</a>.
        ]]></paragraph>
        <paragraph><![CDATA[
Then, every time Alice needs to store some %b in Eve's database, Alice will instead send Eve the encrypted value %b^{%e} \mod %n. If Alice retrieves some encrypted data entry %c from Eve's database, she can always recover the original value by computing (%c<sup>%e^{-1}</sup>}) \mod %n, because by <a href="#8bad52b8e4a740bd82929e05b1f36f15">Euler's theorem</a>:
\begin{eqnarray}
  (%b^{%e})<sup>%e^{-1}</sup> & \equiv & %b<sup>%e \cdot %e^{-1}</sup> & \equiv & %b (\mod %n)
\end{eqnarray}
Furthermore, Alice can ask Eve to compute the product (modulo %n) of all the entries in the database (or any subset of them). Suppose that Alice has stored encrypted versions of %b_1,...,%b_{%k} \in \Z/%n\Z in Eve's database. Then if Eve computes the product of all the encrypted entries stored in her database, she will get:
\begin{eqnarray}
  %b_1^{%e} \cdot ... \cdot %b_{%k}^{%e} & = & (%b_1 \cdot ... \cdot %b_{%k})^{%e} (\mod %n)
\end{eqnarray}
Thus, if Alice asks Eve for the product of all the encrypted entries in the database, Alice can recover the <i>actual</i> product of the <i>original</i> entries that she stored in the database because:
\begin{eqnarray}
  ((%b_1 \cdot ... \cdot %b_{%k})^{%e})<sup>%e^{-1}</sup> & = & %b_1 \cdot ... \cdot %b_{%k} (\mod %n)
\end{eqnarray}
In this way, Alice has avoided having to store and multiply all the database entries, while preventing Eve from finding out the actual entries, or their product. Furthermore, because it is believed that <a href="#40311190a4a9401486183845c7dabf11">factoring %n</a>, <a href="#89a168d4a51f419a9ed5619307d05b5e">computing \phi(%n)</a>, and solving the <a href="#ef5cfce470f24effab453d5e770b1a37">RSA problem</a> is computationally difficult, it is highly unlikely that Eve can decrypt the database entries or the result.
        ]]></paragraph>
      </example>
      <text hooks="math"><![CDATA[
We know by Euler's theorem and the algebraic properties of exponents that for any \Z/%n\Z, any %b \in (\Z/%n\Z)*, and any %x, %y \in \Z/\phi(%n)\Z the following identity must hold:
\begin{eqnarray}
  %b<sup>%x</sup> \cdot %b<sup>%y</sup> & \equiv & %b<sup>%x + %y</sup> (\mod %n) & \equiv & %b<sup>(%x + %y) \mod \phi(n)</sup> (\mod %n)
\end{eqnarray}
We might naturally ask whether there might be an isomorphism between (\Z/\phi(%n)\Z, +) and ((\Z/%n\Z)*, \cdot). In fact, sometimes there is (although more often it is an isomorphism between a subset of (\Z/%n\Z)* and \Z/%k\Z for %k | \phi(%n)).
      ]]></text>
      <paragraph hooks="math"><![CDATA[
Given the above, we might ask whether it might be possible to create a homomorphic encryption protocol using an isomorphism of the form (\Z/\phi(%n)\Z, +) \cong ((\Z/%n\Z)*, \cdot) in which Alice can encrypt her data %x and %y by computing %b<sup>%x</sup> (\mod n) and %b<sup>%y</sup> (\mod n). This should be secure because it is believed that <a href="#4c406aab6b32433f95de381191900df7">no efficient algorithms for computing discrete logarithms exist</a>. Then, in order to have Eve compute a sum of the data values %x and %y, Alice can ask Eve to compute the product %b<sup>%x</sup> \cdot %b<sup>%y</sup> on her end, which is equivalent to %b<sup>%x + %y</sup>.
      ]]></paragraph>
      <paragraph hooks="math"><![CDATA[
However, there is a flaw in this protocol: Alice has no way to retrieve %x + %y from %b<sup>%x + %y</sup> because that requires computing a discrete logarithm, as well. Thus, an isomorphism of the form (\Z/\phi(%n)\Z, +) \cong ((\Z/%n\Z)*, \cdot) would not necessarily give us a practical homomorphic encryption protocol.
      ]]></paragraph>
      <fact required="true" hooks="math" id="c8b18555cc484b6d956eca4589968ee1"><![CDATA[
Given a set of possible data values \Z/%n\Z (e.g., integers within a certain range), any compression algorithm for elements in \Z/%n\Z must be a bijection and a permutation (since it must be invertible in order for decompression to be possible). As a result, it must necessarily expand the representation size of some elements.
      ]]></fact>
      <example required="true" hooks="math" id="9a60de6cb36448f4919e31d24056bac3"><![CDATA[
Suppose that we are working with elements in \Z/11\Z = {0,1,2,3,4,5,6,7,8,9,10}. Suppose we define an algorithm that compresses 10 \in \Z/11\Z into an element in \Z/11\Z with a smaller representation size. One example of such an element is 1, since:
\begin{eqnarray}
  10 \cdot 10 & \equiv & 1 (\mod 11)
\end{eqnarray}
Thus, one possible implementation of a compression algorithm is a function that takes any %x \in \Z/11\Z and returns (10 \cdot %x) \mod 11. Since 10 has an inverse in \Z/11\Z, this function is invertible, so decompression is possible (simply multiply by 10 again). However, this will necessarily expand the representation of at least one value: 1 \in \Z/11\Z:
\begin{eqnarray}
  10 \cdot 1 & \equiv & 10 (\mod 11)
\end{eqnarray}
Note that this cannot be avoided because multiplying all the elements in \Z/11\Z by 10 amounts to a permutation, so at least one compressed element must be 10.
      ]]></example>
    </subsection>
    <subsection title="Generators of Algebraic Structures">
      <text hooks="math"><![CDATA[
Because an algebraic structure (%A,\oplus) often consists of a set of objects that can be "built up" using the binary operator \oplus from a smaller, possibly finite, collection of <i>generators</i> %G \subset %A, it is often easier to reason about an algebraic structure by first reasoning about its generators, and then applying structural induction.
      ]]></text>
      <fact required="true" hooks="math" id="67a305370a7c45b4bfbb87c6262deba5"><![CDATA[
Let %W be the set of swap permutations on %n elements. Then %W is a set of generators for the set of permutations %S_{%n}, which can be defined as:
\begin{eqnarray}
  %S & = & closure(%W, \circ)
\end{eqnarray}
      ]]></fact>
      <fact required="true" hooks="math" id="40bfe9cbb72a498b90389f4352cf9e32"><![CDATA[
Let %A be the set of adjacent swap permutations on %n elements. Then %A is a set of generators for the set of permutations %S_{%n}, which can be defined as:
\begin{eqnarray}
  %S & = & closure(%A, \circ)
\end{eqnarray}
      ]]></fact>
      <fact required="true" hooks="math" id="968ae501ad21498097f01d045ae9abea"><![CDATA[
The set \Z/%n\Z has a single generator 1 \in \Z/%n\Z with respect to addition + modulo %n:
\begin{eqnarray}
  \Z/%n\Z & = & closure({1}, +)
\end{eqnarray}
      ]]></fact>
      <fact required="true" hooks="math" id="9d338d6162f447be9cc7462509dcec03"><![CDATA[
If %a and %n are coprime, then %a is a generator for \Z/%n\Z with respect to addition + modulo %n:
\begin{eqnarray}
  \Z/%n\Z & = & closure({%a}, +)
\end{eqnarray}
      ]]></fact>
      <fact required="true" hooks="math" id="50eea03a99a74634baec7709b3c8088c"><![CDATA[
Suppose we have two algebraic structures %A and %B where for some operator \oplus:
\begin{eqnarray}
  %A & = & closure({%a}, \oplus)\\
  %B & = & closure({%b}, \oplus)\\
\end{eqnarray}
If the generator %a can be expressed in terms of %b, i.e., %a = %b \oplus ... \oplus %b, then it must be that:
\begin{eqnarray}
  %A & \subset & %B\\
\end{eqnarray}
Furthermore, if in addition to the above, the generator %b can be expressed in terms of %a, i.e., %b = %a \oplus ... \oplus %a, then it must be that:
\begin{eqnarray}
  %B & \subset & %A\\
\end{eqnarray}
This would then imply (by basic set theory):
\begin{eqnarray}
  %A & = & %B\\
\end{eqnarray}
      ]]></fact>
    </subsection>
    <!--include sheaf="assignment-five.xml"/-->
    <subsection title="Isomorphisms and Linear Equations of Congruence Classes">
      <fact required="true" hooks="math" id="2ea3deb4f4914b3983cec15fae6e1844"><![CDATA[
Let %n be a positive integer. Then if + represents addition modulo %n, we have:
\begin{eqnarray}
  \Z/%n\Z & \cong & closure({1}, +)
\end{eqnarray}
In other words, 1 is a generator for \Z/%n\Z with respect to +.
      ]]></fact>
      <fact required="true" hooks="math" id="16c77ffd9e7b427b8bf59d13c350242a"><![CDATA[
Let %a and %n be coprime positive integers. Then if + represents addition modulo %n, we have:
\begin{eqnarray}
  \Z/%n\Z & \cong & closure({%a}, +)
\end{eqnarray}
In other words, %a can be a single generator for \Z/%n\Z with respect to +. This is equivalent to <a href="#c9ccf01dcaf440cc815f96df5e09ef04">a fact we have already seen</a>.
      ]]></fact>
      <fact required="true" hooks="math" id="80208908fcf7489eab6d4eab900d1722"><![CDATA[
Let %a and %n be any two positive integers. Then if + represents addition modulo %n, we have:
\begin{eqnarray}
  \Z/(%n/\gcd(%n,%a))\Z & \cong & closure({%a}, +) & \cong & closure({\gcd(%n,%a)}, +)
\end{eqnarray}
      ]]></fact>
       <example required="true" hooks="math" id="d92b42d515744aec88ba94b3d530ce4d"><![CDATA[
Consider %n = 6 and %a = 4. Then we have %g = \gcd(4,6) = 2. We have:
\begin{eqnarray}
  closure({4}, +) & = & {4 \cdot 0, 4 \cdot 1, 4 \cdot 2} & = & {0, 4, 2} & = & closure({2}, +)
\end{eqnarray}
Note that:
\begin{eqnarray}
  4 & = & 2 + 2 (\mod 6) \\
  2 & = & 4 + 4 (\mod 6)
\end{eqnarray}
Thus, 2 can be expressed using the generator 4, and 4 can be expressed using the generator 2.
      ]]></example>
      <fact title="linear congruence theorem" required="true" hooks="math" id="29831f3f3ebd42bb91d29c5d9b298236">
        <text><![CDATA[
Suppose that for a positive integer %n and two congruence classes %a \in \Z/%n\Z and %b \in \Z/%n\Z where %g \equiv \gcd(%a,%n), we are given the following equation:
\begin{eqnarray}
  %a \cdot %x & \equiv & %b (\mod %n)
\end{eqnarray}
Since %a and %n are not coprime, we cannot solve the above equation. Furthermore, if %b \not\in closure({%a}, +), we know the equation cannot be solved. Since closure({%a}, +) = closure({%g}, +), the equation can only be solved if %b \in closure({%g}, +). In other words, the equation can only be solved if %g|%b.
        ]]></text>
        <paragraph><![CDATA[
Note that if %g \equiv \gcd(%a,%n) and %b \in closure({%g}, +), we have:
\begin{eqnarray}
  %n & = & %n' \cdot %g \\
  %a & = & %a' \cdot %g \\
  %b & = & %b' \cdot %g \\
  (%a' \cdot %g) \cdot %x & \equiv & (%b' \cdot %g) (\mod (%n' \cdot %g))
\end{eqnarray}
We can then rewrite the above as:
\begin{eqnarray}
  (%a' \cdot %g) \cdot %x & = & (%b' \cdot %g) + %k \cdot (%n' \cdot %g)
\end{eqnarray}
We can divide both sides of the above equation by %g:
\begin{eqnarray}
  %a' \cdot %x & = & %b' + %k \cdot %n'
\end{eqnarray}
We can convert the above equation back into an equation of congruence classes:
\begin{eqnarray}
  %a' \cdot %x & \equiv & %b' \mod %n'
\end{eqnarray}
At this point %a' and %n' are coprime, we can compute %a'^{-1} (\mod %n') and multiply both sides by it to find our solution %x:
\begin{eqnarray}
  %a'^{-1} \cdot %a' \cdot %x & \equiv & %a'^{-1} \cdot  %b' \mod %n' \\
                           %x & \equiv & %a'^{-1} \cdot  %b' \mod %n'
\end{eqnarray}
        ]]></paragraph>
      </fact>
      <example required="true" id="7e4391788a974bb9b49d560daddb718f">
        <text hooks="math"><![CDATA[
Solve the following equation for %x \in \Z/8\Z, or explain why no solution exists:
\begin{eqnarray}
  2 \cdot %x & \equiv & 3 (\mod 8)
\end{eqnarray}
        ]]></text>
        <solution hooks="math"><![CDATA[
Since 3 \not\in closure({2}, +), there is no solution %x.
        ]]></solution>
      </example>
      <example required="true" id="3acd8130d946494f81d32e888c593096">
        <text hooks="math"><![CDATA[
Solve the following equation for %x \in \Z/24\Z, or explain why no solution exists:
\begin{eqnarray}
  16 \cdot %x & \equiv & 7 (\mod 24)
\end{eqnarray}
        ]]></text>
        <solution hooks="math"><![CDATA[
If we attempt to apply the linear congruence theorem, we will find that \gcd(16,24) = 8, and 7 \not\in closure({8},+), which means there is no solution.
        ]]></solution>
      </example>
      <example required="true" id="e65a8bc217144bbb9e2e9473256cde80">
        <text hooks="math"><![CDATA[
Solve the following equation for %x \in \Z/15\Z, or explain why no solution exists:
\begin{eqnarray}
  9 \cdot %x & \equiv & 6 (\mod 15)
\end{eqnarray}
        ]]></text>
        <solution hooks="math"><![CDATA[
We know that \gcd(9,15) = 3, so we can apply the linear congruence theorem:
\begin{eqnarray}
  3 \cdot %x & \equiv & 2 (\mod 5)
\end{eqnarray}
We can now multiply both sides by 3^{-1} \equiv 2 (\mod 5) to obtain the solution:
\begin{eqnarray}
  3^{-1} \cdot 3 \cdot %x & \equiv & 3^{-1} \cdot 2 (\mod 5) \\
                       %x & \equiv & 4 (\mod 5)
\end{eqnarray}
        ]]></solution>
      </example>
      <example required="true" hooks="math" id="18231a61b42a42e1be8347f75c7f4fd8"><![CDATA[
Suppose we want to find all the solutions in \Z/6\Z to the following equation:
\begin{eqnarray}
  2 \cdot %x & \equiv & 4 (\mod 6)
\end{eqnarray}
Using the linear congruence theorem, we can find the unique solution modulo 3:
\begin{eqnarray}
  %x & \equiv & 2 (\mod 3)
\end{eqnarray}
The solutions modulo 6 will be those congruence classes in \Z/6\Z whose integer representatives are members of 2 + 3\Z = {..., 2, 5, 8, 11, 14, ...}. These are 2 + 6\Z and 5 + 6\Z, since 2 \equiv 2 (\mod 3) and 5 \equiv 2 (\mod 3). Note that:
\begin{eqnarray}
  2 + 3\Z & = & 2 + 6\Z \cup 5 + 6\Z \\
  {..., 2, 5, 8, 11, 14, 17, 20, ...} & = & {..., 2, 8, 14, 20, ...} \cup {..., 5, 11, 17, ...}
\end{eqnarray}
      ]]></example>
    </subsection>
    <subsection title="Isomorphisms and the Chinese Remainder Theorem">
      <fact required="true" title="Chinese remainder theorem isomorphism" hooks="math" id="7eb018ba49d53b9183b62eb01d35b19a"><![CDATA[
Let %n and %m be coprime positive integers. Let \Z/%n\Z \times \Z/%m\Z be the set product of \Z/%n\Z and \Z/%m\Z, and let \oplus be an operation on \Z/%n\Z \times \Z/%m\Z defined as follows:
\begin{eqnarray}
  (%a,%b) \oplus (%c,%d) & = & (%a + %c,%b + %d)
\end{eqnarray}
Then it is true that (\Z/%n\Z \times \Z/%m\Z, \oplus) \cong (\Z/(%m \cdot %n)\Z, +). The bijective relationship in this isomorphism is as follows:
\begin{eqnarray}
  (%a \mod %n, %b \mod %m) \in \Z/%n\Z \times \Z/%m\Z & %~ & corresponds to & %~ & (%a \cdot (%m \cdot %m^{-1}) + %b \cdot (%n \cdot %n^{-1})) \in \Z/(%m \cdot %n)\Z
\end{eqnarray}
In other words, given (%a, %b), we can map it to %a \cdot (%m \cdot %m^{-1}) + %b \cdot (%n \cdot %n^{-1}), and given some %c = %a \cdot (%m \cdot %m^{-1}) + %b \cdot (%n \cdot %n^{-1}) from \Z/(%n \cdot %m)\Z, we can map it back to \Z/%n\Z \times \Z/%m\Z  using (%c \mod %n, %c \mod %m).
      ]]></fact>
      <example title="partial homomorphic encryption with validation" required="true" id="b74cbf87644145b896052b8dbec2010a">
        <text hooks="math"><![CDATA[
Suppose that for some %p \in \N, Alice wants to store a large number of congruence classes %b_1,...,%b_{%k} \in (\Z/%p\Z)* in Eve's database. Alice does not have enough memory to store the congruence classes herself, but she does not want to reveal the congruence classes to Eve. Alice also wants Eve to compute the product of the congruence classes for her as in <a href="#46785e266a2742329077115d68dc1190">this example</a>. However, because Alice does not actually have the numbers Eve is multiplying, Alice has no way to know that the product Eve returns to her corresponds to the actual product; perhaps Eve is saving money and cheating by returning a random number to Alice.
        ]]></text>
        <paragraph hooks="math"><![CDATA[
To address this, Alice first chooses a new prime %q (distinct from %p). She then computes %n = %p \cdot %q and \phi(%n) = (%p %- 1) \cdot (%q %- 1), finds %e \in (\Z/\phi(%n)\Z)* and computes %d \equiv %e^{-1} (\mod \phi(%n)). This will allow Alice to encrypt things before storing them in Eve's database. However, at this point Alice will <b>not</b> simply encrypt her congruence classes %b_1, ..., %b_{%k}.
        ]]></paragraph>
        <paragraph hooks="math"><![CDATA[        
Instead, Alice will first choose a single random value %r \in \Z/%q\Z. Then, Alice will map each of her values (%b_{%i}, %r) \in \Z/%p\Z \times \Z/%q\Z via the <a href="#7eb018ba49d53b9183b62eb01d35b19a">CRT isomorphism</a> to some values %c_{%i} \in \Z/%n\Z. Alice will then encrypt the values %c_{%i} by computing %c_{%i}^{%e} (\mod %n), and will submit these values to Eve's database. Now, whenever Alice can ask Eve to compute the following product:
\begin{eqnarray}
  %c_1^{%e} \cdot ... \cdot %c_{%k}^{%e} & \equiv & (%c_1 \cdot ... \cdot %c_{%k})^{%e} (\mod %n)
\end{eqnarray}
If Eve returns the product (%c_1 \cdot ... \cdot %c_{%k})^{%e} to Alice, Alice can decrypt it by computing:
\begin{eqnarray}
   ((%c_1 \cdot ... \cdot %c_{%k})^{%e})^{%d} & \equiv & %c_1 \cdot ... \cdot %c_{%k} (\mod %n)
\end{eqnarray}
Next, Alice can compute (%c_1 \cdot ... \cdot %c_{%k}) \mod %p to retrieve the actual product in \Z/%p\Z. However, Alice also wants to make sure that Eve actually multiplied all the entries. Alice can do so by computing:
\begin{eqnarray}
   (%c_1 \cdot ... \cdot %c_{%k}) \mod %q & \equiv & %r \cdot ... \cdot %r (\mod %q) \\
                                          & \equiv & %r<sup>%k</sup> (\mod %q)
\end{eqnarray}
Alice can quickly compute %r<sup>%k</sup> (\mod %q) and compare it to (%c_1 \cdot ... \cdot %c_{%k}) \mod %q. This gives Alice some confidence (but not total confidence) that Eve actually computed the product because it ensures that Eve really did multiply %k distinct values provided by Alice.
        ]]></paragraph>
        <paragraph hooks="math"><![CDATA[
What is one way that Eve can still cheat and save money under these circumstances (if she knows that Alice is using this validation method)? Is there any way Alice can counter this (<b>hint</b>: what if Alice chooses different values %r for each entry)?
        ]]></paragraph>        
      </example>
      <fact required="true" hooks="math" id="a18d9596b3b64658a9b749c83f525f07"><![CDATA[
Let %n and %m be positive integers. and let %g = \gcd(%n,%m). Let \Z/(%n/%g)\Z \times \Z/(%m/%g)\Z \times \Z/%g\Z be a set product, and let \oplus be an operation on \Z/(%n/%g)\Z \times \Z/(%m/%g)\Z \times \Z/%g\Z defined as follows:
\begin{eqnarray}
  (%a,%b,%c) \oplus (%x,%y,%z) & = & (%a + %x,%b + %y, %c + %z)
\end{eqnarray}
Then it is true that (\Z/(%n/%g)\Z \times \Z/(%m/%g)\Z \times \Z/%g\Z, \oplus) \cong (\Z/((%m \cdot %n)/%g)\Z, +).
      ]]></fact>
      <example required="true" hooks="math" id="7eb018ba49d51b9183b62eb01d35b19a"><![CDATA[
Consider the set \Z/2\Z \times \Z/3\Z with the operation \oplus, and the set \Z/6\Z together with the operation +. It is true that (\Z/2\Z \times \Z/3\Z, \oplus) \cong (\Z/6\Z, +). The bijection is specified below.
<table class="fig_table">
 <tr>
  <td><b>\Z/2\Z \times \Z/3\Z</b></td>
  <td><b>\Z/6\Z</b></td>
 </tr>
 <tr><td>(0,0)</td><td>0</td></tr>
 <tr><td>(0,1)</td><td>4</td></tr>
 <tr><td>(0,2)</td><td>2</td></tr>
 <tr><td>(1,0)</td><td>3</td></tr>
 <tr><td>(1,1)</td><td>1</td></tr>
 <tr><td>(1,2)</td><td>5</td></tr>
</table>
The isomorphism is demonstrated below.
<table><tr><td>
<table class="fig_table" style="font-size:11px;">
 <tr><td><b>\Z/2\Z \times \Z/3\Z</b></td><td><b>\Z/6\Z</b></td></tr>
 <tr><td>(0,0) \oplus (0,0) = (0,0)</td><td>0 + 0 = 0</td></tr>
 <tr><td>(0,0) \oplus (0,1) = (0,1)</td><td>0 + 4 = 4</td></tr>
 <tr><td>(0,0) \oplus (0,2) = (0,2)</td><td>0 + 2 = 2</td></tr>
 <tr><td>(0,0) \oplus (1,0) = (1,0)</td><td>0 + 3 = 3</td></tr>
 <tr><td>(0,0) \oplus (1,1) = (1,1)</td><td>0 + 1 = 1</td></tr>
 <tr><td>(0,0) \oplus (1,2) = (1,2)</td><td>0 + 5 = 5</td></tr>
 
 <tr><td>(0,1) \oplus (0,0) = (0,1)</td><td>4 + 0 = 4</td></tr>
 <tr><td>(0,1) \oplus (0,1) = (0,2)</td><td>4 + 4 = 2</td></tr>
 <tr><td>(0,1) \oplus (0,2) = (0,0)</td><td>4 + 2 = 0</td></tr>
 <tr><td>(0,1) \oplus (1,0) = (1,1)</td><td>4 + 3 = 1</td></tr>
 <tr><td>(0,1) \oplus (1,1) = (1,2)</td><td>4 + 1 = 5</td></tr>
 <tr><td>(0,1) \oplus (1,2) = (1,0)</td><td>4 + 5 = 3</td></tr>
</table>
</td>
<td>
<table class="fig_table" style="font-size:11px;">
 <tr><td><b>\Z/2\Z \times \Z/3\Z</b></td><td><b>\Z/6\Z</b></td></tr>
 <tr><td>(0,2) \oplus (0,0) = (0,2)</td><td>2 + 0 = 2</td></tr>
 <tr><td>(0,2) \oplus (0,1) = (0,0)</td><td>2 + 4 = 0</td></tr>
 <tr><td>(0,2) \oplus (0,2) = (0,1)</td><td>2 + 2 = 4</td></tr>
 <tr><td>(0,2) \oplus (1,0) = (1,2)</td><td>2 + 3 = 5</td></tr>
 <tr><td>(0,2) \oplus (1,1) = (1,0)</td><td>2 + 1 = 3</td></tr>
 <tr><td>(0,2) \oplus (1,2) = (1,1)</td><td>2 + 5 = 1</td></tr>
 
 <tr><td>(1,0) \oplus (0,0) = (1,0)</td><td>3 + 0 = 3</td></tr>
 <tr><td>(1,0) \oplus (0,1) = (1,1)</td><td>3 + 4 = 1</td></tr>
 <tr><td>(1,0) \oplus (0,2) = (1,2)</td><td>3 + 2 = 5</td></tr>
 <tr><td>(1,0) \oplus (1,0) = (0,0)</td><td>3 + 3 = 0</td></tr>
 <tr><td>(1,0) \oplus (1,1) = (0,1)</td><td>3 + 1 = 4</td></tr>
 <tr><td>(1,0) \oplus (1,2) = (0,2)</td><td>3 + 5 = 2</td></tr>
</table>
</td>
<td>
<table class="fig_table" style="font-size:11px;">
 <tr><td><b>\Z/2\Z \times \Z/3\Z</b></td><td><b>\Z/6\Z</b></td></tr>
 <tr><td>(1,1) \oplus (0,0) = (1,1)</td><td>1 + 0 = 0</td></tr>
 <tr><td>(1,1) \oplus (0,1) = (1,2)</td><td>1 + 4 = 5</td></tr>
 <tr><td>(1,1) \oplus (0,2) = (1,0)</td><td>1 + 2 = 3</td></tr>
 <tr><td>(1,1) \oplus (1,0) = (0,1)</td><td>1 + 3 = 4</td></tr>
 <tr><td>(1,1) \oplus (1,1) = (0,2)</td><td>1 + 1 = 2</td></tr>
 <tr><td>(1,1) \oplus (1,2) = (0,0)</td><td>1 + 5 = 0</td></tr>
 
 <tr><td>(1,2) \oplus (0,0) = (1,2)</td><td>5 + 0 = 5</td></tr>
 <tr><td>(1,2) \oplus (0,1) = (1,0)</td><td>5 + 4 = 3</td></tr>
 <tr><td>(1,2) \oplus (0,2) = (1,1)</td><td>5 + 2 = 1</td></tr>
 <tr><td>(1,2) \oplus (1,0) = (0,2)</td><td>5 + 3 = 2</td></tr>
 <tr><td>(1,2) \oplus (1,1) = (0,0)</td><td>5 + 1 = 0</td></tr>
 <tr><td>(1,2) \oplus (1,2) = (0,1)</td><td>5 + 5 = 4</td></tr>
</table>
</td>
</tr>
</table>
Since 1 and 5 are generators for \Z/6\Z with respect to +, the corresponding elements (1,1) and (1,2) are generators for \Z/2\Z \times \Z/3\Z.
      ]]></example>
      <fact required="true" hooks="math" id="3d8acf002fad4896a3afd4b39104e61e"><![CDATA[
Suppose that for two positive integers %n and %m where %g \equiv \gcd(%n,%m) and two congruence classes %a \in \Z/%n\Z and %b \in \Z/%m\Z, we are given the following system of equations:
\begin{eqnarray}
  %x & \equiv & %a (\mod %n) \\
  %x & \equiv & %b (\mod %m)
\end{eqnarray}
We then know that:
\begin{eqnarray}
  %n & = & %n' \cdot %g \\
  %m & = & %m' \cdot %g
\end{eqnarray}
But this means that:
\begin{eqnarray}
  %x & \equiv & %a (\mod (%n' \cdot %g)) \\
  %x & \equiv & %b (\mod (%m' \cdot %g))
\end{eqnarray}
The above equations can be converted into facts about divisibility:
\begin{eqnarray}
  %x & = & %a + %k \cdot (%n' \cdot %g) \\
  %x & = & %b + %l \cdot (%m' \cdot %g)
\end{eqnarray}
But note that:
\begin{eqnarray}
  %x & = & %a + (%k \cdot %n')) \cdot %g \\
  %x & = & %b + (%l \cdot (%m')) \cdot %g
\end{eqnarray}
The above implies:
\begin{eqnarray}
  %x & \equiv & %a (\mod %g) \\
  %x & \equiv  & %b (\mod %g)
\end{eqnarray}
Since %x \equiv %x, it must be that:
\begin{eqnarray}
  %a & \equiv  & %b (\mod %g)
\end{eqnarray}
Thus, a solution %x exists for the system of equations <i>only</i> if %a \equiv %b (\mod (\gcd(%n,%m)).
      ]]></fact>
      <fact required="true" hooks="math" id="9713fd6d470a483cae1159e87897512b"><![CDATA[
Suppose that for two positive integers %n and %m where %g \equiv \gcd(%n,%m) and two congruence classes %a \in \Z/%n\Z and %b \in \Z/%m\Z, we are given the following system of equations:
\begin{eqnarray}
  %x & \equiv & %a (\mod %n) \\
  %x & \equiv & %b (\mod %m)
\end{eqnarray}
Note that because %g \equiv \gcd(%n,%m), we have:
\begin{eqnarray}
  %n & = & %n' \cdot %g \\
  %m & = & %m' \cdot %g 
\end{eqnarray}
To find a solution, first determine whether %a \equiv %b (\mod %g), and compute %r = %a (\mod %g). Then set:
\begin{eqnarray}
  %x = %y + %r
\end{eqnarray}
We can now solve the following system for %y:
\begin{eqnarray}
  %y + %r & \equiv & %a (\mod %n) \\
  %y + %r & \equiv & %b (\mod %m)
\end{eqnarray}
We substruct %r from both sides in both equations. We now have %g | %a-%r and %g | %b-%r, since %r was the remainder when dividing %a and %b by %g:
\begin{eqnarray}
  %y & \equiv & (%a %- %r) (\mod %n) \\
  %y & \equiv & (%b %- %r) (\mod %m)
\end{eqnarray}
Now set:
\begin{eqnarray}
  %y = %g \cdot %z
\end{eqnarray}
We can now solve the following system for %y:
\begin{eqnarray}
  %g \cdot %z & \equiv & (%a %- %r) (\mod (%n' \cdot %g)) \\
  %g \cdot %z & \equiv & (%b %- %r) (\mod (%m' \cdot %g))
\end{eqnarray}
Using the <a href="#29831f3f3ebd42bb91d29c5d9b298236">linear congruence theorem</a> on both equations, we get:
\begin{eqnarray}
  %z & \equiv & (%a %- %r)/%g (\mod %n') \\
  %z & \equiv & (%b %- %r)/%g (\mod %m')
\end{eqnarray}
We know that %n' and %m' are coprime, so we can solve for %z using the usual method for solving systems of equations with coprime moduli. Once we find %z, we can compute a solution %x to the original system of equations:
\begin{eqnarray}
  %x & \equiv & %g \cdot %z + %r (\mod ((%n \cdot %m) / %g))
\end{eqnarray}
      ]]></fact>
      <example required="true" hooks="math" id="2e09b410ff8144fb8f0f9be5cbcf2bf3"><![CDATA[
Suppose we want to solve the following system of equations:
\begin{eqnarray}
  %x & \equiv & 1 (\mod 6) \\
  %x & \equiv & 3 (\mod 8)
\end{eqnarray}
First, we compute \gcd(6,8) = 2. Then we check that 1 \equiv 3 (\mod 2). Since this is true, we know we can find a solution. We proceed by subtracting 1 from both sides of both equations:
\begin{eqnarray}
  %x %- 1 & \equiv & 0 (\mod 6) \\
  %x %- 1 & \equiv & 2 (\mod 8)
\end{eqnarray}
We can now apply the <a href="#29831f3f3ebd42bb91d29c5d9b298236">linear congruence theorem</a> to both equations:
\begin{eqnarray}
  @( %x %- 1 @; 2 %~ @) & \equiv & 0 (\mod 3) \\
  @( %x %- 1 @; 2 %~ @) & \equiv & 1 (\mod 4)
\end{eqnarray}
We can now solve the above system of equations using the usual CRT solution computation because the moduli are now coprime:
\begin{eqnarray}
  @( %x %- 1 @; 2 %~ @) & \equiv & 0 \cdot (4 \cdot 4^{-1}) + 1 \cdot (3 \cdot 3^{-1}) \\
                     & \equiv & 0 + 1 \cdot (3 \cdot 3) \\
                     & \equiv & 9
\end{eqnarray}
We now compute %x:
\begin{eqnarray}
  @( %x %- 1 @; 2 %~ @) & \equiv & 9 \\
             %x %- 1 & \equiv & 18 \\
                  %x & \equiv & 19
\end{eqnarray}
Since the range of unique CRT solutions with coprime moduli is \Z/((6 \cdot 8)/\gcd(6,8))\Z = \Z/24\Z, the congruence class solution is:
\begin{eqnarray}
                  %x & \equiv & 19 (\mod 24)
\end{eqnarray}
      ]]></example>
      <paragraph hooks="math"><![CDATA[        
By putting together all the theorems and algorithms we have seen so far, we can now define a general-purpose solver for linear systems of equations involving congruence classes.
      ]]></paragraph>
      <diagram hooks="math" id="5d88e2fbd5744f9dab0ebadbf17cedf0"><![CDATA[
<table class="container">
  <tr>
    <td></td>
    <td></td>
    <td class="box" style="background-color:powderblue;">greatest<br/>common<br/>divisor<br/>algorithm</td>
    <td></td>
    <td class="box" style="background-color:#EFEFEF;">Fermat's<br/>little<br/>theorem</td>
    <td></td>
    <td class="box" style="background-color:#EFEFEF;">Euler's<br/>theorem</td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
  </tr>
  <tr>
    <td class="box" style="background-color:#EFEFEF;">B&eacute;zout's<br/>identity</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">extended<br/>Euclidean<br/>algorithm</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">algorithm for<br/>finding<br/>multiplicative<br/>inverses</td>
    <td><span style="font-size:20px;">&rArr;</span></td>
    <td class="box" style="background-color:powderblue;">Euler's<br/>totient<br/>function &phi;</td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td class="box" style="background-color:#EFEFEF;">Chinese<br/>remainder<br/>theorem</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">CRT solver<br/>for two<br/>equations</td>
    <td></td>
    <td></td>
  </tr>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td class="box" style="background-color:#EFEFEF;">linear<br/>congruence<br/>theorem</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">general<br/>CRT solver<br/>for two<br/>equations</td>
    <td></td>
    <td></td>
  </tr>
  </tr>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td class="box" style="background-color:#EFEFEF;">induction</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">general<br/>CRT solver<br/>for %n<br/>equations</td>
    <td></td>
    <td></td>
  </tr>
</table>
      ]]></diagram>
      <paragraph hooks="math"><![CDATA[        
We can also assemble a general-purpose algorithm for computing square roots of congruence classes modulo composite numbers (assuming we have the factorization of the modulus).
      ]]></paragraph>
      <diagram hooks="math" id="5d88e2fbd5744f9dab0ebadbf17cedf1"><![CDATA[
<table class="container">
  <tr>
    <td></td>
    <td></td>
    <td class="box" style="background-color:#EFEFEF;">formula for<br/>3+4\Z<br/>primes</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">square roots<br/>modulo %p</td>
    <td></td>
    <td></td>
  </tr>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td class="box" style="background-color:#EFEFEF;">Hensel's lemma</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">square roots<br/>modulo %p<sup>%k</sup></td>
    <td></td>
    <td></td>
  </tr>
  </tr>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td><span style="font-size:20px;">&uArr;</span></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td></td>
    <td></td>
    <td class="box" style="background-color:powderblue;">CRT solver<br/>for two<br/>equations</td>
    <td><span style="font-size:20px;">&#8656;</span></td>
    <td class="box" style="background-color:powderblue;">square roots<br/>modulo %n \cdot %m</td>
    <td></td>
    <td></td>
  </tr>
</table>
      ]]></diagram>
      <example required="true" id="5d88e2fbd5744f9dab0ebadbf17cedf2">
        <text hooks="math"><![CDATA[
Suppose we want to solve the following equation for any congruence classes in \Z/6\Z that solve it:
\begin{eqnarray}
  4 \cdot %x + 3 \cdot %x^2 & \equiv & 2 (\mod 6)
\end{eqnarray}
One approach is to use the Chinese remainder theorem and split the problem into two equations by factoring 6:
\begin{eqnarray}
  4 \cdot %x + 3 \cdot %x^2 & \equiv & 2 (\mod 2) \\
  4 \cdot %x + 3 \cdot %x^2 & \equiv & 2 (\mod 3)
\end{eqnarray}
We can now simplify each of the above:
\begin{eqnarray}
  3 \cdot %x^2 & \equiv & 0 (\mod 2) \\
  4 \cdot %x & \equiv & 2 (\mod 3)
\end{eqnarray}
We can simplify each further:
\begin{eqnarray}
  %x^2 & \equiv & 0 (\mod 2) \\
  %x & \equiv & 2 (\mod 3)
\end{eqnarray}
We know that the only solution to the first is %x \equiv 0 (\mod 2), so we have now obtained the following system of equations; we can use CRT to find the unique solution modulo 6:
\begin{eqnarray}
  %x & \equiv & 0 (\mod 2) \\
  %x & \equiv & 2 (\mod 3) \\
  %x & \equiv & 2 (\mod 6)
\end{eqnarray}
We can check that, indeed, 4 \cdot 2 + 3 \cdot 2^2 \equiv 20 \equiv 2 (\mod 6).
        ]]></text>
      </example>
      <example required="true" id="dc7f3d14e4484a5a82b64bd8c1e921f5">
        <text hooks="math"><![CDATA[
Solve the following equation for all congruence classes in \Z/7\Z that satisfy it:
\begin{eqnarray}
 %x^2 %- 3 \cdot %x & \equiv & 0 (\mod 7)
\end{eqnarray}
        ]]></text>
      </example>
    </subsection>
    <subsection title="Groups, Subgroups, and Direct Products">
      <definition required="true" hooks="math" id="8f4618a2960e4d3f908da973915f4514"><![CDATA[
We call an algebraic structure (%A, \oplus) a <i>group</i> under \oplus if:
<ul>
  <li>%A is closed under \oplus;</li>
  <li>\oplus is associative on %A;</li>
  <li>%A contains an identity;</li>
  <li>%A has inverses with respect to \oplus (for all %x \in %A, there exists %x^{-1} \in %A such that %x \oplus %x^{-1} = \1 and %x^{-1} \oplus %x = \1 are always true).</li>
</ul>
If (%A, \oplus) possesses no other algebraic properties, we call it a <i>free group</i> or we say it is <i>strictly</i> a group.
      ]]></definition>
      <example required="true" hooks="math" id="42d84a94337b47529bcd38fe477ef70d"><![CDATA[
One example of a group is (\Z, +), because the integers are closed under addition, addition is associative, 1 is an identity, and every integer %x \in \Z has an additive inverse %-%x \in \Z.
      ]]></example>
      <example required="true" hooks="math" id="42d84a94337b47529bcd38fe477ef70d"><![CDATA[
Any vector space %V with vector addition is a group.
      ]]></example>
      <example required="true" hooks="math" id="42d84a94337b47529bcd38fe477ef70d"><![CDATA[
The set \Z<sup>2 \times 2</sup> (the set of all 2 \times 2 matrices with integer entries) together with matrix addition is a group.
      ]]></example>
      <fact required="true" hooks="math" id="42d84a94337b47529bcd38fe477ef702"><![CDATA[
For any %n \in \N, the algebraic structure (\Z/%n\Z, +) where + is addition modulo %n is a group.
      ]]></fact>
      <fact required="true" hooks="math" id="42d84a94337b47529bcd38fe477ef701"><![CDATA[
For any %n \in \N, the algebraic structure ((\Z/%n\Z)*, \cdot) where \cdot is multiplication modulo %n is a group.
      ]]></fact>
      <text hooks="math"><![CDATA[
If we look at subsets of the elements in a group, we might find that certain subsets are closed under the operator for that group. These subsets are called <i>subgroups</i>, and the concept of a subgroup can be very useful when studying and using groups.
      ]]></text>
      <definition required="true" hooks="math" id="42d84a94337b47529bcd38fe477e4bfd"><![CDATA[
Let %A be a group under the operator \oplus. We say that %B is a subgroup of %A if %B \subset %A, %B is closed under \oplus, and %B is a group.
      ]]></definition>
      <example required="true" hooks="math" id="ba6a400fb8564111983d5312406af70d"><![CDATA[
The following are all the subgroups of \Z/4\Z under addition + modulo 4:
<ul>
  <li>{0}, because all terms of the form 0, 0+0, 0+0+0, and so on are equivalent to 0;</li>
  <li>{0,2}, since closure({0,2}, +) = {0,2};</li>
  <li>{0,1,2,3} = \Z/4\Z.</li>
</ul>
The following are all the subgroups of \Z/6\Z under addition + modulo 6
<ul>
  <li>{0}, because all terms of the form 0, 0+0, 0+0+0, and so on are equivalent to 0;</li>
  <li>{0,2,4}, since closure({2}, +) = closure({0,2,4}, +) = {0,2,4};</li>
  <li>{0,3}, since closure({3}, +) = closure({0,3}, +) = {0,3};</li>
  <li>{0,1,2,3,4,5} = closure({1}, +) = \Z/6\Z.</li>
</ul>
      ]]></example>
      <fact required="true" hooks="math" id="72d3893cc83049c491d16d43bb658c75"><![CDATA[
Given some %n \in \N and some factor %f \in \N such that %f|%n, then (closure({%f}, +), +) is a subgroup of (\Z/%n\Z, +), and it is isomorphic to the group (\Z/(%n/%f)\Z, +).
      ]]></fact>
      <example required="true" hooks="math" id="c281916dd6694770b962a563ad9b5e9f"><![CDATA[
The following are all the non-trivial subgroups of \Z/6\Z under addition + modulo 6, together with their corresponding isomorphic group:
<ul>
  <li>({0,2,4}, +) \cong (\Z/(6/2)\Z) \cong (\Z/3\Z, +);</li>
  <li>({0,3}, +) \cong (\Z/(6/3)\Z) \cong (\Z/2\Z, +).</li>
</ul>
      ]]></example>
      <text hooks="math"><![CDATA[
The notion of a subgroup allows us to introduce an alternative definition for prime numbers.
      ]]></text>
      <definition required="true" hooks="math" id="afeda0e83c2b42a499dedd2c0c38163e"><![CDATA[
Given an integer %p \in \N where %p > 1, we say that %p is <i>prime</i> if the only subgroups of (\Z/%p\Z, +) are the trivial subgroups  ({0}, +) and (\Z/%p\Z, +).
      ]]></definition>
      <conjecture title="hidden subgroup problem" required="true" hooks="math" id="9af23aa8e9bb46c0a8ade981711bf444">
        <text hooks="math"><![CDATA[
The following problem is not in %P: given a group (%A, \oplus), find a non-trivial subgroup of %A (<i>non-trivial</i> means not the subgroup that contains only the identity, ({<b>I</b>}, \oplus), and not the subgroup consisting of the entire group, (%A, \oplus)).
        ]]></text>
        <paragraph hooks="math"><![CDATA[
Often, we are interested in a more restricted versions of this problem, which are also not believed to be in %P:
<ul>
  <li>finding a non-trivial subgroup of (\Z/%n\Z, +);</li>
  <li>finding a non-trivial subgroup of ((\Z/%n\Z)*, \cdot);</li>
  <li>finding the size of the subgroup closure({%a}, \cdot) of the group (\Z/%n\Z)*, where %a \in (\Z/%n\Z)*.</li>
</ul>
        ]]></paragraph>
      </conjecture>
      <example required="true" hooks="math" id="4df85de24dab4ba5bba36000b94118af">
        <text hooks="math"><![CDATA[
Suppose that for some %n \in \N, we are given %a \in \Z/%n\Z such that \gcd(%a, %n) = 1. We know from Euler's theorem that %a<sup>\varphi(%n)</sup> \equiv 1 (\mod %n). However, \varphi(%n) is not necessarily the smallest exponent of %a that will yield 1.
        ]]></text>
        <paragraph hooks="math"><![CDATA[
For example, consider 3 \in \Z/8\Z. Even though \varphi(8) = 2^3 - 2^2 = 4 and 3^4 \equiv 1 (\mod 8), it is also true that 3^2 \equiv 9 \equiv 1 (\mod 8).
        ]]></paragraph>
        <paragraph hooks="math"><![CDATA[
Thus, given some %a \in \Z/%n\Z such that \gcd(%a, %n) = 1, the problem of determining the smallest %r such that %a<sup>%r</sup> \equiv 1 (\mod %n) amounts to finding the smallest subgroup of ((\Z/%n\Z)*, \cdot) that contains %a. Equivalently, this amounts to finding |closure({%a}, \cdot)|.
        ]]></paragraph>
      </example>
      <algorithm title="Shor's algorithm" required="true" hooks="math" id="eefac372670742c38867f608e3acb839"><![CDATA[
Shor's algorithm relies on the ability of a quantum computer to find the smallest %r > 0 such that %a<sup>%r</sup> \equiv 1 (\mod %n). It takes an arbitrary integer %n as its input and finds a non-trivial factor of %n with high probability. We highlight the quantum portion of the algorithm in <b style="color:green;">green</b>.
<ol style="list-style-type:none;">
 <li><b>Shor's algorithm:</b> %n \in \N</li>
 <li>
   <ol style="list-style-type:none;">
     <li><b>do</b>
       <ol style="list-style-type:none;">
         <li>choose a random %a \in \Z/%n\Z</li>
         <li><b>if</b> \gcd(%a, %n) > 1, <b>return</b> \gcd(%a, %n)</li>
         <li><b>otherwise</b>, <b style="color:green;">find the smallest %r > 0 such that %a<sup>%r</sup> \equiv 1 (\mod %n)</b></li>
       </ol>
       <b>until</b> %r is even and %a<sup>(%r/2)</sup> \not\equiv %-1 (\mod %n)
     </li>
     <li>since we have exited the loop, then %r is even and %a<sup>(%r/2)</sup> \not\equiv %-1 (\mod %n)</li>
     <li>thus, %a<sup>(%r/2)</sup> is a non-trivial root of %a<sup>%r</sup></li>
     <li><b>return</b> \gcd(%a<sup>(%r/2)</sup> \pm 1, %n), which is a non-trivial factor by <a href="#92c05f074c4242d381e07935f9db5ea9">this fact</a></li>
   </ol>
 </ol>
Note that 1 has exactly four roots modulo %n because %n = %p \cdot %q. Since %r > 0, %a<sup>(%r/2)</sup> cannot be 1. This leaves %-1 and two other possibilities.
      ]]></algorithm>
      <example required="true" hooks="math" id="4df85de24dab4ba5bba36110b94118af">
        <text hooks="math"><![CDATA[
Let us consider the example where %n = 15. If we do not know the factors of 15, we could instead start with %a = 2, since 2 \in (\Z/15\Z)*. We then find that:
\begin{eqnarray}
 %r & = & |closure({2}, \cdot)| & = & |{2, 4, 8, 1}| & = & 4
\end{eqnarray}
Thus, %a^{%r} \equiv 2^4 \equiv 1 (\mod 15). In this case, %r = 4 is even and %a<sup>(%r/2)</sup> \equiv 2<sup>4/2</sup> \equiv 4, where 4 \not\equiv %-1. But this means we have found a root 4 of 1 where 4 \not\equiv \pm 1:
\begin{eqnarray}
  4 \cdot 4 & \equiv & 1 \cdot 1 (\mod 15)
\end{eqnarray}
Thus, we can now use the <a href="#92c05f074c4242d381e07935f9db5ea9">reduction from factoring to the congruent squares problem</a> to find a factor of %n:
\begin{eqnarray}
  \gcd(4 + 1, 15) & = & 5 \\
  \gcd(4 %- 1, 15) & = & 3
\end{eqnarray}
        ]]></text>
      </example>
      <text hooks="math"><![CDATA[
We now consider a few other examples illustrating how subgroups and isomorphisms between groups and subgroups can be applied.
      ]]></text>
      <example title="arithmetic with unbounded error and bounded unreliability" required="true" hooks="math" id="0d3bb24baa3047b0937c0e90501873a7">
        <text><![CDATA[
Suppose you need to perform a sequence of %k addition operations in \Z/15\Z, but all the addition operators \oplus modulo %n available to you are error-prone. To add two numbers %a, %b modulo %n accurately, you must perform the computation %a \oplus %b at least %n times (because up to \lceil %n/2 \rceil of those attempts will result in an arbitrarily large error).
        ]]></text>
        <paragraph><![CDATA[
This means that to perform %k addition operations modulo 15, it will be necessary to perform every operation 15 times, for a total of %k \cdot 15 operations modulo 15. If each addition operation modulo %n takes about \log_2 %n steps, this would mean that %k operations would take:
\begin{eqnarray}
  %k \cdot 15 \cdot 4 steps
\end{eqnarray}
Assuming that performing CRT to find a solution in \Z/15\Z takes 10,000 steps, determine how you can use CRT to speed up the computation of these %k addition operations, and for what minimum %k this would be advantageous.
        ]]></paragraph>
      </example>
      <definition required="true" hooks="math" id="afeda0e83c2b42a499dedd2c0c3816aa"><![CDATA[
Given two groups (%A, \oplus) and (%B, \otimes), we define the <i>direct product</i> of these two groups to be the group (%A \times %B, &loz;) where the operator &loz; is defined over %A \times %B as follows:
\begin{eqnarray}
  (%a, %b) &loz; (%a', %b') & = & (%a \oplus %a', %b \otimes %b)
\end{eqnarray}
      ]]></definition>
      <example required="true" hooks="math" id="18231a61b42aaae1be8347f75c7f4fd8"><![CDATA[
The direct product (\Z/2\Z \times \Z/2\Z, +) where + is component-wise addition is a group, but it is <i>not isomorphic</i> to (\Z/4\Z, +). To see why, consider that \Z/4\Z has a generator 1 \in \Z/4\Z. Are any of the four elements (0,0), (0,1), (1,0), or (1,1) generator for all the elements in \Z/2\Z \times \Z/2\Z?
      ]]></example>
      <example required="true" hooks="math" id="18231a61b42aaaeddd8347f75c7f4fd8"><![CDATA[
The direct product (\Z/2\Z \times \Z/3\Z, +) where + is component-wise addition is a group, and it is isomorphic to \Z/6\Z. Can you find a single generator in \Z/2\Z \times \Z/3\Z that can be used to generate every element in \Z/2\Z \times \Z/3\Z? What is the name of the theorem that states that there is an isomorphism between \Z/2\Z \times \Z/3\Z and \Z/6\Z?
      ]]></example>
      <example required="true" hooks="math" id="18231a61b42aaaeddd8347f75c7f4aaa">
        <text><![CDATA[
Suppose we consider the set of all possible polynomials of the form %a<sub>%k</sub> %x<sup>%k</sup> + %a<sub>%k-1</sub> %x<sup>%k-1</sup> + ... + %a_2 %x^2 + %a_1 %x^1 + %a_0 %x^0 where every coefficient %a_{%i} is from \Z/2\Z, and where + represents addition modulo 2. Then we can observe the following:
\begin{eqnarray}
  0^2 & = & 0 \\
  1^2 & = & 1
\end{eqnarray}
In other words, for any %x \in \Z/2\Z, %x^2 \equiv %x. That means any term of the form %x^{%k} can be simplified into %x:
\begin{eqnarray}
  %x^2 & = & %x \\
  %x^3 & = & %x^2 \cdot %x & = & %x \cdot %x & = & %x \\
  %x^4 & = & %x^3 \cdot %x & = & %x \cdot %x & = & %x \\
       & \vdots & & \vdots & & \vdots &
\end{eqnarray}
This, together with the fact that every coefficient %a_{%i} can be simplified to either 0 or 1 modulo 2, shows us that there are only four distinct polynomials modulo 2:
\begin{eqnarray}
  {0 \cdot %x + 0, %~ 0 \cdot %x + 1, %~ 1 \cdot %x + 0, %~ 1 \cdot %x + 1} & = & {0, 1, %x, %x + 1}
\end{eqnarray}
One notation for this set of polynomials is \Z/2\Z[%x], which can be read as "\Z/2\Z extended with %x" or "polynomials in \Z/2/Z". The set {0, 1, %x, %x + 1} together with addition modulo 2 is an algebraic structure, and it is isomorphic to \Z/2\Z \times \Z/2\Z where the two ceofficients of the polynomial %a_1 %x + %a_0 correspond to the two components of an element (%a_1, %a_0) in \Z/2\Z \times \Z/2\Z.
        ]]></text>
      </example>
    </subsection>
    <!--include sheaf="assignment-six.xml"/-->
  </section>
  <review title="Algebraic Structures and their Properties">
    <text><![CDATA[
This section contains a comprehensive collection of review problems going over all the course material. Many of these problems are an accurate representation of the kinds of problems you may see on an exam.
    ]]></text>
    <exercise required="true" id="cd2b89cad4bd496db3770b8e1d17db97">
      <text hooks="math"><![CDATA[
Suppose we have the following polynomial in the integers (i.e., all operations are arithmetic operations):
\begin{eqnarray}
6 %x<sup>1001</sup> + 2 %x<sup>600</sup> + 1
\end{eqnarray}
Prove that the arithmetic expression above is always divisible by 3 if \gcd(%x,3) = 1.
      ]]></text>
      <solution hooks="math"><![CDATA[
We first notice that the above is simply asking if all possible congruence classes %x \in (\Z/3\Z)* are solutions to the equation:
\begin{eqnarray}
6 %x<sup>1001</sup> + 2 %x<sup>600</sup> + 1 & \equiv & 0 (\mod 3)
\end{eqnarray}
We can use Euler's theorem to simplify the exponents in the above equation, since \varphi(3) = 2 and %x is coprime with 3:
\begin{eqnarray}
6 %x<sup>1001 \mod 2</sup> + 2 %x<sup>600 \mod 2</sup> + 1 & \equiv & 0 (\mod 3) \\
                   6 %x<sup>1</sup> + 2 %x<sup>0</sup> + 1 & \equiv & 0 \\
                     6 %x + 2 + 1 & \equiv & 0 \\
                     6 %x + 0 & \equiv & 0 \\
                     0 \cdot %x & \equiv & 0 \\
                     0 & \equiv & 0
\end{eqnarray}
The above shows that, indeed, for any %x \in \Z/3\Z, the expression yields a result in 0 + 3\Z, so the original arithmetic expression is always divisible by 3 for all integers %x.
      ]]></solution>
    </exercise>
    <exercise required="true" id="f430b1a613bf4e58916a0fec0cb7739f">
      <text hooks="math"><![CDATA[
Suppose you have %n \in \N and a congruence class %a \in \Z/%n\Z such that \gcd(%a, %n) = 1. Compute in terms of %n (and only %n) the congruence class corresponding to the following term:
\begin{eqnarray}
0 \cdot %a + 1 \cdot %a + 2 \cdot %a + ... + (%n %- 1) \cdot %a
\end{eqnarray}
      ]]></text>
      <solution hooks="math"><![CDATA[
As we did when we proved <a href="#71a8e073b8f244809d2c321d5b5d2987">Fermat's little theorem</a>, we notice that the multiples of %a are just a permutation of {0,1,...,%n-1} = \Z/n\Z. This means that:
\begin{eqnarray}
0 \cdot %a + 1 \cdot %a + 2 \cdot %a + ... + (%n %- 1) \cdot %a & \equiv & 0 + 1 + ... + %n-1 (\mod %n)
\end{eqnarray}
We know that there is a closed formula for the summation, which we can use:
\begin{eqnarray}
0 + 1 + ... + %n-1 & \equiv & ((%n \cdot (%n %- 1)) / 2) (\mod %n)
\end{eqnarray}
      ]]></solution>
    </exercise>
    <exercise required="true" id="48af866d4ff842afb1e1eefc5152a3a9">
      <text hooks="math"><![CDATA[
Find all %x \in \Z/29\Z that satisfy the following:
\begin{eqnarray}
  %y^2 & \equiv & 16 (\mod 29) \\
  %x^2 & \equiv & %y (\mod 29)
\end{eqnarray}
      ]]></text>
      <solution hooks="math"><![CDATA[
We first solve for all possible %y. Since 29 > 16, we have that \pm 4 are the square roots of 16 in \Z/29\Z. Thus,
we have two solutions for %y:
\begin{eqnarray}
  %y & \in & {4, 29 %- 4} \\
  %y & \in & {4, 25}
\end{eqnarray}
We want to find all %x that satisfy the system, so we need to solve for %x for each possible %y. Thus, we have:
\begin{eqnarray}
  %y   & \equiv & 4 (\mod 29) \\
  %x^2 & \equiv & 4 (\mod 29) \\
  %x   & \equiv & \pm 2 (\mod 29) \\
  %x   & \in & {2, 29 %- 2} \\
  %x   & \in & {2, 27}
\end{eqnarray}
We also have:
\begin{eqnarray}
  %y   & \equiv & 25 (\mod 29) \\
  %x^2 & \equiv & 25 (\mod 29) \\
  %x   & \equiv & \pm 5 (\mod 29) \\
  %x   & \in & {5, 29 %- 5}\\
  %x   & \in & {5, 24}
\end{eqnarray}
Thus, the possible solutions for %x are:
\begin{eqnarray}
  %x   & \in & {2, 5, 24, 27}
\end{eqnarray}
Notice also that the problem could have been stated as:
\begin{eqnarray}
  %x^4 & \equiv & 16 (\mod 29)
\end{eqnarray}
      ]]></solution>
    </exercise>
    <exercise required="true" id="183a3540263849dfae2693869e6e3813">
      <text hooks="math"><![CDATA[
Solve the following problems.
      ]]></text>
      <orderedlist style="list-style-type:lower-alpha">
        <item>
          <text hooks="math"><![CDATA[
Consider the following two circular shift permutations:
\begin{eqnarray}
  [8,9,0,1,2,3,4,5,6,7] \\
  [5,6,7,8,9,0,1,2,3,4]
\end{eqnarray}
How many of each would you need to compose to obtain the permutation [9,0,1,2,3,4,5,6,7,8]?
          ]]></text>
          <solution hooks="math"><![CDATA[
These permutations specified are in %C_{10}, and we know that %C_{10} \cong \Z/10\Z. Notice that [8,9,0,1,2,3,4,5,6,7] \in %C_{10} can correspond to 8 \in \Z/10\Z, that [5,6,7,8,9,0,1,2,3,4] \in %C_{10} can correspond to 5 \in \Z/10\Z, and that [9,0,1,2,3,4,5,6,7,8] \in %C_{10} can correspond to 9 \in \Z/10\Z. By <a href="#4353592f86d4482c93cebb6da6d749b9">B&eacute;zout's identity</a> we have that:
\begin{eqnarray}
  8 \cdot 2 + 5 \cdot (-3) & = & 1 \\
  8 \cdot 2 + 5 \cdot 7 & \equiv & 1 (\mod 10) \\
  8 \cdot (9 \cdot 2) + 5 \cdot (9 \cdot 7) & \equiv & 9 \cdot 1 (\mod 10) \\
  8 \cdot 8 + 5 \cdot 3 & \equiv & 9 (\mod 10) \\
\end{eqnarray}
Thus, we would need to compose 8 instances of the first permutation and 3 instances of the second permutation to obtain [9,0,1,2,3,4,5,6,7,8].
          ]]></solution>
        </item>
        <item>
          <text hooks="math"><![CDATA[
Rewrite the permutation [3,4,0,1,2] as a composition of adjacent swap permutations.
          ]]></text>
          <solution hooks="math"><![CDATA[
We can simply run the bubble sort algorithm on the above permutation and record the permutation that represents each swap. This leads to the following sequence:
\begin{eqnarray}
  %p_1 & = & [0,<b>2</b>,<b>1</b>,3,4] \\
  %p_2 & = & [0,1,<b>3</b>,<b>2</b>,4] \\
  %p_3 & = & [0,1,2,<b>4</b>,<b>3</b>] \\
  %p_4 & = & [<b>1</b>,<b>0</b>,2,3,4] \\
  %p_5 & = & [0,<b>2</b>,<b>1</b>,3,4] \\
  %p_6 & = & [0,1,<b>3</b>,<b>2</b>,4]
\end{eqnarray}
Thus, by applying the above sequence of permutations to [0,1,2,3,4] in reverse order, we can obtain [3,4,0,1,2], so the factorization of [3,4,0,1,2] into adjacent swap permutations is:
\begin{eqnarray}
  [3,4,0,1,2] & = & %p_1 \circ %p_2 \circ %p_3 \circ %p_4 \circ %p_5 \circ %p_6 \circ [0,1,2,3,4]
\end{eqnarray}
          ]]></solution>
        </item>
      </orderedlist>
    </exercise>
    <exercise required="true" id="bde7c8e569984cb5a17b521788c3237c">
      <text hooks="math"><![CDATA[
Suppose we want to perform %k exponentiation operations (e.g., if %k = 4, we want to compute (((%a^{%b})^{%c})^{%d})^{%e}) modulo 21.
Assume the following:
<ul>
  <li>a single exponentiation operation modulo 21 takes 21^3 = 9261 steps;</li>
  <li>a single exponentiation operation modulo 3 takes 3^3 = 27 steps;</li>
  <li>a single exponentiation operation modulo 7 takes 7^3 = 343 steps;</li>
  <li>an exponentiation operation modulo 3 and an exponentiation operation modulo 7 together take 343 + 27 = 370 steps;</li>
  <li>solving a two-equation system for two values, %a modulo 3 and %b modulo 7, takes 8000 steps using CRT;</li>
  <li>we can either compute the exponentiation sequence directly modulo 21, or we can split it into two sequences of computations (one modulo 3,
      the other modulo 7) and then recombine using CRT at the end.</li>
</ul>
      ]]></text>
      <orderedlist style="list-style-type:lower-roman">
        <item>
          <text hooks="math"><![CDATA[
What is the number of steps needed to perform %k exponentiations modulo 21?
          ]]></text>
          <solution hooks="math"><![CDATA[
\begin{eqnarray}
%f(%k) & = & 9261 \cdot %k
\end{eqnarray}
          ]]></solution>
        </item>
        <item>
          <text hooks="math"><![CDATA[
What is the number of steps needed to perform %k exponentiations modulo 3 and %k exponentiations modulo 7, then to recombine using CRT?
          ]]></text>
          <solution hooks="math"><![CDATA[
\begin{eqnarray}
%f(%k) = 370 \cdot %k + 8000
\end{eqnarray}
          ]]></solution>
        </item>
      </orderedlist>
    </exercise>
    <exercise required="true" id="e6c745c3e11f4d91820dd017bccd5b16">
      <text hooks="math"><![CDATA[
Find solutions to the following problems.
      ]]></text>
      <orderedlist style="list-style-type:lower-alpha">
        <item>
          <text hooks="math"><![CDATA[
Explain why the following polynomial has no integer solutions (<b>Hint:</b> you only need to evaluate the polynomial for two possible values of %x):
\begin{eqnarray}
  %x^4 + %x^2 + 3 & = & 0
\end{eqnarray}
          ]]></text>
          <solution hooks="math">
            <text><![CDATA[
If the above equation has an integer solution %x, then it must have an integer solution modulo 2, since we can take the modulus of both sides:
\begin{eqnarray}
  %x^4 + %x^2 + 3 & = & 0 \\
  (%x^4 + %x^2 + 3) \mod 2 & = & 0 \mod 2\\
  %x^4 + %x^2 + 3 & \equiv & 0 (\mod 2)
\end{eqnarray}
Thus, we have using logic that:
\begin{eqnarray}
  (exists solution in \Z) & \rightarrow & (exists solution modulo 2) \\
  (no solution modulo 2) & \rightarrow & (no solution in \Z)
\end{eqnarray}
Note that this only works in one direction. A solution modulo 2 does not necessarily imply that there is an integer solution.
            ]]></text>
            <paragraph><![CDATA[
We see that for %x = 0 and %x = 1, the left-hand side is odd. The right-hand side is 0, so it is always even. Thus, no integer solution exists.
            ]]></paragraph>
          </solution>
        </item>
        <item>
          <text hooks="math"><![CDATA[
Find at least one solution %x \in \Z/10\Z to the following system of equations (you must use <a href="#4353592f86d4482c93cebb6da6d749b9">B&eacute;zout's identity</a>):
\begin{eqnarray}
  6 \cdot %y + 5 \cdot %x - 1 & \equiv & 0 (\mod 10) \\
                         %x^2 & \equiv & %y (\mod 10)
\end{eqnarray}
          ]]></text>
          <solution hooks="math"><![CDATA[
Since 5 and 6 are coprime, we can find a solution to the first equations. One such solution is:
\begin{eqnarray}
  %y & \equiv & 1 (\mod 10) \\
  %x & \equiv & -1 (\mod 10) \\
     & \equiv & 9 (\mod 10)
\end{eqnarray}
We also have that 9^2 \equiv 81 \equiv 1 (\mod 10). Thus, since 1^2 \equiv 1 (\mod 10), both equations are satisfied by this solution.
          ]]></solution>
        </item>
      </orderedlist>
    </exercise>
    <exercise required="true" id="10d06dbe084340ac98a16d9a9b27324a">
      <text hooks="math"><![CDATA[
Find solutions to the following problems.
      ]]></text>
      <orderedlist style="list-style-type:lower-alpha">
        <item>
          <text hooks="math"><![CDATA[
Suppose you want to send some %s \in \Z/%n\Z to Alice and Bob, but you want to ensure that the only way Alice and Bob can retrieve %s is if they work together. What two distinct pairs (%s_1, %p_1) and (%s_2, %p_2) would you send to Alice and Bob, respectively, so that they would need to work together to recover %s?
          ]]></text>
          <solution hooks="math"><![CDATA[
You would need to send (%s \mod %p, %p) to Alice and (%s \mod %q, %q) to Bob where %s < %p \cdot %q and %p and %q are distinct and coprime.
          ]]></solution>
        </item>
        <item>
          <text hooks="math"><![CDATA[
Suppose Bob is generating a public RSA key; he chooses a very large prime %p, and then he chooses %q = 2. Why is this not secure?
          ]]></text>
          <solution hooks="math"><![CDATA[
Bob must share his public key (%n, %e). Since %n = %p \cdot 2, %n is even. This can immediately be seen by looking at the last bit of %n (which will be 0, since %n \mod 2 = 0). It is then easy to recover the secret value %p.
          ]]></solution>
        </item>
        <item>
          <text hooks="math"><![CDATA[
Suppose Alice and Bob use Shamir secret sharing to share a password %s to a lock that is not protected from brute force attacks (i.e., anyone can keep trying different passwords until they unlock it). Alice holds %s \mod %p and Bob holds %s \mod %q, where %s < %p \cdot %q. However, suppose that Bob happens to be using %q = 2, and Alice knows this. What can Alice do to quickly break the lock?
          ]]></text>
          <solution hooks="math"><![CDATA[
If Alice holds %a and Bob holds %b, the system of equations that would be set up to recover %s is as follows:
\begin{eqnarray}
  %x & \equiv & %a (\mod %p) \\
  %x & \equiv & %b (\mod 2)
\end{eqnarray}
Notice that there are only two possibilities for Bob's value %b \in \Z/2\Z. Thus, Alice could set up two systems, one for %b = 0 and another for %b = 1, solve both, and try both secrets %s on the lock.
          ]]></solution>
        </item>
      </orderedlist>
    </exercise>
    <exercise required="true" id="98cc6b32599a4ae392d563b0be4e20f1">
      <text hooks="math"><![CDATA[
Suppose that Alice, Bob, Carl, and Dan are sharing a secret %s using Shamir secret sharing, where each participant is assigned a distinct modulus %n
that is coprime to everyone else's modulus. Each participant is holding a part of the secret %s \mod %n, and the
secret can be recovered <b>by any two participants</b>. However, Eve has sabotaged the value stored by <b>one</b> one
the participants. Below are the values currently stored by everyone; <b>one of them is corrupted</b>.
<ul>
  <li>Alice: %n<sub>Alice</sub> = 3 and (%s \mod 3) = 2</li>
  <li>Bob: %n<sub>Bob</sub> = 4 and (%s \mod 4) = 3</li>
  <li>Carl: %n<sub>Carl</sub> = 5 and (%s \mod 5) = 2</li>
  <li>Dan: %n<sub>Dan</sub> = 7 and (%s \mod 7) = 4</li>
</ul>
      ]]></text>
      <orderedlist style="list-style-type:lower-alpha">
        <item>
          <text hooks="math"><![CDATA[
Which participant's stored value %s \mod %n has Eve sabotaged?
          ]]></text>
          <solution hooks="math"><![CDATA[
Any two participants can recover the secret %s by setting up a system with two equations and solving the system using CRT. We list all of the possible combinations and solve for %s to find which participant's value has been corrupted.
      <ul>
        <li> Alice and Bob:
\begin{eqnarray}
  %s & \equiv & 2 (\mod 3) \\
  %s & \equiv & 3 (\mod 4) \\
  <b style="color:firebrick;">%s</b> & \equiv & <b style="color:firebrick;">11</b> (\mod 12)
\end{eqnarray}
        </li>
        <li> Alice and Carl:
\begin{eqnarray}
  %s & \equiv & 2 (\mod 3) \\
  %s & \equiv & 2 (\mod 5) \\
  <b style="color:firebrick;">%s</b> & \equiv & <b style="color:firebrick;">2</b> (\mod 15)
\end{eqnarray}
        </li>
        <li> Alice and Dan:
\begin{eqnarray}
  %s & \equiv & 2 (\mod 3) \\
  %s & \equiv & 4 (\mod 7) \\
  <b style="color:firebrick;">%s</b> & \equiv & <b style="color:firebrick;">11</b> (\mod 21)
\end{eqnarray}
        </li>
        <li> Bob and Carl:
\begin{eqnarray}
  %s & \equiv & 3 (\mod 4) \\
  %s & \equiv & 2 (\mod 5) \\
  <b style="color:firebrick;">%s</b> & \equiv & <b style="color:firebrick;">7</b> (\mod 20)
\end{eqnarray}
        </li>
        <li> Bob and Dan:
\begin{eqnarray}
  %s & \equiv & 3 (\mod 4) \\
  %s & \equiv & 4 (\mod 7) \\
  <b style="color:firebrick;">%s</b> & \equiv & <b style="color:firebrick;">11</b> (\mod 28)
\end{eqnarray}
        </li>
        <li> Carl and Dan:
\begin{eqnarray}
  %s & \equiv & 2 (\mod 5) \\
  %s & \equiv & 4 (\mod 7) \\
  <b style="color:firebrick;">%s</b> & \equiv & <b style="color:firebrick;">32</b> (\mod 35)
\end{eqnarray}
        </li>
      </ul>
Since three of the participants can consistently recover the same secret %s = 11, and all pairs of participants in which Carl is present do not yield %s = 11 and are inconsistent with one another, it must be Carl's data that has been sabotaged.
          ]]></solution>
        </item>
        <item>
          <text hooks="math"><![CDATA[
What is the correct secret value %s?
          ]]></text>
          <solution hooks="math"><![CDATA[
Since three of the six possible pairings result in %s = 11, and the other three are inconsistent and all involve Carl, it must be that %s = 11 was the original uncorrupted secret.
          ]]></solution>
        </item>
        <item>
          <text hooks="math"><![CDATA[
What's the number of different shared secret values these four participants can store (assuming they use the same moduli, and require that any two members should be able to recover the secret).
          ]]></text>
          <solution hooks="math"><![CDATA[
Since any two participants must be able to recover %s, it must be that %s < %n \cdot %m for every possible pair %n and %m. The smallest two values are 3 and 4, so 3 \cdot 4 - 1 = 11, where 11 \in \Z/(3 \cdot 4)\Z, is the largest possible %s that can be receovered.
          ]]></solution>
        </item>
        <item>
          <text hooks="math"><![CDATA[
Suppose you want to store an %n-bit number %s. You want to store it in a way that makes it possible to recover %s even if one of the bits is corrupted. How can you accomplish this using at most approximately 2 \cdot %n bits?
          ]]></text>
          <solution hooks="math">
            <text><![CDATA[
Choose four distinct coprime numbers %m_1, %m_2, %m_3, and %m_4 such that %s is less than the product of every pair of these, but such that the product of any pair is not much larger than %s (e.g., %m_1 and %m_2 can be stored in the same number of bits as %s). Then store (%s \mod %m_1, %s \mod %m_2, %s \mod %m_3, %s \mod %m_4) using about 2 \cdot %n bits.
            ]]></text>
            <paragraph><![CDATA[
If any individual bit is corrupted, this corrupts at most one of the four values stored. As with Alice, Bob, and Dan, the original value can still be recovered.
            ]]></paragraph>
          </solution>
        </item>
      </orderedlist>
    </exercise>
    <exercise required="true" id="123b89cad4bd496db3770b8e1d17db97">
      <text hooks="math"><![CDATA[
Suppose you want to make a two-player game in which each player gets a different element (call them @a and @b) from the algebraic structure (%A, \oplus). Then, they would be given a third element @c, and they must work together to use their two elements @a and @b to create the target element @c. <i>It must be impossible for an individual player to make the target element @c on their own</i>. Explain why each of the following algebraic structures would or would not work for this game.
<ul>
  <li>\Z/3\Z</li>
  <li>\Z/4\Z</li>
  <li>\Z/2\Z \times \Z/2\Z</li>
  <li>\Z/6\Z</li>
  <li>\Z/2\Z \times \Z/3\Z</li>
  <li>%S_3</li>
  <li>\Z</li>
</ul>
      ]]></text>
      <solution hooks="math"><![CDATA[
Each of the scenarios is considered below.
<ul>
  <li>For \Z/3\Z, this is impossible because as soon as one player has 1 + 3\Z or 2 + 3\Z, that player can generate all of {0, 1, 2}. Furthermore, 0 + 3\Z can only generate {0}.</li>
  <li>For \Z/4\Z, this is impossible because while closure({2}, +) = {0,2}, the only options for the other player are 1 + 4\Z or 3 + 4\Z, which means the other player can generate all the elements (since 1 and 3 are coprime with 4).</li>
  <li>For \Z/2\Z \times \Z/2\Z, this is possible: give one player (1,0) and the other player (0,1). Only by working together can they generate (1,0) \oplus (0,1) = (1,1).</li>
  <li>For \Z/6\Z, this is possible if we choose 2 and 3: closure({2}, +) = {0,2,4} and closure({3},+) = {0,3}, but together the two players can generate 3 + 2 = 5 and 3 %- 2 = 1.  Both 1 and 5 can be used to generate every element in \Z/6\Z.</li>
  <li>Since \Z/2\Z \times \Z/3\Z is isomorphic to \Z/6\Z, it is also possible (e.g., by choosing the elements corresponding to 2 + 6\Z and 3 + 6\Z, which are (0,2) and (1,0) in this case).</li>
  <li>For %S_3, this is possible by choosing a swap permutation and a shift permutation. This is because a swap permutation such as [1,0,2] can only be used to generate itself or the identity, and a shift permutation like [1,2,0] can only be used to generate %C_3. Together, they can be used to generate all of %S_3.</li>
  <li>For \Z, this amounts to finding any instance of B&eacute;zout's identity. For example, 5 and 4 can each only generate the multiples of 5 or the multiples of 4, respectively, but gievn that 5 \cdot (1) + 4 \cdot (%- 1) = 1, they can used together to generate all the integers.</li>
</ul>
      ]]></solution>
    </exercise>
    
    <!--<text hooks="math"><![CDATA[
The following is a breakdown of what you should be able to do at this point in the course (and of what you may be tested on in an exam).
Notice that many of the tasks below can be composed, and that many problems can be solved in more than one way.
<ul>
  <li>find the greatest common divisor of two relatively small integers</li>
  <li>check if a number is prime
    <ul>
      <li>using an exhaustive search</li>
      <li>using the Fermat primality test</li>
    </ul>
  </li>
  <li>generate random permutations and integers
    <ul>
      <li>generate a permutation of a set {1,...,%m-1}</li>
      <li>generate a "random" number using permutations</li>
      <li>generate a random number in a certain range</li>
      <li>generate a random prime in a certain range</li>
      </li>
    </ul>
  </li>
  <li>use randomly generated primes...
    <ul>
      <li>to encrypt information and transmit it safely (using RSA or Rabin encryption)</li>
      <li>to share information requiring cooperation (using Shamir secret sharing)</li>
      <li>to store information on unreliable storage devices (using Shamir secret sharing)</li>
      <li>to perform many arithmetic operations %x_1 \oplus ... \oplus %x_{%n} for some operator \oplus in sequence more efficiently (using CRT)
        <ul>
          <li>if the range of the final output is known</li>
          <li>if working in parallel along multiple distinct %p_{%i} in \Z/%p_{%i}\Z, and then performing CRT once is less expensive than working in \Z/%n\Z the whole time</li>
        </ul>
      </li>
    </ul>
  </li>
  <li>solving equations involving congruence classes and performing computations
    <ul>
      <li>compute multiplicative inverses \Z/%n\Z
        <ul>
          <li>using \phi(%n)</li>
          <li>using a given output from the extended Euclidean algorithms or (equivalently) an instance of B&eacute;zout's identity</li>
        </ul>
      </li>
      <li>compute exponents modulo %n efficiently
        <ul>
          <li>using Euler's theorem and \phi (when possible)</li>
          <li>using the efficient repeated-squaring method</li>
        </ul>
      </li>
      <li>solve a system of linear equations (i.e., with a coefficient on the left-hand side) where each equation is modulo some %n_{%i}
        <ul>
          <li>derive a system of equations from a word problem
            <ul>
              <li>rotating/cycling objects</li>
              <li>objects that generate/consume different amounts of power, time, space, etc.</li>
              <li>Shamir secret sharing and applications</li>
            </ul>
          </li>
          <li>solve a system involving additive and multiplicative inverses</li>
          <li>using the linear congruence theorem</li>
          <li>using the generalized CRT process (even if moduli are not coprime)</li>
        </ul>
      </li>
      <li>compute square roots of congruence classes...
        <ul>
          <li>modulo a prime</li>
          <li>modulo a (small) prime power</li>
          <li>modulo a product of two coprime numbers</li>
        </ul>
      </li>
    </ul>
  </li>
  <li>efficiency/complexity of modular arithmetic algorithms...
    <ul>
      <li>efficiency of modular addition, multiplication, and exponentiation</li>
      <li>recognize when you cannot solve problems efficiently
        <ul>
          <li>computing \phi(%n) for an arbitrary %n</li>
          <li>factoring %n for an arbitrary %n</li>
          <li>computing discrete logarithms</li>
          <li>computing RSA secret keys from public keys, and decrypting RSA messages without any knowledge of secret keys</li>
          <li>decrypting Rabin messages without any knowledge of secret keys</li>
        </ul>
      </li>
    </ul>
  </li>
  <li>permutations and isomorphisms
    <ul>
      <li>sets of all permutations, cyclic permutations, multiplication-induced permutations, swap permutations, and adjacent swap permutations
        <ul>
          <li>composing two permutations</li>
          <li>decomposing a permutation into adjacent swap permutations (e.g., BubbleSort)</li>
        </ul>
      </li>
      <li>closures and generators
        <ul>
          <li>linear congruence theorem</li>
        </ul>
      </li>
      <li>isomorphisms between common algebraic structures
        <ul>
          <li>cyclic permutations and (\Z/%n\Z, +)</li>
          <li>multiplication-induced permutations and ((\Z/%n\Z)*, \cdot)</li>
          <li>(\Z/\phi(%n)\Z, +) and ((\Z/%n\Z)*, \cdot)</li>
          <li>homomorphic encryption (using multiplication-induced permutations and/or RSA encryption)</li>
          <li>solving permutation equations via isomorphism to (\Z/%n\Z, +) or ((\Z/%n\Z)*, \cdot)</li>
          <li>the CRT isomorphism</li>
        </ul>
      </li>
    </ul>
  </li>
  <li>other algebraic structures and their properties
    <ul>
      <li>magmas, commutative magmas, monoids, groups, and commutative groups
        <ul>
          <li>examples of data structures or mathematical sets (e.g., \Z/%n\Z) of each</li>
          <li>algebraic properties of each</li>
          <li>listing all distinct elements of a small algebraic structure</li>
        </ul>
      </li>
      <li>data structures as algebraic structures
        <ul>
          <li>nested lists/trees, nested sets, lists, strings, integers</li>
          <li>algebraic properties of each data structure</li>
        </ul>
      </li>
    </ul>
  </li>
</ul>
    ]]></text>-->
  </review>
  <appendix title="Python Reference">
    <text><![CDATA[
The Python programming language will be among the languages we use in this course. This language supports the object-oriented, imperative, and functional programming paradigms, has automatic memory managememt, and natively supports common high-level data structures such as lists and sets. Python is often used as an interpreted language, but it can also be compiled.
    ]]></text>
    <subsection title="Obtaining Python">
      <text><![CDATA[
The latest version of Python 3 can be downloaded at: <b><a href="https://www.python.org/downloads/">https://www.python.org/downloads/</a></b>. In this course, we will require the use if <b>Python 3</b>, which has been installed on all the <a href="http://www.bu.edu/cs/resources/laboratories/undergraduate-lab/">CS Department's undergraduate computing lab</a> machines, as well as on <code>csa2/csa3</code>.
      ]]></text>
    </subsection>
    <subsection title="Assembling a Python module">
      <text><![CDATA[
The simplest Python program is a single file (called a <i>module</i>) with the file extension <code>.py</code>. For example, suppose the following is contained within a file called <code>example.py</code>:
      ]]></text>
      <code class="py"><![CDATA[
# This is a comment in "example.py".
# Below is a Python statement.
print("Hello, world.")
      ]]></code>
      <text><![CDATA[
Assuming Python is installed on your system, to run the above program from the command line you can use the following (you may need to use <code>python3</code>, <code>python3.2</code>, <code>python3.3</code>, etc. depending on the Python installation you're using). Note that in the examples below <code>%&gt;</code> represents a terminal prompt, which may look different on your system.
      ]]></text>
      <code class="py"><![CDATA[
%> python example.py
Hello, world.
      ]]></code>
      <text><![CDATA[
If you run Python without an argument on the command line, you will enter Python's interactive prompt. You can then evaluate expressions and execute individual statements using this prompt; you can also load and execute a Python module file:
      ]]></text>
      <code class="py"><![CDATA[
%> python
Python 3.2 ...
Type "help", "copyright", "credits" or "license" for more information.
>>> exec(open("example.py").read()) # Load "example.py" module.
Hello, world.
>>> x = "Hello." # Execute an assignment statement.
>>> print(x)     # Execute a "print" statement.
Hello.
>>> x            # Evaluate a string expression.
'Hello.'
>>> 1 + 2        # Evaluate a numerical expression.
3
      ]]></code>
    </subsection>
    <subsection title="Common data structures (i.e., Python expressions)">
      <text><![CDATA[
Python provides native support for several data structures that we will use throughout this course: integers, strings, lists, tuples, sets, and dictionaries (also known as finite maps). In this subsection, we present how instances of these data structures are represented in Python, as well as the most common operations and functions that can be applied to these data structure instances.
      ]]></text>
      <unorderedlist>
        <item>
          <text><![CDATA[<b>Booleans</b> consist of two constants: <code>True</code> and <code>False</code>.]]></text>
          <unorderedlist>
            <item><![CDATA[The usual logical operations are available using the operators <code>and</code>, <code>or</code>, and <code>not</code>.]]></item>
          </unorderedlist>
          <code class="py"><![CDATA[
>>> True                                      # A boolean constant.
True
>>> False                                     # A boolean constant.
False
>>> True and False or True and (not False)    # A boolean expression.
True
          ]]></code>
        </item>
        <item>
          <text><![CDATA[<b>Integers</b> are written as in most other programming languages (i.e., as a sequence of digits).]]></text>
          <unorderedlist>
            <item><![CDATA[The usual arithmetic operations are available using the operators <code>+</code>, <code>*</code>, <code>-</code>, and <code>/</code>. The infix operator <code>//</code> represents integer division, and the infix operators <code>**</code> represents exponentiation. Negative integers are prefixed with the negation operator <code>-</code>.]]></item>
            <item><![CDATA[The usual relational operators <code>==</code>, <code>!=</code>, <code>&lt;</code>, <code>&gt;</code>, <code>&lt;=</code>, <code>&gt;=</code> are available.]]></item>
            <item><![CDATA[The <code>int()</code> function can convert a string that looks like an integer into an integer.]]></item>
          </unorderedlist>
          <code class="py"><![CDATA[
>>> 123                                       # An integer constant.
True
>>> 1 * (2 + 3) // 4 - 5                      # An integer expression.
-4
>>> 4 * 5 >= 19                               # A boolean expression involving integers.
True
>>> int("123")                                # A string being converted into an integer
123
          ]]></code>
        </item>
        <item>
          <text><![CDATA[<b>Strings</b> are delimited by either <code>'</code> or <code>"</code> characters. Strings can be treated as lists of single-character strings. Another way to look at this is that there is no distinction between a character and a string: all characters are just strings of length 1. Multiline strings can be delimited using <code>"""</code> or <code>'''</code> (i.e., three quotation mark characters at the beginning and end of the string literal).]]></text>
          <unorderedlist>
            <item><![CDATA[The empty string is denoted using <code>''</code> or <code>""</code>.]]></item>
            <item><![CDATA[Two strings can be concatenated using <code>+</code>.]]></item>
            <item><![CDATA[The function <code>len()</code> returns the length of a string.]]></item>
            <item><![CDATA[Individual characters in a string can be accessed using the bracketed index notation (e.g., <code>s[i]</code>). These characters are also strings themselves.]]></item>
          </unorderedlist>
          <code class="py"><![CDATA[
>>> 'Example.'                                # A string.
'Example.'
>>> "Example."                                # Alternate notation for a string.
'Example.'
>>> len("ABCD")                               # String length.
4
>>> "ABCD" + "EFG"                            # String concatenation.
'ABCDEFG'
>>> "ABCD"[2]                                 # Third character in the string.
'C'
          ]]></code>
        </item>
        <item>
          <text><![CDATA[<b>Lists</b> are similar to arrays: they are ordered sequences of objects and/or values. The entries of a list can be of a mixture of different types, and lists containing one or more objects are delimited using <code>[</code> and <code>]</code>, with the individual list entries separated by commas. Lists cannot be members of sets.]]></text>
          <unorderedlist>
            <item><![CDATA[The empty list is denoted using <code>[]</code>.]]></item>
            <item><![CDATA[Two lists can be concatenated using <code>+</code>.]]></item>
            <item><![CDATA[The function <code>len()</code> returns the length of a list.]]></item>
            <item><![CDATA[Individual entries in a list can be accessed using the bracketed index notation (e.g., <code>a[i]</code>).]]></item>
            <item><![CDATA[To check if a value is in a list, use the <code>in</code> relational operator.]]></item>
          </unorderedlist>
          <code class="py"><![CDATA[
>>> [1,2,"A","B"]                             # A list.
[1, 2, 'A', 'B']
>>> [1, 2] + ['A','B']                        # Concatenating lists.
[1, 2, 'A', 'B']
>>> len([1,2,"A","B"] )                       # List length.
4
>>> [1,2,"A","B"][0]                          # First entry in the list.
1
>>> 1 in [1, 2]                               # List containment check.
True
          ]]></code>
        </item>
        <item>
          <text><![CDATA[<b>Tuples</b> are similar to lists (they are ordered, and can contain objects of different types), except they are delimited by parentheses <code>(</code> and <code>)</code>, with entries separated by commas. The main distinction between lists and tuples is that tuples are hashable (i.e., they can be members of sets).]]></text>
          <unorderedlist>
            <item><![CDATA[The empty tuple is denoted using <code>()</code>.]]></item>
            <item><![CDATA[A tuple containing a single object <code>x</code> is denoted using <code>(x, )</code>.]]></item>
            <item><![CDATA[Two tuples can be concatenated using <code>+</code>.]]></item>
            <item><![CDATA[A tuple can be turned into a list using the <code>list()</code> function.]]></item>
            <item><![CDATA[A list can be turned into a tuple using the <code>tuple()</code> function.]]></item>
            <item><![CDATA[The function <code>len()</code> returns the length of a tuple.]]></item>
            <item><![CDATA[Individual entries in a tuple can be accessed using the bracketed index notation (e.g., <code>t[i]</code>).]]></item>
            <item><![CDATA[To check if a value is in a tuple, use the <code>in</code> relational operator.]]></item>
          </unorderedlist>
          <code class="py"><![CDATA[
>>> (1,2,"A","B")                             # A tuple.
(1, 2, 'A', 'B')
>>> (1,)                                      # Another tuple.
(1,)
>>> (1, 2) + ('A','B')                        # Concatenating tuples.
(1, 2, 'A', 'B')
>>> list((1, 2, 'A','B'))                     # A tuple being converted into a list.
[1, 2, 'A', 'B']
>>> tuple([1, 2, 'A','B'])                    # A list being converted into a tuple.
(1, 2, 'A', 'B')
>>> len((1,2,"A","B"))                        # Tuple length.
4
>>> (1,2,"A","B")[0]                          # First entry in the tuple.
1
>>> 1 in (1, 2)                               # Tuple containment check.
True
          ]]></code>
        </item>
        <item>
          <text><![CDATA[<b>Sets</b> are unordered sequences that cannot contain duplicates. They are a close approximation of mathematical sets. Sets cannot be members of sets.]]></text>
          <unorderedlist>
            <item><![CDATA[The empty set is denoted using <code>set()</code>.]]></item>
            <item><![CDATA[The methods <code>.union()</code> and <code>.intersect</code> correspond to the standard set operations.]]></item>
            <item><![CDATA[A list or tuple can be turned into a set using the <code>set()</code> function.]]></item>
            <item><![CDATA[A set can be turned into a list or tuple using the <code>list()</code> or <code>list()</code> function, respectively.]]></item>
            <item><![CDATA[The function <code>len()</code> returns the size of a set.]]></item>
            <item><![CDATA[To access individual entries in a set, it is necessary to turn the set into a list or tuple.]]></item>
            <item><![CDATA[To check if a value is in a set, use the <code>in</code> relational operator.]]></item>
          </unorderedlist>
          <code class="py"><![CDATA[
>>> {1,2,"A","B"}                             # A set.
{1, 2, 'A', 'B'}
>>> ({1,2}.union({3,4})).intersection({4,5})  # Set operations.
{4}
>>> set([1, 2]).union(set(('A','B')))         # Converting a list and a tuple to sets.
{'A', 1, 2, 'B'}
>>> len({1,2,"A","B"})                        # Set size.
4
>>> 1 in {1,2,"A","B"}                        # Tuple containment check.
True
          ]]></code>
        </item>
        <item>
          <text><![CDATA[<b>Frozen sets</b> are like sets, except they can be members of other sets. A set can be turned into a frozen set using the <code>frozenset()</code> function.]]></text>
          <code class="py"><![CDATA[
>>> frozenset({1,2,3})                        # A frozen set.
frozenset({1, 2, 3})
>>> {frozenset({1,2}), frozenset({3,4})}      # Set of frozen sets.
{frozenset({3, 4}), frozenset({1, 2})}
          ]]></code>
          <text hooks="math"><![CDATA[
In Python, values that are members of a <code>set</code> data structure must be <i>hashable</i> so that it is easy to deduplicate elements in an unordered set (e.g., <code>{1,1,2,2} == {1,2}</code> should be <code>True</code>, and this would take %O(%n^2) steps to compute in the worst case because sets are not ordered). However, values of type <code>set</code> are not hashable because they can change (e.g., it is possible to insert an element into a set and also to remove an element from a set), which means their hashes could change, as well. Values of type <code>frozenset</code> <i>cannot</i> be changed; once their hash value is computed at the time of creation, it never changes. Thus, it is okay to include values of type <code>frozenset</code> inside instances of <code>set</code> without worrying about incurring a quadratic running time when deduplicating (or, e.g., computing a set union).
          ]]></text>
        </item>
        <item>
          <text><![CDATA[<b>Dictionaries</b> are unordered collections of associations between some set of keys and some set of values. Dictionaries are also known as finite maps.]]></text>
          <unorderedlist>
            <item><![CDATA[The empty dictionary is denoted using <code>{}</code>.]]></item>
            <item><![CDATA[The list of keys that the dictionary associates with values can be obtained using <code>list(d.keys())</code>.]]></item>
            <item><![CDATA[The list of values that the dictionary contains can be obtained using <code>list(d.values())</code>.]]></item>
            <item><![CDATA[The function <code>len()</code> returns the number of entries in the dictionary.]]></item>
            <item><![CDATA[Individual entries in a dictionary can be accessed using the bracketed index notation (e.g., <code>d[key]</code>).]]></item>
          </unorderedlist>
          <code class="py"><![CDATA[
>>> {"A":1, "B":2}                            # A dictionary.
{'A': 1, 'B': 2}
>>> list({"A":1, "B":2}.keys())               # Dictionary keys.
['A', 'B']
>>> list({"A":1, "B":2}.values())             # Dictionary values.
[1, 2]
>>> len({"A":1, "B":2})                       # Dictionary size.
2
>>> {"A":1, "B":2}["A"]                       # Obtain a dictionary value using a key.
1
          ]]></code>
        </item>
      </unorderedlist>
    </subsection>
    <subsection title="Function, procedure, and method invocations">
      <text><![CDATA[
Python provides a variety of ways to supply parameter arguments when invoking functions, procedures, and methods.
      ]]></text>
      <unorderedlist>
        <item>
          <text><![CDATA[
 <b>Function calls and method/procedure invocations</b> consist of the function, procedure, or method name followed by a parenthesized, comma-delimited list of arguments. For example, suppose a function or procedure <code>example()</code> is defined as follows:
          ]]></text>
          <code class="py"><![CDATA[
def example(x, y, z):
  print("Invoked.")
  return x + y + z
          ]]></code>
          <text><![CDATA[
    To invoke the above definition, we can use one of the following techniques.
          ]]></text>
          <unorderedlist>
            <item>
              <text><![CDATA[
<b>Passing arguments directly</b> involves listing the comma-delimited arguments directly between parentheses.
              ]]></text>
              <code class="py"><![CDATA[
>>> example(1,2,3)
Invoked.
6
              ]]></code>
            </item>
            <item>
              <text><![CDATA[
<b>The argument unpacking operator</b> (also known as the <code>*</code>-operator, the <b>scatter</b> operator, or the <b>splat</b> operator) involves providing a list to the function, preceded by the <code>*</code> symbol; the arguments will be drawn from the elements in the list.
              ]]></text>
              <code class="py"><![CDATA[
>>> args = [1,2,3]
>>> example(*args)
Invoked.
6
              ]]></code>
            </item>
           <item>
              <text><![CDATA[
<b>The keyword argument unpacking operator</b> (also known as the <code>**</code>-operator) involves providing a dictionary to the function, preceded by the <code>**</code> symbol; each named paramter in the function definition will be looked up in the dictionary, and the value associated with that dictionary key will be used as the argument passed to that parameter.
              ]]></text>
              <code class="py"><![CDATA[
>>> args = {'z':3, 'x':1, 'y':2}
>>> example(**args)
Invoked.
6
              ]]></code>
            </item>
          </unorderedlist>
        </item>
        <item>
          <text><![CDATA[
<b>Default parameter values</b> can be specified in any definition. Suppose the following definition is provided.
          ]]></text>
          <code class="py"><![CDATA[
def example(x = 1, y = 2, z = 3):
  return x + y + z
          ]]></code>
          <text><![CDATA[
The behavior is then as follows: if an argument corresponding to a parameter is not supplied, the default value found in the definition is used. If an argument is supplied, the supplied argument value is used.
          ]]></text>
          <code class="py"><![CDATA[
>>> example(0, 0)
3
>>> example(0)
5
>>> example()
6
          ]]></code>
        </item>
      </unorderedlist>
    </subsection>
    <subsection title="Comprehensions">
      <text><![CDATA[
Python provides concise notations for defining data structures and performing logical computations. In particular, it support a comprehension notation that can be used to build lists, tuples, sets, and dictionaries.
      ]]></text>
      <unorderedlist>
        <item>
          <text><![CDATA[<b>List comprehensions</b> make it possible to construct a list by iterating over one or more other data structure instances (such as a list, tuple, set, or dictionary) and performing some operation on each element or combination of elements. The resulting list will contain the result of evaluating the body for every combination.]]></text>
          <code class="py"><![CDATA[
>>> [ x for x in [1,2,3] ]
[1, 2, 3]
>>> [ 2 * x for x in {1,2,3} ]
[2, 4, 6]
>>> [ x + y for x in {1,2,3} for y in (1,2,3) ]
[2, 3, 4, 3, 4, 5, 4, 5, 6]
          ]]></code>
          <text><![CDATA[It is also possible to add conditions anywhere after the first <code>for</code> clause. This will filter which combinations are actually used to add a value to the resulting list.]]></text>
          <code class="py"><![CDATA[
>>> [ x for x in {1,2,3} if x < 3 ]
[1, 2]
>>> [ x + y for x in {1,2,3} for y in (1,2,3) if x > 2 and y > 1 ]
[5, 6]
          ]]></code>
        </item>
        <item>
          <text><![CDATA[<b>Set comprehensions</b> make it possible to construct a set by iterating over one or more other data structure instances (such as a list, tuple, set, or dictionary) and performing some operation on each element or combination of elements. The resulting list will contain the result of evaluating the body for every combination. Notice that the result will contain no duplicates because the result is a set.]]></text>
          <code class="py"><![CDATA[
>>> { x for x in [1,2,3,1,2,3] }
{1, 2, 3}
          ]]></code>
        </item>
        <item>
          <text><![CDATA[<b>Dictionary comprehensions</b> make it possible to construct a dictionary by iterating over one or more other data structure instances (such as a list, tuple, set, or dictionary) and performing some operation on each element or combination of elements. The resulting dictionary will contain the result of evaluating the body for every combination.]]></text>
          <code class="py"><![CDATA[
>>> { key : 2 for key in ["A","B","C"] }
{'A': 2, 'C': 2, 'B': 2}
          ]]></code>
        </item>
      </unorderedlist>
    </subsection>
    <subsection title="Other useful built-in functions">
      <text><![CDATA[
The built-in function <code>type()</code> can be used to determine the type of a value. Below, we provide examples of how to check whether a given expression has one of the common Python types:
      ]]></text>
      <code class="py"><![CDATA[
>>> type(True) == bool
True
>>> type(123) == int
True
>>> type("ABC") == str
True
>>> type([1,2,3]) == list
True
>>> type(("A",1,{1,2})) == tuple
True
>>> type({1,2,3}) == set
True
>>> type({"A":1, "B":2}) == dict
True
      ]]></code>
    </subsection>
    <subsection title="Common Python definition and control constructs (i.e., Python statements)">
      <text><![CDATA[
A Python program is a sequence of Python statements. Each statement is either a function definition, a variable assignment, a conditional statement (i.e., <code>if</code>, <code>else</code>, and/or <code>elif</code>), an iteration construct (i.e., a <code>for</code> or <code>while</code> loop), a <code>return</code> statement, or a <code>break</code> or <code>continue</code> statement.
      ]]></text>
      <unorderedlist>
        <item>
          <text><![CDATA[<b>Variable assignments</b> make it possible to assign a value or object to a variable.]]></text>
          <code class="py"><![CDATA[
x = 10
          ]]></code>
          <text><![CDATA[It is also possible to assign a tuple (or any computation that produces a tuple) to another tuple:]]></text>
          <code class="py"><![CDATA[
(x, y) = (1, 2)
          ]]></code>
        </item>
        <item>
          <text><![CDATA[<b>Function and procedure definitions</b> consist of the <code>def</code> keyword, followed by the name of the function or procedure, and then by one or more arguments (delimited by parentheses and separated by commas).]]></text>
          <code class="py"><![CDATA[
def example(a, b, c):
    return a + b + c
          ]]></code>
        </item>
        <item>
          <text><![CDATA[<b>Conditional statements</b> consist of one or more branches, each with its own boolean expression as the condition (with the exception of <code>else</code>). The body of each branch is an indented sequence of statements.]]></text>
          <code class="py"><![CDATA[
def fibonacci(n):
    # Computes the nth Fibonacci number.
    if n <= 0:
        return 0
    elif n <= 2:
        return 1
    else:
        return fibonacci(n-1) + fibonacci(n-2)
          ]]></code>
        </item>
        <item>
          <text><![CDATA[<b>Iteration constructs</b> make it possible to repeat a sequence of statements over and over. The body of an iteration construct is an indented sequence of statements.]]></text>
          <unorderedlist>
            <item>
              <text><![CDATA[The <b>while</b> construct has a boolean expression as its condition (much like <code>if</code>). The body is executed over and over until the expression in the condition evaluates to <code>False</code>, or a <code>break</code> statement is encountered.]]></text>
              <code class="py"><![CDATA[
def example1(n):
    # Takes an integer n and returns the sum of
    # the integers from 1 to n-1.
    i = 0
    sum = 0
    while i < n:
        sum = sum + i
        i = i + 1
    return sum

def example2(n):
    # Takes an integer n and returns the sum of
    # the integers from 1 to n-1.
    i = 0
    sum = 0
    while True:
        sum = sum + i
        i = i + 1
        if i == n:
            break
    return sum
              ]]></code>
            </item>
            <item>
              <text><![CDATA[The <b>for</b> construct makes it possible to repeat a sequence of statements once for every object in a list, tuple, or set, or once for every key in a dictionary.]]></text>
              <code class="py"><![CDATA[
def example3(n):
    # Takes an integer n and returns the sum of
    # the integers from 1 to n-1.
    sum = 0
    for i in range(0,n):
        sum = sum + i
    return sum

def example4(d):
    # Takes a dictionary d that maps keys to
    # integers and returns the sum of the integers.
    sum = 0
    for key in d:
        sum = sum + d[key]
    return sum
              ]]></code>
            </item>
          </unorderedlist>
        </item>
      </unorderedlist>
    </subsection>
  </appendix>
</sheaf>