Chinese Remainder Theorem (SummerNT) Tuesday, Jul 9 2013 

This post picks up from the previous post on Summer@Brown number theory from 2013.

Now that we’d established ideas about solving the modular equation ax \equiv c \mod m, solving the linear diophantine equation ax + by = c, and about general modular arithmetic, we began to explore systems of modular equations. That is, we began to look at equations like

Suppose x satisfies the following three modular equations (rather, the following system of linear congruences):

x \equiv 1 \mod 5

x \equiv 2 \mod 7

x \equiv 3 \mod 9

Can we find out what x is? This is a clear parallel to solving systems of linear equations, as is usually done in algebra I or II in secondary school. A common way to solve systems of linear equations is to solve for a variable and substitute it into the next equation. We can do something similar here.

From the first equation, we know that x = 1 + 5a for some a. Substituting this into the second equation, we get that 1 + 5a \equiv 2 \mod 7, or that 5a \equiv 1 \mod 7. So a will be the modular inverse of 5 \mod 7. A quick calculation (or a slightly less quick Euclidean algorithm in the general case) shows that the inverse is 3. Multiplying both sides by 3 yields a \equiv 3 \mod 7, or rather that a = 3 + 7b for some b. Back substituting, we see that this means that x = 1+5a = 1+5(3+7b), or that x = 16 + 35b.

Now we repeat this work, using the third equation. 16 + 35b \equiv 3 \mod 9, so that 8b \equiv 5 \mod 9. Another quick calculation (or Euclidean algorithm) shows that this means b \equiv 4 \mod 9, or rather b = 4 + 9c for some c. Putting this back into x yields the final answer:

x = 16 + 35(4 + 9c) = 156 + 315c

x \equiv 156 \mod 315

And if you go back and check, you can see that this works. \diamondsuit

There is another, very slick, method as well. This was a clever solution mentioned in class. The idea is to construct a solution directly. The way we’re going to do this is to set up a sum, where each part only contributes to one of the three modular equations. In particular, note that if we take something like 7 \cdot 9 \cdot [7\cdot9]_5^{-1}, where this inverse means the modular inverse with respect to 5, then this vanishes mod 7 and mod 9, but gives 1 \mod 5. Similarly 2\cdot 5 \cdot 9 \cdot [5\cdot9]_7^{-1} vanishes mod 5 and mod 9 but leaves the right remainder mod 2, and 5 \cdot 7 \cdot [5\cdot 7]_9^{-1} vanishes mod 5 and mod 7, but leaves the right remainder mod 9.

Summing them together yields a solution (Do you see why?). The really nice thing about this algorithm to get the solution is that is parallelizes really well, meaning that you can give different computers separate problems, and then combine the things together to get the final answer. This is going to come up again later in this post.

These are two solutions that follow along the idea of the Chinese Remainder Theorem (CRT), which in general says that as long as the moduli are relative prime, then the system

a_1 x \equiv b_1 \mod m_1

a_2 x \equiv b_2 \mod m_2


a_k x \equiv b_k \mod m_k

will always have a unique solution \mod m_1m_2 \ldots m_k. Note, this is two statements: there is a solution (statement 1), and the statement is unique up to modding by the product of this moduli (statement 2). Proof Sketch: Either of the two methods described above to solve that problem can lead to a proof here. But there is one big step that makes such a proof much easier. Once you’ve shown that the CRT is true for a system of two congruences (effectively meaning you can replace them by one congruence), this means that you can use induction. You can reduce the n+1st case to the nth case using your newfound knowledge of how to combine two equations into one. Then the inductive hypothesis carries out the proof.

Note also that it’s pretty easy to go backwards. If I know that x \equiv 12 \mod 30, then I know that x will also be the solution to the system

x \equiv 2 \mod 5

x \equiv 0 \mod 6

In fact, a higher view of the CRT reveals that the great strength is that considering a number mod a set of relatively prime moduli is the exact same (isomorphic to) considering a number mod the product of the moduli.

The remainder of this post will be about why the CRT is cool and useful.

Application 1: Multiplying Large Numbers

Firstly, the easier application. Suppose you have two really large integers a,b (by really large, I mean with tens or hundreds of digits at least – for concreteness, say they each have n digits). When a computer computes their product ab, it has to perform n^2 digit multiplications, which can be a whole lot if n is big. But a computer can calculate mods of numbers in something like \log n time, which is much much much faster. So one way to quickly compute the product of two really large numbers is to use the Chinese Remainder Theorem to represent each of a and b with a set of much smaller congruences. For example (though we’ll be using small numbers), say we want to multiply 12 by 21. We might represent 12 by 12 \equiv 2 \mod 5, 5 \mod 7, 1 \mod 11 and represent 21 by 21 \equiv 1 \mod 5, 0 \mod 7, 10 \mod 11. To find their product, calculate their product in each of the moduli: 2 \cdot 1 \equiv 2 \mod 5, 5 \cdot 0 \equiv 0 \mod 7, 1 \cdot 10 \equiv 10 \mod 11. We know we can get a solution  to the resulting system of congruences using the above algorithm, and the smallest positive solution will be the actual product.

This might not feel faster, but for much larger numbers, it really is. As an aside, here’s one way to make it play nice for parallel processing (which vastly makes things faster). After you’ve computed the congruences of 12 and 21 for the different moduli, send the numbers mod 5 to one computer, the numbers mod 7 to another, and the numbers mod 11 to a third (but also send each computer the list of moduli: 5,7,11). Each computer will calculate the product in their modulus and then use the Euclidean algorithm to calculate the inverse of the product of the other two moduli, and multiply these together.  Afterwards, the computers resend their data to a central computer, which just adds the result and takes it mod 5 \cdot 7 \cdot 11 (to get the smallest positive solution). Since mods are fast and all the multiplication is with smaller integers (no bigger than the largest mod, ever), it all goes faster. And since it’s parallelized, you’re replacing a hard task with a bunch of smaller easier tasks that can all be worked on at the same time. Very powerful stuff!

I have actually never seen someone give the optimal running time that would come from this sort of procedure, though I don’t know why. Perhaps I’ll look into that one day.

Application 2: Secret Sharing in Networks of People

This is really slick. Let’s lay out the situation: I have a secret. I want you, my students, to have access to the secret, but only if  at least six of you decide together that you want access. So I give each of you a message, consisting of a number and a modulus. Using the CRT, I can create a scheme where if any six of you decide you want to open the message, then you can pool your six bits together to get the message. Notice, I mean any six of you, instead of a designated set of six. Further, no five people can recover the message without a sixth in a reasonable amount of time. That’s pretty slick, right?

The basic idea is for me to encode my message as a number P (I use P to mean plain-text). Then I choose a set of moduli, one for each of you, but I choose them in such a way that the product of any 5 of them is smaller than P, but the product of any 6 of them is greater than P (what this means is that I choose a lot of primes or near-primes right around the same size, all right around the fifth root of P). To each of you, I give you the value of P \mod m_i and the modulus m_i, where m_i is your modulus. Since P is much bigger than m_i, it would take you a very long time to just happen across the correct multiple that reveals a message (if you ever managed). Now, once six of you get together and put your pieces together, the CRT guarantees a solution. Since the product of your six moduli will be larger than P, the smallest solution will be P. But if only five of you get together, since the product of your moduli is less than P, you don’t recover P. In this way, we have our secret sharing network.

To get an idea of the security of this protocol, you might imagine if I gave each of you moduli around the size of a quadrillion. Then missing any single person means there are hundreds of trillions of reasonable multiples of your partial plain-text to check before getting to the correct multiple.

A similar idea, but which doesn’t really use the CRT, is to consider the following problem: suppose two millionaires Alice and Bob (two people of cryptological fame) want to see which of them is richer, but without revealing how much wealth they actually have. This might sound impossible, but indeed it is not! There is a way for them to establish which one is richer but with neither knowing how much money the other has. Similar problems exist for larger parties (more than just 2 people), but none is more famous than the original: Yao’s Millionaire Problem.

Alright – I’ll see you all in class.

Notes on the first week (SummerNT) Monday, Jul 1 2013 

We’ve covered a lot of ground this first week! I wanted to provide a written summary, with partial proof, of what we have done so far.

We began by learning about proofs. We talked about direct proofs, inductive proofs, proofs by contradiction, and proofs by using the contrapositive of the statement we want to prove. A proof is a justification and argument based upon certain logical premises (which we call axioms); in contrast to other disciplines, a mathematical proof is completely logical and can be correct or incorrect.

We then established a set of axioms for the integers that would serve as the foundation of our exploration into the (often fantastic yet sometimes frustrating) realm of number theory. In short, the integers are a non-empty set with addition and multiplication [which are both associative, commutative, and have an identity, and which behave as we think they should behave; further, there are additive inverses], a total order [an integer is either bigger than, less than, or equal to any other integer, and it behaves like we think it should under addition and multiplication], and satisfying the deceptively important well ordering principle [every nonempty set of positive integers has a least element].

With this logical framework in place, we really began number theory in earnest. We talked about divisibility [we say that a divides b, written a \mid b, if b = ak for some integer k]. We showed that every number has a prime factorization. To do this, we used the well-ordering principle.

Suppose that not all integers have a prime factorization. Then there must be a smallest integer that does not have a prime factorization: call it n. Then we know that n is either a prime or a composite. If it’s prime, then it has a prime factorization. If it’s composite, then it factors as n = ab with a,b < n. But then we know that each of a, b have prime factorizations since they are less than n. Multiplying them together, we see that n also has a prime factorization after all. \diamondsuit

Our first major result is the following:

There are infinitely many primes

There are many proofs, and we saw 2 of them in class. For posterity, I’ll present three here.

First proof that there are infinitely many primes

Take a finite collection of primes, say p_1, p_2, \ldots, p_k. We will show that there is at least one more prime not mentioned in the collection. To see this, consider the number p_1 p_2 \ldots p_k + 1. We know that this number will factor into primes, but upon division by every prime in our collection, it leaves a remainder of 1. Thus it has at least one prime factor different than every factor in our collection. \diamondsuit

This was a common proof used in class. A pattern also quickly emerges: 2 + 1 = 3, a prime. 2\cdot3 + 1 = 7, a prime. 2 \cdot 3 \cdot 5 + 1 = 31, also a prime. It is always the case that a product of primes plus one is another prime? No, in fact. If you look at 2 \cdot 3 \cdot 5 \cdot 7 \cdot 11 \cdot 13 + 1=30031 = 59\cdot 509, you get a nonprime.

Second proof that there are infinitely many primes

In a similar vein to the first proof, we will show that there is always a prime larger than n for any positive integer n. To see this, consider n! + 1. Upon dividing by any prime less than n, we get a remainder of 1. So all of its prime factors are larger than n, and so there are infinitely many primes. \diamondsuit

I would also like to present one more, which I’ve always liked.

Third proof that there are infinitely many primes

Suppose there are only finitely many primes p_1, \ldots, p_k. Then consider the two numbers n = p_1 \cdot \dots \cdot p_k and n -1. We know that n - 1 has a prime factor, so that it must share a factor P with n since n is the product of all the primes. But then P divides n - (n - 1) = 1, which is nonsense; no prime divides 1. Thus there are infinitely many primes. \diamondsuit

We also looked at modular arithmetic, often called the arithmetic of a clock. When we say that a \equiv b \mod m, we mean to say that m | (b - a), or equivalently that a = b + km for some integer m (can you show these are equivalent?). And we pronounce that statement as ” a is congruent to b mod m.” We played a lot with modular arithmetic: we added, subtracted, and multiplied many times, hopefully enough to build a bit of familiarity with the feel. In most ways, it feels like regular arithmetic. But in some ways, it’s different. Looking at the integers \mod m partitions the integers into a set of equivalence classes, i.e. into sets of integers that are congruent to 0 \mod m, 1 \mod m, \ldots. When we talk about adding or multiplying numbers mod \mod m, we’re really talking about manipulating these equivalence classes. (This isn’t super important to us – just a hint at what’s going on beneath the surface).

We expect that if a \equiv b \mod m, then we would also have ac \equiv bc \mod m for any integer c, and this is true (can you prove this?). But we would also expect that if we had ac \equiv bc \mod m, then we would necessarily have a \equiv b \mod m, i.e. that we can cancel out the same number on each side. And it turns out that’s not the case. For example, 4 \cdot 2 \equiv 4 \cdot 5 \mod 6 (both are 2 \mod 6), but ‘cancelling the fours’ says that 2 \equiv 5 \mod 6 – that’s simply not true. With this example in mind, we went about proving things about modular arithmetic. It’s important to know what one can and can’t do.

One very big and important observation that we noted is that it doesn’t matter what order we operate, as in it doesn’t matter if we multiply an expression out and then ‘mod it’ down, or ‘mod it down’ and then multiply, or if we intermix these operations. Knowing this allows us to simplify expressions like 11^4 \mod 12, since we know 11 \equiv -1 \mod 12, and we know that (-1)^2 \equiv 1 \mod 12, and so 11^4 \equiv (-1)^{2\cdot 2} \equiv 1 \mod 12. If we’d wanted to, we could have multiplied it out and then reduced – the choice is ours!

Amidst our exploration of modular arithmetic, we noticed some patterns. Some numbers  are invertible in the modular sense, while others are not. For example, 5 \cdot 5 \equiv 1 \mod 6, so in that sense, we might think of \frac{1}{5} \equiv 5 \mod 6. More interestingly but in the same vein, \frac{1}{2} \equiv 6 \mod 11 since 2 \cdot 6 \equiv 1 \mod 11. Stated more formally, a number a has a modular inverse a^{-1} \mod m if there is a solution to the modular equation ax \equiv 1 \mod m, in which case that solution is the modular inverse. When does this happen? Are these units special?

Returning to division, we think of the greatest common divisor. I showed you the Euclidean algorithm, and you managed to prove it in class. The Euclidean algorithm produces the greatest common divisor of a and b, and it looks like this (where I assume that b > 1:

b = q_1 a + r_1

a = q_2 r_1 + r_2

r_1 = q_3 r_2 + r_3


r_k = q_{k+2}r_{k+1} + r_{k+2}

r_{k+1} = q_{k+3}r_{k+2} + 0

where in each step, we just did regular old division to guarantee a remainder r_i that was less than the divisor. As the divisors become the remainders, this yields a strictly decreasing remainder at each iteration, so it will terminate (in fact, it’s very fast). Further, using the notation from above, I claimed that the gcd of a and b was the last nonzero remainder, in this case r_{k+2}. How did we prove it?

Proof of Euclidean Algorithm

Suppose that d is a common divisor (such as the greatest common divisor) of a and b. Then d divides the left hand side of b - q_1 a = r_1, and thus must also divide the right hand side. So any divisor of a and b is also a divisor of r_1. This carries down the list, so that the gcd of a and b will divide each remainder term. How do we know that the last remainder is exactly the gcd, and no more? The way we proved it in class relied on the observation that r_{k+2} \mid r_{k+1}. But then r_{k+2} divides the right hand side of r_k = q_{k+2} r_{k+1} + r_{k+2}, and so it also divides the left. This also carries up the chain, so that r_{k+2} divides both a and b. So it is itself a divisor, and thus cannot be larger than the greatest common divisor. \diamondsuit

As an aside, I really liked the way it was proved in class. Great job!

The Euclidean algorithm can be turned backwards with back-substitution (some call this the extended Euclidean algorithm,) to give a solution in x,y to the equation ax + by = \gcd(a,b). This has played a super important role in our class ever since. By the way, though I never said it in class, we proved Bezout’s Identity along the way (which we just called part of the Extended Euclidean Algorithm). This essentially says that the gcd of a and b is the smallest number expressible in the form ax + by. The Euclidean algorithm has shown us that the gcd is expressible in this form. How do we know it’s the smallest? Observe again that if c is a common divisor of a and b, then c divides the left hand side of ax + by = d, and so c \mid d. So d cannot be smaller than the gcd.

This led us to explore and solve linear Diophantine equations of the form ax + by = c for general a,b,c. There will be solutions whenever the \gcd(a,b) \mid c, and in such cases there are infinitely many solutions (Do you remember how to see infinitely many other solutions?).

Linear Diophantine equations are very closely related a linear problems in modular arithmetic of the form ax \equiv c \mod m. In particular, this last modular equation is equivalent to ax + my = c for some y.(Can you show that these are the same?). Using what we’ve learned about linear Diophantine equations, we know that ax \equiv c \mod m has a solution iff \gcd(a,m) \mid c. But now, there are not infinitely many incongruent (i.e. not the same \mod m) solutions. This is called the ‘Linear Congruence Theorem,’ and is interestingly the first major result we’ve learned with no proof on wikipedia.

Theorem: the modular equation ax \equiv b \mod m has a solution iff \gcd(a,m) \mid b, in which case there are exactly \gcd(a,m) incongruent solutions.


We can translate a solution of ax \equiv b \mod m into a solution of ax + my = b, and vice-versa. So we know from the Extended Euclidean algorithm that there are only solutions if \gcd(a,m) \mid b. Now, let’s show that there are \gcd(a,m) solutions. I will do this a bit differently than how we did it in class.

First, let’s do the case when gcd(a,m)=1, and suppose we have a solution (x,y) so that ax + my = b. If there is another solution, then there is some perturbation we can do by shifting x by a number x' and y by a number y' that yields another solution looking like a(x + x') + m(y + y') = b. As we already know that ax + my = b, we can remove that from the equation. Then we get simply ax' = -my'. Since \gcd(m,a) = 1, we know (see below the proof) that m divides x'. But then the new solution x + x' \equiv x \mod m, so all solutions fall in the same congruence class – the same as x.

Now suppose that gcd(a,m) = d and that there is a solution. Since there is a solution, each of a,m, and b are divisible by d, and we can write them as a = da', b = db', m = dm'. Then the modular equation ax \equiv b \mod m is the same as da' x \equiv d b' \mod d m', which is the same as d m' \mid (d b' - d a'x). Note that in this last case, we can remove the d from both sides, so that m' \mid b' - a'x, or that a'x \equiv b \mod m'. From the first case, we know this has exactly one solution mod m', but we are interested in solutions mod m. Just as knowing that x \equiv 2 \mod 4 means that x might be 2, 6, 10 \mod 12 since 4 goes into 12 three times, m' goes into m d times, and this gives us our d incongruent solutions. \diamondsuit.

I mentioned that we used the fact that we’ve proven 3 times in class now in different forms: if \gcd(a,b) = 1 and a \mid bc, then we can conclude that a \mid c. Can you prove this? Can you prove this without using unique factorization? We actually used this fact to prove unique factorization (really we use the statement about primes: if p is a prime and p \mid ab, then we must have that p \mid a or p \mid b, or perhaps both). Do you remember how we proved that? We used the well-ordered principle to say that if there were a positive integer that couldn’t be uniquely factored, then there is a smaller one. But choosing two of its factorizations, and finding a prime on one side – we concluded that this prime divided the other side. Dividing both sides by this prime yielded a smaller (and therefore unique by assumption) factorization. This was the gist of the argument.

The last major bit of the week was the Chinese Remainder Theorem, which is awesome enough (and which I have enough to say about) that it will get its own post – which I’m working on now.

I’ll see you all in class tomorrow.