\documentclass[%
version=last,%
a5paper,%
10pt,%
headings=small,%
bibliography=totoc,%
index=totoc,%
twoside,%
reqno,%
cleardoublepage=empty,%
open=any,%
draft=false,%
%draft=true,%
BCOR=2mm,%
DIV=18,%
%DIV=12,%
headinclude=true,%
pagesize]%
{scrbook}

\makeindex
\usepackage{makeidx}
\renewcommand{\captionformat}{ }

\usepackage{scrpage2}
\pagestyle{scrheadings}
\ohead{\pagemark}
\ihead{\headmark}
\ofoot{}

\usepackage{cclicenses}

\usepackage{amssymb,amsmath,amsthm}
\usepackage{url}
\usepackage{verbatim}  % allows a comment environment:
\usepackage[all]{xy}
\usepackage{pstricks}
\usepackage{textcomp}  % supposedly useful with \oldstylenums
\usepackage{multicol}
%\usepackage{showlabels}
\usepackage[neverdecrease]{paralist}

\usepackage{layout}
\usepackage{hfoldsty} % this didn't work until I added missing
		      % brackets to some of the files.

\usepackage{graphicx,rotating}

\hyphenation{Arith-metic}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\renewcommand{\leq}{\leqslant}
\renewcommand{\geq}{\geqslant}
\renewcommand{\setminus}{\smallsetminus}
%\renewcommand{\phi}{\varphi}

\newcommand{\Exists}[1]{\exists{#1}\;}
\renewcommand{\emptyset}{\varnothing}
\renewcommand{\epsilon}{\varepsilon}

%%%%%%%%%%%%%%%%%%%%%%%

\newcommand{\lto}{\Rightarrow}
\renewcommand{\land}{\mathrel{\&}}
%\newcommand{\size}[1]{\left|#1\right|}
\newcommand{\size}[1]{\lvert#1\rvert}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\renewcommand{\theenumi}{\alph{enumi}}
\renewcommand{\labelenumi}{\textnormal{\theenumi)}}

\renewcommand{\theenumii}{\roman{enumii}}
\renewcommand{\labelenumii}{\textnormal{(\theenumii)}}

%%%%%%%%%%%%%%%

\newcommand{\divides}{\mathrel{|}}
\newcommand{\ndivides}{\mathrel{\nmid}}

\newcommand{\ord}[2]{\operatorname{ord}_{#1}(#2)}

\newcommand{\ls}[2]{\Bigl(\displaystyle\frac{#1}{#2}\Bigr)}

% set-theoretic relations:

\newcommand{\included}{\subseteq}      % [the name suggests the meaning here]
\newcommand{\nincluded}{\not\subseteq} % not included
\newcommand{\pincluded}{\subset}       % proper inclusion    
\newcommand{\includes}{\supseteq}

\newcommand{\stnd}[1]{\mathbb{#1}}
\newcommand{\N}{\stnd{N}}         % natural numbers
\newcommand{\Z}{\stnd{Z}}         % integers
\newcommand{\Q}{\stnd{Q}}         % rationals
%\newcommand{\Pri}{\stnd{P}}         % primes
\newcommand{\R}{\stnd{R}}         % reals
\newcommand{\C}{\stnd{C}}         % complex numbers
\newcommand{\mi}{\mathrm i}
\newcommand{\me}{\mathrm e}

\newcommand{\units}[1]{#1{}\!^{\times}}
\newcommand{\Zmod}[1][n]{\Z_{#1}}
\newcommand{\Zmodu}[1][n]{\units{\Zmod[#1]}}

\newcommand{\scr}[1]{\operatorname{s}(#1)}
\newcommand{\pred}[1]{\operatorname{pred}(#1)}
\DeclareMathOperator{\lcm}{lcm}

\DeclareMathOperator{\dee}{d}      % 

\let\oldsqrt\sqrt
\renewcommand{\sqrt}[1]{\oldsqrt{\vphantom1}{#1}}
\newcommand{\rten}{\sqrt{10}}
\newcommand{\dsp}{\,}   % space between blocks of three digits



\newcommand{\hw}[1]{\hfill{}\textnormal{[#1]}}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%  Theorem-like environments  %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%\newtheorem*{theorem*}{Theorem}
\newtheorem*{lemma*}{Lemma}
\newtheorem*{corollary}{Corollary}
\newtheorem{theorem}{Theorem}

\newtheorem{Atheorem}{Theorem}[chapter]  % for appendix A
\newtheorem{axdef}[theorem]{Axiom and definition}
\newtheorem{lemma}{Lemma}[chapter]


\newtheorem{problem}{Problem}[section]
\renewcommand{\theproblem}{\arabic{section}.\arabic{problem}}

\theoremstyle{definition}

\newtheorem{definition}[theorem]{Definition}
\newtheorem{xca}{Exercise}%[section]

%\renewcommand{\thexca}{\arabic{section}.\arabic{xca}}

\newtheorem*{solution}{Solution}

\theoremstyle{remark}

\newtheorem{remarks}[theorem]{Remarks}
\newtheorem{remark}[theorem]{Remark}

\newtheorem*{remark*}{Remark}

%\numberwithin{section}{chapter}
%\numberwithin{xca}{section}
\numberwithin{equation}{chapter}
\renewcommand{\theequation}{\fnsymbol{equation}}


\begin{document}

\title{Elementary Number Theory}
\author{David Pierce}
\date{\today}

\uppertitleback{\center{
This work is licensed under the\\
 Creative Commons Attribution--Noncommercial--Share-Alike
License.\\
 To view a copy of this license, visit\\
  \url{http://creativecommons.org/licenses/by-nc-sa/3.0/}\\
\mbox{}\\
\cc \ccby David Pierce \ccnc \ccsa\\
\mbox{}\\
Mathematics Department\\
Middle East Technical University\\
Ankara 06531 Turkey\\
\url{http://metu.edu.tr/~dpierce/}\\
\url{dpierce@metu.edu.tr}
}
}

\maketitle%[-1]


\addchap{Preface}

This book is for the course Elementary Number Theory (Math 365), given
at METU in 2010/11.  The book is based on my lectures in the same
course, 2007/8.  The lectures were based---and hence this book is
based---mainly on Burton's text, \emph{Elementary Number
  Theory}~\cite{Burton}.  I have made a few additions.  Also, where it
makes sense, I try to display the mathematics in pictures or tables,
as for example in Chapter~\ref{ch:look} and in the account of the
Chinese Remainder Theorem given in \S~\ref{sect:CRT-again}. 

Math 365 has this catalogue description:
\begin{quote}
Divisibility, congruences, Euler, Chinese Remainder and Wilson's
Theorems. Arithmetical functions. Primitive roots. Quadratic
resi\-dues and quadratic reciprocity. Diophantine equations.   
\end{quote}
I ask students in addition to know something of the logical
foundations of number theory.  Appendix~\ref{ch:foundations} contains
an account of these foundations, namely a derivation of basic
arithmetic from the so-called Peano Axioms.   

Appendix~\ref{ch:exercises} contains the exercises made available to
the 2007/8 class; Appendix~\ref{ch:exams}, the examinations given to
that class, along with my solutions.  I have not incorporated the
exercises into the main text.  One reason for this is to make it less
obvious how the exercises should be done.  The position of an exercise
in a text is often a hint as to how the exercise should be done; and
yet there are no such hints on examinations.  Whereas the exercises in
this book were originally found in 11 separate documents, issued
roughly once a week, here the exercises are strung together in one
numbered sequence.  I have not changed the order of the exercises. 

In the 2007/8 class, I defined the set $\N$ of natural numbers as
$\{0,1,2,3,\dots\}$; in the present book, I have decided to define it
as $\{1,2,3,\dots\}$.  I have tried to make the appropriate changes,
except in Appendix~\ref{ch:exams}, but I may have missed something.  I
have not changed the examinations. 

Full names and dates of mathematicians given in the text are taken
from the MacTutor History of Mathematics archive,
\url{http://www-gap.dcs.st-and.ac.uk/~history/index.html}.  However, I have not
tried to trace the origin of all of the mathematics in these notes.

\tableofcontents

\chapter{Proving and seeing}\label{ch:look}

\section{The look of a number}

What can we say about the following sequence of numbers?
\begin{equation*}
  1,3,6,10,15,21,28,\dots
\end{equation*}
The terms increase by $2$, $3$, $4$, and so on.  The numbers have
an appearance, a \textbf{look:}\index{look}
\begin{center}
\psset{xunit=1cm,yunit=1.73cm}
  \begin{pspicture}(0,-0.6)(5.4,0)
%\psgrid    
\psdots(0,0)
(1,-0.2)(1.4,-0.2)(1.2,0)
(2.4,-0.4)(2.8,-0.4)(3.2,-0.4)(2.6,-0.2)(3,-0.2)(2.8,0)
(4.2,-0.6)(4.6,-0.6)(5,-0.6)(5.4,-0.6)(4.4,-0.4)(4.8,-0.4)(5.2,-0.4)(4.6,-0.2)(5,-0.2)(4.8,0)
  \end{pspicture}
\end{center}
In particular, the numbers are
the 
\textbf{triangular numbers.}%
\index{triangular number}%
\index{number!triangular ---} 
Let us designate them by $t_1$, $t_2$, and so on.
Then they can be given 
\textbf{recursively}\index{recursive definition} by
\begin{align*}
  t_1&=1,& t_{n+1}&=t_n+n+1.
\end{align*}
The triangular numbers can also be given in various 
\textbf{closed forms:}%
\index{closed form} 
\begin{equation}\label{eqn:tn}
  t_n=\sum_{k=1}^nk=\binom{n+1}{2}=\frac{n(n+1)}{2}.
\end{equation}
Indeed, we can prove this by \textbf{induction:}\index{induction}
\begin{compactenum}[1.]
\item
The claim~\eqref{eqn:tn} is true when $n=1$.
\item
If the claim is true when $n=k$, so that $t_k=k(k+1)/2$, then
\begin{align*}
  t_{k+1}=t_k+k+1
  =\frac{k(k+1)}{2}+k+1
  &=\frac{k(k+1)}{2}+\frac{2(k+1)}2\\
&=\frac{(k+2)(k+1)}{2}
=\frac{(k+1)(k+2)}{2},  
\end{align*}
so the claim is true when $n=k+1$.  
\end{compactenum}
By induction then, \eqref{eqn:tn} is true for all $n$. 

So equation~\eqref{eqn:tn} \emph{is} true; but we might ask further:
\emph{why} is~\eqref{eqn:tn} true?  One answer can be seen
 in
a picture.  First rewrite~\eqref{eqn:tn} as
\begin{equation*}
2t_n=n(n+1).
\end{equation*}
Two copies of $t_n$ do indeed fit together to make an $n\times(n+1)$ array of dots:
\begin{center}
  \begin{pspicture}(0,-1.2)(1.6,0)
\psdots(0,0)   (0.4,0)   (0.8,0)  (1.2,0)
       (0,-0.4)(0.4,-0.4)(0.8,-0.4)
       (0,-0.8)(0.4,-0.8)
       (0,-1.2)
\psdots[dotstyle=o]           (1.6,-0)
                    (1.2,-0.4)(1.6,-0.4)
          (0.8,-0.8)(1.2,-0.8)(1.6,-0.8)
(0.4,-1.2)(0.8,-1.2)(1.2,-1.2)(1.6,-1.2)
  \end{pspicture}
\end{center}
Similarly, $t_{n+1}+t_n=(n+1)^{2}$, since
\begin{equation*}
  t_{n+1}+t_n=\frac{(n+1)(n+{2})}{2}+\frac{n(n+1)}{2}
=\frac{n+1}{2}(n+{2}+n)=(n+1)^{2}; 
\end{equation*}
but this can be seen in a picture:
\begin{center}
  \begin{pspicture}(0,-1.6)(1.6,0)
    \psdots(0,0)(0.4,0)(0.8,0)(1.2,0)(1.6,0)
(0,-0.4)(0.4,-0.4)(0.8,-0.4)(1.2,-0.4)
(0,-0.8)(0.4,-0.8)(0.8,-0.8)
(0,-1.2)(0.4,-1.2)
(0,-1.6)
    \psdots[dotstyle=o]
(1.6,-0.4)
(1.2,-0.8)(1.6,-0.8)
(0.8,-1.2)(1.2,-1.2)(1.6,-1.2)
(0.4,-1.6)(0.8,-1.6)(1.2,-1.6)(1.6,-1.6)
  \end{pspicture}
\end{center}
What can we say about the following sequence?
\begin{equation*}
  {1,3,5,7,9,11,13,15,17,19,21,23,25,27,29,\dots}
\end{equation*}
It is the sequence of odd numbers.  Also, the first $n$ terms seem to
add up to $n^{2}$, that is,
\begin{equation}\label{eqn:n2}
  \sum_{k=1}^n({2}k-1)=n^{2}.
\end{equation}
We can prove this by induction:  
\begin{compactenum}[1.]
\item
The claim is true when $n=1$.
\item
If the claim is
true when $n=k$, then
\begin{equation*}
\sum_{j=1}^{k+1}({2}j-1)
  =\sum_{j=1}^k({2}j-1)+{2}k+1
  =k^{2}+{2}k+1
  =(k+1)^{2},
  \end{equation*}
so the claim is true when $n=k+1$.  
\end{compactenum}
Therefore~\eqref{eqn:n2} is true for all $n$.  A
picture shows why:
\begin{center}
\psset{unit=4mm}
  \begin{pspicture}(1,1)(5,5)
    \psdots
(1,1)(3,1)(5,1)(3,2)(5,2)(1,3)(2,3)(3,3)(5,3)(5,4)(1,5)(2,5)(3,5)(4,5)(5,5)
\psdots[dotstyle=o](2,1)(4,1)(1,2)(2,2)(4,2)(4,3)(1,4)(2,4)(3,4)(4,4)
  \end{pspicture}
\end{center}

Finally, observe:
\begin{equation*}
  {1},\underbrace{{3,5}}_8,\underbrace{{7,9,11}}_{{27}},
  \underbrace{{13,15,17,19}}_{{64}},\underbrace{{21,23,25,27,29}}_{{125}},\dots 
\end{equation*}
Does the pattern continue?  As an exercise, write the suggested
equation, 
\begin{equation*}
n^{3}=\sum_{\dots}^{\dots}\dots, 
\end{equation*}
and prove it.  (The theorem was apparently
known to Nicomachus of Gerasa \cite[II.20.5, p.~263]{Nicomachus},
almost 2000 years ago.) 

\section{Patterns that fail}

This is from Arnol$'$d's talk `On the teaching of mathematics'
\cite{MR1618209}.
Write the odd numbers as sums of odd numbers of summands:
\begin{gather*}
1=1,\\
\begin{aligned}
3
&=3\\
&=1+1+1,
\end{aligned}\\
\begin{aligned}
5
&=5\\
&={3}+1+1\\
&={2}+{2}+1\\
&=1+1+1+1+1,
\end{aligned}\\
\begin{aligned}
7
&=7\\
&=5+1+1\\
&=4+{2}+1\\
&={3}+{3}+1\\
&={3}+{2}+{2}\\
&={3}+1+1+1+1\\
&={2}+{2}+1+1+1\\
&=1+1+1+1+1+1+1,
\end{aligned}
\end{gather*}
and so on.
Then we
have
\begin{equation*}
  \begin{array}{c|c}
n &\text{\# sums for }n\\\hline
1&1\\
{3}&{2}\\
5&4\\
7&8\\
9&16\\
11&29
  \end{array}
\end{equation*}
Thus the pattern ${2}^{0},{2}^1,{2}^{2},\dots$ breaks down.  Is there a formula
for the sequence of numbers of sums?

\section{Incommensurability}\label{sect:incomm}

\begin{theorem}
  No numbers solve the equation
  \begin{equation*}
    x^{2}={2}y^{2}.
  \end{equation*}
\end{theorem}

\begin{proof}
  Suppose $a^{2}={2}b^{2}$.  Then $a>b$.  Also, $a$ must be even: say
  $a=2c$.  Consequently $4c^2=2b^2$, so $b^2=2c^2$.  Thus we obtain a
  sequence 
  \begin{equation*}
a,b,c,\dots,k,\ell,\dots,
\end{equation*}
where always $k^2=2\ell^2$.  But we have also $a>b>c>\dotsb$, which is
absurd; there is no infinite descending sequence of numbers.
Therefore no $a$ and $b$ exist such that $a^2=2b^2$. 
\end{proof}

The proof here is said to be by the method of 
\textbf{infinite descent.}%
\index{infinite descent}%
\index{proof!--- by infinite descent}
Geometrically, the theorem is that the side
and diagonal of a square are 
\textbf{incommensurable:}%
\index{incommensurable}
there is no line
segment that evenly divides each of them.  We can see this as
follows~\cite[v.~I, p.~19]{MR17:814b}.  In Fig.~\ref{fig:square},
\begin{figure}[ht]
\begin{center}
  \begin{pspicture}(-0.5,-0.5)(5.8,4.5)
    \psline(0,0)(4,0)(4,4)(0,4)(0,0)(4,4)
    \psline(1.172,1.172)(0,2.343)(4,4)
    \psarc[linestyle=dotted](4,4){4}{180}{225}
    \psline(5,1.8)(5.8,1.8)
    \uput[ul](0,4){$A$}
    \uput[ur](4,4){$B$}
    \uput[dr](4,0){$C$}
    \uput[dl](0,0){$D$}
    \uput[dr](1.172,1.172){$E$}
    \uput[l](0,2.343){$F$}
    \uput[u](5.4,1.8){$d$}
  \end{pspicture}
\end{center}
\caption{Incommensurability of diagonal and side}\label{fig:square}
\end{figure}
there is a square, $ABCD$.  On the diagonal $BD$, the distance $BE$ is marked equal to
$AB$.  The perpendicular at $E$ meets $AD$ at $F$.  The straight line $BF$ is drawn.  Then
triangles $ABF$ and $EBF$ are congruent, so $EF=AF$.  Also, triangle
$DEF$ is similar to $DAB$, so $DE=EF$.  Suppose a straight line $d$
measures both 
$AB$ and $BD$.  Then it measures $ED$ and $DF$, since
\begin{align*}
  ED&=BD-AB,&
DF&=AB-ED.
\end{align*}
The same construction can be performed with triangle $DEF$ in place of $DAB$.  Since
${2}ED<AB$, there will eventually be segments that are shorter than $d$, but
are measured by it, which is absurd.  So such $d$ cannot exist.

If we consider $DA$ as a unit, then we can write $DB$ as $\sqrt 2$.  In two ways then, we have shown then the \textbf{irrationality} of $\sqrt2$.  For yet another proof, suppose $\sqrt2$ \emph{is} rational.
Then there are numbers $a_1$ and $a_2$ such that
\begin{equation*}
\frac{a_1}{a_2}=\sqrt 2+1.
\end{equation*}
Consequently
\begin{equation*}
\frac{a_2}{a_1}
=\frac1{\sqrt2+1}
=\frac{\sqrt2-1}{(\sqrt2+1)(\sqrt2-1)}
=\sqrt 2-1=\frac{a_1}{a_2}-2=\frac{a_1-2a_2}{a_2}.
\end{equation*}
Now let $a_3=a_1-2a_2$, and continue recursively by defining
\begin{equation*}
  a_{n+2}=a_n-2a_{n+1}.
\end{equation*}
Then by induction
\begin{equation*}
\frac{a_{n+1}}{a_{n+2}}=\sqrt2+1.
\end{equation*}
But $a_n=2a_{n+1}+a_{n+2}$, so $a_1>a_2>a_3>\dotsb$, which again is absurd.

The same argument, adjusted, gives us a way to \emph{approximate} $\sqrt2$.
Suppose there are $b_1$ and $b_2$ such that
\begin{equation*}
\frac{b_1}{b_2}=\sqrt 2-1.
\end{equation*}
Then
\begin{equation*}
\frac{b_2}{b_1}=\sqrt 2+1=\frac{b_1}{b_2}+2=\frac{b_1+2b_2}{b_2}.
\end{equation*}
If we define
\begin{equation}\label{eqn:bn2}
  b_{n+2}=b_n+2b_{n+1},
\end{equation}
then
\begin{equation*}
\frac{b_{n+1}}{b_{n+2}}=\sqrt 2-1.
\end{equation*}
Now however the sequence $b_1$, $b_2$, \dots, increases, so there is no obvious contradiction.  But the definition~\eqref{eqn:bn2} alone yields
\begin{equation*}
\frac{b_{n+2}}{b_{n+1}}
=2+\frac{b_n}{b_{n+1}}
=2+\cfrac1{\cfrac{b_{n+1}}{b_n}}
=2+\cfrac1{2+\cfrac{b_n}{b_{n-1}}}
=2+\cfrac1{2+\cfrac1{2+\cfrac{b_{n-1}}{b_{n-2}}}}
=\dotsb
\end{equation*}
If we just let $b_1=1$ and $b_2=2$, then by~\eqref{eqn:bn2} we get the sequence 
\begin{equation*}
1,2,5,12,27,66,\dots
\end{equation*}
Then the sequence
\begin{equation*}
\frac21,\frac52,\frac{12}5,\frac{27}{12},\frac{66}{27},\dots
\end{equation*}
of fractions converges to $\sqrt2+1$ (though we haven't proved this).
One writes
\begin{equation}\label{eqn:sqrt2}
\sqrt{2}+{1}={2}+\cfrac{1}{{2}+\cfrac{1}{{2}+\cfrac{1}{{2}+\cfrac{1}{{2}+\cfrac{1}{\ddots}}}}}.
\end{equation}


\chapter{Numbers}

\section{The natural numbers}

The \emph{numbers} heretofore mentioned, namely $1$, $2$, $3$, and so on, are more precisely the \textbf{natural numbers.}  They compose the set $\N$.
Everything about $\N$ follows from the following five conditions.
\begin{compactenum}[1.]
  \item
There is a \textbf{first} natural number,%
\index{first natural number}%
\index{number!first natural ---, one}
\textbf{one} or $1$.
\item
Each $n$ in $\N$ has a 
\textbf{successor,}%
\index{successor}%
\index{number!successor}
 $\scr n$.
\item
The number $1$ is not a successor.
\item
Distinct numbers have distinct successors: if $n\neq m$, then $\scr
n\neq\scr m$.
\item
\textbf{proof by induction}%
\index{induction}%
\index{proof!--- by induction}
is possible: a subset $A$ of $\N$ is the whole set, provided 
\begin{compactenum}[a)]
  \item
$1\in A$, and
\item
whenever $n\in A$, then also $\scr n\in A$.
\end{compactenum}
\end{compactenum}

\begin{theorem}[Recursion]%
\index{Recursion Theorem}%
\index{theorem!Recursion Th---}
      Suppose $A$ is a set with an element $b$, and $f\colon A\to A$.
    Then there is a \emph{unique} function $g$ from $\N$ to $A$ such
    that
    \begin{compactenum}
      \item
$g(1)=b$, and
\item
$g(\scr n)=f(g(n))$ for all $n$ in $\N$.
    \end{compactenum}
  \end{theorem}

For the proof, see Appendix~\ref{ch:foundations}.  We now define addition by defining $x\mapsto m+x$ recursively:
\begin{align*}
  m+1&=\scr m,& m+\scr n&=\scr{m+n}.
\end{align*}  
Now the function $g$ in the Recursion Theorem is such that
\begin{align*}
g(1)&=b,&g(n+1)&=f(g(n)).  
\end{align*}
We can then define multiplication by
\begin{align*}
  m\cdot 1&=m,& m\cdot(n+1)&=m\cdot n+m.
\end{align*}
Also the ordering of $\N$ is defined recursively by the requirements
\begin{align*}
x&\not<1,&x<m+1&\iff x\leq m.
%1&\leq n;&m+1<n&\iff m\leq n.
\end{align*}
Really we have defined the function $m\mapsto\{x\colon x<m\}$
recursively.  Here $\{x\colon x<m\}$ is the set of
\textbf{predecessors}%
\index{predecessor}%
\index{number!predecessor}
of $m$. 
Then the usual properties can be proved, usually by induction
(exercise; see Appendix~\ref{ch:foundations}).

Some books suggest wrongly that everything about $\N$ is a consequence
of:

\begin{theorem}[Well Ordering Principle]%
\index{theorem!Well Ordering Principle}%
\index{Well Ordering Principle}
     Every non-empty subset of $\N$ has a least element.
\end{theorem}

Here the 
\textbf{least}%
\index{least element} 
element of a set $A$ of natural numbers is
some $k$ such that
\begin{compactenum}
  \item
$k\in A$;
\item
if $m\in A$, then $k\leq m$.
\end{compactenum}

Let's try to prove the WOP (the Well Ordering Principle).  Suppose
$A\included\N$, and $A$ has no least element.  We want to show that
$A$ is empty, that is, $\N\setminus A=\N$.  Try induction.  For the
base step, we cannot have $1\in A$, since then $1$ would be the least
element of $A$.  So $1\notin A$. 

For the inductive step, suppose $n\notin A$.  This is not enough to
establish $n+1\notin A$, since maybe $n-1\in A$, so $n+1$ can be in
$A$ without being least.
We need to use the following.

  \begin{theorem}[Strong Induction]
    Suppose $A\included\N$, and for all $n$ in $\N$,
if all predecessors of $n$ belong to $A$, then $n\in A$.
Then $A=\N$.
  \end{theorem}

For the proof, see Appendix~\ref{ch:foundations}.  Now we can prove
well-ordering:  If $A$ has no least element, and no member of the set
$\{x\in\N\colon x<n\}$ belongs to $A$, then $A$ must not belong
either.  Therefore, by strong induction, $A=\emptyset$.

\section{The integers}%\asterism{}

The \textbf{integers} compose the set
\begin{equation*}
  \N\cup\{0\}\cup\{-x\colon x\in\N\},
\end{equation*}
denoted by $\Z$.  Then we extend addition and multiplication to $\Z$, 
and we define additive inversion on $\Z$, so that
\begin{gather*}
\begin{aligned}
  a+(b+c)&=(a+b)+c\qquad &\qquad a\cdot(b\cdot c)&=(a\cdot b)\cdot c,\\
b+a&=a+b, & b\cdot a&=a\cdot b,\\
a+{0}&=a, & a\cdot 1&=a,\\
a+(-a)&={0}, &&
\end{aligned}\\
a\cdot (b+c)=a\cdot b+a\cdot c.
\end{gather*}
Then $\Z$ is a \textbf{commutative ring.}
We also extend the ordering to $<$ so that
\begin{gather*}
a<b\lto a+c<b+c,\\
{0}<a\land {0}<b\lto {0}<a\cdot b.
\end{gather*}
Then $\Z$ is an \textbf{ordered} commutative ring.  An integer $a$ is \textbf{positive} if $a>0$; \textbf{negative,} if $a<0$.

\section{Other numbers}

Given integers $a$ and $b$, where $b\neq0$, we can form the \textbf{rational number}
\begin{equation*}
\frac ab
\end{equation*}
or $a/b$.  The properties of rational numbers follow from the rule
\begin{equation*}
\frac ab=\frac xy\iff ay=bx.
\end{equation*}
The set of rational numbers is denoted by $\Q$ and is an \textbf{ordered field,} of which $\Z$ is an ordered sub-ring.  Then $\Q$ has a \textbf{completion,} the set $\R$ of \textbf{real numbers;} this is a complete ordered field.  The (unordered) field $\C$ of \textbf{complex numbers} consists of the formal sums $x+y\mi$, where $x$ and $y$ are in $\R$ and $\mi^2=-1$.

Every equation $a+bx=0$, where $a$ and $b$ are integers, and $b\neq0$, has a solution in $\Q$, namely $-a/b$.  In particular, there is a solution when $b=1$; but then the solution is just $-a$, an integer.  More generally, if $a_0$, \dots, $a_{n-1}$ are integers, a solution in $\C$ to an equation
\begin{equation*}
a_0+a_1x+\dotsb+a_{n-1}x^{n-1}+x^n=0
\end{equation*}
is called an \textbf{algebraic integer.}  The algebraic integers are the subject of \textbf{algebraic number theory.}  The only algebraic integers in $\Q$ are the usual integers---which in this context may be called \textbf{rational integers.}

The study of $\R$ and $\C$ is \textbf{analysis.}  That part of number theory that makes use of analysis is \textbf{analytic number theory.}
One may observe for example that the function given by
\begin{equation*}
  \Gamma(x)=\int_{0}^{\infty}e^{-t}t^{x-1}\dee x
\end{equation*}
satisfies $\Gamma(n+1)=n\Gamma(n)$, and $\Gamma(1)=1$, so that
$G(n+1)=n!$.

Our subject is \textbf{elementary number theory.}  This means not that the subject is easy, but that our integers are just the rational integers, and we shall not use analysis.

\chapter{Divisibility}\label{ch:divisibility}

\section{Division and congruence}

Henceforth minuscule letters will usually denote integers.
If $a$ is such, let the set $\{ax\colon x\in\Z\}$ be denoted by $\Z a$ or
$a\Z$ or
\begin{equation*}
  (a).
\end{equation*}
Then $b\in(a)$ if and only if $a$ \textbf{divides}%
\index{divides, divisor}
$b$, or $a$ is a
\textbf{divisor} of $b$; this situation is
denoted by
\begin{equation*}
  a\divides b.
\end{equation*}
If $c-b\in(a)$, then we may also write
\begin{equation*}
  b\equiv c\pmod a,
\end{equation*}
saying $b$ and $c$ are 
\textbf{congruent}%
\index{congruent numbers}%
\index{number!congruent ---s}
 with respect to the
\textbf{modulus}%
\index{modulus, \emph{modulo}}
$a$, or $b$ and $c$ are
congruent 
\textbf{\emph{modulo}} $a$; also $c$ is a
\textbf{residue}%
\index{residue}
of $b$ \emph{modulo} $a$.  

(This terminology and notation
appear to be due to Johann Carl Friedrich Gauss,\index{Gauss}
1777--1855; they and 
many results in this book are set forth in Gauss's \emph{Disquisitiones
  Arithmeticae} \cite{Gauss}.)
If the modulus $a$ is
understood, we might write simply
\begin{equation*}
  b\equiv c.
\end{equation*}
Congruence with respect to a given modulus is an equivalence-relation.
The congru\-ence-class of $b$ \emph{modulo} $a$ is 
  \begin{equation*}
    \{x\in\Z\colon b-x\in(a)\}.
  \end{equation*}
If $a={0}$, then congruence \emph{modulo} $a$ is equality.  Otherwise,
there are $\size a$ congru\-ence-classes \emph{modulo} $a$, namely the
classes of ${0}$, $1$, \dots, $\size a-1$.  This is by the Division Theorem below.

\begin{lemma*}
If $0<a<b$, then $b< na$ for some $n$ in $\N$.
\end{lemma*}

\begin{proof}
Suppose if possible $na\leq b$ for all $n$ in $\N$.  By the Well Ordering Principle, we may assume $b$ is the \emph{least} integer with this property.  Then $na=b$ for some $n$ in $\N$ (by minimality of $b$), so $(n+1)a>na=b$, which contradicts the original assumption.
\end{proof}

The property of $\N$ given by the lemma is that it is
\textbf{archimedean.}
\index{archimedean property of $\N$} 

\begin{theorem}[Division]
If $a$ and $b$ are integers, and
  $a\neq{0}$, then the system
  \begin{align*}
    b&=ax+y,&{0}\leq y&<\size a
  \end{align*}
has a unique solution.
\end{theorem}

\begin{proof}
  The set $\{z\in\N\colon z=b-ax\text{ for some $x$ in $\Z$}\}$ is
  non-empty (why?).  Let $r$ be its least element (which exists by the
  Well Ordering Principle), and let $q$ be such
  that $r=b-aq$.  Then $b=aq+r$ and ${0}\leq r<\size a$.
\end{proof}

In the notation of the proof, $q$ is the number times that $a$
\emph{goes into} $b$, and $r$ is the \textbf{remainder.}%
\index{remainder}

Every square has the form ${3}n$ or ${3}n+1$.  Indeed, every
number is ${3}k$ or ${3}k+1$ or ${3}k+{2}$, and
\begin{gather*}
  ({3}k)^{2}={9}k^{2}={3}({3}k^{2}),\\
({3}k+1)^{2}={9}k^{2}+6k+1={3}({3}k^{2}+{2}k)+1,\\
({3}k+{2})^{2}={9}k^{2}+{12}k+4={3}({3}k^{2}+4k+1)+1. 
\end{gather*}
An alternative argument can make use of the following:

\begin{theorem}\label{thm:+.mod-n}
  If $a\equiv b$ and $c\equiv d$, then
  \begin{align*}
    a+c&\equiv b+d,& ac&\equiv bd.
  \end{align*}
\end{theorem}

\begin{proof}
If $n\divides b-a$ and $n\divides d-c$, then $n\divides
b-a+d-c$, that 
is, 
\begin{equation*}
n\divides b+d-(a+c), 
\end{equation*}
and also $n\divides(b-a)c+(d-c)b$, that is,
\begin{equation*}
n\divides bd-ac.\qedhere
\end{equation*}
\end{proof}

In particular, congruent numbers have congruent squares.  Since
\begin{align*}
  {0}^{2}&={0},&
1^{2}&=1,&
{2}^{2}&=4\equiv 1\pmod {3},
\end{align*}
again we conclude that every square is $3n$ or $3n+1$ for some $n$.

As suggested above, with respect to a positive modulus $n$, every
integer is congruent to exactly one of the integers $0,1,\dots,n-1$.
Therefore these integers are said to compose a 
\textbf{complete set of residues}%
\index{complete set of residues}%
\index{residue!complete set of ---s}
\emph{modulo} $n$.
Another complete set of residues \emph{modulo} $n$ is the set of $a$ such that
\begin{equation*}
  -\frac n2<a\leq\frac n2.
\end{equation*}
Hence for example every cube is $7n$ or $7n\pm 1$, since
\begin{align*}
 {0}^{3}&\equiv{0},&
 (\pm1)^{3}&\equiv\pm1,&
 (\pm2)^{3}&\equiv\pm8\equiv\pm1,&
 (\pm3)^3&\equiv\pm27\equiv\mp1\pmod{7}.
\end{align*}

Some properties of divisibility are:
\begin{gather}\notag
  a\divides {0};\\\notag
{0}\divides a\iff a={0};\\\notag
1\divides a\land a\divides a;\\\notag
a\divides b\land b\neq{0}\lto \size a\leq\size b;\\\notag
a\divides b\land b\divides c\lto a\divides c\\\notag
a\divides b\land c\divides d\lto ac\divides bd;\\\label{eqn:bx}
a\divides b\lto a\divides bx;\\\label{eqn:b+c}
a\divides b\land a\divides c\lto a\divides b+c.
\end{gather}

\section{Greatest common divisors}

By the last two implications,~\eqref{eqn:bx} and~\eqref{eqn:b+c}, if
$a\divides b$ and $a\divides c$, then
$a$ divides every \textbf{linear combination,}
\begin{equation*}
ax+by,
\end{equation*}
of $a$ and $b$.
Let the set $\{ax+by\colon x,y\in\Z\}$ of these linear combinations be
denoted by
\begin{equation*}
  (a,b).
\end{equation*}
Then $({0},{0})=({0})$.  Otherwise, assuming one of $a$ and $b$ is not
${0}$, let 
$k$ be the least positive element of $(a,b)$.  Then $k$ divides $a$
and $b$.  Indeed, $a=kq+r$ 
and ${0}\leq r<k$ for some $q$ and $r$.  Then
\begin{equation*}
r=a-kq=a-(ax+by)q=a(1-qx)+b(-qy)
\end{equation*}
for some $x$ and $y$, so
$r\in(a,b),$ and hence $r={0}$ by
minimality of $k$, so $k\divides a$.  Similarly, $k\divides b$.  Thus $k$ is a common divisor of $a$ and $b$.
Indeed, $k$ is the 
\textbf{greatest common divisor}%
\index{greatest common divisor}
of $a$ and $b$, that is,
if $d\divides a$
and $d\divides b$, then $d\divides k$.  This is so, since $k$ is a linear
combination of $a$ and $b$.  
We write then
\begin{equation*}
  k=\gcd(a,b).
\end{equation*}
We have also
\begin{equation*}
  (a,b)=(k);
\end{equation*}
we can conclude then that $\Z$ is a \textbf{principal ideal domain.}%
\index{principal ideal domain}
  Indeed, immediately,
$(k)\included(a,b)$.  Also, as $k$ divides $a$ and $b$, it divides
every element of $(a,b)$, so $(a,b)\included(k)$.

If $\gcd(a,b)=1$, then
$a$ and $b$ are 
\textbf{relatively prime}%
\index{relatively prime}%
\index{prime!relatively ---, co-{}---}
 or
\textbf{co-prime.}%
\index{co-prime}
So this
is the case if and only if the equation
\begin{equation*}
  ax+by=1
\end{equation*}
has a solution.
In general, if $\gcd(a,b)=k$, then
\begin{equation*}
  \gcd\left(\frac ak,\frac bk\right)=1,
\end{equation*}
since both $ax+by=k$ and $(a/k)x+(b/k)y=1$ have solutions.

Suppose $a$ and $b$ are co-prime, and each divides $c$; then so does
$ab$.  Indeed, the following have solutions:
\begin{gather*}
  ax+by=1,\\
acx+bcy=c,\\
absx+bary=c,\\
ab(sx+ry)=c,
\end{gather*}
where $c=bs=ar$.
Euclid%
\index{Euclid}
proves the following in Proposition VII.30 of the
\emph{Elements} \cite{MR17:814b,MR1932864}, though his
\emph{statement} of the theorem assumes $a$ is 
\textsl{prime}%
\index{prime}%
\index{number|seealso{prime}} 
(see p.~\pageref{prime}). 


\begin{theorem}[Euclid, VII.30]\label{thm:a|bc}%
\index{theorem!Euclid's Th---}%
\index{Euclid!---'s Theorem}
  If $a\divides bc$ and $\gcd(a,b)=1$, then $a\divides c$.
\end{theorem}

\begin{proof}
  Again, the following have solutions:
  \begin{gather*}
    ax+by=1,\\
acx+bcy=c.
  \end{gather*}
Since $a\divides ac$ and $a\divides bc$, we are done.
\end{proof}

%\section{September 27, 2007 (Thursday)}

\section{Least common multiples}

The positive divisors of $60$ are $1$, $2$, $3$, $4$, $5$, $6$, $10$,
$12$, $15$, $20$, $30$, and $60$.  These twelve numbers can be arranged in
a so-called
\textbf{Hasse diagram} with respect to divisibility; see Fig.~\ref{fig:60}.
\begin{figure}[ht]
\begin{center}
\psset{unit=3mm}
  \begin{pspicture}(-12,-12)(12,12)
    \pspolygon(0,-12)(-12,0)(-2,6)(10,-6)
    \psline(-6,-6)(4,0)
\psdots[linecolor=white,dotsize=4pt 4](-1,-3)(7,-3)(1,3)(-7,3)
    \pspolygon(0,12)(12,0)(2,-6)(-10,6)
    \psline(-12,0)(-10,6)
    \psline(0,-12)(2,-6)
    \psline(12,0)(10,-6)
    \psline(6,6)(-4,0)
    \psline(0,12)(-2,6)
    \psline(-6,-6)(-4,0)
    \psline(6,6)(4,0)
\rput(0,12){\psframebox*[fillstyle=solid]{$60$}}
\rput(0,-12){\psframebox*[fillstyle=solid]{$1$}}
\rput(6,6){\psframebox*[fillstyle=solid]{$30$}}
\rput(-6,-6){\psframebox*[fillstyle=solid]{$2$}}
\rput(-2,6){\psframebox*[fillstyle=solid]{$20$}}
\rput(2,-6){\psframebox*[fillstyle=solid]{$3$}}
\rput(-10,6){\psframebox*[fillstyle=solid]{$12$}}
\rput(10,-6){\psframebox*[fillstyle=solid]{$5$}}
\rput(12,0){\psframebox*[fillstyle=solid]{$15$}}
\rput(-12,0){\psframebox*[fillstyle=solid]{$4$}}
\rput(4,0){\psframebox*[fillstyle=solid]{$10$}}
\rput(-4,0){\psframebox*[fillstyle=solid]{$6$}}
  \end{pspicture}
\end{center}
\caption{Divisors of $60$}\label{fig:60}
\end{figure}
Here a line is drawn from a number $a$ up to a number $b$ if
$a\divides b$, but there is no $c$ distinct from $a$ and $b$ such that
$a\divides c$ and $c\divides b$.  In general, $a\divides b$ if there
is a path upwards from $a$ to $b$.
Then greatest common divisors can be
read off the diagram; for example, $\gcd(12,15)=3$.  By the symmetry
of the diagram, it follows that the \emph{least common multiple} of
$60/12$ and $60/15$ is $60/3$; that is,
\begin{equation*}
  \lcm(5,4)=20.
\end{equation*}

Recall that $(a,b)=\{\text{linear combinations of $a$ and $b$}\}$; its
least positive element (if one of $a$ and $b$ is not ${0}$) is
$\gcd(a,b)$.  Let this be $k$.  We showed
\begin{equation}\label{eqn:abn}
  (a,b)=(k).
\end{equation}
The set $(a)\cap(b)$ consists of the common multiples of $a$ and $b$;
so its least positive element is the \textbf{least common multiple} of
$a$ and $b$, or
\begin{equation*}
  \lcm(a,b).
\end{equation*}
Suppose this is $m$.  As we showed~\eqref{eqn:abn}, so we can show
\begin{equation*}
  (a)\cap(b)=(m).
\end{equation*}
Indeed, suppose $n$ is a common multiple of $(a)$ and $(b)$, that is,
$n\in(a)\cap(b)$.  Then $n=mq+r$ and $0\leq r<m$ for some $q$ and
$r$.  In particular, $r\in(a)\cap(b)$, so $r=0$ by minimality of $m$.
Thus $m\divides n$.  We have a Hasse diagram as in Fig.~\ref{fig:lcm}.
\begin{figure}
  \begin{equation*}
  \xymatrix{&ab&\\
& \lcm(a,b) \ar@{.}[u] &\\
a \ar@{-}[ur] & & b \ar@{-}[ul]\\
& \gcd(a,b) \ar@{-}[ul] \ar@{-}[ur]\\
&1 \ar@{.}[u] &}
  \end{equation*}
  \caption{$\gcd$ and $\lcm$}\label{fig:lcm}
\end{figure}

\begin{theorem}
  $\gcd(a,b)\lcm(a,b)=\size{ab}$.
\end{theorem}

\begin{proof}
If an integer $n$ is a common divisor of $a$ and $b$, then
\begin{equation*}
  \frac{ab}n=\frac an\cdot b=a\cdot\frac bn,
\end{equation*}
so $n\divides ab$ and $ab/n$ is a common multiple of $ab$.  The least
common multiple of $a$ and $b$ divides $ab$ since this is a common
multiple.  Therefore $\lcm(a,b)=ab/n$ for some $n$; in particular, $n$
is a common divisor of $a$ and $b$.  The claim now follows, since
among common divisors $m$ and $n$ of $a$ and $b$,
\begin{equation*}
  m\divides n\iff\frac{ab}n\divides\frac{ab}m.\qedhere
\end{equation*}
\end{proof}

\section{The Euclidean algorithm}

%\section{Linear equations---preliminary}%\asterism{}

How can we find solutions to an equation like the following?
\begin{equation*}
  {63x+7=23y.}
\end{equation*}
Rewrite as
\begin{equation*}
  {63x-23y=-7.}
\end{equation*}
For a solution, we must have
\begin{equation*}
  {\gcd(63,23)\divides 7.}
\end{equation*}
We can find this $\gcd$ by the algorithm demonstrated by Euclid in Propositions VII.1 and 2 of the \emph{Elements.}
Indeed,
\begin{gather*}
63=23\cdot2+17,\\
23=17\cdot1+6,\\
17=6\cdot2+5,\\
6=5\cdot1+1,
\end{gather*}
so $63$ and $23$ are co-prime by Euclid's VII.1.
But $\gcd(9,12)={3}$ by VII.2, since
\begin{gather*}
  12=9\cdot 1+3,\\
3\divides 9.
\end{gather*}
In general, suppose $a_{0}>a_{1}\geq{0}$.  By \emph{strong} recursion (and the Division Theorem), we obtain a sequence $a_0,a_1,a_2,\dots$ by defining
\begin{equation}\label{eqn:anq}
  a_n=a_{n+1}q+a_{n+{2}}\land {0}\leq a_{n+{2}}<a_{n+1}
\end{equation}
(for some $q$) if $a_{n+1}\neq{0}$; but if $a_{n+1}={0}$, we let
$a_{n+{2}}={0}$.  Then the descending sequence
\begin{equation*}
  a_{0}>a_{1}>a_{2}>\dotsb
\end{equation*}
must stop.  That is, let $a_m$ be the least element of $\{a_n\colon
a_n>{0}\}$, so that $a_{m+1}={0}$.  Then 
\begin{equation*}
\gcd(a_{0},a_{1})=a_m.
\end{equation*}
For, if $a_{n+1}\neq{0}$, then
$\gcd(a_n,a_{n+1})=\gcd(a_{n+1},a_{n+{2}})$ by~\eqref{eqn:anq}; so, by
induction,
\begin{equation*}
  \gcd(a_{0},a_{1})=\gcd(a_{1},a_{2})=\dotsb=\gcd(a_m,a_{m+1})=\gcd(a_m,{0})=a_m.
\end{equation*}
This method of finding a $\gcd$ is called the 
\textbf{Euclidean algorithm.}\index{Euclidean algorithm}

In obtaining~\eqref{eqn:sqrt2} in \S~\ref{sect:incomm}, we
used the Euclidean Algorithm (in particular, we used the algorithm given by Euclid in his Proposition X.2).  As in Fig.~\ref{fig:ds},
\begin{figure}[ht]
\begin{center}
  \begin{pspicture}(-0.5,-0.5)(4.5,4.5)
    \psline(0,0)(4,0)(4,4)(0,4)(0,0)(4,4)
    \psline(1.172,1.172)(0,2.343)
    \uput[r](4,2){$s$}
    \uput[d](2,0){$s$}
    \uput[u](2,4){$s$}
    \uput[dr](2,2){$d$}
    \uput[ul](2.586,2.586){$s$}
%    \uput[l](0,3.172){$d-s$}
%    \uput[ur](0.586,1.756){$d-s$}
%    \uput[ul](0.586,0.586){{$d-s$}}
  \end{pspicture}
\end{center}
\caption{Diagonal and side.}\label{fig:ds}
\end{figure}
let $d$ and $s$ be the diagonal and side of a square.  
Since $d^2-s^2=s^2$, we have
\begin{equation*}
  \frac{d+s}s=\frac s{d-s}.
\end{equation*}
Since $s<d+s$, so $d-s<s$.  Because also $d+s=s\cdot2+d-s$, we have
that $s$ goes into $d+s$ twice, with remainder $d-s$.  Then the
Euclidean process is endless: 
\begin{align*}
  d+s=s\cdot2&+d-s,\\
s=(d-s)\cdot 2&+\dotsb,\\
d-s=\dotsb 2&+\dotsb,
\end{align*}
and so on.
As before, we may write
\begin{equation*}
  \frac{d+s}s=2+\cfrac1{2+\cfrac1{2+\cfrac1{\ddots}}}.
\end{equation*}
Compare with an ordinary application of the Algorithm.  For
$\gcd(134,35)$, we have
\begin{align*}
  134=35\cdot 3&+29,\\
35=29\cdot 1&+6,\\
29=6\cdot 4&+5,\\
6=5\cdot 1&+1,\\
5=1\cdot 5&,
\end{align*}
so $\gcd(134,35)=1$; but what is the significance of the
numbers $3$, $1$, $4$, $1$,~$5$?  They appear in the continued fraction:
\begin{multline*}
  \frac{134}{35}
=3+\frac{29}{35}
=3+\cfrac1{\displaystyle\frac{35}{29}}
=3+\cfrac1{1+\displaystyle\frac{6}{29}}
=3+\cfrac1{1+\cfrac1{\displaystyle\frac{29}6}}\\
=3+\cfrac1{1+\cfrac1{4+\displaystyle\frac{5}6}}
=3+\cfrac1{1+\cfrac1{4+\cfrac1{\displaystyle\frac65}}}
=3+\cfrac1{1+\cfrac1{4+\cfrac1{1+\displaystyle\frac15}}}
\end{multline*}


\section{A linear system}

A cock costs 5 L; a hen, 3 L; 3 chicks, 1 L.  Can we buy 100 birds
with 100 L?  Let
\begin{align*}
  x&=\#\text{ cocks,}&
  y&=\#\text{ hens,}&
  z&=\#\text{ chicks.}
\end{align*}
We want to solve
\begin{equation}\label{eqn:sys}
\begin{gathered}
  x+y+z=100,\\
5x+{3}y+\frac13z=100.
\end{gathered}
\end{equation}
Eliminate $z$ and proceed:
\begin{gather}\notag
  z=100-x-y,\\\notag
15x+9y+z=300,\\\notag
15x+9y+100-x-y=300,\\\notag
14x+8y=200,\\\label{eqn:7x+4y=100}
7x+4y=100.
\end{gather}
Since $4\divides 100$, one solution is $({0},25)$, that is, $x={0}$ and
$y=25$.  Then $y=75$.  So the answer to the original question is Yes.
But can we include at least one cock?  What are all the solutions?

Think of linear algebra.  If $(x_{0},y_{0})$ and $(x_{1},y_{1})$ are two
solutions to~\eqref{eqn:7x+4y=100}, then
\begin{gather*}
  7x_{0}+4y_{0}=100,\\
  7x_{1}+4y_{1}=100,\\
  7(x_{1}-x_{0})+4(y_{1}-y_{0})={0}.
\end{gather*}
So we want to solve
\begin{equation*}
  7x+4y={0}.
\end{equation*}
Since $\gcd(7,4)={0}$, the solutions are $(4t,-7t)$.  (Here is a
difference with the usual linear algebra.)  So the original
system~\eqref{eqn:sys} has the general solution
\begin{equation*}
  (x,y,z)=(4t,25-7t,75+{3}t).
\end{equation*}
If we want all entries to be positive, this means
\begin{gather*}
  4t>{0},\quad 25-7t>{0},\quad 75+{3}t>{0};\\
t>{0},\quad 7t<25,\quad {3}t>-75;\\
{0}<t<\frac{25}7;\\
{0}<t\leq{3}.
\end{gather*}
So there are three solutions:
\begin{equation*}
  \begin{array}{c|c|c}
x&y&z\\\hline
4&18&78\\
8&11&81\\
12&4&88
  \end{array}
\end{equation*}

\chapter{Prime numbers}%\asterism{}

\section{The fundamental theorem}

A positive integer is \textbf{prime}\label{prime} if it has exactly two distinct
positive divisors.  So, $1$ is not prime, but $2$ is.  More generally, $b$ is prime if and
only if $b>1$ and for all positive integers $a$,
\begin{equation*}
  a\divides b\lto a\in\{1,b\}.
\end{equation*}
\emph{Throughout these notes,
$p$ and $q$ will always stand for primes.}  Then 
\begin{equation*}
  \gcd(a,p)\in\{1,p\},
\end{equation*}
so either $a$ and $p$ are co-prime, or else $p\divides a$.

\begin{theorem}[Euclid, VII.30]\label{thm:Euclid}
\index{theorem!Euclid's Th---}%
\index{Euclid!---'s Theorem}
If $p\divides ab$, then either $p\divides a$ or $p\divides b$.
\end{theorem}

\begin{proof}
If $p\ndivides a$, then $\gcd(a,p)=1$,
so $p\divides b$ by  Theorem~\ref{thm:a|bc}.
\end{proof}

\begin{corollary}  
If
$p\divides a_1\dotsb a_n$, where $n\geq1$, then $p\divides a_k$ for some $k$.  
\end{corollary}

\begin{proof}
Use induction.
Indeed,
the claim is true when $n=1$.  Suppose it is true when
$n=m$.  Say $p\divides a_1\dotsb a_{m+1}$.  By the theorem, we have
that $p\divides a_1\dotsb a_m$ or $p\divides a_{m+1}$.  In the former
situation, by the inductive hypothesis, $p\divides a_k$ for some $k$.
So the claim holds when $n=m+1$, assuming it holds when $n=m$.  Therefore the claim does indeed hold for all $n$.
\end{proof}

\begin{theorem}[Fundamental Theorem of Arithmetic]%
\index{Fundamental Theorem of Arithmetic}%
\index{theorem!Fundamental Th--- of Arithmetic}
  Every positive integer is uniquely a product
  \begin{equation*}
    p_{1}\dotsm p_n
  \end{equation*}
of primes, where
\begin{equation*}
  p_{1}\leq\dotsb\leq p_n.
\end{equation*}
\end{theorem}

\begin{proof}
Trivially, $1=p_1\dotsm p_n$, where $n=0$.  Suppose $m>1$.  If $a$ is a divisor of $m$ that is greater than $1$, but is not prime, then $a$ has a divisor $b$ such that $1<b<a$; but also then $b$ is a divisor of $m$.  Consequently, the \emph{least} divisor of $m$ that is greater than $1$ is a prime, $p_1$.  If $m=p_1$, we are done; otherwise, the least divisor of $m/p_1$ that is greater than $1$ is a prime, $p_2$.  If $m=p_1p_2$, we are done; otherwise, the least divisor of $m/p_1p_2$ that is greater than $1$ is a prime $p_3$.
Continuing thus, we get a decreasing sequence $p_1,p_2,p_3,\dots$ of primes, where $p_1\dotsm p_k\divides m$.  Since
  \begin{equation*}
    m>\frac m{p_{1}}>\frac m{p_{1}p_{2}}>\dotsb,
  \end{equation*}
the sequence of primes must terminate
by the Well Ordering Principle,
and for some $n$ we have $m=p_{1}\dotsb p_n$.

For uniqueness, suppose also $m=q_{1}\dotsb q_{\ell}$.  Then
$q_{1}\divides m$, so $q_{1}\divides p_i$ for some $i$ by the corollary to Theorem~\ref{thm:Euclid}, and therefore
$q_{1}=p_i$.  Hence 
\begin{equation*}
  p_{1}\leq p_i=q_{1}.
\end{equation*}
By the symmetry of the argument, $q_{1}\leq p_{1}$, so $p_{1}=q_{1}$.
Similarly, $p_{2}=q_{2}$, \&c.,
and $n=\ell$.
\end{proof}

Alternatively, every positive integer is uniquely a product
\begin{equation*}
p_1{}^{a_1}\dotsm p_n{}^{a_n},
\end{equation*}
where $p_1<\dotsb<p_n$ and the exponents $a_k$ are all positive integers.

An integer greater than $1$ that is not prime is called
\textbf{composite,}%
\index{composite number}%
\index{number!composite ---}
since it can be written as a product $ab$, where
both factors are greater than $1$. 

\section{Irreducibility}

A nonzero element of an arbitrary commutative ring is a 
\textbf{unit}%
\index{unit of a ring}
if it has a multiplicative inverse.  A nonzero element $a$ of the ring
is 
\textbf{irreducible}%
\index{irreducible element of a ring}
 if $a$ is not a unit, but if $a=bc$, then one
of $b$ and $c$ is a unit.  Thus the prime numbers are just the
positive irreducibles in the ring of integers.   

In an arbitrary commutative ring, the analogue of
Theorem~\ref{thm:Euclid} may fail.   
For example, let $\Z[\rten]$ be the ring of numbers $a+b\rten$.  Here,
\begin{equation*}
  (4+\rten)(4-\rten)=6={2}\cdot {3};
\end{equation*}
but the factors $4\pm\rten$, $2$, and $3$
are irreducible.  To show this, we use the function $\sigma$ from $\Z[\rten]$ to itself given by
\begin{equation*}
  \sigma(a+b\rten)=a-b\rten.
\end{equation*}
Compare this with complex conjugation.  Since
\begin{equation*}
(a+b\rten)(c+d\rten)=ac+10bd+(ad+bc)\rten,
\end{equation*}
we have
\begin{equation*}
\sigma(xy)=\sigma(x)\cdot\sigma(y).
\end{equation*}
Now define
$N(x)=x\cdot\sigma(x)$, so that
\begin{equation*}
  N(a+b\rten)=a^2-10b^2,
\end{equation*}
an integer.
Then
\begin{equation*}
N(xy)=N(x)\cdot N(y).
\end{equation*}
If $a$ is a unit of $\Z[\rten]$, then 
$ab=1$ for some $b$ in $\Z[\rten]$, so $N(ab)=N(1)$, that is,
$N(a)\cdot N(b)=1$, so $N(a)=\pm1$.  Conversely, if $N(a)=\pm1$, then
$a\cdot(\pm\sigma(a))=1$, so $a$ is a unit.
Finally, $N(c)$ is always a
square \emph{modulo} $10$.  We have 
\begin{align*}
  0^2&=0,&
1^2&=1,&
2^2&=4,&
3^2&=9\equiv-1,&
4^2&=16\equiv-4,&
5^2&=25\equiv5,
\end{align*}
so $N(c)$ is congruent to $0$, $\pm1$, $\pm 4$ or $5$, \emph{modulo}
$10$. 
Now $2$ is irreducible, since if
$2=ab$, then $N(2)=N(ab)$, that is, $4=N(a)\cdot N(b)$, so
$N(a)\in\{\pm1,\pm2,\pm4\}$ and therefore $N(a)\in\{\pm1,\pm4\}$; so one of $N(a)$
  or $N(b)$ is $\pm1$, so it is a unit.  Likewise for the other factors.


\section{Eratosthenes}%\asterism{}

One can find primes with the \textbf{Sieve of Eratosthenes}%
\index{Sieve of Eratosthenes}%
\index{Eratosthenes}
(assumed known to the reader).
Eratosthenes of Cyrene (276--194 \textsc{b.c.e.})
  also measured the circumference 
  of the earth, by measuring the shadows cast by posts a certain
  distance apart in Egypt.  Measuring \emph{this} distance must have needed
  teams of surveyors and a government to 
  fund them.  Columbus was not in a position to make the measurement
  again, so he had to rely on ancient measurements \cite{MR2038833}.

\section{The infinity of primes}%\asterism{}

\begin{theorem}[Euclid, IX.20]
\index{theorem!Euclid's Th---}%
\index{Euclid!---'s Theorem}
  There are more than any number of primes.
\end{theorem}

\begin{proof}
  Suppose $p_1<\dots<p_n$, all prime.  Then $p_1\dotsm p_1+1$
  has a prime factor, distinct from the $p_k$.
\end{proof}

An alternative argument by Filip Saidak (2005) is reported in \emph{Matematik D\"unyas\i} (2007-II [no.~73], p.~69):  Define $a_{0}={2}$ and
$a_{n+1}=a_n(1+a_n)$.  Suppose $k<n$.  Then $a_k\divides a_{k+1}$, and
$a_{k+1}\divides a_{k+{2}}$, and so on, up to $a_{n-1}\divides a_n$, so
$a_k\divides a_n$.  Similarly, since $1+a_k\divides a_{k+1}$, we have
$1+a_k\divides a_n$.  Therefore $\gcd(1+a_k,1+a_n)=1$.  Thus any two
elements of the infinite set $\{1+a_n\colon n\in\N\}$ are co-prime.

For another proof of the infinity of primes,
using the full Fundamental Theorem of Arithmetic, 
consider the product
\begin{equation*}
  \prod_{p}\frac1{1-1/p}
\end{equation*}
(recall that $p$ ranges over the primes).
If there are only finitely many primes, then this product is well defined.  In any case, each factor is the sum of a \textbf{geometric series:}%
\index{geometric series}
\begin{equation*}
\frac1{1-1/p}=1+\frac1p+\frac1{p^2}+\dotsb
=\sum_{k=0}^{\infty}\frac1{p^k}. 
\end{equation*}
Hence, at least formally,
\begin{equation*}
\prod_{p}\frac1{1-1/p}
=\prod_{p}\Bigl(1+\frac1p+\frac1{p^2}+\dotsb\Bigr). 
\end{equation*}
Alternatively, if the primes are $p_1$, $p_2$, \dots, then the product is
\begin{equation*}
  \Bigl(1+\frac1{p_1}+\frac1{p_1{}^2}+\dotsb\Bigr)\cdot
  \Bigl(1+\frac1{p_2}+\frac1{p_2{}^2}+\dotsb\Bigr)\dotsm
\end{equation*}
which can be understood as the sum of terms
\begin{equation*}
  \frac1{p_1{}^{e(1)}p_2{}^{e(2)}\dotsm},
\end{equation*}
where $e(i)\geq0$, and $e(i)=0$ for all but finitely many indices $i$.  But every positive integer is
\emph{uniquely} such a product
$p_1{}^{e(1)}p_2{}^{e(2)}\dotsb$,
by the Fundamental Theorem.  Therefore
\begin{equation*}
  \prod_{p}\frac1{1-1/p}=\sum_{n=1}^{\infty}\frac1n.
\end{equation*}
This is the 
\textbf{harmonic series,}%
\index{harmonic series} which
diverges:
\begin{equation*}
  1+\frac12 +\underbrace{\frac13+\frac14}_{\geq1/2}
  +\underbrace{\frac15+\frac16+\frac17+\frac18}_{\geq1/2}+\dotsb  
\end{equation*}
Therefore there are infinitely many primes.  Using similar ideas, one can show
that
$\sum_{p}1/p$ diverges.

\section{Some theorems}\label{sect:unproved}

I state some theorems, without giving proofs; some of them are recent
and reflect ongoing research:

\begin{theorem}[Dirichlet]
  If $\gcd(a,b)=1$, and $b>{0}$, then $\{a+bn\colon n\in\N\}$ contains
  infinitely many primes.
\end{theorem}

That is in an arithmetic progression whose initial term is prime to the common difference, there are infinitely many primes.  It is moreover possible to find arbitrary long arithmetic progressions consisting entirely of primes:\footnote{This theorem is not mentioned in Burton \cite{Burton}.}

\begin{theorem}[Ben Green and Terence Tao \cite{Green--Tao}, 2004]
  For every $n$, there are $a$ and $b$ such that each of the numbers
  $a, a+b, a+{2}b,\dots,a_nb$ is prime (and $b>{0}$).
\end{theorem}

Is it possible that each of
the numbers  
\begin{equation*}
a,a+b,a+{2}b,a+{3}b,\dots
\end{equation*}
 is
prime?  Yes, if $b={0}$.
What if $b>{0}$?  Then No, since $a\divides a+ab$.  But what if $a=1$?
Then replace $a$ with $a+b$.

Two primes $p$ and $q$ are 
\textbf{twin primes}%
\index{twin primes}%
\index{prime!twin ---s}
if $\size{p-q}={2}$.
The list of all primes begins: 
\begin{equation*}
{2},\underbrace{{3},5,7},
\underbrace{11,13},\underbrace{17,19},23,\underbrace{29,31},37,
\underbrace{41,43},47,\dots 
\end{equation*}
and
there are several twins.  Are there infinitely many?  People think so,
but can't prove it.  We do have:

\begin{theorem}[Goldston, Pintz, Y\i ld\i r\i m \cite{GPY}, 2005]
  For every positive real number $\epsilon$, there are primes~$p$
  and~$q$ such that ${0}<q-p<\epsilon\cdot\log p$.
\end{theorem}

Here of course $\log x$ is the 
\textbf{natural logarithm}%
\index{natural logarithm}%
\index{logarithm}
 of $x$, that is,
\begin{equation*}
\log x=\int_1^x\frac{\mathrm dt}t.
\end{equation*}
This function also appears in the much older

\begin{theorem}[Prime Number Theorem]
Let $\pi(n)$ be the number of primes~$p$ such that $p\leq n$.  Then
\begin{equation*}
\lim_{n\to\infty}\frac{\pi(n)\cdot\log n}{n}=1.
\end{equation*}
\end{theorem}

\chapter{Computations with congruences}

\section{Exponentiation}

We can compute $35^{14}\pmod{43}$ as follows:  First,
$35\equiv-8\pod{43}$, so
\begin{equation*}
  35^{14}\equiv(-8)^{14}\equiv 8^{14}.
\end{equation*}
Also, $14=8+4+2=2^3+2^2+2^1$, so $8^{14}=8^8\cdot8^4\cdot8^2$; and
\begin{gather*}
  8^2=64\equiv21,\\
21^2=441\equiv11,\\
11^2=121\equiv35\equiv-8,
\end{gather*}
so that
\begin{align*}
  35^{14}&\equiv-8\cdot11\cdot21\\
&\equiv-88\cdot21\\
&\equiv-2\cdot21\\
&\equiv-44\equiv1.
\end{align*}

\section{Inversion}\label{sect:inversion}

If $a\equiv b\pod n$, then $ac\equiv bc\pod n$.  But do we have the
converse?
We do if $c$ is invertible (is a unit) \emph{modulo} $n$.  In that
case, $cd\equiv1\pod n$ for some $d$, and then 
\begin{align*}
  ac\equiv bc\pmod n&\implies acd\equiv bcd\pmod n\\
&\implies a\equiv b\pmod n.
\end{align*}
Invertibility of $c$ \emph{modulo} $n$ is equivalent to solubility of
$cx\equiv1\pod n$, or equivalently of
\begin{equation*}
  cx+ny=1.
\end{equation*}
Thus $c$ is invertible \emph{modulo} $n$ if and only if $c$ and $n$
are co-prime.

Alternatively, if
$ac\equiv bc\pod n$, and $c$ and $n$ are co-prime,
then we can argue by Theorem~\ref{thm:Euclid} that, since $n\divides bc-ac$,
that is, $n\divides(b-a)c$, we have $n\divides b-a$, that is, $a\equiv
b\pod n$.

Suppose we simply have $\gcd(c,n)=d$.  Then $\gcd(c,n/d)=1$.  Hence
\begin{align*}
  ac\equiv bc\bmod n&\implies ac\equiv bc\bmod{\frac nd}\\
&\implies a\equiv b\bmod{\frac nd}.
\end{align*}
Conversely,
\begin{align*}
  a\equiv b\bmod{\frac nd}&\implies\frac nd\divides b-a\\
&\implies\frac{cn}d\divides bc-ac\\
&\implies n\divides bc-ac\\
&\implies ac\equiv bc\bmod n.
\end{align*}
In short,
\begin{equation*}
  ac\equiv bc\bmod n\iff a\equiv b\bmod{\frac n{\gcd(c,n)}}.
\end{equation*}
For example, $6x\equiv 6\pod 9\iff x\equiv 1\pod 3$.
A longer problem is to solve
\begin{equation}\label{eqn:70}
  70x\equiv18\pod{134}.
\end{equation}
This reduces to
\begin{equation*}
  35x\equiv9\pod{67}.
\end{equation*}
or $35x+67y=9$.  So there is a solution if and only if
$\gcd(35,67)\divides9$.  We check the divisibility by the Euclidean algorithm:
\begin{align*}
  67&=35\cdot1+32,\\
35&=32\cdot1+3,\\
32&=3\cdot10+2,\\
3&=2\cdot1+1,
\end{align*}
so $\gcd(35,67)=1$.  Rearranging the computations, we have
\begin{align*}
  32&=67-35,\\
3&=35-32=35-(67-35)=35\cdot2-67,\\
2&=32-3\cdot10=67-35-(35\cdot2-67)\cdot10=67\cdot11-35\cdot21,\\
1&=3-2=35\cdot2-67-67\cdot11+35\cdot21=35\cdot23-67\cdot12.
\end{align*}
In particular, $35\cdot23\equiv1\pod{67}$, so~\eqref{eqn:70} is
equivalent to
\begin{gather*}
  x\equiv23\cdot9\equiv207\equiv6\pod{67},\\
  x\equiv6,73\pod{134}.
\end{gather*}

\section{Chinese Remainder Theorem}

A puzzle from a newspaper [the \emph{Guardian Weekly}] is
mathematically the same as one attributed \cite[Prob.~4.4.8--9,
  p.~83]{Burton} to Brahmagupta (7th century \textsc{c.e.}):  A man
dreams he runs up a flight of stairs.  If he takes the stairs $2$, $3$, $4$,
$5$, or $6$ at time, then one stair is left before the top.  If he takes
them $7$ at a time, then he reaches the top exactly.  How many stairs
are there?

If $x$ is that number, then
\begin{align*}
  x&\equiv1\pmod{2,3,4,5,6},\\
x&\equiv0\pmod7.
\end{align*}
But $\lcm(2,3,4,5,6)=60$, so $x=60n+1$, where $7\divides 60n+1$.  We
have this when $n=5$, hence when $n=12,19,\dots$

The general problem is to solve systems
\begin{align}\label{eqn:crt}
  x&\equiv a_1\bmod{n_1},&
  x&\equiv a_2\bmod{n_2},&
  &\dots,&
  x&\equiv a_k\bmod{n_k}.
\end{align}
Let's start with two congruences:
\begin{align}\label{eqn:xan}
  x&\equiv a\bmod n,&
  x&\equiv b\bmod m.
\end{align}
A solution will take the form
\begin{equation*}
  x=a+nu
   =mv+b.
\end{equation*}
Then we shall have $a\equiv mv+b\pod n$ and $a+nu\equiv b\pod m$, that is,
\begin{align*}
mv&\equiv a-b\pmod n,&
nu&\equiv b-a\pmod m.
\end{align*}
These can be achieved if each of $m$ and $n$ is invertible \emph{modulo} the other, that is, $\gcd(n,m)=1$.  In this case we have $nr\equiv1\pod m$ and
$ms\equiv1\pod n$ for some $r$ and $s$, so that a solution
to~\eqref{eqn:xan} is
\begin{equation*}
  x=ams+bnr.
\end{equation*}
Any two solutions are congruent \emph{modulo} $m$ and $n$, hence
$\lcm(n,m)$, which is $nm$ since
$\gcd(n,m)=1$.  

We can solve~\eqref{eqn:crt} similarly, under the assumption
\begin{equation*}
  \gcd(n_i,n_j)=1
\end{equation*}
whenever $1\leq i<j\leq k$.  We have
\begin{align*}
x
&=a_1m_1n_2\dotsm n_k+a_2n_1m_2n_3\dotsm n_k+\dotsb+a_kn_1\dotsm n_{k-1}m_k\\
&=\sum_{k=1}^na_km_k\frac{\prod_{j=1}^nn_j}{n_k},
\end{align*}
where the $m_k$ are chosen so that
\begin{equation*}
  m_1n_2\dotsm n_k\equiv1\pod{n_1},
\end{equation*}
and so forth, that is,
\begin{equation*}
m_k\frac{\prod_{j=1}^nn_j}{n_k}\equiv1\pmod{n_k};
\end{equation*}
this is possible since
\begin{equation*}
  \gcd(n_1,n_2\dotsm n_k)=1.
\end{equation*}
The solution is unique \emph{modulo} $n_1\dotsm n_k$.  This is the
\textbf{Chinese Remainder Theorem.}%
\index{Chinese Remainder Theorem}%
\index{theorem!Chinese Remainder Th---}%
\index{remainder!Chinese R--- Theorem}

\chapter{Mersenne}

\section{Perfect numbers}
%\section{October 16, 2007 (Tuesday)}

Of the 13 books of Euclid's \emph{Elements,} VII, VIII and IX concern
number-theory.  The last proposition in these books is:

\begin{theorem}[Euclid, IX.36]
\index{theorem!Euclid's Th---}%
\index{Euclid!---'s Theorem}
  If $1+2+4+\dotsb+2^n$ is prime, then the product
  \begin{equation*}
  2^n\cdot(1+2+\dotsb+2^n)
  \end{equation*}
is 
\textsl{perfect.}%
\end{theorem}

A number is 
\textbf{perfect}%
\index{perfect number}%
\index{number!perfect ---}
if it is the sum of its positive proper
divisors:
\begin{align*}
  6&=1+2+3,\\
28&=1+2+4+7+14.
\end{align*}

\begin{proof}[Proof of theorem]
Use the notation
\begin{equation}\label{eqn:M_n}
M_{n+1}=1+2+4+\dots+2^n=\sum_{k=0}^n2^k=2^{n+1}-1.  
\end{equation}
If
  $M_{n+1}$ is prime, then the positive divisors of $2^n\cdot M_{n+1}$
  are the divisors of $2^n$, perhaps multiplied by $M_{n+1}$.  So they are
  \begin{equation*}
    1,\ 2,\ 4,\ \dots,\ 2^n,\ M_{n+1},\ 2\cdot M_{n+1},\ 4\cdot
    M_{n+1},\ \dots,\ 2^n\cdot M_{n+1}.
  \end{equation*}
The sum of these is $(1+2+4+\dotsb+2^n)\cdot(1+M_{n+1})$, which is
$M_{n+1}\cdot 2^{n+1}$.  Subtracting $2^n\cdot M_{n+1}$ itself leaves
the same.
\end{proof}

\section{Mersenne primes}

The number $2^n-1$, denoted by $M_n$ as in~\eqref{eqn:M_n}, is called
a 
\textbf{Mersenne number,}%
\index{Mersenne}%
\index{Mersenne!--- number}%
\index{number!Mersenne ---}
after Marin Mersenne,
1588--1648);
if the number is prime, it is a 
\textbf{Mersenne prime.}%
\index{Mersenne!--- prime}%
\index{prime!Mersenne ---}
We do not know whether there are infinitely many
  Mersenne primes.  However, if $M_n$ is prime, then so is $n$, since
  $2^a-1\divides 2^{ab}-1$, because of the identity
  \begin{equation*}
    x^m-y^m=(x-y)\cdot(x^{m-1}+x^{m-2}\cdot y+x^{m-3}\cdot
    y^2+\dots+x\cdot y^{m-2}+y^{m-1}).
  \end{equation*}

\chapter{Fermat}

\section{Fermat's factorization method}%\asterism{}

One method of factorizing $n$ is to get a table of primes and test
whether $p\divides n$ when $p\leq\sqrt n$.

The method of Pierre de Fermat%
\index{Fermat}
(1601--1665) is to solve
\begin{equation*}
  x^2-y^2=n,
\end{equation*}
since then $n=(x+y)(x-y)$.  This method always works in principle,
since
\begin{equation*}
  ab=\left(\frac{a+b}2\right)^2-\left(\frac{a-b}2\right)^2.
\end{equation*}
We may assume $n$ is odd, so if $n=ab$, then $a\pm b$ are even.

For example, the first square greater than $2\dsp279$ is $2\dsp304$, or
$48^2$, and $2\dsp304-2\dsp279=25=5^2$, so
\begin{equation*}
  2\dsp279=(48+5)(48-5)=53\cdot43.
\end{equation*}

We can generalize the method by solving
\begin{equation*}
  x^2\equiv y^2\pmod n.
\end{equation*}
If $x^2-y^2=mn$, then find $\gcd(x+y,n)$ and $\gcd(x-y,n)$.

\section{Fermat's little theorem}\label{sect:FT}

Suppose $p\ndivides a$, that is, $\gcd(p,a)=1$.  What is $a^{p-1}$
\emph{modulo} $p$?  Consider $a$, $2a$, \dots,
$(p-1)a$.  These are all incongruent \emph{modulo} $p$, since
\begin{equation*}
  ia\equiv ja\pmod p\implies i\equiv j\pmod p.
\end{equation*}
But $1$, $2$, \dots, $p-1$ are also incongruent.  There are only $p-1$
numbers incongruent with each other and $0$ \emph{modulo} $p$; so the
numbers  $a$, $2a$, \dots,
$(p-1)a$ are congruent respectively with
 $1$, $2$, \dots, $p-1$ in some order.  Now multiply: 
\begin{equation*}
(p-1)!\cdot a^{p-1}\equiv(p-1)!\pmod p.
\end{equation*}
Since $(p-1)!$ and $p$ are co-prime, we conclude:
\begin{equation*}
 \gcd(a,p)=1\implies a^{p-1}\equiv 1\pmod p.
\end{equation*}
This is 
\textbf{Fermat's Little Theorem.}%
\index{Fermat!---'s Little Theorem}%
\index{theorem!Fermat's Little Th---}
Equivalently,
\begin{equation*}
  a^p\equiv a\pmod p
\end{equation*}
for \emph{all} $a$.
Consequently, for all $a$ and all positive $m$ and $n$,
\begin{equation*}
m\equiv n\pmod{(p-1)}\implies a^m\equiv a^n\pmod p.
\end{equation*}
For example,
\begin{equation*}
  6^{58}\equiv 6^{48+10}\equiv(6^{16})^3\cdot 6^{10}\equiv
  6^{10}\pmod{17}. 
\end{equation*}
Since $10=8+2$, we have $6^{10}=6^8\cdot 6^2$; but
$6^2\equiv36\equiv2\pod{17}$, so
$6^8\equiv2^4\equiv16\equiv-1\pod{17}$, and hence
\begin{equation*}
  6^{58}\equiv -2\pmod{17}.
\end{equation*}

If $a^n\not\equiv a\pmod n$, then $n$ must not be prime.  For example,
  what is $2^{133}$ \emph{modulo} $133$?  We have 
  $133=128+4+1=2^7+2^2+1$, so $2^{133}=2^{2^7}\cdot 2^{2^2}\cdot 2$.
  Also,
  \begin{align*}
2^2&=4;\\
    2^{2^2}&=4^2=16;\\
2^{2^3}&=16^2=256\equiv123\equiv-10\pmod{133};\\
2^{2^4}&\equiv(-10)^2=100\equiv-33;\\
2^{2^5}&\equiv(-33)^2=1089\equiv25;\\
2^{2^6}&\equiv25^2=625\equiv-40;\\
2^{2^7}&\equiv(-40)^2=1600\equiv4.
  \end{align*}
Therefore
\begin{equation*}
  2^{133}\equiv4\cdot16\cdot2\equiv-5\pmod{133},
\end{equation*}
so $133$ must not be prime.  Indeed, $133=7\cdot19$.

\section{Carmichael numbers}

The converse of the Fermat Theorem fails:  It may be that $a^n\equiv
a\pmod n$ for all $a$, although $n$ is not prime.  To see this, we
first define $n$ to be a 
\textbf{pseudo-prime}%
\index{pseudo-prime}%
\index{prime!pseudo-{}---}
if $n$ is not prime,
but 
\begin{equation*}
  2^n\equiv 2\pmod n.
\end{equation*}
Then $341$ is a pseudo-prime.  Indeed, $341=11\cdot31$; but
\begin{align*}
2^{11}&=2048=31\cdot 66+2\equiv 2\pmod{31},\\
  2^{31}&=(2^{10})^3\cdot 2\equiv2\pmod{11}.
\end{align*}
Hence $2^{11\cdot31}\equiv 2\pmod{11\cdot31}$ by the following.

\begin{lemma*}
  If $a^p\equiv a\pod q$ and $a^q\equiv a\pod p$, then $a^{pq}\equiv
  a\pod{pq}$. 
\end{lemma*}

\begin{proof}
  Under the hypothesis, we have
  \begin{gather*}
    a^{pq}=(a^p)^q\equiv a^q\equiv a\pmod q,\\
    a^{pq}=(a^q)^p\equiv a^p\equiv a\pmod p,
  \end{gather*}
and hence $a^{pq}\equiv a\pmod{\lcm(p,q)}$; but $\lcm(p,q)=pq$.
\end{proof}

Again, we now have $2^{341}\equiv2\pmod{341}$, so $341$ is
pseudo-prime. 

\begin{theorem}
  If $n$ is a pseudo-prime, then so is $2^n-1$.
\end{theorem}

\begin{proof}
  Since $n$ factors non-trivially as $ab$, but $2^a-1\divides
  (2^a)^b-1$, we have that $2^a$ is a non-trivial factor of $2^n-1$.
  So $2^n-1$ is not prime.  We assume also $2^n\equiv2\pmod n$; say
  $2^n-2=kn$.  Then
  \begin{equation*}
    2^{2^n-1}-2=2\cdot(2^{2^n-2}-1)=2\cdot(2^{kn}-1),
  \end{equation*}
which has the factor $2^n-1$; so $2^{2^n-1}\equiv2\pmod{2^n-1}$. 
\end{proof}

One can ask whether $3^n\equiv3\pmod n$, for example.  But a number
$n$ is called an 
\textbf{absolute pseudo-prime}%
\index{prime!absolute pseudo-{}---}% 
\index{absolute pseudo-prime}%
\index{pseudo-prime!absolute ---}
or a 
\textbf{Carmichael number}
\index{Carmichael, --- number}%
\index{number!Carmichael ---}
(named for
Robert Daniel Carmichael,
1879--1967)
 if
\begin{equation*}
  a^n\equiv a\pmod n
\end{equation*}
for all $a$.  Then $561$ is a Carmichael number.  Indeed,
\begin{equation*}
  561=3\cdot11\cdot17;
\end{equation*}
and
\begin{align*}
  3-1&\divides 561-1,&
11-1&\divides 561-1,&
17-1&\divides 561-1.
\end{align*}
that is,
\begin{align*}
2&\divides 560,&
10&\divides 560,&
16&\divides 560.
\end{align*}
Hence
\begin{align*}
  3\ndivides a&\implies a^2\equiv 1\pmod 3\implies a^{560}\equiv 1\pmod 3;\\
  11\ndivides a&\implies a^{10}\equiv 1\pmod{11}\implies a^{560}\equiv
  1\pmod{11};\\ 
  17\ndivides a&\implies a^{17}\equiv 1\pmod{17}\implies a^{560}\equiv
  1\pmod{17}.
\end{align*}
Hence $a^{561}\equiv a\pmod{3,11,17}$ for \emph{all} $a$, so
\begin{equation*}
  a^{561}\equiv a\pmod{561}.
\end{equation*}
In general, if $n=p_0\cdot p_1\dotsm p_k$, where $p_0<p_1<\dotsb<p_k$,
and $p_i-1\divides n-1$ for each $i$, then the same argument shows
that $n$ is an absolute pseudo-prime.

For $n$ to be a pseudo-prime, it is necessary that $n$ have no square factor.  Indeed, if
$a^n\equiv a\pmod n$ for all $a$, but $m^2\divides n$, then $m^n\equiv
m\pmod n$, so
\begin{equation*}
  m^n\equiv m\pmod{m^2}.
\end{equation*}
But if $n>1$, then $m^n\equiv0\pmod{m^2}$, so
$m\equiv0\pmod{m^2}$, which is absurd unless $m=\pm1$.

\section{Wilson's Theorem}
%\section{October 18, 2007 (Thursday)}

Can we solve $(p-1)!\equiv x\pmod p$?  The answer is certainly not
$0$.

\begin{theorem}\label{thm:Wilson}
Suppose $n>1$.  Then
  $(n-1)!\equiv-1\pmod n$ if and only if $n$ is prime.
\end{theorem}

This is called 
\textbf{Wilson's Theorem}%
\index{Wilson, ---'s Theorem}
\index{theorem!Wilson's Th---}
after John Wilson, 1741--1793, who apparently conjectured the result,
but did not prove it.  (It appears the result was also known to
 Abu Ali al-Hasan ibn al-Haytham,%
\index{Haytham}
965--1039.)  The result
gives a theoretical test for primality, though not a practical one.

\begin{proof}[Proof of theorem]
  One of the two directions should be easier; which one?
  Suppose $n$
  is not prime, so that $n=ab$, where $1<a<n$.  Then $a\leq n-1$, so
  $a\divides(n-1)!$, so $a\ndivides(n-1)!+1$, so $n\ndivides(n-1)!+1$.

Now suppose $n$ is a prime $p$.  Each number on the list
$1,2,3,\dots,p-1$ has an inverse \emph{modulo} $p$.  Also,
$x^2\equiv1\pmod p$ has only the solutions $\pm1$, that is, $1$ and
$p-1$, since it requires $p\divides x\pm1$.  So the numbers on the
list $2,3,\dots,p-2$ have inverses different from themselves.  Hence
we can partition these numbers into pairs $\{a,b\}$, where
$ab\equiv1\pmod p$.  Therefore $(p-1)!\equiv p-1\equiv-1\pmod p$.
\end{proof}

For example,
\begin{align*}
  2\cdot 4&\equiv1,&
  3\cdot 5&\equiv1\pmod 7,\\
\end{align*}
so $6!=(2\cdot 4)\cdot(3\cdot 5)\cdot 6\equiv 6\equiv-1\pmod7$.  How
can one find inverses \emph{modulo} $7$, other than by trial?  Take successive
powers.  We have
\begin{align*}
  2^2&=4,\\
2^3&=8\equiv1\pmod 7,
\end{align*}
so not every number that is prime to $7$ is a power of $2$ \emph{modulo} $7$;
but
\begin{align*}
  3^2&=9\equiv 2\pmod 7,\\
3^3&\equiv 2\cdot 3\equiv 6\pmod 7,\\
3^4&\equiv 6\cdot 3\equiv 4\pmod 7,\\
3^5&\equiv 4\cdot 3\equiv 5\pmod 7,\\
3^6&\equiv 5\cdot 3\equiv 1\pmod 7.
\end{align*}
So the invertible numbers \emph{modulo} $7$ compose a multiplicative
group generated by $3$; we express this by saying $3$ is a 
\textbf{primitive root}%
\index{primitive root}
of $7$.  Primitive roots will be investigated later.  Meanwhile, we have now
\begin{equation*}
  3\cdot 3^5\equiv 3^2\cdot 3^4\equiv 1\pmod 7.
\end{equation*}
An application of Wilson's Theorem is the
following.

\begin{theorem}\label{thm:Wilson-app}
  Let $p$ be an odd prime.  Then the congruence $x^2\equiv-1\pmod p$
  has a solution if and only if $p\equiv 1\pmod 4$.
\end{theorem}

\begin{proof}
  Suppose $a^2\equiv-1\pmod p$.  By the Fermat Theorem,
  \begin{equation*}
    1\equiv a^{p-1}\equiv(a^2)^{(p-1)/2}\equiv(-1)^{(p-1)/2}\pmod p,
  \end{equation*}
so $(p-1)/2$ must be even: $4\divides p-1$, so $p\equiv1\pmod 4$.

Conversely, by Wilson's Theorem, we have
\begin{align*}
  -1\equiv(p-1)!
&\equiv 1\cdot 2\dotsm\frac{p-1}2\cdot\frac{p+1}2\dotsm(p-1)\\
&\equiv 1\cdot(p-1)\cdot 2\cdot(p-2)\dotsm\frac{p-1}2\cdot\frac{p+1}2\\
&\equiv 1\cdot(-1)\cdot 2\cdot(-2)\dotsm\frac{p-1}2\cdot\frac{1-p}2\\
&\equiv(-1)^{(p-1)/2}\left(\left(\frac{p-1}2\right)!\right)^2.
\end{align*}
So if $p\equiv1\pmod 4$, then $x^2\equiv-1\pmod p$ is solved by $((p-1)/2)!$.
\end{proof}

For example, 
\begin{equation*}
  -1\equiv 4!\equiv 1\cdot(-1)\cdot 2\cdot(-2)\equiv 2^2\pmod 5,
\end{equation*}
while, \emph{modulo} $13$, we have
\begin{equation*}
-1\equiv 12!\equiv
1\cdot(-1)\cdot 2\cdot (-2)\cdot 3\cdot (-3)\cdot 4\cdot (-4)\cdot
5\cdot (-5)\cdot 6\cdot (-6)\equiv (6!)^2 \pod{13}. 
\end{equation*}
In terminology to be developed later, the theorem is that $-1$ is a
\textbf{quadratic residue}%
\index{quadratic!--- residue}%
\index{residue!quadratic ---}
of an odd prime $p$ if and only if $p\equiv1\pmod 4$.

%%\section{October 23, 2007 (Tuesday)}

%[There is an exam in the evening, so during the lecture I merely take
%students' questions on the recommended homework problems.]  

\chapter{Arithmetic functions}

\section{Multiplicative functions}
%\section{October 25, 2007 (Thursday)}

We work now with positive integers---natural numbers---only.  A
function on $\N$ is an 
\textbf{arithmetic function.}% 
\index{arithmetic function}%
\index{function!arithmetic ---}
One such function is $\sigma$, where
$\sigma(n)$
is the sum of the (positive) divisors of $n$.  Then $n$ is
perfect if and only if $\sigma(n)=2n$.  For the \emph{number}
of positive divisors of $n$, we write
$\tau(n)$.
For example,
\begin{equation*}
\begin{array}{r@{{}={}}c@{{}+{}}c@{{}+{}}c@{{}+{}}c@{{}+{}}c@{{}+{}}c@{{}={}}l}
\tau(12)& 1& 2& 3& 4& 6& 12& 28,\\
\sigma(12)& 1& 1& 1& 1& 1& 1& 6.
  \end{array}
\end{equation*}
Indeed, $12=2^2\cdot3$, so the divisors of $12$ are
\begin{align*}
&2^0\cdot 3^0,&
&2^1\cdot 3^0,&
&2^2\cdot 3^0,\\
&2^0\cdot 3^1,&
&2^1\cdot 3^1,&
&2^2\cdot 3^1.
\end{align*}
So the factors of $12$ are determined by a choice from $\{0,1,2\}$ for
the exponent of $2$, and from $\{0,1\}$ for the exponent of $3$.
Hence
\begin{equation*}
  \tau(12)=(2+1)\cdot(1+1).
\end{equation*}
Similarly, each factor of $12$ itself has two factors: one from
$\{1,2,4\}$, and the other from $\{1,3\}$; so
\begin{align*}
  \sigma(12)
&=(1+2+4)\cdot(1+3)\\
&=(1+2+2^2)\cdot(1+3)\\
&=\frac{2^3-1}{2-1}\cdot\frac{3^2-1}{3-1}.
\end{align*}
These ideas work in general:

\begin{theorem}\label{thm:st}
If $n
=p_1{}^{k(1)}\cdot p_2{}^{k(2)}\dotsm p_n{}^{k(n)}
%=\prod_{j=1}^np_j{}^{k(j)}
$,
where $p_1<p_2<\dots<p_n$, then
\begin{align*}
  \tau(n)
%&=(k(1)+1)\cdot(k(2)+1)\dotsm(k(n)+1),\\
&=\prod_{j=1}^n{}(k(j)+1),&
\sigma(n)
%&=(1+p_1+p_1{}^2+\dots+p_1{}^{k(1)})\cdot(1+p_2+p_2{}^2+\dots+p_2{}^{k(2)})\dotsm\\
&%=\prod_{j=1}^n\sum_{i=0}^{k(j)}p_j{}^i
%&=\frac{p_1{}^{k(1)+1}-1}{p_1-1}\cdot
%\frac{p_2{}^{k(2)+1}-1}{p_2-1}\dotsm
%\frac{p_n{}^{k(n)+1}-1}{p_n-1}
=\prod_{j=1}^n\frac{p_j{}^{k(j)+1}-1}{p_j-1}.
\end{align*}
\end{theorem}

We can abbreviate the definitions of $\sigma$ and $\tau$ as follows:
\begin{align*}
  \sigma(n)&=\sum_{d\divides n}d,&
\tau(n)&=\sum_{d\divides n}1.
\end{align*}
Implicitly here, $d$ ranges over the \emph{positive} divisors of $n$.

Is there a relation between $\sigma(n)$ and $\tau(n)$?  We have
\begin{equation*}
  \begin{array}{c|c|c|l}
n & \tau(n) & \sigma(n) & \displaystyle\prod_{d\divides n}d\\\hline
1&1&1&1\\
2&2&3&2\\
3&2&4&3\\
4&3&7&8=2^3=4^{3/2}\\
5&2&6&5\\
6&4&12&36=6^2\\
7&2&8&7\\
8&4&15&64=8^2\\
9&3&13&27=3^3=9^{3/2}\\
10&4&18&100=10^2
  \end{array}
\end{equation*}
It appears that
\begin{equation*}
  \prod_{d\divides n}d=n^{\tau(n)/2}.
\end{equation*}
We can prove it thus:
\begin{equation*}
  \Bigl(\prod_{d\divides n}d\Bigr)^2
= \Bigl(\prod_{d\divides n}d\Bigr)\cdot \Bigl(\prod_{d\divides
  n}d\Bigr)
= \Bigl(\prod_{d\divides n}d\Bigr)\cdot \Bigl(\prod_{d\divides
  n}\frac nd\Bigr)
= \prod_{d\divides n}n
=n^{\tau(n)}.
\end{equation*}

%\section{October 30, 2007 (Tuesday)}

Suppose $\gcd(n,m)=1$.  Then $n=p_1{}^{k(1)}\dotsm p_r{}^{k(r)}$, and
$m=q_1{}^{\ell(1)}\dotsm q_s{}^{\ell(s)}$, where the $p_i$ and $q_j$
are all distinct primes.  Hence the prime factorization of $nm$ is
\begin{equation*}
  p_1{}^{k(1)}\dotsm p_r{}^{k(r)}\cdot q_1{}^{\ell(1)}\dotsm
  q_s{}^{\ell(s)}, 
\end{equation*}
so we have
\begin{align*}
  \sigma(nm)
&=\frac{p_1{}^{k(1)+1}-1}{p_1-1}\dotsm
\frac{p_r{}^{k(r)+1}-1}{p_r-1}\cdot
\frac{q_1{}^{\ell(1)+1}-1}{q_1-1}\dotsm
\frac{q_s{}^{k(s)+1}-1}{q_s-1}\\
&=\sigma(n)\cdot\sigma(m)
\end{align*}
by Theorem~\ref{thm:st}; similarly,
$\tau(nm)=\tau(n)\cdot\tau(m)$.  We say then that $\sigma$
and $\tau$ are 
\textsl{multiplicative;} 
in general, a function $f$ on
the positive integers is 
\textbf{multiplicative}%
\index{multiplicative function}%
\index{function!multiplicative ---}
if
\begin{equation*}
  f(nm)=f(n)\cdot f(m)
\end{equation*}
whenever $n$ and $m$ are co-prime.  We do not require the identity to
hold in general.  For example,
\begin{equation*}
  \sigma(2\cdot 2)=\sigma(4)=1+2+4=7\neq
  9=(1+2)\cdot(1+2)=\sigma(2)\cdot\sigma(2). 
\end{equation*}
The identify function $n\mapsto n$ and the constant function $n\mapsto
1$ are multiplicative.  Since $\sigma(n)=\sum_{d\divides n}d$ and
$\tau(n)=\sum_{d\divides n}1$, the multiplicativity of $\sigma$ and
$\tau$ is a consequence of the following.

\begin{theorem}
  If $f$ is multiplicative, and $F$ is given by
  \begin{equation}\label{eqn:Ff}
    F(n)=\sum_{d\divides n}f(d),
  \end{equation}
then $F$ is multiplicative.
\end{theorem}

Before working out a formal proof, we can see why the theorem ought to
be true from an example.  Note first that, if $f$ is multiplicative
and \emph{non-trivial,} so that $f(n)\neq0$ for some $n$, then
\begin{equation*}
  0\neq f(n)=f(n\cdot1)=f(n)\cdot f(1),
\end{equation*}
so $f(1)=1$.
If also $f$ and $F$ are related
by~\eqref{eqn:Ff}, then
\begin{align*}
  F(36)
&=F(2^2\cdot 3^2)\\
&=f(1)+f(2)+f(4)+f(3)+f(6)+f(12)+f(9)+f(18)+f(36)\\
&=\begin{aligned}[t]
f(1)\cdot f(1)&+f(2)\cdot f(1)+f(4)\cdot f(1)+{}\\
{}+f(1)\cdot f(3)&+f(2)\cdot f(3)+f(4)\cdot f(3)+{}\\
{}+f(1)\cdot f(9)&+f(2)\cdot f(9)+f(4)\cdot f(9)
  \end{aligned}\\
&=(f(1)+f(2)+f(4))\cdot(f(1)+f(3)+f(9))\\
&=F(4)\cdot F(9).
\end{align*}

\begin{proof}[Proof of theorem]
  If $\gcd(m,n)=1$, then every divisor of $mn$ is uniquely of the form
  $de$, where $d\divides m$ and $e\divides n$.  This is because every
  \emph{prime} divisor of $mn$ is uniquely a divisor of $m$ or $n$.
  Hence
  \begin{align*}
    F(mn)
&=\sum_{d\divides mn}f(d)\\
&=\sum_{d\divides m}\sum_{e\divides n}f(de)\\
&=\sum_{d\divides m}\sum_{e\divides n}f(d)\cdot f(e)\\
&=\sum_{d\divides m}f(d)\cdot\sum_{e\divides n}f(e)\\
&=\Bigl(\sum_{d\divides m}f(d)\Bigr)\cdot\sum_{e\divides n}f(e),
  \end{align*}
which is $F(m)\cdot F(n)$ by~\eqref{eqn:Ff}.
\end{proof}

\section{M\"obius}

If $F$ is defined from $f$ as in~\eqref{eqn:Ff}, can we recover $f$
from $F$?  For example, when $f$ is $n\mapsto n$, so that $F$ is
$\sigma$, then
\begin{equation*}
  \begin{array}{r@{{}={}}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c@{}c}
\sigma(12)&1&{}+{}&2&{}+{}&3&{}+{}&4&{}+{}&6&{}+{}&12\\
\sigma(6)&1&+&2&+&3&&+&&6&&\\
\sigma(4)&1&+&2&&+&&4&&&&\\
\sigma(3)&1&&+&&3&&&&&&\\
\sigma(2)&1&+&2&&&&&&&&\\
\sigma(1)&1&&&&&&&&&&
  \end{array}
\end{equation*}
so that
\begin{equation*}
  12=\sigma(12)-\sigma(6)-\sigma(4)+\sigma(2).
\end{equation*}
Why are some terms added, others subtracted?  Why didn't we need
$\sigma(3)$ or $\sigma(1)$?
Note that $12/3=4=2^2$, a square.

We have also
\begin{equation*}
  \begin{array}{r@{{}={}}c*{14}{@{}c}}
\sigma(30)&1&{}+{}&2&{}+{}&3&{}+{}&5&{}+{}&6&{}+{}&10&{}+{}&15&{}+{}&30\\
\sigma(15)&1& &+& &3&+&5& & &+&  &&15&&\\
\sigma(10)&1&+&2& &+& &5& &+& &10&&  &&\\
 \sigma(6)&1&+&2&+&3& &+& &6& &  &&  &&\\
 \sigma(5)&1& & &+& & &5& & & &  &&  &&\\
 \sigma(3)&1& &+& &3& & & & & &  &&  &&\\
 \sigma(2)&1&+&2& & & & & & & &  &&  &&\\
 \sigma(1)&1& & & & & & & & & &  &&  &&
  \end{array}
\end{equation*}
so that
\begin{equation*}
  30=\sigma(30)-\sigma(15)-\sigma(10)-\sigma(6)
  +\sigma(5)+\sigma(3)+\sigma(2)-\sigma(1).  
\end{equation*}
Here we have $30/15=2$, $30/10=3$, and $30/6=5$: each of these numbers
has one prime factor.  But $30/5=2\cdot 3$, $30/3=2\cdot 5$, and
$30/2=3\cdot 5$; each number here has two prime factors.

The 
\textbf{M\"obius function,}%
\index{Mobius@M\"obius}%
\index{Mobius@M\"obius!--- function}%
\index{function!M\"obius function}
$\mu$, 
(named for
August Ferdinand Möbius,
1790--1868)
is given by
\begin{equation*}
  \mu(n)=
  \begin{cases}
    0,&\text{ if $p^2\divides n$ for some prime $p$};\\
(-1)^r,&\text{ if $n=p_1\dotsm p_r$, where $p_1<\dotsb< p_r$}.
  \end{cases}
\end{equation*}
In particular, $\mu(1)=1$.

\begin{lemma*}
The M\"obius function $\mu$ is multiplicative.
\end{lemma*}

\begin{proof}
Suppose $\gcd(m,n)=1$.  If
$p^2\divides mn$, then we may assume $p^2\divides m$, so
$\mu(mn)=0=\mu(m)=\mu(m)\cdot\mu(n)$.  But if $m=p_1\dotsm p_r$, and
$n=q_1\dotsm q_s$, where all factors are distinct primes, then
\begin{equation*}
\mu(mn)=(-1)^{r+s}=(-1)^r\cdot(-1)^s=\mu(m)\cdot\mu(n).\qedhere
\end{equation*}
\end{proof}

\begin{theorem}[M\"obius Inversion Formula]%
\index{Mobius@M\"obius!--- Inversion Formula}%
\index{theorem!M\"obius Inversion Formula}
  If $f$ determines $F$ by the rule~\eqref{eqn:Ff}, then $F$
  determines $f$ by the rule
  \begin{equation}\label{eqn:fF}
    f(n)=\sum_{d\divides n}\mu\Bigl(\frac nd\Bigr)\cdot F(d).
  \end{equation}
\end{theorem}

\begin{proof}
  We just start calculating:
  \begin{align*}
    \sum_{d\divides n}\mu\Bigl(\frac nd\Bigr)\cdot F(d)
&=\sum_{d\divides n}\mu\Bigl(\frac nd\Bigr)\cdot\sum_{e\divides d}f(e)\\
&=\sum_{d\divides n}\sum_{e\divides d}\mu\Bigl(\frac nd\Bigr)\cdot f(e).
  \end{align*}
For all factors $d$ and $e$ of $n$, we have
\begin{equation*}
  e\divides d\iff\frac nd\divides\frac ne.
\end{equation*}
Therefore
\begin{align*}
  \sum_{d\divides n}\mu\Bigl(\frac nd\Bigr)\cdot F(d)
&=\sum_{e\divides n}\sum_{c\divides(n/e)}\mu(c)\cdot f(e)\\
&=\sum_{e\divides n}f(e)\cdot\sum_{c\divides(n/e)}\mu(c).
\end{align*}
We want to obtain $f(n)$ from this.  It will be enough if we can show
that $\sum_{c\divides(n/e)}\mu(c)$ is $0$ unless $e=n$, in which case
the sum is $1$.  So it is enough to show
\begin{equation}\label{eqn:m}
  \sum_{d\divides n}\mu(d)=
  \begin{cases}
    1,&\text{ if }n=1;\\
0,&\text{ otherwise.}
  \end{cases}
\end{equation}
This is easy when $n=p^r$.  Indeed, we have
\begin{align*}
  \sum_{d\divides p^r}\mu(d)
&=\mu(1)+\mu(p)+\mu(p^2)+\dotsb+\mu(p^r)\\
&=  \begin{cases}
    1,&\text{ if }r=0;\\
1-1,&\text{ if }r\geq1.
  \end{cases}
\end{align*}
But also $\mu$ is
multiplicative by the lemma, so we have~\eqref{eqn:m} in general.  For, if $n\neq1$,
then $n$ has a prime factor $p$, and $n=p^r\cdot a$ for some positive
$r$, where $\gcd(a,p)=1$.  Then $\mu(n)=\mu(p^r)\cdot\mu(a)=0$.
\end{proof}

\chapter{Euler}

\section{Chinese Remainder Theorem}\label{sect:CRT-again}

The Chinese Remainder Theorem can be understood with a picture.  Since
$\gcd(5,6)=1$ for example, the Theorem gives us a solution to
\begin{equation*}
  \begin{cases}
    x\equiv a_1\pmod 5,\\
x\equiv a_2\pmod 6,
  \end{cases}
\end{equation*}
---a solution that is unique \emph{modulo} $30$.  In theory, we can
   find this solution by filling out a table diagonally as follows:
   \begin{equation*}
     \begin{array}{|r|rrrrrr|}\hline
 &0&1&2&3&4&5\\\hline
0&0& & & & & \\
1& &1& & & & \\
2& & &2& & & \\
3& & & &3& & \\
4& & & & &4& \\\hline
     \end{array},
\quad\text{ then }\quad
     \begin{array}{|r|rrrrrr|}\hline
 &0&1&2&3&4&5\\\hline
0&0& & & & &5\\
1& &1& & & & \\
2& & &2& & & \\
3& & & &3& & \\
4& & & & &4& \\\hline 
     \end{array},
   \end{equation*}
then
\begin{equation*}
     \begin{array}{|r|rrrrrr|}\hline
 &0&1&2&3&4&5\\\hline
0&0& & & & &5\\
1&6&1& & & & \\
2& &7&2& & & \\
3& & &8&3& & \\
4& & & &9&4& \\\hline 
     \end{array},
\quad\text{ then }
     \begin{array}{|r|rrrrrr|}\hline
 &0&1&2&3&4 &5 \\\hline
0&0& & & &10&5 \\
1&6&1& & &  &11\\
2& &7&2& &  &  \\
3& & &8&3&  &  \\
4& & & &9&4&   \\\hline
     \end{array},
\end{equation*}
and ultimately
\begin{equation*}
     \begin{array}{|r|rrrrrr|}\hline
 & 0& 1& 2&3 & 4& 5 \\\hline
0& 0&25&20&15&10& 5 \\
1& 6& 1&26&21&16&11\\
2&12& 7& 2&27&22&17\\
3&18&13& 8& 3&28&23\\
4&24&19&14& 9& 4&29\\\hline
     \end{array}.  
\end{equation*}
Hence, for example, a solution to $x\equiv 2\pmod 5\land x\equiv
3\pmod 6$ is $27$ (in row~$2$, column $3$).  

Making such a table is not
always practical.  But the possibility of making such a table will
enable us to establish a generalization of Fermat's Theorem.

\section{The Phi-Function}

Fermat tells that, if $\gcd(a,p)=1$, then
\begin{equation*}
  a^{p-1}\equiv1 \pmod p.
\end{equation*}
\textsl{Euler's Theorem}%
\index{Euler!---'s Theorem}%
\index{theorem!Euler's Th---}
will give us a certain function $\phi$ such
that, if $\gcd(a,n)=1$, then 
\begin{equation*}
  a^{\phi(n)}\equiv 1\pmod n.
\end{equation*}

%\section{November 1, 2007 (Thursday)}

We have defined
\begin{equation*}
  \mu(n)=(-1)^r,
\end{equation*}
if $n$ is the product of $r$ \emph{distinct} primes; otherwise,
$\mu(n)=0$.  In particular, $\mu(1)=(-1)^0=1$.  We have shown that
$\mu$ is multiplicative, that is, 
\begin{equation*}
  \mu(mn)=\mu(m)\cdot\mu(n),
\end{equation*}
provided $\gcd(m,n)=1$.  We have shown~\eqref{eqn:m}.  From this, we
have established the M\"obius Inversion Formula: if~\eqref{eqn:Ff},
then~\eqref{eqn:fF}.

Now we define a new multiplicative function, the 
\textbf{Euler phi-function,}%
\index{Euler!--- phi-function}%
\index{function!Euler phi-{}---}
named for Leonhard Euler,
1707--1783:%
\index{Euler}
 $\phi(n)$ is the number of $x$ such that $0\leq
  x<n$
  and $x$ is prime to $n$.  Then
  \begin{compactenum}
    \item
$\phi(1)=1$;
\item
$\phi(p)=p-1$;
\item
$\phi(p^r)=p^r-p^{r-1}$ when $r>0$.
  \end{compactenum}
Indeed, suppose $\gcd(a,p^r)\neq1$.  Then $\gcd(a,p^r)=p^k$ for some
positive $k$.  In particular, $p\divides a$.  Conversely, if
$p\divides a$, then $p\divides\gcd(a,p^r)$, so $\gcd(a,p^r)\neq1$.
Therefore $\phi(p^r)$ is the number of integers $x$ such that $0\leq
x<p^r$ and $p\ndivides x$; so
\begin{equation*}
  \phi(p^r)=p^r-\frac{p^r}p=p^r\cdot\Bigl(1-\frac1p\Bigr).
\end{equation*}
If we can show $\phi$ is multiplicative, and $n=p_1{}^{k(1)}\dotsm
p_r{}^{k(r)}$, then
\begin{align*}
  \phi(n)
&=\phi(p_1{}^{k(1)})\dotsm\phi(p_r{}^{k(r)})\\
&=p_1{}^{k(1)}\cdot\Bigl(1-\frac1{p_1}\Bigr)\dotsm
  p_r{}^{k(r)}\cdot\Bigl(1-\frac1{p_r}\Bigr)\\
&=p_1{}^{k(1)}\dotsm
  p_r{}^{k(r)}\cdot\Bigl(1-\frac1{p_1}\Bigr)\dotsm\Bigl(1-\frac1{p_r}\Bigr)\\
&=n\cdot\Bigl(1-\frac1{p_1}\Bigr)\dotsm\Bigl(1-\frac1{p_r}\Bigr).
\end{align*}
But again, we must show $\phi$ is multiplicative.  We do this with the
Chinese Remainder Theorem.  

Let us denote the set $\{x\in\Z\colon
0\leq x<n\}$ by $[0,n)$.  Assume $\gcd(m,n)=1$.  If $x\in[0,mn)$, then
    there is a unique $a$ in $[0,m)$ such that $x\equiv a\pmod m$;
      likewise, there is a unique $b$ in $[0,n)$ such that $x\equiv
	b\pmod n$.  Thus we have a function $x\mapsto(a,b)$ from
	$[0,mn)$ into $[0,m)\times[0,n)$.  Moreover, if $x$ is prime
	      to $mn$, then it is prime to $m$ and to $n$, so $a$ is
	      prime to $m$, and $b$ is prime to $n$.

Conversely, by the Chinese Remainder Theorem, for every $a$ in
$[0,m)$ and $b$ in $[0,n)$, there is a unique $x$ in $[0,mn)$ such
      that 
      \begin{equation*}
	\begin{cases}
	  x\equiv a\pmod m,\\
x\equiv b\pmod n.
	\end{cases}
      \end{equation*}
Moreover, if $a$ is prime to $m$, and $b$ is prime to $n$, then $x$ is
prime to $m$ and to $n$, hence to $mn$ (that is, $\lcm(m,n)$).
Therefore we have a bijection $x\mapsto(a,b)$ from the set
\begin{equation*}
  \{x\in[0,mn)\colon\gcd(x,mn)=1\}
\end{equation*}
to the set that is the Cartesian product
\begin{equation*}
  \{a\in[0,m)\colon\gcd(a,m)=1\}\times
  \{b\in[0,n)\colon\gcd(b,n)=1\}.
\end{equation*}
Therefore the sizes of these sets are equal; but by definition of
$\phi$, these sizes are $\phi(mn)$ and $\phi(m)\cdot\phi(n)$. 

The idea can be seen in a table as in \S~\ref{sect:CRT-again}.  Or consider now the table
\begin{equation*}
  \begin{array}{|r|rrrrrrr|}
\hline
 & 0& 1& 2& 3& 4& 5& 6\\\hline
0& 0& 8&16&24& 4&12&20\\
1&21& 1& 9&17&25& 5&13\\
2&14&22& 2&10&18&26& 6\\
3& 7&15&23& 3&11&19&27\\\hline
  \end{array}.
\end{equation*}
This gives the function $x\mapsto(a,b)$ from $[0,28)$ to
  $[0,4)\times[0,7)$.  For example, $18$ is in row
$2$ and column $4$, so the function takes $18$ to $(2,4)$.  As $0$ and
  $2$ are not prime to $4$, we delete rows $0$ and $2$; as $0$ is
  not prime to $7$, we delete column $0$.  The numbers remaining
  are prime to $28$; and the \emph{number} of these numbers---by
  definition, $\phi(28)$---is $2\cdot
  6$, which is $\phi(4)\cdot\phi(7)$.
\begin{equation*}
  \begin{array}{|r|ccccccc|}
\hline
 & 0& 1& 2& 3& 4& 5& 6\\\hline
0&  &  &  &  &  &  &  \\
1&  & 1& 9&17&25& 5&13\\
2&  &  &  &  &  &  &  \\
3&  &15&23& 3&11&19&27\\\hline
  \end{array}
\end{equation*}
Burton \cite{Burton} also uses a table of numbers, but written in the
usual order:
\begin{equation*}
  \begin{array}{|ccccccc|}
\hline
 0& 1& 2& 3& 4& 5& 6\\
 7& 8& 9&10&11&12&13\\
14&15&16&17&18&19&20\\
21&22&23&24&25&26&27\\\hline
  \end{array}
\end{equation*}
We can apply to this a variant of the Sieve of Eratosthenes.  First delete the multiples of $7$; these compose the first column, so we delete this:
\begin{equation*}
  \begin{array}{|ccccccc|}
\hline
  & 1& 2& 3& 4& 5& 6\\
  & 8& 9&10&11&12&13\\
  &15&16&17&18&19&20\\
  &22&23&24&25&26&27\\\hline
  \end{array}
\end{equation*}
Then the number of remaining columns is $\phi(7)$.
In each of these columns, just two numbers are prime to $4$ (since
each column contains a complete set of residues \emph{modulo}
$4$).  If we delete the numbers
\emph{not} prime to $4$, what remains is the following:
\begin{equation*}
  \begin{array}{|ccccccc|}
\hline
  & 1&  & 3&  & 5&  \\
  &  & 9&  &11&  &13\\
  &15&  &17&  &19&  \\
  &  &23&  &25&  &27\\\hline
  \end{array}
\end{equation*}
Again, there are $\phi(4)\cdot\phi(7)$ numbers left, or $\phi(28)$.

For another example, say we want to find $\phi(30)$.  As
$30=2\cdot3\cdot 5$, we write down the numbers from $0$ to $29$ (or
$1$ to $30$) and eliminate the multiples of $2$, $3$, or $5$:
\begin{equation*}
  \begin{array}{*{10}{r}}
    0&1&2&3&4&5&6&7&8&9\\
10&11&12&13&14&15&16&17&18&19\\
20&21&22&23&24&25&26&27&28&29\\\hline
     &1& &3& &5& &7& &9\\
  &11&  &13&  &15&  &17&  &19\\
  &21&  &23&  &25&  &27&  &29\\\hline
     &1& & & &5& &7& & \\
  &11&  &13&  &  &  &17&  &19\\
  &  &  &23&  &25&  &  &  &29\\\hline
     &1& & & & & &7& & \\
  &11&  &13&  &  &  &17&  &19\\
  &  &  &23&  &  &  &  &  &29\\
  \end{array}
\end{equation*}
As $8$ numbers remain, we have $\phi(30)=8$.

Our list of numbers had $10$ columns and $3$ rows.  When we eliminated
multiples of $2$ and $5$, we eliminated the columns headed by $0$,
$2$, $4$, $5$, $6$, and $8$.  The remaining columns were headed by
$1$, $3$, $7$, and $9$: four 
numbers.  Therefore $\phi(10)=4$.  In each of the remaining columns,
the entries are incongruent \emph{modulo} $3$.  Indeed, the numbers
differ by $10$ or $20$, and these are not divisible by $3$.  So, in
each column, exactly one entry is a multiple of $3$.  When it is
eliminated, there are $4\cdot 2$ entries remaining: this is
$\phi(10)\cdot\phi(3)$.  Thus, multiplicativity of $\phi$ is
established.  Alternatively, considering the Chinese Remainder Theorem, we can tabulate the numbers
from $0$ to $29$ thus:
\begin{equation*}
  \begin{array}{|r|*{10}{r}|}\hline
 & 0& 1& 2& 3& 4& 5& 6& 7& 8& 9\\\hline
0& 0&21&12& 3&24&15& 6&27&18& 9\\
1&10& 1&22&13& 4&25&16& 7&28&19\\
2&20&11& 2&23&14& 5&26&17& 8&29\\\hline
  \end{array}
\end{equation*}
Eliminating multiples of $2$, $3$, and $5$ means eliminating certain
columns \emph{and} rows:
\begin{equation*}
  \begin{array}{|r|*{10}{r}|}\hline
 & 0& 1& 2& 3& 4& 5& 6& 7& 8& 9\\\hline
0&  &  &  &  &  &  &  &  &  &  \\
1&  & 1&  &13&  &  &  & 7&  &19\\
2&  &11&  &23&  &  &  &17&  &29\\\hline
  \end{array}
\end{equation*}

\section{Euler's Theorem}

In general, we now have
\begin{align*}
  \phi(p)&=p-1;&\\
\phi(p^s)&=p^s-p^{s-1}=p\cdot\Bigl(1-\frac1p\Bigr),&&\text{ if }s>0;\\
\phi(mn)&=\phi(m)\cdot\phi(n),&&\text{ if }\gcd(m,n)=1.
\end{align*}
Hence, if $n$ has the distinct prime divisors $p_1$, \dots, $p_s$,
then
\begin{equation*}
  \phi(n)=n\cdot\prod_{k=1}^s\Bigl(1-\frac1{p_i}\Bigr).
\end{equation*}
We can write this more neatly as
\begin{equation}\label{eqn:phi-nn}
  \phi(n)=n\cdot\prod_{p\divides n}\Bigl(1-\frac1p\Bigr).
\end{equation}
For example,
\begin{equation*}
  \phi(30)=30\cdot\Bigl(1-\frac12\Bigr)\cdot\Bigl(1-\frac13\Bigr)\cdot\Bigl(1-\frac15\Bigr)=30\cdot\frac12\cdot\frac23\cdot\frac45=8.
\end{equation*}
Since $180$ has the same prime divisors as $30$, we have
\begin{equation*}
  \frac{\phi(180)}{\phi(30)}=\frac{180}{30}=6,
\end{equation*}
so $\phi(180)=6\phi(30)=48$.  But $15$ and $30$ do not have the same
prime divisors, and we cannot expect $\phi(15)/\phi(30)$ to be
$15/30$, or $1/2$; indeed, $\phi(15)=\phi(3)\cdot\phi(5)=2\cdot
4=8=\phi(30)$.  

\begin{theorem}[Euler]%
\index{Euler!---'s Theorem}%
\index{theorem!Euler's Th---}
  If $\gcd(a,n)=1$, then
  \begin{equation*}
    a^{\phi(n)}\equiv1\pmod n.
  \end{equation*}
\end{theorem}

Fermat's Theorem is the special case when $n=p$.  But we do \emph{not}
generally have $a^{\phi(n)+1}\equiv a\pmod n$ for arbitrary $a$.  For
example,
$\phi(12)=4$, but $2^5=32\equiv 8\pmod{12}$; so 
\begin{equation*}
  2^{\phi(12)+1}\not\equiv2\pmod{12}.
\end{equation*}

\begin{proof}[Proof of Euler's Theorem]
Assume $\gcd(a,n)=1$.
  We can write $\{x\in\Z\colon0\leq x<n\land\gcd(x,n)=1\}$ as
  \begin{equation*}
    \{b_1,b_2,\dots,b_{\phi(n)}\}.
  \end{equation*}
Then we can obtain $a^{\phi(n)}$ by solving the equation
\begin{equation*}
  \prod_{k=1}^{\phi(n)}(ab_k)=a^{\phi(n)}\cdot\prod_{k=1}^{\phi(n)}b_k.
\end{equation*}
As the two products 
$\prod_{k=1}^{\phi(n)}(ab_k)$ and $\prod_{k=1}^{\phi(n)}b_k$
are invertible \emph{modulo} $n$, it is enough now
to show that they are congruent 
\emph{modulo} $n$.
As $a$ is invertible \emph{modulo} $n$,
there is a function $f$ from $\{1,\dots,\phi(n)\}$ to itself
such that
\begin{equation*}
  ab_i\equiv b_{f(i)}\pmod n
\end{equation*}
for each $i$.  Moreover, if $f(i)=f(j)$, then
\begin{equation*}
  ab_i\equiv b_{f(i)}\equiv b_{f(j)}\equiv ab_j\pmod n,
\end{equation*}
so $b_i\equiv b_j\pmod n$, hence $i=j$.  So $f$ is a permutation.
Therefore
\begin{equation*}
  \prod_{k=1}^{\phi(n)}b_k\equiv
  \prod_{k=1}^{\phi(n)}b_{f(k)}\equiv
  \prod_{k=1}^{\phi(n)}(ab_k)\pmod n.\qedhere
\end{equation*}
\end{proof}

For example, to solve
\begin{equation*}
  369^{19587}x\equiv1\pmod{1000},
\end{equation*}
we compute
\begin{equation*}
  \phi(1000)=\phi(10^3)=\phi(2^3\cdot
  5^3)=\phi(2^3)\cdot\phi(5^3)=4\cdot100=400. 
\end{equation*}
Now reduce the exponent:
\begin{equation*}
  \frac{19587}{400}=48+\frac{387}{400}.
\end{equation*}
So we want to solve
\begin{align*}
  369^{387}x&\equiv1\pmod{1000},\\
x&\equiv369^{13}\pmod{1000}.
\end{align*}
Now proceed, using that $13=8+4+1=2^3+2^2+1$.  Multiplication
\emph{modulo} $1000$ requires only three columns:
\begin{gather*}
  \begin{array}[t]{@{}r@{\,}r@{\,}r@{}}
    3&6&9\\
    3&6&9\\\hline
    3&2&1\\
    1&4& \\
    7& & \\\hline
    1&6&1
  \end{array}\quad\text{ so }
369^2\equiv161\pod{1000};\quad
  \begin{array}[t]{@{}r@{\,}r@{\,}r@{}}
    1&6&1\\
    1&6&1\\\hline
    1&6&1\\
    6&6& \\
    1& & \\\hline
    9&2&1
  \end{array}\quad\text{ so }
369^4\equiv161^2\equiv921\pod{1000};\\
  \begin{array}[t]{@{}r@{\,}r@{\,}r@{}}
    9&2&1\\
    9&2&1\\\hline
    9&2&1\\
    4&2& \\
    9& & \\\hline
    2&4&1
  \end{array}\quad\text{ so }
369^8\equiv921^2\equiv241\pod{1000};\\
369^{13}\equiv369^8\cdot369^4\cdot369\equiv241\cdot921\cdot369\pod{1000};\\
  \begin{array}[t]{@{}r@{\,}r@{\,}r@{}}
    2&4&1\\
    9&2&1\\\hline
    2&4&1\\
    8&2& \\
    9& & \\\hline
    9&6&1
  \end{array}\qquad
  \begin{array}[t]{@{}r@{\,}r@{\,}r@{}}
    9&6&1\\
    3&6&9\\\hline
    6&4&9\\
    6&6& \\
    3& & \\\hline
    6&0&9
  \end{array}
\end{gather*}
So the solution is \fbox{$x\equiv609\pmod{1000}$.}

%\section{}%\asterism{}

Euler's Theorem gives a neat theoretical solution to
Chinese-Remainder-Theorem problems:  Suppose the integers $n_1$,
\dots, $n_s$ are pairwise co-prime.  Say we want to solve the system
\begin{equation*}
  \begin{cases}
    x\equiv a_1\pmod{n_1},\\
\dots\\
x\equiv a_s\pmod{n_s}.
  \end{cases}
\end{equation*}
Define
\begin{gather*}
  n=n_1\dotsm n_s;\\
N_i=\frac n{n_i}.
\end{gather*}
Then the system is solved by
\begin{equation*}
  x\equiv a_1\cdot N_1{}^{\phi(n_1)}+\dotsb+ a_s\cdot N_s{}^{\phi(n_s)}
\end{equation*}
Indeed, we have
\begin{equation*}
  N_i{}^{\phi(n_i)}\equiv
  \begin{cases}
    1\pmod{n_i};&\\
0\pmod{n_j},&\text{ if }j\neq i.
  \end{cases}
\end{equation*}

\section{Gauss's Theorem}%\asterism{}

As $\phi$ is a multiplicative function, so is the function
\begin{equation*}
  n\mapsto\sum_{d\divides n}\phi(d).
\end{equation*}
What \emph{is} this function?  The function is
determined by its values at prime powers; so look at these.  We have
\begin{align*}
\sum_{d\divides p^s}\phi(d)=\sum_{k=0}^s\phi(p^k)
&=1+\sum_{k=1}^s(p^k-p^{k-1})\\
&=1+(p-1)+(p^2-p)+\dotsb+(p^s-p^{s-1})=p^s.
\end{align*}
Thus, the equation
$\sum_{d\divides n}\phi(d)=n$
holds when $n$ is prime power.  As both sides are
\emph{multiplicative} functions of $n$, the equation holds for all
$n$.  Thus we have

\begin{theorem}[Gauss]\label{thm:Gauss}%
\index{Gauss!---'s Theorem}%
\index{theorem!Gauss's Th---}
  For all positive integers $n$,
\begin{equation}\label{eqn:sum-phi}
\sum_{d\divides n}\phi(d)=n.
\end{equation}
\end{theorem}

Note well the technique of our proof.  Since both members
of~\eqref{eqn:sum-phi} are multiplicative functions, the equation is an identity, provided it holds when $n$ is a prime power.  This technique is
frequently useful.

An alternative proof of Gauss's Theorem also demonstrates a useful technique.  Partition the set $\{0,1,\dots,n-1\}$
according to greatest common divisor with $n$.  For example, suppose
$n=12$.  We can construct a table as follows, where the rows are
labelled with the divisors of $12$.  Each number $x$ from $0$ to $11$
inclusive is assigned to row $d$, if $\gcd(x,12)=d$.
\begin{equation*}
  \begin{array}{|r|cccccccccccc|}\hline
  &0&1&2&3&4&5&6&7&8&9&10&11\\\hline
12&0& & & & & & & & & &  &  \\
 6& & & & & & &6& & & &  &  \\
 4& & & & &4& & & &8& &  &  \\
 3& & & &3& & & & & &9&  &  \\
 2& & &2& & & & & & & &10&  \\
 1& &1& & & &5& &7& & &  &11\\\hline
  \end{array}
\end{equation*}
But when $d\divides 12$, we have
\begin{equation*}
0\leq x<12\land\gcd(x,12)=d\iff\gcd\Bigl(\frac xd,\frac{12}d\Bigr)=1
\land0\leq\frac xd<\frac{12}d. 
\end{equation*}
So the number of entries in row $d$ is just
$\phi(12/d)$.  The number of entries in all rows together is $12$, so
$12=\sum_{d\divides 12}\phi(d)$.  

The last argument was not specific to $12$.  If $d\divides n$, let
\begin{equation*}
  S_d^n=\{x\colon0\leq x<n\land\gcd(x,n)=d\}.
\end{equation*}
Then $[0,n)=\bigcup_{d\divides n}S_d^n$, and the sets $S_d^n$ are
  disjoint as $d$ varies over the divisors of $n$.  Therefore
  \begin{equation}\label{eqn:n0n}
    n=\size{[0,n)}=\sum_{d\divides n}\size{S_d^n}.
  \end{equation}
But we also have
\begin{align*}
  x\in S_d^n
&\iff0\leq x<n\land\gcd(x,n)=d\\
&\iff0\leq\frac xd<\frac nd\land\gcd\Bigl(\frac xd,\frac nd\Bigr)=1\\
&\iff\frac xd\in S_1^{n/d}.
\end{align*}
So we have a bijection $x\mapsto x/d$ from $S_d^n$ to $S_1^{n/d}$,
which means
\begin{equation*}
  \size{S_d^n}=\size{S_1^{n/d}}.
\end{equation*}
Also,
\begin{equation*}
  \size{S_1^{n/d}}=\phi\Bigl(\frac nd\Bigr).
\end{equation*}
So~\eqref{eqn:n0n} now becomes
\begin{equation*}
n=\sum_{d\divides n}\phi\Bigl(\frac nd\Bigr)
=\sum_{d\divides n}\phi(d).  
\end{equation*}
Thus we have an alternative proof of Gauss's Theorem.

The idea behind the last equation is frequently useful.  For any
arithmetic function $f$, we have
\begin{equation*}
\sum_{d\divides n}f\Bigl(\frac nd\Bigr)=\sum_{d\divides n}f(d).  
\end{equation*}
This is because the function $x\mapsto n/x$ is a permutation of the
set of divisors of~$n$.  We shall use this for Theorem~\ref{thm:fnn} below.

Is there anything noticeable about the table for $n=12$?  Try $n=20$:
\begin{equation*}
  \begin{array}{|r|*{19}{p{15pt}@{}}p{15pt}|}\hline
%  \begin{array}{|r|*{19}{c@{\ }}c|}\hline
  &$0$&$1$&$2$&$3$&$4$&$5$&$6$&$7$&$8$&$9$&
    $10$&$11$&$12$&$13$&$14$&$15$&$16$&$17$&$18$&$19$\\\hline  
20&$0$& & & & & & & & & &  &  &  &  &  &  &  &  &  &  \\
10& & & & & & & & & & &$10$&  &  &  &  &  &  &  &  &  \\
 5& & & & & &$5$& & & & &  &  &  &  &  &$15$&  &  &  &  \\
 4& & & & &$4$& & & &$8$& &  &  &$12$&  &  &  &$16$&  &  &  \\
 2& & &$2$& & & &$6$& & & &  &  &  &  &$14$&  &  &  &$18$&  \\
 1& &$1$& &$3$& & & &$7$& &$9$&  &$11$&  &$13$&  &  &  &$17$&
    &$19$\\\hline     
  \end{array}
\end{equation*}
The entries are symmetric about a vertical axis, except for $0$.  Is
there a theorem here? 

\begin{theorem}
When $n>1$ and $d\divides n$, the average member of $S^n_d$ is~$n/2$:
\begin{equation*}
  \frac1{\size{S^n_d}}\sum_{x\in S^n_d}x=\frac n2.
\end{equation*}
\end{theorem}

\begin{proof}
When $n>1$, then $S^n_d$ has the permutation $x\mapsto n-x$, so
\begin{equation*}
  2\cdot\sum_{x\in S^n_d}x
=\sum_{x\in S^n_d}x+\sum_{x\in S^n_d}(n-x)
=\sum_{x\in S^n_d}(x+(n-x))
=\sum_{x\in S^n_d}n=n\cdot\size{S^n_d}.\qedhere
\end{equation*}
\end{proof}

\begin{theorem}\label{thm:fnn}
For all $n$,
\begin{equation*}
  \frac{\phi(n)}n=\sum_{d\divides n}\frac{\mu(d)}d.
\end{equation*}
\end{theorem}

\begin{proof}
Applying the M\"obius Inversion Formula to~\eqref{eqn:sum-phi} yields
\begin{equation*}
  \phi(n)
=\sum_{d\divides n}\mu\Bigl(\frac nd\Bigr)\cdot d
=\sum_{d\divides n}\mu(d)\cdot\frac nd
=n\cdot\sum_{d\divides n}\frac{\mu(d)}d.\qedhere
\end{equation*}
\end{proof}

Recalling~\eqref{eqn:phi-nn}, namely $\phi(n)=n\cdot\prod_{p\divides n}(1-1/p)$,
we have now
\begin{equation*}
  \prod_{p\divides n}\Bigl(1-\frac1p\Bigr)=\sum_{d\divides n}\frac{\mu(d)}d.
\end{equation*}
For example,
\begin{align*}
  \sum_{d\divides12}\frac{\mu(d)}d
&=\frac{\mu(1)}1+
\frac{\mu(2)}2+
\frac{\mu(3)}3+
\frac{\mu(4)}4+
\frac{\mu(6)}6+
\frac{\mu(12)}{12}\\
&=1-\frac12-\frac13+\frac16\\
&=1-\frac12-\frac13+\frac1{2\cdot3}\\
&=\Bigl(1-\frac12\Bigr)\Bigl(1-\frac13\Bigr)
=\prod_{p\divides12}\Bigl(1-\frac1p\Bigr).
\end{align*}

\chapter{Primitive roots}

\section{Order}%\asterism{}

Recall Euler's Theorem:
\begin{equation*}
  \gcd(a,n)=1\implies a^{\phi(n)}\equiv1\pmod n.
\end{equation*}
This can be improved in some cases.  For example,
$255=3\cdot5\cdot17$, so
$\phi(255)=\phi(3)\cdot\phi(5)\cdot\phi(17)=2\cdot4\cdot16=128$, and
hence
\begin{equation*}
  \gcd(a,255)=1\implies a^{128}\equiv1\pmod{255}.
\end{equation*}
But by Fermat's Theorem,
\begin{align*}
  3\ndivides a&\implies a^2\equiv1\pmod 3\implies
  a^{16}\equiv1\pmod{3};\\
  5\ndivides a&\implies a^4\equiv1\pmod 5\implies
  a^{16}\equiv1\pmod{5};\\
  17\ndivides a&\implies a^{16}\equiv1\pmod{17}.
\end{align*}
Therefore $\gcd(a,255)=1\implies a^{16}\equiv1\pmod{3,5,17}$, that is,
\begin{equation*}
  \gcd(a,255)=1\implies a^{16}\equiv1\pmod{255}.
\end{equation*}

If it exists, the 
\textbf{order}%
\index{order}
of $a$ \emph{modulo} $n$ is the least
positive $k$ such that
\begin{equation*}
  a^k\equiv1\pmod n.
\end{equation*}
If such $k$ does exist, then $a^k-1=n\cdot\ell$ for some $\ell$, so
\begin{equation*}
  a\cdot a^{k-1}-n\cdot\ell=1,
\end{equation*}
and therefore $\gcd(a,n)=1$.  Conversely, if $\gcd(a,n)=1$, then
$a^{\phi(n)}\equiv 1\pmod n$, so $a$ has an order \emph{modulo} $n$.

Assuming $\gcd(a,n)=1$, let us denote the order of $a$ \emph{modulo}
$n$ by
\begin{equation*}
  \ord na.
\end{equation*}
For example, what is $\ord{17}2$?  Just compute powers of $2$
\emph{modulo} $17$:
\begin{equation*}
  2,\ 4,\ 8,\ 16\equiv-1,\ -2,\ -4,\ -8,\ -16\equiv 1.
\end{equation*}
Then $\ord{17}2=8$.  We also have
\begin{multline*}
  3,\ 9\equiv-8,\ -24\equiv-7,\ -21\equiv-4,\ -12\equiv5,\
  15\equiv-2,\ -6,\ -18\equiv-1,\\ 
-3,\ 8,\ 7,\ 4,\ -5,\ 2,\ 6,\ 1.
\end{multline*}
So $\ord{17}3=16$.
Note how, in each computation, halfway through, we just change signs.  
%\section{November 20, 2007 (Tuesday)}
In the latter case, we computed
\begin{equation*}
  \begin{array}{|c*{8}{|r}|}\hline
    k&1&2&3&4&5&6&7&8\\\hline
3^k\pmod{17}&3&-8&-7&-4&5&-2&-6&-1\\\hline\hline
k&9&10&11&12&13&14&15&16\\\hline
3^k\pmod{17}&-3&8&7&4&-5&2&6&1\\\hline
  \end{array}
\end{equation*}
%Hence $16$ is the least positive $k$ such that $3^k\equiv1\pmod{17}$, so $\ord{17}3=16$.  
From this table, we can extract
\begin{equation*}
  \begin{array}{|c*{8}{|r}|}\hline
    k&1&2&3&4&5&6&7&8\\\hline
(-8)^k\pmod{17}&-8&-4&-2&-1&8&4&2&1\\\hline
  \end{array}
\end{equation*}
which means $\ord{17}{-8}=8$.    Likewise, $\ord{17}{-4}=4$, and
$\ord{17}{-1}=2$.  So we have
\begin{equation*}
  \begin{array}{|c*{8}{|r}|}\hline
          a & 1& 2& 3& 4& 5& 6& 7& 8\\\hline
\ord{17}  a & 1&  &16&  &  &  &  &  \\\hline
\ord{17}{-a}& 2&  &  & 4&  &  &  & 8\\\hline
  \end{array}
\end{equation*}
How can we complete the table?  For example, what is
$\ord{17}{-7}$?  Since $-7\equiv3^3\pmod{17}$, and
$\gcd(3,16)=1$, we have $\ord{17}{-7}=16$.  Likewise, $\ord{17}5=16$.
But $\ord{17}{-2}=16/\gcd(6,16)=8$, since $-2\equiv3^6\pmod{17}$.
This is by a general theorem to be proved presently.  We complete the
table thus:
\begin{equation*}
  \begin{array}{|c*{8}{|r}|}\hline
          a & 1& 2& 3& 4& 5& 6& 7& 8\\\hline
\ord{17}  a & 1& 8&16& 4&16&16&16& 8\\\hline
\ord{17}{-a}& 2& 8&16& 4&16&16&16& 8\\\hline
  \end{array}
\end{equation*}

\begin{theorem}\label{thm:ord}
  Suppose $\gcd(a,n)=1$.  Then
  \begin{enumerate}
    \item\label{item:ak1}
$a^k\equiv1\pmod n$ if and only if $\ord
      na\divides k$;
\item\label{item:nas}
$\ord n{a^s}=\ord na/\gcd(s,\ord na)$;
\item\label{item:akal}
$a^k\equiv a^{\ell}$ if and only if $k\equiv\ell\pmod{\ord na}$. 
  \end{enumerate}
\end{theorem}

\begin{proof}
  For~\eqref{item:ak1}, the reverse direction is easy.  For the
  forward direction, suppose $a^k\equiv1\pmod n$.  Now use division:
  \begin{equation*}
    k=\ord na\cdot s+r
  \end{equation*}
for some $s$ and $r$, where $0\leq r<\ord na$.  Then
\begin{equation*}
  1\equiv a^k\equiv a^{\ord na\cdot s+r}\equiv(a^{\ord na})^s\cdot
  a^r\equiv a^r\pmod n.
\end{equation*}
By minimality of $\ord na$ as an integer $k$ such that $a^k\equiv
1\pmod n$, we conclude $r=0$.  This means $\ord na\divides
k$.

To prove~\eqref{item:nas}, by~\eqref{item:ak1} we have, \emph{modulo} $n$,
\begin{equation*}
  (a^s)^k\equiv 1\iff a^{sk}\equiv1\iff \ord na\divides
  sk\iff\frac{\ord na}{\gcd(s,\ord na)}\divides k,
\end{equation*}
but also
\begin{equation*}
  (a^s)^k\equiv 1\iff \ord n{a^s}\divides k
\end{equation*}
Hence
\begin{equation*}
  \frac{\ord na}{\gcd(s,\ord na)}\divides k\iff
\ord n{a^s}\divides k.
\end{equation*}
This is true for all $k$.  Since orders are
  positive, we conclude
\begin{equation*}
  \frac{\ord na}{\gcd(s,\ord na)}=
\ord n{a^s}.
\end{equation*}
Finally,~\eqref{item:akal} follows from~\eqref{item:ak1}, since
\begin{align*}
  a^k\equiv a^{\ell}\pmod n&\iff a^{k-\ell}\equiv 1\pmod n\\
&\iff\ord na\divides k-\ell\\
&\iff k\equiv\ell\pmod{\ord na}.
\end{align*}
(We have used that $\gcd(a,n)=1$, so that $a^{-\ell}$ exists.)
\end{proof}

Hence, from
\begin{equation*}
  \begin{array}{|c*{9}{|r}|}\hline
    k&1&2&3&4&5&6&7&8&9\\\hline
2^k\pmod{19}&2&4&8&-3&-6&7&-5&9&-1\\\hline
2^{k+9}\pmod{19}&-2&-4&-8&3&6&-7&5&-9&1\\\hline
  \end{array}
\end{equation*}
we obtain
\begin{equation*}
  \begin{array}{|c*{9}{|r}|}\hline
a&1&2&3&4&5&6&7&8&9\\\hline
\ord{19}a&1&18&18&9&9&9&3&6&9\\\hline
\ord{19}{-a}&2&9&9&18&18&18&6&3&18\\\hline
  \end{array}
\end{equation*}
since
\begin{align*}
  \ord{19}{2^k}=18
&\iff\gcd(k,18)=1\\
&\iff k\equiv1,5,7,11,13,17\pmod{18}\\
&\iff 2^k\equiv2,-6,-5,-4,3,-9\pmod{19};\\
\ord{19}{2^k}=9
&\iff\gcd(k,18)=2\\
&\iff k\equiv2,4,8,10,14,16\pmod{18}\\
&\iff 2^k\equiv4,-3,9,-2,6,5\pmod{19},\\
\ord{19}{2^k}=6
&\iff\gcd(k,18)=3\\
&\iff k\equiv3,15\pmod{18}\\
&\iff 2^k\equiv8,-7\pmod{19},\\
\ord{19}{2^k}=3
&\iff\gcd(k,18)=6\\
&\iff k\equiv6,12\pmod{18}\\
&\iff 2^k\equiv7,-8\pmod{19},\\
\ord{19}{2^k}=2
&\iff\gcd(k,18)=9\\
&\iff k\equiv9\pmod{18}\\
&\iff 2^k\equiv-1\pmod{19}.
\end{align*}
If $d\divides 18$, let $\psi_{19}(d)$ be the number of incongruent residues
\emph{modulo} $19$ that have order $d$.  Then we have
\begin{equation*}
  \begin{array}{|r|r|}\hline
d&\psi_{19}(d)\\\hline
18&6\\\hline
9&6\\\hline
6&2\\\hline
3&2\\\hline
2&1\\\hline
1&1\\\hline
  \end{array}
\end{equation*}
Note that $\psi_{19}(d)=\phi(d)$ here.  This is no accident, by Theorem~\ref{thm:psi-phi} below.

\section{Groups}%\asterism{}

We can understand what we are doing algebraically as follows.  The set
of congruence classes \emph{modulo} $n$ is denoted by
\begin{equation*}
  \Zmod
\end{equation*}
or $\Z/(n)$ or $\Z/n\Z$.  On this set, by Theorem~\ref{thm:+.mod-n}, addition and multiplication are
well-defined: the set is a 
\textbf{ring.}%
\index{ring}  The set of multiplicatively
invertible elements of the ring is denoted by
\begin{equation*}
  \Zmodu.
\end{equation*}
This set is closed under multiplication and inversion: it is a
(multiplicative) 
\textbf{group.}%
\index{group}
Suppose $k\in\Zmodu$.
(More precisely one might write the element as $k+(n)$ or $\bar k$.)
Then we have the function
\begin{equation*}
  x\mapsto k^x
\end{equation*}
from $\Z$ to $\Zmodu$.  Since $k^{x+y}=k^x\cdot k^y$, this
function is a 
\textbf{homomorphism}%
\index{homomorphism}%
\index{function!homomorphism}
from the additive group $\Z$ to the
multiplicative group $\Zmodu$.

We have shown that the function $x\mapsto 2^x$ is
surjective onto $\Zmodu[19]$, and its kernel is $(18)$.  Call this function $f_2$.  Then
(by the First Isomorphism Theorem for Groups) $f_2$ is an
\textbf{isomorphism}%
\index{isomorphism}%
\index{function!isomorphism}
from $\Zmod[18]$ onto $\Zmodu[19]$:
\begin{align*}
  \Zmod[18]&\cong\Zmodu[19],\\
(\{0,1,2,\dots,17\},+)&\cong(\{1,2,3,\dots,18\},{}\cdot{}).
\end{align*}
We have
\begin{equation*}
\begin{array}{|c*{9}{|r}|}\hline
x&0&1&2&3&4&5&6&7&8\\\hline
f_2(x)&1&2&4&8&16&13&7&14&9\\\hline
f_2(x+9)&18&17&15&11&3&6&12&5&10\\\hline
\end{array}
\end{equation*}

\section{Primitive roots of primes}%\asterism{}

If $\gcd(a,n)=1$, and $\ord na=\phi(n)$, then $a$ is called a
\textbf{primitive root}%
\index{primitive root}
of $n$.  So we have shown that $3$, but not
$2$, is a primitive root of $17$, and $2$ is a primitive root of
$19$.  There is no formula for determining primitive roots: we just
have to look for them.  But once we know that $2$ is a primitive root
of $19$, then we know that $2^5$, $2^7$, $2^{11}$, $2^{13}$, and $2^{17}$
are primitive roots---or rather, $-6$, $-5$, $-4$, $3$, and $-9$ are
primitive roots.  In particular, the number of primitive roots of $19$
is $\phi(18)$.  

To prove generally that the number of primitive roots of $p$ is
$\phi(p-1)$, we shall need the following (attributed to
Joseph-Louis Lagrange,
1736--1813.)%
\index{Lagrange, ---'s Theorem}%
\index{theorem!Lagrange's Th---}

\begin{theorem}[Lagrange]\label{thm:Lagrange-n}%
  Every congruence of the form
  \begin{equation*}
    x^n+a_1x^{n-1}+\dotsb+a_{n-1}x+a_n\equiv0\pmod p
  \end{equation*}
has $n$ solutions or fewer (\emph{modulo} $p$).
\end{theorem}

\begin{proof}
  Use induction.  The claim is easily true when $n=1$.  Suppose it
  is true when $n=k$.  Say the congruence
  \begin{equation}\label{eqn:x^(k+1)}
    x^{k+1}+a_1x^k+\dotsb+a_kx+a_{k+1}\equiv0\pmod p
  \end{equation}
has a solution $b$.  Then we can factorize the left member, and
rewrite the congruence as
\begin{equation*}
  (x-b)\cdot(x^k+c_1x^{k-1}+\dotsb+c_{k-1}x+c_k)\equiv0\pmod p.
\end{equation*}
Any solution to this that is different from $b$ is a solution of
\begin{equation*}
  x^k+c_1x^{k-1}+\dotsb+c_{k-1}x+c_k\equiv0\pmod p.
\end{equation*}
But by inductive hypothesis, there are at most $k$ such solutions.
Therefore~\eqref{eqn:x^(k+1)} has at most $k+1$ solutions.  This
completes the induction and the proof.
\end{proof}

How did we use that $p$ is prime?  We needed
to know that, if $f(x)$ and $g(x)$ are polynomials, and $f(a)\cdot
g(a)\equiv0\pmod p$, then either $f(a)\equiv0\pmod p$, or else
$g(a)\equiv0\pmod p$.  That is, if $mn\equiv0\pmod p$, then either
$m\equiv0\pmod p$ or $n\equiv0\pmod p$.  That is, if $p\divides mn$,
then $p\divides m$ or $p\divides n$.  This fails if $p$ is replaced by
a composite number.

\begin{theorem}\label{thm:psi-phi}
If $d\divides p-1$, let $\psi_p(d)$ be the number of incongruent
residues \emph{modulo} $p$ that have order $d$.  Then
\begin{equation*}
\psi_p(d)=\phi(d).
\end{equation*}
\end{theorem}

\begin{proof}
Every number prime to $p$ has an order \emph{modulo} $p$, and this
order divides $\phi(p)$, which is $p-1$; so
\begin{equation*}
  \sum_{d\divides p-1}\psi_p(d)=p-1.
\end{equation*}
By Gauss's Theorem, \ref{thm:Gauss}, we have $\sum_{d\divides p-1}\phi(d)=p-1$;
therefore
\begin{equation}\label{eqn:sum_d|p-1}
  \sum_{d\divides p-1}\psi_p(d)=\sum_{d\divides p-1}\phi(d).
\end{equation}
Hence, to establish $\psi_p(d)=\phi(d)$, it is enough to show that
$\psi_p(d)\leq\phi(d)$ whenever $d\divides p-1$.  Indeed, if we show
this, but $\psi_p(e)<\phi(e)$ for some divisor $e$ of $p-1$, then
\begin{equation*}
  \sum_{d\divides p-1}\psi_p(d)
=\sum_{\substack{d\divides p-1\\d\neq e}}\psi_p(d)+\psi_p(e)
<\sum_{\substack{d\divides p-1\\d\neq e}}\phi(d)+\phi(e)
=  \sum_{d\divides p-1}\phi(d),
\end{equation*}
contradicting~\eqref{eqn:sum_d|p-1}.

If $\psi_p(d)=0$, then certainly $\psi_p(d)\leq\phi(d)$.  So suppose
$\psi_p(d)\neq0$.  Then $\ord pa=d$ for some $a$.  In particular, $a$
is a solution of the congruence
\begin{equation}\label{eqn:x^n-1}
  x^d-1\equiv0\pmod p.
\end{equation}
But then every power of $a$ is a solution, since $(a^k)^n=(a^n)^k$.
Moreover, if $0< k<\ell\leq d$, then 
\begin{equation*}
  a^k\not\equiv a^{\ell}\pmod p
\end{equation*}
by Theorem~\ref{thm:ord}.  Hence the numbers $a$, $a^2$, \dots, $a^d$
are incongruent solutions to the congruence~\eqref{eqn:x^n-1}.  Moreover, by
Lagrange's Theorem, \ref{thm:Lagrange-n}, every solution is congruent to one of these solutions.
Among these
solutions, those that have order $d$ \emph{modulo} $p$ are just
those powers $a^k$ such that $\gcd(k,d)=1$, again by Theorem~\ref{thm:ord}.  The number of such powers
is just $\phi(d)$.  Therefore $\psi_p(d)=\phi(d)$, under the
assumption $\psi_p(d)>0$; in any case, $\psi_p(d)\leq\phi(d)$.
\end{proof}

\begin{corollary}
  Every prime number has a primitive root.
\end{corollary}

\begin{proof}
$\psi_p(p-1)=\phi(p-1)\geq1$.
\end{proof}

From analysis, we have the exponential function $x\mapsto\me^x$ or $\exp$ from $\R$ to $\units{\R}$,
where $\units{\R}=\R\setminus\{0\}$ (the multiplicatively invertible
real numbers).  We have
\begin{equation*}
\exp(x+y)=\exp(x)\cdot\exp(y).  
\end{equation*}
The range of
$\exp$ is the interval $(0,\infty)$, which is closed under multiplication and
inversion.  Also $\exp$ is injective.  So $\exp$ is an isomorphism from $(\R,+)$ onto
$((0,\infty),{}\cdot{})$.

We have been looking at a similar
isomorphism in discrete mathematics.  If $a$ is a primitive root of $n$, then $x\mapsto a^x$ is an isomorphism from $\Zmod[\phi(n)]$ to $\Zmodu$.  In particular, a prime $p$ does have a primitive root $a$, and then $x\mapsto a^x$ is an isomorphism from $\Zmod[p-1]$ to $\Zmodu[p]$.  Therefore $\Zmodu[p]$ is a cyclic group, and $\Zmodu$ is cyclic if and only if $n$ has a primitive root.

For example:
\begin{compactenum}
  \item
$\Zmodu[2]=\{1\}$, so $1$ is a primitive root of $2$.
\item
$\Zmodu[3]=\{1,2\}$, and $2^2\equiv1\pmod3$, so $2$ is a primitive
  root of $3$.
\item
$\Zmodu[4]=\{1,3\}$, and $3^2\equiv1\pmod4$, so $3$ is a primitive
  root of $4$.
\item
$\Zmodu[5]=\{1,2,3,4\}$, and $2^2\equiv4$, $2^3\equiv3$, and
  $2^4\equiv1\pmod 5$, so $2$ is a primitive root of $5$.
\item
$\Zmodu[6]=\{1,5\}$, and $5^2\equiv1\pmod6$, so $5$ is a primitive
  root of $6$.
\item
$\Zmodu[7]=\{1,2,3,4,5,6\}$, and we have
  \begin{equation*}
    \begin{array}{|c*{6}{|r}|}\hline
k  &1&2&3&4&5&6\\\hline
2^k&2&4&1& & & \\\hline
3^k&3&2&6&4&5&1\\\hline      
    \end{array}
  \end{equation*}
so $3$ (but not $2$) is a primitive root of $7$.
\item
$\Zmodu[8]=\{1,3,5,7\}$, but $3^2\equiv1$, $5^2\equiv1$, and
  $7^2\equiv1\pmod 8$, so $8$ has no primitive root.
\end{compactenum}

We have shown that primes have
primitive roots, but the converse
fails: not every number with a primitive root is prime.  In fact, we shall show in \S~\ref{sect:comp-roots} that the
following numbers have primitive roots:
\begin{compactenum}
  \item
powers of odd primes;
\item
$2$ and $4$;
\item
doubles of powers of odd primes.
\end{compactenum}

%%\section{November 27, 2007 (Tuesday)}

%[Exam day; I work problems only.]

%\section{November 29, 2007 (Thursday)}

\section{Discrete logarithms}

  The inverse of the function $\exp$ from $\R$ onto $(0,\infty)$ is the logarithm function $\log$, where as noted in \S~\ref{sect:unproved}, $\log x=\int_1^x(\mathrm dt/t)$.  More precisely, this function $\log$ is $\log_{\me}$ or $\ln$, since the notation $\log$ is sometimes used for $\log_{10}$, that is, the inverse of $x\mapsto 10^x$.
  
  We can use similarly terminology for the inverse of an isomorphism $x\mapsto b^x$ from $\Zmod[p-1]$ to $\Zmodu[p]$.  Here $b$ must be a primitive root of $p$, and if $b^x\equiv y\pod p$, we can write
  \begin{equation*}
x\equiv\log_by\pmod{(p-1)}.
\end{equation*}
For example,
\emph{modulo} $17$, we have 
\begin{equation*}
  \begin{array}{*{17}{|r}|}\hline
  k&0&1&2& 3& 4&5& 6& 7& 8& 9&10&11&12&13&14&15\\\hline
3^k&1&3&9&10&13&5&15&11&16&14& 8& 7& 4&12& 2& 6\\\hline
  \end{array}
\end{equation*}
Reordering, we have
\begin{equation*}
  \begin{array}{*{17}{|r}|}\hline
3^k&1& 2&3& 4&5& 6& 7& 8&9&10&11&12&13&14&15&16\\\hline
  k&0&14&1&12&5&15&11&10&2& 3& 7&13& 4& 9& 6& 8\\\hline  
  \end{array}
\end{equation*}
If $3^k=\ell$, then we can denote $k$ by $\log_3\ell$.  But we can
think of these numbers as congruence classes:
\begin{equation*}
  3^k\equiv\ell\pmod{17}\iff k\equiv\log_3\ell\pmod{16}.
\end{equation*}
The usual
properties hold:
\begin{equation*}
  \log_3(xy)\equiv\log_3x+\log_3y\pmod{16};
  \qquad\log_3{x^n}\equiv n\log_3x\pmod{16}.  
\end{equation*}
For example, 
\begin{equation*}
\log_3(11\cdot 14)\equiv\log_311+\log_314\equiv7+9\equiv16\equiv0\pmod{16},
\end{equation*}
and therefore $11\cdot14\equiv3^0\equiv1\pmod{17}$.

We can define logarithms for any modulus that has a primitive root; then the base of the logarithms will be a primitive root.  If $b$
is a primitive root of a modulus $n$, and $\gcd(a,n)=1$, then there is some $s$
such that
\begin{equation*}
  b^s\equiv a\pmod n.
\end{equation*}
Then $s$ is unique \emph{modulo} $\phi(n)$.  Indeed, by Theorem~\ref{thm:ord},
\begin{equation*}
  b^x\equiv b^y\pmod n\iff x\equiv y\pmod{\phi(n)}.
\end{equation*}
Then $\log_ba$ can be defined as the least non-negative such $s$.

Another application of logarithms, besides multiplication problems, is
congruences of the form
\begin{equation*}
  x^d\equiv a\pmod n,
\end{equation*}
again where $n$ has a primitive root $b$.
The last congruence is then equivalent to
\begin{gather*}
  \log_b(x^d)\equiv\log_ba\pmod{\phi(n)},\\
d\log_bx\equiv\log_ba\pmod{\phi(n)}.
\end{gather*}
If this is to have a solution, then we must have
\begin{equation*}
  \gcd(d,\phi(n))\divides \log_ba.
\end{equation*}
For example, let's work \emph{modulo} $7$:
\begin{equation*}
  \begin{array}{*{7}{|r}|}\hline
  k&0&1&2&3&4&5\\\hline
3^k&1&3&2&6&4&5\\\hline
  \end{array}
\quad
  \begin{array}{*{7}{|r}|}\hline
      \ell&1&2&3&4&5&6\\\hline
\log_3\ell&0&2&1&4&5&3\\\hline    
  \end{array}
\end{equation*}
Then we have, for example,
\begin{equation*}
  x^3\equiv2\pmod7
\iff3\log_3x\equiv2\pmod6,
\end{equation*}
so there is no solution, since $\gcd(3,6)=3$, and $3\ndivides 2$.
But we also have
\begin{align*}
  x^3\equiv6\pmod7
&\iff3\log_3x\equiv3\pmod6\\
&\iff\log_3x\equiv1\pmod2\\
&\iff\log_3x\equiv1,3,5\pmod6\\
&\iff x\equiv 3^1,3^3,3^5\pmod7\\
&\iff x\equiv3,6,5\pmod7.
\end{align*}
We expect no more than $3$ solutions, by the Lagrange's Theorem.  Is
there an alternative to using logarithms?  As $6\equiv3^3\pmod7$, we
have
\begin{equation*}
  x^3\equiv6\pmod7\iff x^3\equiv3^3\pmod7;
\end{equation*}
but we cannot conclude from this $x\equiv3\pmod7$.

%\section{December 4, 2007 (Tuesday)}

For congruences \emph{modulo} $11$, we can use the following table:
\begin{equation*}
  \begin{array}{|c|*{10}{|r}||c|}\hline
           k& 0& 1& 2& 3& 4& 5& 6& 7& 8& 9&\log_2\ell\mod{10}\\\hline
2^k\mod{11}&1 & 2& 4&-3& 5&-1&-2&-4& 3&-5&\ell\\\hline    
  \end{array}
\end{equation*}
We have then
\begin{align*}
  4x^{15}\equiv7\pmod{11}
&\iff4x^5\equiv7\pmod{11}\\
&\iff\log_2(4x^5)\equiv\log_27\pmod{10}\\
&\iff\log_24+5\log_2x\equiv\log_27\pmod{10}\\
&\iff2+5\log_2x\equiv7\pmod{10}\\
&\iff5\log_2x\equiv5\pmod{10}\\
&\iff\log_2x\equiv1\pmod{2}\\
&\iff\log_2x\equiv1,3,5,7,9\pmod{10}\\
&\iff x\equiv 2^1,2^3,2^5,2^7,2^9\pmod{11}\\
&\iff x\equiv2,8,10,7,6\pmod{11}.
\end{align*}
Why are there five solutions?

\begin{theorem}
  Suppose $n$ has a primitive root, $\gcd(a,n)=1$, and
\begin{equation*}
d=\gcd(k,\phi(n)).  
\end{equation*}
The 
following are equivalent:
  \begin{enumerate}
    \item\label{item:x^k}
The congruence 
\begin{equation}\label{eqn:cong}
x^k\equiv a\pmod n
\end{equation}
is soluble.
\item\label{item:d}
The congruence~\eqref{eqn:cong} has $d$ solutions.
\item\label{item:a^phi}
$a^{\phi(n)/d}\equiv1\pmod n$.
  \end{enumerate}
\end{theorem}

\begin{proof}
  The following are equivalent:
  \begin{gather*}
    x^k\equiv a\text{ is soluble }\pmod n;\\
k\log x\equiv \log a\text{ is soluble }\pmod{\phi(n)};\\
d\divides\log a;\\
\phi(n)\divides\frac{\phi(n)}d\cdot\log a;\\
\frac{\phi(n)}d\cdot\log a\equiv0\pmod{\phi(n)};\\
\log(a^{\phi(n)/d})\equiv0\pmod{\phi(n)};\\
a^{\phi(n)/d}\equiv1\pmod n.
  \end{gather*}
Thus~\eqref{item:x^k}$\Leftrightarrow$\eqref{item:a^phi}.
Trivially,~\eqref{item:d}$\Rightarrow$\eqref{item:x^k}.  Finally,
assume~\eqref{item:x^k}, so that $d\divides\log a$, as above.  Letting $r$ be the base of the logarithms, we have
\begin{align*}
  x^k\equiv a\pmod n
&\iff k\log x\equiv\log a\pmod{\phi(n)}\\
&\iff\frac kd\cdot\log x\equiv\frac{\log a}d\pmod{\frac{\phi(n)}d}\\
&\iff\log x\equiv\frac{\log a}k\pmod{\frac{\phi(n)}d}\\
&\iff\begin{aligned}[t]
\log x&\equiv\frac{\log a}k+\frac{\phi(n)}d\cdot
  j\pmod{\phi(n)},\\
& \text{ where }j\in\{0,1,\dots,d-1\}
     \end{aligned}\\
&\iff
  \begin{aligned}[t]
    x&\equiv r^{(\log a)/k}\cdot(r^{\phi(n)/d})^j\pmod n,\\
&\text{ where }j\in\{0,1,\dots,d-1\}.
  \end{aligned}
\end{align*}
These $d$ solutions are incongruent, as $\ord nr=\phi(n)$.
\end{proof}

\section{Composite numbers with primitive roots}\label{sect:comp-roots}

We know that all primes have primitive roots.  Now we show that the
numbers with primitive roots are precisely:
\begin{equation*}
  2,4,p^s,2\cdot p^s,
\end{equation*}
where $p$ is an odd prime, and $s\geq1$.  We shall first show that the
numbers \emph{not} on this list do \emph{not} have primitive roots:

\begin{lemma*}
  If $k>2$, then $2\divides\phi(k)$.
\end{lemma*}

\begin{proof}
  Suppose $k>2$.  Then either $k=2^s$, where $s>1$, or else
  $k=p^s\cdot m$ for some odd prime $p$, where $s>0$ and
  $\gcd(p,m)=1$.  In the first case, $\phi(k)=2^s-2^{s-1}=2^{s-1}$,
  which is even.  In the second case, $\phi(k)=\phi(p^s)\cdot\phi(m)$,
  which is even, since $\phi(p^s)=p^s-p^{s-1}$, the difference of two
  odd numbers.
\end{proof}

\begin{theorem}
  If $m$ and $n$ are co-prime, both greater than $2$, then $mn$ has no
  primitive root.
\end{theorem}

\begin{proof}
  Suppose $\gcd(a,mn)=1$.  (This is the only possibility for a
  primitive root.)  Then $a$ is prime to $m$ and $n$, so
  \begin{gather*}
    a^{\phi(m)}\equiv 1\pmod m;\qquad
    a^{\phi(n)}\equiv 1\pmod n;\\
a^{\lcm(\phi(m),\phi(n))}\equiv 1\pmod{m,n},\\
a^{\lcm(\phi(m),\phi(n))}\equiv 1\pmod{\lcm(m,n)},\\
a^{\lcm(\phi(m),\phi(n))}\equiv 1\pmod{mn}.
  \end{gather*}
By the lemma, $2$ divides both $\phi(m)$ and $\phi(n)$, so
\begin{equation*}
  \lcm(\phi(m),\phi(n))\divides\frac{\phi(m)\phi(n)}2,
\end{equation*}
that is, $\lcm(\phi(m),\phi(n))\divides\phi(mn)/2$.  Therefore
\begin{equation*}
  \ord{mn}a\leq\frac{\phi(mn)}2,
\end{equation*}
so $a$ is not a primitive root of $mn$.
\end{proof}

\begin{theorem}
  If $k\geq1$, then $2^{2+k}$ has no primitive root.
\end{theorem}

\begin{proof}
  Any primitive root of $2^{2+k}$ must be odd.  Let $a$ be odd.  We
  shall show by induction that
  \begin{equation*}
    a^{\phi(2^{2+k})/2}\equiv1\pmod{2^{2+k}}.
  \end{equation*}
Since $\phi(2^{2+k})=2^{2+k}-2^{1+k}=2^{1+k}$, it is enough to show
\begin{equation*}
  a^{2^k}\equiv1\pmod{2^{2+k}}.
\end{equation*}
The claim is true when $k=1$, since $a^2\equiv1\pmod8$ for all odd
numbers $a$.  Suppose the claim is true when $k=\ell$: that is,
\begin{equation*}
  a^{2^{\ell}}\equiv1\pmod{2^{2+\ell}}.
\end{equation*}
This means
\begin{equation*}
  a^{2^{\ell}}=1+2^{2+\ell}\cdot m
\end{equation*}
for some $m$.  Now square:
\begin{equation*}
  a^{2^{1+\ell}}
=(a^{2^{\ell}})^2
=(1+2^{2+\ell}\cdot m)^2=1+2^{3+\ell}\cdot m+2^{4+2\ell}\cdot m^2.
\end{equation*}
Hence $a^{2^{1+\ell}}\equiv1\pmod{2^{3+\ell}}$,
so our claim is true when $k=\ell+1$.
\end{proof}

Now for the positive results.  These will use the following.

\begin{lemma*}
  Let $r$ be a primitive root of $p$, and $k>0$.  Then
  \begin{equation*}
    \ord{p^k}r=(p-1)p^{\ell}
  \end{equation*}
for some $\ell$, where $0\leq\ell<k$.
\end{lemma*}

\begin{proof}
  Let $\ord{p^k}r=n$.  Then $n\divides\phi(p^k)$.  But
  $\phi(p^k)=p^k-p^{k-1}=(p-1)\cdot p^{k-1}$.  Thus,
  \begin{equation*}
    n\divides(p-1)\cdot p^{k-1}.
  \end{equation*}
Also, $r^n\equiv1\pmod{p^k}$, so $r^n\equiv1\pmod p$, which means
$\ord pr\divides n$.  But $r$ is a primitive root of $p$, so $\ord
pr=\phi(p)=p-1$.  Therefore
\begin{equation*}
  p-1\divides n.
\end{equation*}
The claim now follows.
\end{proof}

\begin{theorem}\label{thm:p^2}
  $p^2$ has a primitive root.  In fact, if $r$ is a primitive root of
  $p$, then either $r$ or $r+p$ is a primitive root of $p^2$.
\end{theorem}

\begin{proof}
  Let $r$ be a primitive root of $p$.  If $r$ is a primitive root of
  $p^2$, then we are done.  Suppose $r$ is not a primitive root of
  $p^2$.  Then $\ord{p^2}r=p-1$, by the last lemma.  Hence,
  \emph{modulo} $p^2$, we have
  \begin{align*}
    (r+p)^{p-1}
&\equiv r^{p-1}+(p-1)\cdot r^{p-2}\cdot p+\binom{p-1}2\cdot r^{p-3}\cdot
    p^2+\dotsb\\
&\equiv r^{p-1}+(p-1)\cdot r^{p-2}\cdot p\\
&\equiv 1+(p-1)\cdot r^{p-2}\cdot p\\
&\equiv 1-r^{p-2}\cdot p\\
&\not\equiv1,
  \end{align*}
since $p\ndivides r$.  (Note that this argument holds even if $p=2$.)
Hence $\ord{p^2}{r+p}\neq p-1$, so by the lemma, the order must be
$(p-1)\cdot p$, that is, $\phi(p^2)$.  This means $r$ is a primitive
root of $p^2$.
\end{proof}

\begin{theorem}\label{thm:p^n}
  All odd prime powers (that is, all powers of odd primes) have
  primitive roots.  In fact, a primitive root of $p^2$ is a primitive
  root of every power $p^{1+k}$, where $p$ is odd.
\end{theorem}

\begin{proof}
Assume $p$ is an odd prime.
  We know $p$ and $p^2$ have primitive roots.  Let $r$ be a primitive
  root of $p^2$.  We prove by induction that $r$ is a primitive root
  of $p^{1+k}$.  The claim is trivially true when $k=1$.  Suppose it
  is true when $k=\ell$.  This means
  \begin{equation*}
    \ord{p^{1+\ell}}r=(p-1)\cdot p^{\ell}.
  \end{equation*}
In particular,
\begin{equation*}
  r^{(p-1)\cdot p^{\ell-1}}\not\equiv1\pmod{p^{1+\ell}}.
\end{equation*}
However, since $\phi(p^{\ell})=(p-1)\cdot p^{\ell-1}$, we have
\begin{equation*}
  r^{(p-1)\cdot p^{\ell-1}}\equiv 1\pmod{p^{\ell}}.
\end{equation*}
We can now conclude
\begin{equation*}
  r^{(p-1)\cdot p^{\ell-1}}=1+p^{\ell}\cdot m
\end{equation*}
for some $m$ that is indivisible by $p$.  Now raise both sides of this
equation to the power $p$:
\begin{align*}
r^{(p-1)\cdot p^{\ell}}
&=(1+p^{\ell}\cdot m)^p\\
%&=1+p\cdot p^{\ell}\cdot m+\binom p2\cdot(p^{\ell}\cdot m)^2+ \binom
%p3\cdot(p^{\ell}\cdot m)^3+\dotsb\\
&=1+p^{1+\ell}\cdot m+\binom p2\cdot p^{2\ell}\cdot m^2+ \binom
p3\cdot p^{3\ell}\cdot m^3+\dotsb.
\end{align*}
Since $p>2$, so that $p\divides\binom p2$, we have
\begin{align*}
  r^{(p-1)\cdot p^{\ell}}
&\equiv1+p^{1+\ell}\cdot m\pmod{p^{2+\ell)}}\\
&\not\equiv 1\pmod{p^{2+\ell}}.
\end{align*}
Therefore we must have
\begin{equation*}
  \ord{p^{2+\ell}}r=(p-1)\cdot p^{1+\ell}=\phi(p^{2+\ell}),
\end{equation*}
which means $r$ is a primitive root of $p^{2+\ell}$.
\end{proof}

For example, $3$ has the primitive root $2$, since
$2\not\equiv1\pmod3$, but $2^2\equiv1\pmod3$.  Hence, either $2$ or
$5$ is a primitive root of $9$, by Theorem~\ref{thm:p^2}.  In fact, both are.  Using
$5\equiv-4\pmod9$, we have:
\begin{equation*}
  \begin{array}{|c|r|r|}\hline
    k&2&3\\\hline
2^k\pmod9&4&-1\\\hline
(-4)^k\pmod9&-2&-1\\\hline
  \end{array},
\end{equation*}
so the order of $2$ and $-4$ is not $2$ or $3$ \emph{modulo} $9$; hence it must be $6$, since this is $\phi(9)$.
By Theorem~\ref{thm:p^n} then, $27$ has $6$ non-congruent primitive roots, each congruent \emph{modulo} $9$ to one of $2$ and $-4$; those roots then are $-13$, $-7$, $-4$, $2$, $5$, and $11$.  Indeed, $\phi(27)=18$ and we have
\begin{equation*}
  \begin{array}{|c|*{7}{|r}|r|}\hline
               k&  2&  3&  4&  5&  6&  7&  8& 9\\\hline
(-13)^k\pmod{27}&  7&-10& -5& 11& -8& -4& -2&-1\\\hline
 (-4)^k\pmod{27}&-11&-10& 13&  2& -8&  5&  7&-1\\\hline
    5^k\pmod{27}& -2&-10&  4& -7& -8&-13&-11&-1\\\hline
 (-7)^k\pmod{27}& -5&  8& -2& 13& 10&-11&  4&-1\\\hline
    2^k\pmod{27}&  4&  8&-11&  5& 10& -7& 13&-1\\\hline
   11^k\pmod{27}& 13&  8&  7& -4& 10&  2& -5&-1\\\hline
  \end{array}
\end{equation*}
But does $18$ have a primitive root?  The numbers $2$ and $-4$ cannot be primitive roots of $18$, since they are not prime to it;
but $\phi(18)=6$ and we have
\begin{equation*}
  \begin{array}{|c|r|r|}\hline
    k&2&3\\\hline
(-7)^k\pmod{18}&-5&-1\\\hline
5^k\pmod{18}&7&-1\\\hline
  \end{array}
\end{equation*}
so $-7$ and $5$ are primitive roots of $18$.

\begin{theorem}
  If $p$ is an odd prime, and $r$ is a primitive root of $p^s$, then
  either $r$ or $r+p^s$ is a primitive root of $2p^s$---whichever one
  is odd.
\end{theorem}

\begin{proof}
Let $r$ be an odd primitive root of $p^s$, so that $\gcd(r,2p^s)=1$.
  Let $n=\ord{2p^s}r$.  We want to show $n=\phi(2p^s)$.  We
  have
  \begin{equation*}
    n\divides\phi(2p^s).
  \end{equation*}
Also $r^n\equiv1\pmod{2p^s}$, so $r^n\equiv1\pmod{p^s}$, and therefore
\begin{equation*}
  \ord{p^s}r\divides n.
\end{equation*}
But $\ord{p^s}r=\phi(p^s)=\phi(2p^s)$.  Hence
\begin{equation*}
  \phi(2p^s)\divides n.
\end{equation*}
So $n=\phi(2p^s)$.
\end{proof}

\chapter{Quadratic reciprocity}

\section{Quadratic equations}%\asterism{}

Now we return to high-school-like problems.  With respect to the modulus $11$, let us
solve
\begin{equation}\label{eqn:241}
  x^2-4x-1\equiv0.
\end{equation}
We have $x^2-4x-1\equiv
x^2-4x-12\equiv(x-6)(x+2)$, so
the solutions to~\eqref{eqn:241} include $6$ and $-2$, or 
rather $6$ and $9$.  Since the modulus is prime, these are the \emph{only} incongruent solutions, by Lagrange's Theorem, \ref{thm:Lagrange-n}.
Alternatively, $x^2-4x-1\equiv
x^2+7x+10\equiv(x+5)(x+2)$, so $x$ is $-5$ or $-2$, that is, $6$ or
$9$ again.

To solve
\begin{equation*}
  3x^2-4x-6\equiv0\pmod{13},
\end{equation*}
we can search for a factorization as before; but we can also
\textbf{complete the square:}
\index{complete the square}
\begin{align*}
  3x^2-4x-6\equiv0
&\iff x^2-\frac43x-2\equiv0\\
&\iff x^2-\frac43x+\frac49\equiv2+\frac49\\
&\iff\Bigl(x-\frac23\Bigr)^2\equiv\frac{22}9\equiv1\\
&\iff x-\frac23\equiv\pm1\\
&\iff x\equiv\frac23\pm1\\
&\iff x\equiv\frac53\text{ or
  }\frac{-1}3\\
&\iff x\equiv6\text{ or }4.
\end{align*}
Here we can divide by $3$ and $9$ because they are invertible \emph{modulo} $13$;
indeed, $3\cdot9\equiv1\pmod{13}$, so
$1/3\equiv9$ and $1/9\equiv 3\pmod{13}$.

If we take this approach with the first problem, we have, \emph{modulo} $11$,
\begin{align*}
    x^2-4x-1\equiv0
&\iff x^2-4x+4\equiv5\\
&\iff(x-2)^2\equiv5.
\end{align*}
If $5$ is a square \emph{modulo} $11$, then there is a solution; if
not, not.  But $5\equiv16\equiv4^2$, so we have
\begin{align*}
    x^2-4x-1\equiv0
&\iff(x-2)^2\equiv4^2\\
&\iff x-2\equiv\pm4\\
&\iff x\equiv 2\pm 4\\
&\iff x\equiv 6\text{ or }9,
\end{align*}
as before.  But the congruence
\begin{equation*}
  x^2\equiv5\pmod{13}
\end{equation*}
has no solution.  How do we know?  One way is by trial.  As $2$ is a
primitive root of~$13$, and $0$ is not a solution of the congruence,
every solution would be a power of $2$.  But we have, \emph{modulo} $13$,
\begin{equation*}
  \begin{array}{*{13}{|r}|}\hline
k&0&1&2&3&4&5&6&7&8&9&10&11\\\hline
2^k&1&2&4&-5&3&6&-1&-2&-4&5&-3&-6\\\hline
2^{2k}&1&4&3&-1&-4&-3&1&4&3&-1&-4&-3\\\hline
  \end{array}
\end{equation*}
and $5$ does not appear on the bottom row.  So $5$ is not a square \emph{modulo} $13$.  Now we shall work out an easier way to find such results.

\section{Quadratic residues}

Henceforth let $p$ be an odd prime, and $\gcd(a,p)=1$.  
If $p\ndivides a$, we say $a$ is a 
\textbf{quadratic residue}%
\index{quadratic!--- residue}%
\index{residue!quadratic ---}
of $p$ if the congruence
\begin{equation*}
  x^2\equiv a\pmod p
\end{equation*}
is soluble; otherwise, $a$ is a 
\textbf{quadratic non-residue}%
\index{quadratic!--- non-residue}%
\index{residue!quadratic non-{}---}%
\index{non-residue, quadratic}
of $p$.
So we have just seen that the quadratic residues of $13$ are $\pm1$,
$\pm 3$, and $\pm4$, or rather $1$, $3$, $4$, $9$, $10$, and $12$; the
quadratic non-residues are $2$, $5$, $6$, $7$, $8$, and $11$.  So
there are six residues, and six non-residues.  We shall see that this equality is not accidental (by Theorem~\ref{thm:eq} below).

\begin{theorem}[Euler's Criterion]%
\index{Euler!---'s Criterion}%
\index{theorem!Euler's Criterion}
  Let $p$ be an odd prime, and $\gcd(a,p)=1$.  Then $a$ is a quadratic
  residue of $p$ if and only if
  \begin{equation*}
    a^{(p-1)/2}\equiv1\pmod p.
  \end{equation*}
\end{theorem}

\begin{proof}
  Let $r$ be a primitive root of $p$.  If $x^2\equiv a\pmod p$ has a
  solution, then that solution is $r^k$ for some $k$.  Then
  \begin{equation*}
    a^{(p-1)/2}\equiv((r^k)^2)^{(p-1)/2}\equiv(r^k)^{p-1}\equiv1\pmod{p}
  \end{equation*}
by Fermat's Theorem (\S~\ref{sect:FT}).

In any case, $a\equiv r^{\ell}\pmod p$ for some $\ell$.  Suppose
$a^{(p-1)/2}\equiv1\pmod p$.  Then
\begin{equation*}
  1\equiv(r^{\ell})^{(p-1)/2}\equiv r^{\ell\cdot(p-1)/2}\pmod p,
\end{equation*}
so $\ord pr\divides \ell\cdot(p-1)/2$, that is,
\begin{equation*}
  p-1\divides\ell\cdot\frac{p-1}2.
\end{equation*}
Therefore $\ell/2$ is an integer, that is, $\ell$ is even.  Say
$\ell=2m$.  Then $a\equiv r^{2m}\equiv(r^m)^2\pmod p$.
\end{proof}

What other congruence class can
$a^{(p-1)/2}$ belong to, besides $1$?  Only $-1$, since
$a^{p-1}\equiv1\pmod p$, by Fermat's Theorem.  So
$a^{(p-1)/2}\equiv-1\pmod p$ if and only if $a$ is a quadratic
non-residue of $p$.

Another way to prove this is the following:  Suppose $a$ is a
quadratic non-residue of $p$.  If $b\in\{1,\dots,p-1\}$, then the
congruence
\begin{equation*}
  bx\equiv a\pmod p
\end{equation*}
has a unique solution in $\{1,\dots,p-1\}$, and we may denote the
solution by $a/b$.  Then $b\neq a/b$, since $a$ is not a quadratic
residue of $p$.
Now we define a sequence $(b_1,\dots,b_{p-1})$
recursively.  If $b_k$ has
been chosen when $k<\ell<p-1$, then let 
$b_{\ell}$ be the least element of
$\{1,\dots,p-1\}\setminus\{b_1,a/b_1,\dots,b_{\ell-1},a/b_{\ell-1}\}$.  Note then that $a/b_{\ell}$ must be in this set too, since otherwise $a/b_{\ell}=b_k$ for some $k$ such that $k<\ell$, and then $b_{\ell}=a/b_k$.
We now have
\begin{equation*}
  \{1,\dots,p-1\}= \Bigl\{b_1,\frac a{b_1},\dots,b_{p-1},\frac
  a{b_{p-1}}\Bigr\}.
\end{equation*}
Now multiply everything together:
\begin{equation*}
  (p-1)!\equiv a^{(p-1)/2}\pmod p.
\end{equation*}
But we know $(p-1)!\equiv-1\pmod p$ by Wilson's Theorem, \ref{thm:Wilson}.  Thus
\begin{equation*}
  a^{(p-1)/2}\equiv-1\pmod p
\end{equation*}
when $a$ is a quadratic non-residue of $p$.

Now suppose $a$ is a quadratic residue of $p$.  We choose the $b_k$ as
before, except this time let $b_1$ be the least positive solution of
$x^2\equiv a\pmod p$, and replace $a/b_1$ with the next least positive
solution, which is $p-b_1$.  Multiplication now gives us
\begin{align*}
  (p-1)!
&\equiv b_1\cdot(p-b_1)\cdot b_2\cdot a/b_2\dotsm b_{(p-1)/2}\cdot
  a/b_{(p-1)/2}\\
&\equiv -a\cdot a^{(p-1)/2-1}\\
&\equiv-a^{(p-1)/2}\pmod p.
\end{align*}
By Wilson's Theorem again, we have
\begin{equation*}
  a^{(p-1)/2}\equiv 1\pmod p
\end{equation*}
when $a$ is a quadratic residue of $p$.

\begin{comment}





\section{}%\asterism{}

Recall how division works in congruences (see
p.~\ref{sect:inversion}).  We have
\begin{equation*}
  ax\equiv ay\pmod n\iff x\equiv y\pmod{\frac n{\gcd(a,n)}}.
\end{equation*}
Indeed, let $d=\gcd(a,n)$.  Then
\begin{align*}
  ax\equiv ay\pmod n
&\implies n\divides a(x-y)\\
&\implies\frac nd\divides\frac ad(x-y)\\
&\implies\frac nd\divides x-y\\
&\implies x\equiv y\pmod{\frac nd}.
\end{align*}




\end{comment}

\section{The Legendre symbol}%\asterism{}

Again, $p$ is an odd prime, and $p\ndivides a$.  We define the
\textbf{Legendre symbol}%
\index{Legendre}
\index{Legendre!--- symbol}
$(a/p)$, by
\begin{equation*}
  \ls ap=
  \begin{cases}
    1,&\text{ if $a$ is a quadratic residue of $p$};\\
-1,&\text{ if $a$ is a quadratic non-residue of $p$}.
  \end{cases}
\end{equation*}
(This is named for
Adrien-Marie Legendre, 1752--1833.)

Then by Euler's Criterion we have immediately
\begin{equation}\label{eqn:Leg-comp}
  \ls ap\equiv a^{(p-1)/2}\pmod p.
\end{equation}
The Legendre symbol easily has the following properties:
\begin{gather}\notag
a\equiv b\pmod p\implies(a/p)=(b/p),\\\notag
(a^2/p)=1,\\\notag
(1/p)=1,\\\label{eqn:cases}
(-1/p)=
  \begin{cases}
    1,&\text{ if }p\equiv 1\pmod 4,\\
-1,&\text{ if }p\equiv3\pmod 4.
  \end{cases}
\end{gather}
The last equation is equivalent to Theorem~\ref{thm:Wilson-app} above; but it now follows also by direct computation by means of~\eqref{eqn:Leg-comp}.
Finally, we have
\begin{equation*}
\ls{ab}p=\ls ap\ls bp,
\end{equation*}
since $(ab/p)\equiv(ab)^{(p-1)/2}\equiv
a^{(p-1)/2}b^{(p-1)/2}\equiv(a/p)(b/p)\pmod p$, and equality of
$(ab/p)$ and $(a/p)(b/p)$ follows since each is $\pm1$ and $p>2$.
With these properties, we can calculate many Legendre
symbols.  For example, 
\begin{gather*}
  \ls{50}{19}=\ls{12}{19}=\ls2{19}^2\ls3{19}=\ls3{19},\\
3^{(19-1)/2}\equiv 3^9\equiv 3^8\cdot3\equiv
9^4\cdot 3\equiv 81^2\cdot 3\equiv5^2\cdot 3\equiv6\cdot3\equiv
18\equiv-1\pmod{19}, 
\end{gather*}
so $(50/19)=-1$, which means the congruence $x^2\equiv50\pmod{19}$ has
no solution.

We may ask whether~\eqref{eqn:cases} has a simpler form, owing to the existence of only finitely many $p$ satisfying one of the case.  This possibility fails.

\begin{theorem}
  There are infinitely many primes $p$ such that $p\equiv3\pmod
  4$.
\end{theorem}

\begin{proof}
  Suppose $(q_1,q_2,\dots,q_n)$ is a list of primes.  We shall prove
  that there is a prime $p$, not on this list, such that
  $p\equiv3\pmod 4$.  Let
  \begin{equation*}
    s=4q_1\cdot q_2\dotsm q_n-1.
  \end{equation*}
Then $s\equiv3\pmod 4$.  Then $s$ must have a prime factor $p$ such
that $p\equiv 3\pmod 4$.  Indeed, if all prime factors of $s$ are
congruent to $1$, then so must $s$ be.  But $p$ is not any of the $q_k$.
\end{proof}

This argument fails when $3$ is replaced by $1$, since
$3^2\equiv1\pmod4$.  Nonetheless, we still have:

\begin{theorem}
  There are infinitely many primes $p$ such that $p\equiv1\pmod
  4$.  
\end{theorem}

\begin{proof}
  Suppose $(q_1,q_2,\dots,q_n)$ is a list of primes.  We shall prove
  that there is a prime $p$, not on this list, such that
  $p\equiv1\pmod 4$.  Let
  \begin{equation*}
    s=2q_1\cdot q_2\dotsm q_n.
  \end{equation*}
Then $s^2+1$ is odd, so it is divisible by some odd prime $p$, which is distinct from each of the $q_k$.
This means $s^2+1\equiv0\pmod p$, so
$s$ is a solution of the congruence $x^2\equiv-1\pmod
p$.  Then $(-1/p)=1$, so $p\equiv 1\pmod 4$,
by~\eqref{eqn:cases} above. 
\end{proof}

From the rules so far, we obtain the following table:
\begin{equation*}
  \begin{array}{|c*{12}{|r}|}\hline
     a&1&2&3&4&5&6&7&8&9&10&11&12\\\hline
(a/13)&1& &1&1& & & & &1& 1&  & 1\\\hline
  \end{array}
\end{equation*}
Indeed, under the squares $1$, $4$, and $9$, we put $1$.  Also
$4^2=16\equiv3$, so $(3/13)=1$.  Finally, by~\eqref{eqn:cases}, we have $(-1/13)=1$; or we can just compute this: $(-1)^{(13-1)/2}=(-1)^6=1$.  Hence the table will be symmeti $(13-a/13)=(-a/13)=(-1/13)\cdot(a/13)=(a/13)$;
  in particular, $(10/13)=1$ and $(12/13)=1$.  So
half of the slots have been filled with $1$.  The other half must take
$-1$, by the following.

\begin{theorem}\label{thm:eq}
For all odd primes $p$,
\begin{equation*}
\sum_{k=1}^{p-1}\ls kp=0.
\end{equation*}
\end{theorem}

\begin{proof}
  Let $r$ be a primitive root of $p$.  Then
  \begin{equation*}
    \sum_{k=1}^{p-1}\ls kp
=\sum_{k=1}^{p-1}\ls{r^k}p
=\sum_{k=1}^{p-1}\ls rp^k
=\sum_{k=1}^{p-1}(-1)^k=0,
  \end{equation*}
since $r^{(p-1)/2}\equiv-1\pmod p$, since $r$ is a primitive root.
\end{proof}

So now we have
\begin{equation*}
  \begin{array}{|c*{12}{|r}|}\hline
     a&1& 2&3&4& 5& 6& 7& 8&9&10&11&12\\\hline
(a/13)&1&-1&1&1&-1&-1&-1&-1&1& 1&1-& 1\\\hline
  \end{array}
\end{equation*}

\section{Gauss's Lemma}

\begin{lemma*}[Gauss]%
\index{lemma!Gauss's L---}%
\index{theorem!Gauss's Lemma}%
\index{Gauss!---'s Lemma}
  Let $p$ be an odd prime, and $\gcd(a,p)=1$.  Then
  \begin{equation*}
    \ls ap=(-1)^n,
  \end{equation*}
where $n$ is the number of elements of the set
\begin{equation*}
  \bigl\{a,2a,3a,\dots,\frac{p-1}2a\bigr\}
\end{equation*}
whose remainders after division by $p$ are greater than $p/2$.
\end{lemma*}

For example, to find $(3/19)$, we can look at
\begin{equation*}
  3,\; 6,\; 9,\; 12,\; 15,\; 18,\; 21,\; 24,\; 27,
\end{equation*}
whose remainders on division by $19$ are, respectively,
\begin{equation*}
  3,\; 6,\; 9,\; 12,\; 15,\; 18,\; 2,\; 5,\; 8.
\end{equation*}
Of those, $12$, $15$, and $18$ exceed $19/2$, and these are three; so
\begin{equation*}
  \ls3{19}=(-1)^3=-1.
\end{equation*}

\begin{proof}[Proof of Gauss's Lemma]
  If $1\leq k\leq p-1$, let $b_k$ be such that
  \begin{align*}
    1&\leq b_k\leq p-1,&
ka&\equiv b_k\pmod p.
  \end{align*}
Then $\{1,2,\dots,p-1\}=\{b_1,b_2,\dots,b_{p-1}\}$, because the $b_k$
are distinct:
\begin{equation*}
  b_k=b_{\ell}\iff ka\equiv\ell a\iff k\equiv\ell.
\end{equation*}
In the set $\{b_1,b_2,\dots,b_{(p-1)/2}\}$, let $n$ be the number of
elements that are greater than $p/2$.  We want to show
\begin{equation*}
  (-1)^n=\ls ap.
\end{equation*}
There is some permutation $\sigma$ of $\{1,2,\dots,(p-1)/2\}$ such that
\begin{equation*}
  b_{\sigma(1)}>b_{\sigma(2)}>\dotsb>b_{\sigma(n)}>\frac
  p2>b_{\sigma(n+1)}>\dotsb >b_{\sigma((p-1)/2)}.
\end{equation*}
Observe now that
\begin{equation*}
  b_{p-k}=p-b_k;
\end{equation*}
indeed, both numbers are in $\{1,2,\dots,p-1\}$, and
\begin{equation*}
  b_{p-k}\equiv(p-k)a\equiv-ka\equiv-b_k\equiv p-b_k\pmod p.
\end{equation*}
In particular, if $1\leq k\leq(p-1)/2$, then
$p-b_k\notin\{b_1,b_2,\dots,b_{(p-1)/2}\}$.  Since $\sigma$ just permutes the set of such $k$, we have
\begin{equation*}
\{p-b_{\sigma(1)},p-b_{\sigma(2)},\dotsc,p-b_{\sigma(n)},
b_{\sigma(n+1)},\dotsc
b_{\sigma((p-1)/2)}\}=\Bigl\{1,2,\dots,\frac{p-1}2\Bigr\}. 
\end{equation*}
Now take products:
\begin{align*}
  \frac{p-1}2!
&\equiv(p-b_{\sigma(1)})(p-b_{\sigma(2)})\dotsm(p-b_{\sigma(n)})
b_{\sigma(n+1)}\dotsm b_{\sigma((p-1)/2)}\\
&\equiv(-1)^n\cdot b_{\sigma(1)}\dotsm b_{\sigma((p-1)/2)}\\
&\equiv(-1)^n\cdot b_1\dotsm b_{(p-1)/2}\\
&\equiv(-1)^n\cdot a\cdot2a\cdot3a\dotsm\frac{p-1}2a\\
&\equiv(-1)^n\cdot\frac{p-1}2!\cdot a^{(p-1)/2}\pmod p.
\end{align*}
Therefore, since $p\ndivides((p-1)/2)!$, we have
\begin{equation*}
  1\equiv(-1)^n\cdot a^{(p-1)/2}\equiv(-1)^n\cdot(a/p)\pmod p.
\end{equation*}
As both $(-1)^n$ and $(a/p)$ are $\pm1$, the claim follows.
\end{proof}

We shall use Gauss's Lemma to prove the Law of Quadratic Reciprocity,
by which we shall be able to relate $(p/q)$ and $(q/p)$ when both $p$
and $q$ are odd primes.  Meanwhile, besides the direct application of
Gauss's Lemma to computing Legendre symbols, we have:

\begin{theorem}\label{thm:8}
  If $p$ is an odd prime, then
  \begin{equation*}
    \ls2p=
    \begin{cases}
      1,&\text{ if }p\equiv\pm1\pmod 8;\\
-1,&\text{ if }p\equiv\pm3\pmod 8.
    \end{cases}
  \end{equation*}
\end{theorem}

\begin{proof}
  To apply Gauss's Lemma, we look at the numbers
  \begin{equation*}
    2\cdot1,\;2\cdot2,\;\dotsc,\; 2\cdot\frac{p-1}2.
  \end{equation*}
Each is its own remainder on division by $p$.  Hence $(2/p)=(-1)^n$,
where $n$ is the number of integers $k$ such that
\begin{equation*}
  \frac p2<2k\leq p-1,
\end{equation*}
or rather $p/4<k\leq(p-1)/2$.  This means
\begin{equation*}
  n=\frac{p-1}2-\Bigl[\frac p4\Bigr],
\end{equation*}
where $x\mapsto[x]$ is the \textbf{greatest-integer function.}%
\index{greatest-integer function}%
\index{function!greatest-integer ---}
Now consider
the possibilities:
\begin{compactenum}
  \item
$p=8k+1\implies n=4k-[2k+1/4]=2k$, even;
\item
$p=8k+3\implies n=4k+1-[2k+3/4]=2k+1$, odd;
\item
$p=8k+5\implies n=4k+2-[2k+5/4]=4k+1$, odd;
\item
$p=8k+7\implies n=4k+3-[2k+7/4]=4k+2$, even.
\end{compactenum}
In each case then, $(2/p)$ is as claimed.
\end{proof}

As $13\equiv-3\pmod 8$, we have $(2/13)=-1$, which we found by other methods above.  We can also
use the result about $(2/p)$ to find some primitive roots.
A 
\textbf{Germain prime}%
\index{Germain, --- prime}%
\index{prime! Germain ---}
(named for Sophie Germain, 1776--1831) is an
odd prime $p$ such that $2p+1$ is also prime. 

\begin{theorem}
  If $p$ is a Germain prime, then $2p+1$ has the primitive
  root $(-1)^{(p-1)/2}\cdot2$, which is $2$ if $p\equiv1\pmod 4$, and
  is otherwise $-2$.
\end{theorem}

Hence, for example, we have
\begin{equation*}%\mbox{}\hspace{-1cm}
\setlength{\arraycolsep}{2.5pt}
  \begin{array}{*{17}{|r}|}\hline
                     p& 3& 5&11&23&29&41& 53& 83& 89&113&131&173&179&191&233\\\hline
                  2p+1& 7&11&23&47&59&83&107&167&179&227&263&347&359&383&467\\\hline
\text{p.r.\ of $2p+1$}&-2& 2&-2&-2& 2& 2&  2& -2&  2&  2& -2&  2& -2& -2&  2\\\hline
  \end{array}
\end{equation*}

\begin{proof}[Proof of theorem]
  Denote $2p+1$ by $q$.  Then $\phi(q)=2p$, whose divisors are $1$,
  $2$, $p$, and $2p$.  Let $r=(-1)^{(p-1)/2}\cdot2$.  We want to show
  $\ord qr\notin\{1,2,p\}$.  But $p\geq3$, so $q\geq7$, and hence
  $r^1,r^2\not\equiv1\pmod q$.  Hence $\ord qr\notin\{1,2\}$.  It
  remains to show $\ord qr\neq p$.  But we know, from Euler's
  Criterion,
  \begin{equation*}
    r^p\equiv r^{(q-1)/2}\equiv\ls rq\pmod q.
  \end{equation*}
So it is enough to show $(r/q)=-1$.
We consider two cases.  If $p\equiv1\pmod4$, then $r=2$, but also
$q\equiv3\pmod 8$, so $(r/q)=(2/q)=-1$.  If $p\equiv3\pmod4$, then
$r=-2$, but also $q\equiv7\pmod8$, and
$(-1/q)=(-1)^{(q-1)/2}=(-1)^p=-1$, so $(r/q)=(-2/q)=(-1/q)(2/q)=-1$.
\end{proof}

It is not known whether there
infinitely many Germain primes.

Another consequence of Theorem~\ref{thm:8} is:

\begin{theorem}
  There are infinitely many primes congruent to $-1$ \emph{modulo} $8$.
\end{theorem}

\begin{proof}
  Let $q_1$, \dots, $q_n$ be a finite list of primes.  We show that
  there is $p$ not on the list such that $p\equiv-1\pmod8$.  Let
  \begin{equation*}
    M=(4q_1\dotsm q_n)^2-2.
  \end{equation*}
Then $M\equiv-2\pmod{16}$, so $M$ is not a power of $2$; in
particular, $M$ has odd prime divisors.
Also, for every odd prime divisor $p$ of $M$, we have
\begin{equation*}
  (4q_1\dotsm q_n)^2\equiv2\pmod p,
\end{equation*}
so $(2/p)=1$, and therefore $p\equiv\pm1\pmod 8$.  Since
$M/2\equiv-1\pmod8$, we conclude that not every odd prime divisor of
$M$ can be congruent to $1$ \emph{modulo}~$8$.
\end{proof}

\section{The Law of Quadratic Reciprocity}%\asterism{}

We now aim to establish the Law of Quadratic Reciprocity:  If $p$ and
$q$ are distinct odd primes, then
\begin{equation*}
  \ls pq\cdot\ls qp=(-1)^n,\quad\text{ where }\quad
  n=\frac{p-1}2\cdot\frac{q-1}2. 
\end{equation*}
Equivalently,
\begin{equation*}
  \ls qp=
  \begin{cases}
    (p/q),&\text{ if }p\equiv1\text{ or }q\equiv 1\pmod 4;\\
   -(p/q),&\text{ if }q\equiv3\equiv p\pmod 4.
  \end{cases}
\end{equation*}
Then we shall be able to compute as follows:
\begin{align*}
  \ls{365}{941}
&=\ls{5}{941}\ls{73}{941}&&\text{[factorizing]}\\
&=\ls{941}5\ls{941}{73}&&[5,73\equiv1\pod 4]\\
&=\ls15\ls{65}{73}&&\text{[dividing]}\\
&=\ls5{73}\ls{13}{73}&&\text{[factorizing]}\\
&=\ls{73}5\ls{73}{13}&&[5,13\equiv1\pod 4]\\
&=\ls35\ls8{13}&&\text{[dividing]}\\
&=\ls53\ls2{13}^3&&\text{[$5\equiv1\pod 4$; factorizing]}\\
&=\ls23\ls2{13}&&[(p/q)^2=1]\\
&=(-1)(-1)=1&&[3\equiv3\pod8;\;13\equiv-3\pod 8].
\end{align*}

To prove the Law, we shall use the following consequence of Gauss's
Lemma:

\begin{lemma*}
  If $p$ is an odd prime, $p\ndivides a$, and $a$ is odd, then
  \begin{equation*}
    \ls ap=(-1)^n,\quad\text{ where }\quad
    n=\sum_{k=1}^{(p-1)/2}\left[\frac{ka}p\right]. 
  \end{equation*}
\end{lemma*}

\begin{proof}
  As in the proof of Gauss's Lemma, if $1\leq k\leq p-1$, we define
  $b_k$ by
  \begin{equation*}
    1\leq b_k\leq p-1\qquad\&\qquad ka\equiv b_k\pmod p.
  \end{equation*}
Then 
\begin{equation*}
  ka=p\cdot\left[\frac{ka}p\right]+b_k,
\end{equation*}
so
\begin{equation}\label{eqn:G}
  \sum_{k=1}^{(p-1)/2}ka=p\cdot\sum_{k=1}^{(p-1)/2}\left[\frac{ka}p\right]+ 
\sum_{k=1}^{(p-1)/2}b_k.
\end{equation}
For Gauss's Lemma, we introduced a permutation $\sigma$ of
$\{1,\dots,(p-1)/2\}$ such that, for some $n$,
\begin{equation*}
  b_{\sigma(1)}>\dotsb>b_{\sigma(n)}>\frac p2>b_{\sigma(n+1)}>\dotsb
  b_{\sigma((p-1)/2)},
\end{equation*}
and we showed $(a/p)=(-1)^n$ after first showing
\begin{equation*}
\Bigl\{1,2,\dots,\frac{p-1}2\Bigr\}=
\{p-b_{\sigma(1)},\dotsc,p-b_{\sigma(n)},
b_{\sigma(n+1)},\dotsc
b_{\sigma((p-1)/2)}\}. 
\end{equation*}
Now take sums:
\begin{equation*}
  \sum_{k=1}^{(p-1)/2}k=\sum_{k=1}^n(p-b_{\sigma(k)})+
  \sum_{\ell=n+1}^{(p-1)/2}b_{\sigma(\ell)}. 
\end{equation*}
Subtracting this from~\eqref{eqn:G} (and using that
$\sum_{k=1}^{(p-1)/2}b_{\sigma(k)}=
\sum_{k=1}^{(p-1)/2}b_k$)
gives
\begin{equation*}
(a-1)\cdot\sum_{k=1}^{(p-1)/2}k
=p\cdot\Bigl(\sum_{k=1}^n\left[\frac{ka}p\right]-n\Bigr)
+  2\cdot\sum_{k=1}^nb_{\sigma(k)}. 
\end{equation*}
Since $a-1$ is even, but $p$ is odd, we conclude
\begin{equation*}
  \sum_{k=1}^n\left[\frac{ka}p\right]\equiv n\pmod 2,
\end{equation*}
which yields the claim.
\end{proof}

\begin{theorem}[Law of Quadratic Reciprocity]
  If $p$ and $q$ are distinct odd primes, then
\begin{equation}\label{eqn:pqn}
\ls pq\ls qp=(-1)^n,
\end{equation}
where
\begin{equation*}
n=\frac{p-1}2\cdot\frac{q-1}2. 
\end{equation*}
\end{theorem}

This Law was:
\begin{compactitem}
\item
  conjectured by Euler, 1783;\index{Euler}
\item
  imperfectly proved by Legendre, 1785, 1798;\index{Legendre}
\item
discovered and proved independently by Gauss, 1795, at age 18.
\end{compactitem}
The following proof is due to Gauss's student Eisenstein.

\begin{proof}[Proof of Quadratic Reciprocity]
  By the lemma, we have~\eqref{eqn:pqn}, where
  \begin{equation*}
    n=\sum_{k=1}^{(q-1)/2}\left[\frac{kp}q\right]+
\sum_{\ell=1}^{(p-1)/2}\left[\frac{\ell q}p\right].
  \end{equation*}
So it is enough to show
\begin{equation*}
\frac{p-1}2\cdot\frac{q-1}2=
  \sum_{k=1}^{(q-1)/2}\left[\frac{kp}q\right]+
\sum_{\ell=1}^{(p-1)/2}\left[\frac{\ell q}p\right].
\end{equation*}
First consider the example where $p=5$ and $q=7$.  Then
\begin{gather*}
  \frac{p-1}2\cdot\frac{q-1}2=2\cdot3=6;\\
\begin{split}
  \sum_{k=1}^{(q-1)/2}\left[\frac{kp}q\right]+
\sum_{\ell=1}^{(p-1)/2}\left[\frac{\ell q}p\right]
&=
\left[\frac{5}7\right]+
\left[\frac{10}7\right]+
\left[\frac{15}7\right]+
\left[\frac{7}5\right]+
\left[\frac{14}5\right]\\
&=
0+1+2+1+2=6.
\end{split}
\end{gather*}
Here $6$ is the number of certain points in a lattice, as in Fig.~\ref{fig:qr}.
\begin{figure}[ht]
\begin{center}
  \begin{pspicture}(-1,-6)(8,1)
    \multips(0,0)(1,0){8}{\psdots[dotsize=1pt
    1](0,0)(0,-1)(0,-2)(0,-3)(0,-4)(0,-5)} 
\psline(0,0)(7,-5)
\uput[ul](0,0){$(0,0)$}
\uput[ur](7,0){$(0,7)$}
\uput[dl](0,-5){$(5,0)$}
\uput[dr](7,-5){$(5,7)$}
    \multips(1,-1)(1,0){3}{\psdots[dotsize=3pt
    1](0,0)(0,-1)} 
\uput[u](1,0){$\left[\displaystyle\frac57\right]$}
\uput[u](2,0){$\left[\displaystyle\frac{10}7\right]$}
\uput[u](3,0){$\left[\displaystyle\frac{15}7\right]$}
\uput[l](0,-1){$\left[\displaystyle\frac75\right]$}
\uput[l](0,-2){$\left[\displaystyle\frac{14}5\right]$}
  \end{pspicture}
\end{center}
  \caption[Quadratic reciprocity]{Quadratic reciprocity in case $p=5$, $q=7$.  The diagonal separates sets $A$ and $B$.  The label $\left[\frac{10}7\right]$, for example, is also the number (which is $1$) of points of $A$ that lie below it.}\label{fig:qr}
\end{figure}
In general, $((p-1)/2)\cdot((q-1)/2)$ is the number of ordered pairs
$(\ell,k)$ of integers such that
\begin{align*}
  1&\leq\ell\leq\frac{p-1}2,&
  1&\leq k\leq\frac{q-1}2.
\end{align*}
Then $\ell/k\neq p/q$, since $p$ and $q$ are co-prime.  Hence the set
of these pairs $(\ell,k)$ is a disjoint union $A\cup B$, where
\begin{align*}
  (\ell,k)\in A&\iff \frac{\ell}k<\frac pq;\\
(\ell,k)\in B&\iff\frac{\ell}k>\frac pq\iff\frac k{\ell}<\frac qp.
\end{align*}
Hence
\begin{gather*}
  A=\Bigl\{(\ell,k)\in\Z\times\Z\colon 1\leq k\leq\frac{q-1}2\land
  1\leq\ell\leq\left[\frac{kp}q\right]\Bigr\},\\
  B=\Bigl\{(\ell,k)\in\Z\times\Z\colon 1\leq\ell\leq\frac{p-1}2\land
  1\leq k\leq\left[\frac{\ell q}p\right]\Bigr\},
\end{gather*}
so
\begin{equation*}
\frac{p-1}2\cdot\frac{q-1}2=\size{A\cup B}=\size A+\size B=
  \sum_{k=1}^{(q-1)/2}\left[\frac{kp}q\right]+
\sum_{\ell=1}^{(p-1)/2}\left[\frac{\ell q}p\right].\qedhere
\end{equation*}
\end{proof}
Again, the more useful form of the theorem is
\begin{equation*}
  \ls qp=
  \begin{cases}
    (p/q),&\text{ if }p\equiv1\text{ or }q\equiv 1\pmod 4;\\
   -(p/q),&\text{ if }q\equiv3\equiv p\pmod 4.
  \end{cases}
\end{equation*}
Hence, for example,
\begin{equation*}
  \ls{47}{199}
=-\ls{199}{47}
=-\ls{11}{47}
=\ls{47}{11}
=\ls3{11}
=-\ls{11}3
=-\ls23=1.
\end{equation*}
We have used here the formula for $(2/p)$ in Theorem~\ref{thm:8}.  What about $(3/p)$?  We
can compute:
\begin{equation*}
  \ls 3p=\left\{
  \begin{aligned}
    \ls p3,&\text{ if }p\equiv1\pmod 4\\
-\ls p3,&\text{ if }p\equiv 3\pmod 4
  \end{aligned}\right\},\quad
\ls p3=
\begin{cases}
  1,&\text{ if }p\equiv1\pmod 3\\
-1,&\text{ if }p\equiv2\pmod 3.
\end{cases}
\end{equation*}
By the Chinese Remainder Theorem, we have
\begin{align*}
  \left\{
  \begin{aligned}
    p&\equiv1\pod 4\\
    p&\equiv1\pod 3
  \end{aligned}
\right\}&\iff p\equiv1\pod{12},&
  \left\{
  \begin{aligned}
    p&\equiv1\pod 4\\
    p&\equiv2\pod 3
  \end{aligned}
\right\}&\iff p\equiv5\pod{12},\\
  \left\{
  \begin{aligned}
    p&\equiv3\pod 4\\
    p&\equiv1\pod 3
  \end{aligned}
\right\}&\iff p\equiv7\pod{12},&
  \left\{
  \begin{aligned}
    p&\equiv3\pod 4\\
    p&\equiv2\pod 3
  \end{aligned}
\right\}&\iff p\equiv11\pod{12}.
\end{align*}
Actually this is not by the CRT.  Direct computation gives the leftward implications $\Leftarrow$; then the rightward implications $\Rightarrow$ follow by contraposition, so to speak.  But the CRT establishes the rightward implication in any one case, without consideration of the others.)
Therefore
\begin{equation*}
  \ls 3p=
  \begin{cases}
    1,&\text{ if }p\equiv\pm1\pmod p,\\
-1,&\text{ if }p\equiv\pm5\pmod p.
  \end{cases}
\end{equation*}

\section{Composite moduli}%\asterism{}

Assuming $\gcd(a,n)=1$, we know when the congruence $x^2\equiv a\pmod
n$ has solutions, provided $n$ is an odd prime; but what about the
other cases?  When $n=2$, then the congruence always has the solution
$1$. 
If $\gcd(m,n)=1$, and $\gcd(a,mn)=1$, then the congruence $x^2\equiv
a\pmod{mn}$ is soluble if and only if the system
\begin{equation*}
\left\{
  \begin{aligned}
    x^2&\equiv a\pmod m,\\
x^2&\equiv a\pmod n
  \end{aligned}
\right.
\end{equation*}
is soluble.  By the Chinese Remainder Theorem, the system is soluble
if and only if the individual congruences are separately soluble.
Indeed, suppose $b^2\equiv a\pmod m$, and $c^2\equiv a\pmod n$.  By
the Chinese Remainder Theorem, there is some $d$ such that $d\equiv
b\pmod m$ and $d\equiv c\pmod n$.  Then $d^2\equiv b^2\equiv a\pmod
m$, and $d^2\equiv c^2\equiv a\pmod n$, so $d^2\equiv a\pmod{mn}$. 

For example, suppose we want to solve
\begin{equation*}
  x^2\equiv365\pmod{667}.
\end{equation*}
Factorize $667$ as $23\cdot29$.  Then we first want to solve
\begin{align*}
  x^2&\equiv365\pmod{23},&
  x^2&\equiv365\pmod{29}.
\end{align*}
But we have $(365/23)=(20/23)=(5/23)=(23/5)=(3/5)=-1$ by the formula
for $(3/p)$, so the first of the two congruences is insoluble, and
therefore the original congruence is insoluble.  It doesn't matter
whether the second of the two congruences is insoluble.

Contrast with the following: $(2/11)=-1$, and
$(7/11)=-(11/7)=-(4/7)=-1$; so the congruences
\begin{align*}
  x^2&\equiv2\pmod{11},&x^2&\equiv7\pmod{11}
\end{align*}
are insoluble; but $x^2\equiv14\pmod{11}$ is soluble.

Now consider
\begin{equation*}
  x^2\equiv361\pmod{667}.
\end{equation*}
One may notice that this has the solutions $x\equiv\pm19$; but there
are others, and we can find them as follows.  We first solve
\begin{align*}
  x^2&\equiv16\pmod{23},&x^2&\equiv13\pmod{29}.
\end{align*}
The first of these is solved by $x\equiv\pm4\pmod{23}$ (and nothing
else, since $23$ is prime).  For the second, note
$13\equiv42,71,100\pmod{29}$, so $x\equiv\pm10\pmod{29}$.  So the
solutions of the original congruence are the solutions of one of the
following systems:
\begin{align*}
&  \left\{
  \begin{aligned}
    x&\equiv 4 \pmod{23},\\
    x&\equiv 10\pmod{29}
  \end{aligned}
\right\},
&&
 \left\{
  \begin{aligned}
    x&\equiv 4\pmod{23},\\
    x&\equiv -10\pmod{29}
  \end{aligned}
\right\},\\
&  \left\{
  \begin{aligned}
    x&\equiv -4\pmod{23},\\
    x&\equiv 10\pmod{29}
  \end{aligned}
\right\},
&&
 \left\{
  \begin{aligned}
    x&\equiv -4\pmod{23},\\
    x&\equiv -10\pmod{29}
  \end{aligned}
\right\}.
\end{align*}
One finds
$x\equiv\pm19, \pm280\pmod{667}$, or
 $x\equiv648,280,387,19\pmod{667}$.

So now $x^2\equiv a\pmod n$ is soluble if and only if the congruences
\begin{equation*}
  x^2\equiv a\pmod{p^{k(p)}}
\end{equation*}
are soluble, where $n=\prod_{p\divides n}p^{k(p)}$.  

\begin{theorem}
If $p$ is odd, and $a$ is prime to $p$, then the following are equivalent:
\begin{enumerate}
\item
$(a/p)=1$,
\item
the congruence
\begin{equation}\label{eqn:x2a}
x^2\equiv a\pmod{p^k}
\end{equation}
is soluble for some positive $k$,
\item
the congruence~\eqref{eqn:x2a} is soluble for all positive $k$.  
\end{enumerate}
\end{theorem}

\begin{proof}
Suppose $b^2\equiv a\pmod{p^{\ell}}$ for some positive $\ell$.  This 
  means
  \begin{equation*}
    b^2=a+c\cdot p^{\ell}
  \end{equation*}
for some $c$.  Then
\begin{align*}
  (b+p^{\ell}\cdot y)^2
&=b^2+2bp^{\ell}\cdot y+p^{2\ell}\cdot y^2\\
&=a+(c+2by)p^{\ell}+p^{2\ell}\cdot y^2
\end{align*}
Therefore
  $(b+p^{\ell}\cdot y)^2\equiv a\pmod{p^{\ell+1}}
\iff c+2by\equiv0\pmod p$.  But the latter congruence is soluble,
  since $p$ is odd.
\end{proof}

We must finally consider powers of $2$.  

\begin{theorem}
  Suppose $a$ is odd.  Then:
  \begin{enumerate}
    \item
$x^2\equiv a\pmod 2$ is soluble;
\item
$x^2\equiv a\pmod 4$ is soluble if and only if $a\equiv 1\pmod 4$;
\item
the following are equivalent:
  \begin{enumerate}
    \item\label{item:8}
$x^2\equiv a\pmod 8$ is soluble;
\item\label{item:some}
$x^2\equiv a\pmod{2^{2+k}}$ is soluble for some positive $k$;
\item\label{item:all}
$x^2\equiv a\pmod{2^{2+k}}$ is soluble for all positive $k$;
\item\label{item:a18}
$a\equiv 1\pmod 8$.
  \end{enumerate}
  \end{enumerate}
\end{theorem}

\begin{proof}
  The first two parts are easy.  So,
  are~\eqref{item:8}$\Leftrightarrow$\eqref{item:a18}
  and~\eqref{item:all}$\Rightarrow$\eqref{item:some}$\Rightarrow$\eqref{item:8}.
  We shall show~\eqref{item:8}$\Rightarrow$\eqref{item:all} by
  induction.  Suppose $b^2\equiv a\pmod{2^{2+\ell}}$ for some positive
  $\ell$.  Then $b^2=a+2^{2+\ell}\cdot c$ for some $c$.  Hence
  \begin{align*}
    (b+2^{1+\ell}\cdot y)^2
&=b^2+2^{2+\ell}\cdot by+2^{2+2\ell}\cdot y^2\\
&=a+2^{2+\ell}\cdot c+2^{2+\ell}\cdot by+2^{2+2\ell}\cdot y^2\\
&=a+2^{2+\ell}\cdot(c+by)+2^{2+2\ell}\cdot y^2,
  \end{align*}
and this is congruent to $a$ \emph{modulo} $p^{3+\ell}$ if and only if
$c+by\equiv 0\pmod 2$.  But this congruence is soluble, since $b$ is
odd (since $a$ is odd).
\end{proof}

\chapter{Lagrange}

%\section{}%\asterism{}

A \textbf{Diophantine equation}%
\index{Diophantus, Diophantine equation}
(named after Diophantus, of the 3rd century \textsc{c.e.})
is a polynomial equation with integer coefficients for which the solutions
sought are integers.  
Then
\begin{equation*}
x^2+y^2=z^2
\end{equation*}
is a Diophantine equation among whose solutions are $(3,4,5)$ and $(5,12,13)$ are solutions.  The additional condition $x=y$ yields the Diophantine equation
\begin{equation*}
2x^2=z^2,
\end{equation*}
which we know from \S~\ref{sect:incomm} is not soluble.
We considered Diophantine equations $ax+by=c$ in Chapter~\ref{ch:divisibility}.  

Now we shall show that, if $n$ is a natural
number, then the Diophantine equation
\begin{equation*}
  x^2+y^2+z^2+w^2=n
\end{equation*}
is soluble.

If $p$ is an odd prime, we know that the congruence $x^2\equiv-1\pmod
p$ is soluble if and only if $(-1/p)=1$, that is, $(-1)^{(p-1)/2}=1$,
that is, $p\equiv 1\pmod 4$.

\begin{lemma*}
  For every prime $p$, the congruence
  \begin{equation*}
    x^2+y^2\equiv-1\pmod p
  \end{equation*}
is soluble.
\end{lemma*}

\begin{proof}
  The claim is easy when $p=2$.  So assume now $p$ is odd.  We define
  two sets:
  \begin{gather*}
    A=\Bigl\{x^2\colon0\leq x\leq\frac{p-1}2\Bigr\},\\
    B=\Bigl\{-y^2-1\colon0\leq x\leq\frac{p-1}2\Bigr\}.
  \end{gather*}
We shall show that $A$ and $B$ have elements representing the same
congruence class \emph{modulo} $p$; that is, $A$ contains some $a$,
and $B$ contains some $b$, such that $a\equiv b\pmod p$.  To prove
this, note first that distinct elements of $A$ are incongruent, and
likewise of $B$.  Indeed, if $a_0$ and $a_1$ are between $0$ and
$(p-1)/2$ inclusive, and $a_0{}^2\equiv a_1{}^2\pmod p$, then
$a_0\equiv\pm a_1\pmod p$.  If $a_0\equiv-a_1$, then $a_0=p-a_1$,
which is absurd.  Hence $a_0\equiv a_1\pmod p$, so $a_0=a_1$.  

Hence the elements of $A$ represent $(p-1)/2+1$ distinct
congruence classes \emph{modulo} $p$, and so do the elements of $B$.
Since $2((p-1)/2+1)=p+1$, and there are only $p$ distinct
congruence classes \emph{modulo} $p$, there must be a class
represented both in $A$ and in $B$, by the 
\textbf{Pigeonhole Principle.}%
\index{Pigeonhole Principle}%
\index{theorem!Pigeonhole Principle}
\end{proof}

Another way to express the lemma is that, for all primes $p$, there
are $a$, $b$, and $m$ such that
\begin{equation*}
  a^2+b^2+1=mp.
\end{equation*}
Hence there are $a$, $b$, $c$, $d$, and $m$ such that
\begin{equation*}
  a^2+b^2+c^2+d^2=mp.
\end{equation*}
We shall show that we can require $m=1$.  We can combine this with the
following:

\begin{theorem}[Euler]\label{thm:Euler-4}%
\index{Euler!---'s Theorem}%
\index{theorem!Euler's Th---}
  The product of two sums of four squares is the sum of four squares.
\end{theorem}

\begin{proof}
  One can confirm that
  \begin{equation*}
    (a^2+b^2+c^2+d^2)(q^2+r^2+s^2+t^2)=
    \begin{aligned}[t]
      (aq&+br+cs+dt)^2+{}\\
(ar&-bq+ct-ds)^2+{}\\
(as&-bt-cq+dr)^2+{}\\
(at&+bs-cr-dq)^2
    \end{aligned}
  \end{equation*}
by expanding each side.
\end{proof}

\begin{theorem}[Lagrange]
  Every positive integer is the sum of four squares.
\end{theorem}

\begin{proof}
  By the lemma and Euler's Theorem (\ref{thm:Euler-4}), it is now enough to show the
  following.  Let $p$ be a prime.  Suppose $m$ is a positive integer
  such that 
  \begin{equation}\label{eqn:abcd}
    a^2+b^2+c^2+d^2=mp
  \end{equation}
for some $a$, $b$, $c$, and $d$.  We shall show that the same is true
for some smaller positive $m$, unless $m$ is already $1$.  

First we show that, if $m$ is even, then we can replace it with
$m/2$.  Indeed, if $a^2+b^2=n$, then
\begin{equation*}
  \Bigl(\frac{a+b}2\Bigr)^2+
  \Bigl(\frac{a-b}2\Bigr)^2=\frac n2,
\end{equation*}
and if $n$ is even, then so are $(a\pm b)/2$.  In~\eqref{eqn:abcd} then,
if $m$ is even, then we may assume that $a^2+b^2$ and $c^2+d^2$ are
both even, so
\begin{equation*}
  \Bigl(\frac{a+b}2\Bigr)^2+
  \Bigl(\frac{a-b}2\Bigr)^2+
  \Bigl(\frac{c+d}2\Bigr)^2+
  \Bigl(\frac{c-d}2\Bigr)^2=\frac m2\cdot p.
\end{equation*}
Henceforth we may assume $m$ is odd.  Then there are $q$, $r$, $s$ and
$t$ \emph{strictly} between $-m/2$ and $m/2$ such that
\begin{equation*}
  q\equiv a,\quad r\equiv b,\quad s\equiv c,\quad t\equiv d\pmod m.
\end{equation*}
Then
\begin{equation*}
  q^2+r^2+s^2+t^2\equiv0\pmod m,
\end{equation*}
but also
$q^2+r^2+s^2+t^2<m^2$, so
\begin{equation*}
  q^2+r^2+s^2+t^2=km
\end{equation*}
for some positive $k$ less than $m$.  We now have
\begin{equation*}
(a^2+b^2+c^2+d^2)(q^2+r^2+s^2+t^2)=km^2p.
\end{equation*}
By Euler's Theorem, we know the left-hand side as a sum of four
squares.  Moreover, by checking the proof of Euler's Theorem, we can see that each of the squared numbers in that sum is
divisible by $m$:
\begin{align*}
aq+br+cs+dt&\equiv q^2+r^2+s^2+t^2\equiv0\pmod m,\\
ar-bq+ct-ds&\equiv qr-rq+st-ts=0,\\
as-bt+cq+dr&\equiv qs-rt-sq+tr=0,\\
at+bs-cr-dq&\equiv qt+rs-sr-tq=0.
\end{align*}
Therefore we obtain $kp$ as a sum of four squares.
\end{proof}

\appendix

\chapter{Foundations of Number-Theory}\label{ch:foundations}

%\input{foundations.tex}

Theorems about natural numbers have been known for
thousands of years.  Some of these theorems come down to us in Euclid's
\emph{Elements} \cite{MR1932864}, for example, or Nicomachus's
\emph{Introduction to Arithmetic} \cite{Nicomachus}.  Certain underlying assumptions on which the proofs of these theorems are
based were apparently not worked out until more recent
centuries.   

It turns out that all theorems about the natural numbers are logical
consequences of Axiom~\ref{axiom} below.  This axiom lists five
conditions that the natural numbers meet.  Richard Dedekind published
these conditions in 1888 \cite[II, \S~71, p.~67]{MR0159773}.  In 1889,
Giuseppe Peano \cite[\S~1, p.~94]{Peano}\nocite{MR0209111} repeated
them in a more symbolic form, along with some logical
conditions, making nine conditions in all, which he called axioms.  Of
these, the five
specifically number-theoretic conditions have come to be known as
the ``Peano Axioms.''

The foundations of number-theory are often not well understood, even today.
Some books give the impression that all theorems about natural numbers
follow from the so-called ``Well Ordering Principle''
(Theorem~\ref{thm:wo}).  Others suggest that the possibility of definition by
recursion (Theorem~\ref{thm:rec}) can be proved by induction
(Axiom~\ref{axiom}\eqref{part:ind}) alone.  These are mistakes about
the foundations of number-theory.  They are perhaps not really mistakes about
number-theory itself; still, they are mistakes, and it is better not
to make them.  This is why I have written these notes.  

When proofs of lemmas and theorems here are not supplied, I have left
them to the reader as exercises.  

An expression like ``$f\colon A\to B$'' is to
be read as the statement ``$f$ is a function from $A$ to $B$.''  This
means $f$ is a
certain kind of subset of the Cartesian product $A\times B$, namely
a subset that, for each $a$ in $A$, has exactly one element of the form
$(a,b)$; then one writes $f(a)=b$.  Finally, $f$ can also be written
as $x\mapsto f(x)$.

  \begin{axdef}\label{axiom}
    The set of 
\textbf{natural numbers}%
\index{natural number}%
\index{number!natural ---}
denoted by $\N$, meets the
    following five conditions.
    \begin{compactenum}
      \item\label{part:zero}
There is a 
\textbf{first}%
\index{first natural number}%
\index{number!first natural ---, one}
 natural number, called $1$ 
(\textbf{one}%
\index{one}%
\index{number!one}).
\item\label{part:s}
Every $n$ in $\N$ has a unique 
\textbf{successor,}%
\index{successor}%
\index{number!successor}
 denoted (for now) by
$\scr n$.
\item\label{part:not}
Zero is not a successor: if $n\in\N$, then
$\scr n\neq0$.
\item\label{part:inj}
Distinct natural numbers have distinct successors: if
$n,m\in\N$ and $n\neq m$, then $\scr n\neq\scr m$.
\item\label{part:ind}
Proof by 
\textbf{induction}%
\index{induction}%
\index{proof!--- by induction}
is possible: Suppose
$A\included\N$, and two conditions are met, namely
\begin{compactenum}
  \item
the 
\textbf{base condition:}%
\index{base of induction}
 $1\in A$, and
\item
the 
\textbf{inductive condition:}%
\index{inductive condition}%
\index{inductive hypothesis} 
if $n\in A$ (the 
\textbf{inductive hypothesis}), then $\scr n\in A$.
\end{compactenum}
Then $A=\N$.
    \end{compactenum}
The natural number $\scr 1$ is denoted by $2$; the number $\scr 2$, by
$3$; \&c.
   \end{axdef}

  \begin{remark}
    Parts~\eqref{part:not}, \eqref{part:inj} and~\eqref{part:ind} of
    the axiom are
    conditions concerning a set with a first element and an operation of
    succession.  For each of those conditions, there is an
    example of such a set that meets that condition, but not
    the others.  In short, the three conditions are logically
    independent. 
  \end{remark}

  \begin{lemma}
    Every natural number is either $1$ or a successor. 
  \end{lemma}

  \begin{proof}
Let $A$ be the set comprising every natural number that is either $1$
    or a successor.  In particular, $1\in A$, and if $n\in A$, then
    (since it is a successor) $\scr n\in A$.
    Therefore, by induction, $A=\N$.
  \end{proof}

  \begin{Atheorem}[Recursion]\label{thm:rec}
    Suppose a set $A$ has an element $b$, and $f\colon A\to A$.
    Then there is a \emph{unique} function $g$ from $\N$ to $A$ such
    that
    \begin{compactenum}
      \item
$g(1)=b$, and
\item
$g(\scr n)=f(g(n))$ for all $n$ in $\N$.
    \end{compactenum}
  \end{Atheorem}

  \begin{proof}
The following is only a sketch.
One must prove existence and uniqueness of~$g$.  Assuming existence,
one can prove uniqueness by induction.  To prove existence,
let $\mathcal S$ be the set of subsets $R$ of $\N\times A$ such that
\begin{compactenum}
  \item
if $(1,c)\in R$, then $c=b$;
\item
if $(\scr n,c)\in R$, then $(n,d)\in R$ for some $d$ such that $f(d)=c$.
\end{compactenum}
Then $\bigcup\mathcal S$ is the desired function $g$.
  \end{proof}

  \begin{remark}
    In its statement (though not the proof), the Recursion Theorem
    assumes only parts~\eqref{part:zero} and~\eqref{part:s} of
    Axiom~\ref{axiom}.  The other parts can be proved as consequences
    of the Theorem.  Recursion is a method of \emph{definition;}
    induction is a method of \emph{proof.}  There are sets (with first
    elements and successor-operations) that allow proof by induction,
    but not definition by recursion.  In short, induction is logically
    weaker than recursion.
  \end{remark}

  \begin{definition}[Addition]\label{def:add}
    For each $m$ in $\N$, the operation $x\mapsto m+x$ on $\N$ is the
    function $g$ guaranteed by the Recursion Theorem when $A$ is $\N$ and
    $b$ is $m$ and $f$ is $x\mapsto\scr x$.  That is, 
    \begin{align*}
      m+1&=\scr m,\\
m+\scr n&=\scr{m+n}.
    \end{align*}
  \end{definition}

  \begin{lemma}
    For all $n$ and $m$ in $\N$,
    \begin{compactenum}
      \item
$1+n=\scr n$;
\item
$\scr m+n=\scr{m+n}$.
    \end{compactenum}
  \end{lemma}

  \begin{Atheorem}\label{thm:add}
    For all $n$, $m$, and $k$ in $\N$,
    \begin{compactenum}
\item
$n+m=m+n$;
\item
$(n+m)+k=n+(m+k)$;
    \end{compactenum}
  \end{Atheorem}

  \begin{remark}
    It is possible to prove by induction alone that an operation of
    addition with the properties described in
    \P\P\ref{def:add}--\ref{thm:add} exists uniquely. 
  \end{remark}

  \begin{definition}[Multiplication]\label{def:mul}
    For each $m$ in $\N$, the operation $x\mapsto m\cdot x$ on $\N$ is the
    function $g$ guaranteed by the Recursion Theorem when $A$ is $\N$ and
    $b$ is $1$ and $f$ is $x\mapsto x+m$.   That is,
    \begin{align*}
      m\cdot1&=m,\\
m\cdot(n+1)&=m\cdot n+m.
    \end{align*}
  \end{definition}

  \begin{lemma}
    For all $n$ and $m$ in $\N$,
    \begin{compactenum}
      \item
$1\cdot n=n$;
\item
$(m+1)\cdot n=m\cdot n+n$.
    \end{compactenum}
  \end{lemma}

  \begin{Atheorem}\label{thm:mul}
    For all $n$, $m$, and $k$ in $\N$,
    \begin{compactenum}
\item
$n\cdot m=m\cdot n$;
\item
$n\cdot(m+k)=n\cdot m+n\cdot k$;
\item
$(n\cdot m)\cdot k=n\cdot (m\cdot k)$;
    \end{compactenum}
  \end{Atheorem}

  \begin{remark}
As with addition, so with multiplication, one can prove by induction
    alone that it exists uniquely as described in
    \P\P\ref{def:mul}--\ref{thm:mul}.  However, the next
    theorem requires also
    Axioms~\ref{axiom}\eqref{part:not}--\eqref{part:inj}.  
  \end{remark}

  \begin{Atheorem}[Cancellation]
    For all $n$, $m$, and $k$ in $\N$, 
    \begin{compactenum}
      \item
if $n+k=m+k$, then $n=m$;
\item
if $n\cdot k=m\cdot k$, then $n=m$.
    \end{compactenum}
  \end{Atheorem}

  \begin{definition}[Exponentiation]
    For each $m$ in $\N$, the operation $x\mapsto m^x$ on $\N$ is the 
    function $g$ guaranteed by the Recursion Theorem when $A$ is $\N$ and
    $b$ is $m$ and $f$ is $x\mapsto x\cdot m$.  That is,
    \begin{align*}
      m^1&=m,\\
m^{n+1}&=m^n\cdot m.
    \end{align*}
  \end{definition}

  \begin{Atheorem}
    For all $n$, $m$, and $k$ in $\N$,
    \begin{compactenum}
\item
$n^{m+k}=n^m\cdot n^k$;
\item
$(n\cdot m)^k=n^k\cdot m^k$;
\item
$(n^m)^k=n^{m\cdot k}$.
    \end{compactenum}
  \end{Atheorem}

  \begin{remark}
    In contrast with addition and multiplication, exponentiation
    requires more than induction for its existence.
  \end{remark}

  \begin{definition}[Ordering]
If $n,m\in\N$, and $m+k=n$ for some $k$ in $\N$, then this situation
is denoted by
$m<n$.  
That is,
\begin{equation*}
  m< n\iff \exists x\;m+x=n.
\end{equation*}
If $m<n$, we say that
$m$ is a 
\textbf{predecessor}%
\index{predecessor}%
\index{number!predecessor}
of $n$.  If $m<n$ or $m=n$, we write
\begin{equation*}
m\leq n.
\end{equation*}
  \end{definition}

  \begin{Atheorem}
For all $n$, $m$, and $k$ in $\N$,
    \begin{compactenum}
 \item
$1\leq n$;
\item
$m\leq n$ if and only if $m+k\leq n+k$;
\item
$m\leq n$ if and only if $m\cdot k\leq n\cdot k$.     
    \end{compactenum}
  \end{Atheorem}

  \begin{lemma}\label{lem:<}
For all $m$ and $n$ in $\N$,
\begin{compactenum}
  \item
$m<n$ if and only if $m+1\leq n$;
\item\label{item:leq}
$m\leq n$ if and only if $m<n+1$.
\end{compactenum}
  \end{lemma}

  \begin{Atheorem}
        The binary relation $\leq$ is a 
\textbf{total ordering:}%
\index{total ordering}%
\index{ordering!total ---}
for all $n$, $m$, and $k$ in $\N$,
	\begin{compactenum}
	  \item
$n\leq n$;
\item
if $m\leq n$ and $n\leq m$, then $n=m$;
\item
if $k\leq m$ and $m\leq n$, then $k\leq n$;
\item
either $m\leq n$ or $n\leq m$.
	\end{compactenum}
  \end{Atheorem}

  \begin{Atheorem}[Strong Induction]
    Suppose $A\included\N$, and one condition is met, namely
    \begin{itemize}
      \item
if all predecessors of $n$ belong to $A$ (the 
\textbf{strong inductive hypothesis}),%
\index{strong inductive hypothesis}%
\index{inductive hypothesis!strong ---}
then $n\in A$.
    \end{itemize}
Then $A=\N$.
  \end{Atheorem}

  \begin{proof}
    Let $B$ comprise the natural numbers whose predecessors belong to
    $A$.  As~$1$ has no predecessors, they belong to $A$, so $1\in
    B$.  Suppose $n\in B$.  Then all predecessors of $n$ belong to
    $A$, so by assumption, $n\in A$.  Thus, by
    Lemma~\ref{lem:<}\eqref{item:leq}, all
    of the predecessors of $n+1$ belong to $A$, so $n+1\in B$.  By
    induction, $B=\N$.  In particular, if $n\in \N$, then $n+1\in B$,
    so $n$ (being a predecessor of $n+1$) belongs to $A$.  Thus
    $A=\N$. 
  \end{proof}

  \begin{remark}
    In general, strong induction is a proof-technique that can be used
    with some \emph{ordered} sets.  By contrast, ``ordinary''
    induction involves sets with first elements and
    successor-operations, but possibly without orderings.  Strong
    induction does not follow from ordinary induction alone; neither
    does ordinary induction follow from strong induction.
  \end{remark}

  \begin{Atheorem}\label{thm:wo}
    The set of natural numbers is 
\textbf{well ordered}%
\index{well ordered}%
\index{ordering!well ordered}
by $\leq$: that is,
    every non-empty subset of $\N$ has a least element with respect to
    $\leq$. 
  \end{Atheorem}
  
  \begin{proof}
    Use strong induction.  Suppose $A$ is a subset of $\N$ with no
    least element.  We shall show $A$ is empty, that is, $\N\setminus
    A=\N$.  Let $n\in\N$.  Then $n$ is not a least element of $A$.
    This means one of two things: either $n\notin A$, or else $n\in
    A$, but also $m\in A$ for some predecessor of $n$.  Equivalently,
    if no predecessor of $n$ is in $A$, then $n\notin A$.  In other
    words, if every predecessor of $n$ is in $\N\setminus A$, then
    $n\in\N\setminus A$.  By strong induction, we are done.
  \end{proof}

  \begin{remark}
    We have now shown, in effect, that if a total order $(A,\leq)$ admits
    proof by strong recursion, then it is well-ordered.  The converse
    is also true.
  \end{remark}

  \begin{Atheorem}[Recursion with Parameter]
    Suppose $A$ is a set with an element $b$, and $F\colon\N\times
    A\to A$.  Then there is a \emph{unique} function $G$ from $\N$ to
    $A$ such 
    that
    \begin{compactenum}
      \item
$G(1)=b$, and
\item
$G(n+1)=F(n,G(n))$ for all $n$ in $\N$.
    \end{compactenum}
  \end{Atheorem}

  \begin{proof}
 %   Adjust the proof of Theorem~\ref{thm:rec}.
Let $f\colon \N\times A\to\N\times A$,
where $f(n,x)=(n+1,F(n,x))$.  By recursion, there is a unique function
$g$ from
$\N$ to $\N\times A$ such that $g(1)=(1,b)$ and $g(n+1)=f(g(n))$.  By
induction, the first entry in $g(n)$ is always $n$.  The desired
function $G$ is given by $g(n)=(n,G(n))$.  Indeed, we now have
$G(1)=b$; also, $g(n+1)=f(n,G(n))=(n+1,F(n,G(n)))$, so
$G(n+1)=F(n,G(n))$.  By induction, $G$ is unique.
  \end{proof}

  \begin{remark}
    Recursion with Parameter allows us to define the set of
    predecessors of $n$ as $\pred n$, where $x\mapsto\pred x$ is the
    function $G$ guaranteed by the Theorem when $A$ is the set of
    subsets of $\N$, and $b$ is the empty set, and $F$ is
    $(x,Y)\mapsto\{x\}\cup Y$.  Then we can write $m<n$ if $m\in\pred
    n$ and prove the foregoing theorems about the ordering.
  \end{remark}

  \begin{definition}[Factorial]
    The operation $x\mapsto x!$ on $\N$ is the function $G$ guaranteed
    by the Theorem of Recursion with Parameter when $A$ is $\N$ and
    $b$ is $1$ and $F$ is $(x,y)\mapsto(x+1)\cdot y$.  That is,
    \begin{align*}
      1!&=1,\\
(n+1)!&=(n+1)\cdot n!
    \end{align*}
  \end{definition}


\chapter{Exercises}\label{ch:exercises}

In the following exercises, if a \emph{statement} is given that is not a
definition, then 
the exercise is to prove the statement.
Minuscule letters range over $\Z$, or sometimes just over $\N$; letters $p$, $p_i$, and $q$ range over the prime numbers.

Many of these exercises are inspired by exercises in \cite[Ch.~2]{Burton}.


%\section{Exercise set}

\begin{xca}
Prove the unproved propositions in
Appendix~\ref{ch:foundations}.
\end{xca}


%\section{Exercise set}
%set II

\begin{xca}
  An integer $n$ is a triangular number if and only if
  $8n+1$ is a square number.
\end{xca}

\begin{xca}\mbox{}
  \begin{compactenum}
    \item
If $n$ is triangular, then so is $9n+1$.
\item
Find infinitely many pairs $(k,\ell)$ such that, if $n$ is triangular,
then so is $kn+\ell$.
  \end{compactenum}
\end{xca}

\begin{xca}
  If $a=n(n+3)/2$, then $t_a+t_{n+1}=t_{a+1}$.
\end{xca}

\begin{xca}
  The 
\textbf{pentagonal numbers}%
\index{pentagonal number}%
\index{number!pentagonal ---}
are $1$, $5$, $12$, \dots: call these $p_1$,
  $p_2$, \&c.
  \begin{compactenum}
    \item
Give a recursive definition of these numbers.
\item
Find a closed expression for $p_n$ (that is, an expression not
involving $p_{n-1}$, $p_{n-2}$, \&c.). 
\item
Find such an expression involving triangular numbers and square numbers.
  \end{compactenum}
\end{xca}

\begin{xca}\mbox{}
  \begin{compactenum}
    \item
$7\divides2^{3n}+6$.
\item
Given $a$ in $\Z$ and $k$ in $\N$, find integers $b$ and $c$ such
that $b\divides a^{kn}+c$ for all $n$ in $\N$.
  \end{compactenum}
\end{xca}

\begin{xca}
$\gcd(a,a+1)=1$.
\end{xca}

\begin{xca}
$(k!)^n\divides(kn)!$ for all $k$ and $n$ in $\N$.
\end{xca}

\begin{xca}
If $a$ and $b$ are co-prime, and $a$ and $c$ are
  co-prime, then $a$ and $bc$ are co-prime.
\end{xca}

\begin{xca}
  Let $\gcd(204,391)=n$.  
  \begin{compactenum}
    \item
  Compute $n$.
\item
Find a solution of $204x+391y=n$.
  \end{compactenum}
\end{xca}

\begin{xca}
  Let $\gcd(a,b)=n$.
  \begin{compactenum}
    \item
If $k\divides\ell$ and $\ell\divides2k$, then
$\size{\ell}\in\{\size{k},\size{2k}\}$. 
\item
Show $\gcd(a+b,a-b)\in\{n,2n\}$.
\item
Find an example for each possibility.
\item
$\gcd(2a+3b,3a+4b)=n$.
\item
Solve $\gcd(ax+by,az+bw)=n$.
  \end{compactenum}
\end{xca}

\begin{xca}
  $\gcd(a,b)\divides\lcm(a,b)$. 
\end{xca}

\begin{xca}
  When are $\gcd(a,b)$ and $\lcm(a,b)$ the same?
\end{xca}

\begin{xca}
The binary operation $(x,y)\mapsto\gcd(x,y)$ on $\N$ is
  commutative and associative.
\end{xca}

\begin{xca}
  The co-prime relation on $\N$, namely
  \begin{equation*}
  \{(x,y)\in\N\times\N\colon\gcd(x,y)=1\}
  \end{equation*}
---is it reflexive?
  irreflexive? symmetric?  anti-symmetric?  transitive?
\end{xca}

\begin{xca}
  Give complete solutions, or show that they do not exist, for:
  \begin{compactenum}
    \item
$14x-56y=34$;
\item
$10x+11y=12$.
  \end{compactenum}
\end{xca}

\begin{xca}
  I have some 1-TL pieces and some 50- and 25-Kr pieces: 16 coins in
  all.  They make 6 TL.
  How many coins of each denomination have I got?
\end{xca}

%\section{Exercise Set}
% set III

%Henceforth $p$, $p_i$, and $q$ are always prime numbers.

  \begin{xca}
    $p\equiv\pm1\pmod6$ if $n>3$.
  \end{xca}

  \begin{xca}
    If $p\equiv1\pmod3$ then $p\equiv1\pmod6$.
  \end{xca}

  \begin{xca}
    If $n\equiv2\pmod3$, then $n$ has a factor $p$ such that
    $p\equiv2\pmod3$. 
  \end{xca}

  \begin{xca}
    Find all primes of the form $n^3-1$.
  \end{xca}

  \begin{xca}
    Find all $p$ such that $3p+1$ is square.
  \end{xca}

  \begin{xca}
    Find all $p$ such that $p^2+2$ is prime.
  \end{xca}

  \begin{xca}
    $n^4+4$ is composite unless $n=\pm1$.
  \end{xca}

  \begin{xca}
    If $n$ is positive, then $8^n+1$ is composite.
  \end{xca}

  \begin{xca}
    Find all integers $n$ such that the equation
    \begin{equation*}
      x^2=ny^2
    \end{equation*}
has only the zero solution.  Prove your findings.
  \end{xca}

  \begin{xca}
    If $p_0<\dotsb<p_n$, prove that the sum
    \begin{equation*}
      \frac1{p_0}+\dotsb+\frac1{p_n}
    \end{equation*}
is not an integer.
  \end{xca}

%\section{Exercise Set}

%set IV

  \begin{xca}
    Prove that the following are equivalent:
    \begin{compactenum}
      \item
Every even integer greater than $2$ is the sum of two primes.
\item
Every integer greater than $5$ is the sum of three primes.
    \end{compactenum}
  \end{xca}

  \begin{xca}
    Infinitely many primes are congruent to $-1$ \emph{modulo} $6$.
  \end{xca}

  \begin{xca}
    Find all $n$ such that
    \begin{compactenum}
      \item
$n!$ is square;
\item
$n!+(n+1)!+(n+2)!$ is square.
    \end{compactenum}
  \end{xca}

  \begin{xca}
    Determine whether $a^2\equiv b^2\pmod n\implies a\equiv b\pmod
    n$. 
  \end{xca}

  \begin{xca}
    Compute $\sum_{k=1}^{1001}k^{365}\pmod 5$.
  \end{xca}

  \begin{xca}
    $39\divides 53^{103}+103^{53}$.
  \end{xca}

  \begin{xca}
  Solve  $6^{n+2}+7^{2n+1}\equiv x\pmod{43}$.
  \end{xca}

  \begin{xca}
    Determine whether $a\equiv b\pmod n\implies c^a\equiv c^b\pmod
    n$. 
  \end{xca}

  \begin{xca}
    Determine $r$ such that $a\equiv b\pmod r$ whenever $a\equiv
    b\pmod m$ and $a\equiv b\pmod n$. 
  \end{xca}

  \begin{xca}
    Solve the system
    \begin{equation*}
      \begin{cases}
	x\equiv 1\pmod{17},\\
	x\equiv 8\pmod{19},\\
	x\equiv 16\pmod{21}.
      \end{cases}
    \end{equation*}
  \end{xca}

  \begin{xca}
    The system
    \begin{equation*}
    \begin{cases}
      x\equiv a\mod n\\
      x\equiv b\mod m
    \end{cases}
    \end{equation*}
has a solution if and only if $\gcd(n,m)\divides b-a$.
  \end{xca}

%\section{Exercise Set}

% set V


%As usual, $p$ and $q$ are primes.

  \begin{xca}
    The number $32\dsp 970\dsp 563$ is the product of two primes.  Find them.
  \end{xca}

  \begin{xca}
    Factorize $1\dsp 003\dsp 207$ (the product of two primes) knowing
    \begin{equation*}
      1\dsp 835^2\equiv598^2\pmod{1\dsp 003\dsp 207}.
    \end{equation*}
  \end{xca}

  \begin{xca}
    Compute $16{200}$ \emph{modulo} $19$.
  \end{xca}

  \begin{xca}
    If $p\neq q$, and $\gcd(a,pq)=1$, and
    $n=\lcm(p-1,q-1)$, show
    \begin{equation*}
    a^n\equiv1\pmod{pq}.
    \end{equation*}
  \end{xca}

  \begin{xca}
    Show $a^{13}\equiv a\pmod{70}$.
  \end{xca}

  \begin{xca}
    Assuming $\gcd(a,p)=1$, and $0\leq n<p$, solve the congruence
    \begin{equation*}
    a^nx\equiv b\pmod p.
    \end{equation*}
  \end{xca}

  \begin{xca}
    Solve $2^{14}x\equiv 3\pmod{23}$.
  \end{xca}

  \begin{xca}
    Show $\displaystyle\sum_{k=1}^{p-1}k^p\equiv0\pmod p$.
  \end{xca}

  \begin{xca}
    We can write the congruence $2^p\equiv2\pmod p$ as
    \begin{equation*}
      2^p-1\equiv 1\pmod p.
    \end{equation*}
Show that, if $n\divides 2^p-1$, then $n\equiv 1\pmod p$.
(\emph{Suggestion:}  Do this first if $n$ is a prime $q$.  Then
$2^{q-1}\equiv1\pmod q$.  If $q\not\equiv1\pmod p$, then $\gcd(p,q-1)=1$,
so $pa+(q-1)b=1$ for some $a$ and $b$.  Now look at
$2^{pa}\cdot2^{(q-1)b}$ \emph{modulo} $n$.)
  \end{xca}

  \begin{xca}
    Let $F_n=2^{2^n}+1$.  (Then $F_0,\dots,F_4$ are primes.)  Show 
    \begin{equation*}
      2^{F_n}\equiv2\pmod{F_n}.
    \end{equation*}
  \end{xca}

%\section{Exercise Set}

%set VI


%Henceforth the variables $n$, $k$, and $d$ range over $\N$.

  \begin{xca}
Assuming $p$ is an \emph{odd} prime:
    \begin{compactenum}
      \item
$(p-1)!\equiv p-1\pmod{1+2+\dotsb+(p-1)}$;
\item
$1\cdot3\dotsm(p-2)\equiv(-1)^{(p-1)/2}\cdot(p-1)\cdot(p-3)\dotsm2\pmod
  p$;
\item
$1\cdot3\dotsm(p-2)\equiv(-1)^{(p-1)/2}\cdot2\cdot4\dotsm(p-1)\pmod
  p$;
\item
$1^2\cdot 3^2\dotsm(p-2)^2\equiv(-1)^{(p+1)/2}\pmod p$. 
    \end{compactenum}
  \end{xca}

  \begin{xca}
$\tau(n)\leq2\sqrt n$.
  \end{xca}

  \begin{xca}
$\tau(n)$ is odd if and only if $n$ is square.
  \end{xca}

  \begin{xca}
    Assuming $n$ is odd: $\sigma(n)$ is odd if and only if $n$ is
    square. 
  \end{xca}

  \begin{xca}
    $\displaystyle\sum_{d\divides n}\frac 1d=\frac{\sigma(n)}n$.
  \end{xca}

  \begin{xca}
    $\{n\colon\tau(n)=k\}$ is infinite (when $k>1$), but
    $\{n\colon\sigma(n)=k\}$ is finite.
  \end{xca}

  \begin{xca}
Let $m\in\Z$.
    The number-theoretic function $n\mapsto n^m$ is multiplicative.
  \end{xca}

  \begin{xca}
    Let $\omega(n)$ be the number of \emph{distinct} prime divisors of
    $n$, and let $m$ be a non-zero integer.  Then $n\mapsto
    m^{\omega(n)}$ is multiplicative. 
  \end{xca}

  \begin{xca}
    Let $\Lambda(n)=
    \begin{cases}
      \log p,&\text{ if $n=p^m$ for some positive $m$};\\
     0,&\text{ otherwise.}
    \end{cases}$
     \begin{compactenum}
       \item
$\log n=\displaystyle\sum_{d\divides n}\Lambda(d)$.
\item
$\Lambda(n)=\displaystyle\sum_{d\divides n}\mu\Bigl(\frac nd\Bigr)\log
  d$.
\item
$\Lambda(n)=-\displaystyle\sum_{d\divides n}\mu(d)\log d$.
     \end{compactenum}
  \end{xca}

  \begin{xca}\label{ex:f-mult}
    Suppose $n=p_1{}^{k(1)}\dotsm p_r{}^{k(r)}$, where the $p_i$ are
    distinct. 
    \begin{compactenum}
      \item\label{item:f-mult}
If $f$ is multiplicative and non-zero, then $\displaystyle\sum_{d\divides
  n}\mu(d)\cdot f(d)=\prod_{i=1}^r(1-f(p_i))$;
\item
$\displaystyle\sum_{d\divides n}\mu(d)\cdot\tau(d)=(-1)^r$.
    \end{compactenum}
  \end{xca}

%\section{Exercise Set}

%set VII

  \begin{xca}
    $f(568)=f(638)$ when $f\in\{\tau,\sigma,\phi\}$.
  \end{xca}

  \begin{xca}
    Solve:
    \begin{compactenum}
      \item
$n=2\phi(n)$.
\item
$\phi(n)=\phi(2n)$.
\item
$\phi(n)=12$.  (Do this without a table.  There are 6 solutions.)
    \end{compactenum}
  \end{xca}

  \begin{xca}
    Find a sequence $(a_n\colon n\in\N)$ of positive integers such that
    \begin{equation*}
      \lim_{n\to\infty}\frac{\phi(a_n)}{a_n}=0.
    \end{equation*}
(If you assume that there \emph{is} an answer to this problem, then it
    is not hard to see what the answer must be.  To actually
    \emph{prove} that the answer is correct, recall that, formally,
    \begin{equation*}
      \sum_n\frac 1n=\prod_p\frac1{1-\frac1p},
    \end{equation*}
so $\displaystyle\lim_{n\to\infty}\prod_{k=1}^n\frac1{1-\frac1{p_k}}=\infty$ if
$(p_k\colon k\in\N)$ is the list of primes.)
  \end{xca}

  \begin{xca}
    \begin{compactenum}
      \item
Show $a^{100}\equiv1\pmod{1000}$ if $\gcd(a,1000)=1$.
\item
Find $n$ such that $n^{101}\not\equiv n\pmod{1000}$.
    \end{compactenum}
  \end{xca}

  \begin{xca}\label{ex:a13}
    \begin{compactenum}
      \item
Show $a^{24}\equiv1\pmod{35}$ if $\gcd(a,35)=1$.
\item\label{a13}
Show $a^{13}\equiv a\pmod{35}$ for all $a$.
\item
Is there $n$ such that $n^{25}\not\equiv n\pmod{35}$?
    \end{compactenum}
  \end{xca}

  \begin{xca}
    If $\gcd(m,n)=1$, show $m^{\phi(n)}\equiv n^{\phi(m)}\pmod{mn}$. 
  \end{xca}

  \begin{xca}
    If $n$ is odd, and is not a prime power, and if $\gcd(a,n)=1$,
    show $a^{\phi(n)/2}\equiv 1\pmod n$.  (This generalizes
    Exercise~\ref{ex:a13}\eqref{a13}.) 
  \end{xca}

  \begin{xca}
    Solve $5^{10000}x\equiv1\pmod{153}$.
  \end{xca}

  \begin{xca}
    Prove $\displaystyle\sum_{d\divides
    n}\mu(d)\phi(d)=\prod_{p\divides n}(2-p)$.  (This is a special
    case of Exercise~\ref{ex:f-mult}\eqref{item:f-mult}.)
  \end{xca}

  \begin{xca}
    If $n$ is 
\textbf{squarefree}%
\index{squarefree number}%
\index{number!squarefree ---}
(has no factor $p^2$), and $k\geq0$,
    show
    \begin{equation*}
      \sum_{d\divides n}\sigma(d^k)\phi(d)=n^{k+1}.
    \end{equation*}
  \end{xca}

  \begin{xca}
    $\displaystyle\sum_{d\divides n}\sigma(d)\phi\Bigl(\frac
    nd\Bigr)=n\tau(n)$. 
  \end{xca}

  \begin{xca}
    $\displaystyle\sum_{d\divides n}\tau(d)\phi\Bigl(\frac
    nd\Bigr)=\sigma(n)$. 
  \end{xca}

%\section{Exercise Set}

%set VIII

  \begin{xca}
    We have $(\pm3)^2\equiv2\pmod7$.  Compute the orders of $2$, $3$,
    and~$-3$, \emph{modulo} $7$.
  \end{xca}

  \begin{xca}
Suppose $\ord na=k$, and $b^2\equiv a\pmod n$.
\begin{compactenum}
  \item
Show that $\ord nb\in\{k,2k\}$.
\item
Find an example for each possibility of $\ord nb$.
\item
Find a condition on $k$ such that $\ord nb=2k$.
\end{compactenum}
  \end{xca}

  \begin{xca}
This is about $23$:
    \begin{compactenum}
      \item\label{part:a}
Find a primitive root of least absolute value.    
\item
How many primitive roots are there?
\item
Find these primitive roots as powers of the root found
in~\eqref{part:a}.
\item
Find these primitive roots as elements of $[-11,11]$.
    \end{compactenum}
  \end{xca}

  \begin{xca}
    Assuming $\ord pa=3$, show:
    \begin{compactenum}
      \item
$a^2+a+1\equiv0\pmod3$;
\item
$(a+1)^2\equiv a\pmod 3$;
\item
$\ord p{a+1}=6$.
    \end{compactenum}
  \end{xca}

  \begin{xca}
    Find all elements of $[-30,30]$ having order $4$
    \emph{modulo} $61$.
  \end{xca}

  \begin{xca}
$f(x)\equiv0\pmod n$ may have more than $\deg(f)$ solutions:
    \begin{compactenum}
      \item
Find four solutions to $x^2-1\equiv0\pmod{35}$.
\item
Find conditions on $a$ such that the congruence
$x^2-a^2\equiv0\pmod{35}$ has four distinct solutions, and find these
solutions.
\item
If $p$ and $q$ are odd primes, find conditions on $a$ such that the
congruence $x^2-a^2\equiv0\pmod{pq}$ has four distinct solutions, and
find these solutions.
    \end{compactenum}
  \end{xca}

  \begin{xca}
    If $\ord na=n-1$, then $n$ is prime.
  \end{xca}

  \begin{xca}
If $a>1$, show $n\divides\phi(a^n-1)$.
  \end{xca}

  \begin{xca}
If $2\ndivides p$ and $p\divides n^2+1$, show
    $p\equiv1\pmod4$. 
  \end{xca}

  \begin{xca}\mbox{}
    \begin{compactenum}
      \item
Find conditions on $p$ such that, if $r$ is a primitive root of $p$,
then so is $-r$.
\item
If $p$ does not meet these conditions, then what is $\ord p{-r}$?
    \end{compactenum}
  \end{xca}

%\section{Exercise Set}

%set IX


  \begin{xca}\label{IX.1}
For $(\Z/(17))^{\times}$:
    \begin{compactenum}
\item\label{IX.1(a)}
construct a table of logarithms using $5$ as the base; 
\item\label{IX.1(b)}
using this (or some other table, with a different base), solve:
\begin{compactenum}
  \item
$x^{15}\equiv14\pmod{17}$;
\item
$x^{4095}\equiv14\pmod{17}$;
\item
$x^4\equiv4\pmod{17}$;
\item
$11x^4\equiv7\pmod{17}$.
\end{compactenum}
    \end{compactenum}
  \end{xca}

  \begin{xca}
    If $n$ has primitive roots $r$ and $s$, and
    $\gcd(a,n)=1$, prove
    \begin{equation*}
      \log_sa\equiv\frac{\log_ra}{\log_rs}\pmod{\phi(n)}.
    \end{equation*}
  \end{xca}

  \begin{xca}
    In $(\Z/(337))^{\times}$, for any base, show 
    \begin{equation*}
    \log(-a)\equiv\log a+168\pmod{336}.
    \end{equation*}
  \end{xca}

  \begin{xca}
    Solve $4^x\equiv13\pmod{17}$.
  \end{xca}

  \begin{xca}
How many primitive roots has $22$?  Find them.
  \end{xca}

  \begin{xca}\label{IX.6}
    Find a primitive root of $1250$.
  \end{xca}

  \begin{xca}
    Define the function $\lambda$ by the rules
    \begin{align*}
\lambda(2^k)&=
\begin{cases}
  \phi(2^k),&\text{ if }0<k<3;\\
  \phi(2^k)/2,&\text{ if }k\geq3;
\end{cases}\\
%\lambda\Bigl(2^k\cdot\prod_{p\in A}p^{\ell(p)}\Bigr)
%&=\lcm(\{\lambda(2^k)\}\cup\{\phi(p^{\ell(p)})\colon p\in A\}),
\lambda(2^k\cdot p_1{}^{\ell(1)}\dotsm p_m{}^{\ell(m)})
&=\lcm(\phi(2^k),\phi(p_1{}^{\ell(1)}),\dotsc,\phi(p_m{}^{\ell(m)})).
    \end{align*}
where the $p_i$ are distinct odd primes.
\begin{compactenum}
  \item
Prove that, if $\gcd(a,n)=1$, then $a^{\lambda(n)}\equiv1\pmod n$.
\item
Using this, show that, if $n$ is not $2$ or $4$ or an odd prime power
or twice an odd prime power, then $n$ has no primitive root.
\end{compactenum}
  \end{xca}

  \begin{xca}\label{IX.8}
    Solve the following quadratic congruences.
    \begin{compactenum}
      \item
$8x^2+3x+12\equiv0\pmod{17}$;
\item
$14x^2+x-7\equiv0\pmod{29}$;
\item
$x^2-x-17\equiv0\pmod{23}$;
\item
$x^2-x+17\equiv0\pmod{23}$.
    \end{compactenum}
  \end{xca}

%\section{Exercise Set}

% set X


  \begin{xca}\label{X.1}
The Law of Quadratic Reciprocity makes it easy to compute many Legendre
symbols, but this law is not always needed.  Compute $(n/17)$ and
$(m/19)$ for as many $n$ in $\{1,2,\dots,16\}$ and $m$ in
$\{1,2,\dots,18\}$ as you can, 
using only that, whenever $p$ is an odd prime, and $a$ and $b$ are
prime to $p$, then:
\begin{itemize}
  \item
$a\equiv b\pmod p\implies(a/p)=(b/p)$;
\item
$(1/p)=1$;
\item
$(-1/p)=(-1)^{(p-1)/2}$\;;
\item
$(a^2/p)=1$;
\item
$(2/p)=
  \begin{cases}
    1,&\text{ if }p\equiv\pm1\pmod8;\\
   -1,&\text{ if }p\equiv\pm3\pmod8.
  \end{cases}$
\end{itemize}
  \end{xca}


  \begin{xca}\label{X.2}
    Compute all of the Legendre symbols $(n/17)$ and $(m/19)$ by means
    of Gauss's Lemma. 
  \end{xca}

  \begin{xca}
    Find all primes of the form $5\cdot 2^n+1$ that have $2$ as a
    primitive root.
  \end{xca}

  \begin{xca}
    For every prime $p$, show that there is an integer $n$ such that
    \begin{equation*}
      p\divides(3-n^2)(7-n^2)(21-n^2).
    \end{equation*}
  \end{xca}

  \begin{xca}\mbox{}
    \begin{compactenum}
      \item
If $a^n-1$ is prime, show that $a=2$ and $n$ is prime.
\item
Primes of the form $2^p-1$ are called 
\textbf{Mersenne primes.}%
\index{Mersenne!--- prime}%
\index{prime!Mersenne ---}
Examples are $3$, $7$, and $31$.
Show
that, if $p\equiv3\pmod4$, and $2p+1$ is a prime $q$, then
$q\divides2^p-1$, and therefore $2^p-1$ is not prime.  (\emph{Hint:}
Compute $(2/q)$.)
    \end{compactenum}
  \end{xca}


  \begin{xca}\label{X.6}
    Assuming $p$ is an odd prime, and $2p+1$ is a prime $q$, show that $-4$
    is a primitive root of $q$.  (\emph{Hint:}  Show $\ord
    q{-4}\notin\{1,2,p\}$.) 
  \end{xca}

%\section{Exercise Set}

% set XI


  \begin{xca}\label{XI.1}
    Compute the Legendre symbols $(91/167)$ and $(111/941)$.
  \end{xca}

  \begin{xca}
Find $(5/p)$ in terms of the class of $p$ \emph{modulo}
$5$.  
  \end{xca}

  \begin{xca}
    Find $(7/p)$ in terms of the class of $p$
    \emph{modulo} $28$.
  \end{xca}

  \begin{xca}
The $n$th 
\textbf{Fermat number,}%
\index{Fermat!--- number, --- prime} or $F_n$, is $2^{2^n}+1$.  A
\textbf{Fermat prime}%
\index{prime!Fermat ---}
 is a Fermat number that is prime.
\begin{compactenum}
  \item
Show that every prime number of the form $2^m+1$ is a Fermat prime.
\item
Show $4^k\equiv4\pmod{12}$ for all positive $k$.
\item
If $p$ is a Fermat prime, show $(3/p)=-1$.
\item
Show that $3$ is a primitive root of every Fermat prime.
\item
Find a prime $p$ less than $100$ such that $(3/p)=-1$, but $3$ is not
a primitive root of $p$.
\end{compactenum}
  \end{xca}

  \begin{xca}
    Solve the congruence $x^2\equiv11\pmod{35}$.
  \end{xca}

  \begin{xca}\label{XI.6}
We have so far defined the Legendre symbol $(a/p)$ only when
    $p\ndivides a$; but if $p\divides a$, then we can define $(a/p)=0$.
    We can now define $(a/n)$ for
    arbitrary $a$ and arbitrary \emph{odd} $n$: the result is the
    \textbf{Jacobi symbol,}%
\index{Jacobi symbol}
and
    the definition is
    \begin{equation*}
      \ls an=\prod_p\ls ap^{k(p)},\quad\text{ where }\quad
      n=\prod_pp^{k(p)}. 
    \end{equation*}
    \begin{compactenum}
      \item
Prove that the function $x\mapsto(x/n)$ on $\Z$ is 
\textbf{completely multiplicative}%
\index{multiplicative function!completely ---}%
\index{completely multiplicative function}%
\index{function!completely multiplicative ---}
in the sense that $(ab/n)=(a/n)\cdot(b/n)$ for all
  $a$ and $b$ (not necessarily co-prime).
\item
If $\gcd(a,n)=1$, and the congruence $x^2\equiv a\pmod n$ is soluble,
show $(a/n)=1$.
\item
Find an example where $(a/n)=1$, and $\gcd(a,n)=1$, but $x^2\equiv
a\pmod n$ is insoluble.
\item
If $m$ and $n$ are co-prime, show
\begin{equation*}
  \ls mn\cdot\ls nm=(-1)^k,\quad\text{ where }\quad
  k=\frac{m-1}2\cdot\frac{n-1}2. 
\end{equation*}
    \end{compactenum}
  \end{xca}


\chapter{Examinations}\label{ch:exams}

%\input{exams.tex}

\section{In-term examination}

% exam 1

The exam lasts 90 minutes.
All answers must be justified to the reader.

The set $\N$ of natural numbers is $\{0,1,2,\dots\}$. 
\begin{problem}
For all natural numbers $k$ and integers $n$, prove
\begin{equation*}
  k!\divides n\cdot(n+1)\dotsm(n+k-1).
\end{equation*}
\end{problem}

\begin{solution}
  \begin{equation*}
  \frac{n\cdot(n+1)\dotsm(n+k-1)}{k!}=
  \begin{cases}
    \displaystyle
\binom{n+k-1}k,&\text{ if }n>0;\\
0,&\text{ if }n\leq0<n+k;\\
(-1)^k\cdot\displaystyle
\binom{-n}k,&\text{ if }n+k\leq0.
  \end{cases}
  \end{equation*}
\end{solution}

\begin{remark*}
  Every binomial coefficient $\binom ji$ is an integer for the reason
  implied by its name:  it is one of the coefficients in the expansion
  of $(x+y)^j$.  (It is pretty obvious that those coefficients in this
  expansion must be integers, but one can prove it by induction on
  $j$.) 
\end{remark*}

\begin{remark*}
  In the set $\{n,n+1,\dots,n+k-1\}$, one of the elements is
  divisible by $k$, one by $k-1$, one by $k-2$, and so forth.  This
  observation is not enough to solve the problem, since for example,
  in the set $\{3,4,5\}$, one of the elements is divisible by $4$, one
  by $3$, and one by $2$, but $4!\ndivides 3\cdot 4\cdot 5$.
\end{remark*}

\begin{remark*}
  For similar reasons, proving the claim by induction is difficult.
  It is therefore not recommended.
  However, one way to proceed is as follows.  The claim is trivially true (for
  all~$n$) when $k=0$, since $0!=1$, which divides everything.  (When
  $k=0$, then the product $n\cdot(n+1)\dotsm(n+k-1)$ is the
  ``empty product,'' so it should be understood as the neutral element for
  multiplication, namely~$1$.)
  As a first inductive hypothesis, we suppose the claim is true (for
  all~$n$) when
  $k=\ell$.  We want to show 
  \begin{equation}\label{1}
    (\ell+1)!\divides n\cdot(n+1)\dotsm(n+\ell)
  \end{equation}
for all $n$.  We first prove it when $n\geq-\ell$ by
entering a second induction.
The relation~\eqref{1} is true when $n=-\ell$, since then
$n\cdot(n+1)\dotsm(n+\ell)=0$.
As a second inductive
hypothesis, we suppose the relation is true when $n=m$, so that
  \begin{equation}\label{2}
    (\ell+1)!\divides m\cdot(m+1)\dotsm(m+\ell).
  \end{equation}
By the first inductive hypothesis, we have
\begin{equation*}
  \ell!\divides(m+1)\dotsm(m+\ell).
\end{equation*}
Since also $\ell+1\divides m+\ell+1-m$, we have
\begin{equation*}
  (\ell+1)!\divides(m+1)\dotsm(m+\ell)(m+\ell+1-m).
\end{equation*}
Distributing, we have
\begin{equation*}
  (\ell+1)!\divides(m+1)\dotsm(m+\ell)(m+\ell+1)-m\cdot(m+1)\dotsm(m+\ell).
\end{equation*}
By the second inductive hypothesis,~\eqref{2}, we conclude
\begin{equation*}
  (\ell+1)!\divides(m+1)\dotsm(m+\ell)(m+\ell+1).
\end{equation*}
So the second induction is complete, and~\eqref{1} holds when
$n\geq-\ell$.  It therefore holds for all $n$, since
\begin{equation*}
  n\cdot(n+1)\dotsm(n+\ell)=(-1)^{\ell+1}(-n-\ell)\cdot(-n-\ell+1)\dotsm(-n). 
\end{equation*}
Hence the \emph{first} induction is now complete.
\end{remark*}

\begin{problem}
  Find the least natural number $x$ such that 
  \begin{equation*}
    \begin{cases}
  x\equiv1\pmod5,\\
  x\equiv3\pmod 6,\\
  x\equiv5\pmod7.
    \end{cases}
  \end{equation*}
\end{problem}

\begin{solution}
We have
\begin{align*}
  6\cdot 7&\equiv1\cdot 2\equiv 2\pmod 5,& 2\cdot 3\equiv 1\pmod 5;\\
  5\cdot 7&\equiv-1\cdot1\equiv-1\pmod 5,& -1\cdot 5\equiv 1\pmod 6;\\
  5\cdot 6&\equiv-1\cdot(-2)\equiv 2\pmod 7,& 2\cdot 4\equiv 1\pmod 7.
\end{align*}
Therefore, \emph{modulo} $5\cdot 6\cdot 7$ (which is $210$), we
conclude
\begin{align*}
  x
&\equiv 1\cdot 6\cdot7\cdot3+3\cdot5\cdot7\cdot5+5\cdot5\cdot6\cdot
  4\\
&\equiv126+525+600\\
&\equiv1251\\
&\equiv201.
\end{align*}
Therefore \fbox{$x=201$} (since $0\leq201<210$).
\end{solution}

\begin{remark*}
  Instead of solving the equations
  \begin{align*}
  2x_1&\equiv 1\pmod5,\\
-1x_2&\equiv1\pmod6,\\
2x_3&\equiv1\pmod7,
  \end{align*}
(getting $(x_1,x_2,x_3)=(3,5,4)$ as above,) one may solve
  \begin{align*}
  2y_1&\equiv 1\pmod5,\\
-1y_2&\equiv3\pmod6,\\
2y_3&\equiv5\pmod7,
  \end{align*}
getting $(y_1,y_2,y_3)=(3,3,6)$.  But then
\begin{equation*}
    x\equiv 
6\cdot7\cdot3+5\cdot7\cdot3+5\cdot6\cdot6
\end{equation*}
(that is, one doesn't use as coefficients the numbers $1$, $3$, and
$5$ respectively, because they are already incorporated in the $y_i$).
\end{remark*}

\begin{remark*}
  Some people noticed, in effect, that the original system is
  equivalent to
  \begin{equation*}
    \begin{cases}
  x+9\equiv10\equiv0\pmod5,\\
  x+9\equiv12\equiv0\pmod 6,\\
  x+9\equiv14\equiv0\pmod7,
    \end{cases}
  \end{equation*}
which in turn means $x+9\equiv0\pmod{210}$ and so yields the minimal
positive solution $x=201$.  But not every such problem will be so easy.
\end{remark*}

\begin{problem}
  Find all integers $n$ such that $n^4+4$ is prime.
\end{problem}

\begin{solution}
We can factorize as follows:
\begin{align*}
  n^4+4
&=n^4+4n^2+4-4n^2\\
&=(n^2+2)^2-(2n)^2\\
&=(n^2+2+2n)\cdot(n^2+2-2n)\\
&=((n+1)^2+1)\cdot((n-1)^2+1).
\end{align*} 
Both factors are positive.  Moreover, one of the factors is $1$ if and
only if $n=\pm1$.  So $n^4+4$ is prime \emph{only} if $n=\pm1$.
Moreover, if
$n=\pm1$, then $n^4+4=5$, which is prime.  So the answer is,
\fbox{$n=\pm1$.} 
\end{solution}

\begin{problem}
  \begin{compactenum}
\item\label{a}
Find a solution to the equation $151x+71y=1$.
\item\label{b}
Find integers $s$ and $t$ such that
\begin{equation*}
\gcd(a,b)=1\implies\gcd(151a+71b,sa+tb)=1.
\end{equation*}
  \end{compactenum}
\end{problem}

\begin{solution}
\eqref{a} We compute
      \begin{align*}
151&=71\cdot2+9,\\
71&=9\cdot7+8, \\
9&=8\cdot 1+1,
      \end{align*}
and hence
      \begin{align*}
9&=151-71\cdot2,\\
8&=71-(151-71\cdot2)\cdot7=-151\cdot 7+71\cdot15,\\
1&=151-71\cdot2-(-151\cdot 7+71\cdot15)=151\cdot8-71\cdot17.
      \end{align*}
Thus, \fbox{$(8,-17)$} is a solution to $151x+71y=1$.

\eqref{b}
We want $s$ and $t$ such that, if
$a$ and $b$ are co-prime, then so are $151a+71b$ and $sa+tb$.  It is
enough if we can obtain $a$ and $b$ as linear combinations of
$151a+71b$ and $sa+tb$.  That is, it is enough if we can solve
\begin{equation*}
  (151a+71b)x+(sa+tb)y=a
\end{equation*}
and (independently) $(151a+71b)x+(sa+tb)y=b$.  The first equation can
be rearranged as
\begin{equation*}
  (151x+sy)a+(71x+ty)b=a,
\end{equation*}
which is soluble if and only if the linear system
\begin{equation*}
  \left\{
  \begin{aligned}
    151x+sy&=1,\\
    71x+ty&=0
  \end{aligned}
\right.
\end{equation*}
is soluble.  Similarly, we want to be able to solve
\begin{equation*}
  \left\{
  \begin{aligned}
    151x+sy&=0,\\
    71x+ty&=1.
  \end{aligned}
\right.
\end{equation*}
It is enough if the coefficient matrix 
$\begin{pmatrix}
  151&s\\
71&t
\end{pmatrix}$ is invertible \emph{over the integers;} this means
\begin{equation*}
\pm1=  \det\begin{pmatrix}
  151&s\\
71&t
\end{pmatrix}=151t-71s
\end{equation*}
(since $\pm1$ are the only invertible integers).  A solution to this
equation is \fbox{$(17,8)$.}
\end{solution}

\begin{remark*}
  Another method for \eqref{a} is to solve
  \begin{gather*}
    151x\equiv1\pmod{71},\\
9x\equiv1\pmod{71},\\
x\equiv8\pmod{71},
  \end{gather*}
and then solve
\begin{gather*}
  151\cdot8+71y=1,\\
y=\frac{-1207}{71}=-17.
\end{gather*}
But finding inverses may not always be so easy as finding the inverse
of $9$ \emph{modulo} $71$.
\end{remark*}

\begin{problem}
Find the least positive $x$ such that
\begin{equation*}
19^{365}x\equiv2007\pmod{17}.
\end{equation*}
\end{problem}

\begin{solution}
  By applying the elementary-school division algorithm as necessary
  [computations omitted here], we find
  \begin{gather*}
19\equiv2\pmod{17},\\
    365\equiv13\pmod{16},\\
2007\equiv1\pmod{17},
  \end{gather*}
which means our problem is equivalent to solving
\begin{gather*}
  2^{13}x\equiv1\pmod{17},\\
  x\equiv2^3\pmod{17},\\
  x\equiv8\pmod{17};
\end{gather*}
so \fbox{$x=8$} (since $0<8\leq17$).
\end{solution}

\begin{remark*}
  Some people failed to use that $2^{16}\equiv1\pmod{17}$ by Fermat's
  Little Theorem.  Of these, some happened to notice an alternative
  simplification: $2^4\equiv-1\pmod{17}$; but a simplification along
  these lines, unlike the Fermat Theorem, may not always be available.
\end{remark*}

\begin{problem}
Prove $a^{13}\equiv a\pmod{210}$ for all $a$.  
\end{problem}

\begin{solution}
  We have the prime factorization $210=2\cdot 3\cdot5\cdot7$, along
  with the following implications:
  \begin{itemize}
\item
If $2\ndivides a$, then $a\equiv1\pmod2$, and hence
$a^{12}\equiv1\pmod2$;
\item
if $3\ndivides a$,  then $a^2\equiv1\pmod3$, and hence
$a^{12}\equiv1\pmod3$;
\item
if $5\ndivides a$, then $a^4\equiv1\pmod2$, and hence $a^{12}\equiv1\pmod5$;
\item
if $7\ndivides a$, then $a^6\equiv1\pmod2$, and hence $a^{12}\equiv1\pmod7$.
  \end{itemize}
This means that, for all $a$, we have
\begin{gather*}
  a^{13}\equiv a\pmod 2,\\
  a^{13}\equiv a\pmod 3,\\
  a^{13}\equiv a\pmod 5,\\
  a^{13}\equiv a\pmod 7.
\end{gather*}
Therefore $a^{13}\equiv a\pmod{210}$ for all $a$, since
$210=\lcm(2,3,5,7)$. 
\end{solution}

\begin{remark*}
  One should be clear about the restrictions on $a$, if any.  The
  argument here assumes that the reader is familiar with the equivalence
  between the two forms of Fermat's Theorem:
  \begin{compactenum}
    \item
$a^{p-1}\equiv1\pmod p$ when $p\ndivides a$;
\item
$a^p\equiv p\pmod p$ for all $a$.
  \end{compactenum}
\end{remark*}

\begin{problem}
On $\N$, we define the binary relation $\leq$ so that $a\leq b$ if and
only if the equation $a+x=b$ is soluble.  Prove the following for all
natural numbers $a$, $b$, and $c$.  You may use the ``Peano Axioms''
and the standard facts about addition and multiplication that follow
from them.
\begin{compactenum}
  \item
$0\leq a$.
\item
$a\leq b\iff a+c\leq b+c$.
\item
$a\leq b\iff a\cdot(c+1)\leq b\cdot (c+1)$.
\end{compactenum}
\end{problem}

\begin{solution}
  (a)  $0+a=a$.

(b)  By the definition of $\leq$, and the standard cancellation
  properties for addition, we have
  \begin{align*}
    a\leq b&\iff a+d=b\text{ for some }d\\
&\iff a+c+d=b+c\text{ for some }d\\
&\iff a+c\leq b+c.
  \end{align*}

(c)  We use induction on $a$.  By part (a), the claim is trivial when
  $a=0$.  Suppose it is true when $a=d$; we shall prove it is true
  when $a=d+1$.  Note that, if $d+1\leq b$, then $d+e+1=b$ for some
  $e$, so $b$ is a successor: $b=e+1$ for some $e$; in particular,
  $b\neq0$.  Similarly, if 
  $(d+1)\cdot(c+1)\leq b\cdot(c+1)$, then $b\neq0$, so $b$ is a
  successor.  So it is enough now to observe:
  \begin{align*}
    d+1\leq e+1&\iff d\leq e&&\text{[by (b)]}\\
&\iff d\cdot(c+1)\leq e\cdot(c+1)&&\text{[by I.H.]}\\
&\iff d\cdot(c+1)+c+1\leq e\cdot(c+1)+c+1&&\text{[by (b)]}\\
&\iff (d+1)\cdot(c+1)\leq (e+1)\cdot(c+1).
  \end{align*}
This completes the induction.
\end{solution}

\begin{remark*}
   In (c), one may proceed as in (b):
   \begin{align*}
     a\leq b
&\implies a+d=b\text{ for some }d\\
&\implies a\cdot(c+1)+d\cdot(c+1)=b\cdot(c+1)\\
&\implies a\cdot(c+1)\leq b\cdot(c+1).
   \end{align*}
Conversely, if $a\cdot(c+1)\leq b\cdot(c+1)$, then
$a\cdot(c+1)+d=b\cdot(c+1)$ for some $d$; but then $d$ must be a
multiple of $c+1$ (although this is not proved in my notes on
``Foundations of number-theory,'' which are the source of this
problem).  So we have
\begin{gather*}
  a\cdot(c+1)+e\cdot(c+1)=b\cdot(c+1),\\
(a+e)\cdot(c+1)=b\cdot(c+1),\\
a+e=b,\\
a\leq b
\end{gather*}
by the standard cancellation properties of multiplication.
\end{remark*}

\section{In-term examination}

% exam 2

The exam lasts 90 minutes.
Answers must be justified.  Solutions should follow a reasonably
efficient procedure.

\begin{problem}
  We define exponentiation on $\N$ recursively by $n^0=1$ and
  $n^{m+1}=n^m\cdot n$.  Prove that $n^{m+k}=n^m\cdot n^k$ for all
  $n$, $m$, and $k$ in $\N$.
\end{problem}

\begin{solution}
Use induction on $k$.  For the base step, that is, $k=0$, we have
\begin{equation*}
  n^{m+0}=n^m=n^m\cdot1=n^m\cdot n^0.
\end{equation*}
So the claim holds when $k=0$.
For the inductive step, suppose, as an inductive hypothesis, that the
claim holds when $k=\ell$, so that
\begin{equation*}
n^{m+\ell}=n^m\cdot n^{\ell}.  
\end{equation*}
Then
\begin{align*}
  n^{m+(\ell+1)}
&=n^{(m+\ell)+1}&&\\
&=n^{m+\ell}\cdot n&&\text{[by def'n of exponentiation]}\\
&=(n^m\cdot n^{\ell})\cdot n&&\text{[by inductive hypothesis]}\\
&=n^m\cdot(n^{\ell}\cdot n)&&\\
&=n^m\cdot n^{\ell+1}&&\text{[by def'n of exponentiation].}
\end{align*}
Thus the claim holds when $k=\ell+1$.  This completes the induction
and the proof.
\end{solution}

\begin{remark*}
  Some people apparently forgot that, by the convention of this
  course, the first element of $\N$ is $0$, so that the induction here
  must start with the case $k=0$.  This convention can be inferred
  from the statement of the problem, since the given recursive definition of
  exponentiation starts with $n^0$, not $n^1$.
\end{remark*}

\begin{remark*}
The formal recursive definition of exponentiation
is intended to be make precise the informal definition
\begin{equation*}
  n^m=\underbrace{n\cdot n\dotsm n}_m.
\end{equation*}
Likewise, mathematical induction makes precise the informal proof
\begin{equation*}
  n^{m+k}=\underbrace{n\cdot n\dotsm n}_{m+k}
=\underbrace{n\cdot n\dotsm n}_m\cdot\underbrace{n\cdot n\dotsm n}_k=
n^m\cdot n^k.
\end{equation*}
Everybody knows $n^{m+k}=n^m\cdot n^k$; the point of the problem is to
prove it precisely, so the informal proof is not enough.
\end{remark*}

\begin{problem}
  Find some $n$ such that $35\cdot\phi(n)\leq 8n$.
\end{problem}

\begin{solution}
  We want $\displaystyle\frac{\phi(n)}n\leq\frac8{35}$.  We have
  \begin{equation*}
    \frac{\phi(n)}n=\prod_{p\divides n}\frac{p-1}p.
  \end{equation*}
If we take enough primes, this product should get down to $8/35$.  As
$35=5\cdot7$, we might try the primes up to $7$.  Indeed,
\begin{equation*}
  \frac
  12\cdot\frac23\cdot\frac45\cdot\frac67=\frac{2\cdot4}{5\cdot7}=\frac8{35};
\end{equation*}
so we may let \fbox{$n=2\cdot3\cdot5\cdot7=210$.}
\end{solution}


\begin{problem}
  Suppose $f$ and $g$ are multiplicative functions on
  $\N\smallsetminus\{0\}$.  Define~$h$ and $H$ by $h(n)=f(n)\cdot g(n)$ and
  $H(n)=\displaystyle\sum_{d\divides n}f(d)\cdot g\Bigl(\displaystyle\frac nd\Bigr)$.  Prove that these are
  multiplicative. 
\end{problem}

\begin{solution}
  Suppose $\gcd(m,n)=1$.  Then
  \begin{align*}
    h(mn)
&=f(mn)\cdot g(mn)&&\\
&=f(m)\cdot f(n)\cdot g(m)\cdot g(n)&&\text{[by multiplicativity of $f$ and $g$]}\\
&=f(m)\cdot g(m)\cdot f(n)\cdot g(n)&&\\
&=h(m)\cdot h(n),
  \end{align*}
so $h$ is multiplicative.  Also, since every divisor of $mn$ can be
factorized \emph{uniquely} as $d\cdot e$, where $d\divides m$ and
$e\divides n$, we have
\begin{align*}
  H(mn)
&=\sum_{d\divides mn}f(d)\cdot g\Bigl(\frac{mn}d\Bigr)&&\\
&=\sum_{d\divides m}\sum_{e\divides
    n}f(de)\cdot g\Bigl(\frac{mn}{de}\Bigr)&&\\
&=\sum_{d\divides m}\sum_{e\divides
    n}f(d)\cdot f(e)\cdot g\Bigl(\frac{m}{d}\Bigr)\cdot 
  g\Bigl(\frac{n}{e}\Bigr)&&\text{[mult.~of $f$, $g$]}\\
&=\sum_{d\divides m}f(d)\cdot \Bigl(\frac{m}{d}\Bigr)\cdot \sum_{e\divides
    n}f(e)\cdot g\Bigl(\frac{m}{d}\Bigr)\cdot 
  g\Bigl(\frac{n}{e}\Bigr)&&\text{[distributivity]}\\
&=\biggl(\sum_{d\divides m}f(d)\cdot \Bigl(\frac{m}{d}\Bigr)\biggr)\cdot \sum_{e\divides
    n}f(e)\cdot g\Bigl(\frac{m}{d}\Bigr)\cdot 
  g\Bigl(\frac{n}{e}\Bigr)&&\text{[distributivity]}\\
&=H(m)\cdot H(n),
\end{align*}
so $H$ is multiplicative.
\end{solution}

\begin{remark*}
  The assumption that $\gcd(m,n)=1$ is essential here, because
  otherwise we could not conclude, for example, $f(mn)=f(m)\cdot
  f(n)$; neither could we do the trick with the divisors of $mn$.
\end{remark*}

\begin{remark*}
  Since $f$ is multiplicative, we know for example that
  $\sum_{d\divides n}f(d)$ is a multiplicative function of $n$.  Hence
  $\sum_{d\divides n}f(n/d)$ is also multiplicative, since it is the
  same function.  Likewise, once we know that $fg$ is multiplicative,
  then we know that $\sum_{d\divides n}f(d)g(d)$ is multiplicative.
  But we \emph{cannot} conclude so easily that  $\sum_{d\divides
  n}f(d)g(n/d)$ is multiplicative.  It
  does not make sense to say
  $g(n/d)$ is multiplicative, since it has two variables.  We do not
  have $g(mn/d)=g(m/d)\cdot g(n/d)$; neither do we have
  $g(n/de)=g(n/d)\cdot g(n/e)$.  What we have is
  $g(mn/de)=g(m/d)g(n/e)$, if $d\divides m$ and $e\divides n$; but it
  takes some work to make use of this.
\end{remark*}

\begin{problem}
  Concerning $13$:
  \begin{compactenum}
\setlength{\itemsep}{0pt}
\setlength{\parsep}{0pt}
\setlength{\parskip}{0pt}
\setlength{\topsep}{0pt}
    \item
Show that $2$ is a primitive root.
\item
Find all primitive roots as powers of $2$.
\item
Find all primitive roots as elements of $[1,12]$.
\item
Find all elements of $[1,12]$ that have order $4$ \emph{modulo} $13$.
  \end{compactenum}
\end{problem}

\begin{solution}
  (a) \emph{Modulo} $13$, we have 
  \begin{equation*}
  \begin{array}{*{13}{|r}|}\hline
k  &1&2&3&4&5& 6& 7&8&9&10&11&12\\\hline
2^k&2&4&8&3&6&12&11&9&5&10& 7&1\\\hline
    \end{array}
  \end{equation*}

(b) $2^k$, where $\gcd(k,12)=1$; so \fbox{$2$, $2^5$, $2^7$,
    $2^{11}$.}

(c) From the table, \fbox{$2$, $6$, $11$, $7$.}

(d) $2^k$, where $4=12/\gcd(k,12)$, that is, $\gcd(k,12)=3$, so $k$ is
  $3$ or~$9$; so, again from the table, \fbox{$8$, $5$.}
\end{solution}

\begin{problem}[4 points]
  Prove $\displaystyle\sum_{d\divides
  n}\mu(d)\cdot\sigma(d)=\prod_{p\divides n}(-p)$. 
\end{problem}

\begin{solution}
  Each side of the equation is a multiplicative function of $n$, so it
  is enough to check the claim when $n$ is a prime power.
  Accordingly, we have 
  \begin{multline*}
    \sum_{d\divides
  p^s}\mu(d)\cdot\sigma(d)=\sum_{k=0}^s\mu(p^k)\cdot\sigma(p^k)=\\
    =\mu(1)\cdot\sigma(1)+\mu(p)\cdot\sigma(p)=1-(1+p)=-p=\prod_{q\divides p^s}(-q).  
  \end{multline*}
This establishes the claim when $n$ is a prime power, hence for all $n$.
\end{solution}

\begin{remark*}
  It should be understood in the product $\prod_{p\divides n}(-p)$
  that $p$ is prime.  This product is a multiplicative function of
  $n$, because if $\gcd(m,n)=1$, and $p\divides mn$, then $p\divides
  m$ or $p\divides n$, but not both, so that $\prod_{p\divides
  mn}(-p)=\prod_{p\divides m}(-p)\cdot\prod_{p\divides n}(-p)$.
\end{remark*}

\begin{remark*}
  Using multiplicativity of functions to prove their equality is a
  powerful technique.  It works like magic.  It is possible here to
  prove the desired 
  equation directly, for arbitrary $n$; but the proof is long and
  complicated.
It is not enough to write out part of the summation, detect a pattern,
  and claim (as some people did) that everything cancels but what is
  wanted: one must
  \emph{prove} this claim precisely.  One way is as follows.
Every positive integer $n$ can be written as $\prod_{p\in
  A}p^{s(p)}$,  
  where $A$ is a (finite) set of prime numbers, and each exponent
  $s(p)$ is at least $1$.  (Note the streamlined method of writing a
  product.)  Then the only divisors $d$ of
  $n$ for which $\mu(d)\neq0$ are those divisors of the form $\prod_{p\in B}p$
  for some subset $B$ of $A$.  Moreover, each such number \emph{is} a divisor
  of $n$.  Hence
  \begin{align*}
    \sum_{d\divides n}\mu(d)\cdot\sigma(d)
&=\sum_{X\included A}\mu\Bigl(\prod_{p\in
      X}p\Bigr)\cdot\sigma\Bigl(\prod_{p\in X}p\Bigr)\\
&=\sum_{X\included A}(-1)^{\size X}\cdot\prod_{p\in X}(1+p)\\
&=\sum_{X\included A}(-1)^{\size X}\cdot\sum_{Y\included X}\prod_{p\in
      Y}p\\
&=\sum_{Y\included A}\prod_{p\in Y}p\cdot\sum_{Y\included X\included
      A}(-1)^{\size X}\\
&=\sum_{Y\included A}\prod_{p\in Y}p\cdot(-1)^{\size
      Y}\cdot\sum_{Z\included A\setminus Y}(-1)^{\size Z}\\
&=\sum_{Y\included A}\prod_{p\in Y}p\cdot(-1)^{\size
      Y}\cdot\sum_{j=0}^{\size{A\setminus Y}}\binom{\size{A\setminus
	Y}}j(-1)^j\\ 
&=\sum_{Y\included A}\prod_{p\in Y}p\cdot(-1)^{\size
      Y}\cdot(1+(-1))^{\size{A\setminus Y}}\\
&=\prod_{p\in A}p\cdot(-1)^{\size A}\\
&=\prod_{p\in A}(-p).
  \end{align*}
This proves the desired equation; but it is probably easier just to
use the multiplicativity of each side, as above.
\end{remark*}

\begin{problem}
  Solve $6^{3164}x\equiv2\pmod{365}$.
\end{problem}

\begin{solution}
  $365=5\cdot73$, so $\phi(365)=\phi(5)\cdot\phi(73)=4\cdot72=288$.
  And $288$ goes into $3164$ ten times, with remainder $284$.
  Therefore, \emph{modulo} $365$, we have
  \begin{align*}
    6^{3164}x\equiv2&\iff 6^{284}x\equiv2\\
&\iff
    \begin{aligned}[t]
      x&\equiv2\cdot6^4\\
&\equiv2\cdot36^2\\
&\equiv2\cdot1296\\
&\equiv2\cdot201\\
&\equiv402\\
&\equiv37.
    \end{aligned}
  \end{align*}
\end{solution}

\begin{remark*}
  One may note that, since $4\divides 72$, we have that
  $a^{72}\equiv1\pmod{365}$ whenever $\gcd(a,365)=1$.  Such an
  observation might make computations easier in some problems, though
  perhaps not in this one.
\end{remark*}

\begin{problem}
  Show that the least positive primitive root of $41$ is $6$.  (Try to
  compute as few powers as possible.) 
\end{problem}

\begin{solution}
  $\phi(41)=40=2^3\cdot5=8\cdot5$, so the proper divisors of
  $\phi(41)$ are divisors of $8$ or $20$.  So we want to show,
  \emph{modulo} $41$,
  \begin{compactenum}
    \item
when $\ell\in\{2,3,4,5\}$, then either $\ell^8$ or $\ell^{20}$ is
congruent to $1$;
\item
neither $6^8$ nor $6^{20}$ is congruent to $1$.
  \end{compactenum}
To establish that $\ell^{2k}\equiv1$, it is enough to show
$\ell^k\equiv\pm1$. 
To establish that $\ell^{2k}\not\equiv1$, it is enough to show
$\ell^k\not\equiv\pm1$.  So we proceed:
\begin{compactenum}
  \item
$2^2\equiv4$; $2^4\equiv4^2\equiv16$;
    $2^8\equiv16^2\equiv256\equiv10$;
    $2^{10}\equiv2^8\cdot2^2\equiv10\cdot4\equiv40\equiv-1$. 
\item
$3^2\equiv9$; $3^4\equiv9^2\equiv81\equiv-1$.
\item
$4^5\equiv2^{10}\equiv-1$.
\item
$5^2\equiv25\equiv-16$;
  $5^4\equiv16^2\equiv256\equiv10\equiv2^8\equiv4^4$; hence
  $5^{20}\equiv4^{20}\equiv1$;
\item
$6^2\equiv36\equiv-5$; $6^4\equiv25\equiv-16$; $6^8\equiv256\equiv10$;
  $6^{10}\equiv10\cdot(-5)\equiv-50\equiv-9$; $6^{20}\equiv81\equiv-1$.
\end{compactenum}
\end{solution}

\begin{remark*}
  Another possible method is first to write out all of the powers of
  $6$ (\emph{modulo} $41$), thus
  showing that $6$ is a primitive root, and then to select from
  among these the other primitive roots of $41$, write them as
  positive numbers, and note that $6$ is
  the least.  That is, one can start with
  \begin{equation*}
    \begin{array}{*{11}{|r}|}\hline
k  &  1& 2&  3&  4&  5&  6&  7&  8&  9&10\\\hline
6^k&  6&-5& 11&-16&-14& -2&-12& 10& 19&-9\\\hline\hline
k  & 11&12& 13& 14& 15& 16& 17& 18& 19&20\\\hline
6^k&-13& 4&-17&-20&  3& 18&-15& -8& -7&-1\\\hline\hline
k  & 21&22& 23& 24& 25& 26& 27& 28& 29&30\\\hline
6^k& -6& 5&-11& 16& 14&  2& 12&-10&-19& 9\\\hline\hline
k  & 31&32& 33& 34& 35& 36& 37& 38& 39&40\\\hline
6^k& 13&-4& 17& 20& -3&-18& 15&  8&  7& 1\\\hline      
\end{array}
  \end{equation*}
Then $6$ is indeed a primitive root of $41$, so every primitive root
of $41$ takes the form $2^k$, where $\gcd(k,40)=1$.  So the incongruent
primitive roots are $2^k$, where
\begin{equation*}
k\in\{1,3,7,9,11,13,17,19,21,23,27,29,31,33,37,39\}
\end{equation*}
(that is, $k$
is an odd positive integer less than $40$ and indivisible by $5$).
From the table, if we convert these powers to congruent positive
integers less than $41$, we get the list
\begin{equation*}
  6,11,29,19,28,24,26,34,35,30,12,22,13,17,15,7
\end{equation*}
The least number on the list is $6$.
\end{remark*}

\begin{remark*}
  Some people noted that $6$ is the least element of the set
  $\{6^k\colon0<k\leq40\land\gcd(k,40)=1\}$.  This is true, but it
  does not establish the claim that $6$ is the least positive
  primitive root of $41$, since some of the powers in the set may be
  congruent \emph{modulo} $41$ to lesser positive numbers, which
  numbers will still be primitive roots.
\end{remark*}

\section{In-term examination}

% exam 3

The exam lasts 90 minutes.  
Several connected problems involve the prime number~$23$.
As usual, answers must be reasonably justified to the reader.  


Bracketed numbers (as [\ref{XI.1}]) 
refer to related homework exercises.

\begin{problem}\label{prob:Legendre}
Compute the Legendre symbol $\ls{63}{271}$.\hw{\ref{XI.1}}
\end{problem}

\begin{solution}
  $\ls{63}{271}
  =\ls{7\cdot3^2}{271}=\ls7{271}=-\ls{271}7=-\ls57=-\ls75=-\ls25=-(-1)=1$.   
\end{solution}

\begin{remark*}
  The computation uses the following features of the Legendre symbol:
  \begin{compactenum}
\item
the complete multiplicativity of $x\mapsto(x/p)$;
\item
that $(a/p)=\pm1$;
    \item
the Law of Quadratic Reciprocity;
\item
the dependence of $(a/p)$ only on the class of $a$ \emph{modulo} $p$;
\item
the rule for $(2/p)$.
  \end{compactenum}
%The Jacobi symbol $(-a/p)$ is not always equal to $-(a/p)$.
If $(p/q)=-(q/p)$ by the Law of Quadratic
Reciprocity, then also $-(q/p)=(-1/p)(q/p)=(-q/p)$, since
$p\equiv3\pmod4$.  So one could also argue
$(63/271)=(7\cdot 3^2/271)=(7/271)=-(271/7)=(-271/7)=(2/7)=1$. 

However, the equation $(63/271)=-(271/63)$
is not available without explanation and proof.  Because $63$ is not prime,
$(271/63)$ is not a Legendre symbol.  
It is a Jacobi symbol, but these were defined only in [\ref{XI.6}].
\end{remark*}

\begin{problem}[3 points]
  Find the Legendre symbol $(a/29)$, given that\hw{\ref{X.2}}
  \begin{equation*}
  \Bigl\{ka-29\cdot\left[\displaystyle\frac{ka}{29}\right]\colon 1\leq
  k\leq14\Bigr\}= \{1,2,5,6,7,10,11,12,15,16,20,21,25,26\}.
  \end{equation*}
\end{problem}

\begin{solution}
The given set has $6$ elements greater than $29/2$.
  Since $ka-29\cdot[ka/29]$ is the remainder of $ka$ after division by
  $29$, by Gauss's Lemma we have
  $(a/29)=(-a)^6=1$. 
\end{solution}

\begin{problem}[3 points]
  The numbers $1499$ and $2999$ are prime.  Find
  a primitive root of $2999$.\hw{\ref{X.6}}
\end{problem}

\begin{solution}
Since $2999=2\cdot1499+1$, it has the primitive root
$(-1)^{(1499-1)/2}\cdot 2$, that is,~$-2$.% [by a theorem proved in class].  
\end{solution}

\begin{remark*}
  The number $1499$ is a Germain prime.  If $p$ is a Germain prime, so
  that $2p+1$ is a prime $q$, then the number of (congruence classes 
  of) primitive roots of $q$ is $\phi(\phi(q))$, which is $p-1$ or
  $(q-3)/2$.  So \emph{almost} half the numbers that are prime to $q$
  are primitive roots of $q$.  We showed $(-1)^{(p-1)/2}\cdot2$ is a
  primitive root; the cited homework exercise shows $-4$ is a
  primitive root.
By the same method of proof, if $q\ndivides r$, then the following are
  equivalent:
  \begin{compactenum}
    \item
$r$ is a primitive root of $q$;
\item
$\ord qr\not\in\{1,2,p\}$;
\item
$r\not\equiv\pm1\pmod q$ and $(r/q)=1$.
  \end{compactenum}
In particular, to show $r$ is a primitive root of $q$, it is not
enough to show $(r/q)=1$.  (One must also show $r^2\neq1\pmod q$; and
again, this is enough only in case $(q-1)/2$ is prime.)
\end{remark*}

\begin{problem}[4 points]\label{prob:logs}
Fill out the following table of logarithms.  (It should be clear what
method you used.) \hw{\ref{IX.1}\eqref{IX.1(a)}}
%\renewcommand{\arraystretch}{1.6}
\begin{equation*}
  \begin{array}{|c*{11}{|p{0.4cm}}|l|}\hline
    k&$1$&$2$&$3$&$4$&$5$&$6$&$7$&$8$&$9$&$10$&$11$&
    (\operatorname{mod} 23)\\\hline 
 \log_5k&&&&&&&&&&&&(\operatorname{mod} 22)\\\hline
 \log_5(-k)&&&&&&&&&&&&(\operatorname{mod} 22)\\\hline
  \end{array}
\end{equation*}
\end{problem}

\begin{solution}
  First compute powers of $5$, then rearrange:
%\renewcommand{\arraystretch}{1.3}
\begin{gather*}
  \begin{array}{|c*{11}{|r}|l|}\hline
    \ell&0&1&2&3&4&5&6&7&8&9&10&
    (\operatorname{mod} 22)\\\hline 
    5^{\ell}&1&5&2&10&4&-3&8&-6&-7&11&9&(\operatorname{mod} 23)\\\hline
    5^{\ell+11}&-1&-5&-2&-10&-4&3&-8&6&7&-11&-9&(\operatorname{mod}
    23)\\\hline 
  \end{array}\\
  \begin{array}{|c*{11}{|r}|l|}\hline
         k & 1& 2& 3& 4& 5& 6& 7& 8& 9&10&11&(\operatorname{mod} 23)\\\hline 
 \log_5  k & 0& 2&16& 4& 1&18&19& 6&10& 3& 9&(\operatorname{mod} 22)\\\hline
 \log_5(-k)&11&13& 5&15&12& 7& 8&17&21&14&20&(\operatorname{mod} 22)\\\hline
  \end{array}
\end{gather*}
\end{solution}

\begin{remark*}
  Implicitly, $5$ must be a primitive root of $23$, which implies
  $5^{11}\equiv-1\pmod{23}$.  Hence $\log_5(-1)\equiv11\pmod{22}$, and more
  generally $\log_5(-k)\equiv\log_5 k\pm11\pmod{22}$.  Thus the second
  row of the table can be obtained easily from the first.
\end{remark*}

\begin{problem}[3 points]\label{prob:L-table}
%\renewcommand{\arraystretch}{2}
  Fill out the following table of Legendre symbols.  (Again, your
  method should be clear.)
  \begin{equation*}
    \begin{array}{|c*{11}{|p{0.5cm}}|}\hline
      a&$1$&$2$&$3$&$4$&$5$&$6$&$7$&$8$&$9$&$10$&$11$\\\hline
\ls{a}{23}&&&&&&&&&&&\\\hline
\ls{-a}{23}&&&&&&&&&&&\\\hline
    \end{array}
  \end{equation*}
\end{problem}

\begin{solution}
  The quadratic residues of $23$ are just the even powers of a
  primitive root, such as $5$.  Those even powers are just the numbers
  whose logarithms are even.  So, in the logarithm table in
  Problem~\ref{prob:logs}, we can replace even numbers with $1$, and
  odd numbers with 
  $-1$, obtaining
%\renewcommand{\arraystretch}{2}
  \begin{equation*}
    \begin{array}{|c*{11}{|r}|}\hline
      a&1&2&3&4&5&6&7&8&9&10&11\\\hline
\ls{a}{23}&
        1&1&1&1&-1&1&-1&1&1&-1&-1\\\hline
\ls{-a}{23}&
        -1&-1&-1&-1&1&-1&1&-1&-1&1&1\\\hline
    \end{array}
  \end{equation*}
\end{solution}

\begin{remark*}
One can find the Legendre symbols by means of Euler's Criterion and
the properties in the remark on Problem~\ref{prob:Legendre} (as in
[\ref{X.1}]), or by Gauss's Lemma (as in [\ref{X.2}]); but
really, all of the necessary work has already been done in
Problem~\ref{prob:logs}.   
\end{remark*}

\begin{problem}[7 points]
Solve the following congruences \emph{modulo} $23$.\hw{\ref{IX.1}\eqref{IX.1(b)}}
\begin{multicols}{2}
\begin{compactenum}
  \item
$x^2\equiv 8$
\item
$x^{369}\equiv7$
\end{compactenum}
\end{multicols}
\end{problem}

\begin{solution}
(a)  From the solution to Problem~\ref{prob:logs}, we have
  $8\equiv5^6\equiv(5^3)^2\equiv10^2$, so
  \begin{equation*}
    x^2\equiv 8\iff \text{\fbox{$x\equiv\pm10\equiv10,13$}}.
  \end{equation*}
  \begin{minipage}[t]{10cm}
  (b)  From the computation at the right, as well as
  Problem~\ref{prob:logs}, we have
\begin{align*}
  x^{369}\equiv7\pmod{23}
&\iff x^{17}\equiv7\pmod{23}\\
&\iff 17\log_5x\equiv 19\pmod{22}\\
&\iff\log_5x\equiv\frac{19}{17}\equiv\frac{-3}{-5}\equiv\frac35\pmod{22}\\
&\iff\log_5x\equiv
  3\cdot 9\equiv27\equiv5\pmod{22}\\
&\iff x\equiv 5^5\equiv-3\pmod{23}\\
&\iff\text{\fbox{$x\equiv20$}}\pmod{23}
\end{align*}
  \end{minipage}
\hfill
%  Code from TUGboat Vol. 18 (1997), No. 2 
\newdimen\digitwidth
\settowidth\digitwidth{0}
\def~{\hspace{\digitwidth}}
\def\divrule#1#2{%
   \noalign{\moveright#1\digitwidth%
   \vbox{\hrule width#2\digitwidth}}}
22\,
\begin{tabular}[b]{@{}r@{}}
   16\\\hline
\big)
\begin{tabular}[t]{@{}l@{}}
  369\\
  22\\\divrule02
  149\\
  132\\\divrule03
  ~17
\end{tabular}
\end{tabular}
\end{solution}

\begin{remark*}
Some people seemed to overlook the information available from
  Problem~\ref{prob:logs}. 
  In part (a), one may note from Problem~\ref{prob:L-table} that there
  must be a solution, since $(8/23)=1$; but there is no need to do
  this, if one actually \emph{finds} the solutions.
\end{remark*}

\begin{problem}[3 points]
Solve the congruence $x^2-x+5\equiv0\pmod{23}$.    \hw{\ref{IX.8}}
\end{problem}

\begin{solution}
  Complete the square:
  \begin{align*}
    x^2-x+5\equiv0
&\iff x^2-x+\frac14\equiv\frac14-5\equiv\frac{-19}4\equiv1\\
&\iff\Bigl(x-\frac12\Bigr)^2\equiv1\\
&\iff x-\frac12\equiv\pm 1\\
&\iff x\equiv\frac12\pm1\equiv12\pm1\equiv\text{\fbox{$11,13$}}\pmod{23}.
  \end{align*}
\end{solution}

\begin{remark*}
  Although fractions with denominators prime to $23$ are permissible
  here, one may avoid them thus:
  \begin{align*}
    x^2-x+5\equiv0
&\iff x^2+22x+5\equiv0\\
&\iff x^2+22x+121\equiv 121-5\equiv 116\equiv1\\
&\iff (x+11)^2\equiv1\\
&\iff x+11\equiv\pm1.
  \end{align*}
Alternatively, one may apply the identity
\begin{equation*}
  4a(ax^2+bx+c)=(2ax+b)^2-(b^2-4ac),
\end{equation*}
finding in the present case
\begin{align*}
  x^2-x+5\equiv0
&\iff 4x^2-4x+20\equiv0\\
&\iff(2x-1)^2\equiv1-20\equiv-19\equiv4.  
\end{align*}
All approaches used to far can be used on any quadratic congruence
(with odd prime modulus).  Nonetheless, many people chose to look for
a factorization.  Here are some that were found:
\begin{gather*}
  x^2-x+5\equiv x^2-x-110\equiv(x-11)(x+10);\\
  x^2-x+5\equiv x^2-x+143\equiv(x-11)(x-13);\\
  \begin{aligned}
    &x^2-x+5\equiv0\\
&\iff-22x^2+22x-18\equiv0\\
&\iff-11x^2+11x-9\equiv0\\
&\iff12x^2-12x+14\equiv0\\
&\iff6x^2-6x+7\equiv0\\
&\iff6x^2+17x+7\equiv0\\
&\iff(3x+7)(2x+1)\equiv0;
  \end{aligned}\qquad\qquad
  \begin{aligned}
    &x^2-x+5\equiv0\\
&\iff-22x^2+22x-18\equiv0\\
&\iff-11x^2+11x-9\equiv0\\
&\iff12x^2+11x-9\equiv0\\
&\iff12x^2-12x-9\equiv0\\
&\iff4x^2-4x-3\equiv0\\
&\iff(2x-3)(2x+1)\equiv0;
  \end{aligned}\\
  \begin{aligned}
    &x^2-x+5\equiv0\\
&\iff24x^2+22x+28\equiv0\\
&\iff12x^2+11x+14\equiv0\\
&\iff12x^2+34x+14\equiv0\\
&\iff(4x+2)(3x+7)\equiv0;
  \end{aligned}\qquad\qquad
  \begin{aligned}
    &x^2-x+5\equiv0\\
&\iff24x^2+22x+5\equiv0\\
&\iff(12x+5)(2x+1)\equiv0.
  \end{aligned}
\end{gather*}
But for such problems, it does not seem advisable to rely on one's
ingenuity to find factorizations.  How would one best solve a congruence
like $x^2-2987+2243\equiv0\pmod{2999}$?
\end{remark*}

\begin{problem}[4 points]
Explain briefly why exactly one element $n$ of the set $\{2661,2662\}$
has a primitive root.  Give two numbers such that at
least one of them is a primitive root of $n$.\hw{\ref{IX.6}}
\end{problem}

\begin{solution}
  The numbers with primitive roots are just $2$, $4$, odd prime
  powers, and doubles of odd prime powers.  Since $2661=3\cdot887$,
  and $3\ndivides887$, the number $2661$ has no primitive root.  However,
  $2662=2\cdot1331=3\cdot11\cdot121=2\cdot 11^3$, so this has a
  primitive root.

By the computation
\begin{align*}
  \begin{array}{|c *{5}{|r}|c|}\hline
  k&1&2& 3& 4& 5&(\operatorname{mod}10)\\\hline
2^k&2&4&-3&-6&-1&(\operatorname{mod}11)\\\hline
  \end{array}
\end{align*}
we have that $2$ is a primitive root of $11$.  Therefore $2$ or $2+11$
is a primitive root of $121$.  Therefore $2+121$ or $2+11$ is a primitive
root of $121$, hence of $1331$, hence of $2662$.
\end{solution}

\begin{remark*}
  This problem relies on the following propositions about odd primes
  $p$: 
  \begin{compactenum}
    \item
if $r$ is a primitive root of $p$, then $r$ or $r+p$ is a primitive
root of $p^2$;
\item
every primitive root of $p^2$ is a primitive root of every higher
power $p^{2+k}$;
\item
every \emph{odd} primitive root of $p^{\ell}$ is a primitive root of
$2\cdot p^{\ell}$.
  \end{compactenum}
One must also observe that being a primitive root is a property of the
\emph{congruence class} of a number, so if $r\equiv s\pmod n$, and $r$
is a primitive root of $p$, then so is~$s$.  
\end{remark*}

\section{Final Examination}

You may take 120 minutes.  
Several connected problems involve the Fermat prime~$257$.
As usual, answers must be reasonably justified.  


A table of powers of $3$ \emph{modulo} $257$ was provided
for use in several problems [see Figure~\ref{fig:257}].
\begin{sidewaysfigure}
\centering
$\setlength{\arraycolsep}{2pt}
  \begin{array}{|c||*{16}{r|}}\hline
     k &1&2&3&4&5&6&7&8&9&10&11&12&13&14&15&16\\\hline\hline
 3^k &3&9&27&81&-14&-42&-126&-121&-106&-61&74&-35&-105&-58&83&-8\\\hline
 3^{16+k} &-24&-72&41&123&112&79&-20&-60&77&-26&-78&23&69&-50&107&64\\\hline
 3^{32+k} &-65&62&-71&44&-125&-118&-97&-34&-102&-49&110&73&-38&-114&-85&2\\\hline
 3^{48+k} &6&18&54&-95&-28&-84&5&15&45&-122&-109&-70&47&-116&-91&-16\\\hline
 3^{64+k} &-48&113&82&-11&-33&-99&-40&-120&-103&-52&101&46&-119&-100&-43&128\\\hline
 3^{80+k} &127&124&115&88&7&21&63&-68&53&-98&-37&-111&-76&29&87&4\\\hline
 3^{96+k} &12&36&108&67&-56&89&10&30&90&13&39&117&94&25&75&-32\\\hline
 3^{112+k} &-96&-31&-93&-22&-66&59&-80&17&51&-104&-55&92&19&57&-86&-1\\\hline
  \end{array}$
\caption{}\label{fig:257}
\end{sidewaysfigure}


\begin{problem}
  For positive integers $n$, let $\omega(n)=\size{\{p\colon
  p\divides n\}}$, the number
  of primes dividing~$n$.
  \begin{compactenum}
    \item
Show that the function $n\mapsto2^{\omega(n)}$ is multiplicative.
\item
Define the M\"obius function $\mu$ in terms of $\omega$.
\item
Show $\displaystyle\sum_{d\divides n}\size{\mu(d)}=2^{\omega(n)}$ for
all positive integers $n$.
  \end{compactenum}
\end{problem}
Powers of $3$ \emph{modulo} $257$:

\begin{solution}
  \begin{compactenum}
    \item
If $\gcd(m,n)=1$, then $\omega(mn)=\omega(m)+\omega(n)$, so
\begin{equation*}
2^{\omega(mn)}=2^{\omega(m)+\omega(n)}=2^{\omega(m)}\cdot
2^{\omega(n)}.
\end{equation*}
\item
$\mu(n)=
  \begin{cases}
    0,&\text{ if $p^2\divides n$ for some $p$;}\\
(-1)^{\omega(n)},&\text{ otherwise.}
  \end{cases}$
\item
As $\mu$ is multiplicative, so are $\size{\mu}$ and
$n\mapsto\sum_{d\divides n}\size{\mu(d)}$.  Hence it is enough to
establish the equation when $n$ is a prime power.  We have
\begin{equation*}
  \sum_{d\divides p^s}\size{\mu(d)}=\sum_{k=0}^s\size{\mu(p^k)}
=\size{\mu(1)}+\size{\mu(p)}=1+1=2=2^1=2^{\omega(p^s)}.
\end{equation*}
  \end{compactenum}
\end{solution}

  \begin{problem}
    Fill out the following table of Legendre symbols:
    \begin{equation*}
      \begin{array}{|c*{9}{|r}|}\hline
	a&1&2&3&5&7&11&13&17&19\\\hline
\left(\displaystyle\frac a{257}\right)&&&&&&&&&\\\hline
      \end{array}
    \end{equation*}
  \end{problem}

  \begin{solution}
By the table of powers, $3$ must be a primitive root of $257$.  Hence
$(a/257)=1$ if and only if $a$ is an even power of $3$ \emph{modulo}
$257$.  In particular, $(-1/257)=1$, so $(a/257)=(-a/257)$.  So the
table of powers yields the answers:
\begin{equation*}
      \begin{array}{|c*{9}{|r}|}\hline
	a&1&2&3&5&7&11&13&17&19\\\hline
\left(\displaystyle\frac a{257}\right)&1&1&-1&-1&-1&1&1&1&-1\\\hline
      \end{array}
    \end{equation*}    
  \end{solution}

  \begin{remark*}
    Many people preferred to find these Legendre symbols by means of
    the Law of Quadratic Reciprocity.  Possibly this method is faster than
    hunting for numbers in the table of powers; but it may also provide
    more opportunity for error.
  \end{remark*}

  \begin{problem}
In the following table, in the box below each number $a$, write the
least positive integer $n$ such that $\ord{257}n=a$. 
\begin{equation*}
  \begin{array}{*{9}{|r}|}\hline
    1&2&4&8&16&32&64&128&256\\\hline
     & & & &  &  &  &   &    \\\hline
  \end{array}
\end{equation*}
  \end{problem}

  \begin{solution}
    If $r$ is a primitive root of $257$, then
    $\ord{257}{r^{256/a}}=a$.  The primitive roots of $257$ are $3^s$,
    where $s$ is odd.  So below $a$ we want the least $n$ such that
    $n\equiv3^{(256/a)\cdot s}$ for some odd $s$. 
    (In searching the table of powers, since $3^{k+128}\equiv-3^k$, we can
    ignore signs, except when $a\leq2$.  For example, when $a=4$, then
    $3^{(256/a)\cdot s}=3^{64s}$, so $n$ can only be $\size{3^{64}}$.
    When $a=32$, then $3^{(256/a)\cdot s}=3^{8s}$, so $n$ will be the
    absolute value of an entry in the column of powers that is headed
    by $8$.) 
\begin{equation*}
  \begin{array}{*{9}{|r}|}\hline
    1&  2& 4&8&16&32&64&128&256\\\hline
    1&256&16&4& 2&15&11&  9&  3\\\hline
  \end{array}
\end{equation*}
  \end{solution}

  \begin{remark*}
Another way to approach the problem is to note that
\begin{equation*}
    \ord{257}{3^k}=\frac{256}{\gcd(256,k)}.
\end{equation*}
Then one must look among those powers $3^k$ such that
$\gcd(256,k)=256/a$.  \emph{Some} explanation is necessary, though it
need not be so elaborate as what I gave above.

    Some people apparently misread the problem as asking for the
    orders of the given numbers.  Others provided numbers that had the
    desired orders; but they weren't the \emph{least positive} such numbers.
  \end{remark*}

  \begin{problem}
    Solve $x^2+36x+229\equiv0\pmod{257}$.
  \end{problem}

  \begin{solution}
Complete the square:
    $(36/2)^2=(2\cdot 9)^2=4\cdot 81=324$, and $324-229=95$, so (using
    the table of powers)
    \begin{align*}
      x^2+36x+229\equiv0
&\iff(x+18)^2\equiv95\equiv3^{128+52}\equiv3^{180}\equiv(3^{90})^2\\
&\iff x+18\equiv\pm3^{90}\equiv\mp98\\
&\iff x\equiv-116,80\\
&\iff x\equiv 141,80\pmod{257}.
    \end{align*}
  \end{solution}

  \begin{remark*}
    There were a few unsuccessful attempts to factorize the polynomial
    directly.  See my remark on Problem 7 of Exam 3.
  \end{remark*}

  \begin{problem}
    Solve $197^x\equiv137\pmod{257}$.
  \end{problem}

  \begin{solution}
From the table of powers of $3$, we can obtain logarithms:
    \begin{align*}
      197^x\equiv137\pmod{257}
&\iff(-60)^x\equiv-120\pmod{257}\\
&\iff x\log_3(-60)\equiv\log_3(-120)\pmod{256}\\
&\iff x\cdot24\equiv72\pmod{256}\\
&\iff x\cdot8\equiv24\pmod{256}\\
&\iff x\equiv3\pmod{32}\\
&\iff x\equiv 3,35,67,99,131,163,195,227\pmod{256}.
    \end{align*}
  \end{solution}

  \begin{remark*}
    A number of people overlooked the change of modulus when passing
    from $x\cdot 8\equiv24$ to $x\equiv 3$.  One need not use
    logarithms explicitly; one can observe instead
    $197\equiv-60\equiv3^{24}$ and
    $137\equiv-120\equiv3^{72}\pmod{256}$, so that
    \begin{align*}
      197^x\equiv137\pmod{257}
&\iff3^{24x}\equiv3^{72}\pmod{257}\\      
&\iff24x\equiv72\pmod{256},
    \end{align*}
and then proceed as above.
  \end{remark*}

\begin{problem}
Solve $127x+55y=4$.
\end{problem}

\begin{solution}
  Use the Euclidean algorithm:
  \begin{equation*}
    \begin{aligned}[t]
      127&=55\cdot2+17,\\
       55&=17\cdot3+4,\\
       17&= 4\cdot 4+1,
    \end{aligned}\qquad
    \begin{aligned}[t]
      17&=127-55\cdot 2,\\
 4&=55-(127-55\cdot2)\cdot3=55\cdot7-127\cdot3,\\
1&=17-4\cdot4=127-55\cdot2-(55\cdot7-127\cdot3)\cdot4\\
&=127\cdot13-55\cdot30.
    \end{aligned}
  \end{equation*}
Hence $4=127\cdot52-55\cdot 120$, and $\gcd(127,55)=1$, so the
original equation has the general 
solution 
\begin{equation*}
(52,-120)+(55,-127)\cdot t.
\end{equation*}
\end{solution}

\begin{remark*}
Some people omitted
  to find the general solution.
  In carrying out the Euclidean algorithm here, one can save a step,
  as some people did, by
  noting that, once we find $4=55\cdot 7-127\cdot3$, we need not find
  $1$ as a linear combination of $127$ and $55$; we can pass
  immediately to the general solution $(7,-3)+(55,-127)\cdot t$.
\end{remark*}

\begin{problem}
  Solve $x^2\equiv59\pmod{85}$.
\end{problem}

\begin{solution}
Since $85=5\cdot 17$, we first solve $x^2\equiv59$ \emph{modulo} $5$
and $17$ separately:
\begin{equation*}
  \begin{aligned}[t]
 &   x^2\equiv59\pmod5\\
&\iff x^2\equiv4\pmod5\\
&\iff x\equiv\pm2\pmod5;
  \end{aligned}\qquad
  \begin{aligned}[t]
& x^2\equiv59\pmod{17}\\
&\iff x^2\equiv8\pmod{17}\\
&\iff x^2\equiv25\pmod{17}\\
&\iff x\equiv\pm5\pmod{17}.
  \end{aligned}
\end{equation*}
Now there are four systems to solve:
\begin{gather*}
  \left.
\begin{aligned}
    x&\equiv\pm2\pmod5\\
x&\equiv\pm5\pmod{17}
  \end{aligned}
\right\}
\iff x\equiv\pm22\pmod{85},\\
\left.
\begin{aligned}
    x&\equiv\pm2\pmod5\\
x&\equiv\mp5\pmod{17}  
\end{aligned}
\right\}
\iff x\equiv\pm12\pmod{85}.
\end{gather*}
(I solved these by trial.)
So the original congruence is solved by
\begin{equation*}
  x\equiv\pm22,\pm12\pmod{85},
\end{equation*}
or $x\equiv12,22,63,73\pmod{85}$.
\end{solution}

\begin{remark*}
  One may, as some people did, use the algorithm associated with the
  Chinese Remainder Theorem here.  Even if we do not use the
  algorithm, we rely on it to know that the solution we find to each
  pair of congruences is the \emph{only} solution.  Some used a
  theoretical formation of the solution, noting for example that 
$\left\{\begin{aligned}
    x&\equiv2\pmod5\\
x&\equiv5\pmod{17}
  \end{aligned}
\right\}$ has the solution $x\equiv2\cdot17^{\phi(5)}+5\cdot
5^{\phi(17)}\pmod{85}$; but this is not \emph{useful} (the number is
not between $0$ and $85$, or between $-85/2$ and $85/2$).
\end{remark*}



%\backmatter

%\bibliographystyle{plain}
%\bibliography{../../../../TeX/references}

\def\cprime{$'$} \def\cprime{$'$}
\begin{thebibliography}{10}

\bibitem{MR1618209}
V.~I. Arnol{\cprime}d.
\newblock On the teaching of mathematics.
\newblock {\em Uspekhi Mat. Nauk}, 53(1(319)):229--234, 1998.

\bibitem{Burton}
David~M. Burton.
\newblock {\em Elementary Number Theory}.
\newblock McGraw-Hill, Boston, sixth edition, 2007.

\bibitem{MR0159773}
Richard Dedekind.
\newblock {\em Essays on the theory of numbers. {I}: {C}ontinuity and
  irrational numbers. {II}: {T}he nature and meaning of numbers}.
\newblock authorized translation by Wooster Woodruff Beman. Dover Publications
  Inc., New York, 1963.

\bibitem{MR17:814b}
Euclid.
\newblock {\em The thirteen books of {E}uclid's {E}lements translated from the
  text of {H}eiberg. {V}ol. {I}: {I}ntroduction and {B}ooks {I}, {I}{I}. {V}ol.
  {I}{I}: {B}ooks {I}{I}{I}--{I}{X}. {V}ol. {I}{I}{I}: {B}ooks
  {X}--{X}{I}{I}{I} and {A}ppendix}.
\newblock Dover Publications Inc., New York, 1956.
\newblock Translated with introduction and commentary by Thomas L. Heath, 2nd
  ed.

\bibitem{MR1932864}
Euclid.
\newblock {\em Euclid's {E}lements}.
\newblock Green Lion Press, Santa Fe, NM, 2002.
\newblock All thirteen books complete in one volume, the Thomas L. Heath
  translation, edited by Dana Densmore.

\bibitem{MR2135478}
Graham Everest and Thomas Ward.
\newblock {\em An introduction to number theory}, volume 232 of {\em Graduate
  Texts in Mathematics}.
\newblock Springer-Verlag London Ltd., London, 2005.

\bibitem{Gauss}
Carl~Friedrich Gauss.
\newblock {\em Disquisitiones Arithmeticae}.
\newblock Springer-Verlag, New York, 1986.
\newblock Translated into English by Arthur A. Clarke, revised by William C.
  Waterhouse.

\bibitem{GPY}
D.~A. Goldston, J.~Pintz, and C.~Y. Y{\i}ld{\i}r{\i}m.
\newblock \url{http://arxiv.org}, 2005.
\newblock arXiv:math/0508185v1 [math.NT].

\bibitem{Green--Tao}
Ben Green and Terence Tao.
\newblock The primes contain arbitrarily long arithmetic progressions.
\newblock \url{http://arxiv.org}, 2004.
\newblock arXiv:math/0404188v6 [math.NT].

\bibitem{Nicomachus}
Nicomachus of~Gerasa.
\newblock {\em Introduction to Arithmetic}, volume XVI of {\em University of
  Michigan Studies, Humanistic Series}.
\newblock University of Michigan Press, Ann Arbor, 1938.
\newblock First printing, 1926.

\bibitem{Peano}
Giuseppe Peano.
\newblock The principles of arithmetic, presented by a new method (1889).
\newblock In Jean van Heijenoort, editor, {\em From {F}rege to {G}{\"o}del},
  pages 83--97. Harvard University Press, 1976.

\bibitem{MR2038833}
Lucio Russo.
\newblock {\em The forgotten revolution}.
\newblock Springer-Verlag, Berlin, 2004.
\newblock How science was born in 300 BC and why it had to be reborn,
  Translated from the 1996 Italian original by Silvio Levy.

\bibitem{MR0209111}
Jean van Heijenoort.
\newblock {\em From {F}rege to {G}\"odel. {A} source book in mathematical
  logic, 1879--1931}.
\newblock Harvard University Press, Cambridge, Mass., 1967.

\end{thebibliography}


\printindex

%\layout



\end{document}